OpenVPN
options.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2026 OpenVPN Inc <sales@openvpn.net>
9 * Copyright (C) 2008-2026 David Sommerseth <dazo@eurephia.org>
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2
13 * as published by the Free Software Foundation.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <https://www.gnu.org/licenses/>.
22 */
23
24/*
25 * 2004-01-28: Added Socks5 proxy support
26 * (Christof Meerwald, https://cmeerw.org)
27 */
28
29#ifdef HAVE_CONFIG_H
30#include "config.h"
31#endif
32#ifdef HAVE_CONFIG_VERSION_H
33#include "config-version.h"
34#endif
35
36#include "syshead.h"
37
38#include "buffer.h"
39#include "error.h"
40#include "common.h"
41#include "run_command.h"
42#include "shaper.h"
43#include "crypto.h"
44#include "ssl.h"
45#include "ssl_ncp.h"
46#include "options.h"
47#include "misc.h"
48#include "socket_util.h"
49#include "packet_id.h"
50#include "pkcs11.h"
51#include "win32.h"
52#include "push.h"
53#include "pool.h"
54#include "proto.h"
55#include "helper.h"
56#include "manage.h"
57#include "forward.h"
58#include "ssl_verify.h"
59#include "platform.h"
60#include "xkey_common.h"
61#include "dco.h"
62#include "options_util.h"
63#include "tun_afunix.h"
64#include "domain_helper.h"
65#include "mbuf.h"
66#include "check_file_access.h"
67
68#include <ctype.h>
69
70#include "memdbg.h"
71#include "options_util.h"
72
73const char title_string[] = PACKAGE_STRING
74#ifdef CONFIGURE_GIT_REVISION
75 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS "]"
76#endif
77 " " TARGET_ALIAS
78#if defined(ENABLE_CRYPTO_MBEDTLS)
79 " [SSL (mbed TLS)]"
80#elif defined(ENABLE_CRYPTO_OPENSSL)
81 " [SSL (OpenSSL)]"
82#else
83 " [SSL]"
84#endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
85#ifdef USE_COMP
86#ifdef ENABLE_LZO
87 " [LZO]"
88#endif
89#ifdef ENABLE_LZ4
90 " [LZ4]"
91#endif
92#ifdef ENABLE_COMP_STUB
93 " [COMP_STUB]"
94#endif
95#endif /* USE_COMP */
96#if EPOLL
97 " [EPOLL]"
98#endif
99#ifdef PRODUCT_TAP_DEBUG
100 " [TAPDBG]"
101#endif
102#ifdef ENABLE_PKCS11
103 " [PKCS11]"
104#endif
105#if ENABLE_IP_PKTINFO
106#if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
107 " [MH/PKTINFO]"
108#elif defined(IP_RECVDSTADDR)
109 " [MH/RECVDA]"
110#endif
111#endif
112 " [AEAD]"
113#ifdef ENABLE_DCO
114 " [DCO]"
115#endif
116#ifdef CONFIGURE_GIT_REVISION
117 " built on " __DATE__
118#endif
119 ;
120
121#ifndef ENABLE_SMALL
122
123static const char usage_message[] =
124 "%s\n"
125 "\n"
126 "General Options:\n"
127 "--config file : Read configuration options from file.\n"
128 "--help : Show options.\n"
129 "--version : Show copyright and version information.\n"
130 "\n"
131 "Tunnel Options:\n"
132 "--local host|* [port]: Local host name or IP address and port for bind.\n"
133 " If specified, OpenVPN will bindto this address. If unspecified,\n"
134 " OpenVPN will bind to all interfaces. '*' can be used as hostname\n"
135 " and means 'any host' (OpenVPN will listen on what is returned by the OS).\n"
136 " On a client, or in point-to-point mode, this can only be specified once (1 socket).\n"
137 " On an OpenVPN setup running as ``--server``, this can be specified multiple times\n"
138 " to open multiple listening sockets on different addresses and/or different ports.\n"
139 " In order to specify multiple listen ports without specifying an address, use '*'\n"
140 " to signal 'use what the operating system gives you as default', for\n"
141 " 'all IPv4 addresses' use '0.0.0.0', for 'all IPv6 addresses' use '::'.\n"
142 " ``--local`` implies ``--bind``.\n"
143 "--remote host [port] : Remote host name or ip address.\n"
144 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
145 "--remote-random-hostname : Add a random string to remote DNS name.\n"
146 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
147 "--proto p : Use protocol p for communicating with peer.\n"
148 " p = udp (default), tcp-server, tcp-client\n"
149 " udp4, tcp4-server, tcp4-client\n"
150 " udp6, tcp6-server, tcp6-client\n"
151 "--proto-force p : only consider protocol p in list of connection profiles.\n"
152 " p = udp or tcp\n"
153 "--connect-retry n [m] : For client, number of seconds to wait between\n"
154 " connection retries (default=%d). On repeated retries\n"
155 " the wait time is exponentially increased to a maximum of m\n"
156 " (default=%d).\n"
157 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
158 "--http-proxy s p [up] [auth] : Connect to remote host\n"
159 " through an HTTP proxy at address s and port p.\n"
160 " If proxy authentication is required,\n"
161 " up is a file containing username/password on 2 lines, or\n"
162 " 'stdin' to prompt from console.\n"
163 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
164 " determine auth method and query for username/password\n"
165 " if needed. auto-nct disables weak proxy auth methods.\n"
166 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
167 " Repeat to set multiple options.\n"
168 " VERSION version (default=1.0)\n"
169 " AGENT user-agent\n"
170 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
171 " address s and port p (default port = 1080).\n"
172 " If proxy authentication is required,\n"
173 " up is a file containing username/password on 2 lines, or\n"
174 " 'stdin' to prompt for console.\n"
175 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
176 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
177 " resolve for n seconds before failing (disabled by default).\n"
178 " Set n=\"infinite\" to retry indefinitely.\n"
179 "--preresolve : Resolve configured --remote, --local, and proxy hostnames at startup.\n"
180 "--float : Allow remote to change its IP address/port, such as through\n"
181 " DHCP (this is the default if --remote is not used).\n"
182 "--ipchange cmd : Run command cmd on remote ip address initial\n"
183 " setting or change -- execute as: cmd ip-address port#\n"
184 "--port port : TCP/UDP port # for both local and remote.\n"
185 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
186 "--rport port : TCP/UDP port # for remote (default=%s).\n"
187 "--bind : Bind to local address and port. (This is the default unless\n"
188 " --proto tcp-client"
189 " or --http-proxy"
190 " or --socks-proxy"
191 " is used).\n"
192 "--nobind : Do not bind to local address and port.\n"
193 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device).\n"
194 " Defaults to \"tun\" if neither --dev nor --dev-type is given.\n"
195 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
196 " this option only if the tun/tap device used with --dev\n"
197 " does not begin with \"tun\" or \"tap\".\n"
198 "--dev-node node : Explicitly set the device node rather than using\n"
199 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
200#if defined(ENABLE_DCO)
201 "--disable-dco : Do not attempt using Data Channel Offload.\n"
202#endif
203 "--lladdr hw : Set the link layer address of the tap device.\n"
204 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
205#ifdef ENABLE_IPROUTE
206 "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
207#endif
208 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
209 " endpoint and rn as a remote endpoint. l & rn should be\n"
210 " swapped on the other peer. l & rn must be private\n"
211 " addresses outside of the subnets used by either peer.\n"
212 " TAP: configure device to use IP address l as a local\n"
213 " endpoint and rn as a subnet mask.\n"
214 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
215 " endpoint (as a /64) and r as remote endpoint\n"
216 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
217 " pass --ifconfig parms by environment to scripts.\n"
218 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
219 " connection doesn't match the remote side.\n"
220#ifdef TARGET_LINUX
221 "--route-table table_id : Specify a custom routing table for use with --route(-ipv6).\n"
222 " If not specified, the id of the default routing table will be used.\n"
223#endif
224 "--route network [netmask] [gateway] [metric] :\n"
225 " Add route to routing table after connection\n"
226 " is established. Multiple routes can be specified.\n"
227 " netmask default: 255.255.255.255\n"
228 " gateway default: taken from --route-gateway or --ifconfig\n"
229 " Specify default by leaving blank or setting to \"default\".\n"
230 "--route-ipv6 network/bits [gateway] [metric] :\n"
231 " Add IPv6 route to routing table after connection\n"
232 " is established. Multiple routes can be specified.\n"
233 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
234 " in --ifconfig-ipv6\n"
235 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
236 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
237 "--route-metric m : Specify a default metric for use with --route.\n"
238 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
239 " adding routes (may be 0). If not specified, routes will\n"
240 " be added immediately after tun/tap open. On Windows, wait\n"
241 " up to w seconds for TUN/TAP adapter to come up.\n"
242 "--route-up cmd : Run command cmd after routes are added.\n"
243 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
244 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
245 " --route-up script using environmental variables.\n"
246 "--route-nopull : When used with --client or --pull, accept options pushed\n"
247 " by server EXCEPT for routes, dns, and dhcp options.\n"
248 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
249 " --ifconfig, --route, and --route-gateway.\n"
250 "--redirect-gateway [flags]: Automatically execute routing\n"
251 " commands to redirect all outgoing IP traffic through the\n"
252 " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n"
253 " connected via a common subnet, such as with WiFi.\n"
254 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
255 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
256 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
257 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
258 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
259 " the default gateway. Useful when pushing private subnets.\n"
260 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
261 " ICMPv6 host unreachable messages on the client.\n"
262 " (Server) Instead of forwarding IPv6 packets send\n"
263 " ICMPv6 host unreachable packets to the client.\n"
264 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
265 "--push-peer-info : (client only) push client info to server.\n"
266 "--setenv name value : Set a custom environmental variable to pass to script.\n"
267 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
268 " directives for future OpenVPN versions to be ignored.\n"
269 "--ignore-unknown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
270 " these options to be ignored when unknown\n"
271 "--script-security level: Where level can be:\n"
272 " 0 -- strictly no calling of external programs\n"
273 " 1 -- (default) only call built-ins such as ifconfig\n"
274 " 2 -- allow calling of built-ins and scripts\n"
275 " 3 -- allow password to be passed to scripts via env\n"
276 "--shaper n : Restrict output to peer to n bytes per second.\n"
277 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
278 " ping once every n seconds, restart if ping not received\n"
279 " for m seconds.\n"
280 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
281 " produces a combined in/out byte count < bytes.\n"
282 "--session-timeout n: Limit connection time to n seconds.\n"
283 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
284 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
285 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
286 " remote address.\n"
287 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
288#if ENABLE_IP_PKTINFO
289 "--multihome : Configure a multi-homed UDP server.\n"
290#endif
291 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
292 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
293 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
294 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
295#if PASSTOS_CAPABILITY
296 "--passtos : TOS passthrough (applies to IPv4 only).\n"
297#endif
298 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
299 " TCP/UDP MTU from it (default=%d).\n"
300 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
301 " as n bytes more than the tun-mtu size on read\n"
302 " (default TUN=0 TAP=%d).\n"
303 "--tun-mtu-max n : Maximum pushable MTU (default and minimum=%d).\n"
304 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
305 " from it.\n"
306 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
307 " 'no' -- Never send DF (Don't Fragment) frames\n"
308 " 'maybe' -- Use per-route hints\n"
309 " 'yes' -- Always DF (Don't Fragment)\n"
310 "--mtu-test : Empirically measure and report MTU.\n"
311#ifdef ENABLE_FRAGMENT
312 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
313 " datagrams are sent which are larger than max bytes.\n"
314 " Adds 4 bytes of overhead per datagram.\n"
315#endif
316 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
317 " or --fragment max value, whichever is lower.\n"
318 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
319 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
320#if defined(TARGET_LINUX)
321 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
322 " can be matched in policy routing and packetfilter rules.\n"
323 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
324 " listening for connections. This allows sending encrypted packets\n"
325 " via a VRF present on the system.\n"
326#endif
327 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
328 "--mlock : Disable Paging -- ensures key material and tunnel\n"
329 " data will never be written to disk.\n"
330 "--up cmd : Run command cmd after successful tun device open.\n"
331 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
332 " ifconfig-local-ip ifconfig-remote-ip\n"
333 " (pre --user or --group UID/GID change)\n"
334 "--up-delay : Delay tun/tap open and possible --up script execution\n"
335 " until after TCP/UDP connection establishment with peer.\n"
336 "--down cmd : Run command cmd after tun device close.\n"
337 " (post --user/--group UID/GID change and/or --chroot)\n"
338 " (command parameters are same as --up option)\n"
339 "--down-pre : Run --down command before TUN/TAP close.\n"
340 "--up-restart : Run up/down commands for all restarts including those\n"
341 " caused by --ping-restart or SIGUSR1\n"
342 "--user user : Set UID to user after initialization.\n"
343 "--group group : Set GID to group after initialization.\n"
344 "--chroot dir : Chroot to this directory after initialization.\n"
345#ifdef ENABLE_SELINUX
346 "--setcon context: Apply this SELinux context after initialization.\n"
347#endif
348 "--cd dir : Change to this directory before initialization.\n"
349 "--daemon [name] : Become a daemon after initialization.\n"
350 " The optional 'name' parameter will be passed\n"
351 " as the program name to the system logger.\n"
352 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
353 " See --daemon above for a description of the 'name' parm.\n"
354 "--log file : Output log to file which is created/truncated on open.\n"
355 "--log-append file : Append log to file, or create file if nonexistent.\n"
356 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
357 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
358 "--writepid file : Write main process ID to file.\n"
359 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
360 "--echo [parms ...] : Echo parameters to log output.\n"
361 "--verb n : Set output verbosity to n (default=%d):\n"
362 " (Level 3 is recommended if you want a good summary\n"
363 " of what's happening without being swamped by output).\n"
364 " : 0 -- no output except fatal errors\n"
365 " : 1 -- startup info + connection initiated messages +\n"
366 " non-fatal encryption & net errors\n"
367 " : 2,3 -- show TLS negotiations & route info\n"
368 " : 4 -- show parameters\n"
369 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
370 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
371 " : 6 to 11 -- debug messages of increasing verbosity\n"
372 "--mute n : Log at most n consecutive messages in the same category.\n"
373 "--status file [n] : Write operational status to file every n seconds.\n"
374 "--status-version [n] : Choose the status file format version number.\n"
375 " Currently, n can be 1, 2, or 3 (default=1).\n"
376 "--disable-occ : (DEPRECATED) Disable options consistency check between peers.\n"
377#ifdef ENABLE_DEBUG
378 "--gremlin mask : Special stress testing mode (for debugging only).\n"
379#endif
380#if defined(USE_COMP)
381 "--compress alg : Use compression algorithm alg\n"
382 "--allow-compression: Specify whether compression should be allowed\n"
383#if defined(ENABLE_LZO)
384 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
385 " packet for incompressible data.\n"
386 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
387 " is specified.\n"
388#endif
389#endif
390#ifdef ENABLE_MANAGEMENT
391 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
392 " management functions. pass is a password file\n"
393 " or 'stdin' to prompt from console.\n"
394#if UNIX_SOCK_SUPPORT
395 " To listen on a unix domain socket, specific the pathname\n"
396 " in place of ip and use 'unix' as the port number.\n"
397#endif
398 "--management-client : Management interface will connect as a TCP client to\n"
399 " ip/port rather than listen as a TCP server.\n"
400 "--management-query-passwords : Query management channel for private key\n"
401 " and auth-user-pass passwords.\n"
402 "--management-query-proxy : Query management channel for proxy information.\n"
403 "--management-query-remote : Query management channel for --remote directive.\n"
404 "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
405 " of the management interface explicitly starts it.\n"
406 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
407 "--management-forget-disconnect : Forget passwords when management disconnect\n"
408 " event occurs.\n"
409 "--management-up-down : Report tunnel up/down events to management interface.\n"
410 "--management-log-cache n : Cache n lines of log file history for usage\n"
411 " by the management channel.\n"
412#if UNIX_SOCK_SUPPORT
413 "--management-client-user u : When management interface is a unix socket, only\n"
414 " allow connections from user u.\n"
415 "--management-client-group g : When management interface is a unix socket, only\n"
416 " allow connections from group g.\n"
417#endif
418 "--management-client-auth : gives management interface client the responsibility\n"
419 " to authenticate clients after their client certificate\n"
420 " has been verified.\n"
421#endif /* ifdef ENABLE_MANAGEMENT */
422#ifdef ENABLE_PLUGIN
423 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
424 " to its initialization function.\n"
425#endif
426 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
427 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
428 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
429 "\n"
430 "Multi-Client Server options (when --mode server is used):\n"
431 "--server network netmask : Helper option to easily configure server mode.\n"
432 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
433 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
434 " easily configure ethernet bridging server mode.\n"
435 "--push \"option\" : Push a config file option back to the peer for remote\n"
436 " execution. Peer must specify --pull in its config file.\n"
437 "--push-reset : Don't inherit global push list for specific\n"
438 " client instance.\n"
439 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
440 " a specific client instance.\n"
441 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
442 " to be dynamically allocated to connecting clients.\n"
443 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
444 " data to file, at seconds intervals (default=600).\n"
445 " If seconds=0, file will be treated as read-only.\n"
446 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
447 " to be dynamically allocated to connecting clients.\n"
448 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
449 " overrides --ifconfig-pool dynamic allocation.\n"
450 " Only valid in a client-specific config file.\n"
451 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
452 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
453 " Only valid in a client-specific config file.\n"
454 "--iroute network [netmask] : Route subnet to client.\n"
455 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
456 " Sets up internal routes only.\n"
457 " Only valid in a client-specific config file.\n"
458 "--disable : Client is disabled.\n"
459 " Only valid in a client-specific config file.\n"
460 "--override-username: Overrides the client-specific username to be used.\n"
461 " Only valid in a client-specific config file.\n"
462 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
463 " mandatory client certificate verification.\n"
464 " Default is to require the client to supply a certificate.\n"
465 "--username-as-common-name : For auth-user-pass authentication, use\n"
466 " the authenticated username as the common name,\n"
467 " rather than the common name from the client cert.\n"
468 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
469 " run command cmd to verify. If method='via-env', pass\n"
470 " user/pass via environment, if method='via-file', pass\n"
471 " user/pass via temporary file.\n"
472 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
473 " to each client, replacing the password. Useful when\n"
474 " OTP based two-factor auth mechanisms are in use and\n"
475 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
476 " for generated tokens can be set.\n"
477 "--auth-user-pass-optional : Allow connections by clients that don't\n"
478 " specify a username/password.\n"
479 "--client-to-client : Internally route client-to-client traffic.\n"
480 "--duplicate-cn : Allow multiple clients with the same common name to\n"
481 " concurrently connect.\n"
482 "--client-connect cmd : Run command cmd on client connection.\n"
483 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
484 "--client-config-dir dir : Directory for custom client config files.\n"
485 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
486 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
487 "--hash-size r v : Set the size of the real address hash table to r and the\n"
488 " virtual address table to v.\n"
489 "--bcast-buffers n : Allocate n broadcast buffers.\n"
490 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
491 "--tcp-nodelay : In server mode, push TCP_NODELAY to clients (it is\n"
492 " enabled by default on the local socket).\n"
493 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
494 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
495 "--connect-freq-initial n s : Allow a maximum of n replies for initial connections attempts per s seconds.\n"
496 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
497 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
498 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
499 " older than n seconds. Run this check every t\n"
500 " seconds (defaults to n).\n"
501 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
502 " clients. n = 1 - reconnect to same server,\n"
503 " 2 - advance to next server, default=1.\n"
504#if PORT_SHARE
505 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
506 " sessions to a web server at host:port. dir specifies an\n"
507 " optional directory to write origin IP:port data.\n"
508#endif
509 "\n"
510 "Client options (when connecting to a multi-client server):\n"
511 "--client : Helper option to easily configure client mode.\n"
512 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
513 " up is a file containing the username on the first line,\n"
514 " and a password on the second. If either the password or both\n"
515 " the username and the password are omitted OpenVPN will prompt\n"
516 " for them from console. If [up] is 'username-only', only username\n"
517 " will be prompted for from console or management interface.\n"
518 "--pull : Accept certain config file options from the peer as if they\n"
519 " were part of the local config file. Must be specified\n"
520 " when connecting to a '--mode server' remote host.\n"
521 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
522 " server if it starts with the text t. The action flag accept,\n"
523 " ignore or reject causes the option to be allowed, removed or\n"
524 " rejected with error. May be specified multiple times, and\n"
525 " each filter is applied in the order of appearance.\n"
526 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
527 " Valid options are :\n"
528 " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n"
529 " resolve-domains <domain> [domain ...] : split domains\n"
530 " dnssec <yes|no|optional> : option to use DNSSEC\n"
531 " transport <DoH|DoT> : query server over HTTPS / TLS\n"
532 " sni <domain> : DNS server name indication\n"
533 "--dns search-domains <domain> [domain ...]:\n"
534 " Add domains to DNS domain search list\n"
535 "--dns-updown cmd|force|disable : Run cmd as user defined dns config command,\n"
536 " force running the default script or disable running it.\n"
537 "--auth-retry t : How to handle auth failures. Set t to\n"
538 " none (default), interact, or nointeract.\n"
539 "--static-challenge t e [<scrv1|concat>]: Enable static challenge/response protocol using\n"
540 " challenge text t, with e indicating echo flag (0|1)\n"
541 " and optional argument scrv1 or concat to use SCRV1 protocol or"
542 " concatenate response with password. Default is scrv1.\n"
543 "--connect-timeout n : when polling possible remote servers to connect to\n"
544 " in a round-robin fashion, spend no more than n seconds\n"
545 " waiting for a response before trying the next server.\n"
546 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
547 " incoming tun packets with same destination as host.\n"
548 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
549 " server/remote. n = # of retries, default=1.\n"
550 "\n"
551 "Data Channel Encryption Options (must be compatible between peers):\n"
552 "(These options are meaningful for both Static Key & TLS-mode)\n"
553 "--auth alg : Authenticate packets with HMAC using message\n"
554 " digest algorithm alg (default=%s).\n"
555 " (usually adds 16 or 20 bytes per packet)\n"
556 " Set alg=none to disable authentication.\n"
557 "--cipher alg : Encrypt packets with cipher algorithm alg.\n"
558 " You should usually use --data-ciphers instead.\n"
559 " Set alg=none to disable encryption.\n"
560 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
561#ifndef ENABLE_CRYPTO_MBEDTLS
562 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
563#endif
564 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
565 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
566 " and a time window of t seconds.\n"
567 " Default n=%d t=%d\n"
568 "--replay-persist file : Persist replay-protection state across sessions\n"
569 " using file.\n"
570 "--test-crypto : Run a self-test of crypto features enabled.\n"
571 " For debugging only.\n"
572 "\n"
573 "TLS Key Negotiation Options:\n"
574 "(These options are meaningful only for TLS-mode)\n"
575 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
576 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
577 "--ca file : Certificate authority file in .pem format containing\n"
578 " root certificate.\n"
579#ifndef ENABLE_CRYPTO_MBEDTLS
580 "--capath dir : A directory of trusted certificates (CAs"
581 " and CRLs).\n"
582#endif /* ENABLE_CRYPTO_MBEDTLS */
583 "--dh file : File containing Diffie Hellman parameters\n"
584 " in .pem format (for --tls-server only).\n"
585 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
586 "--cert file : Local certificate in .pem format or a URI -- must be signed\n"
587 " by a Certificate Authority in --ca file used by the peer.\n"
588 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
589 "--key file : Local private key in .pem format or a URI.\n"
590 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
591 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
592 " is specified, require max TLS version supported by SSL implementation.\n"
593 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
594#ifndef ENABLE_CRYPTO_MBEDTLS
595 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
596 " and optionally the root CA certificate.\n"
597 "--x509-username-field : Field in x509 certificate containing the username.\n"
598 " Default is CN in the Subject field.\n"
599#endif
600 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
601 " Valid algo flags are SHA1 and SHA256. \n"
602#ifdef _WIN32
603 "--cryptoapicert select-string : Load the certificate and private key from the\n"
604 " Windows Certificate System Store.\n"
605#endif
606 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
607 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites separated by : (optional)\n"
608 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
609 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
610 " (default=legacy).\n"
611#ifndef ENABLE_CRYPTO_MBEDTLS
612 "--providers l : A list l of OpenSSL providers to load.\n"
613#endif
614 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
615 " if no ACK from remote within n seconds (default=%d).\n"
616 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
617 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
618 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
619 " and at least min (defaults to 90%% of max on servers and equal\n"
620 " to max on clients).\n"
621 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
622 " of handshake initiation by any peer (default=%d).\n"
623 "--tran-window n : Transition window -- old key can live this many seconds\n"
624 " after new key renegotiation begins (default=%d).\n"
625 "--single-session: Allow only one session (reset state on restart).\n"
626 "--tls-exit : Exit on TLS negotiation failure.\n"
627 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
628 " control channel to protect against attacks on the TLS stack\n"
629 " and DoS attacks.\n"
630 " f (required) is a shared-secret key file.\n"
631 " The optional d parameter controls key directionality.\n"
632 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
633 " of the TLS control channel to hide the TLS certificate,\n"
634 " provide basic post-quantum security and protect against\n"
635 " attacks on the TLS stack and DoS attacks.\n"
636 " key (required) provides the pre-shared key file.\n"
637 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
638 " For servers: use key to decrypt client-specific keys. For\n"
639 " key generation (--genkey tls-crypt-v2-client): use key to\n"
640 " encrypt generated client-specific key. (See --tls-crypt.)\n"
641 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
642 " fresh tls-crypt-v2 client key, and store to\n"
643 " keyfile. If supplied, include metadata in wrapped key.\n"
644 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
645 " fresh tls-crypt-v2 server key, and store to keyfile\n"
646 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
647 " client-supplied tls-crypt-v2 client key\n"
648 "--tls-crypt-v2-max-age n : Only accept tls-crypt-v2 client keys that have a\n"
649 " timestamp which is at most n days old.\n"
650 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
651 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
652 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
653 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
654 " pending TLS connection that has otherwise passed all other\n"
655 " tests of certification. cmd should return 0 to allow\n"
656 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
657 " executed as 'cmd certificate_depth subject')\n"
658 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
659 " DN name. The remote host must also pass all other tests\n"
660 " of verification.\n"
661#ifndef ENABLE_CRYPTO_MBEDTLS
662 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
663 " an explicit nsCertType designation t = 'client' | 'server'.\n"
664#endif
665 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
666 " plugins and management interface.\n"
667 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
668 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
669 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
670 " explicit key usage, you can specify more than one value.\n"
671 " value should be given in hex format.\n"
672 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
673 " explicit extended key usage. Extended key usage can be encoded\n"
674 " as an object identifier or OpenSSL string representation.\n"
675 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
676 " key usage and extended key usage based on RFC3280 TLS rules.\n"
677 " t = 'client' | 'server'.\n"
678#ifdef ENABLE_PKCS11
679 "\n"
680 "PKCS#11 Options:\n"
681 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
682 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
683 " path. Set for each provider.\n"
684 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
685 " 0 : Try to determine automatically (default).\n"
686 " 1 : Use Sign.\n"
687 " 2 : Use SignRecover.\n"
688 " 4 : Use Decrypt.\n"
689 " 8 : Use Unwrap.\n"
690 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
691 " certificate can be accessed. Set for each provider.\n"
692 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
693 " cache until token is removed.\n"
694 "--pkcs11-id-management : Acquire identity from management interface.\n"
695 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
696#endif /* ENABLE_PKCS11 */
697 "\n"
698 "SSL Library information:\n"
699 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
700 "--show-digests : Show message digest algorithms to use with --auth option.\n"
701 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
702 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
703#ifdef _WIN32
704 "\n"
705 "Windows Specific:\n"
706 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
707 " from SystemRoot environment variable.\n"
708 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
709 " IP address using method = manual, netsh, ipapi,\n"
710 " dynamic, or adaptive (default = adaptive).\n"
711 " Dynamic method allows two optional parameters:\n"
712 " offset: DHCP server address offset (> -256 and < 256).\n"
713 " If 0, use network address, if >0, take nth\n"
714 " address forward from network address, if <0,\n"
715 " take nth address backward from broadcast\n"
716 " address.\n"
717 " Default is 0.\n"
718 " lease-time: Lease time in seconds.\n"
719 " Default is one year.\n"
720 "--route-method : Which method to use for adding routes on Windows?\n"
721 " adaptive (default) -- Try ipapi then fall back to exe.\n"
722 " ipapi -- Use IP helper API.\n"
723 " exe -- Call the route.exe shell command.\n"
724 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
725 " be used with --ip-win32 dynamic. For options\n"
726 " which allow multiple addresses,\n"
727 " --dhcp-option must be repeated.\n"
728 " DOMAIN name : Set DNS suffix\n"
729 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
730 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
731 " NTP : Set NTP server address(es)\n"
732 " NBDD : Set NBDD server address(es)\n"
733 " WINS addr : Set WINS server address(es)\n"
734 " NBT type : Set NetBIOS over TCP/IP Node type\n"
735 " 1: B, 2: P, 4: M, 8: H\n"
736 " NBS id : Set NetBIOS scope ID\n"
737 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
738 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
739 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
740 " startup.\n"
741 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
742 " on connection initiation.\n"
743 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
744 " attempting to set adapter properties.\n"
745 "--pause-exit : When run from a console window, pause before exiting.\n"
746 "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n"
747 " service, and should not be used directly by end-users.\n"
748 " ex is the name of an event object which, when\n"
749 " signaled, will cause " PACKAGE_NAME " to exit. A second\n"
750 " optional parameter controls the initial state of ex.\n"
751 "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n"
752 " after TAP adapter is up and routes have been added.\n"
753 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
754 "Windows Standalone Options:\n"
755 "\n"
756 "--show-adapters : Show all TAP-Windows adapters.\n"
757 "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n"
758 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
759 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME " running without admin privileges\n"
760 " to access TAP adapter.\n"
761#endif /* ifdef _WIN32 */
762 "\n"
763 "Generate a new key :\n"
764 "--genkey tls-auth file : Generate a new random key of type and write to file\n"
765 " (for use with --tls-auth or --tls-crypt)."
766#ifdef ENABLE_FEATURE_TUN_PERSIST
767 "\n"
768 "Tun/tap config mode:\n"
769 "--mktun : Create a persistent tunnel.\n"
770 "--rmtun : Remove a persistent tunnel.\n"
771 "--dev tunX|tapX : tun/tap device\n"
772 "--dev-type dt : Device type. See tunnel options above for details.\n"
773 "--user user : User to set privilege to.\n"
774 "--group group : Group to set privilege to.\n"
775#endif
776#ifdef ENABLE_PKCS11
777 "\n"
778 "PKCS#11 standalone options:\n"
779#ifdef DEFAULT_PKCS11_MODULE
780 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
781#else
782 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
783#endif
784 " --verb option can be added *BEFORE* this.\n"
785#endif /* ENABLE_PKCS11 */
786 "\n"
787 "General Standalone Options:\n"
788#ifdef ENABLE_DEBUG
789 "--show-gateway [address]: Show info about gateway [to v4/v6 address].\n"
790#endif
791 ;
792
793#endif /* !ENABLE_SMALL */
794
795/*
796 * This is where the options defaults go.
797 * Any option not explicitly set here
798 * will be set to 0.
799 */
800void
801init_options(struct options *o)
802{
803 CLEAR(*o);
804 gc_init(&o->gc);
805 gc_init(&o->dns_options.gc);
806
807 o->mode = MODE_POINT_TO_POINT;
808 o->dev = "tun";
809 o->topology = TOP_UNDEF;
810 o->ce.proto = PROTO_UDP;
811 o->ce.af = AF_UNSPEC;
812 o->ce.bind_ipv6_only = false;
813 o->ce.connect_retry_seconds = 1;
814 o->ce.connect_retry_seconds_max = 300;
815 o->ce.connect_timeout = 120;
816 o->connect_retry_max = 0;
817 o->ce.local_port = o->ce.remote_port = OPENVPN_PORT;
818 o->verbosity = 1;
819 o->status_file_update_freq = 60;
820 o->status_file_version = 1;
821 o->ce.bind_local = true;
822 o->ce.tun_mtu = TUN_MTU_DEFAULT;
823 o->ce.occ_mtu = 0;
824 o->ce.link_mtu = LINK_MTU_DEFAULT;
825 o->ce.tls_mtu = TLS_MTU_DEFAULT;
826 o->ce.mtu_discover_type = -1;
827 o->ce.mssfix = 0;
828 o->ce.mssfix_default = true;
829 o->ce.mssfix_encap = true;
830 o->route_default_table_id = 0;
831 o->route_delay_window = 30;
832 o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
833 o->resolve_in_advance = false;
834 o->proto_force = -1;
835 o->occ = true;
836#ifdef ENABLE_MANAGEMENT
837 o->management_log_history_cache = 250;
838 o->management_echo_buffer_size = 100;
839 o->management_state_buffer_size = 100;
840#endif
841#ifdef ENABLE_FEATURE_TUN_PERSIST
842 o->persist_mode = 1;
843#endif
844#ifdef _WIN32
845#if 0
846 o->tuntap_options.ip_win32_type = IPW32_SET_ADAPTIVE;
847#else
848 o->tuntap_options.ip_win32_type = IPW32_SET_DHCP_MASQ;
849#endif
850 o->tuntap_options.dhcp_lease_time = 31536000; /* one year */
851 /* use network address as internal DHCP server address */
852 o->tuntap_options.dhcp_masq_offset = 0;
853 o->route_method = ROUTE_METHOD_ADAPTIVE;
854 o->block_outside_dns = false;
855 o->windows_driver = WINDOWS_DRIVER_UNSPECIFIED;
856#endif
857 o->vlan_accept = VLAN_ALL;
858 o->vlan_pvid = 1;
859 o->n_bcast_buf = 256;
860 o->tcp_queue_limit = 64;
861 o->max_clients = 1024;
862 o->cf_initial_per = 10;
863 o->cf_initial_max = 100;
864 o->max_routes_per_client = 256;
865 o->stale_routes_check_interval = 0;
866 o->ifconfig_pool_persist_refresh_freq = 600;
867 o->scheduled_exit_interval = 5;
868 o->authname = "SHA1";
869 o->replay_window = DEFAULT_SEQ_BACKTRACK;
870 o->replay_time = DEFAULT_TIME_BACKTRACK;
871 o->key_direction = KEY_DIRECTION_BIDIRECTIONAL;
872 o->tls_timeout = 2;
873 o->renegotiate_bytes = -1;
874 o->renegotiate_seconds = 3600;
875 o->renegotiate_seconds_min = -1;
876 o->handshake_window = 60;
877 o->transition_window = 3600;
878 o->tls_cert_profile = NULL;
879 o->ecdh_curve = NULL;
880 o->x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT;
881#ifdef ENABLE_PKCS11
882 o->pkcs11_pin_cache_period = -1;
883#endif /* ENABLE_PKCS11 */
884
885 /* P2MP server context features */
886 o->auth_token_generate = false;
887
888 /* Set default --tmp-dir */
889 o->tmp_dir = platform_get_tmp_dir();
890
891 o->allow_recursive_routing = false;
892
893#ifndef ENABLE_DCO
894 o->disable_dco = true;
895#endif /* ENABLE_DCO */
896
897#ifdef ENABLE_DNS_UPDOWN_BY_DEFAULT
898 o->dns_options.updown = DEFAULT_DNS_UPDOWN;
899#endif /* ENABLE_DNS_UPDOWN_BY_DEFAULT */
900}
901
902void
903uninit_options(struct options *o)
904{
905 if (o->connection_list)
906 {
907 CLEAR(*o->connection_list);
908 }
909 if (o->remote_list)
910 {
911 CLEAR(*o->remote_list);
912 }
913
914 gc_free(&o->gc);
915 gc_free(&o->dns_options.gc);
916}
917
918static void
919setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
920{
921 setenv_str_i(es, "remote", e->remote, i);
922 setenv_str_i(es, "remote_port", e->remote_port, i);
923
924 if (e->http_proxy_options)
925 {
926 setenv_str_i(es, "http_proxy_server", e->http_proxy_options->server, i);
927 setenv_str_i(es, "http_proxy_port", e->http_proxy_options->port, i);
928 }
929 if (e->socks_proxy_server)
930 {
931 setenv_str_i(es, "socks_proxy_server", e->socks_proxy_server, i);
932 setenv_str_i(es, "socks_proxy_port", e->socks_proxy_port, i);
933 }
934}
935
936static void
937setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
938{
939 setenv_str_i(es, "proto", proto2ascii(e->proto, AF_UNSPEC, false), i);
940 setenv_str_i(es, "local", e->local, i);
941 setenv_str_i(es, "local_port", e->port, i);
942}
943
944void
945setenv_settings(struct env_set *es, const struct options *o)
946{
947 setenv_str(es, "config", o->config);
948 setenv_int(es, "verb", o->verbosity);
949 setenv_int(es, "daemon", o->daemon);
950 setenv_int(es, "daemon_log_redirect", o->log);
951 setenv_long_long(es, "daemon_start_time", time(NULL));
952 setenv_int(es, "daemon_pid", platform_getpid());
953
954 if (o->connection_list)
955 {
956 int i;
957 for (i = 0; i < o->connection_list->len; ++i)
958 {
959 setenv_connection_entry(es, o->connection_list->array[i], i + 1);
960 }
961 }
962 else
963 {
964 setenv_connection_entry(es, &o->ce, 1);
965 }
966
967 if (o->ce.local_list)
968 {
969 for (int i = 0; i < o->ce.local_list->len; i++)
970 {
971 setenv_local_entry(es, o->ce.local_list->array[i], i + 1);
972 }
973 }
974}
975
976#ifndef _WIN32
977static void
978setenv_foreign_option(struct options *o, const char *option, const char *value, struct env_set *es)
979{
980 struct gc_arena gc = gc_new();
981 struct buffer env_name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
982 struct buffer env_value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
983 bool good = true;
984
985 good &= buf_printf(&env_name, "foreign_option_%d", o->foreign_option_index + 1);
986 if (value)
987 {
988 good &= buf_printf(&env_value, "dhcp-option %s %s", option, value);
989 }
990 else
991 {
992 good &= buf_printf(&env_value, "dhcp-option %s", option);
993 }
994 if (good)
995 {
996 setenv_str(es, BSTR(&env_name), BSTR(&env_value));
997 ++o->foreign_option_index;
998 }
999 else
1000 {
1001 msg(M_WARN, "foreign_option: name/value overflow");
1002 }
1003 gc_free(&gc);
1004}
1005
1006static void
1007delete_all_dhcp_fo(struct options *o, struct env_item **list)
1008{
1009 struct env_item *current, *prev;
1010
1011 ASSERT(list);
1012
1013 for (current = *list, prev = NULL; current != NULL; current = current->next)
1014 {
1015 char *tmp_value = NULL;
1016 if (!strncmp(current->string, "foreign_option_", sizeof("foreign_option_") - 1))
1017 {
1018 tmp_value = strchr(current->string, '=');
1019 if (tmp_value && ++tmp_value)
1020 {
1021 if (!strncmp(tmp_value, "dhcp-option ", sizeof("dhcp-option ") - 1))
1022 {
1023 if (prev)
1024 {
1025 prev->next = current->next;
1026 }
1027 else
1028 {
1029 *list = current->next;
1030 }
1031 o->foreign_option_index--;
1032 }
1033 }
1034 }
1035 prev = current;
1036 }
1037}
1038
1039#endif /* ifndef _WIN32 */
1040
1041static in_addr_t
1042get_ip_addr(const char *ip_string, msglvl_t msglevel, bool *error)
1043{
1044 unsigned int flags = GETADDR_HOST_ORDER;
1045 bool succeeded = false;
1046 in_addr_t ret;
1047
1048 if (msglevel & M_FATAL)
1049 {
1050 flags |= GETADDR_FATAL;
1051 }
1052
1053 ret = getaddr(flags, ip_string, 0, &succeeded, NULL);
1054 if (!succeeded && error)
1055 {
1056 *error = true;
1057 }
1058 return ret;
1059}
1060
1066static char *
1067get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
1068{
1069 const char *end = strchr(addr, '/');
1070 char *ret = NULL;
1071 if (NULL == end)
1072 {
1073 ret = string_alloc(addr, gc);
1074 }
1075 else
1076 {
1077 size_t len = end - addr;
1078 ret = gc_malloc(len + 1, true, gc);
1079 memcpy(ret, addr, len);
1080 }
1081 return ret;
1082}
1083
1084static bool
1085ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
1086{
1087 return get_ipv6_addr(ipv6_prefix_spec, NULL, NULL, M_WARN);
1088}
1089
1099static struct verify_hash_list *
1100parse_hash_fingerprint(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
1101{
1102 int i = 0;
1103 const char *cp = str;
1104
1105 struct verify_hash_list *ret;
1106 ALLOC_OBJ_CLEAR_GC(ret, struct verify_hash_list, gc);
1107
1108 char term = 0;
1109 unsigned int byte;
1110
1111 while (*cp && i < nbytes)
1112 {
1113 /* valid segments consist of exactly two hex digits, then ':' or EOS */
1114 if (!isxdigit(cp[0]) || !isxdigit(cp[1]) || (cp[2] != ':' && cp[2] != '\0')
1115 || sscanf(cp, "%x", &byte) != 1)
1116 {
1117 msg(msglevel, "format error in hash fingerprint: %s", str);
1118 break;
1119 }
1120
1121 ret->hash[i++] = (uint8_t)byte;
1122
1123 term = cp[2];
1124 if (term == '\0')
1125 {
1126 break;
1127 }
1128 cp += 3;
1129 }
1130 if (i < nbytes)
1131 {
1132 msg(msglevel, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes, i,
1133 str);
1134 }
1135 else if (term != '\0')
1136 {
1137 msg(msglevel, "hash fingerprint too long - expected only %d bytes: %s", nbytes, str);
1138 }
1139 return ret;
1140}
1141
1152static struct verify_hash_list *
1153parse_hash_fingerprint_multiline(const char *str, int nbytes, msglvl_t msglevel,
1154 struct gc_arena *gc)
1155{
1156 struct gc_arena gc_temp = gc_new();
1157 char *lines = string_alloc(str, &gc_temp);
1158
1159 struct verify_hash_list *ret = NULL;
1160
1161 const char *line;
1162 while ((line = strsep(&lines, "\n")))
1163 {
1164 /* ignore leading whitespace */
1165 while (isspace(*line))
1166 {
1167 line++;
1168 }
1169 /* skip empty lines and comment lines */
1170 if (strlen(line) == 0 || *line == '#' || *line == ';')
1171 {
1172 continue;
1173 }
1174
1175 struct verify_hash_list *hash = parse_hash_fingerprint(line, nbytes, msglevel, gc);
1176
1177 if (!hash)
1178 {
1179 gc_free(&gc_temp);
1180 return NULL;
1181 }
1182
1183 hash->next = ret;
1184 ret = hash;
1185 }
1186 gc_free(&gc_temp);
1187
1188 return ret;
1189}
1190
1191static void
1192dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, unsigned int *len, msglvl_t msglevel)
1193{
1194 struct in6_addr addr;
1195 if (*len >= N_DHCP_ADDR)
1196 {
1197 msg(msglevel, "--dhcp-option DNS: maximum of %u IPv6 dns servers can be specified",
1198 N_DHCP_ADDR);
1199 }
1200 else if (get_ipv6_addr(parm, &addr, NULL, msglevel))
1201 {
1202 dns6_list[(*len)++] = addr;
1203 }
1204}
1205static void
1206dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, unsigned int *len,
1207 msglvl_t msglevel)
1208{
1209 if (*len >= N_DHCP_ADDR)
1210 {
1211 msg(msglevel, "--dhcp-option %s: maximum of %u %s servers can be specified", name,
1212 N_DHCP_ADDR, name);
1213 }
1214 else
1215 {
1216 if (ip_addr_dotted_quad_safe(parm)) /* FQDN -- IP address only */
1217 {
1218 bool error = false;
1219 const in_addr_t addr = get_ip_addr(parm, msglevel, &error);
1220 if (!error)
1221 {
1222 array[(*len)++] = addr;
1223 }
1224 }
1225 else
1226 {
1227 msg(msglevel, "dhcp-option parameter %s '%s' must be an IP address", name, parm);
1228 }
1229 }
1230}
1231
1232static void
1233option_iroute(struct options *o, const char *network_str, const char *netmask_str,
1234 msglvl_t msglevel)
1235{
1236 struct iroute *ir;
1237
1238 ALLOC_OBJ_GC(ir, struct iroute, &o->gc);
1239 ir->network = getaddr(GETADDR_HOST_ORDER, network_str, 0, NULL, NULL);
1240 ir->netbits = 32; /* host route if no netmask given */
1241
1242 if (netmask_str)
1243 {
1244 const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, netmask_str, 0, NULL, NULL);
1245 ir->netbits = netmask_to_netbits2(netmask);
1246
1247 if (ir->netbits < 0)
1248 {
1249 msg(msglevel, "in --iroute %s %s : Bad network/subnet specification", network_str,
1250 netmask_str);
1251 return;
1252 }
1253 }
1254
1255 ir->next = o->iroutes;
1256 o->iroutes = ir;
1257}
1258
1259static void
1260option_iroute_ipv6(struct options *o, const char *prefix_str, msglvl_t msglevel)
1261{
1262 struct iroute_ipv6 *ir;
1263
1264 ALLOC_OBJ_GC(ir, struct iroute_ipv6, &o->gc);
1265
1266 if (!get_ipv6_addr(prefix_str, &ir->network, &ir->netbits, msglevel))
1267 {
1268 msg(msglevel, "in --iroute-ipv6 %s: Bad IPv6 prefix specification", prefix_str);
1269 return;
1270 }
1271
1272 ir->next = o->iroutes_ipv6;
1273 o->iroutes_ipv6 = ir;
1274}
1275
1276void
1277options_detach(struct options *o)
1278{
1279 /* The options struct carries two gc_arena's (one generic and one specific
1280 * to the DNS settings), which the by-value options
1281 * copy in inherit_context_child()/inherit_context_top() shares with the
1282 * source.
1283 *
1284 * Detach both (i.e. re-initialize them), otherwise child's call of
1285 * gc_free() (or context teardown) would free allocations the source
1286 * context still references, leading to a use-after-free (and subsequent
1287 * double-free).
