OpenVPN
options.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2026 OpenVPN Inc <sales@openvpn.net>
9 * Copyright (C) 2008-2026 David Sommerseth <dazo@eurephia.org>
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2
13 * as published by the Free Software Foundation.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <https://www.gnu.org/licenses/>.
22 */
23
24/*
25 * 2004-01-28: Added Socks5 proxy support
26 * (Christof Meerwald, https://cmeerw.org)
27 */
28
29#ifdef HAVE_CONFIG_H
30#include "config.h"
31#endif
32#ifdef HAVE_CONFIG_VERSION_H
33#include "config-version.h"
34#endif
35
36#include "syshead.h"
37
38#include "buffer.h"
39#include "error.h"
40#include "common.h"
41#include "run_command.h"
42#include "shaper.h"
43#include "crypto.h"
44#include "ssl.h"
45#include "ssl_ncp.h"
46#include "options.h"
47#include "misc.h"
48#include "socket_util.h"
49#include "packet_id.h"
50#include "pkcs11.h"
51#include "win32.h"
52#include "push.h"
53#include "pool.h"
54#include "proto.h"
55#include "helper.h"
56#include "manage.h"
57#include "forward.h"
58#include "ssl_verify.h"
59#include "platform.h"
60#include "xkey_common.h"
61#include "dco.h"
62#include "options_util.h"
63#include "tun_afunix.h"
64#include "domain_helper.h"
65#include "mbuf.h"
66
67#include <ctype.h>
68
69#include "memdbg.h"
70#include "options_util.h"
71
72const char title_string[] = PACKAGE_STRING
73#ifdef CONFIGURE_GIT_REVISION
74 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS "]"
75#endif
76 " " TARGET_ALIAS
77#if defined(ENABLE_CRYPTO_MBEDTLS)
78 " [SSL (mbed TLS)]"
79#elif defined(ENABLE_CRYPTO_OPENSSL)
80 " [SSL (OpenSSL)]"
81#else
82 " [SSL]"
83#endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
84#ifdef USE_COMP
85#ifdef ENABLE_LZO
86 " [LZO]"
87#endif
88#ifdef ENABLE_LZ4
89 " [LZ4]"
90#endif
91#ifdef ENABLE_COMP_STUB
92 " [COMP_STUB]"
93#endif
94#endif /* USE_COMP */
95#if EPOLL
96 " [EPOLL]"
97#endif
98#ifdef PRODUCT_TAP_DEBUG
99 " [TAPDBG]"
100#endif
101#ifdef ENABLE_PKCS11
102 " [PKCS11]"
103#endif
104#if ENABLE_IP_PKTINFO
105#if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
106 " [MH/PKTINFO]"
107#elif defined(IP_RECVDSTADDR)
108 " [MH/RECVDA]"
109#endif
110#endif
111 " [AEAD]"
112#ifdef ENABLE_DCO
113 " [DCO]"
114#endif
115#ifdef CONFIGURE_GIT_REVISION
116 " built on " __DATE__
117#endif
118 ;
119
120#ifndef ENABLE_SMALL
121
122static const char usage_message[] =
123 "%s\n"
124 "\n"
125 "General Options:\n"
126 "--config file : Read configuration options from file.\n"
127 "--help : Show options.\n"
128 "--version : Show copyright and version information.\n"
129 "\n"
130 "Tunnel Options:\n"
131 "--local host|* [port]: Local host name or IP address and port for bind.\n"
132 " If specified, OpenVPN will bindto this address. If unspecified,\n"
133 " OpenVPN will bind to all interfaces. '*' can be used as hostname\n"
134 " and means 'any host' (OpenVPN will listen on what is returned by the OS).\n"
135 " On a client, or in point-to-point mode, this can only be specified once (1 socket).\n"
136 " On an OpenVPN setup running as ``--server``, this can be specified multiple times\n"
137 " to open multiple listening sockets on different addresses and/or different ports.\n"
138 " In order to specify multiple listen ports without specifying an address, use '*'\n"
139 " to signal 'use what the operating system gives you as default', for\n"
140 " 'all IPv4 addresses' use '0.0.0.0', for 'all IPv6 addresses' use '::'.\n"
141 " ``--local`` implies ``--bind``.\n"
142 "--remote host [port] : Remote host name or ip address.\n"
143 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
144 "--remote-random-hostname : Add a random string to remote DNS name.\n"
145 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
146 "--proto p : Use protocol p for communicating with peer.\n"
147 " p = udp (default), tcp-server, tcp-client\n"
148 " udp4, tcp4-server, tcp4-client\n"
149 " udp6, tcp6-server, tcp6-client\n"
150 "--proto-force p : only consider protocol p in list of connection profiles.\n"
151 " p = udp or tcp\n"
152 "--connect-retry n [m] : For client, number of seconds to wait between\n"
153 " connection retries (default=%d). On repeated retries\n"
154 " the wait time is exponentially increased to a maximum of m\n"
155 " (default=%d).\n"
156 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
157 "--http-proxy s p [up] [auth] : Connect to remote host\n"
158 " through an HTTP proxy at address s and port p.\n"
159 " If proxy authentication is required,\n"
160 " up is a file containing username/password on 2 lines, or\n"
161 " 'stdin' to prompt from console.\n"
162 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
163 " determine auth method and query for username/password\n"
164 " if needed. auto-nct disables weak proxy auth methods.\n"
165 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
166 " Repeat to set multiple options.\n"
167 " VERSION version (default=1.0)\n"
168 " AGENT user-agent\n"
169 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
170 " address s and port p (default port = 1080).\n"
171 " If proxy authentication is required,\n"
172 " up is a file containing username/password on 2 lines, or\n"
173 " 'stdin' to prompt for console.\n"
174 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
175 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
176 " resolve for n seconds before failing (disabled by default).\n"
177 " Set n=\"infinite\" to retry indefinitely.\n"
178 "--preresolve : Resolve configured --remote, --local, and proxy hostnames at startup.\n"
179 "--float : Allow remote to change its IP address/port, such as through\n"
180 " DHCP (this is the default if --remote is not used).\n"
181 "--ipchange cmd : Run command cmd on remote ip address initial\n"
182 " setting or change -- execute as: cmd ip-address port#\n"
183 "--port port : TCP/UDP port # for both local and remote.\n"
184 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
185 "--rport port : TCP/UDP port # for remote (default=%s).\n"
186 "--bind : Bind to local address and port. (This is the default unless\n"
187 " --proto tcp-client"
188 " or --http-proxy"
189 " or --socks-proxy"
190 " is used).\n"
191 "--nobind : Do not bind to local address and port.\n"
192 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device).\n"
193 " Defaults to \"tun\" if neither --dev nor --dev-type is given.\n"
194 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
195 " this option only if the tun/tap device used with --dev\n"
196 " does not begin with \"tun\" or \"tap\".\n"
197 "--dev-node node : Explicitly set the device node rather than using\n"
198 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
199#if defined(ENABLE_DCO)
200 "--disable-dco : Do not attempt using Data Channel Offload.\n"
201#endif
202 "--lladdr hw : Set the link layer address of the tap device.\n"
203 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
204#ifdef ENABLE_IPROUTE
205 "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
206#endif
207 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
208 " endpoint and rn as a remote endpoint. l & rn should be\n"
209 " swapped on the other peer. l & rn must be private\n"
210 " addresses outside of the subnets used by either peer.\n"
211 " TAP: configure device to use IP address l as a local\n"
212 " endpoint and rn as a subnet mask.\n"
213 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
214 " endpoint (as a /64) and r as remote endpoint\n"
215 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
216 " pass --ifconfig parms by environment to scripts.\n"
217 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
218 " connection doesn't match the remote side.\n"
219#ifdef TARGET_LINUX
220 "--route-table table_id : Specify a custom routing table for use with --route(-ipv6).\n"
221 " If not specified, the id of the default routing table will be used.\n"
222#endif
223 "--route network [netmask] [gateway] [metric] :\n"
224 " Add route to routing table after connection\n"
225 " is established. Multiple routes can be specified.\n"
226 " netmask default: 255.255.255.255\n"
227 " gateway default: taken from --route-gateway or --ifconfig\n"
228 " Specify default by leaving blank or setting to \"default\".\n"
229 "--route-ipv6 network/bits [gateway] [metric] :\n"
230 " Add IPv6 route to routing table after connection\n"
231 " is established. Multiple routes can be specified.\n"
232 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
233 " in --ifconfig-ipv6\n"
234 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
235 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
236 "--route-metric m : Specify a default metric for use with --route.\n"
237 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
238 " adding routes (may be 0). If not specified, routes will\n"
239 " be added immediately after tun/tap open. On Windows, wait\n"
240 " up to w seconds for TUN/TAP adapter to come up.\n"
241 "--route-up cmd : Run command cmd after routes are added.\n"
242 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
243 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
244 " --route-up script using environmental variables.\n"
245 "--route-nopull : When used with --client or --pull, accept options pushed\n"
246 " by server EXCEPT for routes, dns, and dhcp options.\n"
247 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
248 " --ifconfig, --route, and --route-gateway.\n"
249 "--redirect-gateway [flags]: Automatically execute routing\n"
250 " commands to redirect all outgoing IP traffic through the\n"
251 " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n"
252 " connected via a common subnet, such as with WiFi.\n"
253 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
254 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
255 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
256 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
257 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
258 " the default gateway. Useful when pushing private subnets.\n"
259 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
260 " ICMPv6 host unreachable messages on the client.\n"
261 " (Server) Instead of forwarding IPv6 packets send\n"
262 " ICMPv6 host unreachable packets to the client.\n"
263 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
264 "--push-peer-info : (client only) push client info to server.\n"
265 "--setenv name value : Set a custom environmental variable to pass to script.\n"
266 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
267 " directives for future OpenVPN versions to be ignored.\n"
268 "--ignore-unknown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
269 " these options to be ignored when unknown\n"
270 "--script-security level: Where level can be:\n"
271 " 0 -- strictly no calling of external programs\n"
272 " 1 -- (default) only call built-ins such as ifconfig\n"
273 " 2 -- allow calling of built-ins and scripts\n"
274 " 3 -- allow password to be passed to scripts via env\n"
275 "--shaper n : Restrict output to peer to n bytes per second.\n"
276 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
277 " ping once every n seconds, restart if ping not received\n"
278 " for m seconds.\n"
279 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
280 " produces a combined in/out byte count < bytes.\n"
281 "--session-timeout n: Limit connection time to n seconds.\n"
282 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
283 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
284 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
285 " remote address.\n"
286 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
287#if ENABLE_IP_PKTINFO
288 "--multihome : Configure a multi-homed UDP server.\n"
289#endif
290 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
291 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
292 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
293 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
294#if PASSTOS_CAPABILITY
295 "--passtos : TOS passthrough (applies to IPv4 only).\n"
296#endif
297 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
298 " TCP/UDP MTU from it (default=%d).\n"
299 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
300 " as n bytes more than the tun-mtu size on read\n"
301 " (default TUN=0 TAP=%d).\n"
302 "--tun-mtu-max n : Maximum pushable MTU (default and minimum=%d).\n"
303 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
304 " from it.\n"
305 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
306 " 'no' -- Never send DF (Don't Fragment) frames\n"
307 " 'maybe' -- Use per-route hints\n"
308 " 'yes' -- Always DF (Don't Fragment)\n"
309 "--mtu-test : Empirically measure and report MTU.\n"
310#ifdef ENABLE_FRAGMENT
311 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
312 " datagrams are sent which are larger than max bytes.\n"
313 " Adds 4 bytes of overhead per datagram.\n"
314#endif
315 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
316 " or --fragment max value, whichever is lower.\n"
317 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
318 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
319#if defined(TARGET_LINUX)
320 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
321 " can be matched in policy routing and packetfilter rules.\n"
322 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
323 " listening for connections. This allows sending encrypted packets\n"
324 " via a VRF present on the system.\n"
325#endif
326 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
327 "--mlock : Disable Paging -- ensures key material and tunnel\n"
328 " data will never be written to disk.\n"
329 "--up cmd : Run command cmd after successful tun device open.\n"
330 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
331 " ifconfig-local-ip ifconfig-remote-ip\n"
332 " (pre --user or --group UID/GID change)\n"
333 "--up-delay : Delay tun/tap open and possible --up script execution\n"
334 " until after TCP/UDP connection establishment with peer.\n"
335 "--down cmd : Run command cmd after tun device close.\n"
336 " (post --user/--group UID/GID change and/or --chroot)\n"
337 " (command parameters are same as --up option)\n"
338 "--down-pre : Run --down command before TUN/TAP close.\n"
339 "--up-restart : Run up/down commands for all restarts including those\n"
340 " caused by --ping-restart or SIGUSR1\n"
341 "--user user : Set UID to user after initialization.\n"
342 "--group group : Set GID to group after initialization.\n"
343 "--chroot dir : Chroot to this directory after initialization.\n"
344#ifdef ENABLE_SELINUX
345 "--setcon context: Apply this SELinux context after initialization.\n"
346#endif
347 "--cd dir : Change to this directory before initialization.\n"
348 "--daemon [name] : Become a daemon after initialization.\n"
349 " The optional 'name' parameter will be passed\n"
350 " as the program name to the system logger.\n"
351 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
352 " See --daemon above for a description of the 'name' parm.\n"
353 "--log file : Output log to file which is created/truncated on open.\n"
354 "--log-append file : Append log to file, or create file if nonexistent.\n"
355 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
356 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
357 "--writepid file : Write main process ID to file.\n"
358 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
359 "--echo [parms ...] : Echo parameters to log output.\n"
360 "--verb n : Set output verbosity to n (default=%d):\n"
361 " (Level 3 is recommended if you want a good summary\n"
362 " of what's happening without being swamped by output).\n"
363 " : 0 -- no output except fatal errors\n"
364 " : 1 -- startup info + connection initiated messages +\n"
365 " non-fatal encryption & net errors\n"
366 " : 2,3 -- show TLS negotiations & route info\n"
367 " : 4 -- show parameters\n"
368 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
369 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
370 " : 6 to 11 -- debug messages of increasing verbosity\n"
371 "--mute n : Log at most n consecutive messages in the same category.\n"
372 "--status file [n] : Write operational status to file every n seconds.\n"
373 "--status-version [n] : Choose the status file format version number.\n"
374 " Currently, n can be 1, 2, or 3 (default=1).\n"
375 "--disable-occ : (DEPRECATED) Disable options consistency check between peers.\n"
376#ifdef ENABLE_DEBUG
377 "--gremlin mask : Special stress testing mode (for debugging only).\n"
378#endif
379#if defined(USE_COMP)
380 "--compress alg : Use compression algorithm alg\n"
381 "--allow-compression: Specify whether compression should be allowed\n"
382#if defined(ENABLE_LZO)
383 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
384 " packet for incompressible data.\n"
385 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
386 " is specified.\n"
387#endif
388#endif
389#ifdef ENABLE_MANAGEMENT
390 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
391 " management functions. pass is a password file\n"
392 " or 'stdin' to prompt from console.\n"
393#if UNIX_SOCK_SUPPORT
394 " To listen on a unix domain socket, specific the pathname\n"
395 " in place of ip and use 'unix' as the port number.\n"
396#endif
397 "--management-client : Management interface will connect as a TCP client to\n"
398 " ip/port rather than listen as a TCP server.\n"
399 "--management-query-passwords : Query management channel for private key\n"
400 " and auth-user-pass passwords.\n"
401 "--management-query-proxy : Query management channel for proxy information.\n"
402 "--management-query-remote : Query management channel for --remote directive.\n"
403 "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
404 " of the management interface explicitly starts it.\n"
405 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
406 "--management-forget-disconnect : Forget passwords when management disconnect\n"
407 " event occurs.\n"
408 "--management-up-down : Report tunnel up/down events to management interface.\n"
409 "--management-log-cache n : Cache n lines of log file history for usage\n"
410 " by the management channel.\n"
411#if UNIX_SOCK_SUPPORT
412 "--management-client-user u : When management interface is a unix socket, only\n"
413 " allow connections from user u.\n"
414 "--management-client-group g : When management interface is a unix socket, only\n"
415 " allow connections from group g.\n"
416#endif
417 "--management-client-auth : gives management interface client the responsibility\n"
418 " to authenticate clients after their client certificate\n"
419 " has been verified.\n"
420#endif /* ifdef ENABLE_MANAGEMENT */
421#ifdef ENABLE_PLUGIN
422 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
423 " to its initialization function.\n"
424#endif
425 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
426 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
427 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
428 "\n"
429 "Multi-Client Server options (when --mode server is used):\n"
430 "--server network netmask : Helper option to easily configure server mode.\n"
431 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
432 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
433 " easily configure ethernet bridging server mode.\n"
434 "--push \"option\" : Push a config file option back to the peer for remote\n"
435 " execution. Peer must specify --pull in its config file.\n"
436 "--push-reset : Don't inherit global push list for specific\n"
437 " client instance.\n"
438 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
439 " a specific client instance.\n"
440 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
441 " to be dynamically allocated to connecting clients.\n"
442 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
443 " data to file, at seconds intervals (default=600).\n"
444 " If seconds=0, file will be treated as read-only.\n"
445 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
446 " to be dynamically allocated to connecting clients.\n"
447 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
448 " overrides --ifconfig-pool dynamic allocation.\n"
449 " Only valid in a client-specific config file.\n"
450 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
451 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
452 " Only valid in a client-specific config file.\n"
453 "--iroute network [netmask] : Route subnet to client.\n"
454 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
455 " Sets up internal routes only.\n"
456 " Only valid in a client-specific config file.\n"
457 "--disable : Client is disabled.\n"
458 " Only valid in a client-specific config file.\n"
459 "--override-username: Overrides the client-specific username to be used.\n"
460 " Only valid in a client-specific config file.\n"
461 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
462 " mandatory client certificate verification.\n"
463 " Default is to require the client to supply a certificate.\n"
464 "--username-as-common-name : For auth-user-pass authentication, use\n"
465 " the authenticated username as the common name,\n"
466 " rather than the common name from the client cert.\n"
467 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
468 " run command cmd to verify. If method='via-env', pass\n"
469 " user/pass via environment, if method='via-file', pass\n"
470 " user/pass via temporary file.\n"
471 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
472 " to each client, replacing the password. Useful when\n"
473 " OTP based two-factor auth mechanisms are in use and\n"
474 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
475 " for generated tokens can be set.\n"
476 "--auth-user-pass-optional : Allow connections by clients that don't\n"
477 " specify a username/password.\n"
478 "--client-to-client : Internally route client-to-client traffic.\n"
479 "--duplicate-cn : Allow multiple clients with the same common name to\n"
480 " concurrently connect.\n"
481 "--client-connect cmd : Run command cmd on client connection.\n"
482 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
483 "--client-config-dir dir : Directory for custom client config files.\n"
484 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
485 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
486 "--hash-size r v : Set the size of the real address hash table to r and the\n"
487 " virtual address table to v.\n"
488 "--bcast-buffers n : Allocate n broadcast buffers.\n"
489 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
490 "--tcp-nodelay : In server mode, push TCP_NODELAY to clients (it is\n"
491 " enabled by default on the local socket).\n"
492 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
493 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
494 "--connect-freq-initial n s : Allow a maximum of n replies for initial connections attempts per s seconds.\n"
495 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
496 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
497 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
498 " older than n seconds. Run this check every t\n"
499 " seconds (defaults to n).\n"
500 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
501 " clients. n = 1 - reconnect to same server,\n"
502 " 2 - advance to next server, default=1.\n"
503#if PORT_SHARE
504 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
505 " sessions to a web server at host:port. dir specifies an\n"
506 " optional directory to write origin IP:port data.\n"
507#endif
508 "\n"
509 "Client options (when connecting to a multi-client server):\n"
510 "--client : Helper option to easily configure client mode.\n"
511 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
512 " up is a file containing the username on the first line,\n"
513 " and a password on the second. If either the password or both\n"
514 " the username and the password are omitted OpenVPN will prompt\n"
515 " for them from console. If [up] is 'username-only', only username\n"
516 " will be prompted for from console or management interface.\n"
517 "--pull : Accept certain config file options from the peer as if they\n"
518 " were part of the local config file. Must be specified\n"
519 " when connecting to a '--mode server' remote host.\n"
520 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
521 " server if it starts with the text t. The action flag accept,\n"
522 " ignore or reject causes the option to be allowed, removed or\n"
523 " rejected with error. May be specified multiple times, and\n"
524 " each filter is applied in the order of appearance.\n"
525 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
526 " Valid options are :\n"
527 " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n"
528 " resolve-domains <domain> [domain ...] : split domains\n"
529 " dnssec <yes|no|optional> : option to use DNSSEC\n"
530 " transport <DoH|DoT> : query server over HTTPS / TLS\n"
531 " sni <domain> : DNS server name indication\n"
532 "--dns search-domains <domain> [domain ...]:\n"
533 " Add domains to DNS domain search list\n"
534 "--dns-updown cmd|force|disable : Run cmd as user defined dns config command,\n"
535 " force running the default script or disable running it.\n"
536 "--auth-retry t : How to handle auth failures. Set t to\n"
537 " none (default), interact, or nointeract.\n"
538 "--static-challenge t e [<scrv1|concat>]: Enable static challenge/response protocol using\n"
539 " challenge text t, with e indicating echo flag (0|1)\n"
540 " and optional argument scrv1 or concat to use SCRV1 protocol or"
541 " concatenate response with password. Default is scrv1.\n"
542 "--connect-timeout n : when polling possible remote servers to connect to\n"
543 " in a round-robin fashion, spend no more than n seconds\n"
544 " waiting for a response before trying the next server.\n"
545 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
546 " incoming tun packets with same destination as host.\n"
547 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
548 " server/remote. n = # of retries, default=1.\n"
549 "\n"
550 "Data Channel Encryption Options (must be compatible between peers):\n"
551 "(These options are meaningful for both Static Key & TLS-mode)\n"
552 "--auth alg : Authenticate packets with HMAC using message\n"
553 " digest algorithm alg (default=%s).\n"
554 " (usually adds 16 or 20 bytes per packet)\n"
555 " Set alg=none to disable authentication.\n"
556 "--cipher alg : Encrypt packets with cipher algorithm alg.\n"
557 " You should usually use --data-ciphers instead.\n"
558 " Set alg=none to disable encryption.\n"
559 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
560#ifndef ENABLE_CRYPTO_MBEDTLS
561 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
562#endif
563 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
564 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
565 " and a time window of t seconds.\n"
566 " Default n=%d t=%d\n"
567 "--replay-persist file : Persist replay-protection state across sessions\n"
568 " using file.\n"
569 "--test-crypto : Run a self-test of crypto features enabled.\n"
570 " For debugging only.\n"
571 "\n"
572 "TLS Key Negotiation Options:\n"
573 "(These options are meaningful only for TLS-mode)\n"
574 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
575 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
576 "--ca file : Certificate authority file in .pem format containing\n"
577 " root certificate.\n"
578#ifndef ENABLE_CRYPTO_MBEDTLS
579 "--capath dir : A directory of trusted certificates (CAs"
580 " and CRLs).\n"
581#endif /* ENABLE_CRYPTO_MBEDTLS */
582 "--dh file : File containing Diffie Hellman parameters\n"
583 " in .pem format (for --tls-server only).\n"
584 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
585 "--cert file : Local certificate in .pem format or a URI -- must be signed\n"
586 " by a Certificate Authority in --ca file used by the peer.\n"
587 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
588 "--key file : Local private key in .pem format or a URI.\n"
589 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
590 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
591 " is specified, require max TLS version supported by SSL implementation.\n"
592 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
593#ifndef ENABLE_CRYPTO_MBEDTLS
594 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
595 " and optionally the root CA certificate.\n"
596 "--x509-username-field : Field in x509 certificate containing the username.\n"
597 " Default is CN in the Subject field.\n"
598#endif
599 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
600 " Valid algo flags are SHA1 and SHA256. \n"
601#ifdef _WIN32
602 "--cryptoapicert select-string : Load the certificate and private key from the\n"
603 " Windows Certificate System Store.\n"
604#endif
605 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
606 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites separated by : (optional)\n"
607 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
608 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
609 " (default=legacy).\n"
610#ifndef ENABLE_CRYPTO_MBEDTLS
611 "--providers l : A list l of OpenSSL providers to load.\n"
612#endif
613 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
614 " if no ACK from remote within n seconds (default=%d).\n"
615 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
616 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
617 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
618 " and at least min (defaults to 90%% of max on servers and equal\n"
619 " to max on clients).\n"
620 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
621 " of handshake initiation by any peer (default=%d).\n"
622 "--tran-window n : Transition window -- old key can live this many seconds\n"
623 " after new key renegotiation begins (default=%d).\n"
624 "--single-session: Allow only one session (reset state on restart).\n"
625 "--tls-exit : Exit on TLS negotiation failure.\n"
626 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
627 " control channel to protect against attacks on the TLS stack\n"
628 " and DoS attacks.\n"
629 " f (required) is a shared-secret key file.\n"
630 " The optional d parameter controls key directionality.\n"
631 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
632 " of the TLS control channel to hide the TLS certificate,\n"
633 " provide basic post-quantum security and protect against\n"
634 " attacks on the TLS stack and DoS attacks.\n"
635 " key (required) provides the pre-shared key file.\n"
636 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
637 " For servers: use key to decrypt client-specific keys. For\n"
638 " key generation (--genkey tls-crypt-v2-client): use key to\n"
639 " encrypt generated client-specific key. (See --tls-crypt.)\n"
640 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
641 " fresh tls-crypt-v2 client key, and store to\n"
642 " keyfile. If supplied, include metadata in wrapped key.\n"
643 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
644 " fresh tls-crypt-v2 server key, and store to keyfile\n"
645 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
646 " client-supplied tls-crypt-v2 client key\n"
647 "--tls-crypt-v2-max-age n : Only accept tls-crypt-v2 client keys that have a\n"
648 " timestamp which is at most n days old.\n"
649 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
650 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
651 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
652 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
653 " pending TLS connection that has otherwise passed all other\n"
654 " tests of certification. cmd should return 0 to allow\n"
655 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
656 " executed as 'cmd certificate_depth subject')\n"
657 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
658 " DN name. The remote host must also pass all other tests\n"
659 " of verification.\n"
660#ifndef ENABLE_CRYPTO_MBEDTLS
661 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
662 " an explicit nsCertType designation t = 'client' | 'server'.\n"
663#endif
664 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
665 " plugins and management interface.\n"
666 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
667 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
668 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
669 " explicit key usage, you can specify more than one value.\n"
670 " value should be given in hex format.\n"
671 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
672 " explicit extended key usage. Extended key usage can be encoded\n"
673 " as an object identifier or OpenSSL string representation.\n"
674 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
675 " key usage and extended key usage based on RFC3280 TLS rules.\n"
676 " t = 'client' | 'server'.\n"
677#ifdef ENABLE_PKCS11
678 "\n"
679 "PKCS#11 Options:\n"
680 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
681 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
682 " path. Set for each provider.\n"
683 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
684 " 0 : Try to determine automatically (default).\n"
685 " 1 : Use Sign.\n"
686 " 2 : Use SignRecover.\n"
687 " 4 : Use Decrypt.\n"
688 " 8 : Use Unwrap.\n"
689 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
690 " certificate can be accessed. Set for each provider.\n"
691 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
692 " cache until token is removed.\n"
693 "--pkcs11-id-management : Acquire identity from management interface.\n"
694 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
695#endif /* ENABLE_PKCS11 */
696 "\n"
697 "SSL Library information:\n"
698 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
699 "--show-digests : Show message digest algorithms to use with --auth option.\n"
700 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
701 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
702#ifdef _WIN32
703 "\n"
704 "Windows Specific:\n"
705 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
706 " from SystemRoot environment variable.\n"
707 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
708 " IP address using method = manual, netsh, ipapi,\n"
709 " dynamic, or adaptive (default = adaptive).\n"
710 " Dynamic method allows two optional parameters:\n"
711 " offset: DHCP server address offset (> -256 and < 256).\n"
712 " If 0, use network address, if >0, take nth\n"
713 " address forward from network address, if <0,\n"
714 " take nth address backward from broadcast\n"
715 " address.\n"
716 " Default is 0.\n"
717 " lease-time: Lease time in seconds.\n"
718 " Default is one year.\n"
719 "--route-method : Which method to use for adding routes on Windows?\n"
720 " adaptive (default) -- Try ipapi then fall back to exe.\n"
721 " ipapi -- Use IP helper API.\n"
722 " exe -- Call the route.exe shell command.\n"
723 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
724 " be used with --ip-win32 dynamic. For options\n"
725 " which allow multiple addresses,\n"
726 " --dhcp-option must be repeated.\n"
727 " DOMAIN name : Set DNS suffix\n"
728 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
729 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
730 " NTP : Set NTP server address(es)\n"
731 " NBDD : Set NBDD server address(es)\n"
732 " WINS addr : Set WINS server address(es)\n"
733 " NBT type : Set NetBIOS over TCP/IP Node type\n"
734 " 1: B, 2: P, 4: M, 8: H\n"
735 " NBS id : Set NetBIOS scope ID\n"
736 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
737 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
738 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
739 " startup.\n"
740 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
741 " on connection initiation.\n"
742 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
743 " attempting to set adapter properties.\n"
744 "--pause-exit : When run from a console window, pause before exiting.\n"
745 "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n"
746 " service, and should not be used directly by end-users.\n"
747 " ex is the name of an event object which, when\n"
748 " signaled, will cause " PACKAGE_NAME " to exit. A second\n"
749 " optional parameter controls the initial state of ex.\n"
750 "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n"
751 " after TAP adapter is up and routes have been added.\n"
752 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
753 "Windows Standalone Options:\n"
754 "\n"
755 "--show-adapters : Show all TAP-Windows adapters.\n"
756 "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n"
757 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
758 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME " running without admin privileges\n"
759 " to access TAP adapter.\n"
760#endif /* ifdef _WIN32 */
761 "\n"
762 "Generate a new key :\n"
763 "--genkey tls-auth file : Generate a new random key of type and write to file\n"
764 " (for use with --tls-auth or --tls-crypt)."
765#ifdef ENABLE_FEATURE_TUN_PERSIST
766 "\n"
767 "Tun/tap config mode:\n"
768 "--mktun : Create a persistent tunnel.\n"
769 "--rmtun : Remove a persistent tunnel.\n"
770 "--dev tunX|tapX : tun/tap device\n"
771 "--dev-type dt : Device type. See tunnel options above for details.\n"
772 "--user user : User to set privilege to.\n"
773 "--group group : Group to set privilege to.\n"
774#endif
775#ifdef ENABLE_PKCS11
776 "\n"
777 "PKCS#11 standalone options:\n"
778#ifdef DEFAULT_PKCS11_MODULE
779 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
780#else
781 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
782#endif
783 " --verb option can be added *BEFORE* this.\n"
784#endif /* ENABLE_PKCS11 */
785 "\n"
786 "General Standalone Options:\n"
787#ifdef ENABLE_DEBUG
788 "--show-gateway [address]: Show info about gateway [to v4/v6 address].\n"
789#endif
790 ;
791
792#endif /* !ENABLE_SMALL */
793
794/*
795 * This is where the options defaults go.
796 * Any option not explicitly set here
797 * will be set to 0.
798 */
799void
800init_options(struct options *o)
801{
802 CLEAR(*o);
803 gc_init(&o->gc);
804 gc_init(&o->dns_options.gc);
805
806 o->mode = MODE_POINT_TO_POINT;
807 o->dev = "tun";
808 o->topology = TOP_UNDEF;
809 o->ce.proto = PROTO_UDP;
810 o->ce.af = AF_UNSPEC;
811 o->ce.bind_ipv6_only = false;
812 o->ce.connect_retry_seconds = 1;
813 o->ce.connect_retry_seconds_max = 300;
814 o->ce.connect_timeout = 120;
815 o->connect_retry_max = 0;
816 o->ce.local_port = o->ce.remote_port = OPENVPN_PORT;
817 o->verbosity = 1;
818 o->status_file_update_freq = 60;
819 o->status_file_version = 1;
820 o->ce.bind_local = true;
821 o->ce.tun_mtu = TUN_MTU_DEFAULT;
822 o->ce.occ_mtu = 0;
823 o->ce.link_mtu = LINK_MTU_DEFAULT;
824 o->ce.tls_mtu = TLS_MTU_DEFAULT;
825 o->ce.mtu_discover_type = -1;
826 o->ce.mssfix = 0;
827 o->ce.mssfix_default = true;
828 o->ce.mssfix_encap = true;
829 o->route_default_table_id = 0;
830 o->route_delay_window = 30;
831 o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
832 o->resolve_in_advance = false;
833 o->proto_force = -1;
834 o->occ = true;
835#ifdef ENABLE_MANAGEMENT
836 o->management_log_history_cache = 250;
837 o->management_echo_buffer_size = 100;
838 o->management_state_buffer_size = 100;
839#endif
840#ifdef ENABLE_FEATURE_TUN_PERSIST
841 o->persist_mode = 1;
842#endif
843#ifdef _WIN32
844#if 0
845 o->tuntap_options.ip_win32_type = IPW32_SET_ADAPTIVE;
846#else
847 o->tuntap_options.ip_win32_type = IPW32_SET_DHCP_MASQ;
848#endif
849 o->tuntap_options.dhcp_lease_time = 31536000; /* one year */
850 /* use network address as internal DHCP server address */
851 o->tuntap_options.dhcp_masq_offset = 0;
852 o->route_method = ROUTE_METHOD_ADAPTIVE;
853 o->block_outside_dns = false;
854 o->windows_driver = WINDOWS_DRIVER_UNSPECIFIED;
855#endif
856 o->vlan_accept = VLAN_ALL;
857 o->vlan_pvid = 1;
858 o->n_bcast_buf = 256;
859 o->tcp_queue_limit = 64;
860 o->max_clients = 1024;
861 o->cf_initial_per = 10;
862 o->cf_initial_max = 100;
863 o->max_routes_per_client = 256;
864 o->stale_routes_check_interval = 0;
865 o->ifconfig_pool_persist_refresh_freq = 600;
866 o->scheduled_exit_interval = 5;
867 o->authname = "SHA1";
868 o->replay_window = DEFAULT_SEQ_BACKTRACK;
869 o->replay_time = DEFAULT_TIME_BACKTRACK;
870 o->key_direction = KEY_DIRECTION_BIDIRECTIONAL;
871 o->tls_timeout = 2;
872 o->renegotiate_bytes = -1;
873 o->renegotiate_seconds = 3600;
874 o->renegotiate_seconds_min = -1;
875 o->handshake_window = 60;
876 o->transition_window = 3600;
877 o->tls_cert_profile = NULL;
878 o->ecdh_curve = NULL;
879 o->x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT;
880#ifdef ENABLE_PKCS11
881 o->pkcs11_pin_cache_period = -1;
882#endif /* ENABLE_PKCS11 */
883
884 /* P2MP server context features */
885 o->auth_token_generate = false;
886
887 /* Set default --tmp-dir */
888#ifdef _WIN32
889 /* On Windows, find temp dir via environment variables */
890 o->tmp_dir = win_get_tempdir();
891
892 if (!o->tmp_dir)
893 {
894 /* Error out if we can't find a valid temporary directory, which should
895 * be very unlikely. */
896 msg(M_USAGE, "Could not find a suitable temporary directory."
897 " (GetTempPath() failed). Consider using --tmp-dir");
898 }
899#else /* ifdef _WIN32 */
900 /* Non-windows platforms use $TMPDIR, and if not set, default to '/tmp' */
901 o->tmp_dir = getenv("TMPDIR");
902 if (!o->tmp_dir)
903 {
904 o->tmp_dir = "/tmp";
905 }
906#endif /* _WIN32 */
907 o->allow_recursive_routing = false;
908
909#ifndef ENABLE_DCO
910 o->disable_dco = true;
911#endif /* ENABLE_DCO */
912
913#ifdef ENABLE_DNS_UPDOWN_BY_DEFAULT
914 o->dns_options.updown = DEFAULT_DNS_UPDOWN;
915#endif /* ENABLE_DNS_UPDOWN_BY_DEFAULT */
916}
917
918void
919uninit_options(struct options *o)
920{
921 if (o->connection_list)
922 {
923 CLEAR(*o->connection_list);
924 }
925 if (o->remote_list)
926 {
927 CLEAR(*o->remote_list);
928 }
929
930 gc_free(&o->gc);
931 gc_free(&o->dns_options.gc);
932}
933
934#ifndef ENABLE_SMALL
935
936static const char *
937pull_filter_type_name(int type)
938{
939 if (type == PUF_TYPE_ACCEPT)
940 {
941 return "accept";
942 }
943 if (type == PUF_TYPE_IGNORE)
944 {
945 return "ignore";
946 }
947 if (type == PUF_TYPE_REJECT)
948 {
949 return "reject";
950 }
951 else
952 {
953 return "???";
954 }
955}
956
957#define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
958#define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
959#define SHOW_STR_INLINE(var) \
960 SHOW_PARM(var, o->var##_inline ? "[INLINE]" : (o->var ? o->var : "[UNDEF]"), "'%s'")
961#define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
962#define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
963#define SHOW_INT64(var) SHOW_PARM(var, o->var, "%" PRIi64)
964#define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
965#define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
966
967#endif /* ifndef ENABLE_SMALL */
968
969static void
970setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
971{
972 setenv_str_i(es, "remote", e->remote, i);
973 setenv_str_i(es, "remote_port", e->remote_port, i);
974
975 if (e->http_proxy_options)
976 {
977 setenv_str_i(es, "http_proxy_server", e->http_proxy_options->server, i);
978 setenv_str_i(es, "http_proxy_port", e->http_proxy_options->port, i);
979 }
980 if (e->socks_proxy_server)
981 {
982 setenv_str_i(es, "socks_proxy_server", e->socks_proxy_server, i);
983 setenv_str_i(es, "socks_proxy_port", e->socks_proxy_port, i);
984 }
985}
986
987static void
988setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
989{
990 setenv_str_i(es, "proto", proto2ascii(e->proto, AF_UNSPEC, false), i);
991 setenv_str_i(es, "local", e->local, i);
992 setenv_str_i(es, "local_port", e->port, i);
993}
994
995void
996setenv_settings(struct env_set *es, const struct options *o)
997{
998 setenv_str(es, "config", o->config);
999 setenv_int(es, "verb", o->verbosity);
1000 setenv_int(es, "daemon", o->daemon);
1001 setenv_int(es, "daemon_log_redirect", o->log);
1002 setenv_long_long(es, "daemon_start_time", time(NULL));
1003 setenv_int(es, "daemon_pid", platform_getpid());
1004
1005 if (o->connection_list)
1006 {
1007 int i;
1008 for (i = 0; i < o->connection_list->len; ++i)
1009 {
1010 setenv_connection_entry(es, o->connection_list->array[i], i + 1);
1011 }
1012 }
1013 else
1014 {
1015 setenv_connection_entry(es, &o->ce, 1);
1016 }
1017
1018 if (o->ce.local_list)
1019 {
1020 for (int i = 0; i < o->ce.local_list->len; i++)
1021 {
1022 setenv_local_entry(es, o->ce.local_list->array[i], i + 1);
1023 }
1024 }
1025}
1026
1027#ifndef _WIN32
1028static void
1029setenv_foreign_option(struct options *o, const char *option, const char *value, struct env_set *es)
1030{
1031 struct gc_arena gc = gc_new();
1032 struct buffer env_name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1033 struct buffer env_value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1034 bool good = true;
1035
1036 good &= buf_printf(&env_name, "foreign_option_%d", o->foreign_option_index + 1);
1037 if (value)
1038 {
1039 good &= buf_printf(&env_value, "dhcp-option %s %s", option, value);
1040 }
1041 else
1042 {
1043 good &= buf_printf(&env_value, "dhcp-option %s", option);
1044 }
1045 if (good)
1046 {
1047 setenv_str(es, BSTR(&env_name), BSTR(&env_value));
1048 ++o->foreign_option_index;
1049 }
1050 else
1051 {
1052 msg(M_WARN, "foreign_option: name/value overflow");
1053 }
1054 gc_free(&gc);
1055}
1056
1057static void
1058delete_all_dhcp_fo(struct options *o, struct env_item **list)
1059{
1060 struct env_item *current, *prev;
1061
1062 ASSERT(list);
1063
1064 for (current = *list, prev = NULL; current != NULL; current = current->next)
1065 {
1066 char *tmp_value = NULL;
1067 if (!strncmp(current->string, "foreign_option_", sizeof("foreign_option_") - 1))
1068 {
1069 tmp_value = strchr(current->string, '=');
1070 if (tmp_value && ++tmp_value)
1071 {
1072 if (!strncmp(tmp_value, "dhcp-option ", sizeof("dhcp-option ") - 1))
1073 {
1074 if (prev)
1075 {
1076 prev->next = current->next;
1077 }
1078 else
1079 {
1080 *list = current->next;
1081 }
1082 o->foreign_option_index--;
1083 }
1084 }
1085 }
1086 prev = current;
1087 }
1088}
1089
1090#endif /* ifndef _WIN32 */
1091
1092static in_addr_t
1093get_ip_addr(const char *ip_string, msglvl_t msglevel, bool *error)
1094{
1095 unsigned int flags = GETADDR_HOST_ORDER;
1096 bool succeeded = false;
1097 in_addr_t ret;
1098
1099 if (msglevel & M_FATAL)
1100 {
1101 flags |= GETADDR_FATAL;
1102 }
1103
1104 ret = getaddr(flags, ip_string, 0, &succeeded, NULL);
1105 if (!succeeded && error)
1106 {
1107 *error = true;
1108 }
1109 return ret;
1110}
1111
1117static char *
1118get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
1119{
1120 const char *end = strchr(addr, '/');
1121 char *ret = NULL;
1122 if (NULL == end)
1123 {
1124 ret = string_alloc(addr, gc);
1125 }
1126 else
1127 {
1128 size_t len = end - addr;
1129 ret = gc_malloc(len + 1, true, gc);
1130 memcpy(ret, addr, len);
1131 }
1132 return ret;
1133}
1134
1135static bool
1136ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
1137{
1138 return get_ipv6_addr(ipv6_prefix_spec, NULL, NULL, M_WARN);
1139}
1140
1141static char *
1142string_substitute(const char *src, char from, char to, struct gc_arena *gc)
1143{
1144 char *ret = (char *)gc_malloc(strlen(src) + 1, true, gc);
1145 char *dest = ret;
1146 char c;
1147
1148 do
1149 {
1150 c = *src++;
1151 if (c == from)
1152 {
1153 c = to;
1154 }
1155 *dest++ = c;
1156 } while (c);
1157 return ret;
1158}
1159
1169static struct verify_hash_list *
1170parse_hash_fingerprint(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
1171{
1172 int i = 0;
1173 const char *cp = str;
1174
1175 struct verify_hash_list *ret;
1176 ALLOC_OBJ_CLEAR_GC(ret, struct verify_hash_list, gc);
1177
1178 char term = 0;
1179 unsigned int byte;
1180
1181 while (*cp && i < nbytes)
1182 {
1183 /* valid segments consist of exactly two hex digits, then ':' or EOS */
1184 if (!isxdigit(cp[0]) || !isxdigit(cp[1]) || (cp[2] != ':' && cp[2] != '\0')
1185 || sscanf(cp, "%x", &byte) != 1)
1186 {
1187 msg(msglevel, "format error in hash fingerprint: %s", str);
1188 break;
1189 }
1190
1191 ret->hash[i++] = (uint8_t)byte;
1192
1193 term = cp[2];
1194 if (term == '\0')
1195 {
1196 break;
1197 }
1198 cp += 3;
1199 }
1200 if (i < nbytes)
1201 {
1202 msg(msglevel, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes, i,
1203 str);
1204 }
1205 else if (term != '\0')
1206 {
1207 msg(msglevel, "hash fingerprint too long - expected only %d bytes: %s", nbytes, str);
1208 }
1209 return ret;
1210}
1211
1222static struct verify_hash_list *
1223parse_hash_fingerprint_multiline(const char *str, int nbytes, msglvl_t msglevel,
1224 struct gc_arena *gc)
1225{
1226 struct gc_arena gc_temp = gc_new();
1227 char *lines = string_alloc(str, &gc_temp);
1228
1229 struct verify_hash_list *ret = NULL;
1230
1231 const char *line;
1232 while ((line = strsep(&lines, "\n")))
1233 {
1234 /* ignore leading whitespace */
1235 while (isspace(*line))
1236 {
1237 line++;
1238 }
1239 /* skip empty lines and comment lines */
1240 if (strlen(line) == 0 || *line == '#' || *line == ';')
1241 {
1242 continue;
1243 }
1244
1245 struct verify_hash_list *hash = parse_hash_fingerprint(line, nbytes, msglevel, gc);
1246
1247 if (!hash)
1248 {
1249 gc_free(&gc_temp);
1250 return NULL;
1251 }
1252
1253 hash->next = ret;
1254 ret = hash;
1255 }
1256 gc_free(&gc_temp);
1257
1258 return ret;
1259}
1260#ifdef _WIN32
1261
1262#ifndef ENABLE_SMALL
1263
1264static void
1265show_dhcp_option_list(const char *name, const char *const *array, unsigned int len)
1266{
1267 for (unsigned int i = 0; i < len; ++i)
1268 {
1269 msg(D_SHOW_PARMS, " %s[%u] = %s", name, i, array[i]);
1270 }
1271}
1272
1273static void
1274show_dhcp_option_addrs(const char *name, const in_addr_t *array, unsigned int len)
1275{
1276 struct gc_arena gc = gc_new();
1277 for (unsigned int i = 0; i < len; ++i)
1278 {
1279 msg(D_SHOW_PARMS, " %s[%u] = %s", name, i, print_in_addr_t(array[i], 0, &gc));
1280 }
1281 gc_free(&gc);
1282}
1283
1284static void
1285show_tuntap_options(const struct tuntap_options *o)
1286{
1287 SHOW_BOOL(ip_win32_defined);
1288 SHOW_INT(ip_win32_type);
1289 SHOW_INT(dhcp_masq_offset);
1290 SHOW_INT(dhcp_lease_time);
1291 SHOW_INT(tap_sleep);
1292 SHOW_UNSIGNED(dhcp_options);
1293 SHOW_BOOL(dhcp_renew);
1294 SHOW_BOOL(dhcp_pre_release);
1295 SHOW_STR(domain);
1296 SHOW_STR(netbios_scope);
1297 SHOW_UNSIGNED(netbios_node_type);
1298 SHOW_BOOL(disable_nbt);
1299
1300 show_dhcp_option_addrs("DNS", o->dns, o->dns_len);
1301 show_dhcp_option_addrs("WINS", o->wins, o->wins_len);
1302 show_dhcp_option_addrs("NTP", o->ntp, o->ntp_len);
1303 show_dhcp_option_addrs("NBDD", o->nbdd, o->nbdd_len);
1304 show_dhcp_option_list("DOMAIN-SEARCH", o->domain_search_list, o->domain_search_list_len);
1305}
1306
1307#endif /* ifndef ENABLE_SMALL */
1308#endif /* ifdef _WIN32 */
1309
1310static void
1311dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, unsigned int *len, msglvl_t msglevel)
1312{
1313 struct in6_addr addr;
1314 if (*len >= N_DHCP_ADDR)
1315 {
1316 msg(msglevel, "--dhcp-option DNS: maximum of %u IPv6 dns servers can be specified",
1317 N_DHCP_ADDR);
1318 }
1319 else if (get_ipv6_addr(parm, &addr, NULL, msglevel))
1320 {
1321 dns6_list[(*len)++] = addr;
1322 }
1323}
1324static void
1325dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, unsigned int *len,
1326 msglvl_t msglevel)
1327{
1328 if (*len >= N_DHCP_ADDR)
1329 {
1330 msg(msglevel, "--dhcp-option %s: maximum of %u %s servers can be specified", name,
1331 N_DHCP_ADDR, name);
1332 }
1333 else
1334 {
1335 if (ip_addr_dotted_quad_safe(parm)) /* FQDN -- IP address only */
1336 {
1337 bool error = false;
1338 const in_addr_t addr = get_ip_addr(parm, msglevel, &error);
1339 if (!error)
1340 {
1341 array[(*len)++] = addr;
1342 }
1343 }
1344 else
1345 {
1346 msg(msglevel, "dhcp-option parameter %s '%s' must be an IP address", name, parm);
1347 }
1348 }
1349}
1350
1351#ifndef ENABLE_SMALL
1352static const char *
1353print_vlan_accept(enum vlan_acceptable_frames mode)
1354{
1355 switch (mode)
1356 {
1357 case VLAN_ONLY_TAGGED:
1358 return "tagged";
1359
1360 case VLAN_ONLY_UNTAGGED_OR_PRIORITY:
1361 return "untagged";
1362
1363 case VLAN_ALL:
1364 return "all";
1365 }
1366 return NULL;
1367}
1368
1369static void
1370show_p2mp_parms(const struct options *o)
1371{
1372 struct gc_arena gc = gc_new();
1373
1374 msg(D_SHOW_PARMS, " server_network = %s", print_in_addr_t(o->server_network, 0, &gc));
1375 msg(D_SHOW_PARMS, " server_netmask = %s", print_in_addr_t(o->server_netmask, 0, &gc));
1376 msg(D_SHOW_PARMS, " server_network_ipv6 = %s", print_in6_addr(o->server_network_ipv6, 0, &gc));
1377 SHOW_INT(server_netbits_ipv6);
1378 msg(D_SHOW_PARMS, " server_bridge_ip = %s", print_in_addr_t(o->server_bridge_ip, 0, &gc));
1379 msg(D_SHOW_PARMS, " server_bridge_netmask = %s",
1380 print_in_addr_t(o->server_bridge_netmask, 0, &gc));
1381 msg(D_SHOW_PARMS, " server_bridge_pool_start = %s",
1382 print_in_addr_t(o->server_bridge_pool_start, 0, &gc));
1383 msg(D_SHOW_PARMS, " server_bridge_pool_end = %s",
1384 print_in_addr_t(o->server_bridge_pool_end, 0, &gc));
1385 if (o->push_list.head)
1386 {
1387 const struct push_entry *e = o->push_list.head;
1388 while (e)
1389 {
1390 if (e->enable)
1391 {
1392 msg(D_SHOW_PARMS, " push_entry = '%s'", e->option);
1393 }
1394 e = e->next;
1395 }
1396 }
1397 SHOW_BOOL(ifconfig_pool_defined);
1398 msg(D_SHOW_PARMS, " ifconfig_pool_start = %s",
1399 print_in_addr_t(o->ifconfig_pool_start, 0, &gc));
1400 msg(D_SHOW_PARMS, " ifconfig_pool_end = %s", print_in_addr_t(o->ifconfig_pool_end, 0, &gc));
1401 msg(D_SHOW_PARMS, " ifconfig_pool_netmask = %s",
1402 print_in_addr_t(o->ifconfig_pool_netmask, 0, &gc));
1403 SHOW_STR(ifconfig_pool_persist_filename);
1404 SHOW_INT(ifconfig_pool_persist_refresh_freq);
1405 SHOW_BOOL(ifconfig_ipv6_pool_defined);
1406 msg(D_SHOW_PARMS, " ifconfig_ipv6_pool_base = %s",
1407 print_in6_addr(o->ifconfig_ipv6_pool_base, 0, &gc));
1408 SHOW_INT(ifconfig_ipv6_pool_netbits);
1409 SHOW_INT(n_bcast_buf);
1410 SHOW_INT(tcp_queue_limit);
1411 SHOW_INT(real_hash_size);
1412 SHOW_INT(virtual_hash_size);
1413 SHOW_STR(client_connect_script);
1414 SHOW_STR(learn_address_script);
1415 SHOW_STR(client_disconnect_script);
1416 SHOW_STR(client_crresponse_script);
1417 SHOW_STR(client_config_dir);
1418 SHOW_BOOL(ccd_exclusive);
1419 SHOW_STR(tmp_dir);
1420 SHOW_BOOL(push_ifconfig_defined);
1421 msg(D_SHOW_PARMS, " push_ifconfig_local = %s",
1422 print_in_addr_t(o->push_ifconfig_local, 0, &gc));
1423 msg(D_SHOW_PARMS, " push_ifconfig_remote_netmask = %s",
1424 print_in_addr_t(o->push_ifconfig_remote_netmask, 0, &gc));
1425 SHOW_BOOL(push_ifconfig_ipv6_defined);
1426 msg(D_SHOW_PARMS, " push_ifconfig_ipv6_local = %s/%d",
1427 print_in6_addr(o->push_ifconfig_ipv6_local, 0, &gc), o->push_ifconfig_ipv6_netbits);
1428 msg(D_SHOW_PARMS, " push_ifconfig_ipv6_remote = %s",
1429 print_in6_addr(o->push_ifconfig_ipv6_remote, 0, &gc));
1430 SHOW_BOOL(enable_c2c);
1431 SHOW_BOOL(duplicate_cn);
1432 SHOW_INT(cf_max);
1433 SHOW_INT(cf_per);
1434 SHOW_INT(cf_initial_max);
1435 SHOW_INT(cf_initial_per);
1436 SHOW_UINT(max_clients);
1437 SHOW_INT(max_routes_per_client);
1438 SHOW_STR(auth_user_pass_verify_script);
1439 SHOW_BOOL(auth_user_pass_verify_script_via_file);
1440 SHOW_BOOL(auth_token_generate);
1441 SHOW_BOOL(force_key_material_export);
1442 SHOW_INT(auth_token_lifetime);
1443 SHOW_STR_INLINE(auth_token_secret_file);
1444#if PORT_SHARE
1445 SHOW_STR(port_share_host);
1446 SHOW_STR(port_share_port);
1447#endif
1448 SHOW_BOOL(vlan_tagging);
1449 msg(D_SHOW_PARMS, " vlan_accept = %s", print_vlan_accept(o->vlan_accept));
1450 SHOW_INT(vlan_pvid);
1451
1452 SHOW_BOOL(client);
1453 SHOW_BOOL(pull);
1454 SHOW_STR_INLINE(auth_user_pass_file);
1455
1456 gc_free(&gc);
1457}
1458
1459#endif /* ! ENABLE_SMALL */
1460
1461static void
1462option_iroute(struct options *o, const char *network_str, const char *netmask_str,
1463 msglvl_t msglevel)
1464{
1465 struct iroute *ir;
1466
1467 ALLOC_OBJ_GC(ir, struct iroute, &o->gc);
1468 ir->network = getaddr(GETADDR_HOST_ORDER, network_str, 0, NULL, NULL);
1469 ir->netbits = 32; /* host route if no netmask given */
1470
1471 if (netmask_str)
1472 {
1473 const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, netmask_str, 0, NULL, NULL);
1474 ir->netbits = netmask_to_netbits2(netmask);
1475
1476 if (ir->netbits < 0)
1477 {
1478 msg(msglevel, "in --iroute %s %s : Bad network/subnet specification", network_str,
1479 netmask_str);
1480 return;
1481 }
1482 }
1483
1484 ir->next = o->iroutes;
1485 o->iroutes = ir;
1486}
1487
1488static void
1489option_iroute_ipv6(struct options *o, const char *prefix_str, msglvl_t msglevel)
1490{
1491 struct iroute_ipv6 *ir;
1492
1493 ALLOC_OBJ_GC(ir, struct iroute_ipv6, &o->gc);
1494
1495 if (!get_ipv6_addr(prefix_str, &ir->network, &ir->netbits, msglevel))
1496 {
1497 msg(msglevel, "in --iroute-ipv6 %s: Bad IPv6 prefix specification", prefix_str);
1498 return;
1499 }
1500
1501 ir->next = o->iroutes_ipv6;
1502 o->iroutes_ipv6 = ir;
1503}
1504
1505#ifndef ENABLE_SMALL
1506static void
1507show_http_proxy_options(const struct http_proxy_options *o)
1508{
1509 int i;
1510 msg(D_SHOW_PARMS, "BEGIN http_proxy");
1511 SHOW_STR(server);
1512 SHOW_STR(port);
1513 SHOW_STR(auth_method_string);
1514 SHOW_STR(auth_file);
1515 SHOW_STR(auth_file_up);
1516 SHOW_BOOL(inline_creds);
1517 SHOW_BOOL(nocache);
1518 SHOW_STR(http_version);
1519 SHOW_STR(user_agent);
1520 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER && o->custom_headers[i].name; i++)
1521 {
1522 if (o->custom_headers[i].content)
1523 {
1524 msg(D_SHOW_PARMS, " custom_header[%d] = %s: %s", i, o->custom_headers[i].name,
1525 o->custom_headers[i].content);
1526 }
1527 else
1528 {
1529 msg(D_SHOW_PARMS, " custom_header[%d] = %s", i, o->custom_headers[i].name);
1530 }
1531 }
1532 msg(D_SHOW_PARMS, "END http_proxy");
1533}
1534#endif /* ifndef ENABLE_SMALL */
1535
1536void
1537options_detach(struct options *o)
1538{
1539 /* The options struct carries two gc_arena's (one generic and one specific
1540 * to the DNS settings), which the by-value options
1541 * copy in inherit_context_child()/inherit_context_top() shares with the
1542 * source.
