OpenVPN
options.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>
9 * Copyright (C) 2008-2024 David Sommerseth <dazo@eurephia.org>
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2
13 * as published by the Free Software Foundation.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, write to the Free Software Foundation, Inc.,
22 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 */
24
25/*
26 * 2004-01-28: Added Socks5 proxy support
27 * (Christof Meerwald, http://cmeerw.org)
28 */
29
30#ifdef HAVE_CONFIG_H
31#include "config.h"
32#endif
33#ifdef HAVE_CONFIG_VERSION_H
34#include "config-version.h"
35#endif
36
37#include "syshead.h"
38
39#include "buffer.h"
40#include "error.h"
41#include "common.h"
42#include "run_command.h"
43#include "shaper.h"
44#include "crypto.h"
45#include "ssl.h"
46#include "ssl_ncp.h"
47#include "options.h"
48#include "misc.h"
49#include "socket.h"
50#include "packet_id.h"
51#include "pkcs11.h"
52#include "win32.h"
53#include "push.h"
54#include "pool.h"
55#include "proto.h"
56#include "helper.h"
57#include "manage.h"
58#include "forward.h"
59#include "ssl_verify.h"
60#include "platform.h"
61#include "xkey_common.h"
62#include "dco.h"
63#include "options_util.h"
64
65#include <ctype.h>
66
67#include "memdbg.h"
68
69const char title_string[] =
71#ifdef CONFIGURE_GIT_REVISION
72 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS "]"
73#endif
74 " " TARGET_ALIAS
75#if defined(ENABLE_CRYPTO_MBEDTLS)
76 " [SSL (mbed TLS)]"
77#elif defined(ENABLE_CRYPTO_OPENSSL)
78 " [SSL (OpenSSL)]"
79#else
80 " [SSL]"
81#endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
82#ifdef USE_COMP
83#ifdef ENABLE_LZO
84 " [LZO]"
85#endif
86#ifdef ENABLE_LZ4
87 " [LZ4]"
88#endif
89#ifdef ENABLE_COMP_STUB
90 " [COMP_STUB]"
91#endif
92#endif /* USE_COMP */
93#if EPOLL
94 " [EPOLL]"
95#endif
96#ifdef PRODUCT_TAP_DEBUG
97 " [TAPDBG]"
98#endif
99#ifdef ENABLE_PKCS11
100 " [PKCS11]"
101#endif
102#if ENABLE_IP_PKTINFO
103#if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
104 " [MH/PKTINFO]"
105#elif defined(IP_RECVDSTADDR)
106 " [MH/RECVDA]"
107#endif
108#endif
109 " [AEAD]"
110#ifdef ENABLE_DCO
111 " [DCO]"
112#endif
113#ifdef CONFIGURE_GIT_REVISION
114 " built on " __DATE__
115#endif
116;
117
118#ifndef ENABLE_SMALL
119
120static const char usage_message[] =
121 "%s\n"
122 "\n"
123 "General Options:\n"
124 "--config file : Read configuration options from file.\n"
125 "--help : Show options.\n"
126 "--version : Show copyright and version information.\n"
127 "\n"
128 "Tunnel Options:\n"
129 "--local host|* [port]: Local host name or IP address and port for bind.\n"
130 " If specified, OpenVPN will bindto this address. If unspecified,\n"
131 " OpenVPN will bind to all interfaces. '*' can be used as hostname\n"
132 " and means 'any host' (OpenVPN will listen on what is returned by the OS).\n"
133 " On a client, or in point-to-point mode, this can only be specified once (1 socket).\n"
134 " On an OpenVPN setup running as ``--server``, this can be specified multiple times\n"
135 " to open multiple listening sockets on different addresses and/or different ports.\n"
136 " In order to specify multiple listen ports without specifying an address, use '*'\n"
137 " to signal 'use what the operating system gives you as default', for\n"
138 " 'all IPv4 addresses' use '0.0.0.0', for 'all IPv6 addresses' use '::'.\n"
139 " ``--local`` implies ``--bind``.\n"
140 "--remote host [port] : Remote host name or ip address.\n"
141 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
142 "--remote-random-hostname : Add a random string to remote DNS name.\n"
143 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
144 "--proto p : Use protocol p for communicating with peer.\n"
145 " p = udp (default), tcp-server, tcp-client\n"
146 " udp4, tcp4-server, tcp4-client\n"
147 " udp6, tcp6-server, tcp6-client\n"
148 "--proto-force p : only consider protocol p in list of connection profiles.\n"
149 " p = udp or tcp\n"
150 "--connect-retry n [m] : For client, number of seconds to wait between\n"
151 " connection retries (default=%d). On repeated retries\n"
152 " the wait time is exponentially increased to a maximum of m\n"
153 " (default=%d).\n"
154 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
155 "--http-proxy s p [up] [auth] : Connect to remote host\n"
156 " through an HTTP proxy at address s and port p.\n"
157 " If proxy authentication is required,\n"
158 " up is a file containing username/password on 2 lines, or\n"
159 " 'stdin' to prompt from console. Add auth='ntlm2' if\n"
160 " the proxy requires NTLM authentication.\n"
161 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
162 " determine auth method and query for username/password\n"
163 " if needed. auto-nct disables weak proxy auth methods.\n"
164 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
165 " Repeat to set multiple options.\n"
166 " VERSION version (default=1.0)\n"
167 " AGENT user-agent\n"
168 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
169 " address s and port p (default port = 1080).\n"
170 " If proxy authentication is required,\n"
171 " up is a file containing username/password on 2 lines, or\n"
172 " 'stdin' to prompt for console.\n"
173 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
174 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
175 " resolve for n seconds before failing (disabled by default).\n"
176 " Set n=\"infinite\" to retry indefinitely.\n"
177 "--float : Allow remote to change its IP address/port, such as through\n"
178 " DHCP (this is the default if --remote is not used).\n"
179 "--ipchange cmd : Run command cmd on remote ip address initial\n"
180 " setting or change -- execute as: cmd ip-address port#\n"
181 "--port port : TCP/UDP port # for both local and remote.\n"
182 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
183 "--rport port : TCP/UDP port # for remote (default=%s).\n"
184 "--bind : Bind to local address and port. (This is the default unless\n"
185 " --proto tcp-client"
186 " or --http-proxy"
187 " or --socks-proxy"
188 " is used).\n"
189 "--nobind : Do not bind to local address and port.\n"
190 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n"
191 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
192 " this option only if the tun/tap device used with --dev\n"
193 " does not begin with \"tun\" or \"tap\".\n"
194 "--dev-node node : Explicitly set the device node rather than using\n"
195 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
196#if defined(ENABLE_DCO)
197 "--disable-dco : Do not attempt using Data Channel Offload.\n"
198#endif
199 "--lladdr hw : Set the link layer address of the tap device.\n"
200 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
201#ifdef ENABLE_IPROUTE
202 "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
203#endif
204 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
205 " endpoint and rn as a remote endpoint. l & rn should be\n"
206 " swapped on the other peer. l & rn must be private\n"
207 " addresses outside of the subnets used by either peer.\n"
208 " TAP: configure device to use IP address l as a local\n"
209 " endpoint and rn as a subnet mask.\n"
210 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
211 " endpoint (as a /64) and r as remote endpoint\n"
212 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
213 " pass --ifconfig parms by environment to scripts.\n"
214 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
215 " connection doesn't match the remote side.\n"
216 "--route network [netmask] [gateway] [metric] :\n"
217 " Add route to routing table after connection\n"
218 " is established. Multiple routes can be specified.\n"
219 " netmask default: 255.255.255.255\n"
220 " gateway default: taken from --route-gateway or --ifconfig\n"
221 " Specify default by leaving blank or setting to \"default\".\n"
222 "--route-ipv6 network/bits [gateway] [metric] :\n"
223 " Add IPv6 route to routing table after connection\n"
224 " is established. Multiple routes can be specified.\n"
225 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
226 " in --ifconfig-ipv6\n"
227 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
228 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
229 "--route-metric m : Specify a default metric for use with --route.\n"
230 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
231 " adding routes (may be 0). If not specified, routes will\n"
232 " be added immediately after tun/tap open. On Windows, wait\n"
233 " up to w seconds for TUN/TAP adapter to come up.\n"
234 "--route-up cmd : Run command cmd after routes are added.\n"
235 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
236 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
237 " --route-up script using environmental variables.\n"
238 "--route-nopull : When used with --client or --pull, accept options pushed\n"
239 " by server EXCEPT for routes, dns, and dhcp options.\n"
240 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
241 " --ifconfig, --route, and --route-gateway.\n"
242 "--redirect-gateway [flags]: Automatically execute routing\n"
243 " commands to redirect all outgoing IP traffic through the\n"
244 " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n"
245 " connected via a common subnet, such as with WiFi.\n"
246 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
247 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
248 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
249 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
250 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
251 " the default gateway. Useful when pushing private subnets.\n"
252 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
253 " ICMPv6 host unreachable messages on the client.\n"
254 " (Server) Instead of forwarding IPv6 packets send\n"
255 " ICMPv6 host unreachable packets to the client.\n"
256 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
257 "--push-peer-info : (client only) push client info to server.\n"
258 "--setenv name value : Set a custom environmental variable to pass to script.\n"
259 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
260 " directives for future OpenVPN versions to be ignored.\n"
261 "--ignore-unknown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
262 " these options to be ignored when unknown\n"
263 "--script-security level: Where level can be:\n"
264 " 0 -- strictly no calling of external programs\n"
265 " 1 -- (default) only call built-ins such as ifconfig\n"
266 " 2 -- allow calling of built-ins and scripts\n"
267 " 3 -- allow password to be passed to scripts via env\n"
268 "--shaper n : Restrict output to peer to n bytes per second.\n"
269 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
270 " ping once every n seconds, restart if ping not received\n"
271 " for m seconds.\n"
272 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
273 " produces a combined in/out byte count < bytes.\n"
274 "--session-timeout n: Limit connection time to n seconds.\n"
275 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
276 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
277 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
278 " remote address.\n"
279 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
280#if ENABLE_IP_PKTINFO
281 "--multihome : Configure a multi-homed UDP server.\n"
282#endif
283 "--fast-io : Optimize TUN/TAP/UDP writes.\n"
284 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
285 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
286 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
287 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
288#if PASSTOS_CAPABILITY
289 "--passtos : TOS passthrough (applies to IPv4 only).\n"
290#endif
291 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
292 " TCP/UDP MTU from it (default=%d).\n"
293 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
294 " as n bytes more than the tun-mtu size on read\n"
295 " (default TUN=0 TAP=%d).\n"
296 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
297 " from it.\n"
298 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
299 " 'no' -- Never send DF (Don't Fragment) frames\n"
300 " 'maybe' -- Use per-route hints\n"
301 " 'yes' -- Always DF (Don't Fragment)\n"
302 "--mtu-test : Empirically measure and report MTU.\n"
303#ifdef ENABLE_FRAGMENT
304 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
305 " datagrams are sent which are larger than max bytes.\n"
306 " Adds 4 bytes of overhead per datagram.\n"
307#endif
308 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
309 " or --fragment max value, whichever is lower.\n"
310 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
311 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
312#if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
313 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
314 " can be matched in policy routing and packetfilter rules.\n"
315 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
316 " listening for connections. This allows sending encrypted packets\n"
317 " via a VRF present on the system.\n"
318#endif
319 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
320#ifdef ENABLE_MEMSTATS
321 "--memstats file : Write live usage stats to memory mapped binary file.\n"
322#endif
323 "--mlock : Disable Paging -- ensures key material and tunnel\n"
324 " data will never be written to disk.\n"
325 "--up cmd : Run command cmd after successful tun device open.\n"
326 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
327 " ifconfig-local-ip ifconfig-remote-ip\n"
328 " (pre --user or --group UID/GID change)\n"
329 "--up-delay : Delay tun/tap open and possible --up script execution\n"
330 " until after TCP/UDP connection establishment with peer.\n"
331 "--down cmd : Run command cmd after tun device close.\n"
332 " (post --user/--group UID/GID change and/or --chroot)\n"
333 " (command parameters are same as --up option)\n"
334 "--down-pre : Run --down command before TUN/TAP close.\n"
335 "--up-restart : Run up/down commands for all restarts including those\n"
336 " caused by --ping-restart or SIGUSR1\n"
337 "--user user : Set UID to user after initialization.\n"
338 "--group group : Set GID to group after initialization.\n"
339 "--chroot dir : Chroot to this directory after initialization.\n"
340#ifdef ENABLE_SELINUX
341 "--setcon context: Apply this SELinux context after initialization.\n"
342#endif
343 "--cd dir : Change to this directory before initialization.\n"
344 "--daemon [name] : Become a daemon after initialization.\n"
345 " The optional 'name' parameter will be passed\n"
346 " as the program name to the system logger.\n"
347 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
348 " See --daemon above for a description of the 'name' parm.\n"
349 "--log file : Output log to file which is created/truncated on open.\n"
350 "--log-append file : Append log to file, or create file if nonexistent.\n"
351 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
352 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
353 "--writepid file : Write main process ID to file.\n"
354 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
355 "--echo [parms ...] : Echo parameters to log output.\n"
356 "--verb n : Set output verbosity to n (default=%d):\n"
357 " (Level 3 is recommended if you want a good summary\n"
358 " of what's happening without being swamped by output).\n"
359 " : 0 -- no output except fatal errors\n"
360 " : 1 -- startup info + connection initiated messages +\n"
361 " non-fatal encryption & net errors\n"
362 " : 2,3 -- show TLS negotiations & route info\n"
363 " : 4 -- show parameters\n"
364 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
365 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
366 " : 6 to 11 -- debug messages of increasing verbosity\n"
367 "--mute n : Log at most n consecutive messages in the same category.\n"
368 "--status file [n] : Write operational status to file every n seconds.\n"
369 "--status-version [n] : Choose the status file format version number.\n"
370 " Currently, n can be 1, 2, or 3 (default=1).\n"
371 "--disable-occ : (DEPRECATED) Disable options consistency check between peers.\n"
372#ifdef ENABLE_DEBUG
373 "--gremlin mask : Special stress testing mode (for debugging only).\n"
374#endif
375#if defined(USE_COMP)
376 "--compress alg : Use compression algorithm alg\n"
377 "--allow-compression: Specify whether compression should be allowed\n"
378#if defined(ENABLE_LZO)
379 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
380 " packet for incompressible data.\n"
381 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
382 " is specified.\n"
383#endif
384#endif
385#ifdef ENABLE_MANAGEMENT
386 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
387 " management functions. pass is a password file\n"
388 " or 'stdin' to prompt from console.\n"
389#if UNIX_SOCK_SUPPORT
390 " To listen on a unix domain socket, specific the pathname\n"
391 " in place of ip and use 'unix' as the port number.\n"
392#endif
393 "--management-client : Management interface will connect as a TCP client to\n"
394 " ip/port rather than listen as a TCP server.\n"
395 "--management-query-passwords : Query management channel for private key\n"
396 " and auth-user-pass passwords.\n"
397 "--management-query-proxy : Query management channel for proxy information.\n"
398 "--management-query-remote : Query management channel for --remote directive.\n"
399 "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
400 " of the management interface explicitly starts it.\n"
401 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
402 "--management-forget-disconnect : Forget passwords when management disconnect\n"
403 " event occurs.\n"
404 "--management-up-down : Report tunnel up/down events to management interface.\n"
405 "--management-log-cache n : Cache n lines of log file history for usage\n"
406 " by the management channel.\n"
407#if UNIX_SOCK_SUPPORT
408 "--management-client-user u : When management interface is a unix socket, only\n"
409 " allow connections from user u.\n"
410 "--management-client-group g : When management interface is a unix socket, only\n"
411 " allow connections from group g.\n"
412#endif
413 "--management-client-auth : gives management interface client the responsibility\n"
414 " to authenticate clients after their client certificate\n"
415 " has been verified.\n"
416#endif /* ifdef ENABLE_MANAGEMENT */
417#ifdef ENABLE_PLUGIN
418 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
419 " to its initialization function.\n"
420#endif
421 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
422 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
423 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
424 "\n"
425 "Multi-Client Server options (when --mode server is used):\n"
426 "--server network netmask : Helper option to easily configure server mode.\n"
427 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
428 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
429 " easily configure ethernet bridging server mode.\n"
430 "--push \"option\" : Push a config file option back to the peer for remote\n"
431 " execution. Peer must specify --pull in its config file.\n"
432 "--push-reset : Don't inherit global push list for specific\n"
433 " client instance.\n"
434 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
435 " a specific client instance.\n"
436 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
437 " to be dynamically allocated to connecting clients.\n"
438 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
439 " data to file, at seconds intervals (default=600).\n"
440 " If seconds=0, file will be treated as read-only.\n"
441 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
442 " to be dynamically allocated to connecting clients.\n"
443 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
444 " overrides --ifconfig-pool dynamic allocation.\n"
445 " Only valid in a client-specific config file.\n"
446 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
447 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
448 " Only valid in a client-specific config file.\n"
449 "--iroute network [netmask] : Route subnet to client.\n"
450 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
451 " Sets up internal routes only.\n"
452 " Only valid in a client-specific config file.\n"
453 "--disable : Client is disabled.\n"
454 " Only valid in a client-specific config file.\n"
455 "--override-username: Overrides the client-specific username to be used.\n"
456 " Only valid in a client-specific config file.\n"
457 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
458 " mandatory client certificate verification.\n"
459 " Default is to require the client to supply a certificate.\n"
460 "--username-as-common-name : For auth-user-pass authentication, use\n"
461 " the authenticated username as the common name,\n"
462 " rather than the common name from the client cert.\n"
463 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
464 " run command cmd to verify. If method='via-env', pass\n"
465 " user/pass via environment, if method='via-file', pass\n"
466 " user/pass via temporary file.\n"
467 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
468 " to each client, replacing the password. Useful when\n"
469 " OTP based two-factor auth mechanisms are in use and\n"
470 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
471 " for generated tokens can be set.\n"
472 "--opt-verify : (DEPRECATED) Clients that connect with options that are incompatible\n"
473 " with those of the server will be disconnected.\n"
474 "--auth-user-pass-optional : Allow connections by clients that don't\n"
475 " specify a username/password.\n"
476 "--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n"
477 " any printable character.\n"
478 "--client-to-client : Internally route client-to-client traffic.\n"
479 "--duplicate-cn : Allow multiple clients with the same common name to\n"
480 " concurrently connect.\n"
481 "--client-connect cmd : Run command cmd on client connection.\n"
482 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
483 "--client-config-dir dir : Directory for custom client config files.\n"
484 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
485 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
486 "--hash-size r v : Set the size of the real address hash table to r and the\n"
487 " virtual address table to v.\n"
488 "--bcast-buffers n : Allocate n broadcast buffers.\n"
489 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
490 "--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server\n"
491 " as well as pushes it to connecting clients.\n"
492 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
493 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
494 "--connect-freq-initial n s : Allow a maximum of n replies for initial connections attempts per s seconds.\n"
495 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
496 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
497 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
498 " older than n seconds. Run this check every t\n"
499 " seconds (defaults to n).\n"
500 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
501 " clients. n = 1 - reconnect to same server,\n"
502 " 2 - advance to next server, default=1.\n"
503#if PORT_SHARE
504 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
505 " sessions to a web server at host:port. dir specifies an\n"
506 " optional directory to write origin IP:port data.\n"
507#endif
508 "\n"
509 "Client options (when connecting to a multi-client server):\n"
510 "--client : Helper option to easily configure client mode.\n"
511 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
512 " up is a file containing the username on the first line,\n"
513 " and a password on the second. If either the password or both\n"
514 " the username and the password are omitted OpenVPN will prompt\n"
515 " for them from console.\n"
516 "--pull : Accept certain config file options from the peer as if they\n"
517 " were part of the local config file. Must be specified\n"
518 " when connecting to a '--mode server' remote host.\n"
519 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
520 " server if it starts with the text t. The action flag accept,\n"
521 " ignore or reject causes the option to be allowed, removed or\n"
522 " rejected with error. May be specified multiple times, and\n"
523 " each filter is applied in the order of appearance.\n"
524 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
525 " Valid options are :\n"
526 " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n"
527 " resolve-domains <domain> [domain ...] : split domains\n"
528 " dnssec <yes|no|optional> : option to use DNSSEC\n"
529 " type <DoH|DoT> : query server over HTTPS / TLS\n"
530 " sni <domain> : DNS server name indication\n"
531 "--dns search-domains <domain> [domain ...]:\n"
532 " Add domains to DNS domain search list\n"
533 "--auth-retry t : How to handle auth failures. Set t to\n"
534 " none (default), interact, or nointeract.\n"
535 "--static-challenge t e [<scrv1|concat>]: Enable static challenge/response protocol using\n"
536 " challenge text t, with e indicating echo flag (0|1)\n"
537 " and optional argument scrv1 or concat to use SCRV1 protocol or"
538 " concatenate response with password. Default is scrv1.\n"
539 "--connect-timeout n : when polling possible remote servers to connect to\n"
540 " in a round-robin fashion, spend no more than n seconds\n"
541 " waiting for a response before trying the next server.\n"
542 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
543 " incoming tun packets with same destination as host.\n"
544 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
545 " server/remote. n = # of retries, default=1.\n"
546 "\n"
547 "Data Channel Encryption Options (must be compatible between peers):\n"
548 "(These options are meaningful for both Static Key & TLS-mode)\n"
549 "--auth alg : Authenticate packets with HMAC using message\n"
550 " digest algorithm alg (default=%s).\n"
551 " (usually adds 16 or 20 bytes per packet)\n"
552 " Set alg=none to disable authentication.\n"
553 "--cipher alg : Encrypt packets with cipher algorithm alg.\n"
554 " You should usually use --data-ciphers instead.\n"
555 " Set alg=none to disable encryption.\n"
556 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
557#ifndef ENABLE_CRYPTO_MBEDTLS
558 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
559#endif
560 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
561 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
562 " and a time window of t seconds.\n"
563 " Default n=%d t=%d\n"
564 "--replay-persist file : Persist replay-protection state across sessions\n"
565 " using file.\n"
566 "--test-crypto : Run a self-test of crypto features enabled.\n"
567 " For debugging only.\n"
568#ifdef ENABLE_PREDICTION_RESISTANCE
569 "--use-prediction-resistance: Enable prediction resistance on the random\n"
570 " number generator.\n"
571#endif
572 "\n"
573 "TLS Key Negotiation Options:\n"
574 "(These options are meaningful only for TLS-mode)\n"
575 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
576 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
577 "--ca file : Certificate authority file in .pem format containing\n"
578 " root certificate.\n"
579#ifndef ENABLE_CRYPTO_MBEDTLS
580 "--capath dir : A directory of trusted certificates (CAs"
581 " and CRLs).\n"
582#endif /* ENABLE_CRYPTO_MBEDTLS */
583 "--dh file : File containing Diffie Hellman parameters\n"
584 " in .pem format (for --tls-server only).\n"
585 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
586 "--cert file : Local certificate in .pem format or a URI -- must be signed\n"
587 " by a Certificate Authority in --ca file used by the peer.\n"
588 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
589 "--key file : Local private key in .pem format or a URI.\n"
590 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
591 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
592 " is specified, require max TLS version supported by SSL implementation.\n"
593 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
594#ifndef ENABLE_CRYPTO_MBEDTLS
595 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
596 " and optionally the root CA certificate.\n"
597#endif
598#ifdef ENABLE_X509ALTUSERNAME
599 "--x509-username-field : Field in x509 certificate containing the username.\n"
600 " Default is CN in the Subject field.\n"
601#endif
602 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
603 " Valid algo flags are SHA1 and SHA256. \n"
604#ifdef _WIN32
605 "--cryptoapicert select-string : Load the certificate and private key from the\n"
606 " Windows Certificate System Store.\n"
607#endif
608 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
609 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites separated by : (optional)\n"
610 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
611 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
612 " (default=legacy).\n"
613 "--providers l : A list l of OpenSSL providers to load.\n"
614 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
615 " if no ACK from remote within n seconds (default=%d).\n"
616 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
617 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
618 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
619 " and at least min (defaults to 90%% of max on servers and equal\n"
620 " to max on clients).\n"
621 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
622 " of handshake initiation by any peer (default=%d).\n"
623 "--tran-window n : Transition window -- old key can live this many seconds\n"
624 " after new key renegotiation begins (default=%d).\n"
625 "--single-session: Allow only one session (reset state on restart).\n"
626 "--tls-exit : Exit on TLS negotiation failure.\n"
627 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
628 " control channel to protect against attacks on the TLS stack\n"
629 " and DoS attacks.\n"
630 " f (required) is a shared-secret key file.\n"
631 " The optional d parameter controls key directionality.\n"
632 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
633 " of the TLS control channel to hide the TLS certificate,\n"
634 " provide basic post-quantum security and protect against\n"
635 " attacks on the TLS stack and DoS attacks.\n"
636 " key (required) provides the pre-shared key file.\n"
637 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
638 " For servers: use key to decrypt client-specific keys. For\n"
639 " key generation (--genkey tls-crypt-v2-client): use key to\n"
640 " encrypt generated client-specific key. (See --tls-crypt.)\n"
641 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
642 " fresh tls-crypt-v2 client key, and store to\n"
643 " keyfile. If supplied, include metadata in wrapped key.\n"
644 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
645 " fresh tls-crypt-v2 server key, and store to keyfile\n"
646 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
647 " client-supplied tls-crypt-v2 client key\n"
648 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
649 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
650 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
651 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
652 " pending TLS connection that has otherwise passed all other\n"
653 " tests of certification. cmd should return 0 to allow\n"
654 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
655 " executed as 'cmd certificate_depth subject')\n"
656 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
657 " DN name. The remote host must also pass all other tests\n"
658 " of verification.\n"
659#ifndef ENABLE_CRYPTO_MBEDTLS
660 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
661 " an explicit nsCertType designation t = 'client' | 'server'.\n"
662#endif
663 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
664 " plugins and management interface.\n"
665#ifdef HAVE_EXPORT_KEYING_MATERIAL
666 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
667 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
668#endif
669 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
670 " explicit key usage, you can specify more than one value.\n"
671 " value should be given in hex format.\n"
672 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
673 " explicit extended key usage. Extended key usage can be encoded\n"
674 " as an object identifier or OpenSSL string representation.\n"
675 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
676 " key usage and extended key usage based on RFC3280 TLS rules.\n"
677 " t = 'client' | 'server'.\n"
678#ifdef ENABLE_PKCS11
679 "\n"
680 "PKCS#11 Options:\n"
681 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
682 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
683 " path. Set for each provider.\n"
684 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
685 " 0 : Try to determine automatically (default).\n"
686 " 1 : Use Sign.\n"
687 " 2 : Use SignRecover.\n"
688 " 4 : Use Decrypt.\n"
689 " 8 : Use Unwrap.\n"
690 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
691 " certificate can be accessed. Set for each provider.\n"
692 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
693 " cache until token is removed.\n"
694 "--pkcs11-id-management : Acquire identity from management interface.\n"
695 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
696#endif /* ENABLE_PKCS11 */
697 "\n"
698 "SSL Library information:\n"
699 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
700 "--show-digests : Show message digest algorithms to use with --auth option.\n"
701 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
702 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
703#ifdef _WIN32
704 "\n"
705 "Windows Specific:\n"
706 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
707 " from SystemRoot environment variable.\n"
708 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
709 " IP address using method = manual, netsh, ipapi,\n"
710 " dynamic, or adaptive (default = adaptive).\n"
711 " Dynamic method allows two optional parameters:\n"
712 " offset: DHCP server address offset (> -256 and < 256).\n"
713 " If 0, use network address, if >0, take nth\n"
714 " address forward from network address, if <0,\n"
715 " take nth address backward from broadcast\n"
716 " address.\n"
717 " Default is 0.\n"
718 " lease-time: Lease time in seconds.\n"
719 " Default is one year.\n"
720 "--route-method : Which method to use for adding routes on Windows?\n"
721 " adaptive (default) -- Try ipapi then fall back to exe.\n"
722 " ipapi -- Use IP helper API.\n"
723 " exe -- Call the route.exe shell command.\n"
724 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
725 " be used with --ip-win32 dynamic. For options\n"
726 " which allow multiple addresses,\n"
727 " --dhcp-option must be repeated.\n"
728 " DOMAIN name : Set DNS suffix\n"
729 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
730 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
731 " NTP : Set NTP server address(es)\n"
732 " NBDD : Set NBDD server address(es)\n"
733 " WINS addr : Set WINS server address(es)\n"
734 " NBT type : Set NetBIOS over TCP/IP Node type\n"
735 " 1: B, 2: P, 4: M, 8: H\n"
736 " NBS id : Set NetBIOS scope ID\n"
737 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
738 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
739 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
740 " startup.\n"
741 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
742 " on connection initiation.\n"
743 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
744 " attempting to set adapter properties.\n"
745 "--pause-exit : When run from a console window, pause before exiting.\n"
746 "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n"
747 " service, and should not be used directly by end-users.\n"
748 " ex is the name of an event object which, when\n"
749 " signaled, will cause " PACKAGE_NAME " to exit. A second\n"
750 " optional parameter controls the initial state of ex.\n"
751 "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n"
752 " after TAP adapter is up and routes have been added.\n"
753 "--windows-driver : Which tun driver to use?\n"
754 " ovpn-dco (default)\n"
755 " tap-windows6\n"
756 " wintun\n"
757 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
758 "Windows Standalone Options:\n"
759 "\n"
760 "--show-adapters : Show all TAP-Windows adapters.\n"
761 "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n"
762 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
763 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME " running without admin privileges\n"
764 " to access TAP adapter.\n"
765#endif /* ifdef _WIN32 */
766 "\n"
767 "Generate a new key :\n"
768 "--genkey tls-auth file : Generate a new random key of type and write to file\n"
769 " (for use with --tls-auth or --tls-crypt)."