1288 */
1289 gc_detach(&o->gc);
1290 gc_detach(&o->dns_options.gc);
1291 o->routes = NULL;
1292 o->client_nat = NULL;
1293 clone_push_list(o);
1294}
1295
1296void
1297rol_check_alloc(struct options *options)
1298{
1299 if (!options->routes)
1300 {
1301 options->routes = new_route_option_list(&options->gc);
1302 }
1303}
1304
1305static void
1313
1314static void
1315cnol_check_alloc(struct options *options)
1316{
1317 if (!options->client_nat)
1318 {
1319 options->client_nat = new_client_nat_list(&options->gc);
1320 }
1321}
1322
1323#ifdef ENABLE_MANAGEMENT
1324
1325static struct http_proxy_options *
1326parse_http_proxy_override(const char *server, const char *port, const char *flags,
1327 struct gc_arena *gc)
1328{
1329 if (server && port)
1330 {
1331 struct http_proxy_options *ho;
1332 ALLOC_OBJ_CLEAR_GC(ho, struct http_proxy_options, gc);
1333 ho->server = string_alloc(server, gc);
1334 ho->port = port;
1335 if (flags && !strcmp(flags, "nct"))
1336 {
1337 ho->auth_retry = PAR_NCT;
1338 }
1339 else
1340 {
1341 ho->auth_retry = PAR_ALL;
1342 }
1343 ho->http_version = "1.0";
1344 ho->user_agent = "OpenVPN-Autoproxy/1.0";
1345 return ho;
1346 }
1347 else
1348 {
1349 return NULL;
1350 }
1351}
1352
1353static void
1354options_postprocess_http_proxy_override(struct options *o)
1355{
1356 const struct connection_list *l = o->connection_list;
1357 int i;
1358 bool succeed = false;
1359 for (i = 0; i < l->len; ++i)
1360 {
1361 struct connection_entry *ce = l->array[i];
1362 if (ce->proto == PROTO_TCP_CLIENT || ce->proto == PROTO_TCP)
1363 {
1364 ce->http_proxy_options = o->http_proxy_override;
1365 succeed = true;
1366 }
1367 }
1368 if (succeed)
1369 {
1370 for (i = 0; i < l->len; ++i)
1371 {
1372 struct connection_entry *ce = l->array[i];
1373 if (ce->proto == PROTO_UDP)
1374 {
1375 ce->flags |= CE_DISABLED;
1376 }
1377 }
1378 }
1379 else
1380 {
1381 msg(M_WARN,
1382 "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
1383 }
1384}
1385
1386#endif /* ifdef ENABLE_MANAGEMENT */
1387
1388static struct local_list *
1389alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
1390{
1391 if (!ce->local_list)
1392 {
1393 ALLOC_OBJ_CLEAR_GC(ce->local_list, struct local_list, gc);
1394 }
1395 return ce->local_list;
1396}
1397
1398static struct local_entry *
1399alloc_local_entry(struct connection_entry *ce, const msglvl_t msglevel, struct gc_arena *gc)
1400{
1401 struct local_list *l = alloc_local_list_if_undef(ce, gc);
1402 struct local_entry *e;
1403
1404 if (l->len >= l->capacity)
1405 {
1406 const int new_cap = l->capacity + 1;
1407 const size_t elem_size = sizeof(*l->array);
1408
1409 struct local_entry **new_array = gc_realloc(l->array, new_cap * elem_size, gc);
1410 if (!new_array)
1411 {
1412 msg(msglevel,
1413 "Unable to process more local options: out of memory. Number of entries = %d",
1414 l->len);
1415 return NULL;
1416 }
1417
1418 l->array = new_array;
1419 l->capacity = new_cap;
1420 }
1421
1422 ALLOC_OBJ_CLEAR_GC(e, struct local_entry, gc);
1423 e->proto = PROTO_NONE;
1424 l->array[l->len++] = e;
1425
1426 return e;
1427}
1428
1429static struct connection_list *
1438
1439static struct connection_entry *
1440alloc_connection_entry(struct options *options, const msglvl_t msglevel)
1441{
1442 struct connection_list *l = alloc_connection_list_if_undef(options);
1443 struct connection_entry *e;
1444
1445 if (l->len == l->capacity)
1446 {
1447 int capacity = l->capacity + CONNECTION_LIST_SIZE;
1448 struct connection_entry **ce =
1449 gc_realloc(l->array, capacity * sizeof(struct connection_entry *), &options->gc);
1450 if (ce == NULL)
1451 {
1452 msg(msglevel,
1453 "Unable to process more connection options: out of memory. Number of entries = %d",
1454 l->len);
1455 return NULL;
1456 }
1457 l->array = ce;
1458 l->capacity = capacity;
1459 }
1460 ALLOC_OBJ_GC(e, struct connection_entry, &options->gc);
1461 l->array[l->len++] = e;
1462 return e;
1463}
1464
1465static struct remote_list *
1466alloc_remote_list_if_undef(struct options *options)
1467{
1468 if (!options->remote_list)
1469 {
1470 ALLOC_OBJ_CLEAR_GC(options->remote_list, struct remote_list, &options->gc);
1471 }
1472 return options->remote_list;
1473}
1474
1475static struct remote_entry *
1476alloc_remote_entry(struct options *options, const msglvl_t msglevel)
1477{
1478 struct remote_list *l = alloc_remote_list_if_undef(options);
1479 struct remote_entry *e;
1480
1481 if (l->len == l->capacity)
1482 {
1483 int capacity = l->capacity + CONNECTION_LIST_SIZE;
1484 struct remote_entry **re =
1485 gc_realloc(l->array, capacity * sizeof(struct remote_entry *), &options->gc);
1486 if (re == NULL)
1487 {
1488 msg(msglevel,
1489 "Unable to process more remote options: out of memory. Number of entries = %d",
1490 l->len);
1491 return NULL;
1492 }
1493 l->array = re;
1494 l->capacity = capacity;
1495 }
1496 ALLOC_OBJ_GC(e, struct remote_entry, &options->gc);
1497 l->array[l->len++] = e;
1498 return e;
1499}
1500
1501static struct pull_filter_list *
1502alloc_pull_filter_list(struct options *o)
1503{
1504 if (!o->pull_filter_list)
1505 {
1506 ALLOC_OBJ_CLEAR_GC(o->pull_filter_list, struct pull_filter_list, &o->gc);
1507 }
1508 return o->pull_filter_list;
1509}
1510
1511static struct pull_filter *
1512alloc_pull_filter(struct options *o)
1513{
1514 struct pull_filter_list *l = alloc_pull_filter_list(o);
1515 struct pull_filter *f;
1516
1517 ALLOC_OBJ_CLEAR_GC(f, struct pull_filter, &o->gc);
1518 if (l->head)
1519 {
1520 ASSERT(l->tail);
1521 l->tail->next = f;
1522 }
1523 else
1524 {
1525 ASSERT(!l->tail);
1526 l->head = f;
1527 }
1528 l->tail = f;
1529 return f;
1530}
1531
1532static void
1533connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
1534{
1535 if (re->remote)
1536 {
1537 ce->remote = re->remote;
1538 }
1539 if (re->remote_port)
1540 {
1541 ce->remote_port = re->remote_port;
1542 }
1543 if (re->proto >= 0)
1544 {
1545 ce->proto = re->proto;
1546 }
1547 if (re->af > 0)
1548 {
1549 ce->af = re->af;
1550 }
1551}
1552
1553static void
1554connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
1555{
1556 if (key_file && *key_file && !(*key_inline))
1557 {
1558 struct buffer in = buffer_read_from_file(*key_file, gc);
1559 if (!buf_valid(&in))
1560 {
1561 msg(M_FATAL, "Cannot pre-load keyfile (%s)", *key_file);
1562 }
1563
1564 *key_file = (const char *)in.data;
1565 *key_inline = true;
1566 }
1567}
1568
1569static void
1570check_ca_required(const struct options *options)
1571{
1572#ifdef ENABLE_CRYPTO_MBEDTLS
1573 if (options->ca_path)
1574 {
1575 msg(M_USAGE, "Parameter --capath cannot be used with the mbed TLS version of OpenVPN.");
1576 }
1577#endif
1578
1579 if (options->verify_hash_no_ca || options->pkcs12_file || options->ca_file
1580#ifndef ENABLE_CRYPTO_MBEDTLS
1581 || options->ca_path
1582#endif
1583 )
1584 {
1585 return;
1586 }
1587
1588 const char *const str = "You must define CA file (--ca)"
1589#ifndef ENABLE_CRYPTO_MBEDTLS
1590 " or CA path (--capath)"
1591#endif
1592 " and/or peer fingerprint verification (--peer-fingerprint)";
1593 msg(M_USAGE, "%s", str);
1594}
1595
1596#define MUST_BE_UNDEF(parm, parm_name) \
1597 if (options->parm != defaults.parm) \
1598 { \
1599 msg(M_USAGE, use_err, parm_name); \
1600 }
1601#define MUST_BE_FALSE(condition, parm_name) \
1602 if (condition) \
1603 { \
1604 msg(M_USAGE, use_err, parm_name); \
1605 }
1606
1607static void
1608options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
1609{
1610 struct options defaults;
1611 int dev = DEV_TYPE_UNDEF;
1612 bool pull = false;
1613
1614 init_options(&defaults);
1615
1616 if (!options->test_crypto)
1617 {
1618 notnull(options->dev, "TUN/TAP device (--dev)");
1619 }
1620
1621 /*
1622 * Get tun/tap/null device type
1623 */
1624 dev = dev_type_enum(options->dev, options->dev_type);
1625
1626 /*
1627 * If "proto tcp" is specified, make sure we know whether it is
1628 * tcp-client or tcp-server.
1629 */
1630 if (ce->proto == PROTO_TCP)
1631 {
1632 msg(M_USAGE, "--proto tcp is ambiguous in this context. Please specify "
1633 "--proto tcp-server or --proto tcp-client");
1634 }
1635
1636 /*
1637 * Sanity check on Client mode
1638 */
1639
1640 if (options->mode != MODE_SERVER && ce->local_list->len > 1)
1641 {
1642 msg(M_USAGE, "multiple --local statements only allowed in --server mode");
1643 }
1644
1645 if (options->lladdr && dev != DEV_TYPE_TAP)
1646 {
1647 msg(M_USAGE, "--lladdr can only be used in --dev tap mode");
1648 }
1649
1650 /*
1651 * Sanity check on MTU parameters
1652 */
1653 if (options->ce.tun_mtu_defined && options->ce.link_mtu_defined)
1654 {
1655 msg(M_USAGE, "only one of --tun-mtu or --link-mtu may be defined");
1656 }
1657
1658 if (!proto_is_udp(ce->proto) && options->mtu_test)
1659 {
1660 msg(M_USAGE, "--mtu-test only makes sense with --proto udp");
1661 }
1662
1663 /* will we be pulling options from server? */
1664 pull = options->pull;
1665
1666 /*
1667 * Sanity check on --local, --remote, and --ifconfig
1668 */
1669
1670 if (string_defined_equal(ce->remote, options->ifconfig_local)
1671 || string_defined_equal(ce->remote, options->ifconfig_remote_netmask))
1672 {
1673 msg(M_USAGE, "--local and --remote addresses must be distinct from --ifconfig "
1674 "addresses");
1675 }
1676
1677 if (string_defined_equal(options->ifconfig_local, options->ifconfig_remote_netmask))
1678 {
1679 msg(M_USAGE, "local and remote/netmask --ifconfig addresses must be different");
1680 }
1681
1682 if (ce->bind_defined && !ce->bind_local)
1683 {
1684 msg(M_USAGE, "--bind and --nobind can't be used together");
1685 }
1686
1687 if (ce->local_port_defined && !ce->bind_local)
1688 {
1689 msg(M_USAGE, "--lport and --nobind don't make sense when used together");
1690 }
1691
1692 if (!ce->remote && !ce->bind_local)
1693 {
1694 msg(M_USAGE, "--nobind doesn't make sense unless used with --remote");
1695 }
1696
1697 for (int i = 0; i < ce->local_list->len; i++)
1698 {
1699 const struct local_entry *le = ce->local_list->array[i];
1700
1701 if (proto_is_net(le->proto) && string_defined_equal(le->local, ce->remote)
1702 && string_defined_equal(le->port, ce->remote_port))
1703 {
1704 msg(M_USAGE, "--remote and one of the --local addresses are the same");
1705 }
1706
1707 if (string_defined_equal(le->local, options->ifconfig_local)
1708 || string_defined_equal(le->local, options->ifconfig_remote_netmask))
1709 {
1710 msg(M_USAGE, "--local addresses must be distinct from --ifconfig addresses");
1711 }
1712
1713 if (le->local && !ce->bind_local)
1714 {
1715 msg(M_USAGE, "--local and --nobind don't make sense when used together");
1716 }
1717 }
1718
1719 /*
1720 * Check for consistency of management options
1721 */
1722#ifdef ENABLE_MANAGEMENT
1723 if (!options->management_addr
1724 && (options->management_flags
1725 || options->management_log_history_cache != defaults.management_log_history_cache))
1726 {
1727 msg(M_USAGE,
1728 "--management is not specified, however one or more options which modify the behavior of --management were specified");
1729 }
1730
1731 if ((options->management_client_user || options->management_client_group)
1732 && !(options->management_flags & MF_UNIX_SOCK))
1733 {
1734 msg(M_USAGE, "--management-client-(user|group) can only be used on unix domain sockets");
1735 }
1736
1737 if (options->management_addr && !(options->management_flags & MF_UNIX_SOCK)
1738 && (!options->management_user_pass))
1739 {
1740 msg(M_WARN, "WARNING: Using --management on a TCP port WITHOUT "
1741 "passwords is STRONGLY discouraged and considered insecure");
1742 }
1743
1744#endif /* ifdef ENABLE_MANAGEMENT */
1745
1746#if !defined(HAVE_XKEY_PROVIDER)
1747 if ((tls_version_max() >= TLS_VER_1_3) && (options->management_flags & MF_EXTERNAL_KEY)
1748 && !(options->management_flags & (MF_EXTERNAL_KEY_NOPADDING)))
1749 {
1750 msg(M_FATAL, "management-external-key with TLS 1.3 or later requires "
1751 "nopadding argument/support");
1752 }
1753#endif
1754 /*
1755 * Windows-specific options.
1756 */
1757
1758#ifdef _WIN32
1759 if (dev == DEV_TYPE_TUN
1760 && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
1761 {
1762 msg(M_USAGE, "On Windows, --ifconfig is required when --dev tun is used");
1763 }
1764
1765 if ((options->tuntap_options.ip_win32_defined)
1766 && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
1767 {
1768 msg(M_USAGE, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
1769 }
1770
1771 if (options->tuntap_options.dhcp_options & DHCP_OPTIONS_DHCP_REQUIRED)
1772 {
1773 const char *prefix = "Some --dhcp-option or --dns options require DHCP server";
1774 if (options->windows_driver != WINDOWS_DRIVER_TAP_WINDOWS6)
1775 {
1776 msg(M_USAGE, "%s, which is not supported by the selected %s driver", prefix,
1777 print_tun_backend_driver(options->windows_driver));
1778 }
1779 else if (options->tuntap_options.ip_win32_type != IPW32_SET_DHCP_MASQ
1780 && options->tuntap_options.ip_win32_type != IPW32_SET_ADAPTIVE)
1781 {
1782 msg(M_USAGE, "%s, which requires --ip-win32 dynamic or adaptive", prefix);
1783 }
1784 }
1785#endif /* ifdef _WIN32 */
1786
1787 /*
1788 * Check that protocol options make sense.
1789 */
1790
1791#ifdef ENABLE_FRAGMENT
1792 if (!proto_is_udp(ce->proto) && ce->fragment)
1793 {
1794 msg(M_USAGE, "--fragment can only be used with --proto udp");
1795 }
1796#endif
1797
1798 if (!ce->remote && ce->proto == PROTO_TCP_CLIENT)
1799 {
1800 msg(M_USAGE, "--remote MUST be used in TCP Client mode");
1801 }
1802
1803 if ((ce->http_proxy_options) && ce->proto != PROTO_TCP_CLIENT)
1804 {
1805 msg(M_USAGE, "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
1806 "tcp-client)");
1807 }
1808
1809 if ((ce->http_proxy_options) && !ce->http_proxy_options->server)
1810 {
1811 msg(M_USAGE, "--http-proxy not specified but other http proxy options present");
1812 }
1813
1814 if (ce->http_proxy_options && ce->socks_proxy_server)
1815 {
1816 msg(M_USAGE, "--http-proxy can not be used together with --socks-proxy");
1817 }
1818
1819 if (ce->socks_proxy_server && ce->proto == PROTO_TCP_SERVER)
1820 {
1821 msg(M_USAGE, "--socks-proxy can not be used in TCP Server mode");
1822 }
1823
1824 if (ce->proto == PROTO_TCP_SERVER && (options->connection_list->len > 1))
1825 {
1826 msg(M_USAGE, "TCP server mode allows at most one --remote address");
1827 }
1828
1829 /*
1830 * Check consistency of --mode server options.
1831 */
1832 if (options->mode == MODE_SERVER)
1833 {
1834 const char use_err[] = "--%s cannot be used with --mode server.";
1835
1836#define USAGE_VALID_SERVER_PROTOS \
1837 "--mode server currently only supports " \
1838 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
1839#ifdef TARGET_ANDROID
1840 msg(M_FATAL, "--mode server not supported on Android");
1841#endif
1842 if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP))
1843 {
1844 msg(M_USAGE, "--mode server only works with --dev tun or --dev tap");
1845 }
1846 MUST_BE_UNDEF(pull, "pull");
1847 if (options->pull_filter_list)
1848 {
1849 msg(M_WARN, "--pull-filter ignored for --mode server");
1850 }
1851 if (!(proto_is_udp(ce->proto) || ce->proto == PROTO_TCP_SERVER))
1852 {
1853 msg(M_USAGE, USAGE_VALID_SERVER_PROTOS);
1854 }
1855#if PORT_SHARE
1856 bool has_tcp = false;
1857 for (int i = 0; i < ce->local_list->len && !has_tcp; i++)
1858 {
1859 has_tcp = (ce->local_list->array[i]->proto == PROTO_TCP_SERVER);
1860 }
1861 if ((options->port_share_host || options->port_share_port)
1862 && !has_tcp)
1863 {
1864 msg(M_USAGE, "--port-share only works in TCP server mode "
1865 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
1866 }
1867#endif
1868 if (!options->tls_server)
1869 {
1870 msg(M_USAGE, "--mode server requires --tls-server");
1871 }
1872 MUST_BE_FALSE(ce->remote, "remote");
1873 MUST_BE_FALSE(!ce->bind_local, "nobind");
1874 MUST_BE_FALSE(ce->http_proxy_options, "http-proxy");
1875 MUST_BE_FALSE(ce->socks_proxy_server, "socks-proxy");
1876 /* <connection> blocks force to have a remote embedded, so we check
1877 * for the --remote and bail out if it is present
1878 */
1879 if (options->connection_list->len > 1 || options->connection_list->array[0]->remote)
1880 {
1881 msg(M_USAGE, "<connection> cannot be used with --mode server");
1882 }
1883
1884 MUST_BE_UNDEF(shaper, "shaper");
1885 if (options->ipchange)
1886 {
1887 msg(M_USAGE, "--ipchange cannot be used with --mode server (use "
1888 "--client-connect instead)");
1889 }
1890 if (!(proto_is_dgram(ce->proto) || ce->proto == PROTO_TCP_SERVER))
1891 {
1892 msg(M_USAGE, USAGE_VALID_SERVER_PROTOS);
1893 }
1894 if (!proto_is_udp(ce->proto) && (options->cf_max || options->cf_per))
1895 {
1896 msg(M_USAGE,
1897 "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
1898 }
1899 if (!(dev == DEV_TYPE_TAP || (dev == DEV_TYPE_TUN && options->topology == TOP_SUBNET))
1900 && options->ifconfig_pool_netmask)
1901 {
1902 msg(M_USAGE,
1903 "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
1904 }
1905 if (options->routes && (options->routes->flags & RG_ENABLE))
1906 {
1907 msg(M_USAGE,
1908 "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
1909 }
1910 MUST_BE_UNDEF(route_delay_defined, "route-delay");
1911 MUST_BE_UNDEF(up_delay, "up-delay");
1912 if (!options->ifconfig_pool_defined && !options->ifconfig_ipv6_pool_defined
1913 && options->ifconfig_pool_persist_filename)
1914 {
1915 msg(M_USAGE,
1916 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
1917 }
1918 if (options->ifconfig_ipv6_pool_defined && !options->ifconfig_ipv6_local)
1919 {
1920 msg(M_USAGE, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
1921 }
1922 MUST_BE_UNDEF(allow_recursive_routing, "allow-recursive-routing");
1923 if (options->auth_user_pass_file)
1924 {
1925 msg(M_USAGE,
1926 "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
1927 }
1928 if (options->ccd_exclusive && !options->client_config_dir)
1929 {
1930 msg(M_USAGE, "--ccd-exclusive must be used with --client-config-dir");
1931 }
1932 if (options->auth_token_generate && !options->renegotiate_seconds)
1933 {
1934 msg(M_USAGE, "--auth-gen-token needs a non-infinite "
1935 "--renegotiate_seconds setting");
1936 }
1937 if (options->auth_token_generate && options->auth_token_renewal
1938 && options->auth_token_renewal < 2 * options->handshake_window)
1939 {
1940 msg(M_USAGE,
1941 "--auth-gen-token renewal time needs to be at least "
1942 " two times --hand-window (%d).",
1943 options->handshake_window);
1944 }
1945 if (!options->auth_user_pass_verify_script && !PLUGIN_OPTION_LIST(options)
1946 && !MAN_CLIENT_AUTH_ENABLED(options))
1947 {
1948 const char *use_err =
1949 "--%s must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
1950
1951 MUST_BE_FALSE(options->ssl_flags
1952 & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL),
1953 "verify-client-cert none|optional");
1954 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME,
1955 "username-as-common-name");
1956 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL,
1957 "auth-user-pass-optional");
1958 }
1959
1960 if (options->vlan_tagging && dev != DEV_TYPE_TAP)
1961 {
1962 msg(M_USAGE, "--vlan-tagging must be used with --dev tap");
1963 }
1964 if (!options->vlan_tagging)
1965 {
1966 const char use_err[] = "--%s requires --vlan-tagging";
1967 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
1968 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
1969 }
1970
1971 if (options->server_flags & SF_TCP_NODELAY_HELPER)
1972 {
1973 msg(M_INFO, "NOTE: TCP_NODELAY is always enabled locally; "
1974 "--tcp-nodelay is now only useful to push the flag to "
1975 "clients older than 2.7.6.");
1976 }
1977 }
1978 else
1979 {
1980 const char use_err[] = "--%s requires --mode server";
1981 /*
1982 * When not in server mode, err if parameters are
1983 * specified which require --mode server.
1984 */
1985 MUST_BE_UNDEF(ifconfig_pool_defined, "ifconfig-pool");
1986 MUST_BE_UNDEF(ifconfig_pool_persist_filename, "ifconfig-pool-persist");
1987 MUST_BE_UNDEF(ifconfig_ipv6_pool_defined, "ifconfig-ipv6-pool");
1988 MUST_BE_UNDEF(real_hash_size, "hash-size");
1989 MUST_BE_UNDEF(virtual_hash_size, "hash-size");
1990 MUST_BE_UNDEF(learn_address_script, "learn-address");
1991 MUST_BE_UNDEF(client_connect_script, "client-connect");
1992 MUST_BE_UNDEF(client_crresponse_script, "client-crresponse");
1993 MUST_BE_UNDEF(client_disconnect_script, "client-disconnect");
1994 MUST_BE_UNDEF(client_config_dir, "client-config-dir");
1995 MUST_BE_UNDEF(ccd_exclusive, "ccd-exclusive");
1996 MUST_BE_UNDEF(enable_c2c, "client-to-client");
1997 MUST_BE_UNDEF(duplicate_cn, "duplicate-cn");
1998 MUST_BE_UNDEF(cf_max, "connect-freq");
1999 MUST_BE_UNDEF(cf_per, "connect-freq");
2000 MUST_BE_FALSE(options->ssl_flags
2001 & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL),
2002 "verify-client-cert");
2003 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME, "username-as-common-name");
2004 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL, "auth-user-pass-optional");
2005 if (options->server_flags & SF_TCP_NODELAY_HELPER)
2006 {
2007 msg(M_WARN, "DEPRECATED OPTION: --tcp-nodelay is always enabled on clients");
2008 }
2009 MUST_BE_UNDEF(auth_user_pass_verify_script, "auth-user-pass-verify");
2010 MUST_BE_UNDEF(auth_token_generate, "auth-gen-token");
2011#if PORT_SHARE
2012 if (options->port_share_host || options->port_share_port)
2013 {
2014 msg(M_USAGE,
2015 "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2016 }
2017#endif
2018 MUST_BE_UNDEF(stale_routes_check_interval, "stale-routes-check");
2019 MUST_BE_UNDEF(vlan_tagging, "vlan-tagging");
2020 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2021 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2022 MUST_BE_UNDEF(force_key_material_export, "force-key-material-export");
2023
2024 if (options->push_list.head)
2025 {
2026 msg(M_WARN, "Note: Using --push without --mode server is an "
2027 "unsupported configuration. Negotiation of OpenVPN "
2028 "features is expected to fail.");
2029 }
2030 }
2031
2032 /*
2033 * SSL/TLS mode sanity checks.
2034 */
2035 if (options->tls_server + options->tls_client + (options->shared_secret_file != NULL) > 1)
2036 {
2037 msg(M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
2038 }
2039
2040 if (!options->tls_server && !options->tls_client && !options->test_crypto)
2041 {
2042 msglvl_t msglevel = M_USAGE;
2043 if (options->allow_deprecated_insecure_static_crypto)
2044 {
2045 msglevel = M_INFO;
2046 }
2047
2048 msg(msglevel, "DEPRECATION: No tls-client or tls-server option in "
2049 "configuration detected. OpenVPN 2.8 will remove the "
2050 "functionality to run a VPN without TLS. "
2051 "See the examples section in the manual page for "
2052 "examples of a similar quick setup with peer-fingerprint. "
2053 "OpenVPN 2.7 allows using this configuration when using "
2054 "--allow-deprecated-insecure-static-crypto but you should move "
2055 "to a proper configuration using TLS as soon as possible.");
2056 }
2057
2058 if (options->ssl_flags & (SSLF_CLIENT_CERT_NOT_REQUIRED | SSLF_CLIENT_CERT_OPTIONAL))
2059 {
2060 msg(M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
2061 "--verify-client-cert none|optional "
2062 "may accept clients which do not present a certificate");
2063 }
2064
2065 const unsigned int tls_ver_max =
2066 (options->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) & SSLF_TLS_VERSION_MAX_MASK;
2067 const unsigned int tls_ver_min =
2068 (options->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT) & SSLF_TLS_VERSION_MIN_MASK;
2069
2070 if (tls_ver_max > 0 && tls_ver_max < tls_ver_min)
2071 {
2072 msg(M_USAGE, "--tls-version-min bigger than --tls-version-max");
2073 }
2074
2075 if (options->tls_server || options->tls_client)
2076 {
2077 check_ca_required(options);
2078#ifdef ENABLE_PKCS11
2079 if (!options->pkcs11_providers[0] && options->pkcs11_id)
2080 {
2081 msg(M_WARN, "Option pkcs11-id is ignored as no pkcs11-providers are specified");
2082 }
2083 else if (!options->pkcs11_providers[0] && options->pkcs11_id_management)
2084 {
2085 msg(M_WARN,
2086 "Option pkcs11-id-management is ignored as no pkcs11-providers are specified");
2087 }
2088
2089 if (options->pkcs11_providers[0])
2090 {
2091 if (options->pkcs11_id_management && options->pkcs11_id != NULL)
2092 {
2093 msg(M_USAGE,
2094 "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2095 }
2096 if (!options->pkcs11_id_management && options->pkcs11_id == NULL)
2097 {
2098 msg(M_USAGE,
2099 "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2100 }
2101 const char use_err[] =
2102 "Parameter --%s cannot be used when --pkcs11-provider is also specified.";
2103 MUST_BE_UNDEF(cert_file, "cert");
2104 MUST_BE_UNDEF(priv_key_file, "key");
2105 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2106 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2107 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2108#ifdef ENABLE_CRYPTOAPI
2109 MUST_BE_UNDEF(cryptoapi_cert, "cryptoapicert");
2110#endif
2111 }
2112 else
2113#endif /* ifdef ENABLE_PKCS11 */
2114#ifdef ENABLE_CRYPTOAPI
2115 if (options->cryptoapi_cert)
2116 {
2117 const char use_err[] =
2118 "Parameter --%s cannot be used when --cryptoapicert is also specified.";
2119 MUST_BE_UNDEF(cert_file, "cert");
2120 MUST_BE_UNDEF(priv_key_file, "key");
2121 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2122 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2123 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2124 }
2125 else
2126#endif
2127 if (options->pkcs12_file)
2128 {
2129#ifdef ENABLE_CRYPTO_MBEDTLS
2130 msg(M_USAGE, "Parameter --pkcs12 cannot be used with the mbed TLS version of OpenVPN.");
2131#else
2132 const char use_err[] = "Parameter --%s cannot be used when --pkcs12 is also specified.";
2133 MUST_BE_UNDEF(ca_path, "capath");
2134 MUST_BE_UNDEF(cert_file, "cert");
2135 MUST_BE_UNDEF(priv_key_file, "key");
2136 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2137 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2138#endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2139 }
2140 else /* cert/key from none of pkcs11, pkcs12, cryptoapi */
2141 {
2142 if ((options->management_flags & MF_EXTERNAL_KEY) && options->priv_key_file)
2143 {
2144 msg(M_USAGE, "--key and --management-external-key are mutually exclusive");
2145 }
2146 if ((options->management_flags & MF_EXTERNAL_CERT))
2147 {
2148 if (options->cert_file)
2149 {
2150 msg(M_USAGE, "--cert and --management-external-cert are mutually exclusive");
2151 }
2152 else if (!(options->management_flags & MF_EXTERNAL_KEY))
2153 {
2154 msg(M_USAGE,
2155 "--management-external-cert must be used with --management-external-key");
2156 }
2157 }
2158 if (pull)
2159 {
2160 const int sum =
2161 ((options->cert_file != NULL) || (options->management_flags & MF_EXTERNAL_CERT))
2162 + ((options->priv_key_file != NULL)
2163 || (options->management_flags & MF_EXTERNAL_KEY));
2164
2165 if (sum == 0)
2166 {
2167 if (!options->auth_user_pass_file)
2168 {
2169 msg(M_USAGE, "No client-side authentication method is "
2170 "specified. You must use either "
2171 "--cert/--key, --pkcs12, or "
2172 "--auth-user-pass");
2173 }
2174 }
2175 else if (sum != 2)
2176 {
2177 msg(M_USAGE, "If you use one of --cert or --key, you must use them both");
2178 }
2179 }
2180 else
2181 {
2182 if (!(options->management_flags & MF_EXTERNAL_CERT))
2183 {
2184 notnull(options->cert_file,
2185 "certificate file (--cert) or PKCS#12 file (--pkcs12)");
2186 }
2187 if (!(options->management_flags & MF_EXTERNAL_KEY))
2188 {
2189 notnull(options->priv_key_file,
2190 "private key file (--key) or PKCS#12 file (--pkcs12)");
2191 }
2192 }
2193 }
2194 if (ce->tls_auth_file && ce->tls_crypt_file)
2195 {
2196 msg(M_USAGE, "--tls-auth and --tls-crypt are mutually exclusive");
2197 }
2198 if (options->tls_client && ce->tls_crypt_v2_file
2199 && (ce->tls_auth_file || ce->tls_crypt_file))
2200 {
2201 msg(M_USAGE,
2202 "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
2203 }
2204 }
2205 else
2206 {
2207 /*
2208 * Make sure user doesn't specify any TLS options
2209 * when in non-TLS mode.
2210 */
2211
2212 const char use_err[] = "Parameter %s can only be specified in TLS-mode, "
2213 "i.e. where --tls-server or --tls-client is also specified.";
2214
2215 MUST_BE_UNDEF(ca_file, "ca");
2216 MUST_BE_UNDEF(ca_path, "capath");
2217 MUST_BE_UNDEF(dh_file, "dh");
2218 MUST_BE_UNDEF(cert_file, "cert");
2219 MUST_BE_UNDEF(priv_key_file, "key");
2220#ifndef ENABLE_CRYPTO_MBEDTLS
2221 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2222#endif
2223 MUST_BE_UNDEF(cipher_list, "tls-cipher");
2224 MUST_BE_UNDEF(cipher_list_tls13, "tls-ciphersuites");
2225 MUST_BE_UNDEF(tls_cert_profile, "tls-cert-profile");
2226 MUST_BE_UNDEF(tls_verify, "tls-verify");
2227 MUST_BE_UNDEF(tls_export_peer_cert_dir, "tls-export-cert");
2228 MUST_BE_UNDEF(verify_x509_name, "verify-x509-name");
2229 MUST_BE_UNDEF(tls_timeout, "tls-timeout");
2230 MUST_BE_UNDEF(renegotiate_bytes, "reneg-bytes");
2231 MUST_BE_UNDEF(renegotiate_packets, "reneg-pkts");
2232 MUST_BE_UNDEF(renegotiate_seconds, "reneg-sec");
2233 MUST_BE_UNDEF(handshake_window, "hand-window");
2234 MUST_BE_UNDEF(transition_window, "tran-window");
2235 MUST_BE_UNDEF(tls_auth_file, "tls-auth");
2236 MUST_BE_UNDEF(tls_crypt_file, "tls-crypt");
2237 MUST_BE_UNDEF(tls_crypt_v2_file, "tls-crypt-v2");
2238 MUST_BE_UNDEF(single_session, "single-session");
2239 MUST_BE_UNDEF(push_peer_info, "push-peer-info");
2240 MUST_BE_UNDEF(tls_exit, "tls-exit");
2241 MUST_BE_UNDEF(crl_file, "crl-verify");
2242 MUST_BE_UNDEF(ns_cert_type, "ns-cert-type");
2243 MUST_BE_UNDEF(remote_cert_ku[0], "remote-cert-ku");
2244 MUST_BE_UNDEF(remote_cert_eku, "remote-cert-eku");
2245#ifdef ENABLE_PKCS11
2246 MUST_BE_UNDEF(pkcs11_providers[0], "pkcs11-providers");
2247 MUST_BE_UNDEF(pkcs11_private_mode[0], "pkcs11-private-mode");
2248 MUST_BE_UNDEF(pkcs11_id, "pkcs11-id");
2249 MUST_BE_UNDEF(pkcs11_id_management, "pkcs11-id-management");
2250#endif
2251
2252 if (pull)
2253 {
2254 msg(M_USAGE, use_err, "--pull");
2255 }
2256 }
2257 if (options->auth_user_pass_file && !options->pull)
2258 {
2259 msg(M_USAGE, "--auth-user-pass requires --pull");
2260 }
2261
2262 uninit_options(&defaults);
2263}
2264
2265#undef MUST_BE_UNDEF
2266#undef MUST_BE_FALSE
2267
2268static void
2269options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
2270{
2271 const int dev = dev_type_enum(o->dev, o->dev_type);
2272
2273 if (o->server_defined || o->server_bridge_defined || o->server_bridge_proxy_dhcp)
2274 {
2275 if (ce->proto == PROTO_TCP)
2276 {
2277 ce->proto = PROTO_TCP_SERVER;
2278 o->ce.proto = ce->proto;
2279 }
2280 }
2281
2282 if (o->mode != MODE_SERVER)
2283 {
2284 if (ce->proto == PROTO_TCP)
2285 {
2286 ce->proto = PROTO_TCP_CLIENT;
2287 o->ce.proto = ce->proto;
2288 }
2289 }
2290
2291 /* an option is present that requires local bind to enabled */
2292 bool need_bind = ce->local_port_defined || ce->bind_defined || ce->local_list;
2293
2294 /* socks proxy is enabled */
2295 bool uses_socks = ce->proto == PROTO_UDP && ce->socks_proxy_server;
2296
2297 /* If binding is not forced by an explicit option and we have (at least)
2298 * one of --tcp-client, --pull (or --client), or socks we do not bind
2299 * locally to have "normal" IP client behaviour of a random source port */
2300 if (!need_bind && (ce->proto == PROTO_TCP_CLIENT || uses_socks || o->pull))
2301 {
2302 ce->bind_local = false;
2303 }
2304
2305 if (!ce->bind_local)
2306 {
2307 ce->local_port = NULL;
2308 }
2309
2310 /* if protocol forcing is enabled, disable all protocols
2311 * except for the forced one
2312 */
2313 if (o->proto_force >= 0 && o->proto_force != ce->proto)
2314 {
2315 ce->flags |= CE_DISABLED;
2316 }
2317
2318 if (ce->http_proxy_options)
2319 {
2320 ce->http_proxy_options->nocache = ssl_get_auth_nocache();
2321 }
2322
2323 /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
2324 * so fall back to IPv4-only (trac #1221)
2325 */
2326 if (ce->socks_proxy_server && proto_is_udp(ce->proto) && ce->af != AF_INET)
2327 {
2328 if (ce->af == AF_INET6)
2329 {
2330 msg(M_INFO, "WARNING: '--proto udp6' is not compatible with "
2331 "'--socks-proxy' today. Forcing IPv4 mode.");
2332 }
2333 else
2334 {
2335 msg(M_INFO, "NOTICE: dual-stack mode for '--proto udp' does not "
2336 "work correctly with '--socks-proxy' today. Forcing IPv4.");
2337 }
2338 ce->af = AF_INET;
2339 }
2340
2341 /*
2342 * Set MTU defaults
2343 */
2344 {
2345 if (!ce->tun_mtu_defined && !ce->link_mtu_defined)
2346 {
2347 ce->tun_mtu_defined = true;
2348 }
2349 if ((dev == DEV_TYPE_TAP) && !ce->tun_mtu_extra_defined)
2350 {
2351 ce->tun_mtu_extra_defined = true;
2352 ce->tun_mtu_extra = TAP_MTU_EXTRA_DEFAULT;
2353 }
2354 }
2355
2356 /*
2357 * If --mssfix is supplied without a parameter or not specified at all,
2358 * default it to --fragment value, if --fragment is specified and otherwise
2359 * to the default if tun-mtu is 1500
2360 */
2361 if (o->ce.mssfix_default)
2362 {
2363#ifdef ENABLE_FRAGMENT
2364 if (ce->fragment)
2365 {
2366 ce->mssfix = ce->fragment;
2367 }
2368 else
2369#endif
2370 if (ce->tun_mtu_defined)
2371 {
2372 if (o->ce.tun_mtu == TUN_MTU_DEFAULT)
2373 {
2374 /* We want to only set mssfix default value if we use a default
2375 * MTU Size, otherwise the different size of tun should either
2376 * already solve the problem or mssfix might artifically make the
2377 * payload packets smaller without mssfix 0 */
2378 ce->mssfix = MSSFIX_DEFAULT;
2379 ce->mssfix_encap = true;
2380 }
2381 else
2382 {
2383 /* We still apply the mssfix value but only adjust it to the
2384 * size of the tun interface. */
2385 ce->mssfix = ce->tun_mtu;
2386 ce->mssfix_fixed = true;
2387 }
2388 }
2389 }
2390
2391 /*
2392 * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
2393 *
2394 * At the end only one of these will be really set because the parser
2395 * logic prevents configurations where more are set.
2396 */
2397 if (!ce->tls_auth_file && !ce->tls_crypt_file && !ce->tls_crypt_v2_file)
2398 {
2399 ce->tls_auth_file = o->tls_auth_file;
2400 ce->tls_auth_file_inline = o->tls_auth_file_inline;
2401 ce->key_direction = o->key_direction;
2402
2403 ce->tls_crypt_file = o->tls_crypt_file;
2404 ce->tls_crypt_file_inline = o->tls_crypt_file_inline;
2405
2406 ce->tls_crypt_v2_file = o->tls_crypt_v2_file;
2407 ce->tls_crypt_v2_file_inline = o->tls_crypt_v2_file_inline;
2408 }
2409
2410 /* Pre-cache tls-auth/crypt(-v2) key file if
2411 * keys were not already embedded in the config file.
2412 */
2413 connection_entry_preload_key(&ce->tls_auth_file, &ce->tls_auth_file_inline, &o->gc);
2414 connection_entry_preload_key(&ce->tls_crypt_file, &ce->tls_crypt_file_inline, &o->gc);
2415 connection_entry_preload_key(&ce->tls_crypt_v2_file, &ce->tls_crypt_v2_file_inline, &o->gc);
2416
2417
2418 if (!proto_is_udp(ce->proto) && ce->explicit_exit_notification)
2419 {
2420 msg(M_WARN, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
2421 ce->explicit_exit_notification = 0;
2422 }
2423}
2424
2425static void
2426options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
2427{
2428 /* use the global port if none is specified */
2429 if (!le->port)
2430 {
2431 le->port = ce->local_port;
2432 }
2433 /* use the global proto if none is specified and
2434 * allow proto bindings on server mode only */
2435 if (!le->proto || mode == MODE_POINT_TO_POINT)
2436 {
2437 le->proto = ce->proto;
2438 }
2439}
2440
2441#ifdef _WIN32
2442/* If iservice is in use, we need def1 method for redirect-gateway */
2443static void
2444remap_redirect_gateway_flags(struct options *opt)
2445{
2446 if (opt->routes && opt->route_method == ROUTE_METHOD_SERVICE
2447 && opt->routes->flags & RG_REROUTE_GW && !(opt->routes->flags & RG_DEF1))
2448 {
2449 msg(M_INFO, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
2450 opt->routes->flags |= RG_DEF1;
2451 }
2452}
2453#endif /* ifdef _WIN32 */
2454
2455/*
2456 * Save/Restore certain option defaults before --pull is applied.
2457 */
2458
2459static void
2460pre_connect_save(struct options *o)
2461{
2462 ALLOC_OBJ_CLEAR_GC(o->pre_connect, struct options_pre_connect, &o->gc);
2463 o->pre_connect->tuntap_options = o->tuntap_options;
2464 o->pre_connect->tuntap_options_defined = true;
2465 o->pre_connect->foreign_option_index = o->foreign_option_index;
2466
2467 if (o->routes)
2468 {
2469 o->pre_connect->routes = clone_route_option_list(o->routes, &o->gc);
2470 o->pre_connect->routes_defined = true;
2471 }
2472 if (o->routes_ipv6)
2473 {
2474 o->pre_connect->routes_ipv6 = clone_route_ipv6_option_list(o->routes_ipv6, &o->gc);
2475 o->pre_connect->routes_ipv6_defined = true;
2476 }
2477 if (o->client_nat)
2478 {
2479 o->pre_connect->client_nat = clone_client_nat_option_list(o->client_nat, &o->gc);
2480 o->pre_connect->client_nat_defined = true;
2481 }
2482
2483 o->pre_connect->ifconfig_local = o->ifconfig_local;
2484 o->pre_connect->ifconfig_ipv6_local = o->ifconfig_ipv6_local;
2485
2486 o->pre_connect->route_default_gateway = o->route_default_gateway;
2487 o->pre_connect->route_ipv6_default_gateway = o->route_ipv6_default_gateway;
2488
2489 o->pre_connect->dns_options = clone_dns_options(&o->dns_options, &o->gc);
2490
2491 /* NCP related options that can be overwritten by a push */
2492 o->pre_connect->ciphername = o->ciphername;
2493 o->pre_connect->authname = o->authname;
2494
2495 /* Ping related options should be reset to the config values on reconnect */
2496 o->pre_connect->ping_rec_timeout = o->ping_rec_timeout;
2497 o->pre_connect->ping_rec_timeout_action = o->ping_rec_timeout_action;
2498 o->pre_connect->ping_send_timeout = o->ping_send_timeout;
2499
2500 /* Miscellaneous Options */
2501 o->pre_connect->comp = o->comp;
2502}
2503
2504void
2505pre_connect_restore(struct options *o, struct gc_arena *gc)
2506{
2507 const struct options_pre_connect *pp = o->pre_connect;
2508 if (pp)
2509 {
2510 CLEAR(o->tuntap_options);
2511 if (pp->tuntap_options_defined)
2512 {
2513 o->tuntap_options = pp->tuntap_options;
2514 }
2515
2516 if (pp->routes_defined)
2517 {
2518 rol_check_alloc(o);
2519 copy_route_option_list(o->routes, pp->routes, gc);
2520 }
2521 else
2522 {
2523 o->routes = NULL;
2524 }
2525
2526 if (pp->routes_ipv6_defined)
2527 {
2528 rol6_check_alloc(o);
2529 copy_route_ipv6_option_list(o->routes_ipv6, pp->routes_ipv6, gc);
2530 }
2531 else
2532 {
2533 o->routes_ipv6 = NULL;
2534 }
2535
2536 o->ifconfig_local = pp->ifconfig_local;
2537 o->ifconfig_ipv6_local = pp->ifconfig_ipv6_local;
2538
2539 o->route_default_gateway = pp->route_default_gateway;
2540 o->route_ipv6_default_gateway = pp->route_ipv6_default_gateway;
2541
2542 /* Free DNS options and reset them to pre-pull state */
2543 gc_free(&o->dns_options.gc);
2544 struct gc_arena dns_gc = gc_new();
2545 o->dns_options = clone_dns_options(&pp->dns_options, &dns_gc);
2546 o->dns_options.gc = dns_gc;
2547
2548 if (pp->client_nat_defined)
2549 {
2550 cnol_check_alloc(o);
2551 copy_client_nat_option_list(o->client_nat, pp->client_nat);
2552 }
2553 else
2554 {
2555 o->client_nat = NULL;
2556 }
2557
2558 o->foreign_option_index = pp->foreign_option_index;
2559
2560 o->ciphername = pp->ciphername;
2561 o->authname = pp->authname;
2562
2563 o->ping_rec_timeout = pp->ping_rec_timeout;
2564 o->ping_rec_timeout_action = pp->ping_rec_timeout_action;
2565 o->ping_send_timeout = pp->ping_send_timeout;
2566
2567 /* Miscellaneous Options */
2568 o->comp = pp->comp;
2569 }
2570
2571 o->push_continuation = 0;
2572 o->push_option_types_found = 0;
2573 o->push_update_options_found = 0;
2574 o->imported_protocol_flags = 0;
2575}
2576
2577static void
2578options_postprocess_mutate_invariant(struct options *options)
2579{
2580#ifdef _WIN32
2581 const int dev = dev_type_enum(options->dev, options->dev_type);
2582
2583 /* when using ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
2584 if ((options->windows_driver == DRIVER_DCO)
2585 && (options->tuntap_options.ip_win32_type == IPW32_SET_DHCP_MASQ
2586 || options->tuntap_options.ip_win32_type == IPW32_SET_ADAPTIVE))
2587 {
2588 options->tuntap_options.ip_win32_type = IPW32_SET_NETSH;
2589 }
2590
2591 if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
2592 {
2593 /* delay may only be necessary when we perform DHCP handshake */
2594 const bool dhcp = (options->tuntap_options.ip_win32_type == IPW32_SET_DHCP_MASQ)
2595 || (options->tuntap_options.ip_win32_type == IPW32_SET_ADAPTIVE);
2596 if ((options->mode == MODE_POINT_TO_POINT) && dhcp)
2597 {
2598 options->route_delay_defined = true;
2599 options->route_delay = 5; /* Vista sometimes has a race without this */
2600 }
2601 }
2602
2603 if (options->ifconfig_noexec)
2604 {
2605 options->tuntap_options.ip_win32_type = IPW32_SET_MANUAL;
2606 options->ifconfig_noexec = false;
2607 }
2608
2609 remap_redirect_gateway_flags(options);
2610
2611 /*
2612 * Check consistency of --mode server options.