1543 *
1544 * Detach both (i.e. re-initialize them), otherwise child's call of
1545 * gc_free() (or context teardown) would free allocations the source
1546 * context still references, leading to a use-after-free (and subsequent
1547 * double-free).
1548 */
1549 gc_detach(&o->gc);
1550 gc_detach(&o->dns_options.gc);
1551 o->routes = NULL;
1552 o->client_nat = NULL;
1553 clone_push_list(o);
1554}
1555
1556void
1557rol_check_alloc(struct options *options)
1558{
1559 if (!options->routes)
1560 {
1561 options->routes = new_route_option_list(&options->gc);
1562 }
1563}
1564
1565static void
1573
1574static void
1575cnol_check_alloc(struct options *options)
1576{
1577 if (!options->client_nat)
1578 {
1579 options->client_nat = new_client_nat_list(&options->gc);
1580 }
1581}
1582
1583#ifndef ENABLE_SMALL
1584static void
1585show_connection_entry(const struct connection_entry *o)
1586{
1587 /* Display the global proto only in client mode or with no '--local'*/
1588 if (o->local_list->len == 1)
1589 {
1590 msg(D_SHOW_PARMS, " proto = %s", proto2ascii(o->proto, o->af, false));
1591 }
1592
1593 msg(D_SHOW_PARMS, " Local Sockets:");
1594 for (int i = 0; i < o->local_list->len; i++)
1595 {
1596 msg(D_SHOW_PARMS, " [%s]:%s-%s", o->local_list->array[i]->local,
1597 o->local_list->array[i]->port,
1598 proto2ascii(o->local_list->array[i]->proto, o->af, false));
1599 }
1600 SHOW_STR(remote);
1601 SHOW_STR(remote_port);
1602 SHOW_BOOL(remote_float);
1603 SHOW_BOOL(bind_defined);
1604 SHOW_BOOL(bind_local);
1605 SHOW_BOOL(bind_ipv6_only);
1606 SHOW_INT(connect_retry_seconds);
1607 SHOW_INT(connect_timeout);
1608
1609 if (o->http_proxy_options)
1610 {
1611 show_http_proxy_options(o->http_proxy_options);
1612 }
1613 SHOW_STR(socks_proxy_server);
1614 SHOW_STR(socks_proxy_port);
1615 SHOW_INT(tun_mtu);
1616 SHOW_BOOL(tun_mtu_defined);
1617 SHOW_INT(link_mtu);
1618 SHOW_BOOL(link_mtu_defined);
1619 SHOW_INT(tun_mtu_extra);
1620 SHOW_BOOL(tun_mtu_extra_defined);
1621 SHOW_INT(tls_mtu);
1622
1623 SHOW_INT(mtu_discover_type);
1624
1625#ifdef ENABLE_FRAGMENT
1626 SHOW_INT(fragment);
1627#endif
1628 SHOW_INT(mssfix);
1629 SHOW_BOOL(mssfix_encap);
1630 SHOW_BOOL(mssfix_fixed);
1631
1632 SHOW_INT(explicit_exit_notification);
1633
1634 SHOW_STR_INLINE(tls_auth_file);
1635 SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true), "%s");
1636 SHOW_STR_INLINE(tls_crypt_file);
1637 SHOW_STR_INLINE(tls_crypt_v2_file);
1638}
1639
1640
1641static void
1642show_connection_entries(const struct options *o)
1643{
1644 if (o->connection_list)
1645 {
1646 const struct connection_list *l = o->connection_list;
1647 int i;
1648 for (i = 0; i < l->len; ++i)
1649 {
1650 msg(D_SHOW_PARMS, "Connection profiles [%d]:", i);
1651 show_connection_entry(l->array[i]);
1652 }
1653 }
1654 else
1655 {
1656 msg(D_SHOW_PARMS, "Connection profiles [default]:");
1657 show_connection_entry(&o->ce);
1658 }
1659 msg(D_SHOW_PARMS, "Connection profiles END");
1660}
1661
1662static void
1663show_pull_filter_list(const struct pull_filter_list *l)
1664{
1665 struct pull_filter *f;
1666 if (!l)
1667 {
1668 return;
1669 }
1670
1671 msg(D_SHOW_PARMS, " Pull filters:");
1672 for (f = l->head; f; f = f->next)
1673 {
1674 msg(D_SHOW_PARMS, " %s \"%s\"", pull_filter_type_name(f->type), f->pattern);
1675 }
1676}
1677
1678#endif /* ifndef ENABLE_SMALL */
1679
1680void
1681show_settings(const struct options *o)
1682{
1683#ifndef ENABLE_SMALL
1684 msg(D_SHOW_PARMS, "Current Parameter Settings:");
1685
1686 SHOW_STR(config);
1687
1688 SHOW_INT(mode);
1689
1690#ifdef ENABLE_FEATURE_TUN_PERSIST
1691 SHOW_BOOL(persist_config);
1692 SHOW_INT(persist_mode);
1693#endif
1694
1695 SHOW_BOOL(show_ciphers);
1696 SHOW_BOOL(show_digests);
1697 SHOW_BOOL(show_engines);
1698 SHOW_BOOL(genkey);
1699 SHOW_STR(genkey_filename);
1700 SHOW_STR(key_pass_file);
1701 SHOW_BOOL(show_tls_ciphers);
1702
1703 SHOW_INT(connect_retry_max);
1704 show_connection_entries(o);
1705
1706 SHOW_BOOL(remote_random);
1707
1708 SHOW_STR(ipchange);
1709 SHOW_STR(dev);
1710 SHOW_STR(dev_type);
1711 SHOW_STR(dev_node);
1712#if defined(ENABLE_DCO)
1713 SHOW_BOOL(disable_dco);
1714#endif
1715 SHOW_STR(lladdr);
1716 SHOW_INT(topology);
1717 SHOW_STR(ifconfig_local);
1718 SHOW_STR(ifconfig_remote_netmask);
1719 SHOW_BOOL(ifconfig_noexec);
1720 SHOW_BOOL(ifconfig_nowarn);
1721 SHOW_STR(ifconfig_ipv6_local);
1722 SHOW_INT(ifconfig_ipv6_netbits);
1723 SHOW_STR(ifconfig_ipv6_remote);
1724
1725 SHOW_INT(shaper);
1726 SHOW_INT(mtu_test);
1727
1728 SHOW_BOOL(mlock);
1729
1730 SHOW_INT(keepalive_ping);
1731 SHOW_INT(keepalive_timeout);
1732 SHOW_INT(inactivity_timeout);
1733 SHOW_INT(session_timeout);
1734 SHOW_INT64(inactivity_minimum_bytes);
1735 SHOW_INT(ping_send_timeout);
1736 SHOW_INT(ping_rec_timeout);
1737 SHOW_INT(ping_rec_timeout_action);
1738 SHOW_BOOL(ping_timer_remote);
1739 SHOW_INT(remap_sigusr1);
1740 SHOW_BOOL(persist_tun);
1741 SHOW_BOOL(persist_local_ip);
1742 SHOW_BOOL(persist_remote_ip);
1743
1744#if PASSTOS_CAPABILITY
1745 SHOW_BOOL(passtos);
1746#endif
1747
1748 SHOW_INT(resolve_retry_seconds);
1749 SHOW_BOOL(resolve_in_advance);
1750
1751 SHOW_STR(username);
1752 SHOW_STR(groupname);
1753 SHOW_STR(chroot_dir);
1754 SHOW_STR(cd_dir);
1755#ifdef ENABLE_SELINUX
1756 SHOW_STR(selinux_context);
1757#endif
1758 SHOW_STR(writepid);
1759 SHOW_STR(up_script);
1760 SHOW_STR(down_script);
1761 SHOW_BOOL(down_pre);
1762 SHOW_BOOL(up_restart);
1763 SHOW_BOOL(up_delay);
1764 SHOW_BOOL(daemon);
1765 SHOW_BOOL(log);
1766 SHOW_BOOL(suppress_timestamps);
1767 SHOW_BOOL(machine_readable_output);
1768 SHOW_INT(nice);
1769 SHOW_INT(verbosity);
1770 SHOW_INT(mute);
1771#ifdef ENABLE_DEBUG
1772 SHOW_INT(gremlin);
1773#endif
1774 SHOW_STR(status_file);
1775 SHOW_INT(status_file_version);
1776 SHOW_INT(status_file_update_freq);
1777
1778 SHOW_BOOL(occ);
1779 SHOW_INT(rcvbuf);
1780 SHOW_INT(sndbuf);
1781#if defined(TARGET_LINUX)
1782 SHOW_INT(mark);
1783#endif
1784 SHOW_INT(sockflags);
1785
1786 SHOW_INT(comp.alg);
1787 SHOW_INT(comp.flags);
1788
1789 SHOW_STR(route_script);
1790 SHOW_STR(route_default_gateway);
1791 SHOW_INT(route_default_metric);
1792 SHOW_INT(route_default_table_id);
1793 SHOW_BOOL(route_noexec);
1794 SHOW_INT(route_delay);
1795 SHOW_INT(route_delay_window);
1796 SHOW_BOOL(route_delay_defined);
1797 SHOW_BOOL(route_nopull);
1798 SHOW_BOOL(route_gateway_via_dhcp);
1799 SHOW_BOOL(allow_pull_fqdn);
1800 show_pull_filter_list(o->pull_filter_list);
1801
1802 if (o->routes)
1803 {
1804 print_route_options(o->routes, D_SHOW_PARMS);
1805 }
1806
1807 if (o->client_nat)
1808 {
1809 print_client_nat_list(o->client_nat, D_SHOW_PARMS);
1810 }
1811
1812 show_dns_options(&o->dns_options);
1813
1814#ifdef ENABLE_MANAGEMENT
1815 SHOW_STR(management_addr);
1816 SHOW_STR(management_port);
1817 SHOW_STR(management_user_pass);
1818 SHOW_INT(management_log_history_cache);
1819 SHOW_INT(management_echo_buffer_size);
1820 SHOW_STR(management_client_user);
1821 SHOW_STR(management_client_group);
1822 SHOW_INT(management_flags);
1823#endif
1824#ifdef ENABLE_PLUGIN
1825 if (o->plugin_list)
1826 {
1827 plugin_option_list_print(o->plugin_list, D_SHOW_PARMS);
1828 }
1829#endif
1830
1831 SHOW_STR_INLINE(shared_secret_file);
1832 SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true), "%s");
1833 SHOW_STR(ciphername);
1834 SHOW_STR(ncp_ciphers);
1835 SHOW_STR(authname);
1836#ifndef ENABLE_CRYPTO_MBEDTLS
1837 SHOW_BOOL(engine);
1838#endif /* ENABLE_CRYPTO_MBEDTLS */
1839 SHOW_BOOL(mute_replay_warnings);
1840 SHOW_INT(replay_window);
1841 SHOW_INT(replay_time);
1842 SHOW_STR(packet_id_file);
1843 SHOW_BOOL(test_crypto);
1844
1845 SHOW_BOOL(tls_server);
1846 SHOW_BOOL(tls_client);
1847 SHOW_STR_INLINE(ca_file);
1848 SHOW_STR(ca_path);
1849 SHOW_STR_INLINE(dh_file);
1850 if ((o->management_flags & MF_EXTERNAL_CERT))
1851 {
1852 SHOW_PARM("cert_file", "EXTERNAL_CERT", "%s");
1853 }
1854 else
1855 {
1856 SHOW_STR_INLINE(cert_file);
1857 }
1858 SHOW_STR_INLINE(extra_certs_file);
1859
1860 if ((o->management_flags & MF_EXTERNAL_KEY))
1861 {
1862 SHOW_PARM("priv_key_file", "EXTERNAL_PRIVATE_KEY", "%s");
1863 }
1864 else
1865 {
1866 SHOW_STR_INLINE(priv_key_file);
1867 }
1868#ifndef ENABLE_CRYPTO_MBEDTLS
1869 SHOW_STR_INLINE(pkcs12_file);
1870#endif
1871#ifdef ENABLE_CRYPTOAPI
1872 SHOW_STR(cryptoapi_cert);
1873#endif
1874 SHOW_STR(cipher_list);
1875 SHOW_STR(cipher_list_tls13);
1876 SHOW_STR(tls_cert_profile);
1877 SHOW_STR(tls_verify);
1878 SHOW_STR(tls_export_peer_cert_dir);
1879 SHOW_INT(verify_x509_type);
1880 SHOW_STR(verify_x509_name);
1881 SHOW_STR_INLINE(crl_file);
1882 SHOW_INT(ns_cert_type);
1883 {
1884 int i;
1885 for (i = 0; i < MAX_PARMS; i++)
1886 {
1887 SHOW_INT(remote_cert_ku[i]);
1888 }
1889 }
1890 SHOW_STR(remote_cert_eku);
1891 if (o->verify_hash)
1892 {
1893 SHOW_INT(verify_hash_algo);
1894 SHOW_INT(verify_hash_depth);
1895 struct gc_arena gc = gc_new();
1896 struct verify_hash_list *hl = o->verify_hash;
1897 int digest_len =
1898 (o->verify_hash_algo == MD_SHA1) ? SHA_DIGEST_LENGTH : SHA256_DIGEST_LENGTH;
1899 while (hl)
1900 {
1901 char *s = format_hex_ex(hl->hash, digest_len, 0, 1, ":", &gc);
1902 SHOW_PARM(verify_hash, s, "%s");
1903 hl = hl->next;
1904 }
1905 gc_free(&gc);
1906 }
1907 SHOW_INT(ssl_flags);
1908
1909 SHOW_INT(tls_timeout);
1910
1911 SHOW_INT64(renegotiate_bytes);
1912 SHOW_INT64(renegotiate_packets);
1913 SHOW_INT(renegotiate_seconds);
1914
1915 SHOW_INT(handshake_window);
1916 SHOW_INT(transition_window);
1917
1918 SHOW_BOOL(single_session);
1919 SHOW_BOOL(push_peer_info);
1920 SHOW_BOOL(tls_exit);
1921
1922 SHOW_STR(tls_crypt_v2_metadata);
1923
1924#ifdef ENABLE_PKCS11
1925 {
1926 int i;
1927 for (i = 0; i < MAX_PARMS && o->pkcs11_providers[i] != NULL; i++)
1928 {
1929 SHOW_PARM(pkcs11_providers, o->pkcs11_providers[i], "%s");
1930 }
1931 }
1932 {
1933 int i;
1934 for (i = 0; i < MAX_PARMS; i++)
1935 {
1936 SHOW_PARM(pkcs11_protected_authentication,
1937 o->pkcs11_protected_authentication[i] ? "ENABLED" : "DISABLED", "%s");
1938 }
1939 }
1940 {
1941 int i;
1942 for (i = 0; i < MAX_PARMS; i++)
1943 {
1944 SHOW_PARM(pkcs11_private_mode, o->pkcs11_private_mode[i], "%08x");
1945 }
1946 }
1947 {
1948 int i;
1949 for (i = 0; i < MAX_PARMS; i++)
1950 {
1951 SHOW_PARM(pkcs11_cert_private, o->pkcs11_cert_private[i] ? "ENABLED" : "DISABLED",
1952 "%s");
1953 }
1954 }
1955 SHOW_INT(pkcs11_pin_cache_period);
1956 SHOW_STR(pkcs11_id);
1957 SHOW_BOOL(pkcs11_id_management);
1958#endif /* ENABLE_PKCS11 */
1959
1960 show_p2mp_parms(o);
1961
1962#ifdef _WIN32
1963 SHOW_BOOL(show_net_up);
1964 SHOW_INT(route_method);
1965 SHOW_BOOL(block_outside_dns);
1966 show_tuntap_options(&o->tuntap_options);
1967#endif
1968#endif /* ifndef ENABLE_SMALL */
1969}
1970
1971#undef SHOW_PARM
1972#undef SHOW_STR
1973#undef SHOW_INT
1974#undef SHOW_BOOL
1975
1976#ifdef ENABLE_MANAGEMENT
1977
1978static struct http_proxy_options *
1979parse_http_proxy_override(const char *server, const char *port, const char *flags,
1980 struct gc_arena *gc)
1981{
1982 if (server && port)
1983 {
1984 struct http_proxy_options *ho;
1985 ALLOC_OBJ_CLEAR_GC(ho, struct http_proxy_options, gc);
1986 ho->server = string_alloc(server, gc);
1987 ho->port = port;
1988 if (flags && !strcmp(flags, "nct"))
1989 {
1990 ho->auth_retry = PAR_NCT;
1991 }
1992 else
1993 {
1994 ho->auth_retry = PAR_ALL;
1995 }
1996 ho->http_version = "1.0";
1997 ho->user_agent = "OpenVPN-Autoproxy/1.0";
1998 return ho;
1999 }
2000 else
2001 {
2002 return NULL;
2003 }
2004}
2005
2006static void
2007options_postprocess_http_proxy_override(struct options *o)
2008{
2009 const struct connection_list *l = o->connection_list;
2010 int i;
2011 bool succeed = false;
2012 for (i = 0; i < l->len; ++i)
2013 {
2014 struct connection_entry *ce = l->array[i];
2015 if (ce->proto == PROTO_TCP_CLIENT || ce->proto == PROTO_TCP)
2016 {
2017 ce->http_proxy_options = o->http_proxy_override;
2018 succeed = true;
2019 }
2020 }
2021 if (succeed)
2022 {
2023 for (i = 0; i < l->len; ++i)
2024 {
2025 struct connection_entry *ce = l->array[i];
2026 if (ce->proto == PROTO_UDP)
2027 {
2028 ce->flags |= CE_DISABLED;
2029 }
2030 }
2031 }
2032 else
2033 {
2034 msg(M_WARN,
2035 "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
2036 }
2037}
2038
2039#endif /* ifdef ENABLE_MANAGEMENT */
2040
2041static struct local_list *
2042alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
2043{
2044 if (!ce->local_list)
2045 {
2046 ALLOC_OBJ_CLEAR_GC(ce->local_list, struct local_list, gc);
2047 }
2048 return ce->local_list;
2049}
2050
2051static struct local_entry *
2052alloc_local_entry(struct connection_entry *ce, const msglvl_t msglevel, struct gc_arena *gc)
2053{
2054 struct local_list *l = alloc_local_list_if_undef(ce, gc);
2055 struct local_entry *e;
2056
2057 if (l->len >= l->capacity)
2058 {
2059 const int new_cap = l->capacity + 1;
2060 const size_t elem_size = sizeof(*l->array);
2061
2062 struct local_entry **new_array = gc_realloc(l->array, new_cap * elem_size, gc);
2063 if (!new_array)
2064 {
2065 msg(msglevel,
2066 "Unable to process more local options: out of memory. Number of entries = %d",
2067 l->len);
2068 return NULL;
2069 }
2070
2071 l->array = new_array;
2072 l->capacity = new_cap;
2073 }
2074
2075 ALLOC_OBJ_CLEAR_GC(e, struct local_entry, gc);
2076 e->proto = PROTO_NONE;
2077 l->array[l->len++] = e;
2078
2079 return e;
2080}
2081
2082static struct connection_list *
2091
2092static struct connection_entry *
2093alloc_connection_entry(struct options *options, const msglvl_t msglevel)
2094{
2095 struct connection_list *l = alloc_connection_list_if_undef(options);
2096 struct connection_entry *e;
2097
2098 if (l->len == l->capacity)
2099 {
2100 int capacity = l->capacity + CONNECTION_LIST_SIZE;
2101 struct connection_entry **ce =
2102 gc_realloc(l->array, capacity * sizeof(struct connection_entry *), &options->gc);
2103 if (ce == NULL)
2104 {
2105 msg(msglevel,
2106 "Unable to process more connection options: out of memory. Number of entries = %d",
2107 l->len);
2108 return NULL;
2109 }
2110 l->array = ce;
2111 l->capacity = capacity;
2112 }
2113 ALLOC_OBJ_GC(e, struct connection_entry, &options->gc);
2114 l->array[l->len++] = e;
2115 return e;
2116}
2117
2118static struct remote_list *
2119alloc_remote_list_if_undef(struct options *options)
2120{
2121 if (!options->remote_list)
2122 {
2123 ALLOC_OBJ_CLEAR_GC(options->remote_list, struct remote_list, &options->gc);
2124 }
2125 return options->remote_list;
2126}
2127
2128static struct remote_entry *
2129alloc_remote_entry(struct options *options, const msglvl_t msglevel)
2130{
2131 struct remote_list *l = alloc_remote_list_if_undef(options);
2132 struct remote_entry *e;
2133
2134 if (l->len == l->capacity)
2135 {
2136 int capacity = l->capacity + CONNECTION_LIST_SIZE;
2137 struct remote_entry **re =
2138 gc_realloc(l->array, capacity * sizeof(struct remote_entry *), &options->gc);
2139 if (re == NULL)
2140 {
2141 msg(msglevel,
2142 "Unable to process more remote options: out of memory. Number of entries = %d",
2143 l->len);
2144 return NULL;
2145 }
2146 l->array = re;
2147 l->capacity = capacity;
2148 }
2149 ALLOC_OBJ_GC(e, struct remote_entry, &options->gc);
2150 l->array[l->len++] = e;
2151 return e;
2152}
2153
2154static struct pull_filter_list *
2155alloc_pull_filter_list(struct options *o)
2156{
2157 if (!o->pull_filter_list)
2158 {
2159 ALLOC_OBJ_CLEAR_GC(o->pull_filter_list, struct pull_filter_list, &o->gc);
2160 }
2161 return o->pull_filter_list;
2162}
2163
2164static struct pull_filter *
2165alloc_pull_filter(struct options *o)
2166{
2167 struct pull_filter_list *l = alloc_pull_filter_list(o);
2168 struct pull_filter *f;
2169
2170 ALLOC_OBJ_CLEAR_GC(f, struct pull_filter, &o->gc);
2171 if (l->head)
2172 {
2173 ASSERT(l->tail);
2174 l->tail->next = f;
2175 }
2176 else
2177 {
2178 ASSERT(!l->tail);
2179 l->head = f;
2180 }
2181 l->tail = f;
2182 return f;
2183}
2184
2185static void
2186connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
2187{
2188 if (re->remote)
2189 {
2190 ce->remote = re->remote;
2191 }
2192 if (re->remote_port)
2193 {
2194 ce->remote_port = re->remote_port;
2195 }
2196 if (re->proto >= 0)
2197 {
2198 ce->proto = re->proto;
2199 }
2200 if (re->af > 0)
2201 {
2202 ce->af = re->af;
2203 }
2204}
2205
2206static void
2207connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
2208{
2209 if (key_file && *key_file && !(*key_inline))
2210 {
2211 struct buffer in = buffer_read_from_file(*key_file, gc);
2212 if (!buf_valid(&in))
2213 {
2214 msg(M_FATAL, "Cannot pre-load keyfile (%s)", *key_file);
2215 }
2216
2217 *key_file = (const char *)in.data;
2218 *key_inline = true;
2219 }
2220}
2221
2222static void
2223check_ca_required(const struct options *options)
2224{
2225#ifdef ENABLE_CRYPTO_MBEDTLS
2226 if (options->ca_path)
2227 {
2228 msg(M_USAGE, "Parameter --capath cannot be used with the mbed TLS version of OpenVPN.");
2229 }
2230#endif
2231
2232 if (options->verify_hash_no_ca || options->pkcs12_file || options->ca_file
2233#ifndef ENABLE_CRYPTO_MBEDTLS
2234 || options->ca_path
2235#endif
2236 )
2237 {
2238 return;
2239 }
2240
2241 const char *const str = "You must define CA file (--ca)"
2242#ifndef ENABLE_CRYPTO_MBEDTLS
2243 " or CA path (--capath)"
2244#endif
2245 " and/or peer fingerprint verification (--peer-fingerprint)";
2246 msg(M_USAGE, "%s", str);
2247}
2248
2249#define MUST_BE_UNDEF(parm, parm_name) \
2250 if (options->parm != defaults.parm) \
2251 { \
2252 msg(M_USAGE, use_err, parm_name); \
2253 }
2254#define MUST_BE_FALSE(condition, parm_name) \
2255 if (condition) \
2256 { \
2257 msg(M_USAGE, use_err, parm_name); \
2258 }
2259
2260static void
2261options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
2262{
2263 struct options defaults;
2264 int dev = DEV_TYPE_UNDEF;
2265 bool pull = false;
2266
2267 init_options(&defaults);
2268
2269 if (!options->test_crypto)
2270 {
2271 notnull(options->dev, "TUN/TAP device (--dev)");
2272 }
2273
2274 /*
2275 * Get tun/tap/null device type
2276 */
2277 dev = dev_type_enum(options->dev, options->dev_type);
2278
2279 /*
2280 * If "proto tcp" is specified, make sure we know whether it is
2281 * tcp-client or tcp-server.
2282 */
2283 if (ce->proto == PROTO_TCP)
2284 {
2285 msg(M_USAGE, "--proto tcp is ambiguous in this context. Please specify "
2286 "--proto tcp-server or --proto tcp-client");
2287 }
2288
2289 /*
2290 * Sanity check on Client mode
2291 */
2292
2293 if (options->mode != MODE_SERVER && ce->local_list->len > 1)
2294 {
2295 msg(M_USAGE, "multiple --local statements only allowed in --server mode");
2296 }
2297
2298 if (options->lladdr && dev != DEV_TYPE_TAP)
2299 {
2300 msg(M_USAGE, "--lladdr can only be used in --dev tap mode");
2301 }
2302
2303 /*
2304 * Sanity check on MTU parameters
2305 */
2306 if (options->ce.tun_mtu_defined && options->ce.link_mtu_defined)
2307 {
2308 msg(M_USAGE, "only one of --tun-mtu or --link-mtu may be defined");
2309 }
2310
2311 if (!proto_is_udp(ce->proto) && options->mtu_test)
2312 {
2313 msg(M_USAGE, "--mtu-test only makes sense with --proto udp");
2314 }
2315
2316 /* will we be pulling options from server? */
2317 pull = options->pull;
2318
2319 /*
2320 * Sanity check on --local, --remote, and --ifconfig
2321 */
2322
2323 if (string_defined_equal(ce->remote, options->ifconfig_local)
2324 || string_defined_equal(ce->remote, options->ifconfig_remote_netmask))
2325 {
2326 msg(M_USAGE, "--local and --remote addresses must be distinct from --ifconfig "
2327 "addresses");
2328 }
2329
2330 if (string_defined_equal(options->ifconfig_local, options->ifconfig_remote_netmask))
2331 {
2332 msg(M_USAGE, "local and remote/netmask --ifconfig addresses must be different");
2333 }
2334
2335 if (ce->bind_defined && !ce->bind_local)
2336 {
2337 msg(M_USAGE, "--bind and --nobind can't be used together");
2338 }
2339
2340 if (ce->local_port_defined && !ce->bind_local)
2341 {
2342 msg(M_USAGE, "--lport and --nobind don't make sense when used together");
2343 }
2344
2345 if (!ce->remote && !ce->bind_local)
2346 {
2347 msg(M_USAGE, "--nobind doesn't make sense unless used with --remote");
2348 }
2349
2350 for (int i = 0; i < ce->local_list->len; i++)
2351 {
2352 struct local_entry *le = ce->local_list->array[i];
2353
2354 if (proto_is_net(le->proto) && string_defined_equal(le->local, ce->remote)
2355 && string_defined_equal(le->port, ce->remote_port))
2356 {
2357 msg(M_USAGE, "--remote and one of the --local addresses are the same");
2358 }
2359
2360 if (string_defined_equal(le->local, options->ifconfig_local)
2361 || string_defined_equal(le->local, options->ifconfig_remote_netmask))
2362 {
2363 msg(M_USAGE, "--local addresses must be distinct from --ifconfig addresses");
2364 }
2365
2366 if (le->local && !ce->bind_local)
2367 {
2368 msg(M_USAGE, "--local and --nobind don't make sense when used together");
2369 }
2370 }
2371
2372 /*
2373 * Check for consistency of management options
2374 */
2375#ifdef ENABLE_MANAGEMENT
2376 if (!options->management_addr
2377 && (options->management_flags
2378 || options->management_log_history_cache != defaults.management_log_history_cache))
2379 {
2380 msg(M_USAGE,
2381 "--management is not specified, however one or more options which modify the behavior of --management were specified");
2382 }
2383
2384 if ((options->management_client_user || options->management_client_group)
2385 && !(options->management_flags & MF_UNIX_SOCK))
2386 {
2387 msg(M_USAGE, "--management-client-(user|group) can only be used on unix domain sockets");
2388 }
2389
2390 if (options->management_addr && !(options->management_flags & MF_UNIX_SOCK)
2391 && (!options->management_user_pass))
2392 {
2393 msg(M_WARN, "WARNING: Using --management on a TCP port WITHOUT "
2394 "passwords is STRONGLY discouraged and considered insecure");
2395 }
2396
2397#endif /* ifdef ENABLE_MANAGEMENT */
2398
2399#if !defined(HAVE_XKEY_PROVIDER)
2400 if ((tls_version_max() >= TLS_VER_1_3) && (options->management_flags & MF_EXTERNAL_KEY)
2401 && !(options->management_flags & (MF_EXTERNAL_KEY_NOPADDING)))
2402 {
2403 msg(M_FATAL, "management-external-key with TLS 1.3 or later requires "
2404 "nopadding argument/support");
2405 }
2406#endif
2407 /*
2408 * Windows-specific options.
2409 */
2410
2411#ifdef _WIN32
2412 if (dev == DEV_TYPE_TUN
2413 && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
2414 {
2415 msg(M_USAGE, "On Windows, --ifconfig is required when --dev tun is used");
2416 }
2417
2418 if ((options->tuntap_options.ip_win32_defined)
2419 && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
2420 {
2421 msg(M_USAGE, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
2422 }
2423
2424 if (options->tuntap_options.dhcp_options & DHCP_OPTIONS_DHCP_REQUIRED)
2425 {
2426 const char *prefix = "Some --dhcp-option or --dns options require DHCP server";
2427 if (options->windows_driver != WINDOWS_DRIVER_TAP_WINDOWS6)
2428 {
2429 msg(M_USAGE, "%s, which is not supported by the selected %s driver", prefix,
2430 print_tun_backend_driver(options->windows_driver));
2431 }
2432 else if (options->tuntap_options.ip_win32_type != IPW32_SET_DHCP_MASQ
2433 && options->tuntap_options.ip_win32_type != IPW32_SET_ADAPTIVE)
2434 {
2435 msg(M_USAGE, "%s, which requires --ip-win32 dynamic or adaptive", prefix);
2436 }
2437 }
2438#endif /* ifdef _WIN32 */
2439
2440 /*
2441 * Check that protocol options make sense.
2442 */
2443
2444#ifdef ENABLE_FRAGMENT
2445 if (!proto_is_udp(ce->proto) && ce->fragment)
2446 {
2447 msg(M_USAGE, "--fragment can only be used with --proto udp");
2448 }
2449#endif
2450
2451 if (!ce->remote && ce->proto == PROTO_TCP_CLIENT)
2452 {
2453 msg(M_USAGE, "--remote MUST be used in TCP Client mode");
2454 }
2455
2456 if ((ce->http_proxy_options) && ce->proto != PROTO_TCP_CLIENT)
2457 {
2458 msg(M_USAGE, "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
2459 "tcp-client)");
2460 }
2461
2462 if ((ce->http_proxy_options) && !ce->http_proxy_options->server)
2463 {
2464 msg(M_USAGE, "--http-proxy not specified but other http proxy options present");
2465 }
2466
2467 if (ce->http_proxy_options && ce->socks_proxy_server)
2468 {
2469 msg(M_USAGE, "--http-proxy can not be used together with --socks-proxy");
2470 }
2471
2472 if (ce->socks_proxy_server && ce->proto == PROTO_TCP_SERVER)
2473 {
2474 msg(M_USAGE, "--socks-proxy can not be used in TCP Server mode");
2475 }
2476
2477 if (ce->proto == PROTO_TCP_SERVER && (options->connection_list->len > 1))
2478 {
2479 msg(M_USAGE, "TCP server mode allows at most one --remote address");
2480 }
2481
2482 /*
2483 * Check consistency of --mode server options.
2484 */
2485 if (options->mode == MODE_SERVER)
2486 {
2487 const char use_err[] = "--%s cannot be used with --mode server.";
2488
2489#define USAGE_VALID_SERVER_PROTOS \
2490 "--mode server currently only supports " \
2491 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
2492#ifdef TARGET_ANDROID
2493 msg(M_FATAL, "--mode server not supported on Android");
2494#endif
2495 if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP))
2496 {
2497 msg(M_USAGE, "--mode server only works with --dev tun or --dev tap");
2498 }
2499 MUST_BE_UNDEF(pull, "pull");
2500 if (options->pull_filter_list)
2501 {
2502 msg(M_WARN, "--pull-filter ignored for --mode server");
2503 }
2504 if (!(proto_is_udp(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2505 {
2506 msg(M_USAGE, USAGE_VALID_SERVER_PROTOS);
2507 }
2508#if PORT_SHARE
2509 bool has_tcp = false;
2510 for (int i = 0; i < ce->local_list->len && !has_tcp; i++)
2511 {
2512 has_tcp = (ce->local_list->array[i]->proto == PROTO_TCP_SERVER);
2513 }
2514 if ((options->port_share_host || options->port_share_port)
2515 && !has_tcp)
2516 {
2517 msg(M_USAGE, "--port-share only works in TCP server mode "
2518 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
2519 }
2520#endif
2521 if (!options->tls_server)
2522 {
2523 msg(M_USAGE, "--mode server requires --tls-server");
2524 }
2525 MUST_BE_FALSE(ce->remote, "remote");
2526 MUST_BE_FALSE(!ce->bind_local, "nobind");
2527 MUST_BE_FALSE(ce->http_proxy_options, "http-proxy");
2528 MUST_BE_FALSE(ce->socks_proxy_server, "socks-proxy");
2529 /* <connection> blocks force to have a remote embedded, so we check
2530 * for the --remote and bail out if it is present
2531 */
2532 if (options->connection_list->len > 1 || options->connection_list->array[0]->remote)
2533 {
2534 msg(M_USAGE, "<connection> cannot be used with --mode server");
2535 }
2536
2537 MUST_BE_UNDEF(shaper, "shaper");
2538 if (options->ipchange)
2539 {
2540 msg(M_USAGE, "--ipchange cannot be used with --mode server (use "
2541 "--client-connect instead)");
2542 }
2543 if (!(proto_is_dgram(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2544 {
2545 msg(M_USAGE, USAGE_VALID_SERVER_PROTOS);
2546 }
2547 if (!proto_is_udp(ce->proto) && (options->cf_max || options->cf_per))
2548 {
2549 msg(M_USAGE,
2550 "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
2551 }
2552 if (!(dev == DEV_TYPE_TAP || (dev == DEV_TYPE_TUN && options->topology == TOP_SUBNET))
2553 && options->ifconfig_pool_netmask)
2554 {
2555 msg(M_USAGE,
2556 "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
2557 }
2558 if (options->routes && (options->routes->flags & RG_ENABLE))
2559 {
2560 msg(M_USAGE,
2561 "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
2562 }
2563 MUST_BE_UNDEF(route_delay_defined, "route-delay");
2564 MUST_BE_UNDEF(up_delay, "up-delay");
2565 if (!options->ifconfig_pool_defined && !options->ifconfig_ipv6_pool_defined
2566 && options->ifconfig_pool_persist_filename)
2567 {
2568 msg(M_USAGE,
2569 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
2570 }
2571 if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local)
2572 {
2573 msg(M_USAGE, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
2574 }
2575 MUST_BE_UNDEF(allow_recursive_routing, "allow-recursive-routing");
2576 if (options->auth_user_pass_file)
2577 {
2578 msg(M_USAGE,
2579 "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
2580 }
2581 if (options->ccd_exclusive && !options->client_config_dir)
2582 {
2583 msg(M_USAGE, "--ccd-exclusive must be used with --client-config-dir");
2584 }
2585 if (options->auth_token_generate && !options->renegotiate_seconds)
2586 {
2587 msg(M_USAGE, "--auth-gen-token needs a non-infinite "
2588 "--renegotiate_seconds setting");
2589 }
2590 if (options->auth_token_generate && options->auth_token_renewal
2591 && options->auth_token_renewal < 2 * options->handshake_window)
2592 {
2593 msg(M_USAGE,
2594 "--auth-gen-token renewal time needs to be at least "
2595 " two times --hand-window (%d).",
2596 options->handshake_window);
2597 }
2598 if (!options->auth_user_pass_verify_script && !PLUGIN_OPTION_LIST(options)
2599 && !MAN_CLIENT_AUTH_ENABLED(options))
2600 {
2601 const char *use_err =
2602 "--%s must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
2603
2604 MUST_BE_FALSE(options->ssl_flags
2605 & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL),
2606 "verify-client-cert none|optional");
2607 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME,
2608 "username-as-common-name");
2609 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL,
2610 "auth-user-pass-optional");
2611 }
2612
2613 if (options->vlan_tagging && dev != DEV_TYPE_TAP)
2614 {
2615 msg(M_USAGE, "--vlan-tagging must be used with --dev tap");
2616 }
2617 if (!options->vlan_tagging)
2618 {
2619 const char use_err[] = "--%s requires --vlan-tagging";
2620 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2621 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2622 }
2623
2624 if (options->server_flags & SF_TCP_NODELAY_HELPER)
2625 {
2626 msg(M_INFO, "NOTE: TCP_NODELAY is always enabled locally; "
2627 "--tcp-nodelay is now only useful to push the flag to "
2628 "clients older than 2.7.6.");
2629 }
2630 }
2631 else
2632 {
2633 const char use_err[] = "--%s requires --mode server";
2634 /*
2635 * When not in server mode, err if parameters are
2636 * specified which require --mode server.
2637 */
2638 MUST_BE_UNDEF(ifconfig_pool_defined, "ifconfig-pool");
2639 MUST_BE_UNDEF(ifconfig_pool_persist_filename, "ifconfig-pool-persist");
2640 MUST_BE_UNDEF(ifconfig_ipv6_pool_defined, "ifconfig-ipv6-pool");
2641 MUST_BE_UNDEF(real_hash_size, "hash-size");
2642 MUST_BE_UNDEF(virtual_hash_size, "hash-size");
2643 MUST_BE_UNDEF(learn_address_script, "learn-address");
2644 MUST_BE_UNDEF(client_connect_script, "client-connect");
2645 MUST_BE_UNDEF(client_crresponse_script, "client-crresponse");
2646 MUST_BE_UNDEF(client_disconnect_script, "client-disconnect");
2647 MUST_BE_UNDEF(client_config_dir, "client-config-dir");
2648 MUST_BE_UNDEF(ccd_exclusive, "ccd-exclusive");
2649 MUST_BE_UNDEF(enable_c2c, "client-to-client");
2650 MUST_BE_UNDEF(duplicate_cn, "duplicate-cn");
2651 MUST_BE_UNDEF(cf_max, "connect-freq");
2652 MUST_BE_UNDEF(cf_per, "connect-freq");
2653 MUST_BE_FALSE(options->ssl_flags
2654 & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL),
2655 "verify-client-cert");
2656 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME, "username-as-common-name");
2657 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL, "auth-user-pass-optional");
2658 if (options->server_flags & SF_TCP_NODELAY_HELPER)
2659 {
2660 msg(M_WARN, "DEPRECATED OPTION: --tcp-nodelay is always enabled on clients");
2661 }
2662 MUST_BE_UNDEF(auth_user_pass_verify_script, "auth-user-pass-verify");
2663 MUST_BE_UNDEF(auth_token_generate, "auth-gen-token");
2664#if PORT_SHARE
2665 if (options->port_share_host || options->port_share_port)
2666 {
2667 msg(M_USAGE,
2668 "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2669 }
2670#endif
2671 MUST_BE_UNDEF(stale_routes_check_interval, "stale-routes-check");
2672 MUST_BE_UNDEF(vlan_tagging, "vlan-tagging");
2673 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2674 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2675 MUST_BE_UNDEF(force_key_material_export, "force-key-material-export");
2676
2677 if (options->push_list.head)
2678 {
2679 msg(M_WARN, "Note: Using --push without --mode server is an "
2680 "unsupported configuration. Negotiation of OpenVPN "
2681 "features is expected to fail.");
2682 }
2683 }
2684
2685 /*
2686 * SSL/TLS mode sanity checks.
2687 */
2688 if (options->tls_server + options->tls_client + (options->shared_secret_file != NULL) > 1)
2689 {
2690 msg(M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
2691 }
2692
2693 if (!options->tls_server && !options->tls_client && !options->test_crypto)
2694 {
2695 msglvl_t msglevel = M_USAGE;
2696 if (options->allow_deprecated_insecure_static_crypto)
2697 {
2698 msglevel = M_INFO;
2699 }
2700
2701 msg(msglevel, "DEPRECATION: No tls-client or tls-server option in "
2702 "configuration detected. OpenVPN 2.8 will remove the "
2703 "functionality to run a VPN without TLS. "
2704 "See the examples section in the manual page for "
2705 "examples of a similar quick setup with peer-fingerprint. "
2706 "OpenVPN 2.7 allows using this configuration when using "
2707 "--allow-deprecated-insecure-static-crypto but you should move "
2708 "to a proper configuration using TLS as soon as possible.");
2709 }
2710
2711 if (options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL))
2712 {
2713 msg(M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
2714 "--verify-client-cert none|optional "
2715 "may accept clients which do not present a certificate");
2716 }
2717
2718 const unsigned int tls_version_max =
2719 (options->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) & SSLF_TLS_VERSION_MAX_MASK;
2720 const unsigned int tls_version_min =
2721 (options->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT) & SSLF_TLS_VERSION_MIN_MASK;
2722
2723 if (tls_version_max > 0 && tls_version_max < tls_version_min)
2724 {
2725 msg(M_USAGE, "--tls-version-min bigger than --tls-version-max");
2726 }
2727
2728 if (options->tls_server || options->tls_client)
2729 {
2730 check_ca_required(options);
2731#ifdef ENABLE_PKCS11
2732 if (!options->pkcs11_providers[0] && options->pkcs11_id)
2733 {
2734 msg(M_WARN, "Option pkcs11-id is ignored as no pkcs11-providers are specified");
2735 }
2736 else if (!options->pkcs11_providers[0] && options->pkcs11_id_management)
2737 {
2738 msg(M_WARN,
2739 "Option pkcs11-id-management is ignored as no pkcs11-providers are specified");
2740 }
2741
2742 if (options->pkcs11_providers[0])
2743 {
2744 if (options->pkcs11_id_management && options->pkcs11_id != NULL)
2745 {
2746 msg(M_USAGE,
2747 "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2748 }
2749 if (!options->pkcs11_id_management && options->pkcs11_id == NULL)
2750 {
2751 msg(M_USAGE,
2752 "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2753 }
2754 const char use_err[] =
2755 "Parameter --%s cannot be used when --pkcs11-provider is also specified.";
2756 MUST_BE_UNDEF(cert_file, "cert");
2757 MUST_BE_UNDEF(priv_key_file, "key");
2758 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2759 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2760 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2761#ifdef ENABLE_CRYPTOAPI
2762 MUST_BE_UNDEF(cryptoapi_cert, "cryptoapicert");
2763#endif
2764 }
2765 else
2766#endif /* ifdef ENABLE_PKCS11 */
2767#ifdef ENABLE_CRYPTOAPI
2768 if (options->cryptoapi_cert)
2769 {
2770 const char use_err[] =
2771 "Parameter --%s cannot be used when --cryptoapicert is also specified.";
2772 MUST_BE_UNDEF(cert_file, "cert");
2773 MUST_BE_UNDEF(priv_key_file, "key");
2774 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2775 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2776 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2777 }
2778 else
2779#endif
2780 if (options->pkcs12_file)
2781 {
2782#ifdef ENABLE_CRYPTO_MBEDTLS
2783 msg(M_USAGE, "Parameter --pkcs12 cannot be used with the mbed TLS version of OpenVPN.");
2784#else
2785 const char use_err[] = "Parameter --%s cannot be used when --pkcs12 is also specified.";
2786 MUST_BE_UNDEF(ca_path, "capath");
2787 MUST_BE_UNDEF(cert_file, "cert");
2788 MUST_BE_UNDEF(priv_key_file, "key");
2789 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2790 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2791#endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2792 }
2793 else /* cert/key from none of pkcs11, pkcs12, cryptoapi */
2794 {
2795 if ((options->management_flags & MF_EXTERNAL_KEY) && options->priv_key_file)
2796 {
2797 msg(M_USAGE, "--key and --management-external-key are mutually exclusive");
2798 }
2799 if ((options->management_flags & MF_EXTERNAL_CERT))
2800 {
2801 if (options->cert_file)
2802 {
2803 msg(M_USAGE, "--cert and --management-external-cert are mutually exclusive");
2804 }
2805 else if (!(options->management_flags & MF_EXTERNAL_KEY))
2806 {
2807 msg(M_USAGE,
2808 "--management-external-cert must be used with --management-external-key");
2809 }
2810 }
2811 if (pull)
2812 {
2813 const int sum =
2814 ((options->cert_file != NULL) || (options->management_flags & MF_EXTERNAL_CERT))
2815 + ((options->priv_key_file != NULL)
2816 || (options->management_flags & MF_EXTERNAL_KEY));
2817
2818 if (sum == 0)
2819 {
2820 if (!options->auth_user_pass_file)
2821 {
2822 msg(M_USAGE, "No client-side authentication method is "
2823 "specified. You must use either "
2824 "--cert/--key, --pkcs12, or "
2825 "--auth-user-pass");
2826 }
2827 }
2828 else if (sum != 2)
2829 {
2830 msg(M_USAGE, "If you use one of --cert or --key, you must use them both");
2831 }
2832 }
2833 else
2834 {
2835 if (!(options->management_flags & MF_EXTERNAL_CERT))
2836 {
2837 notnull(options->cert_file,
2838 "certificate file (--cert) or PKCS#12 file (--pkcs12)");
2839 }
2840 if (!(options->management_flags & MF_EXTERNAL_KEY))
2841 {
2842 notnull(options->priv_key_file,
2843 "private key file (--key) or PKCS#12 file (--pkcs12)");
2844 }
2845 }
2846 }
2847 if (ce->tls_auth_file && ce->tls_crypt_file)
2848 {
2849 msg(M_USAGE, "--tls-auth and --tls-crypt are mutually exclusive");
2850 }
2851 if (options->tls_client && ce->tls_crypt_v2_file
2852 && (ce->tls_auth_file || ce->tls_crypt_file))
2853 {
2854 msg(M_USAGE,
2855 "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
2856 }
2857 }
2858 else
2859 {
2860 /*
2861 * Make sure user doesn't specify any TLS options
2862 * when in non-TLS mode.
2863 */
2864
2865 const char use_err[] = "Parameter %s can only be specified in TLS-mode, "
2866 "i.e. where --tls-server or --tls-client is also specified.";
2867
2868 MUST_BE_UNDEF(ca_file, "ca");
2869 MUST_BE_UNDEF(ca_path, "capath");
2870 MUST_BE_UNDEF(dh_file, "dh");
2871 MUST_BE_UNDEF(cert_file, "cert");
2872 MUST_BE_UNDEF(priv_key_file, "key");
2873#ifndef ENABLE_CRYPTO_MBEDTLS
2874 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2875#endif
2876 MUST_BE_UNDEF(cipher_list, "tls-cipher");
2877 MUST_BE_UNDEF(cipher_list_tls13, "tls-ciphersuites");
2878 MUST_BE_UNDEF(tls_cert_profile, "tls-cert-profile");
2879 MUST_BE_UNDEF(tls_verify, "tls-verify");
2880 MUST_BE_UNDEF(tls_export_peer_cert_dir, "tls-export-cert");
2881 MUST_BE_UNDEF(verify_x509_name, "verify-x509-name");
2882 MUST_BE_UNDEF(tls_timeout, "tls-timeout");
2883 MUST_BE_UNDEF(renegotiate_bytes, "reneg-bytes");
2884 MUST_BE_UNDEF(renegotiate_packets, "reneg-pkts");
2885 MUST_BE_UNDEF(renegotiate_seconds, "reneg-sec");
2886 MUST_BE_UNDEF(handshake_window, "hand-window");
2887 MUST_BE_UNDEF(transition_window, "tran-window");
2888 MUST_BE_UNDEF(tls_auth_file, "tls-auth");
2889 MUST_BE_UNDEF(tls_crypt_file, "tls-crypt");
2890 MUST_BE_UNDEF(tls_crypt_v2_file, "tls-crypt-v2");
2891 MUST_BE_UNDEF(single_session, "single-session");
2892 MUST_BE_UNDEF(push_peer_info, "push-peer-info");
2893 MUST_BE_UNDEF(tls_exit, "tls-exit");
2894 MUST_BE_UNDEF(crl_file, "crl-verify");
2895 MUST_BE_UNDEF(ns_cert_type, "ns-cert-type");
2896 MUST_BE_UNDEF(remote_cert_ku[0], "remote-cert-ku");
2897 MUST_BE_UNDEF(remote_cert_eku, "remote-cert-eku");
2898#ifdef ENABLE_PKCS11
2899 MUST_BE_UNDEF(pkcs11_providers[0], "pkcs11-providers");
2900 MUST_BE_UNDEF(pkcs11_private_mode[0], "pkcs11-private-mode");
2901 MUST_BE_UNDEF(pkcs11_id, "pkcs11-id");
2902 MUST_BE_UNDEF(pkcs11_id_management, "pkcs11-id-management");
2903#endif
2904
2905 if (pull)
2906 {
2907 msg(M_USAGE, use_err, "--pull");
2908 }
2909 }
2910 if (options->auth_user_pass_file && !options->pull)
2911 {
2912 msg(M_USAGE, "--auth-user-pass requires --pull");
2913 }
2914
2915 uninit_options(&defaults);
2916}
2917
2918#undef MUST_BE_UNDEF
2919#undef MUST_BE_FALSE
2920
2921static void
2922options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
2923{
2924 const int dev = dev_type_enum(o->dev, o->dev_type);
2925
2926 if (o->server_defined || o->server_bridge_defined || o->server_bridge_proxy_dhcp)
2927 {
2928 if (ce->proto == PROTO_TCP)
2929 {
2930 ce->proto = PROTO_TCP_SERVER;
2931 o->ce.proto = ce->proto;
2932 }
2933 }
2934
2935 if (o->mode != MODE_SERVER)
2936 {
2937 if (ce->proto == PROTO_TCP)
2938 {
2939 ce->proto = PROTO_TCP_CLIENT;
2940 o->ce.proto = ce->proto;
2941 }
2942 }
2943
2944 /* an option is present that requires local bind to enabled */
2945 bool need_bind = ce->local_port_defined || ce->bind_defined || ce->local_list;
2946
2947 /* socks proxy is enabled */
2948 bool uses_socks = ce->proto == PROTO_UDP && ce->socks_proxy_server;
2949
2950 /* If binding is not forced by an explicit option and we have (at least)
2951 * one of --tcp-client, --pull (or --client), or socks we do not bind
2952 * locally to have "normal" IP client behaviour of a random source port */
2953 if (!need_bind && (ce->proto == PROTO_TCP_CLIENT || uses_socks || o->pull))
2954 {
2955 ce->bind_local = false;
2956 }
2957
2958 if (!ce->bind_local)
2959 {
2960 ce->local_port = NULL;
2961 }
2962
2963 /* if protocol forcing is enabled, disable all protocols
2964 * except for the forced one
2965 */
2966 if (o->proto_force >= 0 && o->proto_force != ce->proto)
2967 {
2968 ce->flags |= CE_DISABLED;
2969 }
2970
2971 if (ce->http_proxy_options)
2972 {
2973 ce->http_proxy_options->nocache = ssl_get_auth_nocache();
2974 }
2975
2976 /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
2977 * so fall back to IPv4-only (trac #1221)
2978 */
2979 if (ce->socks_proxy_server && proto_is_udp(ce->proto) && ce->af != AF_INET)
2980 {
2981 if (ce->af == AF_INET6)
2982 {
2983 msg(M_INFO, "WARNING: '--proto udp6' is not compatible with "
2984 "'--socks-proxy' today. Forcing IPv4 mode.");
2985 }
2986 else
2987 {
2988 msg(M_INFO, "NOTICE: dual-stack mode for '--proto udp' does not "
2989 "work correctly with '--socks-proxy' today. Forcing IPv4.");
2990 }
2991 ce->af = AF_INET;
2992 }
2993
2994 /*
2995 * Set MTU defaults
2996 */
2997 {
2998 if (!ce->tun_mtu_defined && !ce->link_mtu_defined)
2999 {
3000 ce->tun_mtu_defined = true;
3001 }
3002 if ((dev == DEV_TYPE_TAP) && !ce->tun_mtu_extra_defined)
3003 {
3004 ce->tun_mtu_extra_defined = true;
3005 ce->tun_mtu_extra = TAP_MTU_EXTRA_DEFAULT;
3006 }
3007 }
3008
3009 /*
3010 * If --mssfix is supplied without a parameter or not specified at all,
3011 * default it to --fragment value, if --fragment is specified and otherwise
3012 * to the default if tun-mtu is 1500
3013 */
3014 if (o->ce.mssfix_default)
3015 {
3016#ifdef ENABLE_FRAGMENT
3017 if (ce->fragment)
3018 {
3019 ce->mssfix = ce->fragment;
3020 }
3021 else
3022#endif
3023 if (ce->tun_mtu_defined)
3024 {
3025 if (o->ce.tun_mtu == TUN_MTU_DEFAULT)
3026 {
3027 /* We want to only set mssfix default value if we use a default
3028 * MTU Size, otherwise the different size of tun should either
3029 * already solve the problem or mssfix might artifically make the
3030 * payload packets smaller without mssfix 0 */
3031 ce->mssfix = MSSFIX_DEFAULT;
3032 ce->mssfix_encap = true;
3033 }
3034 else
3035 {
3036 /* We still apply the mssfix value but only adjust it to the
3037 * size of the tun interface. */
3038 ce->mssfix = ce->tun_mtu;
3039 ce->mssfix_fixed = true;
3040 }
3041 }
3042 }
3043
3044 /*
3045 * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
3046 *
3047 * At the end only one of these will be really set because the parser
3048 * logic prevents configurations where more are set.