770#ifdef ENABLE_FEATURE_TUN_PERSIST
771 "\n"
772 "Tun/tap config mode (available with linux 2.4+):\n"
773 "--mktun : Create a persistent tunnel.\n"
774 "--rmtun : Remove a persistent tunnel.\n"
775 "--dev tunX|tapX : tun/tap device\n"
776 "--dev-type dt : Device type. See tunnel options above for details.\n"
777 "--user user : User to set privilege to.\n"
778 "--group group : Group to set privilege to.\n"
779#endif
780#ifdef ENABLE_PKCS11
781 "\n"
782 "PKCS#11 standalone options:\n"
783#ifdef DEFAULT_PKCS11_MODULE
784 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
785#else
786 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
787#endif
788 " --verb option can be added *BEFORE* this.\n"
789#endif /* ENABLE_PKCS11 */
790 "\n"
791 "General Standalone Options:\n"
792#ifdef ENABLE_DEBUG
793 "--show-gateway [address]: Show info about gateway [to v4/v6 address].\n"
794#endif
795;
796
797#endif /* !ENABLE_SMALL */
798
799/*
800 * This is where the options defaults go.
801 * Any option not explicitly set here
802 * will be set to 0.
803 */
804void
805init_options(struct options *o, const bool init_gc)
806{
807 CLEAR(*o);
808 if (init_gc)
809 {
810 gc_init(&o->gc);
812 o->gc_owned = true;
813 }
815 o->topology = TOP_UNDEF;
816 o->ce.proto = PROTO_UDP;
817 o->ce.af = AF_UNSPEC;
818 o->ce.bind_ipv6_only = false;
821 o->ce.connect_timeout = 120;
822 o->connect_retry_max = 0;
824 o->verbosity = 1;
826 o->status_file_version = 1;
827 o->ce.bind_local = true;
829 o->ce.occ_mtu = 0;
832 o->ce.mtu_discover_type = -1;
833 o->ce.mssfix = 0;
834 o->ce.mssfix_default = true;
835 o->ce.mssfix_encap = true;
836 o->route_delay_window = 30;
838 o->resolve_in_advance = false;
839 o->proto_force = -1;
840 o->occ = true;
841#ifdef ENABLE_MANAGEMENT
845#endif
846#ifdef ENABLE_FEATURE_TUN_PERSIST
847 o->persist_mode = 1;
848#endif
849#ifdef _WIN32
850#if 0
852#else
854#endif
855 o->tuntap_options.dhcp_lease_time = 31536000; /* one year */
856 /* use network address as internal DHCP server address */
859 o->block_outside_dns = false;
861#endif
863 o->vlan_pvid = 1;
864 o->real_hash_size = 256;
865 o->virtual_hash_size = 256;
866 o->n_bcast_buf = 256;
867 o->tcp_queue_limit = 64;
868 o->max_clients = 1024;
869 o->cf_initial_per = 10;
870 o->cf_initial_max = 100;
871 o->max_routes_per_client = 256;
875 o->authname = "SHA1";
879#ifdef ENABLE_PREDICTION_RESISTANCE
880 o->use_prediction_resistance = false;
881#endif
882 o->tls_timeout = 2;
883 o->renegotiate_bytes = -1;
884 o->renegotiate_seconds = 3600;
886 o->handshake_window = 60;
887 o->transition_window = 3600;
888 o->tls_cert_profile = NULL;
889 o->ecdh_curve = NULL;
890#ifdef ENABLE_X509ALTUSERNAME
891 o->x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT;
892#endif
893#ifdef ENABLE_PKCS11
894 o->pkcs11_pin_cache_period = -1;
895#endif /* ENABLE_PKCS11 */
896
897 /* P2MP server context features */
898 o->auth_token_generate = false;
899
900 /* Set default --tmp-dir */
901#ifdef _WIN32
902 /* On Windows, find temp dir via environment variables */
904
905 if (!o->tmp_dir)
906 {
907 /* Error out if we can't find a valid temporary directory, which should
908 * be very unlikely. */
909 msg(M_USAGE, "Could not find a suitable temporary directory."
910 " (GetTempPath() failed). Consider using --tmp-dir");
911 }
912#else /* ifdef _WIN32 */
913 /* Non-windows platforms use $TMPDIR, and if not set, default to '/tmp' */
914 o->tmp_dir = getenv("TMPDIR");
915 if (!o->tmp_dir)
916 {
917 o->tmp_dir = "/tmp";
918 }
919#endif /* _WIN32 */
920 o->allow_recursive_routing = false;
921
922#ifndef ENABLE_DCO
923 o->disable_dco = true;
924#endif /* ENABLE_DCO */
925}
926
927void
929{
930 if (o->connection_list)
931 {
933 }
934 if (o->remote_list)
935 {
936 CLEAR(*o->remote_list);
937 }
938 if (o->gc_owned)
939 {
940 gc_free(&o->gc);
942 }
943}
944
946{
947#define PUF_TYPE_UNDEF 0
948#define PUF_TYPE_ACCEPT 1
949#define PUF_TYPE_IGNORE 2
950#define PUF_TYPE_REJECT 3
951 int type;
952 int size;
953 char *pattern;
955};
956
958{
961};
962
963#ifndef ENABLE_SMALL
964
965static const char *
967{
968 if (type == PUF_TYPE_ACCEPT)
969 {
970 return "accept";
971 }
972 if (type == PUF_TYPE_IGNORE)
973 {
974 return "ignore";
975 }
976 if (type == PUF_TYPE_REJECT)
977 {
978 return "reject";
979 }
980 else
981 {
982 return "???";
983 }
984}
985
986#define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
987#define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
988#define SHOW_STR_INLINE(var) SHOW_PARM(var, \
989 o->var ## _inline ? "[INLINE]" : \
990 (o->var ? o->var : "[UNDEF]"), \
991 "'%s'")
992#define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
993#define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
994#define SHOW_INT64(var) SHOW_PARM(var, o->var, "%" PRIi64)
995#define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
996#define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
997
998#endif /* ifndef ENABLE_SMALL */
999
1000static void
1002 const struct connection_entry *e,
1003 const int i)
1004{
1005 setenv_str_i(es, "remote", e->remote, i);
1006 setenv_str_i(es, "remote_port", e->remote_port, i);
1007
1008 if (e->http_proxy_options)
1009 {
1010 setenv_str_i(es, "http_proxy_server", e->http_proxy_options->server, i);
1011 setenv_str_i(es, "http_proxy_port", e->http_proxy_options->port, i);
1012 }
1013 if (e->socks_proxy_server)
1014 {
1015 setenv_str_i(es, "socks_proxy_server", e->socks_proxy_server, i);
1016 setenv_str_i(es, "socks_proxy_port", e->socks_proxy_port, i);
1017 }
1018}
1019
1020static void
1022 const struct local_entry *e,
1023 const int i)
1024{
1025 setenv_str_i(es, "proto", proto2ascii(e->proto, AF_UNSPEC, false), i);
1026 setenv_str_i(es, "local", e->local, i);
1027 setenv_str_i(es, "local_port", e->port, i);
1028}
1029
1030void
1031setenv_settings(struct env_set *es, const struct options *o)
1032{
1033 setenv_str(es, "config", o->config);
1034 setenv_int(es, "verb", o->verbosity);
1035 setenv_int(es, "daemon", o->daemon);
1036 setenv_int(es, "daemon_log_redirect", o->log);
1037 setenv_long_long(es, "daemon_start_time", time(NULL));
1038 setenv_int(es, "daemon_pid", platform_getpid());
1039
1040 if (o->connection_list)
1041 {
1042 int i;
1043 for (i = 0; i < o->connection_list->len; ++i)
1044 {
1046 }
1047 }
1048 else
1049 {
1050 setenv_connection_entry(es, &o->ce, 1);
1051 }
1052
1053 if (o->ce.local_list)
1054 {
1055 for (int i = 0; i < o->ce.local_list->len; i++)
1056 {
1057 setenv_local_entry(es, o->ce.local_list->array[i], i+1);
1058 }
1059 }
1060
1061 if (!o->pull)
1062 {
1064 }
1065}
1066
1067#ifndef _WIN32
1068static void
1069setenv_foreign_option(struct options *o, const char *argv[], int len, struct env_set *es)
1070{
1071 if (len > 0)
1072 {
1073 struct gc_arena gc = gc_new();
1074 struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1075 struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1076 int i;
1077 bool first = true;
1078 bool good = true;
1079
1080 good &= buf_printf(&name, "foreign_option_%d", o->foreign_option_index + 1);
1081 ++o->foreign_option_index;
1082 for (i = 0; i < len; ++i)
1083 {
1084 if (argv[i])
1085 {
1086 if (!first)
1087 {
1088 good &= buf_printf(&value, " ");
1089 }
1090 good &= buf_printf(&value, "%s", argv[i]);
1091 first = false;
1092 }
1093 }
1094 if (good)
1095 {
1096 setenv_str(es, BSTR(&name), BSTR(&value));
1097 }
1098 else
1099 {
1100 msg(M_WARN, "foreign_option: name/value overflow");
1101 }
1102 gc_free(&gc);
1103 }
1104}
1105#endif /* ifndef _WIN32 */
1106
1107static in_addr_t
1108get_ip_addr(const char *ip_string, int msglevel, bool *error)
1109{
1110 unsigned int flags = GETADDR_HOST_ORDER;
1111 bool succeeded = false;
1112 in_addr_t ret;
1113
1114 if (msglevel & M_FATAL)
1115 {
1116 flags |= GETADDR_FATAL;
1117 }
1118
1119 ret = getaddr(flags, ip_string, 0, &succeeded, NULL);
1120 if (!succeeded && error)
1121 {
1122 *error = true;
1123 }
1124 return ret;
1125}
1126
1132static char *
1133get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
1134{
1135 const char *end = strchr(addr, '/');
1136 char *ret = NULL;
1137 if (NULL == end)
1138 {
1139 ret = string_alloc(addr, gc);
1140 }
1141 else
1142 {
1143 size_t len = end - addr;
1144 ret = gc_malloc(len + 1, true, gc);
1145 memcpy(ret, addr, len);
1146 }
1147 return ret;
1148}
1149
1150static bool
1152{
1153 struct in6_addr t_addr;
1154 unsigned int t_bits;
1155
1156 return get_ipv6_addr( ipv6_prefix_spec, &t_addr, &t_bits, M_WARN );
1157}
1158
1159static char *
1160string_substitute(const char *src, int from, int to, struct gc_arena *gc)
1161{
1162 char *ret = (char *) gc_malloc(strlen(src) + 1, true, gc);
1163 char *dest = ret;
1164 char c;
1165
1166 do
1167 {
1168 c = *src++;
1169 if (c == from)
1170 {
1171 c = to;
1172 }
1173 *dest++ = c;
1174 }
1175 while (c);
1176 return ret;
1177}
1178
1188static struct verify_hash_list *
1189parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
1190{
1191 int i = 0;
1192 const char *cp = str;
1193
1194 struct verify_hash_list *ret;
1196
1197 char term = 0;
1198 unsigned int byte;
1199
1200 while (*cp && i < nbytes)
1201 {
1202 /* valid segments consist of exactly two hex digits, then ':' or EOS */
1203 if (!isxdigit(cp[0])
1204 || !isxdigit(cp[1])
1205 || (cp[2] != ':' && cp[2] != '\0')
1206 || sscanf(cp, "%x", &byte) != 1)
1207 {
1208 msg(msglevel, "format error in hash fingerprint: %s", str);
1209 break;
1210 }
1211
1212 ret->hash[i++] = (uint8_t)byte;
1213
1214 term = cp[2];
1215 if (term == '\0')
1216 {
1217 break;
1218 }
1219 cp += 3;
1220 }
1221 if (i < nbytes)
1222 {
1223 msg(msglevel, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes, i, str);
1224 }
1225 else if (term != '\0')
1226 {
1227 msg(msglevel, "hash fingerprint too long - expected only %d bytes: %s", nbytes, str);
1228 }
1229 return ret;
1230}
1231
1242static struct verify_hash_list *
1243parse_hash_fingerprint_multiline(const char *str, int nbytes, int msglevel,
1244 struct gc_arena *gc)
1245{
1246 struct gc_arena gc_temp = gc_new();
1247 char *lines = string_alloc(str, &gc_temp);
1248
1249 struct verify_hash_list *ret = NULL;
1250
1251 const char *line;
1252 while ((line = strsep(&lines, "\n")))
1253 {
1254 /* ignore leading whitespace */
1255 while (isspace(*line))
1256 {
1257 line++;
1258 }
1259 /* skip empty lines and comment lines */
1260 if (strlen(line) == 0 || *line == '#' || *line == ';')
1261 {
1262 continue;
1263 }
1264
1265 struct verify_hash_list *hash = parse_hash_fingerprint(line, nbytes,
1266 msglevel, gc);
1267
1268 if (!hash)
1269 {
1270 gc_free(&gc_temp);
1271 return NULL;
1272 }
1273
1274 hash->next = ret;
1275 ret = hash;
1276 }
1277 gc_free(&gc_temp);
1278
1279 return ret;
1280}
1281#ifdef _WIN32
1282
1283#ifndef ENABLE_SMALL
1284
1285static void
1286show_dhcp_option_list(const char *name, const char *const *array, int len)
1287{
1288 int i;
1289 for (i = 0; i < len; ++i)
1290 {
1291 msg(D_SHOW_PARMS, " %s[%d] = %s", name, i, array[i] );
1292 }
1293}
1294
1295static void
1296show_dhcp_option_addrs(const char *name, const in_addr_t *array, int len)
1297{
1298 struct gc_arena gc = gc_new();
1299 int i;
1300 for (i = 0; i < len; ++i)
1301 {
1302 msg(D_SHOW_PARMS, " %s[%d] = %s",
1303 name,
1304 i,
1305 print_in_addr_t(array[i], 0, &gc));
1306 }
1307 gc_free(&gc);
1308}
1309
1310static void
1312{
1313 SHOW_BOOL(ip_win32_defined);
1314 SHOW_INT(ip_win32_type);
1315 SHOW_INT(dhcp_masq_offset);
1316 SHOW_INT(dhcp_lease_time);
1317 SHOW_INT(tap_sleep);
1318 SHOW_UNSIGNED(dhcp_options);
1320 SHOW_BOOL(dhcp_pre_release);
1321 SHOW_STR(domain);
1322 SHOW_STR(netbios_scope);
1323 SHOW_INT(netbios_node_type);
1324 SHOW_BOOL(disable_nbt);
1325
1326 show_dhcp_option_addrs("DNS", o->dns, o->dns_len);
1327 show_dhcp_option_addrs("WINS", o->wins, o->wins_len);
1328 show_dhcp_option_addrs("NTP", o->ntp, o->ntp_len);
1329 show_dhcp_option_addrs("NBDD", o->nbdd, o->nbdd_len);
1331}
1332
1333#endif /* ifndef ENABLE_SMALL */
1334#endif /* ifdef _WIN32 */
1335
1336#if defined(_WIN32) || defined(TARGET_ANDROID)
1337static void
1338dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel)
1339{
1340 struct in6_addr addr;
1341 if (*len >= N_DHCP_ADDR)
1342 {
1343 msg(msglevel, "--dhcp-option DNS: maximum of %d IPv6 dns servers can be specified",
1344 N_DHCP_ADDR);
1345 }
1346 else if (get_ipv6_addr(parm, &addr, NULL, msglevel))
1347 {
1348 dns6_list[(*len)++] = addr;
1349 }
1350}
1351static void
1352dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
1353{
1354 if (*len >= N_DHCP_ADDR)
1355 {
1356 msg(msglevel, "--dhcp-option %s: maximum of %d %s servers can be specified",
1357 name,
1359 name);
1360 }
1361 else
1362 {
1363 if (ip_addr_dotted_quad_safe(parm)) /* FQDN -- IP address only */
1364 {
1365 bool error = false;
1366 const in_addr_t addr = get_ip_addr(parm, msglevel, &error);
1367 if (!error)
1368 {
1369 array[(*len)++] = addr;
1370 }
1371 }
1372 else
1373 {
1374 msg(msglevel, "dhcp-option parameter %s '%s' must be an IP address", name, parm);
1375 }
1376 }
1377}
1378
1379/*
1380 * If DNS options are set use these for TUN/TAP options as well.
1381 * Applies to DNS, DNS6 and DOMAIN-SEARCH.
1382 * Existing options will be discarded.