2613 */
2614 if (options->mode == MODE_SERVER)
2615 {
2616 /*
2617 * We need to explicitly set --tap-sleep because
2618 * we do not schedule event timers in the top-level context.
2619 */
2620 options->tuntap_options.tap_sleep = 10;
2621 if (options->route_delay_defined && options->route_delay)
2622 {
2623 options->tuntap_options.tap_sleep = options->route_delay;
2624 }
2625 options->route_delay_defined = false;
2626 }
2627#endif /* ifdef _WIN32 */
2628
2629#ifdef DEFAULT_PKCS11_MODULE
2630 /* If p11-kit is present on the system then load its p11-kit-proxy.so
2631 * by default if the user asks for PKCS#11 without otherwise specifying
2632 * the module to use. */
2633 if (!options->pkcs11_providers[0] && (options->pkcs11_id || options->pkcs11_id_management))
2634 {
2635 options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
2636 }
2637#endif
2638}
2639
2640static void
2641options_postprocess_verify(const struct options *o)
2642{
2643 if (o->connection_list)
2644 {
2645 int i;
2646 for (i = 0; i < o->connection_list->len; ++i)
2647 {
2648 options_postprocess_verify_ce(o, o->connection_list->array[i]);
2649 }
2650 }
2651 else
2652 {
2653 options_postprocess_verify_ce(o, &o->ce);
2654 }
2655
2656 dns_options_verify(M_FATAL, &o->dns_options);
2657
2658 if (dco_enabled(o))
2659 {
2660 if (o->enable_c2c)
2661 {
2662 msg(M_WARN, "Note: --client-to-client has no effect when using data "
2663 "channel offload: packets are always sent to the VPN "
2664 "interface and then routed based on the system routing table");
2665 }
2666
2667 if (o->renegotiate_bytes > 0 || o->renegotiate_packets)
2668 {
2669 msg(M_WARN, "Note: '--reneg-bytes' and '--reneg-pkts' are not supported "
2670 "by data channel offload; automatic key renegotiation "
2671 "mechanisms are sufficient for modern ciphers. "
2672 "Ignoring these options.");
2673 }
2674 }
2675}
2676
2677static void
2678options_postprocess_cipher(struct options *o)
2679{
2680 if (!o->pull && !(o->mode == MODE_SERVER))
2681 {
2682 /* If the cipher is not set, use the old default of BF-CBC. We will
2683 * warn that this is deprecated on cipher initialisation, no need
2684 * to warn here as well */
2685 if (!o->ciphername)
2686 {
2687 o->ciphername = "BF-CBC";
2688 }
2689 else
2690 {
2691 o->enable_ncp_fallback = true;
2692 }
2693 return;
2694 }
2695
2696 /* pull or P2MP mode */
2697 if (!o->ciphername)
2698 {
2699 /* We still need to set the ciphername to BF-CBC since various other
2700 * parts of OpenVPN assert that the ciphername is set */
2701 o->ciphername = "BF-CBC";
2702
2703 msg(M_INFO,
2704 "Note: --cipher is not set. OpenVPN versions before 2.5 "
2705 "defaulted to BF-CBC as fallback when cipher negotiation "
2706 "failed in this case. If you need this fallback please add "
2707 "'--data-ciphers-fallback BF-CBC' to your configuration "
2708 "and/or add BF-CBC to --data-ciphers. E.g. "
2709 "--data-ciphers %s:BF-CBC",
2710 o->ncp_ciphers_conf);
2711 }
2712 else if (!o->enable_ncp_fallback && !tls_item_in_cipher_list(o->ciphername, o->ncp_ciphers))
2713 {
2714 msg(M_WARN,
2715 "DEPRECATED OPTION: --cipher set to '%s' but missing in "
2716 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
2717 "negotiations. ",
2718 o->ciphername, o->ncp_ciphers_conf);
2719 }
2720}
2721
2737static bool
2738need_compatibility_before(const struct options *o, unsigned int version)
2739{
2740 return o->backwards_compatible != 0 && o->backwards_compatible < version;
2741}
2742
2747static void
2748options_set_backwards_compatible_options(struct options *o)
2749{
2750 /* TLS min version is not set */
2751 unsigned int tls_ver_min = (o->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT) & SSLF_TLS_VERSION_MIN_MASK;
2752 if (tls_ver_min == 0)
2753 {
2754 unsigned int tls_ver_max = (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT) & SSLF_TLS_VERSION_MAX_MASK;
2755 if (need_compatibility_before(o, 20307))
2756 {
2757 /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
2758 o->ssl_flags |= (TLS_VER_1_0 << SSLF_TLS_VERSION_MIN_SHIFT);
2759 }
2760 else if (tls_ver_max == 0 || tls_ver_max >= TLS_VER_1_2)
2761 {
2762 /* Use TLS 1.2 as proper default */
2763 o->ssl_flags |= (TLS_VER_1_2 << SSLF_TLS_VERSION_MIN_SHIFT);
2764 }
2765 else
2766 {
2767 /* Maximize the minimum version */
2768 o->ssl_flags |= (tls_ver_max << SSLF_TLS_VERSION_MIN_SHIFT);
2769 }
2770 }
2771
2772 if (need_compatibility_before(o, 20400))
2773 {
2774 if (!o->ciphername)
2775 {
2776 /* If ciphername is not set default to BF-CBC when targeting these
2777 * old versions that do not have NCP */
2778 o->ciphername = "BF-CBC";
2779 }
2780 /* Versions < 2.4.0 additionally might be compiled with --enable-small and
2781 * not have OCC strings required for "poor man's NCP" */
2782 o->enable_ncp_fallback = true;
2783 }
2784
2785 /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
2786 * Version 2.4 probably does not need it but NCP was not so
2787 * good with 2.4 and ncp-disable might be more common on 2.4 peers.
2788 * Only do this iff --cipher is set (explicitly or by compat mode
2789 * < 2.4.0, see above). This is not 100% correct backwards compatible
2790 * behaviour but 2.5 already behaved like this */
2791 if (o->ciphername && need_compatibility_before(o, 20500)
2792 && !tls_item_in_cipher_list(o->ciphername, o->ncp_ciphers))
2793 {
2794 append_cipher_to_ncp_list(o, o->ciphername);
2795 }
2796
2797#ifdef USE_COMP
2798 /* Compression is deprecated and we do not want to announce support for it
2799 * by default anymore, additionally DCO breaks with compression.
2800 *
2801 * Disable compression by default starting with 2.6.0 if no other
2802 * compression related option has been explicitly set */
2803 if (!need_compatibility_before(o, 20600) && (o->comp.flags == 0))
2804 {
2805 if (!comp_non_stub_enabled(&o->comp))
2806 {
2807 o->comp.flags = COMP_F_ALLOW_STUB_ONLY | COMP_F_ADVERTISE_STUBS_ONLY;
2808 }
2809 }
2810#else /* ifdef USE_COMP */
2811 o->comp.flags = COMP_F_ALLOW_NOCOMP_ONLY;
2812#endif
2813}
2814
2815static void
2816options_process_mutate_prf(struct options *o)
2817{
2818 if (!check_tls_prf_working())
2819 {
2820 msg(D_TLS_ERRORS, "Warning: TLS 1.0 PRF with MD5+SHA1 PRF is not "
2821 "supported by the TLS library. Your system does not support this "
2822 "calculation anymore or your security policy (e.g. FIPS 140-2) "
2823 "forbids it. Connections will only work with peers running "
2824 "OpenVPN 2.6.0 or higher)");
2825 if (o->mode == MODE_SERVER)
2826 {
2827 msg(M_WARN, "Automatically enabling option "
2828 "--force-tls-key-material-export");
2829 o->force_key_material_export = true;
2830 }
2831 }
2832}
2833
2834#if defined(_WIN32) || defined(TARGET_ANDROID)
2843static void
2844tuntap_options_postprocess_dns(struct options *o)
2845{
2846 struct dns_options *dns = &o->dns_options;
2847 struct tuntap_options *tt = &o->tuntap_options;
2848 if (!dns->servers)
2849 {
2850 /* Copy --dhcp-options to tuntap_options */
2851 struct dhcp_options *dhcp = &dns->from_dhcp;
2852 ASSERT(sizeof(dhcp->dns) == sizeof(tt->dns));
2853 ASSERT(sizeof(dhcp->dns6) == sizeof(tt->dns6));
2854 ASSERT(sizeof(dhcp->domain_search_list) == sizeof(tt->domain_search_list));
2855
2856 tt->domain = dhcp->domain;
2857 tt->dns_len = dhcp->dns_len;
2858 tt->dns6_len = dhcp->dns6_len;
2859
2860 memcpy(tt->dns, dhcp->dns, sizeof(tt->dns));
2861 memcpy(tt->dns6, dhcp->dns6, sizeof(tt->dns6));
2862
2863 tt->domain_search_list_len = dhcp->domain_search_list_len;
2864 for (size_t i = 0; i < SIZE(tt->domain_search_list); ++i)
2865 {
2866 tt->domain_search_list[i] = dhcp->domain_search_list[i];
2867 }
2868
2869 return;
2870 }
2871
2872#if defined(_WIN32)
2873 if (tt->ip_win32_type != IPW32_SET_DHCP_MASQ && tt->ip_win32_type != IPW32_SET_ADAPTIVE)
2874 {
2875 return; /* Not in DHCP mode */
2876 }
2877#endif /* if defined(_WIN32) */
2878
2879 /* Copy --dns options to tuntap_options */
2880
2881 const struct dns_domain *d = dns->search_domains;
2882 if (d)
2883 {
2884 tt->domain_search_list_len = 0;
2885 }
2886
2887 while (d && tt->domain_search_list_len + 1 < N_SEARCH_LIST_LEN)
2888 {
2889 tt->domain_search_list[tt->domain_search_list_len++] = d->name;
2890 d = d->next;
2891 }
2892 if (d)
2893 {
2894 msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to TUN/TAP");
2895 }
2896
2897 tt->dns_len = 0;
2898 tt->dns6_len = 0;
2899
2900 const struct dns_server *s = dns->servers;
2901 while (s)
2902 {
2903 bool non_standard_server_port = false;
2904 for (size_t i = 0; i < s->addr_count; ++i)
2905 {
2906 if (s->addr[i].port && s->addr[i].port != 53)
2907 {
2908 non_standard_server_port = true;
2909 break;
2910 }
2911 }
2912 if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN)
2913 || (s->dnssec && s->dnssec != DNS_SECURITY_NO) || non_standard_server_port)
2914 {
2915 /* Skip servers requiring unsupported config to be set */
2916 s = s->next;
2917 }
2918 else
2919 {
2920 bool overflow = false;
2921 for (size_t i = 0; i < s->addr_count; ++i)
2922 {
2923 if (s->addr[i].family == AF_INET && tt->dns_len + 1 < N_DHCP_ADDR)
2924 {
2925 tt->dns[tt->dns_len++] = ntohl(s->addr[i].in.a4.s_addr);
2926 }
2927 else if (tt->dns6_len + 1 < N_DHCP_ADDR)
2928 {
2929 tt->dns6[tt->dns6_len++] = s->addr[i].in.a6;
2930 }
2931 else
2932 {
2933 overflow = true;
2934 }
2935 }
2936 if (overflow)
2937 {
2938 msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to TUN/TAP");
2939 }
2940 tt->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
2941 return;
2942 }
2943 }
2944}
2945
2946#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
2947
2958static void
2959dhcp_options_postprocess_dns(struct options *o, struct env_set *es)
2960{
2961 struct gc_arena gc = gc_new();
2962 struct dns_options *dns = &o->dns_options;
2963
2964 if (is_tun_afunix(o->dev_node))
2965 {
2966 /* Disable running dns-updown script with lwipovpn */
2967 dns->updown_flags = DNS_UPDOWN_NO_FLAGS;
2968 dns->updown = NULL;
2969 }
2970
2971 if (dns->servers || dns_updown_user_set(dns) || dns_updown_forced(dns))
2972 {
2973 /* Clean up env from --dhcp-option DNS config */
2974 struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
2975 struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
2976
2977 const int fo_count = o->foreign_option_index;
2978 o->foreign_option_index = 0;
2979
2980 for (int i = 1; i <= fo_count; ++i)
2981 {
2982 buf_clear(&name);
2983 buf_printf(&name, "foreign_option_%d", i);
2984 const char *env_str = env_set_get(es, BSTR(&name));
2985 const char *item_val = strchr(env_str, '=') + 1;
2986 buf_clear(&value);
2987 buf_printf(&value, "%s", item_val);
2988
2989 /* Remove foreign option item from env set */
2990 env_set_del(es, BSTR(&name));
2991
2992 item_val = BSTR(&value);
2993 if (strncmp(item_val, "dhcp-option ", 12) != 0
2994 || (strncmp(item_val + 12, "ADAPTER-DOMAIN-SUFFIX ", 22) != 0
2995 && strncmp(item_val + 12, "DOMAIN-SEARCH ", 14) != 0
2996 && strncmp(item_val + 12, "DOMAIN ", 7) != 0
2997 && strncmp(item_val + 12, "DNS6 ", 5) != 0
2998 && strncmp(item_val + 12, "DNS ", 4) != 0))
2999 {
3000 /* Re-set the item with potentially updated name */
3001 buf_clear(&name);
3002 buf_printf(&name, "foreign_option_%d", ++o->foreign_option_index);
3003 setenv_str(es, BSTR(&name), BSTR(&value));
3004 }
3005 }
3006 }
3007
3008 if (!dns->servers)
3009 {
3010 /* Copy --dhcp-options to dns_options */
3011 struct dhcp_options *dhcp = &dns->from_dhcp;
3012
3013 if (dhcp->dns_len || dhcp->dns6_len)
3014 {
3015 struct dns_domain **entry = &dns->search_domains;
3016 ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc);
3017 struct dns_domain *domain = *entry;
3018 domain->name = dhcp->domain;
3019 entry = &domain->next;
3020
3021 for (unsigned int i = 0; i < dhcp->domain_search_list_len; ++i)
3022 {
3023 ALLOC_OBJ_CLEAR_GC(*entry, struct dns_domain, &dns->gc);
3024 struct dns_domain *search_domain = *entry;
3025 search_domain->name = dhcp->domain_search_list[i];
3026 entry = &search_domain->next;
3027 }
3028
3029 struct dns_server *server = dns_server_get(&dns->servers, 0, &dns->gc);
3030 const size_t max_addrs = SIZE(server->addr);
3031 for (unsigned int i = 0; i < dhcp->dns_len && server->addr_count < max_addrs; ++i)
3032 {
3033 server->addr[server->addr_count].in.a4.s_addr = htonl(dhcp->dns[i]);
3034 server->addr[server->addr_count].family = AF_INET;
3035 server->addr_count += 1;
3036 }
3037 for (unsigned int i = 0; i < dhcp->dns6_len && server->addr_count < max_addrs; ++i)
3038 {
3039 server->addr[server->addr_count].in.a6 = dhcp->dns6[i];
3040 server->addr[server->addr_count].family = AF_INET6;
3041 server->addr_count += 1;
3042 }
3043 }
3044 }
3045 else if (o->up_script && !dns_updown_user_set(dns) && !dns_updown_forced(dns))
3046 {
3047 /* Set foreign option env vars from --dns config */
3048 const struct dns_domain *d = dns->search_domains;
3049 while (d)
3050 {
3051 setenv_foreign_option(o, "DOMAIN", d->name, es);
3052 d = d->next;
3053 }
3054
3055 const struct dns_server *s = dns->servers;
3056 while (s)
3057 {
3058 bool non_standard_server_port = false;
3059 for (size_t i = 0; i < s->addr_count; ++i)
3060 {
3061 if (s->addr[i].port && s->addr[i].port != 53)
3062 {
3063 non_standard_server_port = true;
3064 break;
3065 }
3066 }
3067 if ((s->transport && s->transport != DNS_TRANSPORT_PLAIN)
3068 || (s->dnssec && s->dnssec != DNS_SECURITY_NO) || non_standard_server_port)
3069 {
3070 /* Skip servers requiring unsupported config to be set */
3071 s = s->next;
3072 }
3073 else
3074 {
3075 for (size_t i = 0; i < s->addr_count; ++i)
3076 {
3077 const char *option;
3078 const char *value;
3079 if (s->addr[i].family == AF_INET)
3080 {
3081 option = "DNS";
3082 value = print_in_addr_t(s->addr[i].in.a4.s_addr, IA_NET_ORDER, &gc);
3083 }
3084 else
3085 {
3086 option = "DNS6";
3087 value = print_in6_addr(s->addr[i].in.a6, 0, &gc);
3088 }
3089 setenv_foreign_option(o, option, value, es);
3090 }
3091 break;
3092 }
3093 }
3094 }
3095
3096 gc_free(&gc);
3097}
3098#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
3103static void
3104helper_hashmap_sizes(struct options *o)
3105{
3106 if (!o->real_hash_size)
3107 {
3108 o->real_hash_size = 4 * o->max_clients;
3109 }
3110 if (!o->virtual_hash_size)
3111 {
3112 o->virtual_hash_size = 4 * o->max_clients;
3113 }
3114}
3115
3116static void
3117options_postprocess_mutate(struct options *o, struct env_set *es)
3118{
3119 /*
3120 * Process helper-type options which map to other, more complex
3121 * sequences of options.
3122 */
3123 helper_client_server(o);
3124 /* must be called after helpers that might set --mode */
3125 helper_setdefault_topology(o);
3126 helper_keepalive(o);
3127 helper_tcp_nodelay(o);
3128
3129 if (o->mode == MODE_SERVER)
3130 {
3131 helper_hashmap_sizes(o);
3132 }
3133
3134 options_postprocess_setdefault_ncpciphers(o);
3135 options_set_backwards_compatible_options(o);
3136 options_process_mutate_prf(o);
3137
3138 options_postprocess_cipher(o);
3139 o->ncp_ciphers = mutate_ncp_cipher_list(o->ncp_ciphers, &o->gc);
3140 if (o->ncp_ciphers == NULL)
3141 {
3142 msg(M_USAGE, "--data-ciphers list contains unsupported ciphers or is too long.");
3143 }
3144
3145 if (o->remote_list && !o->connection_list)
3146 {
3147 /*
3148 * Convert remotes into connection list
3149 */
3150 const struct remote_list *rl = o->remote_list;
3151 for (int i = 0; i < rl->len; ++i)
3152 {
3153 const struct remote_entry *re = rl->array[i];
3154 struct connection_entry ce = o->ce;
3155 struct connection_entry *ace;
3156
3157 ASSERT(re->remote);
3158 connection_entry_load_re(&ce, re);
3159 ace = alloc_connection_entry(o, M_USAGE);
3160 ASSERT(ace);
3161 *ace = ce;
3162 }
3163 }
3164 else if (!o->remote_list && !o->connection_list)
3165 {
3166 struct connection_entry *ace;
3167 ace = alloc_connection_entry(o, M_USAGE);
3168 ASSERT(ace);
3169 *ace = o->ce;
3170 }
3171
3172 ASSERT(o->connection_list);
3173 for (int i = 0; i < o->connection_list->len; ++i)
3174 {
3175 options_postprocess_mutate_ce(o, o->connection_list->array[i]);
3176 }
3177
3178 if (o->ce.local_list)
3179 {
3180 for (int i = 0; i < o->ce.local_list->len; i++)
3181 {
3182 options_postprocess_mutate_le(&o->ce, o->ce.local_list->array[i], o->mode);
3183 }
3184
3185 for (int i = 0; i < o->ce.local_list->len; i++)
3186 {
3187 if (o->ce.local_list->array[i]->proto == PROTO_TCP)
3188 {
3189 o->ce.local_list->array[i]->proto = PROTO_TCP_SERVER;
3190 }
3191 else if (o->ce.local_list->array[i]->proto == PROTO_NONE)
3192 {
3193 o->ce.local_list->array[i]->proto = o->ce.proto;
3194 }
3195 }
3196 }
3197 else
3198 {
3199 /* if no 'local' directive was specified, convert the global port
3200 * setting to a listen entry */
3201 struct local_entry *e = alloc_local_entry(&o->ce, M_USAGE, &o->gc);
3202 ASSERT(e);
3203 e->port = o->ce.local_port;
3204 e->proto = o->ce.proto;
3205 }
3206
3207 /* use the same listen list for every outgoing connection */
3208 for (int i = 0; i < o->connection_list->len; ++i)
3209 {
3210 o->connection_list->array[i]->local_list = o->ce.local_list;
3211 }
3212
3213 if (o->tls_server)
3214 {
3215 if (o->dh_file && streq(o->dh_file, "none"))
3216 {
3217 o->dh_file = NULL;
3218 }
3219 }
3220 else if (o->dh_file)
3221 {
3222 /* DH file is only meaningful in a tls-server context. */
3223 msg(M_WARN, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3224 "include this in your server configuration");
3225 o->dh_file = NULL;
3226 }
3227#if ENABLE_MANAGEMENT
3228 if (o->http_proxy_override)
3229 {
3230 options_postprocess_http_proxy_override(o);
3231 }
3232#endif
3233 if (!o->ca_file && !o->ca_path && o->verify_hash && o->verify_hash_depth == 0)
3234 {
3235 msg(M_INFO, "Using certificate fingerprint to verify peer (no CA "
3236 "option set). ");
3237 o->verify_hash_no_ca = true;
3238 }
3239
3240 if (o->config && streq(o->config, "stdin") && o->remap_sigusr1 == SIGHUP)
3241 {
3242 msg(M_USAGE, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3243 "incompatible with each other.");
3244 }
3245
3246 if (dco_enabled(o))
3247 {
3248 /* check if any option should force disabling DCO */
3249 o->disable_dco = !dco_check_option(D_DCO, o) || !dco_check_startup_option(D_DCO, o);
3250 }
3251#ifdef USE_COMP
3252 if (dco_enabled(o))
3253 {
3254 o->comp.flags |= COMP_F_ALLOW_NOCOMP_ONLY;
3255 }
3256#endif
3257
3258#ifdef _WIN32
3259 if (dco_enabled(o))
3260 {
3261 o->windows_driver = DRIVER_DCO;
3262 }
3263 else
3264 {
3265 o->windows_driver = WINDOWS_DRIVER_TAP_WINDOWS6;
3266 }
3267#else /* _WIN32 */
3268 if (dco_enabled(o) && o->dev_node)
3269 {
3270 msg(M_WARN, "Note: ignoring --dev-node as it has no effect when using "
3271 "data channel offload");
3272 o->dev_node = NULL;
3273 }
3274#endif /* _WIN32 */
3275
3276 /* this depends on o->windows_driver, which is set above */
3277 options_postprocess_mutate_invariant(o);
3278
3279 /* check that compression settings in the options are okay */
3280 check_compression_settings_valid(&o->comp, M_USAGE);
3281
3282 /*
3283 * Save certain parms before modifying options during connect, especially
3284 * when using --pull
3285 */
3286 if (o->pull)
3287 {
3288 dns_options_preprocess_pull(&o->dns_options);
3289 }
3290 else
3291 {
3292#if defined(_WIN32) || defined(TARGET_ANDROID)
3293 tuntap_options_postprocess_dns(o);
3294#else
3295 dhcp_options_postprocess_dns(o, es);
3296#endif
3297 }
3298 if (o->auth_token_generate && !o->auth_token_renewal)
3299 {
3300 o->auth_token_renewal = o->renegotiate_seconds;
3301 }
3302#if ENABLE_MANAGEMENT
3303 if (o->auth_user_pass_username_only && o->sc_info.challenge_text)
3304 {
3305 msg(M_USAGE, "'auth-user-pass username-only' cannot be used with static challenge");
3306 }
3307#endif
3308 pre_connect_save(o);
3309}
3310
3311/*
3312 * Sanity check on options.
3313 * Also set some options based on other
3314 * options.
3315 */
3316void
3317options_postprocess(struct options *options, struct env_set *es)
3318{
3319 options_postprocess_mutate(options, es);
3320 options_postprocess_verify(options);
3321#ifndef ENABLE_SMALL
3322 options_postprocess_filechecks(options);
3323#endif /* !ENABLE_SMALL */
3324}
3325
3326/*
3327 * Sanity check on options after more options were pulled from server.
3328 * Also time to modify some options based on other options.
3329 */
3330bool
3331options_postprocess_pull(struct options *o, struct env_set *es)
3332{
3333 bool success = dns_options_verify(D_PUSH_ERRORS, &o->dns_options);
3334 if (success)
3335 {
3336 dns_options_postprocess_pull(&o->dns_options);
3337#if defined(_WIN32) || defined(TARGET_ANDROID)
3338 tuntap_options_postprocess_dns(o);
3339#else
3340 dhcp_options_postprocess_dns(o, es);
3341#endif
3342 }
3343 return success;
3344}
3345
3346/*
3347 * parse/print topology coding
3348 */
3349
3350int
3351parse_topology(const char *str, const msglvl_t msglevel)
3352{
3353 if (streq(str, "net30"))
3354 {
3355 return TOP_NET30;
3356 }
3357 else if (streq(str, "p2p"))
3358 {
3359 return TOP_P2P;
3360 }
3361 else if (streq(str, "subnet"))
3362 {
3363 return TOP_SUBNET;
3364 }
3365 else
3366 {
3367 msg(msglevel, "--topology must be net30, p2p, or subnet");
3368 return TOP_UNDEF;
3369 }
3370}
3371
3372const char *
3373print_topology(const int topology)
3374{
3375 switch (topology)
3376 {
3377 case TOP_UNDEF:
3378 return "undef";
3379
3380 case TOP_NET30:
3381 return "net30";
3382
3383 case TOP_P2P:
3384 return "p2p";
3385
3386 case TOP_SUBNET:
3387 return "subnet";
3388
3389 default:
3390 return "unknown";
3391 }
3392}
3393
3394/*
3395 * Manage auth-retry variable
3396 */
3397
3398static int global_auth_retry; /* GLOBAL */
3399
3400int
3401auth_retry_get(void)
3402{
3403 return global_auth_retry;
3404}
3405
3406bool
3407auth_retry_set(const msglvl_t msglevel, const char *option)
3408{
3409 if (streq(option, "interact"))
3410 {
3411 global_auth_retry = AR_INTERACT;
3412 }
3413 else if (streq(option, "nointeract"))
3414 {
3415 global_auth_retry = AR_NOINTERACT;
3416 }
3417 else if (streq(option, "none"))
3418 {
3419 global_auth_retry = AR_NONE;
3420 }
3421 else
3422 {
3423 msg(msglevel, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
3424 return false;
3425 }
3426 return true;
3427}
3428
3429const char *
3430auth_retry_print(void)
3431{
3432 switch (global_auth_retry)
3433 {
3434 case AR_NONE:
3435 return "none";
3436
3437 case AR_NOINTERACT:
3438 return "nointeract";
3439
3440 case AR_INTERACT:
3441 return "interact";
3442
3443 default:
3444 return "???";
3445 }
3446}
3447
3448/*
3449 * Print the help message.
3450 */
3451void
3452usage(void)
3453{
3454 FILE *fp = msg_fp(0);
3455
3456#ifdef ENABLE_SMALL
3457
3458 fprintf(fp, "Usage message not available\n");
3459
3460#else
3461
3462 struct options o;
3463 init_options(&o);
3464
3465 fprintf(fp, usage_message, title_string, o.ce.connect_retry_seconds,
3466 o.ce.connect_retry_seconds_max, o.ce.local_port, o.ce.remote_port, TUN_MTU_DEFAULT,
3467 TAP_MTU_EXTRA_DEFAULT, TUN_MTU_MAX_MIN, o.verbosity, o.authname, o.replay_window,
3468 o.replay_time, o.tls_timeout, o.renegotiate_seconds, o.handshake_window,
3469 o.transition_window);
3470 fflush(fp);
3471
3472#endif /* ENABLE_SMALL */
3473
3474 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
3475}
3476
3477void
3478usage_small(void)
3479{
3480 msg(M_WARN | M_NOPREFIX, "Use --help for more information.");
3481 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
3482}
3483
3484#ifdef _WIN32
3485void
3486show_windows_version(const unsigned int flags)
3487{
3488 struct gc_arena gc = gc_new();
3489 msg(flags, "Windows version: %s", win32_version_string(&gc));
3490 gc_free(&gc);
3491}
3492#endif
3493
3494void
3495show_dco_version(const unsigned int flags)
3496{
3497#ifdef ENABLE_DCO
3498 struct gc_arena gc = gc_new();
3499 msg(flags, "DCO version: %s", dco_version_string(&gc));
3500 gc_free(&gc);
3501#endif
3502}
3503
3504void
3505show_library_versions(const unsigned int flags)
3506{
3507#ifdef ENABLE_LZO
3508#define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
3509#else
3510#define LZO_LIB_VER_STR "", ""
3511#endif
3512
3513 msg(flags, "library versions: %s%s%s", get_ssl_library_version(), LZO_LIB_VER_STR);
3514
3515#undef LZO_LIB_VER_STR
3516}
3517
3518static void
3519usage_version(void)
3520{
3521 msg(M_INFO | M_NOPREFIX, "%s", title_string);
3522 show_library_versions(M_INFO | M_NOPREFIX);
3523#ifdef _WIN32
3524 show_windows_version(M_INFO | M_NOPREFIX);
3525#endif
3526 show_dco_version(M_INFO | M_NOPREFIX);
3527 msg(M_INFO | M_NOPREFIX, "Originally developed by James Yonan");
3528 msg(M_INFO | M_NOPREFIX, "Copyright (C) 2002-2026 OpenVPN Inc <sales@openvpn.net>");
3529#ifndef ENABLE_SMALL
3530#ifdef CONFIGURE_DEFINES
3531 msg(M_INFO | M_NOPREFIX, "Compile time defines: %s", CONFIGURE_DEFINES);
3532#endif
3533#ifdef CONFIGURE_SPECIAL_BUILD
3534 msg(M_INFO | M_NOPREFIX, "special build: %s", CONFIGURE_SPECIAL_BUILD);
3535#endif
3536#endif
3537 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD);
3538}
3539
3540void
3541notnull(const char *arg, const char *description)
3542{
3543 if (!arg)
3544 {
3545 msg(M_USAGE, "You must define %s", description);
3546 }
3547}
3548
3549#if 0
3550static void
3551ping_rec_err(msglvl_t msglevel)
3552{
3553 msg(msglevel, "only one of --ping-exit or --ping-restart options may be specified");
3554}
3555#endif
3556
3557#ifdef _WIN32 /* This function is only used when compiling on Windows */
3558static unsigned int
3559atou(const char *str)
3560{
3561 unsigned int val = 0;
3562 sscanf(str, "%u", &val);
3563 return val;
3564}
3565#endif
3566
3567#define VERIFY_PERMISSION(mask) \
3568 { \
3569 if (!verify_permission(p[0], file, line, (mask), permission_mask, option_types_found, \
3570 msglevel, options, is_inline)) \
3571 { \
3572 goto err; \
3573 } \
3574 }
3575
3576static bool
3577verify_permission(const char *name, const char *file, int line, const uint64_t type,
3578 const uint64_t allowed, uint64_t *found, const msglvl_t msglevel,
3579 struct options *options, bool is_inline)
3580{
3581 if (!(type & allowed))
3582 {
3583 msg(msglevel, "option '%s' cannot be used in this context (%s)", name, file);
3584 return false;
3585 }
3586
3587 if (is_inline && !(type & OPT_P_INLINE))
3588 {
3589 msg(msglevel, "option '%s' is not expected to be inline (%s:%d)", name, file, line);
3590 return false;
3591 }
3592
3593 if (found)
3594 {
3595 *found |= type;
3596 }
3597
3598#ifndef ENABLE_SMALL
3599 /* Check if this options is allowed in connection block,
3600 * but we are currently not in a connection block
3601 * unless this is a pushed option.
3602 * Parsing a connection block uses a temporary options struct without
3603 * connection_list
3604 */
3605
3606 if ((type & OPT_P_CONNECTION) && options->connection_list && !(allowed & OPT_P_PULL_MODE))
3607 {
3608 if (file)
3609 {
3610 msg(M_WARN, "Option '%s' in %s:%d is ignored by previous <connection> blocks ", name,
3611 file, line);
3612 }
3613 else
3614 {
3615 msg(M_WARN, "Option '%s' is ignored by previous <connection> blocks", name);
3616 }
3617 }
3618#endif
3619 return true;
3620}
3621
3622/*
3623 * Check that an option doesn't have too
3624 * many parameters.
3625 */
3626
3627#define NM_QUOTE_HINT (1 << 0)
3628
3629static bool
3630no_more_than_n_args(const msglvl_t msglevel, char *p[], const int max, const unsigned int flags)
3631{
3632 const int len = string_array_len((const char **)p);
3633
3634 if (!len)
3635 {
3636 return false;
3637 }
3638
3639 if (len > max)
3640 {
3641 msg(msglevel, "the --%s directive should have at most %d parameter%s.%s", p[0], max - 1,
3642 max >= 3 ? "s" : "",
3643 (flags & NM_QUOTE_HINT)
3644 ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")."
3645 : "");
3646 return false;
3647 }
3648 else
3649 {
3650 return true;
3651 }
3652}
3653
3654static inline msglvl_t
3655msglevel_forward_compatible(struct options *options, const msglvl_t msglevel)
3656{
3657 return options->forward_compatible ? M_WARN : msglevel;
3658}
3659
3660#define RESET_OPTION_ROUTES(option_ptr, field) \
3661 if (option_ptr) \
3662 { \
3663 option_ptr->field = NULL; \
3664 option_ptr->flags = 0; \
3665 }
3666
3667void
3668remove_option(struct context *c, struct options *options, char *p[], bool is_inline,
3669 const char *file, int line, const msglvl_t msglevel,
3670 const uint64_t permission_mask, uint64_t *option_types_found,
3671 struct env_set *es)
3672{
3673 msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
3674
3675 if (streq(p[0], "ifconfig") && !p[1])
3676 {
3677 VERIFY_PERMISSION(OPT_P_UP);
3678 options->ifconfig_local = NULL;
3679 options->ifconfig_remote_netmask = NULL;
3680 }
3681 else if (streq(p[0], "ifconfig-ipv6") && !p[1])
3682 {
3683 VERIFY_PERMISSION(OPT_P_UP);
3684 options->ifconfig_ipv6_local = NULL;
3685 options->ifconfig_ipv6_netbits = 0;
3686 options->ifconfig_ipv6_remote = NULL;
3687 }
3688 else if (streq(p[0], "route") && !p[1])
3689 {
3690 VERIFY_PERMISSION(OPT_P_ROUTE);
3691 if (c->c1.route_list)
3692 {
3693 delete_routes_v4(c->c1.route_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options), es,
3694 &c->net_ctx);
3695 RESET_OPTION_ROUTES(options->routes, routes);
3696 }
3697 }
3698 else if (streq(p[0], "route-ipv6") && !p[1])
3699 {
3700 VERIFY_PERMISSION(OPT_P_ROUTE);
3701 if (c->c1.route_ipv6_list)
3702 {
3703 delete_routes_v6(c->c1.route_ipv6_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options),
3704 es, &c->net_ctx);
3705 RESET_OPTION_ROUTES(options->routes_ipv6, routes_ipv6);
3706 }
3707 }
3708 else if (streq(p[0], "route-gateway") && !p[1])
3709 {
3710 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
3711 options->route_gateway_via_dhcp = false;
3712 options->route_default_gateway = NULL;
3713 }
3714 else if (streq(p[0], "route-metric") && !p[1])
3715 {
3716 VERIFY_PERMISSION(OPT_P_ROUTE);
3717 options->route_default_metric = 0;
3718 }
3719 else if (streq(p[0], "push-continuation") && !p[1])
3720 {
3721 VERIFY_PERMISSION(OPT_P_PULL_MODE);
3722 options->push_continuation = 0;
3723 }
3724 else if ((streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private")) && !p[1])
3725 {
3726 VERIFY_PERMISSION(OPT_P_ROUTE);
3727 if (options->routes)
3728 {
3729 options->routes->flags = 0;
3730 }
3731 if (options->routes_ipv6)
3732 {
3733 options->routes_ipv6->flags = 0;
3734 }
3735 env_set_del(es, "route_redirect_gateway_ipv4");
3736 env_set_del(es, "route_redirect_gateway_ipv6");
3737 }
3738 else if (streq(p[0], "dns") && !p[1])
3739 {
3740 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3741 gc_free(&options->dns_options.gc);
3742 CLEAR(options->dns_options);
3743 }
3744 else if (streq(p[0], "topology") && !p[1])
3745 {
3746 VERIFY_PERMISSION(OPT_P_UP);
3747 options->topology = TOP_UNDEF;
3748 helper_setdefault_topology(options);
3749 }
3750 else if (streq(p[0], "tun-mtu") && !p[1])
3751 {
3752 VERIFY_PERMISSION(OPT_P_PUSH_MTU | OPT_P_CONNECTION);
3753 options->ce.tun_mtu = TUN_MTU_DEFAULT;
3754 options->ce.tun_mtu_defined = false;
3755 options->ce.occ_mtu = 0;
3756 }
3757 else if (streq(p[0], "block-ipv6") && !p[1])
3758 {
3759 VERIFY_PERMISSION(OPT_P_ROUTE);
3760 options->block_ipv6 = false;
3761 }
3762#if defined(_WIN32) || defined(TARGET_ANDROID)
3763 else if (streq(p[0], "dhcp-option") && !p[1])
3764 {
3765 struct tuntap_options *o = &options->tuntap_options;
3766 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3767
3768 o->domain = NULL;
3769 o->netbios_scope = NULL;
3770 o->netbios_node_type = 0;
3771 o->dns6_len = 0;
3772 memset(o->dns6, 0, sizeof(o->dns6));
3773 o->dns_len = 0;
3774 memset(o->dns, 0, sizeof(o->dns));
3775 o->wins_len = 0;
3776 memset(o->wins, 0, sizeof(o->wins));
3777 o->ntp_len = 0;
3778 memset(o->ntp, 0, sizeof(o->ntp));
3779 o->nbdd_len = 0;
3780 memset(o->nbdd, 0, sizeof(o->nbdd));
3781 while (o->domain_search_list_len-- > 0)
3782 {
3783 o->domain_search_list[o->domain_search_list_len] = NULL;
3784 }
3785 o->disable_nbt = 0;
3786 o->dhcp_options = 0;
3787#if defined(TARGET_ANDROID)
3788 o->http_proxy_port = 0;
3789 o->http_proxy = NULL;
3790#endif
3791 }
3792#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
3793#ifdef _WIN32
3794 else if (streq(p[0], "block-outside-dns") && !p[1])
3795 {
3796 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3797 options->block_outside_dns = false;
3798 }
3799#else /* ifdef _WIN32 */
3800 else if (streq(p[0], "dhcp-option") && !p[1])
3801 {
3802 VERIFY_PERMISSION(OPT_P_DHCPDNS);
3803 delete_all_dhcp_fo(options, &es->list);
3804 }
3805#endif
3806 else
3807 {
3808 msglvl_t msglevel_unknown = msglevel_fc;
3809 /* Check if an option is in --ignore-unknown-option and
3810 * set warning level to non fatal */
3811 for (int i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
3812 {
3813 if (streq(p[0], options->ignore_unknown_option[i]))
3814 {
3815 msglevel_unknown = M_WARN;
3816 break;
3817 }
3818 }
3819 msg(msglevel_unknown,
3820 "Unrecognized option or missing or extra parameter(s) in %s:%d: -%s (%s)", file, line,
3821 p[0], PACKAGE_VERSION);
3822 }
3823 return;
3824err:
3825 msg(msglevel, "Error occurred trying to remove %s option", p[0]);
3826}
3827
3828
3829static bool
3830check_route_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
3831{
3832 rol_check_alloc(options);
3833 if (pull_mode)
3834 {
3835 if (!ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
3836 && !is_special_addr(p[1])) /* FQDN -- may be DNS name */
3837 {
3838 msg(msglevel, "route parameter network/IP '%s' must be a valid address", p[1]);
3839 return false;
3840 }
3841 if (p[2] && !ip_addr_dotted_quad_safe(p[2])) /* FQDN -- must be IP address */
3842 {
3843 msg(msglevel, "route parameter netmask '%s' must be an IP address", p[2]);
3844 return false;
3845 }
3846 if (p[3] && !ip_or_dns_addr_safe(p[3], options->allow_pull_fqdn)
3847 && !is_special_addr(p[3])) /* FQDN -- may be DNS name */
3848 {
3849 msg(msglevel, "route parameter gateway '%s' must be a valid address", p[3]);
3850 return false;
3851 }
3852 }
3853 return true;
3854}
3855
3856
3857static bool
3858check_route6_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
3859{
3860 rol6_check_alloc(options);
3861 if (pull_mode)
3862 {
3863 if (!ipv6_addr_safe_hexplusbits(p[1]))
3864 {
3865 msg(msglevel, "route-ipv6 parameter network/IP '%s' must be a valid address", p[1]);
3866 return false;
3867 }
3868 if (p[2] && !ipv6_addr_safe(p[2]))
3869 {
3870 msg(msglevel, "route-ipv6 parameter gateway '%s' must be a valid address", p[2]);
3871 return false;
3872 }
3873 /* p[3] is metric, if present */
3874 }
3875 return true;
3876}
3877
3878static bool
3879check_dns_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
3880{
3881 if (streq(p[1], "search-domains") && p[2])
3882 {
3883 if (!dns_domain_list_append(&options->dns_options.search_domains, &p[2],
3884 &options->dns_options.gc))
3885 {
3886 msg(msglevel, "--dns %s contain invalid characters", p[1]);
3887 return false;
3888 }
3889 }
3890 else if (streq(p[1], "server") && p[2] && p[3] && p[4])
3891 {
3892 long priority;
3893 if (!dns_server_priority_parse(&priority, p[2], pull_mode))
3894 {
3895 msg(msglevel, "--dns server: invalid priority value '%s'", p[2]);
3896 return false;
3897 }
3898
3899 struct dns_server *server =
3900 dns_server_get(&options->dns_options.servers, priority, &options->dns_options.gc);
3901
3902 if (streq(p[3], "address"))
3903 {
3904 for (int i = 4; p[i]; ++i)
3905 {
3906 if (!dns_server_addr_parse(server, p[i]))
3907 {
3908 msg(msglevel, "--dns server %ld: malformed address or maximum exceeded '%s'",
3909 priority, p[i]);
3910 return false;
3911 }
3912 }
3913 }
3914 else if (streq(p[3], "resolve-domains"))
3915 {
3916 if (!dns_domain_list_append(&server->domains, &p[4], &options->dns_options.gc))
3917 {
3918 msg(msglevel, "--dns server %ld: %s contain invalid characters", priority, p[3]);
3919 return false;
3920 }
3921 }
3922 else if (streq(p[3], "dnssec") && !p[5])
3923 {
3924 if (streq(p[4], "yes"))
3925 {
3926 server->dnssec = DNS_SECURITY_YES;
3927 }
3928 else if (streq(p[4], "no"))
3929 {
3930 server->dnssec = DNS_SECURITY_NO;
3931 }
3932 else if (streq(p[4], "optional"))
3933 {
3934 server->dnssec = DNS_SECURITY_OPTIONAL;
3935 }
3936 else
3937 {
3938 msg(msglevel, "--dns server %ld: malformed dnssec value '%s'", priority, p[4]);
3939 return false;
3940 }
3941 }
3942 else if (streq(p[3], "transport") && !p[5])
3943 {
3944 if (streq(p[4], "plain"))
3945 {
3946 server->transport = DNS_TRANSPORT_PLAIN;
3947 }
3948 else if (streq(p[4], "DoH"))
3949 {
3950 server->transport = DNS_TRANSPORT_HTTPS;
3951 }
3952 else if (streq(p[4], "DoT"))
3953 {
3954 server->transport = DNS_TRANSPORT_TLS;
3955 }
3956 else
3957 {
3958 msg(msglevel, "--dns server %ld: malformed transport value '%s'", priority, p[4]);
3959 return false;
3960 }
3961 }
3962 else if (streq(p[3], "sni") && !p[5])
3963 {
3964 if (!validate_domain(p[4]))
3965 {
3966 msg(msglevel, "--dns server %ld: %s contains invalid characters", priority, p[3]);
3967 return false;
3968 }
3969 server->sni = p[4];
3970 }
3971 else
3972 {
3973 msg(msglevel,
3974 "--dns server %ld: unknown option type '%s' or missing or unknown parameter",
3975 priority, p[3]);
3976 return false;
3977 }
3978 }
3979 else
3980 {
3981 msg(msglevel, "--dns: unknown option type '%s' or missing or unknown parameter", p[1]);
3982 return false;
3983 }
3984 return true;
3985}
3986
3987void
3988update_option(struct context *c, struct options *options, char *p[], bool is_inline,
3989 const char *file, int line, const int level, const msglvl_t msglevel,
3990 const uint64_t permission_mask, uint64_t *option_types_found,
3991 struct env_set *es)
3992{
3993 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
3994 ASSERT(MAX_PARMS >= 7);
3995
3996 if (streq(p[0], "route") && p[1] && !p[5])
3997 {
3998 if (!(options->push_update_options_found & OPT_P_U_ROUTE))
3999 {
4000 VERIFY_PERMISSION(OPT_P_ROUTE);
4001 if (!check_route_option(options, p, msglevel, pull_mode))
4002 {
4003 goto err;
4004 }
4005 if (c->c1.route_list)
4006 {
4007 delete_routes_v4(c->c1.route_list, c->c1.tuntap, ROUTE_OPTION_FLAGS(&c->options),
4008 es, &c->net_ctx);
4009 RESET_OPTION_ROUTES(options->routes, routes);
4010 }
4011 options->push_update_options_found |= OPT_P_U_ROUTE;
4012 }
4013 }
4014 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
4015 {
4016 if (!(options->push_update_options_found & OPT_P_U_ROUTE6))
4017 {
4018 VERIFY_PERMISSION(OPT_P_ROUTE);
4019 if (!check_route6_option(options, p, msglevel, pull_mode))
4020 {
4021 goto err;
4022 }
4023 if (c->c1.route_ipv6_list)
4024 {
4025 delete_routes_v6(c->c1.route_ipv6_list, c->c1.tuntap,
4026 ROUTE_OPTION_FLAGS(&c->options), es, &c->net_ctx);
4027 RESET_OPTION_ROUTES(options->routes_ipv6, routes_ipv6);
4028 }
4029 options->push_update_options_found |= OPT_P_U_ROUTE6;
4030 }
4031 }
4032 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
4033 {
4034 if (!(options->push_update_options_found & OPT_P_U_REDIR_GATEWAY))
4035 {
4036 VERIFY_PERMISSION(OPT_P_ROUTE);
4037 if (options->routes)
4038 {
4039 options->routes->flags = 0;
4040 }
4041 if (options->routes_ipv6)
4042 {
4043 options->routes_ipv6->flags = 0;
4044 }
4045 env_set_del(es, "route_redirect_gateway_ipv4");
4046 env_set_del(es, "route_redirect_gateway_ipv6");
4047 options->push_update_options_found |= OPT_P_U_REDIR_GATEWAY;
4048 }
4049 }
4050 else if (streq(p[0], "dns") && p[1])
4051 {
4052 if (!(options->push_update_options_found & OPT_P_U_DNS))
4053 {
4054 VERIFY_PERMISSION(OPT_P_DHCPDNS);
4055 if (!check_dns_option(options, p, msglevel, pull_mode))
4056 {
4057 goto err;
4058 }
4059 gc_free(&options->dns_options.gc);
4060 CLEAR(options->dns_options);
4061 options->push_update_options_found |= OPT_P_U_DNS;
4062 }
4063 }
4064#if defined(_WIN32) || defined(TARGET_ANDROID)
4065 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
4066 {
4067 if (!(options->push_update_options_found & OPT_P_U_DHCP))
4068 {
4069 struct tuntap_options *o = &options->tuntap_options;
4070 VERIFY_PERMISSION(OPT_P_DHCPDNS);
4071
4072 o->domain = NULL;
4073 o->netbios_scope = NULL;
4074 o->netbios_node_type = 0;
4075 o->dns6_len = 0;
4076 CLEAR(o->dns6);
4077 o->dns_len = 0;
4078 CLEAR(o->dns);
4079 o->wins_len = 0;
4080 CLEAR(o->wins);
4081 o->ntp_len = 0;
4082 CLEAR(o->ntp);
4083 o->nbdd_len = 0;
4084 CLEAR(o->nbdd);
4085 while (o->domain_search_list_len-- > 0)
4086 {
4087 o->domain_search_list[o->domain_search_list_len] = NULL;
4088 }
4089 o->disable_nbt = 0;
4090 o->dhcp_options = 0;
4091
4092 CLEAR(options->dns_options.from_dhcp);
4093#if defined(TARGET_ANDROID)
4094 o->http_proxy_port = 0;
4095 o->http_proxy = NULL;
4096#endif
4097 options->push_update_options_found |= OPT_P_U_DHCP;
4098 }
4099 }
4100#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
4101 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
4102 {
4103 if (!(options->push_update_options_found & OPT_P_U_DHCP))
4104 {
4105 VERIFY_PERMISSION(OPT_P_DHCPDNS);
4106 delete_all_dhcp_fo(options, &es->list);
4107 options->push_update_options_found |= OPT_P_U_DHCP;
4108 }
4109 }
4110#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
4111 add_option(options, p, is_inline, file, line, level, msglevel, permission_mask,
4112 option_types_found, es);
4113 return;
4114err:
4115 msg(msglevel, "Error occurred trying to update %s option", p[0]);
4116}
4117
4118static void
4119set_user_script(struct options *options, const char **script, const char *new_script,
4120 const char *type, bool in_chroot)
4121{
4122 if (*script)
4123 {
4124 msg(M_WARN,
4125 "Multiple --%s scripts defined. "
4126 "The previously configured script is overridden.",
4127 type);
4128 }
4129 *script = new_script;
4130 options->user_script_used = true;
4131
4132#ifndef ENABLE_SMALL
4133 {
4134 char script_name[100];
4135 snprintf(script_name, sizeof(script_name), "--%s script", type);
4136
4137 if (check_cmd_access(*script, script_name, (in_chroot ? options->chroot_dir : NULL)))
4138 {
4139 msg(M_USAGE, "Please correct this error.");
4140 }
4141 }
4142#endif
4143}
4144
4145static void
4146show_compression_warning(struct compress_options *info)
4147{
4148 if (comp_non_stub_enabled(info))
4149 {
4150 msg(M_WARN, "WARNING: Compression for receiving enabled. "
4151 "Compression has been used in the past to break encryption. "
4152 "Compression support is deprecated and we recommend to disable "
4153 "it completely.");
4154 }
4155}
4156
4157bool
4158key_is_external(const struct options *options)
4159{
4160 bool ret = false;
4161 ret = ret || (options->management_flags & MF_EXTERNAL_KEY);
4162#ifdef ENABLE_PKCS11
4163 ret = ret || (options->pkcs11_providers[0] != NULL);
4164#endif
4165#ifdef ENABLE_CRYPTOAPI
4166 ret = ret || options->cryptoapi_cert;
4167#endif
4168
4169 return ret;
4170}
4171
4172#if defined(__GNUC__) || defined(__clang__)
4173#pragma GCC diagnostic push
4174#pragma GCC diagnostic ignored "-Wsign-compare"
4175#endif
4176
4177void
4178add_option(struct options *options, char *p[], bool is_inline, const char *file, int line,
4179 const int level, const msglvl_t msglevel, const uint64_t permission_mask,
4180 uint64_t *option_types_found, struct env_set *es)
4181{
4182 struct gc_arena gc = gc_new();
4183 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
4184 msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
4185
4186 ASSERT(MAX_PARMS >= 7);
4187
4188 /*
4189 * If directive begins with "setenv opt" prefix, don't raise an error if
4190 * directive is unrecognized.