3049 */
3050 if (!ce->tls_auth_file && !ce->tls_crypt_file && !ce->tls_crypt_v2_file)
3051 {
3052 ce->tls_auth_file = o->tls_auth_file;
3053 ce->tls_auth_file_inline = o->tls_auth_file_inline;
3054 ce->key_direction = o->key_direction;
3055
3056 ce->tls_crypt_file = o->tls_crypt_file;
3057 ce->tls_crypt_file_inline = o->tls_crypt_file_inline;
3058
3059 ce->tls_crypt_v2_file = o->tls_crypt_v2_file;
3060 ce->tls_crypt_v2_file_inline = o->tls_crypt_v2_file_inline;
3061 }
3062
3063 /* Pre-cache tls-auth/crypt(-v2) key file if
3064 * keys were not already embedded in the config file.
3065 */
3066 connection_entry_preload_key(&ce->tls_auth_file, &ce->tls_auth_file_inline, &o->gc);
3067 connection_entry_preload_key(&ce->tls_crypt_file, &ce->tls_crypt_file_inline, &o->gc);
3068 connection_entry_preload_key(&ce->tls_crypt_v2_file, &ce->tls_crypt_v2_file_inline, &o->gc);
3069
3070
3071 if (!proto_is_udp(ce->proto) && ce->explicit_exit_notification)
3072 {
3073 msg(M_WARN, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
3074 ce->explicit_exit_notification = 0;
3075 }
3076}
3077
3078static void
3079options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
3080{
3081 /* use the global port if none is specified */
3082 if (!le->port)
3083 {
3084 le->port = ce->local_port;
3085 }
3086 /* use the global proto if none is specified and
3087 * allow proto bindings on server mode only */
3088 if (!le->proto || mode == MODE_POINT_TO_POINT)
3089 {
3090 le->proto = ce->proto;
3091 }
3092}
3093
3094#ifdef _WIN32
3095/* If iservice is in use, we need def1 method for redirect-gateway */
3096static void
3097remap_redirect_gateway_flags(struct options *opt)
3098{
3099 if (opt->routes && opt->route_method == ROUTE_METHOD_SERVICE
3100 && opt->routes->flags & RG_REROUTE_GW && !(opt->routes->flags & RG_DEF1))
3101 {
3102 msg(M_INFO, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
3103 opt->routes->flags |= RG_DEF1;
3104 }
3105}
3106#endif /* ifdef _WIN32 */
3107
3108/*
3109 * Save/Restore certain option defaults before --pull is applied.
3110 */
3111
3112static void
3113pre_connect_save(struct options *o)
3114{
3115 ALLOC_OBJ_CLEAR_GC(o->pre_connect, struct options_pre_connect, &o->gc);
3116 o->pre_connect->tuntap_options = o->tuntap_options;
3117 o->pre_connect->tuntap_options_defined = true;
3118 o->pre_connect->foreign_option_index = o->foreign_option_index;
3119
3120 if (o->routes)
3121 {
3122 o->pre_connect->routes = clone_route_option_list(o->routes, &o->gc);
3123 o->pre_connect->routes_defined = true;
3124 }
3125 if (o->routes_ipv6)
3126 {
3127 o->pre_connect->routes_ipv6 = clone_route_ipv6_option_list(o->routes_ipv6, &o->gc);
3128 o->pre_connect->routes_ipv6_defined = true;
3129 }
3130 if (o->client_nat)
3131 {
3132 o->pre_connect->client_nat = clone_client_nat_option_list(o->client_nat, &o->gc);
3133 o->pre_connect->client_nat_defined = true;
3134 }
3135
3136 o->pre_connect->ifconfig_local = o->ifconfig_local;
3137 o->pre_connect->ifconfig_ipv6_local = o->ifconfig_ipv6_local;
3138
3139 o->pre_connect->route_default_gateway = o->route_default_gateway;
3140 o->pre_connect->route_ipv6_default_gateway = o->route_ipv6_default_gateway;
3141
3142 o->pre_connect->dns_options = clone_dns_options(&o->dns_options, &o->gc);
3143
3144 /* NCP related options that can be overwritten by a push */
3145 o->pre_connect->ciphername = o->ciphername;
3146 o->pre_connect->authname = o->authname;
3147
3148 /* Ping related options should be reset to the config values on reconnect */
3149 o->pre_connect->ping_rec_timeout = o->ping_rec_timeout;
3150 o->pre_connect->ping_rec_timeout_action = o->ping_rec_timeout_action;
3151 o->pre_connect->ping_send_timeout = o->ping_send_timeout;
3152
3153 /* Miscellaneous Options */
3154 o->pre_connect->comp = o->comp;
3155}
3156
3157void
3158pre_connect_restore(struct options *o, struct gc_arena *gc)
3159{
3160 const struct options_pre_connect *pp = o->pre_connect;
3161 if (pp)
3162 {
3163 CLEAR(o->tuntap_options);
3164 if (pp->tuntap_options_defined)
3165 {
3166 o->tuntap_options = pp->tuntap_options;
3167 }
3168
3169 if (pp->routes_defined)
3170 {
3171 rol_check_alloc(o);
3172 copy_route_option_list(o->routes, pp->routes, gc);
3173 }
3174 else
3175 {
3176 o->routes = NULL;
3177 }
3178
3179 if (pp->routes_ipv6_defined)
3180 {
3181 rol6_check_alloc(o);
3182 copy_route_ipv6_option_list(o->routes_ipv6, pp->routes_ipv6, gc);
3183 }
3184 else
3185 {
3186 o->routes_ipv6 = NULL;
3187 }
3188
3189 o->ifconfig_local = pp->ifconfig_local;
3190 o->ifconfig_ipv6_local = pp->ifconfig_ipv6_local;
3191
3192 o->route_default_gateway = pp->route_default_gateway;
3193 o->route_ipv6_default_gateway = pp->route_ipv6_default_gateway;
3194
3195 /* Free DNS options and reset them to pre-pull state */
3196 gc_free(&o->dns_options.gc);
3197 struct gc_arena dns_gc = gc_new();
3198 o->dns_options = clone_dns_options(&pp->dns_options, &dns_gc);
3199 o->dns_options.gc = dns_gc;
3200
3201 if (pp->client_nat_defined)
3202 {
3203 cnol_check_alloc(o);
3204 copy_client_nat_option_list(o->client_nat, pp->client_nat);
3205 }
3206 else
3207 {
3208 o->client_nat = NULL;
3209 }
3210
3211 o->foreign_option_index = pp->foreign_option_index;
3212
3213 o->ciphername = pp->ciphername;
3214 o->authname = pp->authname;
3215
3216 o->ping_rec_timeout = pp->ping_rec_timeout;
3217 o->ping_rec_timeout_action = pp->ping_rec_timeout_action;
3218 o->ping_send_timeout = pp->ping_send_timeout;
3219
3220 /* Miscellaneous Options */
3221 o->comp = pp->comp;
3222 }
3223
3224 o->push_continuation = 0;
3225 o->push_option_types_found = 0;
3226 o->push_update_options_found = 0;
3227 o->imported_protocol_flags = 0;
3228}
3229
3230static void
3231options_postprocess_mutate_invariant(struct options *options)
3232{
3233#ifdef _WIN32
3234 const int dev = dev_type_enum(options->dev, options->dev_type);
3235
3236 /* when using ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
3237 if ((options->windows_driver == DRIVER_DCO)
3238 && (options->tuntap_options.ip_win32_type == IPW32_SET_DHCP_MASQ
3239 || options->tuntap_options.ip_win32_type == IPW32_SET_ADAPTIVE))
3240 {
3241 options->tuntap_options.ip_win32_type = IPW32_SET_NETSH;
3242 }
3243
3244 if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
3245 {
3246 /* delay may only be necessary when we perform DHCP handshake */
3247 const bool dhcp = (options->tuntap_options.ip_win32_type == IPW32_SET_DHCP_MASQ)
3248 || (options->tuntap_options.ip_win32_type == IPW32_SET_ADAPTIVE);
3249 if ((options->mode == MODE_POINT_TO_POINT) && dhcp)
3250 {
3251 options->route_delay_defined = true;
3252 options->route_delay = 5; /* Vista sometimes has a race without this */
3253 }
3254 }
3255
3256 if (options->ifconfig_noexec)
3257 {
3258 options->tuntap_options.ip_win32_type = IPW32_SET_MANUAL;
3259 options->ifconfig_noexec = false;
3260 }
3261
3262 remap_redirect_gateway_flags(options);
3263
3264 /*
3265 * Check consistency of --mode server options.
3266 */
3267 if (options->mode == MODE_SERVER)
3268 {
3269 /*
3270 * We need to explicitly set --tap-sleep because
3271 * we do not schedule event timers in the top-level context.
3272 */
3273 options->tuntap_options.tap_sleep = 10;
3274 if (options->route_delay_defined && options->route_delay)
3275 {
3276 options->tuntap_options.tap_sleep = options->route_delay;
3277 }
3278 options->route_delay_defined = false;
3279 }
3280#endif /* ifdef _WIN32 */
3281
3282#ifdef DEFAULT_PKCS11_MODULE
3283 /* If p11-kit is present on the system then load its p11-kit-proxy.so
3284 * by default if the user asks for PKCS#11 without otherwise specifying
3285 * the module to use. */
3286 if (!options->pkcs11_providers[0] && (options->pkcs11_id || options->pkcs11_id_management))
3287 {
3288 options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
3289 }
3290#endif
3291}
3292
3293static void
3294options_postprocess_verify(const struct options *o)
3295{
3296 if (o->connection_list)
3297 {
3298 int i;
3299 for (i = 0; i < o->connection_list->len; ++i)
3300 {
3301 options_postprocess_verify_ce(o, o->connection_list->array[i]);
3302 }
3303 }
3304 else
3305 {
3306 options_postprocess_verify_ce(o, &o->ce);
3307 }
3308
3309 dns_options_verify(M_FATAL, &o->dns_options);
3310
3311 if (dco_enabled(o))
3312 {
3313 if (o->enable_c2c)
3314 {
3315 msg(M_WARN, "Note: --client-to-client has no effect when using data "
3316 "channel offload: packets are always sent to the VPN "
3317 "interface and then routed based on the system routing table");
3318 }
3319
3320 if (o->renegotiate_bytes > 0 || o->renegotiate_packets)
3321 {
3322 msg(M_WARN, "Note: '--reneg-bytes' and '--reneg-pkts' are not supported "
3323 "by data channel offload; automatic key renegotiation "
3324 "mechanisms are sufficient for modern ciphers. "
3325 "Ignoring these options.");
3326 }
3327 }
3328}
3329
3330static void
3331options_postprocess_cipher(struct options *o)
3332{
3333 if (!o->pull && !(o->mode == MODE_SERVER))
3334 {
3335 /* If the cipher is not set, use the old default of BF-CBC. We will
3336 * warn that this is deprecated on cipher initialisation, no need
3337 * to warn here as well */
3338 if (!o->ciphername)
3339 {
3340 o->ciphername = "BF-CBC";
3341 }
3342 else
3343 {
3344 o->enable_ncp_fallback = true;
3345 }
3346 return;
3347 }
3348
3349 /* pull or P2MP mode */
3350 if (!o->ciphername)
3351 {
3352 /* We still need to set the ciphername to BF-CBC since various other
3353 * parts of OpenVPN assert that the ciphername is set */
3354 o->ciphername = "BF-CBC";
3355
3356 msg(M_INFO,
3357 "Note: --cipher is not set. OpenVPN versions before 2.5 "
3358 "defaulted to BF-CBC as fallback when cipher negotiation "
3359 "failed in this case. If you need this fallback please add "
3360 "'--data-ciphers-fallback BF-CBC' to your configuration "
3361 "and/or add BF-CBC to --data-ciphers. E.g. "
3362 "--data-ciphers %s:BF-CBC",
3363 o->ncp_ciphers_conf);
3364 }
3365 else if (!o->enable_ncp_fallback && !tls_item_in_cipher_list(o->ciphername, o->ncp_ciphers))
3366 {
3367 msg(M_WARN,
3368 "DEPRECATED OPTION: --cipher set to '%s' but missing in "
3369 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
3370 "negotiations. ",
3371 o->ciphername, o->ncp_ciphers_conf);
3372 }
3373}
3374
3390static bool
3391need_compatibility_before(const struct options *o, unsigned int version)
3392{
3393 return o->backwards_compatible != 0 && o->backwards_compatible < version;
3394}
3395
3400static void
3401options_set_backwards_compatible_options(struct options *o)
3402{
3403 /* TLS min version is not set */
3404 unsigned int tls_ver_min = (o->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT) & SSLF_TLS_VERSION_MIN_MASK;
3405 if (tls_ver_min == 0)
3406 {
3407 unsigned int tls_ver_max = (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) & SSLF_TLS_VERSION_MAX_MASK;
3408 if (need_compatibility_before(o, 20307))
3409 {
3410 /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
3411 o->ssl_flags |= (TLS_VER_1_0 << SSLF_TLS_VERSION_MIN_SHIFT);
3412 }
3413 else if (tls_ver_max == 0 || tls_ver_max >= TLS_VER_1_2)
3414 {
3415 /* Use TLS 1.2 as proper default */
3416 o->ssl_flags |= (TLS_VER_1_2 << SSLF_TLS_VERSION_MIN_SHIFT);
3417 }
3418 else
3419 {
3420 /* Maximize the minimum version */
3421 o->ssl_flags |= (tls_ver_max << SSLF_TLS_VERSION_MIN_SHIFT);
3422 }
3423 }
3424
3425 if (need_compatibility_before(o, 20400))
3426 {
3427 if (!o->ciphername)
3428 {
3429 /* If ciphername is not set default to BF-CBC when targeting these
3430 * old versions that do not have NCP */
3431 o->ciphername = "BF-CBC";
3432 }
3433 /* Versions < 2.4.0 additionally might be compiled with --enable-small and
3434 * not have OCC strings required for "poor man's NCP" */
3435 o->enable_ncp_fallback = true;
3436 }
3437
3438 /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
3439 * Version 2.4 probably does not need it but NCP was not so
3440 * good with 2.4 and ncp-disable might be more common on 2.4 peers.
3441 * Only do this iff --cipher is set (explicitly or by compat mode
3442 * < 2.4.0, see above). This is not 100% correct backwards compatible
3443 * behaviour but 2.5 already behaved like this */
3444 if (o->ciphername && need_compatibility_before(o, 20500)
3445 && !tls_item_in_cipher_list(o->ciphername, o->ncp_ciphers))
3446 {
3447 append_cipher_to_ncp_list(o, o->ciphername);
3448 }
3449
3450#ifdef USE_COMP
3451 /* Compression is deprecated and we do not want to announce support for it
3452 * by default anymore, additionally DCO breaks with compression.
3453 *
3454 * Disable compression by default starting with 2.6.0 if no other
3455 * compression related option has been explicitly set */
3456 if (!need_compatibility_before(o, 20600) && (o->comp.flags == 0))
3457 {
3458 if (!comp_non_stub_enabled(&o->comp))
3459 {
3460 o->comp.flags = COMP_F_ALLOW_STUB_ONLY | COMP_F_ADVERTISE_STUBS_ONLY;
3461 }
3462 }
3463#else /* ifdef USE_COMP */
3464 o->comp.flags = COMP_F_ALLOW_NOCOMP_ONLY;
3465#endif
3466}
3467
3468static void
3469options_process_mutate_prf(struct options *o)
3470{
3471 if (!check_tls_prf_working())
3472 {
3473 msg(D_TLS_ERRORS, "Warning: TLS 1.0 PRF with MD5+SHA1 PRF is not "
3474 "supported by the TLS library. Your system does not support this "
3475 "calculation anymore or your security policy (e.g. FIPS 140-2) "
3476 "forbids it. Connections will only work with peers running "
3477 "OpenVPN 2.6.0 or higher)");
3478 if (o->mode == MODE_SERVER)
3479 {
3480 msg(M_WARN, "Automatically enabling option "
3481 "--force-tls-key-material-export");
3482 o->force_key_material_export = true;
3483 }
3484 }
3485}
3486
3487#if defined(_WIN32) || defined(TARGET_ANDROID)
3496static void
3497tuntap_options_postprocess_dns(struct options *o)
3498{
3499 struct dns_options *dns = &o->dns_options;
3500 struct tuntap_options *tt = &o->tuntap_options;
3501 if (!dns->servers)
3502 {
3503 /* Copy --dhcp-options to tuntap_options */
3504 struct dhcp_options *dhcp = &dns->from_dhcp;
3505 ASSERT(sizeof(dhcp->dns) == sizeof(tt->dns));
3506 ASSERT(sizeof(dhcp->dns6) == sizeof(tt->dns6));
3507 ASSERT(sizeof(dhcp->domain_search_list) == sizeof(tt->domain_search_list));
3508
3509 tt->domain = dhcp->domain;
3510 tt->dns_len = dhcp->dns_len;
3511 tt->dns6_len = dhcp->dns6_len;
3512
3513 memcpy(tt->dns, dhcp->dns, sizeof(tt->dns));
3514 memcpy(tt->dns6, dhcp->dns6, sizeof(tt->dns6));
3515
3516 tt->domain_search_list_len = dhcp->domain_search_list_len;
3517 for (size_t i = 0; i < SIZE(tt->domain_search_list); ++i)
3518 {
3519 tt->domain_search_list[i] = dhcp->domain_search_list[i];
3520 }
3521
3522 return;
3523 }
3524
3525#if defined(_WIN32)
3526 if (tt->ip_win32_type != IPW32_SET_DHCP_MASQ && tt->ip_win32_type != IPW32_SET_ADAPTIVE)
3527 {
3528 return; /* Not in DHCP mode */
3529 }
3530#endif /* if defined(_WIN32) */
3531
3532 /* Copy --dns options to tuntap_options */
3533
3534 const struct dns_domain *d = dns->search_domains;
3535 if (d)
3536 {
3537 tt->domain_search_list_len = 0;
3538 }
3539
3540 while (d && tt->domain_search_list_len + 1 < N_SEARCH_LIST_LEN)
3541 {
3542 tt->domain_search_list[tt->domain_search_list_len++] = d->name;
3543 d = d->next;
3544 }
3545 if (d)
3546 {
3547 msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to TUN/TAP");
3548 }
3549
3550 tt->dns_len = 0;
3551 tt->dns6_len = 0;
3552
3553 const struct dns_server *s = dns->servers;
3554 while (s)
3555 {
3556 bool non_standard_server_port = false;
3557 for (size_t i = 0; i < s->addr_count; ++i)
3558 {
3559 if (s->addr[i].port && s->addr[i].port != 53)
3560 {
3561 non_standard_server_port = true;
3562 break;
3563 }
3564 }
3565 if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN)
3566 || (s->dnssec && s->dnssec != DNS_SECURITY_NO) || non_standard_server_port)
3567 {
3568 /* Skip servers requiring unsupported config to be set */
3569 s = s->next;
3570 }
3571 else
3572 {
3573 bool overflow = false;
3574 for (size_t i = 0; i < s->addr_count; ++i)
3575 {
3576 if (s->addr[i].family == AF_INET && tt->dns_len + 1 < N_DHCP_ADDR)
3577 {
3578 tt->dns[tt->dns_len++] = ntohl(s->addr[i].in.a4.s_addr);
3579 }
3580 else if (tt->dns6_len + 1 < N_DHCP_ADDR)
3581 {
3582 tt->dns6[tt->dns6_len++] = s->addr[i].in.a6;
3583 }
3584 else
3585 {
3586 overflow = true;
3587 }
3588 }
3589 if (overflow)
3590 {
3591 msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to TUN/TAP");
3592 }
3593 tt->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
3594 return;
3595 }
3596 }
3597}
3598
3599#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
3600
3611static void
3612dhcp_options_postprocess_dns(struct options *o, struct env_set *es)
3613{
3614 struct gc_arena gc = gc_new();
3615 struct dns_options *dns = &o->dns_options;
3616
3617 if (is_tun_afunix(o->dev_node))
3618 {
3619 /* Disable running dns-updown script with lwipovpn */
3620 dns->updown_flags = DNS_UPDOWN_NO_FLAGS;
3621 dns->updown = NULL;
3622 }
3623
3624 if (dns->servers || dns_updown_user_set(dns) || dns_updown_forced(dns))
3625 {
3626 /* Clean up env from --dhcp-option DNS config */
3627 struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
3628 struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
3629
3630 const int fo_count = o->foreign_option_index;
3631 o->foreign_option_index = 0;
3632
3633 for (int i = 1; i <= fo_count; ++i)
3634 {
3635 buf_clear(&name);
3636 buf_printf(&name, "foreign_option_%d", i);
3637 const char *env_str = env_set_get(es, BSTR(&name));
3638 const char *item_val = strchr(env_str, '=') + 1;
3639 buf_clear(&value);
3640 buf_printf(&value, "%s", item_val);
3641
3642 /* Remove foreign option item from env set */
3643 env_set_del(es, BSTR(&name));
3644
3645 item_val = BSTR(&value);
3646 if (strncmp(item_val, "dhcp-option ", 12) != 0
3647 || (strncmp(item_val + 12, "ADAPTER-DOMAIN-SUFFIX ", 22) != 0
3648 && strncmp(item_val + 12, "DOMAIN-SEARCH ", 14) != 0
3649 && strncmp(item_val + 12, "DOMAIN ", 7) != 0
3650 && strncmp(item_val + 12, "DNS6 ", 5) != 0
3651 && strncmp(item_val + 12, "DNS ", 4) != 0))
3652 {
3653 /* Re-set the item with potentially updated name */
3654 buf_clear(&name);
3655 buf_printf(&name, "foreign_option_%d", ++o->foreign_option_index);
3656 setenv_str(es, BSTR(&name), BSTR(&value));
3657 }
3658 }
3659 }
3660
3661 if (!dns->servers)
3662 {
3663 /* Copy --dhcp-options to dns_options */
3664 struct dhcp_options *dhcp = &dns->from_dhcp;
3665
3666 if (dhcp->dns_len || dhcp->dns6_len)
3667 {
3668 struct dns_domain **entry = &dns->search_domains;
3669 ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc);
3670 struct dns_domain *new = *entry;
3671 new->name = dhcp->domain;
3672 entry = &new->next;
3673
3674 for (unsigned int i = 0; i < dhcp->domain_search_list_len; ++i)
3675 {
3676 ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc);
3677 struct dns_domain *new = *entry;
3678 new->name = dhcp->domain_search_list[i];
3679 entry = &new->next;
3680 }
3681
3682 struct dns_server *server = dns_server_get(&dns->servers, 0, &dns->gc);
3683 const size_t max_addrs = SIZE(server->addr);
3684 for (unsigned int i = 0; i < dhcp->dns_len && server->addr_count < max_addrs; ++i)
3685 {
3686 server->addr[server->addr_count].in.a4.s_addr = htonl(dhcp->dns[i]);
3687 server->addr[server->addr_count].family = AF_INET;
3688 server->addr_count += 1;
3689 }
3690 for (unsigned int i = 0; i < dhcp->dns6_len && server->addr_count < max_addrs; ++i)
3691 {
3692 server->addr[server->addr_count].in.a6 = dhcp->dns6[i];
3693 server->addr[server->addr_count].family = AF_INET6;
3694 server->addr_count += 1;
3695 }
3696 }
3697 }
3698 else if (o->up_script && !dns_updown_user_set(dns) && !dns_updown_forced(dns))
3699 {
3700 /* Set foreign option env vars from --dns config */
3701 const struct dns_domain *d = dns->search_domains;
3702 while (d)
3703 {
3704 setenv_foreign_option(o, "DOMAIN", d->name, es);
3705 d = d->next;
3706 }
3707
3708 const struct dns_server *s = dns->servers;
3709 while (s)
3710 {
3711 bool non_standard_server_port = false;
3712 for (size_t i = 0; i < s->addr_count; ++i)
3713 {
3714 if (s->addr[i].port && s->addr[i].port != 53)
3715 {
3716 non_standard_server_port = true;
3717 break;
3718 }
3719 }
3720 if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN)
3721 || (s->dnssec && s->dnssec != DNS_SECURITY_NO) || non_standard_server_port)
3722 {
3723 /* Skip servers requiring unsupported config to be set */
3724 s = s->next;
3725 }
3726 else
3727 {
3728 for (size_t i = 0; i < s->addr_count; ++i)
3729 {
3730 const char *option;
3731 const char *value;
3732 if (s->addr[i].family == AF_INET)
3733 {
3734 option = "DNS";
3735 value = print_in_addr_t(s->addr[i].in.a4.s_addr, IA_NET_ORDER, &gc);
3736 }
3737 else
3738 {
3739 option = "DNS6";
3740 value = print_in6_addr(s->addr[i].in.a6, 0, &gc);
3741 }
3742 setenv_foreign_option(o, option, value, es);
3743 }
3744 break;
3745 }
3746 }
3747 }
3748
3749 gc_free(&gc);
3750}
3751#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
3756static void
3757helper_hashmap_sizes(struct options *o)
3758{
3759 if (!o->real_hash_size)
3760 {
3761 o->real_hash_size = 4 * o->max_clients;
3762 }
3763 if (!o->virtual_hash_size)
3764 {
3765 o->virtual_hash_size = 4 * o->max_clients;
3766 }
3767}
3768
3769static void
3770options_postprocess_mutate(struct options *o, struct env_set *es)
3771{
3772 int i;
3773 /*
3774 * Process helper-type options which map to other, more complex
3775 * sequences of options.
3776 */
3777 helper_client_server(o);
3778 /* must be called after helpers that might set --mode */
3779 helper_setdefault_topology(o);
3780 helper_keepalive(o);
3781 helper_tcp_nodelay(o);
3782
3783 if (o->mode == MODE_SERVER)
3784 {
3785 helper_hashmap_sizes(o);
3786 }
3787
3788 options_postprocess_setdefault_ncpciphers(o);
3789 options_set_backwards_compatible_options(o);
3790 options_process_mutate_prf(o);
3791
3792 options_postprocess_cipher(o);
3793 o->ncp_ciphers = mutate_ncp_cipher_list(o->ncp_ciphers, &o->gc);
3794 if (o->ncp_ciphers == NULL)
3795 {
3796 msg(M_USAGE, "--data-ciphers list contains unsupported ciphers or is too long.");
3797 }
3798
3799 if (o->remote_list && !o->connection_list)
3800 {
3801 /*
3802 * Convert remotes into connection list
3803 */
3804 const struct remote_list *rl = o->remote_list;
3805 for (i = 0; i < rl->len; ++i)
3806 {
3807 const struct remote_entry *re = rl->array[i];
3808 struct connection_entry ce = o->ce;
3809 struct connection_entry *ace;
3810
3811 ASSERT(re->remote);
3812 connection_entry_load_re(&ce, re);
3813 ace = alloc_connection_entry(o, M_USAGE);
3814 ASSERT(ace);
3815 *ace = ce;
3816 }
3817 }
3818 else if (!o->remote_list && !o->connection_list)
3819 {
3820 struct connection_entry *ace;
3821 ace = alloc_connection_entry(o, M_USAGE);
3822 ASSERT(ace);
3823 *ace = o->ce;
3824 }
3825
3826 ASSERT(o->connection_list);
3827 for (i = 0; i < o->connection_list->len; ++i)
3828 {
3829 options_postprocess_mutate_ce(o, o->connection_list->array[i]);
3830 }
3831
3832 if (o->ce.local_list)
3833 {
3834 for (i = 0; i < o->ce.local_list->len; i++)
3835 {
3836 options_postprocess_mutate_le(&o->ce, o->ce.local_list->array[i], o->mode);
3837 }
3838
3839 for (int i = 0; i < o->ce.local_list->len; i++)
3840 {
3841 if (o->ce.local_list->array[i]->proto == PROTO_TCP)
3842 {
3843 o->ce.local_list->array[i]->proto = PROTO_TCP_SERVER;
3844 }
3845 else if (o->ce.local_list->array[i]->proto == PROTO_NONE)
3846 {
3847 o->ce.local_list->array[i]->proto = o->ce.proto;
3848 }
3849 }
3850 }
3851 else
3852 {
3853 /* if no 'local' directive was specified, convert the global port
3854 * setting to a listen entry */
3855 struct local_entry *e = alloc_local_entry(&o->ce, M_USAGE, &o->gc);
3856 ASSERT(e);
3857 e->port = o->ce.local_port;
3858 e->proto = o->ce.proto;
3859 }
3860
3861 /* use the same listen list for every outgoing connection */
3862 for (i = 0; i < o->connection_list->len; ++i)
3863 {
3864 o->connection_list->array[i]->local_list = o->ce.local_list;
3865 }
3866
3867 if (o->tls_server)
3868 {
3869 if (o->dh_file && streq(o->dh_file, "none"))
3870 {
3871 o->dh_file = NULL;
3872 }
3873 }
3874 else if (o->dh_file)
3875 {
3876 /* DH file is only meaningful in a tls-server context. */
3877 msg(M_WARN, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3878 "include this in your server configuration");
3879 o->dh_file = NULL;
3880 }
3881#if ENABLE_MANAGEMENT
3882 if (o->http_proxy_override)
3883 {
3884 options_postprocess_http_proxy_override(o);
3885 }
3886#endif
3887 if (!o->ca_file && !o->ca_path && o->verify_hash && o->verify_hash_depth == 0)
3888 {
3889 msg(M_INFO, "Using certificate fingerprint to verify peer (no CA "
3890 "option set). ");
3891 o->verify_hash_no_ca = true;
3892 }
3893
3894 if (o->config && streq(o->config, "stdin") && o->remap_sigusr1 == SIGHUP)
3895 {
3896 msg(M_USAGE, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3897 "incompatible with each other.");
3898 }
3899
3900 if (dco_enabled(o))
3901 {
3902 /* check if any option should force disabling DCO */
3903 o->disable_dco = !dco_check_option(D_DCO, o) || !dco_check_startup_option(D_DCO, o);
3904 }
3905#ifdef USE_COMP
3906 if (dco_enabled(o))
3907 {
3908 o->comp.flags |= COMP_F_ALLOW_NOCOMP_ONLY;
3909 }
3910#endif
3911
3912#ifdef _WIN32
3913 if (dco_enabled(o))
3914 {
3915 o->windows_driver = DRIVER_DCO;
3916 }
3917 else
3918 {
3919 o->windows_driver = WINDOWS_DRIVER_TAP_WINDOWS6;
3920 }
3921#else /* _WIN32 */
3922 if (dco_enabled(o) && o->dev_node)
3923 {
3924 msg(M_WARN, "Note: ignoring --dev-node as it has no effect when using "
3925 "data channel offload");
3926 o->dev_node = NULL;
3927 }
3928#endif /* _WIN32 */
3929
3930 /* this depends on o->windows_driver, which is set above */
3931 options_postprocess_mutate_invariant(o);
3932
3933 /* check that compression settings in the options are okay */
3934 check_compression_settings_valid(&o->comp, M_USAGE);
3935
3936 /*
3937 * Save certain parms before modifying options during connect, especially
3938 * when using --pull
3939 */
3940 if (o->pull)
3941 {
3942 dns_options_preprocess_pull(&o->dns_options);
3943 }
3944 else
3945 {
3946#if defined(_WIN32) || defined(TARGET_ANDROID)
3947 tuntap_options_postprocess_dns(o);
3948#else
3949 dhcp_options_postprocess_dns(o, es);
3950#endif
3951 }
3952 if (o->auth_token_generate && !o->auth_token_renewal)
3953 {
3954 o->auth_token_renewal = o->renegotiate_seconds;
3955 }
3956#if ENABLE_MANAGEMENT
3957 if (o->auth_user_pass_username_only && o->sc_info.challenge_text)
3958 {
3959 msg(M_USAGE, "'auth-user-pass username-only' cannot be used with static challenge");
3960 }
3961#endif
3962 pre_connect_save(o);
3963}
3964
3965/*
3966 * Check file/directory sanity
3967 *
3968 */
3969/* Expect people using the stripped down version to know what they do */
3970#ifndef ENABLE_SMALL
3971
3972#define CHKACC_FILE (1 << 0)
3973#define CHKACC_DIRPATH (1 << 1)
3974#define CHKACC_FILEXSTWR (1 << 2)
3975#define CHKACC_ACPTSTDIN (1 << 3)
3976#define CHKACC_PRIVATE (1 << 4)
3977#define CHKACC_ACCEPT_URI (1 << 5)
3979static bool
3980check_file_access(const int type, const char *file, const int mode, const char *opt)
3981{
3982 int errcode = 0;
3983
3984 /* If no file configured, no errors to look for */
3985 if (!file)
3986 {
3987 return false;
3988 }
3989
3990 /* If stdin is allowed and the file name is 'stdin', then do no
3991 * further checks as stdin is always available
3992 */
3993 if ((type & CHKACC_ACPTSTDIN) && streq(file, "stdin"))
3994 {
3995 return false;
3996 }
3997
3998 /* file name is a URI if its first segment has ":" (i.e., before any "/")
3999 * Then no checks done if CHKACC_ACCEPT_URI is set and the URI does not start with "file:"
4000 */
4001 if ((type & CHKACC_ACCEPT_URI) && strchr(file, ':'))
4002 {
4003 if (!strncmp(file, "file:", 5))
4004 {
4005 file += 5;
4006 }
4007 else if (!strchr(file, '/') || strchr(file, '/') > strchr(file, ':'))
4008 {
4009 return false;
4010 }
4011 }
4012
4013 /* Is the directory path leading to the given file accessible? */
4014 if (type & CHKACC_DIRPATH)
4015 {
4016 char *fullpath =
4017 string_alloc(file, NULL); /* POSIX dirname() implementation may modify its arguments */
4018 char *dirpath = dirname(fullpath);
4019
4020 if (platform_access(dirpath, mode | X_OK) != 0)
4021 {
4022 errcode = errno;
4023 }
4024 free(fullpath);
4025 }
4026
4027 /* Is the file itself accessible? */
4028 if (!errcode && (type & CHKACC_FILE) && (platform_access(file, mode) != 0))
4029 {
4030 errcode = errno;
4031 }
4032
4033 /* If the file exists and is accessible, is it writable? */
4034 if (!errcode && (type & CHKACC_FILEXSTWR) && (platform_access(file, F_OK) == 0))
4035 {
4036 if (platform_access(file, W_OK) != 0)
4037 {
4038 errcode = errno;
4039 }
4040 }
4041
4042 /* Warn if a given private file is group/others accessible. */
4043 if (type & CHKACC_PRIVATE)
4044 {
4045 platform_stat_t st;
4046 if (platform_stat(file, &st))
4047 {
4048 msg(M_WARN | M_ERRNO, "WARNING: cannot stat file '%s'", file);
4049 }
4050#ifndef _WIN32
4051 else
4052 {
4053 if (st.st_mode & (S_IRWXG | S_IRWXO))
4054 {
4055 msg(M_WARN, "WARNING: file '%s' is group or others accessible", file);
4056 }
4057 }
4058#endif
4059 }
4060
4061 /* Scream if an error is found */
4062 if (errcode > 0)
4063 {
4064 msg(M_NOPREFIX | M_OPTERR | M_ERRNO, "%s fails with '%s'", opt, file);
4065 }
4066
4067 /* Return true if an error occurred */
4068 return (errcode != 0 ? true : false);
4069}
4070
4071/* A wrapper for check_file_access() which also takes a chroot directory.
4072 * If chroot is NULL, behaviour is exactly the same as calling check_file_access() directly,
4073 * otherwise it will look for the file inside the given chroot directory instead.
4074 */
4075static bool
4076check_file_access_chroot(const char *chroot, const int type, const char *file, const int mode,
4077 const char *opt)
4078{
4079 bool ret = false;
4080
4081 /* If no file configured, no errors to look for */
4082 if (!file)
4083 {
4084 return false;
4085 }
4086
4087 /* If chroot is set, look for the file/directory inside the chroot */
4088 if (chroot)
4089 {
4090 struct gc_arena gc = gc_new();
4091 struct buffer chroot_file;
4092
4093 chroot_file = prepend_dir(chroot, file, &gc);
4094 ret = check_file_access(type, BSTR(&chroot_file), mode, opt);
4095 gc_free(&gc);
4096 }
4097 else
4098 {
4099 /* No chroot in play, just call core file check function */
4100 ret = check_file_access(type, file, mode, opt);
4101 }
4102 return ret;
4103}
4104
4109static bool
4110check_file_access_chroot_inline(bool is_inline, const char *chroot, const int type,
4111 const char *file, const int mode, const char *opt)
4112{
4113 if (is_inline)
4114 {
4115 return false;
4116 }
4117
4118 return check_file_access_chroot(chroot, type, file, mode, opt);
4119}
4120
4125static bool
4126check_file_access_inline(bool is_inline, const int type, const char *file, const int mode,
4127 const char *opt)
4128{
4129 if (is_inline)
4130 {
4131 return false;
4132 }
4133
4134 return check_file_access(type, file, mode, opt);
4135}
4136
4137/*
4138 * Verifies that the path in the "command" that comes after certain script options (e.g., --up) is a
4139 * valid file with appropriate permissions.
4140 *
4141 * "command" consists of a path, optionally followed by a space, which may be
4142 * followed by arbitrary arguments. It is NOT a full shell command line -- shell expansion is not
4143 * performed.
4144 *
4145 * The path and arguments in "command" may be single- or double-quoted or escaped.
4146 *
4147 * The path is extracted from "command", then check_file_access() is called to check it. The
4148 * arguments, if any, are ignored.
4149 *
4150 * Note that the type, mode, and opt arguments to this routine are the same as the corresponding
4151 * check_file_access() arguments.
4152 */
4153static bool
4154check_cmd_access(const char *command, const char *opt, const char *chroot)
4155{
4156 struct argv argv;
4157 bool return_code;
4158
4159 /* If no command was set, there are no errors to look for */
4160 if (!command)
4161 {
4162 return false;
4163 }
4164
4165 /* Extract executable path and arguments */
4166 argv = argv_new();
4167 argv_parse_cmd(&argv, command);
4168
4169 /* if an executable is specified then check it; otherwise, complain */
4170 if (argv.argv[0])
4171 {
4172 /* Scripts requires R_OK as well, but that might fail on binaries which
4173 * only requires X_OK to function on Unix - a scenario not unlikely to
4174 * be seen on suid binaries.
4175 */
4176 return_code = check_file_access_chroot(chroot, CHKACC_FILE, argv.argv[0], X_OK, opt);
4177 }
4178 else
4179 {
4180 msg(M_NOPREFIX | M_OPTERR, "%s fails with '%s': No path to executable.", opt, command);
4181 return_code = true;
4182 }
4183
4184 argv_free(&argv);
4185
4186 return return_code;
4187}
4188
4189/*
4190 * Sanity check of all file/dir options. Checks that file/dir
4191 * is accessible by OpenVPN
4192 */
4193static void
4194options_postprocess_filechecks(struct options *options)
4195{
4196 bool errs = false;
4197
4198 /* ** SSL/TLS/crypto related files ** */
4199 errs |= check_file_access_inline(options->dh_file_inline, CHKACC_FILE, options->dh_file, R_OK,
4200 "--dh");
4201
4202 if (!options->verify_hash_no_ca)
4203 {
4204 errs |= check_file_access_inline(options->ca_file_inline, CHKACC_FILE, options->ca_file,
4205 R_OK, "--ca");
4206 }
4207
4208 errs |= check_file_access_chroot(options->chroot_dir, CHKACC_FILE, options->ca_path, R_OK,
4209 "--capath");
4210
4211 errs |= check_file_access_inline(options->cert_file_inline, CHKACC_FILE | CHKACC_ACCEPT_URI,
4212 options->cert_file, R_OK, "--cert");
4213
4214 errs |= check_file_access_inline(options->extra_certs_file, CHKACC_FILE,
4215 options->extra_certs_file, R_OK, "--extra-certs");
4216
4217 if (!(options->management_flags & MF_EXTERNAL_KEY))
4218 {
4219 errs |= check_file_access_inline(options->priv_key_file_inline,
4220 CHKACC_FILE | CHKACC_PRIVATE | CHKACC_ACCEPT_URI,
4221 options->priv_key_file, R_OK, "--key");
4222 }
4223
4224 errs |= check_file_access_inline(options->pkcs12_file_inline, CHKACC_FILE | CHKACC_PRIVATE,
4225 options->pkcs12_file, R_OK, "--pkcs12");
4226
4227 if (options->ssl_flags & SSLF_CRL_VERIFY_DIR)
4228 {
4229 errs |= check_file_access_chroot(options->chroot_dir, CHKACC_FILE, options->crl_file,
4230 R_OK | X_OK, "--crl-verify directory");
4231 }
4232 else
4233 {
4234 errs |=
4235 check_file_access_chroot_inline(options->crl_file_inline, options->chroot_dir,
4236 CHKACC_FILE, options->crl_file, R_OK, "--crl-verify");
4237 }
4238
4239 if (options->tls_export_peer_cert_dir)
4240 {
4241 errs |=
4242 check_file_access_chroot(options->chroot_dir, CHKACC_FILE,
4243 options->tls_export_peer_cert_dir, W_OK, "--tls-export-cert");
4244 }
4245
4246 ASSERT(options->connection_list);
4247 for (int i = 0; i < options->connection_list->len; ++i)
4248 {
4249 struct connection_entry *ce = options->connection_list->array[i];
4250
4251 errs |= check_file_access_inline(ce->tls_auth_file_inline, CHKACC_FILE | CHKACC_PRIVATE,
4252 ce->tls_auth_file, R_OK, "--tls-auth");
4253 errs |= check_file_access_inline(ce->tls_crypt_file_inline, CHKACC_FILE | CHKACC_PRIVATE,
4254 ce->tls_crypt_file, R_OK, "--tls-crypt");
4255 errs |= check_file_access_inline(ce->tls_crypt_v2_file_inline, CHKACC_FILE | CHKACC_PRIVATE,
4256 ce->tls_crypt_v2_file, R_OK, "--tls-crypt-v2");
4257 }
4258
4259 errs |=
4260 check_file_access_inline(options->shared_secret_file_inline, CHKACC_FILE | CHKACC_PRIVATE,
4261 options->shared_secret_file, R_OK, "--secret");
4262
4263 errs |= check_file_access(CHKACC_DIRPATH | CHKACC_FILEXSTWR, options->packet_id_file,
4264 R_OK | W_OK, "--replay-persist");
4265
4266 /* ** Password files ** */
4267 errs |= check_file_access(CHKACC_FILE | CHKACC_ACPTSTDIN | CHKACC_PRIVATE,
4268 options->key_pass_file, R_OK, "--askpass");
4269#ifdef ENABLE_MANAGEMENT
4270 errs |=
4271 check_file_access(CHKACC_FILE | CHKACC_ACPTSTDIN | CHKACC_PRIVATE,
4272 options->management_user_pass, R_OK, "--management user/password file");
4273#endif /* ENABLE_MANAGEMENT */
4274 errs |= check_file_access_inline(options->auth_user_pass_file_inline,
4275 CHKACC_FILE | CHKACC_ACPTSTDIN | CHKACC_PRIVATE,
4276 options->auth_user_pass_file, R_OK, "--auth-user-pass");
4277 /* ** System related ** */
4278 errs |= check_file_access(CHKACC_FILE, options->chroot_dir, R_OK | X_OK, "--chroot directory");
4279 errs |= check_file_access(CHKACC_DIRPATH | CHKACC_FILEXSTWR, options->writepid, R_OK | W_OK,
4280 "--writepid");
4281
4282 /* ** Log related ** */
4283 errs |= check_file_access(CHKACC_DIRPATH | CHKACC_FILEXSTWR, options->status_file, R_OK | W_OK,
4284 "--status");
4285
4286 /* ** Config related ** */
4287 errs |= check_file_access_chroot(options->chroot_dir, CHKACC_FILE, options->client_config_dir,
4288 R_OK | X_OK, "--client-config-dir");
4289 errs |= check_file_access_chroot(options->chroot_dir, CHKACC_FILE, options->tmp_dir,
4290 R_OK | W_OK | X_OK, "Temporary directory (--tmp-dir)");
4291
4292 if (errs)
4293 {
4294 msg(M_USAGE, "Please correct these errors.");
4295 }
4296}
4297#endif /* !ENABLE_SMALL */
4298
4299/*
4300 * Sanity check on options.
4301 * Also set some options based on other
4302 * options.
4303 */
4304void
4305options_postprocess(struct options *options, struct env_set *es)
4306{
4307 options_postprocess_mutate(options, es);
4308 options_postprocess_verify(options);
4309#ifndef ENABLE_SMALL
4310 options_postprocess_filechecks(options);
4311#endif /* !ENABLE_SMALL */
4312}
4313
4314/*
4315 * Sanity check on options after more options were pulled from server.
4316 * Also time to modify some options based on other options.
4317 */
4318bool
4319options_postprocess_pull(struct options *o, struct env_set *es)
4320{
4321 bool success = dns_options_verify(D_PUSH_ERRORS, &o->dns_options);
4322 if (success)
4323 {
4324 dns_options_postprocess_pull(&o->dns_options);
4325#if defined(_WIN32) || defined(TARGET_ANDROID)
4326 tuntap_options_postprocess_dns(o);
4327#else
4328 dhcp_options_postprocess_dns(o, es);
4329#endif
4330 }
4331 return success;
4332}
4333
4334/*
4335 * Build an options string to represent data channel encryption options.
4336 * This string must match exactly between peers. The keysize is checked
4337 * separately by read_key().
4338 *
4339 * The following options must match on both peers:
4340 *
4341 * Tunnel options:
4342 *
4343 * --dev tun|tap [unit number need not match]
4344 * --dev-type tun|tap
4345 * --link-mtu
4346 * --udp-mtu
4347 * --tun-mtu
4348 * --proto udp
4349 * --proto tcp-client [matched with --proto tcp-server
4350 * on the other end of the connection]
4351 * --proto tcp-server [matched with --proto tcp-client on
4352 * the other end of the connection]
4353 * --tun-ipv6
4354 * --ifconfig x y [matched with --ifconfig y x on
4355 * the other end of the connection]
4356 *
4357 * --comp-lzo
4358 * --compress alg
4359 * --fragment
4360 *
4361 * Crypto Options:
4362 *
4363 * --cipher
4364 * --auth
4365 * --secret
4366 *
4367 * SSL Options:
4368 *
4369 * --tls-auth
4370 * --tls-client [matched with --tls-server on
4371 * the other end of the connection]
4372 * --tls-server [matched with --tls-client on
4373 * the other end of the connection]
4374 */
4375char *
4376options_string(const struct options *o, const struct frame *frame, struct tuntap *tt,
4377 openvpn_net_ctx_t *ctx, bool remote, struct gc_arena *gc)
4378{
4379 struct buffer out = alloc_buf(OPTION_LINE_SIZE);
4380 bool tt_local = false;
4381
4382 buf_printf(&out, "V4");
4383
4384 /*
4385 * Tunnel Options
4386 */
4387
4388 buf_printf(&out, ",dev-type %s", dev_type_string(o->dev, o->dev_type));
4389 /* the link-mtu that we send has only a meaning if have a fixed
4390 * cipher (p2p) or have a fallback cipher configured for older non
4391 * ncp clients. But not sending it will make even 2.4 complain
4392 * about it being missing. So still send it. */
4393 buf_printf(&out, ",link-mtu %u", (unsigned int)calc_options_string_link_mtu(o, frame));
4394
4395 if (o->ce.occ_mtu != 0)
4396 {
4397 buf_printf(&out, ",tun-mtu %d", o->ce.occ_mtu);
4398 }
4399 else
4400 {
4401 buf_printf(&out, ",tun-mtu %d", frame->tun_mtu);
4402 }
4403
4404 buf_printf(&out, ",proto %s", proto_remote(o->ce.proto, remote));
4405
4406 bool p2p_nopull = o->mode == MODE_POINT_TO_POINT && !PULL_DEFINED(o);
4407 /* send tun_ipv6 only in peer2peer mode - in client/server mode, it
4408 * is usually pushed by the server, triggering a non-helpful warning
4409 */
4410 if (o->ifconfig_ipv6_local && p2p_nopull)
4411 {
4412 buf_printf(&out, ",tun-ipv6");
4413 }
4414
4415 /*
4416 * Try to get ifconfig parameters into the options string.
4417 * If tt is undefined, make a temporary instantiation.
4418 */
4419 if (!tt)
4420 {
4421 tt = init_tun(o->dev, o->dev_type, o->topology, o->ifconfig_local,
4422 o->ifconfig_remote_netmask, o->ifconfig_ipv6_local, o->ifconfig_ipv6_netbits,
4423 o->ifconfig_ipv6_remote, NULL, NULL, false, NULL, ctx, NULL);
4424 if (tt)
4425 {
4426 tt_local = true;
4427 }
4428 }
4429
4430 if (tt && p2p_nopull)
4431 {
4432 const char *ios = ifconfig_options_string(tt, remote, o->ifconfig_nowarn, gc);
4433 if (ios && strlen(ios))
4434 {
4435 buf_printf(&out, ",ifconfig %s", ios);
4436 }
4437 }
4438 if (tt_local)
4439 {
4440 free(tt);
4441 tt = NULL;
4442 }
4443
4444#ifdef USE_COMP
4445 if (o->comp.alg != COMP_ALG_UNDEF)
4446 {
4447 buf_printf(&out, ",comp-lzo"); /* for compatibility, this simply indicates that compression
4448 context is active, not necessarily LZO per-se */
4449 }
4450#endif
4451
4452#ifdef ENABLE_FRAGMENT
4453 if (o->ce.fragment)
4454 {
4455 buf_printf(&out, ",mtu-dynamic");
4456 }
4457#endif
4458
4459#define TLS_CLIENT (o->tls_client)
4460#define TLS_SERVER (o->tls_server)
4461
4462 /*
4463 * Key direction
4464 */
4465 {
4466 const char *kd = keydirection2ascii(o->key_direction, remote, false);
4467 if (kd)
4468 {
4469 buf_printf(&out, ",keydir %s", kd);
4470 }
4471 }
4472
4473 /*
4474 * Crypto Options
4475 */
4476 if (o->shared_secret_file || TLS_CLIENT || TLS_SERVER)
4477 {
4478 struct key_type kt;
4479
4480 ASSERT((o->shared_secret_file != NULL) + (TLS_CLIENT == true) + (TLS_SERVER == true) <= 1);
4481
4482 /* Skip resolving BF-CBC to allow SSL libraries without BF-CBC
4483 * to work here in the default configuration */
4484 const char *ciphername = o->ciphername;
4485 size_t keysize = 0;
4486
4487 if (strcmp(o->ciphername, "BF-CBC") == 0)
4488 {
4489 init_key_type(&kt, "none", o->authname, true, false);
4490 keysize = 128;
4491 }
4492 else
4493 {
4494 init_key_type(&kt, o->ciphername, o->authname, true, false);
4495 ciphername = cipher_kt_name(kt.cipher);
4496 if (cipher_defined(o->ciphername))
4497 {
4498 keysize = cipher_kt_key_size(kt.cipher) * 8;
4499 }
4500 }
4501 /* Only announce the cipher to our peer if we are willing to
4502 * support it */
4503 if (p2p_nopull || tls_item_in_cipher_list(ciphername, o->ncp_ciphers))
4504 {
4505 buf_printf(&out, ",cipher %s", ciphername);
4506 }
4507 buf_printf(&out, ",auth %s", md_kt_name(kt.digest));
4508 buf_printf(&out, ",keysize %zu", keysize);
4509 if (o->shared_secret_file)
4510 {
4511 buf_printf(&out, ",secret");
4512 }
4513 }
4514
4515 /*
4516 * SSL Options
4517 */
4518 {
4519 if (TLS_CLIENT || TLS_SERVER)
4520 {
4521 if (o->ce.tls_auth_file)
4522 {
4523 buf_printf(&out, ",tls-auth");
4524 }
4525 /* Not adding tls-crypt here, because we won't reach this code if
4526 * tls-auth/tls-crypt does not match. Removing tls-auth here would
4527 * break stuff, so leaving that in place. */
4528
4529 buf_printf(&out, ",key-method %d", KEY_METHOD_2);
4530 }
4531
4532 if (remote)
4533 {
4534 if (TLS_CLIENT)
4535 {
4536 buf_printf(&out, ",tls-server");
4537 }
4538 else if (TLS_SERVER)
4539 {
4540 buf_printf(&out, ",tls-client");
4541 }
4542 }
4543 else
4544 {
4545 if (TLS_CLIENT)
4546 {
4547 buf_printf(&out, ",tls-client");
4548 }
4549 else if (TLS_SERVER)
4550 {
4551 buf_printf(&out, ",tls-server");
4552 }
4553 }
4554 }
4555
4556#undef TLS_CLIENT
4557#undef TLS_SERVER
4558
4559 return BSTR(&out);
4560}
4561
4562/*
4563 * Compare option strings for equality.