1383 */
1384static void
1386{
1387 struct tuntap_options *tt = &o->tuntap_options;
1388 struct dns_options *dns = &o->dns_options;
1389
1390 if (dns->search_domains)
1391 {
1392 tt->domain_search_list_len = 0;
1393 const struct dns_domain *domain = dns->search_domains;
1394 while (domain && tt->domain_search_list_len < N_SEARCH_LIST_LEN)
1395 {
1396 tt->domain_search_list[tt->domain_search_list_len++] = domain->name;
1397 domain = domain->next;
1398 }
1399 if (domain)
1400 {
1401 msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to --dhcp-option");
1402 }
1404 }
1405
1406 if (dns->servers)
1407 {
1408 tt->dns_len = 0;
1409 tt->dns6_len = 0;
1410 bool overflow = false;
1411 const struct dns_server *server = dns->servers;
1412 while (server)
1413 {
1414 for (int i = 0; i < server->addr_count; ++i)
1415 {
1416 if (server->addr[i].family == AF_INET)
1417 {
1418 if (tt->dns_len >= N_DHCP_ADDR)
1419 {
1420 overflow = true;
1421 continue;
1422 }
1423 tt->dns[tt->dns_len++] = ntohl(server->addr[i].in.a4.s_addr);
1424 }
1425 else
1426 {
1427 if (tt->dns6_len >= N_DHCP_ADDR)
1428 {
1429 overflow = true;
1430 continue;
1431 }
1432 tt->dns6[tt->dns6_len++] = server->addr[i].in.a6;
1433 }
1434 }
1435 server = server->next;
1436 }
1437 if (overflow)
1438 {
1439 msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to --dhcp-option");
1440 }
1442 }
1443}
1444#else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1445static void
1446foreign_options_copy_dns(struct options *o, struct env_set *es)
1447{
1448 const struct dns_domain *domain = o->dns_options.search_domains;
1449 const struct dns_server *server = o->dns_options.servers;
1450 if (!domain && !server)
1451 {
1452 return;
1453 }
1454
1455 /* reset the index since we're starting all over again */
1456 int opt_max = o->foreign_option_index;
1457 o->foreign_option_index = 0;
1458
1459 for (int i = 1; i <= opt_max; ++i)
1460 {
1461 char name[32];
1462 snprintf(name, sizeof(name), "foreign_option_%d", i);
1463
1464 const char *env_str = env_set_get(es, name);
1465 const char *value = strchr(env_str, '=') + 1;
1466 if ((domain && strstr(value, "dhcp-option DOMAIN-SEARCH") == value)
1467 || (server && strstr(value, "dhcp-option DNS") == value))
1468 {
1469 setenv_del(es, name);
1470 }
1471 else
1472 {
1473 setenv_foreign_option(o, &value, 1, es);
1474 }
1475 }
1476
1477 struct gc_arena gc = gc_new();
1478
1479 while (server)
1480 {
1481 for (size_t i = 0; i < server->addr_count; ++i)
1482 {
1483 if (server->addr[i].family == AF_INET)
1484 {
1485 const char *argv[] = {
1486 "dhcp-option",
1487 "DNS",
1488 print_in_addr_t(server->addr[i].in.a4.s_addr, 0, &gc)
1489 };
1490 setenv_foreign_option(o, argv, 3, es);
1491 }
1492 else
1493 {
1494 const char *argv[] = {
1495 "dhcp-option",
1496 "DNS6",
1497 print_in6_addr(server->addr[i].in.a6, 0, &gc)
1498 };
1499 setenv_foreign_option(o, argv, 3, es);
1500 }
1501 }
1502 server = server->next;
1503 }
1504 while (domain)
1505 {
1506 const char *argv[] = { "dhcp-option", "DOMAIN-SEARCH", domain->name };
1507 setenv_foreign_option(o, argv, 3, es);
1508 domain = domain->next;
1509 }
1510
1511 gc_free(&gc);
1512
1513 /* remove old leftover entries */
1514 while (o->foreign_option_index < opt_max)
1515 {
1516 char name[32];
1517 snprintf(name, sizeof(name), "foreign_option_%d", opt_max--);
1518 setenv_del(es, name);
1519 }
1520}
1521#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1522
1523#ifndef ENABLE_SMALL
1524static const char *
1526{
1527 switch (mode)
1528 {
1529 case VLAN_ONLY_TAGGED:
1530 return "tagged";
1531
1533 return "untagged";
1534
1535 case VLAN_ALL:
1536 return "all";
1537 }
1538 return NULL;
1539}
1540
1541static void
1542show_p2mp_parms(const struct options *o)
1543{
1544 struct gc_arena gc = gc_new();
1545
1546 msg(D_SHOW_PARMS, " server_network = %s", print_in_addr_t(o->server_network, 0, &gc));
1547 msg(D_SHOW_PARMS, " server_netmask = %s", print_in_addr_t(o->server_netmask, 0, &gc));
1548 msg(D_SHOW_PARMS, " server_network_ipv6 = %s", print_in6_addr(o->server_network_ipv6, 0, &gc) );
1549 SHOW_INT(server_netbits_ipv6);
1550 msg(D_SHOW_PARMS, " server_bridge_ip = %s", print_in_addr_t(o->server_bridge_ip, 0, &gc));
1551 msg(D_SHOW_PARMS, " server_bridge_netmask = %s", print_in_addr_t(o->server_bridge_netmask, 0, &gc));
1552 msg(D_SHOW_PARMS, " server_bridge_pool_start = %s", print_in_addr_t(o->server_bridge_pool_start, 0, &gc));
1553 msg(D_SHOW_PARMS, " server_bridge_pool_end = %s", print_in_addr_t(o->server_bridge_pool_end, 0, &gc));
1554 if (o->push_list.head)
1555 {
1556 const struct push_entry *e = o->push_list.head;
1557 while (e)
1558 {
1559 if (e->enable)
1560 {
1561 msg(D_SHOW_PARMS, " push_entry = '%s'", e->option);
1562 }
1563 e = e->next;
1564 }
1565 }
1566 SHOW_BOOL(ifconfig_pool_defined);
1567 msg(D_SHOW_PARMS, " ifconfig_pool_start = %s", print_in_addr_t(o->ifconfig_pool_start, 0, &gc));
1568 msg(D_SHOW_PARMS, " ifconfig_pool_end = %s", print_in_addr_t(o->ifconfig_pool_end, 0, &gc));
1569 msg(D_SHOW_PARMS, " ifconfig_pool_netmask = %s", print_in_addr_t(o->ifconfig_pool_netmask, 0, &gc));
1570 SHOW_STR(ifconfig_pool_persist_filename);
1571 SHOW_INT(ifconfig_pool_persist_refresh_freq);
1572 SHOW_BOOL(ifconfig_ipv6_pool_defined);
1573 msg(D_SHOW_PARMS, " ifconfig_ipv6_pool_base = %s", print_in6_addr(o->ifconfig_ipv6_pool_base, 0, &gc));
1574 SHOW_INT(ifconfig_ipv6_pool_netbits);
1575 SHOW_INT(n_bcast_buf);
1576 SHOW_INT(tcp_queue_limit);
1577 SHOW_INT(real_hash_size);
1578 SHOW_INT(virtual_hash_size);
1579 SHOW_STR(client_connect_script);
1581 SHOW_STR(client_disconnect_script);
1582 SHOW_STR(client_crresponse_script);
1583 SHOW_STR(client_config_dir);
1584 SHOW_BOOL(ccd_exclusive);
1585 SHOW_STR(tmp_dir);
1586 SHOW_BOOL(push_ifconfig_defined);
1587 msg(D_SHOW_PARMS, " push_ifconfig_local = %s", print_in_addr_t(o->push_ifconfig_local, 0, &gc));
1588 msg(D_SHOW_PARMS, " push_ifconfig_remote_netmask = %s", print_in_addr_t(o->push_ifconfig_remote_netmask, 0, &gc));
1589 SHOW_BOOL(push_ifconfig_ipv6_defined);
1590 msg(D_SHOW_PARMS, " push_ifconfig_ipv6_local = %s/%d", print_in6_addr(o->push_ifconfig_ipv6_local, 0, &gc), o->push_ifconfig_ipv6_netbits );
1591 msg(D_SHOW_PARMS, " push_ifconfig_ipv6_remote = %s", print_in6_addr(o->push_ifconfig_ipv6_remote, 0, &gc));
1592 SHOW_BOOL(enable_c2c);
1593 SHOW_BOOL(duplicate_cn);
1594 SHOW_INT(cf_max);
1595 SHOW_INT(cf_per);
1596 SHOW_INT(cf_initial_max);
1597 SHOW_INT(cf_initial_per);
1598 SHOW_INT(max_clients);
1599 SHOW_INT(max_routes_per_client);
1600 SHOW_STR(auth_user_pass_verify_script);
1601 SHOW_BOOL(auth_user_pass_verify_script_via_file);
1602 SHOW_BOOL(auth_token_generate);
1603 SHOW_BOOL(force_key_material_export);
1604 SHOW_INT(auth_token_lifetime);
1605 SHOW_STR_INLINE(auth_token_secret_file);
1606#if PORT_SHARE
1607 SHOW_STR(port_share_host);
1608 SHOW_STR(port_share_port);
1609#endif
1610 SHOW_BOOL(vlan_tagging);
1611 msg(D_SHOW_PARMS, " vlan_accept = %s", print_vlan_accept(o->vlan_accept));
1612 SHOW_INT(vlan_pvid);
1613
1614 SHOW_BOOL(client);
1615 SHOW_BOOL(pull);
1616 SHOW_STR_INLINE(auth_user_pass_file);
1617
1618 gc_free(&gc);
1619}
1620
1621#endif /* ! ENABLE_SMALL */
1622
1623static void
1625 const char *network_str,
1626 const char *netmask_str,
1627 int msglevel)
1628{
1629 struct iroute *ir;
1630
1631 ALLOC_OBJ_GC(ir, struct iroute, &o->gc);
1632 ir->network = getaddr(GETADDR_HOST_ORDER, network_str, 0, NULL, NULL);
1633 ir->netbits = 32; /* host route if no netmask given */
1634
1635 if (netmask_str)
1636 {
1637 const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, netmask_str, 0, NULL, NULL);
1638 ir->netbits = netmask_to_netbits2(netmask);
1639
1640 if (ir->netbits < 0)
1641 {
1642 msg(msglevel, "in --iroute %s %s : Bad network/subnet specification",
1643 network_str,
1644 netmask_str);
1645 return;
1646 }
1647 }
1648
1649 ir->next = o->iroutes;
1650 o->iroutes = ir;
1651}
1652
1653static void
1655 const char *prefix_str,
1656 int msglevel)
1657{
1658 struct iroute_ipv6 *ir;
1659
1660 ALLOC_OBJ_GC(ir, struct iroute_ipv6, &o->gc);
1661
1662 if (!get_ipv6_addr(prefix_str, &ir->network, &ir->netbits, msglevel ))
1663 {
1664 msg(msglevel, "in --iroute-ipv6 %s: Bad IPv6 prefix specification",
1665 prefix_str);
1666 return;
1667 }
1668
1669 ir->next = o->iroutes_ipv6;
1670 o->iroutes_ipv6 = ir;
1671}
1672
1673#ifndef ENABLE_SMALL
1674static void
1676{
1677 int i;
1678 msg(D_SHOW_PARMS, "BEGIN http_proxy");
1679 SHOW_STR(server);
1680 SHOW_STR(port);
1681 SHOW_STR(auth_method_string);
1682 SHOW_STR(auth_file);
1683 SHOW_STR(auth_file_up);
1684 SHOW_BOOL(inline_creds);
1685 SHOW_BOOL(nocache);
1686 SHOW_STR(http_version);
1687 SHOW_STR(user_agent);
1688 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER && o->custom_headers[i].name; i++)
1689 {
1690 if (o->custom_headers[i].content)
1691 {
1692 msg(D_SHOW_PARMS, " custom_header[%d] = %s: %s", i,
1694 }
1695 else
1696 {
1697 msg(D_SHOW_PARMS, " custom_header[%d] = %s", i,
1698 o->custom_headers[i].name);
1699 }
1700 }
1701 msg(D_SHOW_PARMS, "END http_proxy");
1702}
1703#endif /* ifndef ENABLE_SMALL */
1704
1705void
1707{
1708 gc_detach(&o->gc);
1709 o->routes = NULL;
1710 o->client_nat = NULL;
1711 clone_push_list(o);
1712}
1713
1714void
1716{
1717 if (!options->routes)
1718 {
1720 }
1721}
1722
1723static void
1731
1732static void
1734{
1735 if (!options->client_nat)
1736 {
1738 }
1739}
1740
1741#ifndef ENABLE_SMALL
1742static void
1744{
1745 /* Display the global proto only in client mode or with no '--local'*/
1746 if (o->local_list->len == 1)
1747 {
1748 msg(D_SHOW_PARMS, " proto = %s", proto2ascii(o->proto, o->af, false));
1749 }
1750
1751 msg(D_SHOW_PARMS, " Local Sockets:");
1752 for (int i = 0; i < o->local_list->len; i++)
1753 {
1754 msg(D_SHOW_PARMS, " [%s]:%s-%s", o->local_list->array[i]->local,
1755 o->local_list->array[i]->port, proto2ascii(o->local_list->array[i]->proto, o->af, false));
1756 }
1757 SHOW_STR(remote);
1758 SHOW_STR(remote_port);
1759 SHOW_BOOL(remote_float);
1760 SHOW_BOOL(bind_defined);
1762 SHOW_BOOL(bind_ipv6_only);
1763 SHOW_INT(connect_retry_seconds);
1764 SHOW_INT(connect_timeout);
1765
1766 if (o->http_proxy_options)
1767 {
1769 }
1770 SHOW_STR(socks_proxy_server);
1771 SHOW_STR(socks_proxy_port);
1772 SHOW_INT(tun_mtu);
1773 SHOW_BOOL(tun_mtu_defined);
1774 SHOW_INT(link_mtu);
1775 SHOW_BOOL(link_mtu_defined);
1776 SHOW_INT(tun_mtu_extra);
1777 SHOW_BOOL(tun_mtu_extra_defined);
1778 SHOW_INT(tls_mtu);
1779
1780 SHOW_INT(mtu_discover_type);
1781
1782#ifdef ENABLE_FRAGMENT
1784#endif
1785 SHOW_INT(mssfix);
1786 SHOW_BOOL(mssfix_encap);
1787 SHOW_BOOL(mssfix_fixed);
1788
1789 SHOW_INT(explicit_exit_notification);
1790
1791 SHOW_STR_INLINE(tls_auth_file);
1792 SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true),
1793 "%s");
1794 SHOW_STR_INLINE(tls_crypt_file);
1795 SHOW_STR_INLINE(tls_crypt_v2_file);
1796}
1797
1798
1799static void
1801{
1802 if (o->connection_list)
1803 {
1804 const struct connection_list *l = o->connection_list;
1805 int i;
1806 for (i = 0; i < l->len; ++i)
1807 {
1808 msg(D_SHOW_PARMS, "Connection profiles [%d]:", i);
1809 show_connection_entry(l->array[i]);
1810 }
1811 }
1812 else
1813 {
1814 msg(D_SHOW_PARMS, "Connection profiles [default]:");
1816 }
1817 msg(D_SHOW_PARMS, "Connection profiles END");
1818}
1819
1820static void
1822{
1823 struct pull_filter *f;
1824 if (!l)
1825 {
1826 return;
1827 }
1828
1829 msg(D_SHOW_PARMS, " Pull filters:");
1830 for (f = l->head; f; f = f->next)
1831 {
1832 msg(D_SHOW_PARMS, " %s \"%s\"", pull_filter_type_name(f->type), f->pattern);
1833 }
1834}
1835
1836#endif /* ifndef ENABLE_SMALL */
1837
1838void
1839show_settings(const struct options *o)
1840{
1841#ifndef ENABLE_SMALL
1842 msg(D_SHOW_PARMS, "Current Parameter Settings:");
1843
1844 SHOW_STR(config);
1845
1846 SHOW_INT(mode);
1847
1848#ifdef ENABLE_FEATURE_TUN_PERSIST
1849 SHOW_BOOL(persist_config);
1850 SHOW_INT(persist_mode);
1851#endif
1852
1853 SHOW_BOOL(show_ciphers);
1854 SHOW_BOOL(show_digests);
1855 SHOW_BOOL(show_engines);
1856 SHOW_BOOL(genkey);
1857 SHOW_STR(genkey_filename);
1858 SHOW_STR(key_pass_file);
1859 SHOW_BOOL(show_tls_ciphers);
1860
1861 SHOW_INT(connect_retry_max);
1863
1864 SHOW_BOOL(remote_random);
1865
1866 SHOW_STR(ipchange);
1867 SHOW_STR(dev);
1868 SHOW_STR(dev_type);
1869 SHOW_STR(dev_node);
1870#if defined(ENABLE_DCO)
1871 SHOW_BOOL(disable_dco);
1872#endif
1873 SHOW_STR(lladdr);
1874 SHOW_INT(topology);
1875 SHOW_STR(ifconfig_local);
1876 SHOW_STR(ifconfig_remote_netmask);
1877 SHOW_BOOL(ifconfig_noexec);
1878 SHOW_BOOL(ifconfig_nowarn);
1879 SHOW_STR(ifconfig_ipv6_local);
1880 SHOW_INT(ifconfig_ipv6_netbits);
1881 SHOW_STR(ifconfig_ipv6_remote);
1882
1884 SHOW_INT(mtu_test);
1885
1886 SHOW_BOOL(mlock);
1887
1888 SHOW_INT(keepalive_ping);
1889 SHOW_INT(keepalive_timeout);
1890 SHOW_INT(inactivity_timeout);
1891 SHOW_INT(session_timeout);
1892 SHOW_INT64(inactivity_minimum_bytes);
1893 SHOW_INT(ping_send_timeout);
1894 SHOW_INT(ping_rec_timeout);
1895 SHOW_INT(ping_rec_timeout_action);
1896 SHOW_BOOL(ping_timer_remote);
1897 SHOW_INT(remap_sigusr1);
1898 SHOW_BOOL(persist_tun);
1899 SHOW_BOOL(persist_local_ip);
1900 SHOW_BOOL(persist_remote_ip);
1901
1902#if PASSTOS_CAPABILITY
1903 SHOW_BOOL(passtos);
1904#endif
1905
1906 SHOW_INT(resolve_retry_seconds);
1907 SHOW_BOOL(resolve_in_advance);
1908
1909 SHOW_STR(username);
1910 SHOW_STR(groupname);
1911 SHOW_STR(chroot_dir);
1912 SHOW_STR(cd_dir);
1913#ifdef ENABLE_SELINUX
1914 SHOW_STR(selinux_context);
1915#endif
1916 SHOW_STR(writepid);
1917 SHOW_STR(up_script);
1918 SHOW_STR(down_script);
1919 SHOW_BOOL(down_pre);
1920 SHOW_BOOL(up_restart);
1921 SHOW_BOOL(up_delay);
1923 SHOW_BOOL(log);
1926 SHOW_INT(nice);
1927 SHOW_INT(verbosity);
1928 SHOW_INT(mute);
1929#ifdef ENABLE_DEBUG
1930 SHOW_INT(gremlin);
1931#endif
1932 SHOW_STR(status_file);
1933 SHOW_INT(status_file_version);
1934 SHOW_INT(status_file_update_freq);
1935
1936 SHOW_BOOL(occ);
1937 SHOW_INT(rcvbuf);
1938 SHOW_INT(sndbuf);
1939#if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
1940 SHOW_INT(mark);
1941#endif
1942 SHOW_INT(sockflags);
1943
1944 SHOW_BOOL(fast_io);
1945
1946 SHOW_INT(comp.alg);
1947 SHOW_INT(comp.flags);
1948
1949 SHOW_STR(route_script);
1950 SHOW_STR(route_default_gateway);
1951 SHOW_INT(route_default_metric);
1952 SHOW_BOOL(route_noexec);
1953 SHOW_INT(route_delay);
1954 SHOW_INT(route_delay_window);
1955 SHOW_BOOL(route_delay_defined);
1956 SHOW_BOOL(route_nopull);
1957 SHOW_BOOL(route_gateway_via_dhcp);
1958 SHOW_BOOL(allow_pull_fqdn);
1960
1961 if (o->routes)
1962 {
1964 }
1965
1966 if (o->client_nat)
1967 {
1969 }
1970
1972
1973#ifdef ENABLE_MANAGEMENT
1974 SHOW_STR(management_addr);
1975 SHOW_STR(management_port);
1976 SHOW_STR(management_user_pass);
1977 SHOW_INT(management_log_history_cache);
1978 SHOW_INT(management_echo_buffer_size);
1979 SHOW_STR(management_client_user);
1980 SHOW_STR(management_client_group);
1981 SHOW_INT(management_flags);
1982#endif
1983#ifdef ENABLE_PLUGIN
1984 if (o->plugin_list)
1985 {
1987 }
1988#endif
1989
1990 SHOW_STR_INLINE(shared_secret_file);
1991 SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true), "%s");
1992 SHOW_STR(ciphername);
1993 SHOW_STR(ncp_ciphers);
1994 SHOW_STR(authname);
1995#ifndef ENABLE_CRYPTO_MBEDTLS
1996 SHOW_BOOL(engine);
1997#endif /* ENABLE_CRYPTO_MBEDTLS */
1998 SHOW_BOOL(mute_replay_warnings);
1999 SHOW_INT(replay_window);
2000 SHOW_INT(replay_time);
2001 SHOW_STR(packet_id_file);
2003#ifdef ENABLE_PREDICTION_RESISTANCE
2004 SHOW_BOOL(use_prediction_resistance);
2005#endif
2006
2007 SHOW_BOOL(tls_server);
2008 SHOW_BOOL(tls_client);
2009 SHOW_STR_INLINE(ca_file);
2010 SHOW_STR(ca_path);
2011 SHOW_STR_INLINE(dh_file);
2013 {
2014 SHOW_PARM("cert_file", "EXTERNAL_CERT", "%s");
2015 }
2016 else
2017 {
2018 SHOW_STR_INLINE(cert_file);
2019 }
2020 SHOW_STR_INLINE(extra_certs_file);
2021
2023 {
2024 SHOW_PARM("priv_key_file", "EXTERNAL_PRIVATE_KEY", "%s");
2025 }
2026 else
2027 {
2028 SHOW_STR_INLINE(priv_key_file);
2029 }
2030#ifndef ENABLE_CRYPTO_MBEDTLS
2031 SHOW_STR_INLINE(pkcs12_file);
2032#endif
2033#ifdef ENABLE_CRYPTOAPI
2034 SHOW_STR(cryptoapi_cert);
2035#endif
2036 SHOW_STR(cipher_list);
2037 SHOW_STR(cipher_list_tls13);
2038 SHOW_STR(tls_cert_profile);
2040 SHOW_STR(tls_export_peer_cert_dir);
2041 SHOW_INT(verify_x509_type);
2042 SHOW_STR(verify_x509_name);
2043 SHOW_STR_INLINE(crl_file);
2044 SHOW_INT(ns_cert_type);
2045 {
2046 int i;
2047 for (i = 0; i<MAX_PARMS; i++)
2048 {
2049 SHOW_INT(remote_cert_ku[i]);
2050 }
2051 }
2052 SHOW_STR(remote_cert_eku);
2053 if (o->verify_hash)
2054 {
2055 SHOW_INT(verify_hash_algo);
2056 SHOW_INT(verify_hash_depth);
2057 struct gc_arena gc = gc_new();
2058 struct verify_hash_list *hl = o->verify_hash;
2059 int digest_len = (o->verify_hash_algo == MD_SHA1) ? SHA_DIGEST_LENGTH :
2061 while (hl)
2062 {
2063 char *s = format_hex_ex(hl->hash, digest_len, 0,
2064 1, ":", &gc);
2065 SHOW_PARM(verify_hash, s, "%s");
2066 hl = hl->next;
2067 }
2068 gc_free(&gc);
2069 }
2070 SHOW_INT(ssl_flags);
2071
2072 SHOW_INT(tls_timeout);
2073
2074 SHOW_INT64(renegotiate_bytes);
2075 SHOW_INT64(renegotiate_packets);
2076 SHOW_INT(renegotiate_seconds);
2077
2078 SHOW_INT(handshake_window);
2079 SHOW_INT(transition_window);
2080
2081 SHOW_BOOL(single_session);
2083 SHOW_BOOL(tls_exit);
2084
2085 SHOW_STR(tls_crypt_v2_metadata);
2086
2087#ifdef ENABLE_PKCS11
2088 {
2089 int i;
2090 for (i = 0; i<MAX_PARMS && o->pkcs11_providers[i] != NULL; i++)
2091 {
2092 SHOW_PARM(pkcs11_providers, o->pkcs11_providers[i], "%s");
2093 }
2094 }
2095 {
2096 int i;
2097 for (i = 0; i<MAX_PARMS; i++)
2098 {
2099 SHOW_PARM(pkcs11_protected_authentication, o->pkcs11_protected_authentication[i] ? "ENABLED" : "DISABLED", "%s");
2100 }
2101 }
2102 {
2103 int i;
2104 for (i = 0; i<MAX_PARMS; i++)
2105 {
2106 SHOW_PARM(pkcs11_private_mode, o->pkcs11_private_mode[i], "%08x");
2107 }
2108 }
2109 {
2110 int i;
2111 for (i = 0; i<MAX_PARMS; i++)
2112 {
2113 SHOW_PARM(pkcs11_cert_private, o->pkcs11_cert_private[i] ? "ENABLED" : "DISABLED", "%s");
2114 }
2115 }
2116 SHOW_INT(pkcs11_pin_cache_period);
2117 SHOW_STR(pkcs11_id);
2119#endif /* ENABLE_PKCS11 */
2120
2121 show_p2mp_parms(o);
2122
2123#ifdef _WIN32
2124 SHOW_BOOL(show_net_up);
2125 SHOW_INT(route_method);
2126 SHOW_BOOL(block_outside_dns);
2128#endif
2129#endif /* ifndef ENABLE_SMALL */
2130}
2131
2132#undef SHOW_PARM
2133#undef SHOW_STR
2134#undef SHOW_INT
2135#undef SHOW_BOOL
2136
2137#ifdef ENABLE_MANAGEMENT
2138
2139static struct http_proxy_options *
2141 const char *port,
2142 const char *flags,
2143 struct gc_arena *gc)
2144{
2145 if (server && port)
2146 {
2147 struct http_proxy_options *ho;
2149 ho->server = string_alloc(server, gc);
2150 ho->port = port;
2151 if (flags && !strcmp(flags, "nct"))
2152 {
2153 ho->auth_retry = PAR_NCT;
2154 }
2155 else
2156 {
2157 ho->auth_retry = PAR_ALL;
2158 }
2159 ho->http_version = "1.0";
2160 ho->user_agent = "OpenVPN-Autoproxy/1.0";
2161 return ho;
2162 }
2163 else
2164 {
2165 return NULL;
2166 }
2167}
2168
2169static void
2171{
2172 const struct connection_list *l = o->connection_list;
2173 int i;
2174 bool succeed = false;
2175 for (i = 0; i < l->len; ++i)
2176 {
2177 struct connection_entry *ce = l->array[i];
2178 if (ce->proto == PROTO_TCP_CLIENT || ce->proto == PROTO_TCP)
2179 {
2181 succeed = true;
2182 }
2183 }
2184 if (succeed)
2185 {
2186 for (i = 0; i < l->len; ++i)
2187 {
2188 struct connection_entry *ce = l->array[i];
2189 if (ce->proto == PROTO_UDP)
2190 {
2191 ce->flags |= CE_DISABLED;
2192 }
2193 }
2194 }
2195 else
2196 {
2197 msg(M_WARN, "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
2198 }
2199}
2200
2201#endif /* ifdef ENABLE_MANAGEMENT */
2202
2203static struct local_list *
2205{
2206 if (!ce->local_list)
2207 {
2209 }
2210 return ce->local_list;
2211}
2212
2213static struct local_entry *
