OpenVPN
options.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>
9 * Copyright (C) 2008-2024 David Sommerseth <dazo@eurephia.org>
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2
13 * as published by the Free Software Foundation.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, write to the Free Software Foundation, Inc.,
22 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 */
24
25/*
26 * 2004-01-28: Added Socks5 proxy support
27 * (Christof Meerwald, http://cmeerw.org)
28 */
29
30#ifdef HAVE_CONFIG_H
31#include "config.h"
32#endif
33#ifdef HAVE_CONFIG_VERSION_H
34#include "config-version.h"
35#endif
36
37#include "syshead.h"
38
39#include "buffer.h"
40#include "error.h"
41#include "common.h"
42#include "run_command.h"
43#include "shaper.h"
44#include "crypto.h"
45#include "ssl.h"
46#include "ssl_ncp.h"
47#include "options.h"
48#include "misc.h"
49#include "socket.h"
50#include "packet_id.h"
51#include "pkcs11.h"
52#include "win32.h"
53#include "push.h"
54#include "pool.h"
55#include "proto.h"
56#include "helper.h"
57#include "manage.h"
58#include "forward.h"
59#include "ssl_verify.h"
60#include "platform.h"
61#include "xkey_common.h"
62#include "dco.h"
63#include "options_util.h"
64
65#include <ctype.h>
66
67#include "memdbg.h"
68
69const char title_string[] =
71#ifdef CONFIGURE_GIT_REVISION
72 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS "]"
73#endif
74 " " TARGET_ALIAS
75#if defined(ENABLE_CRYPTO_MBEDTLS)
76 " [SSL (mbed TLS)]"
77#elif defined(ENABLE_CRYPTO_OPENSSL)
78 " [SSL (OpenSSL)]"
79#else
80 " [SSL]"
81#endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
82#ifdef USE_COMP
83#ifdef ENABLE_LZO
84 " [LZO]"
85#endif
86#ifdef ENABLE_LZ4
87 " [LZ4]"
88#endif
89#ifdef ENABLE_COMP_STUB
90 " [COMP_STUB]"
91#endif
92#endif /* USE_COMP */
93#if EPOLL
94 " [EPOLL]"
95#endif
96#ifdef PRODUCT_TAP_DEBUG
97 " [TAPDBG]"
98#endif
99#ifdef ENABLE_PKCS11
100 " [PKCS11]"
101#endif
102#if ENABLE_IP_PKTINFO
103#if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
104 " [MH/PKTINFO]"
105#elif defined(IP_RECVDSTADDR)
106 " [MH/RECVDA]"
107#endif
108#endif
109 " [AEAD]"
110#ifdef ENABLE_DCO
111 " [DCO]"
112#endif
113#ifdef CONFIGURE_GIT_REVISION
114 " built on " __DATE__
115#endif
116;
117
118#ifndef ENABLE_SMALL
119
120static const char usage_message[] =
121 "%s\n"
122 "\n"
123 "General Options:\n"
124 "--config file : Read configuration options from file.\n"
125 "--help : Show options.\n"
126 "--version : Show copyright and version information.\n"
127 "\n"
128 "Tunnel Options:\n"
129 "--local host|* [port]: Local host name or IP address and port for bind.\n"
130 " If specified, OpenVPN will bindto this address. If unspecified,\n"
131 " OpenVPN will bind to all interfaces. '*' can be used as hostname\n"
132 " and means 'any host' (OpenVPN will listen on what is returned by the OS).\n"
133 " On a client, or in point-to-point mode, this can only be specified once (1 socket).\n"
134 " On an OpenVPN setup running as ``--server``, this can be specified multiple times\n"
135 " to open multiple listening sockets on different addresses and/or different ports.\n"
136 " In order to specify multiple listen ports without specifying an address, use '*'\n"
137 " to signal 'use what the operating system gives you as default', for\n"
138 " 'all IPv4 addresses' use '0.0.0.0', for 'all IPv6 addresses' use '::'.\n"
139 " ``--local`` implies ``--bind``.\n"
140 "--remote host [port] : Remote host name or ip address.\n"
141 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
142 "--remote-random-hostname : Add a random string to remote DNS name.\n"
143 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
144 "--proto p : Use protocol p for communicating with peer.\n"
145 " p = udp (default), tcp-server, tcp-client\n"
146 " udp4, tcp4-server, tcp4-client\n"
147 " udp6, tcp6-server, tcp6-client\n"
148 "--proto-force p : only consider protocol p in list of connection profiles.\n"
149 " p = udp or tcp\n"
150 "--connect-retry n [m] : For client, number of seconds to wait between\n"
151 " connection retries (default=%d). On repeated retries\n"
152 " the wait time is exponentially increased to a maximum of m\n"
153 " (default=%d).\n"
154 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
155 "--http-proxy s p [up] [auth] : Connect to remote host\n"
156 " through an HTTP proxy at address s and port p.\n"
157 " If proxy authentication is required,\n"
158 " up is a file containing username/password on 2 lines, or\n"
159 " 'stdin' to prompt from console. Add auth='ntlm2' if\n"
160 " the proxy requires NTLM authentication.\n"
161 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
162 " determine auth method and query for username/password\n"
163 " if needed. auto-nct disables weak proxy auth methods.\n"
164 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
165 " Repeat to set multiple options.\n"
166 " VERSION version (default=1.0)\n"
167 " AGENT user-agent\n"
168 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
169 " address s and port p (default port = 1080).\n"
170 " If proxy authentication is required,\n"
171 " up is a file containing username/password on 2 lines, or\n"
172 " 'stdin' to prompt for console.\n"
173 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
174 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
175 " resolve for n seconds before failing (disabled by default).\n"
176 " Set n=\"infinite\" to retry indefinitely.\n"
177 "--float : Allow remote to change its IP address/port, such as through\n"
178 " DHCP (this is the default if --remote is not used).\n"
179 "--ipchange cmd : Run command cmd on remote ip address initial\n"
180 " setting or change -- execute as: cmd ip-address port#\n"
181 "--port port : TCP/UDP port # for both local and remote.\n"
182 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
183 "--rport port : TCP/UDP port # for remote (default=%s).\n"
184 "--bind : Bind to local address and port. (This is the default unless\n"
185 " --proto tcp-client"
186 " or --http-proxy"
187 " or --socks-proxy"
188 " is used).\n"
189 "--nobind : Do not bind to local address and port.\n"
190 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n"
191 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
192 " this option only if the tun/tap device used with --dev\n"
193 " does not begin with \"tun\" or \"tap\".\n"
194 "--dev-node node : Explicitly set the device node rather than using\n"
195 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
196#if defined(ENABLE_DCO)
197 "--disable-dco : Do not attempt using Data Channel Offload.\n"
198#endif
199 "--lladdr hw : Set the link layer address of the tap device.\n"
200 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
201#ifdef ENABLE_IPROUTE
202 "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
203#endif
204 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
205 " endpoint and rn as a remote endpoint. l & rn should be\n"
206 " swapped on the other peer. l & rn must be private\n"
207 " addresses outside of the subnets used by either peer.\n"
208 " TAP: configure device to use IP address l as a local\n"
209 " endpoint and rn as a subnet mask.\n"
210 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
211 " endpoint (as a /64) and r as remote endpoint\n"
212 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
213 " pass --ifconfig parms by environment to scripts.\n"
214 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
215 " connection doesn't match the remote side.\n"
216 "--route network [netmask] [gateway] [metric] :\n"
217 " Add route to routing table after connection\n"
218 " is established. Multiple routes can be specified.\n"
219 " netmask default: 255.255.255.255\n"
220 " gateway default: taken from --route-gateway or --ifconfig\n"
221 " Specify default by leaving blank or setting to \"default\".\n"
222 "--route-ipv6 network/bits [gateway] [metric] :\n"
223 " Add IPv6 route to routing table after connection\n"
224 " is established. Multiple routes can be specified.\n"
225 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
226 " in --ifconfig-ipv6\n"
227 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
228 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
229 "--route-metric m : Specify a default metric for use with --route.\n"
230 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
231 " adding routes (may be 0). If not specified, routes will\n"
232 " be added immediately after tun/tap open. On Windows, wait\n"
233 " up to w seconds for TUN/TAP adapter to come up.\n"
234 "--route-up cmd : Run command cmd after routes are added.\n"
235 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
236 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
237 " --route-up script using environmental variables.\n"
238 "--route-nopull : When used with --client or --pull, accept options pushed\n"
239 " by server EXCEPT for routes, dns, and dhcp options.\n"
240 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
241 " --ifconfig, --route, and --route-gateway.\n"
242 "--redirect-gateway [flags]: Automatically execute routing\n"
243 " commands to redirect all outgoing IP traffic through the\n"
244 " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n"
245 " connected via a common subnet, such as with WiFi.\n"
246 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
247 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
248 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
249 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
250 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
251 " the default gateway. Useful when pushing private subnets.\n"
252 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
253 " ICMPv6 host unreachable messages on the client.\n"
254 " (Server) Instead of forwarding IPv6 packets send\n"
255 " ICMPv6 host unreachable packets to the client.\n"
256 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
257 "--push-peer-info : (client only) push client info to server.\n"
258 "--setenv name value : Set a custom environmental variable to pass to script.\n"
259 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
260 " directives for future OpenVPN versions to be ignored.\n"
261 "--ignore-unknown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
262 " these options to be ignored when unknown\n"
263 "--script-security level: Where level can be:\n"
264 " 0 -- strictly no calling of external programs\n"
265 " 1 -- (default) only call built-ins such as ifconfig\n"
266 " 2 -- allow calling of built-ins and scripts\n"
267 " 3 -- allow password to be passed to scripts via env\n"
268 "--shaper n : Restrict output to peer to n bytes per second.\n"
269 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
270 " ping once every n seconds, restart if ping not received\n"
271 " for m seconds.\n"
272 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
273 " produces a combined in/out byte count < bytes.\n"
274 "--session-timeout n: Limit connection time to n seconds.\n"
275 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
276 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
277 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
278 " remote address.\n"
279 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
280#if ENABLE_IP_PKTINFO
281 "--multihome : Configure a multi-homed UDP server.\n"
282#endif
283 "--fast-io : Optimize TUN/TAP/UDP writes.\n"
284 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
285 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
286 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
287 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
288#if PASSTOS_CAPABILITY
289 "--passtos : TOS passthrough (applies to IPv4 only).\n"
290#endif
291 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
292 " TCP/UDP MTU from it (default=%d).\n"
293 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
294 " as n bytes more than the tun-mtu size on read\n"
295 " (default TUN=0 TAP=%d).\n"
296 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
297 " from it.\n"
298 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
299 " 'no' -- Never send DF (Don't Fragment) frames\n"
300 " 'maybe' -- Use per-route hints\n"
301 " 'yes' -- Always DF (Don't Fragment)\n"
302 "--mtu-test : Empirically measure and report MTU.\n"
303#ifdef ENABLE_FRAGMENT
304 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
305 " datagrams are sent which are larger than max bytes.\n"
306 " Adds 4 bytes of overhead per datagram.\n"
307#endif
308 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
309 " or --fragment max value, whichever is lower.\n"
310 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
311 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
312#if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
313 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
314 " can be matched in policy routing and packetfilter rules.\n"
315 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
316 " listening for connections. This allows sending encrypted packets\n"
317 " via a VRF present on the system.\n"
318#endif
319 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
320#ifdef ENABLE_MEMSTATS
321 "--memstats file : Write live usage stats to memory mapped binary file.\n"
322#endif
323 "--mlock : Disable Paging -- ensures key material and tunnel\n"
324 " data will never be written to disk.\n"
325 "--up cmd : Run command cmd after successful tun device open.\n"
326 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
327 " ifconfig-local-ip ifconfig-remote-ip\n"
328 " (pre --user or --group UID/GID change)\n"
329 "--up-delay : Delay tun/tap open and possible --up script execution\n"
330 " until after TCP/UDP connection establishment with peer.\n"
331 "--down cmd : Run command cmd after tun device close.\n"
332 " (post --user/--group UID/GID change and/or --chroot)\n"
333 " (command parameters are same as --up option)\n"
334 "--down-pre : Run --down command before TUN/TAP close.\n"
335 "--up-restart : Run up/down commands for all restarts including those\n"
336 " caused by --ping-restart or SIGUSR1\n"
337 "--user user : Set UID to user after initialization.\n"
338 "--group group : Set GID to group after initialization.\n"
339 "--chroot dir : Chroot to this directory after initialization.\n"
340#ifdef ENABLE_SELINUX
341 "--setcon context: Apply this SELinux context after initialization.\n"
342#endif
343 "--cd dir : Change to this directory before initialization.\n"
344 "--daemon [name] : Become a daemon after initialization.\n"
345 " The optional 'name' parameter will be passed\n"
346 " as the program name to the system logger.\n"
347 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
348 " See --daemon above for a description of the 'name' parm.\n"
349 "--log file : Output log to file which is created/truncated on open.\n"
350 "--log-append file : Append log to file, or create file if nonexistent.\n"
351 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
352 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
353 "--writepid file : Write main process ID to file.\n"
354 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
355 "--echo [parms ...] : Echo parameters to log output.\n"
356 "--verb n : Set output verbosity to n (default=%d):\n"
357 " (Level 3 is recommended if you want a good summary\n"
358 " of what's happening without being swamped by output).\n"
359 " : 0 -- no output except fatal errors\n"
360 " : 1 -- startup info + connection initiated messages +\n"
361 " non-fatal encryption & net errors\n"
362 " : 2,3 -- show TLS negotiations & route info\n"
363 " : 4 -- show parameters\n"
364 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
365 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
366 " : 6 to 11 -- debug messages of increasing verbosity\n"
367 "--mute n : Log at most n consecutive messages in the same category.\n"
368 "--status file [n] : Write operational status to file every n seconds.\n"
369 "--status-version [n] : Choose the status file format version number.\n"
370 " Currently, n can be 1, 2, or 3 (default=1).\n"
371 "--disable-occ : (DEPRECATED) Disable options consistency check between peers.\n"
372#ifdef ENABLE_DEBUG
373 "--gremlin mask : Special stress testing mode (for debugging only).\n"
374#endif
375#if defined(USE_COMP)
376 "--compress alg : Use compression algorithm alg\n"
377 "--allow-compression: Specify whether compression should be allowed\n"
378#if defined(ENABLE_LZO)
379 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
380 " packet for incompressible data.\n"
381 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
382 " is specified.\n"
383#endif
384#endif
385#ifdef ENABLE_MANAGEMENT
386 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
387 " management functions. pass is a password file\n"
388 " or 'stdin' to prompt from console.\n"
389#if UNIX_SOCK_SUPPORT
390 " To listen on a unix domain socket, specific the pathname\n"
391 " in place of ip and use 'unix' as the port number.\n"
392#endif
393 "--management-client : Management interface will connect as a TCP client to\n"
394 " ip/port rather than listen as a TCP server.\n"
395 "--management-query-passwords : Query management channel for private key\n"
396 " and auth-user-pass passwords.\n"
397 "--management-query-proxy : Query management channel for proxy information.\n"
398 "--management-query-remote : Query management channel for --remote directive.\n"
399 "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
400 " of the management interface explicitly starts it.\n"
401 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
402 "--management-forget-disconnect : Forget passwords when management disconnect\n"
403 " event occurs.\n"
404 "--management-up-down : Report tunnel up/down events to management interface.\n"
405 "--management-log-cache n : Cache n lines of log file history for usage\n"
406 " by the management channel.\n"
407#if UNIX_SOCK_SUPPORT
408 "--management-client-user u : When management interface is a unix socket, only\n"
409 " allow connections from user u.\n"
410 "--management-client-group g : When management interface is a unix socket, only\n"
411 " allow connections from group g.\n"
412#endif
413 "--management-client-auth : gives management interface client the responsibility\n"
414 " to authenticate clients after their client certificate\n"
415 " has been verified.\n"
416#endif /* ifdef ENABLE_MANAGEMENT */
417#ifdef ENABLE_PLUGIN
418 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
419 " to its initialization function.\n"
420#endif
421 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
422 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
423 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
424 "\n"
425 "Multi-Client Server options (when --mode server is used):\n"
426 "--server network netmask : Helper option to easily configure server mode.\n"
427 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
428 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
429 " easily configure ethernet bridging server mode.\n"
430 "--push \"option\" : Push a config file option back to the peer for remote\n"
431 " execution. Peer must specify --pull in its config file.\n"
432 "--push-reset : Don't inherit global push list for specific\n"
433 " client instance.\n"
434 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
435 " a specific client instance.\n"
436 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
437 " to be dynamically allocated to connecting clients.\n"
438 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
439 " data to file, at seconds intervals (default=600).\n"
440 " If seconds=0, file will be treated as read-only.\n"
441 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
442 " to be dynamically allocated to connecting clients.\n"
443 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
444 " overrides --ifconfig-pool dynamic allocation.\n"
445 " Only valid in a client-specific config file.\n"
446 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
447 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
448 " Only valid in a client-specific config file.\n"
449 "--iroute network [netmask] : Route subnet to client.\n"
450 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
451 " Sets up internal routes only.\n"
452 " Only valid in a client-specific config file.\n"
453 "--disable : Client is disabled.\n"
454 " Only valid in a client-specific config file.\n"
455 "--override-username: Overrides the client-specific username to be used.\n"
456 " Only valid in a client-specific config file.\n"
457 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
458 " mandatory client certificate verification.\n"
459 " Default is to require the client to supply a certificate.\n"
460 "--username-as-common-name : For auth-user-pass authentication, use\n"
461 " the authenticated username as the common name,\n"
462 " rather than the common name from the client cert.\n"
463 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
464 " run command cmd to verify. If method='via-env', pass\n"
465 " user/pass via environment, if method='via-file', pass\n"
466 " user/pass via temporary file.\n"
467 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
468 " to each client, replacing the password. Useful when\n"
469 " OTP based two-factor auth mechanisms are in use and\n"
470 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
471 " for generated tokens can be set.\n"
472 "--opt-verify : (DEPRECATED) Clients that connect with options that are incompatible\n"
473 " with those of the server will be disconnected.\n"
474 "--auth-user-pass-optional : Allow connections by clients that don't\n"
475 " specify a username/password.\n"
476 "--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n"
477 " any printable character.\n"
478 "--client-to-client : Internally route client-to-client traffic.\n"
479 "--duplicate-cn : Allow multiple clients with the same common name to\n"
480 " concurrently connect.\n"
481 "--client-connect cmd : Run command cmd on client connection.\n"
482 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
483 "--client-config-dir dir : Directory for custom client config files.\n"
484 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
485 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
486 "--hash-size r v : Set the size of the real address hash table to r and the\n"
487 " virtual address table to v.\n"
488 "--bcast-buffers n : Allocate n broadcast buffers.\n"
489 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
490 "--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server\n"
491 " as well as pushes it to connecting clients.\n"
492 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
493 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
494 "--connect-freq-initial n s : Allow a maximum of n replies for initial connections attempts per s seconds.\n"
495 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
496 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
497 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
498 " older than n seconds. Run this check every t\n"
499 " seconds (defaults to n).\n"
500 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
501 " clients. n = 1 - reconnect to same server,\n"
502 " 2 - advance to next server, default=1.\n"
503#if PORT_SHARE
504 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
505 " sessions to a web server at host:port. dir specifies an\n"
506 " optional directory to write origin IP:port data.\n"
507#endif
508 "\n"
509 "Client options (when connecting to a multi-client server):\n"
510 "--client : Helper option to easily configure client mode.\n"
511 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
512 " up is a file containing the username on the first line,\n"
513 " and a password on the second. If either the password or both\n"
514 " the username and the password are omitted OpenVPN will prompt\n"
515 " for them from console.\n"
516 "--pull : Accept certain config file options from the peer as if they\n"
517 " were part of the local config file. Must be specified\n"
518 " when connecting to a '--mode server' remote host.\n"
519 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
520 " server if it starts with the text t. The action flag accept,\n"
521 " ignore or reject causes the option to be allowed, removed or\n"
522 " rejected with error. May be specified multiple times, and\n"
523 " each filter is applied in the order of appearance.\n"
524 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
525 " Valid options are :\n"
526 " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n"
527 " resolve-domains <domain> [domain ...] : split domains\n"
528 " dnssec <yes|no|optional> : option to use DNSSEC\n"
529 " transport <DoH|DoT> : query server over HTTPS / TLS\n"
530 " sni <domain> : DNS server name indication\n"
531 "--dns search-domains <domain> [domain ...]:\n"
532 " Add domains to DNS domain search list\n"
533 "--dns-updown cmd|force|disable : Run cmd as user defined dns config command,\n"
534 " force running the default script or disable running it.\n"
535 "--auth-retry t : How to handle auth failures. Set t to\n"
536 " none (default), interact, or nointeract.\n"
537 "--static-challenge t e [<scrv1|concat>]: Enable static challenge/response protocol using\n"
538 " challenge text t, with e indicating echo flag (0|1)\n"
539 " and optional argument scrv1 or concat to use SCRV1 protocol or"
540 " concatenate response with password. Default is scrv1.\n"
541 "--connect-timeout n : when polling possible remote servers to connect to\n"
542 " in a round-robin fashion, spend no more than n seconds\n"
543 " waiting for a response before trying the next server.\n"
544 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
545 " incoming tun packets with same destination as host.\n"
546 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
547 " server/remote. n = # of retries, default=1.\n"
548 "\n"
549 "Data Channel Encryption Options (must be compatible between peers):\n"
550 "(These options are meaningful for both Static Key & TLS-mode)\n"
551 "--auth alg : Authenticate packets with HMAC using message\n"
552 " digest algorithm alg (default=%s).\n"
553 " (usually adds 16 or 20 bytes per packet)\n"
554 " Set alg=none to disable authentication.\n"
555 "--cipher alg : Encrypt packets with cipher algorithm alg.\n"
556 " You should usually use --data-ciphers instead.\n"
557 " Set alg=none to disable encryption.\n"
558 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
559#ifndef ENABLE_CRYPTO_MBEDTLS
560 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
561#endif
562 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
563 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
564 " and a time window of t seconds.\n"
565 " Default n=%d t=%d\n"
566 "--replay-persist file : Persist replay-protection state across sessions\n"
567 " using file.\n"
568 "--test-crypto : Run a self-test of crypto features enabled.\n"
569 " For debugging only.\n"
570#ifdef ENABLE_PREDICTION_RESISTANCE
571 "--use-prediction-resistance: Enable prediction resistance on the random\n"
572 " number generator.\n"
573#endif
574 "\n"
575 "TLS Key Negotiation Options:\n"
576 "(These options are meaningful only for TLS-mode)\n"
577 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
578 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
579 "--ca file : Certificate authority file in .pem format containing\n"
580 " root certificate.\n"
581#ifndef ENABLE_CRYPTO_MBEDTLS
582 "--capath dir : A directory of trusted certificates (CAs"
583 " and CRLs).\n"
584#endif /* ENABLE_CRYPTO_MBEDTLS */
585 "--dh file : File containing Diffie Hellman parameters\n"
586 " in .pem format (for --tls-server only).\n"
587 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
588 "--cert file : Local certificate in .pem format or a URI -- must be signed\n"
589 " by a Certificate Authority in --ca file used by the peer.\n"
590 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
591 "--key file : Local private key in .pem format or a URI.\n"
592 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
593 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
594 " is specified, require max TLS version supported by SSL implementation.\n"
595 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
596#ifndef ENABLE_CRYPTO_MBEDTLS
597 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
598 " and optionally the root CA certificate.\n"
599#endif
600#ifdef ENABLE_X509ALTUSERNAME
601 "--x509-username-field : Field in x509 certificate containing the username.\n"
602 " Default is CN in the Subject field.\n"
603#endif
604 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
605 " Valid algo flags are SHA1 and SHA256. \n"
606#ifdef _WIN32
607 "--cryptoapicert select-string : Load the certificate and private key from the\n"
608 " Windows Certificate System Store.\n"
609#endif
610 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
611 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites separated by : (optional)\n"
612 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
613 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
614 " (default=legacy).\n"
615 "--providers l : A list l of OpenSSL providers to load.\n"
616 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
617 " if no ACK from remote within n seconds (default=%d).\n"
618 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
619 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
620 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
621 " and at least min (defaults to 90%% of max on servers and equal\n"
622 " to max on clients).\n"
623 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
624 " of handshake initiation by any peer (default=%d).\n"
625 "--tran-window n : Transition window -- old key can live this many seconds\n"
626 " after new key renegotiation begins (default=%d).\n"
627 "--single-session: Allow only one session (reset state on restart).\n"
628 "--tls-exit : Exit on TLS negotiation failure.\n"
629 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
630 " control channel to protect against attacks on the TLS stack\n"
631 " and DoS attacks.\n"
632 " f (required) is a shared-secret key file.\n"
633 " The optional d parameter controls key directionality.\n"
634 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
635 " of the TLS control channel to hide the TLS certificate,\n"
636 " provide basic post-quantum security and protect against\n"
637 " attacks on the TLS stack and DoS attacks.\n"
638 " key (required) provides the pre-shared key file.\n"
639 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
640 " For servers: use key to decrypt client-specific keys. For\n"
641 " key generation (--genkey tls-crypt-v2-client): use key to\n"
642 " encrypt generated client-specific key. (See --tls-crypt.)\n"
643 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
644 " fresh tls-crypt-v2 client key, and store to\n"
645 " keyfile. If supplied, include metadata in wrapped key.\n"
646 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
647 " fresh tls-crypt-v2 server key, and store to keyfile\n"
648 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
649 " client-supplied tls-crypt-v2 client key\n"
650 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
651 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
652 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
653 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
654 " pending TLS connection that has otherwise passed all other\n"
655 " tests of certification. cmd should return 0 to allow\n"
656 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
657 " executed as 'cmd certificate_depth subject')\n"
658 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
659 " DN name. The remote host must also pass all other tests\n"
660 " of verification.\n"
661#ifndef ENABLE_CRYPTO_MBEDTLS
662 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
663 " an explicit nsCertType designation t = 'client' | 'server'.\n"
664#endif
665 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
666 " plugins and management interface.\n"
667 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
668 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
669 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
670 " explicit key usage, you can specify more than one value.\n"
671 " value should be given in hex format.\n"
672 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
673 " explicit extended key usage. Extended key usage can be encoded\n"
674 " as an object identifier or OpenSSL string representation.\n"
675 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
676 " key usage and extended key usage based on RFC3280 TLS rules.\n"
677 " t = 'client' | 'server'.\n"
678#ifdef ENABLE_PKCS11
679 "\n"
680 "PKCS#11 Options:\n"
681 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
682 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
683 " path. Set for each provider.\n"
684 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
685 " 0 : Try to determine automatically (default).\n"
686 " 1 : Use Sign.\n"
687 " 2 : Use SignRecover.\n"
688 " 4 : Use Decrypt.\n"
689 " 8 : Use Unwrap.\n"
690 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
691 " certificate can be accessed. Set for each provider.\n"
692 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
693 " cache until token is removed.\n"
694 "--pkcs11-id-management : Acquire identity from management interface.\n"
695 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
696#endif /* ENABLE_PKCS11 */
697 "\n"
698 "SSL Library information:\n"
699 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
700 "--show-digests : Show message digest algorithms to use with --auth option.\n"
701 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
702 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
703#ifdef _WIN32
704 "\n"
705 "Windows Specific:\n"
706 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
707 " from SystemRoot environment variable.\n"
708 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
709 " IP address using method = manual, netsh, ipapi,\n"
710 " dynamic, or adaptive (default = adaptive).\n"
711 " Dynamic method allows two optional parameters:\n"
712 " offset: DHCP server address offset (> -256 and < 256).\n"
713 " If 0, use network address, if >0, take nth\n"
714 " address forward from network address, if <0,\n"
715 " take nth address backward from broadcast\n"
716 " address.\n"
717 " Default is 0.\n"
718 " lease-time: Lease time in seconds.\n"
719 " Default is one year.\n"
720 "--route-method : Which method to use for adding routes on Windows?\n"
721 " adaptive (default) -- Try ipapi then fall back to exe.\n"
722 " ipapi -- Use IP helper API.\n"
723 " exe -- Call the route.exe shell command.\n"
724 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
725 " be used with --ip-win32 dynamic. For options\n"
726 " which allow multiple addresses,\n"
727 " --dhcp-option must be repeated.\n"
728 " DOMAIN name : Set DNS suffix\n"
729 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
730 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
731 " NTP : Set NTP server address(es)\n"
732 " NBDD : Set NBDD server address(es)\n"
733 " WINS addr : Set WINS server address(es)\n"
734 " NBT type : Set NetBIOS over TCP/IP Node type\n"
735 " 1: B, 2: P, 4: M, 8: H\n"
736 " NBS id : Set NetBIOS scope ID\n"
737 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
738 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
739 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
740 " startup.\n"
741 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
742 " on connection initiation.\n"
743 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
744 " attempting to set adapter properties.\n"
745 "--pause-exit : When run from a console window, pause before exiting.\n"
746 "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n"
747 " service, and should not be used directly by end-users.\n"
748 " ex is the name of an event object which, when\n"
749 " signaled, will cause " PACKAGE_NAME " to exit. A second\n"
750 " optional parameter controls the initial state of ex.\n"
751 "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n"
752 " after TAP adapter is up and routes have been added.\n"
753 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
754 "Windows Standalone Options:\n"
755 "\n"
756 "--show-adapters : Show all TAP-Windows adapters.\n"
757 "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n"
758 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
759 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME " running without admin privileges\n"
760 " to access TAP adapter.\n"
761#endif /* ifdef _WIN32 */
762 "\n"
763 "Generate a new key :\n"
764 "--genkey tls-auth file : Generate a new random key of type and write to file\n"
765 " (for use with --tls-auth or --tls-crypt)."
766#ifdef ENABLE_FEATURE_TUN_PERSIST
767 "\n"
768 "Tun/tap config mode (available with linux 2.4+):\n"
769 "--mktun : Create a persistent tunnel.\n"
770 "--rmtun : Remove a persistent tunnel.\n"
771 "--dev tunX|tapX : tun/tap device\n"
772 "--dev-type dt : Device type. See tunnel options above for details.\n"
773 "--user user : User to set privilege to.\n"
774 "--group group : Group to set privilege to.\n"
775#endif
776#ifdef ENABLE_PKCS11
777 "\n"
778 "PKCS#11 standalone options:\n"
779#ifdef DEFAULT_PKCS11_MODULE
780 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
781#else
782 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
783#endif
784 " --verb option can be added *BEFORE* this.\n"
785#endif /* ENABLE_PKCS11 */
786 "\n"
787 "General Standalone Options:\n"
788#ifdef ENABLE_DEBUG
789 "--show-gateway [address]: Show info about gateway [to v4/v6 address].\n"
790#endif
791;
792
793#endif /* !ENABLE_SMALL */
794
795/*
796 * This is where the options defaults go.
797 * Any option not explicitly set here
798 * will be set to 0.
799 */
800void
801init_options(struct options *o, const bool init_gc)
802{
803 CLEAR(*o);
804 if (init_gc)
805 {
806 gc_init(&o->gc);
808 o->gc_owned = true;
809 }
811 o->topology = TOP_UNDEF;
812 o->ce.proto = PROTO_UDP;
813 o->ce.af = AF_UNSPEC;
814 o->ce.bind_ipv6_only = false;
817 o->ce.connect_timeout = 120;
818 o->connect_retry_max = 0;
820 o->verbosity = 1;
822 o->status_file_version = 1;
823 o->ce.bind_local = true;
825 o->ce.occ_mtu = 0;
828 o->ce.mtu_discover_type = -1;
829 o->ce.mssfix = 0;
830 o->ce.mssfix_default = true;
831 o->ce.mssfix_encap = true;
832 o->route_delay_window = 30;
834 o->resolve_in_advance = false;
835 o->proto_force = -1;
836 o->occ = true;
837#ifdef ENABLE_MANAGEMENT
841#endif
842#ifdef ENABLE_FEATURE_TUN_PERSIST
843 o->persist_mode = 1;
844#endif
845#ifdef _WIN32
846#if 0
848#else
850#endif
851 o->tuntap_options.dhcp_lease_time = 31536000; /* one year */
852 /* use network address as internal DHCP server address */
855 o->block_outside_dns = false;
857#endif
859 o->vlan_pvid = 1;
860 o->real_hash_size = 256;
861 o->virtual_hash_size = 256;
862 o->n_bcast_buf = 256;
863 o->tcp_queue_limit = 64;
864 o->max_clients = 1024;
865 o->cf_initial_per = 10;
866 o->cf_initial_max = 100;
867 o->max_routes_per_client = 256;
871 o->authname = "SHA1";
875#ifdef ENABLE_PREDICTION_RESISTANCE
876 o->use_prediction_resistance = false;
877#endif
878 o->tls_timeout = 2;
879 o->renegotiate_bytes = -1;
880 o->renegotiate_seconds = 3600;
882 o->handshake_window = 60;
883 o->transition_window = 3600;
884 o->tls_cert_profile = NULL;
885 o->ecdh_curve = NULL;
886#ifdef ENABLE_X509ALTUSERNAME
887 o->x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT;
888#endif
889#ifdef ENABLE_PKCS11
890 o->pkcs11_pin_cache_period = -1;
891#endif /* ENABLE_PKCS11 */
892
893 /* P2MP server context features */
894 o->auth_token_generate = false;
895
896 /* Set default --tmp-dir */
897#ifdef _WIN32
898 /* On Windows, find temp dir via environment variables */
900
901 if (!o->tmp_dir)
902 {
903 /* Error out if we can't find a valid temporary directory, which should
904 * be very unlikely. */
905 msg(M_USAGE, "Could not find a suitable temporary directory."
906 " (GetTempPath() failed). Consider using --tmp-dir");
907 }
908#else /* ifdef _WIN32 */
909 /* Non-windows platforms use $TMPDIR, and if not set, default to '/tmp' */
910 o->tmp_dir = getenv("TMPDIR");
911 if (!o->tmp_dir)
912 {
913 o->tmp_dir = "/tmp";
914 }
915#endif /* _WIN32 */
916 o->allow_recursive_routing = false;
917
918#ifndef ENABLE_DCO
919 o->disable_dco = true;
920#endif /* ENABLE_DCO */
921
922#ifdef ENABLE_DNS_UPDOWN_BY_DEFAULT
923 o->dns_options.updown = DEFAULT_DNS_UPDOWN;
924#endif /* ENABLE_DNS_UPDOWN_BY_DEFAULT */
925}
926
927void
929{
930 if (o->connection_list)
931 {
933 }
934 if (o->remote_list)
935 {
936 CLEAR(*o->remote_list);
937 }
938 if (o->gc_owned)
939 {
940 gc_free(&o->gc);
942 }
943}
944
946{
947#define PUF_TYPE_UNDEF 0
948#define PUF_TYPE_ACCEPT 1
949#define PUF_TYPE_IGNORE 2
950#define PUF_TYPE_REJECT 3
951 int type;
952 int size;
953 char *pattern;
955};
956
958{
961};
962
963#ifndef ENABLE_SMALL
964
965static const char *
967{
968 if (type == PUF_TYPE_ACCEPT)
969 {
970 return "accept";
971 }
972 if (type == PUF_TYPE_IGNORE)
973 {
974 return "ignore";
975 }
976 if (type == PUF_TYPE_REJECT)
977 {
978 return "reject";
979 }
980 else
981 {
982 return "???";
983 }
984}
985
986#define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
987#define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
988#define SHOW_STR_INLINE(var) SHOW_PARM(var, \
989 o->var ## _inline ? "[INLINE]" : \
990 (o->var ? o->var : "[UNDEF]"), \
991 "'%s'")
992#define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
993#define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
994#define SHOW_INT64(var) SHOW_PARM(var, o->var, "%" PRIi64)
995#define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
996#define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
997
998#endif /* ifndef ENABLE_SMALL */
999
1000static void
1002 const struct connection_entry *e,
1003 const int i)
1004{
1005 setenv_str_i(es, "remote", e->remote, i);
1006 setenv_str_i(es, "remote_port", e->remote_port, i);
1007
1008 if (e->http_proxy_options)
1009 {
1010 setenv_str_i(es, "http_proxy_server", e->http_proxy_options->server, i);
1011 setenv_str_i(es, "http_proxy_port", e->http_proxy_options->port, i);
1012 }
1013 if (e->socks_proxy_server)
1014 {
1015 setenv_str_i(es, "socks_proxy_server", e->socks_proxy_server, i);
1016 setenv_str_i(es, "socks_proxy_port", e->socks_proxy_port, i);
1017 }
1018}
1019
1020static void
1022 const struct local_entry *e,
1023 const int i)
1024{
1025 setenv_str_i(es, "proto", proto2ascii(e->proto, AF_UNSPEC, false), i);
1026 setenv_str_i(es, "local", e->local, i);
1027 setenv_str_i(es, "local_port", e->port, i);
1028}
1029
1030void
1031setenv_settings(struct env_set *es, const struct options *o)
1032{
1033 setenv_str(es, "config", o->config);
1034 setenv_int(es, "verb", o->verbosity);
1035 setenv_int(es, "daemon", o->daemon);
1036 setenv_int(es, "daemon_log_redirect", o->log);
1037 setenv_long_long(es, "daemon_start_time", time(NULL));
1038 setenv_int(es, "daemon_pid", platform_getpid());
1039
1040 if (o->connection_list)
1041 {
1042 int i;
1043 for (i = 0; i < o->connection_list->len; ++i)
1044 {
1046 }
1047 }
1048 else
1049 {
1050 setenv_connection_entry(es, &o->ce, 1);
1051 }
1052
1053 if (o->ce.local_list)
1054 {
1055 for (int i = 0; i < o->ce.local_list->len; i++)
1056 {
1057 setenv_local_entry(es, o->ce.local_list->array[i], i+1);
1058 }
1059 }
1060}
1061
1062#ifndef _WIN32
1063static void
1064setenv_foreign_option(struct options *o, const char *argv[], int len, struct env_set *es)
1065{
1066 if (len > 0)
1067 {
1068 struct gc_arena gc = gc_new();
1069 struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1070 struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1071 int i;
1072 bool first = true;
1073 bool good = true;
1074
1075 good &= buf_printf(&name, "foreign_option_%d", o->foreign_option_index + 1);
1076 ++o->foreign_option_index;
1077 for (i = 0; i < len; ++i)
1078 {
1079 if (argv[i])
1080 {
1081 if (!first)
1082 {
1083 good &= buf_printf(&value, " ");
1084 }
1085 good &= buf_printf(&value, "%s", argv[i]);
1086 first = false;
1087 }
1088 }
1089 if (good)
1090 {
1091 setenv_str(es, BSTR(&name), BSTR(&value));
1092 }
1093 else
1094 {
1095 msg(M_WARN, "foreign_option: name/value overflow");
1096 }
1097 gc_free(&gc);
1098 }
1099}
1100#endif /* ifndef _WIN32 */
1101
1102static in_addr_t
1103get_ip_addr(const char *ip_string, int msglevel, bool *error)
1104{
1105 unsigned int flags = GETADDR_HOST_ORDER;
1106 bool succeeded = false;
1107 in_addr_t ret;
1108
1109 if (msglevel & M_FATAL)
1110 {
1111 flags |= GETADDR_FATAL;
1112 }
1113
1114 ret = getaddr(flags, ip_string, 0, &succeeded, NULL);
1115 if (!succeeded && error)
1116 {
1117 *error = true;
1118 }
1119 return ret;
1120}
1121
1127static char *
1128get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
1129{
1130 const char *end = strchr(addr, '/');
1131 char *ret = NULL;
1132 if (NULL == end)
1133 {
1134 ret = string_alloc(addr, gc);
1135 }
1136 else
1137 {
1138 size_t len = end - addr;
1139 ret = gc_malloc(len + 1, true, gc);
1140 memcpy(ret, addr, len);
1141 }
1142 return ret;
1143}
1144
1145static bool
1147{
1148 struct in6_addr t_addr;
1149 unsigned int t_bits;
1150
1151 return get_ipv6_addr( ipv6_prefix_spec, &t_addr, &t_bits, M_WARN );
1152}
1153
1154static char *
1155string_substitute(const char *src, int from, int to, struct gc_arena *gc)
1156{
1157 char *ret = (char *) gc_malloc(strlen(src) + 1, true, gc);
1158 char *dest = ret;
1159 char c;
1160
1161 do
1162 {
1163 c = *src++;
1164 if (c == from)
1165 {
1166 c = to;
1167 }
1168 *dest++ = c;
1169 }
1170 while (c);
1171 return ret;
1172}
1173
1183static struct verify_hash_list *
1184parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
1185{
1186 int i = 0;
1187 const char *cp = str;
1188
1189 struct verify_hash_list *ret;
1191
1192 char term = 0;
1193 unsigned int byte;
1194
1195 while (*cp && i < nbytes)
1196 {
1197 /* valid segments consist of exactly two hex digits, then ':' or EOS */
1198 if (!isxdigit(cp[0])
1199 || !isxdigit(cp[1])
1200 || (cp[2] != ':' && cp[2] != '\0')
1201 || sscanf(cp, "%x", &byte) != 1)
1202 {
1203 msg(msglevel, "format error in hash fingerprint: %s", str);
1204 break;
1205 }
1206
1207 ret->hash[i++] = (uint8_t)byte;
1208
1209 term = cp[2];
1210 if (term == '\0')
1211 {
1212 break;
1213 }
1214 cp += 3;
1215 }
1216 if (i < nbytes)
1217 {
1218 msg(msglevel, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes, i, str);
1219 }
1220 else if (term != '\0')
1221 {
1222 msg(msglevel, "hash fingerprint too long - expected only %d bytes: %s", nbytes, str);
1223 }
1224 return ret;
1225}
1226
1237static struct verify_hash_list *
1238parse_hash_fingerprint_multiline(const char *str, int nbytes, int msglevel,
1239 struct gc_arena *gc)
1240{
1241 struct gc_arena gc_temp = gc_new();
1242 char *lines = string_alloc(str, &gc_temp);
1243
1244 struct verify_hash_list *ret = NULL;
1245
1246 const char *line;
1247 while ((line = strsep(&lines, "\n")))
1248 {
1249 /* ignore leading whitespace */
1250 while (isspace(*line))
1251 {
1252 line++;
1253 }
1254 /* skip empty lines and comment lines */
1255 if (strlen(line) == 0 || *line == '#' || *line == ';')
1256 {
1257 continue;
1258 }
1259
1260 struct verify_hash_list *hash = parse_hash_fingerprint(line, nbytes,
1261 msglevel, gc);
1262
1263 if (!hash)
1264 {
1265 gc_free(&gc_temp);
1266 return NULL;
1267 }
1268
1269 hash->next = ret;
1270 ret = hash;
1271 }
1272 gc_free(&gc_temp);
1273
1274 return ret;
1275}
1276#ifdef _WIN32
1277
1278#ifndef ENABLE_SMALL
1279
1280static void
1281show_dhcp_option_list(const char *name, const char *const *array, int len)
1282{
1283 int i;
1284 for (i = 0; i < len; ++i)
1285 {
1286 msg(D_SHOW_PARMS, " %s[%d] = %s", name, i, array[i] );
1287 }
1288}
1289
1290static void
1291show_dhcp_option_addrs(const char *name, const in_addr_t *array, int len)
1292{
1293 struct gc_arena gc = gc_new();
1294 int i;
1295 for (i = 0; i < len; ++i)
1296 {
1297 msg(D_SHOW_PARMS, " %s[%d] = %s",
1298 name,
1299 i,
1300 print_in_addr_t(array[i], 0, &gc));
1301 }
1302 gc_free(&gc);
1303}
1304
1305static void
1307{
1308 SHOW_BOOL(ip_win32_defined);
1309 SHOW_INT(ip_win32_type);
1310 SHOW_INT(dhcp_masq_offset);
1311 SHOW_INT(dhcp_lease_time);
1312 SHOW_INT(tap_sleep);
1313 SHOW_UNSIGNED(dhcp_options);
1315 SHOW_BOOL(dhcp_pre_release);
1316 SHOW_STR(domain);
1317 SHOW_STR(netbios_scope);
1318 SHOW_INT(netbios_node_type);
1319 SHOW_BOOL(disable_nbt);
1320
1321 show_dhcp_option_addrs("DNS", o->dns, o->dns_len);
1322 show_dhcp_option_addrs("WINS", o->wins, o->wins_len);
1323 show_dhcp_option_addrs("NTP", o->ntp, o->ntp_len);
1324 show_dhcp_option_addrs("NBDD", o->nbdd, o->nbdd_len);
1326}
1327
1328#endif /* ifndef ENABLE_SMALL */
1329#endif /* ifdef _WIN32 */
1330
1331#if defined(_WIN32) || defined(TARGET_ANDROID)
1332static void
1333dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel)
1334{
1335 struct in6_addr addr;
1336 if (*len >= N_DHCP_ADDR)
1337 {
1338 msg(msglevel, "--dhcp-option DNS: maximum of %d IPv6 dns servers can be specified",
1339 N_DHCP_ADDR);
1340 }
1341 else if (get_ipv6_addr(parm, &addr, NULL, msglevel))
1342 {
1343 dns6_list[(*len)++] = addr;
1344 }
1345}
1346static void
1347dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
1348{
1349 if (*len >= N_DHCP_ADDR)
1350 {
1351 msg(msglevel, "--dhcp-option %s: maximum of %d %s servers can be specified",
1352 name,
1354 name);
1355 }
1356 else
1357 {
1358 if (ip_addr_dotted_quad_safe(parm)) /* FQDN -- IP address only */
1359 {
1360 bool error = false;
1361 const in_addr_t addr = get_ip_addr(parm, msglevel, &error);
1362 if (!error)
1363 {
1364 array[(*len)++] = addr;
1365 }
1366 }
1367 else
1368 {
1369 msg(msglevel, "dhcp-option parameter %s '%s' must be an IP address", name, parm);
1370 }
1371 }
1372}
1373
1374/*
1375 * If DNS options are set use these for TUN/TAP options as well.