4564 * If the first two chars of the strings differ, it means that
4565 * we are looking at different versions of the options string,
4566 * therefore don't compare them and return true.
4567 */
4568
4569bool
4570options_cmp_equal(char *actual, const char *expected)
4571{
4572 return options_cmp_equal_safe(actual, expected, strlen(actual) + 1);
4573}
4574
4575void
4576options_warning(char *actual, const char *expected)
4577{
4578 options_warning_safe(actual, expected, strlen(actual) + 1);
4579}
4580
4581static const char *
4582options_warning_extract_parm1(const char *option_string, struct gc_arena *gc_ret)
4583{
4584 struct gc_arena gc = gc_new();
4585 struct buffer b = string_alloc_buf(option_string, &gc);
4586 char *p = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4587 const char *ret;
4588
4589 buf_parse(&b, ' ', p, OPTION_PARM_SIZE);
4590 ret = string_alloc(p, gc_ret);
4591 gc_free(&gc);
4592 return ret;
4593}
4594
4595static void
4596options_warning_safe_scan2(const msglvl_t msglevel, const int delim,
4597 const bool report_inconsistent, const char *p1,
4598 const struct buffer *b2_src, const char *b1_name,
4599 const char *b2_name)
4600{
4601 /* We will stop sending 'key-method', 'keydir', 'proto' and 'tls-auth' in
4602 * OCC in a future version (because it's not useful). To reduce questions
4603 * when interoperating, we no longer printing a warning about it.
4604 */
4605 if (strprefix(p1, "key-method ") || strprefix(p1, "keydir ") || strprefix(p1, "proto ")
4606 || streq(p1, "tls-auth") || strprefix(p1, "tun-ipv6") || strprefix(p1, "cipher "))
4607 {
4608 return;
4609 }
4610
4611 if (strlen(p1) > 0)
4612 {
4613 struct gc_arena gc = gc_new();
4614 struct buffer b2 = *b2_src;
4615 const char *p1_prefix = options_warning_extract_parm1(p1, &gc);
4616 char *p2 = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4617
4618 while (buf_parse(&b2, delim, p2, OPTION_PARM_SIZE))
4619 {
4620 if (strlen(p2))
4621 {
4622 const char *p2_prefix = options_warning_extract_parm1(p2, &gc);
4623
4624 if (!strcmp(p1, p2))
4625 {
4626 goto done;
4627 }
4628 if (!strcmp(p1_prefix, p2_prefix))
4629 {
4630 if (report_inconsistent)
4631 {
4632 msg(msglevel, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
4633 safe_print(p1_prefix, &gc), b1_name, safe_print(p1, &gc), b2_name,
4634 safe_print(p2, &gc));
4635 }
4636 goto done;
4637 }
4638 }
4639 }
4640
4641 msg(msglevel, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
4642 safe_print(p1_prefix, &gc), b1_name, b2_name, b1_name, safe_print(p1, &gc));
4643
4644done:
4645 gc_free(&gc);
4646 }
4647}
4648
4649static void
4650options_warning_safe_scan1(const msglvl_t msglevel, const int delim,
4651 const bool report_inconsistent, const struct buffer *b1_src,
4652 const struct buffer *b2_src, const char *b1_name, const char *b2_name)
4653{
4654 struct gc_arena gc = gc_new();
4655 struct buffer b = *b1_src;
4656 char *p = gc_malloc(OPTION_PARM_SIZE, true, &gc);
4657
4658 while (buf_parse(&b, delim, p, OPTION_PARM_SIZE))
4659 {
4660 options_warning_safe_scan2(msglevel, delim, report_inconsistent, p, b2_src, b1_name,
4661 b2_name);
4662 }
4663
4664 gc_free(&gc);
4665}
4666
4667static void
4668options_warning_safe_ml(const msglvl_t msglevel, char *actual, const char *expected, size_t actual_n)
4669{
4670 struct gc_arena gc = gc_new();
4671
4672 if (actual_n > 0)
4673 {
4674 struct buffer local = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4675 struct buffer remote = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4676 actual[actual_n - 1] = 0;
4677
4678 buf_printf(&local, "version %s", expected);
4679 buf_printf(&remote, "version %s", actual);
4680
4681 options_warning_safe_scan1(msglevel, ',', true, &local, &remote, "local", "remote");
4682
4683 options_warning_safe_scan1(msglevel, ',', false, &remote, &local, "remote", "local");
4684 }
4685
4686 gc_free(&gc);
4687}
4688
4689bool
4690options_cmp_equal_safe(char *actual, const char *expected, size_t actual_n)
4691{
4692 struct gc_arena gc = gc_new();
4693 bool ret = true;
4694
4695 if (actual_n > 0)
4696 {
4697 actual[actual_n - 1] = 0;
4698 if (strncmp(actual, expected, 2))
4699 {
4700 msg(D_SHOW_OCC, "NOTE: Options consistency check may be skewed by version differences");
4701 options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4702 }
4703 else
4704 {
4705 ret = !strcmp(actual, expected);
4706 }
4707 }
4708 gc_free(&gc);
4709 return ret;
4710}
4711
4712void
4713options_warning_safe(char *actual, const char *expected, size_t actual_n)
4714{
4715 options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4716}
4717
4718const char *
4719options_string_version(const char *s, struct gc_arena *gc)
4720{
4721 struct buffer out = alloc_buf_gc(4, gc);
4722 strncpynt((char *)BPTR(&out), s, 3);
4723 return BSTR(&out);
4724}
4725
4726#if defined(__GNUC__) || defined(__clang__)
4727#pragma GCC diagnostic push
4728#pragma GCC diagnostic ignored "-Wsign-compare"
4729#endif
4730
4731char *
4732options_string_extract_option(const char *options_string, const char *opt_name, struct gc_arena *gc)
4733{
4734 char *ret = NULL;
4735 const size_t opt_name_len = strlen(opt_name);
4736
4737 const char *p = options_string;
4738 while (p)
4739 {
4740 if (0 == strncmp(p, opt_name, opt_name_len) && strlen(p) > (opt_name_len + 1)
4741 && p[opt_name_len] == ' ')
4742 {
4743 /* option found, extract value */
4744 const char *start = &p[opt_name_len + 1];
4745 const char *end = strchr(p, ',');
4746 size_t val_len = end ? end - start : strlen(start);
4747 ret = gc_malloc(val_len + 1, true, gc);
4748 memcpy(ret, start, val_len);
4749 break;
4750 }
4751 p = strchr(p, ',');
4752 if (p)
4753 {
4754 p++; /* skip delimiter */
4755 }
4756 }
4757 return ret;
4758}
4759
4760#if defined(__GNUC__) || defined(__clang__)
4761#pragma GCC diagnostic pop
4762#endif
4763
4764/*
4765 * parse/print topology coding
4766 */
4767
4768int
4769parse_topology(const char *str, const msglvl_t msglevel)
4770{
4771 if (streq(str, "net30"))
4772 {
4773 return TOP_NET30;
4774 }
4775 else if (streq(str, "p2p"))
4776 {
4777 return TOP_P2P;
4778 }
4779 else if (streq(str, "subnet"))
4780 {
4781 return TOP_SUBNET;
4782 }
4783 else
4784 {
4785 msg(msglevel, "--topology must be net30, p2p, or subnet");
4786 return TOP_UNDEF;
4787 }
4788}
4789
4790const char *
4791print_topology(const int topology)
4792{
4793 switch (topology)
4794 {
4795 case TOP_UNDEF:
4796 return "undef";
4797
4798 case TOP_NET30:
4799 return "net30";
4800
4801 case TOP_P2P:
4802 return "p2p";
4803
4804 case TOP_SUBNET:
4805 return "subnet";
4806
4807 default:
4808 return "unknown";
4809 }
4810}
4811
4812/*
4813 * Manage auth-retry variable
4814 */
4815
4816static int global_auth_retry; /* GLOBAL */
4817
4818int
4819auth_retry_get(void)
4820{
4821 return global_auth_retry;
4822}
4823
4824bool
4825auth_retry_set(const msglvl_t msglevel, const char *option)
4826{
4827 if (streq(option, "interact"))
4828 {
4829 global_auth_retry = AR_INTERACT;
4830 }
4831 else if (streq(option, "nointeract"))
4832 {
4833 global_auth_retry = AR_NOINTERACT;
4834 }
4835 else if (streq(option, "none"))
4836 {
4837 global_auth_retry = AR_NONE;
4838 }
4839 else
4840 {
4841 msg(msglevel, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
4842 return false;
4843 }
4844 return true;
4845}
4846
4847const char *
4848auth_retry_print(void)
4849{
4850 switch (global_auth_retry)
4851 {
4852 case AR_NONE:
4853 return "none";
4854
4855 case AR_NOINTERACT:
4856 return "nointeract";
4857
4858 case AR_INTERACT:
4859 return "interact";
4860
4861 default:
4862 return "???";
4863 }
4864}
4865
4866/*
4867 * Print the help message.
4868 */
4869void
4870usage(void)
4871{
4872 FILE *fp = msg_fp(0);
4873
4874#ifdef ENABLE_SMALL
4875
4876 fprintf(fp, "Usage message not available\n");
4877
4878#else
4879
4880 struct options o;
4881 init_options(&o);
4882
4883 fprintf(fp, usage_message, title_string, o.ce.connect_retry_seconds,
4884 o.ce.connect_retry_seconds_max, o.ce.local_port, o.ce.remote_port, TUN_MTU_DEFAULT,
4885 TAP_MTU_EXTRA_DEFAULT, TUN_MTU_MAX_MIN, o.verbosity, o.authname, o.replay_window,
4886 o.replay_time, o.tls_timeout, o.renegotiate_seconds, o.handshake_window,
4887 o.transition_window);
4888 fflush(fp);
4889
4890#endif /* ENABLE_SMALL */
4891
4892 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4893}
4894
4895void
4896usage_small(void)
4897{
4898 msg(M_WARN | M_NOPREFIX, "Use --help for more information.");
4899 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4900}
4901
4902#ifdef _WIN32
4903void
4904show_windows_version(const unsigned int flags)
4905{
4906 struct gc_arena gc = gc_new();
4907 msg(flags, "Windows version: %s", win32_version_string(&gc));
4908 gc_free(&gc);
4909}
4910#endif
4911
4912void
4913show_dco_version(const unsigned int flags)
4914{
4915#ifdef ENABLE_DCO
4916 struct gc_arena gc = gc_new();
4917 msg(flags, "DCO version: %s", dco_version_string(&gc));
4918 gc_free(&gc);
4919#endif
4920}
4921
4922void
4923show_library_versions(const unsigned int flags)
4924{
4925#ifdef ENABLE_LZO
4926#define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
4927#else
4928#define LZO_LIB_VER_STR "", ""
4929#endif
4930
4931 msg(flags, "library versions: %s%s%s", get_ssl_library_version(), LZO_LIB_VER_STR);
4932
4933#undef LZO_LIB_VER_STR
4934}
4935
4936static void
4937usage_version(void)
4938{
4939 msg(M_INFO | M_NOPREFIX, "%s", title_string);
4940 show_library_versions(M_INFO | M_NOPREFIX);
4941#ifdef _WIN32
4942 show_windows_version(M_INFO | M_NOPREFIX);
4943#endif
4944 show_dco_version(M_INFO | M_NOPREFIX);
4945 msg(M_INFO | M_NOPREFIX, "Originally developed by James Yonan");
4946 msg(M_INFO | M_NOPREFIX, "Copyright (C) 2002-2026 OpenVPN Inc <sales@openvpn.net>");
4947#ifndef ENABLE_SMALL
4948#ifdef CONFIGURE_DEFINES
4949 msg(M_INFO | M_NOPREFIX, "Compile time defines: %s", CONFIGURE_DEFINES);
4950#endif
4951#ifdef CONFIGURE_SPECIAL_BUILD
4952 msg(M_INFO | M_NOPREFIX, "special build: %s", CONFIGURE_SPECIAL_BUILD);
4953#endif
4954#endif
4955 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD);
4956}
4957
4958void
4959notnull(const char *arg, const char *description)
4960{
4961 if (!arg)
4962 {
4963 msg(M_USAGE, "You must define %s", description);
4964 }
4965}
4966
4967bool
4968string_defined_equal(const char *s1, const char *s2)
4969{
4970 if (s1 && s2)
4971 {
4972 return !strcmp(s1, s2);
4973 }
4974 else
4975 {
4976 return false;
4977 }
4978}
4979
4980#if 0
4981static void
4982ping_rec_err(msglvl_t msglevel)
4983{
4984 msg(msglevel, "only one of --ping-exit or --ping-restart options may be specified");
4985}
4986#endif
4987
4988#ifdef _WIN32 /* This function is only used when compiling on Windows */
4989static unsigned int
4990atou(const char *str)
4991{
4992 unsigned int val = 0;
4993 sscanf(str, "%u", &val);
4994 return val;
4995}
4996#endif
4997
4998#define VERIFY_PERMISSION(mask) \
4999 { \
5000 if (!verify_permission(p[0], file, line, (mask), permission_mask, option_types_found, \
5001 msglevel, options, is_inline)) \
5002 { \
5003 goto err; \
5004 } \
5005 }
5006
5007static bool
5008verify_permission(const char *name, const char *file, int line, const uint64_t type,
5009 const uint64_t allowed, uint64_t *found, const msglvl_t msglevel,
5010 struct options *options, bool is_inline)
5011{
5012 if (!(type & allowed))
5013 {
5014 msg(msglevel, "option '%s' cannot be used in this context (%s)", name, file);
5015 return false;
5016 }
5017
5018 if (is_inline && !(type & OPT_P_INLINE))
5019 {
5020 msg(msglevel, "option '%s' is not expected to be inline (%s:%d)", name, file, line);
5021 return false;
5022 }
5023
5024 if (found)
5025 {
5026 *found |= type;
5027 }
5028
5029#ifndef ENABLE_SMALL
5030 /* Check if this options is allowed in connection block,
5031 * but we are currently not in a connection block
5032 * unless this is a pushed option.
5033 * Parsing a connection block uses a temporary options struct without
5034 * connection_list
5035 */
5036
5037 if ((type & OPT_P_CONNECTION) && options->connection_list && !(allowed & OPT_P_PULL_MODE))
5038 {
5039 if (file)
5040 {
5041 msg(M_WARN, "Option '%s' in %s:%d is ignored by previous <connection> blocks ", name,
5042 file, line);
5043 }
5044 else
5045 {
5046 msg(M_WARN, "Option '%s' is ignored by previous <connection> blocks", name);
5047 }
5048 }
5049#endif
5050 return true;
5051}
5052
5053/*
5054 * Check that an option doesn't have too
5055 * many parameters.
5056 */
5057
5058#define NM_QUOTE_HINT (1 << 0)
5059
5060static bool
5061no_more_than_n_args(const msglvl_t msglevel, char *p[], const int max, const unsigned int flags)
5062{
5063 const int len = string_array_len((const char **)p);
5064
5065 if (!len)
5066 {
5067 return false;
5068 }
5069
5070 if (len > max)
5071 {
5072 msg(msglevel, "the --%s directive should have at most %d parameter%s.%s", p[0], max - 1,
5073 max >= 3 ? "s" : "",
5074 (flags & NM_QUOTE_HINT)
5075 ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")."
5076 : "");
5077 return false;
5078 }
5079 else
5080 {
5081 return true;
5082 }
5083}
5084
5085static inline msglvl_t
5086msglevel_forward_compatible(struct options *options, const msglvl_t msglevel)
5087{
5088 return options->forward_compatible ? M_WARN : msglevel;
5089}
5090
5091#define RESET_OPTION_ROUTES(option_ptr, field) \
5092 if (option_ptr) \
5093 { \
5094 option_ptr->field = NULL; \
5095 option_ptr->flags = 0; \
5096 }
5097
5098void
5099remove_option(struct context *c, struct options *options, char *p[], bool is_inline,
5100 const char *file, int line, const msglvl_t msglevel,
5101 const uint64_t permission_mask, uint64_t *option_types_found,
5102 struct env_set *es)
5103{
5104 msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
5105
5106 if (streq(p[0], "ifconfig") && !p[1])
5107 {
5108 VERIFY_PERMISSION(OPT_P_UP);
5109 options->ifconfig_local = NULL;
5110 options->ifconfig_remote_netmask = NULL;
5111 }
5112 else if (streq(p[0], "ifconfig-ipv6") && !p[1])
5113 {
5114 VERIFY_PERMISSION(OPT_P_UP);
5115 options->ifconfig_ipv6_local = NULL;
5116 options->ifconfig_ipv6_netbits = 0;
5117 options->ifconfig_ipv6_remote = NULL;
5118 }
5119 else if (streq(p[0], "route") && !p[1])
5120 {
5121 VERIFY_PERMISSION(OPT_P_ROUTE);
5122 if (c->c1.route_list)
5123 {
5124 delete_routes_v4(c->c1.route_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options), es,
5125 &c->net_ctx);
5126 RESET_OPTION_ROUTES(options->routes, routes);
5127 }
5128 }
5129 else if (streq(p[0], "route-ipv6") && !p[1])
5130 {
5131 VERIFY_PERMISSION(OPT_P_ROUTE);
5132 if (c->c1.route_ipv6_list)
5133 {
5134 delete_routes_v6(c->c1.route_ipv6_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options),
5135 es, &c->net_ctx);
5136 RESET_OPTION_ROUTES(options->routes_ipv6, routes_ipv6);
5137 }
5138 }
5139 else if (streq(p[0], "route-gateway") && !p[1])
5140 {
5141 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
5142 options->route_gateway_via_dhcp = false;
5143 options->route_default_gateway = NULL;
5144 }
5145 else if (streq(p[0], "route-metric") && !p[1])
5146 {
5147 VERIFY_PERMISSION(OPT_P_ROUTE);
5148 options->route_default_metric = 0;
5149 }
5150 else if (streq(p[0], "push-continuation") && !p[1])
5151 {
5152 VERIFY_PERMISSION(OPT_P_PULL_MODE);
5153 options->push_continuation = 0;
5154 }
5155 else if ((streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private")) && !p[1])
5156 {
5157 VERIFY_PERMISSION(OPT_P_ROUTE);
5158 if (options->routes)
5159 {
5160 options->routes->flags = 0;
5161 }
5162 if (options->routes_ipv6)
5163 {
5164 options->routes_ipv6->flags = 0;
5165 }
5166 env_set_del(es, "route_redirect_gateway_ipv4");
5167 env_set_del(es, "route_redirect_gateway_ipv6");
5168 }
5169 else if (streq(p[0], "dns") && !p[1])
5170 {
5171 VERIFY_PERMISSION(OPT_P_DHCPDNS);
5172 gc_free(&options->dns_options.gc);
5173 CLEAR(options->dns_options);
5174 }
5175 else if (streq(p[0], "topology") && !p[1])
5176 {
5177 VERIFY_PERMISSION(OPT_P_UP);
5178 options->topology = TOP_UNDEF;
5179 helper_setdefault_topology(options);
5180 }
5181 else if (streq(p[0], "tun-mtu") && !p[1])
5182 {
5183 VERIFY_PERMISSION(OPT_P_PUSH_MTU | OPT_P_CONNECTION);
5184 options->ce.tun_mtu = TUN_MTU_DEFAULT;
5185 options->ce.tun_mtu_defined = false;
5186 options->ce.occ_mtu = 0;
5187 }
5188 else if (streq(p[0], "block-ipv6") && !p[1])
5189 {
5190 VERIFY_PERMISSION(OPT_P_ROUTE);
5191 options->block_ipv6 = false;
5192 }
5193#if defined(_WIN32) || defined(TARGET_ANDROID)
5194 else if (streq(p[0], "dhcp-option") && !p[1])
5195 {
5196 struct tuntap_options *o = &options->tuntap_options;
5197 VERIFY_PERMISSION(OPT_P_DHCPDNS);
5198
5199 o->domain = NULL;
5200 o->netbios_scope = NULL;
5201 o->netbios_node_type = 0;
5202 o->dns6_len = 0;
5203 memset(o->dns6, 0, sizeof(o->dns6));
5204 o->dns_len = 0;
5205 memset(o->dns, 0, sizeof(o->dns));
5206 o->wins_len = 0;
5207 memset(o->wins, 0, sizeof(o->wins));
5208 o->ntp_len = 0;
5209 memset(o->ntp, 0, sizeof(o->ntp));
5210 o->nbdd_len = 0;
5211 memset(o->nbdd, 0, sizeof(o->nbdd));
5212 while (o->domain_search_list_len-- > 0)
5213 {
5214 o->domain_search_list[o->domain_search_list_len] = NULL;
5215 }
5216 o->disable_nbt = 0;
5217 o->dhcp_options = 0;
5218#if defined(TARGET_ANDROID)
5219 o->http_proxy_port = 0;
5220 o->http_proxy = NULL;
5221#endif
5222 }
5223#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
5224#ifdef _WIN32
5225 else if (streq(p[0], "block-outside-dns") && !p[1])
5226 {
5227 VERIFY_PERMISSION(OPT_P_DHCPDNS);
5228 options->block_outside_dns = false;
5229 }
5230#else /* ifdef _WIN32 */
5231 else if (streq(p[0], "dhcp-option") && !p[1])
5232 {
5233 VERIFY_PERMISSION(OPT_P_DHCPDNS);
5234 delete_all_dhcp_fo(options, &es->list);
5235 }
5236#endif
5237 else
5238 {
5239 msglvl_t msglevel_unknown = msglevel_fc;
5240 /* Check if an option is in --ignore-unknown-option and
5241 * set warning level to non fatal */
5242 for (int i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
5243 {
5244 if (streq(p[0], options->ignore_unknown_option[i]))
5245 {
5246 msglevel_unknown = M_WARN;
5247 break;
5248 }
5249 }
5250 msg(msglevel_unknown,
5251 "Unrecognized option or missing or extra parameter(s) in %s:%d: -%s (%s)", file, line,
5252 p[0], PACKAGE_VERSION);
5253 }
5254 return;
5255err:
5256 msg(msglevel, "Error occurred trying to remove %s option", p[0]);
5257}
5258
5259
5260static bool
5261check_route_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
5262{
5263 rol_check_alloc(options);
5264 if (pull_mode)
5265 {
5266 if (!ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
5267 && !is_special_addr(p[1])) /* FQDN -- may be DNS name */
5268 {
5269 msg(msglevel, "route parameter network/IP '%s' must be a valid address", p[1]);
5270 return false;
5271 }
5272 if (p[2] && !ip_addr_dotted_quad_safe(p[2])) /* FQDN -- must be IP address */
5273 {
5274 msg(msglevel, "route parameter netmask '%s' must be an IP address", p[2]);
5275 return false;
5276 }
5277 if (p[3] && !ip_or_dns_addr_safe(p[3], options->allow_pull_fqdn)
5278 && !is_special_addr(p[3])) /* FQDN -- may be DNS name */
5279 {
5280 msg(msglevel, "route parameter gateway '%s' must be a valid address", p[3]);
5281 return false;
5282 }
5283 }
5284 return true;
5285}
5286
5287
5288static bool
5289check_route6_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
5290{
5291 rol6_check_alloc(options);
5292 if (pull_mode)
5293 {
5294 if (!ipv6_addr_safe_hexplusbits(p[1]))
5295 {
5296 msg(msglevel, "route-ipv6 parameter network/IP '%s' must be a valid address", p[1]);
5297 return false;
5298 }
5299 if (p[2] && !ipv6_addr_safe(p[2]))
5300 {
5301 msg(msglevel, "route-ipv6 parameter gateway '%s' must be a valid address", p[2]);
5302 return false;
5303 }
5304 /* p[3] is metric, if present */
5305 }
5306 return true;
5307}
5308
5309static bool
5310check_dns_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
5311{
5312 if (streq(p[1], "search-domains") && p[2])
5313 {
5314 if (!dns_domain_list_append(&options->dns_options.search_domains, &p[2],
5315 &options->dns_options.gc))
5316 {
5317 msg(msglevel, "--dns %s contain invalid characters", p[1]);
5318 return false;
5319 }
5320 }
5321 else if (streq(p[1], "server") && p[2] && p[3] && p[4])
5322 {
5323 long priority;
5324 if (!dns_server_priority_parse(&priority, p[2], pull_mode))
5325 {
5326 msg(msglevel, "--dns server: invalid priority value '%s'", p[2]);
5327 return false;
5328 }
5329
5330 struct dns_server *server =
5331 dns_server_get(&options->dns_options.servers, priority, &options->dns_options.gc);
5332
5333 if (streq(p[3], "address"))
5334 {
5335 for (int i = 4; p[i]; ++i)
5336 {
5337 if (!dns_server_addr_parse(server, p[i]))
5338 {
5339 msg(msglevel, "--dns server %ld: malformed address or maximum exceeded '%s'",
5340 priority, p[i]);
5341 return false;
5342 }
5343 }
5344 }
5345 else if (streq(p[3], "resolve-domains"))
5346 {
5347 if (!dns_domain_list_append(&server->domains, &p[4], &options->dns_options.gc))
5348 {
5349 msg(msglevel, "--dns server %ld: %s contain invalid characters", priority, p[3]);
5350 return false;
5351 }
5352 }
5353 else if (streq(p[3], "dnssec") && !p[5])
5354 {
5355 if (streq(p[4], "yes"))
5356 {
5357 server->dnssec = DNS_SECURITY_YES;
5358 }
5359 else if (streq(p[4], "no"))
5360 {
5361 server->dnssec = DNS_SECURITY_NO;
5362 }
5363 else if (streq(p[4], "optional"))
5364 {
5365 server->dnssec = DNS_SECURITY_OPTIONAL;
5366 }
5367 else
5368 {
5369 msg(msglevel, "--dns server %ld: malformed dnssec value '%s'", priority, p[4]);
5370 return false;
5371 }
5372 }
5373 else if (streq(p[3], "transport") && !p[5])
5374 {
5375 if (streq(p[4], "plain"))
5376 {
5377 server->transport = DNS_TRANSPORT_PLAIN;
5378 }
5379 else if (streq(p[4], "DoH"))
5380 {
5381 server->transport = DNS_TRANSPORT_HTTPS;
5382 }
5383 else if (streq(p[4], "DoT"))
5384 {
5385 server->transport = DNS_TRANSPORT_TLS;
5386 }
5387 else
5388 {
5389 msg(msglevel, "--dns server %ld: malformed transport value '%s'", priority, p[4]);
5390 return false;
5391 }
5392 }
5393 else if (streq(p[3], "sni") && !p[5])
5394 {
5395 if (!validate_domain(p[4]))
5396 {
5397 msg(msglevel, "--dns server %ld: %s contains invalid characters", priority, p[3]);
5398 return false;
5399 }
5400 server->sni = p[4];
5401 }
5402 else
5403 {
5404 msg(msglevel,
5405 "--dns server %ld: unknown option type '%s' or missing or unknown parameter",
5406 priority, p[3]);
5407 return false;
5408 }
5409 }
5410 else
5411 {
5412 msg(msglevel, "--dns: unknown option type '%s' or missing or unknown parameter", p[1]);
5413 return false;
5414 }
5415 return true;
5416}
5417
5418void
5419update_option(struct context *c, struct options *options, char *p[], bool is_inline,
5420 const char *file, int line, const int level, const msglvl_t msglevel,
5421 const uint64_t permission_mask, uint64_t *option_types_found,
5422 struct env_set *es)
5423{
5424 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
5425 ASSERT(MAX_PARMS >= 7);
5426
5427 if (streq(p[0], "route") && p[1] && !p[5])
5428 {
5429 if (!(options->push_update_options_found & OPT_P_U_ROUTE))
5430 {
5431 VERIFY_PERMISSION(OPT_P_ROUTE);
5432 if (!check_route_option(options, p, msglevel, pull_mode))
5433 {
5434 goto err;
5435 }
5436 if (c->c1.route_list)
5437 {
5438 delete_routes_v4(c->c1.route_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options),
5439 es, &c->net_ctx);
5440 RESET_OPTION_ROUTES(options->routes, routes);
5441 }
5442 options->push_update_options_found |= OPT_P_U_ROUTE;
5443 }
5444 }
5445 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
5446 {
5447 if (!(options->push_update_options_found & OPT_P_U_ROUTE6))
5448 {
5449 VERIFY_PERMISSION(OPT_P_ROUTE);
5450 if (!check_route6_option(options, p, msglevel, pull_mode))
5451 {
5452 goto err;
5453 }
5454 if (c->c1.route_ipv6_list)
5455 {
5456 delete_routes_v6(c->c1.route_ipv6_list, c->c1.tuntap,
5457 ROUTE_OPTION_FLAGS(&c->options), es, &c->net_ctx);
5458 RESET_OPTION_ROUTES(options->routes_ipv6, routes_ipv6);
5459 }
5460 options->push_update_options_found |= OPT_P_U_ROUTE6;
5461 }
5462 }
5463 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
5464 {
5465 if (!(options->push_update_options_found & OPT_P_U_REDIR_GATEWAY))
5466 {
5467 VERIFY_PERMISSION(OPT_P_ROUTE);
5468 if (options->routes)
5469 {
5470 options->routes->flags = 0;
5471 }
5472 if (options->routes_ipv6)
5473 {
5474 options->routes_ipv6->flags = 0;
5475 }
5476 env_set_del(es, "route_redirect_gateway_ipv4");
5477 env_set_del(es, "route_redirect_gateway_ipv6");
5478 options->push_update_options_found |= OPT_P_U_REDIR_GATEWAY;
5479 }
5480 }
5481 else if (streq(p[0], "dns") && p[1])
5482 {
5483 if (!(options->push_update_options_found & OPT_P_U_DNS))
5484 {
5485 VERIFY_PERMISSION(OPT_P_DHCPDNS);
5486 if (!check_dns_option(options, p, msglevel, pull_mode))
5487 {
5488 goto err;
5489 }
5490 gc_free(&options->dns_options.gc);
5491 CLEAR(options->dns_options);
5492 options->push_update_options_found |= OPT_P_U_DNS;
5493 }
5494 }
5495#if defined(_WIN32) || defined(TARGET_ANDROID)
5496 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
5497 {
5498 if (!(options->push_update_options_found & OPT_P_U_DHCP))
5499 {
5500 struct tuntap_options *o = &options->tuntap_options;
5501 VERIFY_PERMISSION(OPT_P_DHCPDNS);
5502
5503 o->domain = NULL;
5504 o->netbios_scope = NULL;
5505 o->netbios_node_type = 0;
5506 o->dns6_len = 0;
5507 CLEAR(o->dns6);
5508 o->dns_len = 0;
5509 CLEAR(o->dns);
5510 o->wins_len = 0;
5511 CLEAR(o->wins);
5512 o->ntp_len = 0;
5513 CLEAR(o->ntp);
5514 o->nbdd_len = 0;
5515 CLEAR(o->nbdd);
5516 while (o->domain_search_list_len-- > 0)
5517 {
5518 o->domain_search_list[o->domain_search_list_len] = NULL;
5519 }
5520 o->disable_nbt = 0;
5521 o->dhcp_options = 0;
5522
5523 CLEAR(options->dns_options.from_dhcp);
5524#if defined(TARGET_ANDROID)
5525 o->http_proxy_port = 0;
5526 o->http_proxy = NULL;
5527#endif
5528 options->push_update_options_found |= OPT_P_U_DHCP;
5529 }
5530 }
5531#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
5532 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
5533 {
5534 if (!(options->push_update_options_found & OPT_P_U_DHCP))
5535 {
5536 VERIFY_PERMISSION(OPT_P_DHCPDNS);
5537 delete_all_dhcp_fo(options, &es->list);
5538 options->push_update_options_found |= OPT_P_U_DHCP;
5539 }
5540 }
5541#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
5542 add_option(options, p, is_inline, file, line, level, msglevel, permission_mask,
5543 option_types_found, es);
5544 return;
5545err:
5546 msg(msglevel, "Error occurred trying to update %s option", p[0]);
5547}
5548
5549static void
5550set_user_script(struct options *options, const char **script, const char *new_script,
5551 const char *type, bool in_chroot)
5552{
5553 if (*script)
5554 {
5555 msg(M_WARN,
5556 "Multiple --%s scripts defined. "
5557 "The previously configured script is overridden.",
5558 type);
5559 }
5560 *script = new_script;
5561 options->user_script_used = true;
5562
5563#ifndef ENABLE_SMALL
5564 {
5565 char script_name[100];
5566 snprintf(script_name, sizeof(script_name), "--%s script", type);
5567
5568 if (check_cmd_access(*script, script_name, (in_chroot ? options->chroot_dir : NULL)))
5569 {
5570 msg(M_USAGE, "Please correct this error.");
5571 }
5572 }
5573#endif
5574}
5575
5576static void
5577show_compression_warning(struct compress_options *info)
5578{
5579 if (comp_non_stub_enabled(info))
5580 {
5581 msg(M_WARN, "WARNING: Compression for receiving enabled. "
5582 "Compression has been used in the past to break encryption. "
5583 "Compression support is deprecated and we recommend to disable "
5584 "it completely.");
5585 }
5586}
5587
5588bool
5589key_is_external(const struct options *options)
5590{
5591 bool ret = false;
5592 ret = ret || (options->management_flags & MF_EXTERNAL_KEY);
5593#ifdef ENABLE_PKCS11
5594 ret = ret || (options->pkcs11_providers[0] != NULL);
5595#endif
5596#ifdef ENABLE_CRYPTOAPI
5597 ret = ret || options->cryptoapi_cert;
5598#endif
5599
5600 return ret;
5601}
5602
5603#if defined(__GNUC__) || defined(__clang__)
5604#pragma GCC diagnostic push
5605#pragma GCC diagnostic ignored "-Wsign-compare"
5606#endif
5607
5608void
5609add_option(struct options *options, char *p[], bool is_inline, const char *file, int line,
5610 const int level, const msglvl_t msglevel, const uint64_t permission_mask,
5611 uint64_t *option_types_found, struct env_set *es)
5612{
5613 struct gc_arena gc = gc_new();
5614 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
5615 msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
5616
5617 ASSERT(MAX_PARMS >= 7);
5618
5619 /*
5620 * If directive begins with "setenv opt" prefix, don't raise an error if
5621 * directive is unrecognized.
5622 */
5623 if (streq(p[0], "setenv") && p[1] && streq(p[1], "opt") && !(permission_mask & OPT_P_PULL_MODE))
5624 {
5625 if (!p[2])
5626 {
5627 p[2] = "setenv opt"; /* will trigger an error that includes setenv opt */
5628 }
5629 p += 2;
5630 msglevel_fc = M_WARN;
5631 }
5632
5633 if (!file)
5634 {
5635 file = "[CMD-LINE]";
5636 line = 1;
5637 }
5638 if (streq(p[0], "help"))
5639 {
5640 VERIFY_PERMISSION(OPT_P_GENERAL);
5641 usage();
5642 if (p[1])
5643 {
5644 msg(msglevel, "--help does not accept any parameters");
5645 goto err;
5646 }
5647 }
5648 if (streq(p[0], "version") && !p[1])
5649 {
5650 VERIFY_PERMISSION(OPT_P_GENERAL);
5651 usage_version();
5652 }
5653 else if (streq(p[0], "config") && p[1] && !p[2])
5654 {
5655 VERIFY_PERMISSION(OPT_P_CONFIG);
5656
5657 /* save first config file only in options */
5658 if (!options->config)
5659 {
5660 options->config = p[1];
5661 }
5662
5663 read_config_file(options, p[1], level, file, line, msglevel, permission_mask,
5664 option_types_found, es);
5665 }
5666#if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
5667 else if (streq(p[0], "show-gateway") && !p[2])
5668 {
5669 struct route_gateway_info rgi;
5670 struct route_ipv6_gateway_info rgi6;
5671 in_addr_t remote_ipv4 = 0;
5672 struct in6_addr remote_ipv6 = IN6ADDR_ANY_INIT;
5673 openvpn_net_ctx_t net_ctx;
5674 VERIFY_PERMISSION(OPT_P_GENERAL);
5675 if (p[1])
5676 {
5677 /* try parsing the argument as a v4 or v6 address - if
5678 * possible, the output will show the exact route there, and
5679 * "the default route" for the other protocol
5680 */
5681 remote_ipv4 = get_ip_addr(p[1], M_WARN, NULL);
5682 get_ipv6_addr(p[1], &remote_ipv6, NULL, M_WARN);
5683 }
5684 net_ctx_init(NULL, &net_ctx);
5685 get_default_gateway(&rgi, remote_ipv4, &net_ctx);
5686 get_default_gateway_ipv6(&rgi6, &remote_ipv6, &net_ctx);
5687 print_default_gateway(M_INFO, &rgi, &rgi6);
5688 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
5689 }
5690#endif
5691 else if (streq(p[0], "echo") || streq(p[0], "parameter"))
5692 {
5693 struct buffer string = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
5694 int j;
5695 bool good = true;
5696
5697 VERIFY_PERMISSION(OPT_P_ECHO);
5698
5699 for (j = 1; j < MAX_PARMS; ++j)
5700 {
5701 if (!p[j])
5702 {
5703 break;
5704 }
5705 if (j > 1)
5706 {
5707 good &= buf_printf(&string, " ");
5708 }
5709 good &= buf_printf(&string, "%s", p[j]);
5710 }
5711 if (good)
5712 {
5713 /* only message-related ECHO are logged, since other ECHOs
5714 * can potentially include security-sensitive strings */
5715 if (p[1] && strncmp(p[1], "msg", 3) == 0)
5716 {
5717 msg(M_INFO, "%s:%s", pull_mode ? "ECHO-PULL" : "ECHO", BSTR(&string));
5718 }
5719#ifdef ENABLE_MANAGEMENT
5720 if (management)
5721 {
5722 management_echo(management, BSTR(&string), pull_mode);
5723 }
5724#endif
5725 }
5726 else
5727 {
5728 msg(M_WARN, "echo/parameter option overflow");
5729 }
5730 }
5731#ifdef ENABLE_MANAGEMENT
5732 else if (streq(p[0], "management") && p[1] && p[2] && !p[4])
5733 {
5734 VERIFY_PERMISSION(OPT_P_GENERAL);
5735 if (streq(p[2], "unix"))
5736 {
5737#if UNIX_SOCK_SUPPORT
5738 options->management_flags |= MF_UNIX_SOCK;
5739#else
5740 msg(msglevel, "MANAGEMENT: this platform does not support unix domain sockets");
5741 goto err;
5742#endif
5743 }
5744
5745 options->management_addr = p[1];
5746 options->management_port = p[2];
5747 if (p[3])
5748 {
5749 options->management_user_pass = p[3];
5750 }
5751 }
5752 else if (streq(p[0], "management-client-user") && p[1] && !p[2])
5753 {
5754 VERIFY_PERMISSION(OPT_P_GENERAL);
5755 options->management_client_user = p[1];
5756 }
5757 else if (streq(p[0], "management-client-group") && p[1] && !p[2])
5758 {
5759 VERIFY_PERMISSION(OPT_P_GENERAL);
5760 options->management_client_group = p[1];
5761 }
5762 else if (streq(p[0], "management-query-passwords") && !p[1])
5763 {
5764 VERIFY_PERMISSION(OPT_P_GENERAL);
5765 options->management_flags |= MF_QUERY_PASSWORDS;
5766 }
5767 else if (streq(p[0], "management-query-remote") && !p[1])
5768 {
5769 VERIFY_PERMISSION(OPT_P_GENERAL);
5770 options->management_flags |= MF_QUERY_REMOTE;
5771 }
5772 else if (streq(p[0], "management-query-proxy") && !p[1])
5773 {
5774 VERIFY_PERMISSION(OPT_P_GENERAL);
5775 options->management_flags |= MF_QUERY_PROXY;
5776 }
5777 else if (streq(p[0], "management-hold") && !p[1])
5778 {
5779 VERIFY_PERMISSION(OPT_P_GENERAL);
5780 options->management_flags |= MF_HOLD;
5781 }
5782 else if (streq(p[0], "management-signal") && !p[1])
5783 {
5784 VERIFY_PERMISSION(OPT_P_GENERAL);
5785 options->management_flags |= MF_SIGNAL;
5786 }
5787 else if (streq(p[0], "management-forget-disconnect") && !p[1])
5788 {
5789 VERIFY_PERMISSION(OPT_P_GENERAL);
5790 options->management_flags |= MF_FORGET_DISCONNECT;
5791 }
5792 else if (streq(p[0], "management-up-down") && !p[1])
5793 {
5794 VERIFY_PERMISSION(OPT_P_GENERAL);
5795 options->management_flags |= MF_UP_DOWN;
5796 }
5797 else if (streq(p[0], "management-client") && !p[1])
5798 {
5799 VERIFY_PERMISSION(OPT_P_GENERAL);
5800 options->management_flags |= MF_CONNECT_AS_CLIENT;
5801 }
5802 else if (streq(p[0], "management-external-key"))
5803 {
5804 VERIFY_PERMISSION(OPT_P_GENERAL);
5805 for (int j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
5806 {
5807 if (streq(p[j], "nopadding"))
5808 {
5809 options->management_flags |= MF_EXTERNAL_KEY_NOPADDING;
5810 }
5811 else if (streq(p[j], "pkcs1"))
5812 {
5813 options->management_flags |= MF_EXTERNAL_KEY_PKCS1PAD;
5814 }
5815 else if (streq(p[j], "pss"))
5816 {
5817 options->management_flags |= MF_EXTERNAL_KEY_PSSPAD;
5818 }
5819 else if (streq(p[j], "digest"))
5820 {
5821 options->management_flags |= MF_EXTERNAL_KEY_DIGEST;
5822 }
5823 else
5824 {
5825 msg(msglevel, "Unknown management-external-key flag: %s", p[j]);
5826 }
5827 }
5828 /*
5829 * When no option is present, assume that only PKCS1
5830 * padding is supported
5831 */
5832 if (!(options->management_flags & (MF_EXTERNAL_KEY_NOPADDING | MF_EXTERNAL_KEY_PKCS1PAD)))
5833 {
5834 options->management_flags |= MF_EXTERNAL_KEY_PKCS1PAD;
5835 }
5836 options->management_flags |= MF_EXTERNAL_KEY;
5837 }
5838 else if (streq(p[0], "management-external-cert") && p[1] && !p[2])
5839 {
5840 VERIFY_PERMISSION(OPT_P_GENERAL);
5841 options->management_flags |= MF_EXTERNAL_CERT;
5842 options->management_certificate = p[1];
5843 }
5844 else if (streq(p[0], "management-client-auth") && !p[1])
5845 {
5846 VERIFY_PERMISSION(OPT_P_GENERAL);
5847 options->management_flags |= MF_CLIENT_AUTH;
5848 }
5849 else if (streq(p[0], "management-log-cache") && p[1] && !p[2])
5850 {
5851 VERIFY_PERMISSION(OPT_P_GENERAL);
5852 if (!atoi_constrained(p[1], &options->management_log_history_cache,
5853 p[0], 1, INT_MAX, msglevel))
5854 {
5855 goto err;
5856 }
5857 }
5858#endif /* ifdef ENABLE_MANAGEMENT */
5859#ifdef ENABLE_PLUGIN
5860 else if (streq(p[0], "plugin") && p[1])
5861 {
5862 VERIFY_PERMISSION(OPT_P_PLUGIN);
5863 if (!options->plugin_list)
5864 {
5865 options->plugin_list = plugin_option_list_new(&options->gc);
5866 }
5867 if (!plugin_option_list_add(options->plugin_list, &p[1], &options->gc))
5868 {
5869 msg(msglevel, "plugin add failed: %s", p[1]);
5870 goto err;
5871 }
5872 }
5873#endif
5874 else if (streq(p[0], "mode") && p[1] && !p[2])
5875 {
5876 VERIFY_PERMISSION(OPT_P_GENERAL);
5877 if (streq(p[1], "p2p"))
5878 {
5879 options->mode = MODE_POINT_TO_POINT;
5880 }
5881 else if (streq(p[1], "server"))
5882 {
5883 options->mode = MODE_SERVER;
5884 }
5885 else
5886 {
5887 msg(msglevel, "Bad --mode parameter: %s", p[1]);
5888 goto err;
5889 }
5890 }
5891 else if (streq(p[0], "dev") && p[1] && !p[2])
5892 {
5893 VERIFY_PERMISSION(OPT_P_GENERAL);
5894 options->dev = p[1];
5895 }
5896 else if (streq(p[0], "dev-type") && p[1] && !p[2])
5897 {
5898 VERIFY_PERMISSION(OPT_P_GENERAL);
5899 options->dev_type = p[1];
5900 }
5901#ifdef _WIN32
5902 else if (streq(p[0], "windows-driver") && p[1] && !p[2])
5903 {
5904 VERIFY_PERMISSION(OPT_P_GENERAL);
5905 msg(M_WARN,
5906 "DEPRECATED OPTION: windows-driver: In OpenVPN 2.7, the default Windows driver is ovpn-dco. "
5907 "If incompatible options are used, OpenVPN will fall back to tap-windows6. Wintun support has been removed.");
5908 }
5909#endif
5910 else if (streq(p[0], "disable-dco"))
5911 {
5912 options->disable_dco = true;
5913 }
5914 else if (streq(p[0], "dev-node") && p[1] && !p[2])
5915 {
5916 VERIFY_PERMISSION(OPT_P_GENERAL);
5917 options->dev_node = p[1];
5918 }
5919 else if (streq(p[0], "lladdr") && p[1] && !p[2])
5920 {
5921 VERIFY_PERMISSION(OPT_P_UP);
5922 if (mac_addr_safe(p[1])) /* MAC address only */
5923 {
5924 options->lladdr = p[1];
5925 }
5926 else
5927 {
5928 msg(msglevel, "lladdr parm '%s' must be a MAC address", p[1]);
5929 goto err;
5930 }
5931 }
5932 else if (streq(p[0], "topology") && p[1] && !p[2])
5933 {
5934 VERIFY_PERMISSION(OPT_P_UP);
5935 options->topology = parse_topology(p[1], msglevel);
5936 }
5937 else if (streq(p[0], "tun-ipv6") && !p[1])
5938 {
5939 if (!pull_mode)
5940 {
5941 msg(M_WARN,
5942 "Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.");
5943 }
5944 }
5945#ifdef ENABLE_IPROUTE
5946 else if (streq(p[0], "iproute") && p[1] && !p[2])
5947 {
5948 VERIFY_PERMISSION(OPT_P_GENERAL);
5949 iproute_path = p[1];
5950 }
5951#endif
5952 else if (streq(p[0], "ifconfig") && p[1] && p[2] && !p[3])
5953 {
5954 VERIFY_PERMISSION(OPT_P_UP);
5955 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
5956 && ip_or_dns_addr_safe(p[2], options->allow_pull_fqdn)) /* FQDN -- may be DNS name */
5957 {
5958 options->ifconfig_local = p[1];
5959 options->ifconfig_remote_netmask = p[2];
5960 }
5961 else
5962 {
5963 msg(msglevel, "ifconfig parms '%s' and '%s' must be valid addresses", p[1], p[2]);
5964 goto err;
5965 }
5966 }
5967 else if (streq(p[0], "ifconfig-ipv6") && p[1] && p[2] && !p[3])
5968 {
5969 unsigned int netbits;
5970
5971 VERIFY_PERMISSION(OPT_P_UP);
5972 if (get_ipv6_addr(p[1], NULL, &netbits, msglevel) && ipv6_addr_safe(p[2]))
5973 {
5974 if (netbits < 64 || netbits > 124)
5975 {
5976 msg(msglevel, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'",
5977 netbits);
5978 goto err;
5979 }
5980
5981 options->ifconfig_ipv6_local = get_ipv6_addr_no_netbits(p[1], &options->gc);
5982 options->ifconfig_ipv6_netbits = netbits;
5983 options->ifconfig_ipv6_remote = p[2];
5984 }
5985 else
5986 {
5987 msg(msglevel, "ifconfig-ipv6 parms '%s' and '%s' must be valid addresses", p[1], p[2]);
5988 goto err;
5989 }
5990 }
5991 else if (streq(p[0], "ifconfig-noexec") && !p[1])
5992 {
5993 VERIFY_PERMISSION(OPT_P_UP);
5994 options->ifconfig_noexec = true;
5995 }
5996 else if (streq(p[0], "ifconfig-nowarn") && !p[1])
5997 {
5998 VERIFY_PERMISSION(OPT_P_UP);
5999 options->ifconfig_nowarn = true;
6000 }
6001 else if (streq(p[0], "local") && p[1] && !p[4])
6002 {
6003 struct local_entry *e;
6004
6005 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6006
6007 e = alloc_local_entry(&options->ce, M_USAGE, &options->gc);
6008 ASSERT(e);
6009
6010 /* '*' is treated as 'ask the system to get some socket',
6011 * therefore force binding on a particular address only when
6012 * actually specified. */
6013 if (strcmp(p[1], "*") != 0)
6014 {
6015 e->local = p[1];
6016 }
6017
6018 if (p[2])
6019 {
6020 e->port = p[2];
6021 }
6022
6023 if (p[3])
6024 {
6025 e->proto = ascii2proto(p[3]);
6026 }
6027 }
6028 else if (streq(p[0], "remote-random") && !p[1])
6029 {
6030 VERIFY_PERMISSION(OPT_P_GENERAL);
6031 options->remote_random = true;
6032 }
6033 else if (streq(p[0], "connection") && p[1] && !p[3])
6034 {
6035 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6036 if (is_inline)
6037 {
6038 struct options sub;
6039 struct connection_entry *e;
6040
6041 init_options(&sub);
6042 sub.ce = options->ce;
6043 read_config_string("[CONNECTION-OPTIONS]", &sub, p[1], msglevel, OPT_P_CONNECTION,
6044 option_types_found, es);
6045 if (!sub.ce.remote)
6046 {
6047 msg(msglevel,
6048 "Each 'connection' block must contain exactly one 'remote' directive");
6049 uninit_options(&sub);
6050 goto err;
6051 }
6052
6053 e = alloc_connection_entry(options, msglevel);
6054 if (!e)
6055 {
6056 uninit_options(&sub);
6057 goto err;
6058 }
6059 *e = sub.ce;
6060 gc_transfer(&options->gc, &sub.gc);
6061 uninit_options(&sub);
6062 }
6063 }
6064 else if (streq(p[0], "ignore-unknown-option") && p[1])
6065 {
6066 int i;
6067 int j;
6068 int numignored = 0;
6069 const char **ignore;
6070
6071 VERIFY_PERMISSION(OPT_P_GENERAL);
6072 /* Find out how many options to be ignored */
6073 for (i = 1; p[i]; i++)
6074 {
6075 numignored++;
6076 }
6077
6078 /* add number of options already ignored */
6079 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
6080 {
6081 numignored++;
6082 }
6083
6084 /* Allocate array */
6085 ALLOC_ARRAY_GC(ignore, const char *, numignored + 1, &options->gc);
6086 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
6087 {
6088 ignore[i] = options->ignore_unknown_option[i];
6089 }
6090
6091 options->ignore_unknown_option = ignore;
6092
6093 for (j = 1; p[j]; j++)
6094 {
6095 /* Allow the user to specify ignore-unknown-option --opt too */
6096 if (p[j][0] == '-' && p[j][1] == '-')
6097 {
6098 options->ignore_unknown_option[i] = (p[j] + 2);
6099 }
6100 else
6101 {
6102 options->ignore_unknown_option[i] = p[j];
6103 }
6104 i++;
6105 }
6106
6107 options->ignore_unknown_option[i] = NULL;
6108 }
6109#if ENABLE_MANAGEMENT
6110 else if (streq(p[0], "http-proxy-override") && p[1] && p[2] && !p[4])
6111 {
6112 VERIFY_PERMISSION(OPT_P_GENERAL);
6113 options->http_proxy_override = parse_http_proxy_override(p[1], p[2], p[3], &options->gc);
6114 if (!options->http_proxy_override)
6115 {
6116 goto err;
6117 }
6118 }
6119#endif
6120 else if (streq(p[0], "remote") && p[1] && !p[4])
6121 {
6122 struct remote_entry re;
6123 re.remote = re.remote_port = NULL;
6124 re.proto = -1;
6125 re.af = 0;
6126
6127 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6128 re.remote = p[1];
6129 if (p[2])
6130 {
6131 re.remote_port = p[2];
6132 if (p[3])
6133 {
6134 const int proto = ascii2proto(p[3]);
6135 const sa_family_t af = ascii2af(p[3]);
6136 if (proto < 0)
6137 {
6138 msg(msglevel, "remote: bad protocol associated with host %s: '%s'", p[1], p[3]);
6139 goto err;
6140 }
6141 re.proto = proto;
6142 re.af = af;
6143 }
6144 }
6145 if (permission_mask & OPT_P_GENERAL)
6146 {
6147 struct remote_entry *e = alloc_remote_entry(options, msglevel);
6148 if (!e)
6149 {
6150 goto err;
6151 }
6152 *e = re;
6153 }
6154 else if (permission_mask & OPT_P_CONNECTION)
6155 {
6156 connection_entry_load_re(&options->ce, &re);
6157 }
6158 }
6159 else if (streq(p[0], "resolv-retry") && p[1] && !p[2])
6160 {
6161 VERIFY_PERMISSION(OPT_P_GENERAL);
6162 if (streq(p[1], "infinite"))
6163 {
6164 options->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
6165 }
6166 else
6167 {