2214alloc_local_entry(struct connection_entry *ce, const int msglevel,
2215 struct gc_arena *gc)
2216{
2218 struct local_entry *e;
2219
2220 if (l->len >= CONNECTION_LIST_SIZE)
2221 {
2222 msg(msglevel, "Maximum number of 'local' options (%d) exceeded",
2224
2225 return NULL;
2226 }
2227
2228 ALLOC_OBJ_CLEAR_GC(e, struct local_entry, gc);
2229 e->proto = PROTO_NONE;
2230 l->array[l->len++] = e;
2231
2232 return e;
2233}
2234
2235static struct connection_list *
2244
2245static struct connection_entry *
2246alloc_connection_entry(struct options *options, const int msglevel)
2247{
2249 struct connection_entry *e;
2250
2251 if (l->len == l->capacity)
2252 {
2253 int capacity = l->capacity + CONNECTION_LIST_SIZE;
2254 struct connection_entry **ce = gc_realloc(l->array, capacity*sizeof(struct connection_entry *), &options->gc);
2255 if (ce == NULL)
2256 {
2257 msg(msglevel, "Unable to process more connection options: out of memory. Number of entries = %d", l->len);
2258 return NULL;
2259 }
2260 l->array = ce;
2261 l->capacity = capacity;
2262 }
2264 l->array[l->len++] = e;
2265 return e;
2266}
2267
2268static struct remote_list *
2270{
2271 if (!options->remote_list)
2272 {
2274 }
2275 return options->remote_list;
2276}
2277
2278static struct remote_entry *
2279alloc_remote_entry(struct options *options, const int msglevel)
2280{
2282 struct remote_entry *e;
2283
2284 if (l->len == l->capacity)
2285 {
2286 int capacity = l->capacity + CONNECTION_LIST_SIZE;
2287 struct remote_entry **re = gc_realloc(l->array, capacity*sizeof(struct remote_entry *), &options->gc);
2288 if (re == NULL)
2289 {
2290 msg(msglevel, "Unable to process more remote options: out of memory. Number of entries = %d", l->len);
2291 return NULL;
2292 }
2293 l->array = re;
2294 l->capacity = capacity;
2295 }
2296 ALLOC_OBJ_GC(e, struct remote_entry, &options->gc);
2297 l->array[l->len++] = e;
2298 return e;
2299}
2300
2301static struct pull_filter_list *
2303{
2304 if (!o->pull_filter_list)
2305 {
2307 }
2308 return o->pull_filter_list;
2309}
2310
2311static struct pull_filter *
2313{
2315 struct pull_filter *f;
2316
2317 ALLOC_OBJ_CLEAR_GC(f, struct pull_filter, &o->gc);
2318 if (l->head)
2319 {
2320 ASSERT(l->tail);
2321 l->tail->next = f;
2322 }
2323 else
2324 {
2325 ASSERT(!l->tail);
2326 l->head = f;
2327 }
2328 l->tail = f;
2329 return f;
2330}
2331
2332static void
2334{
2335 if (re->remote)
2336 {
2337 ce->remote = re->remote;
2338 }
2339 if (re->remote_port)
2340 {
2341 ce->remote_port = re->remote_port;
2342 }
2343 if (re->proto >= 0)
2344 {
2345 ce->proto = re->proto;
2346 }
2347 if (re->af > 0)
2348 {
2349 ce->af = re->af;
2350 }
2351}
2352
2353static void
2354connection_entry_preload_key(const char **key_file, bool *key_inline,
2355 struct gc_arena *gc)
2356{
2357 if (key_file && *key_file && !(*key_inline))
2358 {
2359 struct buffer in = buffer_read_from_file(*key_file, gc);
2360 if (!buf_valid(&in))
2361 {
2362 msg(M_FATAL, "Cannot pre-load keyfile (%s)", *key_file);
2363 }
2364
2365 *key_file = (const char *) in.data;
2366 *key_inline = true;
2367 }
2368}
2369
2370static void
2372{
2373#ifdef ENABLE_CRYPTO_MBEDTLS
2374 if (options->ca_path)
2375 {
2376 msg(M_USAGE, "Parameter --capath cannot be used with the mbed TLS version of OpenVPN.");
2377 }
2378#endif
2379
2382 || options->ca_file
2384 || options->ca_path
2385#endif
2386 )
2387 {
2388 return;
2389 }
2390
2391 const char *const str = "You must define CA file (--ca)"
2392#ifndef ENABLE_CRYPTO_MBEDTLS
2393 " or CA path (--capath)"
2394#endif
2395 " and/or peer fingerprint verification (--peer-fingerprint)";
2396 msg(M_USAGE, "%s", str);
2397}
2398
2399#define MUST_BE_UNDEF(parm, parm_name) \
2400 if (options->parm != defaults.parm) { msg(M_USAGE, use_err, parm_name); }
2401#define MUST_BE_FALSE(condition, parm_name) \
2402 if (condition) { msg(M_USAGE, use_err, parm_name); }
2403
2404static void
2406 const struct connection_entry *ce)
2407{
2408 struct options defaults;
2409 int dev = DEV_TYPE_UNDEF;
2410 bool pull = false;
2411
2412 init_options(&defaults, true);
2413
2414 if (options->test_crypto)
2415 {
2416 notnull(options->shared_secret_file, "key file (--secret)");
2417 }
2418 else
2419 {
2420 notnull(options->dev, "TUN/TAP device (--dev)");
2421 }
2422
2423 /*
2424 * Get tun/tap/null device type
2425 */
2427
2428 /*
2429 * If "proto tcp" is specified, make sure we know whether it is
2430 * tcp-client or tcp-server.
2431 */
2432 if (ce->proto == PROTO_TCP)
2433 {
2434 msg(M_USAGE,
2435 "--proto tcp is ambiguous in this context. Please specify "
2436 "--proto tcp-server or --proto tcp-client");
2437 }
2438
2439 /*
2440 * Sanity check on Client mode
2441 */
2442
2443 if (options->mode != MODE_SERVER && ce->local_list->len > 1)
2444 {
2445 msg(M_USAGE, "multiple --local statements only allowed in --server mode");
2446 }
2447
2448 if (options->lladdr && dev != DEV_TYPE_TAP)
2449 {
2450 msg(M_USAGE, "--lladdr can only be used in --dev tap mode");
2451 }
2452
2453 /*
2454 * Sanity check on MTU parameters
2455 */
2457 {
2458 msg(M_USAGE, "only one of --tun-mtu or --link-mtu may be defined");
2459 }
2460
2462 {
2463 msg(M_USAGE, "--mtu-test only makes sense with --proto udp");
2464 }
2465
2466 /* will we be pulling options from server? */
2467 pull = options->pull;
2468
2469 /*
2470 * Sanity check on --local, --remote, and --ifconfig
2471 */
2472
2475 {
2476 msg(M_USAGE,
2477 "--local and --remote addresses must be distinct from --ifconfig "
2478 "addresses");
2479 }
2480
2483 {
2484 msg(M_USAGE,
2485 "local and remote/netmask --ifconfig addresses must be different");
2486 }
2487
2488 if (ce->bind_defined && !ce->bind_local)
2489 {
2490 msg(M_USAGE, "--bind and --nobind can't be used together");
2491 }
2492
2494 {
2495 msg(M_USAGE,
2496 "--lport and --nobind don't make sense when used together");
2497 }
2498
2499 if (!ce->remote && !ce->bind_local)
2500 {
2501 msg(M_USAGE, "--nobind doesn't make sense unless used with --remote");
2502 }
2503
2504 for (int i = 0; i < ce->local_list->len; i++)
2505 {
2506 struct local_entry *le = ce->local_list->array[i];
2507
2508 if (proto_is_net(le->proto)
2509 && string_defined_equal(le->local, ce->remote)
2511 {
2512 msg(M_USAGE, "--remote and one of the --local addresses are the same");
2513 }
2514
2517 {
2518 msg(M_USAGE, "--local addresses must be distinct from --ifconfig addresses");
2519 }
2520
2521 if (le->local && !ce->bind_local)
2522 {
2523 msg(M_USAGE, "--local and --nobind don't make sense when used together");
2524 }
2525 }
2526
2527 /*
2528 * Check for consistency of management options
2529 */
2530#ifdef ENABLE_MANAGEMENT
2534 {
2535 msg(M_USAGE, "--management is not specified, however one or more options which modify the behavior of --management were specified");
2536 }
2537
2540 {
2541 msg(M_USAGE, "--management-client-(user|group) can only be used on unix domain sockets");
2542 }
2543
2547 {
2548 msg(M_WARN, "WARNING: Using --management on a TCP port WITHOUT "
2549 "passwords is STRONGLY discouraged and considered insecure");
2550 }
2551
2552#endif /* ifdef ENABLE_MANAGEMENT */
2553
2554#if !defined(HAVE_XKEY_PROVIDER)
2555 if ((tls_version_max() >= TLS_VER_1_3)
2558 )
2559 {
2560 msg(M_FATAL, "management-external-key with TLS 1.3 or later requires "
2561 "nopadding argument/support");
2562 }
2563#endif
2564 /*
2565 * Windows-specific options.
2566 */
2567
2568#ifdef _WIN32
2569 if (dev == DEV_TYPE_TUN && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask)))
2570 {
2571 msg(M_USAGE, "On Windows, --ifconfig is required when --dev tun is used");
2572 }
2573
2576 {
2577 msg(M_USAGE, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
2578 }
2579
2581 {
2582 const char *prefix = "Some --dhcp-option or --dns options require DHCP server";
2584 {
2585 msg(M_USAGE, "%s, which is not supported by the selected %s driver",
2587 }
2590 {
2591 msg(M_USAGE, "%s, which requires --ip-win32 dynamic or adaptive",
2592 prefix);
2593 }
2594 }
2595
2597 {
2598 msg(M_USAGE, "--windows-driver wintun requires --dev tun");
2599 }
2600#endif /* ifdef _WIN32 */
2601
2602 /*
2603 * Check that protocol options make sense.
2604 */
2605
2606#ifdef ENABLE_FRAGMENT
2607 if (!proto_is_udp(ce->proto) && ce->fragment)
2608 {
2609 msg(M_USAGE, "--fragment can only be used with --proto udp");
2610 }
2611#endif
2612
2613 if (!ce->remote && ce->proto == PROTO_TCP_CLIENT)
2614 {
2615 msg(M_USAGE, "--remote MUST be used in TCP Client mode");
2616 }
2617
2618 if ((ce->http_proxy_options) && ce->proto != PROTO_TCP_CLIENT)
2619 {
2620 msg(M_USAGE,
2621 "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
2622 "tcp-client)");
2623 }
2624
2625 if ((ce->http_proxy_options) && !ce->http_proxy_options->server)
2626 {
2627 msg(M_USAGE,
2628 "--http-proxy not specified but other http proxy options present");
2629 }
2630
2632 {
2633 msg(M_USAGE,
2634 "--http-proxy can not be used together with --socks-proxy");
2635 }
2636
2637 if (ce->socks_proxy_server && ce->proto == PROTO_TCP_SERVER)
2638 {
2639 msg(M_USAGE, "--socks-proxy can not be used in TCP Server mode");
2640 }
2641
2642 if (ce->proto == PROTO_TCP_SERVER && (options->connection_list->len > 1))
2643 {
2644 msg(M_USAGE, "TCP server mode allows at most one --remote address");
2645 }
2646
2647 /*
2648 * Check consistency of --mode server options.
2649 */
2650 if (options->mode == MODE_SERVER)
2651 {
2652 const char use_err[] = "--%s cannot be used with --mode server.";
2653
2654#define USAGE_VALID_SERVER_PROTOS "--mode server currently only supports " \
2655 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
2656#ifdef TARGET_ANDROID
2657 msg(M_FATAL, "--mode server not supported on Android");
2658#endif
2659 if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP))
2660 {
2661 msg(M_USAGE, "--mode server only works with --dev tun or --dev tap");
2662 }
2663 MUST_BE_UNDEF(pull, "pull");
2665 {
2666 msg(M_WARN, "--pull-filter ignored for --mode server");
2667 }
2668 if (!(proto_is_udp(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2669 {
2671 }
2672#if PORT_SHARE
2673 if ((options->port_share_host || options->port_share_port)
2674 && (ce->proto != PROTO_TCP_SERVER))
2675 {
2676 msg(M_USAGE, "--port-share only works in TCP server mode "
2677 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
2678 }
2679#endif
2680 if (!options->tls_server)
2681 {
2682 msg(M_USAGE, "--mode server requires --tls-server");
2683 }
2684 MUST_BE_FALSE(ce->remote, "remote");
2685 MUST_BE_FALSE(!ce->bind_local, "nobind");
2686 MUST_BE_FALSE(ce->http_proxy_options, "http-proxy");
2687 MUST_BE_FALSE(ce->socks_proxy_server, "socks-proxy");
2688 /* <connection> blocks force to have a remote embedded, so we check
2689 * for the --remote and bail out if it is present
2690 */
2691 if (options->connection_list->len >1
2693 {
2694 msg(M_USAGE, "<connection> cannot be used with --mode server");
2695 }
2696
2697 MUST_BE_UNDEF(shaper, "shaper");
2698 if (options->ipchange)
2699 {
2700 msg(M_USAGE,
2701 "--ipchange cannot be used with --mode server (use "
2702 "--client-connect instead)");
2703 }
2704 if (!(proto_is_dgram(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2705 {
2707 }
2708 if (!proto_is_udp(ce->proto) && (options->cf_max || options->cf_per))
2709 {
2710 msg(M_USAGE, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
2711 }
2713 {
2714 msg(M_USAGE, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
2715 }
2717 {
2718 msg(M_USAGE, "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
2719 }
2720 MUST_BE_UNDEF(route_delay_defined, "route-delay");
2721 MUST_BE_UNDEF(up_delay, "up-delay");
2725 {
2726 msg(M_USAGE,
2727 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
2728 }
2730 {
2731 msg(M_USAGE, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
2732 }
2733 MUST_BE_UNDEF(allow_recursive_routing, "allow-recursive-routing");
2735 {
2736 msg(M_USAGE, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
2737 }
2739 {
2740 msg(M_USAGE, "--ccd-exclusive must be used with --client-config-dir");
2741 }
2743 {
2744 msg(M_USAGE, "--auth-gen-token needs a non-infinite "
2745 "--renegotiate_seconds setting");
2746 }
2749 {
2750 msg(M_USAGE, "--auth-gen-token renewal time needs to be at least "
2751 " two times --hand-window (%d).",
2753
2754 }
2758 {
2759 const char *use_err = "--%s must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
2760
2763 "verify-client-cert none|optional");
2765 "username-as-common-name");
2767 "auth-user-pass-optional");
2768 }
2769
2770 if (options->vlan_tagging && dev != DEV_TYPE_TAP)
2771 {
2772 msg(M_USAGE, "--vlan-tagging must be used with --dev tap");
2773 }
2774 if (!options->vlan_tagging)
2775 {
2776 const char use_err[] = "--%s requires --vlan-tagging";
2777 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2778 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2779 }
2780 }
2781 else
2782 {
2783 const char use_err[] = "--%s requires --mode server";
2784 /*
2785 * When not in server mode, err if parameters are
2786 * specified which require --mode server.
2787 */
2788 MUST_BE_UNDEF(ifconfig_pool_defined, "ifconfig-pool");
2789 MUST_BE_UNDEF(ifconfig_pool_persist_filename, "ifconfig-pool-persist");
2790 MUST_BE_UNDEF(ifconfig_ipv6_pool_defined, "ifconfig-ipv6-pool");
2791 MUST_BE_UNDEF(real_hash_size, "hash-size");
2792 MUST_BE_UNDEF(virtual_hash_size, "hash-size");
2793 MUST_BE_UNDEF(learn_address_script, "learn-address");
2794 MUST_BE_UNDEF(client_connect_script, "client-connect");
2795 MUST_BE_UNDEF(client_crresponse_script, "client-crresponse");
2796 MUST_BE_UNDEF(client_disconnect_script, "client-disconnect");
2797 MUST_BE_UNDEF(client_config_dir, "client-config-dir");
2798 MUST_BE_UNDEF(ccd_exclusive, "ccd-exclusive");
2799 MUST_BE_UNDEF(enable_c2c, "client-to-client");
2800 MUST_BE_UNDEF(duplicate_cn, "duplicate-cn");
2801 MUST_BE_UNDEF(cf_max, "connect-freq");
2802 MUST_BE_UNDEF(cf_per, "connect-freq");
2805 "verify-client-cert");
2806 MUST_BE_FALSE(options->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME, "username-as-common-name");
2807 MUST_BE_FALSE(options->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL, "auth-user-pass-optional");
2810 {
2811 msg(M_WARN, "WARNING: setting tcp-nodelay on the client side will not "
2812 "affect the server. To have TCP_NODELAY in both direction use "
2813 "tcp-nodelay in the server configuration instead.");
2814 }
2815 MUST_BE_UNDEF(auth_user_pass_verify_script, "auth-user-pass-verify");
2816 MUST_BE_UNDEF(auth_token_generate, "auth-gen-token");
2817#if PORT_SHARE
2818 if (options->port_share_host || options->port_share_port)
2819 {
2820 msg(M_USAGE, "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2821 }
2822#endif
2823 MUST_BE_UNDEF(stale_routes_check_interval, "stale-routes-check");
2824 MUST_BE_UNDEF(vlan_tagging, "vlan-tagging");
2825 MUST_BE_UNDEF(vlan_accept, "vlan-accept");
2826 MUST_BE_UNDEF(vlan_pvid, "vlan-pvid");
2827 MUST_BE_UNDEF(force_key_material_export, "force-key-material-export");
2828 }
2829
2830 /*
2831 * SSL/TLS mode sanity checks.
2832 */
2834 + (options->shared_secret_file != NULL) > 1)
2835 {
2836 msg(M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
2837 }
2838
2840 {
2841 int msglevel = M_USAGE;
2843 {
2844 msglevel = M_INFO;
2845 }
2846
2847 msg(msglevel, "DEPRECATION: No tls-client or tls-server option in "
2848 "configuration detected. OpenVPN 2.8 will remove the "
2849 "functionality to run a VPN without TLS. "
2850 "See the examples section in the manual page for "
2851 "examples of a similar quick setup with peer-fingerprint. "
2852 "OpenVPN 2.7 allows using this configuration when using "
2853 "--allow-deprecated-insecure-static-crypto but you should move "
2854 "to a proper configuration using TLS as soon as possible."
2855 );
2856 }
2857
2859 {
2860 msg(M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
2861 "--verify-client-cert none|optional "
2862 "may accept clients which do not present a certificate");
2863 }
2864
2865 const int tls_version_max =
2868 const int tls_version_min =
2871
2872 if (tls_version_max > 0 && tls_version_max < tls_version_min)
2873 {
2874 msg(M_USAGE, "--tls-version-min bigger than --tls-version-max");
2875 }
2876
2878 {
2880#ifdef ENABLE_PKCS11
2881 if (!options->pkcs11_providers[0] && options->pkcs11_id)
2882 {
2883 msg(M_WARN, "Option pkcs11-id is ignored as no pkcs11-providers are specified");
2884 }
2885 else if (!options->pkcs11_providers[0] && options->pkcs11_id_management)
2886 {
2887 msg(M_WARN, "Option pkcs11-id-management is ignored as no pkcs11-providers are specified");
2888 }
2889
2890 if (options->pkcs11_providers[0])
2891 {
2892 if (options->pkcs11_id_management && options->pkcs11_id != NULL)
2893 {
2894 msg(M_USAGE, "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2895 }
2896 if (!options->pkcs11_id_management && options->pkcs11_id == NULL)
2897 {
2898 msg(M_USAGE, "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2899 }
2900 const char use_err[] = "Parameter --%s cannot be used when --pkcs11-provider is also specified.";
2901 MUST_BE_UNDEF(cert_file, "cert");
2902 MUST_BE_UNDEF(priv_key_file, "key");
2903 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2904 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2905 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2906#ifdef ENABLE_CRYPTOAPI
2907 MUST_BE_UNDEF(cryptoapi_cert, "cryptoapicert");
2908#endif
2909 }
2910 else
2911#endif /* ifdef ENABLE_PKCS11 */
2912#ifdef ENABLE_CRYPTOAPI
2914 {
2915 const char use_err[] = "Parameter --%s cannot be used when --cryptoapicert is also specified.";
2916 MUST_BE_UNDEF(cert_file, "cert");
2917 MUST_BE_UNDEF(priv_key_file, "key");
2918 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
2919 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2920 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2921 }
2922 else
2923#endif
2924 if (options->pkcs12_file)
2925 {
2926#ifdef ENABLE_CRYPTO_MBEDTLS
2927 msg(M_USAGE, "Parameter --pkcs12 cannot be used with the mbed TLS version of OpenVPN.");
2928#else
2929 const char use_err[] = "Parameter --%s cannot be used when --pkcs12 is also specified.";
2930 MUST_BE_UNDEF(ca_path, "capath");
2931 MUST_BE_UNDEF(cert_file, "cert");
2932 MUST_BE_UNDEF(priv_key_file, "key");
2933 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_KEY, "management-external-key");
2934 MUST_BE_FALSE(options->management_flags & MF_EXTERNAL_CERT, "management-external-cert");
2935#endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2936 }
2937 else /* cert/key from none of pkcs11, pkcs12, cryptoapi */
2938 {
2940 {
2941 msg(M_USAGE, "--key and --management-external-key are mutually exclusive");
2942 }
2944 {
2945 if (options->cert_file)
2946 {
2947 msg(M_USAGE, "--cert and --management-external-cert are mutually exclusive");
2948 }
2950 {
2951 msg(M_USAGE, "--management-external-cert must be used with --management-external-key");
2952 }
2953 }
2954 if (pull)
2955 {
2956
2957 const int sum =
2960
2961 if (sum == 0)
2962 {
2964 {
2965 msg(M_USAGE, "No client-side authentication method is "
2966 "specified. You must use either "
2967 "--cert/--key, --pkcs12, or "
2968 "--auth-user-pass");
2969 }
2970 }
2971 else if (sum != 2)
2972 {
2973 msg(M_USAGE, "If you use one of --cert or --key, you must use them both");
2974 }
2975 }
2976 else
2977 {
2979 {
2980 notnull(options->cert_file, "certificate file (--cert) or PKCS#12 file (--pkcs12)");
2981 }
2983 {
2984 notnull(options->priv_key_file, "private key file (--key) or PKCS#12 file (--pkcs12)");
2985 }
2986 }
2987 }
2988 if (ce->tls_auth_file && ce->tls_crypt_file)
2989 {
2990 msg(M_USAGE, "--tls-auth and --tls-crypt are mutually exclusive");
2991 }
2993 && (ce->tls_auth_file || ce->tls_crypt_file))
2994 {
2995 msg(M_USAGE, "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
2996 }
2997 }
2998 else
2999 {
3000 /*
3001 * Make sure user doesn't specify any TLS options
3002 * when in non-TLS mode.