4191 */
4192 if (streq(p[0], "setenv") && p[1] && streq(p[1], "opt") && !(permission_mask & OPT_P_PULL_MODE))
4193 {
4194 if (!p[2])
4195 {
4196 p[2] = "setenv opt"; /* will trigger an error that includes setenv opt */
4197 }
4198 p += 2;
4199 msglevel_fc = M_WARN;
4200 }
4201
4202 if (!file)
4203 {
4204 file = "[CMD-LINE]";
4205 line = 1;
4206 }
4207 if (streq(p[0], "help"))
4208 {
4209 VERIFY_PERMISSION(OPT_P_GENERAL);
4210 usage();
4211 if (p[1])
4212 {
4213 msg(msglevel, "--help does not accept any parameters");
4214 goto err;
4215 }
4216 }
4217 if (streq(p[0], "version") && !p[1])
4218 {
4219 VERIFY_PERMISSION(OPT_P_GENERAL);
4220 usage_version();
4221 }
4222 else if (streq(p[0], "config") && p[1] && !p[2])
4223 {
4224 VERIFY_PERMISSION(OPT_P_CONFIG);
4225
4226 /* save first config file only in options */
4227 if (!options->config)
4228 {
4229 options->config = p[1];
4230 }
4231
4232 read_config_file(options, p[1], level, file, line, msglevel, permission_mask,
4233 option_types_found, es);
4234 }
4235#if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
4236 else if (streq(p[0], "show-gateway") && !p[2])
4237 {
4238 struct route_gateway_info rgi;
4239 struct route_ipv6_gateway_info rgi6;
4240 in_addr_t remote_ipv4 = 0;
4241 struct in6_addr remote_ipv6 = IN6ADDR_ANY_INIT;
4242 openvpn_net_ctx_t net_ctx;
4243 VERIFY_PERMISSION(OPT_P_GENERAL);
4244 if (p[1])
4245 {
4246 /* try parsing the argument as a v4 or v6 address - if
4247 * possible, the output will show the exact route there, and
4248 * "the default route" for the other protocol
4249 */
4250 remote_ipv4 = get_ip_addr(p[1], M_WARN, NULL);
4251 get_ipv6_addr(p[1], &remote_ipv6, NULL, M_WARN);
4252 }
4253 net_ctx_init(NULL, &net_ctx);
4254 get_default_gateway(&rgi, remote_ipv4, &net_ctx);
4255 get_default_gateway_ipv6(&rgi6, &remote_ipv6, &net_ctx);
4256 print_default_gateway(M_INFO, &rgi, &rgi6);
4257 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
4258 }
4259#endif
4260 else if (streq(p[0], "echo") || streq(p[0], "parameter"))
4261 {
4262 struct buffer string = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
4263 int j;
4264 bool good = true;
4265
4266 VERIFY_PERMISSION(OPT_P_ECHO);
4267
4268 for (j = 1; j < MAX_PARMS; ++j)
4269 {
4270 if (!p[j])
4271 {
4272 break;
4273 }
4274 if (j > 1)
4275 {
4276 good &= buf_printf(&string, " ");
4277 }
4278 good &= buf_printf(&string, "%s", p[j]);
4279 }
4280 if (good)
4281 {
4282 /* only message-related ECHO are logged, since other ECHOs
4283 * can potentially include security-sensitive strings */
4284 if (p[1] && strncmp(p[1], "msg", 3) == 0)
4285 {
4286 msg(M_INFO, "%s:%s", pull_mode ? "ECHO-PULL" : "ECHO", BSTR(&string));
4287 }
4288#ifdef ENABLE_MANAGEMENT
4289 if (management)
4290 {
4291 management_echo(management, BSTR(&string), pull_mode);
4292 }
4293#endif
4294 }
4295 else
4296 {
4297 msg(M_WARN, "echo/parameter option overflow");
4298 }
4299 }
4300#ifdef ENABLE_MANAGEMENT
4301 else if (streq(p[0], "management") && p[1] && p[2] && !p[4])
4302 {
4303 VERIFY_PERMISSION(OPT_P_GENERAL);
4304 if (streq(p[2], "unix"))
4305 {
4306#if UNIX_SOCK_SUPPORT
4307 options->management_flags |= MF_UNIX_SOCK;
4308#else
4309 msg(msglevel, "MANAGEMENT: this platform does not support unix domain sockets");
4310 goto err;
4311#endif
4312 }
4313
4314 options->management_addr = p[1];
4315 options->management_port = p[2];
4316 if (p[3])
4317 {
4318 options->management_user_pass = p[3];
4319 }
4320 }
4321 else if (streq(p[0], "management-client-user") && p[1] && !p[2])
4322 {
4323 VERIFY_PERMISSION(OPT_P_GENERAL);
4324 options->management_client_user = p[1];
4325 }
4326 else if (streq(p[0], "management-client-group") && p[1] && !p[2])
4327 {
4328 VERIFY_PERMISSION(OPT_P_GENERAL);
4329 options->management_client_group = p[1];
4330 }
4331 else if (streq(p[0], "management-query-passwords") && !p[1])
4332 {
4333 VERIFY_PERMISSION(OPT_P_GENERAL);
4334 options->management_flags |= MF_QUERY_PASSWORDS;
4335 }
4336 else if (streq(p[0], "management-query-remote") && !p[1])
4337 {
4338 VERIFY_PERMISSION(OPT_P_GENERAL);
4339 options->management_flags |= MF_QUERY_REMOTE;
4340 }
4341 else if (streq(p[0], "management-query-proxy") && !p[1])
4342 {
4343 VERIFY_PERMISSION(OPT_P_GENERAL);
4344 options->management_flags |= MF_QUERY_PROXY;
4345 }
4346 else if (streq(p[0], "management-hold") && !p[1])
4347 {
4348 VERIFY_PERMISSION(OPT_P_GENERAL);
4349 options->management_flags |= MF_HOLD;
4350 }
4351 else if (streq(p[0], "management-signal") && !p[1])
4352 {
4353 VERIFY_PERMISSION(OPT_P_GENERAL);
4354 options->management_flags |= MF_SIGNAL;
4355 }
4356 else if (streq(p[0], "management-forget-disconnect") && !p[1])
4357 {
4358 VERIFY_PERMISSION(OPT_P_GENERAL);
4359 options->management_flags |= MF_FORGET_DISCONNECT;
4360 }
4361 else if (streq(p[0], "management-up-down") && !p[1])
4362 {
4363 VERIFY_PERMISSION(OPT_P_GENERAL);
4364 options->management_flags |= MF_UP_DOWN;
4365 }
4366 else if (streq(p[0], "management-client") && !p[1])
4367 {
4368 VERIFY_PERMISSION(OPT_P_GENERAL);
4369 options->management_flags |= MF_CONNECT_AS_CLIENT;
4370 }
4371 else if (streq(p[0], "management-external-key"))
4372 {
4373 VERIFY_PERMISSION(OPT_P_GENERAL);
4374 for (int j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
4375 {
4376 if (streq(p[j], "nopadding"))
4377 {
4378 options->management_flags |= MF_EXTERNAL_KEY_NOPADDING;
4379 }
4380 else if (streq(p[j], "pkcs1"))
4381 {
4382 options->management_flags |= MF_EXTERNAL_KEY_PKCS1PAD;
4383 }
4384 else if (streq(p[j], "pss"))
4385 {
4386 options->management_flags |= MF_EXTERNAL_KEY_PSSPAD;
4387 }
4388 else if (streq(p[j], "digest"))
4389 {
4390 options->management_flags |= MF_EXTERNAL_KEY_DIGEST;
4391 }
4392 else
4393 {
4394 msg(msglevel, "Unknown management-external-key flag: %s", p[j]);
4395 }
4396 }
4397 /*
4398 * When no option is present, assume that only PKCS1
4399 * padding is supported
4400 */
4401 if (!(options->management_flags & (MF_EXTERNAL_KEY_NOPADDING | MF_EXTERNAL_KEY_PKCS1PAD)))
4402 {
4403 options->management_flags |= MF_EXTERNAL_KEY_PKCS1PAD;
4404 }
4405 options->management_flags |= MF_EXTERNAL_KEY;
4406 }
4407 else if (streq(p[0], "management-external-cert") && p[1] && !p[2])
4408 {
4409 VERIFY_PERMISSION(OPT_P_GENERAL);
4410 options->management_flags |= MF_EXTERNAL_CERT;
4411 options->management_certificate = p[1];
4412 }
4413 else if (streq(p[0], "management-client-auth") && !p[1])
4414 {
4415 VERIFY_PERMISSION(OPT_P_GENERAL);
4416 options->management_flags |= MF_CLIENT_AUTH;
4417 }
4418 else if (streq(p[0], "management-log-cache") && p[1] && !p[2])
4419 {
4420 VERIFY_PERMISSION(OPT_P_GENERAL);
4421 if (!atoi_constrained(p[1], &options->management_log_history_cache,
4422 p[0], 1, INT_MAX, msglevel))
4423 {
4424 goto err;
4425 }
4426 }
4427#endif /* ifdef ENABLE_MANAGEMENT */
4428#ifdef ENABLE_PLUGIN
4429 else if (streq(p[0], "plugin") && p[1])
4430 {
4431 VERIFY_PERMISSION(OPT_P_PLUGIN);
4432 if (!options->plugin_list)
4433 {
4434 options->plugin_list = plugin_option_list_new(&options->gc);
4435 }
4436 if (!plugin_option_list_add(options->plugin_list, &p[1], &options->gc))
4437 {
4438 msg(msglevel, "plugin add failed: %s", p[1]);
4439 goto err;
4440 }
4441 }
4442#endif
4443 else if (streq(p[0], "mode") && p[1] && !p[2])
4444 {
4445 VERIFY_PERMISSION(OPT_P_GENERAL);
4446 if (streq(p[1], "p2p"))
4447 {
4448 options->mode = MODE_POINT_TO_POINT;
4449 }
4450 else if (streq(p[1], "server"))
4451 {
4452 options->mode = MODE_SERVER;
4453 }
4454 else
4455 {
4456 msg(msglevel, "Bad --mode parameter: %s", p[1]);
4457 goto err;
4458 }
4459 }
4460 else if (streq(p[0], "dev") && p[1] && !p[2])
4461 {
4462 VERIFY_PERMISSION(OPT_P_GENERAL);
4463 options->dev = p[1];
4464 }
4465 else if (streq(p[0], "dev-type") && p[1] && !p[2])
4466 {
4467 VERIFY_PERMISSION(OPT_P_GENERAL);
4468 options->dev_type = p[1];
4469 }
4470#ifdef _WIN32
4471 else if (streq(p[0], "windows-driver") && p[1] && !p[2])
4472 {
4473 VERIFY_PERMISSION(OPT_P_GENERAL);
4474 msg(M_WARN,
4475 "DEPRECATED OPTION: windows-driver: In OpenVPN 2.7, the default Windows driver is ovpn-dco. "
4476 "If incompatible options are used, OpenVPN will fall back to tap-windows6. Wintun support has been removed.");
4477 }
4478#endif
4479 else if (streq(p[0], "disable-dco"))
4480 {
4481 options->disable_dco = true;
4482 }
4483 else if (streq(p[0], "dev-node") && p[1] && !p[2])
4484 {
4485 VERIFY_PERMISSION(OPT_P_GENERAL);
4486 options->dev_node = p[1];
4487 }
4488 else if (streq(p[0], "lladdr") && p[1] && !p[2])
4489 {
4490 VERIFY_PERMISSION(OPT_P_UP);
4491 if (mac_addr_safe(p[1])) /* MAC address only */
4492 {
4493 options->lladdr = p[1];
4494 }
4495 else
4496 {
4497 msg(msglevel, "lladdr parm '%s' must be a MAC address", p[1]);
4498 goto err;
4499 }
4500 }
4501 else if (streq(p[0], "topology") && p[1] && !p[2])
4502 {
4503 VERIFY_PERMISSION(OPT_P_UP);
4504 options->topology = parse_topology(p[1], msglevel);
4505 }
4506 else if (streq(p[0], "tun-ipv6") && !p[1])
4507 {
4508 if (!pull_mode)
4509 {
4510 msg(M_WARN,
4511 "Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.");
4512 }
4513 }
4514#ifdef ENABLE_IPROUTE
4515 else if (streq(p[0], "iproute") && p[1] && !p[2])
4516 {
4517 VERIFY_PERMISSION(OPT_P_GENERAL);
4518 iproute_path = p[1];
4519 }
4520#endif
4521 else if (streq(p[0], "ifconfig") && p[1] && p[2] && !p[3])
4522 {
4523 VERIFY_PERMISSION(OPT_P_UP);
4524 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
4525 && ip_or_dns_addr_safe(p[2], options->allow_pull_fqdn)) /* FQDN -- may be DNS name */
4526 {
4527 options->ifconfig_local = p[1];
4528 options->ifconfig_remote_netmask = p[2];
4529 }
4530 else
4531 {
4532 msg(msglevel, "ifconfig parms '%s' and '%s' must be valid addresses", p[1], p[2]);
4533 goto err;
4534 }
4535 }
4536 else if (streq(p[0], "ifconfig-ipv6") && p[1] && p[2] && !p[3])
4537 {
4538 unsigned int netbits;
4539
4540 VERIFY_PERMISSION(OPT_P_UP);
4541 if (get_ipv6_addr(p[1], NULL, &netbits, msglevel) && ipv6_addr_safe(p[2]))
4542 {
4543 if (netbits < 64 || netbits > 124)
4544 {
4545 msg(msglevel, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'",
4546 netbits);
4547 goto err;
4548 }
4549
4550 options->ifconfig_ipv6_local = get_ipv6_addr_no_netbits(p[1], &options->gc);
4551 options->ifconfig_ipv6_netbits = netbits;
4552 options->ifconfig_ipv6_remote = p[2];
4553 }
4554 else
4555 {
4556 msg(msglevel, "ifconfig-ipv6 parms '%s' and '%s' must be valid addresses", p[1], p[2]);
4557 goto err;
4558 }
4559 }
4560 else if (streq(p[0], "ifconfig-noexec") && !p[1])
4561 {
4562 VERIFY_PERMISSION(OPT_P_UP);
4563 options->ifconfig_noexec = true;
4564 }
4565 else if (streq(p[0], "ifconfig-nowarn") && !p[1])
4566 {
4567 VERIFY_PERMISSION(OPT_P_UP);
4568 options->ifconfig_nowarn = true;
4569 }
4570 else if (streq(p[0], "local") && p[1] && !p[4])
4571 {
4572 struct local_entry *e;
4573
4574 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4575
4576 e = alloc_local_entry(&options->ce, M_USAGE, &options->gc);
4577 ASSERT(e);
4578
4579 /* '*' is treated as 'ask the system to get some socket',
4580 * therefore force binding on a particular address only when
4581 * actually specified. */
4582 if (strcmp(p[1], "*") != 0)
4583 {
4584 e->local = p[1];
4585 }
4586
4587 if (p[2])
4588 {
4589 e->port = p[2];
4590 }
4591
4592 if (p[3])
4593 {
4594 e->proto = ascii2proto(p[3]);
4595 }
4596 }
4597 else if (streq(p[0], "remote-random") && !p[1])
4598 {
4599 VERIFY_PERMISSION(OPT_P_GENERAL);
4600 options->remote_random = true;
4601 }
4602 else if (streq(p[0], "connection") && p[1] && !p[3])
4603 {
4604 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
4605 if (is_inline)
4606 {
4607 struct options sub;
4608 struct connection_entry *e;
4609
4610 init_options(&sub);
4611 sub.ce = options->ce;
4612 read_config_string("[CONNECTION-OPTIONS]", &sub, p[1], msglevel, OPT_P_CONNECTION,
4613 option_types_found, es);
4614 if (!sub.ce.remote)
4615 {
4616 msg(msglevel,
4617 "Each 'connection' block must contain exactly one 'remote' directive");
4618 uninit_options(&sub);
4619 goto err;
4620 }
4621
4622 e = alloc_connection_entry(options, msglevel);
4623 if (!e)
4624 {
4625 uninit_options(&sub);
4626 goto err;
4627 }
4628 *e = sub.ce;
4629 gc_transfer(&options->gc, &sub.gc);
4630 uninit_options(&sub);
4631 }
4632 }
4633 else if (streq(p[0], "ignore-unknown-option") && p[1])
4634 {
4635 int i;
4636 int j;
4637 int numignored = 0;
4638 const char **ignore;
4639
4640 VERIFY_PERMISSION(OPT_P_GENERAL);
4641 /* Find out how many options to be ignored */
4642 for (i = 1; p[i]; i++)
4643 {
4644 numignored++;
4645 }
4646
4647 /* add number of options already ignored */
4648 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
4649 {
4650 numignored++;
4651 }
4652
4653 /* Allocate array */
4654 ALLOC_ARRAY_GC(ignore, const char *, numignored + 1, &options->gc);
4655 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
4656 {
4657 ignore[i] = options->ignore_unknown_option[i];
4658 }
4659
4660 options->ignore_unknown_option = ignore;
4661
4662 for (j = 1; p[j]; j++)
4663 {
4664 /* Allow the user to specify ignore-unknown-option --opt too */
4665 if (p[j][0] == '-' && p[j][1] == '-')
4666 {
4667 options->ignore_unknown_option[i] = (p[j] + 2);
4668 }
4669 else
4670 {
4671 options->ignore_unknown_option[i] = p[j];
4672 }
4673 i++;
4674 }
4675
4676 options->ignore_unknown_option[i] = NULL;
4677 }
4678#if ENABLE_MANAGEMENT
4679 else if (streq(p[0], "http-proxy-override") && p[1] && p[2] && !p[4])
4680 {
4681 VERIFY_PERMISSION(OPT_P_GENERAL);
4682 options->http_proxy_override = parse_http_proxy_override(p[1], p[2], p[3], &options->gc);
4683 if (!options->http_proxy_override)
4684 {
4685 goto err;
4686 }
4687 }
4688#endif
4689 else if (streq(p[0], "remote") && p[1] && !p[4])
4690 {
4691 struct remote_entry re;
4692 re.remote = re.remote_port = NULL;
4693 re.proto = -1;
4694 re.af = 0;
4695
4696 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4697 re.remote = p[1];
4698 if (p[2])
4699 {
4700 re.remote_port = p[2];
4701 if (p[3])
4702 {
4703 const int proto = ascii2proto(p[3]);
4704 const sa_family_t af = ascii2af(p[3]);
4705 if (proto < 0)
4706 {
4707 msg(msglevel, "remote: bad protocol associated with host %s: '%s'", p[1], p[3]);
4708 goto err;
4709 }
4710 re.proto = proto;
4711 re.af = af;
4712 }
4713 }
4714 if (permission_mask & OPT_P_GENERAL)
4715 {
4716 struct remote_entry *e = alloc_remote_entry(options, msglevel);
4717 if (!e)
4718 {
4719 goto err;
4720 }
4721 *e = re;
4722 }
4723 else if (permission_mask & OPT_P_CONNECTION)
4724 {
4725 connection_entry_load_re(&options->ce, &re);
4726 }
4727 }
4728 else if (streq(p[0], "resolv-retry") && p[1] && !p[2])
4729 {
4730 VERIFY_PERMISSION(OPT_P_GENERAL);
4731 if (streq(p[1], "infinite"))
4732 {
4733 options->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
4734 }
4735 else
4736 {
4737 options->resolve_retry_seconds = positive_atoi(p[1], msglevel);
4738 }
4739 }
4740 else if ((streq(p[0], "preresolve") || streq(p[0], "ip-remote-hint")) && !p[2])
4741 {
4742 VERIFY_PERMISSION(OPT_P_GENERAL);
4743 options->resolve_in_advance = true;
4744 /* Note the ip-remote-hint and the argument p[1] are for
4745 * backward compatibility */
4746 if (p[1])
4747 {
4748 options->ip_remote_hint = p[1];
4749 }
4750 }
4751 else if (streq(p[0], "connect-retry") && p[1] && !p[3])
4752 {
4753 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4754 options->ce.connect_retry_seconds = positive_atoi(p[1], msglevel);
4755 /*
4756 * Limit the base value of retry wait interval to 16 bits to avoid
4757 * overflow when scaled up for exponential backoff
4758 */
4759 if (options->ce.connect_retry_seconds > 0xFFFF)
4760 {
4761 options->ce.connect_retry_seconds = 0xFFFF;
4762 msg(M_WARN, "connect retry wait interval truncated to %d",
4763 options->ce.connect_retry_seconds);
4764 }
4765
4766 if (p[2])
4767 {
4768 options->ce.connect_retry_seconds_max =
4769 max_int(positive_atoi(p[2], msglevel), options->ce.connect_retry_seconds);
4770 }
4771 }
4772 else if ((streq(p[0], "connect-timeout") || streq(p[0], "server-poll-timeout")) && p[1]
4773 && !p[2])
4774 {
4775 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4776 options->ce.connect_timeout = positive_atoi(p[1], msglevel);
4777 }
4778 else if (streq(p[0], "connect-retry-max") && p[1] && !p[2])
4779 {
4780 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4781 options->connect_retry_max = positive_atoi(p[1], msglevel);
4782 }
4783 else if (streq(p[0], "ipchange") && p[1])
4784 {
4785 VERIFY_PERMISSION(OPT_P_SCRIPT);
4786 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
4787 {
4788 goto err;
4789 }
4790 set_user_script(options, &options->ipchange,
4791 string_substitute(p[1], ',', ' ', &options->gc), "ipchange", true);
4792 }
4793 else if (streq(p[0], "float") && !p[1])
4794 {
4795 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
4796 options->ce.remote_float = true;
4797 }
4798#ifdef ENABLE_DEBUG
4799 else if (streq(p[0], "gremlin") && p[1] && !p[2])
4800 {
4801 VERIFY_PERMISSION(OPT_P_GENERAL);
4802 options->gremlin = positive_atoi(p[1], msglevel);
4803 }
4804#endif
4805 else if (streq(p[0], "chroot") && p[1] && !p[2])
4806 {
4807 VERIFY_PERMISSION(OPT_P_GENERAL);
4808 options->chroot_dir = p[1];
4809 }
4810 else if (streq(p[0], "cd") && p[1] && !p[2])
4811 {
4812 VERIFY_PERMISSION(OPT_P_GENERAL);
4813 if (platform_chdir(p[1]))
4814 {
4815 msg(M_ERR, "cd to '%s' failed", p[1]);
4816 goto err;
4817 }
4818 options->cd_dir = p[1];
4819 }
4820#ifdef ENABLE_SELINUX
4821 else if (streq(p[0], "setcon") && p[1] && !p[2])
4822 {
4823 VERIFY_PERMISSION(OPT_P_GENERAL);
4824 options->selinux_context = p[1];
4825 }
4826#endif
4827 else if (streq(p[0], "writepid") && p[1] && !p[2])
4828 {
4829 VERIFY_PERMISSION(OPT_P_GENERAL);
4830 options->writepid = p[1];
4831 }
4832 else if (streq(p[0], "up") && p[1])
4833 {
4834 VERIFY_PERMISSION(OPT_P_SCRIPT);
4835 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
4836 {
4837 goto err;
4838 }
4839 set_user_script(options, &options->up_script, p[1], "up", false);
4840 }
4841 else if (streq(p[0], "down") && p[1])
4842 {
4843 VERIFY_PERMISSION(OPT_P_SCRIPT);
4844 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
4845 {
4846 goto err;
4847 }
4848 set_user_script(options, &options->down_script, p[1], "down", true);
4849 }
4850 else if (streq(p[0], "down-pre") && !p[1])
4851 {
4852 VERIFY_PERMISSION(OPT_P_GENERAL);
4853 options->down_pre = true;
4854 }
4855 else if (streq(p[0], "up-delay") && !p[1])
4856 {
4857 VERIFY_PERMISSION(OPT_P_GENERAL);
4858 options->up_delay = true;
4859 }
4860 else if (streq(p[0], "up-restart") && !p[1])
4861 {
4862 VERIFY_PERMISSION(OPT_P_GENERAL);
4863 options->up_restart = true;
4864 }
4865 else if (streq(p[0], "syslog") && !p[2])
4866 {
4867 VERIFY_PERMISSION(OPT_P_GENERAL);
4868 open_syslog(p[1], false);
4869 }
4870 else if (streq(p[0], "daemon") && !p[2])
4871 {
4872 bool didit = false;
4873 VERIFY_PERMISSION(OPT_P_GENERAL);
4874 if (!options->daemon)
4875 {
4876 options->daemon = didit = true;
4877 open_syslog(p[1], false);
4878 }
4879 if (p[1])
4880 {
4881 if (!didit)
4882 {
4883 msg(M_WARN,
4884 "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)",
4885 p[1]);
4886 goto err;
4887 }
4888 }
4889 }
4890 else if (streq(p[0], "log") && p[1] && !p[2])
4891 {
4892 VERIFY_PERMISSION(OPT_P_GENERAL);
4893 options->log = true;
4894 redirect_stdout_stderr(p[1], false);
4895 }
4896 else if (streq(p[0], "suppress-timestamps") && !p[1])
4897 {
4898 VERIFY_PERMISSION(OPT_P_GENERAL);
4899 options->suppress_timestamps = true;
4900 set_suppress_timestamps(true);
4901 }
4902 else if (streq(p[0], "machine-readable-output") && !p[1])
4903 {
4904 VERIFY_PERMISSION(OPT_P_GENERAL);
4905 options->machine_readable_output = true;
4906 set_machine_readable_output(true);
4907 }
4908 else if (streq(p[0], "log-append") && p[1] && !p[2])
4909 {
4910 VERIFY_PERMISSION(OPT_P_GENERAL);
4911 options->log = true;
4912 redirect_stdout_stderr(p[1], true);
4913 }
4914 else if (streq(p[0], "mlock") && !p[1])
4915 {
4916 VERIFY_PERMISSION(OPT_P_GENERAL);
4917 options->mlock = true;
4918 }
4919#if ENABLE_IP_PKTINFO
4920 else if (streq(p[0], "multihome") && !p[2])
4921 {
4922 VERIFY_PERMISSION(OPT_P_GENERAL);
4923 options->sockflags |= SF_USE_IP_PKTINFO;
4924 if (p[1] && streq(p[1], "same-interface"))
4925 {
4926 options->sockflags |= SF_PKTINFO_COPY_IIF;
4927 }
4928 else if (p[1])
4929 {
4930 msg(msglevel, "Unknown parameter to --multihome: %s", p[1]);
4931 }
4932 }
4933#endif
4934 else if (streq(p[0], "verb") && p[1] && !p[2])
4935 {
4936 VERIFY_PERMISSION(OPT_P_MESSAGES);
4937 options->verbosity = positive_atoi(p[1], msglevel);
4938 if (options->verbosity >= (D_TLS_DEBUG_MED & M_DEBUG_LEVEL))
4939 {
4940 /* We pass this flag to the SSL library to avoid
4941 * mbed TLS always generating debug level logging */
4942 options->ssl_flags |= SSLF_TLS_DEBUG_ENABLED;
4943 }
4944#if !defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
4945 /* Warn when a debug verbosity is supplied when built without debug support */
4946 if (options->verbosity >= 7)
4947 {
4948 msg(M_WARN,
4949 "NOTE: debug verbosity (--verb %d) is enabled but this build lacks debug support.",
4950 options->verbosity);
4951 }
4952#endif
4953 }
4954 else if (streq(p[0], "mute") && p[1] && !p[2])
4955 {
4956 VERIFY_PERMISSION(OPT_P_MESSAGES);
4957 options->mute = positive_atoi(p[1], msglevel);
4958 }
4959 else if (streq(p[0], "errors-to-stderr") && !p[1])
4960 {
4961 VERIFY_PERMISSION(OPT_P_MESSAGES);
4962 errors_to_stderr();
4963 }
4964 else if (streq(p[0], "status") && p[1] && !p[3])
4965 {
4966 VERIFY_PERMISSION(OPT_P_GENERAL);
4967 options->status_file = p[1];
4968 if (p[2])
4969 {
4970 options->status_file_update_freq = positive_atoi(p[2], msglevel);
4971 }
4972 }
4973 else if (streq(p[0], "status-version") && p[1] && !p[2])
4974 {
4975 VERIFY_PERMISSION(OPT_P_GENERAL);
4976 if (!atoi_constrained(p[1], &options->status_file_version, p[0], 1, 3, msglevel))
4977 {
4978 goto err;
4979 }
4980 }
4981 else if (streq(p[0], "remap-usr1") && p[1] && !p[2])
4982 {
4983 VERIFY_PERMISSION(OPT_P_GENERAL);
4984 if (streq(p[1], "SIGHUP"))
4985 {
4986 options->remap_sigusr1 = SIGHUP;
4987 }
4988 else if (streq(p[1], "SIGTERM"))
4989 {
4990 options->remap_sigusr1 = SIGTERM;
4991 }
4992 else
4993 {
4994 msg(msglevel, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
4995 goto err;
4996 }
4997 }
4998 else if ((streq(p[0], "link-mtu") || streq(p[0], "udp-mtu")) && p[1] && !p[2])
4999 {
5000 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5001 options->ce.link_mtu = positive_atoi(p[1], msglevel);
5002 options->ce.link_mtu_defined = true;
5003 }
5004 else if (streq(p[0], "tun-mtu") && p[1] && !p[3])
5005 {
5006 VERIFY_PERMISSION(OPT_P_PUSH_MTU | OPT_P_CONNECTION);
5007 if (atoi_constrained(p[1], &options->ce.tun_mtu, "tun-mtu", TUN_MTU_MIN, TUN_MTU_MAX, msglevel))
5008 {
5009 options->ce.tun_mtu_defined = true;
5010 if (p[2])
5011 {
5012 atoi_constrained(p[2], &options->ce.occ_mtu, "tun-mtu occ-mtu", TUN_MTU_MIN, TUN_MTU_MAX, msglevel);
5013 }
5014 else
5015 {
5016 options->ce.occ_mtu = 0;
5017 }
5018 }
5019 }
5020 else if (streq(p[0], "tun-mtu-max") && p[1] && !p[2])
5021 {
5022 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5023 atoi_constrained(p[1], &options->ce.tun_mtu_max, p[0], TUN_MTU_MAX_MIN, TUN_MTU_MAX, msglevel);
5024 }
5025 else if (streq(p[0], "tun-mtu-extra") && p[1] && !p[2])
5026 {
5027 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5028 if (atoi_constrained(p[1], &options->ce.tun_mtu_extra, p[0], 0, TUN_MTU_MAX, msglevel))
5029 {
5030 options->ce.tun_mtu_extra_defined = true;
5031 }
5032 }
5033 else if (streq(p[0], "max-packet-size") && p[1] && !p[2])
5034 {
5035 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5036 int maxmtu = positive_atoi(p[1], msglevel);
5037 options->ce.tls_mtu = constrain_int(maxmtu, TLS_CHANNEL_MTU_MIN, TLS_CHANNEL_BUF_SIZE);
5038
5039 if (maxmtu < TLS_CHANNEL_MTU_MIN || maxmtu > TLS_CHANNEL_BUF_SIZE)
5040 {
5041 msg(M_WARN,
5042 "Note: max-packet-size value outside of allowed "
5043 "control channel packet size (%d to %d), will use %d "
5044 "instead.",
5045 TLS_CHANNEL_MTU_MIN, TLS_CHANNEL_BUF_SIZE, options->ce.tls_mtu);
5046 }
5047
5048 /* also set mssfix maxmtu mtu */
5049 options->ce.mssfix = maxmtu;
5050 options->ce.mssfix_default = false;
5051 options->ce.mssfix_encap = true;
5052 }
5053#ifdef ENABLE_FRAGMENT
5054 else if (streq(p[0], "mtu-dynamic"))
5055 {
5056 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5057 msg(msglevel, "--mtu-dynamic has been replaced by --fragment");
5058 goto err;
5059 }
5060 else if (streq(p[0], "fragment") && p[1] && !p[3])
5061 {
5062 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5063 if (!atoi_constrained(p[1], &options->ce.fragment, p[0], 68, INT_MAX, msglevel))
5064 {
5065 goto err;
5066 }
5067
5068 if (p[2] && streq(p[2], "mtu"))
5069 {
5070 options->ce.fragment_encap = true;
5071 }
5072 else if (p[2])
5073 {
5074 msg(msglevel, "Unknown parameter to --fragment: %s", p[2]);
5075 }
5076 }
5077#endif /* ifdef ENABLE_FRAGMENT */
5078 else if (streq(p[0], "mtu-disc") && p[1] && !p[2])
5079 {
5080 VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);
5081 options->ce.mtu_discover_type = translate_mtu_discover_type_name(p[1]);
5082 }
5083 else if (streq(p[0], "mtu-test") && !p[1])
5084 {
5085 VERIFY_PERMISSION(OPT_P_GENERAL);
5086 options->mtu_test = true;
5087 }
5088 else if (streq(p[0], "nice") && p[1] && !p[2])
5089 {
5090 VERIFY_PERMISSION(OPT_P_NICE);
5091 options->nice = atoi_warn(p[1], msglevel);
5092 }
5093 else if (streq(p[0], "rcvbuf") && p[1] && !p[2])
5094 {
5095 VERIFY_PERMISSION(OPT_P_SOCKBUF);
5096 options->rcvbuf = positive_atoi(p[1], msglevel);
5097 }
5098 else if (streq(p[0], "sndbuf") && p[1] && !p[2])
5099 {
5100 VERIFY_PERMISSION(OPT_P_SOCKBUF);
5101 options->sndbuf = positive_atoi(p[1], msglevel);
5102 }
5103 else if (streq(p[0], "mark") && p[1] && !p[2])
5104 {
5105#if defined(TARGET_LINUX)
5106 VERIFY_PERMISSION(OPT_P_GENERAL);
5107 options->mark = atoi_warn(p[1], msglevel);
5108#endif
5109 }
5110 else if (streq(p[0], "socket-flags"))
5111 {
5112 int j;
5113 VERIFY_PERMISSION(OPT_P_SOCKFLAGS);
5114 for (j = 1; j < MAX_PARMS && p[j]; ++j)
5115 {
5116 /* TCP_NODELAY is enabled by default; the flag is still accepted
5117 * for backwards compatibility but no longer has any effect */
5118 if (!streq(p[j], "TCP_NODELAY"))
5119 {
5120 msg(msglevel, "unknown socket flag: %s", p[j]);
5121 }
5122 }
5123 }
5124#ifdef TARGET_LINUX
5125 else if (streq(p[0], "bind-dev") && p[1])
5126 {
5127 VERIFY_PERMISSION(OPT_P_SOCKFLAGS);
5128 if (strlen(p[1]) < IFNAMSIZ)
5129 {
5130 options->bind_dev = p[1];
5131 }
5132 else
5133 {
5134 msg(msglevel, "argument to --bind-dev is longer than allowed %u", IFNAMSIZ - 1);
5135 goto err;
5136 }
5137 }
5138#endif
5139 else if (streq(p[0], "txqueuelen") && p[1] && !p[2])
5140 {
5141 VERIFY_PERMISSION(OPT_P_GENERAL);
5142#ifdef TARGET_LINUX
5143 options->tuntap_options.txqueuelen = positive_atoi(p[1], msglevel);
5144#else
5145 msg(msglevel, "--txqueuelen not supported on this OS");
5146 goto err;
5147#endif
5148 }
5149 else if (streq(p[0], "shaper") && p[1] && !p[2])
5150 {
5151 VERIFY_PERMISSION(OPT_P_SHAPER);
5152 if (!atoi_constrained(p[1], &options->shaper, p[0], SHAPER_MIN, SHAPER_MAX, msglevel))
5153 {
5154 goto err;
5155 }
5156 }
5157 else if (streq(p[0], "port") && p[1] && !p[2])
5158 {
5159 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5160 options->ce.local_port = options->ce.remote_port = p[1];
5161 }
5162 else if (streq(p[0], "lport") && p[1] && !p[2])
5163 {
5164 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5165
5166 /* only trigger bind() if port is not 0 (or --local is used) */
5167 if (!streq(p[1], "0"))
5168 {
5169 options->ce.local_port_defined = true;
5170 }
5171 options->ce.local_port = p[1];
5172 }
5173 else if (streq(p[0], "rport") && p[1] && !p[2])
5174 {
5175 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5176 options->ce.remote_port = p[1];
5177 }
5178 else if (streq(p[0], "bind") && !p[2])
5179 {
5180 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5181 options->ce.bind_defined = true;
5182 if (p[1] && streq(p[1], "ipv6only"))
5183 {
5184 options->ce.bind_ipv6_only = true;
5185 }
5186 }
5187 else if (streq(p[0], "nobind") && !p[1])
5188 {
5189 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5190 options->ce.bind_local = false;
5191 }
5192 else if (streq(p[0], "fast-io") && !p[1])
5193 {
5194 VERIFY_PERMISSION(OPT_P_GENERAL);
5195 msg(M_WARN, "DEPRECATED OPTION: --fast-io option ignored.");
5196 }
5197 else if (streq(p[0], "inactive") && p[1] && !p[3])
5198 {
5199 VERIFY_PERMISSION(OPT_P_TIMER);
5200 options->inactivity_timeout = positive_atoi(p[1], msglevel);
5201 if (p[2])
5202 {
5203 positive_atoll(p[2], &options->inactivity_minimum_bytes, p[0], msglevel);
5204 if (options->inactivity_minimum_bytes > INT_MAX)
5205 {
5206 msg(M_WARN,
5207 "WARNING: '--inactive' with a 'bytes' value"
5208 " >2 Gbyte was silently ignored in older versions. If "
5209 " your VPN exits unexpectedly with 'Inactivity timeout'"
5210 " in %d seconds, revisit this value.",
5211 options->inactivity_timeout);
5212 }
5213 }
5214 }
5215 else if (streq(p[0], "session-timeout") && p[1] && !p[2])
5216 {
5217 VERIFY_PERMISSION(OPT_P_TIMER);
5218 options->session_timeout = positive_atoi(p[1], msglevel);
5219 }
5220 else if (streq(p[0], "proto") && p[1] && !p[2])
5221 {
5222 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5223 int proto = ascii2proto(p[1]);
5224 sa_family_t af = ascii2af(p[1]);
5225 if (proto < 0)
5226 {
5227 msg(msglevel, "Bad protocol: '%s'. Allowed protocols with --proto option: %s", p[1],
5228 proto2ascii_all(&gc));
5229 goto err;
5230 }
5231 options->ce.proto = proto;
5232 options->ce.af = af;
5233 }
5234 else if (streq(p[0], "proto-force") && p[1] && !p[2])
5235 {
5236 int proto_force;
5237 VERIFY_PERMISSION(OPT_P_GENERAL);
5238 proto_force = ascii2proto(p[1]);
5239 if (proto_force < 0)
5240 {
5241 msg(msglevel, "Bad --proto-force protocol: '%s'", p[1]);
5242 goto err;
5243 }
5244 options->proto_force = proto_force;
5245 }
5246 else if (streq(p[0], "http-proxy") && p[1] && !p[5])
5247 {
5248 struct http_proxy_options *ho;
5249
5250 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5251
5252 {
5253 if (!p[2])
5254 {
5255 msg(msglevel, "http-proxy port number not defined");
5256 goto err;
5257 }
5258
5259 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
5260
5261 ho->server = p[1];
5262 ho->port = p[2];
5263 }
5264
5265 if (p[3])
5266 {
5267 /* auto -- try to figure out proxy addr, port, and type automatically */
5268 /* auto-nct -- disable proxy auth cleartext protocols (i.e. basic auth) */
5269 if (streq(p[3], "auto"))
5270 {
5271 ho->auth_retry = PAR_ALL;
5272 }
5273 else if (streq(p[3], "auto-nct"))
5274 {
5275 ho->auth_retry = PAR_NCT;
5276 }
5277 else
5278 {
5279 ho->auth_method_string = "basic";
5280 ho->auth_file = p[3];
5281
5282 if (p[4])
5283 {
5284 ho->auth_method_string = p[4];
5285 }
5286 }
5287 }
5288 else
5289 {
5290 ho->auth_method_string = "none";
5291 }
5292 }
5293 else if (streq(p[0], "http-proxy-user-pass") && p[1])
5294 {
5295 struct http_proxy_options *ho;
5296 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
5297 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
5298 ho->auth_file_up = p[1];
5299 ho->inline_creds = is_inline;
5300 }
5301 else if (streq(p[0], "http-proxy-retry") || streq(p[0], "socks-proxy-retry") || streq(p[0], "http-proxy-timeout"))
5302 {
5303 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5304 msg(M_WARN, "DEPRECATED OPTION: %s option ignored.", p[0]);
5305 }
5306 else if (streq(p[0], "http-proxy-option") && p[1] && !p[4])
5307 {
5308 struct http_proxy_options *ho;
5309
5310 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5311 ho = init_http_proxy_options_once(&options->ce.http_proxy_options, &options->gc);
5312
5313 if (streq(p[1], "VERSION") && p[2] && !p[3])
5314 {
5315 ho->http_version = p[2];
5316 }
5317 else if (streq(p[1], "AGENT") && p[2] && !p[3])
5318 {
5319 ho->user_agent = p[2];
5320 }
5321 else if ((streq(p[1], "EXT1") || streq(p[1], "EXT2") || streq(p[1], "CUSTOM-HEADER"))
5322 && p[2])
5323 {
5324 /* In the wild patched versions use both EXT1/2 and CUSTOM-HEADER
5325 * with either two argument or one */
5326
5327 struct http_custom_header *custom_header = NULL;
5328 int i;
5329 /* Find the first free header */
5330 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER; i++)
5331 {
5332 if (!ho->custom_headers[i].name)
5333 {
5334 custom_header = &ho->custom_headers[i];
5335 break;
5336 }
5337 }
5338 if (!custom_header)
5339 {
5340 msg(msglevel, "Cannot use more than %d http-proxy-option CUSTOM-HEADER : '%s'",
5341 MAX_CUSTOM_HTTP_HEADER, p[1]);
5342 }
5343 else
5344 {
5345 /* We will save p[2] and p[3], the proxy code will detect if
5346 * p[3] is NULL */
5347 custom_header->name = p[2];
5348 custom_header->content = p[3];
5349 }
5350 }
5351 else
5352 {
5353 msg(msglevel, "Bad http-proxy-option or missing or extra parameter: '%s'", p[1]);
5354 }
5355 }
5356 else if (streq(p[0], "socks-proxy") && p[1] && !p[4])
5357 {
5358 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5359
5360 if (p[2])
5361 {
5362 options->ce.socks_proxy_port = p[2];
5363 }
5364 else
5365 {
5366 options->ce.socks_proxy_port = "1080";
5367 }
5368 options->ce.socks_proxy_server = p[1];
5369 options->ce.socks_proxy_authfile = p[3]; /* might be NULL */
5370 }
5371 else if (streq(p[0], "keepalive") && p[1] && p[2] && !p[3])
5372 {
5373 VERIFY_PERMISSION(OPT_P_GENERAL);
5374 atoi_constrained(p[1], &options->keepalive_ping, "keepalive ping",
5375 1, PING_TIMEOUT_MAX, msglevel);
5376 atoi_constrained(p[2], &options->keepalive_timeout, "keepalive timeout",
5377 1, PING_TIMEOUT_MAX, msglevel);
5378 }
5379 else if (streq(p[0], "ping") && p[1] && !p[2])
5380 {
5381 VERIFY_PERMISSION(OPT_P_TIMER);
5382 atoi_constrained(p[1], &options->ping_send_timeout, p[0],
5383 0, PING_TIMEOUT_MAX, msglevel);
5384 }
5385 else if (streq(p[0], "ping-exit") && p[1] && !p[2])
5386 {
5387 VERIFY_PERMISSION(OPT_P_TIMER);
5388 atoi_constrained(p[1], &options->ping_rec_timeout, p[0],
5389 0, PING_TIMEOUT_MAX, msglevel);
5390 options->ping_rec_timeout_action = PING_EXIT;
5391 }
5392 else if (streq(p[0], "ping-restart") && p[1] && !p[2])
5393 {
5394 VERIFY_PERMISSION(OPT_P_TIMER);
5395 atoi_constrained(p[1], &options->ping_rec_timeout, p[0],
5396 0, PING_TIMEOUT_MAX, msglevel);
5397 options->ping_rec_timeout_action = PING_RESTART;
5398 }
5399 else if (streq(p[0], "ping-timer-rem") && !p[1])
5400 {
5401 VERIFY_PERMISSION(OPT_P_TIMER);
5402 options->ping_timer_remote = true;
5403 }
5404 else if (streq(p[0], "explicit-exit-notify") && !p[2])
5405 {
5406 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_EXPLICIT_NOTIFY);
5407 if (p[1])
5408 {
5409 options->ce.explicit_exit_notification = positive_atoi(p[1], msglevel);
5410 }
5411 else
5412 {
5413 options->ce.explicit_exit_notification = 1;
5414 }
5415 }
5416 else if (streq(p[0], "persist-tun") && !p[1])
5417 {
5418 VERIFY_PERMISSION(OPT_P_PERSIST);
5419 options->persist_tun = true;
5420 }
5421 else if (streq(p[0], "persist-key") && !p[1])
5422 {
5423 VERIFY_PERMISSION(OPT_P_PERSIST);
5424 msg(M_WARN, "DEPRECATED OPTION: --persist-key option ignored. "
5425 "Keys are now always persisted across restarts. ");
5426 }
5427 else if (streq(p[0], "persist-local-ip") && !p[1])
5428 {
5429 VERIFY_PERMISSION(OPT_P_PERSIST_IP);
5430 options->persist_local_ip = true;
5431 }
5432 else if (streq(p[0], "persist-remote-ip") && !p[1])
5433 {
5434 VERIFY_PERMISSION(OPT_P_PERSIST_IP);
5435 options->persist_remote_ip = true;
5436 }
5437 else if (streq(p[0], "client-nat") && p[1] && p[2] && p[3] && p[4] && !p[5])
5438 {
5439 VERIFY_PERMISSION(OPT_P_ROUTE);
5440 cnol_check_alloc(options);
5441 add_client_nat_to_option_list(options->client_nat, p[1], p[2], p[3], p[4], msglevel);
5442 }
5443 else if (streq(p[0], "route-table") && p[1] && !p[2])
5444 {
5445#ifndef ENABLE_SITNL
5446 msg(M_WARN, "NOTE: --route-table is supported only on Linux when SITNL is built-in");
5447#endif
5448 VERIFY_PERMISSION(OPT_P_ROUTE_TABLE);
5449 options->route_default_table_id = positive_atoi(p[1], msglevel);
5450 }
5451 else if (streq(p[0], "route") && p[1] && !p[5])
5452 {
5453 VERIFY_PERMISSION(OPT_P_ROUTE);
5454 if (!check_route_option(options, p, msglevel, pull_mode))
5455 {
5456 goto err;
5457 }
5458 add_route_to_option_list(options->routes, p[1], p[2], p[3], p[4],
5459 options->route_default_table_id);
5460 }
5461 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
5462 {
5463 VERIFY_PERMISSION(OPT_P_ROUTE);
5464 if (!check_route6_option(options, p, msglevel, pull_mode))
5465 {
5466 goto err;
5467 }
5468 add_route_ipv6_to_option_list(options->routes_ipv6, p[1], p[2], p[3],
5469 options->route_default_table_id);
5470 }
5471 else if (streq(p[0], "max-routes") && !p[2])
5472 {
5473 msg(M_WARN, "DEPRECATED OPTION: --max-routes option ignored.");
5474 }
5475 else if (streq(p[0], "route-gateway") && p[1] && !p[2])
5476 {
5477 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
5478 if (streq(p[1], "dhcp"))
5479 {
5480 options->route_gateway_via_dhcp = true;
5481 }
5482 else
5483 {
5484 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn)
5485 || is_special_addr(p[1])) /* FQDN -- may be DNS name */
5486 {
5487 options->route_default_gateway = p[1];
5488 }
5489 else
5490 {
5491 msg(msglevel, "route-gateway parm '%s' must be a valid address", p[1]);
5492 goto err;
5493 }
5494 }
5495 }
5496 else if (streq(p[0], "route-ipv6-gateway") && p[1] && !p[2])
5497 {
5498 if (ipv6_addr_safe(p[1]))
5499 {
5500 options->route_ipv6_default_gateway = p[1];
5501 }
5502 else
5503 {
5504 msg(msglevel, "route-ipv6-gateway parm '%s' must be a valid address", p[1]);
5505 goto err;
5506 }
5507 }
5508 else if (streq(p[0], "route-metric") && p[1] && !p[2])
5509 {
5510 VERIFY_PERMISSION(OPT_P_ROUTE);
5511 options->route_default_metric = positive_atoi(p[1], msglevel);
5512 }
5513 else if (streq(p[0], "route-delay") && !p[3])
5514 {
5515 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
5516 options->route_delay_defined = true;
5517 if (p[1])
5518 {
5519 options->route_delay = positive_atoi(p[1], msglevel);
5520 if (p[2])
5521 {
5522 options->route_delay_window = positive_atoi(p[2], msglevel);
5523 }
5524 }
5525 else
5526 {
5527 options->route_delay = 0;
5528 }
5529 }
5530 else if (streq(p[0], "route-up") && p[1])
5531 {
5532 VERIFY_PERMISSION(OPT_P_SCRIPT);
5533 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
5534 {
5535 goto err;
5536 }
5537 set_user_script(options, &options->route_script, p[1], "route-up", false);
5538 }