6168 options->resolve_retry_seconds = positive_atoi(p[1], msglevel);
6169 }
6170 }
6171 else if ((streq(p[0], "preresolve") || streq(p[0], "ip-remote-hint")) && !p[2])
6172 {
6173 VERIFY_PERMISSION(OPT_P_GENERAL);
6174 options->resolve_in_advance = true;
6175 /* Note the ip-remote-hint and the argument p[1] are for
6176 * backward compatibility */
6177 if (p[1])
6178 {
6179 options->ip_remote_hint = p[1];
6180 }
6181 }
6182 else if (streq(p[0], "connect-retry") && p[1] && !p[3])
6183 {
6184 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6185 options->ce.connect_retry_seconds = positive_atoi(p[1], msglevel);
6186 /*
6187 * Limit the base value of retry wait interval to 16 bits to avoid
6188 * overflow when scaled up for exponential backoff
6189 */
6190 if (options->ce.connect_retry_seconds > 0xFFFF)
6191 {
6192 options->ce.connect_retry_seconds = 0xFFFF;
6193 msg(M_WARN, "connect retry wait interval truncated to %d",
6194 options->ce.connect_retry_seconds);
6195 }
6196
6197 if (p[2])
6198 {
6199 options->ce.connect_retry_seconds_max =
6200 max_int(positive_atoi(p[2], msglevel), options->ce.connect_retry_seconds);
6201 }
6202 }
6203 else if ((streq(p[0], "connect-timeout") || streq(p[0], "server-poll-timeout")) && p[1]
6204 && !p[2])
6205 {
6206 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6207 options->ce.connect_timeout = positive_atoi(p[1], msglevel);
6208 }
6209 else if (streq(p[0], "connect-retry-max") && p[1] && !p[2])
6210 {
6211 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6212 options->connect_retry_max = positive_atoi(p[1], msglevel);
6213 }
6214 else if (streq(p[0], "ipchange") && p[1])
6215 {
6216 VERIFY_PERMISSION(OPT_P_SCRIPT);
6217 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6218 {
6219 goto err;
6220 }
6221 set_user_script(options, &options->ipchange,
6222 string_substitute(p[1], ',', ' ', &options->gc), "ipchange", true);
6223 }
6224 else if (streq(p[0], "float") && !p[1])
6225 {
6226 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6227 options->ce.remote_float = true;
6228 }
6229#ifdef ENABLE_DEBUG
6230 else if (streq(p[0], "gremlin") && p[1] && !p[2])
6231 {
6232 VERIFY_PERMISSION(OPT_P_GENERAL);
6233 options->gremlin = positive_atoi(p[1], msglevel);
6234 }
6235#endif
6236 else if (streq(p[0], "chroot") && p[1] && !p[2])
6237 {
6238 VERIFY_PERMISSION(OPT_P_GENERAL);
6239 options->chroot_dir = p[1];
6240 }
6241 else if (streq(p[0], "cd") && p[1] && !p[2])
6242 {
6243 VERIFY_PERMISSION(OPT_P_GENERAL);
6244 if (platform_chdir(p[1]))
6245 {
6246 msg(M_ERR, "cd to '%s' failed", p[1]);
6247 goto err;
6248 }
6249 options->cd_dir = p[1];
6250 }
6251#ifdef ENABLE_SELINUX
6252 else if (streq(p[0], "setcon") && p[1] && !p[2])
6253 {
6254 VERIFY_PERMISSION(OPT_P_GENERAL);
6255 options->selinux_context = p[1];
6256 }
6257#endif
6258 else if (streq(p[0], "writepid") && p[1] && !p[2])
6259 {
6260 VERIFY_PERMISSION(OPT_P_GENERAL);
6261 options->writepid = p[1];
6262 }
6263 else if (streq(p[0], "up") && p[1])
6264 {
6265 VERIFY_PERMISSION(OPT_P_SCRIPT);
6266 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6267 {
6268 goto err;
6269 }
6270 set_user_script(options, &options->up_script, p[1], "up", false);
6271 }
6272 else if (streq(p[0], "down") && p[1])
6273 {
6274 VERIFY_PERMISSION(OPT_P_SCRIPT);
6275 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6276 {
6277 goto err;
6278 }
6279 set_user_script(options, &options->down_script, p[1], "down", true);
6280 }
6281 else if (streq(p[0], "down-pre") && !p[1])
6282 {
6283 VERIFY_PERMISSION(OPT_P_GENERAL);
6284 options->down_pre = true;
6285 }
6286 else if (streq(p[0], "up-delay") && !p[1])
6287 {
6288 VERIFY_PERMISSION(OPT_P_GENERAL);
6289 options->up_delay = true;
6290 }
6291 else if (streq(p[0], "up-restart") && !p[1])
6292 {
6293 VERIFY_PERMISSION(OPT_P_GENERAL);
6294 options->up_restart = true;
6295 }
6296 else if (streq(p[0], "syslog") && !p[2])
6297 {
6298 VERIFY_PERMISSION(OPT_P_GENERAL);
6299 open_syslog(p[1], false);
6300 }
6301 else if (streq(p[0], "daemon") && !p[2])
6302 {
6303 bool didit = false;
6304 VERIFY_PERMISSION(OPT_P_GENERAL);
6305 if (!options->daemon)
6306 {
6307 options->daemon = didit = true;
6308 open_syslog(p[1], false);
6309 }
6310 if (p[1])
6311 {
6312 if (!didit)
6313 {
6314 msg(M_WARN,
6315 "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)",
6316 p[1]);
6317 goto err;
6318 }
6319 }
6320 }
6321 else if (streq(p[0], "log") && p[1] && !p[2])
6322 {
6323 VERIFY_PERMISSION(OPT_P_GENERAL);
6324 options->log = true;
6325 redirect_stdout_stderr(p[1], false);
6326 }
6327 else if (streq(p[0], "suppress-timestamps") && !p[1])
6328 {
6329 VERIFY_PERMISSION(OPT_P_GENERAL);
6330 options->suppress_timestamps = true;
6331 set_suppress_timestamps(true);
6332 }
6333 else if (streq(p[0], "machine-readable-output") && !p[1])
6334 {
6335 VERIFY_PERMISSION(OPT_P_GENERAL);
6336 options->machine_readable_output = true;
6337 set_machine_readable_output(true);
6338 }
6339 else if (streq(p[0], "log-append") && p[1] && !p[2])
6340 {
6341 VERIFY_PERMISSION(OPT_P_GENERAL);
6342 options->log = true;
6343 redirect_stdout_stderr(p[1], true);
6344 }
6345 else if (streq(p[0], "mlock") && !p[1])
6346 {
6347 VERIFY_PERMISSION(OPT_P_GENERAL);
6348 options->mlock = true;
6349 }
6350#if ENABLE_IP_PKTINFO
6351 else if (streq(p[0], "multihome") && !p[2])
6352 {
6353 VERIFY_PERMISSION(OPT_P_GENERAL);
6354 options->sockflags |= SF_USE_IP_PKTINFO;
6355 if (p[1] && streq(p[1], "same-interface"))
6356 {
6357 options->sockflags |= SF_PKTINFO_COPY_IIF;
6358 }
6359 else if (p[1])
6360 {
6361 msg(msglevel, "Unknown parameter to --multihome: %s", p[1]);
6362 }
6363 }
6364#endif
6365 else if (streq(p[0], "verb") && p[1] && !p[2])
6366 {
6367 VERIFY_PERMISSION(OPT_P_MESSAGES);
6368 options->verbosity = positive_atoi(p[1], msglevel);
6369 if (options->verbosity >= (D_TLS_DEBUG_MED & M_DEBUG_LEVEL))
6370 {
6371 /* We pass this flag to the SSL library to avoid
6372 * mbed TLS always generating debug level logging */
6373 options->ssl_flags |= SSLF_TLS_DEBUG_ENABLED;
6374 }
6375#if !defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
6376 /* Warn when a debug verbosity is supplied when built without debug support */
6377 if (options->verbosity >= 7)
6378 {
6379 msg(M_WARN,
6380 "NOTE: debug verbosity (--verb %d) is enabled but this build lacks debug support.",
6381 options->verbosity);
6382 }
6383#endif
6384 }
6385 else if (streq(p[0], "mute") && p[1] && !p[2])
6386 {
6387 VERIFY_PERMISSION(OPT_P_MESSAGES);
6388 options->mute = positive_atoi(p[1], msglevel);
6389 }
6390 else if (streq(p[0], "errors-to-stderr") && !p[1])
6391 {
6392 VERIFY_PERMISSION(OPT_P_MESSAGES);
6393 errors_to_stderr();
6394 }
6395 else if (streq(p[0], "status") && p[1] && !p[3])
6396 {
6397 VERIFY_PERMISSION(OPT_P_GENERAL);
6398 options->status_file = p[1];
6399 if (p[2])
6400 {
6401 options->status_file_update_freq = positive_atoi(p[2], msglevel);
6402 }
6403 }
6404 else if (streq(p[0], "status-version") && p[1] && !p[2])
6405 {
6406 VERIFY_PERMISSION(OPT_P_GENERAL);
6407 if (!atoi_constrained(p[1], &options->status_file_version, p[0], 1, 3, msglevel))
6408 {
6409 goto err;
6410 }
6411 }
6412 else if (streq(p[0], "remap-usr1") && p[1] && !p[2])
6413 {
6414 VERIFY_PERMISSION(OPT_P_GENERAL);
6415 if (streq(p[1], "SIGHUP"))
6416 {
6417 options->remap_sigusr1 = SIGHUP;
6418 }
6419 else if (streq(p[1], "SIGTERM"))
6420 {
6421 options->remap_sigusr1 = SIGTERM;
6422 }
6423 else
6424 {
6425 msg(msglevel, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
6426 goto err;
6427 }
6428 }
6429 else if ((streq(p[0], "link-mtu") || streq(p[0], "udp-mtu")) && p[1] && !p[2])
6430 {
6431 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
6432 options->ce.link_mtu = positive_atoi(p[1], msglevel);
6433 options->ce.link_mtu_defined = true;
6434 }
6435 else if (streq(p[0], "tun-mtu") && p[1] && !p[3])
6436 {
6437 VERIFY_PERMISSION(OPT_P_PUSH_MTU | OPT_P_CONNECTION);
6438 if (atoi_constrained(p[1], &options->ce.tun_mtu, "tun-mtu", TUN_MTU_MIN, TUN_MTU_MAX, msglevel))
6439 {
6440 options->ce.tun_mtu_defined = true;
6441 if (p[2])
6442 {
6443 atoi_constrained(p[2], &options->ce.occ_mtu, "tun-mtu occ-mtu", TUN_MTU_MIN, TUN_MTU_MAX, msglevel);
6444 }
6445 else
6446 {
6447 options->ce.occ_mtu = 0;
6448 }
6449 }
6450 }
6451 else if (streq(p[0], "tun-mtu-max") && p[1] && !p[2])
6452 {
6453 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
6454 atoi_constrained(p[1], &options->ce.tun_mtu_max, p[0], TUN_MTU_MAX_MIN, TUN_MTU_MAX, msglevel);
6455 }
6456 else if (streq(p[0], "tun-mtu-extra") && p[1] && !p[2])
6457 {
6458 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
6459 if (atoi_constrained(p[1], &options->ce.tun_mtu_extra, p[0], 0, TUN_MTU_MAX, msglevel))
6460 {
6461 options->ce.tun_mtu_extra_defined = true;
6462 }
6463 }
6464 else if (streq(p[0], "max-packet-size") && p[1] && !p[2])
6465 {
6466 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
6467 int maxmtu = positive_atoi(p[1], msglevel);
6468 options->ce.tls_mtu = constrain_int(maxmtu, TLS_CHANNEL_MTU_MIN, TLS_CHANNEL_BUF_SIZE);
6469
6470 if (maxmtu < TLS_CHANNEL_MTU_MIN || maxmtu > TLS_CHANNEL_BUF_SIZE)
6471 {
6472 msg(M_WARN,
6473 "Note: max-packet-size value outside of allowed "
6474 "control channel packet size (%d to %d), will use %d "
6475 "instead.",
6476 TLS_CHANNEL_MTU_MIN, TLS_CHANNEL_BUF_SIZE, options->ce.tls_mtu);
6477 }
6478
6479 /* also set mssfix maxmtu mtu */
6480 options->ce.mssfix = maxmtu;
6481 options->ce.mssfix_default = false;
6482 options->ce.mssfix_encap = true;
6483 }
6484#ifdef ENABLE_FRAGMENT
6485 else if (streq(p[0], "mtu-dynamic"))
6486 {
6487 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
6488 msg(msglevel, "--mtu-dynamic has been replaced by --fragment");
6489 goto err;
6490 }
6491 else if (streq(p[0], "fragment") && p[1] && !p[3])
6492 {
6493 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
6494 if (!atoi_constrained(p[1], &options->ce.fragment, p[0], 68, INT_MAX, msglevel))
6495 {
6496 goto err;
6497 }
6498
6499 if (p[2] && streq(p[2], "mtu"))
6500 {
6501 options->ce.fragment_encap = true;
6502 }
6503 else if (p[2])
6504 {
6505 msg(msglevel, "Unknown parameter to --fragment: %s", p[2]);
6506 }
6507 }
6508#endif /* ifdef ENABLE_FRAGMENT */
6509 else if (streq(p[0], "mtu-disc") && p[1] && !p[2])
6510 {
6511 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
6512 options->ce.mtu_discover_type = translate_mtu_discover_type_name(p[1]);
6513 }
6514 else if (streq(p[0], "mtu-test") && !p[1])
6515 {
6516 VERIFY_PERMISSION(OPT_P_GENERAL);
6517 options->mtu_test = true;
6518 }
6519 else if (streq(p[0], "nice") && p[1] && !p[2])
6520 {
6521 VERIFY_PERMISSION(OPT_P_NICE);
6522 options->nice = atoi_warn(p[1], msglevel);
6523 }
6524 else if (streq(p[0], "rcvbuf") && p[1] && !p[2])
6525 {
6526 VERIFY_PERMISSION(OPT_P_SOCKBUF);
6527 options->rcvbuf = positive_atoi(p[1], msglevel);
6528 }
6529 else if (streq(p[0], "sndbuf") && p[1] && !p[2])
6530 {
6531 VERIFY_PERMISSION(OPT_P_SOCKBUF);
6532 options->sndbuf = positive_atoi(p[1], msglevel);
6533 }
6534 else if (streq(p[0], "mark") && p[1] && !p[2])
6535 {
6536#if defined(TARGET_LINUX)
6537 VERIFY_PERMISSION(OPT_P_GENERAL);
6538 options->mark = atoi_warn(p[1], msglevel);
6539#endif
6540 }
6541 else if (streq(p[0], "socket-flags"))
6542 {
6543 int j;
6544 VERIFY_PERMISSION(OPT_P_SOCKFLAGS);
6545 for (j = 1; j < MAX_PARMS && p[j]; ++j)
6546 {
6547 /* TCP_NODELAY is enabled by default; the flag is still accepted
6548 * for backwards compatibility but no longer has any effect */
6549 if (!streq(p[j], "TCP_NODELAY"))
6550 {
6551 msg(msglevel, "unknown socket flag: %s", p[j]);
6552 }
6553 }
6554 }
6555#ifdef TARGET_LINUX
6556 else if (streq(p[0], "bind-dev") && p[1])
6557 {
6558 VERIFY_PERMISSION(OPT_P_SOCKFLAGS);
6559 options->bind_dev = p[1];
6560 }
6561#endif
6562 else if (streq(p[0], "txqueuelen") && p[1] && !p[2])
6563 {
6564 VERIFY_PERMISSION(OPT_P_GENERAL);
6565#ifdef TARGET_LINUX
6566 options->tuntap_options.txqueuelen = positive_atoi(p[1], msglevel);
6567#else
6568 msg(msglevel, "--txqueuelen not supported on this OS");
6569 goto err;
6570#endif
6571 }
6572 else if (streq(p[0], "shaper") && p[1] && !p[2])
6573 {
6574 VERIFY_PERMISSION(OPT_P_SHAPER);
6575 if (!atoi_constrained(p[1], &options->shaper, p[0], SHAPER_MIN, SHAPER_MAX, msglevel))
6576 {
6577 goto err;
6578 }
6579 }
6580 else if (streq(p[0], "port") && p[1] && !p[2])
6581 {
6582 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6583 options->ce.local_port = options->ce.remote_port = p[1];
6584 }
6585 else if (streq(p[0], "lport") && p[1] && !p[2])
6586 {
6587 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6588
6589 /* only trigger bind() if port is not 0 (or --local is used) */
6590 if (!streq(p[1], "0"))
6591 {
6592 options->ce.local_port_defined = true;
6593 }
6594 options->ce.local_port = p[1];
6595 }
6596 else if (streq(p[0], "rport") && p[1] && !p[2])
6597 {
6598 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6599 options->ce.remote_port = p[1];
6600 }
6601 else if (streq(p[0], "bind") && !p[2])
6602 {
6603 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6604 options->ce.bind_defined = true;
6605 if (p[1] && streq(p[1], "ipv6only"))
6606 {
6607 options->ce.bind_ipv6_only = true;
6608 }
6609 }
6610 else if (streq(p[0], "nobind") && !p[1])
6611 {
6612 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6613 options->ce.bind_local = false;
6614 }
6615 else if (streq(p[0], "fast-io") && !p[1])
6616 {
6617 VERIFY_PERMISSION(OPT_P_GENERAL);
6618 msg(M_WARN, "DEPRECATED OPTION: --fast-io option ignored.");
6619 }
6620 else if (streq(p[0], "inactive") && p[1] && !p[3])
6621 {
6622 VERIFY_PERMISSION(OPT_P_TIMER);
6623 options->inactivity_timeout = positive_atoi(p[1], msglevel);
6624 if (p[2])
6625 {
6626 positive_atoll(p[2], &options->inactivity_minimum_bytes, p[0], msglevel);
6627 if (options->inactivity_minimum_bytes > INT_MAX)
6628 {
6629 msg(M_WARN,
6630 "WARNING: '--inactive' with a 'bytes' value"
6631 " >2 Gbyte was silently ignored in older versions. If "
6632 " your VPN exits unexpectedly with 'Inactivity timeout'"
6633 " in %d seconds, revisit this value.",
6634 options->inactivity_timeout);
6635 }
6636 }
6637 }
6638 else if (streq(p[0], "session-timeout") && p[1] && !p[2])
6639 {
6640 VERIFY_PERMISSION(OPT_P_TIMER);
6641 options->session_timeout = positive_atoi(p[1], msglevel);
6642 }
6643 else if (streq(p[0], "proto") && p[1] && !p[2])
6644 {
6645 int proto;
6646 sa_family_t af;
6647 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6648 proto = ascii2proto(p[1]);
6649 af = ascii2af(p[1]);
6650 if (proto < 0)
6651 {
6652 msg(msglevel, "Bad protocol: '%s'. Allowed protocols with --proto option: %s", p[1],
6653 proto2ascii_all(&gc));
6654 goto err;
6655 }
6656 options->ce.proto = proto;
6657 options->ce.af = af;
6658 }
6659 else if (streq(p[0], "proto-force") && p[1] && !p[2])
6660 {
6661 int proto_force;
6662 VERIFY_PERMISSION(OPT_P_GENERAL);
6663 proto_force = ascii2proto(p[1]);
6664 if (proto_force < 0)
6665 {
6666 msg(msglevel, "Bad --proto-force protocol: '%s'", p[1]);
6667 goto err;
6668 }
6669 options->proto_force = proto_force;
6670 }
6671 else if (streq(p[0], "http-proxy") && p[1] && !p[5])
6672 {
6673 struct http_proxy_options *ho;
6674
6675 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6676
6677 {
6678 if (!p[2])
6679 {
6680 msg(msglevel, "http-proxy port number not defined");
6681 goto err;
6682 }
6683
6684 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
6685
6686 ho->server = p[1];
6687 ho->port = p[2];
6688 }
6689
6690 if (p[3])
6691 {
6692 /* auto -- try to figure out proxy addr, port, and type automatically */
6693 /* auto-nct -- disable proxy auth cleartext protocols (i.e. basic auth) */
6694 if (streq(p[3], "auto"))
6695 {
6696 ho->auth_retry = PAR_ALL;
6697 }
6698 else if (streq(p[3], "auto-nct"))
6699 {
6700 ho->auth_retry = PAR_NCT;
6701 }
6702 else
6703 {
6704 ho->auth_method_string = "basic";
6705 ho->auth_file = p[3];
6706
6707 if (p[4])
6708 {
6709 ho->auth_method_string = p[4];
6710 }
6711 }
6712 }
6713 else
6714 {
6715 ho->auth_method_string = "none";
6716 }
6717 }
6718 else if (streq(p[0], "http-proxy-user-pass") && p[1])
6719 {
6720 struct http_proxy_options *ho;
6721 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6722 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
6723 ho->auth_file_up = p[1];
6724 ho->inline_creds = is_inline;
6725 }
6726 else if (streq(p[0], "http-proxy-retry") || streq(p[0], "socks-proxy-retry") || streq(p[0], "http-proxy-timeout"))
6727 {
6728 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6729 msg(M_WARN, "DEPRECATED OPTION: %s option ignored.", p[0]);
6730 }
6731 else if (streq(p[0], "http-proxy-option") && p[1] && !p[4])
6732 {
6733 struct http_proxy_options *ho;
6734
6735 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6736 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
6737
6738 if (streq(p[1], "VERSION") && p[2] && !p[3])
6739 {
6740 ho->http_version = p[2];
6741 }
6742 else if (streq(p[1], "AGENT") && p[2] && !p[3])
6743 {
6744 ho->user_agent = p[2];
6745 }
6746 else if ((streq(p[1], "EXT1") || streq(p[1], "EXT2") || streq(p[1], "CUSTOM-HEADER"))
6747 && p[2])
6748 {
6749 /* In the wild patched versions use both EXT1/2 and CUSTOM-HEADER
6750 * with either two argument or one */
6751
6752 struct http_custom_header *custom_header = NULL;
6753 int i;
6754 /* Find the first free header */
6755 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER; i++)
6756 {
6757 if (!ho->custom_headers[i].name)
6758 {
6759 custom_header = &ho->custom_headers[i];
6760 break;
6761 }
6762 }
6763 if (!custom_header)
6764 {
6765 msg(msglevel, "Cannot use more than %d http-proxy-option CUSTOM-HEADER : '%s'",
6766 MAX_CUSTOM_HTTP_HEADER, p[1]);
6767 }
6768 else
6769 {
6770 /* We will save p[2] and p[3], the proxy code will detect if
6771 * p[3] is NULL */
6772 custom_header->name = p[2];
6773 custom_header->content = p[3];
6774 }
6775 }
6776 else
6777 {
6778 msg(msglevel, "Bad http-proxy-option or missing or extra parameter: '%s'", p[1]);
6779 }
6780 }
6781 else if (streq(p[0], "socks-proxy") && p[1] && !p[4])
6782 {
6783 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6784
6785 if (p[2])
6786 {
6787 options->ce.socks_proxy_port = p[2];
6788 }
6789 else
6790 {
6791 options->ce.socks_proxy_port = "1080";
6792 }
6793 options->ce.socks_proxy_server = p[1];
6794 options->ce.socks_proxy_authfile = p[3]; /* might be NULL */
6795 }
6796 else if (streq(p[0], "keepalive") && p[1] && p[2] && !p[3])
6797 {
6798 VERIFY_PERMISSION(OPT_P_GENERAL);
6799 atoi_constrained(p[1], &options->keepalive_ping, "keepalive ping",
6800 1, PING_TIMEOUT_MAX, msglevel);
6801 atoi_constrained(p[2], &options->keepalive_timeout, "keepalive timeout",
6802 1, PING_TIMEOUT_MAX, msglevel);
6803 }
6804 else if (streq(p[0], "ping") && p[1] && !p[2])
6805 {
6806 VERIFY_PERMISSION(OPT_P_TIMER);
6807 atoi_constrained(p[1], &options->ping_send_timeout, p[0],
6808 0, PING_TIMEOUT_MAX, msglevel);
6809 }
6810 else if (streq(p[0], "ping-exit") && p[1] && !p[2])
6811 {
6812 VERIFY_PERMISSION(OPT_P_TIMER);
6813 atoi_constrained(p[1], &options->ping_rec_timeout, p[0],
6814 0, PING_TIMEOUT_MAX, msglevel);
6815 options->ping_rec_timeout_action = PING_EXIT;
6816 }
6817 else if (streq(p[0], "ping-restart") && p[1] && !p[2])
6818 {
6819 VERIFY_PERMISSION(OPT_P_TIMER);
6820 atoi_constrained(p[1], &options->ping_rec_timeout, p[0],
6821 0, PING_TIMEOUT_MAX, msglevel);
6822 options->ping_rec_timeout_action = PING_RESTART;
6823 }
6824 else if (streq(p[0], "ping-timer-rem") && !p[1])
6825 {
6826 VERIFY_PERMISSION(OPT_P_TIMER);
6827 options->ping_timer_remote = true;
6828 }
6829 else if (streq(p[0], "explicit-exit-notify") && !p[2])
6830 {
6831 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_EXPLICIT_NOTIFY);
6832 if (p[1])
6833 {
6834 options->ce.explicit_exit_notification = positive_atoi(p[1], msglevel);
6835 }
6836 else
6837 {
6838 options->ce.explicit_exit_notification = 1;
6839 }
6840 }
6841 else if (streq(p[0], "persist-tun") && !p[1])
6842 {
6843 VERIFY_PERMISSION(OPT_P_PERSIST);
6844 options->persist_tun = true;
6845 }
6846 else if (streq(p[0], "persist-key") && !p[1])
6847 {
6848 VERIFY_PERMISSION(OPT_P_PERSIST);
6849 msg(M_WARN, "DEPRECATED OPTION: --persist-key option ignored. "
6850 "Keys are now always persisted across restarts. ");
6851 }
6852 else if (streq(p[0], "persist-local-ip") && !p[1])
6853 {
6854 VERIFY_PERMISSION(OPT_P_PERSIST_IP);
6855 options->persist_local_ip = true;
6856 }
6857 else if (streq(p[0], "persist-remote-ip") && !p[1])
6858 {
6859 VERIFY_PERMISSION(OPT_P_PERSIST_IP);
6860 options->persist_remote_ip = true;
6861 }
6862 else if (streq(p[0], "client-nat") && p[1] && p[2] && p[3] && p[4] && !p[5])
6863 {
6864 VERIFY_PERMISSION(OPT_P_ROUTE);
6865 cnol_check_alloc(options);
6866 add_client_nat_to_option_list(options->client_nat, p[1], p[2], p[3], p[4], msglevel);
6867 }
6868 else if (streq(p[0], "route-table") && p[1] && !p[2])
6869 {
6870#ifndef ENABLE_SITNL
6871 msg(M_WARN, "NOTE: --route-table is supported only on Linux when SITNL is built-in");
6872#endif
6873 VERIFY_PERMISSION(OPT_P_ROUTE_TABLE);
6874 options->route_default_table_id = positive_atoi(p[1], msglevel);
6875 }
6876 else if (streq(p[0], "route") && p[1] && !p[5])
6877 {
6878 VERIFY_PERMISSION(OPT_P_ROUTE);
6879 if (!check_route_option(options, p, msglevel, pull_mode))
6880 {
6881 goto err;
6882 }
6883 add_route_to_option_list(options->routes, p[1], p[2], p[3], p[4],
6884 options->route_default_table_id);
6885 }
6886 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
6887 {
6888 VERIFY_PERMISSION(OPT_P_ROUTE);
6889 if (!check_route6_option(options, p, msglevel, pull_mode))
6890 {
6891 goto err;
6892 }
6893 add_route_ipv6_to_option_list(options->routes_ipv6, p[1], p[2], p[3],
6894 options->route_default_table_id);
6895 }
6896 else if (streq(p[0], "max-routes") && !p[2])
6897 {
6898 msg(M_WARN, "DEPRECATED OPTION: --max-routes option ignored.");
6899 }
6900 else if (streq(p[0], "route-gateway") && p[1] && !p[2])
6901 {
6902 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
6903 if (streq(p[1], "dhcp"))
6904 {
6905 options->route_gateway_via_dhcp = true;
6906 }
6907 else
6908 {
6909 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
6910 || is_special_addr(p[1])) /* FQDN -- may be DNS name */
6911 {
6912 options->route_default_gateway = p[1];
6913 }
6914 else
6915 {
6916 msg(msglevel, "route-gateway parm '%s' must be a valid address", p[1]);
6917 goto err;
6918 }
6919 }
6920 }
6921 else if (streq(p[0], "route-ipv6-gateway") && p[1] && !p[2])
6922 {
6923 if (ipv6_addr_safe(p[1]))
6924 {
6925 options->route_ipv6_default_gateway = p[1];
6926 }
6927 else
6928 {
6929 msg(msglevel, "route-ipv6-gateway parm '%s' must be a valid address", p[1]);
6930 goto err;
6931 }
6932 }
6933 else if (streq(p[0], "route-metric") && p[1] && !p[2])
6934 {
6935 VERIFY_PERMISSION(OPT_P_ROUTE);
6936 options->route_default_metric = positive_atoi(p[1], msglevel);
6937 }
6938 else if (streq(p[0], "route-delay") && !p[3])
6939 {
6940 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
6941 options->route_delay_defined = true;
6942 if (p[1])
6943 {
6944 options->route_delay = positive_atoi(p[1], msglevel);
6945 if (p[2])
6946 {
6947 options->route_delay_window = positive_atoi(p[2], msglevel);
6948 }
6949 }
6950 else
6951 {
6952 options->route_delay = 0;
6953 }
6954 }
6955 else if (streq(p[0], "route-up") && p[1])
6956 {
6957 VERIFY_PERMISSION(OPT_P_SCRIPT);
6958 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6959 {
6960 goto err;
6961 }
6962 set_user_script(options, &options->route_script, p[1], "route-up", false);
6963 }
6964 else if (streq(p[0], "route-pre-down") && p[1])
6965 {
6966 VERIFY_PERMISSION(OPT_P_SCRIPT);
6967 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6968 {
6969 goto err;
6970 }
6971 set_user_script(options, &options->route_predown_script, p[1], "route-pre-down", true);
6972 }
6973 else if (streq(p[0], "route-noexec") && !p[1])
6974 {
6975 VERIFY_PERMISSION(OPT_P_SCRIPT);
6976 options->route_noexec = true;
6977 }
6978 else if (streq(p[0], "route-nopull") && !p[1])
6979 {
6980 VERIFY_PERMISSION(OPT_P_GENERAL);
6981 options->route_nopull = true;
6982 }
6983 else if (streq(p[0], "pull-filter") && p[1] && p[2] && !p[3])
6984 {
6985 struct pull_filter *f;
6986 VERIFY_PERMISSION(OPT_P_GENERAL)
6987 f = alloc_pull_filter(options);
6988
6989 if (strcmp("accept", p[1]) == 0)
6990 {
6991 f->type = PUF_TYPE_ACCEPT;
6992 }
6993 else if (strcmp("ignore", p[1]) == 0)
6994 {
6995 f->type = PUF_TYPE_IGNORE;
6996 }
6997 else if (strcmp("reject", p[1]) == 0)
6998 {
6999 f->type = PUF_TYPE_REJECT;
7000 }
7001 else
7002 {
7003 msg(msglevel, "Unknown --pull-filter type: %s", p[1]);
7004 goto err;
7005 }
7006 f->pattern = p[2];
7007 f->size = strlen(p[2]);
7008 }
7009 else if (streq(p[0], "allow-pull-fqdn") && !p[1])
7010 {
7011 VERIFY_PERMISSION(OPT_P_GENERAL);
7012 options->allow_pull_fqdn = true;
7013 }
7014 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
7015 {
7016 int j;
7017 VERIFY_PERMISSION(OPT_P_ROUTE);
7018 rol_check_alloc(options);
7019
7020 if (options->routes->flags & RG_ENABLE)
7021 {
7022 msg(M_WARN, "WARNING: You have specified redirect-gateway and "
7023 "redirect-private at the same time (or the same option "
7024 "multiple times). This is not well supported and may lead to "
7025 "unexpected results");
7026 }
7027
7028 options->routes->flags |= RG_ENABLE;
7029
7030 if (streq(p[0], "redirect-gateway"))
7031 {
7032 options->routes->flags |= RG_REROUTE_GW;
7033 }
7034 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7035 {
7036 if (streq(p[j], "local"))
7037 {
7038 options->routes->flags |= RG_LOCAL;
7039 }
7040 else if (streq(p[j], "autolocal"))
7041 {
7042 options->routes->flags |= RG_AUTO_LOCAL;
7043 }
7044 else if (streq(p[j], "def1"))
7045 {
7046 options->routes->flags |= RG_DEF1;
7047 }
7048 else if (streq(p[j], "bypass-dhcp"))
7049 {
7050 options->routes->flags |= RG_BYPASS_DHCP;
7051 }
7052 else if (streq(p[j], "bypass-dns"))
7053 {
7054 options->routes->flags |= RG_BYPASS_DNS;
7055 }
7056 else if (streq(p[j], "block-local"))
7057 {
7058 options->routes->flags |= RG_BLOCK_LOCAL;
7059 }
7060 else if (streq(p[j], "ipv6"))
7061 {
7062 rol6_check_alloc(options);
7063 options->routes_ipv6->flags |= RG_REROUTE_GW;
7064 }
7065 else if (streq(p[j], "!ipv4"))
7066 {
7067 options->routes->flags &= ~(RG_REROUTE_GW | RG_ENABLE);
7068 }
7069 else
7070 {
7071 msg(msglevel, "unknown --%s flag: %s", p[0], p[j]);
7072 goto err;
7073 }
7074 }
7075 if (options->routes->flags & RG_REROUTE_GW)
7076 {
7077 setenv_int(es, "route_redirect_gateway_ipv4",
7078 (options->routes->flags & RG_BLOCK_LOCAL) ? 2 : 1);
7079 }
7080 if (options->routes_ipv6 && (options->routes_ipv6->flags & RG_REROUTE_GW))
7081 {
7082 setenv_int(es, "route_redirect_gateway_ipv6",
7083 (options->routes->flags & RG_BLOCK_LOCAL) ? 2 : 1);
7084 }
7085#ifdef _WIN32
7086 /* we need this here to handle pushed --redirect-gateway */
7087 remap_redirect_gateway_flags(options);
7088#endif
7089 }
7090 else if (streq(p[0], "block-ipv6") && !p[1])
7091 {
7092 VERIFY_PERMISSION(OPT_P_ROUTE);
7093 options->block_ipv6 = true;
7094 }
7095 else if (streq(p[0], "remote-random-hostname") && !p[1])
7096 {
7097 VERIFY_PERMISSION(OPT_P_GENERAL);
7098 options->sockflags |= SF_HOST_RANDOMIZE;
7099 }
7100 else if (streq(p[0], "setenv") && p[1] && !p[3])
7101 {
7102 VERIFY_PERMISSION(OPT_P_GENERAL);
7103 if (streq(p[1], "REMOTE_RANDOM_HOSTNAME") && !p[2])
7104 {
7105 options->sockflags |= SF_HOST_RANDOMIZE;
7106 }
7107 else if (streq(p[1], "GENERIC_CONFIG"))
7108 {
7109 msg(msglevel, "this is a generic configuration and cannot directly be used");
7110 goto err;
7111 }
7112 else if (streq(p[1], "PUSH_PEER_INFO") && !p[2])
7113 {
7114 options->push_peer_info = true;
7115 }
7116 else if (streq(p[1], "SERVER_POLL_TIMEOUT") && p[2])
7117 {
7118 options->ce.connect_timeout = positive_atoi(p[2], msglevel);
7119 }
7120 else
7121 {
7122 if (streq(p[1], "FORWARD_COMPATIBLE") && p[2] && streq(p[2], "1"))
7123 {
7124 options->forward_compatible = true;
7125 msglevel_fc = msglevel_forward_compatible(options, msglevel);
7126 }
7127 setenv_str(es, p[1], p[2] ? p[2] : "");
7128 }
7129 }
7130 else if (streq(p[0], "compat-mode") && p[1] && !p[3])
7131 {
7132 unsigned int major, minor, patch;
7133 if (!(sscanf(p[1], "%u.%u.%u", &major, &minor, &patch) == 3))
7134 {
7135 msg(msglevel, "cannot parse version number for --compat-mode: %s", p[1]);
7136 goto err;
7137 }
7138
7139 options->backwards_compatible = major * 10000 + minor * 100 + patch;
7140 }
7141 else if (streq(p[0], "setenv-safe") && p[1] && !p[3])
7142 {
7143 VERIFY_PERMISSION(OPT_P_SETENV);
7144 setenv_str_safe(es, p[1], p[2] ? p[2] : "");
7145 }
7146 else if (streq(p[0], "script-security") && p[1] && !p[2])
7147 {
7148 VERIFY_PERMISSION(OPT_P_GENERAL);
7149 int security;
7150 if (atoi_constrained(p[1], &security, p[0], SSEC_NONE, SSEC_PW_ENV, msglevel))
7151 {
7152 script_security_set(security);
7153 }
7154 }
7155 else if (streq(p[0], "mssfix") && !p[3])
7156 {
7157 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
7158 if (p[1])
7159 {
7160 int mssfix;
7161 if (!atoi_constrained(p[1], &mssfix, p[0], 0, UINT16_MAX, msglevel))
7162 {
7163 goto err;
7164 }
7165 if (mssfix != 0 && mssfix < TLS_CHANNEL_MTU_MIN)
7166 {
7167 msg(msglevel, "mssfix needs to be >= %d, not %d", TLS_CHANNEL_MTU_MIN, mssfix);
7168 goto err;
7169 }
7170
7171 /* value specified, assume encapsulation is not
7172 * included unless "mtu" follows later */
7173 options->ce.mssfix = mssfix;
7174 options->ce.mssfix_encap = false;
7175 options->ce.mssfix_default = false;
7176 }
7177 else
7178 {
7179 /* Set MTU to default values */
7180 options->ce.mssfix_default = true;
7181 options->ce.mssfix_encap = true;
7182 options->ce.mssfix_fixed = false;
7183 }
7184
7185 if (p[2] && streq(p[2], "mtu"))
7186 {
7187 options->ce.mssfix_encap = true;
7188 }
7189 else if (p[2] && streq(p[2], "fixed"))
7190 {
7191 options->ce.mssfix_fixed = true;
7192 }
7193 else if (p[2])
7194 {
7195 msg(msglevel, "Unknown parameter to --mssfix: %s", p[2]);
7196 }
7197 }
7198 else if (streq(p[0], "disable-occ") && !p[1])
7199 {
7200 VERIFY_PERMISSION(OPT_P_GENERAL);
7201 options->occ = false;
7202 }
7203 else if (streq(p[0], "server") && p[1] && p[2] && !p[4])
7204 {
7205 const int lev = M_WARN;
7206 bool error = false;
7207 in_addr_t network, netmask;
7208
7209 VERIFY_PERMISSION(OPT_P_GENERAL);
7210 network = get_ip_addr(p[1], lev, &error);
7211 netmask = get_ip_addr(p[2], lev, &error);
7212 if (error || !network || !netmask)
7213 {
7214 msg(msglevel, "error parsing --server parameters");
7215 goto err;
7216 }
7217 options->server_defined = true;
7218 options->server_network = network;
7219 options->server_netmask = netmask;
7220
7221 if (p[3])
7222 {
7223 if (streq(p[3], "nopool"))
7224 {
7225 options->server_flags |= SF_NOPOOL;
7226 }
7227 else
7228 {
7229 msg(msglevel, "error parsing --server: %s is not a recognized flag", p[3]);
7230 goto err;
7231 }
7232 }
7233 }
7234 else if (streq(p[0], "server-ipv6") && p[1] && !p[2])
7235 {
7236 const int lev = M_WARN;
7237 struct in6_addr network;
7238 unsigned int netbits = 0;
7239
7240 VERIFY_PERMISSION(OPT_P_GENERAL);
7241 if (!get_ipv6_addr(p[1], &network, &netbits, lev))
7242 {
7243 msg(msglevel, "error parsing --server-ipv6 parameter");
7244 goto err;
7245 }
7246 if (netbits < 64 || netbits > 124)
7247 {
7248 msg(msglevel, "--server-ipv6 settings: network must be between /64 and /124 (not /%d)",
7249 netbits);
7250
7251 goto err;
7252 }
7253 options->server_ipv6_defined = true;
7254 options->server_network_ipv6 = network;
7255 options->server_netbits_ipv6 = netbits;
7256 }
7257 else if (streq(p[0], "server-bridge") && p[1] && p[2] && p[3] && p[4] && !p[5])
7258 {
7259 const int lev = M_WARN;
7260 bool error = false;
7261 in_addr_t ip, netmask, pool_start, pool_end;
7262
7263 VERIFY_PERMISSION(OPT_P_GENERAL);
7264 ip = get_ip_addr(p[1], lev, &error);
7265 netmask = get_ip_addr(p[2], lev, &error);
7266 pool_start = get_ip_addr(p[3], lev, &error);
7267 pool_end = get_ip_addr(p[4], lev, &error);
7268 if (error || !ip || !netmask || !pool_start || !pool_end)
7269 {
7270 msg(msglevel, "error parsing --server-bridge parameters");
7271 goto err;
7272 }
7273 options->server_bridge_defined = true;
7274 options->server_bridge_ip = ip;
7275 options->server_bridge_netmask = netmask;
7276 options->server_bridge_pool_start = pool_start;
7277 options->server_bridge_pool_end = pool_end;
7278 }
7279 else if (streq(p[0], "server-bridge") && p[1] && streq(p[1], "nogw") && !p[2])
7280 {
7281 VERIFY_PERMISSION(OPT_P_GENERAL);
7282 options->server_bridge_proxy_dhcp = true;
7283 options->server_flags |= SF_NO_PUSH_ROUTE_GATEWAY;
7284 }
7285 else if (streq(p[0], "server-bridge") && !p[1])
7286 {
7287 VERIFY_PERMISSION(OPT_P_GENERAL);
7288 options->server_bridge_proxy_dhcp = true;
7289 }
7290 else if (streq(p[0], "push") && p[1] && !p[2])
7291 {
7292 VERIFY_PERMISSION(OPT_P_PUSH);
7293 push_options(options, &p[1], msglevel, &options->gc);
7294 }
7295 else if (streq(p[0], "push-reset") && !p[1])
7296 {
7297 VERIFY_PERMISSION(OPT_P_INSTANCE);
7298 push_reset(options);
7299 }
7300 else if (streq(p[0], "push-remove") && p[1] && !p[2])
7301 {
7302 VERIFY_PERMISSION(OPT_P_INSTANCE);
7303 msg(D_PUSH, "PUSH_REMOVE '%s'", p[1]);
7304 push_remove_option(options, p[1]);
7305 }
7306 else if (streq(p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
7307 {
7308 const int lev = M_WARN;
7309 bool error = false;
7310 in_addr_t start, end, netmask = 0;
7311
7312 VERIFY_PERMISSION(OPT_P_GENERAL);
7313 start = get_ip_addr(p[1], lev, &error);
7314 end = get_ip_addr(p[2], lev, &error);
7315 if (p[3])
7316 {
7317 netmask = get_ip_addr(p[3], lev, &error);
7318 }
7319 if (error)
7320 {
7321 msg(msglevel, "error parsing --ifconfig-pool parameters");
7322 goto err;
7323 }
7324 if (!ifconfig_pool_verify_range(msglevel, start, end))
7325 {
7326 goto err;
7327 }
7328
7329 options->ifconfig_pool_defined = true;
7330 options->ifconfig_pool_start = start;
7331 options->ifconfig_pool_end = end;
7332 if (netmask)
7333 {
7334 options->ifconfig_pool_netmask = netmask;
7335 }
7336 }
7337 else if (streq(p[0], "ifconfig-pool-persist") && p[1] && !p[3])
7338 {
7339 VERIFY_PERMISSION(OPT_P_GENERAL);
7340 options->ifconfig_pool_persist_filename = p[1];
7341 if (p[2])
7342 {
7343 options->ifconfig_pool_persist_refresh_freq = positive_atoi(p[2], msglevel);
7344 }
7345 }
7346 else if (streq(p[0], "ifconfig-ipv6-pool") && p[1] && !p[2])
7347 {
7348 const int lev = M_WARN;
7349 struct in6_addr network;
7350 unsigned int netbits = 0;
7351
7352 VERIFY_PERMISSION(OPT_P_GENERAL);
7353 if (!get_ipv6_addr(p[1], &network, &netbits, lev))
7354 {
7355 msg(msglevel, "error parsing --ifconfig-ipv6-pool parameters");
7356 goto err;
7357 }
7358 if (netbits < 64 || netbits > 124)
7359 {
7360 msg(msglevel,
7361 "--ifconfig-ipv6-pool settings: network must be between /64 and /124 (not /%d)",
7362 netbits);
7363 goto err;
7364 }
7365
7366 options->ifconfig_ipv6_pool_defined = true;
7367 options->ifconfig_ipv6_pool_base = network;
7368 options->ifconfig_ipv6_pool_netbits = netbits;
7369 }
7370 else if (streq(p[0], "hash-size") && p[1] && p[2] && !p[3])
7371 {
7372 int real, virtual;
7373
7374 VERIFY_PERMISSION(OPT_P_GENERAL);
7375 if (!atoi_constrained(p[1], &real, "hash-size real", 1, INT_MAX, msglevel)
7376 || !atoi_constrained(p[2], &virtual, "hash-size virtual", 1, INT_MAX, msglevel))
7377 {
7378 goto err;
7379 }
7380 options->real_hash_size = (uint32_t)real;
7381 options->virtual_hash_size = (uint32_t)virtual;
7382 }
7383 else if (streq(p[0], "connect-freq") && p[1] && p[2] && !p[3])
7384 {
7385 int cf_max, cf_per;
7386
7387 VERIFY_PERMISSION(OPT_P_GENERAL);
7388 if (!atoi_constrained(p[1], &cf_max, "connect-freq n", 1, INT_MAX, msglevel)
7389 || !atoi_constrained(p[2], &cf_per, "connect-freq seconds", 1, INT_MAX, msglevel))
7390 {
7391 goto err;
7392 }
7393 options->cf_max = cf_max;
7394 options->cf_per = cf_per;
7395 }
7396 else if (streq(p[0], "connect-freq-initial") && p[1] && p[2] && !p[3])
7397 {
7398 int cf_max, cf_per;
7399
7400 VERIFY_PERMISSION(OPT_P_GENERAL);
7401 if (!atoi_constrained(p[1], &cf_max, "connect-freq-initial n", 1, INT_MAX, msglevel)
7402 || !atoi_constrained(p[2], &cf_per, "connect-freq-initial seconds", 1, INT_MAX, msglevel))
7403 {
7404 goto err;
7405 }
7406 options->cf_initial_max = cf_max;
7407 options->cf_initial_per = cf_per;
7408 }
7409 else if (streq(p[0], "max-clients") && p[1] && !p[2])
7410 {
7411 VERIFY_PERMISSION(OPT_P_GENERAL);
7412 if (!atoi_constrained(p[1], (int *)&options->max_clients, p[0], 1, MAX_PEER_ID - 1, msglevel))
7413 {
7414 goto err;
7415 }
7416 }
7417 else if (streq(p[0], "max-routes-per-client") && p[1] && !p[2])
7418 {
7419 VERIFY_PERMISSION(OPT_P_INHERIT);
7420 atoi_constrained(p[1], &options->max_routes_per_client, p[0], 1, INT_MAX, msglevel);
7421 }
7422 else if (streq(p[0], "client-cert-not-required") && !p[1])
7423 {
7424 VERIFY_PERMISSION(OPT_P_GENERAL);
7425 msg(M_FATAL,
7426 "REMOVED OPTION: --client-cert-not-required, use '--verify-client-cert none' instead");
7427 }
7428 else if (streq(p[0], "verify-client-cert") && !p[2])
7429 {
7430 VERIFY_PERMISSION(OPT_P_GENERAL);
7431
7432 /* Reset any existing flags */
7433 options->ssl_flags &= ~SSLF_CLIENT_CERT_OPTIONAL;
7434 options->ssl_flags &= ~SSLF_CLIENT_CERT_NOT_REQUIRED;
7435 if (p[1])
7436 {
7437 if (streq(p[1], "none"))
7438 {
7439 options->ssl_flags |= SSLF_CLIENT_CERT_NOT_REQUIRED;
7440 }
7441 else if (streq(p[1], "optional"))
7442 {
7443 options->ssl_flags |= SSLF_CLIENT_CERT_OPTIONAL;
7444 }
7445 else if (!streq(p[1], "require"))
7446 {
7447 msg(msglevel,
7448 "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
7449 goto err;
7450 }
7451 }
7452 }
7453 else if (streq(p[0], "username-as-common-name") && !p[1])
7454 {
7455 VERIFY_PERMISSION(OPT_P_GENERAL);
7456 options->ssl_flags |= SSLF_USERNAME_AS_COMMON_NAME;
7457 }
7458 else if (streq(p[0], "auth-user-pass-optional") && !p[1])
7459 {
7460 VERIFY_PERMISSION(OPT_P_GENERAL);
7461 options->ssl_flags |= SSLF_AUTH_USER_PASS_OPTIONAL;
7462 }
7463 else if (streq(p[0], "opt-verify") && !p[1])
7464 {
7465 VERIFY_PERMISSION(OPT_P_GENERAL);
7466 msg(M_INFO, "DEPRECATED OPTION: --opt-verify was removed in OpenVPN 2.7.");
7467 }
7468 else if (streq(p[0], "auth-user-pass-verify") && p[1])
7469 {
7470 VERIFY_PERMISSION(OPT_P_SCRIPT);
7471 if (!no_more_than_n_args(msglevel, p, 3, NM_QUOTE_HINT))
7472 {
7473 goto err;
7474 }
7475 if (p[2])
7476 {
7477 if (streq(p[2], "via-env"))
7478 {
7479 options->auth_user_pass_verify_script_via_file = false;
7480 }
7481 else if (streq(p[2], "via-file"))
7482 {
7483 options->auth_user_pass_verify_script_via_file = true;
7484 }
7485 else
7486 {
7487 msg(msglevel,
7488 "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
7489 goto err;
7490 }
7491 }
7492 else
7493 {
7494 msg(msglevel,
7495 "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
7496 goto err;
7497 }
7498 set_user_script(options, &options->auth_user_pass_verify_script, p[1],
7499 "auth-user-pass-verify", true);
7500 }
7501 else if (streq(p[0], "auth-gen-token"))
7502 {
7503 VERIFY_PERMISSION(OPT_P_GENERAL);
7504 options->auth_token_generate = true;
7505 options->auth_token_lifetime = p[1] ? positive_atoi(p[1], msglevel) : 0;
7506
7507 for (int i = 2; i < MAX_PARMS && p[i] != NULL; i++)
7508 {
7509 /* the second parameter can be the renewal time */
7510 if (i == 2 && valid_integer(p[i], true))
7511 {
7512 options->auth_token_renewal = positive_atoi(p[i], msglevel);
7513 }
7514 else if (streq(p[i], "external-auth"))
7515 {
7516 options->auth_token_call_auth = true;
7517 }
7518 else
7519 {
7520 msg(msglevel, "Invalid argument to auth-gen-token: %s (%d)", p[i], i);
7521 }
7522 }
7523 }
7524 else if (streq(p[0], "auth-gen-token-secret") && p[1] && !p[2])
7525 {
7526 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7527 options->auth_token_secret_file = p[1];
7528 options->auth_token_secret_file_inline = is_inline;
7529 }
7530 else if (streq(p[0], "client-connect") && p[1])
7531 {
7532 VERIFY_PERMISSION(OPT_P_SCRIPT);
7533 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7534 {
7535 goto err;
7536 }
7537 set_user_script(options, &options->client_connect_script, p[1], "client-connect", true);
7538 }
7539 else if (streq(p[0], "client-crresponse") && p[1])
7540 {
7541 VERIFY_PERMISSION(OPT_P_SCRIPT);
7542 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7543 {
7544 goto err;
7545 }
7546 set_user_script(options, &options->client_crresponse_script, p[1], "client-crresponse",
7547 true);
7548 }
7549 else if (streq(p[0], "client-disconnect") && p[1])
7550 {
7551 VERIFY_PERMISSION(OPT_P_SCRIPT);
7552 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7553 {
7554 goto err;
7555 }
7556 set_user_script(options, &options->client_disconnect_script, p[1], "client-disconnect",
7557 true);
7558 }
7559 else if (streq(p[0], "learn-address") && p[1])
7560 {
7561 VERIFY_PERMISSION(OPT_P_SCRIPT);
7562 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7563 {
7564 goto err;
7565 }
7566 set_user_script(options, &options->learn_address_script, p[1], "learn-address", true);
7567 }
7568 else if (streq(p[0], "tmp-dir") && p[1] && !p[2])
7569 {
7570 VERIFY_PERMISSION(OPT_P_GENERAL);
7571 options->tmp_dir = p[1];
7572 }
7573 else if (streq(p[0], "client-config-dir") && p[1] && !p[2])
7574 {
7575 VERIFY_PERMISSION(OPT_P_GENERAL);
7576 options->client_config_dir = p[1];
7577 }
7578 else if (streq(p[0], "ccd-exclusive") && !p[1])
7579 {
7580 VERIFY_PERMISSION(OPT_P_GENERAL);
7581 options->ccd_exclusive = true;
7582 }
7583 else if (streq(p[0], "bcast-buffers") && p[1] && !p[2])
7584 {
7585 VERIFY_PERMISSION(OPT_P_GENERAL);
7586 atoi_constrained(p[1], &options->n_bcast_buf, p[0], 1, MBUF_SIZE_MAX, msglevel);
7587 }
7588 else if (streq(p[0], "tcp-queue-limit") && p[1] && !p[2])
7589 {
7590 VERIFY_PERMISSION(OPT_P_GENERAL);
7591 atoi_constrained(p[1], &options->tcp_queue_limit, p[0], 1, INT_MAX, msglevel);
7592 }
7593#if PORT_SHARE
7594 else if (streq(p[0], "port-share") && p[1] && p[2] && !p[4])
7595 {
7596 VERIFY_PERMISSION(OPT_P_GENERAL);
7597 options->port_share_host = p[1];
7598 options->port_share_port = p[2];
7599 options->port_share_journal_dir = p[3];
7600 }
7601#endif
7602 else if (streq(p[0], "client-to-client") && !p[1])
7603 {
7604 VERIFY_PERMISSION(OPT_P_GENERAL);
7605 options->enable_c2c = true;
7606 }
7607 else if (streq(p[0], "duplicate-cn") && !p[1])
7608 {
7609 VERIFY_PERMISSION(OPT_P_GENERAL);
7610 options->duplicate_cn = true;
7611 }
7612 else if (streq(p[0], "iroute") && p[1] && !p[3])
7613 {
7614 VERIFY_PERMISSION(OPT_P_INSTANCE);
7615 option_iroute(options, p[1], p[2], msglevel);
7616 }
7617 else if (streq(p[0], "iroute-ipv6") && p[1] && !p[2])
7618 {
7619 VERIFY_PERMISSION(OPT_P_INSTANCE);
7620 option_iroute_ipv6(options, p[1], msglevel);
7621 }
7622 else if (streq(p[0], "ifconfig-push") && p[1] && p[2] && !p[4])
7623 {
7624 in_addr_t local, remote_netmask;
7625
7626 VERIFY_PERMISSION(OPT_P_INSTANCE);
7627 local = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[1], 0, NULL, NULL);
7628 remote_netmask = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[2], 0, NULL, NULL);
7629 if (local && remote_netmask)
7630 {
7631 options->push_ifconfig_defined = true;
7632 options->push_ifconfig_local = local;