3003 */
3004
3005 const char use_err[] = "Parameter %s can only be specified in TLS-mode, "
3006 "i.e. where --tls-server or --tls-client is also specified.";
3007
3008 MUST_BE_UNDEF(ca_file, "ca");
3009 MUST_BE_UNDEF(ca_path, "capath");
3010 MUST_BE_UNDEF(dh_file, "dh");
3011 MUST_BE_UNDEF(cert_file, "cert");
3012 MUST_BE_UNDEF(priv_key_file, "key");
3013#ifndef ENABLE_CRYPTO_MBEDTLS
3014 MUST_BE_UNDEF(pkcs12_file, "pkcs12");
3015#endif
3016 MUST_BE_UNDEF(cipher_list, "tls-cipher");
3017 MUST_BE_UNDEF(cipher_list_tls13, "tls-ciphersuites");
3018 MUST_BE_UNDEF(tls_cert_profile, "tls-cert-profile");
3019 MUST_BE_UNDEF(tls_verify, "tls-verify");
3020 MUST_BE_UNDEF(tls_export_peer_cert_dir, "tls-export-cert");
3021 MUST_BE_UNDEF(verify_x509_name, "verify-x509-name");
3022 MUST_BE_UNDEF(tls_timeout, "tls-timeout");
3023 MUST_BE_UNDEF(renegotiate_bytes, "reneg-bytes");
3024 MUST_BE_UNDEF(renegotiate_packets, "reneg-pkts");
3025 MUST_BE_UNDEF(renegotiate_seconds, "reneg-sec");
3026 MUST_BE_UNDEF(handshake_window, "hand-window");
3027 MUST_BE_UNDEF(transition_window, "tran-window");
3028 MUST_BE_UNDEF(tls_auth_file, "tls-auth");
3029 MUST_BE_UNDEF(tls_crypt_file, "tls-crypt");
3030 MUST_BE_UNDEF(tls_crypt_v2_file, "tls-crypt-v2");
3031 MUST_BE_UNDEF(single_session, "single-session");
3032 MUST_BE_UNDEF(push_peer_info, "push-peer-info");
3033 MUST_BE_UNDEF(tls_exit, "tls-exit");
3034 MUST_BE_UNDEF(crl_file, "crl-verify");
3035 MUST_BE_UNDEF(ns_cert_type, "ns-cert-type");
3036 MUST_BE_UNDEF(remote_cert_ku[0], "remote-cert-ku");
3037 MUST_BE_UNDEF(remote_cert_eku, "remote-cert-eku");
3038#ifdef ENABLE_PKCS11
3039 MUST_BE_UNDEF(pkcs11_providers[0], "pkcs11-providers");
3040 MUST_BE_UNDEF(pkcs11_private_mode[0], "pkcs11-private-mode");
3041 MUST_BE_UNDEF(pkcs11_id, "pkcs11-id");
3042 MUST_BE_UNDEF(pkcs11_id_management, "pkcs11-id-management");
3043#endif
3044
3045 if (pull)
3046 {
3047 msg(M_USAGE, use_err, "--pull");
3048 }
3049 }
3051 {
3052 msg(M_USAGE, "--auth-user-pass requires --pull");
3053 }
3054
3055 uninit_options(&defaults);
3056}
3057
3058#undef MUST_BE_UNDEF
3059#undef MUST_BE_FALSE
3060
3061static void
3063{
3064 const int dev = dev_type_enum(o->dev, o->dev_type);
3065
3067 {
3068 if (ce->proto == PROTO_TCP)
3069 {
3070 ce->proto = PROTO_TCP_SERVER;
3071 o->ce.proto = ce->proto;
3072 }
3073 }
3074
3075 if (o->mode != MODE_SERVER)
3076 {
3077 if (ce->proto == PROTO_TCP)
3078 {
3079 ce->proto = PROTO_TCP_CLIENT;
3080 o->ce.proto = ce->proto;
3081 }
3082 }
3083
3084 /* an option is present that requires local bind to enabled */
3085 bool need_bind = ce->local_port_defined || ce->bind_defined || ce->local_list;
3086
3087 /* socks proxy is enabled */
3088 bool uses_socks = ce->proto == PROTO_UDP && ce->socks_proxy_server;
3089
3090 /* If binding is not forced by an explicit option and we have (at least)
3091 * one of --tcp-client, --pull (or --client), or socks we do not bind
3092 * locally to have "normal" IP client behaviour of a random source port */
3093 if (!need_bind && (ce->proto == PROTO_TCP_CLIENT || uses_socks || o->pull))
3094 {
3095 ce->bind_local = false;
3096 }
3097
3098 if (!ce->bind_local)
3099 {
3100 ce->local_port = NULL;
3101 }
3102
3103 /* if protocol forcing is enabled, disable all protocols
3104 * except for the forced one
3105 */
3106 if (o->proto_force >= 0 && o->proto_force != ce->proto)
3107 {
3108 ce->flags |= CE_DISABLED;
3109 }
3110
3111 if (ce->http_proxy_options)
3112 {
3114 }
3115
3116 /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
3117 * so fall back to IPv4-only (trac #1221)
3118 */
3119 if (ce->socks_proxy_server && proto_is_udp(ce->proto) && ce->af != AF_INET)
3120 {
3121 if (ce->af == AF_INET6)
3122 {
3123 msg(M_INFO, "WARNING: '--proto udp6' is not compatible with "
3124 "'--socks-proxy' today. Forcing IPv4 mode." );
3125 }
3126 else
3127 {
3128 msg(M_INFO, "NOTICE: dual-stack mode for '--proto udp' does not "
3129 "work correctly with '--socks-proxy' today. Forcing IPv4." );
3130 }
3131 ce->af = AF_INET;
3132 }
3133
3134 /*
3135 * Set MTU defaults
3136 */
3137 {
3138 if (!ce->tun_mtu_defined && !ce->link_mtu_defined)
3139 {
3140 ce->tun_mtu_defined = true;
3141 }
3142 if ((dev == DEV_TYPE_TAP) && !ce->tun_mtu_extra_defined)
3143 {
3144 ce->tun_mtu_extra_defined = true;
3146 }
3147 }
3148
3149 /*
3150 * If --mssfix is supplied without a parameter or not specified at all,
3151 * default it to --fragment value, if --fragment is specified and otherwise
3152 * to the default if tun-mtu is 1500
3153 */
3154 if (o->ce.mssfix_default)
3155 {
3156#ifdef ENABLE_FRAGMENT
3157 if (ce->fragment)
3158 {
3159 ce->mssfix = ce->fragment;
3160 }
3161 else
3162#endif
3163 if (ce->tun_mtu_defined)
3164 {
3165 if (o->ce.tun_mtu == TUN_MTU_DEFAULT)
3166 {
3167 /* We want to only set mssfix default value if we use a default
3168 * MTU Size, otherwise the different size of tun should either
3169 * already solve the problem or mssfix might artifically make the
3170 * payload packets smaller without mssfix 0 */
3171 ce->mssfix = MSSFIX_DEFAULT;
3172 ce->mssfix_encap = true;
3173 }
3174 else
3175 {
3176 /* We still apply the mssfix value but only adjust it to the
3177 * size of the tun interface. */
3178 ce->mssfix = ce->tun_mtu;
3179 ce->mssfix_fixed = true;
3180 }
3181 }
3182 }
3183
3184 /*
3185 * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
3186 *
3187 * At the end only one of these will be really set because the parser
3188 * logic prevents configurations where more are set.
3189 */
3190 if (!ce->tls_auth_file && !ce->tls_crypt_file && !ce->tls_crypt_v2_file)
3191 {
3195
3198
3201 }
3202
3203 /* Pre-cache tls-auth/crypt(-v2) key file if
3204 * keys were not already embedded in the config file.
3205 */
3207 &ce->tls_auth_file_inline, &o->gc);
3209 &ce->tls_crypt_file_inline, &o->gc);
3211 &ce->tls_crypt_v2_file_inline, &o->gc);
3212
3213
3215 {
3216 msg(M_WARN, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
3218 }
3219}
3220
3221static void
3223{
3224 /* use the global port if none is specified */
3225 if (!le->port)
3226 {
3227 le->port = ce->local_port;
3228 }
3229 /* use the global proto if none is specified and
3230 * allow proto bindings on server mode only */
3231 if (!le->proto || mode == MODE_POINT_TO_POINT)
3232 {
3233 le->proto = ce->proto;
3234 }
3235}
3236
3237#ifdef _WIN32
3238/* If iservice is in use, we need def1 method for redirect-gateway */
3239static void
3241{
3242 if (opt->routes
3244 && opt->routes->flags & RG_REROUTE_GW
3245 && !(opt->routes->flags & RG_DEF1))
3246 {
3247 msg(M_INFO, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
3248 opt->routes->flags |= RG_DEF1;
3249 }
3250}
3251#endif
3252
3253/*
3254 * Save/Restore certain option defaults before --pull is applied.
3255 */
3256
3257static void
3259{
3264
3265 if (o->routes)
3266 {
3268 o->pre_connect->routes_defined = true;
3269 }
3270 if (o->routes_ipv6)
3271 {
3274 }
3275 if (o->client_nat)
3276 {
3279 }
3280
3283
3285
3286 /* NCP related options that can be overwritten by a push */
3288 o->pre_connect->authname = o->authname;
3289
3290 /* Ping related options should be reset to the config values on reconnect */
3294
3295 /* Miscellaneous Options */
3296 o->pre_connect->comp = o->comp;
3297}
3298
3299void
3301{
3302 const struct options_pre_connect *pp = o->pre_connect;
3303 if (pp)
3304 {
3306 if (pp->tuntap_options_defined)
3307 {
3309 }
3310
3311 if (pp->routes_defined)
3312 {
3313 rol_check_alloc(o);
3315 }
3316 else
3317 {
3318 o->routes = NULL;
3319 }
3320
3321 if (pp->routes_ipv6_defined)
3322 {
3325 }
3326 else
3327 {
3328 o->routes_ipv6 = NULL;
3329 }
3330
3333
3334 /* Free DNS options and reset them to pre-pull state */
3335 gc_free(&o->dns_options.gc);
3336 struct gc_arena dns_gc = gc_new();
3337 o->dns_options = clone_dns_options(&pp->dns_options, &dns_gc);
3338 o->dns_options.gc = dns_gc;
3339
3340 if (pp->client_nat_defined)
3341 {
3344 }
3345 else
3346 {
3347 o->client_nat = NULL;
3348 }
3349
3351
3352 o->ciphername = pp->ciphername;
3353 o->authname = pp->authname;
3354
3358
3359 /* Miscellaneous Options */
3360 o->comp = pp->comp;
3361 }
3362
3363 o->push_continuation = 0;
3366}
3367
3368static void
3370{
3371#ifdef _WIN32
3372 const int dev = dev_type_enum(options->dev, options->dev_type);
3373
3374 /* when using wintun/ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
3379 {
3381 }
3382
3383 if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
3384 {
3385 /* delay may only be necessary when we perform DHCP handshake */
3388 if ((options->mode == MODE_POINT_TO_POINT) && dhcp)
3389 {
3391 options->route_delay = 5; /* Vista sometimes has a race without this */
3392 }
3393 }
3394
3396 {
3398 options->ifconfig_noexec = false;
3399 }
3400
3402
3403 /*
3404 * Check consistency of --mode server options.
3405 */
3406 if (options->mode == MODE_SERVER)
3407 {
3408 /*
3409 * We need to explicitly set --tap-sleep because
3410 * we do not schedule event timers in the top-level context.
3411 */
3414 {
3416 }
3418 }
3419#endif /* ifdef _WIN32 */
3420
3421#ifdef DEFAULT_PKCS11_MODULE
3422 /* If p11-kit is present on the system then load its p11-kit-proxy.so
3423 * by default if the user asks for PKCS#11 without otherwise specifying
3424 * the module to use. */
3425 if (!options->pkcs11_providers[0]
3426 && (options->pkcs11_id || options->pkcs11_id_management))
3427 {
3428 options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
3429 }
3430#endif
3431}
3432
3433static void
3435{
3436 if (o->connection_list)
3437 {
3438 int i;
3439 for (i = 0; i < o->connection_list->len; ++i)
3440 {
3442 }
3443 }
3444 else
3445 {
3447 }
3448
3450
3451 if (dco_enabled(o) && o->enable_c2c)
3452 {
3453 msg(M_WARN, "Note: --client-to-client has no effect when using data "
3454 "channel offload: packets are always sent to the VPN "
3455 "interface and then routed based on the system routing table");
3456 }
3457}
3458
3459static void
3461{
3462 if (!o->pull && !(o->mode == MODE_SERVER))
3463 {
3464 /* If the cipher is not set, use the old default of BF-CBC. We will
3465 * warn that this is deprecated on cipher initialisation, no need
3466 * to warn here as well */
3467 if (!o->ciphername)
3468 {
3469 o->ciphername = "BF-CBC";
3470 }
3471 else
3472 {
3473 o->enable_ncp_fallback = true;
3474 }
3475 return;
3476 }
3477
3478 /* pull or P2MP mode */
3479 if (!o->ciphername)
3480 {
3481 /* We still need to set the ciphername to BF-CBC since various other
3482 * parts of OpenVPN assert that the ciphername is set */
3483 o->ciphername = "BF-CBC";
3484
3485 msg(M_INFO, "Note: --cipher is not set. OpenVPN versions before 2.5 "
3486 "defaulted to BF-CBC as fallback when cipher negotiation "
3487 "failed in this case. If you need this fallback please add "
3488 "'--data-ciphers-fallback BF-CBC' to your configuration "
3489 "and/or add BF-CBC to --data-ciphers. E.g. "
3490 "--data-ciphers %s:BF-CBC", o->ncp_ciphers_conf);
3491 }
3492 else if (!o->enable_ncp_fallback
3494 {
3495 msg(M_WARN, "DEPRECATED OPTION: --cipher set to '%s' but missing in "
3496 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
3497 "negotiations. ",
3499 }
3500}
3501
3516static bool
3517need_compatibility_before(const struct options *o, unsigned int version)
3518{
3519 return o->backwards_compatible != 0 && o->backwards_compatible < version;
3520}
3521
3526static void
3528{
3529 /* TLS min version is not set */
3530 int tls_ver_min = (o->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT)
3532 if (tls_ver_min == 0)
3533 {
3534 int tls_ver_max = (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT)
3536 if (need_compatibility_before(o, 20307))
3537 {
3538 /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
3540 }
3541 else if (tls_ver_max == 0 || tls_ver_max >= TLS_VER_1_2)
3542 {
3543 /* Use TLS 1.2 as proper default */
3545 }
3546 else
3547 {
3548 /* Maximize the minimum version */
3549 o->ssl_flags |= (tls_ver_max << SSLF_TLS_VERSION_MIN_SHIFT);
3550 }
3551 }
3552
3553 if (need_compatibility_before(o, 20400))
3554 {
3555 if (!o->ciphername)
3556 {
3557 /* If ciphername is not set default to BF-CBC when targeting these
3558 * old versions that do not have NCP */
3559 o->ciphername = "BF-CBC";
3560 }
3561 /* Versions < 2.4.0 additionally might be compiled with --enable-small and
3562 * not have OCC strings required for "poor man's NCP" */
3563 o->enable_ncp_fallback = true;
3564 }
3565
3566 /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
3567 * Version 2.4 probably does not need it but NCP was not so
3568 * good with 2.4 and ncp-disable might be more common on 2.4 peers.
3569 * Only do this iff --cipher is set (explicitly or by compat mode
3570 * < 2.4.0, see above). This is not 100% correct backwards compatible
3571 * behaviour but 2.5 already behaved like this */
3572 if (o->ciphername && need_compatibility_before(o, 20500)
3574 {
3576 }
3577
3578#ifdef USE_COMP
3579 /* Compression is deprecated and we do not want to announce support for it
3580 * by default anymore, additionally DCO breaks with compression.
3581 *
3582 * Disable compression by default starting with 2.6.0 if no other
3583 * compression related option has been explicitly set */
3584 if (!need_compatibility_before(o, 20600) && (o->comp.flags == 0))
3585 {
3586 if (!comp_non_stub_enabled(&o->comp))
3587 {
3589 }
3590 }
3591#else /* ifdef USE_COMP */
3593#endif
3594}
3595
3596static void
3598{
3599 if (!check_tls_prf_working())
3600 {
3601 msg(D_TLS_ERRORS, "Warning: TLS 1.0 PRF with MD5+SHA1 PRF is not "
3602 "supported by the TLS library. Your system does not support this "
3603 "calculation anymore or your security policy (e.g. FIPS 140-2) "
3604 "forbids it. Connections will only work with peers running "
3605 "OpenVPN 2.6.0 or higher)");
3606#ifndef HAVE_EXPORT_KEYING_MATERIAL
3607 msg(M_FATAL, "Keying Material Exporters (RFC 5705) not available either. "
3608 "No way to generate data channel keys left.");
3609#endif
3610 if (o->mode == MODE_SERVER)
3611 {
3612 msg(M_WARN, "Automatically enabling option "
3613 "--force-tls-key-material-export");
3614 o->force_key_material_export = true;
3615 }
3616
3617 }
3618}
3619
3620static void
3622{
3623 int i;
3624 /*
3625 * Process helper-type options which map to other, more complex
3626 * sequences of options.
3627 */
3629 /* must be called after helpers that might set --mode */
3633
3637
3640 if (o->ncp_ciphers == NULL)
3641 {
3642 msg(M_USAGE, "--data-ciphers list contains unsupported ciphers or is too long.");
3643 }
3644
3645 if (o->remote_list && !o->connection_list)
3646 {
3647 /*
3648 * Convert remotes into connection list
3649 */
3650 const struct remote_list *rl = o->remote_list;
3651 for (i = 0; i < rl->len; ++i)
3652 {
3653 const struct remote_entry *re = rl->array[i];
3654 struct connection_entry ce = o->ce;
3655 struct connection_entry *ace;
3656
3657 ASSERT(re->remote);
3658 connection_entry_load_re(&ce, re);
3660 ASSERT(ace);
3661 *ace = ce;
3662 }
3663 }
3664 else if (!o->remote_list && !o->connection_list)
3665 {
3666 struct connection_entry *ace;
3668 ASSERT(ace);
3669 *ace = o->ce;
3670 }
3671
3673 for (i = 0; i < o->connection_list->len; ++i)
3674 {
3676 }
3677
3678 if (o->ce.local_list)
3679 {
3680 for (i = 0; i < o->ce.local_list->len; i++)
3681 {
3683 }
3684
3685 for (int i = 0; i < o->ce.local_list->len; i++)
3686 {
3687 if (o->ce.local_list->array[i]->proto == PROTO_TCP)
3688 {
3690 }
3691 else if (o->ce.local_list->array[i]->proto == PROTO_NONE)
3692 {
3693 o->ce.local_list->array[i]->proto = o->ce.proto;
3694 }
3695 }
3696 }
3697 else
3698 {
3699 /* if no 'local' directive was specified, convert the global port
3700 * setting to a listen entry */
3701 struct local_entry *e = alloc_local_entry(&o->ce, M_USAGE, &o->gc);
3702 ASSERT(e);
3703 e->port = o->ce.local_port;
3704 e->proto = o->ce.proto;
3705 }
3706
3707 /* use the same listen list for every outgoing connection */
3708 for (i = 0; i < o->connection_list->len; ++i)
3709 {
3711 }
3712
3713 if (o->tls_server)
3714 {
3715 /* Check that DH file is specified, or explicitly disabled */
3716 notnull(o->dh_file, "DH file (--dh)");
3717 if (streq(o->dh_file, "none"))
3718 {
3719 o->dh_file = NULL;
3720 }
3721 }
3722 else if (o->dh_file)
3723 {
3724 /* DH file is only meaningful in a tls-server context. */
3725 msg(M_WARN, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3726 "include this in your server configuration");
3727 o->dh_file = NULL;
3728 }
3729#if ENABLE_MANAGEMENT
3730 if (o->http_proxy_override)
3731 {
3733 }
3734#endif
3735 if (!o->ca_file && !o->ca_path && o->verify_hash
3736 && o->verify_hash_depth == 0)
3737 {
3738 msg(M_INFO, "Using certificate fingerprint to verify peer (no CA "
3739 "option set). ");
3740 o->verify_hash_no_ca = true;
3741 }
3742
3743 if (o->config && streq(o->config, "stdin") && o->remap_sigusr1 == SIGHUP)
3744 {
3745 msg(M_USAGE, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3746 "incompatible with each other.");
3747 }
3748
3749 if (dco_enabled(o))
3750 {
3751 /* check if any option should force disabling DCO */
3754 }
3755#ifdef USE_COMP
3756 if (dco_enabled(o))
3757 {
3759 }
3760#endif
3761
3762#ifdef _WIN32
3763 if (dco_enabled(o))
3764 {
3766 }
3767 else
3768 {
3769 if (o->windows_driver == DRIVER_DCO)
3770 {
3771 msg(M_WARN, "Option --windows-driver ovpn-dco is ignored because Data Channel Offload is disabled");
3773 }
3775 {
3777 }
3778 }
3779#else /* _WIN32 */
3780 if (dco_enabled(o) && o->dev_node)
3781 {
3782 msg(M_WARN, "Note: ignoring --dev-node as it has no effect when using "
3783 "data channel offload");
3784 o->dev_node = NULL;
3785 }
3786#endif /* _WIN32 */
3787
3788 /* this depends on o->windows_driver, which is set above */
3790
3791 /* check that compression settings in the options are okay */
3793
3794 /*
3795 * Save certain parms before modifying options during connect, especially
3796 * when using --pull
3797 */
3798 if (o->pull)
3799 {
3801 }
3802 else
3803 {
3804#if defined(_WIN32) || defined(TARGET_ANDROID)
3806#else
3807 foreign_options_copy_dns(o, es);
3808#endif
3809 }
3811 {
3813 }
3815}
3816
3817/*
3818 * Check file/directory sanity
3819 *
3820 */
3821#ifndef ENABLE_SMALL /* Expect people using the stripped down version to know what they do */
3822
3823#define CHKACC_FILE (1<<0)
3824#define CHKACC_DIRPATH (1<<1)
3825#define CHKACC_FILEXSTWR (1<<2)
3826#define CHKACC_ACPTSTDIN (1<<3)
3827#define CHKACC_PRIVATE (1<<4)
3828#define CHKACC_ACCEPT_URI (1<<5)
3830static bool
3831check_file_access(const int type, const char *file, const int mode, const char *opt)
3832{
3833 int errcode = 0;
3834
3835 /* If no file configured, no errors to look for */
3836 if (!file)
3837 {
3838 return false;
3839 }
3840
3841 /* If stdin is allowed and the file name is 'stdin', then do no
3842 * further checks as stdin is always available
3843 */
3844 if ( (type & CHKACC_ACPTSTDIN) && streq(file, "stdin") )
3845 {
3846 return false;
3847 }
3848
3849 /* file name is a URI if its first segment has ":" (i.e., before any "/")
3850 * Then no checks done if CHKACC_ACCEPT_URI is set and the URI does not start with "file:"
3851 */
3852 if ((type & CHKACC_ACCEPT_URI) && strchr(file, ':'))
3853 {
3854 if (!strncmp(file, "file:", 5))
3855 {
3856 file += 5;
3857 }
3858 else if (!strchr(file, '/') || strchr(file, '/') > strchr(file, ':'))
3859 {
3860 return false;
3861 }
3862 }
3863
3864 /* Is the directory path leading to the given file accessible? */
3865 if (type & CHKACC_DIRPATH)
3866 {
3867 char *fullpath = string_alloc(file, NULL); /* POSIX dirname() implementation may modify its arguments */
3868 char *dirpath = dirname(fullpath);
3869
3870 if (platform_access(dirpath, mode|X_OK) != 0)
3871 {
3872 errcode = errno;
3873 }
3874 free(fullpath);
3875 }
3876
3877 /* Is the file itself accessible? */
3878 if (!errcode && (type & CHKACC_FILE) && (platform_access(file, mode) != 0) )
3879 {
3880 errcode = errno;
3881 }
3882
3883 /* If the file exists and is accessible, is it writable? */
3884 if (!errcode && (type & CHKACC_FILEXSTWR) && (platform_access(file, F_OK) == 0) )
3885 {
3886 if (platform_access(file, W_OK) != 0)
3887 {
3888 errcode = errno;
3889 }
3890 }
3891
3892 /* Warn if a given private file is group/others accessible. */
3893 if (type & CHKACC_PRIVATE)
3894 {
3895 platform_stat_t st;
3896 if (platform_stat(file, &st))
3897 {
3898 msg(M_WARN | M_ERRNO, "WARNING: cannot stat file '%s'", file);
3899 }
3900#ifndef _WIN32
3901 else
3902 {
3903 if (st.st_mode & (S_IRWXG|S_IRWXO))
3904 {
3905 msg(M_WARN, "WARNING: file '%s' is group or others accessible", file);
3906 }
3907 }
3908#endif
3909 }
3910
3911 /* Scream if an error is found */
3912 if (errcode > 0)
3913 {
3914 msg(M_NOPREFIX | M_OPTERR | M_ERRNO, "%s fails with '%s'", opt, file);
3915 }
3916
3917 /* Return true if an error occurred */
3918 return (errcode != 0 ? true : false);
3919}
3920
3921/* A wrapper for check_file_access() which also takes a chroot directory.