5539 else if (streq(p[0], "route-pre-down") && p[1])
5540 {
5541 VERIFY_PERMISSION(OPT_P_SCRIPT);
5542 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
5543 {
5544 goto err;
5545 }
5546 set_user_script(options, &options->route_predown_script, p[1], "route-pre-down", true);
5547 }
5548 else if (streq(p[0], "route-noexec") && !p[1])
5549 {
5550 VERIFY_PERMISSION(OPT_P_SCRIPT);
5551 options->route_noexec = true;
5552 }
5553 else if (streq(p[0], "route-nopull") && !p[1])
5554 {
5555 VERIFY_PERMISSION(OPT_P_GENERAL);
5556 options->route_nopull = true;
5557 }
5558 else if (streq(p[0], "pull-filter") && p[1] && p[2] && !p[3])
5559 {
5560 struct pull_filter *f;
5561 VERIFY_PERMISSION(OPT_P_GENERAL)
5562 f = alloc_pull_filter(options);
5563
5564 if (strcmp("accept", p[1]) == 0)
5565 {
5566 f->type = PUF_TYPE_ACCEPT;
5567 }
5568 else if (strcmp("ignore", p[1]) == 0)
5569 {
5570 f->type = PUF_TYPE_IGNORE;
5571 }
5572 else if (strcmp("reject", p[1]) == 0)
5573 {
5574 f->type = PUF_TYPE_REJECT;
5575 }
5576 else
5577 {
5578 msg(msglevel, "Unknown --pull-filter type: %s", p[1]);
5579 goto err;
5580 }
5581 f->pattern = p[2];
5582 f->size = strlen(p[2]);
5583 }
5584 else if (streq(p[0], "allow-pull-fqdn") && !p[1])
5585 {
5586 VERIFY_PERMISSION(OPT_P_GENERAL);
5587 options->allow_pull_fqdn = true;
5588 }
5589 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
5590 {
5591 int j;
5592 VERIFY_PERMISSION(OPT_P_ROUTE);
5593 rol_check_alloc(options);
5594
5595 if (options->routes->flags & RG_ENABLE)
5596 {
5597 msg(M_WARN, "WARNING: You have specified redirect-gateway and "
5598 "redirect-private at the same time (or the same option "
5599 "multiple times). This is not well supported and may lead to "
5600 "unexpected results");
5601 }
5602
5603 options->routes->flags |= RG_ENABLE;
5604
5605 if (streq(p[0], "redirect-gateway"))
5606 {
5607 options->routes->flags |= RG_REROUTE_GW;
5608 }
5609 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
5610 {
5611 if (streq(p[j], "local"))
5612 {
5613 options->routes->flags |= RG_LOCAL;
5614 }
5615 else if (streq(p[j], "autolocal"))
5616 {
5617 options->routes->flags |= RG_AUTO_LOCAL;
5618 }
5619 else if (streq(p[j], "def1"))
5620 {
5621 options->routes->flags |= RG_DEF1;
5622 }
5623 else if (streq(p[j], "bypass-dhcp"))
5624 {
5625 options->routes->flags |= RG_BYPASS_DHCP;
5626 }
5627 else if (streq(p[j], "bypass-dns"))
5628 {
5629 options->routes->flags |= RG_BYPASS_DNS;
5630 }
5631 else if (streq(p[j], "block-local"))
5632 {
5633 options->routes->flags |= RG_BLOCK_LOCAL;
5634 }
5635 else if (streq(p[j], "ipv6"))
5636 {
5637 rol6_check_alloc(options);
5638 options->routes_ipv6->flags |= RG_REROUTE_GW;
5639 }
5640 else if (streq(p[j], "!ipv4"))
5641 {
5642 options->routes->flags &= ~(RG_REROUTE_GW | RG_ENABLE);
5643 }
5644 else
5645 {
5646 msg(msglevel, "unknown --%s flag: %s", p[0], p[j]);
5647 goto err;
5648 }
5649 }
5650 if (options->routes->flags & RG_REROUTE_GW)
5651 {
5652 setenv_int(es, "route_redirect_gateway_ipv4",
5653 (options->routes->flags & RG_BLOCK_LOCAL) ? 2 : 1);
5654 }
5655 if (options->routes_ipv6 && (options->routes_ipv6->flags & RG_REROUTE_GW))
5656 {
5657 setenv_int(es, "route_redirect_gateway_ipv6",
5658 (options->routes->flags & RG_BLOCK_LOCAL) ? 2 : 1);
5659 }
5660#ifdef _WIN32
5661 /* we need this here to handle pushed --redirect-gateway */
5662 remap_redirect_gateway_flags(options);
5663#endif
5664 }
5665 else if (streq(p[0], "block-ipv6") && !p[1])
5666 {
5667 VERIFY_PERMISSION(OPT_P_ROUTE);
5668 options->block_ipv6 = true;
5669 }
5670 else if (streq(p[0], "remote-random-hostname") && !p[1])
5671 {
5672 VERIFY_PERMISSION(OPT_P_GENERAL);
5673 options->sockflags |= SF_HOST_RANDOMIZE;
5674 }
5675 else if (streq(p[0], "setenv") && p[1] && !p[3])
5676 {
5677 VERIFY_PERMISSION(OPT_P_GENERAL);
5678 if (streq(p[1], "REMOTE_RANDOM_HOSTNAME") && !p[2])
5679 {
5680 options->sockflags |= SF_HOST_RANDOMIZE;
5681 }
5682 else if (streq(p[1], "GENERIC_CONFIG"))
5683 {
5684 msg(msglevel, "this is a generic configuration and cannot directly be used");
5685 goto err;
5686 }
5687 else if (streq(p[1], "PUSH_PEER_INFO") && !p[2])
5688 {
5689 options->push_peer_info = true;
5690 }
5691 else if (streq(p[1], "SERVER_POLL_TIMEOUT") && p[2])
5692 {
5693 options->ce.connect_timeout = positive_atoi(p[2], msglevel);
5694 }
5695 else
5696 {
5697 if (streq(p[1], "FORWARD_COMPATIBLE") && p[2] && streq(p[2], "1"))
5698 {
5699 options->forward_compatible = true;
5700 msglevel_fc = msglevel_forward_compatible(options, msglevel);
5701 }
5702 setenv_str(es, p[1], p[2] ? p[2] : "");
5703 }
5704 }
5705 else if (streq(p[0], "compat-mode") && p[1] && !p[3])
5706 {
5707 unsigned int major, minor, patch;
5708 if (!(sscanf(p[1], "%u.%u.%u", &major, &minor, &patch) == 3))
5709 {
5710 msg(msglevel, "cannot parse version number for --compat-mode: %s", p[1]);
5711 goto err;
5712 }
5713
5714 options->backwards_compatible = major * 10000 + minor * 100 + patch;
5715 }
5716 else if (streq(p[0], "setenv-safe") && p[1] && !p[3])
5717 {
5718 VERIFY_PERMISSION(OPT_P_SETENV);
5719 setenv_str_safe(es, p[1], p[2] ? p[2] : "");
5720 }
5721 else if (streq(p[0], "script-security") && p[1] && !p[2])
5722 {
5723 VERIFY_PERMISSION(OPT_P_GENERAL);
5724 int security;
5725 if (atoi_constrained(p[1], &security, p[0], SSEC_NONE, SSEC_PW_ENV, msglevel))
5726 {
5727 script_security_set(security);
5728 }
5729 }
5730 else if (streq(p[0], "mssfix") && !p[3])
5731 {
5732 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
5733 if (p[1])
5734 {
5735 int mssfix;
5736 if (!atoi_constrained(p[1], &mssfix, p[0], 0, UINT16_MAX, msglevel))
5737 {
5738 goto err;
5739 }
5740 if (mssfix != 0 && mssfix < TLS_CHANNEL_MTU_MIN)
5741 {
5742 msg(msglevel, "mssfix needs to be >= %d, not %d", TLS_CHANNEL_MTU_MIN, mssfix);
5743 goto err;
5744 }
5745
5746 /* value specified, assume encapsulation is not
5747 * included unless "mtu" follows later */
5748 options->ce.mssfix = mssfix;
5749 options->ce.mssfix_encap = false;
5750 options->ce.mssfix_default = false;
5751 }
5752 else
5753 {
5754 /* Set MTU to default values */
5755 options->ce.mssfix_default = true;
5756 options->ce.mssfix_encap = true;
5757 options->ce.mssfix_fixed = false;
5758 }
5759
5760 if (p[2] && streq(p[2], "mtu"))
5761 {
5762 options->ce.mssfix_encap = true;
5763 }
5764 else if (p[2] && streq(p[2], "fixed"))
5765 {
5766 options->ce.mssfix_fixed = true;
5767 }
5768 else if (p[2])
5769 {
5770 msg(msglevel, "Unknown parameter to --mssfix: %s", p[2]);
5771 }
5772 }
5773 else if (streq(p[0], "disable-occ") && !p[1])
5774 {
5775 VERIFY_PERMISSION(OPT_P_GENERAL);
5776 options->occ = false;
5777 }
5778 else if (streq(p[0], "server") && p[1] && p[2] && !p[4])
5779 {
5780 const int lev = M_WARN;
5781 bool error = false;
5782 in_addr_t network, netmask;
5783
5784 VERIFY_PERMISSION(OPT_P_GENERAL);
5785 network = get_ip_addr(p[1], lev, &error);
5786 netmask = get_ip_addr(p[2], lev, &error);
5787 if (error || !network || !netmask)
5788 {
5789 msg(msglevel, "error parsing --server parameters");
5790 goto err;
5791 }
5792 options->server_defined = true;
5793 options->server_network = network;
5794 options->server_netmask = netmask;
5795
5796 if (p[3])
5797 {
5798 if (streq(p[3], "nopool"))
5799 {
5800 options->server_flags |= SF_NOPOOL;
5801 }
5802 else
5803 {
5804 msg(msglevel, "error parsing --server: %s is not a recognized flag", p[3]);
5805 goto err;
5806 }
5807 }
5808 }
5809 else if (streq(p[0], "server-ipv6") && p[1] && !p[2])
5810 {
5811 const int lev = M_WARN;
5812 struct in6_addr network;
5813 unsigned int netbits = 0;
5814
5815 VERIFY_PERMISSION(OPT_P_GENERAL);
5816 if (!get_ipv6_addr(p[1], &network, &netbits, lev))
5817 {
5818 msg(msglevel, "error parsing --server-ipv6 parameter");
5819 goto err;
5820 }
5821 if (netbits < 64 || netbits > 124)
5822 {
5823 msg(msglevel, "--server-ipv6 settings: network must be between /64 and /124 (not /%d)",
5824 netbits);
5825
5826 goto err;
5827 }
5828 options->server_ipv6_defined = true;
5829 options->server_network_ipv6 = network;
5830 options->server_netbits_ipv6 = netbits;
5831 }
5832 else if (streq(p[0], "server-bridge") && p[1] && p[2] && p[3] && p[4] && !p[5])
5833 {
5834 const int lev = M_WARN;
5835 bool error = false;
5836 in_addr_t ip, netmask, pool_start, pool_end;
5837
5838 VERIFY_PERMISSION(OPT_P_GENERAL);
5839 ip = get_ip_addr(p[1], lev, &error);
5840 netmask = get_ip_addr(p[2], lev, &error);
5841 pool_start = get_ip_addr(p[3], lev, &error);
5842 pool_end = get_ip_addr(p[4], lev, &error);
5843 if (error || !ip || !netmask || !pool_start || !pool_end)
5844 {
5845 msg(msglevel, "error parsing --server-bridge parameters");
5846 goto err;
5847 }
5848 options->server_bridge_defined = true;
5849 options->server_bridge_ip = ip;
5850 options->server_bridge_netmask = netmask;
5851 options->server_bridge_pool_start = pool_start;
5852 options->server_bridge_pool_end = pool_end;
5853 }
5854 else if (streq(p[0], "server-bridge") && p[1] && streq(p[1], "nogw") && !p[2])
5855 {
5856 VERIFY_PERMISSION(OPT_P_GENERAL);
5857 options->server_bridge_proxy_dhcp = true;
5858 options->server_flags |= SF_NO_PUSH_ROUTE_GATEWAY;
5859 }
5860 else if (streq(p[0], "server-bridge") && !p[1])
5861 {
5862 VERIFY_PERMISSION(OPT_P_GENERAL);
5863 options->server_bridge_proxy_dhcp = true;
5864 }
5865 else if (streq(p[0], "push") && p[1] && !p[2])
5866 {
5867 VERIFY_PERMISSION(OPT_P_PUSH);
5868 push_options(options, &p[1], msglevel, &options->gc);
5869 }
5870 else if (streq(p[0], "push-reset") && !p[1])
5871 {
5872 VERIFY_PERMISSION(OPT_P_INSTANCE);
5873 push_reset(options);
5874 }
5875 else if (streq(p[0], "push-remove") && p[1] && !p[2])
5876 {
5877 VERIFY_PERMISSION(OPT_P_INSTANCE);
5878 msg(D_PUSH, "PUSH_REMOVE '%s'", p[1]);
5879 push_remove_option(options, p[1]);
5880 }
5881 else if (streq(p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
5882 {
5883 const int lev = M_WARN;
5884 bool error = false;
5885 in_addr_t start, end, netmask = 0;
5886
5887 VERIFY_PERMISSION(OPT_P_GENERAL);
5888 start = get_ip_addr(p[1], lev, &error);
5889 end = get_ip_addr(p[2], lev, &error);
5890 if (p[3])
5891 {
5892 netmask = get_ip_addr(p[3], lev, &error);
5893 }
5894 if (error)
5895 {
5896 msg(msglevel, "error parsing --ifconfig-pool parameters");
5897 goto err;
5898 }
5899 if (!ifconfig_pool_verify_range(msglevel, start, end))
5900 {
5901 goto err;
5902 }
5903
5904 options->ifconfig_pool_defined = true;
5905 options->ifconfig_pool_start = start;
5906 options->ifconfig_pool_end = end;
5907 if (netmask)
5908 {
5909 options->ifconfig_pool_netmask = netmask;
5910 }
5911 }
5912 else if (streq(p[0], "ifconfig-pool-persist") && p[1] && !p[3])
5913 {
5914 VERIFY_PERMISSION(OPT_P_GENERAL);
5915 options->ifconfig_pool_persist_filename = p[1];
5916 if (p[2])
5917 {
5918 options->ifconfig_pool_persist_refresh_freq = positive_atoi(p[2], msglevel);
5919 }
5920 }
5921 else if (streq(p[0], "ifconfig-ipv6-pool") && p[1] && !p[2])
5922 {
5923 const int lev = M_WARN;
5924 struct in6_addr network;
5925 unsigned int netbits = 0;
5926
5927 VERIFY_PERMISSION(OPT_P_GENERAL);
5928 if (!get_ipv6_addr(p[1], &network, &netbits, lev))
5929 {
5930 msg(msglevel, "error parsing --ifconfig-ipv6-pool parameters");
5931 goto err;
5932 }
5933 if (netbits < 64 || netbits > 124)
5934 {
5935 msg(msglevel,
5936 "--ifconfig-ipv6-pool settings: network must be between /64 and /124 (not /%d)",
5937 netbits);
5938 goto err;
5939 }
5940
5941 options->ifconfig_ipv6_pool_defined = true;
5942 options->ifconfig_ipv6_pool_base = network;
5943 options->ifconfig_ipv6_pool_netbits = netbits;
5944 }
5945 else if (streq(p[0], "hash-size") && p[1] && p[2] && !p[3])
5946 {
5947 int real, virtual;
5948
5949 VERIFY_PERMISSION(OPT_P_GENERAL);
5950 if (!atoi_constrained(p[1], &real, "hash-size real", 1, INT_MAX, msglevel)
5951 || !atoi_constrained(p[2], &virtual, "hash-size virtual", 1, INT_MAX, msglevel))
5952 {
5953 goto err;
5954 }
5955 options->real_hash_size = (uint32_t)real;
5956 options->virtual_hash_size = (uint32_t)virtual;
5957 }
5958 else if (streq(p[0], "connect-freq") && p[1] && p[2] && !p[3])
5959 {
5960 int cf_max, cf_per;
5961
5962 VERIFY_PERMISSION(OPT_P_GENERAL);
5963 if (!atoi_constrained(p[1], &cf_max, "connect-freq n", 1, INT_MAX, msglevel)
5964 || !atoi_constrained(p[2], &cf_per, "connect-freq seconds", 1, INT_MAX, msglevel))
5965 {
5966 goto err;
5967 }
5968 options->cf_max = cf_max;
5969 options->cf_per = cf_per;
5970 }
5971 else if (streq(p[0], "connect-freq-initial") && p[1] && p[2] && !p[3])
5972 {
5973 int cf_max, cf_per;
5974
5975 VERIFY_PERMISSION(OPT_P_GENERAL);
5976 if (!atoi_constrained(p[1], &cf_max, "connect-freq-initial n", 1, INT_MAX, msglevel)
5977 || !atoi_constrained(p[2], &cf_per, "connect-freq-initial seconds", 1, INT_MAX, msglevel))
5978 {
5979 goto err;
5980 }
5981 options->cf_initial_max = cf_max;
5982 options->cf_initial_per = cf_per;
5983 }
5984 else if (streq(p[0], "max-clients") && p[1] && !p[2])
5985 {
5986 VERIFY_PERMISSION(OPT_P_GENERAL);
5987 if (!atoi_constrained(p[1], (int *)&options->max_clients, p[0], 1, MAX_PEER_ID - 1, msglevel))
5988 {
5989 goto err;
5990 }
5991 }
5992 else if (streq(p[0], "max-routes-per-client") && p[1] && !p[2])
5993 {
5994 VERIFY_PERMISSION(OPT_P_INHERIT);
5995 atoi_constrained(p[1], &options->max_routes_per_client, p[0], 1, INT_MAX, msglevel);
5996 }
5997 else if (streq(p[0], "client-cert-not-required") && !p[1])
5998 {
5999 VERIFY_PERMISSION(OPT_P_GENERAL);
6000 msg(M_FATAL,
6001 "REMOVED OPTION: --client-cert-not-required, use '--verify-client-cert none' instead");
6002 }
6003 else if (streq(p[0], "verify-client-cert") && !p[2])
6004 {
6005 VERIFY_PERMISSION(OPT_P_GENERAL);
6006
6007 /* Reset any existing flags */
6008 options->ssl_flags &= ~SSLF_CLIENT_CERT_OPTIONAL;
6009 options->ssl_flags &= ~SSLF_CLIENT_CERT_NOT_REQUIRED;
6010 if (p[1])
6011 {
6012 if (streq(p[1], "none"))
6013 {
6014 options->ssl_flags |= SSLF_CLIENT_CERT_NOT_REQUIRED;
6015 }
6016 else if (streq(p[1], "optional"))
6017 {
6018 options->ssl_flags |= SSLF_CLIENT_CERT_OPTIONAL;
6019 }
6020 else if (!streq(p[1], "require"))
6021 {
6022 msg(msglevel,
6023 "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
6024 goto err;
6025 }
6026 }
6027 }
6028 else if (streq(p[0], "username-as-common-name") && !p[1])
6029 {
6030 VERIFY_PERMISSION(OPT_P_GENERAL);
6031 options->ssl_flags |= SSLF_USERNAME_AS_COMMON_NAME;
6032 }
6033 else if (streq(p[0], "auth-user-pass-optional") && !p[1])
6034 {
6035 VERIFY_PERMISSION(OPT_P_GENERAL);
6036 options->ssl_flags |= SSLF_AUTH_USER_PASS_OPTIONAL;
6037 }
6038 else if (streq(p[0], "opt-verify") && !p[1])
6039 {
6040 VERIFY_PERMISSION(OPT_P_GENERAL);
6041 msg(M_INFO, "DEPRECATED OPTION: --opt-verify was removed in OpenVPN 2.7.");
6042 }
6043 else if (streq(p[0], "auth-user-pass-verify") && p[1])
6044 {
6045 VERIFY_PERMISSION(OPT_P_SCRIPT);
6046 if (!no_more_than_n_args(msglevel, p, 3, NM_QUOTE_HINT))
6047 {
6048 goto err;
6049 }
6050 if (p[2])
6051 {
6052 if (streq(p[2], "via-env"))
6053 {
6054 options->auth_user_pass_verify_script_via_file = false;
6055 }
6056 else if (streq(p[2], "via-file"))
6057 {
6058 options->auth_user_pass_verify_script_via_file = true;
6059 }
6060 else
6061 {
6062 msg(msglevel,
6063 "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
6064 goto err;
6065 }
6066 }
6067 else
6068 {
6069 msg(msglevel,
6070 "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
6071 goto err;
6072 }
6073 set_user_script(options, &options->auth_user_pass_verify_script, p[1],
6074 "auth-user-pass-verify", true);
6075 }
6076 else if (streq(p[0], "auth-gen-token"))
6077 {
6078 VERIFY_PERMISSION(OPT_P_GENERAL);
6079 options->auth_token_generate = true;
6080 options->auth_token_lifetime = p[1] ? positive_atoi(p[1], msglevel) : 0;
6081
6082 for (int i = 2; i < MAX_PARMS && p[i] != NULL; i++)
6083 {
6084 /* the second parameter can be the renewal time */
6085 if (i == 2 && valid_integer(p[i], true))
6086 {
6087 options->auth_token_renewal = positive_atoi(p[i], msglevel);
6088 }
6089 else if (streq(p[i], "external-auth"))
6090 {
6091 options->auth_token_call_auth = true;
6092 }
6093 else
6094 {
6095 msg(msglevel, "Invalid argument to auth-gen-token: %s (%d)", p[i], i);
6096 }
6097 }
6098 }
6099 else if (streq(p[0], "auth-gen-token-secret") && p[1] && !p[2])
6100 {
6101 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6102 options->auth_token_secret_file = p[1];
6103 options->auth_token_secret_file_inline = is_inline;
6104 }
6105 else if (streq(p[0], "client-connect") && p[1])
6106 {
6107 VERIFY_PERMISSION(OPT_P_SCRIPT);
6108 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6109 {
6110 goto err;
6111 }
6112 set_user_script(options, &options->client_connect_script, p[1], "client-connect", true);
6113 }
6114 else if (streq(p[0], "client-crresponse") && p[1])
6115 {
6116 VERIFY_PERMISSION(OPT_P_SCRIPT);
6117 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6118 {
6119 goto err;
6120 }
6121 set_user_script(options, &options->client_crresponse_script, p[1], "client-crresponse",
6122 true);
6123 }
6124 else if (streq(p[0], "client-disconnect") && p[1])
6125 {
6126 VERIFY_PERMISSION(OPT_P_SCRIPT);
6127 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6128 {
6129 goto err;
6130 }
6131 set_user_script(options, &options->client_disconnect_script, p[1], "client-disconnect",
6132 true);
6133 }
6134 else if (streq(p[0], "learn-address") && p[1])
6135 {
6136 VERIFY_PERMISSION(OPT_P_SCRIPT);
6137 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6138 {
6139 goto err;
6140 }
6141 set_user_script(options, &options->learn_address_script, p[1], "learn-address", true);
6142 }
6143 else if (streq(p[0], "tmp-dir") && p[1] && !p[2])
6144 {
6145 VERIFY_PERMISSION(OPT_P_GENERAL);
6146 options->tmp_dir = p[1];
6147 }
6148 else if (streq(p[0], "client-config-dir") && p[1] && !p[2])
6149 {
6150 VERIFY_PERMISSION(OPT_P_GENERAL);
6151 options->client_config_dir = p[1];
6152 }
6153 else if (streq(p[0], "ccd-exclusive") && !p[1])
6154 {
6155 VERIFY_PERMISSION(OPT_P_GENERAL);
6156 options->ccd_exclusive = true;
6157 }
6158 else if (streq(p[0], "bcast-buffers") && p[1] && !p[2])
6159 {
6160 VERIFY_PERMISSION(OPT_P_GENERAL);
6161 atoi_constrained(p[1], &options->n_bcast_buf, p[0], 1, MBUF_SIZE_MAX, msglevel);
6162 }
6163 else if (streq(p[0], "tcp-queue-limit") && p[1] && !p[2])
6164 {
6165 VERIFY_PERMISSION(OPT_P_GENERAL);
6166 atoi_constrained(p[1], &options->tcp_queue_limit, p[0], 1, INT_MAX, msglevel);
6167 }
6168#if PORT_SHARE
6169 else if (streq(p[0], "port-share") && p[1] && p[2] && !p[4])
6170 {
6171 VERIFY_PERMISSION(OPT_P_GENERAL);
6172 options->port_share_host = p[1];
6173 options->port_share_port = p[2];
6174 options->port_share_journal_dir = p[3];
6175 }
6176#endif
6177 else if (streq(p[0], "client-to-client") && !p[1])
6178 {
6179 VERIFY_PERMISSION(OPT_P_GENERAL);
6180 options->enable_c2c = true;
6181 }
6182 else if (streq(p[0], "duplicate-cn") && !p[1])
6183 {
6184 VERIFY_PERMISSION(OPT_P_GENERAL);
6185 options->duplicate_cn = true;
6186 }
6187 else if (streq(p[0], "iroute") && p[1] && !p[3])
6188 {
6189 VERIFY_PERMISSION(OPT_P_INSTANCE);
6190 option_iroute(options, p[1], p[2], msglevel);
6191 }
6192 else if (streq(p[0], "iroute-ipv6") && p[1] && !p[2])
6193 {
6194 VERIFY_PERMISSION(OPT_P_INSTANCE);
6195 option_iroute_ipv6(options, p[1], msglevel);
6196 }
6197 else if (streq(p[0], "ifconfig-push") && p[1] && p[2] && !p[4])
6198 {
6199 in_addr_t local, remote_netmask;
6200
6201 VERIFY_PERMISSION(OPT_P_INSTANCE);
6202 local = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[1], 0, NULL, NULL);
6203 remote_netmask = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[2], 0, NULL, NULL);
6204 if (local && remote_netmask)
6205 {
6206 options->push_ifconfig_defined = true;
6207 options->push_ifconfig_local = local;
6208 options->push_ifconfig_remote_netmask = remote_netmask;
6209 if (p[3])
6210 {
6211 options->push_ifconfig_local_alias =
6212 getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[3], 0, NULL, NULL);
6213 }
6214 }
6215 else
6216 {
6217 msg(msglevel, "cannot parse --ifconfig-push addresses");
6218 goto err;
6219 }
6220 }
6221 else if (streq(p[0], "ifconfig-push-constraint") && p[1] && p[2] && !p[3])
6222 {
6223 in_addr_t network, netmask;
6224
6225 VERIFY_PERMISSION(OPT_P_GENERAL);
6226 network = getaddr(GETADDR_HOST_ORDER | GETADDR_RESOLVE, p[1], 0, NULL, NULL);
6227 netmask = getaddr(GETADDR_HOST_ORDER, p[2], 0, NULL, NULL);
6228 if (network && netmask)
6229 {
6230 options->push_ifconfig_constraint_defined = true;
6231 options->push_ifconfig_constraint_network = network;
6232 options->push_ifconfig_constraint_netmask = netmask;
6233 }
6234 else
6235 {
6236 msg(msglevel, "cannot parse --ifconfig-push-constraint addresses");
6237 goto err;
6238 }
6239 }
6240 else if (streq(p[0], "ifconfig-ipv6-push") && p[1] && !p[3])
6241 {
6242 struct in6_addr local, remote;
6243 unsigned int netbits;
6244
6245 VERIFY_PERMISSION(OPT_P_INSTANCE);
6246
6247 if (!get_ipv6_addr(p[1], &local, &netbits, msglevel))
6248 {
6249 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
6250 goto err;
6251 }
6252
6253 if (p[2])
6254 {
6255 if (!get_ipv6_addr(p[2], &remote, NULL, msglevel))
6256 {
6257 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
6258 goto err;
6259 }
6260 }
6261 else
6262 {
6263 if (!options->ifconfig_ipv6_local
6264 || !get_ipv6_addr(options->ifconfig_ipv6_local, &remote, NULL, msglevel))
6265 {
6266 msg(msglevel,
6267 "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
6268 goto err;
6269 }
6270 }
6271
6272 options->push_ifconfig_ipv6_defined = true;
6273 options->push_ifconfig_ipv6_local = local;
6274 options->push_ifconfig_ipv6_netbits = netbits;
6275 options->push_ifconfig_ipv6_remote = remote;
6276 options->push_ifconfig_ipv6_blocked = false;
6277 }
6278 else if (streq(p[0], "disable") && !p[1])
6279 {
6280 VERIFY_PERMISSION(OPT_P_INSTANCE);
6281 options->disable = true;
6282 }
6283 else if (streq(p[0], "override-username") && p[1] && !p[2])
6284 {
6285 VERIFY_PERMISSION(OPT_P_INSTANCE);
6286 if (strlen(p[1]) > USER_PASS_LEN)
6287 {
6288 msg(msglevel,
6289 "override-username exceeds the maximum length of %d "
6290 "characters",
6291 USER_PASS_LEN);
6292
6293 /* disable the connection since ignoring the request to
6294 * set another username might cause serious problems */
6295 options->disable = true;
6296 }
6297 else
6298 {
6299 options->override_username = p[1];
6300 }
6301 }
6302 else if (streq(p[0], "tcp-nodelay") && !p[1])
6303 {
6304 VERIFY_PERMISSION(OPT_P_GENERAL);
6305 options->server_flags |= SF_TCP_NODELAY_HELPER;
6306 }
6307 else if (streq(p[0], "stale-routes-check") && p[1] && !p[3])
6308 {
6309 int ageing_time, check_interval;
6310
6311 VERIFY_PERMISSION(OPT_P_GENERAL);
6312 if (!atoi_constrained(p[1], &ageing_time, "stale-routes-check age", 1, INT_MAX, msglevel))
6313 {
6314 goto err;
6315 }
6316
6317 if (p[2])
6318 {
6319 if (!atoi_constrained(p[2], &check_interval,
6320 "stale-routes-check interval", 1, INT_MAX, msglevel))
6321 {
6322 goto err;
6323 }
6324 }
6325 else
6326 {
6327 check_interval = ageing_time;
6328 }
6329
6330 options->stale_routes_ageing_time = ageing_time;
6331 options->stale_routes_check_interval = check_interval;
6332 }
6333
6334 else if (streq(p[0], "client") && !p[1])
6335 {
6336 VERIFY_PERMISSION(OPT_P_GENERAL);
6337 options->client = true;
6338 }
6339 else if (streq(p[0], "pull") && !p[1])
6340 {
6341 VERIFY_PERMISSION(OPT_P_GENERAL);
6342 options->pull = true;
6343 }
6344 else if (streq(p[0], "push-continuation") && p[1] && !p[2])
6345 {
6346 VERIFY_PERMISSION(OPT_P_PULL_MODE);
6347 atoi_constrained(p[1], &options->push_continuation, p[0], 0, 2, msglevel);
6348 }
6349 else if (streq(p[0], "auth-user-pass") && !p[2])
6350 {
6351 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6352 options->auth_user_pass_username_only = false;
6353 if (p[1] && streq(p[1], "username-only"))
6354 {
6355 options->auth_user_pass_username_only = true;
6356 options->auth_user_pass_file = "stdin";
6357 }
6358 else if (p[1])
6359 {
6360 options->auth_user_pass_file = p[1];
6361 options->auth_user_pass_file_inline = is_inline;
6362 }
6363 else
6364 {
6365 options->auth_user_pass_file = "stdin";
6366 }
6367 }
6368 else if (streq(p[0], "auth-retry") && p[1] && !p[2])
6369 {
6370 VERIFY_PERMISSION(OPT_P_GENERAL);
6371 auth_retry_set(msglevel, p[1]);
6372 }
6373#ifdef ENABLE_MANAGEMENT
6374 else if (streq(p[0], "static-challenge") && p[1] && p[2] && !p[4])
6375 {
6376 VERIFY_PERMISSION(OPT_P_GENERAL);
6377 options->sc_info.challenge_text = p[1];
6378 if (atoi_warn(p[2], msglevel))
6379 {
6380 options->sc_info.flags |= SC_ECHO;
6381 }
6382 if (p[3] && streq(p[3], "concat"))
6383 {
6384 options->sc_info.flags |= SC_CONCAT;
6385 }
6386 else if (p[3] && !streq(p[3], "scrv1"))
6387 {
6388 msg(msglevel, "--static-challenge: unknown format indicator '%s'", p[3]);
6389 goto err;
6390 }
6391 }
6392#endif
6393 else if (streq(p[0], "msg-channel") && p[1])
6394 {
6395#ifdef _WIN32
6396 VERIFY_PERMISSION(OPT_P_GENERAL);
6397 HANDLE process = GetCurrentProcess();
6398 HANDLE handle = (HANDLE)((intptr_t)atoll(p[1]));
6399 if (!DuplicateHandle(process, handle, process, &options->msg_channel, 0, FALSE,
6400 DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS))
6401 {
6402 msg(msglevel, "could not duplicate service pipe handle");
6403 goto err;
6404 }
6405 options->route_method = ROUTE_METHOD_SERVICE;
6406#else /* ifdef _WIN32 */
6407 msg(msglevel, "--msg-channel is only supported on Windows");
6408 goto err;
6409#endif
6410 }
6411#ifdef _WIN32
6412 else if (streq(p[0], "win-sys") && p[1] && !p[2])
6413 {
6414 VERIFY_PERMISSION(OPT_P_GENERAL);
6415 if (streq(p[1], "env"))
6416 {
6417 msg(M_INFO, "NOTE: --win-sys env is default from OpenVPN 2.3. "
6418 "This entry will now be ignored. "
6419 "Please remove this entry from your configuration file.");
6420 }
6421 else
6422 {
6423 set_win_sys_path(p[1], es);
6424 }
6425 }
6426 else if (streq(p[0], "route-method") && p[1] && !p[2])
6427 {
6428 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
6429 if (streq(p[1], "adaptive"))
6430 {
6431 options->route_method = ROUTE_METHOD_ADAPTIVE;
6432 }
6433 else if (streq(p[1], "ipapi"))
6434 {
6435 options->route_method = ROUTE_METHOD_IPAPI;
6436 }
6437 else if (streq(p[1], "exe"))
6438 {
6439 options->route_method = ROUTE_METHOD_EXE;
6440 }
6441 else
6442 {
6443 msg(msglevel, "--route method must be 'adaptive', 'ipapi', or 'exe'");
6444 goto err;
6445 }
6446 }
6447 else if (streq(p[0], "ip-win32") && p[1] && !p[4])
6448 {
6449 const int index = ascii2ipset(p[1]);
6450 struct tuntap_options *to = &options->tuntap_options;
6451
6452 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6453
6454 if (index < 0)
6455 {
6456 msg(msglevel, "Bad --ip-win32 method: '%s'. Allowed methods: %s", p[1],
6457 ipset2ascii_all(&gc));
6458 goto err;
6459 }
6460
6461 if (index == IPW32_SET_ADAPTIVE)
6462 {
6463 options->route_delay_window = IPW32_SET_ADAPTIVE_DELAY_WINDOW;
6464 }
6465
6466 if (index == IPW32_SET_DHCP_MASQ)
6467 {
6468 if (p[2])
6469 {
6470 if (!streq(p[2], "default"))
6471 {
6472 int offset;
6473
6474 if (!atoi_constrained(p[2], &offset, "ip-win32 offset", -256, 256, msglevel))
6475 {
6476 goto err;
6477 }
6478 to->dhcp_masq_custom_offset = true;
6479 to->dhcp_masq_offset = offset;
6480 }
6481
6482 if (p[3])
6483 {
6484 if (!atoi_constrained(p[3], &to->dhcp_lease_time,
6485 "ip-win32 lease time", 30, INT_MAX, msglevel))
6486 {
6487 goto err;
6488 }
6489 }
6490 }
6491 }
6492 to->ip_win32_type = index;
6493 to->ip_win32_defined = true;
6494 }
6495#endif /* ifdef _WIN32 */
6496 else if (streq(p[0], "dns-updown") && p[1])
6497 {
6498 VERIFY_PERMISSION(OPT_P_SCRIPT);
6499 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6500 {
6501 goto err;
6502 }
6503 struct dns_options *dns = &options->dns_options;
6504 if (streq(p[1], "disable"))
6505 {
6506 dns->updown = NULL;
6507 dns->updown_flags = DNS_UPDOWN_NO_FLAGS;
6508 }
6509 else if (streq(p[1], "force"))
6510 {
6511 /* force dns-updown run, even if a --up script is defined */
6512 if (!dns_updown_user_set(dns))
6513 {
6514 dns->updown = DEFAULT_DNS_UPDOWN;
6515 dns->updown_flags = DNS_UPDOWN_FORCED;
6516 }
6517 }
6518 else
6519 {
6520 if (dns->updown && streq(dns->updown, DEFAULT_DNS_UPDOWN))
6521 {
6522 /* Unset the default command to prevent warnings */
6523 dns->updown = NULL;
6524 }
6525 set_user_script(options, &dns->updown, p[1], p[0], false);
6526 dns->updown_flags = DNS_UPDOWN_USER_SET;
6527 }
6528 }
6529 else if (streq(p[0], "dns") && p[1])
6530 {
6531 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6532 if (!check_dns_option(options, p, msglevel, pull_mode))
6533 {
6534 goto err;
6535 }
6536 }
6537 else if (streq(p[0], "dhcp-option") && p[1])
6538 {
6539 struct dhcp_options *dhcp = &options->dns_options.from_dhcp;
6540#if defined(_WIN32) || defined(TARGET_ANDROID)
6541 struct tuntap_options *o = &options->tuntap_options;
6542#endif
6543 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6544
6545 bool dhcp_optional = false;
6546
6547 if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX")) && p[2] && !p[3])
6548 {
6549 if (!validate_domain(p[2]))
6550 {
6551 msg(msglevel, "--dhcp-option %s contains invalid characters", p[1]);
6552 goto err;
6553 }
6554
6555 dhcp->domain = p[2];
6556 dhcp_optional = true;
6557 }
6558 else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3])
6559 {
6560 if (!validate_domain(p[2]))
6561 {
6562 msg(msglevel, "--dhcp-option %s contains invalid characters", p[1]);
6563 goto err;
6564 }
6565
6566 if (dhcp->domain_search_list_len < N_SEARCH_LIST_LEN)
6567 {
6568 dhcp->domain_search_list[dhcp->domain_search_list_len++] = p[2];
6569 }
6570 else
6571 {
6572 msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified",
6573 p[1], N_SEARCH_LIST_LEN);
6574 }
6575 dhcp_optional = true;
6576 }
6577 else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3]
6578 && (!strstr(p[2], ":") || ipv6_addr_safe(p[2])))
6579 {
6580 if (strstr(p[2], ":"))
6581 {
6582 dhcp_option_dns6_parse(p[2], dhcp->dns6, &dhcp->dns6_len, msglevel);
6583 }
6584 else
6585 {
6586 dhcp_option_address_parse("DNS", p[2], dhcp->dns, &dhcp->dns_len, msglevel);
6587 dhcp_optional = true;
6588 }
6589 }
6590#if defined(_WIN32) || defined(TARGET_ANDROID)
6591 else if (streq(p[1], "NBS") && p[2] && !p[3])
6592 {
6593 o->netbios_scope = p[2];
6594 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6595 }
6596 else if (streq(p[1], "NBT") && p[2] && !p[3])
6597 {
6598 int t = atoi_warn(p[2], msglevel);
6599 if (!(t == 1 || t == 2 || t == 4 || t == 8))
6600 {
6601 msg(msglevel, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t);
6602 goto err;
6603 }
6604 o->netbios_node_type = (uint8_t)t;
6605 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6606 }
6607 else if (streq(p[1], "WINS") && p[2] && !p[3])
6608 {
6609 dhcp_option_address_parse("WINS", p[2], o->wins, &o->wins_len, msglevel);
6610 o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
6611 }
6612 else if (streq(p[1], "NTP") && p[2] && !p[3])
6613 {
6614 dhcp_option_address_parse("NTP", p[2], o->ntp, &o->ntp_len, msglevel);
6615 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6616 }
6617 else if (streq(p[1], "NBDD") && p[2] && !p[3])
6618 {
6619 dhcp_option_address_parse("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel);
6620 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6621 }
6622 else if (streq(p[1], "DISABLE-NBT") && !p[2])
6623 {
6624 o->disable_nbt = 1;
6625 o->dhcp_options |= DHCP_OPTIONS_DHCP_REQUIRED;
6626 }
6627#if defined(TARGET_ANDROID)
6628 else if (streq(p[1], "PROXY_HTTP") && p[3] && !p[4])
6629 {
6630 o->http_proxy_port = positive_atoi(p[3], msglevel);
6631 o->http_proxy = p[2];
6632 }
6633#endif
6634 else
6635 {
6636 msg(msglevel, "--dhcp-option: unknown option type '%s' or missing or unknown parameter",
6637 p[1]);
6638 goto err;
6639 }
6640#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
6641 setenv_foreign_option(options, p[1], p[2], es);
6642#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
6643
6644 if (dhcp_optional)
6645 {
6646#if defined(_WIN32) || defined(TARGET_ANDROID)
6647 o->dhcp_options |= DHCP_OPTIONS_DHCP_OPTIONAL;
6648#endif
6649 }
6650 }
6651#ifdef _WIN32
6652 else if (streq(p[0], "show-adapters") && !p[1])
6653 {
6654 VERIFY_PERMISSION(OPT_P_GENERAL);
6655 show_tap_win_adapters(M_INFO | M_NOPREFIX, M_WARN | M_NOPREFIX);
6656 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6657 }
6658 else if (streq(p[0], "show-net") && !p[1])
6659 {
6660 VERIFY_PERMISSION(OPT_P_GENERAL);
6661 show_routes(M_INFO | M_NOPREFIX);
6662 show_adapters(M_INFO | M_NOPREFIX);
6663 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6664 }
6665 else if (streq(p[0], "show-net-up") && !p[1])
6666 {
6667 VERIFY_PERMISSION(OPT_P_UP);
6668 options->show_net_up = true;
6669 }
6670 else if (streq(p[0], "tap-sleep") && p[1] && !p[2])
6671 {
6672 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6673 if (!atoi_constrained(p[1], &options->tuntap_options.tap_sleep, p[0], 0, 255, msglevel))
6674 {
6675 goto err;
6676 }
6677 }
6678 else if (streq(p[0], "dhcp-renew") && !p[1])
6679 {
6680 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6681 options->tuntap_options.dhcp_renew = true;
6682 }
6683 else if (streq(p[0], "dhcp-pre-release") && !p[1])
6684 {
6685 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6686 options->tuntap_options.dhcp_pre_release = true;
6687 options->tuntap_options.dhcp_renew = true;
6688 }
6689 else if (streq(p[0], "dhcp-release") && !p[1])
6690 {
6691 msg(M_WARN, "Obsolete option --dhcp-release detected. This is now on by default");
6692 }
6693 else if (streq(p[0], "dhcp-internal") && p[1] && !p[2]) /* standalone method for internal use */
6694 {
6695 unsigned int adapter_index;
6696 VERIFY_PERMISSION(OPT_P_GENERAL);
6697 set_debug_level(options->verbosity, SDL_CONSTRAIN);
6698 adapter_index = atou(p[1]);
6699 sleep(options->tuntap_options.tap_sleep);
6700 if (options->tuntap_options.dhcp_pre_release)
6701 {
6702 dhcp_release_by_adapter_index(adapter_index);
6703 }
6704 if (options->tuntap_options.dhcp_renew)
6705 {
6706 dhcp_renew_by_adapter_index(adapter_index);
6707 }
6708 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6709 }
6710 else if (streq(p[0], "register-dns") && !p[1])
6711 {
6712 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6713 options->tuntap_options.register_dns = true;
6714 }
6715 else if (streq(p[0], "block-outside-dns") && !p[1])
6716 {
6717 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6718 options->block_outside_dns = true;
6719 }
6720 else if (streq(p[0], "rdns-internal") && !p[1])
6721 /* standalone method for internal use
6722 *
6723 * (if --register-dns is set, openvpn needs to call itself in a
6724 * sub-process to execute the required functions in a non-blocking
6725 * way, and uses --rdns-internal to signal that to itself)
6726 */
6727 {
6728 VERIFY_PERMISSION(OPT_P_GENERAL);
6729 set_debug_level(options->verbosity, SDL_CONSTRAIN);
6730 if (options->tuntap_options.register_dns)
6731 {
6732 ipconfig_register_dns(NULL);
6733 }
6734 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6735 }
6736 else if (streq(p[0], "show-valid-subnets") && !p[1])
6737 {
6738 VERIFY_PERMISSION(OPT_P_GENERAL);
6739 show_valid_win32_tun_subnets();
6740 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6741 }
6742 else if (streq(p[0], "pause-exit") && !p[1])
6743 {
6744 VERIFY_PERMISSION(OPT_P_GENERAL);
6745 set_pause_exit_win32();
6746 }
6747 else if (streq(p[0], "service") && p[1] && !p[3])
6748 {
6749 VERIFY_PERMISSION(OPT_P_GENERAL);
6750 options->exit_event_name = p[1];
6751 if (p[2])
6752 {
6753 options->exit_event_initial_state = (atoi_warn(p[2], msglevel) != 0);
6754 }
6755 }
6756 else if (streq(p[0], "allow-nonadmin") && !p[2])
6757 {
6758 VERIFY_PERMISSION(OPT_P_GENERAL);
6759 tap_allow_nonadmin_access(p[1]);
6760 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
6761 }
6762 else if (streq(p[0], "user") && p[1] && !p[2])
6763 {
6764 VERIFY_PERMISSION(OPT_P_GENERAL);
6765 msg(M_WARN, "NOTE: --user option is not implemented on Windows");
6766 }
6767 else if (streq(p[0], "group") && p[1] && !p[2])
6768 {
6769 VERIFY_PERMISSION(OPT_P_GENERAL);
6770 msg(M_WARN, "NOTE: --group option is not implemented on Windows");
6771 }
6772#else /* ifdef _WIN32 */
6773 else if (streq(p[0], "user") && p[1] && !p[2])
6774 {
6775 VERIFY_PERMISSION(OPT_P_GENERAL);
6776 options->username = p[1];
6777 }
6778 else if (streq(p[0], "group") && p[1] && !p[2])
6779 {
6780 VERIFY_PERMISSION(OPT_P_GENERAL);
6781 options->groupname = p[1];
6782 }
6783 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
6784 {
6785 VERIFY_PERMISSION(OPT_P_DHCPDNS);
6786 setenv_foreign_option(options, p[1], p[2], es);
6787 }
6788 else if (streq(p[0], "route-method") && p[1] && !p[2])
6789 {
6790 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS);
6791 /* ignore when pushed to non-Windows OS */
6792 }
6793#endif /* ifdef _WIN32 */
6794#if PASSTOS_CAPABILITY
6795 else if (streq(p[0], "passtos") && !p[1])
6796 {
6797 VERIFY_PERMISSION(OPT_P_GENERAL);
6798 options->passtos = true;
6799 }
6800#endif
6801 else if (streq(p[0], "allow-compression") && p[1] && !p[2])
6802 {
6803 VERIFY_PERMISSION(OPT_P_GENERAL);
6804
6805 if (streq(p[1], "no"))
6806 {
6807 options->comp.flags = COMP_F_ALLOW_STUB_ONLY | COMP_F_ADVERTISE_STUBS_ONLY;
6808 if (comp_non_stub_enabled(&options->comp))
6809 {
6810 msg(msglevel, "'--allow-compression no' conflicts with "
6811 " enabling compression");
6812 }
6813 }
6814 else if (options->comp.flags & COMP_F_ALLOW_STUB_ONLY)
6815 {
6816 /* Also printed on a push to hint at configuration problems */
6817 msg(msglevel,
6818 "Cannot set allow-compression to '%s' "
6819 "after set to 'no'",
6820 p[1]);
6821 goto err;
6822 }
6823 else if (streq(p[1], "asym"))
6824 {
6825 options->comp.flags |= COMP_F_ALLOW_ASYM;
6826 }
6827 else if (streq(p[1], "yes"))
6828 {
6829 msg(M_WARN,
6830 "DEPRECATED OPTION: \"--allow-compression yes\" has been removed. "
6831 "We will use \"asym\" mode instead. See the manual page for more information.");
6832
6833 options->comp.flags |= COMP_F_ALLOW_ASYM;
6834 }
6835 else
6836 {
6837 msg(msglevel,
6838 "bad allow-compression option: %s -- "
6839 "must be 'yes', 'no', or 'asym'",
6840 p[1]);
6841 goto err;
6842 }
6843 }
6844 else if (streq(p[0], "comp-lzo") && !p[2])
6845 {
6846 VERIFY_PERMISSION(OPT_P_COMP);
6847
6848 /* All lzo variants do not use swap */
6849 options->comp.flags &= ~COMP_F_SWAP;
6850 options->comp.alg = COMP_ALG_LZO;
6851
6852 if (p[1])
6853 {
6854 if (streq(p[1], "no"))
6855 {
6856 options->comp.alg = COMP_ALG_STUB;
6857 }
6858 /* There is no actual difference anymore between these variants.