1376 * Applies to DNS, DNS6 and DOMAIN-SEARCH.
1377 * Existing options will be discarded.
1378 */
1379static void
1381{
1382 struct tuntap_options *tt = &o->tuntap_options;
1383 struct dns_options *dns = &o->dns_options;
1384
1385 if (dns->search_domains)
1386 {
1387 tt->domain_search_list_len = 0;
1388 const struct dns_domain *domain = dns->search_domains;
1389 while (domain && tt->domain_search_list_len < N_SEARCH_LIST_LEN)
1390 {
1391 tt->domain_search_list[tt->domain_search_list_len++] = domain->name;
1392 domain = domain->next;
1393 }
1394 if (domain)
1395 {
1396 msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to --dhcp-option");
1397 }
1399 }
1400
1401 if (dns->servers)
1402 {
1403 tt->dns_len = 0;
1404 tt->dns6_len = 0;
1405 bool overflow = false;
1406 const struct dns_server *server = dns->servers;
1407 while (server)
1408 {
1409 for (int i = 0; i < server->addr_count; ++i)
1410 {
1411 if (server->addr[i].family == AF_INET)
1412 {
1413 if (tt->dns_len >= N_DHCP_ADDR)
1414 {
1415 overflow = true;
1416 continue;
1417 }
1418 tt->dns[tt->dns_len++] = ntohl(server->addr[i].in.a4.s_addr);
1419 }
1420 else
1421 {
1422 if (tt->dns6_len >= N_DHCP_ADDR)
1423 {
1424 overflow = true;
1425 continue;
1426 }
1427 tt->dns6[tt->dns6_len++] = server->addr[i].in.a6;
1428 }
1429 }
1430 server = server->next;
1431 }
1432 if (overflow)
1433 {
1434 msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to --dhcp-option");
1435 }
1437 }
1438}
1439#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1440static void
1441foreign_options_copy_dns(struct options *o, struct env_set *es)
1442{
1443 const struct dns_domain *domain = o->dns_options.search_domains;
1444 const struct dns_server *server = o->dns_options.servers;
1445 if (!domain && !server)
1446 {
1447 return;
1448 }
1449
1450 /* reset the index since we're starting all over again */
1451 int opt_max = o->foreign_option_index;
1452 o->foreign_option_index = 0;
1453
1454 for (int i = 1; i <= opt_max; ++i)
1455 {
1456 char name[32];
1457 snprintf(name, sizeof(name), "foreign_option_%d", i);
1458
1459 const char *env_str = env_set_get(es, name);
1460 const char *value = strchr(env_str, '=') + 1;
1461 if ((domain && strstr(value, "dhcp-option DOMAIN-SEARCH") == value)
1462 || (server && strstr(value, "dhcp-option DNS") == value))
1463 {
1464 setenv_del(es, name);
1465 }
1466 else
1467 {
1468 setenv_foreign_option(o, &value, 1, es);
1469 }
1470 }
1471
1472 struct gc_arena gc = gc_new();
1473
1474 while (server)
1475 {
1476 for (size_t i = 0; i < server->addr_count; ++i)
1477 {
1478 if (server->addr[i].family == AF_INET)
1479 {
1480 const char *argv[] = {
1481 "dhcp-option",
1482 "DNS",
1483 print_in_addr_t(server->addr[i].in.a4.s_addr, 0, &gc)
1484 };
1485 setenv_foreign_option(o, argv, 3, es);
1486 }
1487 else
1488 {
1489 const char *argv[] = {
1490 "dhcp-option",
1491 "DNS6",
1492 print_in6_addr(server->addr[i].in.a6, 0, &gc)
1493 };
1494 setenv_foreign_option(o, argv, 3, es);
1495 }
1496 }
1497 server = server->next;
1498 }
1499 while (domain)
1500 {
1501 const char *argv[] = { "dhcp-option", "DOMAIN-SEARCH", domain->name };
1502 setenv_foreign_option(o, argv, 3, es);
1503 domain = domain->next;
1504 }
1505
1506 gc_free(&gc);
1507
1508 /* remove old leftover entries */
1509 while (o->foreign_option_index < opt_max)
1510 {
1511 char name[32];
1512 snprintf(name, sizeof(name), "foreign_option_%d", opt_max--);
1513 setenv_del(es, name);
1514 }
1515}
1516#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1517
1518#ifndef ENABLE_SMALL
1519static const char *
1521{
1522 switch (mode)
1523 {
1524 case VLAN_ONLY_TAGGED:
1525 return "tagged";
1526
1528 return "untagged";
1529
1530 case VLAN_ALL:
1531 return "all";
1532 }
1533 return NULL;
1534}
1535
1536static void
1537show_p2mp_parms(const struct options *o)
1538{
1539 struct gc_arena gc = gc_new();
1540
1541 msg(D_SHOW_PARMS, " server_network = %s", print_in_addr_t(o->server_network, 0, &gc));
1542 msg(D_SHOW_PARMS, " server_netmask = %s", print_in_addr_t(o->server_netmask, 0, &gc));
1543 msg(D_SHOW_PARMS, " server_network_ipv6 = %s", print_in6_addr(o->server_network_ipv6, 0, &gc) );
1544 SHOW_INT(server_netbits_ipv6);
1545 msg(D_SHOW_PARMS, " server_bridge_ip = %s", print_in_addr_t(o->server_bridge_ip, 0, &gc));
1546 msg(D_SHOW_PARMS, " server_bridge_netmask = %s", print_in_addr_t(o->server_bridge_netmask, 0, &gc));
1547 msg(D_SHOW_PARMS, " server_bridge_pool_start = %s", print_in_addr_t(o->server_bridge_pool_start, 0, &gc));
1548 msg(D_SHOW_PARMS, " server_bridge_pool_end = %s", print_in_addr_t(o->server_bridge_pool_end, 0, &gc));
1549 if (o->push_list.head)
1550 {
1551 const struct push_entry *e = o->push_list.head;
1552 while (e)
1553 {
1554 if (e->enable)
1555 {
1556 msg(D_SHOW_PARMS, " push_entry = '%s'", e->option);
1557 }
1558 e = e->next;
1559 }
1560 }
1561 SHOW_BOOL(ifconfig_pool_defined);
1562 msg(D_SHOW_PARMS, " ifconfig_pool_start = %s", print_in_addr_t(o->ifconfig_pool_start, 0, &gc));
1563 msg(D_SHOW_PARMS, " ifconfig_pool_end = %s", print_in_addr_t(o->ifconfig_pool_end, 0, &gc));
1564 msg(D_SHOW_PARMS, " ifconfig_pool_netmask = %s", print_in_addr_t(o->ifconfig_pool_netmask, 0, &gc));
1565 SHOW_STR(ifconfig_pool_persist_filename);
1566 SHOW_INT(ifconfig_pool_persist_refresh_freq);
1567 SHOW_BOOL(ifconfig_ipv6_pool_defined);
1568 msg(D_SHOW_PARMS, " ifconfig_ipv6_pool_base = %s", print_in6_addr(o->ifconfig_ipv6_pool_base, 0, &gc));
1569 SHOW_INT(ifconfig_ipv6_pool_netbits);
1570 SHOW_INT(n_bcast_buf);
1571 SHOW_INT(tcp_queue_limit);
1572 SHOW_INT(real_hash_size);
1573 SHOW_INT(virtual_hash_size);
1574 SHOW_STR(client_connect_script);
1576 SHOW_STR(client_disconnect_script);
1577 SHOW_STR(client_crresponse_script);
1578 SHOW_STR(client_config_dir);
1579 SHOW_BOOL(ccd_exclusive);
1580 SHOW_STR(tmp_dir);
1581 SHOW_BOOL(push_ifconfig_defined);
1582 msg(D_SHOW_PARMS, " push_ifconfig_local = %s", print_in_addr_t(o->push_ifconfig_local, 0, &gc));
1583 msg(D_SHOW_PARMS, " push_ifconfig_remote_netmask = %s", print_in_addr_t(o->push_ifconfig_remote_netmask, 0, &gc));
1584 SHOW_BOOL(push_ifconfig_ipv6_defined);
1585 msg(D_SHOW_PARMS, " push_ifconfig_ipv6_local = %s/%d", print_in6_addr(o->push_ifconfig_ipv6_local, 0, &gc), o->push_ifconfig_ipv6_netbits );
1586 msg(D_SHOW_PARMS, " push_ifconfig_ipv6_remote = %s", print_in6_addr(o->push_ifconfig_ipv6_remote, 0, &gc));
1587 SHOW_BOOL(enable_c2c);
1588 SHOW_BOOL(duplicate_cn);
1589 SHOW_INT(cf_max);
1590 SHOW_INT(cf_per);
1591 SHOW_INT(cf_initial_max);
1592 SHOW_INT(cf_initial_per);
1593 SHOW_INT(max_clients);
1594 SHOW_INT(max_routes_per_client);
1595 SHOW_STR(auth_user_pass_verify_script);
1596 SHOW_BOOL(auth_user_pass_verify_script_via_file);
1597 SHOW_BOOL(auth_token_generate);
1598 SHOW_BOOL(force_key_material_export);
1599 SHOW_INT(auth_token_lifetime);
1600 SHOW_STR_INLINE(auth_token_secret_file);
1601#if PORT_SHARE
1602 SHOW_STR(port_share_host);
1603 SHOW_STR(port_share_port);
1604#endif
1605 SHOW_BOOL(vlan_tagging);
1606 msg(D_SHOW_PARMS, " vlan_accept = %s", print_vlan_accept(o->vlan_accept));
1607 SHOW_INT(vlan_pvid);
1608
1609 SHOW_BOOL(client);
1610 SHOW_BOOL(pull);
1611 SHOW_STR_INLINE(auth_user_pass_file);
1612
1613 gc_free(&gc);
1614}
1615
1616#endif /* ! ENABLE_SMALL */
1617
1618static void
1620 const char *network_str,
1621 const char *netmask_str,
1622 int msglevel)
1623{
1624 struct iroute *ir;
1625
1626 ALLOC_OBJ_GC(ir, struct iroute, &o->gc);
1627 ir->network = getaddr(GETADDR_HOST_ORDER, network_str, 0, NULL, NULL);
1628 ir->netbits = 32; /* host route if no netmask given */
1629
1630 if (netmask_str)
1631 {
1632 const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, netmask_str, 0, NULL, NULL);
1633 ir->netbits = netmask_to_netbits2(netmask);
1634
1635 if (ir->netbits < 0)
1636 {
1637 msg(msglevel, "in --iroute %s %s : Bad network/subnet specification",
1638 network_str,
1639 netmask_str);
1640 return;
1641 }
1642 }
1643
1644 ir->next = o->iroutes;
1645 o->iroutes = ir;
1646}
1647
1648static void
1650 const char *prefix_str,
1651 int msglevel)
1652{
1653 struct iroute_ipv6 *ir;
1654
1655 ALLOC_OBJ_GC(ir, struct iroute_ipv6, &o->gc);
1656
1657 if (!get_ipv6_addr(prefix_str, &ir->network, &ir->netbits, msglevel ))
1658 {
1659 msg(msglevel, "in --iroute-ipv6 %s: Bad IPv6 prefix specification",
1660 prefix_str);
1661 return;
1662 }
1663
1664 ir->next = o->iroutes_ipv6;
1665 o->iroutes_ipv6 = ir;
1666}
1667
1668#ifndef ENABLE_SMALL
1669static void
1671{
1672 int i;
1673 msg(D_SHOW_PARMS, "BEGIN http_proxy");
1674 SHOW_STR(server);
1675 SHOW_STR(port);
1676 SHOW_STR(auth_method_string);
1677 SHOW_STR(auth_file);
1678 SHOW_STR(auth_file_up);
1679 SHOW_BOOL(inline_creds);
1680 SHOW_BOOL(nocache);
1681 SHOW_STR(http_version);
1682 SHOW_STR(user_agent);
1683 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER && o->custom_headers[i].name; i++)
1684 {
1685 if (o->custom_headers[i].content)
1686 {
1687 msg(D_SHOW_PARMS, " custom_header[%d] = %s: %s", i,
1689 }
1690 else
1691 {
1692 msg(D_SHOW_PARMS, " custom_header[%d] = %s", i,
1693 o->custom_headers[i].name);
1694 }
1695 }
1696 msg(D_SHOW_PARMS, "END http_proxy");
1697}
1698#endif /* ifndef ENABLE_SMALL */
1699
1700void
1702{
1703 gc_detach(&o->gc);
1704 o->routes = NULL;
1705 o->client_nat = NULL;
1706 clone_push_list(o);
1707}
1708
1709void
1711{
1712 if (!options->routes)
1713 {
1715 }
1716}
1717
1718static void
1726
1727static void
1729{
1730 if (!options->client_nat)
1731 {
1733 }
1734}
1735
1736#ifndef ENABLE_SMALL
1737static void
1739{
1740 /* Display the global proto only in client mode or with no '--local'*/
1741 if (o->local_list->len == 1)
1742 {
1743 msg(D_SHOW_PARMS, " proto = %s", proto2ascii(o->proto, o->af, false));
1744 }
1745
1746 msg(D_SHOW_PARMS, " Local Sockets:");
1747 for (int i = 0; i < o->local_list->len; i++)
1748 {
1749 msg(D_SHOW_PARMS, " [%s]:%s-%s", o->local_list->array[i]->local,
1750 o->local_list->array[i]->port, proto2ascii(o->local_list->array[i]->proto, o->af, false));
1751 }
1752 SHOW_STR(remote);
1753 SHOW_STR(remote_port);
1754 SHOW_BOOL(remote_float);
1755 SHOW_BOOL(bind_defined);
1757 SHOW_BOOL(bind_ipv6_only);
1758 SHOW_INT(connect_retry_seconds);
1759 SHOW_INT(connect_timeout);
1760
1761 if (o->http_proxy_options)
1762 {
1764 }
1765 SHOW_STR(socks_proxy_server);
1766 SHOW_STR(socks_proxy_port);
1767 SHOW_INT(tun_mtu);
1768 SHOW_BOOL(tun_mtu_defined);
1769 SHOW_INT(link_mtu);
1770 SHOW_BOOL(link_mtu_defined);
1771 SHOW_INT(tun_mtu_extra);
1772 SHOW_BOOL(tun_mtu_extra_defined);
1773 SHOW_INT(tls_mtu);
1774
1775 SHOW_INT(mtu_discover_type);
1776
1777#ifdef ENABLE_FRAGMENT
1779#endif
1780 SHOW_INT(mssfix);
1781 SHOW_BOOL(mssfix_encap);
1782 SHOW_BOOL(mssfix_fixed);
1783
1784 SHOW_INT(explicit_exit_notification);
1785
1786 SHOW_STR_INLINE(tls_auth_file);
1787 SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true),
1788 "%s");
1789 SHOW_STR_INLINE(tls_crypt_file);
1790 SHOW_STR_INLINE(tls_crypt_v2_file);
1791}
1792
1793
1794static void
1796{
1797 if (o->connection_list)
1798 {
1799 const struct connection_list *l = o->connection_list;
1800 int i;
1801 for (i = 0; i < l->len; ++i)
1802 {
1803 msg(D_SHOW_PARMS, "Connection profiles [%d]:", i);
1804 show_connection_entry(l->array[i]);
1805 }
1806 }
1807 else
1808 {
1809 msg(D_SHOW_PARMS, "Connection profiles [default]:");
1811 }
1812 msg(D_SHOW_PARMS, "Connection profiles END");
1813}
1814
1815static void
1817{
1818 struct pull_filter *f;
1819 if (!l)
1820 {
1821 return;
1822 }
1823
1824 msg(D_SHOW_PARMS, " Pull filters:");
1825 for (f = l->head; f; f = f->next)
1826 {
1827 msg(D_SHOW_PARMS, " %s \"%s\"", pull_filter_type_name(f->type), f->pattern);
1828 }
1829}
1830
1831#endif /* ifndef ENABLE_SMALL */
1832
1833void
1834show_settings(const struct options *o)
1835{
1836#ifndef ENABLE_SMALL
1837 msg(D_SHOW_PARMS, "Current Parameter Settings:");
1838
1839 SHOW_STR(config);
1840
1841 SHOW_INT(mode);
1842
1843#ifdef ENABLE_FEATURE_TUN_PERSIST
1844 SHOW_BOOL(persist_config);
1845 SHOW_INT(persist_mode);
1846#endif
1847
1848 SHOW_BOOL(show_ciphers);
1849 SHOW_BOOL(show_digests);
1850 SHOW_BOOL(show_engines);
1851 SHOW_BOOL(genkey);
1852 SHOW_STR(genkey_filename);
1853 SHOW_STR(key_pass_file);
1854 SHOW_BOOL(show_tls_ciphers);
1855
1856 SHOW_INT(connect_retry_max);
1858
1859 SHOW_BOOL(remote_random);
1860
1861 SHOW_STR(ipchange);
1862 SHOW_STR(dev);
1863 SHOW_STR(dev_type);
1864 SHOW_STR(dev_node);
1865#if defined(ENABLE_DCO)
1866 SHOW_BOOL(disable_dco);
1867#endif
1868 SHOW_STR(lladdr);
1869 SHOW_INT(topology);
1870 SHOW_STR(ifconfig_local);
1871 SHOW_STR(ifconfig_remote_netmask);
1872 SHOW_BOOL(ifconfig_noexec);
1873 SHOW_BOOL(ifconfig_nowarn);
1874 SHOW_STR(ifconfig_ipv6_local);
1875 SHOW_INT(ifconfig_ipv6_netbits);
1876 SHOW_STR(ifconfig_ipv6_remote);
1877
1879 SHOW_INT(mtu_test);
1880
1881 SHOW_BOOL(mlock);
1882
1883 SHOW_INT(keepalive_ping);
1884 SHOW_INT(keepalive_timeout);
1885 SHOW_INT(inactivity_timeout);
1886 SHOW_INT(session_timeout);
1887 SHOW_INT64(inactivity_minimum_bytes);
1888 SHOW_INT(ping_send_timeout);
1889 SHOW_INT(ping_rec_timeout);
1890 SHOW_INT(ping_rec_timeout_action);
1891 SHOW_BOOL(ping_timer_remote);
1892 SHOW_INT(remap_sigusr1);
1893 SHOW_BOOL(persist_tun);
1894 SHOW_BOOL(persist_local_ip);
1895 SHOW_BOOL(persist_remote_ip);
1896
1897#if PASSTOS_CAPABILITY
1898 SHOW_BOOL(passtos);
1899#endif
1900
1901 SHOW_INT(resolve_retry_seconds);
1902 SHOW_BOOL(resolve_in_advance);
1903
1904 SHOW_STR(username);
1905 SHOW_STR(groupname);
1906 SHOW_STR(chroot_dir);
1907 SHOW_STR(cd_dir);
1908#ifdef ENABLE_SELINUX
1909 SHOW_STR(selinux_context);
1910#endif
1911 SHOW_STR(writepid);
1912 SHOW_STR(up_script);
1913 SHOW_STR(down_script);
1914 SHOW_BOOL(down_pre);
1915 SHOW_BOOL(up_restart);
1916 SHOW_BOOL(up_delay);
1918 SHOW_BOOL(log);
1921 SHOW_INT(nice);
1922 SHOW_INT(verbosity);
1923 SHOW_INT(mute);
1924#ifdef ENABLE_DEBUG
1925 SHOW_INT(gremlin);
1926#endif
1927 SHOW_STR(status_file);
1928 SHOW_INT(status_file_version);
1929 SHOW_INT(status_file_update_freq);
1930
1931 SHOW_BOOL(occ);
1932 SHOW_INT(rcvbuf);
1933 SHOW_INT(sndbuf);
1934#if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
1935 SHOW_INT(mark);
1936#endif
1937 SHOW_INT(sockflags);
1938
1939 SHOW_BOOL(fast_io);
1940
1941 SHOW_INT(comp.alg);
1942 SHOW_INT(comp.flags);
1943
1944 SHOW_STR(route_script);
1945 SHOW_STR(route_default_gateway);
1946 SHOW_INT(route_default_metric);
1947 SHOW_BOOL(route_noexec);
1948 SHOW_INT(route_delay);
1949 SHOW_INT(route_delay_window);
1950 SHOW_BOOL(route_delay_defined);
1951 SHOW_BOOL(route_nopull);
1952 SHOW_BOOL(route_gateway_via_dhcp);
1953 SHOW_BOOL(allow_pull_fqdn);
1955
1956 if (o->routes)
1957 {
1959 }
1960
1961 if (o->client_nat)
1962 {
1964 }
1965
1967
1968#ifdef ENABLE_MANAGEMENT
1969 SHOW_STR(management_addr);
1970 SHOW_STR(management_port);
1971 SHOW_STR(management_user_pass);
1972 SHOW_INT(management_log_history_cache);
1973 SHOW_INT(management_echo_buffer_size);
1974 SHOW_STR(management_client_user);
1975 SHOW_STR(management_client_group);
1976 SHOW_INT(management_flags);
1977#endif
1978#ifdef ENABLE_PLUGIN
1979 if (o->plugin_list)
1980 {
1982 }
1983#endif
1984
1985 SHOW_STR_INLINE(shared_secret_file);
1986 SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true), "%s");
1987 SHOW_STR(ciphername);
1988 SHOW_STR(ncp_ciphers);
1989 SHOW_STR(authname);
1990#ifndef ENABLE_CRYPTO_MBEDTLS
1991 SHOW_BOOL(engine);
1992#endif /* ENABLE_CRYPTO_MBEDTLS */
1993 SHOW_BOOL(mute_replay_warnings);
1994 SHOW_INT(replay_window);
1995 SHOW_INT(replay_time);
1996 SHOW_STR(packet_id_file);
1998#ifdef ENABLE_PREDICTION_RESISTANCE
1999 SHOW_BOOL(use_prediction_resistance);
2000#endif
2001
2002 SHOW_BOOL(tls_server);
2003 SHOW_BOOL(tls_client);
2004 SHOW_STR_INLINE(ca_file);
2005 SHOW_STR(ca_path);
2006 SHOW_STR_INLINE(dh_file);
2008 {
2009 SHOW_PARM("cert_file", "EXTERNAL_CERT", "%s");
2010 }
2011 else
2012 {
2013 SHOW_STR_INLINE(cert_file);
2014 }
2015 SHOW_STR_INLINE(extra_certs_file);
2016
2018 {
2019 SHOW_PARM("priv_key_file", "EXTERNAL_PRIVATE_KEY", "%s");
2020 }
2021 else
2022 {
2023 SHOW_STR_INLINE(priv_key_file);
2024 }
2025#ifndef ENABLE_CRYPTO_MBEDTLS
2026 SHOW_STR_INLINE(pkcs12_file);
2027#endif
2028#ifdef ENABLE_CRYPTOAPI
2029 SHOW_STR(cryptoapi_cert);
2030#endif
2031 SHOW_STR(cipher_list);
2032 SHOW_STR(cipher_list_tls13);
2033 SHOW_STR(tls_cert_profile);
2035 SHOW_STR(tls_export_peer_cert_dir);
2036 SHOW_INT(verify_x509_type);
2037 SHOW_STR(verify_x509_name);
2038 SHOW_STR_INLINE(crl_file);
2039 SHOW_INT(ns_cert_type);
2040 {
2041 int i;
2042 for (i = 0; i<MAX_PARMS; i++)
2043 {
2044 SHOW_INT(remote_cert_ku[i]);
2045 }
2046 }
2047 SHOW_STR(remote_cert_eku);
2048 if (o->verify_hash)
2049 {
2050 SHOW_INT(verify_hash_algo);
2051 SHOW_INT(verify_hash_depth);
2052 struct gc_arena gc = gc_new();
2053 struct verify_hash_list *hl = o->verify_hash;
2054 int digest_len = (o->verify_hash_algo == MD_SHA1) ? SHA_DIGEST_LENGTH :
2056 while (hl)
2057 {
2058 char *s = format_hex_ex(hl->hash, digest_len, 0,
2059 1, ":", &gc);
2060 SHOW_PARM(verify_hash, s, "%s");
2061 hl = hl->next;
2062 }
2063 gc_free(&gc);
2064 }
2065 SHOW_INT(ssl_flags);
2066
2067 SHOW_INT(tls_timeout);
2068
2069 SHOW_INT64(renegotiate_bytes);
2070 SHOW_INT64(renegotiate_packets);
2071 SHOW_INT(renegotiate_seconds);
2072
2073 SHOW_INT(handshake_window);
2074 SHOW_INT(transition_window);
2075
2076 SHOW_BOOL(single_session);
2078 SHOW_BOOL(tls_exit);
2079
2080 SHOW_STR(tls_crypt_v2_metadata);
2081
2082#ifdef ENABLE_PKCS11
2083 {
2084 int i;
2085 for (i = 0; i<MAX_PARMS && o->pkcs11_providers[i] != NULL; i++)
2086 {
2087 SHOW_PARM(pkcs11_providers, o->pkcs11_providers[i], "%s");
2088 }
2089 }
2090 {
2091 int i;
2092 for (i = 0; i<MAX_PARMS; i++)
2093 {
2094 SHOW_PARM(pkcs11_protected_authentication, o->pkcs11_protected_authentication[i] ? "ENABLED" : "DISABLED", "%s");
2095 }
2096 }
2097 {
2098 int i;
2099 for (i = 0; i<MAX_PARMS; i++)
2100 {
2101 SHOW_PARM(pkcs11_private_mode, o->pkcs11_private_mode[i], "%08x");
2102 }
2103 }
2104 {
2105 int i;
2106 for (i = 0; i<MAX_PARMS; i++)
2107 {
2108 SHOW_PARM(pkcs11_cert_private, o->pkcs11_cert_private[i] ? "ENABLED" : "DISABLED", "%s");
2109 }
2110 }
2111 SHOW_INT(pkcs11_pin_cache_period);
2112 SHOW_STR(pkcs11_id);
2114#endif /* ENABLE_PKCS11 */
2115
2116 show_p2mp_parms(o);
2117
2118#ifdef _WIN32
2119 SHOW_BOOL(show_net_up);
2120 SHOW_INT(route_method);
2121 SHOW_BOOL(block_outside_dns);
2123#endif
2124#endif /* ifndef ENABLE_SMALL */
2125}
2126
2127#undef SHOW_PARM
2128#undef SHOW_STR
2129#undef SHOW_INT
2130#undef SHOW_BOOL
2131
2132#ifdef ENABLE_MANAGEMENT
2133
2134static struct http_proxy_options *
2136 const char *port,
2137 const char *flags,
2138 struct gc_arena *gc)
2139{
2140 if (server && port)
2141 {
2142 struct http_proxy_options *ho;
2144 ho->server = string_alloc(server, gc);
2145 ho->port = port;
2146 if (flags && !strcmp(flags, "nct"))
2147 {
2148 ho->auth_retry = PAR_NCT;
2149 }
2150 else
2151 {
2152 ho->auth_retry = PAR_ALL;
2153 }
2154 ho->http_version = "1.0";
2155 ho->user_agent = "OpenVPN-Autoproxy/1.0";
2156 return ho;
2157 }
2158 else
2159 {
2160 return NULL;
2161 }
2162}
2163
2164static void
2166{
2167 const struct connection_list *l = o->connection_list;
2168 int i;
2169 bool succeed = false;
2170 for (i = 0; i < l->len; ++i)
2171 {
2172 struct connection_entry *ce = l->array[i];
2173 if (ce->proto == PROTO_TCP_CLIENT || ce->proto == PROTO_TCP)
2174 {
2176 succeed = true;
2177 }
2178 }
2179 if (succeed)
2180 {
2181 for (i = 0; i < l->len; ++i)
2182 {
2183 struct connection_entry *ce = l->array[i];
2184 if (ce->proto == PROTO_UDP)
2185 {
2186 ce->flags |= CE_DISABLED;
2187 }
2188 }
2189 }
2190 else
2191 {
2192 msg(M_WARN, "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
2193 }
2194}
2195
2196#endif /* ifdef ENABLE_MANAGEMENT */
2197
2198static struct local_list *
2200{
2201 if (!ce->local_list)
2202 {
2204 }
2205 return ce->local_list;
2206}
2207
2208static struct local_entry *
2209alloc_local_entry(struct connection_entry *ce, const int msglevel,
2210 struct gc_arena *gc)
2211{
2213 struct local_entry *e;
2214
2215 if (l->len >= CONNECTION_LIST_SIZE)
2216 {
2217 msg(msglevel, "Maximum number of 'local' options (%d) exceeded",
2219
2220 return NULL;
2221 }
2222
2223 ALLOC_OBJ_CLEAR_GC(e, struct local_entry, gc);
2224 e->proto = PROTO_NONE;
2225 l->array[l->len++] = e;
2226
2227 return e;
2228}
2229
2230static struct connection_list *
2239
2240static struct connection_entry *
2241alloc_connection_entry(struct options *options, const int msglevel)
2242{
2244 struct connection_entry *e;
2245
2246 if (l->len == l->capacity)
2247 {
2248 int capacity = l->capacity + CONNECTION_LIST_SIZE;
2249 struct connection_entry **ce = gc_realloc(l->array, capacity*sizeof(struct connection_entry *), &options->gc);
2250 if (ce == NULL)
2251 {
2252 msg(msglevel, "Unable to process more connection options: out of memory. Number of entries = %d", l->len);
2253 return NULL;
2254 }
2255 l->array = ce;
2256 l->capacity = capacity;
2257 }
2259 l->array[l->len++] = e;
2260 return e;
2261}
2262
2263static struct remote_list *
2265{
2266 if (!options->remote_list)
2267 {
2269 }
2270 return options->remote_list;
2271}
2272
2273static struct remote_entry *
2274alloc_remote_entry(struct options *options, const int msglevel)
2275{
2277 struct remote_entry *e;
2278
2279 if (l->len == l->capacity)
2280 {
2281 int capacity = l->capacity + CONNECTION_LIST_SIZE;
2282 struct remote_entry **re = gc_realloc(l->array, capacity*sizeof(struct remote_entry *), &options->gc);
2283 if (re == NULL)
2284 {
2285 msg(msglevel, "Unable to process more remote options: out of memory. Number of entries = %d", l->len);
2286 return NULL;
2287 }
2288 l->array = re;
2289 l->capacity = capacity;
2290 }
2291 ALLOC_OBJ_GC(e, struct remote_entry, &options->gc);
2292 l->array[l->len++] = e;
2293 return e;
2294}
2295
2296static struct pull_filter_list *
2298{
2299 if (!o->pull_filter_list)
2300 {
2302 }
2303 return o->pull_filter_list;
2304}
2305
2306static struct pull_filter *
2308{
2310 struct pull_filter *f;
2311
2312 ALLOC_OBJ_CLEAR_GC(f, struct pull_filter, &o->gc);
2313 if (l->head)
2314 {
2315 ASSERT(l->tail);
2316 l->tail->next = f;
2317 }
2318 else
2319 {
2320 ASSERT(!l->tail);
2321 l->head = f;
2322 }
2323 l->tail = f;
2324 return f;
2325}
2326
2327static void
2329{
2330 if (re->remote)
2331 {
2332 ce->remote = re->remote;
2333 }
2334 if (re->remote_port)
2335 {
2336 ce->remote_port = re->remote_port;
2337 }
2338 if (re->proto >= 0)
2339 {
2340 ce->proto = re->proto;
2341 }
2342 if (re->af > 0)
2343 {
2344 ce->af = re->af;
2345 }
2346}
2347
2348static void
2349connection_entry_preload_key(const char **key_file, bool *key_inline,
2350 struct gc_arena *gc)
2351{
2352 if (key_file && *key_file && !(*key_inline))
2353 {
2354 struct buffer in = buffer_read_from_file(*key_file, gc);
2355 if (!buf_valid(&in))
2356 {
2357 msg(M_FATAL, "Cannot pre-load keyfile (%s)", *key_file);
2358 }
2359
2360 *key_file = (const char *) in.data;
2361 *key_inline = true;
2362 }
2363}
2364
2365static void
2367{
2368#ifdef ENABLE_CRYPTO_MBEDTLS
2369 if (options->ca_path)
2370 {
2371 msg(M_USAGE, "Parameter --capath cannot be used with the mbed TLS version of OpenVPN.");
2372 }
2373#endif
2374
2377 || options->ca_file
2379 || options->ca_path
2380#endif
2381 )
2382 {
2383 return;
2384 }
2385
2386 const char *const str = "You must define CA file (--ca)"
2387#ifndef ENABLE_CRYPTO_MBEDTLS
2388 " or CA path (--capath)"
2389#endif
2390 " and/or peer fingerprint verification (--peer-fingerprint)";
2391 msg(M_USAGE, "%s", str);
2392}
2393
2394#define MUST_BE_UNDEF(parm, parm_name) \
2395 if (options->parm != defaults.parm) { msg(M_USAGE, use_err, parm_name); }
2396#define MUST_BE_FALSE(condition, parm_name) \
2397 if (condition) { msg(M_USAGE, use_err, parm_name); }
2398
2399static void
2401 const struct connection_entry *ce)
2402{
2403 struct options defaults;
2404 int dev = DEV_TYPE_UNDEF;
2405 bool pull = false;
2406
2407 init_options(&defaults, true);
2408
2409 if (options->test_crypto)
2410 {
2411 notnull(options->shared_secret_file, "key file (--secret)");
2412 }
2413 else
2414 {
2415 notnull(options->dev, "TUN/TAP device (--dev)");
2416 }
2417
2418 /*
2419 * Get tun/tap/null device type
2420 */
2422
2423 /*
2424 * If "proto tcp" is specified, make sure we know whether it is
2425 * tcp-client or tcp-server.
2426 */
2427 if (ce->proto == PROTO_TCP)
2428 {
2429 msg(M_USAGE,
2430 "--proto tcp is ambiguous in this context. Please specify "
2431 "--proto tcp-server or --proto tcp-client");
2432 }
2433
2434 /*
2435 * Sanity check on Client mode
2436 */
2437
2438 if (options->mode != MODE_SERVER && ce->local_list->len > 1)
2439 {
2440 msg(M_USAGE, "multiple --local statements only allowed in --server mode");
2441 }
2442
2443 if (options->lladdr && dev != DEV_TYPE_TAP)
2444 {
2445 msg(M_USAGE, "--lladdr can only be used in --dev tap mode");
2446 }
2447
2448 /*
2449 * Sanity check on MTU parameters
2450 */
2452 {
2453 msg(M_USAGE, "only one of --tun-mtu or --link-mtu may be defined");
2454 }
2455
2457 {
2458 msg(M_USAGE, "--mtu-test only makes sense with --proto udp");
2459 }
2460
2461 /* will we be pulling options from server? */
2462 pull = options->pull;
2463
2464 /*
2465 * Sanity check on --local, --remote, and --ifconfig
2466 */
2467
2470 {
2471 msg(M_USAGE,
2472 "--local and --remote addresses must be distinct from --ifconfig "
2473 "addresses");
2474 }
2475
2478 {
2479 msg(M_USAGE,
2480 "local and remote/netmask --ifconfig addresses must be different");
2481 }
2482
2483 if (ce->bind_defined && !ce->bind_local)
2484 {
2485 msg(M_USAGE, "--bind and --nobind can't be used together");
2486 }
2487
2489 {
2490 msg(M_USAGE,
2491 "--lport and --nobind don't make sense when used together");
2492 }
2493
2494 if (!ce->remote && !ce->bind_local)
2495 {
2496 msg(M_USAGE, "--nobind doesn't make sense unless used with --remote");
2497 }
2498
2499 for (int i = 0; i < ce->local_list->len; i++)
2500 {
2501 struct local_entry *le = ce->local_list->array[i];
2502
2503 if (proto_is_net(le->proto)
2504 && string_defined_equal(le->local, ce->remote)
2506 {
2507 msg(M_USAGE, "--remote and one of the --local addresses are the same");
2508 }
2509
2512 {
2513 msg(M_USAGE, "--local addresses must be distinct from --ifconfig addresses");
2514 }
2515
2516 if (le->local && !ce->bind_local)
2517 {
2518 msg(M_USAGE, "--local and --nobind don't make sense when used together");
2519 }
2520 }
2521
2522 /*
2523 * Check for consistency of management options
2524 */
2525#ifdef ENABLE_MANAGEMENT
2529 {
2530 msg(M_USAGE, "--management is not specified, however one or more options which modify the behavior of --management were specified");
2531 }
2532
2535 {
2536 msg(M_USAGE, "--management-client-(user|group) can only be used on unix domain sockets");
2537 }
2538
2542 {
2543 msg(M_WARN, "WARNING: Using --management on a TCP port WITHOUT "
2544 "passwords is STRONGLY discouraged and considered insecure");
2545 }
2546
2547#endif /* ifdef ENABLE_MANAGEMENT */
2548
2549#if !defined(HAVE_XKEY_PROVIDER)
2550 if ((tls_version_max() >= TLS_VER_1_3)
2553 )
2554 {
2555 msg(M_FATAL, "management-external-key with TLS 1.3 or later requires "
2556 "nopadding argument/support");
2557 }
2558#endif
2559 /*
2560 * Windows-specific options.
2561 */
2562
2563#ifdef _WIN32
2564 if (dev == DEV_TYPE_TUN && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
2565 {
2566 msg(M_USAGE, "On Windows, --ifconfig is required when --dev tun is used");
2567 }
2568
2571 {
2572 msg(M_USAGE, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
2573 }
2574
2576 {
2577 const char *prefix = "Some --dhcp-option or --dns options require DHCP server";
2579 {
2580 msg(M_USAGE, "%s, which is not supported by the selected %s driver",
2582 }
2585 {
2586 msg(M_USAGE, "%s, which requires --ip-win32 dynamic or adaptive",
2587 prefix);
2588 }
2589 }
2590#endif /* ifdef _WIN32 */
2591
2592 /*
2593 * Check that protocol options make sense.
2594 */
2595
2596#ifdef ENABLE_FRAGMENT
2597 if (!proto_is_udp(ce->proto) && ce->fragment)
2598 {
2599 msg(M_USAGE, "--fragment can only be used with --proto udp");
2600 }
2601#endif
2602
2603 if (!ce->remote && ce->proto == PROTO_TCP_CLIENT)
2604 {
2605 msg(M_USAGE, "--remote MUST be used in TCP Client mode");
2606 }
2607
2608 if ((ce->http_proxy_options) && ce->proto != PROTO_TCP_CLIENT)
2609 {
2610 msg(M_USAGE,
2611 "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
2612 "tcp-client)");
2613 }
2614
2615 if ((ce->http_proxy_options) && !ce->http_proxy_options->server)
2616 {
2617 msg(M_USAGE,
2618 "--http-proxy not specified but other http proxy options present");
2619 }
2620
2622 {
2623 msg(M_USAGE,
2624 "--http-proxy can not be used together with --socks-proxy");
2625 }
2626
2627 if (ce->socks_proxy_server && ce->proto == PROTO_TCP_SERVER)
2628 {
2629 msg(M_USAGE, "--socks-proxy can not be used in TCP Server mode");
2630 }
2631
2632 if (ce->proto == PROTO_TCP_SERVER && (options->connection_list->len > 1))
2633 {
2634 msg(M_USAGE, "TCP server mode allows at most one --remote address");
2635 }
2636
2637 /*
2638 * Check consistency of --mode server options.