3922 * If chroot is NULL, behaviour is exactly the same as calling check_file_access() directly,
3923 * otherwise it will look for the file inside the given chroot directory instead.
3924 */
3925static bool
3926check_file_access_chroot(const char *chroot, const int type, const char *file, const int mode, const char *opt)
3927{
3928 bool ret = false;
3929
3930 /* If no file configured, no errors to look for */
3931 if (!file)
3932 {
3933 return false;
3934 }
3935
3936 /* If chroot is set, look for the file/directory inside the chroot */
3937 if (chroot)
3938 {
3939 struct gc_arena gc = gc_new();
3940 struct buffer chroot_file;
3941
3942 chroot_file = prepend_dir(chroot, file, &gc);
3943 ret = check_file_access(type, BSTR(&chroot_file), mode, opt);
3944 gc_free(&gc);
3945 }
3946 else
3947 {
3948 /* No chroot in play, just call core file check function */
3949 ret = check_file_access(type, file, mode, opt);
3950 }
3951 return ret;
3952}
3953
3958static bool
3960 const int type, const char *file,
3961 const int mode, const char *opt)
3962{
3963 if (is_inline)
3964 {
3965 return false;
3966 }
3967
3968 return check_file_access_chroot(chroot, type, file, mode, opt);
3969}
3970
3975static bool
3976check_file_access_inline(bool is_inline, const int type, const char *file,
3977 const int mode, const char *opt)
3978{
3979 if (is_inline)
3980 {
3981 return false;
3982 }
3983
3984 return check_file_access(type, file, mode, opt);
3985}
3986
3987/*
3988 * Verifies that the path in the "command" that comes after certain script options (e.g., --up) is a
3989 * valid file with appropriate permissions.
3990 *
3991 * "command" consists of a path, optionally followed by a space, which may be
3992 * followed by arbitrary arguments. It is NOT a full shell command line -- shell expansion is not
3993 * performed.
3994 *
3995 * The path and arguments in "command" may be single- or double-quoted or escaped.
3996 *
3997 * The path is extracted from "command", then check_file_access() is called to check it. The
3998 * arguments, if any, are ignored.
3999 *
4000 * Note that the type, mode, and opt arguments to this routine are the same as the corresponding
4001 * check_file_access() arguments.
4002 */
4003static bool
4004check_cmd_access(const char *command, const char *opt, const char *chroot)
4005{
4006 struct argv argv;
4007 bool return_code;
4008
4009 /* If no command was set, there are no errors to look for */
4010 if (!command)
4011 {
4012 return false;
4013 }
4014
4015 /* Extract executable path and arguments */
4016 argv = argv_new();
4017 argv_parse_cmd(&argv, command);
4018
4019 /* if an executable is specified then check it; otherwise, complain */
4020 if (argv.argv[0])
4021 {
4022 /* Scripts requires R_OK as well, but that might fail on binaries which
4023 * only requires X_OK to function on Unix - a scenario not unlikely to
4024 * be seen on suid binaries.
4025 */
4026 return_code = check_file_access_chroot(chroot, CHKACC_FILE, argv.argv[0], X_OK, opt);
4027 }
4028 else
4029 {
4030 msg(M_NOPREFIX|M_OPTERR, "%s fails with '%s': No path to executable.",
4031 opt, command);
4032 return_code = true;
4033 }
4034
4035 argv_free(&argv);
4036
4037 return return_code;
4038}
4039
4040/*
4041 * Sanity check of all file/dir options. Checks that file/dir
4042 * is accessible by OpenVPN
4043 */
4044static void
4046{
4047 bool errs = false;
4048
4049 /* ** SSL/TLS/crypto related files ** */
4051 options->dh_file, R_OK, "--dh");
4052
4054 {
4056 options->ca_file, R_OK, "--ca");
4057 }
4058
4060 options->ca_path, R_OK, "--capath");
4061
4063 options->cert_file, R_OK, "--cert");
4064
4067 "--extra-certs");
4068
4070 {
4073 options->priv_key_file, R_OK, "--key");
4074 }
4075
4078 options->pkcs12_file, R_OK, "--pkcs12");
4079
4081 {
4083 options->crl_file, R_OK|X_OK,
4084 "--crl-verify directory");
4085 }
4086 else
4087 {
4091 R_OK, "--crl-verify");
4092 }
4093
4095 {
4098 W_OK, "--tls-export-cert");
4099 }
4100
4102 for (int i = 0; i < options->connection_list->len; ++i)
4103 {
4105
4108 ce->tls_auth_file, R_OK,
4109 "--tls-auth");
4112 ce->tls_crypt_file, R_OK,
4113 "--tls-crypt");
4116 ce->tls_crypt_v2_file, R_OK,
4117 "--tls-crypt-v2");
4118 }
4119
4123 "--secret");
4124
4126 options->packet_id_file, R_OK|W_OK, "--replay-persist");
4127
4128 /* ** Password files ** */
4130 options->key_pass_file, R_OK, "--askpass");
4131#ifdef ENABLE_MANAGEMENT
4134 "--management user/password file");
4135#endif /* ENABLE_MANAGEMENT */
4139 "--auth-user-pass");
4140 /* ** System related ** */
4142 R_OK|X_OK, "--chroot directory");
4144 R_OK|W_OK, "--writepid");
4145
4146 /* ** Log related ** */
4148 R_OK|W_OK, "--status");
4149
4150 /* ** Config related ** */
4152 R_OK|X_OK, "--client-config-dir");
4154 R_OK|W_OK|X_OK, "Temporary directory (--tmp-dir)");
4155
4156 if (errs)
4157 {
4158 msg(M_USAGE, "Please correct these errors.");
4159 }
4160}
4161#endif /* !ENABLE_SMALL */
4162
4163/*
4164 * Sanity check on options.
4165 * Also set some options based on other
4166 * options.
4167 */
4168void
4170{
4173#ifndef ENABLE_SMALL
4175#endif /* !ENABLE_SMALL */
4176}
4177
4178/*
4179 * Sanity check on options after more options were pulled from server.
4180 * Also time to modify some options based on other options.
4181 */
4182bool
4184{
4185 bool success = dns_options_verify(D_PUSH_ERRORS, &o->dns_options);
4186 if (success)
4187 {
4190#if defined(_WIN32) || defined(TARGET_ANDROID)
4192#else
4193 foreign_options_copy_dns(o, es);
4194#endif
4195 }
4196 return success;
4197}
4198
4199/*
4200 * Build an options string to represent data channel encryption options.
4201 * This string must match exactly between peers. The keysize is checked
4202 * separately by read_key().
4203 *
4204 * The following options must match on both peers:
4205 *
4206 * Tunnel options:
4207 *
4208 * --dev tun|tap [unit number need not match]
4209 * --dev-type tun|tap
4210 * --link-mtu
4211 * --udp-mtu
4212 * --tun-mtu
4213 * --proto udp
4214 * --proto tcp-client [matched with --proto tcp-server
4215 * on the other end of the connection]
4216 * --proto tcp-server [matched with --proto tcp-client on
4217 * the other end of the connection]
4218 * --tun-ipv6
4219 * --ifconfig x y [matched with --ifconfig y x on
4220 * the other end of the connection]
4221 *
4222 * --comp-lzo
4223 * --compress alg
4224 * --fragment
4225 *
4226 * Crypto Options:
4227 *
4228 * --cipher
4229 * --auth
4230 * --secret
4231 *
4232 * SSL Options:
4233 *
4234 * --tls-auth
4235 * --tls-client [matched with --tls-server on
4236 * the other end of the connection]
4237 * --tls-server [matched with --tls-client on
4238 * the other end of the connection]
4239 */
4240char *
4241options_string(const struct options *o,
4242 const struct frame *frame,
4243 struct tuntap *tt,
4244 openvpn_net_ctx_t *ctx,
4245 bool remote,
4246 struct gc_arena *gc)
4247{
4248 struct buffer out = alloc_buf(OPTION_LINE_SIZE);
4249 bool tt_local = false;
4250
4251 buf_printf(&out, "V4");
4252
4253 /*
4254 * Tunnel Options
4255 */
4256
4257 buf_printf(&out, ",dev-type %s", dev_type_string(o->dev, o->dev_type));
4258 /* the link-mtu that we send has only a meaning if have a fixed
4259 * cipher (p2p) or have a fallback cipher configured for older non
4260 * ncp clients. But not sending it will make even 2.4 complain
4261 * about it being missing. So still send it. */
4262 buf_printf(&out, ",link-mtu %u",
4263 (unsigned int) calc_options_string_link_mtu(o, frame));
4264
4265 if (o->ce.occ_mtu != 0)
4266 {
4267 buf_printf(&out, ",tun-mtu %d", o->ce.occ_mtu);
4268 }
4269 else
4270 {
4271 buf_printf(&out, ",tun-mtu %d", frame->tun_mtu);
4272 }
4273
4274 buf_printf(&out, ",proto %s", proto_remote(o->ce.proto, remote));
4275
4276 bool p2p_nopull = o->mode == MODE_POINT_TO_POINT && !PULL_DEFINED(o);
4277 /* send tun_ipv6 only in peer2peer mode - in client/server mode, it
4278 * is usually pushed by the server, triggering a non-helpful warning
4279 */
4280 if (o->ifconfig_ipv6_local && p2p_nopull)
4281 {
4282 buf_printf(&out, ",tun-ipv6");
4283 }
4284
4285 /*
4286 * Try to get ifconfig parameters into the options string.
4287 * If tt is undefined, make a temporary instantiation.
4288 */
4289 if (!tt)
4290 {
4291 tt = init_tun(o->dev,
4292 o->dev_type,
4293 o->topology,
4294 o->ifconfig_local,
4295 o->ifconfig_remote_netmask,
4296 o->ifconfig_ipv6_local,
4297 o->ifconfig_ipv6_netbits,
4298 o->ifconfig_ipv6_remote,
4299 NULL,
4300 NULL,
4301 false,
4302 NULL,
4303 ctx,
4304 NULL);
4305 if (tt)
4306 {
4307 tt_local = true;
4308 }
4309 }
4310
4311 if (tt && p2p_nopull)
4312 {
4313 const char *ios = ifconfig_options_string(tt, remote, o->ifconfig_nowarn, gc);
4314 if (ios && strlen(ios))
4315 {
4316 buf_printf(&out, ",ifconfig %s", ios);
4317 }
4318 }
4319 if (tt_local)
4320 {
4321 free(tt);
4322 tt = NULL;
4323 }
4324
4325#ifdef USE_COMP
4326 if (o->comp.alg != COMP_ALG_UNDEF)
4327 {
4328 buf_printf(&out, ",comp-lzo"); /* for compatibility, this simply indicates that compression context is active, not necessarily LZO per-se */
4329 }
4330#endif
4331
4332#ifdef ENABLE_FRAGMENT
4333 if (o->ce.fragment)
4334 {
4335 buf_printf(&out, ",mtu-dynamic");
4336 }
4337#endif
4338
4339#define TLS_CLIENT (o->tls_client)
4340#define TLS_SERVER (o->tls_server)
4341
4342 /*
4343 * Key direction
4344 */
4345 {
4346 const char *kd = keydirection2ascii(o->key_direction, remote, false);
4347 if (kd)
4348 {
4349 buf_printf(&out, ",keydir %s", kd);
4350 }
4351 }
4352
4353 /*
4354 * Crypto Options
4355 */
4356 if (o->shared_secret_file || TLS_CLIENT || TLS_SERVER)
4357 {
4358 struct key_type kt;
4359
4360 ASSERT((o->shared_secret_file != NULL)
4361 + (TLS_CLIENT == true)
4362 + (TLS_SERVER == true)
4363 <= 1);
4364
4365 /* Skip resolving BF-CBC to allow SSL libraries without BF-CBC
4366 * to work here in the default configuration */
4367 const char *ciphername = o->ciphername;
4368 int keysize = 0;
4369
4370 if (strcmp(o->ciphername, "BF-CBC") == 0)
4371 {
4372 init_key_type(&kt, "none", o->authname, true, false);
4373 keysize = 128;
4374 }
4375 else
4376 {
4377 init_key_type(&kt, o->ciphername, o->authname, true, false);
4378 ciphername = cipher_kt_name(kt.cipher);
4379 if (cipher_defined(o->ciphername))
4380 {
4381 keysize = cipher_kt_key_size(kt.cipher) * 8;
4382 }
4383 }
4384 /* Only announce the cipher to our peer if we are willing to
4385 * support it */
4386 if (p2p_nopull || tls_item_in_cipher_list(ciphername, o->ncp_ciphers))
4387 {
4388 buf_printf(&out, ",cipher %s", ciphername);
4389 }
4390 buf_printf(&out, ",auth %s", md_kt_name(kt.digest));
4391 buf_printf(&out, ",keysize %d", keysize);
4392 if (o->shared_secret_file)
4393 {
4394 buf_printf(&out, ",secret");
4395 }
4396
4397#ifdef ENABLE_PREDICTION_RESISTANCE
4398 if (o->use_prediction_resistance)
4399 {
4400 buf_printf(&out, ",use-prediction-resistance");
4401 }
4402#endif
4403 }
4404
4405 /*
4406 * SSL Options
4407 */
4408 {
4409 if (TLS_CLIENT || TLS_SERVER)
4410 {
4411 if (o->ce.tls_auth_file)
4412 {
4413 buf_printf(&out, ",tls-auth");
4414 }
4415 /* Not adding tls-crypt here, because we won't reach this code if
4416 * tls-auth/tls-crypt does not match. Removing tls-auth here would
4417 * break stuff, so leaving that in place. */
4418
4419 buf_printf(&out, ",key-method %d", KEY_METHOD_2);
4420 }
4421
4422 if (remote)
4423 {
4424 if (TLS_CLIENT)
4425 {
4426 buf_printf(&out, ",tls-server");
4427 }
4428 else if (TLS_SERVER)
4429 {
4430 buf_printf(&out, ",tls-client");
4431 }
4432 }
4433 else
4434 {
4435 if (TLS_CLIENT)
4436 {
4437 buf_printf(&out, ",tls-client");
4438 }
4439 else if (TLS_SERVER)
4440 {
4441 buf_printf(&out, ",tls-server");
4442 }
4443 }
4444 }
4445
4446#undef TLS_CLIENT
4447#undef TLS_SERVER
4448
4449 return BSTR(&out);
4450}
4451
4452/*
4453 * Compare option strings for equality.
4454 * If the first two chars of the strings differ, it means that
4455 * we are looking at different versions of the options string,
4456 * therefore don't compare them and return true.
4457 */
4458
4459bool
4460options_cmp_equal(char *actual, const char *expected)
4461{
4462 return options_cmp_equal_safe(actual, expected, strlen(actual) + 1);
4463}
4464
4465void
4466options_warning(char *actual, const char *expected)
4467{
4468 options_warning_safe(actual, expected, strlen(actual) + 1);
4469}
4470
4471static const char *
4472options_warning_extract_parm1(const char *option_string,
4473 struct gc_arena *gc_ret)
4474{
4475 struct gc_arena gc = gc_new();
4477 char *p = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4478 const char *ret;
4479
4480 buf_parse(&b, ' ', p, OPTION_PARM_SIZE);
4481 ret = string_alloc(p, gc_ret);
4482 gc_free(&gc);
4483 return ret;
4484}
4485
4486static void
4488 const int delim,
4489 const bool report_inconsistent,
4490 const char *p1,
4491 const struct buffer *b2_src,
4492 const char *b1_name,
4493 const char *b2_name)
4494{
4495 /* We will stop sending 'key-method', 'keydir', 'proto' and 'tls-auth' in
4496 * OCC in a future version (because it's not useful). To reduce questions
4497 * when interoperating, we no longer printing a warning about it.
4498 */
4499 if (strprefix(p1, "key-method ")
4500 || strprefix(p1, "keydir ")
4501 || strprefix(p1, "proto ")
4502 || streq(p1, "tls-auth")
4503 || strprefix(p1, "tun-ipv6")
4504 || strprefix(p1, "cipher "))
4505 {
4506 return;
4507 }
4508
4509 if (strlen(p1) > 0)
4510 {
4511 struct gc_arena gc = gc_new();
4512 struct buffer b2 = *b2_src;
4514 char *p2 = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4515
4516 while (buf_parse(&b2, delim, p2, OPTION_PARM_SIZE))
4517 {
4518 if (strlen(p2))
4519 {
4521
4522 if (!strcmp(p1, p2))
4523 {
4524 goto done;
4525 }
4526 if (!strcmp(p1_prefix, p2_prefix))
4527 {
4529 {
4530 msg(msglevel, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
4532 b1_name,
4533 safe_print(p1, &gc),
4534 b2_name,
4535 safe_print(p2, &gc));
4536 }
4537 goto done;
4538 }
4539 }
4540 }
4541
4542 msg(msglevel, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
4544 b1_name,
4545 b2_name,
4546 b1_name,
4547 safe_print(p1, &gc));
4548
4549done:
4550 gc_free(&gc);
4551 }
4552}
4553
4554static void
4556 const int delim,
4557 const bool report_inconsistent,
4558 const struct buffer *b1_src,
4559 const struct buffer *b2_src,
4560 const char *b1_name,
4561 const char *b2_name)
4562{
4563 struct gc_arena gc = gc_new();
4564 struct buffer b = *b1_src;
4565 char *p = gc_malloc(OPTION_PARM_SIZE, true, &gc);
4566
4567 while (buf_parse(&b, delim, p, OPTION_PARM_SIZE))
4568 {
4570 }
4571
4572 gc_free(&gc);
4573}
4574
4575static void
4576options_warning_safe_ml(const int msglevel, char *actual, const char *expected, size_t actual_n)
4577{
4578 struct gc_arena gc = gc_new();
4579
4580 if (actual_n > 0)
4581 {
4582 struct buffer local = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4583 struct buffer remote = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4584 actual[actual_n - 1] = 0;
4585
4586 buf_printf(&local, "version %s", expected);
4587 buf_printf(&remote, "version %s", actual);
4588
4589 options_warning_safe_scan1(msglevel, ',', true,
4590 &local, &remote,
4591 "local", "remote");
4592
4593 options_warning_safe_scan1(msglevel, ',', false,
4594 &remote, &local,
4595 "remote", "local");
4596 }
4597
4598 gc_free(&gc);
4599}
4600
4601bool
4602options_cmp_equal_safe(char *actual, const char *expected, size_t actual_n)
4603{
4604 struct gc_arena gc = gc_new();
4605 bool ret = true;
4606
4607 if (actual_n > 0)
4608 {
4609 actual[actual_n - 1] = 0;
4610 if (strncmp(actual, expected, 2))
4611 {
4612 msg(D_SHOW_OCC, "NOTE: Options consistency check may be skewed by version differences");
4613 options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4614 }
4615 else
4616 {
4617 ret = !strcmp(actual, expected);
4618 }
4619 }
4620 gc_free(&gc);
4621 return ret;
4622}
4623
4624void
4625options_warning_safe(char *actual, const char *expected, size_t actual_n)
4626{
4627 options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4628}
4629
4630const char *
4631options_string_version(const char *s, struct gc_arena *gc)
4632{
4633 struct buffer out = alloc_buf_gc(4, gc);
4634 strncpynt((char *) BPTR(&out), s, 3);
4635 return BSTR(&out);
4636}
4637
4638char *
4640 struct gc_arena *gc)
4641{
4642 char *ret = NULL;
4643 const size_t opt_name_len = strlen(opt_name);
4644
4645 const char *p = options_string;
4646 while (p)
4647 {
4648 if (0 == strncmp(p, opt_name, opt_name_len)
4649 && strlen(p) > (opt_name_len+1) && p[opt_name_len] == ' ')
4650 {
4651 /* option found, extract value */
4652 const char *start = &p[opt_name_len+1];
4653 const char *end = strchr(p, ',');
4654 size_t val_len = end ? end - start : strlen(start);
4655 ret = gc_malloc(val_len+1, true, gc);
4656 memcpy(ret, start, val_len);
4657 break;
4658 }
4659 p = strchr(p, ',');
4660 if (p)
4661 {
4662 p++; /* skip delimiter */
4663 }
4664 }
4665 return ret;
4666}
4667
4668#ifdef _WIN32
4676static enum tun_driver_type
4677parse_windows_driver(const char *str, const int msglevel)
4678{
4679 if (streq(str, "tap-windows6"))
4680 {
4682 }
4683 else if (streq(str, "wintun"))
4684 {
4685 return WINDOWS_DRIVER_WINTUN;
4686 }
4687
4688 else if (streq(str, "ovpn-dco"))
4689 {
4690 return DRIVER_DCO;
4691 }
4692 else
4693 {
4694 msg(msglevel, "--windows-driver must be tap-windows6, wintun "
4695 "or ovpn-dco");
4697 }
4698}
4699#endif /* ifdef _WIN32 */
4700
4701/*
4702 * parse/print topology coding
4703 */
4704
4705int
4706parse_topology(const char *str, const int msglevel)
4707{
4708 if (streq(str, "net30"))
4709 {
4710 return TOP_NET30;
4711 }
4712 else if (streq(str, "p2p"))
4713 {
4714 return TOP_P2P;
4715 }
4716 else if (streq(str, "subnet"))
4717 {
4718 return TOP_SUBNET;
4719 }
4720 else
4721 {
4722 msg(msglevel, "--topology must be net30, p2p, or subnet");
4723 return TOP_UNDEF;
4724 }
4725}
4726
4727const char *
4728print_topology(const int topology)
4729{
4730 switch (topology)
4731 {
4732 case TOP_UNDEF:
4733 return "undef";
4734
4735 case TOP_NET30:
4736 return "net30";
4737
4738 case TOP_P2P:
4739 return "p2p";
4740
4741 case TOP_SUBNET:
4742 return "subnet";
4743
4744 default:
4745 return "unknown";
4746 }
4747}
4748
4749/*
4750 * Manage auth-retry variable
4751 */
4752
4753static int global_auth_retry; /* GLOBAL */
4754
4755int
4757{
4758 return global_auth_retry;
4759}
4760
4761bool
4762auth_retry_set(const int msglevel, const char *option)
4763{
4764 if (streq(option, "interact"))
4765 {
4767 }
4768 else if (streq(option, "nointeract"))
4769 {
4771 }
4772 else if (streq(option, "none"))
4773 {
4775 }
4776 else
4777 {
4778 msg(msglevel, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
4779 return false;
4780 }
4781 return true;
4782}
4783
4784const char *
4786{
4787 switch (global_auth_retry)
4788 {
4789 case AR_NONE:
4790 return "none";
4791
4792 case AR_NOINTERACT:
4793 return "nointeract";
4794
4795 case AR_INTERACT:
4796 return "interact";
4797
4798 default:
4799 return "???";
4800 }
4801}
4802
4803/*
4804 * Print the help message.