6859 * We never compress. On the server side we replace this with
6860 * --compress migrate later anyway.
6861 */
6862 else if (!(streq(p[1], "yes") || streq(p[1], "adaptive")))
6863 {
6864 msg(msglevel, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'",
6865 p[1]);
6866 goto err;
6867 }
6868 }
6869 show_compression_warning(&options->comp);
6870 }
6871 else if (streq(p[0], "comp-noadapt") && !p[1])
6872 {
6873 /* NO-OP since we never compress anymore */
6874 }
6875 else if (streq(p[0], "compress") && !p[2])
6876 {
6877 VERIFY_PERMISSION(OPT_P_COMP);
6878 const char *alg = "stub";
6879 if (p[1])
6880 {
6881 alg = p[1];
6882 }
6883
6884 if (streq(alg, "stub"))
6885 {
6886 options->comp.alg = COMP_ALG_STUB;
6887 options->comp.flags |= (COMP_F_SWAP | COMP_F_ADVERTISE_STUBS_ONLY);
6888 }
6889 else if (streq(alg, "stub-v2"))
6890 {
6891 options->comp.alg = COMP_ALGV2_UNCOMPRESSED;
6892 options->comp.flags |= COMP_F_ADVERTISE_STUBS_ONLY;
6893 }
6894 else if (streq(alg, "migrate"))
6895 {
6896 options->comp.alg = COMP_ALG_UNDEF;
6897 options->comp.flags = COMP_F_MIGRATE;
6898 }
6899 else if (streq(alg, "lzo"))
6900 {
6901 options->comp.alg = COMP_ALG_LZO;
6902 options->comp.flags &= ~COMP_F_SWAP;
6903 }
6904 else if (streq(alg, "lz4"))
6905 {
6906 options->comp.alg = COMP_ALG_LZ4;
6907 options->comp.flags |= COMP_F_SWAP;
6908 }
6909 else if (streq(alg, "lz4-v2"))
6910 {
6911 options->comp.alg = COMP_ALGV2_LZ4;
6912 }
6913 else
6914 {
6915 msg(msglevel, "bad comp option: %s", alg);
6916 goto err;
6917 }
6918
6919 show_compression_warning(&options->comp);
6920 }
6921 else if (streq(p[0], "show-ciphers") && !p[1])
6922 {
6923 VERIFY_PERMISSION(OPT_P_GENERAL);
6924 options->show_ciphers = true;
6925 }
6926 else if (streq(p[0], "show-digests") && !p[1])
6927 {
6928 VERIFY_PERMISSION(OPT_P_GENERAL);
6929 options->show_digests = true;
6930 }
6931 else if (streq(p[0], "show-engines") && !p[1])
6932 {
6933 VERIFY_PERMISSION(OPT_P_GENERAL);
6934 options->show_engines = true;
6935 }
6936 else if (streq(p[0], "key-direction") && p[1] && !p[2])
6937 {
6938 int key_direction;
6939
6940 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION);
6941
6942 key_direction = ascii2keydirection(msglevel, p[1]);
6943 if (key_direction >= 0)
6944 {
6945 if (permission_mask & OPT_P_GENERAL)
6946 {
6947 options->key_direction = key_direction;
6948 }
6949 else if (permission_mask & OPT_P_CONNECTION)
6950 {
6951 options->ce.key_direction = key_direction;
6952 }
6953 }
6954 else
6955 {
6956 goto err;
6957 }
6958 }
6959 else if (streq(p[0], "secret") && p[1] && !p[3])
6960 {
6961 msg(M_WARN, "DEPRECATED OPTION: The option --secret is deprecated.");
6962 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
6963 options->shared_secret_file = p[1];
6964 options->shared_secret_file_inline = is_inline;
6965 if (!is_inline && p[2])
6966 {
6967 int key_direction;
6968
6969 key_direction = ascii2keydirection(msglevel, p[2]);
6970 if (key_direction >= 0)
6971 {
6972 options->key_direction = key_direction;
6973 }
6974 else
6975 {
6976 goto err;
6977 }
6978 }
6979 }
6980 else if (streq(p[0], "allow-deprecated-insecure-static-crypto"))
6981 {
6982 VERIFY_PERMISSION(OPT_P_GENERAL);
6983 options->allow_deprecated_insecure_static_crypto = true;
6984 }
6985 else if (streq(p[0], "genkey") && !p[4])
6986 {
6987 VERIFY_PERMISSION(OPT_P_GENERAL);
6988 options->genkey = true;
6989 if (!p[1])
6990 {
6991 options->genkey_type = GENKEY_SECRET;
6992 }
6993 else
6994 {
6995 if (streq(p[1], "secret") || streq(p[1], "tls-auth") || streq(p[1], "tls-crypt"))
6996 {
6997 options->genkey_type = GENKEY_SECRET;
6998 }
6999 else if (streq(p[1], "tls-crypt-v2-server"))
7000 {
7001 options->genkey_type = GENKEY_TLS_CRYPTV2_SERVER;
7002 }
7003 else if (streq(p[1], "tls-crypt-v2-client"))
7004 {
7005 options->genkey_type = GENKEY_TLS_CRYPTV2_CLIENT;
7006 if (p[3])
7007 {
7008 options->genkey_extra_data = p[3];
7009 }
7010 }
7011 else if (streq(p[1], "auth-token"))
7012 {
7013 options->genkey_type = GENKEY_AUTH_TOKEN;
7014 }
7015 else
7016 {
7017 msg(msglevel, "unknown --genkey type: %s", p[1]);
7018 }
7019 }
7020 if (p[2])
7021 {
7022 options->genkey_filename = p[2];
7023 }
7024 }
7025 else if (streq(p[0], "auth") && p[1] && !p[2])
7026 {
7027 VERIFY_PERMISSION(OPT_P_GENERAL);
7028 options->authname = p[1];
7029 }
7030 else if (streq(p[0], "cipher") && p[1] && !p[2])
7031 {
7032 VERIFY_PERMISSION(OPT_P_NCP | OPT_P_INSTANCE);
7033 options->ciphername = p[1];
7034 }
7035 else if (streq(p[0], "data-ciphers-fallback") && p[1] && !p[2])
7036 {
7037 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
7038 options->ciphername = p[1];
7039 options->enable_ncp_fallback = true;
7040 }
7041 else if ((streq(p[0], "data-ciphers") || streq(p[0], "ncp-ciphers")) && p[1] && !p[2])
7042 {
7043 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
7044 if (streq(p[0], "ncp-ciphers"))
7045 {
7046 msg(M_INFO, "Note: Treating option '--ncp-ciphers' as "
7047 " '--data-ciphers' (renamed in OpenVPN 2.5).");
7048 }
7049 options->ncp_ciphers = p[1];
7050 }
7051 else if (streq(p[0], "key-derivation") && p[1])
7052 {
7053 /* NCP only option that is pushed by the server to enable EKM,
7054 * should not be used by normal users in config files*/
7055 VERIFY_PERMISSION(OPT_P_NCP)
7056 if (streq(p[1], "tls-ekm"))
7057 {
7058 options->imported_protocol_flags |= CO_USE_TLS_KEY_MATERIAL_EXPORT;
7059 }
7060 else
7061 {
7062 msg(msglevel, "Unknown key-derivation method %s", p[1]);
7063 }
7064 }
7065 else if (streq(p[0], "protocol-flags") && p[1])
7066 {
7067 /* NCP only option that is pushed by the server to enable protocol
7068 * features that are negotiated, should not be used by normal users
7069 * in config files */
7070 VERIFY_PERMISSION(OPT_P_NCP)
7071 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
7072 {
7073 if (streq(p[j], "cc-exit"))
7074 {
7075 options->imported_protocol_flags |= CO_USE_CC_EXIT_NOTIFY;
7076 }
7077 else if (streq(p[j], "tls-ekm"))
7078 {
7079 options->imported_protocol_flags |= CO_USE_TLS_KEY_MATERIAL_EXPORT;
7080 }
7081 else if (streq(p[j], "dyn-tls-crypt"))
7082 {
7083 options->imported_protocol_flags |= CO_USE_DYNAMIC_TLS_CRYPT;
7084 }
7085 else if (streq(p[j], "aead-epoch"))
7086 {
7087 options->imported_protocol_flags |= CO_EPOCH_DATA_KEY_FORMAT;
7088 }
7089 else
7090 {
7091 msg(msglevel, "Unknown protocol-flags flag: %s", p[j]);
7092 }
7093 }
7094 }
7095 else if (streq(p[0], "force-tls-key-material-export"))
7096 {
7097 VERIFY_PERMISSION(OPT_P_GENERAL);
7098 options->force_key_material_export = true;
7099 }
7100 else if (streq(p[0], "prng") && p[1] && !p[3])
7101 {
7102 msg(M_WARN, "NOTICE: --prng option ignored (SSL library PRNG is used)");
7103 }
7104 else if (streq(p[0], "no-replay") && !p[1])
7105 {
7106 VERIFY_PERMISSION(OPT_P_GENERAL);
7107 /* always error out, this breaks the connection */
7108 msg(M_FATAL, "--no-replay was removed in OpenVPN 2.7. "
7109 "Update your configuration.");
7110 }
7111 else if (streq(p[0], "replay-window") && !p[3])
7112 {
7113 VERIFY_PERMISSION(OPT_P_GENERAL);
7114 if (p[1])
7115 {
7116 if (!atoi_constrained(p[1], &options->replay_window, "replay-window windows size",
7117 MIN_SEQ_BACKTRACK, MAX_SEQ_BACKTRACK, msglevel))
7118 {
7119 goto err;
7120 }
7121
7122 if (p[2])
7123 {
7124 if (!atoi_constrained(p[2], &options->replay_time, "replay-window time window",
7125 MIN_TIME_BACKTRACK, MAX_TIME_BACKTRACK, msglevel))
7126 {
7127 goto err;
7128 }
7129 }
7130 }
7131 else
7132 {
7133 msg(msglevel, "replay-window option is missing window size parameter");
7134 goto err;
7135 }
7136 }
7137 else if (streq(p[0], "mute-replay-warnings") && !p[1])
7138 {
7139 VERIFY_PERMISSION(OPT_P_GENERAL);
7140 options->mute_replay_warnings = true;
7141 }
7142 else if (streq(p[0], "replay-persist") && p[1] && !p[2])
7143 {
7144 VERIFY_PERMISSION(OPT_P_GENERAL);
7145 options->packet_id_file = p[1];
7146 }
7147 else if (streq(p[0], "test-crypto") && !p[1])
7148 {
7149 VERIFY_PERMISSION(OPT_P_GENERAL);
7150 options->test_crypto = true;
7151 }
7152#ifndef ENABLE_CRYPTO_MBEDTLS
7153 else if (streq(p[0], "engine") && !p[2])
7154 {
7155 VERIFY_PERMISSION(OPT_P_GENERAL);
7156 if (p[1])
7157 {
7158 options->engine = p[1];
7159 }
7160 else
7161 {
7162 options->engine = "auto";
7163 }
7164 }
7165#endif /* ENABLE_CRYPTO_MBEDTLS */
7166 else if (streq(p[0], "providers") && p[1])
7167 {
7168 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
7169 {
7170 options->providers.names[j] = p[j];
7171 }
7172 }
7173 else if (streq(p[0], "show-tls") && !p[1])
7174 {
7175 VERIFY_PERMISSION(OPT_P_GENERAL);
7176 options->show_tls_ciphers = true;
7177 }
7178 else if ((streq(p[0], "show-curves") || streq(p[0], "show-groups")) && !p[1])
7179 {
7180 VERIFY_PERMISSION(OPT_P_GENERAL);
7181 options->show_curves = true;
7182 }
7183 else if (streq(p[0], "ecdh-curve") && p[1] && !p[2])
7184 {
7185 VERIFY_PERMISSION(OPT_P_GENERAL);
7186 msg(M_WARN, "Consider setting groups/curves preference with "
7187 "tls-groups instead of forcing a specific curve with "
7188 "ecdh-curve.");
7189 options->ecdh_curve = p[1];
7190 }
7191 else if (streq(p[0], "tls-server") && !p[1])
7192 {
7193 VERIFY_PERMISSION(OPT_P_GENERAL);
7194 options->tls_server = true;
7195 }
7196 else if (streq(p[0], "tls-client") && !p[1])
7197 {
7198 VERIFY_PERMISSION(OPT_P_GENERAL);
7199 options->tls_client = true;
7200 }
7201 else if (streq(p[0], "ca") && p[1] && !p[2])
7202 {
7203 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7204 options->ca_file = p[1];
7205 options->ca_file_inline = is_inline;
7206 }
7207#ifndef ENABLE_CRYPTO_MBEDTLS
7208 else if (streq(p[0], "capath") && p[1] && !p[2])
7209 {
7210 VERIFY_PERMISSION(OPT_P_GENERAL);
7211 options->ca_path = p[1];
7212 }
7213#endif /* ENABLE_CRYPTO_MBEDTLS */
7214 else if (streq(p[0], "dh") && p[1] && !p[2])
7215 {
7216 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7217 options->dh_file = p[1];
7218 options->dh_file_inline = is_inline;
7219 }
7220 else if (streq(p[0], "cert") && p[1] && !p[2])
7221 {
7222 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7223 options->cert_file = p[1];
7224 options->cert_file_inline = is_inline;
7225 }
7226 else if (streq(p[0], "extra-certs") && p[1] && !p[2])
7227 {
7228 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7229 options->extra_certs_file = p[1];
7230 options->extra_certs_file_inline = is_inline;
7231 }
7232 else if ((streq(p[0], "verify-hash") && p[1] && !p[3])
7233 || (streq(p[0], "peer-fingerprint") && p[1] && !p[2]))
7234 {
7235 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7236
7237 int verify_hash_depth = 0;
7238 if (streq(p[0], "verify-hash"))
7239 {
7240 msg(M_WARN, "DEPRECATED OPTION: The option --verify-hash is deprecated. "
7241 "You should switch to the either use the level 1 certificate as "
7242 "--ca option, use --tls-verify or use --peer-fingerprint");
7243 /* verify level 1 cert, i.e. the CA that signed the leaf cert */
7244 verify_hash_depth = 1;
7245 }
7246
7247 options->verify_hash_algo = MD_SHA256;
7248
7249 int digest_len = SHA256_DIGEST_LENGTH;
7250
7251 if (options->verify_hash && options->verify_hash_depth != verify_hash_depth)
7252 {
7253 msg(msglevel,
7254 "ERROR: Setting %s not allowed. --verify-hash and"
7255 " --peer-fingerprint are mutually exclusive",
7256 p[0]);
7257 goto err;
7258 }
7259
7260 if (streq(p[0], "verify-hash"))
7261 {
7262 if ((!p[2] && !is_inline) || (p[2] && streq(p[2], "SHA1")))
7263 {
7264 options->verify_hash_algo = MD_SHA1;
7265 digest_len = SHA_DIGEST_LENGTH;
7266 }
7267 else if (p[2] && !streq(p[2], "SHA256"))
7268 {
7269 msg(msglevel,
7270 "invalid or unsupported hashing algorithm: %s "
7271 "(only SHA1 and SHA256 are supported)",
7272 p[2]);
7273 goto err;
7274 }
7275 }
7276
7277 struct verify_hash_list *newlist;
7278 newlist = parse_hash_fingerprint_multiline(p[1], digest_len, msglevel, &options->gc);
7279
7280 /* Append the new list to the end of our current list */
7281 if (!options->verify_hash)
7282 {
7283 options->verify_hash = newlist;
7284 options->verify_hash_depth = verify_hash_depth;
7285 }
7286 else
7287 {
7288 /* since both the old and new list can have multiple entries
7289 * we need to go to the end of one of them to concatenate them */
7290 struct verify_hash_list *listend = options->verify_hash;
7291 while (listend->next)
7292 {
7293 listend = listend->next;
7294 }
7295 listend->next = newlist;
7296 }
7297 }
7298#if defined(ENABLE_CRYPTOAPI) && defined(HAVE_XKEY_PROVIDER)
7299 else if (streq(p[0], "cryptoapicert") && p[1] && !p[2])
7300 {
7301 VERIFY_PERMISSION(OPT_P_GENERAL);
7302 options->cryptoapi_cert = p[1];
7303 }
7304#endif
7305 else if (streq(p[0], "key") && p[1] && !p[2])
7306 {
7307 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7308 options->priv_key_file = p[1];
7309 options->priv_key_file_inline = is_inline;
7310 }
7311 else if (streq(p[0], "tls-version-min") && p[1] && !p[3])
7312 {
7313 VERIFY_PERMISSION(OPT_P_GENERAL);
7314 int ver = tls_version_parse(p[1], p[2]);
7315 if (ver == TLS_VER_BAD)
7316 {
7317 msg(msglevel, "unknown tls-version-min parameter: %s", p[1]);
7318 goto err;
7319 }
7320
7321#ifdef ENABLE_CRYPTO_MBEDTLS
7322 if (ver < TLS_VER_1_2)
7323 {
7324 msg(M_WARN, "--tls-version-min %s is not supported by mbedtls, using 1.2", p[1]);
7325 ver = TLS_VER_1_2;
7326 }
7327#endif
7328
7329 options->ssl_flags &= ~(SSLF_TLS_VERSION_MIN_MASK << SSLF_TLS_VERSION_MIN_SHIFT);
7330 options->ssl_flags |= ((unsigned int)ver << SSLF_TLS_VERSION_MIN_SHIFT);
7331 }
7332 else if (streq(p[0], "tls-version-max") && p[1] && !p[2])
7333 {
7334 VERIFY_PERMISSION(OPT_P_GENERAL);
7335 int ver = tls_version_parse(p[1], NULL);
7336 if (ver == TLS_VER_BAD)
7337 {
7338 msg(msglevel, "unknown tls-version-max parameter: %s", p[1]);
7339 goto err;
7340 }
7341 options->ssl_flags &= ~(SSLF_TLS_VERSION_MAX_MASK << SSLF_TLS_VERSION_MAX_SHIFT);
7342 options->ssl_flags |= ((unsigned int)ver << SSLF_TLS_VERSION_MAX_SHIFT);
7343 }
7344#ifndef ENABLE_CRYPTO_MBEDTLS
7345 else if (streq(p[0], "pkcs12") && p[1] && !p[2])
7346 {
7347 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7348 options->pkcs12_file = p[1];
7349 options->pkcs12_file_inline = is_inline;
7350 }
7351#endif /* ENABLE_CRYPTO_MBEDTLS */
7352 else if (streq(p[0], "askpass") && !p[2])
7353 {
7354 VERIFY_PERMISSION(OPT_P_GENERAL);
7355 if (p[1])
7356 {
7357 options->key_pass_file = p[1];
7358 }
7359 else
7360 {
7361 options->key_pass_file = "stdin";
7362 }
7363 }
7364 else if (streq(p[0], "auth-nocache") && !p[1])
7365 {
7366 VERIFY_PERMISSION(OPT_P_GENERAL);
7367 ssl_set_auth_nocache();
7368 }
7369 else if (streq(p[0], "auth-token") && p[1] && !p[2])
7370 {
7371 VERIFY_PERMISSION(OPT_P_ECHO);
7372 ssl_set_auth_token(p[1]);
7373#ifdef ENABLE_MANAGEMENT
7374 if (management)
7375 {
7376 management_auth_token(management, p[1]);
7377 }
7378#endif
7379 }
7380 else if (streq(p[0], "auth-token-user") && p[1] && !p[2])
7381 {
7382 VERIFY_PERMISSION(OPT_P_ECHO);
7383 ssl_set_auth_token_user(p[1]);
7384 }
7385 else if (streq(p[0], "single-session") && !p[1])
7386 {
7387 VERIFY_PERMISSION(OPT_P_GENERAL);
7388 options->single_session = true;
7389 }
7390 else if (streq(p[0], "push-peer-info") && !p[1])
7391 {
7392 VERIFY_PERMISSION(OPT_P_GENERAL);
7393 options->push_peer_info = true;
7394 }
7395 else if (streq(p[0], "tls-exit") && !p[1])
7396 {
7397 VERIFY_PERMISSION(OPT_P_GENERAL);
7398 options->tls_exit = true;
7399 }
7400 else if (streq(p[0], "tls-cipher") && p[1] && !p[2])
7401 {
7402 VERIFY_PERMISSION(OPT_P_GENERAL);
7403 options->cipher_list = p[1];
7404 }
7405 else if (streq(p[0], "tls-cert-profile") && p[1] && !p[2])
7406 {
7407 VERIFY_PERMISSION(OPT_P_GENERAL);
7408 options->tls_cert_profile = p[1];
7409 }
7410 else if (streq(p[0], "tls-ciphersuites") && p[1] && !p[2])
7411 {
7412 VERIFY_PERMISSION(OPT_P_GENERAL);
7413 options->cipher_list_tls13 = p[1];
7414 }
7415 else if (streq(p[0], "tls-groups") && p[1] && !p[2])
7416 {
7417 VERIFY_PERMISSION(OPT_P_GENERAL);
7418 options->tls_groups = p[1];
7419 }
7420 else if (streq(p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || !p[2]))
7421 {
7422 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INLINE);
7423 if (p[2] && streq(p[2], "dir"))
7424 {
7425 options->ssl_flags |= SSLF_CRL_VERIFY_DIR;
7426 }
7427 options->crl_file = p[1];
7428 options->crl_file_inline = is_inline;
7429 }
7430 else if (streq(p[0], "tls-verify") && p[1])
7431 {
7432 VERIFY_PERMISSION(OPT_P_SCRIPT);
7433 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7434 {
7435 goto err;
7436 }
7437 set_user_script(options, &options->tls_verify,
7438 string_substitute(p[1], ',', ' ', &options->gc), "tls-verify", true);
7439 }
7440 else if (streq(p[0], "tls-export-cert") && p[1] && !p[2])
7441 {
7442 VERIFY_PERMISSION(OPT_P_SCRIPT);
7443 options->tls_export_peer_cert_dir = p[1];
7444 }
7445 else if (streq(p[0], "compat-names"))
7446 {
7447 VERIFY_PERMISSION(OPT_P_GENERAL);
7448 msg(msglevel, "--compat-names was removed in OpenVPN 2.5. "
7449 "Update your configuration.");
7450 goto err;
7451 }
7452 else if (streq(p[0], "no-name-remapping") && !p[1])
7453 {
7454 VERIFY_PERMISSION(OPT_P_GENERAL);
7455 msg(msglevel, "--no-name-remapping was removed in OpenVPN 2.5. "
7456 "Update your configuration.");
7457 goto err;
7458 }
7459 else if (streq(p[0], "verify-x509-name") && p[1] && strlen(p[1]) && !p[3])
7460 {
7461 int type = VERIFY_X509_SUBJECT_DN;
7462 VERIFY_PERMISSION(OPT_P_GENERAL);
7463 if (p[2])
7464 {
7465 if (streq(p[2], "subject"))
7466 {
7467 type = VERIFY_X509_SUBJECT_DN;
7468 }
7469 else if (streq(p[2], "name"))
7470 {
7471 type = VERIFY_X509_SUBJECT_RDN;
7472 }
7473 else if (streq(p[2], "name-prefix"))
7474 {
7475 type = VERIFY_X509_SUBJECT_RDN_PREFIX;
7476 }
7477 else
7478 {
7479 msg(msglevel, "unknown X.509 name type: %s", p[2]);
7480 goto err;
7481 }
7482 }
7483 options->verify_x509_type = type;
7484 options->verify_x509_name = p[1];
7485 }
7486 else if (streq(p[0], "ns-cert-type") && p[1] && !p[2])
7487 {
7488#ifdef ENABLE_CRYPTO_MBEDTLS
7489 msg(msglevel, "--ns-cert-type is not available with mbedtls.");
7490 goto err;
7491#else
7492 VERIFY_PERMISSION(OPT_P_GENERAL);
7493 if (streq(p[1], "server"))
7494 {
7495 options->ns_cert_type = NS_CERT_CHECK_SERVER;
7496 }
7497 else if (streq(p[1], "client"))
7498 {
7499 options->ns_cert_type = NS_CERT_CHECK_CLIENT;
7500 }
7501 else
7502 {
7503 msg(msglevel, "--ns-cert-type must be 'client' or 'server'");
7504 goto err;
7505 }
7506#endif /* ENABLE_CRYPTO_MBEDTLS */
7507 }
7508 else if (streq(p[0], "remote-cert-ku"))
7509 {
7510 VERIFY_PERMISSION(OPT_P_GENERAL);
7511
7512 size_t j;
7513 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7514 {
7515 sscanf(p[j], "%x", &(options->remote_cert_ku[j - 1]));
7516 }
7517 if (j == 1)
7518 {
7519 /* No specific KU required, but require KU to be present */
7520 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
7521 }
7522 }
7523 else if (streq(p[0], "remote-cert-eku") && p[1] && !p[2])
7524 {
7525 VERIFY_PERMISSION(OPT_P_GENERAL);
7526 options->remote_cert_eku = p[1];
7527 }
7528 else if (streq(p[0], "remote-cert-tls") && p[1] && !p[2])
7529 {
7530 VERIFY_PERMISSION(OPT_P_GENERAL);
7531
7532 if (streq(p[1], "server"))
7533 {
7534 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
7535 options->remote_cert_eku = "TLS Web Server Authentication";
7536 }
7537 else if (streq(p[1], "client"))
7538 {
7539 options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
7540 options->remote_cert_eku = "TLS Web Client Authentication";
7541 }
7542 else
7543 {
7544 msg(msglevel, "--remote-cert-tls must be 'client' or 'server'");
7545 goto err;
7546 }
7547 }
7548 else if (streq(p[0], "tls-timeout") && p[1] && !p[2])
7549 {
7550 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7551 /* Constrain the timeout to not have problems with
7552 * RELIABLE_MAX_TIMEOUT_SHIFT creating an overflow. 65k seconds
7553 * timeout is already way too much anyway */
7554 if (!atoi_constrained(p[1], &options->tls_timeout, "tls-timeout", 1,
7555 RELIABLE_MAX_INITIAL_TIMEOUT, msglevel))
7556 {
7557 goto err;
7558 }
7559 }
7560 else if (streq(p[0], "reneg-bytes") && p[1] && !p[2])
7561 {
7562 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7563 if (!positive_atoll(p[1], &options->renegotiate_bytes, p[0], msglevel))
7564 {
7565 goto err;
7566 }
7567 }
7568 else if (streq(p[0], "reneg-pkts") && p[1] && !p[2])
7569 {
7570 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7571 if (!positive_atoll(p[1], &options->renegotiate_packets, p[0], msglevel))
7572 {
7573 goto err;
7574 }
7575 }
7576 else if (streq(p[0], "reneg-sec") && p[1] && !p[3])
7577 {
7578 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7579 options->renegotiate_seconds = positive_atoi(p[1], msglevel);
7580 if (p[2])
7581 {
7582 options->renegotiate_seconds_min = positive_atoi(p[2], msglevel);
7583 }
7584 }
7585 else if (streq(p[0], "hand-window") && p[1] && !p[2])
7586 {
7587 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7588 options->handshake_window = positive_atoi(p[1], msglevel);
7589 }
7590 else if (streq(p[0], "tran-window") && p[1] && !p[2])
7591 {
7592 VERIFY_PERMISSION(OPT_P_TLS_PARMS);
7593 options->transition_window = positive_atoi(p[1], msglevel);
7594 }
7595 else if (streq(p[0], "tls-auth") && p[1] && !p[3])
7596 {
7597 int key_direction = -1;
7598
7599 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
7600
7601 if (permission_mask & OPT_P_GENERAL)
7602 {
7603 options->tls_auth_file = p[1];
7604 options->tls_auth_file_inline = is_inline;
7605
7606 if (!is_inline && p[2])
7607 {
7608 key_direction = ascii2keydirection(msglevel, p[2]);
7609 if (key_direction < 0)
7610 {
7611 goto err;
7612 }
7613 options->key_direction = key_direction;
7614 }
7615 }
7616 else if (permission_mask & OPT_P_CONNECTION)
7617 {
7618 options->ce.tls_auth_file = p[1];
7619 options->ce.tls_auth_file_inline = is_inline;
7620 options->ce.key_direction = KEY_DIRECTION_BIDIRECTIONAL;
7621
7622 if (!is_inline && p[2])
7623 {
7624 key_direction = ascii2keydirection(msglevel, p[2]);
7625 if (key_direction < 0)
7626 {
7627 goto err;
7628 }
7629 options->ce.key_direction = key_direction;
7630 }
7631 }
7632 }
7633 else if (streq(p[0], "tls-crypt") && p[1] && !p[3])
7634 {
7635 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
7636 if (permission_mask & OPT_P_GENERAL)
7637 {
7638 options->tls_crypt_file = p[1];
7639 options->tls_crypt_file_inline = is_inline;
7640 }
7641 else if (permission_mask & OPT_P_CONNECTION)
7642 {
7643 options->ce.tls_crypt_file = p[1];
7644 options->ce.tls_crypt_file_inline = is_inline;
7645 }
7646 }
7647 else if (streq(p[0], "tls-crypt-v2") && p[1] && !p[3])
7648 {
7649 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_CONNECTION | OPT_P_INLINE);
7650 if (permission_mask & OPT_P_GENERAL)
7651 {
7652 options->tls_crypt_v2_file = p[1];
7653 options->tls_crypt_v2_file_inline = is_inline;
7654 }
7655 else if (permission_mask & OPT_P_CONNECTION)
7656 {
7657 options->ce.tls_crypt_v2_file = p[1];
7658 options->ce.tls_crypt_v2_file_inline = is_inline;
7659 }
7660
7661 if (p[2] && streq(p[2], "force-cookie"))
7662 {
7663 options->ce.tls_crypt_v2_force_cookie = true;
7664 }
7665 else if (p[2] && streq(p[2], "allow-noncookie"))
7666 {
7667 options->ce.tls_crypt_v2_force_cookie = false;
7668 }
7669 else if (p[2])
7670 {
7671 msg(msglevel, "Unsupported tls-crypt-v2 argument: %s", p[2]);
7672 }
7673 }
7674 else if (streq(p[0], "tls-crypt-v2-verify") && p[1] && !p[2])
7675 {
7676 VERIFY_PERMISSION(OPT_P_GENERAL);
7677 options->tls_crypt_v2_verify_script = p[1];
7678 }
7679 else if (streq(p[0], "tls-crypt-v2-max-age") && p[1])
7680 {
7681 VERIFY_PERMISSION(OPT_P_GENERAL);
7682 if (!atoi_constrained(p[1], &options->tls_crypt_v2_max_age, "tls-crypt-v2-max-age", 1, INT_MAX, msglevel))
7683 {
7684 goto err;
7685 }
7686 }
7687 else if (streq(p[0], "x509-track") && p[1] && !p[2])
7688 {
7689 VERIFY_PERMISSION(OPT_P_GENERAL);
7690 x509_track_add(&options->x509_track, p[1], msglevel, &options->gc);
7691 }
7692 else if (streq(p[0], "x509-username-field") && p[1])
7693 {
7694 VERIFY_PERMISSION(OPT_P_GENERAL);
7695 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7696 {
7697 char *s = p[j];
7698
7699 if (strncmp("ext:", s, 4) == 0 && !x509_username_field_ext_supported(s + 4))
7700 {
7701 msg(msglevel, "Unsupported x509-username-field extension: %s", s);
7702 }
7703 options->x509_username_field[j - 1] = p[j];
7704 }
7705 }
7706#ifdef ENABLE_PKCS11
7707 else if (streq(p[0], "show-pkcs11-ids") && !p[3])
7708 {
7709 const char *provider = p[1];
7710 bool cert_private = (p[2] == NULL ? false : (atoi_warn(p[2], msglevel) != 0));
7711
7712#ifdef DEFAULT_PKCS11_MODULE
7713 if (!provider)
7714 {
7715 provider = DEFAULT_PKCS11_MODULE;
7716 }
7717 else if (!p[2])
7718 {
7719 char *endp = NULL;
7720 long i = strtol(provider, &endp, 10);
7721
7722 if (*endp == 0)
7723 {
7724 /* There was one argument, and it was purely numeric.
7725 * Interpret it as the cert_private argument */
7726 provider = DEFAULT_PKCS11_MODULE;
7727 cert_private = i;
7728 }
7729 }
7730#else /* ifdef DEFAULT_PKCS11_MODULE */
7731 if (!provider)
7732 {
7733 msg(msglevel, "--show-pkcs11-ids requires a provider parameter");
7734 goto err;
7735 }
7736#endif /* ifdef DEFAULT_PKCS11_MODULE */
7737 VERIFY_PERMISSION(OPT_P_GENERAL);
7738
7739 set_debug_level(options->verbosity, SDL_CONSTRAIN);
7740 show_pkcs11_ids(provider, cert_private);
7741 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
7742 }
7743 else if (streq(p[0], "pkcs11-providers") && p[1])
7744 {
7745 int j;
7746
7747 VERIFY_PERMISSION(OPT_P_GENERAL);
7748
7749 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7750 {
7751 options->pkcs11_providers[j - 1] = p[j];
7752 }
7753 }
7754 else if (streq(p[0], "pkcs11-protected-authentication"))
7755 {
7756 int j;
7757
7758 VERIFY_PERMISSION(OPT_P_GENERAL);
7759
7760 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7761 {
7762 options->pkcs11_protected_authentication[j - 1] =
7763 atoi_warn(p[j], msglevel) != 0 ? 1 : 0;
7764 }
7765 }
7766 else if (streq(p[0], "pkcs11-private-mode") && p[1])
7767 {
7768 int j;
7769
7770 VERIFY_PERMISSION(OPT_P_GENERAL);
7771
7772 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7773 {
7774 sscanf(p[j], "%x", &(options->pkcs11_private_mode[j - 1]));
7775 }
7776 }
7777 else if (streq(p[0], "pkcs11-cert-private"))
7778 {
7779 int j;
7780
7781 VERIFY_PERMISSION(OPT_P_GENERAL);
7782
7783 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7784 {
7785 options->pkcs11_cert_private[j - 1] = (bool)(atoi_warn(p[j], msglevel));
7786 }
7787 }
7788 else if (streq(p[0], "pkcs11-pin-cache") && p[1] && !p[2])
7789 {
7790 VERIFY_PERMISSION(OPT_P_GENERAL);
7791 options->pkcs11_pin_cache_period = positive_atoi(p[1], msglevel);
7792 }
7793 else if (streq(p[0], "pkcs11-id") && p[1] && !p[2])
7794 {
7795 VERIFY_PERMISSION(OPT_P_GENERAL);
7796 options->pkcs11_id = p[1];
7797 }
7798 else if (streq(p[0], "pkcs11-id-management") && !p[1])
7799 {
7800 VERIFY_PERMISSION(OPT_P_GENERAL);
7801 options->pkcs11_id_management = true;
7802 }
7803#endif /* ifdef ENABLE_PKCS11 */
7804 else if (streq(p[0], "rmtun") && !p[1])
7805 {
7806 VERIFY_PERMISSION(OPT_P_GENERAL);
7807 options->persist_config = true;
7808 options->persist_mode = 0;
7809 }
7810 else if (streq(p[0], "mktun") && !p[1])
7811 {
7812 VERIFY_PERMISSION(OPT_P_GENERAL);
7813 options->persist_config = true;
7814 options->persist_mode = 1;
7815 }
7816 else if (streq(p[0], "peer-id") && p[1] && !p[2])
7817 {
7818 VERIFY_PERMISSION(OPT_P_PEER_ID);
7819 options->use_peer_id = true;
7820 options->peer_id = atoi_warn(p[1], msglevel);
7821 }
7822 else if (streq(p[0], "keying-material-exporter") && p[1] && p[2])
7823 {
7824 VERIFY_PERMISSION(OPT_P_GENERAL);
7825
7826 if (strncmp(p[1], "EXPORTER", 8))
7827 {
7828 msg(msglevel, "Keying material exporter label must begin with "
7829 "\"EXPORTER\"");
7830 goto err;
7831 }
7832 if (streq(p[1], EXPORT_KEY_DATA_LABEL))
7833 {
7834 msg(msglevel,
7835 "Keying material exporter label must not be '" EXPORT_KEY_DATA_LABEL "'.");
7836 }
7837
7838 if (!atoi_constrained(p[2], &options->keying_material_exporter_length,
7839 p[0], 16, 4095, msglevel))
7840 {
7841 goto err;
7842 }
7843
7844 options->keying_material_exporter_label = p[1];
7845 }
7846 else if (streq(p[0], "allow-recursive-routing") && !p[1])
7847 {
7848 VERIFY_PERMISSION(OPT_P_GENERAL);
7849 options->allow_recursive_routing = true;
7850 }
7851 else if (streq(p[0], "vlan-tagging") && !p[1])
7852 {
7853 VERIFY_PERMISSION(OPT_P_GENERAL);
7854 options->vlan_tagging = true;
7855 }
7856 else if (streq(p[0], "vlan-accept") && p[1] && !p[2])
7857 {
7858 VERIFY_PERMISSION(OPT_P_GENERAL);
7859 if (streq(p[1], "tagged"))
7860 {
7861 options->vlan_accept = VLAN_ONLY_TAGGED;
7862 }
7863 else if (streq(p[1], "untagged"))
7864 {
7865 options->vlan_accept = VLAN_ONLY_UNTAGGED_OR_PRIORITY;
7866 }
7867 else if (streq(p[1], "all"))
7868 {
7869 options->vlan_accept = VLAN_ALL;
7870 }
7871 else
7872 {
7873 msg(msglevel, "--vlan-accept must be 'tagged', 'untagged' or 'all'");
7874 goto err;
7875 }
7876 }
7877 else if (streq(p[0], "vlan-pvid") && p[1] && !p[2])
7878 {
7879 int vlan_pvid;
7880 VERIFY_PERMISSION(OPT_P_GENERAL | OPT_P_INSTANCE);
7881 if (!atoi_constrained(p[1], &vlan_pvid, p[0],
7882 OPENVPN_8021Q_MIN_VID, OPENVPN_8021Q_MAX_VID, msglevel))
7883 {
7884 goto err;
7885 }
7886 options->vlan_pvid = (uint16_t)vlan_pvid;
7887 }
7888 else
7889 {
7890 int i;
7891 msglvl_t msglevel_unknown = msglevel_fc;
7892 /* Check if an option is in --ignore-unknown-option and
7893 * set warning level to non fatal */
7894 for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
7895 {
7896 if (streq(p[0], options->ignore_unknown_option[i]))
7897 {
7898 msglevel_unknown = M_WARN;
7899 break;
7900 }
7901 }
7902 if (file)
7903 {
7904 msg(msglevel_unknown,
7905 "Unrecognized option or missing or extra parameter(s) in %s:%d: %s (%s)", file,
7906 line, p[0], PACKAGE_VERSION);
7907 }
7908 else
7909 {
7910 msg(msglevel_unknown, "Unrecognized option or missing or extra parameter(s): --%s (%s)",
7911 p[0], PACKAGE_VERSION);
7912 }
7913 }
7914err:
7915 gc_free(&gc);
7916}
7917
7918#if defined(__GNUC__) || defined(__clang__)
7919#pragma GCC diagnostic pop
7920#endif
7921
7922bool
7923has_udp_in_local_list(const struct options *options)
7924{
7925 if (options->ce.local_list)
7926 {
7927 for (int i = 0; i < options->ce.local_list->len; i++)
7928 {
7929 if (proto_is_dgram(options->ce.local_list->array[i]->proto))
7930 {
7931 return true;
7932 }
7933 }
7934 }
7935
7936 return false;
7937}
buf_clear
void buf_clear(struct buffer *buf)
Zeroise and reset a buffer.