7633 options->push_ifconfig_remote_netmask = remote_netmask;
7634 if (p[3])
7635 {
7636 options->push_ifconfig_local_alias =
7637 getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[3], 0, NULL, NULL);
7638 }
7639 }
7640 else
7641 {
7642 msg(msglevel, "cannot parse --ifconfig-push addresses");
7643 goto err;
7644 }
7645 }
7646 else if (streq(p[0], "ifconfig-push-constraint") && p[1] && p[2] && !p[3])
7647 {
7648 in_addr_t network, netmask;
7649
7650 VERIFY_PERMISSION(OPT_P_GENERAL);
7651 network = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[1], 0, NULL, NULL);
7652 netmask = getaddr(GETADDR_HOST_ORDER, p[2], 0, NULL, NULL);
7653 if (network && netmask)
7654 {
7655 options->push_ifconfig_constraint_defined = true;
7656 options->push_ifconfig_constraint_network = network;
7657 options->push_ifconfig_constraint_netmask = netmask;
7658 }
7659 else
7660 {
7661 msg(msglevel, "cannot parse --ifconfig-push-constraint addresses");
7662 goto err;
7663 }
7664 }
7665 else if (streq(p[0], "ifconfig-ipv6-push") && p[1] && !p[3])
7666 {
7667 struct in6_addr local, remote;
7668 unsigned int netbits;
7669
7670 VERIFY_PERMISSION(OPT_P_INSTANCE);
7671
7672 if (!get_ipv6_addr(p[1], &local, &netbits, msglevel))
7673 {
7674 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
7675 goto err;
7676 }
7677
7678 if (p[2])
7679 {
7680 if (!get_ipv6_addr(p[2], &remote, NULL, msglevel))
7681 {
7682 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
7683 goto err;
7684 }
7685 }
7686 else
7687 {
7688 if (!options->ifconfig_ipv6_local
7689 || !get_ipv6_addr(options->ifconfig_ipv6_local, &remote, NULL, msglevel))
7690 {
7691 msg(msglevel,
7692 "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
7693 goto err;
7694 }
7695 }
7696
7697 options->push_ifconfig_ipv6_defined = true;
7698 options->push_ifconfig_ipv6_local = local;
7699 options->push_ifconfig_ipv6_netbits = netbits;
7700 options->push_ifconfig_ipv6_remote = remote;
7701 options->push_ifconfig_ipv6_blocked = false;
7702 }
7703 else if (streq(p[0], "disable") && !p[1])
7704 {
7705 VERIFY_PERMISSION(OPT_P_INSTANCE);
7706 options->disable = true;
7707 }
7708 else if (streq(p[0], "override-username") && p[1] && !p[2])
7709 {
7710 VERIFY_PERMISSION(OPT_P_INSTANCE);
7711 if (strlen(p[1]) > USER_PASS_LEN)
7712 {
7713 msg(msglevel,
7714 "override-username exceeds the maximum length of %d "
7715 "characters",
7716 USER_PASS_LEN);
7717
7718 /* disable the connection since ignoring the request to
7719 * set another username might cause serious problems */
7720 options->disable = true;
7721 }
7722 else
7723 {
7724 options->override_username = p[1];
7725 }
7726 }
7727 else if (streq(p[0], "tcp-nodelay") && !p[1])
7728 {
7729 VERIFY_PERMISSION(OPT_P_GENERAL);
7730 options->server_flags |= SF_TCP_NODELAY_HELPER;
7731 }
7732 else if (streq(p[0], "stale-routes-check") && p[1] && !p[3])
7733 {
7734 int ageing_time, check_interval;
7735
7736 VERIFY_PERMISSION(OPT_P_GENERAL);
7737 if (!atoi_constrained(p[1], &ageing_time, "stale-routes-check age", 1, INT_MAX, msglevel))
7738 {
7739 goto err;
7740 }
7741
7742 if (p[2])
7743 {
7744 if (!atoi_constrained(p[2], &check_interval,
7745 "stale-routes-check interval", 1, INT_MAX, msglevel))
7746 {
7747 goto err;
7748 }
7749 }
7750 else
7751 {
7752 check_interval = ageing_time;
7753 }
7754
7755 options->stale_routes_ageing_time = ageing_time;
7756 options->stale_routes_check_interval = check_interval;
7757 }
7758
7759 else if (streq(p[0], "client") && !p[1])
7760 {
7761 VERIFY_PERMISSION(OPT_P_GENERAL);
7762 options->client = true;
7763 }
7764 else if (streq(p[0], "pull") && !p[1])
7765 {
7766 VERIFY_PERMISSION(OPT_P_GENERAL);
7767 options->pull = true;
7768 }
7769 else if (streq(p[0], "push-continuation") && p[1] && !p[2])
7770 {
7771 VERIFY_PERMISSION(OPT_P_PULL_MODE);
7772 atoi_constrained(p[1], &options->push_continuation, p[0], 0, 2, msglevel);
7773 }
7774 else if (streq(p[0], "auth-user-pass") && !p[2])
7775 {
7776 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7777 options->auth_user_pass_username_only = false;
7778 if (p[1] && streq(p[1], "username-only"))
7779 {
7780 options->auth_user_pass_username_only = true;
7781 options->auth_user_pass_file = "stdin";
7782 }
7783 else if (p[1])
7784 {
7785 options->auth_user_pass_file = p[1];
7786 options->auth_user_pass_file_inline = is_inline;
7787 }
7788 else
7789 {
7790 options->auth_user_pass_file = "stdin";
7791 }
7792 }
7793 else if (streq(p[0], "auth-retry") && p[1] && !p[2])
7794 {
7795 VERIFY_PERMISSION(OPT_P_GENERAL);
7796 auth_retry_set(msglevel, p[1]);
7797 }
7798#ifdef ENABLE_MANAGEMENT
7799 else if (streq(p[0], "static-challenge") && p[1] && p[2] && !p[4])
7800 {
7801 VERIFY_PERMISSION(OPT_P_GENERAL);
7802 options->sc_info.challenge_text = p[1];
7803 if (atoi_warn(p[2], msglevel))
7804 {
7805 options->sc_info.flags |= SC_ECHO;
7806 }
7807 if (p[3] && streq(p[3], "concat"))
7808 {
7809 options->sc_info.flags |= SC_CONCAT;
7810 }
7811 else if (p[3] && !streq(p[3], "scrv1"))
7812 {
7813 msg(msglevel, "--static-challenge: unknown format indicator '%s'", p[3]);
7814 goto err;
7815 }
7816 }
7817#endif
7818 else if (streq(p[0], "msg-channel") && p[1])
7819 {
7820#ifdef _WIN32
7821 VERIFY_PERMISSION(OPT_P_GENERAL);
7822 HANDLE process = GetCurrentProcess();
7823 HANDLE handle = (HANDLE)((intptr_t)atoll(p[1]));
7824 if (!DuplicateHandle(process, handle, process, &options->msg_channel, 0, FALSE,
7825 DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS))
7826 {
7827 msg(msglevel, "could not duplicate service pipe handle");
7828 goto err;
7829 }
7830 options->route_method = ROUTE_METHOD_SERVICE;
7831#else /* ifdef _WIN32 */
7832 msg(msglevel, "--msg-channel is only supported on Windows");
7833 goto err;
7834#endif
7835 }
7836#ifdef _WIN32
7837 else if (streq(p[0], "win-sys") && p[1] && !p[2])
7838 {
7839 VERIFY_PERMISSION(OPT_P_GENERAL);
7840 if (streq(p[1], "env"))
7841 {
7842 msg(M_INFO, "NOTE: --win-sys env is default from OpenVPN 2.3. "
7843 "This entry will now be ignored. "
7844 "Please remove this entry from your configuration file.");
7845 }
7846 else
7847 {
7848 set_win_sys_path(p[1], es);
7849 }
7850 }
7851 else if (streq(p[0], "route-method") && p[1] && !p[2])
7852 {
7853 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
7854 if (streq(p[1], "adaptive"))
7855 {
7856 options->route_method = ROUTE_METHOD_ADAPTIVE;
7857 }
7858 else if (streq(p[1], "ipapi"))
7859 {
7860 options->route_method = ROUTE_METHOD_IPAPI;
7861 }
7862 else if (streq(p[1], "exe"))
7863 {
7864 options->route_method = ROUTE_METHOD_EXE;
7865 }
7866 else
7867 {
7868 msg(msglevel, "--route method must be 'adaptive', 'ipapi', or 'exe'");
7869 goto err;
7870 }
7871 }
7872 else if (streq(p[0], "ip-win32") && p[1] && !p[4])
7873 {
7874 const int index = ascii2ipset(p[1]);
7875 struct tuntap_options *to = &options->tuntap_options;
7876
7877 VERIFY_PERMISSION(OPT_P_DHCPDNS);
7878
7879 if (index < 0)
7880 {
7881 msg(msglevel, "Bad --ip-win32 method: '%s'. Allowed methods: %s", p[1],
7882 ipset2ascii_all(&gc));
7883 goto err;
7884 }
7885
7886 if (index == IPW32_SET_ADAPTIVE)
7887 {
7888 options->route_delay_window = IPW32_SET_ADAPTIVE_DELAY_WINDOW;
7889 }
7890
7891 if (index == IPW32_SET_DHCP_MASQ)
7892 {
7893 if (p[2])
7894 {
7895 if (!streq(p[2], "default"))
7896 {
7897 int offset;
7898
7899 if (!atoi_constrained(p[2], &offset, "ip-win32 offset", -256, 256, msglevel))
7900 {
7901 goto err;
7902 }
7903 to->dhcp_masq_custom_offset = true;
7904 to->dhcp_masq_offset = offset;
7905 }
7906
7907 if (p[3])
7908 {
7909 if (!atoi_constrained(p[3], &to->dhcp_lease_time,
7910 "ip-win32 lease time", 30, INT_MAX, msglevel))
7911 {
7912 goto err;
7913 }
7914 }
7915 }
7916 }
7917 to->ip_win32_type = index;
7918 to->ip_win32_defined = true;
7919 }
7920#endif /* ifdef _WIN32 */
7921 else if (streq(p[0], "dns-updown") && p[1])
7922 {
7923 VERIFY_PERMISSION(OPT_P_SCRIPT);
7924 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7925 {
7926 goto err;
7927 }
7928 struct dns_options *dns = &options->dns_options;
7929 if (streq(p[1], "disable"))
7930 {
7931 dns->updown = NULL;
7932 dns->updown_flags = DNS_UPDOWN_NO_FLAGS;
7933 }
7934 else if (streq(p[1], "force"))
7935 {
7936 /* force dns-updown run, even if a --up script is defined */
7937 if (!dns_updown_user_set(dns))
7938 {
7939 dns->updown = DEFAULT_DNS_UPDOWN;
7940 dns->updown_flags = DNS_UPDOWN_FORCED;
7941 }
7942 }
7943 else
7944 {
7945 if (dns->updown && streq(dns->updown, DEFAULT_DNS_UPDOWN))
7946 {
7947 /* Unset the default command to prevent warnings */
7948 dns->updown = NULL;
7949 }
7950 set_user_script(options, &dns->updown, p[1], p[0], false);
7951 dns->updown_flags = DNS_UPDOWN_USER_SET;
7952 }
7953 }
7954 else if (streq(p[0], "dns") && p[1])
7955 {
7956 VERIFY_PERMISSION(OPT_P_DHCPDNS);
7957 if (!check_dns_option(options, p, msglevel, pull_mode))
7958 {
7959 goto err;
7960 }
7961 }
7962 else if (streq(p[0], "dhcp-option") && p[1])
7963 {
7964 struct dhcp_options *dhcp = &options->dns_options.from_dhcp;
7965#if defined(_WIN32) || defined(TARGET_ANDROID)
7966 struct tuntap_options *o = &options->tuntap_options;
7967#endif
7968 VERIFY_PERMISSION(OPT_P_DHCPDNS);
7969
7970 bool dhcp_optional = false;
7971
7972 if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX")) && p[2] && !p[3])
7973 {
7974 if (!validate_domain(p[2]))
7975 {
7976 msg(msglevel, "--dhcp-option %s contains invalid characters", p[1]);
7977 goto err;
7978 }
7979
7980 dhcp->domain = p[2];
7981 dhcp_optional = true;
7982 }
7983 else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3])
7984 {
7985 if (!validate_domain(p[2]))
7986 {
7987 msg(msglevel, "--dhcp-option %s contains invalid characters", p[1]);
7988 goto err;
7989 }
7990
7991 if (dhcp->domain_search_list_len < N_SEARCH_LIST_LEN)
7992 {
7993 dhcp->domain_search_list[dhcp->domain_search_list_len++] = p[2];
7994 }
7995 else
7996 {
7997 msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified",
7998 p[1], N_SEARCH_LIST_LEN);
7999 }
8000 dhcp_optional = true;
8001 }
8002 else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3]
8003 && (!strstr(p[2], ":") || ipv6_addr_safe(p[2])))
8004 {
8005 if (strstr(p[2], ":"))
8006 {
8007 dhcp_option_dns6_parse(p[2], dhcp->dns6, &dhcp->dns6_len, msglevel);
8008 }
8009 else
8010 {
8011 dhcp_option_address_parse("DNS", p[2], dhcp->dns, &dhcp->dns_len, msglevel);
8012 dhcp_optional = true;
8013 }
8014 }
8015#if defined(_WIN32) || defined(TARGET_ANDROID)
8016 else if (streq(p[1], "NBS") && p[2] && !p[3])
8017 {
8018 o->netbios_scope = p[2];
8019 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
8020 }
8021 else if (streq(p[1], "NBT") && p[2] && !p[3])
8022 {
8023 int t = atoi_warn(p[2], msglevel);
8024 if (!(t == 1 || t == 2 || t == 4 || t == 8))
8025 {
8026 msg(msglevel, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t);
8027 goto err;
8028 }
8029 o->netbios_node_type = (uint8_t)t;
8030 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
8031 }
8032 else if (streq(p[1], "WINS") && p[2] && !p[3])
8033 {
8034 dhcp_option_address_parse("WINS", p[2], o->wins, &o->wins_len, msglevel);
8035 o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
8036 }
8037 else if (streq(p[1], "NTP") && p[2] && !p[3])
8038 {
8039 dhcp_option_address_parse("NTP", p[2], o->ntp, &o->ntp_len, msglevel);
8040 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
8041 }
8042 else if (streq(p[1], "NBDD") && p[2] && !p[3])
8043 {
8044 dhcp_option_address_parse("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel);
8045 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
8046 }
8047 else if (streq(p[1], "DISABLE-NBT") && !p[2])
8048 {
8049 o->disable_nbt = 1;
8050 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
8051 }
8052#if defined(TARGET_ANDROID)
8053 else if (streq(p[1], "PROXY_HTTP") && p[3] && !p[4])
8054 {
8055 o->http_proxy_port = positive_atoi(p[3], msglevel);
8056 o->http_proxy = p[2];
8057 }
8058#endif
8059 else
8060 {
8061 msg(msglevel, "--dhcp-option: unknown option type '%s' or missing or unknown parameter",
8062 p[1]);
8063 goto err;
8064 }
8065#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
8066 setenv_foreign_option(options, p[1], p[2], es);
8067#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
8068
8069 if (dhcp_optional)
8070 {
8071#if defined(_WIN32) || defined(TARGET_ANDROID)
8072 o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
8073#endif
8074 }
8075 }
8076#ifdef _WIN32
8077 else if (streq(p[0], "show-adapters") && !p[1])
8078 {
8079 VERIFY_PERMISSION(OPT_P_GENERAL);
8080 show_tap_win_adapters(M_INFO | M_NOPREFIX, M_WARN | M_NOPREFIX);
8081 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8082 }
8083 else if (streq(p[0], "show-net") && !p[1])
8084 {
8085 VERIFY_PERMISSION(OPT_P_GENERAL);
8086 show_routes(M_INFO | M_NOPREFIX);
8087 show_adapters(M_INFO | M_NOPREFIX);
8088 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8089 }
8090 else if (streq(p[0], "show-net-up") && !p[1])
8091 {
8092 VERIFY_PERMISSION(OPT_P_UP);
8093 options->show_net_up = true;
8094 }
8095 else if (streq(p[0], "tap-sleep") && p[1] && !p[2])
8096 {
8097 VERIFY_PERMISSION(OPT_P_DHCPDNS);
8098 if (!atoi_constrained(p[1], &options->tuntap_options.tap_sleep, p[0], 0, 255, msglevel))
8099 {
8100 goto err;
8101 }
8102 }
8103 else if (streq(p[0], "dhcp-renew") && !p[1])
8104 {
8105 VERIFY_PERMISSION(OPT_P_DHCPDNS);
8106 options->tuntap_options.dhcp_renew = true;
8107 }
8108 else if (streq(p[0], "dhcp-pre-release") && !p[1])
8109 {
8110 VERIFY_PERMISSION(OPT_P_DHCPDNS);
8111 options->tuntap_options.dhcp_pre_release = true;
8112 options->tuntap_options.dhcp_renew = true;
8113 }
8114 else if (streq(p[0], "dhcp-release") && !p[1])
8115 {
8116 msg(M_WARN, "Obsolete option --dhcp-release detected. This is now on by default");
8117 }
8118 else if (streq(p[0], "dhcp-internal") && p[1] && !p[2]) /* standalone method for internal use */
8119 {
8120 unsigned int adapter_index;
8121 VERIFY_PERMISSION(OPT_P_GENERAL);
8122 set_debug_level(options->verbosity, SDL_CONSTRAIN);
8123 adapter_index = atou(p[1]);
8124 sleep(options->tuntap_options.tap_sleep);
8125 if (options->tuntap_options.dhcp_pre_release)
8126 {
8127 dhcp_release_by_adapter_index(adapter_index);
8128 }
8129 if (options->tuntap_options.dhcp_renew)
8130 {
8131 dhcp_renew_by_adapter_index(adapter_index);
8132 }
8133 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8134 }
8135 else if (streq(p[0], "register-dns") && !p[1])
8136 {
8137 VERIFY_PERMISSION(OPT_P_DHCPDNS);
8138 options->tuntap_options.register_dns = true;
8139 }
8140 else if (streq(p[0], "block-outside-dns") && !p[1])
8141 {
8142 VERIFY_PERMISSION(OPT_P_DHCPDNS);
8143 options->block_outside_dns = true;
8144 }
8145 else if (streq(p[0], "rdns-internal") && !p[1])
8146 /* standalone method for internal use
8147 *
8148 * (if --register-dns is set, openvpn needs to call itself in a
8149 * sub-process to execute the required functions in a non-blocking
8150 * way, and uses --rdns-internal to signal that to itself)
8151 */
8152 {
8153 VERIFY_PERMISSION(OPT_P_GENERAL);
8154 set_debug_level(options->verbosity, SDL_CONSTRAIN);
8155 if (options->tuntap_options.register_dns)
8156 {
8157 ipconfig_register_dns(NULL);
8158 }
8159 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8160 }
8161 else if (streq(p[0], "show-valid-subnets") && !p[1])
8162 {
8163 VERIFY_PERMISSION(OPT_P_GENERAL);
8164 show_valid_win32_tun_subnets();
8165 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8166 }
8167 else if (streq(p[0], "pause-exit") && !p[1])
8168 {
8169 VERIFY_PERMISSION(OPT_P_GENERAL);
8170 set_pause_exit_win32();
8171 }
8172 else if (streq(p[0], "service") && p[1] && !p[3])
8173 {
8174 VERIFY_PERMISSION(OPT_P_GENERAL);
8175 options->exit_event_name = p[1];
8176 if (p[2])
8177 {
8178 options->exit_event_initial_state = (atoi_warn(p[2], msglevel) != 0);
8179 }
8180 }
8181 else if (streq(p[0], "allow-nonadmin") && !p[2])
8182 {
8183 VERIFY_PERMISSION(OPT_P_GENERAL);
8184 tap_allow_nonadmin_access(p[1]);
8185 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8186 }
8187 else if (streq(p[0], "user") && p[1] && !p[2])
8188 {
8189 VERIFY_PERMISSION(OPT_P_GENERAL);
8190 msg(M_WARN, "NOTE: --user option is not implemented on Windows");
8191 }
8192 else if (streq(p[0], "group") && p[1] && !p[2])
8193 {
8194 VERIFY_PERMISSION(OPT_P_GENERAL);
8195 msg(M_WARN, "NOTE: --group option is not implemented on Windows");
8196 }
8197#else /* ifdef _WIN32 */
8198 else if (streq(p[0], "user") && p[1] && !p[2])
8199 {
8200 VERIFY_PERMISSION(OPT_P_GENERAL);
8201 options->username = p[1];
8202 }
8203 else if (streq(p[0], "group") && p[1] && !p[2])
8204 {
8205 VERIFY_PERMISSION(OPT_P_GENERAL);
8206 options->groupname = p[1];
8207 }
8208 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
8209 {
8210 VERIFY_PERMISSION(OPT_P_DHCPDNS);
8211 setenv_foreign_option(options, p[1], p[2], es);
8212 }
8213 else if (streq(p[0], "route-method") && p[1] && !p[2])
8214 {
8215 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
8216 /* ignore when pushed to non-Windows OS */
8217 }
8218#endif /* ifdef _WIN32 */
8219#if PASSTOS_CAPABILITY
8220 else if (streq(p[0], "passtos") && !p[1])
8221 {
8222 VERIFY_PERMISSION(OPT_P_GENERAL);
8223 options->passtos = true;
8224 }
8225#endif
8226 else if (streq(p[0], "allow-compression") && p[1] && !p[2])
8227 {
8228 VERIFY_PERMISSION(OPT_P_GENERAL);
8229
8230 if (streq(p[1], "no"))
8231 {
8232 options->comp.flags = COMP_F_ALLOW_STUB_ONLY | COMP_F_ADVERTISE_STUBS_ONLY;
8233 if (comp_non_stub_enabled(&options->comp))
8234 {
8235 msg(msglevel, "'--allow-compression no' conflicts with "
8236 " enabling compression");
8237 }
8238 }
8239 else if (options->comp.flags & COMP_F_ALLOW_STUB_ONLY)
8240 {
8241 /* Also printed on a push to hint at configuration problems */
8242 msg(msglevel,
8243 "Cannot set allow-compression to '%s' "
8244 "after set to 'no'",
8245 p[1]);
8246 goto err;
8247 }
8248 else if (streq(p[1], "asym"))
8249 {
8250 options->comp.flags |= COMP_F_ALLOW_ASYM;
8251 }
8252 else if (streq(p[1], "yes"))
8253 {
8254 msg(M_WARN,
8255 "DEPRECATED OPTION: \"--allow-compression yes\" has been removed. "
8256 "We will use \"asym\" mode instead. See the manual page for more information.");
8257
8258 options->comp.flags |= COMP_F_ALLOW_ASYM;
8259 }
8260 else
8261 {
8262 msg(msglevel,
8263 "bad allow-compression option: %s -- "
8264 "must be 'yes', 'no', or 'asym'",
8265 p[1]);
8266 goto err;
8267 }
8268 }
8269 else if (streq(p[0], "comp-lzo") && !p[2])
8270 {
8271 VERIFY_PERMISSION(OPT_P_COMP);
8272
8273 /* All lzo variants do not use swap */
8274 options->comp.flags &= ~COMP_F_SWAP;
8275 options->comp.alg = COMP_ALG_LZO;
8276
8277 if (p[1])
8278 {
8279 if (streq(p[1], "no"))
8280 {
8281 options->comp.alg = COMP_ALG_STUB;
8282 }
8283 /* There is no actual difference anymore between these variants.
8284 * We never compress. On the server side we replace this with
8285 * --compress migrate later anyway.
8286 */
8287 else if (!(streq(p[1], "yes") || streq(p[1], "adaptive")))
8288 {
8289 msg(msglevel, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'",
8290 p[1]);
8291 goto err;
8292 }
8293 }
8294 show_compression_warning(&options->comp);
8295 }
8296 else if (streq(p[0], "comp-noadapt") && !p[1])
8297 {
8298 /* NO-OP since we never compress anymore */
8299 }
8300 else if (streq(p[0], "compress") && !p[2])
8301 {
8302 VERIFY_PERMISSION(OPT_P_COMP);
8303 const char *alg = "stub";
8304 if (p[1])
8305 {
8306 alg = p[1];
8307 }
8308
8309 if (streq(alg, "stub"))
8310 {
8311 options->comp.alg = COMP_ALG_STUB;
8312 options->comp.flags |= (COMP_F_SWAP | COMP_F_ADVERTISE_STUBS_ONLY);
8313 }
8314 else if (streq(alg, "stub-v2"))
8315 {
8316 options->comp.alg = COMP_ALGV2_UNCOMPRESSED;
8317 options->comp.flags |= COMP_F_ADVERTISE_STUBS_ONLY;
8318 }
8319 else if (streq(alg, "migrate"))
8320 {
8321 options->comp.alg = COMP_ALG_UNDEF;
8322 options->comp.flags = COMP_F_MIGRATE;
8323 }
8324 else if (streq(alg, "lzo"))
8325 {
8326 options->comp.alg = COMP_ALG_LZO;
8327 options->comp.flags &= ~COMP_F_SWAP;
8328 }
8329 else if (streq(alg, "lz4"))
8330 {
8331 options->comp.alg = COMP_ALG_LZ4;
8332 options->comp.flags |= COMP_F_SWAP;
8333 }
8334 else if (streq(alg, "lz4-v2"))
8335 {
8336 options->comp.alg = COMP_ALGV2_LZ4;
8337 }
8338 else
8339 {
8340 msg(msglevel, "bad comp option: %s", alg);
8341 goto err;
8342 }
8343
8344 show_compression_warning(&options->comp);
8345 }
8346 else if (streq(p[0], "show-ciphers") && !p[1])
8347 {
8348 VERIFY_PERMISSION(OPT_P_GENERAL);
8349 options->show_ciphers = true;
8350 }
8351 else if (streq(p[0], "show-digests") && !p[1])
8352 {
8353 VERIFY_PERMISSION(OPT_P_GENERAL);
8354 options->show_digests = true;
8355 }
8356 else if (streq(p[0], "show-engines") && !p[1])
8357 {
8358 VERIFY_PERMISSION(OPT_P_GENERAL);
8359 options->show_engines = true;
8360 }
8361 else if (streq(p[0], "key-direction") && p[1] && !p[2])
8362 {
8363 int key_direction;
8364
8365 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
8366
8367 key_direction = ascii2keydirection(msglevel, p[1]);
8368 if (key_direction >= 0)
8369 {
8370 if (permission_mask & OPT_P_GENERAL)
8371 {
8372 options->key_direction = key_direction;
8373 }
8374 else if (permission_mask & OPT_P_CONNECTION)
8375 {
8376 options->ce.key_direction = key_direction;
8377 }
8378 }
8379 else
8380 {
8381 goto err;
8382 }
8383 }
8384 else if (streq(p[0], "secret") && p[1] && !p[3])
8385 {
8386 msg(M_WARN, "DEPRECATED OPTION: The option --secret is deprecated.");
8387 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8388 options->shared_secret_file = p[1];
8389 options->shared_secret_file_inline = is_inline;
8390 if (!is_inline && p[2])
8391 {
8392 int key_direction;
8393
8394 key_direction = ascii2keydirection(msglevel, p[2]);
8395 if (key_direction >= 0)
8396 {
8397 options->key_direction = key_direction;
8398 }
8399 else
8400 {
8401 goto err;
8402 }
8403 }
8404 }
8405 else if (streq(p[0], "allow-deprecated-insecure-static-crypto"))
8406 {
8407 VERIFY_PERMISSION(OPT_P_GENERAL);
8408 options->allow_deprecated_insecure_static_crypto = true;
8409 }
8410 else if (streq(p[0], "genkey") && !p[4])
8411 {
8412 VERIFY_PERMISSION(OPT_P_GENERAL);
8413 options->genkey = true;
8414 if (!p[1])
8415 {
8416 options->genkey_type = GENKEY_SECRET;
8417 }
8418 else
8419 {
8420 if (streq(p[1], "secret") || streq(p[1], "tls-auth") || streq(p[1], "tls-crypt"))
8421 {
8422 options->genkey_type = GENKEY_SECRET;
8423 }
8424 else if (streq(p[1], "tls-crypt-v2-server"))
8425 {
8426 options->genkey_type = GENKEY_TLS_CRYPTV2_SERVER;
8427 }
8428 else if (streq(p[1], "tls-crypt-v2-client"))
8429 {
8430 options->genkey_type = GENKEY_TLS_CRYPTV2_CLIENT;
8431 if (p[3])
8432 {
8433 options->genkey_extra_data = p[3];
8434 }
8435 }
8436 else if (streq(p[1], "auth-token"))
8437 {
8438 options->genkey_type = GENKEY_AUTH_TOKEN;
8439 }
8440 else
8441 {
8442 msg(msglevel, "unknown --genkey type: %s", p[1]);
8443 }
8444 }
8445 if (p[2])
8446 {
8447 options->genkey_filename = p[2];
8448 }
8449 }
8450 else if (streq(p[0], "auth") && p[1] && !p[2])
8451 {
8452 VERIFY_PERMISSION(OPT_P_GENERAL);
8453 options->authname = p[1];
8454 }
8455 else if (streq(p[0], "cipher") && p[1] && !p[2])
8456 {
8457 VERIFY_PERMISSION(OPT_P_NCP | OPT_P_INSTANCE);
8458 options->ciphername = p[1];
8459 }
8460 else if (streq(p[0], "data-ciphers-fallback") && p[1] && !p[2])
8461 {
8462 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
8463 options->ciphername = p[1];
8464 options->enable_ncp_fallback = true;
8465 }
8466 else if ((streq(p[0], "data-ciphers") || streq(p[0], "ncp-ciphers")) && p[1] && !p[2])
8467 {
8468 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
8469 if (streq(p[0], "ncp-ciphers"))
8470 {
8471 msg(M_INFO, "Note: Treating option '--ncp-ciphers' as "
8472 " '--data-ciphers' (renamed in OpenVPN 2.5).");
8473 }
8474 options->ncp_ciphers = p[1];
8475 }
8476 else if (streq(p[0], "key-derivation") && p[1])
8477 {
8478 /* NCP only option that is pushed by the server to enable EKM,
8479 * should not be used by normal users in config files*/
8480 VERIFY_PERMISSION(OPT_P_NCP)
8481 if (streq(p[1], "tls-ekm"))
8482 {
8483 options->imported_protocol_flags |= CO_USE_TLS_KEY_MATERIAL_EXPORT;
8484 }
8485 else
8486 {
8487 msg(msglevel, "Unknown key-derivation method %s", p[1]);
8488 }
8489 }
8490 else if (streq(p[0], "protocol-flags") && p[1])
8491 {
8492 /* NCP only option that is pushed by the server to enable protocol
8493 * features that are negotiated, should not be used by normal users
8494 * in config files */
8495 VERIFY_PERMISSION(OPT_P_NCP)
8496 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
8497 {
8498 if (streq(p[j], "cc-exit"))
8499 {
8500 options->imported_protocol_flags |= CO_USE_CC_EXIT_NOTIFY;
8501 }
8502 else if (streq(p[j], "tls-ekm"))
8503 {
8504 options->imported_protocol_flags |= CO_USE_TLS_KEY_MATERIAL_EXPORT;
8505 }
8506 else if (streq(p[j], "dyn-tls-crypt"))
8507 {
8508 options->imported_protocol_flags |= CO_USE_DYNAMIC_TLS_CRYPT;
8509 }
8510 else if (streq(p[j], "aead-epoch"))
8511 {
8512 options->imported_protocol_flags |= CO_EPOCH_DATA_KEY_FORMAT;
8513 }
8514 else
8515 {
8516 msg(msglevel, "Unknown protocol-flags flag: %s", p[j]);
8517 }
8518 }
8519 }
8520 else if (streq(p[0], "force-tls-key-material-export"))
8521 {
8522 VERIFY_PERMISSION(OPT_P_GENERAL);
8523 options->force_key_material_export = true;
8524 }
8525 else if (streq(p[0], "prng") && p[1] && !p[3])
8526 {
8527 msg(M_WARN, "NOTICE: --prng option ignored (SSL library PRNG is used)");
8528 }
8529 else if (streq(p[0], "no-replay") && !p[1])
8530 {
8531 VERIFY_PERMISSION(OPT_P_GENERAL);
8532 /* always error out, this breaks the connection */
8533 msg(M_FATAL, "--no-replay was removed in OpenVPN 2.7. "
8534 "Update your configuration.");
8535 }
8536 else if (streq(p[0], "replay-window") && !p[3])
8537 {
8538 VERIFY_PERMISSION(OPT_P_GENERAL);
8539 if (p[1])
8540 {
8541 if (!atoi_constrained(p[1], &options->replay_window, "replay-window windows size",
8542 MIN_SEQ_BACKTRACK, MAX_SEQ_BACKTRACK, msglevel))
8543 {
8544 goto err;
8545 }
8546
8547 if (p[2])
8548 {
8549 if (!atoi_constrained(p[2], &options->replay_time, "replay-window time window",
8550 MIN_TIME_BACKTRACK, MAX_TIME_BACKTRACK, msglevel))
8551 {
8552 goto err;
8553 }
8554 }
8555 }
8556 else
8557 {
8558 msg(msglevel, "replay-window option is missing window size parameter");
8559 goto err;
8560 }
8561 }
8562 else if (streq(p[0], "mute-replay-warnings") && !p[1])
8563 {
8564 VERIFY_PERMISSION(OPT_P_GENERAL);
8565 options->mute_replay_warnings = true;
8566 }
8567 else if (streq(p[0], "replay-persist") && p[1] && !p[2])
8568 {
8569 VERIFY_PERMISSION(OPT_P_GENERAL);
8570 options->packet_id_file = p[1];
8571 }
8572 else if (streq(p[0], "test-crypto") && !p[1])
8573 {
8574 VERIFY_PERMISSION(OPT_P_GENERAL);
8575 options->test_crypto = true;
8576 }
8577#ifndef ENABLE_CRYPTO_MBEDTLS
8578 else if (streq(p[0], "engine") && !p[2])
8579 {
8580 VERIFY_PERMISSION(OPT_P_GENERAL);
8581 if (p[1])
8582 {
8583 options->engine = p[1];
8584 }
8585 else
8586 {
8587 options->engine = "auto";
8588 }
8589 }
8590#endif /* ENABLE_CRYPTO_MBEDTLS */
8591 else if (streq(p[0], "providers") && p[1])
8592 {
8593 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
8594 {
8595 options->providers.names[j] = p[j];
8596 }
8597 }
8598 else if (streq(p[0], "show-tls") && !p[1])
8599 {
8600 VERIFY_PERMISSION(OPT_P_GENERAL);
8601 options->show_tls_ciphers = true;
8602 }
8603 else if ((streq(p[0], "show-curves") || streq(p[0], "show-groups")) && !p[1])
8604 {
8605 VERIFY_PERMISSION(OPT_P_GENERAL);
8606 options->show_curves = true;
8607 }
8608 else if (streq(p[0], "ecdh-curve") && p[1] && !p[2])
8609 {
8610 VERIFY_PERMISSION(OPT_P_GENERAL);
8611 msg(M_WARN, "Consider setting groups/curves preference with "
8612 "tls-groups instead of forcing a specific curve with "
8613 "ecdh-curve.");
8614 options->ecdh_curve = p[1];
8615 }
8616 else if (streq(p[0], "tls-server") && !p[1])
8617 {
8618 VERIFY_PERMISSION(OPT_P_GENERAL);
8619 options->tls_server = true;
8620 }
8621 else if (streq(p[0], "tls-client") && !p[1])
8622 {
8623 VERIFY_PERMISSION(OPT_P_GENERAL);
8624 options->tls_client = true;
8625 }
8626 else if (streq(p[0], "ca") && p[1] && !p[2])
8627 {
8628 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8629 options->ca_file = p[1];
8630 options->ca_file_inline = is_inline;
8631 }
8632#ifndef ENABLE_CRYPTO_MBEDTLS
8633 else if (streq(p[0], "capath") && p[1] && !p[2])
8634 {
8635 VERIFY_PERMISSION(OPT_P_GENERAL);
8636 options->ca_path = p[1];
8637 }
8638#endif /* ENABLE_CRYPTO_MBEDTLS */
8639 else if (streq(p[0], "dh") && p[1] && !p[2])
8640 {
8641 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8642 options->dh_file = p[1];
8643 options->dh_file_inline = is_inline;
8644 }
8645 else if (streq(p[0], "cert") && p[1] && !p[2])
8646 {
8647 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8648 options->cert_file = p[1];
8649 options->cert_file_inline = is_inline;
8650 }
8651 else if (streq(p[0], "extra-certs") && p[1] && !p[2])
8652 {
8653 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8654 options->extra_certs_file = p[1];
8655 options->extra_certs_file_inline = is_inline;
8656 }
8657 else if ((streq(p[0], "verify-hash") && p[1] && !p[3])
8658 || (streq(p[0], "peer-fingerprint") && p[1] && !p[2]))
8659 {
8660 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8661
8662 int verify_hash_depth = 0;
8663 if (streq(p[0], "verify-hash"))
8664 {
8665 msg(M_WARN, "DEPRECATED OPTION: The option --verify-hash is deprecated. "
8666 "You should switch to the either use the level 1 certificate as "
8667 "--ca option, use --tls-verify or use --peer-fingerprint");
8668 /* verify level 1 cert, i.e. the CA that signed the leaf cert */
8669 verify_hash_depth = 1;
8670 }
8671
8672 options->verify_hash_algo = MD_SHA256;
8673
8674 int digest_len = SHA256_DIGEST_LENGTH;
8675
8676 if (options->verify_hash && options->verify_hash_depth != verify_hash_depth)
8677 {
8678 msg(msglevel,
8679 "ERROR: Setting %s not allowed. --verify-hash and"
8680 " --peer-fingerprint are mutually exclusive",
8681 p[0]);
8682 goto err;
8683 }
8684
8685 if (streq(p[0], "verify-hash"))
8686 {
8687 if ((!p[2] && !is_inline) || (p[2] && streq(p[2], "SHA1")))
8688 {
8689 options->verify_hash_algo = MD_SHA1;
8690 digest_len = SHA_DIGEST_LENGTH;
8691 }
8692 else if (p[2] && !streq(p[2], "SHA256"))
8693 {
8694 msg(msglevel,
8695 "invalid or unsupported hashing algorithm: %s "
8696 "(only SHA1 and SHA256 are supported)",
8697 p[2]);
8698 goto err;
8699 }
8700 }
8701
8702 struct verify_hash_list *newlist;
8703 newlist = parse_hash_fingerprint_multiline(p[1], digest_len, msglevel, &options->gc);
8704
8705 /* Append the new list to the end of our current list */
8706 if (!options->verify_hash)
8707 {
8708 options->verify_hash = newlist;
8709 options->verify_hash_depth = verify_hash_depth;
8710 }
8711 else
8712 {
8713 /* since both the old and new list can have multiple entries
8714 * we need to go to the end of one of them to concatenate them */
8715 struct verify_hash_list *listend = options->verify_hash;
8716 while (listend->next)
8717 {
8718 listend = listend->next;
8719 }
8720 listend->next = newlist;
8721 }
8722 }
8723#if defined(ENABLE_CRYPTOAPI) && defined(HAVE_XKEY_PROVIDER)
8724 else if (streq(p[0], "cryptoapicert") && p[1] && !p[2])
8725 {
8726 VERIFY_PERMISSION(OPT_P_GENERAL);
8727 options->cryptoapi_cert = p[1];
8728 }
8729#endif
8730 else if (streq(p[0], "key") && p[1] && !p[2])
8731 {
8732 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8733 options->priv_key_file = p[1];
8734 options->priv_key_file_inline = is_inline;
8735 }
8736 else if (streq(p[0], "tls-version-min") && p[1] && !p[3])
8737 {
8738 VERIFY_PERMISSION(OPT_P_GENERAL);
8739 int ver = tls_version_parse(p[1], p[2]);
8740 if (ver == TLS_VER_BAD)
8741 {
8742 msg(msglevel, "unknown tls-version-min parameter: %s", p[1]);
8743 goto err;
8744 }
8745
8746#ifdef ENABLE_CRYPTO_MBEDTLS
8747 if (ver < TLS_VER_1_2)
8748 {
8749 msg(M_WARN, "--tls-version-min %s is not supported by mbedtls, using 1.2", p[1]);
8750 ver = TLS_VER_1_2;
8751 }
8752#endif
8753
8754 options->ssl_flags &= ~(SSLF_TLS_VERSION_MIN_MASK << SSLF_TLS_VERSION_MIN_SHIFT);
8755 options->ssl_flags |= ((unsigned int)ver << SSLF_TLS_VERSION_MIN_SHIFT);
8756 }
8757 else if (streq(p[0], "tls-version-max") && p[1] && !p[2])
8758 {
8759 VERIFY_PERMISSION(OPT_P_GENERAL);
8760 int ver = tls_version_parse(p[1], NULL);
8761 if (ver == TLS_VER_BAD)
8762 {
8763 msg(msglevel, "unknown tls-version-max parameter: %s", p[1]);
8764 goto err;
8765 }
8766 options->ssl_flags &= ~(SSLF_TLS_VERSION_MAX_MASK << SSLF_TLS_VERSION_MAX_SHIFT);
8767 options->ssl_flags |= ((unsigned int)ver << SSLF_TLS_VERSION_MAX_SHIFT);
8768 }
8769#ifndef ENABLE_CRYPTO_MBEDTLS
8770 else if (streq(p[0], "pkcs12") && p[1] && !p[2])
8771 {
8772 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8773 options->pkcs12_file = p[1];
8774 options->pkcs12_file_inline = is_inline;
8775 }
8776#endif /* ENABLE_CRYPTO_MBEDTLS */
8777 else if (streq(p[0], "askpass") && !p[2])
8778 {
8779 VERIFY_PERMISSION(OPT_P_GENERAL);
8780 if (p[1])
8781 {
8782 options->key_pass_file = p[1];
8783 }
8784 else
8785 {
8786 options->key_pass_file = "stdin";
8787 }
8788 }
8789 else if (streq(p[0], "auth-nocache") && !p[1])
8790 {
8791 VERIFY_PERMISSION(OPT_P_GENERAL);
8792 ssl_set_auth_nocache();
8793 }
8794 else if (streq(p[0], "auth-token") && p[1] && !p[2])
8795 {
8796 VERIFY_PERMISSION(OPT_P_ECHO);
8797 ssl_set_auth_token(p[1]);
8798#ifdef ENABLE_MANAGEMENT
8799 if (management)
8800 {
8801 management_auth_token(management, p[1]);
8802 }
8803#endif
8804 }
8805 else if (streq(p[0], "auth-token-user") && p[1] && !p[2])
8806 {
8807 VERIFY_PERMISSION(OPT_P_ECHO);
8808 ssl_set_auth_token_user(p[1]);
8809 }
8810 else if (streq(p[0], "single-session") && !p[1])
8811 {
8812 VERIFY_PERMISSION(OPT_P_GENERAL);
8813 options->single_session = true;
8814 }
8815 else if (streq(p[0], "push-peer-info") && !p[1])
8816 {
8817 VERIFY_PERMISSION(OPT_P_GENERAL);
8818 options->push_peer_info = true;
8819 }
8820 else if (streq(p[0], "tls-exit") && !p[1])
8821 {
8822 VERIFY_PERMISSION(OPT_P_GENERAL);
8823 options->tls_exit = true;
8824 }
8825 else if (streq(p[0], "tls-cipher") && p[1] && !p[2])
8826 {
8827 VERIFY_PERMISSION(OPT_P_GENERAL);
8828 options->cipher_list = p[1];
8829 }
8830 else if (streq(p[0], "tls-cert-profile") && p[1] && !p[2])
8831 {
8832 VERIFY_PERMISSION(OPT_P_GENERAL);
8833 options->tls_cert_profile = p[1];
8834 }
8835 else if (streq(p[0], "tls-ciphersuites") && p[1] && !p[2])
8836 {
8837 VERIFY_PERMISSION(OPT_P_GENERAL);
8838 options->cipher_list_tls13 = p[1];
8839 }
8840 else if (streq(p[0], "tls-groups") && p[1] && !p[2])
8841 {
8842 VERIFY_PERMISSION(OPT_P_GENERAL);
8843 options->tls_groups = p[1];
8844 }
8845 else if (streq(p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || !p[2]))
8846 {
8847 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
8848 if (p[2] && streq(p[2], "dir"))
8849 {
8850 options->ssl_flags |= SSLF_CRL_VERIFY_DIR;
8851 }
8852 options->crl_file = p[1];
8853 options->crl_file_inline = is_inline;
8854 }
8855 else if (streq(p[0], "tls-verify") && p[1])
8856 {
8857 VERIFY_PERMISSION(OPT_P_SCRIPT);
8858 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
8859 {
8860 goto err;
8861 }
8862 set_user_script(options, &options->tls_verify,
8863 string_substitute(p[1], ',', ' ', &options->gc), "tls-verify", true);
8864 }
8865 else if (streq(p[0], "tls-export-cert") && p[1] && !p[2])
8866 {
8867 VERIFY_PERMISSION(OPT_P_SCRIPT);
8868 options->tls_export_peer_cert_dir = p[1];
8869 }
8870 else if (streq(p[0], "compat-names"))
8871 {
8872 VERIFY_PERMISSION(OPT_P_GENERAL);
8873 msg(msglevel, "--compat-names was removed in OpenVPN 2.5. "
8874 "Update your configuration.");
8875 goto err;
8876 }
8877 else if (streq(p[0], "no-name-remapping") && !p[1])
8878 {
8879 VERIFY_PERMISSION(OPT_P_GENERAL);
8880 msg(msglevel, "--no-name-remapping was removed in OpenVPN 2.5. "
8881 "Update your configuration.");
8882 goto err;
8883 }
8884 else if (streq(p[0], "verify-x509-name") && p[1] && strlen(p[1]) && !p[3])
8885 {
8886 int type = VERIFY_X509_SUBJECT_DN;
8887 VERIFY_PERMISSION(OPT_P_GENERAL);
8888 if (p[2])
8889 {
8890 if (streq(p[2], "subject"))
8891 {
8892 type = VERIFY_X509_SUBJECT_DN;
8893 }
8894 else if (streq(p[2], "name"))
8895 {
8896 type = VERIFY_X509_SUBJECT_RDN;
8897 }
8898 else if (streq(p[2], "name-prefix"))
8899 {
8900 type = VERIFY_X509_SUBJECT_RDN_PREFIX;
8901 }
8902 else
8903 {
8904 msg(msglevel, "unknown X.509 name type: %s", p[2]);
8905 goto err;
8906 }
8907 }
8908 options->verify_x509_type = type;
8909 options->verify_x509_name = p[1];
8910 }
8911 else if (streq(p[0], "ns-cert-type") && p[1] && !p[2])
8912 {
8913#ifdef ENABLE_CRYPTO_MBEDTLS
8914 msg(msglevel, "--ns-cert-type is not available with mbedtls.");
8915 goto err;
8916#else
8917 VERIFY_PERMISSION(OPT_P_GENERAL);
8918 if (streq(p[1], "server"))
8919 {
8920 options->ns_cert_type = NS_CERT_CHECK_SERVER;
8921 }
8922 else if (streq(p[1], "client"))
8923 {
8924 options->ns_cert_type = NS_CERT_CHECK_CLIENT;
8925 }
8926 else
8927 {
8928 msg(msglevel, "--ns-cert-type must be 'client' or 'server'");
8929 goto err;
8930 }
8931#endif /* ENABLE_CRYPTO_MBEDTLS */
8932 }
8933 else if (streq(p[0], "remote-cert-ku"))
8934 {
8935 VERIFY_PERMISSION(OPT_P_GENERAL);
8936
8937 size_t j;
8938 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
8939 {
8940 sscanf(p[j], "%x", &(options->remote_cert_ku[j - 1]));
8941 }
8942 if (j == 1)
8943 {
8944 /* No specific KU required, but require KU to be present */
8945 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
8946 }
8947 }
8948 else if (streq(p[0], "remote-cert-eku") && p[1] && !p[2])
8949 {
8950 VERIFY_PERMISSION(OPT_P_GENERAL);
8951 options->remote_cert_eku = p[1];
8952 }
8953 else if (streq(p[0], "remote-cert-tls") && p[1] && !p[2])
8954 {
8955 VERIFY_PERMISSION(OPT_P_GENERAL);
8956
8957 if (streq(p[1], "server"))
8958 {
8959 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
8960 options->remote_cert_eku = "TLS Web Server Authentication";
8961 }
8962 else if (streq(p[1], "client"))
8963 {
8964 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
8965 options->remote_cert_eku = "TLS Web Client Authentication";
8966 }
8967 else
8968 {
8969 msg(msglevel, "--remote-cert-tls must be 'client' or 'server'");
8970 goto err;
8971 }
8972 }
8973 else if (streq(p[0], "tls-timeout") && p[1] && !p[2])
8974 {
8975 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
8976 options->tls_timeout = positive_atoi(p[1], msglevel);
8977 }
8978 else if (streq(p[0], "reneg-bytes") && p[1] && !p[2])
8979 {
8980 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
8981 if (!positive_atoll(p[1], &options->renegotiate_bytes, p[0], msglevel))
8982 {
8983 goto err;
8984 }
8985 }
8986 else if (streq(p[0], "reneg-pkts") && p[1] && !p[2])
8987 {
8988 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
8989 if (!positive_atoll(p[1], &options->renegotiate_packets, p[0], msglevel))
8990 {
8991 goto err;
8992 }
8993 }
8994 else if (streq(p[0], "reneg-sec") && p[1] && !p[3])
8995 {
8996 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
8997 options->renegotiate_seconds = positive_atoi(p[1], msglevel);
8998 if (p[2])
8999 {
9000 options->renegotiate_seconds_min = positive_atoi(p[2], msglevel);
9001 }
9002 }
9003 else if (streq(p[0], "hand-window") && p[1] && !p[2])
9004 {
9005 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
9006 options->handshake_window = positive_atoi(p[1], msglevel);
9007 }
9008 else if (streq(p[0], "tran-window") && p[1] && !p[2])
9009 {
9010 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
9011 options->transition_window = positive_atoi(p[1], msglevel);
9012 }
9013 else if (streq(p[0], "tls-auth") && p[1] && !p[3])
9014 {
9015 int key_direction = -1;
9016
9017 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
9018
9019 if (permission_mask & OPT_P_GENERAL)
9020 {
9021 options->tls_auth_file = p[1];
9022 options->tls_auth_file_inline = is_inline;
9023
9024 if (!is_inline && p[2])
9025 {
9026 key_direction = ascii2keydirection(msglevel, p[2]);
9027 if (key_direction < 0)
9028 {
9029 goto err;
9030 }
9031 options->key_direction = key_direction;
9032 }
9033 }
9034 else if (permission_mask & OPT_P_CONNECTION)
9035 {
9036 options->ce.tls_auth_file = p[1];
9037 options->ce.tls_auth_file_inline = is_inline;
9038 options->ce.key_direction = KEY_DIRECTION_BIDIRECTIONAL;
9039
9040 if (!is_inline && p[2])
9041 {
9042 key_direction = ascii2keydirection(msglevel, p[2]);
9043 if (key_direction < 0)
9044 {
9045 goto err;
9046 }
9047 options->ce.key_direction = key_direction;
9048 }
9049 }
9050 }
9051 else if (streq(p[0], "tls-crypt") && p[1] && !p[3])
9052 {
9053 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
9054 if (permission_mask & OPT_P_GENERAL)
9055 {
9056 options->tls_crypt_file = p[1];
9057 options->tls_crypt_file_inline = is_inline;
9058 }
9059 else if (permission_mask & OPT_P_CONNECTION)
9060 {
9061 options->ce.tls_crypt_file = p[1];
9062 options->ce.tls_crypt_file_inline = is_inline;
9063 }
9064 }
9065 else if (streq(p[0], "tls-crypt-v2") && p[1] && !p[3])
9066 {
9067 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
9068 if (permission_mask & OPT_P_GENERAL)
9069 {
9070 options->tls_crypt_v2_file = p[1];
9071 options->tls_crypt_v2_file_inline = is_inline;
9072 }
9073 else if (permission_mask & OPT_P_CONNECTION)
9074 {
9075 options->ce.tls_crypt_v2_file = p[1];
9076 options->ce.tls_crypt_v2_file_inline = is_inline;
9077 }
9078
9079 if (p[2] && streq(p[2], "force-cookie"))
9080 {
9081 options->ce.tls_crypt_v2_force_cookie = true;
9082 }
9083 else if (p[2] && streq(p[2], "allow-noncookie"))
9084 {
9085 options->ce.tls_crypt_v2_force_cookie = false;
9086 }
9087 else if (p[2])
9088 {
9089 msg(msglevel, "Unsupported tls-crypt-v2 argument: %s", p[2]);
9090 }
9091 }
9092 else if (streq(p[0], "tls-crypt-v2-verify") && p[1] && !p[2])
9093 {
9094 VERIFY_PERMISSION(OPT_P_GENERAL);
9095 options->tls_crypt_v2_verify_script = p[1];
9096 }
9097 else if (streq(p[0], "tls-crypt-v2-max-age") && p[1])
9098 {
9099 VERIFY_PERMISSION(OPT_P_GENERAL);
9100 if (!atoi_constrained(p[1], &options->tls_crypt_v2_max_age, "tls-crypt-v2-max-age", 1, INT_MAX, msglevel))
9101 {
9102 goto err;
9103 }
9104 }
9105 else if (streq(p[0], "x509-track") && p[1] && !p[2])
9106 {
9107 VERIFY_PERMISSION(OPT_P_GENERAL);
9108 x509_track_add(&options->x509_track, p[1], msglevel, &options->gc);
9109 }
9110 else if (streq(p[0], "x509-username-field") && p[1])
9111 {
9112 VERIFY_PERMISSION(OPT_P_GENERAL);
9113 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9114 {
9115 char *s = p[j];
9116
9117 if (strncmp("ext:", s, 4) == 0 && !x509_username_field_ext_supported(s + 4))
9118 {
9119 msg(msglevel, "Unsupported x509-username-field extension: %s", s);
9120 }
9121 options->x509_username_field[j - 1] = p[j];
9122 }
9123 }
9124#ifdef ENABLE_PKCS11
9125 else if (streq(p[0], "show-pkcs11-ids") && !p[3])
9126 {
9127 char *provider = p[1];
9128 bool cert_private = (p[2] == NULL ? false : (atoi_warn(p[2], msglevel) != 0));
9129
9130#ifdef DEFAULT_PKCS11_MODULE
9131 if (!provider)
9132 {
9133 provider = DEFAULT_PKCS11_MODULE;
9134 }
9135 else if (!p[2])
9136 {
9137 char *endp = NULL;
9138 long i = strtol(provider, &endp, 10);
9139
9140 if (*endp == 0)
9141 {
9142 /* There was one argument, and it was purely numeric.