4805 */
4806static void
4808{
4809 FILE *fp = msg_fp(0);
4810
4811#ifdef ENABLE_SMALL
4812
4813 fprintf(fp, "Usage message not available\n");
4814
4815#else
4816
4817 struct options o;
4818 init_options(&o, true);
4819
4820 fprintf(fp, usage_message,
4826 o.verbosity,
4827 o.authname,
4831 fflush(fp);
4832
4833#endif /* ENABLE_SMALL */
4834
4835 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4836}
4837
4838void
4840{
4841 msg(M_WARN|M_NOPREFIX, "Use --help for more information.");
4842 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4843}
4844
4845#ifdef _WIN32
4846void
4847show_windows_version(const unsigned int flags)
4848{
4849 struct gc_arena gc = gc_new();
4850 msg(flags, "Windows version: %s", win32_version_string(&gc));
4851 gc_free(&gc);
4852}
4853#endif
4854
4855void
4856show_dco_version(const unsigned int flags)
4857{
4858#ifdef ENABLE_DCO
4859 struct gc_arena gc = gc_new();
4860 msg(flags, "DCO version: %s", dco_version_string(&gc));
4861 gc_free(&gc);
4862#endif
4863}
4864
4865void
4866show_library_versions(const unsigned int flags)
4867{
4868#ifdef ENABLE_LZO
4869#define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
4870#else
4871#define LZO_LIB_VER_STR "", ""
4872#endif
4873
4874 msg(flags, "library versions: %s%s%s", get_ssl_library_version(),
4876
4877#undef LZO_LIB_VER_STR
4878}
4879
4880static void
4882{
4885#ifdef _WIN32
4887#endif
4889 msg(M_INFO|M_NOPREFIX, "Originally developed by James Yonan");
4890 msg(M_INFO|M_NOPREFIX, "Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>");
4891#ifndef ENABLE_SMALL
4892#ifdef CONFIGURE_DEFINES
4893 msg(M_INFO|M_NOPREFIX, "Compile time defines: %s", CONFIGURE_DEFINES);
4894#endif
4895#ifdef CONFIGURE_SPECIAL_BUILD
4896 msg(M_INFO|M_NOPREFIX, "special build: %s", CONFIGURE_SPECIAL_BUILD);
4897#endif
4898#endif
4900}
4901
4902void
4903notnull(const char *arg, const char *description)
4904{
4905 if (!arg)
4906 {
4907 msg(M_USAGE, "You must define %s", description);
4908 }
4909}
4910
4911bool
4912string_defined_equal(const char *s1, const char *s2)
4913{
4914 if (s1 && s2)
4915 {
4916 return !strcmp(s1, s2);
4917 }
4918 else
4919 {
4920 return false;
4921 }
4922}
4923
4924#if 0
4925static void
4926ping_rec_err(int msglevel)
4927{
4928 msg(msglevel, "only one of --ping-exit or --ping-restart options may be specified");
4929}
4930#endif
4931
4932#ifdef _WIN32 /* This function is only used when compiling on Windows */
4933static unsigned int
4934atou(const char *str)
4935{
4936 unsigned int val = 0;
4937 sscanf(str, "%u", &val);
4938 return val;
4939}
4940#endif
4941
4942static inline bool
4943space(unsigned char c)
4944{
4945 return c == '\0' || isspace(c);
4946}
4947
4948int
4949parse_line(const char *line,
4950 char *p[],
4951 const int n,
4952 const char *file,
4953 const int line_num,
4954 int msglevel,
4955 struct gc_arena *gc)
4956{
4957 const int STATE_INITIAL = 0;
4958 const int STATE_READING_QUOTED_PARM = 1;
4959 const int STATE_READING_UNQUOTED_PARM = 2;
4960 const int STATE_DONE = 3;
4961 const int STATE_READING_SQUOTED_PARM = 4;
4962
4963 const char *error_prefix = "";
4964
4965 int ret = 0;
4966 const char *c = line;
4967 int state = STATE_INITIAL;
4968 bool backslash = false;
4969 char in, out;
4970
4971 char parm[OPTION_PARM_SIZE];
4972 unsigned int parm_len = 0;
4973
4974 msglevel &= ~M_OPTERR;
4975
4976 if (msglevel & M_MSG_VIRT_OUT)
4977 {
4978 error_prefix = "ERROR: ";
4979 }
4980
4981 do
4982 {
4983 in = *c;
4984 out = 0;
4985
4986 if (!backslash && in == '\\' && state != STATE_READING_SQUOTED_PARM)
4987 {
4988 backslash = true;
4989 }
4990 else
4991 {
4992 if (state == STATE_INITIAL)
4993 {
4994 if (!space(in))
4995 {
4996 if (in == ';' || in == '#') /* comment */
4997 {
4998 break;
4999 }
5000 if (!backslash && in == '\"')
5001 {
5002 state = STATE_READING_QUOTED_PARM;
5003 }
5004 else if (!backslash && in == '\'')
5005 {
5006 state = STATE_READING_SQUOTED_PARM;
5007 }
5008 else
5009 {
5010 out = in;
5011 state = STATE_READING_UNQUOTED_PARM;
5012 }
5013 }
5014 }
5015 else if (state == STATE_READING_UNQUOTED_PARM)
5016 {
5017 if (!backslash && space(in))
5018 {
5019 state = STATE_DONE;
5020 }
5021 else
5022 {
5023 out = in;
5024 }
5025 }
5026 else if (state == STATE_READING_QUOTED_PARM)
5027 {
5028 if (!backslash && in == '\"')
5029 {
5030 state = STATE_DONE;
5031 }
5032 else
5033 {
5034 out = in;
5035 }
5036 }
5037 else if (state == STATE_READING_SQUOTED_PARM)
5038 {
5039 if (in == '\'')
5040 {
5041 state = STATE_DONE;
5042 }
5043 else
5044 {
5045 out = in;
5046 }
5047 }
5048 if (state == STATE_DONE)
5049 {
5050 /* ASSERT (parm_len > 0); */
5051 p[ret] = gc_malloc(parm_len + 1, true, gc);
5052 memcpy(p[ret], parm, parm_len);
5053 p[ret][parm_len] = '\0';
5054 state = STATE_INITIAL;
5055 parm_len = 0;
5056 ++ret;
5057 }
5058
5059 if (backslash && out)
5060 {
5061 if (!(out == '\\' || out == '\"' || space(out)))
5062 {
5063#ifdef ENABLE_SMALL
5064 msg(msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix, file, line_num);
5065#else
5066 msg(msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE "\\\\static.key\"", error_prefix, file, line_num);
5067#endif
5068 return 0;
5069 }
5070 }
5071 backslash = false;
5072 }
5073
5074 /* store parameter character */
5075 if (out)
5076 {
5077 if (parm_len >= SIZE(parm))
5078 {
5079 parm[SIZE(parm) - 1] = 0;
5080 msg(msglevel, "%sOptions error: Parameter at %s:%d is too long (%d chars max): %s",
5081 error_prefix, file, line_num, (int) SIZE(parm), parm);
5082 return 0;
5083 }
5084 parm[parm_len++] = out;
5085 }
5086
5087 /* avoid overflow if too many parms in one config file line */
5088 if (ret >= n)
5089 {
5090 break;
5091 }
5092
5093 } while (*c++ != '\0');
5094
5095 if (state == STATE_READING_QUOTED_PARM)
5096 {
5097 msg(msglevel, "%sOptions error: No closing quotation (\") in %s:%d", error_prefix, file, line_num);
5098 return 0;
5099 }
5100 if (state == STATE_READING_SQUOTED_PARM)
5101 {
5102 msg(msglevel, "%sOptions error: No closing single quotation (\') in %s:%d", error_prefix, file, line_num);
5103 return 0;
5104 }
5105 if (state != STATE_INITIAL)
5106 {
5107 msg(msglevel, "%sOptions error: Residual parse state (%d) in %s:%d", error_prefix, state, file, line_num);
5108 return 0;
5109 }
5110#if 0
5111 {
5112 int i;
5113 for (i = 0; i < ret; ++i)
5114 {
5115 msg(M_INFO|M_NOPREFIX, "%s:%d ARG[%d] '%s'", file, line_num, i, p[i]);
5116 }
5117 }
5118#endif
5119 return ret;
5120}
5121
5122static void
5124{
5125 if (strlen(*p) >= 3 && !strncmp(*p, "--", 2))
5126 {
5127 *p += 2;
5128 }
5129}
5130
5131struct in_src {
5132#define IS_TYPE_FP 1
5133#define IS_TYPE_BUF 2
5134 int type;
5135 union {
5136 FILE *fp;
5138 } u;
5139};
5140
5141static bool
5142in_src_get(const struct in_src *is, char *line, const int size)
5143{
5144 if (is->type == IS_TYPE_FP)
5145 {
5146 return BOOL_CAST(fgets(line, size, is->u.fp));
5147 }
5148 else if (is->type == IS_TYPE_BUF)
5149 {
5150 bool status = buf_parse(is->u.multiline, '\n', line, size);
5151 if ((int) strlen(line) + 1 < size)
5152 {
5153 strcat(line, "\n");
5154 }
5155 return status;
5156 }
5157 else
5158 {
5159 ASSERT(0);
5160 return false;
5161 }
5162}
5163
5164static char *
5166 int *num_lines, struct gc_arena *gc)
5167{
5168 char line[OPTION_LINE_SIZE];
5169 struct buffer buf = alloc_buf(8*OPTION_LINE_SIZE);
5170 char *ret;
5171 bool endtagfound = false;
5172
5173 while (in_src_get(is, line, sizeof(line)))
5174 {
5175 (*num_lines)++;
5176 char *line_ptr = line;
5177 /* Remove leading spaces */
5178 while (isspace(*line_ptr))
5179 {
5180 line_ptr++;
5181 }
5183 {
5184 endtagfound = true;
5185 break;
5186 }
5187 if (!buf_safe(&buf, strlen(line)+1))
5188 {
5189 /* Increase buffer size */
5190 struct buffer buf2 = alloc_buf(buf.capacity * 2);
5191 ASSERT(buf_copy(&buf2, &buf));
5192 buf_clear(&buf);
5193 free_buf(&buf);
5194 buf = buf2;
5195 }
5196 buf_printf(&buf, "%s", line);
5197 }
5198 if (!endtagfound)
5199 {
5200 msg(M_FATAL, "ERROR: Endtag %s missing", close_tag);
5201 }
5202 ret = string_alloc(BSTR(&buf), gc);
5203 buf_clear(&buf);
5204 free_buf(&buf);
5205 secure_memzero(line, sizeof(line));
5206 return ret;
5207}
5208
5209static int
5210check_inline_file(struct in_src *is, char *p[], struct gc_arena *gc)
5211{
5212 int num_inline_lines = 0;
5213
5214 if (p[0] && !p[1])
5215 {
5216 char *arg = p[0];
5217 if (arg[0] == '<' && arg[strlen(arg)-1] == '>')
5218 {
5219 struct buffer close_tag;
5220
5221 arg[strlen(arg) - 1] = '\0';
5222 p[0] = string_alloc(arg + 1, gc);
5223 close_tag = alloc_buf(strlen(p[0]) + 4);
5224 buf_printf(&close_tag, "</%s>", p[0]);
5226 p[2] = NULL;
5228 }
5229 }
5230 return num_inline_lines;
5231}
5232
5233static int
5235{
5236 struct in_src is;
5237 is.type = IS_TYPE_FP;
5238 is.u.fp = fp;
5239 return check_inline_file(&is, p, gc);
5240}
5241
5242static int
5244 struct gc_arena *gc)
5245{
5246 struct in_src is;
5247 is.type = IS_TYPE_BUF;
5248 is.u.multiline = multiline;
5249 return check_inline_file(&is, p, gc);
5250}
5251
5252static void
5253add_option(struct options *options,
5254 char *p[],
5255 bool is_inline,
5256 const char *file,
5257 int line,
5258 const int level,
5259 const int msglevel,
5260 const unsigned int permission_mask,
5261 unsigned int *option_types_found,
5262 struct env_set *es);
5263
5264static void
5266 const char *file,
5267 int level,
5268 const char *top_file,
5269 const int top_line,
5270 const int msglevel,
5271 const unsigned int permission_mask,
5272 unsigned int *option_types_found,
5273 struct env_set *es)
5274{
5275 const int max_recursive_levels = 10;
5276 FILE *fp;
5277 int line_num;
5278 char line[OPTION_LINE_SIZE+1];
5279 char *p[MAX_PARMS+1];
5280
5281 ++level;
5282 if (level <= max_recursive_levels)
5283 {
5284 if (streq(file, "stdin"))
5285 {
5286 fp = stdin;
5287 }
5288 else
5289 {
5290 fp = platform_fopen(file, "r");
5291 }
5292 if (fp)
5293 {
5294 line_num = 0;
5295 while (fgets(line, sizeof(line), fp))
5296 {
5297 int offset = 0;
5298 CLEAR(p);
5299 ++line_num;
5300 if (strlen(line) == OPTION_LINE_SIZE)
5301 {
5302 msg(msglevel, "In %s:%d: Maximum option line length (%d) exceeded, line starts with %s",
5303 file, line_num, OPTION_LINE_SIZE, line);
5304 }
5305
5306 /* Ignore UTF-8 BOM at start of stream */
5307 if (line_num == 1 && strncmp(line, "\xEF\xBB\xBF", 3) == 0)
5308 {
5309 offset = 3;
5310 }
5311 if (parse_line(line + offset, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
5312 {
5313 bypass_doubledash(&p[0]);
5314 int lines_inline = check_inline_file_via_fp(fp, p, &options->gc);
5315 add_option(options, p, lines_inline, file, line_num, level,
5316 msglevel, permission_mask, option_types_found,
5317 es);
5318 line_num += lines_inline;
5319 }
5320 }
5321 if (fp != stdin)
5322 {
5323 fclose(fp);
5324 }
5325 }
5326 else
5327 {
5328 msg(msglevel, "In %s:%d: Error opening configuration file: %s", top_file, top_line, file);
5329 }
5330 }
5331 else
5332 {
5333 msg(msglevel, "In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file, top_line, file);
5334 }
5335 secure_memzero(line, sizeof(line));
5336 CLEAR(p);
5337}
5338
5339static void
5340read_config_string(const char *prefix,
5341 struct options *options,
5342 const char *config,
5343 const int msglevel,
5344 const unsigned int permission_mask,
5345 unsigned int *option_types_found,
5346 struct env_set *es)
5347{
5348 char line[OPTION_LINE_SIZE];
5349 struct buffer multiline;
5350 int line_num = 0;
5351
5352 buf_set_read(&multiline, (uint8_t *)config, strlen(config));
5353
5354 while (buf_parse(&multiline, '\n', line, sizeof(line)))
5355 {
5356 char *p[MAX_PARMS+1];
5357 CLEAR(p);
5358 ++line_num;
5359 if (parse_line(line, p, SIZE(p)-1, prefix, line_num, msglevel, &options->gc))
5360 {
5361 bypass_doubledash(&p[0]);
5362 int lines_inline = check_inline_file_via_buf(&multiline, p, &options->gc);
5363 add_option(options, p, lines_inline, prefix, line_num, 0, msglevel,
5364 permission_mask, option_types_found, es);
5366 }
5367 CLEAR(p);
5368 }
5369 secure_memzero(line, sizeof(line));
5370}
5371
5372void
5374 const int argc,
5375 char *argv[],
5376 const int msglevel,
5377 const unsigned int permission_mask,
5378 unsigned int *option_types_found,
5379 struct env_set *es)
5380{
5381 /* usage message */
5382 if (argc <= 1)
5383 {
5384 usage();
5385 }
5386
5387 /* config filename specified only? */
5388 if (argc == 2 && strncmp(argv[1], "--", 2))
5389 {
5390 char *p[MAX_PARMS+1];
5391 CLEAR(p);
5392 p[0] = "config";
5393 p[1] = argv[1];
5394 add_option(options, p, false, NULL, 0, 0, msglevel, permission_mask,
5395 option_types_found, es);
5396 }
5397 else
5398 {
5399 /* parse command line */
5400 for (int i = 1; i < argc; ++i)
5401 {
5402 char *p[MAX_PARMS+1];
5403 CLEAR(p);
5404 p[0] = argv[i];
5405 if (strncmp(p[0], "--", 2))
5406 {
5407 msg(msglevel, "I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p[0]);
5408 }
5409 else
5410 {
5411 p[0] += 2;
5412 }
5413
5414 int j;
5415 for (j = 1; j < MAX_PARMS; ++j)
5416 {
5417 if (i + j < argc)
5418 {
5419 char *arg = argv[i + j];
5420 if (strncmp(arg, "--", 2))
5421 {
5422 p[j] = arg;
5423 }
5424 else
5425 {
5426 break;
5427 }
5428 }
5429 }
5430 add_option(options, p, false, NULL, 0, 0, msglevel, permission_mask,
5431 option_types_found, es);
5432 i += j - 1;
5433 }
5434 }
5435}
5436
5445static bool
5446apply_pull_filter(const struct options *o, char *line)
5447{
5448 struct pull_filter *f;
5449
5450 if (!o->pull_filter_list)
5451 {
5452 return true;
5453 }
5454
5455 /* skip leading spaces matching the behaviour of parse_line */
5456 while (isspace(*line))
5457 {
5458 line++;
5459 }
5460
5461 for (f = o->pull_filter_list->head; f; f = f->next)
5462 {
5463 if (f->type == PUF_TYPE_ACCEPT && strncmp(line, f->pattern, f->size) == 0)
5464 {
5465 msg(D_LOW, "Pushed option accepted by filter: '%s'", line);
5466 return true;
5467 }
5468 else if (f->type == PUF_TYPE_IGNORE && strncmp(line, f->pattern, f->size) == 0)
5469 {
5470 msg(D_PUSH, "Pushed option removed by filter: '%s'", line);
5471 *line = '\0';
5472 return true;
5473 }
5474 else if (f->type == PUF_TYPE_REJECT && strncmp(line, f->pattern, f->size) == 0)
5475 {
5476 msg(M_WARN, "Pushed option rejected by filter: '%s'. Restarting.", line);
5477 *line = '\0';
5478 throw_signal_soft(SIGUSR1, "Offending option received from server");
5479 return false;
5480 }
5481 }
5482 return true;
5483}
5484
5485bool
5487 struct buffer *buf,
5488 unsigned int permission_mask,
5489 unsigned int *option_types_found,
5490 struct env_set *es)
5491{
5492 char line[OPTION_PARM_SIZE];
5493 int line_num = 0;
5494 const char *file = "[PUSH-OPTIONS]";
5495 const int msglevel = D_PUSH_ERRORS|M_OPTERR;
5496
5497 while (buf_parse(buf, ',', line, sizeof(line)))
5498 {
5499 char *p[MAX_PARMS+1];
5500 CLEAR(p);
5501 ++line_num;
5502 if (!apply_pull_filter(options, line))
5503 {
5504 return false; /* Cause push/pull error and stop push processing */
5505 }
5506 if (parse_line(line, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
5507 {
5508 add_option(options, p, false, file, line_num, 0, msglevel,
5509 permission_mask, option_types_found, es);
5510 }
5511 }
5512 return true;
5513}
5514
5515void
5517 const char *filename,
5518 int msglevel,
5519 unsigned int permission_mask,
5520 unsigned int *option_types_found,
5521 struct env_set *es)
5522{
5523 msg(D_PUSH, "OPTIONS IMPORT: reading client specific options from: %s", filename);
5525 filename,
5526 0,
5527 filename,
5528 0,
5529 msglevel,
5530 permission_mask,
5531 option_types_found,
5532 es);
5533}
5534
5535void
5537 const char *config,
5538 const int msglevel,
5539 const unsigned int permission_mask,
5540 unsigned int *option_types_found,
5541 struct env_set *es)
5542{
5543 read_config_string("[CONFIG-STRING]", options, config, msglevel, permission_mask, option_types_found, es);
5544}
5545
5546#define VERIFY_PERMISSION(mask) { \
5547 if (!verify_permission(p[0], file, line, (mask), permission_mask, \
5548 option_types_found, msglevel, options, is_inline)) \
5549 { \
5550 goto err; \
5551 } \
5552}
5553
5554static bool
5555verify_permission(const char *name,
5556 const char *file,
5557 int line,
5558 const unsigned int type,
5559 const unsigned int allowed,
5560 unsigned int *found,
5561 const int msglevel,
5562 struct options *options,
5563 bool is_inline)
5564{
5565 if (!(type & allowed))
5566 {
5567 msg(msglevel, "option '%s' cannot be used in this context (%s)", name, file);
5568 return false;
5569 }
5570
5571 if (is_inline && !(type & OPT_P_INLINE))
5572 {
5573 msg(msglevel, "option '%s' is not expected to be inline (%s:%d)", name,
5574 file, line);
5575 return false;
5576 }
5577
5578 if (found)
5579 {
5580 *found |= type;
5581 }
5582
5583#ifndef ENABLE_SMALL
5584 /* Check if this options is allowed in connection block,
5585 * but we are currently not in a connection block
5586 * unless this is a pushed option.
5587 * Parsing a connection block uses a temporary options struct without
5588 * connection_list
5589 */
5590
5592 && !(allowed & OPT_P_PULL_MODE))
5593 {
5594 if (file)
5595 {
5596 msg(M_WARN, "Option '%s' in %s:%d is ignored by previous <connection> blocks ", name, file, line);
5597 }
5598 else
5599 {
5600 msg(M_WARN, "Option '%s' is ignored by previous <connection> blocks", name);
5601 }
5602 }
5603#endif
5604 return true;
5605}
5606
5607/*
5608 * Check that an option doesn't have too
5609 * many parameters.