2639 */
2640 if (options->mode == MODE_SERVER)
2641 {
2642 const char use_err[] = "--%s cannot be used with --mode server.";
2643
2644#define USAGE_VALID_SERVER_PROTOS "--mode server currently only supports " \
2645 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
2646#ifdef TARGET_ANDROID
2647 msg(M_FATAL, "--mode server not supported on Android");
2648#endif
2649 if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP))
2650 {
2651 msg(M_USAGE, "--mode server only works with --dev tun or --dev tap");
2652 }
2653 MUST_BE_UNDEF(pull, "pull");
2655 {
2656 msg(M_WARN, "--pull-filter ignored for --mode server");
2657 }
2658 if (!(proto_is_udp(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2659 {
2661 }
2662#if PORT_SHARE
2663 if ((options->port_share_host || options->port_share_port)
2664 && (ce->proto != PROTO_TCP_SERVER))
2665 {
2666 msg(M_USAGE, "--port-share only works in TCP server mode "
2667 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
2668 }
2669#endif
2670 if (!options->tls_server)
2671 {
2672 msg(M_USAGE, "--mode server requires --tls-server");
2673 }
2674 MUST_BE_FALSE(ce->remote, "remote");
2675 MUST_BE_FALSE(!ce->bind_local, "nobind");
2676 MUST_BE_FALSE(ce->http_proxy_options, "http-proxy");
2677 MUST_BE_FALSE(ce->socks_proxy_server, "socks-proxy");
2678 /* <connection> blocks force to have a remote embedded, so we check
2679 * for the --remote and bail out if it is present
2680 */
2681 if (options->connection_list->len >1
2683 {
2684 msg(M_USAGE, "<connection> cannot be used with --mode server");
2685 }
2686
2687 MUST_BE_UNDEF(shaper, "shaper");
2688 if (options->ipchange)
2689 {
2690 msg(M_USAGE,
2691 "--ipchange cannot be used with --mode server (use "
2692 "--client-connect instead)");
2693 }
2694 if (!(proto_is_dgram(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2695 {
2697 }
2698 if (!proto_is_udp(ce->proto) && (options->cf_max || options->cf_per))
2699 {
2700 msg(M_USAGE, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
2701 }
2703 {
2704 msg(M_USAGE, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
2705 }
2707 {
2708 msg(M_USAGE, "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
2709 }
2710 MUST_BE_UNDEF(route_delay_defined, "route-delay");
2711 MUST_BE_UNDEF(up_delay, "up-delay");
2715 {
2716 msg(M_USAGE,
2717 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
2718 }
2720 {
2721 msg(M_USAGE, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
2722 }
2723 MUST_BE_UNDEF(allow_recursive_routing, "allow-recursive-routing");
2725 {
2726 msg(M_USAGE, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
2727 }
2729 {
2730 msg(M_USAGE, "--ccd-exclusive must be used with --client-config-dir");
2731 }
2733 {
2734 msg(M_USAGE, "--auth-gen-token needs a non-infinite "
2735 "--renegotiate_seconds setting");
2736 }
2739 {
2740 msg(M_USAGE, "--auth-gen-token renewal time needs to be at least "
2741 " two times --hand-window (%d).",
2743
2744 }
2748 {
2749 const char *use_err = "--%s must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
2750
2753 "verify-client-cert none|optional");
2755 "username-as-common-name");
2757 "auth-user-pass-optional");
2758 }
2759
2760 if (options->vlan_tagging && dev != DEV_TYPE_TAP)
2761 {
2762 msg(M_USAGE, "--vlan-tagging must be used with --dev tap");
2763 }
2764 if (!options->vlan_tagging)
2765 {
2766 const char use_err[] = "--%s requires --vlan-tagging";
2767 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2768 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2769 }
2770 }
2771 else
2772 {
2773 const char use_err[] = "--%s requires --mode server";
2774 /*
2775 * When not in server mode, err if parameters are
2776 * specified which require --mode server.
2777 */
2778 MUST_BE_UNDEF(ifconfig_pool_defined, "ifconfig-pool");
2779 MUST_BE_UNDEF(ifconfig_pool_persist_filename, "ifconfig-pool-persist");
2780 MUST_BE_UNDEF(ifconfig_ipv6_pool_defined, "ifconfig-ipv6-pool");
2781 MUST_BE_UNDEF(real_hash_size, "hash-size");
2782 MUST_BE_UNDEF(virtual_hash_size, "hash-size");
2783 MUST_BE_UNDEF(learn_address_script, "learn-address");
2784 MUST_BE_UNDEF(client_connect_script, "client-connect");
2785 MUST_BE_UNDEF(client_crresponse_script, "client-crresponse");
2786 MUST_BE_UNDEF(client_disconnect_script, "client-disconnect");
2787 MUST_BE_UNDEF(client_config_dir, "client-config-dir");
2788 MUST_BE_UNDEF(ccd_exclusive, "ccd-exclusive");
2789 MUST_BE_UNDEF(enable_c2c, "client-to-client");
2790 MUST_BE_UNDEF(duplicate_cn, "duplicate-cn");
2791 MUST_BE_UNDEF(cf_max, "connect-freq");
2792 MUST_BE_UNDEF(cf_per, "connect-freq");
2795 "verify-client-cert");
2796 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME, "username-as-common-name");
2797 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL, "auth-user-pass-optional");
2800 {
2801 msg(M_WARN, "WARNING: setting tcp-nodelay on the client side will not "
2802 "affect the server. To have TCP_NODELAY in both direction use "
2803 "tcp-nodelay in the server configuration instead.");
2804 }
2805 MUST_BE_UNDEF(auth_user_pass_verify_script, "auth-user-pass-verify");
2806 MUST_BE_UNDEF(auth_token_generate, "auth-gen-token");
2807#if PORT_SHARE
2808 if (options->port_share_host || options->port_share_port)
2809 {
2810 msg(M_USAGE, "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2811 }
2812#endif
2813 MUST_BE_UNDEF(stale_routes_check_interval, "stale-routes-check");
2814 MUST_BE_UNDEF(vlan_tagging, "vlan-tagging");
2815 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2816 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2817 MUST_BE_UNDEF(force_key_material_export, "force-key-material-export");
2818 }
2819
2820 /*
2821 * SSL/TLS mode sanity checks.
2822 */
2824 + (options->shared_secret_file != NULL) > 1)
2825 {
2826 msg(M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
2827 }
2828
2830 {
2831 int msglevel = M_USAGE;
2833 {
2834 msglevel = M_INFO;
2835 }
2836
2837 msg(msglevel, "DEPRECATION: No tls-client or tls-server option in "
2838 "configuration detected. OpenVPN 2.8 will remove the "
2839 "functionality to run a VPN without TLS. "
2840 "See the examples section in the manual page for "
2841 "examples of a similar quick setup with peer-fingerprint. "
2842 "OpenVPN 2.7 allows using this configuration when using "
2843 "--allow-deprecated-insecure-static-crypto but you should move "
2844 "to a proper configuration using TLS as soon as possible."
2845 );
2846 }
2847
2849 {
2850 msg(M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
2851 "--verify-client-cert none|optional "
2852 "may accept clients which do not present a certificate");
2853 }
2854
2855 const int tls_version_max =
2858 const int tls_version_min =
2861
2862 if (tls_version_max > 0 && tls_version_max < tls_version_min)
2863 {
2864 msg(M_USAGE, "--tls-version-min bigger than --tls-version-max");
2865 }
2866
2868 {
2870#ifdef ENABLE_PKCS11
2871 if (!options->pkcs11_providers[0] && options->pkcs11_id)
2872 {
2873 msg(M_WARN, "Option pkcs11-id is ignored as no pkcs11-providers are specified");
2874 }
2875 else if (!options->pkcs11_providers[0] && options->pkcs11_id_management)
2876 {
2877 msg(M_WARN, "Option pkcs11-id-management is ignored as no pkcs11-providers are specified");
2878 }
2879
2880 if (options->pkcs11_providers[0])
2881 {
2882 if (options->pkcs11_id_management && options->pkcs11_id != NULL)
2883 {
2884 msg(M_USAGE, "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2885 }
2886 if (!options->pkcs11_id_management && options->pkcs11_id == NULL)
2887 {
2888 msg(M_USAGE, "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2889 }
2890 const char use_err[] = "Parameter --%s cannot be used when --pkcs11-provider is also specified.";
2891 MUST_BE_UNDEF(cert_file, "cert");
2892 MUST_BE_UNDEF(priv_key_file, "key");
2893 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2894 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2895 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2896#ifdef ENABLE_CRYPTOAPI
2897 MUST_BE_UNDEF(cryptoapi_cert, "cryptoapicert");
2898#endif
2899 }
2900 else
2901#endif /* ifdef ENABLE_PKCS11 */
2902#ifdef ENABLE_CRYPTOAPI
2904 {
2905 const char use_err[] = "Parameter --%s cannot be used when --cryptoapicert is also specified.";
2906 MUST_BE_UNDEF(cert_file, "cert");
2907 MUST_BE_UNDEF(priv_key_file, "key");
2908 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2909 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2910 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2911 }
2912 else
2913#endif
2914 if (options->pkcs12_file)
2915 {
2916#ifdef ENABLE_CRYPTO_MBEDTLS
2917 msg(M_USAGE, "Parameter --pkcs12 cannot be used with the mbed TLS version of OpenVPN.");
2918#else
2919 const char use_err[] = "Parameter --%s cannot be used when --pkcs12 is also specified.";
2920 MUST_BE_UNDEF(ca_path, "capath");
2921 MUST_BE_UNDEF(cert_file, "cert");
2922 MUST_BE_UNDEF(priv_key_file, "key");
2923 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2924 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2925#endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2926 }
2927 else /* cert/key from none of pkcs11, pkcs12, cryptoapi */
2928 {
2930 {
2931 msg(M_USAGE, "--key and --management-external-key are mutually exclusive");
2932 }
2934 {
2935 if (options->cert_file)
2936 {
2937 msg(M_USAGE, "--cert and --management-external-cert are mutually exclusive");
2938 }
2940 {
2941 msg(M_USAGE, "--management-external-cert must be used with --management-external-key");
2942 }
2943 }
2944 if (pull)
2945 {
2946
2947 const int sum =
2950
2951 if (sum == 0)
2952 {
2954 {
2955 msg(M_USAGE, "No client-side authentication method is "
2956 "specified. You must use either "
2957 "--cert/--key, --pkcs12, or "
2958 "--auth-user-pass");
2959 }
2960 }
2961 else if (sum != 2)
2962 {
2963 msg(M_USAGE, "If you use one of --cert or --key, you must use them both");
2964 }
2965 }
2966 else
2967 {
2969 {
2970 notnull(options->cert_file, "certificate file (--cert) or PKCS#12 file (--pkcs12)");
2971 }
2973 {
2974 notnull(options->priv_key_file, "private key file (--key) or PKCS#12 file (--pkcs12)");
2975 }
2976 }
2977 }
2978 if (ce->tls_auth_file && ce->tls_crypt_file)
2979 {
2980 msg(M_USAGE, "--tls-auth and --tls-crypt are mutually exclusive");
2981 }
2983 && (ce->tls_auth_file || ce->tls_crypt_file))
2984 {
2985 msg(M_USAGE, "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
2986 }
2987 }
2988 else
2989 {
2990 /*
2991 * Make sure user doesn't specify any TLS options
2992 * when in non-TLS mode.
2993 */
2994
2995 const char use_err[] = "Parameter %s can only be specified in TLS-mode, "
2996 "i.e. where --tls-server or --tls-client is also specified.";
2997
2998 MUST_BE_UNDEF(ca_file, "ca");
2999 MUST_BE_UNDEF(ca_path, "capath");
3000 MUST_BE_UNDEF(dh_file, "dh");
3001 MUST_BE_UNDEF(cert_file, "cert");
3002 MUST_BE_UNDEF(priv_key_file, "key");
3003#ifndef ENABLE_CRYPTO_MBEDTLS
3004 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
3005#endif
3006 MUST_BE_UNDEF(cipher_list, "tls-cipher");
3007 MUST_BE_UNDEF(cipher_list_tls13, "tls-ciphersuites");
3008 MUST_BE_UNDEF(tls_cert_profile, "tls-cert-profile");
3009 MUST_BE_UNDEF(tls_verify, "tls-verify");
3010 MUST_BE_UNDEF(tls_export_peer_cert_dir, "tls-export-cert");
3011 MUST_BE_UNDEF(verify_x509_name, "verify-x509-name");
3012 MUST_BE_UNDEF(tls_timeout, "tls-timeout");
3013 MUST_BE_UNDEF(renegotiate_bytes, "reneg-bytes");
3014 MUST_BE_UNDEF(renegotiate_packets, "reneg-pkts");
3015 MUST_BE_UNDEF(renegotiate_seconds, "reneg-sec");
3016 MUST_BE_UNDEF(handshake_window, "hand-window");
3017 MUST_BE_UNDEF(transition_window, "tran-window");
3018 MUST_BE_UNDEF(tls_auth_file, "tls-auth");
3019 MUST_BE_UNDEF(tls_crypt_file, "tls-crypt");
3020 MUST_BE_UNDEF(tls_crypt_v2_file, "tls-crypt-v2");
3021 MUST_BE_UNDEF(single_session, "single-session");
3022 MUST_BE_UNDEF(push_peer_info, "push-peer-info");
3023 MUST_BE_UNDEF(tls_exit, "tls-exit");
3024 MUST_BE_UNDEF(crl_file, "crl-verify");
3025 MUST_BE_UNDEF(ns_cert_type, "ns-cert-type");
3026 MUST_BE_UNDEF(remote_cert_ku[0], "remote-cert-ku");
3027 MUST_BE_UNDEF(remote_cert_eku, "remote-cert-eku");
3028#ifdef ENABLE_PKCS11
3029 MUST_BE_UNDEF(pkcs11_providers[0], "pkcs11-providers");
3030 MUST_BE_UNDEF(pkcs11_private_mode[0], "pkcs11-private-mode");
3031 MUST_BE_UNDEF(pkcs11_id, "pkcs11-id");
3032 MUST_BE_UNDEF(pkcs11_id_management, "pkcs11-id-management");
3033#endif
3034
3035 if (pull)
3036 {
3037 msg(M_USAGE, use_err, "--pull");
3038 }
3039 }
3041 {
3042 msg(M_USAGE, "--auth-user-pass requires --pull");
3043 }
3044
3045 uninit_options(&defaults);
3046}
3047
3048#undef MUST_BE_UNDEF
3049#undef MUST_BE_FALSE
3050
3051static void
3053{
3054 const int dev = dev_type_enum(o->dev, o->dev_type);
3055
3057 {
3058 if (ce->proto == PROTO_TCP)
3059 {
3060 ce->proto = PROTO_TCP_SERVER;
3061 o->ce.proto = ce->proto;
3062 }
3063 }
3064
3065 if (o->mode != MODE_SERVER)
3066 {
3067 if (ce->proto == PROTO_TCP)
3068 {
3069 ce->proto = PROTO_TCP_CLIENT;
3070 o->ce.proto = ce->proto;
3071 }
3072 }
3073
3074 /* an option is present that requires local bind to enabled */
3075 bool need_bind = ce->local_port_defined || ce->bind_defined || ce->local_list;
3076
3077 /* socks proxy is enabled */
3078 bool uses_socks = ce->proto == PROTO_UDP && ce->socks_proxy_server;
3079
3080 /* If binding is not forced by an explicit option and we have (at least)
3081 * one of --tcp-client, --pull (or --client), or socks we do not bind
3082 * locally to have "normal" IP client behaviour of a random source port */
3083 if (!need_bind && (ce->proto == PROTO_TCP_CLIENT || uses_socks || o->pull))
3084 {
3085 ce->bind_local = false;
3086 }
3087
3088 if (!ce->bind_local)
3089 {
3090 ce->local_port = NULL;
3091 }
3092
3093 /* if protocol forcing is enabled, disable all protocols
3094 * except for the forced one
3095 */
3096 if (o->proto_force >= 0 && o->proto_force != ce->proto)
3097 {
3098 ce->flags |= CE_DISABLED;
3099 }
3100
3101 if (ce->http_proxy_options)
3102 {
3104 }
3105
3106 /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
3107 * so fall back to IPv4-only (trac #1221)
3108 */
3109 if (ce->socks_proxy_server && proto_is_udp(ce->proto) && ce->af != AF_INET)
3110 {
3111 if (ce->af == AF_INET6)
3112 {
3113 msg(M_INFO, "WARNING: '--proto udp6' is not compatible with "
3114 "'--socks-proxy' today. Forcing IPv4 mode." );
3115 }
3116 else
3117 {
3118 msg(M_INFO, "NOTICE: dual-stack mode for '--proto udp' does not "
3119 "work correctly with '--socks-proxy' today. Forcing IPv4." );
3120 }
3121 ce->af = AF_INET;
3122 }
3123
3124 /*
3125 * Set MTU defaults
3126 */
3127 {
3128 if (!ce->tun_mtu_defined && !ce->link_mtu_defined)
3129 {
3130 ce->tun_mtu_defined = true;
3131 }
3132 if ((dev == DEV_TYPE_TAP) && !ce->tun_mtu_extra_defined)
3133 {
3134 ce->tun_mtu_extra_defined = true;
3136 }
3137 }
3138
3139 /*
3140 * If --mssfix is supplied without a parameter or not specified at all,
3141 * default it to --fragment value, if --fragment is specified and otherwise
3142 * to the default if tun-mtu is 1500
3143 */
3144 if (o->ce.mssfix_default)
3145 {
3146#ifdef ENABLE_FRAGMENT
3147 if (ce->fragment)
3148 {
3149 ce->mssfix = ce->fragment;
3150 }
3151 else
3152#endif
3153 if (ce->tun_mtu_defined)
3154 {
3155 if (o->ce.tun_mtu == TUN_MTU_DEFAULT)
3156 {
3157 /* We want to only set mssfix default value if we use a default
3158 * MTU Size, otherwise the different size of tun should either
3159 * already solve the problem or mssfix might artifically make the
3160 * payload packets smaller without mssfix 0 */
3161 ce->mssfix = MSSFIX_DEFAULT;
3162 ce->mssfix_encap = true;
3163 }
3164 else
3165 {
3166 /* We still apply the mssfix value but only adjust it to the
3167 * size of the tun interface. */
3168 ce->mssfix = ce->tun_mtu;
3169 ce->mssfix_fixed = true;
3170 }
3171 }
3172 }
3173
3174 /*
3175 * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
3176 *
3177 * At the end only one of these will be really set because the parser
3178 * logic prevents configurations where more are set.
3179 */
3180 if (!ce->tls_auth_file && !ce->tls_crypt_file && !ce->tls_crypt_v2_file)
3181 {
3185
3188
3191 }
3192
3193 /* Pre-cache tls-auth/crypt(-v2) key file if
3194 * keys were not already embedded in the config file.
3195 */
3197 &ce->tls_auth_file_inline, &o->gc);
3199 &ce->tls_crypt_file_inline, &o->gc);
3201 &ce->tls_crypt_v2_file_inline, &o->gc);
3202
3203
3205 {
3206 msg(M_WARN, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
3208 }
3209}
3210
3211static void
3213{
3214 /* use the global port if none is specified */
3215 if (!le->port)
3216 {
3217 le->port = ce->local_port;
3218 }
3219 /* use the global proto if none is specified and
3220 * allow proto bindings on server mode only */
3221 if (!le->proto || mode == MODE_POINT_TO_POINT)
3222 {
3223 le->proto = ce->proto;
3224 }
3225}
3226
3227#ifdef _WIN32
3228/* If iservice is in use, we need def1 method for redirect-gateway */
3229static void
3231{
3232 if (opt->routes
3234 && opt->routes->flags & RG_REROUTE_GW
3235 && !(opt->routes->flags & RG_DEF1))
3236 {
3237 msg(M_INFO, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
3238 opt->routes->flags |= RG_DEF1;
3239 }
3240}
3241#endif
3242
3243/*
3244 * Save/Restore certain option defaults before --pull is applied.
3245 */
3246
3247static void
3249{
3254
3255 if (o->routes)
3256 {
3258 o->pre_connect->routes_defined = true;
3259 }
3260 if (o->routes_ipv6)
3261 {
3264 }
3265 if (o->client_nat)
3266 {
3269 }
3270
3273
3275
3276 /* NCP related options that can be overwritten by a push */
3278 o->pre_connect->authname = o->authname;
3279
3280 /* Ping related options should be reset to the config values on reconnect */
3284
3285 /* Miscellaneous Options */
3286 o->pre_connect->comp = o->comp;
3287}
3288
3289void
3291{
3292 const struct options_pre_connect *pp = o->pre_connect;
3293 if (pp)
3294 {
3296 if (pp->tuntap_options_defined)
3297 {
3299 }
3300
3301 if (pp->routes_defined)
3302 {
3303 rol_check_alloc(o);
3305 }
3306 else
3307 {
3308 o->routes = NULL;
3309 }
3310
3311 if (pp->routes_ipv6_defined)
3312 {
3315 }
3316 else
3317 {
3318 o->routes_ipv6 = NULL;
3319 }
3320
3323
3324 /* Free DNS options and reset them to pre-pull state */
3325 gc_free(&o->dns_options.gc);
3326 struct gc_arena dns_gc = gc_new();
3327 o->dns_options = clone_dns_options(&pp->dns_options, &dns_gc);
3328 o->dns_options.gc = dns_gc;
3329
3330 if (pp->client_nat_defined)
3331 {
3334 }
3335 else
3336 {
3337 o->client_nat = NULL;
3338 }
3339
3341
3342 o->ciphername = pp->ciphername;
3343 o->authname = pp->authname;
3344
3348
3349 /* Miscellaneous Options */
3350 o->comp = pp->comp;
3351 }
3352
3353 o->push_continuation = 0;
3356}
3357
3358static void
3360{
3361#ifdef _WIN32
3362 const int dev = dev_type_enum(options->dev, options->dev_type);
3363
3364 /* when using ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
3368 {
3370 }
3371
3372 if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
3373 {
3374 /* delay may only be necessary when we perform DHCP handshake */
3377 if ((options->mode == MODE_POINT_TO_POINT) && dhcp)
3378 {
3380 options->route_delay = 5; /* Vista sometimes has a race without this */
3381 }
3382 }
3383
3385 {
3387 options->ifconfig_noexec = false;
3388 }
3389
3391
3392 /*
3393 * Check consistency of --mode server options.
3394 */
3395 if (options->mode == MODE_SERVER)
3396 {
3397 /*
3398 * We need to explicitly set --tap-sleep because
3399 * we do not schedule event timers in the top-level context.
3400 */
3403 {
3405 }
3407 }
3408#endif /* ifdef _WIN32 */
3409
3410#ifdef DEFAULT_PKCS11_MODULE
3411 /* If p11-kit is present on the system then load its p11-kit-proxy.so
3412 * by default if the user asks for PKCS#11 without otherwise specifying
3413 * the module to use. */
3414 if (!options->pkcs11_providers[0]
3415 && (options->pkcs11_id || options->pkcs11_id_management))
3416 {
3417 options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
3418 }
3419#endif
3420}
3421
3422static void
3424{
3425 if (o->connection_list)
3426 {
3427 int i;
3428 for (i = 0; i < o->connection_list->len; ++i)
3429 {
3431 }
3432 }
3433 else
3434 {
3436 }
3437
3439
3440 if (dco_enabled(o) && o->enable_c2c)
3441 {
3442 msg(M_WARN, "Note: --client-to-client has no effect when using data "
3443 "channel offload: packets are always sent to the VPN "
3444 "interface and then routed based on the system routing table");
3445 }
3446}
3447
3448static void
3450{
3451 if (!o->pull && !(o->mode == MODE_SERVER))
3452 {
3453 /* If the cipher is not set, use the old default of BF-CBC. We will
3454 * warn that this is deprecated on cipher initialisation, no need
3455 * to warn here as well */
3456 if (!o->ciphername)
3457 {
3458 o->ciphername = "BF-CBC";
3459 }
3460 else
3461 {
3462 o->enable_ncp_fallback = true;
3463 }
3464 return;
3465 }
3466
3467 /* pull or P2MP mode */
3468 if (!o->ciphername)
3469 {
3470 /* We still need to set the ciphername to BF-CBC since various other
3471 * parts of OpenVPN assert that the ciphername is set */
3472 o->ciphername = "BF-CBC";
3473
3474 msg(M_INFO, "Note: --cipher is not set. OpenVPN versions before 2.5 "
3475 "defaulted to BF-CBC as fallback when cipher negotiation "
3476 "failed in this case. If you need this fallback please add "
3477 "'--data-ciphers-fallback BF-CBC' to your configuration "
3478 "and/or add BF-CBC to --data-ciphers. E.g. "
3479 "--data-ciphers %s:BF-CBC", o->ncp_ciphers_conf);
3480 }
3481 else if (!o->enable_ncp_fallback
3483 {
3484 msg(M_WARN, "DEPRECATED OPTION: --cipher set to '%s' but missing in "
3485 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
3486 "negotiations. ",
3488 }
3489}
3490
3506static bool
3507need_compatibility_before(const struct options *o, unsigned int version)
3508{
3509 return o->backwards_compatible != 0 && o->backwards_compatible < version;
3510}
3511
3516static void
3518{
3519 /* TLS min version is not set */
3520 int tls_ver_min = (o->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT)
3522 if (tls_ver_min == 0)
3523 {
3524 int tls_ver_max = (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT)
3526 if (need_compatibility_before(o, 20307))
3527 {
3528 /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
3530 }
3531 else if (tls_ver_max == 0 || tls_ver_max >= TLS_VER_1_2)
3532 {
3533 /* Use TLS 1.2 as proper default */
3535 }
3536 else
3537 {
3538 /* Maximize the minimum version */
3539 o->ssl_flags |= (tls_ver_max << SSLF_TLS_VERSION_MIN_SHIFT);
3540 }
3541 }
3542
3543 if (need_compatibility_before(o, 20400))
3544 {
3545 if (!o->ciphername)
3546 {
3547 /* If ciphername is not set default to BF-CBC when targeting these
3548 * old versions that do not have NCP */
3549 o->ciphername = "BF-CBC";
3550 }
3551 /* Versions < 2.4.0 additionally might be compiled with --enable-small and
3552 * not have OCC strings required for "poor man's NCP" */
3553 o->enable_ncp_fallback = true;
3554 }
3555
3556 /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
3557 * Version 2.4 probably does not need it but NCP was not so
3558 * good with 2.4 and ncp-disable might be more common on 2.4 peers.
3559 * Only do this iff --cipher is set (explicitly or by compat mode
3560 * < 2.4.0, see above). This is not 100% correct backwards compatible
3561 * behaviour but 2.5 already behaved like this */
3562 if (o->ciphername && need_compatibility_before(o, 20500)
3564 {
3566 }
3567
3568#ifdef USE_COMP
3569 /* Compression is deprecated and we do not want to announce support for it
3570 * by default anymore, additionally DCO breaks with compression.
3571 *
3572 * Disable compression by default starting with 2.6.0 if no other
3573 * compression related option has been explicitly set */
3574 if (!need_compatibility_before(o, 20600) && (o->comp.flags == 0))
3575 {
3576 if (!comp_non_stub_enabled(&o->comp))
3577 {
3579 }
3580 }
3581#else /* ifdef USE_COMP */
3583#endif
3584}
3585
3586static void
3588{
3589 if (!check_tls_prf_working())
3590 {
3591 msg(D_TLS_ERRORS, "Warning: TLS 1.0 PRF with MD5+SHA1 PRF is not "
3592 "supported by the TLS library. Your system does not support this "
3593 "calculation anymore or your security policy (e.g. FIPS 140-2) "
3594 "forbids it. Connections will only work with peers running "
3595 "OpenVPN 2.6.0 or higher)");
3596 if (o->mode == MODE_SERVER)
3597 {
3598 msg(M_WARN, "Automatically enabling option "
3599 "--force-tls-key-material-export");
3600 o->force_key_material_export = true;
3601 }
3602
3603 }
3604}
3605
3606static void
3608{
3609 int i;
3610 /*
3611 * Process helper-type options which map to other, more complex
3612 * sequences of options.
3613 */
3615 /* must be called after helpers that might set --mode */
3619
3623
3626 if (o->ncp_ciphers == NULL)
3627 {
3628 msg(M_USAGE, "--data-ciphers list contains unsupported ciphers or is too long.");
3629 }
3630
3631 if (o->remote_list && !o->connection_list)
3632 {
3633 /*
3634 * Convert remotes into connection list
3635 */
3636 const struct remote_list *rl = o->remote_list;
3637 for (i = 0; i < rl->len; ++i)
3638 {
3639 const struct remote_entry *re = rl->array[i];
3640 struct connection_entry ce = o->ce;
3641 struct connection_entry *ace;
3642
3643 ASSERT(re->remote);
3644 connection_entry_load_re(&ce, re);
3646 ASSERT(ace);
3647 *ace = ce;
3648 }
3649 }
3650 else if (!o->remote_list && !o->connection_list)
3651 {
3652 struct connection_entry *ace;
3654 ASSERT(ace);
3655 *ace = o->ce;
3656 }
3657
3659 for (i = 0; i < o->connection_list->len; ++i)
3660 {
3662 }
3663
3664 if (o->ce.local_list)
3665 {
3666 for (i = 0; i < o->ce.local_list->len; i++)
3667 {
3669 }
3670
3671 for (int i = 0; i < o->ce.local_list->len; i++)
3672 {
3673 if (o->ce.local_list->array[i]->proto == PROTO_TCP)
3674 {
3676 }
3677 else if (o->ce.local_list->array[i]->proto == PROTO_NONE)
3678 {
3679 o->ce.local_list->array[i]->proto = o->ce.proto;
3680 }
3681 }
3682 }
3683 else
3684 {
3685 /* if no 'local' directive was specified, convert the global port
3686 * setting to a listen entry */
3687 struct local_entry *e = alloc_local_entry(&o->ce, M_USAGE, &o->gc);
3688 ASSERT(e);
3689 e->port = o->ce.local_port;
3690 e->proto = o->ce.proto;
3691 }
3692
3693 /* use the same listen list for every outgoing connection */
3694 for (i = 0; i < o->connection_list->len; ++i)
3695 {
3697 }
3698
3699 if (o->tls_server)
3700 {
3701 if (streq(o->dh_file, "none"))
3702 {
3703 o->dh_file = NULL;
3704 }
3705 }
3706 else if (o->dh_file)
3707 {
3708 /* DH file is only meaningful in a tls-server context. */
3709 msg(M_WARN, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3710 "include this in your server configuration");
3711 o->dh_file = NULL;
3712 }
3713#if ENABLE_MANAGEMENT
3714 if (o->http_proxy_override)
3715 {
3717 }
3718#endif
3719 if (!o->ca_file && !o->ca_path && o->verify_hash
3720 && o->verify_hash_depth == 0)
3721 {
3722 msg(M_INFO, "Using certificate fingerprint to verify peer (no CA "
3723 "option set). ");
3724 o->verify_hash_no_ca = true;
3725 }
3726
3727 if (o->config && streq(o->config, "stdin") && o->remap_sigusr1 == SIGHUP)
3728 {
3729 msg(M_USAGE, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3730 "incompatible with each other.");
3731 }
3732
3733 if (dco_enabled(o))
3734 {
3735 /* check if any option should force disabling DCO */
3738 }
3739#ifdef USE_COMP
3740 if (dco_enabled(o))
3741 {
3743 }
3744#endif
3745
3746#ifdef _WIN32
3747 if (dco_enabled(o))
3748 {
3750 }
3751 else
3752 {
3753 if (o->windows_driver == DRIVER_DCO)
3754 {
3755 msg(M_WARN, "Option --windows-driver ovpn-dco is ignored because Data Channel Offload is disabled");
3757 }
3759 {
3761 }
3762 }
3763#else /* _WIN32 */
3764 if (dco_enabled(o) && o->dev_node)
3765 {
3766 msg(M_WARN, "Note: ignoring --dev-node as it has no effect when using "
3767 "data channel offload");
3768 o->dev_node = NULL;
3769 }
3770#endif /* _WIN32 */
3771
3772 /* this depends on o->windows_driver, which is set above */
3774
3775 /* check that compression settings in the options are okay */
3777
3778 /*
3779 * Save certain parms before modifying options during connect, especially
3780 * when using --pull
3781 */
3782 if (o->pull)
3783 {
3785 }
3786 else
3787 {
3788#if defined(_WIN32) || defined(TARGET_ANDROID)
3790#else
3791 foreign_options_copy_dns(o, es);
3792#endif
3793 }
3795 {
3797 }
3799}
3800
3801/*
3802 * Check file/directory sanity
3803 *
3804 */
3805#ifndef ENABLE_SMALL /* Expect people using the stripped down version to know what they do */
3806
3807#define CHKACC_FILE (1<<0)
3808#define CHKACC_DIRPATH (1<<1)
3809#define CHKACC_FILEXSTWR (1<<2)
3810#define CHKACC_ACPTSTDIN (1<<3)
3811#define CHKACC_PRIVATE (1<<4)
3812#define CHKACC_ACCEPT_URI (1<<5)
3814static bool
3815check_file_access(const int type, const char *file, const int mode, const char *opt)
3816{
3817 int errcode = 0;
3818
3819 /* If no file configured, no errors to look for */
3820 if (!file)
3821 {
3822 return false;
3823 }
3824
3825 /* If stdin is allowed and the file name is 'stdin', then do no
3826 * further checks as stdin is always available
3827 */
3828 if ( (type & CHKACC_ACPTSTDIN) && streq(file, "stdin") )
3829 {
3830 return false;
3831 }
3832
3833 /* file name is a URI if its first segment has ":" (i.e., before any "/")
3834 * Then no checks done if CHKACC_ACCEPT_URI is set and the URI does not start with "file:"
3835 */
3836 if ((type & CHKACC_ACCEPT_URI) && strchr(file, ':'))
3837 {
3838 if (!strncmp(file, "file:", 5))
3839 {
3840 file += 5;
3841 }
3842 else if (!strchr(file, '/') || strchr(file, '/') > strchr(file, ':'))
3843 {
3844 return false;
3845 }
3846 }
3847
3848 /* Is the directory path leading to the given file accessible? */
3849 if (type & CHKACC_DIRPATH)
3850 {
3851 char *fullpath = string_alloc(file, NULL); /* POSIX dirname() implementation may modify its arguments */
3852 char *dirpath = dirname(fullpath);
3853
3854 if (platform_access(dirpath, mode|X_OK) != 0)
3855 {
3856 errcode = errno;
3857 }
3858 free(fullpath);
3859 }
3860
3861 /* Is the file itself accessible? */
3862 if (!errcode && (type & CHKACC_FILE) && (platform_access(file, mode) != 0) )
3863 {
3864 errcode = errno;
3865 }
3866
3867 /* If the file exists and is accessible, is it writable? */
3868 if (!errcode && (type & CHKACC_FILEXSTWR) && (platform_access(file, F_OK) == 0) )
3869 {
3870 if (platform_access(file, W_OK) != 0)
3871 {
3872 errcode = errno;
3873 }
3874 }
3875
3876 /* Warn if a given private file is group/others accessible. */
3877 if (type & CHKACC_PRIVATE)
3878 {
3879 platform_stat_t st;
3880 if (platform_stat(file, &st))
3881 {
3882 msg(M_WARN | M_ERRNO, "WARNING: cannot stat file '%s'", file);
3883 }
3884#ifndef _WIN32
3885 else
3886 {
3887 if (st.st_mode & (S_IRWXG|S_IRWXO))
3888 {
3889 msg(M_WARN, "WARNING: file '%s' is group or others accessible", file);
3890 }
3891 }
3892#endif
3893 }
3894
3895 /* Scream if an error is found */
3896 if (errcode > 0)
3897 {
3898 msg(M_NOPREFIX | M_OPTERR | M_ERRNO, "%s fails with '%s'", opt, file);
3899 }
3900
3901 /* Return true if an error occurred */
3902 return (errcode != 0 ? true : false);
3903}
3904
3905/* A wrapper for check_file_access() which also takes a chroot directory.
3906 * If chroot is NULL, behaviour is exactly the same as calling check_file_access() directly,
3907 * otherwise it will look for the file inside the given chroot directory instead.
3908 */
3909static bool
3910check_file_access_chroot(const char *chroot, const int type, const char *file, const int mode, const char *opt)
3911{
3912 bool ret = false;
3913
3914 /* If no file configured, no errors to look for */
3915 if (!file)
3916 {
3917 return false;
3918 }
3919
3920 /* If chroot is set, look for the file/directory inside the chroot */
3921 if (chroot)
3922 {
3923 struct gc_arena gc = gc_new();
3924 struct buffer chroot_file;
3925
3926 chroot_file = prepend_dir(chroot, file, &gc);
3927 ret = check_file_access(type, BSTR(&chroot_file), mode, opt);
3928 gc_free(&gc);
3929 }
3930 else
3931 {
3932 /* No chroot in play, just call core file check function */
3933 ret = check_file_access(type, file, mode, opt);
3934 }
3935 return ret;
3936}
3937
3942static bool
3944 const int type, const char *file,
3945 const int mode, const char *opt)
3946{
3947 if (is_inline)
3948 {
3949 return false;
3950 }
3951
3952 return check_file_access_chroot(chroot, type, file, mode, opt);
3953}
3954
3959static bool
3960check_file_access_inline(bool is_inline, const int type, const char *file,
3961 const int mode, const char *opt)
3962{
3963 if (is_inline)
3964 {
3965 return false;
3966 }
3967
3968 return check_file_access(type, file, mode, opt);
3969}
3970
3971/*
3972 * Verifies that the path in the "command" that comes after certain script options (e.g., --up) is a
3973 * valid file with appropriate permissions.
3974 *
3975 * "command" consists of a path, optionally followed by a space, which may be
3976 * followed by arbitrary arguments. It is NOT a full shell command line -- shell expansion is not
3977 * performed.
3978 *
3979 * The path and arguments in "command" may be single- or double-quoted or escaped.
3980 *
3981 * The path is extracted from "command", then check_file_access() is called to check it. The
3982 * arguments, if any, are ignored.
3983 *
3984 * Note that the type, mode, and opt arguments to this routine are the same as the corresponding
3985 * check_file_access() arguments.
3986 */
3987static bool
3988check_cmd_access(const char *command, const char *opt, const char *chroot)
3989{
3990 struct argv argv;
3991 bool return_code;
3992
3993 /* If no command was set, there are no errors to look for */
3994 if (!command)
3995 {
3996 return false;
3997 }
3998
3999 /* Extract executable path and arguments */
4000 argv = argv_new();
4001 argv_parse_cmd(&argv, command);
4002
4003 /* if an executable is specified then check it; otherwise, complain */
4004 if (argv.argv[0])
4005 {
4006 /* Scripts requires R_OK as well, but that might fail on binaries which
4007 * only requires X_OK to function on Unix - a scenario not unlikely to
4008 * be seen on suid binaries.
4009 */
4010 return_code = check_file_access_chroot(chroot, CHKACC_FILE, argv.argv[0], X_OK, opt);
4011 }
4012 else
4013 {
4014 msg(M_NOPREFIX|M_OPTERR, "%s fails with '%s': No path to executable.",
4015 opt, command);
4016 return_code = true;
4017 }
4018
4019 argv_free(&argv);
4020
4021 return return_code;
4022}
4023
4024/*
4025 * Sanity check of all file/dir options. Checks that file/dir
4026 * is accessible by OpenVPN
4027 */
4028static void
4030{
4031 bool errs = false;
4032
4033 /* ** SSL/TLS/crypto related files ** */
4035 options->dh_file, R_OK, "--dh");
4036
4038 {
4040 options->ca_file, R_OK, "--ca");
4041 }
4042
4044 options->ca_path, R_OK, "--capath");
4045
4047 options->cert_file, R_OK, "--cert");
4048
4051 "--extra-certs");
4052
4054 {
4057 options->priv_key_file, R_OK, "--key");
4058 }
4059
4062 options->pkcs12_file, R_OK, "--pkcs12");
4063
4065 {
4067 options->crl_file, R_OK|X_OK,
4068 "--crl-verify directory");
4069 }
4070 else
4071 {
4075 R_OK, "--crl-verify");
4076 }
4077
4079 {
4082 W_OK, "--tls-export-cert");
4083 }
4084
4086 for (int i = 0; i < options->connection_list->len; ++i)
4087 {
4089
4092 ce->tls_auth_file, R_OK,
4093 "--tls-auth");
4096 ce->tls_crypt_file, R_OK,
4097 "--tls-crypt");
4100 ce->tls_crypt_v2_file, R_OK,
4101 "--tls-crypt-v2");
4102 }
4103
4107 "--secret");
4108
4110 options->packet_id_file, R_OK|W_OK, "--replay-persist");
4111
4112 /* ** Password files ** */
4114 options->key_pass_file, R_OK, "--askpass");
4115#ifdef ENABLE_MANAGEMENT
4118 "--management user/password file");
4119#endif /* ENABLE_MANAGEMENT */
4123 "--auth-user-pass");
4124 /* ** System related ** */
4126 R_OK|X_OK, "--chroot directory");
4128 R_OK|W_OK, "--writepid");
4129
4130 /* ** Log related ** */
4132 R_OK|W_OK, "--status");
4133
4134 /* ** Config related ** */
4136 R_OK|X_OK, "--client-config-dir");
4138 R_OK|W_OK|X_OK, "Temporary directory (--tmp-dir)");
4139
4140 if (errs)
4141 {
4142 msg(M_USAGE, "Please correct these errors.");
4143 }
4144}
4145#endif /* !ENABLE_SMALL */
4146
4147/*
4148 * Sanity check on options.
4149 * Also set some options based on other
4150 * options.
4151 */
4152void
4154{
4157#ifndef ENABLE_SMALL
4159#endif /* !ENABLE_SMALL */
4160}
4161
4162/*
4163 * Sanity check on options after more options were pulled from server.
4164 * Also time to modify some options based on other options.
4165 */
4166bool
4168{
4169 bool success = dns_options_verify(D_PUSH_ERRORS, &o->dns_options);
4170 if (success)
4171 {
4173#if defined(_WIN32) || defined(TARGET_ANDROID)
4175#else
4176 foreign_options_copy_dns(o, es);
4177#endif
4178 }
4179 return success;
4180}
4181
4182/*
4183 * Build an options string to represent data channel encryption options.
4184 * This string must match exactly between peers. The keysize is checked
4185 * separately by read_key().