9143 * Interpret it as the cert_private argument */
9144 provider = DEFAULT_PKCS11_MODULE;
9145 cert_private = i;
9146 }
9147 }
9148#else /* ifdef DEFAULT_PKCS11_MODULE */
9149 if (!provider)
9150 {
9151 msg(msglevel, "--show-pkcs11-ids requires a provider parameter");
9152 goto err;
9153 }
9154#endif /* ifdef DEFAULT_PKCS11_MODULE */
9155 VERIFY_PERMISSION(OPT_P_GENERAL);
9156
9157 set_debug_level(options->verbosity, SDL_CONSTRAIN);
9158 show_pkcs11_ids(provider, cert_private);
9159 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
9160 }
9161 else if (streq(p[0], "pkcs11-providers") && p[1])
9162 {
9163 int j;
9164
9165 VERIFY_PERMISSION(OPT_P_GENERAL);
9166
9167 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9168 {
9169 options->pkcs11_providers[j - 1] = p[j];
9170 }
9171 }
9172 else if (streq(p[0], "pkcs11-protected-authentication"))
9173 {
9174 int j;
9175
9176 VERIFY_PERMISSION(OPT_P_GENERAL);
9177
9178 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9179 {
9180 options->pkcs11_protected_authentication[j - 1] =
9181 atoi_warn(p[j], msglevel) != 0 ? 1 : 0;
9182 }
9183 }
9184 else if (streq(p[0], "pkcs11-private-mode") && p[1])
9185 {
9186 int j;
9187
9188 VERIFY_PERMISSION(OPT_P_GENERAL);
9189
9190 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9191 {
9192 sscanf(p[j], "%x", &(options->pkcs11_private_mode[j - 1]));
9193 }
9194 }
9195 else if (streq(p[0], "pkcs11-cert-private"))
9196 {
9197 int j;
9198
9199 VERIFY_PERMISSION(OPT_P_GENERAL);
9200
9201 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9202 {
9203 options->pkcs11_cert_private[j - 1] = (bool)(atoi_warn(p[j], msglevel));
9204 }
9205 }
9206 else if (streq(p[0], "pkcs11-pin-cache") && p[1] && !p[2])
9207 {
9208 VERIFY_PERMISSION(OPT_P_GENERAL);
9209 options->pkcs11_pin_cache_period = positive_atoi(p[1], msglevel);
9210 }
9211 else if (streq(p[0], "pkcs11-id") && p[1] && !p[2])
9212 {
9213 VERIFY_PERMISSION(OPT_P_GENERAL);
9214 options->pkcs11_id = p[1];
9215 }
9216 else if (streq(p[0], "pkcs11-id-management") && !p[1])
9217 {
9218 VERIFY_PERMISSION(OPT_P_GENERAL);
9219 options->pkcs11_id_management = true;
9220 }
9221#endif /* ifdef ENABLE_PKCS11 */
9222 else if (streq(p[0], "rmtun") && !p[1])
9223 {
9224 VERIFY_PERMISSION(OPT_P_GENERAL);
9225 options->persist_config = true;
9226 options->persist_mode = 0;
9227 }
9228 else if (streq(p[0], "mktun") && !p[1])
9229 {
9230 VERIFY_PERMISSION(OPT_P_GENERAL);
9231 options->persist_config = true;
9232 options->persist_mode = 1;
9233 }
9234 else if (streq(p[0], "peer-id") && p[1] && !p[2])
9235 {
9236 VERIFY_PERMISSION(OPT_P_PEER_ID);
9237 options->use_peer_id = true;
9238 options->peer_id = atoi_warn(p[1], msglevel);
9239 }
9240 else if (streq(p[0], "keying-material-exporter") && p[1] && p[2])
9241 {
9242 VERIFY_PERMISSION(OPT_P_GENERAL);
9243
9244 if (strncmp(p[1], "EXPORTER", 8))
9245 {
9246 msg(msglevel, "Keying material exporter label must begin with "
9247 "\"EXPORTER\"");
9248 goto err;
9249 }
9250 if (streq(p[1], EXPORT_KEY_DATA_LABEL))
9251 {
9252 msg(msglevel,
9253 "Keying material exporter label must not be '" EXPORT_KEY_DATA_LABEL "'.");
9254 }
9255
9256 if (!atoi_constrained(p[2], &options->keying_material_exporter_length,
9257 p[0], 16, 4095, msglevel))
9258 {
9259 goto err;
9260 }
9261
9262 options->keying_material_exporter_label = p[1];
9263 }
9264 else if (streq(p[0], "allow-recursive-routing") && !p[1])
9265 {
9266 VERIFY_PERMISSION(OPT_P_GENERAL);
9267 options->allow_recursive_routing = true;
9268 }
9269 else if (streq(p[0], "vlan-tagging") && !p[1])
9270 {
9271 VERIFY_PERMISSION(OPT_P_GENERAL);
9272 options->vlan_tagging = true;
9273 }
9274 else if (streq(p[0], "vlan-accept") && p[1] && !p[2])
9275 {
9276 VERIFY_PERMISSION(OPT_P_GENERAL);
9277 if (streq(p[1], "tagged"))
9278 {
9279 options->vlan_accept = VLAN_ONLY_TAGGED;
9280 }
9281 else if (streq(p[1], "untagged"))
9282 {
9283 options->vlan_accept = VLAN_ONLY_UNTAGGED_OR_PRIORITY;
9284 }
9285 else if (streq(p[1], "all"))
9286 {
9287 options->vlan_accept = VLAN_ALL;
9288 }
9289 else
9290 {
9291 msg(msglevel, "--vlan-accept must be 'tagged', 'untagged' or 'all'");
9292 goto err;
9293 }
9294 }
9295 else if (streq(p[0], "vlan-pvid") && p[1] && !p[2])
9296 {
9297 int vlan_pvid;
9298 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
9299 if (!atoi_constrained(p[1], &vlan_pvid, p[0],
9300 OPENVPN_8021Q_MIN_VID, OPENVPN_8021Q_MAX_VID, msglevel))
9301 {
9302 goto err;
9303 }
9304 options->vlan_pvid = (uint16_t)vlan_pvid;
9305 }
9306 else
9307 {
9308 int i;
9309 msglvl_t msglevel_unknown = msglevel_fc;
9310 /* Check if an option is in --ignore-unknown-option and
9311 * set warning level to non fatal */
9312 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
9313 {
9314 if (streq(p[0], options->ignore_unknown_option[i]))
9315 {
9316 msglevel_unknown = M_WARN;
9317 break;
9318 }
9319 }
9320 if (file)
9321 {
9322 msg(msglevel_unknown,
9323 "Unrecognized option or missing or extra parameter(s) in %s:%d: %s (%s)", file,
9324 line, p[0], PACKAGE_VERSION);
9325 }
9326 else
9327 {
9328 msg(msglevel_unknown, "Unrecognized option or missing or extra parameter(s): --%s (%s)",
9329 p[0], PACKAGE_VERSION);
9330 }
9331 }
9332err:
9333 gc_free(&gc);
9334}
9335
9336#if defined(__GNUC__) || defined(__clang__)
9337#pragma GCC diagnostic pop
9338#endif
9339
9340bool
9341has_udp_in_local_list(const struct options *options)
9342{
9343 if (options->ce.local_list)
9344 {
9345 for (int i = 0; i < options->ce.local_list->len; i++)
9346 {
9347 if (proto_is_dgram(options->ce.local_list->array[i]->proto))
9348 {
9349 return true;
9350 }
9351 }
9352 }
9353
9354 return false;
9355}
argv_parse_cmd
void argv_parse_cmd(struct argv *argres, const char *cmdstr)
Parses a command string, tokenizes it and puts each element into a separate struct argv argument slot...
Definition argv.c:481
argv_free
void argv_free(struct argv *a)
Frees all memory allocations allocated by the struct argv related functions.
Definition argv.c:101
argv_new
struct argv argv_new(void)
Allocates a new struct argv and ensures it is initialised.
Definition argv.c:87
buf_clear
void buf_clear(struct buffer *buf)
Definition buffer.c:168
buf_printf
bool buf_printf(struct buffer *buf, const char *format,...)
Definition buffer.c:246
gc_transfer
void gc_transfer(struct gc_arena *dest, struct gc_arena *src)
Definition buffer.c:465
gc_realloc
void * gc_realloc(void *ptr, size_t size, struct gc_arena *a)
allows to realloc a pointer previously allocated by gc_malloc or gc_realloc
Definition buffer.c:375
gc_malloc
void * gc_malloc(size_t size, bool clear, struct gc_arena *a)
Definition buffer.c:341
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:88
format_hex_ex
char * format_hex_ex(const uint8_t *data, size_t size, size_t maxoutput, unsigned int space_break_flags, const char *separator, struct gc_arena *gc)
Definition buffer.c:488
alloc_buf
struct buffer alloc_buf(size_t size)
Definition buffer.c:63
string_array_len
int string_array_len(const char **array)
Definition buffer.c:707
buffer_read_from_file
struct buffer buffer_read_from_file(const char *filename, struct gc_arena *gc)
buffer_read_from_file - copy the content of a file into a buffer
Definition buffer.c:1378
buf_parse
bool buf_parse(struct buffer *buf, const int delim, char *line, const int size)
Definition buffer.c:829
string_alloc
char * string_alloc(const char *str, struct gc_arena *gc)
Definition buffer.c:653
string_alloc_buf
struct buffer string_alloc_buf(const char *str, struct gc_arena *gc)
Definition buffer.c:756
gc_detach
static void gc_detach(struct gc_arena *a)
Definition buffer.h:1067
BSTR
#define BSTR(buf)
Definition buffer.h:130
BPTR
#define BPTR(buf)
Definition buffer.h:124
ALLOC_ARRAY_GC
#define ALLOC_ARRAY_GC(dptr, type, n, gc)
Definition buffer.h:1131
buf_valid
static bool buf_valid(const struct buffer *buf)
Definition buffer.h:236
gc_init
static void gc_init(struct gc_arena *a)
Definition buffer.h:1060
ALLOC_OBJ_CLEAR_GC
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Definition buffer.h:1157
ALLOC_OBJ_GC
#define ALLOC_OBJ_GC(dptr, type, gc)
Definition buffer.h:1152
strncpynt
static void strncpynt(char *dest, const char *src, size_t maxlen)
Definition buffer.h:363
gc_free
static void gc_free(struct gc_arena *a)
Definition buffer.h:1081
strprefix
static bool strprefix(const char *str, const char *prefix)
Return true iff str starts with prefix.
Definition buffer.h:1002
gc_new
static struct gc_arena gc_new(void)
Definition buffer.h:1073
add_client_nat_to_option_list
void add_client_nat_to_option_list(struct client_nat_option_list *dest, const char *type, const char *network, const char *netmask, const char *foreign_network, msglvl_t msglevel)
Definition clinat.c:102
print_client_nat_list
void print_client_nat_list(const struct client_nat_option_list *list, msglvl_t msglevel)
Definition clinat.c:50
new_client_nat_list
struct client_nat_option_list * new_client_nat_list(struct gc_arena *gc)
Definition clinat.c:71
clone_client_nat_option_list
struct client_nat_option_list * clone_client_nat_option_list(const struct client_nat_option_list *src, struct gc_arena *gc)
Definition clinat.c:79
copy_client_nat_option_list
void copy_client_nat_option_list(struct client_nat_option_list *dest, const struct client_nat_option_list *src)
Definition clinat.c:88
TLS_CHANNEL_BUF_SIZE
#define TLS_CHANNEL_BUF_SIZE
Definition common.h:70
TLS_CHANNEL_MTU_MIN
#define TLS_CHANNEL_MTU_MIN
Definition common.h:83
check_compression_settings_valid
bool check_compression_settings_valid(struct compress_options *info, msglvl_t msglevel)
Checks if the compression settings are valid.
Definition comp.c:162
COMP_F_ALLOW_STUB_ONLY
#define COMP_F_ALLOW_STUB_ONLY
Only accept stub compression, even with COMP_F_ADVERTISE_STUBS_ONLY we still accept other compression...
Definition comp.h:45
COMP_F_SWAP
#define COMP_F_SWAP
initial command byte is swapped with last byte in buffer to preserve payload alignment
Definition comp.h:40
COMP_ALG_LZ4
#define COMP_ALG_LZ4
LZ4 algorithm.
Definition comp.h:59
COMP_ALGV2_LZ4
#define COMP_ALGV2_LZ4
Definition comp.h:64
COMP_F_ALLOW_NOCOMP_ONLY
#define COMP_F_ALLOW_NOCOMP_ONLY
Do not allow compression framing (breaks DCO)
Definition comp.h:51
COMP_F_ALLOW_ASYM
#define COMP_F_ALLOW_ASYM
Compression was explicitly set to allow asymetric compression.
Definition comp.h:49
COMP_ALGV2_UNCOMPRESSED
#define COMP_ALGV2_UNCOMPRESSED
Definition comp.h:63
COMP_ALG_STUB
#define COMP_ALG_STUB
support compression command byte and framing without actual compression
Definition comp.h:56
COMP_ALG_LZO
#define COMP_ALG_LZO
LZO algorithm.
Definition comp.h:57
COMP_F_ADVERTISE_STUBS_ONLY
#define COMP_F_ADVERTISE_STUBS_ONLY
tell server that we only support compression stubs
Definition comp.h:42
COMP_F_MIGRATE
#define COMP_F_MIGRATE
push stub-v2 or comp-lzo no when we see a client with comp-lzo in occ
Definition comp.h:47
comp_non_stub_enabled
static bool comp_non_stub_enabled(const struct compress_options *info)
Definition comp.h:81
COMP_ALG_UNDEF
#define COMP_ALG_UNDEF
Definition comp.h:54
daemon
int daemon(int nochdir, int noclose)
Definition compat-daemon.c:50
dirname
char * dirname(char *path)
Definition compat-dirname.c:61
strsep
char * strsep(char **stringp, const char *delim)
Definition compat-strsep.c:35
init_key_type
void init_key_type(struct key_type *kt, const char *ciphername, const char *authname, bool tls_mode, bool warn)
Initialize a key_type structure with.
Definition crypto.c:875
ascii2keydirection
int ascii2keydirection(msglvl_t msglevel, const char *str)
Definition crypto.c:1632
keydirection2ascii
const char * keydirection2ascii(int kd, bool remote, bool humanreadable)
Definition crypto.c:1655
check_tls_prf_working
bool check_tls_prf_working(void)
Checks if the current TLS library supports the TLS 1.0 PRF with MD5+SHA1 that OpenVPN uses when TLS K...
Definition crypto.c:1916
test_crypto
void test_crypto(struct crypto_options *co, struct frame *frame)
Definition crypto.c:1199
crypto.h
Data Channel Cryptography Module.
CO_USE_TLS_KEY_MATERIAL_EXPORT
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition crypto.h:359
CO_USE_DYNAMIC_TLS_CRYPT
#define CO_USE_DYNAMIC_TLS_CRYPT
Bit-flag indicating that renegotiations are using tls-crypt with a TLS-EKM derived key.
Definition crypto.h:375
CO_EPOCH_DATA_KEY_FORMAT
#define CO_EPOCH_DATA_KEY_FORMAT
Bit-flag indicating the epoch the data format.
Definition crypto.h:379
KEY_DIRECTION_BIDIRECTIONAL
#define KEY_DIRECTION_BIDIRECTIONAL
Definition crypto.h:231
CO_USE_CC_EXIT_NOTIFY
#define CO_USE_CC_EXIT_NOTIFY
Bit-flag indicating that explicit exit notifies should be sent via the control channel instead of usi...
Definition crypto.h:371
MD_SHA256
@ MD_SHA256
Definition crypto_backend.h:61
MD_SHA1
@ MD_SHA1
Definition crypto_backend.h:60
cipher_defined
static bool cipher_defined(const char *ciphername)
Checks if the cipher is defined and is not the null (none) cipher.
Definition crypto_backend.h:226
md_kt_name
const char * md_kt_name(const char *mdname)
Retrieve a string describing the digest digest (e.g.
Definition crypto_openssl.c:1067
cipher_kt_name
const char * cipher_kt_name(const char *ciphername)
Retrieve a normalised string describing the cipher (e.g.
Definition crypto_openssl.c:653
cipher_kt_key_size
unsigned int cipher_kt_key_size(const char *ciphername)
Returns the size of keys used by the cipher, in bytes.
Definition crypto_openssl.c:673
SHA_DIGEST_LENGTH
#define SHA_DIGEST_LENGTH
Definition crypto_mbedtls.h:63
SHA256_DIGEST_LENGTH
#define SHA256_DIGEST_LENGTH
Definition crypto_mbedtls.h:64
dco_check_startup_option
static bool dco_check_startup_option(msglvl_t msglevel, const struct options *o)
Definition dco.h:280
dco_check_option
static bool dco_check_option(msglvl_t msglevel, const struct options *o)
Definition dco.h:274
dco_version_string
static const char * dco_version_string(struct gc_arena *gc)
Definition dco.h:268
dns_options_verify
bool dns_options_verify(msglvl_t msglevel, const struct dns_options *o)
Checks validity of DNS options.
Definition dns.c:212
dns_options_postprocess_pull
void dns_options_postprocess_pull(struct dns_options *o)
Merges pulled DNS servers with static ones into an ordered list.
Definition dns.c:289
dns_server_addr_parse
bool dns_server_addr_parse(struct dns_server *server, const char *addr)
Parses a string IPv4 or IPv6 address and optional colon separated port, into a in_addr or in6_addr re...
Definition dns.c:62
dns_domain_list_append
bool dns_domain_list_append(struct dns_domain **entry, char **domains, struct gc_arena *gc)
Appends safe DNS domain parameters to a linked list.
Definition dns.c:148
dns_server_get
struct dns_server * dns_server_get(struct dns_server **entry, long priority, struct gc_arena *gc)
Find or create DNS server with priority in a linked list.
Definition dns.c:190
dns_server_priority_parse
bool dns_server_priority_parse(long *priority, const char *str, bool pulled)
Parses a string DNS server priority and validates it.
Definition dns.c:175
clone_dns_options
struct dns_options clone_dns_options(const struct dns_options *o, struct gc_arena *gc)
Makes a deep copy of the passed DNS options.
Definition dns.c:266
show_dns_options
void show_dns_options(const struct dns_options *o)
Prints configured DNS options.
Definition dns.c:779
dns_options_preprocess_pull
void dns_options_preprocess_pull(struct dns_options *o)
Saves and resets the server options, so that pulled ones don't mix in.
Definition dns.c:282
dns_updown_user_set
static bool dns_updown_user_set(const struct dns_options *o)
Returns whether dns-updown is user defined.
Definition dns.h:218
DNS_UPDOWN_FORCED
@ DNS_UPDOWN_FORCED
Definition dns.h:50
DNS_UPDOWN_NO_FLAGS
@ DNS_UPDOWN_NO_FLAGS
Definition dns.h:48
DNS_UPDOWN_USER_SET
@ DNS_UPDOWN_USER_SET
Definition dns.h:49
DNS_SECURITY_NO
@ DNS_SECURITY_NO
Definition dns.h:33
DNS_SECURITY_YES
@ DNS_SECURITY_YES
Definition dns.h:34
DNS_SECURITY_OPTIONAL
@ DNS_SECURITY_OPTIONAL
Definition dns.h:35
dns_updown_forced
static bool dns_updown_forced(const struct dns_options *o)
Returns whether dns-updown is forced to run.
Definition dns.h:229
DNS_TRANSPORT_PLAIN
@ DNS_TRANSPORT_PLAIN
Definition dns.h:41
DNS_TRANSPORT_TLS
@ DNS_TRANSPORT_TLS
Definition dns.h:43
DNS_TRANSPORT_HTTPS
@ DNS_TRANSPORT_HTTPS
Definition dns.h:42
domain_helper.h
validate_domain
static bool validate_domain(const char *domain)
Definition domain_helper.h:34
setenv_int
void setenv_int(struct env_set *es, const char *name, int value)
Definition env_set.c:291
setenv_str_i
void setenv_str_i(struct env_set *es, const char *name, const char *value, const int i)
Definition env_set.c:423
setenv_str
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition env_set.c:307
env_set_get
const char * env_set_get(const struct env_set *es, const char *name)
Definition env_set.c:201
setenv_str_safe
void setenv_str_safe(struct env_set *es, const char *name, const char *value)
Definition env_set.c:313
env_set_del
bool env_set_del(struct env_set *es, const char *str)
Definition env_set.c:183
setenv_long_long
void setenv_long_long(struct env_set *es, const char *name, long long value)
Definition env_set.c:299
D_SHOW_OCC
#define D_SHOW_OCC
Definition errlevel.h:150
D_PUSH
#define D_PUSH
Definition errlevel.h:82
D_TLS_DEBUG_MED
#define D_TLS_DEBUG_MED
Definition errlevel.h:156
D_DCO
#define D_DCO
Definition errlevel.h:93
D_SHOW_PARMS
#define D_SHOW_PARMS
Definition errlevel.h:95
D_PUSH_ERRORS
#define D_PUSH_ERRORS
Definition errlevel.h:66
D_TLS_ERRORS
#define D_TLS_ERRORS
Definition errlevel.h:58
M_INFO
#define M_INFO
Definition errlevel.h:54
forward.h
Interface functions to the internal and external multiplexers.
helper_setdefault_topology
void helper_setdefault_topology(struct options *o)
Set –topology default depending on –mode.
Definition helper.c:129
helper_tcp_nodelay
void helper_tcp_nodelay(struct options *o)
Definition helper.c:601
helper_client_server
void helper_client_server(struct options *o)
Definition helper.c:157
helper_keepalive
void helper_keepalive(struct options *o)
Definition helper.c:540
max_int
static int max_int(int x, int y)
Definition integer.h:92
constrain_int
static int constrain_int(int x, int min, int max)
Definition integer.h:118
tls_verify
static int tls_verify(struct openvpn_plugin_args_func_in const *args)
Definition keyingmaterialexporter.c:166
management_auth_token
void management_auth_token(struct management *man, const char *token)
Definition manage.c:3225
management_echo
void management_echo(struct management *man, const char *string, const bool pull)
Definition manage.c:3146
MF_FORGET_DISCONNECT
#define MF_FORGET_DISCONNECT
Definition manage.h:31
MF_EXTERNAL_KEY_PKCS1PAD
#define MF_EXTERNAL_KEY_PKCS1PAD
Definition manage.h:38
MF_CLIENT_AUTH
#define MF_CLIENT_AUTH
Definition manage.h:33
MF_EXTERNAL_KEY_PSSPAD
#define MF_EXTERNAL_KEY_PSSPAD
Definition manage.h:43
MF_EXTERNAL_KEY_NOPADDING
#define MF_EXTERNAL_KEY_NOPADDING
Definition manage.h:37
MF_QUERY_PROXY
#define MF_QUERY_PROXY
Definition manage.h:41
MF_EXTERNAL_KEY
#define MF_EXTERNAL_KEY
Definition manage.h:36
MF_QUERY_REMOTE
#define MF_QUERY_REMOTE
Definition manage.h:40
MF_QUERY_PASSWORDS
#define MF_QUERY_PASSWORDS
Definition manage.h:28
MF_EXTERNAL_CERT
#define MF_EXTERNAL_CERT
Definition manage.h:42
MF_EXTERNAL_KEY_DIGEST
#define MF_EXTERNAL_KEY_DIGEST
Definition manage.h:44
MF_UP_DOWN
#define MF_UP_DOWN
Definition manage.h:39
MF_HOLD
#define MF_HOLD
Definition manage.h:29
MF_SIGNAL
#define MF_SIGNAL
Definition manage.h:30
MF_UNIX_SOCK
#define MF_UNIX_SOCK
Definition manage.h:35
MF_CONNECT_AS_CLIENT
#define MF_CONNECT_AS_CLIENT
Definition manage.h:32
MBUF_SIZE_MAX
#define MBUF_SIZE_MAX
Definition mbuf.h:40
prepend_dir
struct buffer prepend_dir(const char *dir, const char *path, struct gc_arena *gc)
Prepend a directory to a path.
Definition misc.c:781
safe_print
const char * safe_print(const char *str, struct gc_arena *gc)
Definition misc.c:547
USER_PASS_LEN
#define USER_PASS_LEN
Definition misc.h:67
SC_CONCAT
#define SC_CONCAT
Definition misc.h:95
SC_ECHO
#define SC_ECHO
Definition misc.h:94
translate_mtu_discover_type_name
int translate_mtu_discover_type_name(const char *name)
Definition mtu.c:261
calc_options_string_link_mtu
size_t calc_options_string_link_mtu(const struct options *o, const struct frame *frame)
Calculate the link-mtu to advertise to our peer.
Definition mtu.c:155
MSSFIX_DEFAULT
#define MSSFIX_DEFAULT
Definition mtu.h:89
TUN_MTU_MAX_MIN
#define TUN_MTU_MAX_MIN
Definition mtu.h:79
TAP_MTU_EXTRA_DEFAULT
#define TAP_MTU_EXTRA_DEFAULT
Definition mtu.h:84
LINK_MTU_DEFAULT
#define LINK_MTU_DEFAULT
Definition mtu.h:64
TUN_MTU_DEFAULT
#define TUN_MTU_DEFAULT
Definition mtu.h:69
TUN_MTU_MAX
#define TUN_MTU_MAX
Maximum MTU we accept for MTU related options.
Definition mtu.h:74
TUN_MTU_MIN
#define TUN_MTU_MIN
Definition mtu.h:59
TLS_MTU_DEFAULT
#define TLS_MTU_DEFAULT
Definition mtu.h:94
learn_address_script
static bool learn_address_script(const struct multi_context *m, const struct multi_instance *mi, const char *op, const struct mroute_addr *addr)
Definition multi.c:83
net_ctx_init
static int net_ctx_init(struct context *c, openvpn_net_ctx_t *ctx)
Definition networking.h:47
openvpn_net_ctx_t
void * openvpn_net_ctx_t
Definition networking.h:38
BOOL_CAST
#define BOOL_CAST(x)
Definition basic.h:26
CLEAR
#define CLEAR(x)
Definition basic.h:32
SIZE
#define SIZE(x)
Definition basic.h:29
errors_to_stderr
void errors_to_stderr(void)
Definition error.c:179
open_syslog
void open_syslog(const char *pgmname, bool stdio_to_null)
Definition error.c:442
redirect_stdout_stderr
void redirect_stdout_stderr(const char *file, bool append)
Definition error.c:491
openvpn_exit
void openvpn_exit(const int status)
Definition error.c:707
machine_readable_output
static bool machine_readable_output
Definition error.c:74
set_suppress_timestamps
void set_suppress_timestamps(bool suppressed)
Definition error.c:143
set_machine_readable_output
void set_machine_readable_output(bool parsable)
Definition error.c:149
msg_fp
FILE * msg_fp(const msglvl_t flags)
Definition error.c:188
set_debug_level
bool set_debug_level(const int level, const unsigned int flags)
Definition error.c:101
suppress_timestamps
static bool suppress_timestamps
Definition error.c:77
M_OPTERR
#define M_OPTERR
Definition error.h:101
SDL_CONSTRAIN
#define SDL_CONSTRAIN
Definition error.h:201
M_NOPREFIX
#define M_NOPREFIX
Definition error.h:98
M_DEBUG_LEVEL
#define M_DEBUG_LEVEL
Definition error.h:88
M_USAGE
#define M_USAGE
Definition error.h:107
OPENVPN_EXIT_STATUS_USAGE
#define OPENVPN_EXIT_STATUS_USAGE
Definition error.h:54
OPENVPN_EXIT_STATUS_GOOD
#define OPENVPN_EXIT_STATUS_GOOD
Definition error.h:52
M_FATAL
#define M_FATAL
Definition error.h:90
M_ERR
#define M_ERR
Definition error.h:106
msg
#define msg(flags,...)
Definition error.h:152
msglvl_t
unsigned int msglvl_t
Definition error.h:77
ASSERT
#define ASSERT(x)
Definition error.h:219
M_WARN
#define M_WARN
Definition error.h:92
M_ERRNO
#define M_ERRNO
Definition error.h:95
MAX_PEER_ID
#define MAX_PEER_ID
Definition openvpn.h:550
options_cmp_equal
bool options_cmp_equal(char *actual, const char *expected)
Definition options.c:4570
RESET_OPTION_ROUTES
#define RESET_OPTION_ROUTES(option_ptr, field)
Definition options.c:5091
rol6_check_alloc
static void rol6_check_alloc(struct options *options)
Definition options.c:1566
CHKACC_PRIVATE
#define CHKACC_PRIVATE
Warn if this (private) file is group/others accessible.
Definition options.c:3976
check_file_access_chroot_inline
static bool check_file_access_chroot_inline(bool is_inline, const char *chroot, const int type, const char *file, const int mode, const char *opt)
A wrapper for check_file_access_chroot() that returns false immediately if the file is inline (and th...
Definition options.c:4110
check_file_access_chroot
static bool check_file_access_chroot(const char *chroot, const int type, const char *file, const int mode, const char *opt)
Definition options.c:4076
options_postprocess_verify_ce
static void options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
Definition options.c:2261
NM_QUOTE_HINT
#define NM_QUOTE_HINT
Definition options.c:5058
options_postprocess_mutate_ce
static void options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
Definition options.c:2922
usage_version
static void usage_version(void)
Definition options.c:4937
get_ip_addr
static in_addr_t get_ip_addr(const char *ip_string, msglvl_t msglevel, bool *error)
Definition options.c:1093
alloc_pull_filter
static struct pull_filter * alloc_pull_filter(struct options *o)
Definition options.c:2165
USAGE_VALID_SERVER_PROTOS
#define USAGE_VALID_SERVER_PROTOS
SHOW_BOOL
#define SHOW_BOOL(var)
Definition options.c:965
CHKACC_DIRPATH
#define CHKACC_DIRPATH
Check for directory presence where a file should reside.
Definition options.c:3973
pre_connect_save
static void pre_connect_save(struct options *o)
Definition options.c:3113
CHKACC_ACPTSTDIN
#define CHKACC_ACPTSTDIN
If filename is stdin, it's allowed and "exists".
Definition options.c:3975
TLS_CLIENT
#define TLS_CLIENT
setenv_connection_entry
static void setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
Definition options.c:970
global_auth_retry
static int global_auth_retry
Definition options.c:4816
options_postprocess_pull
bool options_postprocess_pull(struct options *o, struct env_set *es)
Definition options.c:4319
remove_option
void remove_option(struct context *c, struct options *options, char *p[], bool is_inline, const char *file, int line, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Resets options found in the PUSH_UPDATE message that are preceded by the - flag.
Definition options.c:5099
uninit_options
void uninit_options(struct options *o)
Definition options.c:919
connection_entry_load_re
static void connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
Definition options.c:2186
SHOW_STR
#define SHOW_STR(var)
Definition options.c:958
parse_topology
int parse_topology(const char *str, const msglvl_t msglevel)
Definition options.c:4769
show_windows_version
void show_windows_version(const unsigned int flags)
Definition options.c:4904
VERIFY_PERMISSION
#define VERIFY_PERMISSION(mask)
Definition options.c:4998
options_warning_extract_parm1
static const char * options_warning_extract_parm1(const char *option_string, struct gc_arena *gc_ret)
Definition options.c:4582
key_is_external
bool key_is_external(const struct options *options)
Definition options.c:5589
string_substitute
static char * string_substitute(const char *src, char from, char to, struct gc_arena *gc)
Definition options.c:1142
show_dhcp_option_list
static void show_dhcp_option_list(const char *name, const char *const *array, unsigned int len)
Definition options.c:1265
check_ca_required
static void check_ca_required(const struct options *options)
Definition options.c:2223
parse_http_proxy_override
static struct http_proxy_options * parse_http_proxy_override(const char *server, const char *port, const char *flags, struct gc_arena *gc)
Definition options.c:1979
init_options
void init_options(struct options *o)
Definition options.c:800
CHKACC_FILEXSTWR
#define CHKACC_FILEXSTWR
If file exists, is it writable?
Definition options.c:3974
tuntap_options_postprocess_dns
static void tuntap_options_postprocess_dns(struct options *o)
Postprocess DNS related settings.
Definition options.c:3497
dhcp_option_dns6_parse
static void dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, unsigned int *len, msglvl_t msglevel)
Definition options.c:1311
get_ipv6_addr_no_netbits
static char * get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
Returns newly allocated string containing address part without "/nn".
Definition options.c:1118
option_iroute_ipv6
static void option_iroute_ipv6(struct options *o, const char *prefix_str, msglvl_t msglevel)
Definition options.c:1489
check_route_option
static bool check_route_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:5261
show_dco_version
void show_dco_version(const unsigned int flags)
Definition options.c:4913
rol_check_alloc
void rol_check_alloc(struct options *options)
Definition options.c:1557
alloc_local_list_if_undef
static struct local_list * alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
Definition options.c:2042
dhcp_option_address_parse
static void dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, unsigned int *len, msglvl_t msglevel)
Definition options.c:1325
helper_hashmap_sizes
static void helper_hashmap_sizes(struct options *o)
Sets the internal hash maps sizes according to the max_clients.
Definition options.c:3757
SHOW_UNSIGNED
#define SHOW_UNSIGNED(var)
Definition options.c:964
show_settings
void show_settings(const struct options *o)
Definition options.c:1681
set_user_script
static void set_user_script(struct options *options, const char **script, const char *new_script, const char *type, bool in_chroot)
Definition options.c:5550
update_option
void update_option(struct context *c, struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Processes an option to update.
Definition options.c:5419
verify_permission
static bool verify_permission(const char *name, const char *file, int line, const uint64_t type, const uint64_t allowed, uint64_t *found, const msglvl_t msglevel, struct options *options, bool is_inline)
Definition options.c:5008
parse_hash_fingerprint_multiline
static struct verify_hash_list * parse_hash_fingerprint_multiline(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
Parses a string consisting of multiple lines of hexstrings and checks if each string has the correct ...
Definition options.c:1223
LZO_LIB_VER_STR
#define LZO_LIB_VER_STR
no_more_than_n_args
static bool no_more_than_n_args(const msglvl_t msglevel, char *p[], const int max, const unsigned int flags)
Definition options.c:5061
show_connection_entries
static void show_connection_entries(const struct options *o)
Definition options.c:1642
options_postprocess_mutate_le
static void options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
Definition options.c:3079
show_dhcp_option_addrs
static void show_dhcp_option_addrs(const char *name, const in_addr_t *array, unsigned int len)
Definition options.c:1274
options_cmp_equal_safe
bool options_cmp_equal_safe(char *actual, const char *expected, size_t actual_n)
Definition options.c:4690
string_defined_equal
bool string_defined_equal(const char *s1, const char *s2)
Definition options.c:4968
check_file_access_inline
static bool check_file_access_inline(bool is_inline, const int type, const char *file, const int mode, const char *opt)
A wrapper for check_file_access() that returns false immediately if the file is inline (and therefore...
Definition options.c:4126
options_postprocess
void options_postprocess(struct options *options, struct env_set *es)
Definition options.c:4305
SHOW_UINT
#define SHOW_UINT(var)
Definition options.c:962
usage_small
void usage_small(void)
Definition options.c:4896
auth_retry_print
const char * auth_retry_print(void)
Definition options.c:4848
show_http_proxy_options
static void show_http_proxy_options(const struct http_proxy_options *o)
Definition options.c:1507
options_postprocess_filechecks
static void options_postprocess_filechecks(struct options *options)
Definition options.c:4194
alloc_remote_entry
static struct remote_entry * alloc_remote_entry(struct options *options, const msglvl_t msglevel)
Definition options.c:2129
show_connection_entry
static void show_connection_entry(const struct connection_entry *o)
Definition options.c:1585
options_warning_safe
void options_warning_safe(char *actual, const char *expected, size_t actual_n)
Definition options.c:4713
show_library_versions
void show_library_versions(const unsigned int flags)
Definition options.c:4923
setenv_settings
void setenv_settings(struct env_set *es, const struct options *o)
Definition options.c:996
CHKACC_ACCEPT_URI
#define CHKACC_ACCEPT_URI
Do not check URIs, unless they start with file:
Definition options.c:3977
usage_message
static const char usage_message[]
Definition options.c:122
options_warning_safe_scan1
static void options_warning_safe_scan1(const msglvl_t msglevel, const int delim, const bool report_inconsistent, const struct buffer *b1_src, const struct buffer *b2_src, const char *b1_name, const char *b2_name)
Definition options.c:4650
alloc_connection_list_if_undef
static struct connection_list * alloc_connection_list_if_undef(struct options *options)
Definition options.c:2083
check_cmd_access
static bool check_cmd_access(const char *command, const char *opt, const char *chroot)
Definition options.c:4154
SHOW_INT64
#define SHOW_INT64(var)
Definition options.c:963
check_file_access
static bool check_file_access(const int type, const char *file, const int mode, const char *opt)
Definition options.c:3980
show_p2mp_parms
static void show_p2mp_parms(const struct options *o)
Definition options.c:1370
pull_filter_type_name
static const char * pull_filter_type_name(int type)
Definition options.c:937
cnol_check_alloc
static void cnol_check_alloc(struct options *options)
Definition options.c:1575
options_postprocess_mutate
static void options_postprocess_mutate(struct options *o, struct env_set *es)
Definition options.c:3770
options_detach
void options_detach(struct options *o)
Definition options.c:1537
options_warning_safe_ml
static void options_warning_safe_ml(const msglvl_t msglevel, char *actual, const char *expected, size_t actual_n)
Definition options.c:4668
atou
static unsigned int atou(const char *str)
Definition options.c:4990
pre_connect_restore
void pre_connect_restore(struct options *o, struct gc_arena *gc)
Definition options.c:3158
alloc_pull_filter_list
static struct pull_filter_list * alloc_pull_filter_list(struct options *o)
Definition options.c:2155
print_topology
const char * print_topology(const int topology)
Definition options.c:4791
options_string_extract_option
char * options_string_extract_option(const char *options_string, const char *opt_name, struct gc_arena *gc)
Given an OpenVPN options string, extract the value of an option.
Definition options.c:4732
parse_hash_fingerprint
static struct verify_hash_list * parse_hash_fingerprint(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
Parses a hexstring and checks if the string has the correct length.
Definition options.c:1170
check_dns_option
static bool check_dns_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:5310
SHOW_STR_INLINE
#define SHOW_STR_INLINE(var)
Definition options.c:959
options_warning_safe_scan2
static void options_warning_safe_scan2(const msglvl_t msglevel, const int delim, const bool report_inconsistent, const char *p1, const struct buffer *b2_src, const char *b1_name, const char *b2_name)
Definition options.c:4596
options_postprocess_cipher
static void options_postprocess_cipher(struct options *o)
Definition options.c:3331
options_set_backwards_compatible_options
static void options_set_backwards_compatible_options(struct options *o)
Changes default values so that OpenVPN can be compatible with the user specified version.
Definition options.c:3401
show_tuntap_options
static void show_tuntap_options(const struct tuntap_options *o)
Definition options.c:1285
MUST_BE_FALSE
#define MUST_BE_FALSE(condition, parm_name)
Definition options.c:2254
MUST_BE_UNDEF
#define MUST_BE_UNDEF(parm, parm_name)
Definition options.c:2249
print_vlan_accept
static const char * print_vlan_accept(enum vlan_acceptable_frames mode)
Definition options.c:1353
SHOW_PARM
#define SHOW_PARM(name, value, format)
Definition options.c:957
options_postprocess_http_proxy_override
static void options_postprocess_http_proxy_override(struct options *o)
Definition options.c:2007
options_warning
void options_warning(char *actual, const char *expected)
Definition options.c:4576
show_pull_filter_list
static void show_pull_filter_list(const struct pull_filter_list *l)
Definition options.c:1663
CHKACC_FILE
#define CHKACC_FILE
Check for a file/directory presence.
Definition options.c:3972
options_string_version
const char * options_string_version(const char *s, struct gc_arena *gc)
Definition options.c:4719
options_postprocess_mutate_invariant
static void options_postprocess_mutate_invariant(struct options *options)
Definition options.c:3231
ipv6_addr_safe_hexplusbits
static bool ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
Definition options.c:1136
title_string
const char title_string[]
Definition options.c:72
setenv_local_entry
static void setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
Definition options.c:988
remap_redirect_gateway_flags
static void remap_redirect_gateway_flags(struct options *opt)
Definition options.c:3097
TLS_SERVER
#define TLS_SERVER
msglevel_forward_compatible
static msglvl_t msglevel_forward_compatible(struct options *options, const msglvl_t msglevel)
Definition options.c:5086
auth_retry_set
bool auth_retry_set(const msglvl_t msglevel, const char *option)
Definition options.c:4825
auth_retry_get
int auth_retry_get(void)
Definition options.c:4819
alloc_remote_list_if_undef
static struct remote_list * alloc_remote_list_if_undef(struct options *options)
Definition options.c:2119
check_route6_option
static bool check_route6_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:5289
notnull
void notnull(const char *arg, const char *description)
Definition options.c:4959
usage
void usage(void)
Definition options.c:4870
alloc_local_entry
static struct local_entry * alloc_local_entry(struct connection_entry *ce, const msglvl_t msglevel, struct gc_arena *gc)
Definition options.c:2052
show_compression_warning
static void show_compression_warning(struct compress_options *info)
Definition options.c:5577
options_process_mutate_prf
static void options_process_mutate_prf(struct options *o)
Definition options.c:3469
add_option
void add_option(struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options.c:5609
has_udp_in_local_list
bool has_udp_in_local_list(const struct options *options)
Definition options.c:9341
options_string
char * options_string(const struct options *o, const struct frame *frame, struct tuntap *tt, openvpn_net_ctx_t *ctx, bool remote, struct gc_arena *gc)
Definition options.c:4376
option_iroute
static void option_iroute(struct options *o, const char *network_str, const char *netmask_str, msglvl_t msglevel)
Definition options.c:1462
options_postprocess_verify
static void options_postprocess_verify(const struct options *o)
Definition options.c:3294
connection_entry_preload_key
static void connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
Definition options.c:2207
alloc_connection_entry
static struct connection_entry * alloc_connection_entry(struct options *options, const msglvl_t msglevel)
Definition options.c:2093
SHOW_INT
#define SHOW_INT(var)
Definition options.c:961
need_compatibility_before
static bool need_compatibility_before(const struct options *o, unsigned int version)
The option –compat-mode is used to set up default settings to values used on the specified openvpn ve...
Definition options.c:3391
MODE_POINT_TO_POINT
#define MODE_POINT_TO_POINT
Definition options.h:264
OPT_P_SCRIPT
#define OPT_P_SCRIPT
Definition options.h:732
PUF_TYPE_ACCEPT
#define PUF_TYPE_ACCEPT
filter type to accept a matching option
Definition options.h:797
OPT_P_PUSH
#define OPT_P_PUSH
Definition options.h:744
SF_TCP_NODELAY_HELPER
#define SF_TCP_NODELAY_HELPER
Definition options.h:475
OPT_P_UP
#define OPT_P_UP
Definition options.h:729
OPT_P_CONNECTION
#define OPT_P_CONNECTION
Definition options.h:755
OPT_P_INSTANCE
#define OPT_P_INSTANCE
allowed in ccd, client-connect etc
Definition options.h:745
OPT_P_NCP
#define OPT_P_NCP
Negotiable crypto parameters.
Definition options.h:740
OPT_P_ECHO
#define OPT_P_ECHO
Definition options.h:748
OPT_P_ROUTE_TABLE
#define OPT_P_ROUTE_TABLE
Definition options.h:759
OPT_P_CONFIG
#define OPT_P_CONFIG
Definition options.h:746
MODE_SERVER
#define MODE_SERVER
Definition options.h:265
CONNECTION_LIST_SIZE
#define CONNECTION_LIST_SIZE
Definition options.h:192
streq
#define streq(x, y)
Definition options.h:723
OPT_P_U_REDIR_GATEWAY
#define OPT_P_U_REDIR_GATEWAY
Definition options.h:792
OPT_P_EXPLICIT_NOTIFY
#define OPT_P_EXPLICIT_NOTIFY
Definition options.h:747
PUF_TYPE_IGNORE
#define PUF_TYPE_IGNORE
filter type to ignore a matching option
Definition options.h:798
AR_INTERACT
#define AR_INTERACT
Definition options.h:968
OPT_P_SHAPER
#define OPT_P_SHAPER
Definition options.h:734
OPT_P_U_ROUTE6
#define OPT_P_U_ROUTE6
Definition options.h:789
dco_enabled
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition options.h:989
OPT_P_SOCKFLAGS
#define OPT_P_SOCKFLAGS
Definition options.h:754
SF_NOPOOL
#define SF_NOPOOL
Definition options.h:474
PUF_TYPE_REJECT
#define PUF_TYPE_REJECT
filter type to reject and trigger SIGUSR1
Definition options.h:799
OPT_P_MESSAGES
#define OPT_P_MESSAGES
Definition options.h:739
OPT_P_SETENV
#define OPT_P_SETENV
Definition options.h:733
OPT_P_SOCKBUF
#define OPT_P_SOCKBUF
Definition options.h:753
OPT_P_PLUGIN
#define OPT_P_PLUGIN
Definition options.h:752
OPTION_PARM_SIZE
#define OPTION_PARM_SIZE
Definition options.h:56
OPT_P_TIMER
#define OPT_P_TIMER
Definition options.h:735
OPT_P_GENERAL
#define OPT_P_GENERAL
Definition options.h:728
read_config_file
void read_config_file(struct options *options, const char *file, int level, const char *top_file, const int top_line, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options_parse.c:347
PING_RESTART
#define PING_RESTART
Definition options.h:356
OPT_P_DHCPDNS
#define OPT_P_DHCPDNS
Definition options.h:731
OPT_P_PULL_MODE
#define OPT_P_PULL_MODE
Definition options.h:751
GENKEY_AUTH_TOKEN
@ GENKEY_AUTH_TOKEN
Definition options.h:244
GENKEY_SECRET
@ GENKEY_SECRET
Definition options.h:241
GENKEY_TLS_CRYPTV2_SERVER
@ GENKEY_TLS_CRYPTV2_SERVER
Definition options.h:243
GENKEY_TLS_CRYPTV2_CLIENT
@ GENKEY_TLS_CRYPTV2_CLIENT
Definition options.h:242
OPT_P_PUSH_MTU
#define OPT_P_PUSH_MTU
Definition options.h:758
AR_NONE
#define AR_NONE
Definition options.h:967
AR_NOINTERACT
#define AR_NOINTERACT
Definition options.h:969
SF_NO_PUSH_ROUTE_GATEWAY
#define SF_NO_PUSH_ROUTE_GATEWAY
Definition options.h:476
OPT_P_PERSIST
#define OPT_P_PERSIST
Definition options.h:736
MAX_PARMS
#define MAX_PARMS
Definition options.h:51
PULL_DEFINED
#define PULL_DEFINED(opt)
Definition options.h:763
OPT_P_U_DNS
#define OPT_P_U_DNS
Definition options.h:790
PLUGIN_OPTION_LIST
#define PLUGIN_OPTION_LIST(opt)
Definition options.h:774
ROUTE_OPTION_FLAGS
#define ROUTE_OPTION_FLAGS(o)
Definition options.h:766
OPTION_LINE_SIZE
#define OPTION_LINE_SIZE
Definition options.h:57
OPT_P_U_ROUTE
#define OPT_P_U_ROUTE
Definition options.h:788
PING_EXIT
#define PING_EXIT
Definition options.h:355
OPT_P_COMP
#define OPT_P_COMP
Definition options.h:738
OPT_P_PERSIST_IP
#define OPT_P_PERSIST_IP
Definition options.h:737
OPT_P_MTU
#define OPT_P_MTU
Definition options.h:742
OPT_P_ROUTE_EXTRAS
#define OPT_P_ROUTE_EXTRAS
Definition options.h:750
OPT_P_U_DHCP
#define OPT_P_U_DHCP
Definition options.h:791
OPT_P_NICE
#define OPT_P_NICE
Definition options.h:743
OPT_P_PEER_ID
#define OPT_P_PEER_ID
Definition options.h:756
OPT_P_INHERIT
#define OPT_P_INHERIT
Definition options.h:749
OPT_P_TLS_PARMS
#define OPT_P_TLS_PARMS
Definition options.h:741
OPT_P_ROUTE
#define OPT_P_ROUTE
Definition options.h:730
PING_TIMEOUT_MAX
#define PING_TIMEOUT_MAX
Definition options.h:59
read_config_string
void read_config_string(const char *prefix, struct options *options, const char *config, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options_parse.c:421
MAN_CLIENT_AUTH_ENABLED
#define MAN_CLIENT_AUTH_ENABLED(opt)
Definition options.h:780
CE_DISABLED
#define CE_DISABLED
Definition options.h:155
OPT_P_INLINE
#define OPT_P_INLINE
Definition options.h:757
vlan_acceptable_frames
vlan_acceptable_frames
Definition options.h:225
VLAN_ONLY_UNTAGGED_OR_PRIORITY
@ VLAN_ONLY_UNTAGGED_OR_PRIORITY
Definition options.h:227
VLAN_ALL
@ VLAN_ALL
Definition options.h:228
VLAN_ONLY_TAGGED
@ VLAN_ONLY_TAGGED
Definition options.h:226
atoi_warn
int atoi_warn(const char *str, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number.
Definition options_util.c:152
positive_atoi
int positive_atoi(const char *str, msglvl_t msglevel)
Converts a str to a positive number if the string represents a postive integer number.
Definition options_util.c:121
positive_atoll
bool positive_atoll(const char *str, int64_t *value, const char *name, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number and is >= 0.
Definition options_util.c:136
valid_integer
bool valid_integer(const char *str, bool positive)
Checks if the string is a valid integer by checking if it can be converted to an integer.
Definition options_util.c:105
atoi_constrained
bool atoi_constrained(const char *str, int *value, const char *name, int min, int max, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number and is between min...
Definition options_util.c:167
options_util.h
packet_id.h
MAX_SEQ_BACKTRACK
#define MAX_SEQ_BACKTRACK
Definition packet_id.h:85
MIN_SEQ_BACKTRACK
#define MIN_SEQ_BACKTRACK
Definition packet_id.h:84
DEFAULT_SEQ_BACKTRACK
#define DEFAULT_SEQ_BACKTRACK
Definition packet_id.h:86
MAX_TIME_BACKTRACK
#define MAX_TIME_BACKTRACK
Definition packet_id.h:94
DEFAULT_TIME_BACKTRACK
#define DEFAULT_TIME_BACKTRACK
Definition packet_id.h:95
MIN_TIME_BACKTRACK
#define MIN_TIME_BACKTRACK
Definition packet_id.h:93
platform_getpid
unsigned int platform_getpid(void)
Definition platform.c:333
platform_access
int platform_access(const char *path, int mode)
Definition platform.c:457
platform_chdir
int platform_chdir(const char *dir)
Definition platform.c:392
platform_stat
int platform_stat(const char *path, platform_stat_t *buf)
Definition platform.c:526
platform_stat_t
struct _stat platform_stat_t
Definition platform.h:118
plugin_option_list_new
struct plugin_option_list * plugin_option_list_new(struct gc_arena *gc)
Definition plugin.c:159
plugin_option_list_add
bool plugin_option_list_add(struct plugin_option_list *list, char **p, struct gc_arena *gc)
Definition plugin.c:167
plugin_option_list_print
void plugin_option_list_print(const struct plugin_option_list *list, msglvl_t msglevel)
Definition plugin.c:187
ifconfig_pool_verify_range
bool ifconfig_pool_verify_range(const msglvl_t msglevel, const in_addr_t start, const in_addr_t end)
Definition pool.c:117
OPENVPN_8021Q_MIN_VID
#define OPENVPN_8021Q_MIN_VID
Definition proto.h:316
OPENVPN_8021Q_MAX_VID
#define OPENVPN_8021Q_MAX_VID
Definition proto.h:317
DEV_TYPE_TAP
#define DEV_TYPE_TAP
Definition proto.h:36
TOP_UNDEF
#define TOP_UNDEF
Definition proto.h:40
DEV_TYPE_UNDEF
#define DEV_TYPE_UNDEF
Definition proto.h:34
TOP_NET30
#define TOP_NET30
Definition proto.h:41
DEV_TYPE_TUN
#define DEV_TYPE_TUN
Definition proto.h:35
TOP_P2P
#define TOP_P2P
Definition proto.h:42
TOP_SUBNET
#define TOP_SUBNET
Definition proto.h:43
init_http_proxy_options_once
struct http_proxy_options * init_http_proxy_options_once(struct http_proxy_options **hpo, struct gc_arena *gc)
Definition proxy.c:44
PAR_NCT
#define PAR_NCT
Definition proxy.h:51
MAX_CUSTOM_HTTP_HEADER
#define MAX_CUSTOM_HTTP_HEADER
Definition proxy.h:43
PAR_ALL
#define PAR_ALL
Definition proxy.h:50
push_reset
void push_reset(struct options *o)
Definition push.c:944
push_options
void push_options(struct options *o, char **p, msglvl_t msglevel, struct gc_arena *gc)
Definition push.c:918
clone_push_list
void clone_push_list(struct options *o)
Definition push.c:903
push_remove_option
void push_remove_option(struct options *o, const char *p)
Definition push.c:950
print_route_options
void print_route_options(const struct route_option_list *rol, msglvl_t msglevel)
Definition route.c:1240
is_special_addr
bool is_special_addr(const char *addr_str)
Definition route.c:301
clone_route_option_list
struct route_option_list * clone_route_option_list(const struct route_option_list *src, struct gc_arena *a)
Definition route.c:155
netmask_to_netbits2
int netmask_to_netbits2(in_addr_t netmask)
Definition route.c:3889
new_route_ipv6_option_list
struct route_ipv6_option_list * new_route_ipv6_option_list(struct gc_arena *a)
Definition route.c:139
delete_routes_v6
void delete_routes_v6(struct route_ipv6_list *rl6, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1198
get_default_gateway_ipv6
void get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest, openvpn_net_ctx_t *ctx)
Definition route.c:2662
add_route_ipv6_to_option_list
void add_route_ipv6_to_option_list(struct route_ipv6_option_list *l, const char *prefix, const char *gateway, const char *metric, int table_id)
Definition route.c:509
copy_route_option_list
void copy_route_option_list(struct route_option_list *dest, const struct route_option_list *src, struct gc_arena *a)
Definition route.c:173
copy_route_ipv6_option_list
void copy_route_ipv6_option_list(struct route_ipv6_option_list *dest, const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:181
print_default_gateway
void print_default_gateway(const msglvl_t msglevel, const struct route_gateway_info *rgi, const struct route_ipv6_gateway_info *rgi6)
Definition route.c:1254
get_default_gateway
void get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
Retrieves the best gateway for a given destination based on the routing table.