Definition buffer.c:148
buf_printf
bool buf_printf(struct buffer *buf, const char *format,...)
printf-style append to a buffer with overflow check.
Definition buffer.c:226
gc_transfer
void gc_transfer(struct gc_arena *dest, struct gc_arena *src)
Move all allocations from one garbage collection arena to another.
Definition buffer.c:429
gc_realloc
void * gc_realloc(void *ptr, size_t size, struct gc_arena *a)
allows to realloc a pointer previously allocated by gc_malloc or gc_realloc
Definition buffer.c:343
string_defined_equal
bool string_defined_equal(const char *s1, const char *s2)
Definition buffer.c:1089
gc_malloc
void * gc_malloc(size_t size, bool clear, struct gc_arena *a)
Allocate memory and, optionally, zero it.
Definition buffer.c:318
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Allocate a buffer of the given size under garbage collection.
Definition buffer.c:77
string_array_len
int string_array_len(const char **array)
Return the number of elements in a NULL-terminated array of strings.
Definition buffer.c:661
buffer_read_from_file
struct buffer buffer_read_from_file(const char *filename, struct gc_arena *gc)
buffer_read_from_file - copy the content of a file into a buffer
Definition buffer.c:1356
string_substitute
char * string_substitute(const char *src, char from, char to, struct gc_arena *gc)
Definition buffer.c:1102
string_alloc
char * string_alloc(const char *str, struct gc_arena *gc)
Duplicate a string, allocating memory under garbage collection.
Definition buffer.c:616
buffer.h
Buffer management functions and garbage collection.
gc_detach
static void gc_detach(struct gc_arena *a)
Detach all allocations from an arena without freeing them.
Definition buffer.h:1885
BSTR
#define BSTR(buf)
Return the buffer content pointer cast to char *.
Definition buffer.h:151
ALLOC_ARRAY_GC
#define ALLOC_ARRAY_GC(dptr, type, n, gc)
Allocate a garbage-collected array of n elements of the given type.
Definition buffer.h:2003
buf_valid
static bool buf_valid(const struct buffer *buf)
Return true iff buf is valid.
Definition buffer.h:404
gc_init
static void gc_init(struct gc_arena *a)
Initialise a garbage collection arena to an empty state.
Definition buffer.h:1870
ALLOC_OBJ_CLEAR_GC
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Allocate and zero-initialise a garbage-collected object of the given type.
Definition buffer.h:2070
ALLOC_OBJ_GC
#define ALLOC_OBJ_GC(dptr, type, gc)
Allocate a garbage-collected object of the given type (uninitialised).
Definition buffer.h:2058
gc_free
static void gc_free(struct gc_arena *a)
Free all allocations in a garbage collection arena.
Definition buffer.h:1912
gc_new
static struct gc_arena gc_new(void)
Allocate and return a new, empty garbage collection arena.
Definition buffer.h:1896
check_cmd_access
bool check_cmd_access(const char *command, const char *opt, const char *chroot)
Verifies that the path in the "command" that comes after certain script options (e....
Definition check_file_access.c:214
options_postprocess_filechecks
void options_postprocess_filechecks(struct options *options)
Sanity check of all file/dir options.
Definition check_file_access.c:250
check_file_access.h
add_client_nat_to_option_list
void add_client_nat_to_option_list(struct client_nat_option_list *dest, const char *type, const char *network, const char *netmask, const char *foreign_network, msglvl_t msglevel)
Definition clinat.c:102
new_client_nat_list
struct client_nat_option_list * new_client_nat_list(struct gc_arena *gc)
Definition clinat.c:71
clone_client_nat_option_list
struct client_nat_option_list * clone_client_nat_option_list(const struct client_nat_option_list *src, struct gc_arena *gc)
Definition clinat.c:79
copy_client_nat_option_list
void copy_client_nat_option_list(struct client_nat_option_list *dest, const struct client_nat_option_list *src)
Definition clinat.c:88
TLS_CHANNEL_BUF_SIZE
#define TLS_CHANNEL_BUF_SIZE
Definition common.h:70
TLS_CHANNEL_MTU_MIN
#define TLS_CHANNEL_MTU_MIN
Definition common.h:83
check_compression_settings_valid
bool check_compression_settings_valid(struct compress_options *info, msglvl_t msglevel)
Checks if the compression settings are valid.
Definition comp.c:162
COMP_F_ALLOW_STUB_ONLY
#define COMP_F_ALLOW_STUB_ONLY
Only accept stub compression, even with COMP_F_ADVERTISE_STUBS_ONLY we still accept other compression...
Definition comp.h:45
COMP_F_SWAP
#define COMP_F_SWAP
initial command byte is swapped with last byte in buffer to preserve payload alignment
Definition comp.h:40
COMP_ALG_LZ4
#define COMP_ALG_LZ4
LZ4 algorithm.
Definition comp.h:59
COMP_ALGV2_LZ4
#define COMP_ALGV2_LZ4
Definition comp.h:64
COMP_F_ALLOW_NOCOMP_ONLY
#define COMP_F_ALLOW_NOCOMP_ONLY
Do not allow compression framing (breaks DCO)
Definition comp.h:51
COMP_F_ALLOW_ASYM
#define COMP_F_ALLOW_ASYM
Compression was explicitly set to allow asymetric compression.
Definition comp.h:49
COMP_ALGV2_UNCOMPRESSED
#define COMP_ALGV2_UNCOMPRESSED
Definition comp.h:63
COMP_ALG_STUB
#define COMP_ALG_STUB
support compression command byte and framing without actual compression
Definition comp.h:56
COMP_ALG_LZO
#define COMP_ALG_LZO
LZO algorithm.
Definition comp.h:57
COMP_F_ADVERTISE_STUBS_ONLY
#define COMP_F_ADVERTISE_STUBS_ONLY
tell server that we only support compression stubs
Definition comp.h:42
COMP_F_MIGRATE
#define COMP_F_MIGRATE
push stub-v2 or comp-lzo no when we see a client with comp-lzo in occ
Definition comp.h:47
comp_non_stub_enabled
static bool comp_non_stub_enabled(const struct compress_options *info)
Definition comp.h:81
COMP_ALG_UNDEF
#define COMP_ALG_UNDEF
Definition comp.h:54
strsep
char * strsep(char **stringp, const char *delim)
Definition compat-strsep.c:35
PACKAGE_NAME
#define PACKAGE_NAME
Definition config.h:492
IPROUTE_PATH
#define IPROUTE_PATH
Definition config.h:468
PACKAGE_VERSION
#define PACKAGE_VERSION
Definition config.h:504
CONFIGURE_DEFINES
#define CONFIGURE_DEFINES
Definition config.h:5
PACKAGE_STRING
#define PACKAGE_STRING
Definition config.h:495
TARGET_ALIAS
#define TARGET_ALIAS
Definition config.h:558
ascii2keydirection
int ascii2keydirection(msglvl_t msglevel, const char *str)
Definition crypto.c:1632
check_tls_prf_working
bool check_tls_prf_working(void)
Checks if the current TLS library supports the TLS 1.0 PRF with MD5+SHA1 that OpenVPN uses when TLS K...
Definition crypto.c:1916
crypto.h
Data Channel Cryptography Module.
CO_USE_TLS_KEY_MATERIAL_EXPORT
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition crypto.h:359
CO_USE_DYNAMIC_TLS_CRYPT
#define CO_USE_DYNAMIC_TLS_CRYPT
Bit-flag indicating that renegotiations are using tls-crypt with a TLS-EKM derived key.
Definition crypto.h:375
CO_EPOCH_DATA_KEY_FORMAT
#define CO_EPOCH_DATA_KEY_FORMAT
Bit-flag indicating the epoch the data format.
Definition crypto.h:379
KEY_DIRECTION_BIDIRECTIONAL
#define KEY_DIRECTION_BIDIRECTIONAL
Definition crypto.h:231
CO_USE_CC_EXIT_NOTIFY
#define CO_USE_CC_EXIT_NOTIFY
Bit-flag indicating that explicit exit notifies should be sent via the control channel instead of usi...
Definition crypto.h:371
MD_SHA256
@ MD_SHA256
Definition crypto_backend.h:61
MD_SHA1
@ MD_SHA1
Definition crypto_backend.h:60
SHA_DIGEST_LENGTH
#define SHA_DIGEST_LENGTH
Definition crypto_mbedtls.h:62
SHA256_DIGEST_LENGTH
#define SHA256_DIGEST_LENGTH
Definition crypto_mbedtls.h:63
dco_check_startup_option
static bool dco_check_startup_option(msglvl_t msglevel, const struct options *o)
Definition dco.h:280
dco_check_option
static bool dco_check_option(msglvl_t msglevel, const struct options *o)
Definition dco.h:274
dco_version_string
static const char * dco_version_string(struct gc_arena *gc)
Definition dco.h:268
dns_options_verify
bool dns_options_verify(msglvl_t msglevel, const struct dns_options *o)
Checks validity of DNS options.
Definition dns.c:212
dns_options_postprocess_pull
void dns_options_postprocess_pull(struct dns_options *o)
Merges pulled DNS servers with static ones into an ordered list.
Definition dns.c:289
dns_server_addr_parse
bool dns_server_addr_parse(struct dns_server *server, const char *addr)
Parses a string IPv4 or IPv6 address and optional colon separated port, into a in_addr or in6_addr re...
Definition dns.c:62
dns_domain_list_append
bool dns_domain_list_append(struct dns_domain **entry, char **domains, struct gc_arena *gc)
Appends safe DNS domain parameters to a linked list.
Definition dns.c:148
dns_server_get
struct dns_server * dns_server_get(struct dns_server **entry, long priority, struct gc_arena *gc)
Find or create DNS server with priority in a linked list.
Definition dns.c:190
dns_server_priority_parse
bool dns_server_priority_parse(long *priority, const char *str, bool pulled)
Parses a string DNS server priority and validates it.
Definition dns.c:175
clone_dns_options
struct dns_options clone_dns_options(const struct dns_options *o, struct gc_arena *gc)
Makes a deep copy of the passed DNS options.
Definition dns.c:266
dns_options_preprocess_pull
void dns_options_preprocess_pull(struct dns_options *o)
Saves and resets the server options, so that pulled ones don't mix in.
Definition dns.c:282
dns_updown_user_set
static bool dns_updown_user_set(const struct dns_options *o)
Returns whether dns-updown is user defined.
Definition dns.h:218
DNS_UPDOWN_FORCED
@ DNS_UPDOWN_FORCED
Definition dns.h:50
DNS_UPDOWN_NO_FLAGS
@ DNS_UPDOWN_NO_FLAGS
Definition dns.h:48
DNS_UPDOWN_USER_SET
@ DNS_UPDOWN_USER_SET
Definition dns.h:49
DNS_SECURITY_NO
@ DNS_SECURITY_NO
Definition dns.h:33
DNS_SECURITY_YES
@ DNS_SECURITY_YES
Definition dns.h:34
DNS_SECURITY_OPTIONAL
@ DNS_SECURITY_OPTIONAL
Definition dns.h:35
dns_updown_forced
static bool dns_updown_forced(const struct dns_options *o)
Returns whether dns-updown is forced to run.
Definition dns.h:229
DNS_TRANSPORT_PLAIN
@ DNS_TRANSPORT_PLAIN
Definition dns.h:41
DNS_TRANSPORT_TLS
@ DNS_TRANSPORT_TLS
Definition dns.h:43
DNS_TRANSPORT_HTTPS
@ DNS_TRANSPORT_HTTPS
Definition dns.h:42
domain_helper.h
validate_domain
static bool validate_domain(const char *domain)
Definition domain_helper.h:34
setenv_int
void setenv_int(struct env_set *es, const char *name, int value)
Definition env_set.c:291
setenv_str_i
void setenv_str_i(struct env_set *es, const char *name, const char *value, const int i)
Definition env_set.c:423
setenv_str
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition env_set.c:307
env_set_get
const char * env_set_get(const struct env_set *es, const char *name)
Definition env_set.c:201
setenv_str_safe
void setenv_str_safe(struct env_set *es, const char *name, const char *value)
Definition env_set.c:313
env_set_del
bool env_set_del(struct env_set *es, const char *str)
Definition env_set.c:183
setenv_long_long
void setenv_long_long(struct env_set *es, const char *name, long long value)
Definition env_set.c:299
D_PUSH
#define D_PUSH
Definition errlevel.h:82
D_TLS_DEBUG_MED
#define D_TLS_DEBUG_MED
Definition errlevel.h:156
D_DCO
#define D_DCO
Definition errlevel.h:93
D_PUSH_ERRORS
#define D_PUSH_ERRORS
Definition errlevel.h:66
D_TLS_ERRORS
#define D_TLS_ERRORS
Definition errlevel.h:58
M_INFO
#define M_INFO
Definition errlevel.h:54
forward.h
Interface functions to the internal and external multiplexers.
RELIABLE_MAX_INITIAL_TIMEOUT
#define RELIABLE_MAX_INITIAL_TIMEOUT
Maximum initial timeout (–tls-timeout) we accept.
Definition reliable.h:65
helper_setdefault_topology
void helper_setdefault_topology(struct options *o)
Set –topology default depending on –mode.
Definition helper.c:129
helper_tcp_nodelay
void helper_tcp_nodelay(struct options *o)
Definition helper.c:601
helper_client_server
void helper_client_server(struct options *o)
Definition helper.c:157
helper_keepalive
void helper_keepalive(struct options *o)
Definition helper.c:540
max_int
static int max_int(int x, int y)
Definition integer.h:92
constrain_int
static int constrain_int(int x, int min, int max)
Definition integer.h:118
tls_verify
static int tls_verify(struct openvpn_plugin_args_func_in const *args)
Definition keyingmaterialexporter.c:166
management_auth_token
void management_auth_token(struct management *man, const char *token)
Definition manage.c:3223
management_echo
void management_echo(struct management *man, const char *string, const bool pull)
Definition manage.c:3144
MF_FORGET_DISCONNECT
#define MF_FORGET_DISCONNECT
Definition manage.h:31
MF_EXTERNAL_KEY_PKCS1PAD
#define MF_EXTERNAL_KEY_PKCS1PAD
Definition manage.h:38
MF_CLIENT_AUTH
#define MF_CLIENT_AUTH
Definition manage.h:33
MF_EXTERNAL_KEY_PSSPAD
#define MF_EXTERNAL_KEY_PSSPAD
Definition manage.h:43
MF_EXTERNAL_KEY_NOPADDING
#define MF_EXTERNAL_KEY_NOPADDING
Definition manage.h:37
MF_QUERY_PROXY
#define MF_QUERY_PROXY
Definition manage.h:41
MF_EXTERNAL_KEY
#define MF_EXTERNAL_KEY
Definition manage.h:36
MF_QUERY_REMOTE
#define MF_QUERY_REMOTE
Definition manage.h:40
MF_QUERY_PASSWORDS
#define MF_QUERY_PASSWORDS
Definition manage.h:28
MF_EXTERNAL_CERT
#define MF_EXTERNAL_CERT
Definition manage.h:42
MF_EXTERNAL_KEY_DIGEST
#define MF_EXTERNAL_KEY_DIGEST
Definition manage.h:44
MF_UP_DOWN
#define MF_UP_DOWN
Definition manage.h:39
MF_HOLD
#define MF_HOLD
Definition manage.h:29
MF_SIGNAL
#define MF_SIGNAL
Definition manage.h:30
MF_UNIX_SOCK
#define MF_UNIX_SOCK
Definition manage.h:35
MF_CONNECT_AS_CLIENT
#define MF_CONNECT_AS_CLIENT
Definition manage.h:32
MBUF_SIZE_MAX
#define MBUF_SIZE_MAX
Definition mbuf.h:40
USER_PASS_LEN
#define USER_PASS_LEN
Definition misc.h:67
SC_CONCAT
#define SC_CONCAT
Definition misc.h:95
SC_ECHO
#define SC_ECHO
Definition misc.h:94
translate_mtu_discover_type_name
int translate_mtu_discover_type_name(const char *name)
Definition mtu.c:261
MSSFIX_DEFAULT
#define MSSFIX_DEFAULT
Definition mtu.h:89
TUN_MTU_MAX_MIN
#define TUN_MTU_MAX_MIN
Definition mtu.h:79
TAP_MTU_EXTRA_DEFAULT
#define TAP_MTU_EXTRA_DEFAULT
Definition mtu.h:84
LINK_MTU_DEFAULT
#define LINK_MTU_DEFAULT
Definition mtu.h:64
TUN_MTU_DEFAULT
#define TUN_MTU_DEFAULT
Definition mtu.h:69
TUN_MTU_MAX
#define TUN_MTU_MAX
Maximum MTU we accept for MTU related options.
Definition mtu.h:74
TUN_MTU_MIN
#define TUN_MTU_MIN
Definition mtu.h:59
TLS_MTU_DEFAULT
#define TLS_MTU_DEFAULT
Definition mtu.h:94
learn_address_script
static bool learn_address_script(const struct multi_context *m, const struct multi_instance *mi, const char *op, const struct mroute_addr *addr)
Definition multi.c:83
net_ctx_init
static int net_ctx_init(struct context *c, openvpn_net_ctx_t *ctx)
Definition networking.h:47
openvpn_net_ctx_t
void * openvpn_net_ctx_t
Definition networking.h:38
BOOL_CAST
#define BOOL_CAST(x)
Definition basic.h:26
CLEAR
#define CLEAR(x)
Definition basic.h:32
SIZE
#define SIZE(x)
Definition basic.h:29
errors_to_stderr
void errors_to_stderr(void)
Definition error.c:181
open_syslog
void open_syslog(const char *pgmname, bool stdio_to_null)
Definition error.c:444
redirect_stdout_stderr
void redirect_stdout_stderr(const char *file, bool append)
Definition error.c:493
openvpn_exit
void openvpn_exit(const int status)
Definition error.c:709
set_suppress_timestamps
void set_suppress_timestamps(bool suppressed)
Definition error.c:145
set_machine_readable_output
void set_machine_readable_output(bool parsable)
Definition error.c:151
msg_fp
FILE * msg_fp(const msglvl_t flags)
Definition error.c:190
set_debug_level
bool set_debug_level(const int level, const unsigned int flags)
Definition error.c:103
SDL_CONSTRAIN
#define SDL_CONSTRAIN
Definition error.h:201
M_NOPREFIX
#define M_NOPREFIX
Definition error.h:98
M_DEBUG_LEVEL
#define M_DEBUG_LEVEL
Definition error.h:88
M_USAGE
#define M_USAGE
Definition error.h:107
OPENVPN_EXIT_STATUS_USAGE
#define OPENVPN_EXIT_STATUS_USAGE
Definition error.h:54
OPENVPN_EXIT_STATUS_GOOD
#define OPENVPN_EXIT_STATUS_GOOD
Definition error.h:52
M_FATAL
#define M_FATAL
Definition error.h:90
M_ERR
#define M_ERR
Definition error.h:106
msg
#define msg(flags,...)
Definition error.h:152
msglvl_t
unsigned int msglvl_t
Definition error.h:77
ASSERT
#define ASSERT(x)
Definition error.h:219
M_WARN
#define M_WARN
Definition error.h:92
MAX_PEER_ID
#define MAX_PEER_ID
Definition openvpn.h:550
RESET_OPTION_ROUTES
#define RESET_OPTION_ROUTES(option_ptr, field)
Definition options.c:3660
rol6_check_alloc
static void rol6_check_alloc(struct options *options)
Definition options.c:1306
options_postprocess_verify_ce
static void options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
Definition options.c:1608
NM_QUOTE_HINT
#define NM_QUOTE_HINT
Definition options.c:3627
options_postprocess_mutate_ce
static void options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
Definition options.c:2269
usage_version
static void usage_version(void)
Definition options.c:3519
get_ip_addr
static in_addr_t get_ip_addr(const char *ip_string, msglvl_t msglevel, bool *error)
Definition options.c:1042
alloc_pull_filter
static struct pull_filter * alloc_pull_filter(struct options *o)
Definition options.c:1512
USAGE_VALID_SERVER_PROTOS
#define USAGE_VALID_SERVER_PROTOS
pre_connect_save
static void pre_connect_save(struct options *o)
Definition options.c:2460
setenv_connection_entry
static void setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
Definition options.c:919
global_auth_retry
static int global_auth_retry
Definition options.c:3398
options_postprocess_pull
bool options_postprocess_pull(struct options *o, struct env_set *es)
Definition options.c:3331
remove_option
void remove_option(struct context *c, struct options *options, char *p[], bool is_inline, const char *file, int line, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Resets options found in the PUSH_UPDATE message that are preceded by the - flag.
Definition options.c:3668
uninit_options
void uninit_options(struct options *o)
Definition options.c:903
connection_entry_load_re
static void connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
Definition options.c:1533
parse_topology
int parse_topology(const char *str, const msglvl_t msglevel)
Definition options.c:3351
show_windows_version
void show_windows_version(const unsigned int flags)
Definition options.c:3486
VERIFY_PERMISSION
#define VERIFY_PERMISSION(mask)
Definition options.c:3567
key_is_external
bool key_is_external(const struct options *options)
Definition options.c:4158
check_ca_required
static void check_ca_required(const struct options *options)
Definition options.c:1570
parse_http_proxy_override
static struct http_proxy_options * parse_http_proxy_override(const char *server, const char *port, const char *flags, struct gc_arena *gc)
Definition options.c:1326
init_options
void init_options(struct options *o)
Definition options.c:801
tuntap_options_postprocess_dns
static void tuntap_options_postprocess_dns(struct options *o)
Postprocess DNS related settings.
Definition options.c:2844
dhcp_option_dns6_parse
static void dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, unsigned int *len, msglvl_t msglevel)
Definition options.c:1192
get_ipv6_addr_no_netbits
static char * get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
Returns newly allocated string containing address part without "/nn".
Definition options.c:1067
option_iroute_ipv6
static void option_iroute_ipv6(struct options *o, const char *prefix_str, msglvl_t msglevel)
Definition options.c:1260
check_route_option
static bool check_route_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:3830
show_dco_version
void show_dco_version(const unsigned int flags)
Definition options.c:3495
rol_check_alloc
void rol_check_alloc(struct options *options)
Definition options.c:1297
alloc_local_list_if_undef
static struct local_list * alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
Definition options.c:1389
dhcp_option_address_parse
static void dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, unsigned int *len, msglvl_t msglevel)
Definition options.c:1206
helper_hashmap_sizes
static void helper_hashmap_sizes(struct options *o)
Sets the internal hash maps sizes according to the max_clients.
Definition options.c:3104
set_user_script
static void set_user_script(struct options *options, const char **script, const char *new_script, const char *type, bool in_chroot)
Definition options.c:4119
update_option
void update_option(struct context *c, struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Processes an option to update.
Definition options.c:3988
verify_permission
static bool verify_permission(const char *name, const char *file, int line, const uint64_t type, const uint64_t allowed, uint64_t *found, const msglvl_t msglevel, struct options *options, bool is_inline)
Definition options.c:3577
parse_hash_fingerprint_multiline
static struct verify_hash_list * parse_hash_fingerprint_multiline(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
Parses a string consisting of multiple lines of hexstrings and checks if each string has the correct ...
Definition options.c:1153
LZO_LIB_VER_STR
#define LZO_LIB_VER_STR
no_more_than_n_args
static bool no_more_than_n_args(const msglvl_t msglevel, char *p[], const int max, const unsigned int flags)
Definition options.c:3630
options_postprocess_mutate_le
static void options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
Definition options.c:2426
options_postprocess
void options_postprocess(struct options *options, struct env_set *es)
Definition options.c:3317
usage_small
void usage_small(void)
Definition options.c:3478
auth_retry_print
const char * auth_retry_print(void)
Definition options.c:3430
alloc_remote_entry
static struct remote_entry * alloc_remote_entry(struct options *options, const msglvl_t msglevel)
Definition options.c:1476
show_library_versions
void show_library_versions(const unsigned int flags)
Definition options.c:3505
setenv_settings
void setenv_settings(struct env_set *es, const struct options *o)
Definition options.c:945
usage_message
static const char usage_message[]
Definition options.c:123
alloc_connection_list_if_undef
static struct connection_list * alloc_connection_list_if_undef(struct options *options)
Definition options.c:1430
cnol_check_alloc
static void cnol_check_alloc(struct options *options)
Definition options.c:1315
options_postprocess_mutate
static void options_postprocess_mutate(struct options *o, struct env_set *es)
Definition options.c:3117
options_detach
void options_detach(struct options *o)
Definition options.c:1277
atou
static unsigned int atou(const char *str)
Definition options.c:3559
pre_connect_restore
void pre_connect_restore(struct options *o, struct gc_arena *gc)
Definition options.c:2505
alloc_pull_filter_list
static struct pull_filter_list * alloc_pull_filter_list(struct options *o)
Definition options.c:1502
print_topology
const char * print_topology(const int topology)
Definition options.c:3373
parse_hash_fingerprint
static struct verify_hash_list * parse_hash_fingerprint(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
Parses a hexstring and checks if the string has the correct length.
Definition options.c:1100
check_dns_option
static bool check_dns_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:3879
options_postprocess_cipher
static void options_postprocess_cipher(struct options *o)
Definition options.c:2678
options_set_backwards_compatible_options
static void options_set_backwards_compatible_options(struct options *o)
Changes default values so that OpenVPN can be compatible with the user specified version.
Definition options.c:2748
MUST_BE_FALSE
#define MUST_BE_FALSE(condition, parm_name)
Definition options.c:1601
MUST_BE_UNDEF
#define MUST_BE_UNDEF(parm, parm_name)
Definition options.c:1596
options_postprocess_http_proxy_override
static void options_postprocess_http_proxy_override(struct options *o)
Definition options.c:1354
options_postprocess_mutate_invariant
static void options_postprocess_mutate_invariant(struct options *options)
Definition options.c:2578
ipv6_addr_safe_hexplusbits
static bool ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
Definition options.c:1085
title_string
const char title_string[]
Definition options.c:73
setenv_local_entry
static void setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
Definition options.c:937
remap_redirect_gateway_flags
static void remap_redirect_gateway_flags(struct options *opt)
Definition options.c:2444
msglevel_forward_compatible
static msglvl_t msglevel_forward_compatible(struct options *options, const msglvl_t msglevel)
Definition options.c:3655
auth_retry_set
bool auth_retry_set(const msglvl_t msglevel, const char *option)
Definition options.c:3407
auth_retry_get
int auth_retry_get(void)
Definition options.c:3401
alloc_remote_list_if_undef
static struct remote_list * alloc_remote_list_if_undef(struct options *options)
Definition options.c:1466
check_route6_option
static bool check_route6_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
Definition options.c:3858
notnull
void notnull(const char *arg, const char *description)
Definition options.c:3541
usage
void usage(void)
Definition options.c:3452
alloc_local_entry
static struct local_entry * alloc_local_entry(struct connection_entry *ce, const msglvl_t msglevel, struct gc_arena *gc)
Definition options.c:1399
show_compression_warning
static void show_compression_warning(struct compress_options *info)
Definition options.c:4146
options_process_mutate_prf
static void options_process_mutate_prf(struct options *o)
Definition options.c:2816
add_option
void add_option(struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options.c:4178
has_udp_in_local_list
bool has_udp_in_local_list(const struct options *options)
Definition options.c:7923
option_iroute
static void option_iroute(struct options *o, const char *network_str, const char *netmask_str, msglvl_t msglevel)
Definition options.c:1233
options_postprocess_verify
static void options_postprocess_verify(const struct options *o)
Definition options.c:2641
connection_entry_preload_key
static void connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
Definition options.c:1554
alloc_connection_entry
static struct connection_entry * alloc_connection_entry(struct options *options, const msglvl_t msglevel)
Definition options.c:1440
need_compatibility_before
static bool need_compatibility_before(const struct options *o, unsigned int version)
The option –compat-mode is used to set up default settings to values used on the specified openvpn ve...
Definition options.c:2738
MODE_POINT_TO_POINT
#define MODE_POINT_TO_POINT
Definition options.h:264
OPT_P_SCRIPT
#define OPT_P_SCRIPT
Definition options.h:735
PUF_TYPE_ACCEPT
#define PUF_TYPE_ACCEPT
filter type to accept a matching option
Definition options.h:800
OPT_P_PUSH
#define OPT_P_PUSH
Definition options.h:747
SF_TCP_NODELAY_HELPER
#define SF_TCP_NODELAY_HELPER
Definition options.h:475
OPT_P_UP
#define OPT_P_UP
Definition options.h:732
OPT_P_CONNECTION
#define OPT_P_CONNECTION
Definition options.h:758
OPT_P_INSTANCE
#define OPT_P_INSTANCE
allowed in ccd, client-connect etc
Definition options.h:748
OPT_P_NCP
#define OPT_P_NCP
Negotiable crypto parameters.
Definition options.h:743
OPT_P_ECHO
#define OPT_P_ECHO
Definition options.h:751
OPT_P_ROUTE_TABLE
#define OPT_P_ROUTE_TABLE
Definition options.h:762
OPT_P_CONFIG
#define OPT_P_CONFIG
Definition options.h:749
MODE_SERVER
#define MODE_SERVER
Definition options.h:265
CONNECTION_LIST_SIZE
#define CONNECTION_LIST_SIZE
Definition options.h:192
streq
#define streq(x, y)
Definition options.h:726
OPT_P_U_REDIR_GATEWAY
#define OPT_P_U_REDIR_GATEWAY
Definition options.h:795
OPT_P_EXPLICIT_NOTIFY
#define OPT_P_EXPLICIT_NOTIFY
Definition options.h:750
PUF_TYPE_IGNORE
#define PUF_TYPE_IGNORE
filter type to ignore a matching option
Definition options.h:801
AR_INTERACT
#define AR_INTERACT
Definition options.h:940
OPT_P_SHAPER
#define OPT_P_SHAPER
Definition options.h:737
OPT_P_U_ROUTE6
#define OPT_P_U_ROUTE6
Definition options.h:792
dco_enabled
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition options.h:961
OPT_P_SOCKFLAGS
#define OPT_P_SOCKFLAGS
Definition options.h:757
SF_NOPOOL
#define SF_NOPOOL
Definition options.h:474
PUF_TYPE_REJECT
#define PUF_TYPE_REJECT
filter type to reject and trigger SIGUSR1
Definition options.h:802
OPT_P_MESSAGES
#define OPT_P_MESSAGES
Definition options.h:742
OPT_P_SETENV
#define OPT_P_SETENV
Definition options.h:736
OPT_P_SOCKBUF
#define OPT_P_SOCKBUF
Definition options.h:756
OPT_P_PLUGIN
#define OPT_P_PLUGIN
Definition options.h:755
OPTION_PARM_SIZE
#define OPTION_PARM_SIZE
Definition options.h:56
OPT_P_TIMER
#define OPT_P_TIMER
Definition options.h:738
OPT_P_GENERAL
#define OPT_P_GENERAL
Definition options.h:731
read_config_file
void read_config_file(struct options *options, const char *file, int level, const char *top_file, const int top_line, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options_parse.c:347
PING_RESTART
#define PING_RESTART
Definition options.h:356
OPT_P_DHCPDNS
#define OPT_P_DHCPDNS
Definition options.h:734
OPT_P_PULL_MODE
#define OPT_P_PULL_MODE
Definition options.h:754
GENKEY_AUTH_TOKEN
@ GENKEY_AUTH_TOKEN
Definition options.h:244
GENKEY_SECRET
@ GENKEY_SECRET
Definition options.h:241
GENKEY_TLS_CRYPTV2_SERVER
@ GENKEY_TLS_CRYPTV2_SERVER
Definition options.h:243
GENKEY_TLS_CRYPTV2_CLIENT
@ GENKEY_TLS_CRYPTV2_CLIENT
Definition options.h:242
OPT_P_PUSH_MTU
#define OPT_P_PUSH_MTU
Definition options.h:761
AR_NONE
#define AR_NONE
Definition options.h:939
AR_NOINTERACT
#define AR_NOINTERACT
Definition options.h:941
SF_NO_PUSH_ROUTE_GATEWAY
#define SF_NO_PUSH_ROUTE_GATEWAY
Definition options.h:476
OPT_P_PERSIST
#define OPT_P_PERSIST
Definition options.h:739
MAX_PARMS
#define MAX_PARMS
Definition options.h:51
OPT_P_U_DNS
#define OPT_P_U_DNS
Definition options.h:793
PLUGIN_OPTION_LIST
#define PLUGIN_OPTION_LIST(opt)
Definition options.h:777
ROUTE_OPTION_FLAGS
#define ROUTE_OPTION_FLAGS(o)
Definition options.h:769
OPT_P_U_ROUTE
#define OPT_P_U_ROUTE
Definition options.h:791
PING_EXIT
#define PING_EXIT
Definition options.h:355
OPT_P_COMP
#define OPT_P_COMP
Definition options.h:741
OPT_P_PERSIST_IP
#define OPT_P_PERSIST_IP
Definition options.h:740
OPT_P_MTU
#define OPT_P_MTU
Definition options.h:745
OPT_P_ROUTE_EXTRAS
#define OPT_P_ROUTE_EXTRAS
Definition options.h:753
OPT_P_U_DHCP
#define OPT_P_U_DHCP
Definition options.h:794
OPT_P_NICE
#define OPT_P_NICE
Definition options.h:746
OPT_P_PEER_ID
#define OPT_P_PEER_ID
Definition options.h:759
OPT_P_INHERIT
#define OPT_P_INHERIT
Definition options.h:752
OPT_P_TLS_PARMS
#define OPT_P_TLS_PARMS
Definition options.h:744
OPT_P_ROUTE
#define OPT_P_ROUTE
Definition options.h:733
PING_TIMEOUT_MAX
#define PING_TIMEOUT_MAX
Definition options.h:59
read_config_string
void read_config_string(const char *prefix, struct options *options, const char *config, const msglvl_t msglevel, const uint64_t permission_mask, uint64_t *option_types_found, struct env_set *es)
Definition options_parse.c:421
MAN_CLIENT_AUTH_ENABLED
#define MAN_CLIENT_AUTH_ENABLED(opt)
Definition options.h:783
CE_DISABLED
#define CE_DISABLED
Definition options.h:155
OPT_P_INLINE
#define OPT_P_INLINE
Definition options.h:760
VLAN_ONLY_UNTAGGED_OR_PRIORITY
@ VLAN_ONLY_UNTAGGED_OR_PRIORITY
Definition options.h:227
VLAN_ALL
@ VLAN_ALL
Definition options.h:228
VLAN_ONLY_TAGGED
@ VLAN_ONLY_TAGGED
Definition options.h:226
atoi_warn
int atoi_warn(const char *str, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number.
Definition options_util.c:152
positive_atoi
int positive_atoi(const char *str, msglvl_t msglevel)
Converts a str to a positive number if the string represents a postive integer number.
Definition options_util.c:121
positive_atoll
bool positive_atoll(const char *str, int64_t *value, const char *name, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number and is >= 0.
Definition options_util.c:136
valid_integer
bool valid_integer(const char *str, bool positive)
Checks if the string is a valid integer by checking if it can be converted to an integer.
Definition options_util.c:105
atoi_constrained
bool atoi_constrained(const char *str, int *value, const char *name, int min, int max, msglvl_t msglevel)
Converts a str to an integer if the string can be represented as an integer number and is between min...
Definition options_util.c:167
options_util.h
packet_id.h
MAX_SEQ_BACKTRACK
#define MAX_SEQ_BACKTRACK
Definition packet_id.h:85
MIN_SEQ_BACKTRACK
#define MIN_SEQ_BACKTRACK
Definition packet_id.h:84
DEFAULT_SEQ_BACKTRACK
#define DEFAULT_SEQ_BACKTRACK
Definition packet_id.h:86
MAX_TIME_BACKTRACK
#define MAX_TIME_BACKTRACK
Definition packet_id.h:94
DEFAULT_TIME_BACKTRACK
#define DEFAULT_TIME_BACKTRACK
Definition packet_id.h:95
MIN_TIME_BACKTRACK
#define MIN_TIME_BACKTRACK
Definition packet_id.h:93
platform_getpid
unsigned int platform_getpid(void)
Definition platform.c:333
platform_chdir
int platform_chdir(const char *dir)
Definition platform.c:392
platform_get_tmp_dir
const char * platform_get_tmp_dir(void)
Get a directory for temporary files.
Definition platform.c:588
plugin_option_list_new
struct plugin_option_list * plugin_option_list_new(struct gc_arena *gc)
Definition plugin.c:159
plugin_option_list_add
bool plugin_option_list_add(struct plugin_option_list *list, char **p, struct gc_arena *gc)
Definition plugin.c:167
ifconfig_pool_verify_range
bool ifconfig_pool_verify_range(const msglvl_t msglevel, const in_addr_t start, const in_addr_t end)
Definition pool.c:117
OPENVPN_8021Q_MIN_VID
#define OPENVPN_8021Q_MIN_VID
Definition proto.h:316
OPENVPN_8021Q_MAX_VID
#define OPENVPN_8021Q_MAX_VID
Definition proto.h:317
DEV_TYPE_TAP
#define DEV_TYPE_TAP
Definition proto.h:36
TOP_UNDEF
#define TOP_UNDEF
Definition proto.h:40
DEV_TYPE_UNDEF
#define DEV_TYPE_UNDEF
Definition proto.h:34
TOP_NET30
#define TOP_NET30
Definition proto.h:41
DEV_TYPE_TUN
#define DEV_TYPE_TUN
Definition proto.h:35
TOP_P2P
#define TOP_P2P
Definition proto.h:42
TOP_SUBNET
#define TOP_SUBNET
Definition proto.h:43
init_http_proxy_options_once
struct http_proxy_options * init_http_proxy_options_once(struct http_proxy_options **hpo, struct gc_arena *gc)
Definition proxy.c:44
PAR_NCT
#define PAR_NCT
Definition proxy.h:51
MAX_CUSTOM_HTTP_HEADER
#define MAX_CUSTOM_HTTP_HEADER
Definition proxy.h:43
PAR_ALL
#define PAR_ALL
Definition proxy.h:50
push_reset
void push_reset(struct options *o)
Definition push.c:943
push_options
void push_options(struct options *o, char **p, msglvl_t msglevel, struct gc_arena *gc)
Definition push.c:917
clone_push_list
void clone_push_list(struct options *o)
Definition push.c:902
push_remove_option
void push_remove_option(struct options *o, const char *p)
Definition push.c:949
is_special_addr
bool is_special_addr(const char *addr_str)
Definition route.c:288
clone_route_option_list
struct route_option_list * clone_route_option_list(const struct route_option_list *src, struct gc_arena *a)
Definition route.c:155
netmask_to_netbits2
int netmask_to_netbits2(in_addr_t netmask)
Definition route.c:3856
new_route_ipv6_option_list
struct route_ipv6_option_list * new_route_ipv6_option_list(struct gc_arena *a)
Definition route.c:139
delete_routes_v6
void delete_routes_v6(struct route_ipv6_list *rl6, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1185
get_default_gateway_ipv6
void get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest, openvpn_net_ctx_t *ctx)
Definition route.c:2628
add_route_ipv6_to_option_list
void add_route_ipv6_to_option_list(struct route_ipv6_option_list *l, const char *prefix, const char *gateway, const char *metric, int table_id)
Definition route.c:496
copy_route_option_list
void copy_route_option_list(struct route_option_list *dest, const struct route_option_list *src, struct gc_arena *a)
Definition route.c:173
copy_route_ipv6_option_list
void copy_route_ipv6_option_list(struct route_ipv6_option_list *dest, const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:181
print_default_gateway
void print_default_gateway(const msglvl_t msglevel, const struct route_gateway_info *rgi, const struct route_ipv6_gateway_info *rgi6)
Definition route.c:1241
get_default_gateway
void get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
Retrieves the best gateway for a given destination based on the routing table.
Definition route.c:2531
clone_route_ipv6_option_list
struct route_ipv6_option_list * clone_route_ipv6_option_list(const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:164
new_route_option_list
struct route_option_list * new_route_option_list(struct gc_arena *a)
Definition route.c:130
show_routes
void show_routes(msglvl_t msglevel)
Definition route.c:3031
delete_routes_v4
void delete_routes_v4(struct route_list *rl, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1163
add_route_to_option_list
void add_route_to_option_list(struct route_option_list *l, const char *network, const char *netmask, const char *gateway, const char *metric, int table_id)
Definition route.c:481
RG_LOCAL
#define RG_LOCAL
Definition route.h:87
RG_BYPASS_DHCP
#define RG_BYPASS_DHCP
Definition route.h:89
ROUTE_METHOD_SERVICE
#define ROUTE_METHOD_SERVICE
Definition route.h:42
ROUTE_METHOD_IPAPI
#define ROUTE_METHOD_IPAPI
Definition route.h:40
ROUTE_METHOD_EXE
#define ROUTE_METHOD_EXE
Definition route.h:41
RG_DEF1
#define RG_DEF1
Definition route.h:88
RG_BYPASS_DNS
#define RG_BYPASS_DNS
Definition route.h:90
RG_ENABLE
#define RG_ENABLE
Definition route.h:86
RG_REROUTE_GW
#define RG_REROUTE_GW
Definition route.h:91
ROUTE_METHOD_ADAPTIVE
#define ROUTE_METHOD_ADAPTIVE
Definition route.h:39
RG_AUTO_LOCAL
#define RG_AUTO_LOCAL
Definition route.h:92
RG_BLOCK_LOCAL
#define RG_BLOCK_LOCAL
Definition route.h:93
script_security_set
void script_security_set(int level)
Definition run_command.c:48
run_command.h
SSEC_PW_ENV
#define SSEC_PW_ENV
allow calling of built-in programs and user-defined scripts that may receive a password as an environ...
Definition run_command.h:38
SSEC_NONE
#define SSEC_NONE
strictly no calling of external programs
Definition run_command.h:31
SHAPER_MAX
#define SHAPER_MAX
Definition shaper.h:40
SHAPER_MIN
#define SHAPER_MIN
Definition shaper.h:39
get_ipv6_addr
bool get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits, msglvl_t msglevel)
Translate an IPv6 addr or hostname from string form to in6_addr.
Definition socket.c:222
getaddr
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, struct signal_info *sig_info)
Translate an IPv4 addr or hostname from string form to in_addr_t.