4186 *
4187 * The following options must match on both peers:
4188 *
4189 * Tunnel options:
4190 *
4191 * --dev tun|tap [unit number need not match]
4192 * --dev-type tun|tap
4193 * --link-mtu
4194 * --udp-mtu
4195 * --tun-mtu
4196 * --proto udp
4197 * --proto tcp-client [matched with --proto tcp-server
4198 * on the other end of the connection]
4199 * --proto tcp-server [matched with --proto tcp-client on
4200 * the other end of the connection]
4201 * --tun-ipv6
4202 * --ifconfig x y [matched with --ifconfig y x on
4203 * the other end of the connection]
4204 *
4205 * --comp-lzo
4206 * --compress alg
4207 * --fragment
4208 *
4209 * Crypto Options:
4210 *
4211 * --cipher
4212 * --auth
4213 * --secret
4214 *
4215 * SSL Options:
4216 *
4217 * --tls-auth
4218 * --tls-client [matched with --tls-server on
4219 * the other end of the connection]
4220 * --tls-server [matched with --tls-client on
4221 * the other end of the connection]
4222 */
4223char *
4224options_string(const struct options *o,
4225 const struct frame *frame,
4226 struct tuntap *tt,
4227 openvpn_net_ctx_t *ctx,
4228 bool remote,
4229 struct gc_arena *gc)
4230{
4231 struct buffer out = alloc_buf(OPTION_LINE_SIZE);
4232 bool tt_local = false;
4233
4234 buf_printf(&out, "V4");
4235
4236 /*
4237 * Tunnel Options
4238 */
4239
4240 buf_printf(&out, ",dev-type %s", dev_type_string(o->dev, o->dev_type));
4241 /* the link-mtu that we send has only a meaning if have a fixed
4242 * cipher (p2p) or have a fallback cipher configured for older non
4243 * ncp clients. But not sending it will make even 2.4 complain
4244 * about it being missing. So still send it. */
4245 buf_printf(&out, ",link-mtu %u",
4246 (unsigned int) calc_options_string_link_mtu(o, frame));
4247
4248 if (o->ce.occ_mtu != 0)
4249 {
4250 buf_printf(&out, ",tun-mtu %d", o->ce.occ_mtu);
4251 }
4252 else
4253 {
4254 buf_printf(&out, ",tun-mtu %d", frame->tun_mtu);
4255 }
4256
4257 buf_printf(&out, ",proto %s", proto_remote(o->ce.proto, remote));
4258
4259 bool p2p_nopull = o->mode == MODE_POINT_TO_POINT && !PULL_DEFINED(o);
4260 /* send tun_ipv6 only in peer2peer mode - in client/server mode, it
4261 * is usually pushed by the server, triggering a non-helpful warning
4262 */
4263 if (o->ifconfig_ipv6_local && p2p_nopull)
4264 {
4265 buf_printf(&out, ",tun-ipv6");
4266 }
4267
4268 /*
4269 * Try to get ifconfig parameters into the options string.
4270 * If tt is undefined, make a temporary instantiation.
4271 */
4272 if (!tt)
4273 {
4274 tt = init_tun(o->dev,
4275 o->dev_type,
4276 o->topology,
4277 o->ifconfig_local,
4278 o->ifconfig_remote_netmask,
4279 o->ifconfig_ipv6_local,
4280 o->ifconfig_ipv6_netbits,
4281 o->ifconfig_ipv6_remote,
4282 NULL,
4283 NULL,
4284 false,
4285 NULL,
4286 ctx,
4287 NULL);
4288 if (tt)
4289 {
4290 tt_local = true;
4291 }
4292 }
4293
4294 if (tt && p2p_nopull)
4295 {
4296 const char *ios = ifconfig_options_string(tt, remote, o->ifconfig_nowarn, gc);
4297 if (ios && strlen(ios))
4298 {
4299 buf_printf(&out, ",ifconfig %s", ios);
4300 }
4301 }
4302 if (tt_local)
4303 {
4304 free(tt);
4305 tt = NULL;
4306 }
4307
4308#ifdef USE_COMP
4309 if (o->comp.alg != COMP_ALG_UNDEF)
4310 {
4311 buf_printf(&out, ",comp-lzo"); /* for compatibility, this simply indicates that compression context is active, not necessarily LZO per-se */
4312 }
4313#endif
4314
4315#ifdef ENABLE_FRAGMENT
4316 if (o->ce.fragment)
4317 {
4318 buf_printf(&out, ",mtu-dynamic");
4319 }
4320#endif
4321
4322#define TLS_CLIENT (o->tls_client)
4323#define TLS_SERVER (o->tls_server)
4324
4325 /*
4326 * Key direction
4327 */
4328 {
4329 const char *kd = keydirection2ascii(o->key_direction, remote, false);
4330 if (kd)
4331 {
4332 buf_printf(&out, ",keydir %s", kd);
4333 }
4334 }
4335
4336 /*
4337 * Crypto Options
4338 */
4339 if (o->shared_secret_file || TLS_CLIENT || TLS_SERVER)
4340 {
4341 struct key_type kt;
4342
4343 ASSERT((o->shared_secret_file != NULL)
4344 + (TLS_CLIENT == true)
4345 + (TLS_SERVER == true)
4346 <= 1);
4347
4348 /* Skip resolving BF-CBC to allow SSL libraries without BF-CBC
4349 * to work here in the default configuration */
4350 const char *ciphername = o->ciphername;
4351 int keysize = 0;
4352
4353 if (strcmp(o->ciphername, "BF-CBC") == 0)
4354 {
4355 init_key_type(&kt, "none", o->authname, true, false);
4356 keysize = 128;
4357 }
4358 else
4359 {
4360 init_key_type(&kt, o->ciphername, o->authname, true, false);
4361 ciphername = cipher_kt_name(kt.cipher);
4362 if (cipher_defined(o->ciphername))
4363 {
4364 keysize = cipher_kt_key_size(kt.cipher) * 8;
4365 }
4366 }
4367 /* Only announce the cipher to our peer if we are willing to
4368 * support it */
4369 if (p2p_nopull || tls_item_in_cipher_list(ciphername, o->ncp_ciphers))
4370 {
4371 buf_printf(&out, ",cipher %s", ciphername);
4372 }
4373 buf_printf(&out, ",auth %s", md_kt_name(kt.digest));
4374 buf_printf(&out, ",keysize %d", keysize);
4375 if (o->shared_secret_file)
4376 {
4377 buf_printf(&out, ",secret");
4378 }
4379
4380#ifdef ENABLE_PREDICTION_RESISTANCE
4381 if (o->use_prediction_resistance)
4382 {
4383 buf_printf(&out, ",use-prediction-resistance");
4384 }
4385#endif
4386 }
4387
4388 /*
4389 * SSL Options
4390 */
4391 {
4392 if (TLS_CLIENT || TLS_SERVER)
4393 {
4394 if (o->ce.tls_auth_file)
4395 {
4396 buf_printf(&out, ",tls-auth");
4397 }
4398 /* Not adding tls-crypt here, because we won't reach this code if
4399 * tls-auth/tls-crypt does not match. Removing tls-auth here would
4400 * break stuff, so leaving that in place. */
4401
4402 buf_printf(&out, ",key-method %d", KEY_METHOD_2);
4403 }
4404
4405 if (remote)
4406 {
4407 if (TLS_CLIENT)
4408 {
4409 buf_printf(&out, ",tls-server");
4410 }
4411 else if (TLS_SERVER)
4412 {
4413 buf_printf(&out, ",tls-client");
4414 }
4415 }
4416 else
4417 {
4418 if (TLS_CLIENT)
4419 {
4420 buf_printf(&out, ",tls-client");
4421 }
4422 else if (TLS_SERVER)
4423 {
4424 buf_printf(&out, ",tls-server");
4425 }
4426 }
4427 }
4428
4429#undef TLS_CLIENT
4430#undef TLS_SERVER
4431
4432 return BSTR(&out);
4433}
4434
4435/*
4436 * Compare option strings for equality.
4437 * If the first two chars of the strings differ, it means that
4438 * we are looking at different versions of the options string,
4439 * therefore don't compare them and return true.
4440 */
4441
4442bool
4443options_cmp_equal(char *actual, const char *expected)
4444{
4445 return options_cmp_equal_safe(actual, expected, strlen(actual) + 1);
4446}
4447
4448void
4449options_warning(char *actual, const char *expected)
4450{
4451 options_warning_safe(actual, expected, strlen(actual) + 1);
4452}
4453
4454static const char *
4455options_warning_extract_parm1(const char *option_string,
4456 struct gc_arena *gc_ret)
4457{
4458 struct gc_arena gc = gc_new();
4460 char *p = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4461 const char *ret;
4462
4463 buf_parse(&b, ' ', p, OPTION_PARM_SIZE);
4464 ret = string_alloc(p, gc_ret);
4465 gc_free(&gc);
4466 return ret;
4467}
4468
4469static void
4471 const int delim,
4472 const bool report_inconsistent,
4473 const char *p1,
4474 const struct buffer *b2_src,
4475 const char *b1_name,
4476 const char *b2_name)
4477{
4478 /* We will stop sending 'key-method', 'keydir', 'proto' and 'tls-auth' in
4479 * OCC in a future version (because it's not useful). To reduce questions
4480 * when interoperating, we no longer printing a warning about it.
4481 */
4482 if (strprefix(p1, "key-method ")
4483 || strprefix(p1, "keydir ")
4484 || strprefix(p1, "proto ")
4485 || streq(p1, "tls-auth")
4486 || strprefix(p1, "tun-ipv6")
4487 || strprefix(p1, "cipher "))
4488 {
4489 return;
4490 }
4491
4492 if (strlen(p1) > 0)
4493 {
4494 struct gc_arena gc = gc_new();
4495 struct buffer b2 = *b2_src;
4497 char *p2 = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4498
4499 while (buf_parse(&b2, delim, p2, OPTION_PARM_SIZE))
4500 {
4501 if (strlen(p2))
4502 {
4504
4505 if (!strcmp(p1, p2))
4506 {
4507 goto done;
4508 }
4509 if (!strcmp(p1_prefix, p2_prefix))
4510 {
4512 {
4513 msg(msglevel, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
4515 b1_name,
4516 safe_print(p1, &gc),
4517 b2_name,
4518 safe_print(p2, &gc));
4519 }
4520 goto done;
4521 }
4522 }
4523 }
4524
4525 msg(msglevel, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
4527 b1_name,
4528 b2_name,
4529 b1_name,
4530 safe_print(p1, &gc));
4531
4532done:
4533 gc_free(&gc);
4534 }
4535}
4536
4537static void
4539 const int delim,
4540 const bool report_inconsistent,
4541 const struct buffer *b1_src,
4542 const struct buffer *b2_src,
4543 const char *b1_name,
4544 const char *b2_name)
4545{
4546 struct gc_arena gc = gc_new();
4547 struct buffer b = *b1_src;
4548 char *p = gc_malloc(OPTION_PARM_SIZE, true, &gc);
4549
4550 while (buf_parse(&b, delim, p, OPTION_PARM_SIZE))
4551 {
4553 }
4554
4555 gc_free(&gc);
4556}
4557
4558static void
4559options_warning_safe_ml(const int msglevel, char *actual, const char *expected, size_t actual_n)
4560{
4561 struct gc_arena gc = gc_new();
4562
4563 if (actual_n > 0)
4564 {
4565 struct buffer local = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4566 struct buffer remote = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4567 actual[actual_n - 1] = 0;
4568
4569 buf_printf(&local, "version %s", expected);
4570 buf_printf(&remote, "version %s", actual);
4571
4572 options_warning_safe_scan1(msglevel, ',', true,
4573 &local, &remote,
4574 "local", "remote");
4575
4576 options_warning_safe_scan1(msglevel, ',', false,
4577 &remote, &local,
4578 "remote", "local");
4579 }
4580
4581 gc_free(&gc);
4582}
4583
4584bool
4585options_cmp_equal_safe(char *actual, const char *expected, size_t actual_n)
4586{
4587 struct gc_arena gc = gc_new();
4588 bool ret = true;
4589
4590 if (actual_n > 0)
4591 {
4592 actual[actual_n - 1] = 0;
4593 if (strncmp(actual, expected, 2))
4594 {
4595 msg(D_SHOW_OCC, "NOTE: Options consistency check may be skewed by version differences");
4596 options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4597 }
4598 else
4599 {
4600 ret = !strcmp(actual, expected);
4601 }
4602 }
4603 gc_free(&gc);
4604 return ret;
4605}
4606
4607void
4608options_warning_safe(char *actual, const char *expected, size_t actual_n)
4609{
4610 options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4611}
4612
4613const char *
4614options_string_version(const char *s, struct gc_arena *gc)
4615{
4616 struct buffer out = alloc_buf_gc(4, gc);
4617 strncpynt((char *) BPTR(&out), s, 3);
4618 return BSTR(&out);
4619}
4620
4621char *
4623 struct gc_arena *gc)
4624{
4625 char *ret = NULL;
4626 const size_t opt_name_len = strlen(opt_name);
4627
4628 const char *p = options_string;
4629 while (p)
4630 {
4631 if (0 == strncmp(p, opt_name, opt_name_len)
4632 && strlen(p) > (opt_name_len+1) && p[opt_name_len] == ' ')
4633 {
4634 /* option found, extract value */
4635 const char *start = &p[opt_name_len+1];
4636 const char *end = strchr(p, ',');
4637 size_t val_len = end ? end - start : strlen(start);
4638 ret = gc_malloc(val_len+1, true, gc);
4639 memcpy(ret, start, val_len);
4640 break;
4641 }
4642 p = strchr(p, ',');
4643 if (p)
4644 {
4645 p++; /* skip delimiter */
4646 }
4647 }
4648 return ret;
4649}
4650
4651/*
4652 * parse/print topology coding
4653 */
4654
4655int
4656parse_topology(const char *str, const int msglevel)
4657{
4658 if (streq(str, "net30"))
4659 {
4660 return TOP_NET30;
4661 }
4662 else if (streq(str, "p2p"))
4663 {
4664 return TOP_P2P;
4665 }
4666 else if (streq(str, "subnet"))
4667 {
4668 return TOP_SUBNET;
4669 }
4670 else
4671 {
4672 msg(msglevel, "--topology must be net30, p2p, or subnet");
4673 return TOP_UNDEF;
4674 }
4675}
4676
4677const char *
4678print_topology(const int topology)
4679{
4680 switch (topology)
4681 {
4682 case TOP_UNDEF:
4683 return "undef";
4684
4685 case TOP_NET30:
4686 return "net30";
4687
4688 case TOP_P2P:
4689 return "p2p";
4690
4691 case TOP_SUBNET:
4692 return "subnet";
4693
4694 default:
4695 return "unknown";
4696 }
4697}
4698
4699/*
4700 * Manage auth-retry variable
4701 */
4702
4703static int global_auth_retry; /* GLOBAL */
4704
4705int
4707{
4708 return global_auth_retry;
4709}
4710
4711bool
4712auth_retry_set(const int msglevel, const char *option)
4713{
4714 if (streq(option, "interact"))
4715 {
4717 }
4718 else if (streq(option, "nointeract"))
4719 {
4721 }
4722 else if (streq(option, "none"))
4723 {
4725 }
4726 else
4727 {
4728 msg(msglevel, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
4729 return false;
4730 }
4731 return true;
4732}
4733
4734const char *
4736{
4737 switch (global_auth_retry)
4738 {
4739 case AR_NONE:
4740 return "none";
4741
4742 case AR_NOINTERACT:
4743 return "nointeract";
4744
4745 case AR_INTERACT:
4746 return "interact";
4747
4748 default:
4749 return "???";
4750 }
4751}
4752
4753/*
4754 * Print the help message.
4755 */
4756static void
4758{
4759 FILE *fp = msg_fp(0);
4760
4761#ifdef ENABLE_SMALL
4762
4763 fprintf(fp, "Usage message not available\n");
4764
4765#else
4766
4767 struct options o;
4768 init_options(&o, true);
4769
4770 fprintf(fp, usage_message,
4776 o.verbosity,
4777 o.authname,
4781 fflush(fp);
4782
4783#endif /* ENABLE_SMALL */
4784
4785 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4786}
4787
4788void
4790{
4791 msg(M_WARN|M_NOPREFIX, "Use --help for more information.");
4792 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4793}
4794
4795#ifdef _WIN32
4796void
4797show_windows_version(const unsigned int flags)
4798{
4799 struct gc_arena gc = gc_new();
4800 msg(flags, "Windows version: %s", win32_version_string(&gc));
4801 gc_free(&gc);
4802}
4803#endif
4804
4805void
4806show_dco_version(const unsigned int flags)
4807{
4808#ifdef ENABLE_DCO
4809 struct gc_arena gc = gc_new();
4810 msg(flags, "DCO version: %s", dco_version_string(&gc));
4811 gc_free(&gc);
4812#endif
4813}
4814
4815void
4816show_library_versions(const unsigned int flags)
4817{
4818#ifdef ENABLE_LZO
4819#define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
4820#else
4821#define LZO_LIB_VER_STR "", ""
4822#endif
4823
4824 msg(flags, "library versions: %s%s%s", get_ssl_library_version(),
4826
4827#undef LZO_LIB_VER_STR
4828}
4829
4830static void
4832{
4835#ifdef _WIN32
4837#endif
4839 msg(M_INFO|M_NOPREFIX, "Originally developed by James Yonan");
4840 msg(M_INFO|M_NOPREFIX, "Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>");
4841#ifndef ENABLE_SMALL
4842#ifdef CONFIGURE_DEFINES
4843 msg(M_INFO|M_NOPREFIX, "Compile time defines: %s", CONFIGURE_DEFINES);
4844#endif
4845#ifdef CONFIGURE_SPECIAL_BUILD
4846 msg(M_INFO|M_NOPREFIX, "special build: %s", CONFIGURE_SPECIAL_BUILD);
4847#endif
4848#endif
4850}
4851
4852void
4853notnull(const char *arg, const char *description)
4854{
4855 if (!arg)
4856 {
4857 msg(M_USAGE, "You must define %s", description);
4858 }
4859}
4860
4861bool
4862string_defined_equal(const char *s1, const char *s2)
4863{
4864 if (s1 && s2)
4865 {
4866 return !strcmp(s1, s2);
4867 }
4868 else
4869 {
4870 return false;
4871 }
4872}
4873
4874#if 0
4875static void
4876ping_rec_err(int msglevel)
4877{
4878 msg(msglevel, "only one of --ping-exit or --ping-restart options may be specified");
4879}
4880#endif
4881
4882#ifdef _WIN32 /* This function is only used when compiling on Windows */
4883static unsigned int
4884atou(const char *str)
4885{
4886 unsigned int val = 0;
4887 sscanf(str, "%u", &val);
4888 return val;
4889}
4890#endif
4891
4892static inline bool
4893space(unsigned char c)
4894{
4895 return c == '\0' || isspace(c);
4896}
4897
4898int
4899parse_line(const char *line,
4900 char *p[],
4901 const int n,
4902 const char *file,
4903 const int line_num,
4904 int msglevel,
4905 struct gc_arena *gc)
4906{
4907 const int STATE_INITIAL = 0;
4908 const int STATE_READING_QUOTED_PARM = 1;
4909 const int STATE_READING_UNQUOTED_PARM = 2;
4910 const int STATE_DONE = 3;
4911 const int STATE_READING_SQUOTED_PARM = 4;
4912
4913 const char *error_prefix = "";
4914
4915 int ret = 0;
4916 const char *c = line;
4917 int state = STATE_INITIAL;
4918 bool backslash = false;
4919 char in, out;
4920
4921 char parm[OPTION_PARM_SIZE];
4922 unsigned int parm_len = 0;
4923
4924 msglevel &= ~M_OPTERR;
4925
4926 if (msglevel & M_MSG_VIRT_OUT)
4927 {
4928 error_prefix = "ERROR: ";
4929 }
4930
4931 do
4932 {
4933 in = *c;
4934 out = 0;
4935
4936 if (!backslash && in == '\\' && state != STATE_READING_SQUOTED_PARM)
4937 {
4938 backslash = true;
4939 }
4940 else
4941 {
4942 if (state == STATE_INITIAL)
4943 {
4944 if (!space(in))
4945 {
4946 if (in == ';' || in == '#') /* comment */
4947 {
4948 break;
4949 }
4950 if (!backslash && in == '\"')
4951 {
4952 state = STATE_READING_QUOTED_PARM;
4953 }
4954 else if (!backslash && in == '\'')
4955 {
4956 state = STATE_READING_SQUOTED_PARM;
4957 }
4958 else
4959 {
4960 out = in;
4961 state = STATE_READING_UNQUOTED_PARM;
4962 }
4963 }
4964 }
4965 else if (state == STATE_READING_UNQUOTED_PARM)
4966 {
4967 if (!backslash && space(in))
4968 {
4969 state = STATE_DONE;
4970 }
4971 else
4972 {
4973 out = in;
4974 }
4975 }
4976 else if (state == STATE_READING_QUOTED_PARM)
4977 {
4978 if (!backslash && in == '\"')
4979 {
4980 state = STATE_DONE;
4981 }
4982 else
4983 {
4984 out = in;
4985 }
4986 }
4987 else if (state == STATE_READING_SQUOTED_PARM)
4988 {
4989 if (in == '\'')
4990 {
4991 state = STATE_DONE;
4992 }
4993 else
4994 {
4995 out = in;
4996 }
4997 }
4998 if (state == STATE_DONE)
4999 {
5000 /* ASSERT (parm_len > 0); */
5001 p[ret] = gc_malloc(parm_len + 1, true, gc);
5002 memcpy(p[ret], parm, parm_len);
5003 p[ret][parm_len] = '\0';
5004 state = STATE_INITIAL;
5005 parm_len = 0;
5006 ++ret;
5007 }
5008
5009 if (backslash && out)
5010 {
5011 if (!(out == '\\' || out == '\"' || space(out)))
5012 {
5013#ifdef ENABLE_SMALL
5014 msg(msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix, file, line_num);
5015#else
5016 msg(msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE "\\\\static.key\"", error_prefix, file, line_num);
5017#endif
5018 return 0;
5019 }
5020 }
5021 backslash = false;
5022 }
5023
5024 /* store parameter character */
5025 if (out)
5026 {
5027 if (parm_len >= SIZE(parm))
5028 {
5029 parm[SIZE(parm) - 1] = 0;
5030 msg(msglevel, "%sOptions error: Parameter at %s:%d is too long (%d chars max): %s",
5031 error_prefix, file, line_num, (int) SIZE(parm), parm);
5032 return 0;
5033 }
5034 parm[parm_len++] = out;
5035 }
5036
5037 /* avoid overflow if too many parms in one config file line */
5038 if (ret >= n)
5039 {
5040 break;
5041 }
5042
5043 } while (*c++ != '\0');
5044
5045 if (state == STATE_READING_QUOTED_PARM)
5046 {
5047 msg(msglevel, "%sOptions error: No closing quotation (\") in %s:%d", error_prefix, file, line_num);
5048 return 0;
5049 }
5050 if (state == STATE_READING_SQUOTED_PARM)
5051 {
5052 msg(msglevel, "%sOptions error: No closing single quotation (\') in %s:%d", error_prefix, file, line_num);
5053 return 0;
5054 }
5055 if (state != STATE_INITIAL)
5056 {
5057 msg(msglevel, "%sOptions error: Residual parse state (%d) in %s:%d", error_prefix, state, file, line_num);
5058 return 0;
5059 }
5060#if 0
5061 {
5062 int i;
5063 for (i = 0; i < ret; ++i)
5064 {
5065 msg(M_INFO|M_NOPREFIX, "%s:%d ARG[%d] '%s'", file, line_num, i, p[i]);
5066 }
5067 }
5068#endif
5069 return ret;
5070}
5071
5072static void
5074{
5075 if (strlen(*p) >= 3 && !strncmp(*p, "--", 2))
5076 {
5077 *p += 2;
5078 }
5079}
5080
5081struct in_src {
5082#define IS_TYPE_FP 1
5083#define IS_TYPE_BUF 2
5084 int type;
5085 union {
5086 FILE *fp;
5088 } u;
5089};
5090
5091static bool
5092in_src_get(const struct in_src *is, char *line, const int size)
5093{
5094 if (is->type == IS_TYPE_FP)
5095 {
5096 return BOOL_CAST(fgets(line, size, is->u.fp));
5097 }
5098 else if (is->type == IS_TYPE_BUF)
5099 {
5100 bool status = buf_parse(is->u.multiline, '\n', line, size);
5101 if ((int) strlen(line) + 1 < size)
5102 {
5103 strcat(line, "\n");
5104 }
5105 return status;
5106 }
5107 else
5108 {
5109 ASSERT(0);
5110 return false;
5111 }
5112}
5113
5114static char *
5116 int *num_lines, struct gc_arena *gc)
5117{
5118 char line[OPTION_LINE_SIZE];
5119 struct buffer buf = alloc_buf(8*OPTION_LINE_SIZE);
5120 char *ret;
5121 bool endtagfound = false;
5122
5123 while (in_src_get(is, line, sizeof(line)))
5124 {
5125 (*num_lines)++;
5126 char *line_ptr = line;
5127 /* Remove leading spaces */
5128 while (isspace(*line_ptr))
5129 {
5130 line_ptr++;
5131 }
5133 {
5134 endtagfound = true;
5135 break;
5136 }
5137 if (!buf_safe(&buf, strlen(line)+1))
5138 {
5139 /* Increase buffer size */
5140 struct buffer buf2 = alloc_buf(buf.capacity * 2);
5141 ASSERT(buf_copy(&buf2, &buf));
5142 buf_clear(&buf);
5143 free_buf(&buf);
5144 buf = buf2;
5145 }
5146 buf_printf(&buf, "%s", line);
5147 }
5148 if (!endtagfound)
5149 {
5150 msg(M_FATAL, "ERROR: Endtag %s missing", close_tag);
5151 }
5152 ret = string_alloc(BSTR(&buf), gc);
5153 buf_clear(&buf);
5154 free_buf(&buf);
5155 secure_memzero(line, sizeof(line));
5156 return ret;
5157}
5158
5159static int
5160check_inline_file(struct in_src *is, char *p[], struct gc_arena *gc)
5161{
5162 int num_inline_lines = 0;
5163
5164 if (p[0] && !p[1])
5165 {
5166 char *arg = p[0];
5167 if (arg[0] == '<' && arg[strlen(arg)-1] == '>')
5168 {
5169 struct buffer close_tag;
5170
5171 arg[strlen(arg) - 1] = '\0';
5172 p[0] = string_alloc(arg + 1, gc);
5173 close_tag = alloc_buf(strlen(p[0]) + 4);
5174 buf_printf(&close_tag, "</%s>", p[0]);
5176 p[2] = NULL;
5178 }
5179 }
5180 return num_inline_lines;
5181}
5182
5183static int
5185{
5186 struct in_src is;
5187 is.type = IS_TYPE_FP;
5188 is.u.fp = fp;
5189 return check_inline_file(&is, p, gc);
5190}
5191
5192static int
5194 struct gc_arena *gc)
5195{
5196 struct in_src is;
5197 is.type = IS_TYPE_BUF;
5198 is.u.multiline = multiline;
5199 return check_inline_file(&is, p, gc);
5200}
5201
5202static void
5203add_option(struct options *options,
5204 char *p[],
5205 bool is_inline,
5206 const char *file,
5207 int line,
5208 const int level,
5209 const int msglevel,
5210 const unsigned int permission_mask,
5211 unsigned int *option_types_found,
5212 struct env_set *es);
5213
5214static void
5216 const char *file,
5217 int level,
5218 const char *top_file,
5219 const int top_line,
5220 const int msglevel,
5221 const unsigned int permission_mask,
5222 unsigned int *option_types_found,
5223 struct env_set *es)
5224{
5225 const int max_recursive_levels = 10;
5226 FILE *fp;
5227 int line_num;
5228 char line[OPTION_LINE_SIZE+1];
5229 char *p[MAX_PARMS+1];
5230
5231 ++level;
5232 if (level <= max_recursive_levels)
5233 {
5234 if (streq(file, "stdin"))
5235 {
5236 fp = stdin;
5237 }
5238 else
5239 {
5240 fp = platform_fopen(file, "r");
5241 }
5242 if (fp)
5243 {
5244 line_num = 0;
5245 while (fgets(line, sizeof(line), fp))
5246 {
5247 int offset = 0;
5248 CLEAR(p);
5249 ++line_num;
5250 if (strlen(line) == OPTION_LINE_SIZE)
5251 {
5252 msg(msglevel, "In %s:%d: Maximum option line length (%d) exceeded, line starts with %s",
5253 file, line_num, OPTION_LINE_SIZE, line);
5254 }
5255
5256 /* Ignore UTF-8 BOM at start of stream */
5257 if (line_num == 1 && strncmp(line, "\xEF\xBB\xBF", 3) == 0)
5258 {
5259 offset = 3;
5260 }
5261 if (parse_line(line + offset, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
5262 {
5263 bypass_doubledash(&p[0]);
5264 int lines_inline = check_inline_file_via_fp(fp, p, &options->gc);
5265 add_option(options, p, lines_inline, file, line_num, level,
5266 msglevel, permission_mask, option_types_found,
5267 es);
5268 line_num += lines_inline;
5269 }
5270 }
5271 if (fp != stdin)
5272 {
5273 fclose(fp);
5274 }
5275 }
5276 else
5277 {
5278 msg(msglevel, "In %s:%d: Error opening configuration file: %s", top_file, top_line, file);
5279 }
5280 }
5281 else
5282 {
5283 msg(msglevel, "In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file, top_line, file);
5284 }
5285 secure_memzero(line, sizeof(line));
5286 CLEAR(p);
5287}
5288
5289static void
5290read_config_string(const char *prefix,
5291 struct options *options,
5292 const char *config,
5293 const int msglevel,
5294 const unsigned int permission_mask,
5295 unsigned int *option_types_found,
5296 struct env_set *es)
5297{
5298 char line[OPTION_LINE_SIZE];
5299 struct buffer multiline;
5300 int line_num = 0;
5301
5302 buf_set_read(&multiline, (uint8_t *)config, strlen(config));
5303
5304 while (buf_parse(&multiline, '\n', line, sizeof(line)))
5305 {
5306 char *p[MAX_PARMS+1];
5307 CLEAR(p);
5308 ++line_num;
5309 if (parse_line(line, p, SIZE(p)-1, prefix, line_num, msglevel, &options->gc))
5310 {
5311 bypass_doubledash(&p[0]);
5312 int lines_inline = check_inline_file_via_buf(&multiline, p, &options->gc);
5313 add_option(options, p, lines_inline, prefix, line_num, 0, msglevel,
5314 permission_mask, option_types_found, es);
5316 }
5317 CLEAR(p);
5318 }
5319 secure_memzero(line, sizeof(line));
5320}
5321
5322void
5324 const int argc,
5325 char *argv[],
5326 const int msglevel,
5327 const unsigned int permission_mask,
5328 unsigned int *option_types_found,
5329 struct env_set *es)
5330{
5331 /* usage message */
5332 if (argc <= 1)
5333 {
5334 usage();
5335 }
5336
5337 /* config filename specified only? */
5338 if (argc == 2 && strncmp(argv[1], "--", 2))
5339 {
5340 char *p[MAX_PARMS+1];
5341 CLEAR(p);
5342 p[0] = "config";
5343 p[1] = argv[1];
5344 add_option(options, p, false, NULL, 0, 0, msglevel, permission_mask,
5345 option_types_found, es);
5346 }
5347 else
5348 {
5349 /* parse command line */
5350 for (int i = 1; i < argc; ++i)
5351 {
5352 char *p[MAX_PARMS+1];
5353 CLEAR(p);
5354 p[0] = argv[i];
5355 if (strncmp(p[0], "--", 2))
5356 {
5357 msg(msglevel, "I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p[0]);
5358 }
5359 else
5360 {
5361 p[0] += 2;
5362 }
5363
5364 int j;
5365 for (j = 1; j < MAX_PARMS; ++j)
5366 {
5367 if (i + j < argc)
5368 {
5369 char *arg = argv[i + j];
5370 if (strncmp(arg, "--", 2))
5371 {
5372 p[j] = arg;
5373 }
5374 else
5375 {
5376 break;
5377 }
5378 }
5379 }
5380 add_option(options, p, false, NULL, 0, 0, msglevel, permission_mask,
5381 option_types_found, es);
5382 i += j - 1;
5383 }
5384 }
5385}
5386
5395static bool
5396apply_pull_filter(const struct options *o, char *line)
5397{
5398 struct pull_filter *f;
5399
5400 if (!o->pull_filter_list)
5401 {
5402 return true;
5403 }
5404
5405 /* skip leading spaces matching the behaviour of parse_line */
5406 while (isspace(*line))
5407 {
5408 line++;
5409 }
5410
5411 for (f = o->pull_filter_list->head; f; f = f->next)
5412 {
5413 if (f->type == PUF_TYPE_ACCEPT && strncmp(line, f->pattern, f->size) == 0)
5414 {
5415 msg(D_LOW, "Pushed option accepted by filter: '%s'", line);
5416 return true;
5417 }
5418 else if (f->type == PUF_TYPE_IGNORE && strncmp(line, f->pattern, f->size) == 0)
5419 {
5420 msg(D_PUSH, "Pushed option removed by filter: '%s'", line);
5421 *line = '\0';
5422 return true;
5423 }
5424 else if (f->type == PUF_TYPE_REJECT && strncmp(line, f->pattern, f->size) == 0)
5425 {
5426 msg(M_WARN, "Pushed option rejected by filter: '%s'. Restarting.", line);
5427 *line = '\0';
5428 throw_signal_soft(SIGUSR1, "Offending option received from server");
5429 return false;
5430 }
5431 }
5432 return true;
5433}
5434
5435bool
5437 struct buffer *buf,
5438 unsigned int permission_mask,
5439 unsigned int *option_types_found,
5440 struct env_set *es)
5441{
5442 char line[OPTION_PARM_SIZE];
5443 int line_num = 0;
5444 const char *file = "[PUSH-OPTIONS]";
5445 const int msglevel = D_PUSH_ERRORS|M_OPTERR;
5446
5447 while (buf_parse(buf, ',', line, sizeof(line)))
5448 {
5449 char *p[MAX_PARMS+1];
5450 CLEAR(p);
5451 ++line_num;
5452 if (!apply_pull_filter(options, line))
5453 {
5454 return false; /* Cause push/pull error and stop push processing */
5455 }
5456 if (parse_line(line, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
5457 {
5458 add_option(options, p, false, file, line_num, 0, msglevel,
5459 permission_mask, option_types_found, es);
5460 }
5461 }
5462 return true;
5463}
5464
5465void
5467 const char *filename,
5468 int msglevel,
5469 unsigned int permission_mask,
5470 unsigned int *option_types_found,
5471 struct env_set *es)
5472{
5473 msg(D_PUSH, "OPTIONS IMPORT: reading client specific options from: %s", filename);
5475 filename,
5476 0,
5477 filename,
5478 0,
5479 msglevel,
5480 permission_mask,
5481 option_types_found,
5482 es);
5483}
5484
5485void
5487 const char *config,
5488 const int msglevel,
5489 const unsigned int permission_mask,
5490 unsigned int *option_types_found,
5491 struct env_set *es)
5492{
5493 read_config_string("[CONFIG-STRING]", options, config, msglevel, permission_mask, option_types_found, es);
5494}
5495
5496#define VERIFY_PERMISSION(mask) { \
5497 if (!verify_permission(p[0], file, line, (mask), permission_mask, \
5498 option_types_found, msglevel, options, is_inline)) \
5499 { \
5500 goto err; \
5501 } \
5502}
5503
5504static bool
5505verify_permission(const char *name,
5506 const char *file,
5507 int line,
5508 const unsigned int type,
5509 const unsigned int allowed,
5510 unsigned int *found,
5511 const int msglevel,
5512 struct options *options,
5513 bool is_inline)
5514{
5515 if (!(type & allowed))
5516 {
5517 msg(msglevel, "option '%s' cannot be used in this context (%s)", name, file);
5518 return false;
5519 }
5520
5521 if (is_inline && !(type & OPT_P_INLINE))
5522 {
5523 msg(msglevel, "option '%s' is not expected to be inline (%s:%d)", name,
5524 file, line);
5525 return false;
5526 }
5527
5528 if (found)
5529 {
5530 *found |= type;
5531 }
5532
5533#ifndef ENABLE_SMALL
5534 /* Check if this options is allowed in connection block,
5535 * but we are currently not in a connection block
5536 * unless this is a pushed option.
5537 * Parsing a connection block uses a temporary options struct without
5538 * connection_list
5539 */
5540
5542 && !(allowed & OPT_P_PULL_MODE))
5543 {
5544 if (file)
5545 {
5546 msg(M_WARN, "Option '%s' in %s:%d is ignored by previous <connection> blocks ", name, file, line);
5547 }
5548 else
5549 {
5550 msg(M_WARN, "Option '%s' is ignored by previous <connection> blocks", name);
5551 }
5552 }
5553#endif
5554 return true;
5555}
5556
5557/*
5558 * Check that an option doesn't have too
5559 * many parameters.
5560 */
5561
5562#define NM_QUOTE_HINT (1<<0)
5563
5564static bool
5565no_more_than_n_args(const int msglevel,
5566 char *p[],
5567 const int max,
5568 const unsigned int flags)
5569{
5570 const int len = string_array_len((const char **)p);
5571
5572 if (!len)
5573 {
5574 return false;
5575 }
5576
5577 if (len > max)
5578 {
5579 msg(msglevel, "the --%s directive should have at most %d parameter%s.%s",
5580 p[0],
5581 max - 1,
5582 max >= 3 ? "s" : "",
5583 (flags & NM_QUOTE_HINT) ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")." : "");
5584 return false;
5585 }
5586 else
5587 {
5588 return true;
5589 }
5590}
5591
5592static inline int
5593msglevel_forward_compatible(struct options *options, const int msglevel)
5594{
5595 return options->forward_compatible ? M_WARN : msglevel;
5596}
5597
5598static void
5600 const char **script,
5601 const char *new_script,
5602 const char *type,
5603 bool in_chroot)
5604{
5605 if (*script)
5606 {
5607 msg(M_WARN, "Multiple --%s scripts defined. "
5608 "The previously configured script is overridden.", type);
5609 }
5610 *script = new_script;
5611 options->user_script_used = true;
5612
5613#ifndef ENABLE_SMALL
5614 {
5615 char script_name[100];
5616 snprintf(script_name, sizeof(script_name),
5617 "--%s script", type);
5618
5619 if (check_cmd_access(*script, script_name, (in_chroot ? options->chroot_dir : NULL)))
5620 {
5621 msg(M_USAGE, "Please correct this error.");
5622 }
5623
5624 }
5625#endif
5626}
5627
5628static void
5630{
5631 if (comp_non_stub_enabled(info))
5632 {
5633 msg(M_WARN, "WARNING: Compression for receiving enabled. "
5634 "Compression has been used in the past to break encryption. "
5635 "Compression support is deprecated and we recommend to disable "
5636 "it completely.");
5637 }
5638}
5639
5640bool
5642{
5643 bool ret = false;
5644 ret = ret || (options->management_flags & MF_EXTERNAL_KEY);
5645#ifdef ENABLE_PKCS11
5646 ret = ret || (options->pkcs11_providers[0] != NULL);
5647#endif
5648#ifdef ENABLE_CRYPTOAPI
5649 ret = ret || options->cryptoapi_cert;
5650#endif
5651
5652 return ret;
5653}
5654
5655static void
5657 char *p[],
5658 bool is_inline,
5659 const char *file,
5660 int line,
5661 const int level,
5662 const int msglevel,
5663 const unsigned int permission_mask,
5664 unsigned int *option_types_found,
5665 struct env_set *es)
5666{
5667 struct gc_arena gc = gc_new();
5668 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
5669 int msglevel_fc = msglevel_forward_compatible(options, msglevel);
5670
5671 ASSERT(MAX_PARMS >= 7);
5672
5673 /*
5674 * If directive begins with "setenv opt" prefix, don't raise an error if
5675 * directive is unrecognized.