Definition route.c:2565
clone_route_ipv6_option_list
struct route_ipv6_option_list * clone_route_ipv6_option_list(const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:164
new_route_option_list
struct route_option_list * new_route_option_list(struct gc_arena *a)
Definition route.c:130
show_routes
void show_routes(msglvl_t msglevel)
Definition route.c:3065
delete_routes_v4
void delete_routes_v4(struct route_list *rl, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1176
add_route_to_option_list
void add_route_to_option_list(struct route_option_list *l, const char *network, const char *netmask, const char *gateway, const char *metric, int table_id)
Definition route.c:494
RG_LOCAL
#define RG_LOCAL
Definition route.h:87
RG_BYPASS_DHCP
#define RG_BYPASS_DHCP
Definition route.h:89
ROUTE_METHOD_SERVICE
#define ROUTE_METHOD_SERVICE
Definition route.h:42
ROUTE_METHOD_IPAPI
#define ROUTE_METHOD_IPAPI
Definition route.h:40
ROUTE_METHOD_EXE
#define ROUTE_METHOD_EXE
Definition route.h:41
RG_DEF1
#define RG_DEF1
Definition route.h:88
RG_BYPASS_DNS
#define RG_BYPASS_DNS
Definition route.h:90
RG_ENABLE
#define RG_ENABLE
Definition route.h:86
RG_REROUTE_GW
#define RG_REROUTE_GW
Definition route.h:91
ROUTE_METHOD_ADAPTIVE
#define ROUTE_METHOD_ADAPTIVE
Definition route.h:39
RG_AUTO_LOCAL
#define RG_AUTO_LOCAL
Definition route.h:92
RG_BLOCK_LOCAL
#define RG_BLOCK_LOCAL
Definition route.h:93
script_security_set
void script_security_set(int level)
Definition run_command.c:48
run_command.h
SSEC_PW_ENV
#define SSEC_PW_ENV
allow calling of built-in programs and user-defined scripts that may receive a password as an environ...
Definition run_command.h:38
SSEC_NONE
#define SSEC_NONE
strictly no calling of external programs
Definition run_command.h:31
SHAPER_MAX
#define SHAPER_MAX
Definition shaper.h:40
SHAPER_MIN
#define SHAPER_MIN
Definition shaper.h:39
bind_local
static void bind_local(struct link_socket *sock, const sa_family_t ai_family)
Definition socket.c:622
get_ipv6_addr
bool get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits, msglvl_t msglevel)
Translate an IPv6 addr or hostname from string form to in6_addr.
Definition socket.c:222
getaddr
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, struct signal_info *sig_info)
Translate an IPv4 addr or hostname from string form to in_addr_t.
Definition socket.c:195
RESOLV_RETRY_INFINITE
#define RESOLV_RETRY_INFINITE
Definition socket.h:48
OPENVPN_PORT
#define OPENVPN_PORT
Definition socket.h:42
SF_USE_IP_PKTINFO
#define SF_USE_IP_PKTINFO
Definition socket.h:210
SF_HOST_RANDOMIZE
#define SF_HOST_RANDOMIZE
Definition socket.h:213
SF_PKTINFO_COPY_IIF
#define SF_PKTINFO_COPY_IIF
Definition socket.h:217
proto2ascii
const char * proto2ascii(int proto, sa_family_t af, bool display_form)
Definition socket_util.c:409
mac_addr_safe
bool mac_addr_safe(const char *mac_addr)
Definition socket_util.c:890
proto2ascii_all
const char * proto2ascii_all(struct gc_arena *gc)
Definition socket_util.c:430
ascii2af
sa_family_t ascii2af(const char *proto_name)
Definition socket_util.c:396
proto_remote
const char * proto_remote(int proto, bool remote)
Definition socket_util.c:472
ipv6_addr_safe
bool ipv6_addr_safe(const char *ipv6_text_addr)
Definition socket_util.c:837
print_in6_addr
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition socket_util.c:216
ip_or_dns_addr_safe
bool ip_or_dns_addr_safe(const char *addr, const bool allow_fqdn)
Definition socket_util.c:873
ascii2proto
int ascii2proto(const char *proto_name)
Definition socket_util.c:383
print_in_addr_t
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition socket_util.c:196
ip_addr_dotted_quad_safe
bool ip_addr_dotted_quad_safe(const char *dotted_quad)
Definition socket_util.c:787
socket_util.h
proto_is_net
static bool proto_is_net(int proto)
Definition socket_util.h:185
proto_is_udp
static bool proto_is_udp(int proto)
Returns if the protocol being used is UDP.
Definition socket_util.h:195
GETADDR_FATAL
#define GETADDR_FATAL
Definition socket_util.h:118
PROTO_NONE
@ PROTO_NONE
Definition socket_util.h:176
PROTO_UDP
@ PROTO_UDP
Definition socket_util.h:177
PROTO_TCP
@ PROTO_TCP
Definition socket_util.h:178
PROTO_TCP_CLIENT
@ PROTO_TCP_CLIENT
Definition socket_util.h:180
PROTO_TCP_SERVER
@ PROTO_TCP_SERVER
Definition socket_util.h:179
GETADDR_HOST_ORDER
#define GETADDR_HOST_ORDER
Definition socket_util.h:119
proto_is_dgram
static bool proto_is_dgram(int proto)
Return if the protocol is datagram (UDP)
Definition socket_util.h:206
GETADDR_RESOLVE
#define GETADDR_RESOLVE
Definition socket_util.h:117
IA_NET_ORDER
#define IA_NET_ORDER
Definition socket_util.h:90
ssl_set_auth_token_user
void ssl_set_auth_token_user(const char *username)
Definition ssl.c:366
ssl_set_auth_nocache
void ssl_set_auth_nocache(void)
Definition ssl.c:341
tls_version_parse
int tls_version_parse(const char *vstr, const char *extra)
Definition ssl.c:425
ssl_set_auth_token
void ssl_set_auth_token(const char *token)
Definition ssl.c:360
ssl_get_auth_nocache
bool ssl_get_auth_nocache(void)
Definition ssl.c:351
push_peer_info
static bool push_peer_info(struct buffer *buf, struct tls_session *session)
Prepares the IV_ and UV_ variables that are part of the exchange to signal the peer's capabilities.
Definition ssl.c:1877
ssl.h
Control Channel SSL/Data channel negotiation module.
X509_USERNAME_FIELD_DEFAULT
#define X509_USERNAME_FIELD_DEFAULT
Definition ssl.h:120
KEY_METHOD_2
#define KEY_METHOD_2
Definition ssl.h:122
get_ssl_library_version
const char * get_ssl_library_version(void)
return a pointer to a static memory area containing the name and version number of the SSL library in...
Definition ssl_openssl.c:2644
TLS_VER_BAD
#define TLS_VER_BAD
Parse a TLS version specifier.
Definition ssl_backend.h:103
TLS_VER_1_0
#define TLS_VER_1_0
Definition ssl_backend.h:105
EXPORT_KEY_DATA_LABEL
#define EXPORT_KEY_DATA_LABEL
Definition ssl_backend.h:390
TLS_VER_1_2
#define TLS_VER_1_2
Definition ssl_backend.h:107
TLS_VER_1_3
#define TLS_VER_1_3
Definition ssl_backend.h:108
tls_version_max
int tls_version_max(void)
Return the maximum TLS version (as a TLS_VER_x constant) supported by current SSL implementation.
Definition ssl_openssl.c:206
SSLF_TLS_VERSION_MAX_SHIFT
#define SSLF_TLS_VERSION_MAX_SHIFT
Definition ssl_common.h:431
SSLF_CLIENT_CERT_OPTIONAL
#define SSLF_CLIENT_CERT_OPTIONAL
Definition ssl_common.h:424
SSLF_AUTH_USER_PASS_OPTIONAL
#define SSLF_AUTH_USER_PASS_OPTIONAL
Definition ssl_common.h:426
SSLF_CLIENT_CERT_NOT_REQUIRED
#define SSLF_CLIENT_CERT_NOT_REQUIRED
Definition ssl_common.h:423
SSLF_CRL_VERIFY_DIR
#define SSLF_CRL_VERIFY_DIR
Definition ssl_common.h:428
SSLF_TLS_DEBUG_ENABLED
#define SSLF_TLS_DEBUG_ENABLED
Definition ssl_common.h:433
SSLF_TLS_VERSION_MAX_MASK
#define SSLF_TLS_VERSION_MAX_MASK
Definition ssl_common.h:432
SSLF_TLS_VERSION_MIN_SHIFT
#define SSLF_TLS_VERSION_MIN_SHIFT
Definition ssl_common.h:429
SSLF_TLS_VERSION_MIN_MASK
#define SSLF_TLS_VERSION_MIN_MASK
Definition ssl_common.h:430
SSLF_USERNAME_AS_COMMON_NAME
#define SSLF_USERNAME_AS_COMMON_NAME
Definition ssl_common.h:425
options_postprocess_setdefault_ncpciphers
void options_postprocess_setdefault_ncpciphers(struct options *o)
Checks for availibility of Chacha20-Poly1305 and sets the ncp_cipher to either AES-256-GCM:AES-128-GC...
Definition ssl_ncp.c:578
tls_item_in_cipher_list
bool tls_item_in_cipher_list(const char *item, const char *list)
Return true iff item is present in the colon-separated zero-terminated cipher list.
Definition ssl_ncp.c:207
append_cipher_to_ncp_list
void append_cipher_to_ncp_list(struct options *o, const char *ciphername)
Appends the cipher specified by the ciphernamer parameter to to the o->ncp_ciphers list.
Definition ssl_ncp.c:196
mutate_ncp_cipher_list
char * mutate_ncp_cipher_list(const char *list, struct gc_arena *gc)
Check whether the ciphers in the supplied list are supported.
Definition ssl_ncp.c:96
ssl_ncp.h
Control Channel SSL/Data dynamic negotiation Module This file is split from ssl.h to be able to unit ...
ssl_verify.h
Control Channel Verification Module.
OPENVPN_KU_REQUIRED
#define OPENVPN_KU_REQUIRED
Require keyUsage to be present in cert (0xFFFF is an invalid KU value)
Definition ssl_verify.h:257
VERIFY_X509_SUBJECT_DN
#define VERIFY_X509_SUBJECT_DN
Definition ssl_verify.h:69
VERIFY_X509_SUBJECT_RDN
#define VERIFY_X509_SUBJECT_RDN
Definition ssl_verify.h:70
NS_CERT_CHECK_CLIENT
#define NS_CERT_CHECK_CLIENT
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:254
VERIFY_X509_SUBJECT_RDN_PREFIX
#define VERIFY_X509_SUBJECT_RDN_PREFIX
Definition ssl_verify.h:71
NS_CERT_CHECK_SERVER
#define NS_CERT_CHECK_SERVER
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:252
x509_username_field_ext_supported
bool x509_username_field_ext_supported(const char *extname)
Return true iff the supplied extension field is supported by the –x509-username-field option.
Definition ssl_verify_openssl.c:115
x509_track_add
void x509_track_add(const struct x509_track **ll_head, const char *name, msglvl_t msglevel, struct gc_arena *gc)
Definition ssl_verify_openssl.c:431
argv
Definition argv.h:35
argv::argv
char ** argv
Definition argv.h:39
buffer
Wrapper structure for dynamically allocated memory.
Definition buffer.h:61
buffer::data
uint8_t * data
Pointer to the allocated memory.
Definition buffer.h:68
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:66
compress_options
Definition comp.h:75
compress_options::flags
unsigned int flags
Definition comp.h:77
compress_options::alg
int alg
Definition comp.h:76
connection_entry
Definition options.h:109
connection_entry::local_list
struct local_list * local_list
Definition options.h:110
connection_entry::tun_mtu_max
int tun_mtu_max
Definition options.h:131
connection_entry::connect_retry_seconds
int connect_retry_seconds
Definition options.h:121
connection_entry::tls_crypt_v2_force_cookie
bool tls_crypt_v2_force_cookie
Definition options.h:181
connection_entry::link_mtu
int link_mtu
Definition options.h:136
connection_entry::link_mtu_defined
bool link_mtu_defined
Definition options.h:137
connection_entry::tun_mtu_extra
int tun_mtu_extra
Definition options.h:134
connection_entry::connect_retry_seconds_max
int connect_retry_seconds_max
Definition options.h:122
connection_entry::bind_local
bool bind_local
Definition options.h:120
connection_entry::mssfix
int mssfix
Definition options.h:146
connection_entry::tls_crypt_file
const char * tls_crypt_file
Definition options.h:172
connection_entry::tls_crypt_v2_file
const char * tls_crypt_v2_file
Definition options.h:177
connection_entry::tun_mtu_extra_defined
bool tun_mtu_extra_defined
Definition options.h:135
connection_entry::remote
const char * remote
Definition options.h:116
connection_entry::connect_timeout
int connect_timeout
Definition options.h:123
connection_entry::socks_proxy_port
const char * socks_proxy_port
Definition options.h:126
connection_entry::mssfix_default
bool mssfix_default
Definition options.h:147
connection_entry::mssfix_encap
bool mssfix_encap
Definition options.h:148
connection_entry::occ_mtu
int occ_mtu
Definition options.h:130
connection_entry::http_proxy_options
struct http_proxy_options * http_proxy_options
Definition options.h:124
connection_entry::tls_crypt_file_inline
bool tls_crypt_file_inline
Definition options.h:173
connection_entry::tls_auth_file_inline
bool tls_auth_file_inline
Definition options.h:168
connection_entry::bind_ipv6_only
bool bind_ipv6_only
Definition options.h:119
connection_entry::tun_mtu_defined
bool tun_mtu_defined
Definition options.h:133
connection_entry::remote_float
bool remote_float
Definition options.h:117
connection_entry::tls_mtu
int tls_mtu
Definition options.h:138
connection_entry::explicit_exit_notification
int explicit_exit_notification
Definition options.h:152
connection_entry::socks_proxy_authfile
const char * socks_proxy_authfile
Definition options.h:127
connection_entry::remote_port
const char * remote_port
Definition options.h:115
connection_entry::fragment_encap
bool fragment_encap
Definition options.h:144
connection_entry::socks_proxy_server
const char * socks_proxy_server
Definition options.h:125
connection_entry::fragment
int fragment
Definition options.h:143
connection_entry::mtu_discover_type
int mtu_discover_type
Definition options.h:141
connection_entry::proto
int proto
Definition options.h:111
connection_entry::af
sa_family_t af
Definition options.h:112
connection_entry::tls_auth_file
const char * tls_auth_file
Definition options.h:167
connection_entry::local_port_defined
bool local_port_defined
Definition options.h:114
connection_entry::tun_mtu
int tun_mtu
Definition options.h:129
connection_entry::bind_defined
bool bind_defined
Definition options.h:118
connection_entry::local_port
const char * local_port
Definition options.h:113
connection_entry::key_direction
int key_direction
Definition options.h:169
connection_entry::tls_crypt_v2_file_inline
bool tls_crypt_v2_file_inline
Definition options.h:178
connection_entry::flags
unsigned int flags
Definition options.h:164
connection_entry::mssfix_fixed
bool mssfix_fixed
Definition options.h:150
connection_list
Definition options.h:202
connection_list::array
struct connection_entry ** array
Definition options.h:206
connection_list::capacity
int capacity
Definition options.h:203
connection_list::len
int len
Definition options.h:204
context_1::route_list
struct route_list * route_list
List of routing information.
Definition openvpn.h:177
context_1::route_ipv6_list
struct route_ipv6_list * route_ipv6_list
Definition openvpn.h:182
context_1::tuntap
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition openvpn.h:172
context
Contains all state information for one tunnel.
Definition openvpn.h:471
context::net_ctx
openvpn_net_ctx_t net_ctx
Networking API opaque context.
Definition openvpn.h:498
context::options
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:472
context::c1
struct context_1 c1
Level 1 context.
Definition openvpn.h:513
dhcp_options
Definition dns.h:100
dhcp_options::dns
in_addr_t dns[N_DHCP_ADDR]
Definition dns.h:101
dhcp
Definition dhcp.h:62
dns_domain
Definition dns.h:54
dns_domain::next
struct dns_domain * next
Definition dns.h:55
dns_domain::name
const char * name
Definition dns.h:56
dns_options
Definition dns.h:113
dns_options::servers
struct dns_server * servers
Definition dns.h:117
dns_options::updown
const char * updown
Definition dns.h:119
dns_options::from_dhcp
struct dhcp_options from_dhcp
Definition dns.h:114
dns_options::gc
struct gc_arena gc
Definition dns.h:118
dns_options::updown_flags
enum dns_updown_flags updown_flags
Definition dns.h:120
dns_options::search_domains
struct dns_domain * search_domains
Definition dns.h:115
dns_server_addr::a4
struct in_addr a4
Definition dns.h:63
dns_server_addr::in
union dns_server_addr::@0 in
dns_server_addr::family
sa_family_t family
Definition dns.h:66
dns_server_addr::a6
struct in6_addr a6
Definition dns.h:64
dns_server_addr::port
in_port_t port
Definition dns.h:67
dns_server
Definition dns.h:71
dns_server::addr
struct dns_server_addr addr[8]
Definition dns.h:75
dns_server::dnssec
enum dns_security dnssec
Definition dns.h:77
dns_server::next
struct dns_server * next
Definition dns.h:72
dns_server::priority
long priority
Definition dns.h:73
dns_server::addr_count
size_t addr_count
Definition dns.h:74
dns_server::domains
struct dns_domain * domains
Definition dns.h:76
dns_server::transport
enum dns_server_transport transport
Definition dns.h:78
dns_server::sni
const char * sni
Definition dns.h:79
env_item
Definition env_set.h:37
env_item::string
char * string
Definition env_set.h:38
env_item::next
struct env_item * next
Definition env_set.h:39
env_set
Definition env_set.h:43
env_set::list
struct env_item * list
Definition env_set.h:45
fragment
Structure for reassembling one incoming fragmented packet.
Definition fragment.h:65
frame
Packet geometry parameters.
Definition mtu.h:113
frame::tun_mtu
int tun_mtu
the (user) configured tun-mtu.
Definition mtu.h:147
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:117
hash
Definition list.h:53
http_custom_header
Definition proxy.h:38
http_custom_header::name
const char * name
Definition proxy.h:39
http_custom_header::content
const char * content
Definition proxy.h:40
http_proxy_options
Definition proxy.h:45
http_proxy_options::auth_file
const char * auth_file
Definition proxy.h:55
http_proxy_options::http_version
const char * http_version
Definition proxy.h:57
http_proxy_options::port
const char * port
Definition proxy.h:47
http_proxy_options::inline_creds
bool inline_creds
Definition proxy.h:60
http_proxy_options::user_agent
const char * user_agent
Definition proxy.h:58
http_proxy_options::auth_retry
int auth_retry
Definition proxy.h:52
http_proxy_options::auth_method_string
const char * auth_method_string
Definition proxy.h:54
http_proxy_options::nocache
bool nocache
Definition proxy.h:63
http_proxy_options::custom_headers
struct http_custom_header custom_headers[MAX_CUSTOM_HTTP_HEADER]
Definition proxy.h:59
http_proxy_options::auth_file_up
const char * auth_file_up
Definition proxy.h:56
http_proxy_options::server
const char * server
Definition proxy.h:46
iroute_ipv6
Definition route.h:268
iroute_ipv6::next
struct iroute_ipv6 * next
Definition route.h:271
iroute_ipv6::netbits
unsigned int netbits
Definition route.h:270
iroute_ipv6::network
struct in6_addr network
Definition route.h:269
iroute::network
in_addr_t network
Definition route.h:262
iroute::netbits
int netbits
Definition route.h:263
iroute::next
struct iroute * next
Definition route.h:264
key_type
Definition crypto.h:141
key_type::cipher
const char * cipher
const name of the cipher
Definition crypto.h:142
key_type::digest
const char * digest
Message digest static parameters.
Definition crypto.h:143
local_entry
Definition options.h:102
local_entry::port
const char * port
Definition options.h:104
local_entry::proto
int proto
Definition options.h:105
local_entry::local
const char * local
Definition options.h:103
local_list
Definition options.h:195
local_list::array
struct local_entry ** array
Definition options.h:198
local_list::len
int len
Definition options.h:197
local_list::capacity
int capacity
Definition options.h:196
options_pre_connect
Definition options.h:65
options_pre_connect::tuntap_options
struct tuntap_options tuntap_options
Definition options.h:67
options_pre_connect::routes_defined
bool routes_defined
Definition options.h:72
options_pre_connect::ping_rec_timeout_action
int ping_rec_timeout_action
Definition options.h:91
options_pre_connect::foreign_option_index
int foreign_option_index
Definition options.h:93
options_pre_connect::tuntap_options_defined
bool tuntap_options_defined
Definition options.h:66
options_pre_connect::routes_ipv6_defined
bool routes_ipv6_defined
Definition options.h:75
options_pre_connect::ping_rec_timeout
int ping_rec_timeout
Definition options.h:90
options_pre_connect::routes
struct route_option_list * routes
Definition options.h:73
options_pre_connect::comp
struct compress_options comp
Definition options.h:94
options_pre_connect::ciphername
const char * ciphername
Definition options.h:86
options_pre_connect::ifconfig_local
const char * ifconfig_local
Definition options.h:69
options_pre_connect::dns_options
struct dns_options dns_options
Definition options.h:84
options_pre_connect::route_default_gateway
const char * route_default_gateway
Definition options.h:78
options_pre_connect::ping_send_timeout
int ping_send_timeout
Definition options.h:89
options_pre_connect::ifconfig_ipv6_local
const char * ifconfig_ipv6_local
Definition options.h:70
options_pre_connect::authname
const char * authname
Definition options.h:87
options_pre_connect::routes_ipv6
struct route_ipv6_option_list * routes_ipv6
Definition options.h:76
options_pre_connect::client_nat_defined
bool client_nat_defined
Definition options.h:81
options_pre_connect::client_nat
struct client_nat_option_list * client_nat
Definition options.h:82
options_pre_connect::route_ipv6_default_gateway
const char * route_ipv6_default_gateway
Definition options.h:79
options::resolve_retry_seconds
int resolve_retry_seconds
Definition options.h:367
options::rcvbuf
int rcvbuf
Definition options.h:413
options::resolve_in_advance
bool resolve_in_advance
Definition options.h:368
options::route_nopull
bool route_nopull
Definition options.h:437
options::genkey_extra_data
const char * genkey_extra_data
Definition options.h:290
options::comp
struct compress_options comp
Definition options.h:410
options::http_proxy_override
struct http_proxy_options * http_proxy_override
Definition options.h:313
options::push_ifconfig_ipv6_netbits
int push_ifconfig_ipv6_netbits
Definition options.h:523
options::proto_force
int proto_force
Definition options.h:336
options::persist_config
bool persist_config
Definition options.h:278
options::connection_list
struct connection_list * connection_list
Definition options.h:295
options::management_port
const char * management_port
Definition options.h:447
options::tls_crypt_file_inline
bool tls_crypt_file_inline
Definition options.h:665
options::ifconfig_ipv6_remote
const char * ifconfig_ipv6_remote
Definition options.h:331
options::max_routes_per_client
int max_routes_per_client
Definition options.h:536
options::ncp_ciphers_conf
const char * ncp_ciphers_conf
The original ncp_ciphers specified by the user in the configuration.
Definition options.h:579
options::status_file_version
int status_file_version
Definition options.h:407
options::vlan_accept
enum vlan_acceptable_frames vlan_accept
Definition options.h:710
options::auth_token_renewal
int auth_token_renewal
Definition options.h:545
options::push_ifconfig_constraint_network
in_addr_t push_ifconfig_constraint_network
Definition options.h:518
options::tmp_dir
const char * tmp_dir
Definition options.h:466
options::push_peer_info
bool push_peer_info
Definition options.h:681
options::daemon
bool daemon
Definition options.h:391
options::pre_connect
struct options_pre_connect * pre_connect
Definition options.h:563
options::route_default_metric
int route_default_metric
Definition options.h:429
options::renegotiate_seconds_min
int renegotiate_seconds_min
Definition options.h:647
options::auth_token_secret_file
const char * auth_token_secret_file
Definition options.h:546
options::imported_protocol_flags
unsigned int imported_protocol_flags
Definition options.h:720
options::tls_export_peer_cert_dir
const char * tls_export_peer_cert_dir
Definition options.h:612
options::crl_file_inline
bool crl_file_inline
Definition options.h:616
options::cryptoapi_cert
const char * cryptoapi_cert
Definition options.h:638
options::down_script
const char * down_script
Definition options.h:386
options::backwards_compatible
unsigned int backwards_compatible
What version we should try to be compatible with as major * 10000 + minor * 100 + patch,...
Definition options.h:272
options::verify_hash_algo
hash_algo_type verify_hash_algo
Definition options.h:622
options::scheduled_exit_interval
int scheduled_exit_interval
Definition options.h:565
options::stale_routes_ageing_time
int stale_routes_ageing_time
Definition options.h:538
options::pkcs12_file_inline
bool pkcs12_file_inline
Definition options.h:605
options::replay_time
int replay_time
Definition options.h:586
options::management_state_buffer_size
int management_state_buffer_size
Definition options.h:451
options::ca_file
const char * ca_file
Definition options.h:593
options::tls_auth_file
const char * tls_auth_file
Definition options.h:660
options::providers
struct provider_list providers
Definition options.h:583
options::duplicate_cn
bool duplicate_cn
Definition options.h:527
options::server_network_ipv6
struct in6_addr server_network_ipv6
Definition options.h:471
options::shaper
int shaper
Definition options.h:334
options::management_echo_buffer_size
int management_echo_buffer_size
Definition options.h:450
options::server_network
in_addr_t server_network
Definition options.h:468
options::real_hash_size
uint32_t real_hash_size
Definition options.h:499
options::show_net_up
bool show_net_up
Definition options.h:694
options::verify_hash_no_ca
bool verify_hash_no_ca
Definition options.h:624
options::allow_pull_fqdn
bool allow_pull_fqdn
Definition options.h:439
options::use_peer_id
bool use_peer_id
Definition options.h:700
options::remote_cert_ku
unsigned remote_cert_ku[MAX_PARMS]
Definition options.h:619
options::server_bridge_defined
bool server_bridge_defined
Definition options.h:481
options::keying_material_exporter_label
const char * keying_material_exporter_label
Definition options.h:704
options::status_file
const char * status_file
Definition options.h:406
options::ssl_flags
unsigned int ssl_flags
Definition options.h:625
options::route_noexec
bool route_noexec
Definition options.h:430
options::ifconfig_nowarn
bool ifconfig_nowarn
Definition options.h:333
options::remote_cert_eku
const char * remote_cert_eku
Definition options.h:620
options::ifconfig_pool_netmask
in_addr_t ifconfig_pool_netmask
Definition options.h:491
options::server_netmask
in_addr_t server_netmask
Definition options.h:469
options::tls_timeout
int tls_timeout
Definition options.h:641
options::test_crypto
bool test_crypto
Definition options.h:588
options::up_delay
bool up_delay
Definition options.h:389
options::server_bridge_proxy_dhcp
bool server_bridge_proxy_dhcp
Definition options.h:479
options::allow_recursive_routing
bool allow_recursive_routing
Definition options.h:717
options::authname
const char * authname
Definition options.h:581
options::exit_event_name
const char * exit_event_name
Definition options.h:692
options::ifconfig_ipv6_local
const char * ifconfig_ipv6_local
Definition options.h:329
options::cf_max
int cf_max
Definition options.h:529
options::dh_file_inline
bool dh_file_inline
Definition options.h:597
options::replay_window
int replay_window
Definition options.h:585
options::disable
bool disable
Definition options.h:507
options::mute
int mute
Definition options.h:400
options::auth_user_pass_verify_script_via_file
bool auth_user_pass_verify_script_via_file
Definition options.h:541
options::dev_type
const char * dev_type
Definition options.h:323
options::persist_mode
int persist_mode
Definition options.h:279
options::ifconfig_pool_persist_refresh_freq
int ifconfig_pool_persist_refresh_freq
Definition options.h:493
options::show_digests
bool show_digests
Definition options.h:283
options::up_script
const char * up_script
Definition options.h:385
options::push_option_types_found
uint64_t push_option_types_found
Definition options.h:558
options::single_session
bool single_session
Definition options.h:679
options::push_ifconfig_defined
bool push_ifconfig_defined
Definition options.h:513
options::ifconfig_pool_defined
bool ifconfig_pool_defined
Definition options.h:488
options::verify_hash_depth
int verify_hash_depth
Definition options.h:623
options::route_delay_defined
bool route_delay_defined
Definition options.h:433
options::packet_id_file
const char * packet_id_file
Definition options.h:587
options::tls_crypt_v2_file
const char * tls_crypt_v2_file
Definition options.h:669
options::management_log_history_cache
int management_log_history_cache
Definition options.h:449
options::server_bridge_netmask
in_addr_t server_bridge_netmask
Definition options.h:483
options::ip_remote_hint
const char * ip_remote_hint
Definition options.h:369
options::vlan_tagging
bool vlan_tagging
Definition options.h:709
options::peer_id
uint32_t peer_id
Definition options.h:701
options::routes
struct route_option_list * routes
Definition options.h:434
options::ifconfig_pool_end
in_addr_t ifconfig_pool_end
Definition options.h:490
options::keepalive_timeout
int keepalive_timeout
Definition options.h:343
options::writepid
const char * writepid
Definition options.h:384
options::inactivity_minimum_bytes
int64_t inactivity_minimum_bytes
Definition options.h:346
options::ifconfig_ipv6_pool_defined
bool ifconfig_ipv6_pool_defined
Definition options.h:495
options::server_flags
unsigned int server_flags
Definition options.h:477
options::max_clients
uint32_t max_clients
Definition options.h:535
options::block_outside_dns
bool block_outside_dns
Definition options.h:696
options::push_ifconfig_ipv6_blocked
bool push_ifconfig_ipv6_blocked
Definition options.h:525
options::tls_exit
bool tls_exit
Definition options.h:683
options::pkcs12_file
const char * pkcs12_file
Definition options.h:604
options::client_disconnect_script
const char * client_disconnect_script
Definition options.h:502
options::show_engines
bool show_engines
Definition options.h:284
options::remote_list
struct remote_list * remote_list
Definition options.h:297
options::msg_channel
HANDLE msg_channel
Definition options.h:691
options::key_pass_file
const char * key_pass_file
Definition options.h:281
options::mute_replay_warnings
bool mute_replay_warnings
Definition options.h:584
options::tls_crypt_file
const char * tls_crypt_file
Definition options.h:664
options::inactivity_timeout
int inactivity_timeout
Definition options.h:345
options::n_bcast_buf
int n_bcast_buf
Definition options.h:509
options::handshake_window
int handshake_window
Definition options.h:651
options::server_defined
bool server_defined
Definition options.h:467
options::ifconfig_local
const char * ifconfig_local
Definition options.h:327
options::x509_username_field
char * x509_username_field[MAX_PARMS]
Definition options.h:654
options::ce
struct connection_entry ce
Definition options.h:294
options::iroutes_ipv6
struct iroute_ipv6 * iroutes_ipv6
Definition options.h:512
options::push_list
struct push_list push_list
Definition options.h:487
options::user_script_used
bool user_script_used
Definition options.h:387
options::tls_groups
const char * tls_groups
Definition options.h:608
options::show_tls_ciphers
bool show_tls_ciphers
Definition options.h:285
options::tuntap_options
struct tuntap_options tuntap_options
Definition options.h:371
options::route_method
int route_method
Definition options.h:695
options::verify_hash
struct verify_hash_list * verify_hash
Definition options.h:621
options::tls_cert_profile
const char * tls_cert_profile
Definition options.h:609
options::renegotiate_packets
int64_t renegotiate_packets
Definition options.h:645
options::management_flags
unsigned int management_flags
Definition options.h:459
options::push_continuation
int push_continuation
Definition options.h:557
options::route_default_gateway
const char * route_default_gateway
Definition options.h:426
options::push_ifconfig_local_alias
in_addr_t push_ifconfig_local_alias
Definition options.h:516
options::dns_options
struct dns_options dns_options
Definition options.h:318
options::exit_event_initial_state
bool exit_event_initial_state
Definition options.h:693
options::sc_info
struct static_challenge_info sc_info
Definition options.h:568
options::auth_token_call_auth
bool auth_token_call_auth
Definition options.h:543
options::ipchange
const char * ipchange
Definition options.h:321
options::topology
int topology
Definition options.h:326
options::disable_dco
bool disable_dco
Definition options.h:374
options::ncp_ciphers
const char * ncp_ciphers
Definition options.h:580
options::genkey
bool genkey
Definition options.h:287
options::virtual_hash_size
uint32_t virtual_hash_size
Definition options.h:500
options::learn_address_script
const char * learn_address_script
Definition options.h:503
options::ciphername
const char * ciphername
Definition options.h:575
options::auth_user_pass_file
const char * auth_user_pass_file
Definition options.h:560
options::tls_crypt_v2_max_age
int tls_crypt_v2_max_age
Definition options.h:676
options::forward_compatible
bool forward_compatible
Definition options.h:269
options::username
const char * username
Definition options.h:377
options::cf_initial_max
int cf_initial_max
Definition options.h:532
options::stale_routes_check_interval
int stale_routes_check_interval
Definition options.h:537
options::plugin_list
struct plugin_option_list * plugin_list
Definition options.h:462
options::auth_token_lifetime
int auth_token_lifetime
Definition options.h:544
options::vlan_pvid
uint16_t vlan_pvid
Definition options.h:711
options::ns_cert_type
int ns_cert_type
Definition options.h:618
options::tls_crypt_v2_verify_script
const char * tls_crypt_v2_verify_script
Definition options.h:674
options::mode
int mode
Definition options.h:266
options::tls_server
bool tls_server
Definition options.h:591
options::auth_user_pass_verify_script
const char * auth_user_pass_verify_script
Definition options.h:540
options::connect_retry_max
int connect_retry_max
Definition options.h:293
options::bind_dev
char * bind_dev
Definition options.h:418
options::extra_certs_file
const char * extra_certs_file
Definition options.h:600
options::client
bool client
Definition options.h:555
options::pull
bool pull
Definition options.h:556
options::ifconfig_ipv6_pool_netbits
int ifconfig_ipv6_pool_netbits
Definition options.h:497
options::push_ifconfig_constraint_netmask
in_addr_t push_ifconfig_constraint_netmask
Definition options.h:519
options::show_curves
bool show_curves
Definition options.h:286
options::route_ipv6_default_gateway
const char * route_ipv6_default_gateway
Definition options.h:427
options::tls_client
bool tls_client
Definition options.h:592
options::ping_timer_remote
bool ping_timer_remote
Definition options.h:352
options::auth_token_generate
bool auth_token_generate
Definition options.h:542
options::priv_key_file_inline
bool priv_key_file_inline
Definition options.h:603
options::tls_verify
const char * tls_verify
Definition options.h:611
options::crl_file
const char * crl_file
Definition options.h:615
options::ping_rec_timeout_action
int ping_rec_timeout_action
Definition options.h:357
options::auth_user_pass_file_inline
bool auth_user_pass_file_inline
Definition options.h:561
options::show_ciphers
bool show_ciphers
Definition options.h:282
options::enable_ncp_fallback
bool enable_ncp_fallback
If defined fall back to ciphername if NCP fails.
Definition options.h:576
options::route_predown_script
const char * route_predown_script
Definition options.h:425
options::dh_file
const char * dh_file
Definition options.h:596
options::route_delay_window
int route_delay_window
Definition options.h:432
options::push_ifconfig_local
in_addr_t push_ifconfig_local
Definition options.h:514
options::mlock
bool mlock
Definition options.h:340
options::ignore_unknown_option
const char ** ignore_unknown_option
Definition options.h:275
options::sndbuf
int sndbuf
Definition options.h:414
options::foreign_option_index
int foreign_option_index
Definition options.h:688
options::gc
struct gc_arena gc
Definition options.h:258
options::down_pre
bool down_pre
Definition options.h:388
options::persist_tun
bool persist_tun
Definition options.h:359
options::route_default_table_id
int route_default_table_id
Definition options.h:428
options::ca_file_inline
bool ca_file_inline
Definition options.h:594
options::auth_token_secret_file_inline
bool auth_token_secret_file_inline
Definition options.h:547
options::block_ipv6
bool block_ipv6
Definition options.h:436
options::config
const char * config
Definition options.h:261
options::extra_certs_file_inline
bool extra_certs_file_inline
Definition options.h:601
options::push_ifconfig_constraint_defined
bool push_ifconfig_constraint_defined
Definition options.h:517
options::mark
int mark
Definition options.h:417
options::cf_initial_per
int cf_initial_per
Definition options.h:533
options::keying_material_exporter_length
int keying_material_exporter_length
Definition options.h:705
options::suppress_timestamps
bool suppress_timestamps
Definition options.h:396
options::force_key_material_export
bool force_key_material_export
Definition options.h:707
options::mtu_test
bool mtu_test
Definition options.h:338
options::iroutes
struct iroute * iroutes
Definition options.h:511
options::verify_x509_type
int verify_x509_type
Definition options.h:613
options::cipher_list_tls13
const char * cipher_list_tls13
Definition options.h:607
options::ecdh_curve
const char * ecdh_curve
Definition options.h:610
options::status_file_update_freq
int status_file_update_freq
Definition options.h:408
options::management_client_user
const char * management_client_user
Definition options.h:453
options::cipher_list
const char * cipher_list
Definition options.h:606
options::ccd_exclusive
bool ccd_exclusive
Definition options.h:506
options::allow_deprecated_insecure_static_crypto
bool allow_deprecated_insecure_static_crypto
Definition options.h:573
options::pull_filter_list
struct pull_filter_list * pull_filter_list
Definition options.h:713
options::management_certificate
const char * management_certificate
Definition options.h:456
options::genkey_filename
const char * genkey_filename
Definition options.h:289
options::x509_track
const struct x509_track * x509_track
Definition options.h:685
options::chroot_dir
const char * chroot_dir
Definition options.h:379
options::auth_user_pass_username_only
bool auth_user_pass_username_only
Definition options.h:562
options::log
bool log
Definition options.h:395
options::shared_secret_file_inline
bool shared_secret_file_inline
Definition options.h:572
options::push_ifconfig_ipv6_remote
struct in6_addr push_ifconfig_ipv6_remote
Definition options.h:524
options::ca_path
const char * ca_path
Definition options.h:595
options::renegotiate_seconds
int renegotiate_seconds
Definition options.h:646
options::ping_rec_timeout
int ping_rec_timeout
Definition options.h:351
options::sockflags
unsigned int sockflags
Definition options.h:421
options::engine
const char * engine
Definition options.h:582
options::management_addr
const char * management_addr
Definition options.h:446
options::client_connect_script
const char * client_connect_script
Definition options.h:501
options::verify_x509_name
const char * verify_x509_name
Definition options.h:614
options::ping_send_timeout
int ping_send_timeout
Definition options.h:350
options::route_gateway_via_dhcp
bool route_gateway_via_dhcp
Definition options.h:438
options::remote_random
bool remote_random
Definition options.h:320
options::push_ifconfig_ipv6_defined
bool push_ifconfig_ipv6_defined
Definition options.h:521
options::tcp_queue_limit
int tcp_queue_limit
Definition options.h:510
options::route_delay
int route_delay
Definition options.h:431
options::dev_node
const char * dev_node
Definition options.h:324
options::override_username
const char * override_username
Definition options.h:508
options::client_crresponse_script
const char * client_crresponse_script
Definition options.h:504
options::routes_ipv6
struct route_ipv6_option_list * routes_ipv6
Definition options.h:435
options::machine_readable_output
bool machine_readable_output
Definition options.h:397
options::key_direction
int key_direction
Definition options.h:574
options::server_ipv6_defined
bool server_ipv6_defined
Definition options.h:470
options::priv_key_file
const char * priv_key_file
Definition options.h:602
options::persist_remote_ip
bool persist_remote_ip
Definition options.h:361
options::up_restart
bool up_restart
Definition options.h:390
options::keepalive_ping
int keepalive_ping
Definition options.h:342
options::tls_auth_file_inline
bool tls_auth_file_inline
Definition options.h:661
options::tls_crypt_v2_file_inline
bool tls_crypt_v2_file_inline
Definition options.h:670
options::groupname
const char * groupname
Definition options.h:378
options::server_bridge_pool_start
in_addr_t server_bridge_pool_start
Definition options.h:484
options::cd_dir
const char * cd_dir
Definition options.h:380
options::client_nat
struct client_nat_option_list * client_nat
Definition options.h:440
options::push_ifconfig_ipv6_local
struct in6_addr push_ifconfig_ipv6_local
Definition options.h:522
options::nice
int nice
Definition options.h:398
options::push_update_options_found
uint64_t push_update_options_found
Definition options.h:559
options::transition_window
int transition_window
Definition options.h:657
options::ifconfig_remote_netmask
const char * ifconfig_remote_netmask
Definition options.h:328
options::lladdr
const char * lladdr
Definition options.h:325
options::verbosity
int verbosity
Definition options.h:399
options::session_timeout
int session_timeout
Definition options.h:348
options::cert_file
const char * cert_file
Definition options.h:598
options::enable_c2c
bool enable_c2c
Definition options.h:526
options::server_bridge_pool_end
in_addr_t server_bridge_pool_end
Definition options.h:485
options::cf_per
int cf_per
Definition options.h:530
options::windows_driver
enum tun_driver_type windows_driver
Definition options.h:697
options::cert_file_inline
bool cert_file_inline
Definition options.h:599
options::remap_sigusr1
int remap_sigusr1
Definition options.h:393
options::renegotiate_bytes
int64_t renegotiate_bytes
Definition options.h:644
options::route_script
const char * route_script
Definition options.h:424
options::ifconfig_pool_start
in_addr_t ifconfig_pool_start
Definition options.h:489
options::management_user_pass
const char * management_user_pass
Definition options.h:448
options::server_netbits_ipv6
unsigned int server_netbits_ipv6
Definition options.h:472
options::push_ifconfig_remote_netmask
in_addr_t push_ifconfig_remote_netmask
Definition options.h:515
options::occ
bool occ
Definition options.h:443
options::server_bridge_ip
in_addr_t server_bridge_ip
Definition options.h:482
options::shared_secret_file
const char * shared_secret_file
Definition options.h:571
options::ifconfig_noexec
bool ifconfig_noexec
Definition options.h:332
options::dev
const char * dev
Definition options.h:322
options::management_client_group
const char * management_client_group
Definition options.h:454
options::ifconfig_ipv6_pool_base
struct in6_addr ifconfig_ipv6_pool_base
Definition options.h:496
options::client_config_dir
const char * client_config_dir
Definition options.h:505
options::genkey_type
enum genkey_type genkey_type
Definition options.h:288
options::ifconfig_pool_persist_filename
const char * ifconfig_pool_persist_filename
Definition options.h:492
options::ifconfig_ipv6_netbits
int ifconfig_ipv6_netbits
Definition options.h:330
options::persist_local_ip
bool persist_local_ip
Definition options.h:360
provider_list::names
const char * names[MAX_PARMS]
Definition options.h:219
pull_filter_list
Definition options.h:807
pull_filter_list::tail
struct pull_filter * tail
Definition options.h:809
pull_filter_list::head
struct pull_filter * head
Definition options.h:808
pull_filter
Definition options.h:795
pull_filter::type
int type
Definition options.h:800
pull_filter::next
struct pull_filter * next
Definition options.h:803
pull_filter::pattern
char * pattern
Definition options.h:802
pull_filter::size
size_t size
Definition options.h:801
push_entry
Definition pushlist.h:29
push_entry::next
struct push_entry * next
Definition pushlist.h:30
push_entry::enable
bool enable
Definition pushlist.h:31
push_entry::option
const char * option
Definition pushlist.h:32
push_list::head
struct push_entry * head
Definition pushlist.h:37
remote_entry
Definition options.h:185
remote_entry::proto
int proto
Definition options.h:188
remote_entry::remote
const char * remote
Definition options.h:186
remote_entry::remote_port
const char * remote_port
Definition options.h:187
remote_entry::af
sa_family_t af
Definition options.h:189
remote_list
Definition options.h:210
remote_list::len
int len
Definition options.h:212
remote_list::array
struct remote_entry ** array
Definition options.h:213
remote_list::capacity
int capacity
Definition options.h:211
route_gateway_info
Definition route.h:158
route_ipv6_gateway_info
Definition route.h:195
route_ipv6_option_list::flags
unsigned int flags
Definition route.h:113
route_option_list::flags
unsigned int flags
Definition route.h:97
static_challenge_info::flags
unsigned int flags
Definition misc.h:96
static_challenge_info::challenge_text
const char * challenge_text
Definition misc.h:98
tuntap_options
Definition tun.h:73
tuntap_options::dns6
struct in6_addr dns6[N_DHCP_ADDR]
Definition tun.h:140
tuntap_options::nbdd
in_addr_t nbdd[N_DHCP_ADDR]
Definition tun.h:123
tuntap_options::dns6_len
unsigned int dns6_len
Definition tun.h:141
tuntap_options::ntp
in_addr_t ntp[N_DHCP_ADDR]
Definition tun.h:119
tuntap_options::ntp_len
unsigned int ntp_len
Definition tun.h:120
tuntap_options::wins
in_addr_t wins[N_DHCP_ADDR]
Definition tun.h:115
tuntap_options::tap_sleep
int tap_sleep
Definition tun.h:95
tuntap_options::netbios_node_type
uint8_t netbios_node_type
Definition tun.h:105
tuntap_options::dns_len
unsigned int dns_len
Definition tun.h:112
tuntap_options::dhcp_lease_time
int dhcp_lease_time
Definition tun.h:92
tuntap_options::dns
in_addr_t dns[N_DHCP_ADDR]
Definition tun.h:111
tuntap_options::netbios_scope
const char * netbios_scope
Definition tun.h:103
tuntap_options::ip_win32_defined
bool ip_win32_defined
Definition tun.h:75
tuntap_options::domain_search_list_len
unsigned int domain_search_list_len
Definition tun.h:130
tuntap_options::dhcp_masq_custom_offset
bool dhcp_masq_custom_offset
Definition tun.h:90
tuntap_options::domain
const char * domain
Definition tun.h:101
tuntap_options::dhcp_renew
bool dhcp_renew
Definition tun.h:135
tuntap_options::domain_search_list
const char * domain_search_list[N_SEARCH_LIST_LEN]
Definition tun.h:129
tuntap_options::dhcp_masq_offset
int dhcp_masq_offset
Definition tun.h:91
tuntap_options::ip_win32_type
int ip_win32_type
Definition tun.h:83
tuntap_options::nbdd_len
unsigned int nbdd_len
Definition tun.h:124
tuntap_options::dhcp_pre_release
bool dhcp_pre_release
Definition tun.h:136
tuntap_options::register_dns
bool register_dns
Definition tun.h:138
tuntap_options::disable_nbt
bool disable_nbt
Definition tun.h:133
tuntap_options::wins_len
unsigned int wins_len
Definition tun.h:116
tuntap_options::dhcp_options
int dhcp_options
Definition tun.h:99
tuntap
Definition tun.h:181
verify_hash_list
Definition options.h:248
verify_hash_list::next
struct verify_hash_list * next
Definition options.h:252
verify_hash_list::hash
uint8_t hash[SHA256_DIGEST_LENGTH]
Definition options.h:251
SIGHUP
#define SIGHUP
Definition syshead.h:55
sa_family_t
unsigned short sa_family_t
Definition syshead.h:409
SIGTERM
#define SIGTERM
Definition syshead.h:59
sleep
#define sleep(x)
Definition syshead.h:42
in_addr_t
uint32_t in_addr_t
Definition syshead.h:52
es
struct env_set * es
Definition test_pkcs11.c:138
pkcs11_id_management
static bool pkcs11_id_management
Definition test_pkcs11.c:133
gc
struct gc_arena gc
Definition test_ssl.c:133
ipconfig_register_dns
void ipconfig_register_dns(const struct env_set *es)
Definition tun.c:4889
dev_type_enum
int dev_type_enum(const char *dev, const char *dev_type)
Definition tun.c:521
show_tap_win_adapters
void show_tap_win_adapters(msglvl_t msglevel, msglvl_t warnlevel)
Definition tun.c:3815
dhcp_renew_by_adapter_index
bool dhcp_renew_by_adapter_index(const DWORD adapter_index)
Definition tun.c:4822
ascii2ipset
int ascii2ipset(const char *name)
Definition tun.c:6246
init_tun
struct tuntap * init_tun(const char *dev, const char *dev_type, int topology, const char *ifconfig_local_parm, const char *ifconfig_remote_netmask_parm, const char *ifconfig_ipv6_local_parm, int ifconfig_ipv6_netbits_parm, const char *ifconfig_ipv6_remote_parm, struct addrinfo *local_public, struct addrinfo *remote_public, const bool strict_warn, struct env_set *es, openvpn_net_ctx_t *ctx, struct tuntap *tt)
Definition tun.c:830
dhcp_release_by_adapter_index
bool dhcp_release_by_adapter_index(const DWORD adapter_index)
Definition tun.c:4781
dev_type_string
const char * dev_type_string(const char *dev, const char *dev_type)
Definition tun.c:540
tap_allow_nonadmin_access
void tap_allow_nonadmin_access(const char *dev_node)
Definition tun.c:4701
show_adapters
void show_adapters(msglvl_t msglevel)
Definition tun.c:4652
dhcp_renew
static bool dhcp_renew(const struct tuntap *tt)
Definition tun.c:4848
ifconfig_options_string
const char * ifconfig_options_string(const struct tuntap *tt, bool remote, bool disable, struct gc_arena *gc)
Definition tun.c:694
ipset2ascii_all
const char * ipset2ascii_all(struct gc_arena *gc)
Definition tun.c:6275
show_valid_win32_tun_subnets
void show_valid_win32_tun_subnets(void)
Definition tun.c:3782
print_tun_backend_driver
const char * print_tun_backend_driver(enum tun_driver_type driver)
Return a string representation of the tun backed driver type.
Definition tun.c:59
IPW32_SET_NETSH
#define IPW32_SET_NETSH
Definition tun.h:78
IPW32_SET_ADAPTIVE
#define IPW32_SET_ADAPTIVE
Definition tun.h:81
DHCP_OPTIONS_DHCP_REQUIRED
#define DHCP_OPTIONS_DHCP_REQUIRED
Definition tun.h:70
N_SEARCH_LIST_LEN
#define N_SEARCH_LIST_LEN
Definition tun.h:126
IPW32_SET_DHCP_MASQ
#define IPW32_SET_DHCP_MASQ
Definition tun.h:80
IPW32_SET_MANUAL
#define IPW32_SET_MANUAL
Definition tun.h:77
WINDOWS_DRIVER_UNSPECIFIED
@ WINDOWS_DRIVER_UNSPECIFIED
Definition tun.h:45
WINDOWS_DRIVER_TAP_WINDOWS6
@ WINDOWS_DRIVER_TAP_WINDOWS6
Definition tun.h:46
DRIVER_DCO
@ DRIVER_DCO
Definition tun.h:53
IPW32_SET_ADAPTIVE_DELAY_WINDOW
#define IPW32_SET_ADAPTIVE_DELAY_WINDOW
Definition tun.h:65
N_DHCP_ADDR
#define N_DHCP_ADDR
Definition tun.h:108
DHCP_OPTIONS_DHCP_OPTIONAL
#define DHCP_OPTIONS_DHCP_OPTIONAL
Definition tun.h:69
tun_afunix.h
is_tun_afunix
static bool is_tun_afunix(const char *devnode)
Checks whether a –dev-node parameter specifies a AF_UNIX device.
Definition tun_afunix.h:61
win_get_tempdir
const char * win_get_tempdir(void)
Definition win32-util.c:150
set_win_sys_path
void set_win_sys_path(const char *newpath, struct env_set *es)
Definition win32.c:1115
win32_version_string
const char * win32_version_string(struct gc_arena *gc)
Get Windows version string with architecture info.
Definition win32.c:1380
set_pause_exit_win32
void set_pause_exit_win32(void)
Definition win32.c:144
xkey_common.h
Generated by doxygen 1.9.8