Definition socket.c:195
RESOLV_RETRY_INFINITE
#define RESOLV_RETRY_INFINITE
Definition socket.h:48
OPENVPN_PORT
#define OPENVPN_PORT
Definition socket.h:42
SF_USE_IP_PKTINFO
#define SF_USE_IP_PKTINFO
Definition socket.h:210
SF_HOST_RANDOMIZE
#define SF_HOST_RANDOMIZE
Definition socket.h:213
SF_PKTINFO_COPY_IIF
#define SF_PKTINFO_COPY_IIF
Definition socket.h:217
proto2ascii
const char * proto2ascii(int proto, sa_family_t af, bool display_form)
Definition socket_util.c:409
mac_addr_safe
bool mac_addr_safe(const char *mac_addr)
Definition socket_util.c:890
proto2ascii_all
const char * proto2ascii_all(struct gc_arena *gc)
Definition socket_util.c:430
ascii2af
sa_family_t ascii2af(const char *proto_name)
Definition socket_util.c:396
ipv6_addr_safe
bool ipv6_addr_safe(const char *ipv6_text_addr)
Definition socket_util.c:837
print_in6_addr
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition socket_util.c:216
ip_or_dns_addr_safe
bool ip_or_dns_addr_safe(const char *addr, const bool allow_fqdn)
Definition socket_util.c:873
ascii2proto
int ascii2proto(const char *proto_name)
Definition socket_util.c:383
print_in_addr_t
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition socket_util.c:196
ip_addr_dotted_quad_safe
bool ip_addr_dotted_quad_safe(const char *dotted_quad)
Definition socket_util.c:787
socket_util.h
proto_is_net
static bool proto_is_net(int proto)
Definition socket_util.h:185
proto_is_udp
static bool proto_is_udp(int proto)
Returns if the protocol being used is UDP.
Definition socket_util.h:195
GETADDR_FATAL
#define GETADDR_FATAL
Definition socket_util.h:118
PROTO_NONE
@ PROTO_NONE
Definition socket_util.h:176
PROTO_UDP
@ PROTO_UDP
Definition socket_util.h:177
PROTO_TCP
@ PROTO_TCP
Definition socket_util.h:178
PROTO_TCP_CLIENT
@ PROTO_TCP_CLIENT
Definition socket_util.h:180
PROTO_TCP_SERVER
@ PROTO_TCP_SERVER
Definition socket_util.h:179
GETADDR_HOST_ORDER
#define GETADDR_HOST_ORDER
Definition socket_util.h:119
proto_is_dgram
static bool proto_is_dgram(int proto)
Return if the protocol is datagram (UDP)
Definition socket_util.h:206
GETADDR_RESOLVE
#define GETADDR_RESOLVE
Definition socket_util.h:117
IA_NET_ORDER
#define IA_NET_ORDER
Definition socket_util.h:90
ssl_set_auth_token_user
void ssl_set_auth_token_user(const char *username)
Definition ssl.c:375
ssl_set_auth_nocache
void ssl_set_auth_nocache(void)
Definition ssl.c:350
push_peer_info
static bool push_peer_info(struct buffer *buf, struct tls_multi *multi, struct tls_session *session)
Prepares the IV_ and UV_ variables that are part of the exchange to signal the peer's capabilities.
Definition ssl.c:1925
tls_version_parse
int tls_version_parse(const char *vstr, const char *extra)
Definition ssl.c:434
ssl_set_auth_token
void ssl_set_auth_token(const char *token)
Definition ssl.c:369
ssl_get_auth_nocache
bool ssl_get_auth_nocache(void)
Definition ssl.c:360
ssl.h
Control Channel SSL/Data channel negotiation module.
X509_USERNAME_FIELD_DEFAULT
#define X509_USERNAME_FIELD_DEFAULT
Definition ssl.h:120
get_ssl_library_version
const char * get_ssl_library_version(void)
return a pointer to a static memory area containing the name and version number of the SSL library in...
Definition ssl_openssl.c:2628
TLS_VER_BAD
#define TLS_VER_BAD
Parse a TLS version specifier.
Definition ssl_backend.h:103
TLS_VER_1_0
#define TLS_VER_1_0
Definition ssl_backend.h:105
EXPORT_KEY_DATA_LABEL
#define EXPORT_KEY_DATA_LABEL
Definition ssl_backend.h:383
TLS_VER_1_2
#define TLS_VER_1_2
Definition ssl_backend.h:107
TLS_VER_1_3
#define TLS_VER_1_3
Definition ssl_backend.h:108
tls_version_max
int tls_version_max(void)
Return the maximum TLS version (as a TLS_VER_x constant) supported by current SSL implementation.
Definition ssl_openssl.c:188
SSLF_TLS_VERSION_MAX_SHIFT
#define SSLF_TLS_VERSION_MAX_SHIFT
Definition ssl_common.h:431
SSLF_CLIENT_CERT_OPTIONAL
#define SSLF_CLIENT_CERT_OPTIONAL
Definition ssl_common.h:424
SSLF_AUTH_USER_PASS_OPTIONAL
#define SSLF_AUTH_USER_PASS_OPTIONAL
Definition ssl_common.h:426
SSLF_CLIENT_CERT_NOT_REQUIRED
#define SSLF_CLIENT_CERT_NOT_REQUIRED
Definition ssl_common.h:423
SSLF_CRL_VERIFY_DIR
#define SSLF_CRL_VERIFY_DIR
Definition ssl_common.h:428
SSLF_TLS_DEBUG_ENABLED
#define SSLF_TLS_DEBUG_ENABLED
Definition ssl_common.h:433
SSLF_TLS_VERSION_MAX_MASK
#define SSLF_TLS_VERSION_MAX_MASK
Definition ssl_common.h:432
SSLF_TLS_VERSION_MIN_SHIFT
#define SSLF_TLS_VERSION_MIN_SHIFT
Definition ssl_common.h:429
SSLF_TLS_VERSION_MIN_MASK
#define SSLF_TLS_VERSION_MIN_MASK
Definition ssl_common.h:430
SSLF_USERNAME_AS_COMMON_NAME
#define SSLF_USERNAME_AS_COMMON_NAME
Definition ssl_common.h:425
options_postprocess_setdefault_ncpciphers
void options_postprocess_setdefault_ncpciphers(struct options *o)
Checks for availibility of Chacha20-Poly1305 and sets the ncp_cipher to either AES-256-GCM:AES-128-GC...
Definition ssl_ncp.c:585
tls_item_in_cipher_list
bool tls_item_in_cipher_list(const char *item, const char *list)
Return true iff item is present in the colon-separated zero-terminated cipher list.
Definition ssl_ncp.c:197
append_cipher_to_ncp_list
void append_cipher_to_ncp_list(struct options *o, const char *ciphername)
Appends the cipher specified by the ciphernamer parameter to to the o->ncp_ciphers list.
Definition ssl_ncp.c:186
mutate_ncp_cipher_list
char * mutate_ncp_cipher_list(const char *list, struct gc_arena *gc)
Check whether the ciphers in the supplied list are supported.
Definition ssl_ncp.c:86
ssl_ncp.h
Control Channel SSL/Data dynamic negotiation Module This file is split from ssl.h to be able to unit ...
ssl_verify.h
Control Channel Verification Module.
OPENVPN_KU_REQUIRED
#define OPENVPN_KU_REQUIRED
Require keyUsage to be present in cert (0xFFFF is an invalid KU value)
Definition ssl_verify.h:257
VERIFY_X509_SUBJECT_DN
#define VERIFY_X509_SUBJECT_DN
Definition ssl_verify.h:69
VERIFY_X509_SUBJECT_RDN
#define VERIFY_X509_SUBJECT_RDN
Definition ssl_verify.h:70
NS_CERT_CHECK_CLIENT
#define NS_CERT_CHECK_CLIENT
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:254
VERIFY_X509_SUBJECT_RDN_PREFIX
#define VERIFY_X509_SUBJECT_RDN_PREFIX
Definition ssl_verify.h:71
NS_CERT_CHECK_SERVER
#define NS_CERT_CHECK_SERVER
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:252
x509_username_field_ext_supported
bool x509_username_field_ext_supported(const char *extname)
Return true iff the supplied extension field is supported by the –x509-username-field option.
Definition ssl_verify_openssl.c:115
x509_track_add
void x509_track_add(const struct x509_track **ll_head, const char *name, msglvl_t msglevel, struct gc_arena *gc)
Definition ssl_verify_openssl.c:431
buffer
Wrapper structure for dynamically allocated memory.
Definition buffer.h:71
buffer::data
uint8_t * data
Pointer to the allocated memory.
Definition buffer.h:78
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:76
compress_options
Definition comp.h:75
compress_options::flags
unsigned int flags
Definition comp.h:77
compress_options::alg
int alg
Definition comp.h:76
connection_entry
Definition options.h:109
connection_entry::local_list
struct local_list * local_list
Definition options.h:110
connection_entry::tun_mtu_max
int tun_mtu_max
Definition options.h:131
connection_entry::connect_retry_seconds
int connect_retry_seconds
Definition options.h:121
connection_entry::tls_crypt_v2_force_cookie
bool tls_crypt_v2_force_cookie
Definition options.h:181
connection_entry::link_mtu
int link_mtu
Definition options.h:136
connection_entry::link_mtu_defined
bool link_mtu_defined
Definition options.h:137
connection_entry::tun_mtu_extra
int tun_mtu_extra
Definition options.h:134
connection_entry::connect_retry_seconds_max
int connect_retry_seconds_max
Definition options.h:122
connection_entry::bind_local
bool bind_local
Definition options.h:120
connection_entry::mssfix
int mssfix
Definition options.h:146
connection_entry::tls_crypt_file
const char * tls_crypt_file
Definition options.h:172
connection_entry::tls_crypt_v2_file
const char * tls_crypt_v2_file
Definition options.h:177
connection_entry::tun_mtu_extra_defined
bool tun_mtu_extra_defined
Definition options.h:135
connection_entry::remote
const char * remote
Definition options.h:116
connection_entry::connect_timeout
int connect_timeout
Definition options.h:123
connection_entry::socks_proxy_port
const char * socks_proxy_port
Definition options.h:126
connection_entry::mssfix_default
bool mssfix_default
Definition options.h:147
connection_entry::mssfix_encap
bool mssfix_encap
Definition options.h:148
connection_entry::occ_mtu
int occ_mtu
Definition options.h:130
connection_entry::http_proxy_options
struct http_proxy_options * http_proxy_options
Definition options.h:124
connection_entry::tls_crypt_file_inline
bool tls_crypt_file_inline
Definition options.h:173
connection_entry::tls_auth_file_inline
bool tls_auth_file_inline
Definition options.h:168
connection_entry::bind_ipv6_only
bool bind_ipv6_only
Definition options.h:119
connection_entry::tun_mtu_defined
bool tun_mtu_defined
Definition options.h:133
connection_entry::remote_float
bool remote_float
Definition options.h:117
connection_entry::tls_mtu
int tls_mtu
Definition options.h:138
connection_entry::explicit_exit_notification
int explicit_exit_notification
Definition options.h:152
connection_entry::socks_proxy_authfile
const char * socks_proxy_authfile
Definition options.h:127
connection_entry::remote_port
const char * remote_port
Definition options.h:115
connection_entry::fragment_encap
bool fragment_encap
Definition options.h:144
connection_entry::socks_proxy_server
const char * socks_proxy_server
Definition options.h:125
connection_entry::fragment
int fragment
Definition options.h:143
connection_entry::mtu_discover_type
int mtu_discover_type
Definition options.h:141
connection_entry::proto
int proto
Definition options.h:111
connection_entry::af
sa_family_t af
Definition options.h:112
connection_entry::tls_auth_file
const char * tls_auth_file
Definition options.h:167
connection_entry::local_port_defined
bool local_port_defined
Definition options.h:114
connection_entry::tun_mtu
int tun_mtu
Definition options.h:129
connection_entry::bind_defined
bool bind_defined
Definition options.h:118
connection_entry::local_port
const char * local_port
Definition options.h:113
connection_entry::key_direction
int key_direction
Definition options.h:169
connection_entry::tls_crypt_v2_file_inline
bool tls_crypt_v2_file_inline
Definition options.h:178
connection_entry::flags
unsigned int flags
Definition options.h:164
connection_entry::mssfix_fixed
bool mssfix_fixed
Definition options.h:150
connection_list
Definition options.h:202
connection_list::array
struct connection_entry ** array
Definition options.h:206
connection_list::capacity
int capacity
Definition options.h:203
connection_list::len
int len
Definition options.h:204
context_1::route_list
struct route_list * route_list
List of routing information.
Definition openvpn.h:178
context_1::route_ipv6_list
struct route_ipv6_list * route_ipv6_list
Definition openvpn.h:183
context_1::tuntap
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition openvpn.h:173
context
Contains all state information for one tunnel.
Definition openvpn.h:471
context::net_ctx
openvpn_net_ctx_t net_ctx
Networking API opaque context.
Definition openvpn.h:498
context::options
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:472
context::c1
struct context_1 c1
Level 1 context.
Definition openvpn.h:513
dhcp_options
Definition dns.h:100
dhcp_options::dns
in_addr_t dns[N_DHCP_ADDR]
Definition dns.h:101
dhcp
Definition dhcp.h:62
dns_domain
Definition dns.h:54
dns_domain::next
struct dns_domain * next
Definition dns.h:55
dns_domain::name
const char * name
Definition dns.h:56
dns_options
Definition dns.h:113
dns_options::servers
struct dns_server * servers
Definition dns.h:117
dns_options::updown
const char * updown
Definition dns.h:119
dns_options::from_dhcp
struct dhcp_options from_dhcp
Definition dns.h:114
dns_options::gc
struct gc_arena gc
Definition dns.h:118
dns_options::updown_flags
enum dns_updown_flags updown_flags
Definition dns.h:120
dns_options::search_domains
struct dns_domain * search_domains
Definition dns.h:115
dns_server_addr::a4
struct in_addr a4
Definition dns.h:63
dns_server_addr::in
union dns_server_addr::@0 in
dns_server_addr::family
sa_family_t family
Definition dns.h:66
dns_server_addr::a6
struct in6_addr a6
Definition dns.h:64
dns_server_addr::port
in_port_t port
Definition dns.h:67
dns_server
Definition dns.h:71
dns_server::addr
struct dns_server_addr addr[8]
Definition dns.h:75
dns_server::dnssec
enum dns_security dnssec
Definition dns.h:77
dns_server::next
struct dns_server * next
Definition dns.h:72
dns_server::priority
long priority
Definition dns.h:73
dns_server::addr_count
size_t addr_count
Definition dns.h:74
dns_server::domains
struct dns_domain * domains
Definition dns.h:76
dns_server::transport
enum dns_server_transport transport
Definition dns.h:78
dns_server::sni
const char * sni
Definition dns.h:79
env_item
Definition env_set.h:37
env_item::string
char * string
Definition env_set.h:38
env_item::next
struct env_item * next
Definition env_set.h:39
env_set
Definition env_set.h:43
env_set::list
struct env_item * list
Definition env_set.h:45
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:127
hash
Definition list.h:56
http_custom_header
Definition proxy.h:38
http_custom_header::name
const char * name
Definition proxy.h:39
http_custom_header::content
const char * content
Definition proxy.h:40
http_proxy_options
Definition proxy.h:45
http_proxy_options::auth_file
const char * auth_file
Definition proxy.h:55
http_proxy_options::http_version
const char * http_version
Definition proxy.h:57
http_proxy_options::port
const char * port
Definition proxy.h:47
http_proxy_options::inline_creds
bool inline_creds
Definition proxy.h:60
http_proxy_options::user_agent
const char * user_agent
Definition proxy.h:58
http_proxy_options::auth_retry
int auth_retry
Definition proxy.h:52
http_proxy_options::auth_method_string
const char * auth_method_string
Definition proxy.h:54
http_proxy_options::nocache
bool nocache
Definition proxy.h:63
http_proxy_options::custom_headers
struct http_custom_header custom_headers[MAX_CUSTOM_HTTP_HEADER]
Definition proxy.h:59
http_proxy_options::auth_file_up
const char * auth_file_up
Definition proxy.h:56
http_proxy_options::server
const char * server
Definition proxy.h:46
iroute_ipv6
Definition route.h:268
iroute_ipv6::next
struct iroute_ipv6 * next
Definition route.h:271
iroute_ipv6::netbits
unsigned int netbits
Definition route.h:270
iroute_ipv6::network
struct in6_addr network
Definition route.h:269
iroute::network
in_addr_t network
Definition route.h:262
iroute::netbits
int netbits
Definition route.h:263
iroute::next
struct iroute * next
Definition route.h:264
local_entry
Definition options.h:102
local_entry::port
const char * port
Definition options.h:104
local_entry::proto
int proto
Definition options.h:105
local_entry::local
const char * local
Definition options.h:103
local_list
Definition options.h:195
local_list::array
struct local_entry ** array
Definition options.h:198
local_list::len
int len
Definition options.h:197
local_list::capacity
int capacity
Definition options.h:196
options_pre_connect
Definition options.h:65
options_pre_connect::tuntap_options
struct tuntap_options tuntap_options
Definition options.h:67
options_pre_connect::routes_defined
bool routes_defined
Definition options.h:72
options_pre_connect::ping_rec_timeout_action
int ping_rec_timeout_action
Definition options.h:91
options_pre_connect::foreign_option_index
int foreign_option_index
Definition options.h:93
options_pre_connect::tuntap_options_defined
bool tuntap_options_defined
Definition options.h:66
options_pre_connect::routes_ipv6_defined
bool routes_ipv6_defined
Definition options.h:75
options_pre_connect::ping_rec_timeout
int ping_rec_timeout
Definition options.h:90
options_pre_connect::routes
struct route_option_list * routes
Definition options.h:73
options_pre_connect::comp
struct compress_options comp
Definition options.h:94
options_pre_connect::ciphername
const char * ciphername
Definition options.h:86
options_pre_connect::ifconfig_local
const char * ifconfig_local
Definition options.h:69
options_pre_connect::dns_options
struct dns_options dns_options
Definition options.h:84
options_pre_connect::route_default_gateway
const char * route_default_gateway
Definition options.h:78
options_pre_connect::ping_send_timeout
int ping_send_timeout
Definition options.h:89
options_pre_connect::ifconfig_ipv6_local
const char * ifconfig_ipv6_local
Definition options.h:70
options_pre_connect::authname
const char * authname
Definition options.h:87
options_pre_connect::routes_ipv6
struct route_ipv6_option_list * routes_ipv6
Definition options.h:76
options_pre_connect::client_nat_defined
bool client_nat_defined
Definition options.h:81
options_pre_connect::client_nat
struct client_nat_option_list * client_nat
Definition options.h:82
options_pre_connect::route_ipv6_default_gateway
const char * route_ipv6_default_gateway
Definition options.h:79
options::resolve_retry_seconds
int resolve_retry_seconds
Definition options.h:367
options::rcvbuf
int rcvbuf
Definition options.h:413
options::resolve_in_advance
bool resolve_in_advance
Definition options.h:368
options::route_nopull
bool route_nopull
Definition options.h:437
options::genkey_extra_data
const char * genkey_extra_data
Definition options.h:290
options::comp
struct compress_options comp
Definition options.h:410
options::http_proxy_override
struct http_proxy_options * http_proxy_override
Definition options.h:313
options::push_ifconfig_ipv6_netbits
int push_ifconfig_ipv6_netbits
Definition options.h:523
options::proto_force
int proto_force
Definition options.h:336
options::persist_config
bool persist_config
Definition options.h:278
options::connection_list
struct connection_list * connection_list
Definition options.h:295
options::management_port
const char * management_port
Definition options.h:447
options::tls_crypt_file_inline
bool tls_crypt_file_inline
Definition options.h:665
options::ifconfig_ipv6_remote
const char * ifconfig_ipv6_remote
Definition options.h:331
options::max_routes_per_client
int max_routes_per_client
Definition options.h:536
options::ncp_ciphers_conf
const char * ncp_ciphers_conf
The original ncp_ciphers specified by the user in the configuration.
Definition options.h:579
options::status_file_version
int status_file_version
Definition options.h:407
options::vlan_accept
enum vlan_acceptable_frames vlan_accept
Definition options.h:713
options::auth_token_renewal
int auth_token_renewal
Definition options.h:545
options::push_ifconfig_constraint_network
in_addr_t push_ifconfig_constraint_network
Definition options.h:518
options::tmp_dir
const char * tmp_dir
Definition options.h:466
options::push_peer_info
bool push_peer_info
Definition options.h:681
options::daemon
bool daemon
Definition options.h:391
options::pre_connect
struct options_pre_connect * pre_connect
Definition options.h:563
options::route_default_metric
int route_default_metric
Definition options.h:429
options::renegotiate_seconds_min
int renegotiate_seconds_min
Definition options.h:647
options::auth_token_secret_file
const char * auth_token_secret_file
Definition options.h:546
options::imported_protocol_flags
unsigned int imported_protocol_flags
Definition options.h:723
options::tls_export_peer_cert_dir
const char * tls_export_peer_cert_dir
Definition options.h:612
options::crl_file_inline
bool crl_file_inline
Definition options.h:616
options::cryptoapi_cert
const char * cryptoapi_cert
Definition options.h:638
options::down_script
const char * down_script
Definition options.h:386
options::backwards_compatible
unsigned int backwards_compatible
What version we should try to be compatible with as major * 10000 + minor * 100 + patch,...
Definition options.h:272
options::verify_hash_algo
hash_algo_type verify_hash_algo
Definition options.h:622
options::scheduled_exit_interval
int scheduled_exit_interval
Definition options.h:565
options::stale_routes_ageing_time
int stale_routes_ageing_time
Definition options.h:538
options::pkcs12_file_inline
bool pkcs12_file_inline
Definition options.h:605
options::replay_time
int replay_time
Definition options.h:586
options::management_state_buffer_size
int management_state_buffer_size
Definition options.h:451
options::ca_file
const char * ca_file
Definition options.h:593
options::tls_auth_file
const char * tls_auth_file
Definition options.h:660
options::providers
struct provider_list providers
Definition options.h:583
options::duplicate_cn
bool duplicate_cn
Definition options.h:527
options::server_network_ipv6
struct in6_addr server_network_ipv6
Definition options.h:471
options::shaper
int shaper
Definition options.h:334
options::management_echo_buffer_size
int management_echo_buffer_size
Definition options.h:450
options::server_network
in_addr_t server_network
Definition options.h:468
options::real_hash_size
uint32_t real_hash_size
Definition options.h:499
options::show_net_up
bool show_net_up
Definition options.h:694
options::verify_hash_no_ca
bool verify_hash_no_ca
Definition options.h:624
options::allow_pull_fqdn
bool allow_pull_fqdn
Definition options.h:439
options::use_peer_id
bool use_peer_id
Whether the data channel uses the DATA_V2 header (peer-id).
Definition options.h:703
options::remote_cert_ku
unsigned remote_cert_ku[MAX_PARMS]
Definition options.h:619
options::server_bridge_defined
bool server_bridge_defined
Definition options.h:481
options::keying_material_exporter_label
const char * keying_material_exporter_label
Definition options.h:707
options::status_file
const char * status_file
Definition options.h:406
options::ssl_flags
unsigned int ssl_flags
Definition options.h:625
options::route_noexec
bool route_noexec
Definition options.h:430
options::ifconfig_nowarn
bool ifconfig_nowarn
Definition options.h:333
options::remote_cert_eku
const char * remote_cert_eku
Definition options.h:620
options::ifconfig_pool_netmask
in_addr_t ifconfig_pool_netmask
Definition options.h:491
options::server_netmask
in_addr_t server_netmask
Definition options.h:469
options::tls_timeout
int tls_timeout
Definition options.h:641
options::test_crypto
bool test_crypto
Definition options.h:588
options::up_delay
bool up_delay
Definition options.h:389
options::server_bridge_proxy_dhcp
bool server_bridge_proxy_dhcp
Definition options.h:479
options::allow_recursive_routing
bool allow_recursive_routing
Definition options.h:720
options::authname
const char * authname
Definition options.h:581
options::exit_event_name
const char * exit_event_name
Definition options.h:692
options::ifconfig_ipv6_local
const char * ifconfig_ipv6_local
Definition options.h:329
options::cf_max
int cf_max
Definition options.h:529
options::dh_file_inline
bool dh_file_inline
Definition options.h:597
options::replay_window
int replay_window
Definition options.h:585
options::disable
bool disable
Definition options.h:507
options::mute
int mute
Definition options.h:400
options::auth_user_pass_verify_script_via_file
bool auth_user_pass_verify_script_via_file
Definition options.h:541
options::dev_type
const char * dev_type
Definition options.h:323
options::persist_mode
int persist_mode
Definition options.h:279
options::ifconfig_pool_persist_refresh_freq
int ifconfig_pool_persist_refresh_freq
Definition options.h:493
options::show_digests
bool show_digests
Definition options.h:283
options::up_script
const char * up_script
Definition options.h:385
options::push_option_types_found
uint64_t push_option_types_found
Definition options.h:558
options::single_session
bool single_session
Definition options.h:679
options::push_ifconfig_defined
bool push_ifconfig_defined
Definition options.h:513
options::ifconfig_pool_defined
bool ifconfig_pool_defined
Definition options.h:488
options::verify_hash_depth
int verify_hash_depth
Definition options.h:623
options::route_delay_defined
bool route_delay_defined
Definition options.h:433
options::packet_id_file
const char * packet_id_file
Definition options.h:587
options::tls_crypt_v2_file
const char * tls_crypt_v2_file
Definition options.h:669
options::management_log_history_cache
int management_log_history_cache
Definition options.h:449
options::server_bridge_netmask
in_addr_t server_bridge_netmask
Definition options.h:483
options::ip_remote_hint
const char * ip_remote_hint
Definition options.h:369
options::vlan_tagging
bool vlan_tagging
Definition options.h:712
options::peer_id
uint32_t peer_id
Definition options.h:704
options::routes
struct route_option_list * routes
Definition options.h:434
options::ifconfig_pool_end
in_addr_t ifconfig_pool_end
Definition options.h:490
options::keepalive_timeout
int keepalive_timeout
Definition options.h:343
options::writepid
const char * writepid
Definition options.h:384
options::inactivity_minimum_bytes
int64_t inactivity_minimum_bytes
Definition options.h:346
options::ifconfig_ipv6_pool_defined
bool ifconfig_ipv6_pool_defined
Definition options.h:495
options::server_flags
unsigned int server_flags
Definition options.h:477
options::max_clients
uint32_t max_clients
Definition options.h:535
options::block_outside_dns
bool block_outside_dns
Definition options.h:696
options::push_ifconfig_ipv6_blocked
bool push_ifconfig_ipv6_blocked
Definition options.h:525
options::tls_exit
bool tls_exit
Definition options.h:683
options::pkcs12_file
const char * pkcs12_file
Definition options.h:604
options::client_disconnect_script
const char * client_disconnect_script
Definition options.h:502
options::show_engines
bool show_engines
Definition options.h:284
options::remote_list
struct remote_list * remote_list
Definition options.h:297
options::msg_channel
HANDLE msg_channel
Definition options.h:691
options::key_pass_file
const char * key_pass_file
Definition options.h:281
options::mute_replay_warnings
bool mute_replay_warnings
Definition options.h:584
options::tls_crypt_file
const char * tls_crypt_file
Definition options.h:664
options::inactivity_timeout
int inactivity_timeout
Definition options.h:345
options::n_bcast_buf
int n_bcast_buf
Definition options.h:509
options::handshake_window
int handshake_window
Definition options.h:651
options::server_defined
bool server_defined
Definition options.h:467
options::ifconfig_local
const char * ifconfig_local
Definition options.h:327
options::x509_username_field
char * x509_username_field[MAX_PARMS]
Definition options.h:654
options::ce
struct connection_entry ce
Definition options.h:294
options::iroutes_ipv6
struct iroute_ipv6 * iroutes_ipv6
Definition options.h:512
options::push_list
struct push_list push_list
Definition options.h:487
options::user_script_used
bool user_script_used
Definition options.h:387
options::tls_groups
const char * tls_groups
Definition options.h:608
options::show_tls_ciphers
bool show_tls_ciphers
Definition options.h:285
options::tuntap_options
struct tuntap_options tuntap_options
Definition options.h:371
options::route_method
int route_method
Definition options.h:695
options::verify_hash
struct verify_hash_list * verify_hash
Definition options.h:621
options::tls_cert_profile
const char * tls_cert_profile
Definition options.h:609
options::renegotiate_packets
int64_t renegotiate_packets
Definition options.h:645
options::management_flags
unsigned int management_flags
Definition options.h:459
options::push_continuation
int push_continuation
Definition options.h:557
options::route_default_gateway
const char * route_default_gateway
Definition options.h:426
options::push_ifconfig_local_alias
in_addr_t push_ifconfig_local_alias
Definition options.h:516
options::dns_options
struct dns_options dns_options
Definition options.h:318
options::exit_event_initial_state
bool exit_event_initial_state
Definition options.h:693
options::sc_info
struct static_challenge_info sc_info
Definition options.h:568
options::auth_token_call_auth
bool auth_token_call_auth
Definition options.h:543
options::ipchange
const char * ipchange
Definition options.h:321
options::topology
int topology
Definition options.h:326
options::disable_dco
bool disable_dco
Definition options.h:374
options::ncp_ciphers
const char * ncp_ciphers
Definition options.h:580
options::genkey
bool genkey
Definition options.h:287
options::virtual_hash_size
uint32_t virtual_hash_size
Definition options.h:500
options::learn_address_script
const char * learn_address_script
Definition options.h:503
options::ciphername
const char * ciphername
Definition options.h:575
options::auth_user_pass_file
const char * auth_user_pass_file
Definition options.h:560
options::tls_crypt_v2_max_age
int tls_crypt_v2_max_age
Definition options.h:676
options::forward_compatible
bool forward_compatible
Definition options.h:269
options::username
const char * username
Definition options.h:377
options::cf_initial_max
int cf_initial_max
Definition options.h:532
options::stale_routes_check_interval
int stale_routes_check_interval
Definition options.h:537
options::plugin_list
struct plugin_option_list * plugin_list
Definition options.h:462
options::auth_token_lifetime
int auth_token_lifetime
Definition options.h:544
options::vlan_pvid
uint16_t vlan_pvid
Definition options.h:714
options::ns_cert_type
int ns_cert_type
Definition options.h:618
options::tls_crypt_v2_verify_script
const char * tls_crypt_v2_verify_script
Definition options.h:674
options::mode
int mode
Definition options.h:266
options::tls_server
bool tls_server
Definition options.h:591
options::auth_user_pass_verify_script
const char * auth_user_pass_verify_script
Definition options.h:540
options::connect_retry_max
int connect_retry_max
Definition options.h:293
options::bind_dev
char * bind_dev
Definition options.h:418
options::extra_certs_file
const char * extra_certs_file
Definition options.h:600
options::client
bool client
Definition options.h:555
options::pull
bool pull
Definition options.h:556
options::ifconfig_ipv6_pool_netbits
int ifconfig_ipv6_pool_netbits
Definition options.h:497
options::push_ifconfig_constraint_netmask
in_addr_t push_ifconfig_constraint_netmask
Definition options.h:519
options::show_curves
bool show_curves
Definition options.h:286
options::route_ipv6_default_gateway
const char * route_ipv6_default_gateway
Definition options.h:427
options::tls_client
bool tls_client
Definition options.h:592
options::ping_timer_remote
bool ping_timer_remote
Definition options.h:352
options::auth_token_generate
bool auth_token_generate
Definition options.h:542
options::priv_key_file_inline
bool priv_key_file_inline
Definition options.h:603
options::tls_verify
const char * tls_verify
Definition options.h:611
options::crl_file
const char * crl_file
Definition options.h:615
options::ping_rec_timeout_action
int ping_rec_timeout_action
Definition options.h:357
options::auth_user_pass_file_inline
bool auth_user_pass_file_inline
Definition options.h:561
options::show_ciphers
bool show_ciphers
Definition options.h:282
options::enable_ncp_fallback
bool enable_ncp_fallback
If defined fall back to ciphername if NCP fails.
Definition options.h:576
options::route_predown_script
const char * route_predown_script
Definition options.h:425
options::dh_file
const char * dh_file
Definition options.h:596
options::route_delay_window
int route_delay_window
Definition options.h:432
options::push_ifconfig_local
in_addr_t push_ifconfig_local
Definition options.h:514
options::mlock
bool mlock
Definition options.h:340
options::ignore_unknown_option
const char ** ignore_unknown_option
Definition options.h:275
options::sndbuf
int sndbuf
Definition options.h:414
options::foreign_option_index
int foreign_option_index
Definition options.h:688
options::gc
struct gc_arena gc
Definition options.h:258
options::down_pre
bool down_pre
Definition options.h:388
options::persist_tun
bool persist_tun
Definition options.h:359
options::route_default_table_id
int route_default_table_id
Definition options.h:428
options::ca_file_inline
bool ca_file_inline
Definition options.h:594
options::auth_token_secret_file_inline
bool auth_token_secret_file_inline
Definition options.h:547
options::block_ipv6
bool block_ipv6
Definition options.h:436
options::config
const char * config
Definition options.h:261
options::extra_certs_file_inline
bool extra_certs_file_inline
Definition options.h:601
options::push_ifconfig_constraint_defined
bool push_ifconfig_constraint_defined
Definition options.h:517
options::mark
int mark
Definition options.h:417
options::cf_initial_per
int cf_initial_per
Definition options.h:533
options::keying_material_exporter_length
int keying_material_exporter_length
Definition options.h:708
options::suppress_timestamps
bool suppress_timestamps
Definition options.h:396
options::force_key_material_export
bool force_key_material_export
Definition options.h:710
options::mtu_test
bool mtu_test
Definition options.h:338
options::iroutes
struct iroute * iroutes
Definition options.h:511
options::verify_x509_type
int verify_x509_type
Definition options.h:613
options::cipher_list_tls13
const char * cipher_list_tls13
Definition options.h:607
options::ecdh_curve
const char * ecdh_curve
Definition options.h:610
options::status_file_update_freq
int status_file_update_freq
Definition options.h:408
options::management_client_user
const char * management_client_user
Definition options.h:453
options::cipher_list
const char * cipher_list
Definition options.h:606
options::ccd_exclusive
bool ccd_exclusive
Definition options.h:506
options::allow_deprecated_insecure_static_crypto
bool allow_deprecated_insecure_static_crypto
Definition options.h:573
options::pull_filter_list
struct pull_filter_list * pull_filter_list
Definition options.h:716
options::management_certificate
const char * management_certificate
Definition options.h:456
options::genkey_filename
const char * genkey_filename
Definition options.h:289
options::x509_track
const struct x509_track * x509_track
Definition options.h:685
options::chroot_dir
const char * chroot_dir
Definition options.h:379
options::auth_user_pass_username_only
bool auth_user_pass_username_only
Definition options.h:562
options::log
bool log
Definition options.h:395
options::shared_secret_file_inline
bool shared_secret_file_inline
Definition options.h:572
options::push_ifconfig_ipv6_remote
struct in6_addr push_ifconfig_ipv6_remote
Definition options.h:524
options::ca_path
const char * ca_path
Definition options.h:595
options::renegotiate_seconds
int renegotiate_seconds
Definition options.h:646
options::ping_rec_timeout
int ping_rec_timeout
Definition options.h:351
options::sockflags
unsigned int sockflags
Definition options.h:421
options::engine
const char * engine
Definition options.h:582
options::management_addr
const char * management_addr
Definition options.h:446
options::client_connect_script
const char * client_connect_script
Definition options.h:501
options::verify_x509_name
const char * verify_x509_name
Definition options.h:614
options::ping_send_timeout
int ping_send_timeout
Definition options.h:350
options::route_gateway_via_dhcp
bool route_gateway_via_dhcp
Definition options.h:438
options::remote_random
bool remote_random
Definition options.h:320
options::push_ifconfig_ipv6_defined
bool push_ifconfig_ipv6_defined
Definition options.h:521
options::tcp_queue_limit
int tcp_queue_limit
Definition options.h:510
options::route_delay
int route_delay
Definition options.h:431
options::dev_node
const char * dev_node
Definition options.h:324
options::override_username
const char * override_username
Definition options.h:508
options::client_crresponse_script
const char * client_crresponse_script
Definition options.h:504
options::routes_ipv6
struct route_ipv6_option_list * routes_ipv6
Definition options.h:435
options::machine_readable_output
bool machine_readable_output
Definition options.h:397
options::key_direction
int key_direction
Definition options.h:574
options::server_ipv6_defined
bool server_ipv6_defined
Definition options.h:470
options::priv_key_file
const char * priv_key_file
Definition options.h:602
options::persist_remote_ip
bool persist_remote_ip
Definition options.h:361
options::up_restart
bool up_restart
Definition options.h:390
options::keepalive_ping
int keepalive_ping
Definition options.h:342
options::tls_auth_file_inline
bool tls_auth_file_inline
Definition options.h:661
options::tls_crypt_v2_file_inline
bool tls_crypt_v2_file_inline
Definition options.h:670
options::groupname
const char * groupname
Definition options.h:378
options::server_bridge_pool_start
in_addr_t server_bridge_pool_start
Definition options.h:484
options::cd_dir
const char * cd_dir
Definition options.h:380
options::client_nat
struct client_nat_option_list * client_nat
Definition options.h:440
options::push_ifconfig_ipv6_local
struct in6_addr push_ifconfig_ipv6_local
Definition options.h:522
options::nice
int nice
Definition options.h:398
options::push_update_options_found
uint64_t push_update_options_found
Definition options.h:559
options::transition_window
int transition_window
Definition options.h:657
options::ifconfig_remote_netmask
const char * ifconfig_remote_netmask
Definition options.h:328
options::lladdr
const char * lladdr
Definition options.h:325
options::verbosity
int verbosity
Definition options.h:399
options::session_timeout
int session_timeout
Definition options.h:348
options::cert_file
const char * cert_file
Definition options.h:598
options::enable_c2c
bool enable_c2c
Definition options.h:526
options::server_bridge_pool_end
in_addr_t server_bridge_pool_end
Definition options.h:485
options::cf_per
int cf_per
Definition options.h:530
options::windows_driver
enum tun_driver_type windows_driver
Definition options.h:697
options::cert_file_inline
bool cert_file_inline
Definition options.h:599
options::remap_sigusr1
int remap_sigusr1
Definition options.h:393
options::renegotiate_bytes
int64_t renegotiate_bytes
Definition options.h:644
options::route_script
const char * route_script
Definition options.h:424
options::ifconfig_pool_start
in_addr_t ifconfig_pool_start
Definition options.h:489
options::management_user_pass
const char * management_user_pass
Definition options.h:448
options::server_netbits_ipv6
unsigned int server_netbits_ipv6
Definition options.h:472
options::push_ifconfig_remote_netmask
in_addr_t push_ifconfig_remote_netmask
Definition options.h:515
options::occ
bool occ
Definition options.h:443
options::server_bridge_ip
in_addr_t server_bridge_ip
Definition options.h:482
options::shared_secret_file
const char * shared_secret_file
Definition options.h:571
options::ifconfig_noexec
bool ifconfig_noexec
Definition options.h:332
options::dev
const char * dev
Definition options.h:322
options::management_client_group
const char * management_client_group
Definition options.h:454
options::ifconfig_ipv6_pool_base
struct in6_addr ifconfig_ipv6_pool_base
Definition options.h:496
options::client_config_dir
const char * client_config_dir
Definition options.h:505
options::genkey_type
enum genkey_type genkey_type
Definition options.h:288
options::ifconfig_pool_persist_filename
const char * ifconfig_pool_persist_filename
Definition options.h:492
options::ifconfig_ipv6_netbits
int ifconfig_ipv6_netbits
Definition options.h:330
options::persist_local_ip
bool persist_local_ip
Definition options.h:360
provider_list::names
const char * names[MAX_PARMS]
Definition options.h:219
pull_filter_list
Definition options.h:810
pull_filter_list::tail
struct pull_filter * tail
Definition options.h:812
pull_filter_list::head
struct pull_filter * head
Definition options.h:811
pull_filter
Definition options.h:798
pull_filter::next
struct pull_filter * next
Definition options.h:806
push_list::head
struct push_entry * head
Definition pushlist.h:37
remote_entry
Definition options.h:185
remote_entry::proto
int proto
Definition options.h:188
remote_entry::remote
const char * remote
Definition options.h:186
remote_entry::remote_port
const char * remote_port
Definition options.h:187
remote_entry::af
sa_family_t af
Definition options.h:189
remote_list
Definition options.h:210
remote_list::len
int len
Definition options.h:212
remote_list::array
struct remote_entry ** array
Definition options.h:213
remote_list::capacity
int capacity
Definition options.h:211
route_gateway_info
Definition route.h:158
route_ipv6_gateway_info
Definition route.h:195
route_ipv6_option_list::flags
unsigned int flags
Definition route.h:113
route_option_list::flags
unsigned int flags
Definition route.h:97
static_challenge_info::flags
unsigned int flags
Definition misc.h:96
static_challenge_info::challenge_text
const char * challenge_text
Definition misc.h:98
tuntap_options
Definition tun.h:73
tuntap_options::dns6
struct in6_addr dns6[N_DHCP_ADDR]
Definition tun.h:140
tuntap_options::nbdd
in_addr_t nbdd[N_DHCP_ADDR]
Definition tun.h:123
tuntap_options::dns6_len
unsigned int dns6_len
Definition tun.h:141
tuntap_options::ntp
in_addr_t ntp[N_DHCP_ADDR]
Definition tun.h:119
tuntap_options::ntp_len
unsigned int ntp_len
Definition tun.h:120
tuntap_options::wins
in_addr_t wins[N_DHCP_ADDR]
Definition tun.h:115
tuntap_options::tap_sleep
int tap_sleep
Definition tun.h:95
tuntap_options::netbios_node_type
uint8_t netbios_node_type
Definition tun.h:105
tuntap_options::dns_len
unsigned int dns_len
Definition tun.h:112
tuntap_options::dhcp_lease_time
int dhcp_lease_time
Definition tun.h:92
tuntap_options::dns
in_addr_t dns[N_DHCP_ADDR]
Definition tun.h:111
tuntap_options::netbios_scope
const char * netbios_scope
Definition tun.h:103
tuntap_options::ip_win32_defined
bool ip_win32_defined
Definition tun.h:75
tuntap_options::domain_search_list_len
unsigned int domain_search_list_len
Definition tun.h:130
tuntap_options::dhcp_masq_custom_offset
bool dhcp_masq_custom_offset
Definition tun.h:90
tuntap_options::domain
const char * domain
Definition tun.h:101
tuntap_options::dhcp_renew
bool dhcp_renew
Definition tun.h:135
tuntap_options::domain_search_list
const char * domain_search_list[N_SEARCH_LIST_LEN]
Definition tun.h:129
tuntap_options::dhcp_masq_offset
int dhcp_masq_offset
Definition tun.h:91
tuntap_options::ip_win32_type
int ip_win32_type
Definition tun.h:83
tuntap_options::nbdd_len
unsigned int nbdd_len
Definition tun.h:124
tuntap_options::dhcp_pre_release
bool dhcp_pre_release
Definition tun.h:136
tuntap_options::register_dns
bool register_dns
Definition tun.h:138
tuntap_options::disable_nbt
bool disable_nbt
Definition tun.h:133
tuntap_options::wins_len
unsigned int wins_len
Definition tun.h:116
tuntap_options::dhcp_options
int dhcp_options
Definition tun.h:99
verify_hash_list
Definition options.h:248
verify_hash_list::next
struct verify_hash_list * next
Definition options.h:252
verify_hash_list::hash
uint8_t hash[SHA256_DIGEST_LENGTH]
Definition options.h:251
SIGHUP
#define SIGHUP
Definition syshead.h:55
sa_family_t
unsigned short sa_family_t
Definition syshead.h:409
SIGTERM
#define SIGTERM
Definition syshead.h:59
sleep
#define sleep(x)
Definition syshead.h:42
in_addr_t
uint32_t in_addr_t
Definition syshead.h:52
es
struct env_set * es
Definition test_pkcs11.c:140
pkcs11_id_management
static bool pkcs11_id_management
Definition test_pkcs11.c:135
gc
struct gc_arena gc
Definition test_ssl.c:122
ipconfig_register_dns
void ipconfig_register_dns(const struct env_set *es)
Definition tun.c:4880
dev_type_enum
int dev_type_enum(const char *dev, const char *dev_type)
Definition tun.c:521
show_tap_win_adapters
void show_tap_win_adapters(msglvl_t msglevel, msglvl_t warnlevel)
Definition tun.c:3806
dhcp_renew_by_adapter_index
bool dhcp_renew_by_adapter_index(const DWORD adapter_index)
Definition tun.c:4813
ascii2ipset
int ascii2ipset(const char *name)
Definition tun.c:6237
dhcp_release_by_adapter_index
bool dhcp_release_by_adapter_index(const DWORD adapter_index)
Definition tun.c:4772
tap_allow_nonadmin_access
void tap_allow_nonadmin_access(const char *dev_node)
Definition tun.c:4692
show_adapters
void show_adapters(msglvl_t msglevel)
Definition tun.c:4643
ipset2ascii_all
const char * ipset2ascii_all(struct gc_arena *gc)
Definition tun.c:6266
show_valid_win32_tun_subnets
void show_valid_win32_tun_subnets(void)
Definition tun.c:3773
print_tun_backend_driver
const char * print_tun_backend_driver(enum tun_driver_type driver)
Return a string representation of the tun backed driver type.
Definition tun.c:59
IPW32_SET_NETSH
#define IPW32_SET_NETSH
Definition tun.h:78
IPW32_SET_ADAPTIVE
#define IPW32_SET_ADAPTIVE
Definition tun.h:81
DHCP_OPTIONS_DHCP_REQUIRED
#define DHCP_OPTIONS_DHCP_REQUIRED
Definition tun.h:70
N_SEARCH_LIST_LEN
#define N_SEARCH_LIST_LEN
Definition tun.h:126
IPW32_SET_DHCP_MASQ
#define IPW32_SET_DHCP_MASQ
Definition tun.h:80
IPW32_SET_MANUAL
#define IPW32_SET_MANUAL
Definition tun.h:77
WINDOWS_DRIVER_UNSPECIFIED
@ WINDOWS_DRIVER_UNSPECIFIED
Definition tun.h:45
WINDOWS_DRIVER_TAP_WINDOWS6
@ WINDOWS_DRIVER_TAP_WINDOWS6
Definition tun.h:46
DRIVER_DCO
@ DRIVER_DCO
Definition tun.h:53
IPW32_SET_ADAPTIVE_DELAY_WINDOW
#define IPW32_SET_ADAPTIVE_DELAY_WINDOW
Definition tun.h:65
N_DHCP_ADDR
#define N_DHCP_ADDR
Definition tun.h:108
DHCP_OPTIONS_DHCP_OPTIONAL
#define DHCP_OPTIONS_DHCP_OPTIONAL
Definition tun.h:69
tun_afunix.h
is_tun_afunix
static bool is_tun_afunix(const char *devnode)
Checks whether a –dev-node parameter specifies a AF_UNIX device.
Definition tun_afunix.h:61
set_win_sys_path
void set_win_sys_path(const char *newpath, struct env_set *es)
Definition win32.c:1162
win32_version_string
const char * win32_version_string(struct gc_arena *gc)
Get Windows version string with architecture info.
Definition win32.c:1427
set_pause_exit_win32
void set_pause_exit_win32(void)
Definition win32.c:146
xkey_common.h
Generated by doxygen 1.9.8