5676 */
5677 if (streq(p[0], "setenv") && p[1] && streq(p[1], "opt") && !(permission_mask & OPT_P_PULL_MODE))
5678 {
5679 if (!p[2])
5680 {
5681 p[2] = "setenv opt"; /* will trigger an error that includes setenv opt */
5682 }
5683 p += 2;
5684 msglevel_fc = M_WARN;
5685 }
5686
5687 if (!file)
5688 {
5689 file = "[CMD-LINE]";
5690 line = 1;
5691 }
5692 if (streq(p[0], "help"))
5693 {
5695 usage();
5696 if (p[1])
5697 {
5698 msg(msglevel, "--help does not accept any parameters");
5699 goto err;
5700 }
5701 }
5702 if (streq(p[0], "version") && !p[1])
5703 {
5705 usage_version();
5706 }
5707 else if (streq(p[0], "config") && p[1] && !p[2])
5708 {
5710
5711 /* save first config file only in options */
5712 if (!options->config)
5713 {
5714 options->config = p[1];
5715 }
5716
5717 read_config_file(options, p[1], level, file, line, msglevel, permission_mask, option_types_found, es);
5718 }
5719#if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
5720 else if (streq(p[0], "show-gateway") && !p[2])
5721 {
5722 struct route_gateway_info rgi;
5723 struct route_ipv6_gateway_info rgi6;
5724 in_addr_t remote_ipv4 = 0;
5725 struct in6_addr remote_ipv6 = IN6ADDR_ANY_INIT;
5726 openvpn_net_ctx_t net_ctx;
5728 if (p[1])
5729 {
5730 /* try parsing the argument as a v4 or v6 address - if
5731 * possible, the output will show the exact route there, and
5732 * "the default route" for the other protocol
5733 */
5734 remote_ipv4 = get_ip_addr(p[1], M_WARN, NULL);
5735 get_ipv6_addr(p[1], &remote_ipv6, NULL, M_WARN);
5736 }
5737 net_ctx_init(NULL, &net_ctx);
5738 get_default_gateway(&rgi, remote_ipv4, &net_ctx);
5739 get_default_gateway_ipv6(&rgi6, &remote_ipv6, &net_ctx);
5740 print_default_gateway(M_INFO, &rgi, &rgi6);
5741 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
5742 }
5743#endif /* if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL) */
5744 else if (streq(p[0], "echo") || streq(p[0], "parameter"))
5745 {
5746 struct buffer string = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
5747 int j;
5748 bool good = true;
5749
5751
5752 for (j = 1; j < MAX_PARMS; ++j)
5753 {
5754 if (!p[j])
5755 {
5756 break;
5757 }
5758 if (j > 1)
5759 {
5760 good &= buf_printf(&string, " ");
5761 }
5762 good &= buf_printf(&string, "%s", p[j]);
5763 }
5764 if (good)
5765 {
5766 /* only message-related ECHO are logged, since other ECHOs
5767 * can potentially include security-sensitive strings */
5768 if (p[1] && strncmp(p[1], "msg", 3) == 0)
5769 {
5770 msg(M_INFO, "%s:%s",
5771 pull_mode ? "ECHO-PULL" : "ECHO",
5772 BSTR(&string));
5773 }
5774#ifdef ENABLE_MANAGEMENT
5775 if (management)
5776 {
5778 }
5779#endif
5780 }
5781 else
5782 {
5783 msg(M_WARN, "echo/parameter option overflow");
5784 }
5785 }
5786#ifdef ENABLE_MANAGEMENT
5787 else if (streq(p[0], "management") && p[1] && p[2] && !p[4])
5788 {
5790 if (streq(p[2], "unix"))
5791 {
5792#if UNIX_SOCK_SUPPORT
5794#else
5795 msg(msglevel, "MANAGEMENT: this platform does not support unix domain sockets");
5796 goto err;
5797#endif
5798 }
5799
5802 if (p[3])
5803 {
5805 }
5806 }
5807 else if (streq(p[0], "management-client-user") && p[1] && !p[2])
5808 {
5811 }
5812 else if (streq(p[0], "management-client-group") && p[1] && !p[2])
5813 {
5816 }
5817 else if (streq(p[0], "management-query-passwords") && !p[1])
5818 {
5821 }
5822 else if (streq(p[0], "management-query-remote") && !p[1])
5823 {
5826 }
5827 else if (streq(p[0], "management-query-proxy") && !p[1])
5828 {
5831 }
5832 else if (streq(p[0], "management-hold") && !p[1])
5833 {
5836 }
5837 else if (streq(p[0], "management-signal") && !p[1])
5838 {
5841 }
5842 else if (streq(p[0], "management-forget-disconnect") && !p[1])
5843 {
5846 }
5847 else if (streq(p[0], "management-up-down") && !p[1])
5848 {
5851 }
5852 else if (streq(p[0], "management-client") && !p[1])
5853 {
5856 }
5857 else if (streq(p[0], "management-external-key"))
5858 {
5860 for (int j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
5861 {
5862 if (streq(p[j], "nopadding"))
5863 {
5865 }
5866 else if (streq(p[j], "pkcs1"))
5867 {
5869 }
5870 else if (streq(p[j], "pss"))
5871 {
5873 }
5874 else if (streq(p[j], "digest"))
5875 {
5877 }
5878 else
5879 {
5880 msg(msglevel, "Unknown management-external-key flag: %s", p[j]);
5881 }
5882 }
5883 /*
5884 * When no option is present, assume that only PKCS1
5885 * padding is supported
5886 */
5889 {
5891 }
5893 }
5894 else if (streq(p[0], "management-external-cert") && p[1] && !p[2])
5895 {
5899 }
5900 else if (streq(p[0], "management-client-auth") && !p[1])
5901 {
5904 }
5905 else if (streq(p[0], "management-log-cache") && p[1] && !p[2])
5906 {
5907 int cache;
5908
5910 cache = atoi_warn(p[1], msglevel);
5911 if (cache < 1)
5912 {
5913 msg(msglevel, "--management-log-cache parameter is out of range");
5914 goto err;
5915 }
5917 }
5918#endif /* ifdef ENABLE_MANAGEMENT */
5919#ifdef ENABLE_PLUGIN
5920 else if (streq(p[0], "plugin") && p[1])
5921 {
5923 if (!options->plugin_list)
5924 {
5926 }
5928 {
5929 msg(msglevel, "plugin add failed: %s", p[1]);
5930 goto err;
5931 }
5932 }
5933#endif
5934 else if (streq(p[0], "mode") && p[1] && !p[2])
5935 {
5937 if (streq(p[1], "p2p"))
5938 {
5940 }
5941 else if (streq(p[1], "server"))
5942 {
5944 }
5945 else
5946 {
5947 msg(msglevel, "Bad --mode parameter: %s", p[1]);
5948 goto err;
5949 }
5950 }
5951 else if (streq(p[0], "dev") && p[1] && !p[2])
5952 {
5954 options->dev = p[1];
5955 }
5956 else if (streq(p[0], "dev-type") && p[1] && !p[2])
5957 {
5959 options->dev_type = p[1];
5960 }
5961#ifdef _WIN32
5962 else if (streq(p[0], "windows-driver") && p[1] && !p[2])
5963 {
5965 msg(M_WARN, "DEPRECATED OPTION: windows-driver: In OpenVPN 2.7, the default Windows driver is ovpn-dco. "
5966 "If incompatible options are used, OpenVPN will fall back to tap-windows6. Wintun support has been removed.");
5967 }
5968#endif
5969 else if (streq(p[0], "disable-dco"))
5970 {
5971 options->disable_dco = true;
5972 }
5973 else if (streq(p[0], "dev-node") && p[1] && !p[2])
5974 {
5976 options->dev_node = p[1];
5977 }
5978 else if (streq(p[0], "lladdr") && p[1] && !p[2])
5979 {
5981 if (mac_addr_safe(p[1])) /* MAC address only */
5982 {
5983 options->lladdr = p[1];
5984 }
5985 else
5986 {
5987 msg(msglevel, "lladdr parm '%s' must be a MAC address", p[1]);
5988 goto err;
5989 }
5990 }
5991 else if (streq(p[0], "topology") && p[1] && !p[2])
5992 {
5994 options->topology = parse_topology(p[1], msglevel);
5995 }
5996 else if (streq(p[0], "tun-ipv6") && !p[1])
5997 {
5998 if (!pull_mode)
5999 {
6000 msg(M_WARN, "Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.");
6001 }
6002 }
6003#ifdef ENABLE_IPROUTE
6004 else if (streq(p[0], "iproute") && p[1] && !p[2])
6005 {
6007 iproute_path = p[1];
6008 }
6009#endif
6010 else if (streq(p[0], "ifconfig") && p[1] && p[2] && !p[3])
6011 {
6013 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn) && ip_or_dns_addr_safe(p[2], options->allow_pull_fqdn)) /* FQDN -- may be DNS name */
6014 {
6015 options->ifconfig_local = p[1];
6017 }
6018 else
6019 {
6020 msg(msglevel, "ifconfig parms '%s' and '%s' must be valid addresses", p[1], p[2]);
6021 goto err;
6022 }
6023 }
6024 else if (streq(p[0], "ifconfig-ipv6") && p[1] && p[2] && !p[3])
6025 {
6026 unsigned int netbits;
6027
6029 if (get_ipv6_addr( p[1], NULL, &netbits, msglevel )
6030 && ipv6_addr_safe( p[2] ) )
6031 {
6033 {
6034 msg( msglevel, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'", netbits );
6035 goto err;
6036 }
6037
6039 options->ifconfig_ipv6_netbits = netbits;
6041 }
6042 else
6043 {
6044 msg(msglevel, "ifconfig-ipv6 parms '%s' and '%s' must be valid addresses", p[1], p[2]);
6045 goto err;
6046 }
6047 }
6048 else if (streq(p[0], "ifconfig-noexec") && !p[1])
6049 {
6051 options->ifconfig_noexec = true;
6052 }
6053 else if (streq(p[0], "ifconfig-nowarn") && !p[1])
6054 {
6056 options->ifconfig_nowarn = true;
6057 }
6058 else if (streq(p[0], "local") && p[1] && !p[4])
6059 {
6060 struct local_entry *e;
6061
6063
6065 ASSERT(e);
6066
6067 /* '*' is treated as 'ask the system to get some socket',
6068 * therefore force binding on a particular address only when
6069 * actually specified. */
6070 if (strcmp(p[1], "*") != 0)
6071 {
6072 e->local = p[1];
6073 }
6074
6075 if (p[2])
6076 {
6077 e->port = p[2];
6078 }
6079
6080 if (p[3])
6081 {
6082 e->proto = ascii2proto(p[3]);
6083 }
6084 }
6085 else if (streq(p[0], "remote-random") && !p[1])
6086 {
6088 options->remote_random = true;
6089 }
6090 else if (streq(p[0], "connection") && p[1] && !p[3])
6091 {
6093 if (is_inline)
6094 {
6095 struct options sub;
6096 struct connection_entry *e;
6097
6098 init_options(&sub, true);
6099 sub.ce = options->ce;
6100 read_config_string("[CONNECTION-OPTIONS]", &sub, p[1], msglevel,
6101 OPT_P_CONNECTION, option_types_found, es);
6102 if (!sub.ce.remote)
6103 {
6104 msg(msglevel, "Each 'connection' block must contain exactly one 'remote' directive");
6105 uninit_options(&sub);
6106 goto err;
6107 }
6108
6109 e = alloc_connection_entry(options, msglevel);
6110 if (!e)
6111 {
6112 uninit_options(&sub);
6113 goto err;
6114 }
6115 *e = sub.ce;
6116 gc_transfer(&options->gc, &sub.gc);
6117 uninit_options(&sub);
6118 }
6119 }
6120 else if (streq(p[0], "ignore-unknown-option") && p[1])
6121 {
6122 int i;
6123 int j;
6124 int numignored = 0;
6125 const char **ignore;
6126
6128 /* Find out how many options to be ignored */
6129 for (i = 1; p[i]; i++)
6130 {
6131 numignored++;
6132 }
6133
6134 /* add number of options already ignored */
6135 for (i = 0; options->ignore_unknown_option
6136 && options->ignore_unknown_option[i]; i++)
6137 {
6138 numignored++;
6139 }
6140
6141 /* Allocate array */
6142 ALLOC_ARRAY_GC(ignore, const char *, numignored+1, &options->gc);
6143 for (i = 0; options->ignore_unknown_option
6144 && options->ignore_unknown_option[i]; i++)
6145 {
6146 ignore[i] = options->ignore_unknown_option[i];
6147 }
6148
6150
6151 for (j = 1; p[j]; j++)
6152 {
6153 /* Allow the user to specify ignore-unknown-option --opt too */
6154 if (p[j][0]=='-' && p[j][1]=='-')
6155 {
6156 options->ignore_unknown_option[i] = (p[j]+2);
6157 }
6158 else
6159 {
6160 options->ignore_unknown_option[i] = p[j];
6161 }
6162 i++;
6163 }
6164
6165 options->ignore_unknown_option[i] = NULL;
6166 }
6167#if ENABLE_MANAGEMENT
6168 else if (streq(p[0], "http-proxy-override") && p[1] && p[2] && !p[4])
6169 {
6173 {
6174 goto err;
6175 }
6176 }
6177#endif
6178 else if (streq(p[0], "remote") && p[1] && !p[4])
6179 {
6180 struct remote_entry re;
6181 re.remote = re.remote_port = NULL;
6182 re.proto = -1;
6183 re.af = 0;
6184
6186 re.remote = p[1];
6187 if (p[2])
6188 {
6189 re.remote_port = p[2];
6190 if (p[3])
6191 {
6192 const int proto = ascii2proto(p[3]);
6193 const sa_family_t af = ascii2af(p[3]);
6194 if (proto < 0)
6195 {
6196 msg(msglevel,
6197 "remote: bad protocol associated with host %s: '%s'",
6198 p[1], p[3]);
6199 goto err;
6200 }
6201 re.proto = proto;
6202 re.af = af;
6203 }
6204 }
6205 if (permission_mask & OPT_P_GENERAL)
6206 {
6207 struct remote_entry *e = alloc_remote_entry(options, msglevel);
6208 if (!e)
6209 {
6210 goto err;
6211 }
6212 *e = re;
6213 }
6214 else if (permission_mask & OPT_P_CONNECTION)
6215 {
6217 }
6218 }
6219 else if (streq(p[0], "resolv-retry") && p[1] && !p[2])
6220 {
6222 if (streq(p[1], "infinite"))
6223 {
6225 }
6226 else
6227 {
6228 options->resolve_retry_seconds = positive_atoi(p[1], msglevel);
6229 }
6230 }
6231 else if ((streq(p[0], "preresolve") || streq(p[0], "ip-remote-hint")) && !p[2])
6232 {
6235 /* Note the ip-remote-hint and the argument p[1] are for
6236 * backward compatibility */
6237 if (p[1])
6238 {
6239 options->ip_remote_hint = p[1];
6240 }
6241 }
6242 else if (streq(p[0], "connect-retry") && p[1] && !p[3])
6243 {
6245 options->ce.connect_retry_seconds = positive_atoi(p[1], msglevel);
6246 /*
6247 * Limit the base value of retry wait interval to 16 bits to avoid
6248 * overflow when scaled up for exponential backoff
6249 */
6250 if (options->ce.connect_retry_seconds > 0xFFFF)
6251 {
6253 msg(M_WARN, "connect retry wait interval truncated to %d",
6255 }
6256
6257 if (p[2])
6258 {
6261 }
6262 }
6263 else if ((streq(p[0], "connect-timeout") || streq(p[0], "server-poll-timeout"))
6264 && p[1] && !p[2])
6265 {
6267 options->ce.connect_timeout = positive_atoi(p[1], msglevel);
6268 }
6269 else if (streq(p[0], "connect-retry-max") && p[1] && !p[2])
6270 {
6272 options->connect_retry_max = positive_atoi(p[1], msglevel);
6273 }
6274 else if (streq(p[0], "ipchange") && p[1])
6275 {
6277 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6278 {
6279 goto err;
6280 }
6282 &options->ipchange,
6283 string_substitute(p[1], ',', ' ', &options->gc),
6284 "ipchange", true);
6285 }
6286 else if (streq(p[0], "float") && !p[1])
6287 {
6289 options->ce.remote_float = true;
6290 }
6291#ifdef ENABLE_DEBUG
6292 else if (streq(p[0], "gremlin") && p[1] && !p[2])
6293 {
6295 options->gremlin = positive_atoi(p[1], msglevel);
6296 }
6297#endif
6298 else if (streq(p[0], "chroot") && p[1] && !p[2])
6299 {
6301 options->chroot_dir = p[1];
6302 }
6303 else if (streq(p[0], "cd") && p[1] && !p[2])
6304 {
6306 if (platform_chdir(p[1]))
6307 {
6308 msg(M_ERR, "cd to '%s' failed", p[1]);
6309 goto err;
6310 }
6311 options->cd_dir = p[1];
6312 }
6313#ifdef ENABLE_SELINUX
6314 else if (streq(p[0], "setcon") && p[1] && !p[2])
6315 {
6317 options->selinux_context = p[1];
6318 }
6319#endif
6320 else if (streq(p[0], "writepid") && p[1] && !p[2])
6321 {
6323 options->writepid = p[1];
6324 }
6325 else if (streq(p[0], "up") && p[1])
6326 {
6328 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6329 {
6330 goto err;
6331 }
6332 set_user_script(options, &options->up_script, p[1], "up", false);
6333 }
6334 else if (streq(p[0], "down") && p[1])
6335 {
6337 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6338 {
6339 goto err;
6340 }
6341 set_user_script(options, &options->down_script, p[1], "down", true);
6342 }
6343 else if (streq(p[0], "down-pre") && !p[1])
6344 {
6346 options->down_pre = true;
6347 }
6348 else if (streq(p[0], "up-delay") && !p[1])
6349 {
6351 options->up_delay = true;
6352 }
6353 else if (streq(p[0], "up-restart") && !p[1])
6354 {
6356 options->up_restart = true;
6357 }
6358 else if (streq(p[0], "syslog") && !p[2])
6359 {
6361 open_syslog(p[1], false);
6362 }
6363 else if (streq(p[0], "daemon") && !p[2])
6364 {
6365 bool didit = false;
6367 if (!options->daemon)
6368 {
6369 options->daemon = didit = true;
6370 open_syslog(p[1], false);
6371 }
6372 if (p[1])
6373 {
6374 if (!didit)
6375 {
6376 msg(M_WARN, "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)", p[1]);
6377 goto err;
6378 }
6379 }
6380 }
6381 else if (streq(p[0], "log") && p[1] && !p[2])
6382 {
6384 options->log = true;
6385 redirect_stdout_stderr(p[1], false);
6386 }
6387 else if (streq(p[0], "suppress-timestamps") && !p[1])
6388 {
6392 }
6393 else if (streq(p[0], "machine-readable-output") && !p[1])
6394 {
6398 }
6399 else if (streq(p[0], "log-append") && p[1] && !p[2])
6400 {
6402 options->log = true;
6403 redirect_stdout_stderr(p[1], true);
6404 }
6405#ifdef ENABLE_MEMSTATS
6406 else if (streq(p[0], "memstats") && p[1] && !p[2])
6407 {
6409 options->memstats_fn = p[1];
6410 }
6411#endif
6412 else if (streq(p[0], "mlock") && !p[1])
6413 {
6415 options->mlock = true;
6416 }
6417#if ENABLE_IP_PKTINFO
6418 else if (streq(p[0], "multihome") && !p[1])
6419 {
6422 }
6423#endif
6424 else if (streq(p[0], "verb") && p[1] && !p[2])
6425 {
6427 options->verbosity = positive_atoi(p[1], msglevel);
6429 {
6430 /* We pass this flag to the SSL library to avoid
6431 * mbed TLS always generating debug level logging */
6433 }
6434#if !defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
6435 /* Warn when a debug verbosity is supplied when built without debug support */
6436 if (options->verbosity >= 7)
6437 {
6438 msg(M_WARN, "NOTE: debug verbosity (--verb %d) is enabled but this build lacks debug support.",
6440 }
6441#endif
6442 }
6443 else if (streq(p[0], "mute") && p[1] && !p[2])
6444 {
6446 options->mute = positive_atoi(p[1], msglevel);
6447 }
6448 else if (streq(p[0], "errors-to-stderr") && !p[1])
6449 {
6452 }
6453 else if (streq(p[0], "status") && p[1] && !p[3])
6454 {
6456 options->status_file = p[1];
6457 if (p[2])
6458 {
6460 }
6461 }
6462 else if (streq(p[0], "status-version") && p[1] && !p[2])
6463 {
6464 int version;
6465
6467 version = atoi_warn(p[1], msglevel);
6468 if (version < 1 || version > 3)
6469 {
6470 msg(msglevel, "--status-version must be 1 to 3");
6471 goto err;
6472 }
6473 options->status_file_version = version;
6474 }
6475 else if (streq(p[0], "remap-usr1") && p[1] && !p[2])
6476 {
6478 if (streq(p[1], "SIGHUP"))
6479 {
6480 options->remap_sigusr1 = SIGHUP;
6481 }
6482 else if (streq(p[1], "SIGTERM"))
6483 {
6484 options->remap_sigusr1 = SIGTERM;
6485 }
6486 else
6487 {
6488 msg(msglevel, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
6489 goto err;
6490 }
6491 }
6492 else if ((streq(p[0], "link-mtu") || streq(p[0], "udp-mtu")) && p[1] && !p[2])
6493 {
6495 options->ce.link_mtu = positive_atoi(p[1], msglevel);
6496 options->ce.link_mtu_defined = true;
6497 }
6498 else if (streq(p[0], "tun-mtu") && p[1] && !p[3])
6499 {
6501 options->ce.tun_mtu = positive_atoi(p[1], msglevel);
6502 options->ce.tun_mtu_defined = true;
6503 if (p[2])
6504 {
6505 options->ce.occ_mtu = positive_atoi(p[2], msglevel);
6506 }
6507 else
6508 {
6509 options->ce.occ_mtu = 0;
6510 }
6511 }
6512 else if (streq(p[0], "tun-mtu-max") && p[1] && !p[3])
6513 {
6515 int max_mtu = positive_atoi(p[1], msglevel);
6516 if (max_mtu < 68 || max_mtu > 65536)
6517 {
6518 msg(msglevel, "--tun-mtu-max value '%s' is invalid", p[1]);
6519 }
6520 else
6521 {
6522 options->ce.tun_mtu_max = max_mtu;
6523 }
6524 }
6525 else if (streq(p[0], "tun-mtu-extra") && p[1] && !p[2])
6526 {
6528 options->ce.tun_mtu_extra = positive_atoi(p[1], msglevel);
6530 }
6531 else if (streq(p[0], "max-packet-size") && p[1] && !p[2])
6532 {
6534 int maxmtu = positive_atoi(p[1], msglevel);
6536
6537 if (maxmtu < TLS_CHANNEL_MTU_MIN || maxmtu > TLS_CHANNEL_BUF_SIZE)
6538 {
6539 msg(M_WARN, "Note: max-packet-size value outside of allowed "
6540 "control channel packet size (%d to %d), will use %d "
6542 options->ce.tls_mtu);
6543 }
6544
6545 /* also set mssfix maxmtu mtu */
6546 options->ce.mssfix = maxmtu;
6547 options->ce.mssfix_default = false;
6548 options->ce.mssfix_encap = true;
6549 }
6550#ifdef ENABLE_FRAGMENT
6551 else if (streq(p[0], "mtu-dynamic"))
6552 {
6554 msg(msglevel, "--mtu-dynamic has been replaced by --fragment");
6555 goto err;
6556 }
6557 else if (streq(p[0], "fragment") && p[1] && !p[3])
6558 {
6560 options->ce.fragment = positive_atoi(p[1], msglevel);
6561
6562 if (options->ce.fragment < 68)
6563 {
6564 msg(msglevel, "--fragment needs to be at least 68");
6565 goto err;
6566 }
6567
6568 if (p[2] && streq(p[2], "mtu"))
6569 {
6570 options->ce.fragment_encap = true;
6571 }
6572 else if (p[2])
6573 {
6574 msg(msglevel, "Unknown parameter to --fragment: %s", p[2]);
6575 }
6576 }
6577#endif /* ifdef ENABLE_FRAGMENT */
6578 else if (streq(p[0], "mtu-disc") && p[1] && !p[2])
6579 {
6582 }
6583 else if (streq(p[0], "mtu-test") && !p[1])
6584 {
6586 options->mtu_test = true;
6587 }
6588 else if (streq(p[0], "nice") && p[1] && !p[2])
6589 {
6591 options->nice = atoi_warn(p[1], msglevel);
6592 }
6593 else if (streq(p[0], "rcvbuf") && p[1] && !p[2])
6594 {
6596 options->rcvbuf = positive_atoi(p[1], msglevel);
6597 }
6598 else if (streq(p[0], "sndbuf") && p[1] && !p[2])
6599 {
6601 options->sndbuf = positive_atoi(p[1], msglevel);
6602 }
6603 else if (streq(p[0], "mark") && p[1] && !p[2])
6604 {
6605#if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
6607 options->mark = atoi_warn(p[1], msglevel);
6608#endif
6609 }
6610 else if (streq(p[0], "socket-flags"))
6611 {
6612 int j;
6614 for (j = 1; j < MAX_PARMS && p[j]; ++j)
6615 {
6616 if (streq(p[j], "TCP_NODELAY"))
6617 {
6619 }
6620 else
6621 {
6622 msg(msglevel, "unknown socket flag: %s", p[j]);
6623 }
6624 }
6625 }
6626#ifdef TARGET_LINUX
6627 else if (streq(p[0], "bind-dev") && p[1])
6628 {
6630 options->bind_dev = p[1];
6631 }
6632#endif
6633 else if (streq(p[0], "txqueuelen") && p[1] && !p[2])
6634 {
6636#ifdef TARGET_LINUX
6637 options->tuntap_options.txqueuelen = positive_atoi(p[1], msglevel);
6638#else
6639 msg(msglevel, "--txqueuelen not supported on this OS");
6640 goto err;
6641#endif
6642 }
6643 else if (streq(p[0], "shaper") && p[1] && !p[2])
6644 {
6645 int shaper;
6646
6648 shaper = atoi_warn(p[1], msglevel);
6649 if (shaper < SHAPER_MIN || shaper > SHAPER_MAX)
6650 {
6651 msg(msglevel, "Bad shaper value, must be between %d and %d",
6653 goto err;
6654 }
6656 }
6657 else if (streq(p[0], "port") && p[1] && !p[2])
6658 {
6661 }
6662 else if (streq(p[0], "lport") && p[1] && !p[2])
6663 {
6665
6666 /* only trigger bind() if port is not 0 (or --local is used) */
6667 if (!streq(p[1], "0"))
6668 {
6670 }
6671 options->ce.local_port = p[1];
6672 }
6673 else if (streq(p[0], "rport") && p[1] && !p[2])
6674 {
6676 options->ce.remote_port = p[1];
6677 }
6678 else if (streq(p[0], "bind") && !p[2])
6679 {
6681 options->ce.bind_defined = true;
6682 if (p[1] && streq(p[1], "ipv6only"))
6683 {
6684 options->ce.bind_ipv6_only = true;
6685 }
6686
6687 }
6688 else if (streq(p[0], "nobind") && !p[1])
6689 {
6691 options->ce.bind_local = false;
6692 }
6693 else if (streq(p[0], "fast-io") && !p[1])
6694 {
6696 options->fast_io = true;
6697 }
6698 else if (streq(p[0], "inactive") && p[1] && !p[3])
6699 {
6701 options->inactivity_timeout = positive_atoi(p[1], msglevel);
6702 if (p[2])
6703 {
6704 int64_t val = atoll(p[2]);
6705 options->inactivity_minimum_bytes = (val < 0) ? 0 : val;
6706 if (options->inactivity_minimum_bytes > INT_MAX)
6707 {
6708 msg(M_WARN, "WARNING: '--inactive' with a 'bytes' value"
6709 " >2 Gbyte was silently ignored in older versions. If "
6710 " your VPN exits unexpectedly with 'Inactivity timeout'"
6711 " in %d seconds, revisit this value.",
6713 }
6714 }
6715 }
6716 else if (streq(p[0], "session-timeout") && p[1] && !p[2])
6717 {
6719 options->session_timeout = positive_atoi(p[1], msglevel);
6720 }
6721 else if (streq(p[0], "proto") && p[1] && !p[2])
6722 {
6723 int proto;
6726 proto = ascii2proto(p[1]);
6727 af = ascii2af(p[1]);
6728 if (proto < 0)
6729 {
6730 msg(msglevel,
6731 "Bad protocol: '%s'. Allowed protocols with --proto option: %s",
6732 p[1],
6734 goto err;
6735 }
6736 options->ce.proto = proto;
6737 options->ce.af = af;
6738 }
6739 else if (streq(p[0], "proto-force") && p[1] && !p[2])
6740 {
6741 int proto_force;
6743 proto_force = ascii2proto(p[1]);
6744 if (proto_force < 0)
6745 {
6746 msg(msglevel, "Bad --proto-force protocol: '%s'", p[1]);
6747 goto err;
6748 }
6749 options->proto_force = proto_force;
6750 }
6751 else if (streq(p[0], "http-proxy") && p[1] && !p[5])
6752 {
6753 struct http_proxy_options *ho;
6754
6756
6757 {
6758 if (!p[2])
6759 {
6760 msg(msglevel, "http-proxy port number not defined");
6761 goto err;
6762 }
6763
6765
6766 ho->server = p[1];
6767 ho->port = p[2];
6768 }
6769
6770 if (p[3])
6771 {
6772 /* auto -- try to figure out proxy addr, port, and type automatically */
6773 /* auto-nct -- disable proxy auth cleartext protocols (i.e. basic auth) */
6774 if (streq(p[3], "auto"))
6775 {
6776 ho->auth_retry = PAR_ALL;
6777 }
6778 else if (streq(p[3], "auto-nct"))
6779 {
6780 ho->auth_retry = PAR_NCT;
6781 }
6782 else
6783 {
6784 ho->auth_method_string = "basic";
6785 ho->auth_file = p[3];
6786
6787 if (p[4])
6788 {
6789 ho->auth_method_string = p[4];
6790 }
6791 }
6792 }
6793 else
6794 {
6795 ho->auth_method_string = "none";
6796 }
6797 }
6798 else if (streq(p[0], "http-proxy-user-pass") && p[1])
6799 {
6800 struct http_proxy_options *ho;
6803 ho->auth_file_up = p[1];
6804 ho->inline_creds = is_inline;
6805 }
6806 else if (streq(p[0], "http-proxy-retry") || streq(p[0], "socks-proxy-retry"))
6807 {
6809 msg(M_WARN, "DEPRECATED OPTION: http-proxy-retry and socks-proxy-retry: "
6810 "In OpenVPN 2.4 proxy connection retries are handled like regular connections. "
6811 "Use connect-retry-max 1 to get a similar behavior as before.");
6812 }
6813 else if (streq(p[0], "http-proxy-timeout") && p[1] && !p[2])
6814 {
6816 msg(M_WARN, "DEPRECATED OPTION: http-proxy-timeout: In OpenVPN 2.4 the timeout until a connection to a "
6817 "server is established is managed with a single timeout set by connect-timeout");
6818 }
6819 else if (streq(p[0], "http-proxy-option") && p[1] && !p[4])
6820 {
6821 struct http_proxy_options *ho;
6822
6825
6826 if (streq(p[1], "VERSION") && p[2] && !p[3])
6827 {
6828 ho->http_version = p[2];
6829 }
6830 else if (streq(p[1], "AGENT") && p[2] && !p[3])
6831 {
6832 ho->user_agent = p[2];
6833 }
6834 else if ((streq(p[1], "EXT1") || streq(p[1], "EXT2") || streq(p[1], "CUSTOM-HEADER"))
6835 && p[2])
6836 {
6837 /* In the wild patched versions use both EXT1/2 and CUSTOM-HEADER
6838 * with either two argument or one */
6839
6840 struct http_custom_header *custom_header = NULL;
6841 int i;
6842 /* Find the first free header */
6843 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER; i++)
6844 {
6845 if (!ho->custom_headers[i].name)
6846 {
6847 custom_header = &ho->custom_headers[i];
6848 break;
6849 }
6850 }
6851 if (!custom_header)
6852 {
6853 msg(msglevel, "Cannot use more than %d http-proxy-option CUSTOM-HEADER : '%s'", MAX_CUSTOM_HTTP_HEADER, p[1]);
6854 }
6855 else
6856 {
6857 /* We will save p[2] and p[3], the proxy code will detect if
6858 * p[3] is NULL */
6859 custom_header->name = p[2];
6860 custom_header->content = p[3];
6861 }
6862 }
6863 else
6864 {
6865 msg(msglevel, "Bad http-proxy-option or missing or extra parameter: '%s'", p[1]);
6866 }
6867 }
6868 else if (streq(p[0], "socks-proxy") && p[1] && !p[4])
6869 {
6871
6872 if (p[2])
6873 {
6874 options->ce.socks_proxy_port = p[2];
6875 }
6876 else
6877 {
6878 options->ce.socks_proxy_port = "1080";
6879 }
6881 options->ce.socks_proxy_authfile = p[3]; /* might be NULL */
6882 }
6883 else if (streq(p[0], "keepalive") && p[1] && p[2] && !p[3])
6884 {
6886 options->keepalive_ping = atoi_warn(p[1], msglevel);
6887 options->keepalive_timeout = atoi_warn(p[2], msglevel);
6888 }
6889 else if (streq(p[0], "ping") && p[1] && !p[2])
6890 {
6892 options->ping_send_timeout = positive_atoi(p[1], msglevel);
6893 }
6894 else if (streq(p[0], "ping-exit") && p[1] && !p[2])
6895 {
6897 options->ping_rec_timeout = positive_atoi(p[1], msglevel);
6899 }
6900 else if (streq(p[0], "ping-restart") && p[1] && !p[2])
6901 {
6903 options->ping_rec_timeout = positive_atoi(p[1], msglevel);
6905 }
6906 else if (streq(p[0], "ping-timer-rem") && !p[1])
6907 {
6909 options->ping_timer_remote = true;
6910 }
6911 else if (streq(p[0], "explicit-exit-notify") && !p[2])
6912 {
6914 if (p[1])
6915 {
6917 }
6918 else
6919 {
6921 }
6922 }
6923 else if (streq(p[0], "persist-tun") && !p[1])
6924 {
6926 options->persist_tun = true;
6927 }
6928 else if (streq(p[0], "persist-key") && !p[1])
6929 {
6931 msg(M_WARN, "DEPRECATED: --persist-key option ignored. "
6932 "Keys are now always persisted across restarts. ");
6933 }
6934 else if (streq(p[0], "persist-local-ip") && !p[1])
6935 {
6937 options->persist_local_ip = true;
6938 }
6939 else if (streq(p[0], "persist-remote-ip") && !p[1])
6940 {
6942 options->persist_remote_ip = true;
6943 }
6944 else if (streq(p[0], "client-nat") && p[1] && p[2] && p[3] && p[4] && !p[5])
6945 {
6948 add_client_nat_to_option_list(options->client_nat, p[1], p[2], p[3], p[4], msglevel);
6949 }
6950 else if (streq(p[0], "route") && p[1] && !p[5])
6951 {
6954 if (pull_mode)
6955 {
6956 if (!ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn) && !is_special_addr(p[1])) /* FQDN -- may be DNS name */
6957 {
6958 msg(msglevel, "route parameter network/IP '%s' must be a valid address", p[1]);
6959 goto err;
6960 }
6961 if (p[2] && !ip_addr_dotted_quad_safe(p[2])) /* FQDN -- must be IP address */
6962 {
6963 msg(msglevel, "route parameter netmask '%s' must be an IP address", p[2]);
6964 goto err;
6965 }
6966 if (p[3] && !ip_or_dns_addr_safe(p[3], options->allow_pull_fqdn) && !is_special_addr(p[3])) /* FQDN -- may be DNS name */
6967 {
6968 msg(msglevel, "route parameter gateway '%s' must be a valid address", p[3]);
6969 goto err;
6970 }
6971 }
6972 add_route_to_option_list(options->routes, p[1], p[2], p[3], p[4]);
6973 }
6974 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
6975 {
6978 if (pull_mode)
6979 {
6980 if (!ipv6_addr_safe_hexplusbits(p[1]))
6981 {
6982 msg(msglevel, "route-ipv6 parameter network/IP '%s' must be a valid address", p[1]);
6983 goto err;
6984 }
6985 if (p[2] && !ipv6_addr_safe(p[2]))
6986 {
6987 msg(msglevel, "route-ipv6 parameter gateway '%s' must be a valid address", p[2]);
6988 goto err;
6989 }
6990 /* p[3] is metric, if present */
6991 }
6993 }
6994 else if (streq(p[0], "max-routes") && !p[2])
6995 {
6996 msg(M_WARN, "DEPRECATED OPTION: --max-routes option ignored. "
6997 "The number of routes is unlimited as of OpenVPN 2.4. "
6998 "This option will be removed in a future version, "
6999 "please remove it from your configuration.");
7000 }
7001 else if (streq(p[0], "route-gateway") && p[1] && !p[2])
7002 {
7004 if (streq(p[1], "dhcp"))
7005 {
7007 }
7008 else
7009 {
7010 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn) || is_special_addr(p[1])) /* FQDN -- may be DNS name */
7011 {
7013 }
7014 else
7015 {
7016 msg(msglevel, "route-gateway parm '%s' must be a valid address", p[1]);
7017 goto err;
7018 }
7019 }
7020 }
7021 else if (streq(p[0], "route-ipv6-gateway") && p[1] && !p[2])
7022 {
7023 if (ipv6_addr_safe(p[1]))
7024 {
7026 }
7027 else
7028 {
7029 msg(msglevel, "route-ipv6-gateway parm '%s' must be a valid address", p[1]);
7030 goto err;
7031 }
7032 }
7033 else if (streq(p[0], "route-metric") && p[1] && !p[2])
7034 {
7036 options->route_default_metric = positive_atoi(p[1], msglevel);
7037 }
7038 else if (streq(p[0], "route-delay") && !p[3])
7039 {
7042 if (p[1])
7043 {
7044 options->route_delay = positive_atoi(p[1], msglevel);
7045 if (p[2])
7046 {
7047 options->route_delay_window = positive_atoi(p[2], msglevel);
7048 }
7049 }
7050 else
7051 {
7052 options->route_delay = 0;
7053 }
7054 }
7055 else if (streq(p[0], "route-up") && p[1])
7056 {
7058 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7059 {
7060 goto err;
7061 }
7062 set_user_script(options, &options->route_script, p[1], "route-up", false);
7063 }
7064 else if (streq(p[0], "route-pre-down") && p[1])
7065 {
7067 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7068 {
7069 goto err;
7070 }
7073 p[1],
7074 "route-pre-down", true);
7075 }
7076 else if (streq(p[0], "route-noexec") && !p[1])
7077 {
7079 options->route_noexec = true;
7080 }
7081 else if (streq(p[0], "route-nopull") && !p[1])
7082 {
7084 options->route_nopull = true;
7085 }
7086 else if (streq(p[0], "pull-filter") && p[1] && p[2] && !p[3])
7087 {
7088 struct pull_filter *f;
7091
7092 if (strcmp("accept", p[1]) == 0)
7093 {
7094 f->type = PUF_TYPE_ACCEPT;
7095 }
7096 else if (strcmp("ignore", p[1]) == 0)
7097 {
7098 f->type = PUF_TYPE_IGNORE;
7099 }
7100 else if (strcmp("reject", p[1]) == 0)
7101 {
7102 f->type = PUF_TYPE_REJECT;
7103 }
7104 else
7105 {
7106 msg(msglevel, "Unknown --pull-filter type: %s", p[1]);
7107 goto err;
7108 }
7109 f->pattern = p[2];
7110 f->size = strlen(p[2]);
7111 }
7112 else if (streq(p[0], "allow-pull-fqdn") && !p[1])
7113 {
7115 options->allow_pull_fqdn = true;
7116 }
7117 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
7118 {
7119 int j;
7122
7123 if (options->routes->flags & RG_ENABLE)
7124 {
7125 msg(M_WARN,
7126 "WARNING: You have specified redirect-gateway and "
7127 "redirect-private at the same time (or the same option "
7128 "multiple times). This is not well supported and may lead to "
7129 "unexpected results");
7130 }
7131
7133
7134 if (streq(p[0], "redirect-gateway"))
7135 {
7137 }
7138 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7139 {
7140 if (streq(p[j], "local"))
7141 {
7143 }
7144 else if (streq(p[j], "autolocal"))
7145 {
7147 }
7148 else if (streq(p[j], "def1"))
7149 {
7151 }
7152 else if (streq(p[j], "bypass-dhcp"))
7153 {
7155 }
7156 else if (streq(p[j], "bypass-dns"))
7157 {
7159 }
7160 else if (streq(p[j], "block-local"))
7161 {
7163 }
7164 else if (streq(p[j], "ipv6"))
7165 {
7168 }
7169 else if (streq(p[j], "!ipv4"))
7170 {
7172 }
7173 else
7174 {
7175 msg(msglevel, "unknown --%s flag: %s", p[0], p[j]);
7176 goto err;
7177 }
7178 }
7179#ifdef _WIN32
7180 /* we need this here to handle pushed --redirect-gateway */
7182#endif
7183 }
7184 else if (streq(p[0], "block-ipv6") && !p[1])
7185 {
7187 options->block_ipv6 = true;
7188 }
7189 else if (streq(p[0], "remote-random-hostname") && !p[1])
7190 {
7193 }
7194 else if (streq(p[0], "setenv") && p[1] && !p[3])
7195 {
7197 if (streq(p[1], "REMOTE_RANDOM_HOSTNAME") && !p[2])
7198 {
7200 }
7201 else if (streq(p[1], "GENERIC_CONFIG"))
7202 {
7203 msg(msglevel, "this is a generic configuration and cannot directly be used");
7204 goto err;
7205 }
7206 else if (streq(p[1], "PUSH_PEER_INFO") && !p[2])
7207 {
7208 options->push_peer_info = true;
7209 }
7210 else if (streq(p[1], "SERVER_POLL_TIMEOUT") && p[2])
7211 {
7212 options->ce.connect_timeout = positive_atoi(p[2], msglevel);
7213 }
7214 else
7215 {
7216 if (streq(p[1], "FORWARD_COMPATIBLE") && p[2] && streq(p[2], "1"))
7217 {
7219 msglevel_fc = msglevel_forward_compatible(options, msglevel);
7220 }
7221 setenv_str(es, p[1], p[2] ? p[2] : "");
7222 }
7223 }
7224 else if (streq(p[0], "compat-mode") && p[1] && !p[3])
7225 {
7226 unsigned int major, minor, patch;
7227 if (!(sscanf(p[1], "%u.%u.%u", &major, &minor, &patch) == 3))
7228 {
7229 msg(msglevel, "cannot parse version number for --compat-mode: %s",
7230 p[1]);
7231 goto err;
7232 }
7233
7234 options->backwards_compatible = major * 10000 + minor * 100 + patch;
7235 }
7236 else if (streq(p[0], "setenv-safe") && p[1] && !p[3])
7237 {
7239 setenv_str_safe(es, p[1], p[2] ? p[2] : "");
7240 }
7241 else if (streq(p[0], "script-security") && p[1] && !p[2])
7242 {
7244 script_security_set(atoi_warn(p[1], msglevel));
7245 }
7246 else if (streq(p[0], "mssfix") && !p[3])
7247 {
7249 if (p[1])
7250 {
7251 int mssfix = positive_atoi(p[1], msglevel);
7252 /* can be 0, but otherwise it needs to be high enough so we can
7253 * substract room for headers. */
7254 if (mssfix != 0
7255 && (mssfix < TLS_CHANNEL_MTU_MIN || mssfix > UINT16_MAX))
7256 {
7257 msg(msglevel, "--mssfix value '%s' is invalid", p[1]);
7258 goto err;
7259 }
7260
7261 /* value specified, assume encapsulation is not
7262 * included unless "mtu" follows later */
7263 options->ce.mssfix = mssfix;
7264 options->ce.mssfix_encap = false;
7265 options->ce.mssfix_default = false;
7266 }
7267 else
7268 {
7269 /* Set MTU to default values */
7270 options->ce.mssfix_default = true;
7271 options->ce.mssfix_encap = true;
7272 options->ce.mssfix_fixed = false;
7273 }
7274
7275 if (p[2] && streq(p[2], "mtu"))
7276 {
7277 options->ce.mssfix_encap = true;
7278 }
7279 else if (p[2] && streq(p[2], "fixed"))
7280 {
7281 options->ce.mssfix_fixed = true;
7282 }
7283 else if (p[2])
7284 {
7285 msg(msglevel, "Unknown parameter to --mssfix: %s", p[2]);
7286 }
7287 }
7288 else if (streq(p[0], "disable-occ") && !p[1])
7289 {
7291 options->occ = false;
7292 }
7293 else if (streq(p[0], "server") && p[1] && p[2] && !p[4])
7294 {
7295 const int lev = M_WARN;
7296 bool error = false;
7297 in_addr_t network, netmask;
7298
7300 network = get_ip_addr(p[1], lev, &error);
7301 netmask = get_ip_addr(p[2], lev, &error);
7302 if (error || !network || !netmask)
7303 {
7304 msg(msglevel, "error parsing --server parameters");
7305 goto err;
7306 }
7307 options->server_defined = true;
7308 options->server_network = network;
7309 options->server_netmask = netmask;
7310
7311 if (p[3])
7312 {
7313 if (streq(p[3], "nopool"))
7314 {
7316 }
7317 else
7318 {
7319 msg(msglevel, "error parsing --server: %s is not a recognized flag", p[3]);
7320 goto err;
7321 }
7322 }
7323 }
7324 else if (streq(p[0], "server-ipv6") && p[1] && !p[2])
7325 {
7326 const int lev = M_WARN;
7327 struct in6_addr network;
7328 unsigned int netbits = 0;
7329
7331 if (!get_ipv6_addr(p[1], &network, &netbits, lev) )
7332 {
7333 msg(msglevel, "error parsing --server-ipv6 parameter");
7334 goto err;
7335 }
7336 if (netbits < 64 || netbits > 124)
7337 {
7338 msg(msglevel,
7339 "--server-ipv6 settings: network must be between /64 and /124 (not /%d)",
7340 netbits);
7341
7342 goto err;
7343 }
7345 options->server_network_ipv6 = network;
7346 options->server_netbits_ipv6 = netbits;
7347 }
7348 else if (streq(p[0], "server-bridge") && p[1] && p[2] && p[3] && p[4] && !p[5])
7349 {
7350 const int lev = M_WARN;
7351 bool error = false;
7352 in_addr_t ip, netmask, pool_start, pool_end;
7353
7355 ip = get_ip_addr(p[1], lev, &error);
7356 netmask = get_ip_addr(p[2], lev, &error);
7357 pool_start = get_ip_addr(p[3], lev, &error);
7358 pool_end = get_ip_addr(p[4], lev, &error);
7359 if (error || !ip || !netmask || !pool_start || !pool_end)
7360 {
7361 msg(msglevel, "error parsing --server-bridge parameters");
7362 goto err;
7363 }
7366 options->server_bridge_netmask = netmask;
7367 options->server_bridge_pool_start = pool_start;
7368 options->server_bridge_pool_end = pool_end;
7369 }
7370 else if (streq(p[0], "server-bridge") && p[1] && streq(p[1], "nogw") && !p[2])
7371 {
7375 }
7376 else if (streq(p[0], "server-bridge") && !p[1])
7377 {
7380 }
7381 else if (streq(p[0], "push") && p[1] && !p[2])
7382 {
7384 push_options(options, &p[1], msglevel, &options->gc);
7385 }
7386 else if (streq(p[0], "push-reset") && !p[1])
7387 {
7390 }
7391 else if (streq(p[0], "push-remove") && p[1] && !p[2])
7392 {
7394 msg(D_PUSH, "PUSH_REMOVE '%s'", p[1]);
7396 }
7397 else if (streq(p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
7398 {
7399 const int lev = M_WARN;
7400 bool error = false;
7401 in_addr_t start, end, netmask = 0;
7402
7404 start = get_ip_addr(p[1], lev, &error);
7405 end = get_ip_addr(p[2], lev, &error);
7406 if (p[3])
7407 {
7408 netmask = get_ip_addr(p[3], lev, &error);
7409 }
7410 if (error)
7411 {
7412 msg(msglevel, "error parsing --ifconfig-pool parameters");
7413 goto err;
7414 }
7415 if (!ifconfig_pool_verify_range(msglevel, start, end))
7416 {
7417 goto err;
7418 }
7419
7423 if (netmask)
7424 {
7425 options->ifconfig_pool_netmask = netmask;
7426 }
7427 }
7428 else if (streq(p[0], "ifconfig-pool-persist") && p[1] && !p[3])
7429 {
7432 if (p[2])
7433 {
7435 }
7436 }
7437 else if (streq(p[0], "ifconfig-ipv6-pool") && p[1] && !p[2])
7438 {
7439 const int lev = M_WARN;
7440 struct in6_addr network;
7441 unsigned int netbits = 0;
7442
7444 if (!get_ipv6_addr(p[1], &network, &netbits, lev ) )
7445 {
7446 msg(msglevel, "error parsing --ifconfig-ipv6-pool parameters");
7447 goto err;
7448 }
7449 if (netbits < 64 || netbits > 124)
7450 {
7451 msg(msglevel,
7452 "--ifconfig-ipv6-pool settings: network must be between /64 and /124 (not /%d)",
7453 netbits);
7454 goto err;
7455 }
7456
7460 }
7461 else if (streq(p[0], "hash-size") && p[1] && p[2] && !p[3])
7462 {
7463 int real, virtual;
7464
7466 real = atoi_warn(p[1], msglevel);
7467 virtual = atoi_warn(p[2], msglevel);
7468 if (real < 1 || virtual < 1)
7469 {
7470 msg(msglevel, "--hash-size sizes must be >= 1 (preferably a power of 2)");
7471 goto err;
7472 }
7473 options->real_hash_size = real;
7474 options->virtual_hash_size = real;
7475 }
7476 else if (streq(p[0], "connect-freq") && p[1] && p[2] && !p[3])
7477 {
7478 int cf_max, cf_per;
7479
7481 cf_max = atoi_warn(p[1], msglevel);
7482 cf_per = atoi_warn(p[2], msglevel);
7483 if (cf_max < 0 || cf_per < 0)
7484 {
7485 msg(msglevel, "--connect-freq parms must be > 0");
7486 goto err;
7487 }
7488 options->cf_max = cf_max;
7489 options->cf_per = cf_per;
7490 }
7491 else if (streq(p[0], "connect-freq-initial") && p[1] && p[2] && !p[3])
7492 {
7493 long cf_max, cf_per;
7494
7496 char *e1, *e2;
7497 cf_max = strtol(p[1], &e1, 10);
7498 cf_per = strtol(p[2], &e2, 10);
7499 if (cf_max < 0 || cf_per < 0 || *e1 != '\0' || *e2 != '\0')
7500 {
7501 msg(msglevel, "--connect-freq-initial parameters must be integers and >= 0");
7502 goto err;
7503 }
7504 options->cf_initial_max = cf_max;
7505 options->cf_initial_per = cf_per;
7506 }
7507 else if (streq(p[0], "max-clients") && p[1] && !p[2])
7508 {
7509 int max_clients;
7510
7512 max_clients = atoi_warn(p[1], msglevel);
7513 if (max_clients < 0)
7514 {
7515 msg(msglevel, "--max-clients must be at least 1");
7516 goto err;
7517 }
7518 if (max_clients >= MAX_PEER_ID) /* max peer-id value */
7519 {
7520 msg(msglevel, "--max-clients must be less than %d", MAX_PEER_ID);
7521 goto err;
7522 }
7523 options->max_clients = max_clients;
7524 }
7525 else if (streq(p[0], "max-routes-per-client") && p[1] && !p[2])
7526 {
7528 options->max_routes_per_client = max_int(positive_atoi(p[1], msglevel), 1);
7529 }
7530 else if (streq(p[0], "client-cert-not-required") && !p[1])
7531 {
7533 msg(M_FATAL, "REMOVED OPTION: --client-cert-not-required, use '--verify-client-cert none' instead");
7534 }
7535 else if (streq(p[0], "verify-client-cert") && !p[2])
7536 {
7538
7539 /* Reset any existing flags */
7540 options->ssl_flags &= ~SSLF_CLIENT_CERT_OPTIONAL;
7541 options->ssl_flags &= ~SSLF_CLIENT_CERT_NOT_REQUIRED;
7542 if (p[1])
7543 {
7544 if (streq(p[1], "none"))
7545 {
7547 }
7548 else if (streq(p[1], "optional"))
7549 {
7551 }
7552 else if (!streq(p[1], "require"))
7553 {
7554 msg(msglevel, "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
7555 goto err;
7556 }
7557 }
7558 }
7559 else if (streq(p[0], "username-as-common-name") && !p[1])
7560 {
7563 }
7564 else if (streq(p[0], "auth-user-pass-optional") && !p[1])
7565 {
7568 }
7569 else if (streq(p[0], "opt-verify") && !p[1])
7570 {
7572 msg(M_INFO, "DEPRECATION: opt-verify is deprecated and will be removed "
7573 "in OpenVPN 2.7");
7575 }
7576 else if (streq(p[0], "auth-user-pass-verify") && p[1])
7577 {
7579 if (!no_more_than_n_args(msglevel, p, 3, NM_QUOTE_HINT))
7580 {
7581 goto err;
7582 }
7583 if (p[2])
7584 {
7585 if (streq(p[2], "via-env"))
7586 {
7588 }
7589 else if (streq(p[2], "via-file"))
7590 {
7592 }
7593 else
7594 {
7595 msg(msglevel, "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
7596 goto err;
7597 }
7598 }
7599 else
7600 {
7601 msg(msglevel, "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
7602 goto err;
7603 }
7606 p[1], "auth-user-pass-verify", true);
7607 }
7608 else if (streq(p[0], "auth-gen-token"))
7609 {
7612 options->auth_token_lifetime = p[1] ? positive_atoi(p[1], msglevel) : 0;
7613
7614 for (int i = 2; i < MAX_PARMS && p[i] != NULL; i++)
7615 {
7616 /* the second parameter can be the renewal time */
7617 if (i == 2 && valid_integer(p[i], true))
7618 {
7619 options->auth_token_renewal = positive_atoi(p[i], msglevel);
7620 }
7621 else if (streq(p[i], "external-auth"))
7622 {
7624 }
7625 else
7626 {
7627 msg(msglevel, "Invalid argument to auth-gen-token: %s (%d)", p[i], i);
7628 }
7629 }
7630
7631 }
7632 else if (streq(p[0], "auth-gen-token-secret") && p[1] && !p[2])
7633 {
7637
7638 }
7639 else if (streq(p[0], "client-connect") && p[1])
7640 {
7642 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7643 {
7644 goto err;
7645 }
7647 p[1], "client-connect", true);
7648 }
7649 else if (streq(p[0], "client-crresponse") && p[1])
7650 {
7652 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7653 {
7654 goto err;
7655 }
7657 p[1], "client-crresponse", true);
7658 }
7659 else if (streq(p[0], "client-disconnect") && p[1])
7660 {
7662 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7663 {
7664 goto err;
7665 }
7667 p[1], "client-disconnect", true);
7668 }
7669 else if (streq(p[0], "learn-address") && p[1])
7670 {
7672 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7673 {
7674 goto err;
7675 }
7677 p[1], "learn-address", true);
7678 }
7679 else if (streq(p[0], "tmp-dir") && p[1] && !p[2])
7680 {
7682 options->tmp_dir = p[1];
7683 }
7684 else if (streq(p[0], "client-config-dir") && p[1] && !p[2])
7685 {
7687 options->client_config_dir = p[1];
7688 }
7689 else if (streq(p[0], "ccd-exclusive") && !p[1])
7690 {
7692 options->ccd_exclusive = true;
7693 }
7694 else if (streq(p[0], "bcast-buffers") && p[1] && !p[2])
7695 {
7696 int n_bcast_buf;
7697
7699 n_bcast_buf = atoi_warn(p[1], msglevel);
7700 if (n_bcast_buf < 1)
7701 {
7702 msg(msglevel, "--bcast-buffers parameter must be > 0");
7703 }
7704 options->n_bcast_buf = n_bcast_buf;
7705 }
7706 else if (streq(p[0], "tcp-queue-limit") && p[1] && !p[2])
7707 {
7708 int tcp_queue_limit;
7709
7711 tcp_queue_limit = atoi_warn(p[1], msglevel);
7712 if (tcp_queue_limit < 1)
7713 {
7714 msg(msglevel, "--tcp-queue-limit parameter must be > 0");
7715 }
7716 options->tcp_queue_limit = tcp_queue_limit;
7717 }
7718#if PORT_SHARE
7719 else if (streq(p[0], "port-share") && p[1] && p[2] && !p[4])
7720 {
7722 options->port_share_host = p[1];
7723 options->port_share_port = p[2];
7724 options->port_share_journal_dir = p[3];
7725 }
7726#endif
7727 else if (streq(p[0], "client-to-client") && !p[1])
7728 {
7730 options->enable_c2c = true;
7731 }
7732 else if (streq(p[0], "duplicate-cn") && !p[1])
7733 {
7735 options->duplicate_cn = true;
7736 }
7737 else if (streq(p[0], "iroute") && p[1] && !p[3])
7738 {
7740 option_iroute(options, p[1], p[2], msglevel);
7741 }
7742 else if (streq(p[0], "iroute-ipv6") && p[1] && !p[2])
7743 {
7745 option_iroute_ipv6(options, p[1], msglevel);
7746 }
7747 else if (streq(p[0], "ifconfig-push") && p[1] && p[2] && !p[4])
7748 {
7749 in_addr_t local, remote_netmask;
7750
7752 local = getaddr(GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[1], 0, NULL, NULL);
7753 remote_netmask = getaddr(GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[2], 0, NULL, NULL);
7754 if (local && remote_netmask)
7755 {
7758 options->push_ifconfig_remote_netmask = remote_netmask;
7759 if (p[3])
7760 {
7762 }
7763 }
7764 else
7765 {
7766 msg(msglevel, "cannot parse --ifconfig-push addresses");
7767 goto err;
7768 }
7769 }
7770 else if (streq(p[0], "ifconfig-push-constraint") && p[1] && p[2] && !p[3])
7771 {
7772 in_addr_t network, netmask;
7773
7775 network = getaddr(GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[1], 0, NULL, NULL);
7776 netmask = getaddr(GETADDR_HOST_ORDER, p[2], 0, NULL, NULL);
7777 if (network && netmask)
7778 {
7782 }
7783 else
7784 {
7785 msg(msglevel, "cannot parse --ifconfig-push-constraint addresses");
7786 goto err;
7787 }
7788 }
7789 else if (streq(p[0], "ifconfig-ipv6-push") && p[1] && !p[3])
7790 {
7791 struct in6_addr local, remote;
7792 unsigned int netbits;
7793
7795
7796 if (!get_ipv6_addr( p[1], &local, &netbits, msglevel ) )
7797 {
7798 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
7799 goto err;
7800 }
7801
7802 if (p[2])
7803 {
7804 if (!get_ipv6_addr( p[2], &remote, NULL, msglevel ) )
7805 {
7806 msg( msglevel, "cannot parse --ifconfig-ipv6-push addresses");
7807 goto err;
7808 }
7809 }
7810 else
7811 {
7814 NULL, msglevel ) )
7815 {
7816 msg( msglevel, "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
7817 goto err;
7818 }
7819 }
7820
7826 }
7827 else if (streq(p[0], "disable") && !p[1])
7828 {
7830 options->disable = true;
7831 }
7832 else if (streq(p[0], "override-username") && p[1] && !p[2])
7833 {
7835 if (strlen(p[1]) > USER_PASS_LEN)
7836 {
7837 msg(msglevel, "override-username exceeds the maximum length of %d "
7838 "characters", USER_PASS_LEN);
7839
7840 /* disable the connection since ignoring the request to
7841 * set another username might cause serious problems */
7842 options->disable = true;
7843 }
7844 else
7845 {
7846 options->override_username = p[1];
7847 }
7848 }
7849 else if (streq(p[0], "tcp-nodelay") && !p[1])
7850 {
7853 }
7854 else if (streq(p[0], "stale-routes-check") && p[1] && !p[3])
7855 {
7856 int ageing_time, check_interval;
7857
7859 ageing_time = atoi_warn(p[1], msglevel);
7860 if (p[2])
7861 {
7862 check_interval = atoi_warn(p[2], msglevel);
7863 }
7864 else
7865 {
7866 check_interval = ageing_time;
7867 }
7868
7869 if (ageing_time < 1 || check_interval < 1)
7870 {
7871 msg(msglevel, "--stale-routes-check aging time and check interval must be >= 1");
7872 goto err;
7873 }
7874 options->stale_routes_ageing_time = ageing_time;
7875 options->stale_routes_check_interval = check_interval;
7876 }
7877
7878 else if (streq(p[0], "client") && !p[1])
7879 {
7881 options->client = true;
7882 }
7883 else if (streq(p[0], "pull") && !p[1])
7884 {
7886 options->pull = true;
7887 }
7888 else if (streq(p[0], "push-continuation") && p[1] && !p[2])
7889 {
7891 options->push_continuation = atoi_warn(p[1], msglevel);
7892 }
7893 else if (streq(p[0], "auth-user-pass") && !p[2])
7894 {
7896 if (p[1])
7897 {
7900 }
7901 else
7902 {
7903 options->auth_user_pass_file = "stdin";
7904 }
7905 }
7906 else if (streq(p[0], "auth-retry") && p[1] && !p[2])
7907 {
7909 auth_retry_set(msglevel, p[1]);
7910 }
7911#ifdef ENABLE_MANAGEMENT
7912 else if (streq(p[0], "static-challenge") && p[1] && p[2] && !p[4])
7913 {
7916 if (atoi_warn(p[2], msglevel))
7917 {
7919 }
7920 if (p[3] && streq(p[3], "concat"))
7921 {
7923 }
7924 else if (p[3] && !streq(p[3], "scrv1"))
7925 {
7926 msg(msglevel, "--static-challenge: unknown format indicator '%s'", p[3]);
7927 goto err;
7928 }
7929 }
7930#endif
7931 else if (streq(p[0], "msg-channel") && p[1])
7932 {
7933#ifdef _WIN32
7935 HANDLE process = GetCurrentProcess();
7936 HANDLE handle = (HANDLE) ((intptr_t) atoll(p[1]));
7937 if (!DuplicateHandle(process, handle, process, &options->msg_channel, 0,
7938 FALSE, DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS))
7939 {
7940 msg(msglevel, "could not duplicate service pipe handle");
7941 goto err;
7942 }
7944#else /* ifdef _WIN32 */
7945 msg(msglevel, "--msg-channel is only supported on Windows");
7946 goto err;
7947#endif
7948 }
7949#ifdef _WIN32
7950 else if (streq(p[0], "win-sys") && p[1] && !p[2])
7951 {
7953 if (streq(p[1], "env"))
7954 {
7955 msg(M_INFO, "NOTE: --win-sys env is default from OpenVPN 2.3. "
7956 "This entry will now be ignored. "
7957 "Please remove this entry from your configuration file.");
7958 }
7959 else
7960 {
7961 set_win_sys_path(p[1], es);
7962 }
7963 }
7964 else if (streq(p[0], "route-method") && p[1] && !p[2])
7965 {
7967 if (streq(p[1], "adaptive"))
7968 {
7970 }
7971 else if (streq(p[1], "ipapi"))
7972 {
7974 }
7975 else if (streq(p[1], "exe"))
7976 {
7978 }
7979 else
7980 {
7981 msg(msglevel, "--route method must be 'adaptive', 'ipapi', or 'exe'");
7982 goto err;
7983 }
7984 }
7985 else if (streq(p[0], "ip-win32") && p[1] && !p[4])
7986 {
7987 const int index = ascii2ipset(p[1]);
7988 struct tuntap_options *to = &options->tuntap_options;
7989
7991
7992 if (index < 0)
7993 {
7994 msg(msglevel,
7995 "Bad --ip-win32 method: '%s'. Allowed methods: %s",
7996 p[1],
7998 goto err;
7999 }
8000
8001 if (index == IPW32_SET_ADAPTIVE)
8002 {
8004 }
8005
8006 if (index == IPW32_SET_DHCP_MASQ)
8007 {
8008 if (p[2])
8009 {
8010 if (!streq(p[2], "default"))
8011 {
8012 int offset = atoi_warn(p[2], msglevel);
8013
8014 if (!(offset > -256 && offset < 256))
8015 {
8016 msg(msglevel, "--ip-win32 dynamic [offset] [lease-time]: offset (%d) must be > -256 and < 256", offset);
8017 goto err;
8018 }
8019
8020 to->dhcp_masq_custom_offset = true;
8021 to->dhcp_masq_offset = offset;
8022 }
8023
8024 if (p[3])
8025 {
8026 const int min_lease = 30;
8027 int lease_time;
8028 lease_time = atoi_warn(p[3], msglevel);
8029 if (lease_time < min_lease)
8030 {
8031 msg(msglevel, "--ip-win32 dynamic [offset] [lease-time]: lease time parameter (%d) must be at least %d seconds", lease_time, min_lease);
8032 goto err;
8033 }
8034 to->dhcp_lease_time = lease_time;
8035 }
8036 }
8037 }
8038 to->ip_win32_type = index;
8039 to->ip_win32_defined = true;
8040 }
8041#endif /* ifdef _WIN32 */
8042 else if (streq(p[0], "dns-updown") && p[1])
8043 {
8045 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
8046 {
8047 goto err;
8048 }
8049 struct dns_options *dns = &options->dns_options;
8050 if (streq(p[1], "disable"))
8051 {
8052 dns->updown = NULL;
8053 dns->user_set_updown = false;
8054 }
8055 else if (streq(p[1], "force"))
8056 {
8057 /* force dns-updown run, even if a --up script is defined */
8058 if (dns->user_set_updown == false)
8059 {
8060 dns->updown = DEFAULT_DNS_UPDOWN;
8061 dns->user_set_updown = true;
8062 }
8063 }
8064 else
8065 {
8066 if (streq(dns->updown, DEFAULT_DNS_UPDOWN))
8067 {
8068 /* Unset the default command to prevent warnings */
8069 dns->updown = NULL;
8070 }
8071 set_user_script(options, &dns->updown, p[1], p[0], false);
8072 dns->user_set_updown = true;
8073 }
8074 }
8075 else if (streq(p[0], "dns") && p[1])
8076 {
8078
8079 if (streq(p[1], "search-domains") && p[2])
8080 {
8082 }
8083 else if (streq(p[1], "server") && p[2] && p[3] && p[4])
8084 {
8085 long priority;
8086 if (!dns_server_priority_parse(&priority, p[2], pull_mode))
8087 {
8088 msg(msglevel, "--dns server: invalid priority value '%s'", p[2]);
8089 goto err;
8090 }
8091
8093
8094 if (streq(p[3], "address") && p[4])
8095 {
8096 for (int i = 4; p[i]; ++i)
8097 {
8098 if (!dns_server_addr_parse(server, p[i]))
8099 {
8100 msg(msglevel, "--dns server %ld: malformed address or maximum exceeded '%s'", priority, p[i]);
8101 goto err;
8102 }
8103 }
8104 }
8105 else if (streq(p[3], "resolve-domains"))
8106 {
8108 }
8109 else if (streq(p[3], "dnssec") && !p[5])
8110 {
8111 if (streq(p[4], "yes"))
8112 {
8113 server->dnssec = DNS_SECURITY_YES;
8114 }
8115 else if (streq(p[4], "no"))
8116 {
8117 server->dnssec = DNS_SECURITY_NO;
8118 }
8119 else if (streq(p[4], "optional"))
8120 {
8121 server->dnssec = DNS_SECURITY_OPTIONAL;
8122 }
8123 else
8124 {
8125 msg(msglevel, "--dns server %ld: malformed dnssec value '%s'", priority, p[4]);
8126 goto err;
8127 }
8128 }
8129 else if (streq(p[3], "transport") && !p[5])
8130 {
8131 if (streq(p[4], "plain"))
8132 {
8134 }
8135 else if (streq(p[4], "DoH"))
8136 {
8138 }
8139 else if (streq(p[4], "DoT"))
8140 {
8141 server->transport = DNS_TRANSPORT_TLS;
8142 }
8143 else
8144 {
8145 msg(msglevel, "--dns server %ld: malformed transport value '%s'", priority, p[4]);
8146 goto err;
8147 }
8148 }
8149 else if (streq(p[3], "sni") && !p[5])
8150 {
8151 server->sni = p[4];
8152 }
8153 else
8154 {
8155 msg(msglevel, "--dns server %ld: unknown option type '%s' or missing or unknown parameter", priority, p[3]);
8156 goto err;
8157 }
8158 }
8159 else
8160 {
8161 msg(msglevel, "--dns: unknown option type '%s' or missing or unknown parameter", p[1]);
8162 goto err;
8163 }
8164 }
8165#if defined(_WIN32) || defined(TARGET_ANDROID)
8166 else if (streq(p[0], "dhcp-option") && p[1])
8167 {
8170
8171 if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX"))
8172 && p[2] && !p[3])
8173 {
8174 o->domain = p[2];
8176 }
8177 else if (streq(p[1], "NBS") && p[2] && !p[3])
8178 {
8179 o->netbios_scope = p[2];
8181 }
8182 else if (streq(p[1], "NBT") && p[2] && !p[3])
8183 {
8184 int t;
8185 t = atoi_warn(p[2], msglevel);
8186 if (!(t == 1 || t == 2 || t == 4 || t == 8))
8187 {
8188 msg(msglevel, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t);
8189 goto err;
8190 }
8191 o->netbios_node_type = t;
8193 }
8194 else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3]
8195 && (!strstr(p[2], ":") || ipv6_addr_safe(p[2])))
8196 {
8197 if (strstr(p[2], ":"))
8198 {
8199 dhcp_option_dns6_parse(p[2], o->dns6, &o->dns6_len, msglevel);
8200 }
8201 else
8202 {
8203 dhcp_option_address_parse("DNS", p[2], o->dns, &o->dns_len, msglevel);
8205 }
8206 }
8207 else if (streq(p[1], "WINS") && p[2] && !p[3])
8208 {
8209 dhcp_option_address_parse("WINS", p[2], o->wins, &o->wins_len, msglevel);
8211 }
8212 else if (streq(p[1], "NTP") && p[2] && !p[3])
8213 {
8214 dhcp_option_address_parse("NTP", p[2], o->ntp, &o->ntp_len, msglevel);
8216 }
8217 else if (streq(p[1], "NBDD") && p[2] && !p[3])
8218 {
8219 dhcp_option_address_parse("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel);
8221 }
8222 else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3])
8223 {
8225 {
8227 }
8228 else
8229 {
8230 msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified",
8231 p[1], N_SEARCH_LIST_LEN);
8232 }
8234 }
8235 else if (streq(p[1], "DISABLE-NBT") && !p[2])
8236 {
8237 o->disable_nbt = 1;
8239 }
8240#if defined(TARGET_ANDROID)
8241 else if (streq(p[1], "PROXY_HTTP") && p[3] && !p[4])
8242 {
8243 o->http_proxy_port = positive_atoi(p[3], msglevel);
8244 o->http_proxy = p[2];
8245 }
8246#endif
8247 else
8248 {
8249 msg(msglevel, "--dhcp-option: unknown option type '%s' or missing or unknown parameter", p[1]);
8250 goto err;
8251 }
8252 }
8253#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
8254#ifdef _WIN32
8255 else if (streq(p[0], "show-adapters") && !p[1])
8256 {
8259 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8260 }
8261 else if (streq(p[0], "show-net") && !p[1])
8262 {
8266 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8267 }
8268 else if (streq(p[0], "show-net-up") && !p[1])
8269 {
8271 options->show_net_up = true;
8272 }
8273 else if (streq(p[0], "tap-sleep") && p[1] && !p[2])
8274 {
8275 int s;
8277 s = atoi_warn(p[1], msglevel);
8278 if (s < 0 || s >= 256)
8279 {
8280 msg(msglevel, "--tap-sleep parameter must be between 0 and 255");
8281 goto err;
8282 }
8284 }
8285 else if (streq(p[0], "dhcp-renew") && !p[1])
8286 {
8289 }
8290 else if (streq(p[0], "dhcp-pre-release") && !p[1])
8291 {
8295 }
8296 else if (streq(p[0], "dhcp-release") && !p[1])
8297 {
8298 msg(M_WARN, "Obsolete option --dhcp-release detected. This is now on by default");
8299 }
8300 else if (streq(p[0], "dhcp-internal") && p[1] && !p[2]) /* standalone method for internal use */
8301 {
8302 unsigned int adapter_index;
8305 adapter_index = atou(p[1]);
8308 {
8309 dhcp_release_by_adapter_index(adapter_index);
8310 }
8312 {
8313 dhcp_renew_by_adapter_index(adapter_index);
8314 }
8315 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8316 }
8317 else if (streq(p[0], "register-dns") && !p[1])
8318 {
8321 }
8322 else if (streq(p[0], "block-outside-dns") && !p[1])
8323 {
8325 options->block_outside_dns = true;
8326 }
8327 else if (streq(p[0], "rdns-internal") && !p[1])
8328 /* standalone method for internal use
8329 *
8330 * (if --register-dns is set, openvpn needs to call itself in a
8331 * sub-process to execute the required functions in a non-blocking
8332 * way, and uses --rdns-internal to signal that to itself)
8333 */
8334 {
8338 {
8340 }
8341 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8342 }
8343 else if (streq(p[0], "show-valid-subnets") && !p[1])
8344 {
8347 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8348 }
8349 else if (streq(p[0], "pause-exit") && !p[1])
8350 {
8353 }
8354 else if (streq(p[0], "service") && p[1] && !p[3])
8355 {
8357 options->exit_event_name = p[1];
8358 if (p[2])
8359 {
8360 options->exit_event_initial_state = (atoi_warn(p[2], msglevel) != 0);
8361 }
8362 }
8363 else if (streq(p[0], "allow-nonadmin") && !p[2])
8364 {
8367 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8368 }
8369 else if (streq(p[0], "user") && p[1] && !p[2])
8370 {
8372 msg(M_WARN, "NOTE: --user option is not implemented on Windows");
8373 }
8374 else if (streq(p[0], "group") && p[1] && !p[2])
8375 {
8377 msg(M_WARN, "NOTE: --group option is not implemented on Windows");
8378 }
8379#else /* ifdef _WIN32 */
8380 else if (streq(p[0], "user") && p[1] && !p[2])
8381 {
8383 options->username = p[1];
8384 }
8385 else if (streq(p[0], "group") && p[1] && !p[2])
8386 {
8388 options->groupname = p[1];
8389 }
8390 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
8391 {
8393 setenv_foreign_option(options, (const char **)p, 3, es);
8394 }
8395 else if (streq(p[0], "route-method") && p[1] && !p[2]) /* ignore when pushed to non-Windows OS */
8396 {
8398 }
8399#endif /* ifdef _WIN32 */
8400#if PASSTOS_CAPABILITY
8401 else if (streq(p[0], "passtos") && !p[1])
8402 {
8404 options->passtos = true;
8405 }
8406#endif
8407 else if (streq(p[0], "allow-compression") && p[1] && !p[2])
8408 {
8410
8411 if (streq(p[1], "no"))
8412 {
8413 options->comp.flags =
8416 {
8417 msg(msglevel, "'--allow-compression no' conflicts with "
8418 " enabling compression");
8419 }
8420 }
8422 {
8423 /* Also printed on a push to hint at configuration problems */
8424 msg(msglevel, "Cannot set allow-compression to '%s' "
8425 "after set to 'no'", p[1]);
8426 goto err;
8427 }
8428 else if (streq(p[1], "asym"))
8429 {
8431 }
8432 else if (streq(p[1], "yes"))
8433 {
8434 msg(M_WARN, "DEPRECATED OPTION: \"--allow-compression yes\" has been removed. "
8435 "We will use \"asym\" mode instead. See the manual page for more information.");
8436
8438 }
8439 else
8440 {
8441 msg(msglevel, "bad allow-compression option: %s -- "
8442 "must be 'yes', 'no', or 'asym'", p[1]);
8443 goto err;
8444 }
8445 }
8446 else if (streq(p[0], "comp-lzo") && !p[2])
8447 {
8449
8450 /* All lzo variants do not use swap */
8451 options->comp.flags &= ~COMP_F_SWAP;
8453
8454 if (p[1])
8455 {
8456 if (streq(p[1], "no"))
8457 {
8459 }
8460 /* There is no actual difference anymore between these variants.
8461 * We never compress. On the server side we replace this with
8462 * --compress migrate later anyway.
8463 */
8464 else if (!(streq(p[1], "yes") || streq(p[1], "adaptive")))
8465 {
8466 msg(msglevel, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'", p[1]);
8467 goto err;
8468 }
8469 }
8471 }
8472 else if (streq(p[0], "comp-noadapt") && !p[1])
8473 {
8474 /* NO-OP since we never compress anymore */
8475 }
8476 else if (streq(p[0], "compress") && !p[2])
8477 {
8479 const char *alg = "stub";
8480 if (p[1])
8481 {
8482 alg = p[1];
8483 }
8484
8485 if (streq(alg, "stub"))
8486 {
8489 }
8490 else if (streq(alg, "stub-v2"))
8491 {
8494 }
8495 else if (streq(alg, "migrate"))
8496 {
8499 }
8500 else if (streq(alg, "lzo"))
8501 {
8503 options->comp.flags &= ~COMP_F_SWAP;
8504 }
8505 else if (streq(alg, "lz4"))
8506 {
8509 }
8510 else if (streq(alg, "lz4-v2"))
8511 {
8513 }
8514 else
8515 {
8516 msg(msglevel, "bad comp option: %s", alg);
8517 goto err;
8518 }
8519
8521 }
8522 else if (streq(p[0], "show-ciphers") && !p[1])
8523 {
8525 options->show_ciphers = true;
8526 }
8527 else if (streq(p[0], "show-digests") && !p[1])
8528 {
8530 options->show_digests = true;
8531 }
8532 else if (streq(p[0], "show-engines") && !p[1])
8533 {
8535 options->show_engines = true;
8536 }
8537 else if (streq(p[0], "key-direction") && p[1] && !p[2])
8538 {
8539 int key_direction;
8540
8542
8543 key_direction = ascii2keydirection(msglevel, p[1]);
8544 if (key_direction >= 0)
8545 {
8546 if (permission_mask & OPT_P_GENERAL)
8547 {
8548 options->key_direction = key_direction;
8549 }
8550 else if (permission_mask & OPT_P_CONNECTION)
8551 {
8552 options->ce.key_direction = key_direction;
8553 }
8554 }
8555 else
8556 {
8557 goto err;
8558 }
8559 }
8560 else if (streq(p[0], "secret") && p[1] && !p[3])
8561 {
8562 msg(M_WARN, "DEPRECATED OPTION: The option --secret is deprecated.");
8566 if (!is_inline && p[2])
8567 {
8568 int key_direction;
8569
8570 key_direction = ascii2keydirection(msglevel, p[2]);
8571 if (key_direction >= 0)
8572 {
8573 options->key_direction = key_direction;
8574 }
8575 else
8576 {
8577 goto err;
8578 }
8579 }
8580 }
8581 else if (streq(p[0], "allow-deprecated-insecure-static-crypto"))
8582 {
8585
8586 }
8587 else if (streq(p[0], "genkey") && !p[4])
8588 {
8590 options->genkey = true;
8591 if (!p[1])
8592 {
8594 }
8595 else
8596 {
8597 if (streq(p[1], "secret") || streq(p[1], "tls-auth")
8598 || streq(p[1], "tls-crypt"))
8599 {
8601 }
8602 else if (streq(p[1], "tls-crypt-v2-server"))
8603 {
8605 }
8606 else if (streq(p[1], "tls-crypt-v2-client"))
8607 {
8609 if (p[3])
8610 {
8611 options->genkey_extra_data = p[3];
8612 }
8613 }
8614 else if (streq(p[1], "auth-token"))
8615 {
8617 }
8618 else
8619 {
8620 msg(msglevel, "unknown --genkey type: %s", p[1]);
8621 }
8622
8623 }
8624 if (p[2])
8625 {
8626 options->genkey_filename = p[2];
8627 }
8628 }
8629 else if (streq(p[0], "auth") && p[1] && !p[2])
8630 {
8632 options->authname = p[1];
8633 }
8634 else if (streq(p[0], "cipher") && p[1] && !p[2])
8635 {
8637 options->ciphername = p[1];
8638 }
8639 else if (streq(p[0], "data-ciphers-fallback") && p[1] && !p[2])
8640 {
8642 options->ciphername = p[1];
8644 }
8645 else if ((streq(p[0], "data-ciphers") || streq(p[0], "ncp-ciphers"))
8646 && p[1] && !p[2])
8647 {
8649 if (streq(p[0], "ncp-ciphers"))
8650 {
8651 msg(M_INFO, "Note: Treating option '--ncp-ciphers' as "
8652 " '--data-ciphers' (renamed in OpenVPN 2.5).");
8653 }
8654 options->ncp_ciphers = p[1];
8655 }
8656 else if (streq(p[0], "key-derivation") && p[1])
8657 {
8658 /* NCP only option that is pushed by the server to enable EKM,
8659 * should not be used by normal users in config files*/
8661 if (streq(p[1], "tls-ekm"))
8662 {
8664 }
8665 else
8666 {
8667 msg(msglevel, "Unknown key-derivation method %s", p[1]);
8668 }
8669 }
8670 else if (streq(p[0], "protocol-flags") && p[1])
8671 {
8672 /* NCP only option that is pushed by the server to enable protocol
8673 * features that are negotiated, should not be used by normal users
8674 * in config files */
8676 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
8677 {
8678 if (streq(p[j], "cc-exit"))
8679 {
8681 }
8682 else if (streq(p[j], "tls-ekm"))
8683 {
8685 }
8686 else if (streq(p[j], "dyn-tls-crypt"))
8687 {
8689 }
8690 else if (streq(p[j], "aead-epoch"))
8691 {
8693 }
8694 else
8695 {
8696 msg(msglevel, "Unknown protocol-flags flag: %s", p[j]);
8697 }
8698 }
8699 }
8700 else if (streq(p[0], "force-tls-key-material-export"))
8701 {
8704 }
8705 else if (streq(p[0], "prng") && p[1] && !p[3])
8706 {
8707 msg(M_WARN, "NOTICE: --prng option ignored (SSL library PRNG is used)");
8708 }
8709 else if (streq(p[0], "no-replay") && !p[1])
8710 {
8712 /* always error out, this breaks the connection */
8713 msg(M_FATAL, "--no-replay was removed in OpenVPN 2.7. "
8714 "Update your configuration.");
8715 }
8716 else if (streq(p[0], "replay-window") && !p[3])
8717 {
8719 if (p[1])
8720 {
8721 int replay_window;
8722
8723 replay_window = atoi_warn(p[1], msglevel);
8724 if (!(MIN_SEQ_BACKTRACK <= replay_window && replay_window <= MAX_SEQ_BACKTRACK))
8725 {
8726 msg(msglevel, "replay-window window size parameter (%d) must be between %d and %d",
8727 replay_window,
8730 goto err;
8731 }
8732 options->replay_window = replay_window;
8733
8734 if (p[2])
8735 {
8736 int replay_time;
8737
8738 replay_time = atoi_warn(p[2], msglevel);
8739 if (!(MIN_TIME_BACKTRACK <= replay_time && replay_time <= MAX_TIME_BACKTRACK))
8740 {
8741 msg(msglevel, "replay-window time window parameter (%d) must be between %d and %d",
8742 replay_time,
8745 goto err;
8746 }
8747 options->replay_time = replay_time;
8748 }
8749 }
8750 else
8751 {
8752 msg(msglevel, "replay-window option is missing window size parameter");
8753 goto err;
8754 }
8755 }
8756 else if (streq(p[0], "mute-replay-warnings") && !p[1])
8757 {
8760 }
8761 else if (streq(p[0], "replay-persist") && p[1] && !p[2])
8762 {
8764 options->packet_id_file = p[1];
8765 }
8766 else if (streq(p[0], "test-crypto") && !p[1])
8767 {
8769 options->test_crypto = true;
8770 }
8771#ifndef ENABLE_CRYPTO_MBEDTLS
8772 else if (streq(p[0], "engine") && !p[2])
8773 {
8775 if (p[1])
8776 {
8777 options->engine = p[1];
8778 }
8779 else
8780 {
8781 options->engine = "auto";
8782 }
8783 }
8784#endif /* ENABLE_CRYPTO_MBEDTLS */
8785 else if (streq(p[0], "providers") && p[1])
8786 {
8787 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
8788 {
8789 options->providers.names[j] = p[j];
8790 }
8791 }
8792#ifdef ENABLE_PREDICTION_RESISTANCE
8793 else if (streq(p[0], "use-prediction-resistance") && !p[1])
8794 {
8796 options->use_prediction_resistance = true;
8797 }
8798#endif
8799 else if (streq(p[0], "show-tls") && !p[1])
8800 {
8802 options->show_tls_ciphers = true;
8803 }
8804 else if ((streq(p[0], "show-curves") || streq(p[0], "show-groups")) && !p[1])
8805 {
8807 options->show_curves = true;
8808 }
8809 else if (streq(p[0], "ecdh-curve") && p[1] && !p[2])
8810 {
8812 msg(M_WARN, "Consider setting groups/curves preference with "
8813 "tls-groups instead of forcing a specific curve with "
8814 "ecdh-curve.");
8815 options->ecdh_curve = p[1];
8816 }
8817 else if (streq(p[0], "tls-server") && !p[1])
8818 {
8820 options->tls_server = true;
8821 }
8822 else if (streq(p[0], "tls-client") && !p[1])
8823 {
8825 options->tls_client = true;
8826 }
8827 else if (streq(p[0], "ca") && p[1] && !p[2])
8828 {
8830 options->ca_file = p[1];
8831 options->ca_file_inline = is_inline;
8832 }
8833#ifndef ENABLE_CRYPTO_MBEDTLS
8834 else if (streq(p[0], "capath") && p[1] && !p[2])
8835 {
8837 options->ca_path = p[1];
8838 }
8839#endif /* ENABLE_CRYPTO_MBEDTLS */
8840 else if (streq(p[0], "dh") && p[1] && !p[2])
8841 {
8843 options->dh_file = p[1];
8844 options->dh_file_inline = is_inline;
8845 }
8846 else if (streq(p[0], "cert") && p[1] && !p[2])
8847 {
8849 options->cert_file = p[1];
8850 options->cert_file_inline = is_inline;
8851 }
8852 else if (streq(p[0], "extra-certs") && p[1] && !p[2])
8853 {
8855 options->extra_certs_file = p[1];
8856 options->extra_certs_file_inline = is_inline;
8857 }
8858 else if ((streq(p[0], "verify-hash") && p[1] && !p[3])
8859 || (streq(p[0], "peer-fingerprint") && p[1] && !p[2]))
8860 {
8862
8863 int verify_hash_depth = 0;
8864 if (streq(p[0], "verify-hash"))
8865 {
8866 msg(M_WARN, "DEPRECATED OPTION: The option --verify-hash is deprecated. "
8867 "You should switch to the either use the level 1 certificate as "
8868 "--ca option, use --tls-verify or use --peer-fingerprint");
8869 /* verify level 1 cert, i.e. the CA that signed the leaf cert */
8870 verify_hash_depth = 1;
8871 }
8872
8874
8875 int digest_len = SHA256_DIGEST_LENGTH;
8876
8877 if (options->verify_hash && options->verify_hash_depth != verify_hash_depth)
8878 {
8879 msg(msglevel, "ERROR: Setting %s not allowed. --verify-hash and"
8880 " --peer-fingerprint are mutually exclusive", p[0]);
8881 goto err;
8882 }
8883
8884 if (streq(p[0], "verify-hash"))
8885 {
8886 if ((!p[2] && !is_inline) || (p[2] && streq(p[2], "SHA1")))
8887 {
8889 digest_len = SHA_DIGEST_LENGTH;
8890 }
8891 else if (p[2] && !streq(p[2], "SHA256"))
8892 {
8893 msg(msglevel, "invalid or unsupported hashing algorithm: %s "
8894 "(only SHA1 and SHA256 are supported)", p[2]);
8895 goto err;
8896 }
8897 }
8898
8899 struct verify_hash_list *newlist;
8900 newlist = parse_hash_fingerprint_multiline(p[1], digest_len,
8901 msglevel, &options->gc);
8902
8903 /* Append the new list to the end of our current list */
8904 if (!options->verify_hash)
8905 {
8906 options->verify_hash = newlist;
8907 options->verify_hash_depth = verify_hash_depth;
8908 }
8909 else
8910 {
8911 /* since both the old and new list can have multiple entries
8912 * we need to go to the end of one of them to concatenate them */
8913 struct verify_hash_list *listend = options->verify_hash;
8914 while (listend->next)
8915 {
8916 listend = listend->next;
8917 }
8918 listend->next = newlist;
8919 }
8920 }
8921#if defined(ENABLE_CRYPTOAPI) && defined(HAVE_XKEY_PROVIDER)
8922 else if (streq(p[0], "cryptoapicert") && p[1] && !p[2])
8923 {
8925 options->cryptoapi_cert = p[1];
8926 }
8927#endif
8928 else if (streq(p[0], "key") && p[1] && !p[2])
8929 {
8931 options->priv_key_file = p[1];
8932 options->priv_key_file_inline = is_inline;
8933 }
8934 else if (streq(p[0], "tls-version-min") && p[1] && !p[3])
8935 {
8936 int ver;
8938 ver = tls_version_parse(p[1], p[2]);
8939 if (ver == TLS_VER_BAD)
8940 {
8941 msg(msglevel, "unknown tls-version-min parameter: %s", p[1]);
8942 goto err;
8943 }
8944
8945#ifdef ENABLE_CRYPTO_MBEDTLS
8946 if (ver < TLS_VER_1_2)
8947 {
8948 msg(M_WARN, "--tls-version-min %s is not supported by mbedtls, using 1.2", p[1]);
8949 ver = TLS_VER_1_2;
8950 }
8951#endif
8952
8953 options->ssl_flags &=
8956 }
8957 else if (streq(p[0], "tls-version-max") && p[1] && !p[2])
8958 {
8959 int ver;
8961 ver = tls_version_parse(p[1], NULL);
8962 if (ver == TLS_VER_BAD)
8963 {
8964 msg(msglevel, "unknown tls-version-max parameter: %s", p[1]);
8965 goto err;
8966 }
8967 options->ssl_flags &=
8970 }
8971#ifndef ENABLE_CRYPTO_MBEDTLS
8972 else if (streq(p[0], "pkcs12") && p[1] && !p[2])
8973 {
8975 options->pkcs12_file = p[1];
8976 options->pkcs12_file_inline = is_inline;
8977 }
8978#endif /* ENABLE_CRYPTO_MBEDTLS */
8979 else if (streq(p[0], "askpass") && !p[2])
8980 {
8982 if (p[1])
8983 {
8984 options->key_pass_file = p[1];
8985 }
8986 else
8987 {
8988 options->key_pass_file = "stdin";
8989 }
8990 }
8991 else if (streq(p[0], "auth-nocache") && !p[1])
8992 {
8995 }
8996 else if (streq(p[0], "auth-token") && p[1] && !p[2])
8997 {
8999 ssl_set_auth_token(p[1]);
9000#ifdef ENABLE_MANAGEMENT
9001 if (management)
9002 {
9004 }
9005#endif
9006 }
9007 else if (streq(p[0], "auth-token-user") && p[1] && !p[2])
9008 {
9011 }
9012 else if (streq(p[0], "single-session") && !p[1])
9013 {
9015 options->single_session = true;
9016 }
9017 else if (streq(p[0], "push-peer-info") && !p[1])
9018 {
9020 options->push_peer_info = true;
9021 }
9022 else if (streq(p[0], "tls-exit") && !p[1])
9023 {
9025 options->tls_exit = true;
9026 }
9027 else if (streq(p[0], "tls-cipher") && p[1] && !p[2])
9028 {
9030 options->cipher_list = p[1];
9031 }
9032 else if (streq(p[0], "tls-cert-profile") && p[1] && !p[2])
9033 {
9035 options->tls_cert_profile = p[1];
9036 }
9037 else if (streq(p[0], "tls-ciphersuites") && p[1] && !p[2])
9038 {
9040 options->cipher_list_tls13 = p[1];
9041 }
9042 else if (streq(p[0], "tls-groups") && p[1] && !p[2])
9043 {
9045 options->tls_groups = p[1];
9046 }
9047 else if (streq(p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir"))
9048 || !p[2]))
9049 {
9051 if (p[2] && streq(p[2], "dir"))
9052 {
9054 }
9055 options->crl_file = p[1];
9056 options->crl_file_inline = is_inline;
9057 }
9058 else if (streq(p[0], "tls-verify") && p[1])
9059 {
9061 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
9062 {
9063 goto err;
9064 }
9066 string_substitute(p[1], ',', ' ', &options->gc),
9067 "tls-verify", true);
9068 }
9069 else if (streq(p[0], "tls-export-cert") && p[1] && !p[2])
9070 {
9073 }
9074 else if (streq(p[0], "compat-names"))
9075 {
9077 msg(msglevel, "--compat-names was removed in OpenVPN 2.5. "
9078 "Update your configuration.");
9079 goto err;
9080 }
9081 else if (streq(p[0], "no-name-remapping") && !p[1])
9082 {
9084 msg(msglevel, "--no-name-remapping was removed in OpenVPN 2.5. "
9085 "Update your configuration.");
9086 goto err;
9087 }
9088 else if (streq(p[0], "verify-x509-name") && p[1] && strlen(p[1]) && !p[3])
9089 {
9090 int type = VERIFY_X509_SUBJECT_DN;
9092 if (p[2])
9093 {
9094 if (streq(p[2], "subject"))
9095 {
9097 }
9098 else if (streq(p[2], "name"))
9099 {
9101 }
9102 else if (streq(p[2], "name-prefix"))
9103 {
9105 }
9106 else
9107 {
9108 msg(msglevel, "unknown X.509 name type: %s", p[2]);
9109 goto err;
9110 }
9111 }
9112 options->verify_x509_type = type;
9113 options->verify_x509_name = p[1];
9114 }
9115 else if (streq(p[0], "ns-cert-type") && p[1] && !p[2])
9116 {
9117#ifdef ENABLE_CRYPTO_MBEDTLS
9118 msg(msglevel, "--ns-cert-type is not available with mbedtls.");
9119 goto err;
9120#else
9122 if (streq(p[1], "server"))
9123 {
9125 }
9126 else if (streq(p[1], "client"))
9127 {
9129 }
9130 else
9131 {
9132 msg(msglevel, "--ns-cert-type must be 'client' or 'server'");
9133 goto err;
9134 }
9135#endif /* ENABLE_CRYPTO_MBEDTLS */
9136 }
9137 else if (streq(p[0], "remote-cert-ku"))
9138 {
9140
9141 size_t j;
9142 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9143 {
9144 sscanf(p[j], "%x", &(options->remote_cert_ku[j-1]));
9145 }
9146 if (j == 1)
9147 {
9148 /* No specific KU required, but require KU to be present */
9150 }
9151 }
9152 else if (streq(p[0], "remote-cert-eku") && p[1] && !p[2])
9153 {
9155 options->remote_cert_eku = p[1];
9156 }
9157 else if (streq(p[0], "remote-cert-tls") && p[1] && !p[2])
9158 {
9160
9161 if (streq(p[1], "server"))
9162 {
9164 options->remote_cert_eku = "TLS Web Server Authentication";
9165 }
9166 else if (streq(p[1], "client"))
9167 {
9169 options->remote_cert_eku = "TLS Web Client Authentication";
9170 }
9171 else
9172 {
9173 msg(msglevel, "--remote-cert-tls must be 'client' or 'server'");
9174 goto err;
9175 }
9176 }
9177 else if (streq(p[0], "tls-timeout") && p[1] && !p[2])
9178 {
9180 options->tls_timeout = positive_atoi(p[1], msglevel);
9181 }
9182 else if (streq(p[0], "reneg-bytes") && p[1] && !p[2])
9183 {
9185 char *end;
9186 long long reneg_bytes = strtoll(p[1], &end, 10);
9187 if (*end != '\0' || reneg_bytes < 0)
9188 {
9189 msg(msglevel, "--reneg-bytes parameter must be an integer and >= 0");
9190 goto err;
9191 }
9192 options->renegotiate_bytes = reneg_bytes;
9193 }
9194 else if (streq(p[0], "reneg-pkts") && p[1] && !p[2])
9195 {
9197 char *end;
9198 long long pkt_max = strtoll(p[1], &end, 10);
9199 if (*end != '\0' || pkt_max < 0)
9200 {
9201 msg(msglevel, "--reneg-pkts parameter must be an integer and >= 0");
9202 goto err;
9203 }
9204 options->renegotiate_packets = pkt_max;
9205 }
9206 else if (streq(p[0], "reneg-sec") && p[1] && !p[3])
9207 {
9209 options->renegotiate_seconds = positive_atoi(p[1], msglevel);
9210 if (p[2])
9211 {
9213 }
9214 }
9215 else if (streq(p[0], "hand-window") && p[1] && !p[2])
9216 {
9218 options->handshake_window = positive_atoi(p[1], msglevel);
9219 }
9220 else if (streq(p[0], "tran-window") && p[1] && !p[2])
9221 {
9223 options->transition_window = positive_atoi(p[1], msglevel);
9224 }
9225 else if (streq(p[0], "tls-auth") && p[1] && !p[3])
9226 {
9227 int key_direction = -1;
9228
9230
9231 if (permission_mask & OPT_P_GENERAL)
9232 {
9233 options->tls_auth_file = p[1];
9234 options->tls_auth_file_inline = is_inline;
9235
9236 if (!is_inline && p[2])
9237 {
9238 key_direction = ascii2keydirection(msglevel, p[2]);
9239 if (key_direction < 0)
9240 {
9241 goto err;
9242 }
9243 options->key_direction = key_direction;
9244 }
9245
9246 }
9247 else if (permission_mask & OPT_P_CONNECTION)
9248 {
9249 options->ce.tls_auth_file = p[1];
9250 options->ce.tls_auth_file_inline = is_inline;
9252
9253 if (!is_inline && p[2])
9254 {
9255 key_direction = ascii2keydirection(msglevel, p[2]);
9256 if (key_direction < 0)
9257 {
9258 goto err;
9259 }
9260 options->ce.key_direction = key_direction;
9261 }
9262 }
9263 }
9264 else if (streq(p[0], "tls-crypt") && p[1] && !p[3])
9265 {
9267 if (permission_mask & OPT_P_GENERAL)
9268 {
9269 options->tls_crypt_file = p[1];
9270 options->tls_crypt_file_inline = is_inline;
9271 }
9272 else if (permission_mask & OPT_P_CONNECTION)
9273 {
9274 options->ce.tls_crypt_file = p[1];
9275 options->ce.tls_crypt_file_inline = is_inline;
9276 }
9277 }
9278 else if (streq(p[0], "tls-crypt-v2") && p[1] && !p[3])
9279 {
9281 if (permission_mask & OPT_P_GENERAL)
9282 {
9283 options->tls_crypt_v2_file = p[1];
9284 options->tls_crypt_v2_file_inline = is_inline;
9285 }
9286 else if (permission_mask & OPT_P_CONNECTION)
9287 {
9289 options->ce.tls_crypt_v2_file_inline = is_inline;
9290 }
9291
9292 if (p[2] && streq(p[2], "force-cookie"))
9293 {
9295 }
9296 else if (p[2] && streq(p[2], "allow-noncookie"))
9297 {
9299 }
9300 else if (p[2])
9301 {
9302 msg(msglevel, "Unsupported tls-crypt-v2 argument: %s", p[2]);
9303 }
9304 }
9305 else if (streq(p[0], "tls-crypt-v2-verify") && p[1] && !p[2])
9306 {
9309 }
9310 else if (streq(p[0], "x509-track") && p[1] && !p[2])
9311 {
9313 x509_track_add(&options->x509_track, p[1], msglevel, &options->gc);
9314 }
9315#ifdef ENABLE_X509ALTUSERNAME
9316 else if (streq(p[0], "x509-username-field") && p[1])
9317 {
9319 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9320 {
9321 char *s = p[j];
9322
9323 if (strncmp("ext:", s, 4) == 0 && !x509_username_field_ext_supported(s+4))
9324 {
9325 msg(msglevel, "Unsupported x509-username-field extension: %s", s);
9326 }
9327 options->x509_username_field[j-1] = p[j];
9328 }
9329 }
9330#endif /* ENABLE_X509ALTUSERNAME */
9331#ifdef ENABLE_PKCS11
9332 else if (streq(p[0], "show-pkcs11-ids") && !p[3])
9333 {
9334 char *provider = p[1];
9335 bool cert_private = (p[2] == NULL ? false : (atoi_warn(p[2], msglevel) != 0 ));
9336
9337#ifdef DEFAULT_PKCS11_MODULE
9338 if (!provider)
9339 {
9340 provider = DEFAULT_PKCS11_MODULE;
9341 }
9342 else if (!p[2])
9343 {
9344 char *endp = NULL;
9345 int i = strtol(provider, &endp, 10);
9346
9347 if (*endp == 0)
9348 {
9349 /* There was one argument, and it was purely numeric.
9350 * Interpret it as the cert_private argument */
9351 provider = DEFAULT_PKCS11_MODULE;
9352 cert_private = i;
9353 }
9354 }
9355#else /* ifdef DEFAULT_PKCS11_MODULE */
9356 if (!provider)
9357 {
9358 msg(msglevel, "--show-pkcs11-ids requires a provider parameter");
9359 goto err;
9360 }
9361#endif /* ifdef DEFAULT_PKCS11_MODULE */
9363
9365 show_pkcs11_ids(provider, cert_private);
9366 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
9367 }
9368 else if (streq(p[0], "pkcs11-providers") && p[1])
9369 {
9370 int j;
9371
9373
9374 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9375 {
9376 options->pkcs11_providers[j-1] = p[j];
9377 }
9378 }
9379 else if (streq(p[0], "pkcs11-protected-authentication"))
9380 {
9381 int j;
9382
9384
9385 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9386 {
9387 options->pkcs11_protected_authentication[j-1] = atoi_warn(p[j], msglevel) != 0 ? 1 : 0;
9388 }
9389 }
9390 else if (streq(p[0], "pkcs11-private-mode") && p[1])
9391 {
9392 int j;
9393
9395
9396 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9397 {
9398 sscanf(p[j], "%x", &(options->pkcs11_private_mode[j-1]));
9399 }
9400 }
9401 else if (streq(p[0], "pkcs11-cert-private"))
9402 {
9403 int j;
9404
9406
9407 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9408 {
9409 options->pkcs11_cert_private[j-1] = (bool) (atoi_warn(p[j], msglevel));
9410 }
9411 }
9412 else if (streq(p[0], "pkcs11-pin-cache") && p[1] && !p[2])
9413 {
9415 options->pkcs11_pin_cache_period = atoi_warn(p[1], msglevel);
9416 }
9417 else if (streq(p[0], "pkcs11-id") && p[1] && !p[2])
9418 {
9420 options->pkcs11_id = p[1];
9421 }
9422 else if (streq(p[0], "pkcs11-id-management") && !p[1])
9423 {
9425 options->pkcs11_id_management = true;
9426 }
9427#endif /* ifdef ENABLE_PKCS11 */
9428 else if (streq(p[0], "rmtun") && !p[1])
9429 {
9431 options->persist_config = true;
9432 options->persist_mode = 0;
9433 }
9434 else if (streq(p[0], "mktun") && !p[1])
9435 {
9437 options->persist_config = true;
9438 options->persist_mode = 1;
9439 }
9440 else if (streq(p[0], "peer-id") && p[1] && !p[2])
9441 {
9443 options->use_peer_id = true;
9444 options->peer_id = atoi_warn(p[1], msglevel);
9445 }
9446 else if (streq(p[0], "keying-material-exporter") && p[1] && p[2])
9447 {
9448 int ekm_length = positive_atoi(p[2], msglevel);
9449
9451
9452 if (strncmp(p[1], "EXPORTER", 8))
9453 {
9454 msg(msglevel, "Keying material exporter label must begin with "
9455 "\"EXPORTER\"");
9456 goto err;
9457 }
9458 if (streq(p[1], EXPORT_KEY_DATA_LABEL))
9459 {
9460 msg(msglevel, "Keying material exporter label must not be '"
9462 }
9463 if (ekm_length < 16 || ekm_length > 4095)
9464 {
9465 msg(msglevel, "Invalid keying material exporter length");
9466 goto err;
9467 }
9468
9471 }
9472 else if (streq(p[0], "allow-recursive-routing") && !p[1])
9473 {
9476 }
9477 else if (streq(p[0], "vlan-tagging") && !p[1])
9478 {
9480 options->vlan_tagging = true;
9481 }
9482 else if (streq(p[0], "vlan-accept") && p[1] && !p[2])
9483 {
9485 if (streq(p[1], "tagged"))
9486 {
9488 }
9489 else if (streq(p[1], "untagged"))
9490 {
9492 }
9493 else if (streq(p[1], "all"))
9494 {
9496 }
9497 else
9498 {
9499 msg(msglevel, "--vlan-accept must be 'tagged', 'untagged' or 'all'");
9500 goto err;
9501 }
9502 }
9503 else if (streq(p[0], "vlan-pvid") && p[1] && !p[2])
9504 {
9506 options->vlan_pvid = positive_atoi(p[1], msglevel);
9509 {
9510 msg(msglevel,
9511 "the parameter of --vlan-pvid parameters must be >= %u and <= %u",
9513 goto err;
9514 }
9515 }
9516 else
9517 {
9518 int i;
9519 int msglevel_unknown = msglevel_fc;
9520 /* Check if an option is in --ignore-unknown-option and
9521 * set warning level to non fatal */
9523 {
9524 if (streq(p[0], options->ignore_unknown_option[i]))
9525 {
9526 msglevel_unknown = M_WARN;
9527 break;
9528 }
9529 }
9530 if (file)
9531 {
9532 msg(msglevel_unknown, "Unrecognized option or missing or extra parameter(s) in %s:%d: %s (%s)", file, line, p[0], PACKAGE_VERSION);
9533 }
9534 else
9535 {
9536 msg(msglevel_unknown, "Unrecognized option or missing or extra parameter(s): --%s (%s)", p[0], PACKAGE_VERSION);
9537 }
9538 }
9539err:
9540 gc_free(&gc);
9541}
9542
9543bool
9545{
9546 if (options->ce.local_list)
9547 {
9548 for (int i = 0; i < options->ce.local_list->len; i++)
9549 {
9551 {
9552 return true;
9553 }
9554 }
9555 }
9556
9557 return false;
9558}
void argv_parse_cmd(struct argv *argres, const char *cmdstr)
Parses a command string, tokenizes it and puts each element into a separate struct argv argument slot...
Definition argv.c:483
void argv_free(struct argv *a)
Frees all memory allocations allocated by the struct argv related functions.
Definition argv.c:102
struct argv argv_new(void)
Allocates a new struct argv and ensures it is initialised.
Definition argv.c:88
void free_buf(struct buffer *buf)
Definition buffer.c:183
void buf_clear(struct buffer *buf)
Definition buffer.c:162
bool buf_printf(struct buffer *buf, const char *format,...)
Definition buffer.c:240
void gc_transfer(struct gc_arena *dest, struct gc_arena *src)
Definition buffer.c:460
void * gc_realloc(void *ptr, size_t size, struct gc_arena *a)
allows to realloc a pointer previously allocated by gc_malloc or gc_realloc
Definition buffer.c:370
char * format_hex_ex(const uint8_t *data, int size, int maxoutput, unsigned int space_break_flags, const char *separator, struct gc_arena *gc)
Definition buffer.c:483
void * gc_malloc(size_t size, bool clear, struct gc_arena *a)
Definition buffer.c:336
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:88
struct buffer alloc_buf(size_t size)
Definition buffer.c:62
int string_array_len(const char **array)
Definition buffer.c:703
struct buffer buffer_read_from_file(const char *filename, struct gc_arena *gc)
buffer_read_from_file - copy the content of a file into a buffer
Definition buffer.c:1358
bool buf_parse(struct buffer *buf, const int delim, char *line, const int size)
Definition buffer.c:825
char * string_alloc(const char *str, struct gc_arena *gc)
Definition buffer.c:649
struct buffer string_alloc_buf(const char *str, struct gc_arena *gc)
Definition buffer.c:752
static void gc_detach(struct gc_arena *a)
Definition buffer.h:1019
#define BSTR(buf)
Definition buffer.h:129
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition buffer.h:712
#define BPTR(buf)
Definition buffer.h:124
#define ALLOC_ARRAY_GC(dptr, type, n, gc)
Definition buffer.h:1071
static bool buf_valid(const struct buffer *buf)
Definition buffer.h:234
static void gc_init(struct gc_arena *a)
Definition buffer.h:1012
static bool buf_safe(const struct buffer *buf, size_t len)
Definition buffer.h:520
static void buf_set_read(struct buffer *buf, const uint8_t *data, size_t size)
Definition buffer.h:348
static void secure_memzero(void *data, size_t len)
Securely zeroise memory.
Definition buffer.h:414
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Definition buffer.h:1097
#define ALLOC_OBJ_GC(dptr, type, gc)
Definition buffer.h:1092
static void strncpynt(char *dest, const char *src, size_t maxlen)
Definition buffer.h:361
static void gc_free(struct gc_arena *a)
Definition buffer.h:1033
static bool strprefix(const char *str, const char *prefix)
Return true iff str starts with prefix.
Definition buffer.h:977
static struct gc_arena gc_new(void)
Definition buffer.h:1025
void print_client_nat_list(const struct client_nat_option_list *list, int msglevel)
Definition clinat.c:52
void add_client_nat_to_option_list(struct client_nat_option_list *dest, const char *type, const char *network, const char *netmask, const char *foreign_network, int msglevel)
Definition clinat.c:106
struct client_nat_option_list * new_client_nat_list(struct gc_arena *gc)
Definition clinat.c:75
struct client_nat_option_list * clone_client_nat_option_list(const struct client_nat_option_list *src, struct gc_arena *gc)
Definition clinat.c:83
void copy_client_nat_option_list(struct client_nat_option_list *dest, const struct client_nat_option_list *src)
Definition clinat.c:92
#define TLS_CHANNEL_BUF_SIZE
Definition common.h:69
#define TLS_CHANNEL_MTU_MIN
Definition common.h:82
bool check_compression_settings_valid(struct compress_options *info, int msglevel)
Checks if the compression settings are valid.
Definition comp.c:163
#define COMP_F_ALLOW_STUB_ONLY
Only accept stub compression, even with COMP_F_ADVERTISE_STUBS_ONLY we still accept other compression...
Definition comp.h:45
#define COMP_F_SWAP
initial command byte is swapped with last byte in buffer to preserve payload alignment
Definition comp.h:40
#define COMP_ALG_LZ4
LZ4 algorithm.
Definition comp.h:59
#define COMP_ALGV2_LZ4
Definition comp.h:64
#define COMP_F_ALLOW_NOCOMP_ONLY
Do not allow compression framing (breaks DCO)
Definition comp.h:51
#define COMP_F_ALLOW_ASYM
Compression was explicitly set to allow asymetric compression.
Definition comp.h:49
#define COMP_ALGV2_UNCOMPRESSED
Definition comp.h:63
#define COMP_ALG_STUB
support compression command byte and framing without actual compression
Definition comp.h:56
#define COMP_ALG_LZO
LZO algorithm.
Definition comp.h:57
#define COMP_F_ADVERTISE_STUBS_ONLY
tell server that we only support compression stubs
Definition comp.h:42
#define COMP_F_MIGRATE
push stub-v2 or comp-lzo no when we see a client with comp-lzo in occ
Definition comp.h:47
static bool comp_non_stub_enabled(const struct compress_options *info)
Definition comp.h:81
#define COMP_ALG_UNDEF
Definition comp.h:54
int daemon(int nochdir, int noclose)
char * dirname(char *path)
char * strsep(char **stringp, const char *delim)
#define PACKAGE_NAME
Definition config.h:492
#define IPROUTE_PATH
Definition config.h:468
#define PACKAGE_VERSION
Definition config.h:504
#define CONFIGURE_DEFINES
Definition config.h:5
#define PACKAGE_STRING
Definition config.h:495
#define PACKAGE
Definition config.h:486
#define TARGET_ALIAS
Definition config.h:558
void init_key_type(struct key_type *kt, const char *ciphername, const char *authname, bool tls_mode, bool warn)
Initialize a key_type structure with.
Definition crypto.c:893
int ascii2keydirection(int msglevel, const char *str)
Definition crypto.c:1653
const char * keydirection2ascii(int kd, bool remote, bool humanreadable)
Definition crypto.c:1676
bool check_tls_prf_working(void)
Checks if the current TLS library supports the TLS 1.0 PRF with MD5+SHA1 that OpenVPN uses when TLS K...
Definition crypto.c:1941
void test_crypto(struct crypto_options *co, struct frame *frame)
Definition crypto.c:1229
Data Channel Cryptography Module.
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition crypto.h:356
#define CO_USE_DYNAMIC_TLS_CRYPT
Bit-flag indicating that renegotiations are using tls-crypt with a TLS-EKM derived key.
Definition crypto.h:372
#define CO_EPOCH_DATA_KEY_FORMAT
Bit-flag indicating the epoch the data format.
Definition crypto.h:376
#define KEY_DIRECTION_BIDIRECTIONAL
Definition crypto.h:230
#define CO_USE_CC_EXIT_NOTIFY
Bit-flag indicating that explicit exit notifies should be sent via the control channel instead of usi...
Definition crypto.h:368
@ MD_SHA256
@ MD_SHA1
static bool cipher_defined(const char *ciphername)
Checks if the cipher is defined and is not the null (none) cipher.
const char * md_kt_name(const char *mdname)
Retrieve a string describing the digest digest (e.g.
const char * cipher_kt_name(const char *ciphername)
Retrieve a normalised string describing the cipher (e.g.
int cipher_kt_key_size(const char *ciphername)
Returns the size of keys used by the cipher, in bytes.
#define SHA_DIGEST_LENGTH
#define SHA256_DIGEST_LENGTH
static bool dco_check_startup_option(int msglevel, const struct options *o)
Definition dco.h:288
static bool dco_check_option(int msglevel, const struct options *o)
Definition dco.h:282
static const char * dco_version_string(struct gc_arena *gc)
Definition dco.h:276
bool dns_options_verify(int msglevel, const struct dns_options *o)
Checks validity of DNS options.
Definition dns.c:204
void dns_domain_list_append(struct dns_domain **entry, char **domains, struct gc_arena *gc)
Appends DNS domain parameters to a linked list.
Definition dns.c:148
void dns_options_postprocess_pull(struct dns_options *o)
Merges pulled DNS servers with static ones into an ordered list.
Definition dns.c:280
bool dns_server_addr_parse(struct dns_server *server, const char *addr)
Parses a string IPv4 or IPv6 address and optional colon separated port, into a in_addr or in6_addr re...
Definition dns.c:62
struct dns_server * dns_server_get(struct dns_server **entry, long priority, struct gc_arena *gc)
Find or create DNS server with priority in a linked list.
Definition dns.c:182
bool dns_server_priority_parse(long *priority, const char *str, bool pulled)
Parses a string DNS server priority and validates it.
Definition dns.c:167
struct dns_options clone_dns_options(const struct dns_options *o, struct gc_arena *gc)
Makes a deep copy of the passed DNS options.
Definition dns.c:258
void show_dns_options(const struct dns_options *o)
Prints configured DNS options.
Definition dns.c:770
void dns_options_preprocess_pull(struct dns_options *o)
Saves and resets the server options, so that pulled ones don't mix in.
Definition dns.c:273
@ DNS_SECURITY_NO
Definition dns.h:33
@ DNS_SECURITY_YES
Definition dns.h:34
@ DNS_SECURITY_OPTIONAL
Definition dns.h:35
@ DNS_TRANSPORT_PLAIN
Definition dns.h:40
@ DNS_TRANSPORT_TLS
Definition dns.h:42
@ DNS_TRANSPORT_HTTPS
Definition dns.h:41
void setenv_int(struct env_set *es, const char *name, int value)
Definition env_set.c:292
void setenv_str_i(struct env_set *es, const char *name, const char *value, const int i)
Definition env_set.c:429
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition env_set.c:308
const char * env_set_get(const struct env_set *es, const char *name)
Definition env_set.c:202
void setenv_str_safe(struct env_set *es, const char *name, const char *value)
Definition env_set.c:314
void setenv_long_long(struct env_set *es, const char *name, long long value)
Definition env_set.c:300
void setenv_del(struct env_set *es, const char *name)
Definition env_set.c:353
#define D_SHOW_OCC
Definition errlevel.h:151
#define D_PUSH
Definition errlevel.h:83
#define D_TLS_DEBUG_MED
Definition errlevel.h:157
#define D_DCO
Definition errlevel.h:94
#define D_SHOW_PARMS
Definition errlevel.h:96
#define D_PUSH_ERRORS
Definition errlevel.h:67
#define D_TLS_ERRORS
Definition errlevel.h:59
#define D_LOW
Definition errlevel.h:97
#define M_INFO
Definition errlevel.h:55
Interface functions to the internal and external multiplexers.
void helper_setdefault_topology(struct options *o)
Set –topology default depending on –mode.
Definition helper.c:144
void helper_tcp_nodelay(struct options *o)
Definition helper.c:600
void helper_client_server(struct options *o)
Definition helper.c:172
void helper_keepalive(struct options *o)
Definition helper.c:541
static int max_int(int x, int y)
Definition integer.h:89
static int constrain_int(int x, int min, int max)
Definition integer.h:115
static SERVICE_STATUS status
Definition interactive.c:52
static int tls_verify(struct openvpn_plugin_args_func_in const *args)
void management_auth_token(struct management *man, const char *token)
Definition manage.c:3106
void management_echo(struct management *man, const char *string, const bool pull)
Definition manage.c:3028
#define MF_FORGET_DISCONNECT
Definition manage.h:32
#define MF_EXTERNAL_KEY_PKCS1PAD
Definition manage.h:39
#define MF_CLIENT_AUTH
Definition manage.h:34
#define MF_EXTERNAL_KEY_PSSPAD
Definition manage.h:44
#define MF_EXTERNAL_KEY_NOPADDING
Definition manage.h:38
#define MF_QUERY_PROXY
Definition manage.h:42
#define MF_EXTERNAL_KEY
Definition manage.h:37
#define MF_QUERY_REMOTE
Definition manage.h:41
#define MF_QUERY_PASSWORDS
Definition manage.h:29
#define MF_EXTERNAL_CERT
Definition manage.h:43
#define MF_EXTERNAL_KEY_DIGEST
Definition manage.h:45
#define MF_UP_DOWN
Definition manage.h:40
#define MF_HOLD
Definition manage.h:30
#define MF_SIGNAL
Definition manage.h:31
#define MF_UNIX_SOCK
Definition manage.h:36
#define MF_CONNECT_AS_CLIENT
Definition manage.h:33
struct buffer prepend_dir(const char *dir, const char *path, struct gc_arena *gc)
Prepend a directory to a path.
Definition misc.c:793
const char * safe_print(const char *str, struct gc_arena *gc)
Definition misc.c:557
#define USER_PASS_LEN
Definition misc.h:69
#define SC_CONCAT
Definition misc.h:95
#define SC_ECHO
Definition misc.h:94
int translate_mtu_discover_type_name(const char *name)
Definition mtu.c:261
size_t calc_options_string_link_mtu(const struct options *o, const struct frame *frame)
Calculate the link-mtu to advertise to our peer.
Definition mtu.c:152
#define MSSFIX_DEFAULT
Definition mtu.h:80
#define TAP_MTU_EXTRA_DEFAULT
Definition mtu.h:75
#define LINK_MTU_DEFAULT
Definition mtu.h:65
#define TUN_MTU_DEFAULT
Definition mtu.h:70
#define TLS_MTU_DEFAULT
Definition mtu.h:85
static bool learn_address_script(const struct multi_context *m, const struct multi_instance *mi, const char *op, const struct mroute_addr *addr)
Definition multi.c:95
static int net_ctx_init(struct context *c, openvpn_net_ctx_t *ctx)
Definition networking.h:48
void * openvpn_net_ctx_t
Definition networking.h:39
#define BOOL_CAST(x)
Definition basic.h:27
#define CLEAR(x)
Definition basic.h:33
#define SIZE(x)
Definition basic.h:30
void errors_to_stderr(void)
Definition error.c:185
void open_syslog(const char *pgmname, bool stdio_to_null)
Definition error.c:467
void redirect_stdout_stderr(const char *file, bool append)
Definition error.c:515
FILE * msg_fp(const unsigned int flags)
Definition error.c:194
void openvpn_exit(const int status)
Definition error.c:735
static bool machine_readable_output
Definition error.c:78
void set_suppress_timestamps(bool suppressed)
Definition error.c:149
void set_machine_readable_output(bool parsable)
Definition error.c:155
bool set_debug_level(const int level, const unsigned int flags)
Definition error.c:105
static bool suppress_timestamps
Definition error.c:81
#define M_OPTERR
Definition error.h:100
#define SDL_CONSTRAIN
Definition error.h:177
#define M_NOPREFIX
Definition error.h:97
#define M_DEBUG_LEVEL
Definition error.h:87
#define M_USAGE
Definition error.h:106
#define OPENVPN_EXIT_STATUS_USAGE
Definition error.h:55
#define OPENVPN_EXIT_STATUS_GOOD
Definition error.h:53
#define M_FATAL
Definition error.h:89
#define M_ERR
Definition error.h:105
#define msg(flags,...)
Definition error.h:144
#define ASSERT(x)
Definition error.h:195
#define M_WARN
Definition error.h:91
#define M_MSG_VIRT_OUT
Definition error.h:99
#define M_ERRNO
Definition error.h:94
#define MAX_PEER_ID
Definition openvpn.h:548
bool options_cmp_equal(char *actual, const char *expected)
Definition options.c:4443
static void options_warning_safe_ml(const int msglevel, char *actual, const char *expected, size_t actual_n)
Definition options.c:4559
#define PUF_TYPE_ACCEPT
filter type to accept a matching option
Definition options.c:948
static void rol6_check_alloc(struct options *options)
Definition options.c:1719
#define CHKACC_PRIVATE
Warn if this (private) file is group/others accessible.
Definition options.c:3811
static bool check_file_access_chroot_inline(bool is_inline, const char *chroot, const int type, const char *file, const int mode, const char *opt)
A wrapper for check_file_access_chroot() that returns false immediately if the file is inline (and th...
Definition options.c:3943
static bool check_file_access_chroot(const char *chroot, const int type, const char *file, const int mode, const char *opt)
Definition options.c:3910
static void options_warning_safe_scan2(const int msglevel, const int delim, const bool report_inconsistent, const char *p1, const struct buffer *b2_src, const char *b1_name, const char *b2_name)
Definition options.c:4470
static void options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
Definition options.c:2400
static int msglevel_forward_compatible(struct options *options, const int msglevel)
Definition options.c:5593
static struct local_entry * alloc_local_entry(struct connection_entry *ce, const int msglevel, struct gc_arena *gc)
Definition options.c:2209
#define NM_QUOTE_HINT
Definition options.c:5562
static void options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
Definition options.c:3052
static void usage_version(void)
Definition options.c:4831
static bool in_src_get(const struct in_src *is, char *line, const int size)
Definition options.c:5092
static struct pull_filter * alloc_pull_filter(struct options *o)
Definition options.c:2307
void options_server_import(struct options *o, const char *filename, int msglevel, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5466
#define USAGE_VALID_SERVER_PROTOS
#define SHOW_BOOL(var)
Definition options.c:996
#define CHKACC_DIRPATH
Check for directory presence where a file should reside.
Definition options.c:3808
static void pre_connect_save(struct options *o)
Definition options.c:3248
#define CHKACC_ACPTSTDIN
If filename is stdin, it's allowed and "exists".
Definition options.c:3810
#define TLS_CLIENT
static void setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
Definition options.c:1001
static int check_inline_file_via_buf(struct buffer *multiline, char *p[], struct gc_arena *gc)
Definition options.c:5193
static int global_auth_retry
Definition options.c:4703
#define IS_TYPE_BUF
Definition options.c:5083
bool options_postprocess_pull(struct options *o, struct env_set *es)
Definition options.c:4167
void uninit_options(struct options *o)
Definition options.c:928
static void connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
Definition options.c:2328
#define SHOW_STR(var)
Definition options.c:987
static int check_inline_file(struct in_src *is, char *p[], struct gc_arena *gc)
Definition options.c:5160
static bool verify_permission(const char *name, const char *file, int line, const unsigned int type, const unsigned int allowed, unsigned int *found, const int msglevel, struct options *options, bool is_inline)
Definition options.c:5505
static void read_config_file(struct options *options, const char *file, int level, const char *top_file, const int top_line, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5215
void show_windows_version(const unsigned int flags)
Definition options.c:4797
#define VERIFY_PERMISSION(mask)
Definition options.c:5496
static const char * options_warning_extract_parm1(const char *option_string, struct gc_arena *gc_ret)
Definition options.c:4455
bool key_is_external(const struct options *options)
Definition options.c:5641
static bool no_more_than_n_args(const int msglevel, char *p[], const int max, const unsigned int flags)
Definition options.c:5565
static void check_ca_required(const struct options *options)
Definition options.c:2366
bool auth_retry_set(const int msglevel, const char *option)
Definition options.c:4712
static struct http_proxy_options * parse_http_proxy_override(const char *server, const char *port, const char *flags, struct gc_arena *gc)
Definition options.c:2135
static void read_config_string(const char *prefix, struct options *options, const char *config, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5290
static void bypass_doubledash(char **p)
Definition options.c:5073
#define CHKACC_FILEXSTWR
If file exists, is it writable?
Definition options.c:3809
static char * get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
Returns newly allocated string containing address part without "/nn".
Definition options.c:1128
#define PUF_TYPE_IGNORE
filter type to ignore a matching option
Definition options.c:949
void show_dco_version(const unsigned int flags)
Definition options.c:4806
static bool apply_pull_filter(const struct options *o, char *line)
Filter an option line by all pull filters.
Definition options.c:5396
void rol_check_alloc(struct options *options)
Definition options.c:1710
static struct local_list * alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
Definition options.c:2199
#define SHOW_UNSIGNED(var)
Definition options.c:995
void show_settings(const struct options *o)
Definition options.c:1834
static void set_user_script(struct options *options, const char **script, const char *new_script, const char *type, bool in_chroot)
Definition options.c:5599
static in_addr_t get_ip_addr(const char *ip_string, int msglevel, bool *error)
Definition options.c:1103
#define LZO_LIB_VER_STR
bool apply_push_options(struct options *options, struct buffer *buf, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5436
static void show_dhcp_option_list(const char *name, const char *const *array, int len)
Definition options.c:1281
static void show_connection_entries(const struct options *o)
Definition options.c:1795
static void options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
Definition options.c:3212
static void option_iroute_ipv6(struct options *o, const char *prefix_str, int msglevel)
Definition options.c:1649
bool options_cmp_equal_safe(char *actual, const char *expected, size_t actual_n)
Definition options.c:4585
void parse_argv(struct options *options, const int argc, char *argv[], const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5323
#define PUF_TYPE_REJECT
filter type to reject and trigger SIGUSR1
Definition options.c:950
bool string_defined_equal(const char *s1, const char *s2)
Definition options.c:4862
static bool check_file_access_inline(bool is_inline, const int type, const char *file, const int mode, const char *opt)
A wrapper for check_file_access() that returns false immediately if the file is inline (and therefore...
Definition options.c:3960
void options_postprocess(struct options *options, struct env_set *es)
Definition options.c:4153
int parse_topology(const char *str, const int msglevel)
Definition options.c:4656
static void show_dhcp_option_addrs(const char *name, const in_addr_t *array, int len)
Definition options.c:1291
void usage_small(void)
Definition options.c:4789
const char * auth_retry_print(void)
Definition options.c:4735
static void show_http_proxy_options(const struct http_proxy_options *o)
Definition options.c:1670
static void options_postprocess_filechecks(struct options *options)
Definition options.c:4029
static void show_connection_entry(const struct connection_entry *o)
Definition options.c:1738
void options_warning_safe(char *actual, const char *expected, size_t actual_n)
Definition options.c:4608
void show_library_versions(const unsigned int flags)
Definition options.c:4816
void setenv_settings(struct env_set *es, const struct options *o)
Definition options.c:1031
#define CHKACC_ACCEPT_URI
Do not check URIs, unless they start with file:
Definition options.c:3812
static const char usage_message[]
Definition options.c:120
static char * string_substitute(const char *src, int from, int to, struct gc_arena *gc)
Definition options.c:1155
static struct verify_hash_list * parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
Parses a hexstring and checks if the string has the correct length.
Definition options.c:1184
static struct connection_list * alloc_connection_list_if_undef(struct options *options)
Definition options.c:2231
static bool space(unsigned char c)
Definition options.c:4893
static bool check_cmd_access(const char *command, const char *opt, const char *chroot)
Definition options.c:3988
static void options_warning_safe_scan1(const int msglevel, const int delim, const bool report_inconsistent, const struct buffer *b1_src, const struct buffer *b2_src, const char *b1_name, const char *b2_name)
Definition options.c:4538
#define SHOW_INT64(var)
Definition options.c:994
static struct connection_entry * alloc_connection_entry(struct options *options, const int msglevel)
Definition options.c:2241
static void dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel)
Definition options.c:1333
static bool check_file_access(const int type, const char *file, const int mode, const char *opt)
Definition options.c:3815
static void show_p2mp_parms(const struct options *o)
Definition options.c:1537
static const char * pull_filter_type_name(int type)
Definition options.c:966
static void cnol_check_alloc(struct options *options)
Definition options.c:1728
int parse_line(const char *line, char *p[], const int n, const char *file, const int line_num, int msglevel, struct gc_arena *gc)
Definition options.c:4899
static int check_inline_file_via_fp(FILE *fp, char *p[], struct gc_arena *gc)
Definition options.c:5184
static struct remote_entry * alloc_remote_entry(struct options *options, const int msglevel)
Definition options.c:2274
static void options_postprocess_mutate(struct options *o, struct env_set *es)
Definition options.c:3607
void options_detach(struct options *o)
Definition options.c:1701
static unsigned int atou(const char *str)
Definition options.c:4884
void pre_connect_restore(struct options *o, struct gc_arena *gc)
Definition options.c:3290
static void dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
Definition options.c:1347
static struct pull_filter_list * alloc_pull_filter_list(struct options *o)
Definition options.c:2297
const char * print_topology(const int topology)
Definition options.c:4678
void options_string_import(struct options *options, const char *config, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5486
char * options_string_extract_option(const char *options_string, const char *opt_name, struct gc_arena *gc)
Given an OpenVPN options string, extract the value of an option.
Definition options.c:4622
#define SHOW_STR_INLINE(var)
Definition options.c:988
static void options_postprocess_cipher(struct options *o)
Definition options.c:3449
static void options_set_backwards_compatible_options(struct options *o)
Changes default values so that OpenVPN can be compatible with the user specified version.
Definition options.c:3517
static void show_tuntap_options(const struct tuntap_options *o)
Definition options.c:1306
void init_options(struct options *o, const bool init_gc)
Definition options.c:801
#define MUST_BE_FALSE(condition, parm_name)
Definition options.c:2396
#define MUST_BE_UNDEF(parm, parm_name)
Definition options.c:2394
static const char * print_vlan_accept(enum vlan_acceptable_frames mode)
Definition options.c:1520
#define SHOW_PARM(name, value, format)
Definition options.c:986
static void options_postprocess_http_proxy_override(struct options *o)
Definition options.c:2165
#define IS_TYPE_FP
Definition options.c:5082
void options_warning(char *actual, const char *expected)
Definition options.c:4449
static void show_pull_filter_list(const struct pull_filter_list *l)
Definition options.c:1816
#define CHKACC_FILE
Check for a file/directory presence.
Definition options.c:3807
const char * options_string_version(const char *s, struct gc_arena *gc)
Definition options.c:4614
static void options_postprocess_mutate_invariant(struct options *options)
Definition options.c:3359
static bool ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
Definition options.c:1146
const char title_string[]
Definition options.c:69
static void setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
Definition options.c:1021
static void remap_redirect_gateway_flags(struct options *opt)
Definition options.c:3230
#define TLS_SERVER
static void usage(void)
Definition options.c:4757
int auth_retry_get(void)
Definition options.c:4706
static void add_option(struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5656
static struct verify_hash_list * parse_hash_fingerprint_multiline(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
Parses a string consisting of multiple lines of hexstrings and checks if each string has the correct ...
Definition options.c:1238
static struct remote_list * alloc_remote_list_if_undef(struct options *options)
Definition options.c:2264
void notnull(const char *arg, const char *description)
Definition options.c:4853
static void tuntap_options_copy_dns(struct options *o)
Definition options.c:1380
static void show_compression_warning(struct compress_options *info)
Definition options.c:5629
static void options_process_mutate_prf(struct options *o)
Definition options.c:3587
bool has_udp_in_local_list(const struct options *options)
Definition options.c:9544
static void option_iroute(struct options *o, const char *network_str, const char *netmask_str, int msglevel)
Definition options.c:1619
char * options_string(const struct options *o, const struct frame *frame, struct tuntap *tt, openvpn_net_ctx_t *ctx, bool remote, struct gc_arena *gc)
Definition options.c:4224
static char * read_inline_file(struct in_src *is, const char *close_tag, int *num_lines, struct gc_arena *gc)
Definition options.c:5115
static void options_postprocess_verify(const struct options *o)
Definition options.c:3423
static void connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
Definition options.c:2349
#define SHOW_INT(var)
Definition options.c:992
static bool need_compatibility_before(const struct options *o, unsigned int version)
The option –compat-mode is used to set up default settings to values used on the specified openvpn ve...
Definition options.c:3507
#define MODE_POINT_TO_POINT
Definition options.h:258
#define OPT_P_SCRIPT
Definition options.h:733
#define OPT_P_PUSH
Definition options.h:745
#define SF_TCP_NODELAY_HELPER
Definition options.h:475
#define OPT_P_UP
Definition options.h:730
#define OPT_P_CONNECTION
Definition options.h:756
#define OPT_P_INSTANCE
allowed in ccd, client-connect etc
Definition options.h:746
#define OPT_P_NCP
Negotiable crypto parameters.
Definition options.h:741
#define OPT_P_ECHO
Definition options.h:749
#define OPT_P_CONFIG
Definition options.h:747
#define MODE_SERVER
Definition options.h:259
#define CONNECTION_LIST_SIZE
Definition options.h:187
#define streq(x, y)
Definition options.h:724
#define OPT_P_EXPLICIT_NOTIFY
Definition options.h:748
#define AR_INTERACT
Definition options.h:902
#define OPT_P_SHAPER
Definition options.h:735
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition options.h:926
#define OPT_P_SOCKFLAGS
Definition options.h:755
#define SF_NOPOOL
Definition options.h:474
#define OPT_P_MESSAGES
Definition options.h:740
#define OPT_P_SETENV
Definition options.h:734
#define OPT_P_SOCKBUF
Definition options.h:754
#define OPT_P_PLUGIN
Definition options.h:753
#define OPTION_PARM_SIZE
Definition options.h:57
#define OPT_P_TIMER
Definition options.h:736
#define OPT_P_GENERAL
Definition options.h:729
#define PING_RESTART
Definition options.h:354
#define OPT_P_DHCPDNS
Definition options.h:732
#define OPT_P_PULL_MODE
Definition options.h:752
@ GENKEY_AUTH_TOKEN
Definition options.h:237
@ GENKEY_SECRET
Definition options.h:234
@ GENKEY_TLS_CRYPTV2_SERVER
Definition options.h:236
@ GENKEY_TLS_CRYPTV2_CLIENT
Definition options.h:235
#define OPT_P_PUSH_MTU
Definition options.h:759
#define AR_NONE
Definition options.h:901
#define AR_NOINTERACT
Definition options.h:903
#define SF_NO_PUSH_ROUTE_GATEWAY
Definition options.h:476
#define OPT_P_PERSIST
Definition options.h:737
#define MAX_PARMS
Definition options.h:52
#define PULL_DEFINED(opt)
Definition options.h:763
#define PLUGIN_OPTION_LIST(opt)
Definition options.h:783
#define OPTION_LINE_SIZE
Definition options.h:58
#define PING_EXIT
Definition options.h:353
#define OPT_P_COMP
Definition options.h:739
#define OPT_P_PERSIST_IP
Definition options.h:738
#define OPT_P_MTU
Definition options.h:743
#define OPT_P_ROUTE_EXTRAS
Definition options.h:751
#define OPT_P_NICE
Definition options.h:744
#define OPT_P_PEER_ID
Definition options.h:757
#define OPT_P_INHERIT
Definition options.h:750
#define OPT_P_TLS_PARMS
Definition options.h:742
#define OPT_P_ROUTE
Definition options.h:731
#define MAN_CLIENT_AUTH_ENABLED(opt)
Definition options.h:789
#define CE_DISABLED
Definition options.h:150
#define OPT_P_INLINE
Definition options.h:758
vlan_acceptable_frames
Definition options.h:219
@ VLAN_ONLY_UNTAGGED_OR_PRIORITY
Definition options.h:221
@ VLAN_ALL
Definition options.h:222
@ VLAN_ONLY_TAGGED
Definition options.h:220
int positive_atoi(const char *str, int msglevel)
Converts a str to a positive number if the string represents a postive integer number.
int atoi_warn(const char *str, int msglevel)
Converts a str to an integer if the string can be represented as an integer number.
bool valid_integer(const char *str, bool positive)
Checks if the string is a valid integer by checking if it can be converted to an integer.
#define MAX_SEQ_BACKTRACK
Definition packet_id.h:86
#define MIN_SEQ_BACKTRACK
Definition packet_id.h:85
#define DEFAULT_SEQ_BACKTRACK
Definition packet_id.h:87
#define MAX_TIME_BACKTRACK
Definition packet_id.h:95
#define DEFAULT_TIME_BACKTRACK
Definition packet_id.h:96
#define MIN_TIME_BACKTRACK
Definition packet_id.h:94
unsigned int platform_getpid(void)
Definition platform.c:333
int platform_access(const char *path, int mode)
Definition platform.c:458
FILE * platform_fopen(const char *path, const char *mode)
Definition platform.c:501
int platform_chdir(const char *dir)
Definition platform.c:393
int platform_stat(const char *path, platform_stat_t *buf)
Definition platform.c:527
struct _stat platform_stat_t
Definition platform.h:142
struct plugin_option_list * plugin_option_list_new(struct gc_arena *gc)
Definition plugin.c:160
bool plugin_option_list_add(struct plugin_option_list *list, char **p, struct gc_arena *gc)
Definition plugin.c:168
void plugin_option_list_print(const struct plugin_option_list *list, int msglevel)
Definition plugin.c:189
bool ifconfig_pool_verify_range(const int msglevel, const in_addr_t start, const in_addr_t end)
Definition pool.c:121
#define OPENVPN_8021Q_MIN_VID
Definition proto.h:311
#define OPENVPN_8021Q_MAX_VID
Definition proto.h:312
#define DEV_TYPE_TAP
Definition proto.h:37
#define TOP_UNDEF
Definition proto.h:41
#define DEV_TYPE_UNDEF
Definition proto.h:35
#define TOP_NET30
Definition proto.h:42
#define DEV_TYPE_TUN
Definition proto.h:36
#define TOP_P2P
Definition proto.h:43
#define TOP_SUBNET
Definition proto.h:44
struct http_proxy_options * init_http_proxy_options_once(struct http_proxy_options **hpo, struct gc_arena *gc)
Definition proxy.c:46
#define PAR_NCT
Definition proxy.h:50
#define MAX_CUSTOM_HTTP_HEADER
Definition proxy.h:43
#define PAR_ALL
Definition proxy.h:49
void push_reset(struct options *o)
Definition push.c:933
void clone_push_list(struct options *o)
Definition push.c:891
void push_remove_option(struct options *o, const char *p)
Definition push.c:939
void push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
Definition push.c:907
bool is_special_addr(const char *addr_str)
Definition route.c:306
struct route_option_list * clone_route_option_list(const struct route_option_list *src, struct gc_arena *a)
Definition route.c:155
int netmask_to_netbits2(in_addr_t netmask)
Definition route.c:4139
struct route_ipv6_option_list * new_route_ipv6_option_list(struct gc_arena *a)
Definition route.c:139
void add_route_ipv6_to_option_list(struct route_ipv6_option_list *l, const char *prefix, const char *gateway, const char *metric)
Definition route.c:528
void get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest, openvpn_net_ctx_t *ctx)
Definition route.c:2886
void show_routes(int msglev)
Definition route.c:3308
void print_route_options(const struct route_option_list *rol, int level)
Definition route.c:1319
void add_route_to_option_list(struct route_option_list *l, const char *network, const char *netmask, const char *gateway, const char *metric)
Definition route.c:510
void print_default_gateway(const int msglevel, const struct route_gateway_info *rgi, const struct route_ipv6_gateway_info *rgi6)
Definition route.c:1335
void copy_route_option_list(struct route_option_list *dest, const struct route_option_list *src, struct gc_arena *a)
Definition route.c:173
void copy_route_ipv6_option_list(struct route_ipv6_option_list *dest, const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:180
void get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
Retrieves the best gateway for a given destination based on the routing table.
Definition route.c:2785
struct route_ipv6_option_list * clone_route_ipv6_option_list(const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:164
struct route_option_list * new_route_option_list(struct gc_arena *a)
Definition route.c:130
#define RG_LOCAL
Definition route.h:85
#define RG_BYPASS_DHCP
Definition route.h:87
#define ROUTE_METHOD_SERVICE
Definition route.h:43
#define ROUTE_METHOD_IPAPI
Definition route.h:41
#define ROUTE_METHOD_EXE
Definition route.h:42
#define RG_DEF1
Definition route.h:86
#define RG_BYPASS_DNS
Definition route.h:88
#define RG_ENABLE
Definition route.h:84
#define RG_REROUTE_GW
Definition route.h:89
#define ROUTE_METHOD_ADAPTIVE
Definition route.h:40
#define RG_AUTO_LOCAL
Definition route.h:90
#define RG_BLOCK_LOCAL
Definition route.h:91
void script_security_set(int level)
Definition run_command.c:49
#define SHAPER_MAX
Definition shaper.h:41
#define SHAPER_MIN
Definition shaper.h:40
void throw_signal_soft(const int signum, const char *signal_text)
Throw a soft global signal.
Definition sig.c:206
const char * proto2ascii(int proto, sa_family_t af, bool display_form)
Definition socket.c:3225
bool get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits, int msglevel)
Translate an IPv6 addr or hostname from string form to in6_addr.
Definition socket.c:226
bool mac_addr_safe(const char *mac_addr)
Definition socket.c:840
const char * proto2ascii_all(struct gc_arena *gc)
Definition socket.c:3246
static void bind_local(struct link_socket *sock, const sa_family_t ai_family)
Definition socket.c:1140
sa_family_t ascii2af(const char *proto_name)
Definition socket.c:3212
const char * proto_remote(int proto, bool remote)
Definition socket.c:3286
bool ipv6_addr_safe(const char *ipv6_text_addr)
Definition socket.c:787
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition socket.c:3027
bool ip_or_dns_addr_safe(const char *addr, const bool allow_fqdn)
Definition socket.c:823
int ascii2proto(const char *proto_name)
Definition socket.c:3199
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition socket.c:3007
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, struct signal_info *sig_info)
Translate an IPv4 addr or hostname from string form to in_addr_t.
Definition socket.c:195
bool ip_addr_dotted_quad_safe(const char *dotted_quad)
Definition socket.c:737
static bool proto_is_net(int proto)
Definition socket.h:576
static bool proto_is_udp(int proto)
Returns if the protocol being used is UDP.
Definition socket.h:586
#define GETADDR_FATAL
Definition socket.h:518
@ PROTO_NONE
Definition socket.h:567
@ PROTO_UDP
Definition socket.h:568
@ PROTO_TCP
Definition socket.h:569
@ PROTO_TCP_CLIENT
Definition socket.h:571
@ PROTO_TCP_SERVER
Definition socket.h:570
#define GETADDR_HOST_ORDER
Definition socket.h:519
#define SF_TCP_NODELAY
Definition socket.h:222
#define RESOLV_RETRY_INFINITE
Definition socket.h:48
#define OPENVPN_PORT
Definition socket.h:42
#define SF_USE_IP_PKTINFO
Definition socket.h:221
static bool proto_is_dgram(int proto)
Return if the protocol is datagram (UDP)
Definition socket.h:597
#define SF_HOST_RANDOMIZE
Definition socket.h:224
#define GETADDR_RESOLVE
Definition socket.h:517
void ssl_set_auth_token_user(const char *username)
Definition ssl.c:372
void ssl_set_auth_nocache(void)
Definition ssl.c:347
int tls_version_parse(const char *vstr, const char *extra)
Definition ssl.c:431
void ssl_set_auth_token(const char *token)
Definition ssl.c:366
bool ssl_get_auth_nocache(void)
Definition ssl.c:357
static bool push_peer_info(struct buffer *buf, struct tls_session *session)
Prepares the IV_ and UV_ variables that are part of the exchange to signal the peer's capabilities.
Definition ssl.c:1950
Control Channel SSL/Data channel negotiation module.
#define X509_USERNAME_FIELD_DEFAULT
Definition ssl.h:117
#define KEY_METHOD_2
Definition ssl.h:119
const char * get_ssl_library_version(void)
return a pointer to a static memory area containing the name and version number of the SSL library in...
#define TLS_VER_BAD
Parse a TLS version specifier.
#define TLS_VER_1_0
#define EXPORT_KEY_DATA_LABEL
#define TLS_VER_1_2
#define TLS_VER_1_3
int tls_version_max(void)
Return the maximum TLS version (as a TLS_VER_x constant) supported by current SSL implementation.
#define SSLF_TLS_VERSION_MAX_SHIFT
Definition ssl_common.h:426
#define SSLF_CLIENT_CERT_OPTIONAL
Definition ssl_common.h:419
#define SSLF_AUTH_USER_PASS_OPTIONAL
Definition ssl_common.h:421
#define SSLF_CLIENT_CERT_NOT_REQUIRED
Definition ssl_common.h:418
#define SSLF_CRL_VERIFY_DIR
Definition ssl_common.h:423
#define SSLF_TLS_DEBUG_ENABLED
Definition ssl_common.h:428
#define SSLF_TLS_VERSION_MAX_MASK
Definition ssl_common.h:427
#define SSLF_TLS_VERSION_MIN_SHIFT
Definition ssl_common.h:424
#define SSLF_TLS_VERSION_MIN_MASK
Definition ssl_common.h:425
#define SSLF_USERNAME_AS_COMMON_NAME
Definition ssl_common.h:420
#define SSLF_OPT_VERIFY
Definition ssl_common.h:422
void options_postprocess_setdefault_ncpciphers(struct options *o)
Checks for availibility of Chacha20-Poly1305 and sets the ncp_cipher to either AES-256-GCM:AES-128-GC...
Definition ssl_ncp.c:589
bool tls_item_in_cipher_list(const char *item, const char *list)
Return true iff item is present in the colon-separated zero-terminated cipher list.
Definition ssl_ncp.c:210
void append_cipher_to_ncp_list(struct options *o, const char *ciphername)
Appends the cipher specified by the ciphernamer parameter to to the o->ncp_ciphers list.
Definition ssl_ncp.c:198
char * mutate_ncp_cipher_list(const char *list, struct gc_arena *gc)
Check whether the ciphers in the supplied list are supported.
Definition ssl_ncp.c:98
Control Channel SSL/Data dynamic negotiation Module This file is split from ssl.h to be able to unit ...
Control Channel Verification Module.
#define OPENVPN_KU_REQUIRED
Require keyUsage to be present in cert (0xFFFF is an invalid KU value)
Definition ssl_verify.h:262
#define VERIFY_X509_SUBJECT_DN
Definition ssl_verify.h:68
#define VERIFY_X509_SUBJECT_RDN
Definition ssl_verify.h:69
#define NS_CERT_CHECK_CLIENT
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:259
#define VERIFY_X509_SUBJECT_RDN_PREFIX
Definition ssl_verify.h:70
#define NS_CERT_CHECK_SERVER
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:257
void x509_track_add(const struct x509_track **ll_head, const char *name, int msglevel, struct gc_arena *gc)
Definition argv.h:35
char ** argv
Definition argv.h:39
Wrapper structure for dynamically allocated memory.
Definition buffer.h:61
int capacity
Size in bytes of memory allocated by malloc().
Definition buffer.h:62
uint8_t * data
Pointer to the allocated memory.
Definition buffer.h:68
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:66
unsigned int flags
Definition comp.h:77
Definition options.h:105
struct local_list * local_list
Definition options.h:106
int tun_mtu_max
Definition options.h:127
int connect_retry_seconds
Definition options.h:117
bool tls_crypt_v2_force_cookie
Definition options.h:176
int link_mtu
Definition options.h:132
bool link_mtu_defined
Definition options.h:133
int tun_mtu_extra
Definition options.h:130
int connect_retry_seconds_max
Definition options.h:118
bool bind_local
Definition options.h:116
int mssfix
Definition options.h:142
const char * tls_crypt_file
Definition options.h:167
const char * tls_crypt_v2_file
Definition options.h:172
bool tun_mtu_extra_defined
Definition options.h:131
const char * remote
Definition options.h:112
int connect_timeout
Definition options.h:119
const char * socks_proxy_port
Definition options.h:122
bool mssfix_default
Definition options.h:143
bool mssfix_encap
Definition options.h:144
int occ_mtu
Definition options.h:126
struct http_proxy_options * http_proxy_options
Definition options.h:120
bool tls_crypt_file_inline
Definition options.h:168
bool tls_auth_file_inline
Definition options.h:163
bool bind_ipv6_only
Definition options.h:115
bool tun_mtu_defined
Definition options.h:129
bool remote_float
Definition options.h:113
int tls_mtu
Definition options.h:134
int explicit_exit_notification
Definition options.h:148
const char * socks_proxy_authfile
Definition options.h:123
const char * remote_port
Definition options.h:111
bool fragment_encap
Definition options.h:140
const char * socks_proxy_server
Definition options.h:121
int fragment
Definition options.h:139
int mtu_discover_type
Definition options.h:137
int proto
Definition options.h:107
sa_family_t af
Definition options.h:108
const char * tls_auth_file
Definition options.h:162
bool local_port_defined
Definition options.h:110
int tun_mtu
Definition options.h:125
bool bind_defined
Definition options.h:114
const char * local_port
Definition options.h:109
int key_direction
Definition options.h:164
bool tls_crypt_v2_file_inline
Definition options.h:173
unsigned int flags
Definition options.h:159
bool mssfix_fixed
Definition options.h:146
struct connection_entry ** array
Definition options.h:200
Definition dhcp.h:53
struct dns_domain * next
Definition dns.h:46
const char * name
Definition dns.h:47
struct dns_server * servers
Definition dns.h:82
const char * updown
Definition dns.h:84
struct gc_arena gc
Definition dns.h:83
bool user_set_updown
Definition dns.h:85
struct dns_domain * search_domains
Definition dns.h:80
struct in_addr a4
Definition dns.h:53
union dns_server_addr::@0 in
sa_family_t family
Definition dns.h:56
struct in6_addr a6
Definition dns.h:54
struct dns_server_addr addr[8]
Definition dns.h:64
enum dns_security dnssec
Definition dns.h:66
struct dns_server * next
Definition dns.h:61
long priority
Definition dns.h:62
size_t addr_count
Definition dns.h:63
struct dns_domain * domains
Definition dns.h:65
enum dns_server_transport transport
Definition dns.h:67
const char * sni
Definition dns.h:68
Structure for reassembling one incoming fragmented packet.
Definition fragment.h:65
Packet geometry parameters.
Definition mtu.h:98
int tun_mtu
the (user) configured tun-mtu.
Definition mtu.h:131
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:117
Definition list.h:57
const char * name
Definition proxy.h:39
const char * content
Definition proxy.h:40
const char * auth_file
Definition proxy.h:54
const char * http_version
Definition proxy.h:56
const char * port
Definition proxy.h:46
bool inline_creds
Definition proxy.h:59
const char * user_agent
Definition proxy.h:57
const char * auth_method_string
Definition proxy.h:53
struct http_custom_header custom_headers[MAX_CUSTOM_HTTP_HEADER]
Definition proxy.h:58
const char * auth_file_up
Definition proxy.h:55
const char * server
Definition proxy.h:45
struct buffer * multiline
Definition options.c:5087
union in_src::@9 u
FILE * fp
Definition options.c:5086
int type
Definition options.c:5084
struct iroute_ipv6 * next
Definition route.h:250
unsigned int netbits
Definition route.h:249
struct in6_addr network
Definition route.h:248
in_addr_t network
Definition route.h:242
int netbits
Definition route.h:243
struct iroute * next
Definition route.h:244
const char * cipher
const name of the cipher
Definition crypto.h:142
const char * digest
Message digest static parameters.
Definition crypto.h:143
Definition options.h:98
const char * port
Definition options.h:100
int proto
Definition options.h:101
const char * local
Definition options.h:99
struct local_entry * array[CONNECTION_LIST_SIZE]
Definition options.h:192
struct tuntap_options tuntap_options
Definition options.h:66
int ping_rec_timeout_action
Definition options.h:87
bool tuntap_options_defined
Definition options.h:65
bool routes_ipv6_defined
Definition options.h:71
struct route_option_list * routes
Definition options.h:69
struct compress_options comp
Definition options.h:90
const char * ciphername
Definition options.h:82
struct dns_options dns_options
Definition options.h:80
const char * route_default_gateway
Definition options.h:74
const char * authname
Definition options.h:83
struct route_ipv6_option_list * routes_ipv6
Definition options.h:72
bool client_nat_defined
Definition options.h:77
struct client_nat_option_list * client_nat
Definition options.h:78
const char * route_ipv6_default_gateway
Definition options.h:75
int resolve_retry_seconds
Definition options.h:365
int rcvbuf
Definition options.h:414
bool resolve_in_advance
Definition options.h:366
bool route_nopull
Definition options.h:437
const char * genkey_extra_data
Definition options.h:284
struct compress_options comp
Definition options.h:411
struct http_proxy_options * http_proxy_override
Definition options.h:307
int push_ifconfig_ipv6_netbits
Definition options.h:523
int proto_force
Definition options.h:330
bool persist_config
Definition options.h:272
struct connection_list * connection_list
Definition options.h:289
const char * management_port
Definition options.h:447
bool tls_crypt_file_inline
Definition options.h:668
const char * ifconfig_ipv6_remote
Definition options.h:325
int max_routes_per_client
Definition options.h:536
const char * ncp_ciphers_conf
The original ncp_ciphers specified by the user in the configuration.
Definition options.h:577
int status_file_version
Definition options.h:405
enum vlan_acceptable_frames vlan_accept
Definition options.h:711
int auth_token_renewal
Definition options.h:545
in_addr_t push_ifconfig_constraint_network
Definition options.h:518
const char * tmp_dir
Definition options.h:466
bool push_peer_info
Definition options.h:682
bool daemon
Definition options.h:389
struct options_pre_connect * pre_connect
Definition options.h:561
int route_default_metric
Definition options.h:429
int renegotiate_seconds_min
Definition options.h:648
const char * auth_token_secret_file
Definition options.h:546
unsigned int imported_protocol_flags
Definition options.h:721
const char * tls_export_peer_cert_dir
Definition options.h:613
bool crl_file_inline
Definition options.h:617
const char * cryptoapi_cert
Definition options.h:639
const char * down_script
Definition options.h:384
unsigned int backwards_compatible
What version we should try to be compatible with as major * 10000 + minor * 100 + patch,...
Definition options.h:266
hash_algo_type verify_hash_algo
Definition options.h:623
int scheduled_exit_interval
Definition options.h:563
int stale_routes_ageing_time
Definition options.h:538
bool pkcs12_file_inline
Definition options.h:606
int replay_time
Definition options.h:584
unsigned int push_option_types_found
Definition options.h:558
int management_state_buffer_size
Definition options.h:451
const char * ca_file
Definition options.h:594
const char * tls_auth_file
Definition options.h:663
struct provider_list providers
Definition options.h:581
bool duplicate_cn
Definition options.h:527
struct in6_addr server_network_ipv6
Definition options.h:471
int shaper
Definition options.h:328
int management_echo_buffer_size
Definition options.h:450
in_addr_t server_network
Definition options.h:468
bool show_net_up
Definition options.h:695
bool verify_hash_no_ca
Definition options.h:625
bool allow_pull_fqdn
Definition options.h:439
bool use_peer_id
Definition options.h:701
unsigned remote_cert_ku[MAX_PARMS]
Definition options.h:620
bool server_bridge_defined
Definition options.h:481
const char * keying_material_exporter_label
Definition options.h:705
const char * status_file
Definition options.h:404
unsigned int ssl_flags
Definition options.h:626
bool route_noexec
Definition options.h:430
bool ifconfig_nowarn
Definition options.h:327
const char * remote_cert_eku
Definition options.h:621
in_addr_t ifconfig_pool_netmask
Definition options.h:491
in_addr_t server_netmask
Definition options.h:469
int tls_timeout
Definition options.h:642
bool test_crypto
Definition options.h:586
bool up_delay
Definition options.h:387
bool server_bridge_proxy_dhcp
Definition options.h:479
bool allow_recursive_routing
Definition options.h:718
const char * authname
Definition options.h:579
const char * exit_event_name
Definition options.h:693
const char * ifconfig_ipv6_local
Definition options.h:323
int cf_max
Definition options.h:529
bool dh_file_inline
Definition options.h:598
int replay_window
Definition options.h:583
bool disable
Definition options.h:507
int mute
Definition options.h:398
bool auth_user_pass_verify_script_via_file
Definition options.h:541
const char * dev_type
Definition options.h:317
int persist_mode
Definition options.h:273
int ifconfig_pool_persist_refresh_freq
Definition options.h:493
bool show_digests
Definition options.h:277
const char * up_script
Definition options.h:383
bool single_session
Definition options.h:680
bool push_ifconfig_defined
Definition options.h:513
bool ifconfig_pool_defined
Definition options.h:488
int verify_hash_depth
Definition options.h:624
bool route_delay_defined
Definition options.h:433
const char * packet_id_file
Definition options.h:585
const char * tls_crypt_v2_file
Definition options.h:672
int management_log_history_cache
Definition options.h:449
in_addr_t server_bridge_netmask
Definition options.h:483
const char * ip_remote_hint
Definition options.h:367
bool vlan_tagging
Definition options.h:710
uint32_t peer_id
Definition options.h:702
struct route_option_list * routes
Definition options.h:434
in_addr_t ifconfig_pool_end
Definition options.h:490
int keepalive_timeout
Definition options.h:341
const char * writepid
Definition options.h:382
int64_t inactivity_minimum_bytes
Definition options.h:344
bool ifconfig_ipv6_pool_defined
Definition options.h:495
bool fast_io
Definition options.h:409
unsigned int server_flags
Definition options.h:477
bool block_outside_dns
Definition options.h:697
bool push_ifconfig_ipv6_blocked
Definition options.h:525
bool tls_exit
Definition options.h:684
const char * pkcs12_file
Definition options.h:605
const char * client_disconnect_script
Definition options.h:502
bool show_engines
Definition options.h:278
struct remote_list * remote_list
Definition options.h:291
HANDLE msg_channel
Definition options.h:692
const char * key_pass_file
Definition options.h:275
bool mute_replay_warnings
Definition options.h:582
const char * tls_crypt_file
Definition options.h:667
int inactivity_timeout
Definition options.h:343
int n_bcast_buf
Definition options.h:509
int handshake_window
Definition options.h:652
bool server_defined
Definition options.h:467
const char * ifconfig_local
Definition options.h:321
struct connection_entry ce
Definition options.h:288
struct iroute_ipv6 * iroutes_ipv6
Definition options.h:512
struct push_list push_list
Definition options.h:487
bool user_script_used
Definition options.h:385
const char * tls_groups
Definition options.h:609
bool show_tls_ciphers
Definition options.h:279
struct tuntap_options tuntap_options
Definition options.h:369
int route_method
Definition options.h:696
struct verify_hash_list * verify_hash
Definition options.h:622
const char * tls_cert_profile
Definition options.h:610
int64_t renegotiate_packets
Definition options.h:646
unsigned int management_flags
Definition options.h:459
int push_continuation
Definition options.h:557
const char * route_default_gateway
Definition options.h:427
in_addr_t push_ifconfig_local_alias
Definition options.h:516
struct dns_options dns_options
Definition options.h:312
bool exit_event_initial_state
Definition options.h:694
struct static_challenge_info sc_info
Definition options.h:566
bool auth_token_call_auth
Definition options.h:543
const char * ipchange
Definition options.h:315
int topology
Definition options.h:320
bool disable_dco
Definition options.h:372
const char * ncp_ciphers
Definition options.h:578
bool genkey
Definition options.h:281
const char * learn_address_script
Definition options.h:503
const char * ciphername
Definition options.h:573
const char * auth_user_pass_file
Definition options.h:559
bool forward_compatible
Definition options.h:263
const char * username
Definition options.h:375
int cf_initial_max
Definition options.h:532
int stale_routes_check_interval
Definition options.h:537
struct plugin_option_list * plugin_list
Definition options.h:462
int auth_token_lifetime
Definition options.h:544
uint16_t vlan_pvid
Definition options.h:712
int ns_cert_type
Definition options.h:619
const char * tls_crypt_v2_verify_script
Definition options.h:677
int mode
Definition options.h:260
bool tls_server
Definition options.h:592
const char * auth_user_pass_verify_script
Definition options.h:540
int connect_retry_max
Definition options.h:287
char * bind_dev
Definition options.h:419
const char * extra_certs_file
Definition options.h:601
bool client
Definition options.h:555
bool pull
Definition options.h:556
int ifconfig_ipv6_pool_netbits
Definition options.h:497
in_addr_t push_ifconfig_constraint_netmask
Definition options.h:519
bool show_curves
Definition options.h:280
const char * route_ipv6_default_gateway
Definition options.h:428
bool tls_client
Definition options.h:593
bool ping_timer_remote
Definition options.h:350
bool auth_token_generate
Definition options.h:542
bool priv_key_file_inline
Definition options.h:604
const char * tls_verify
Definition options.h:612
const char * crl_file
Definition options.h:616
int ping_rec_timeout_action
Definition options.h:355
bool auth_user_pass_file_inline
Definition options.h:560
bool show_ciphers
Definition options.h:276
bool enable_ncp_fallback
If defined fall back to ciphername if NCP fails.
Definition options.h:574
int real_hash_size
Definition options.h:499
const char * route_predown_script
Definition options.h:426
const char * dh_file
Definition options.h:597
int route_delay_window
Definition options.h:432
in_addr_t push_ifconfig_local
Definition options.h:514
bool mlock
Definition options.h:338
const char ** ignore_unknown_option
Definition options.h:269
int sndbuf
Definition options.h:415
int foreign_option_index
Definition options.h:689
struct gc_arena gc
Definition options.h:251
bool gc_owned
Definition options.h:252
bool down_pre
Definition options.h:386
bool persist_tun
Definition options.h:357
bool ca_file_inline
Definition options.h:595
bool auth_token_secret_file_inline
Definition options.h:547
bool block_ipv6
Definition options.h:436
const char * config
Definition options.h:255
bool extra_certs_file_inline
Definition options.h:602
bool push_ifconfig_constraint_defined
Definition options.h:517
int mark
Definition options.h:418
int cf_initial_per
Definition options.h:533
int keying_material_exporter_length
Definition options.h:706
bool suppress_timestamps
Definition options.h:394
bool force_key_material_export
Definition options.h:708
bool mtu_test
Definition options.h:332
struct iroute * iroutes
Definition options.h:511
int verify_x509_type
Definition options.h:614
const char * cipher_list_tls13
Definition options.h:608
const char * ecdh_curve
Definition options.h:611
int status_file_update_freq
Definition options.h:406
const char * management_client_user
Definition options.h:453
const char * cipher_list
Definition options.h:607
bool ccd_exclusive
Definition options.h:506
bool allow_deprecated_insecure_static_crypto
Definition options.h:571
struct pull_filter_list * pull_filter_list
Definition options.h:714
const char * management_certificate
Definition options.h:456
const char * genkey_filename
Definition options.h:283
const struct x509_track * x509_track
Definition options.h:686
const char * chroot_dir
Definition options.h:377
bool log
Definition options.h:393
bool shared_secret_file_inline
Definition options.h:570
struct in6_addr push_ifconfig_ipv6_remote
Definition options.h:524
const char * ca_path
Definition options.h:596
int renegotiate_seconds
Definition options.h:647
int ping_rec_timeout
Definition options.h:349
unsigned int sockflags
Definition options.h:422
const char * engine
Definition options.h:580
const char * management_addr
Definition options.h:446
const char * client_connect_script
Definition options.h:501
const char * verify_x509_name
Definition options.h:615
int ping_send_timeout
Definition options.h:348
bool route_gateway_via_dhcp
Definition options.h:438
bool remote_random
Definition options.h:314
bool push_ifconfig_ipv6_defined
Definition options.h:521
int tcp_queue_limit
Definition options.h:510
int route_delay
Definition options.h:431
const char * dev_node
Definition options.h:318
const char * override_username
Definition options.h:508
const char * client_crresponse_script
Definition options.h:504
struct route_ipv6_option_list * routes_ipv6
Definition options.h:435
bool machine_readable_output
Definition options.h:395
int key_direction
Definition options.h:572
bool server_ipv6_defined
Definition options.h:470
const char * priv_key_file
Definition options.h:603
bool persist_remote_ip
Definition options.h:359
bool up_restart
Definition options.h:388
int keepalive_ping
Definition options.h:340
int virtual_hash_size
Definition options.h:500
bool tls_auth_file_inline
Definition options.h:664
bool tls_crypt_v2_file_inline
Definition options.h:673
const char * groupname
Definition options.h:376
in_addr_t server_bridge_pool_start
Definition options.h:484
const char * cd_dir
Definition options.h:378
struct client_nat_option_list * client_nat
Definition options.h:440
struct in6_addr push_ifconfig_ipv6_local
Definition options.h:522
int nice
Definition options.h:396
int max_clients
Definition options.h:535
int transition_window
Definition options.h:660
const char * ifconfig_remote_netmask
Definition options.h:322
const char * lladdr
Definition options.h:319
int verbosity
Definition options.h:397
int session_timeout
Definition options.h:346
const char * cert_file
Definition options.h:599
bool enable_c2c
Definition options.h:526
in_addr_t server_bridge_pool_end
Definition options.h:485
int cf_per
Definition options.h:530
enum tun_driver_type windows_driver
Definition options.h:698
bool cert_file_inline
Definition options.h:600
int remap_sigusr1
Definition options.h:391
int64_t renegotiate_bytes
Definition options.h:645
const char * route_script
Definition options.h:425
in_addr_t ifconfig_pool_start
Definition options.h:489
const char * management_user_pass
Definition options.h:448
unsigned int server_netbits_ipv6
Definition options.h:472
in_addr_t push_ifconfig_remote_netmask
Definition options.h:515
bool occ
Definition options.h:443
in_addr_t server_bridge_ip
Definition options.h:482
const char * shared_secret_file
Definition options.h:569
bool ifconfig_noexec
Definition options.h:326
const char * dev
Definition options.h:316
const char * management_client_group
Definition options.h:454
struct in6_addr ifconfig_ipv6_pool_base
Definition options.h:496
const char * client_config_dir
Definition options.h:505
enum genkey_type genkey_type
Definition options.h:282
const char * ifconfig_pool_persist_filename
Definition options.h:492
int ifconfig_ipv6_netbits
Definition options.h:324
bool persist_local_ip
Definition options.h:358
const char * names[MAX_PARMS]
Definition options.h:213
struct pull_filter * tail
Definition options.c:960
struct pull_filter * head
Definition options.c:959
struct pull_filter * next
Definition options.c:954
char * pattern
Definition options.c:953
Definition pushlist.h:29
struct push_entry * next
Definition pushlist.h:30
bool enable
Definition pushlist.h:31
const char * option
Definition pushlist.h:32
struct push_entry * head
Definition pushlist.h:36
Definition options.h:180
int proto
Definition options.h:183
const char * remote
Definition options.h:181
const char * remote_port
Definition options.h:182
sa_family_t af
Definition options.h:184
struct remote_entry ** array
Definition options.h:207
int capacity
Definition options.h:205
unsigned int flags
Definition route.h:107
unsigned int flags
Definition route.h:94
unsigned int flags
Definition misc.h:96
const char * challenge_text
Definition misc.h:98
int wins_len
Definition tun.h:116
struct in6_addr dns6[N_DHCP_ADDR]
Definition tun.h:140
in_addr_t nbdd[N_DHCP_ADDR]
Definition tun.h:123
int dns_len
Definition tun.h:112
int dns6_len
Definition tun.h:141
in_addr_t ntp[N_DHCP_ADDR]
Definition tun.h:119
int ntp_len
Definition tun.h:120
in_addr_t wins[N_DHCP_ADDR]
Definition tun.h:115
int tap_sleep
Definition tun.h:96
int dhcp_lease_time
Definition tun.h:93
in_addr_t dns[N_DHCP_ADDR]
Definition tun.h:111
const char * netbios_scope
Definition tun.h:104
int nbdd_len
Definition tun.h:124
bool ip_win32_defined
Definition tun.h:76
bool dhcp_masq_custom_offset
Definition tun.h:91
const char * domain
Definition tun.h:102
int domain_search_list_len
Definition tun.h:130
bool dhcp_renew
Definition tun.h:135
const char * domain_search_list[N_SEARCH_LIST_LEN]
Definition tun.h:129
int dhcp_masq_offset
Definition tun.h:92
int netbios_node_type
Definition tun.h:106
int ip_win32_type
Definition tun.h:84
bool dhcp_pre_release
Definition tun.h:136
bool register_dns
Definition tun.h:138
bool disable_nbt
Definition tun.h:133
int dhcp_options
Definition tun.h:100
Definition tun.h:178
struct verify_hash_list * next
Definition options.h:245
uint8_t hash[SHA256_DIGEST_LENGTH]
Definition options.h:244
unsigned short sa_family_t
Definition syshead.h:395
#define sleep(x)
Definition syshead.h:43
struct env_set * es
static bool pkcs11_id_management
struct gc_arena gc
Definition test_ssl.c:155
void ipconfig_register_dns(const struct env_set *es)
Definition tun.c:5316
int dev_type_enum(const char *dev, const char *dev_type)
Definition tun.c:547
bool dhcp_renew_by_adapter_index(const DWORD adapter_index)
Definition tun.c:5250
int ascii2ipset(const char *name)
Definition tun.c:6952
struct tuntap * init_tun(const char *dev, const char *dev_type, int topology, const char *ifconfig_local_parm, const char *ifconfig_remote_netmask_parm, const char *ifconfig_ipv6_local_parm, int ifconfig_ipv6_netbits_parm, const char *ifconfig_ipv6_remote_parm, struct addrinfo *local_public, struct addrinfo *remote_public, const bool strict_warn, struct env_set *es, openvpn_net_ctx_t *ctx, struct tuntap *tt)
Definition tun.c:874
void show_tap_win_adapters(int msglev, int warnlev)
Definition tun.c:4204
void show_adapters(int msglev)
Definition tun.c:5059
bool dhcp_release_by_adapter_index(const DWORD adapter_index)
Definition tun.c:5210
const char * dev_type_string(const char *dev, const char *dev_type)
Definition tun.c:566
void tap_allow_nonadmin_access(const char *dev_node)
Definition tun.c:5108
static bool dhcp_renew(const struct tuntap *tt)
Definition tun.c:5276
const char * ifconfig_options_string(const struct tuntap *tt, bool remote, bool disable, struct gc_arena *gc)
Definition tun.c:733
const char * ipset2ascii_all(struct gc_arena *gc)
Definition tun.c:6981
void show_valid_win32_tun_subnets(void)
Definition tun.c:4171
const char * print_tun_backend_driver(enum tun_driver_type driver)
Return a string representation of the tun backed driver type.
Definition tun.c:59
#define IPW32_SET_NETSH
Definition tun.h:79
#define IPW32_SET_ADAPTIVE
Definition tun.h:82
#define DHCP_OPTIONS_DHCP_REQUIRED
Definition tun.h:72
#define N_SEARCH_LIST_LEN
Definition tun.h:126
#define IPW32_SET_DHCP_MASQ
Definition tun.h:81
#define IPW32_SET_MANUAL
Definition tun.h:78
@ WINDOWS_DRIVER_UNSPECIFIED
Definition tun.h:45
@ WINDOWS_DRIVER_TAP_WINDOWS6
Definition tun.h:46
@ DRIVER_DCO
Definition tun.h:53
#define IPW32_SET_ADAPTIVE_DELAY_WINDOW
Definition tun.h:67
#define N_DHCP_ADDR
Definition tun.h:108
#define DHCP_OPTIONS_DHCP_OPTIONAL
Definition tun.h:71
const char * win_get_tempdir(void)
Definition win32-util.c:152
void set_win_sys_path(const char *newpath, struct env_set *es)
Definition win32.c:1120
const char * win32_version_string(struct gc_arena *gc)
Get Windows version string with architecture info.
Definition win32.c:1390
void set_pause_exit_win32(void)
Definition win32.c:146