5610 */
5611
5612#define NM_QUOTE_HINT (1<<0)
5613
5614static bool
5615no_more_than_n_args(const int msglevel,
5616 char *p[],
5617 const int max,
5618 const unsigned int flags)
5619{
5620 const int len = string_array_len((const char **)p);
5621
5622 if (!len)
5623 {
5624 return false;
5625 }
5626
5627 if (len > max)
5628 {
5629 msg(msglevel, "the --%s directive should have at most %d parameter%s.%s",
5630 p[0],
5631 max - 1,
5632 max >= 3 ? "s" : "",
5633 (flags & NM_QUOTE_HINT) ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")." : "");
5634 return false;
5635 }
5636 else
5637 {
5638 return true;
5639 }
5640}
5641
5642static inline int
5643msglevel_forward_compatible(struct options *options, const int msglevel)
5644{
5645 return options->forward_compatible ? M_WARN : msglevel;
5646}
5647
5648static void
5650 const char **script,
5651 const char *new_script,
5652 const char *type,
5653 bool in_chroot)
5654{
5655 if (*script)
5656 {
5657 msg(M_WARN, "Multiple --%s scripts defined. "
5658 "The previously configured script is overridden.", type);
5659 }
5660 *script = new_script;
5661 options->user_script_used = true;
5662
5663#ifndef ENABLE_SMALL
5664 {
5665 char script_name[100];
5666 snprintf(script_name, sizeof(script_name),
5667 "--%s script", type);
5668
5669 if (check_cmd_access(*script, script_name, (in_chroot ? options->chroot_dir : NULL)))
5670 {
5671 msg(M_USAGE, "Please correct this error.");
5672 }
5673
5674 }
5675#endif
5676}
5677
5678static void
5680{
5681 if (comp_non_stub_enabled(info))
5682 {
5683 msg(M_WARN, "WARNING: Compression for receiving enabled. "
5684 "Compression has been used in the past to break encryption. "
5685 "Compression support is deprecated and we recommend to disable "
5686 "it completely.");
5687 }
5688}
5689
5690bool
5692{
5693 bool ret = false;
5694 ret = ret || (options->management_flags & MF_EXTERNAL_KEY);
5695#ifdef ENABLE_PKCS11
5696 ret = ret || (options->pkcs11_providers[0] != NULL);
5697#endif
5698#ifdef ENABLE_CRYPTOAPI
5699 ret = ret || options->cryptoapi_cert;
5700#endif
5701
5702 return ret;
5703}
5704
5705static void
5707 char *p[],
5708 bool is_inline,
5709 const char *file,
5710 int line,
5711 const int level,
5712 const int msglevel,
5713 const unsigned int permission_mask,
5714 unsigned int *option_types_found,
5715 struct env_set *es)
5716{
5717 struct gc_arena gc = gc_new();
5718 const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
5719 int msglevel_fc = msglevel_forward_compatible(options, msglevel);
5720
5721 ASSERT(MAX_PARMS >= 7);
5722
5723 /*
5724 * If directive begins with "setenv opt" prefix, don't raise an error if
5725 * directive is unrecognized.
5726 */
5727 if (streq(p[0], "setenv") && p[1] && streq(p[1], "opt") && !(permission_mask & OPT_P_PULL_MODE))
5728 {
5729 if (!p[2])
5730 {
5731 p[2] = "setenv opt"; /* will trigger an error that includes setenv opt */
5732 }
5733 p += 2;
5734 msglevel_fc = M_WARN;
5735 }
5736
5737 if (!file)
5738 {
5739 file = "[CMD-LINE]";
5740 line = 1;
5741 }
5742 if (streq(p[0], "help"))
5743 {
5745 usage();
5746 if (p[1])
5747 {
5748 msg(msglevel, "--help does not accept any parameters");
5749 goto err;
5750 }
5751 }
5752 if (streq(p[0], "version") && !p[1])
5753 {
5755 usage_version();
5756 }
5757 else if (streq(p[0], "config") && p[1] && !p[2])
5758 {
5760
5761 /* save first config file only in options */
5762 if (!options->config)
5763 {
5764 options->config = p[1];
5765 }
5766
5767 read_config_file(options, p[1], level, file, line, msglevel, permission_mask, option_types_found, es);
5768 }
5769#if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
5770 else if (streq(p[0], "show-gateway") && !p[2])
5771 {
5772 struct route_gateway_info rgi;
5773 struct route_ipv6_gateway_info rgi6;
5774 in_addr_t remote_ipv4 = 0;
5775 struct in6_addr remote_ipv6 = IN6ADDR_ANY_INIT;
5776 openvpn_net_ctx_t net_ctx;
5778 if (p[1])
5779 {
5780 /* try parsing the argument as a v4 or v6 address - if
5781 * possible, the output will show the exact route there, and
5782 * "the default route" for the other protocol
5783 */
5784 remote_ipv4 = get_ip_addr(p[1], M_WARN, NULL);
5785 get_ipv6_addr(p[1], &remote_ipv6, NULL, M_WARN);
5786 }
5787 net_ctx_init(NULL, &net_ctx);
5788 get_default_gateway(&rgi, remote_ipv4, &net_ctx);
5789 get_default_gateway_ipv6(&rgi6, &remote_ipv6, &net_ctx);
5790 print_default_gateway(M_INFO, &rgi, &rgi6);
5791 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
5792 }
5793#endif /* if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL) */
5794 else if (streq(p[0], "echo") || streq(p[0], "parameter"))
5795 {
5796 struct buffer string = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
5797 int j;
5798 bool good = true;
5799
5801
5802 for (j = 1; j < MAX_PARMS; ++j)
5803 {
5804 if (!p[j])
5805 {
5806 break;
5807 }
5808 if (j > 1)
5809 {
5810 good &= buf_printf(&string, " ");
5811 }
5812 good &= buf_printf(&string, "%s", p[j]);
5813 }
5814 if (good)
5815 {
5816 /* only message-related ECHO are logged, since other ECHOs
5817 * can potentially include security-sensitive strings */
5818 if (p[1] && strncmp(p[1], "msg", 3) == 0)
5819 {
5820 msg(M_INFO, "%s:%s",
5821 pull_mode ? "ECHO-PULL" : "ECHO",
5822 BSTR(&string));
5823 }
5824#ifdef ENABLE_MANAGEMENT
5825 if (management)
5826 {
5828 }
5829#endif
5830 }
5831 else
5832 {
5833 msg(M_WARN, "echo/parameter option overflow");
5834 }
5835 }
5836#ifdef ENABLE_MANAGEMENT
5837 else if (streq(p[0], "management") && p[1] && p[2] && !p[4])
5838 {
5840 if (streq(p[2], "unix"))
5841 {
5842#if UNIX_SOCK_SUPPORT
5844#else
5845 msg(msglevel, "MANAGEMENT: this platform does not support unix domain sockets");
5846 goto err;
5847#endif
5848 }
5849
5852 if (p[3])
5853 {
5855 }
5856 }
5857 else if (streq(p[0], "management-client-user") && p[1] && !p[2])
5858 {
5861 }
5862 else if (streq(p[0], "management-client-group") && p[1] && !p[2])
5863 {
5866 }
5867 else if (streq(p[0], "management-query-passwords") && !p[1])
5868 {
5871 }
5872 else if (streq(p[0], "management-query-remote") && !p[1])
5873 {
5876 }
5877 else if (streq(p[0], "management-query-proxy") && !p[1])
5878 {
5881 }
5882 else if (streq(p[0], "management-hold") && !p[1])
5883 {
5886 }
5887 else if (streq(p[0], "management-signal") && !p[1])
5888 {
5891 }
5892 else if (streq(p[0], "management-forget-disconnect") && !p[1])
5893 {
5896 }
5897 else if (streq(p[0], "management-up-down") && !p[1])
5898 {
5901 }
5902 else if (streq(p[0], "management-client") && !p[1])
5903 {
5906 }
5907 else if (streq(p[0], "management-external-key"))
5908 {
5910 for (int j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
5911 {
5912 if (streq(p[j], "nopadding"))
5913 {
5915 }
5916 else if (streq(p[j], "pkcs1"))
5917 {
5919 }
5920 else if (streq(p[j], "pss"))
5921 {
5923 }
5924 else if (streq(p[j], "digest"))
5925 {
5927 }
5928 else
5929 {
5930 msg(msglevel, "Unknown management-external-key flag: %s", p[j]);
5931 }
5932 }
5933 /*
5934 * When no option is present, assume that only PKCS1
5935 * padding is supported
5936 */
5939 {
5941 }
5943 }
5944 else if (streq(p[0], "management-external-cert") && p[1] && !p[2])
5945 {
5949 }
5950 else if (streq(p[0], "management-client-auth") && !p[1])
5951 {
5954 }
5955 else if (streq(p[0], "management-log-cache") && p[1] && !p[2])
5956 {
5957 int cache;
5958
5960 cache = atoi_warn(p[1], msglevel);
5961 if (cache < 1)
5962 {
5963 msg(msglevel, "--management-log-cache parameter is out of range");
5964 goto err;
5965 }
5967 }
5968#endif /* ifdef ENABLE_MANAGEMENT */
5969#ifdef ENABLE_PLUGIN
5970 else if (streq(p[0], "plugin") && p[1])
5971 {
5973 if (!options->plugin_list)
5974 {
5976 }
5978 {
5979 msg(msglevel, "plugin add failed: %s", p[1]);
5980 goto err;
5981 }
5982 }
5983#endif
5984 else if (streq(p[0], "mode") && p[1] && !p[2])
5985 {
5987 if (streq(p[1], "p2p"))
5988 {
5990 }
5991 else if (streq(p[1], "server"))
5992 {
5994 }
5995 else
5996 {
5997 msg(msglevel, "Bad --mode parameter: %s", p[1]);
5998 goto err;
5999 }
6000 }
6001 else if (streq(p[0], "dev") && p[1] && !p[2])
6002 {
6004 options->dev = p[1];
6005 }
6006 else if (streq(p[0], "dev-type") && p[1] && !p[2])
6007 {
6009 options->dev_type = p[1];
6010 }
6011#ifdef _WIN32
6012 else if (streq(p[0], "windows-driver") && p[1] && !p[2])
6013 {
6016 }
6017#endif
6018 else if (streq(p[0], "disable-dco"))
6019 {
6020 options->disable_dco = true;
6021 }
6022 else if (streq(p[0], "dev-node") && p[1] && !p[2])
6023 {
6025 options->dev_node = p[1];
6026 }
6027 else if (streq(p[0], "lladdr") && p[1] && !p[2])
6028 {
6030 if (mac_addr_safe(p[1])) /* MAC address only */
6031 {
6032 options->lladdr = p[1];
6033 }
6034 else
6035 {
6036 msg(msglevel, "lladdr parm '%s' must be a MAC address", p[1]);
6037 goto err;
6038 }
6039 }
6040 else if (streq(p[0], "topology") && p[1] && !p[2])
6041 {
6043 options->topology = parse_topology(p[1], msglevel);
6044 }
6045 else if (streq(p[0], "tun-ipv6") && !p[1])
6046 {
6047 if (!pull_mode)
6048 {
6049 msg(M_WARN, "Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.");
6050 }
6051 }
6052#ifdef ENABLE_IPROUTE
6053 else if (streq(p[0], "iproute") && p[1] && !p[2])
6054 {
6056 iproute_path = p[1];
6057 }
6058#endif
6059 else if (streq(p[0], "ifconfig") && p[1] && p[2] && !p[3])
6060 {
6062 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn) && ip_or_dns_addr_safe(p[2], options->allow_pull_fqdn)) /* FQDN -- may be DNS name */
6063 {
6064 options->ifconfig_local = p[1];
6066 }
6067 else
6068 {
6069 msg(msglevel, "ifconfig parms '%s' and '%s' must be valid addresses", p[1], p[2]);
6070 goto err;
6071 }
6072 }
6073 else if (streq(p[0], "ifconfig-ipv6") && p[1] && p[2] && !p[3])
6074 {
6075 unsigned int netbits;
6076
6078 if (get_ipv6_addr( p[1], NULL, &netbits, msglevel )
6079 && ipv6_addr_safe( p[2] ) )
6080 {
6082 {
6083 msg( msglevel, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'", netbits );
6084 goto err;
6085 }
6086
6088 options->ifconfig_ipv6_netbits = netbits;
6090 }
6091 else
6092 {
6093 msg(msglevel, "ifconfig-ipv6 parms '%s' and '%s' must be valid addresses", p[1], p[2]);
6094 goto err;
6095 }
6096 }
6097 else if (streq(p[0], "ifconfig-noexec") && !p[1])
6098 {
6100 options->ifconfig_noexec = true;
6101 }
6102 else if (streq(p[0], "ifconfig-nowarn") && !p[1])
6103 {
6105 options->ifconfig_nowarn = true;
6106 }
6107 else if (streq(p[0], "local") && p[1] && !p[4])
6108 {
6109 struct local_entry *e;
6110
6112
6114 ASSERT(e);
6115
6116 /* '*' is treated as 'ask the system to get some socket',
6117 * therefore force binding on a particular address only when
6118 * actually specified. */
6119 if (strcmp(p[1], "*") != 0)
6120 {
6121 e->local = p[1];
6122 }
6123
6124 if (p[2])
6125 {
6126 e->port = p[2];
6127 }
6128
6129 if (p[3])
6130 {
6131 e->proto = ascii2proto(p[3]);
6132 }
6133 }
6134 else if (streq(p[0], "remote-random") && !p[1])
6135 {
6137 options->remote_random = true;
6138 }
6139 else if (streq(p[0], "connection") && p[1] && !p[3])
6140 {
6142 if (is_inline)
6143 {
6144 struct options sub;
6145 struct connection_entry *e;
6146
6147 init_options(&sub, true);
6148 sub.ce = options->ce;
6149 read_config_string("[CONNECTION-OPTIONS]", &sub, p[1], msglevel,
6150 OPT_P_CONNECTION, option_types_found, es);
6151 if (!sub.ce.remote)
6152 {
6153 msg(msglevel, "Each 'connection' block must contain exactly one 'remote' directive");
6154 uninit_options(&sub);
6155 goto err;
6156 }
6157
6158 e = alloc_connection_entry(options, msglevel);
6159 if (!e)
6160 {
6161 uninit_options(&sub);
6162 goto err;
6163 }
6164 *e = sub.ce;
6165 gc_transfer(&options->gc, &sub.gc);
6166 uninit_options(&sub);
6167 }
6168 }
6169 else if (streq(p[0], "ignore-unknown-option") && p[1])
6170 {
6171 int i;
6172 int j;
6173 int numignored = 0;
6174 const char **ignore;
6175
6177 /* Find out how many options to be ignored */
6178 for (i = 1; p[i]; i++)
6179 {
6180 numignored++;
6181 }
6182
6183 /* add number of options already ignored */
6184 for (i = 0; options->ignore_unknown_option
6185 && options->ignore_unknown_option[i]; i++)
6186 {
6187 numignored++;
6188 }
6189
6190 /* Allocate array */
6191 ALLOC_ARRAY_GC(ignore, const char *, numignored+1, &options->gc);
6192 for (i = 0; options->ignore_unknown_option
6193 && options->ignore_unknown_option[i]; i++)
6194 {
6195 ignore[i] = options->ignore_unknown_option[i];
6196 }
6197
6199
6200 for (j = 1; p[j]; j++)
6201 {
6202 /* Allow the user to specify ignore-unknown-option --opt too */
6203 if (p[j][0]=='-' && p[j][1]=='-')
6204 {
6205 options->ignore_unknown_option[i] = (p[j]+2);
6206 }
6207 else
6208 {
6209 options->ignore_unknown_option[i] = p[j];
6210 }
6211 i++;
6212 }
6213
6214 options->ignore_unknown_option[i] = NULL;
6215 }
6216#if ENABLE_MANAGEMENT
6217 else if (streq(p[0], "http-proxy-override") && p[1] && p[2] && !p[4])
6218 {
6222 {
6223 goto err;
6224 }
6225 }
6226#endif
6227 else if (streq(p[0], "remote") && p[1] && !p[4])
6228 {
6229 struct remote_entry re;
6230 re.remote = re.remote_port = NULL;
6231 re.proto = -1;
6232 re.af = 0;
6233
6235 re.remote = p[1];
6236 if (p[2])
6237 {
6238 re.remote_port = p[2];
6239 if (p[3])
6240 {
6241 const int proto = ascii2proto(p[3]);
6242 const sa_family_t af = ascii2af(p[3]);
6243 if (proto < 0)
6244 {
6245 msg(msglevel,
6246 "remote: bad protocol associated with host %s: '%s'",
6247 p[1], p[3]);
6248 goto err;
6249 }
6250 re.proto = proto;
6251 re.af = af;
6252 }
6253 }
6254 if (permission_mask & OPT_P_GENERAL)
6255 {
6256 struct remote_entry *e = alloc_remote_entry(options, msglevel);
6257 if (!e)
6258 {
6259 goto err;
6260 }
6261 *e = re;
6262 }
6263 else if (permission_mask & OPT_P_CONNECTION)
6264 {
6266 }
6267 }
6268 else if (streq(p[0], "resolv-retry") && p[1] && !p[2])
6269 {
6271 if (streq(p[1], "infinite"))
6272 {
6274 }
6275 else
6276 {
6277 options->resolve_retry_seconds = positive_atoi(p[1], msglevel);
6278 }
6279 }
6280 else if ((streq(p[0], "preresolve") || streq(p[0], "ip-remote-hint")) && !p[2])
6281 {
6284 /* Note the ip-remote-hint and the argument p[1] are for
6285 * backward compatibility */
6286 if (p[1])
6287 {
6288 options->ip_remote_hint = p[1];
6289 }
6290 }
6291 else if (streq(p[0], "connect-retry") && p[1] && !p[3])
6292 {
6294 options->ce.connect_retry_seconds = positive_atoi(p[1], msglevel);
6295 /*
6296 * Limit the base value of retry wait interval to 16 bits to avoid
6297 * overflow when scaled up for exponential backoff
6298 */
6299 if (options->ce.connect_retry_seconds > 0xFFFF)
6300 {
6302 msg(M_WARN, "connect retry wait interval truncated to %d",
6304 }
6305
6306 if (p[2])
6307 {
6310 }
6311 }
6312 else if ((streq(p[0], "connect-timeout") || streq(p[0], "server-poll-timeout"))
6313 && p[1] && !p[2])
6314 {
6316 options->ce.connect_timeout = positive_atoi(p[1], msglevel);
6317 }
6318 else if (streq(p[0], "connect-retry-max") && p[1] && !p[2])
6319 {
6321 options->connect_retry_max = positive_atoi(p[1], msglevel);
6322 }
6323 else if (streq(p[0], "ipchange") && p[1])
6324 {
6326 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6327 {
6328 goto err;
6329 }
6331 &options->ipchange,
6332 string_substitute(p[1], ',', ' ', &options->gc),
6333 "ipchange", true);
6334 }
6335 else if (streq(p[0], "float") && !p[1])
6336 {
6338 options->ce.remote_float = true;
6339 }
6340#ifdef ENABLE_DEBUG
6341 else if (streq(p[0], "gremlin") && p[1] && !p[2])
6342 {
6344 options->gremlin = positive_atoi(p[1], msglevel);
6345 }
6346#endif
6347 else if (streq(p[0], "chroot") && p[1] && !p[2])
6348 {
6350 options->chroot_dir = p[1];
6351 }
6352 else if (streq(p[0], "cd") && p[1] && !p[2])
6353 {
6355 if (platform_chdir(p[1]))
6356 {
6357 msg(M_ERR, "cd to '%s' failed", p[1]);
6358 goto err;
6359 }
6360 options->cd_dir = p[1];
6361 }
6362#ifdef ENABLE_SELINUX
6363 else if (streq(p[0], "setcon") && p[1] && !p[2])
6364 {
6366 options->selinux_context = p[1];
6367 }
6368#endif
6369 else if (streq(p[0], "writepid") && p[1] && !p[2])
6370 {
6372 options->writepid = p[1];
6373 }
6374 else if (streq(p[0], "up") && p[1])
6375 {
6377 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6378 {
6379 goto err;
6380 }
6381 set_user_script(options, &options->up_script, p[1], "up", false);
6382 }
6383 else if (streq(p[0], "down") && p[1])
6384 {
6386 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
6387 {
6388 goto err;
6389 }
6390 set_user_script(options, &options->down_script, p[1], "down", true);
6391 }
6392 else if (streq(p[0], "down-pre") && !p[1])
6393 {
6395 options->down_pre = true;
6396 }
6397 else if (streq(p[0], "up-delay") && !p[1])
6398 {
6400 options->up_delay = true;
6401 }
6402 else if (streq(p[0], "up-restart") && !p[1])
6403 {
6405 options->up_restart = true;
6406 }
6407 else if (streq(p[0], "syslog") && !p[2])
6408 {
6410 open_syslog(p[1], false);
6411 }
6412 else if (streq(p[0], "daemon") && !p[2])
6413 {
6414 bool didit = false;
6416 if (!options->daemon)
6417 {
6418 options->daemon = didit = true;
6419 open_syslog(p[1], false);
6420 }
6421 if (p[1])
6422 {
6423 if (!didit)
6424 {
6425 msg(M_WARN, "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)", p[1]);
6426 goto err;
6427 }
6428 }
6429 }
6430 else if (streq(p[0], "log") && p[1] && !p[2])
6431 {
6433 options->log = true;
6434 redirect_stdout_stderr(p[1], false);
6435 }
6436 else if (streq(p[0], "suppress-timestamps") && !p[1])
6437 {
6441 }
6442 else if (streq(p[0], "machine-readable-output") && !p[1])
6443 {
6447 }
6448 else if (streq(p[0], "log-append") && p[1] && !p[2])
6449 {
6451 options->log = true;
6452 redirect_stdout_stderr(p[1], true);
6453 }
6454#ifdef ENABLE_MEMSTATS
6455 else if (streq(p[0], "memstats") && p[1] && !p[2])
6456 {
6458 options->memstats_fn = p[1];
6459 }
6460#endif
6461 else if (streq(p[0], "mlock") && !p[1])
6462 {
6464 options->mlock = true;
6465 }
6466#if ENABLE_IP_PKTINFO
6467 else if (streq(p[0], "multihome") && !p[1])
6468 {
6471 }
6472#endif
6473 else if (streq(p[0], "verb") && p[1] && !p[2])
6474 {
6476 options->verbosity = positive_atoi(p[1], msglevel);
6478 {
6479 /* We pass this flag to the SSL library to avoid
6480 * mbed TLS always generating debug level logging */
6482 }
6483#if !defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
6484 /* Warn when a debug verbosity is supplied when built without debug support */
6485 if (options->verbosity >= 7)
6486 {
6487 msg(M_WARN, "NOTE: debug verbosity (--verb %d) is enabled but this build lacks debug support.",
6489 }
6490#endif
6491 }
6492 else if (streq(p[0], "mute") && p[1] && !p[2])
6493 {
6495 options->mute = positive_atoi(p[1], msglevel);
6496 }
6497 else if (streq(p[0], "errors-to-stderr") && !p[1])
6498 {
6501 }
6502 else if (streq(p[0], "status") && p[1] && !p[3])
6503 {
6505 options->status_file = p[1];
6506 if (p[2])
6507 {
6509 }
6510 }
6511 else if (streq(p[0], "status-version") && p[1] && !p[2])
6512 {
6513 int version;
6514
6516 version = atoi_warn(p[1], msglevel);
6517 if (version < 1 || version > 3)
6518 {
6519 msg(msglevel, "--status-version must be 1 to 3");
6520 goto err;
6521 }
6522 options->status_file_version = version;
6523 }
6524 else if (streq(p[0], "remap-usr1") && p[1] && !p[2])
6525 {
6527 if (streq(p[1], "SIGHUP"))
6528 {
6529 options->remap_sigusr1 = SIGHUP;
6530 }
6531 else if (streq(p[1], "SIGTERM"))
6532 {
6533 options->remap_sigusr1 = SIGTERM;
6534 }
6535 else
6536 {
6537 msg(msglevel, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
6538 goto err;
6539 }
6540 }
6541 else if ((streq(p[0], "link-mtu") || streq(p[0], "udp-mtu")) && p[1] && !p[2])
6542 {
6544 options->ce.link_mtu = positive_atoi(p[1], msglevel);
6545 options->ce.link_mtu_defined = true;
6546 }
6547 else if (streq(p[0], "tun-mtu") && p[1] && !p[3])
6548 {
6550 options->ce.tun_mtu = positive_atoi(p[1], msglevel);
6551 options->ce.tun_mtu_defined = true;
6552 if (p[2])
6553 {
6554 options->ce.occ_mtu = positive_atoi(p[2], msglevel);
6555 }
6556 else
6557 {
6558 options->ce.occ_mtu = 0;
6559 }
6560 }
6561 else if (streq(p[0], "tun-mtu-max") && p[1] && !p[3])
6562 {
6564 int max_mtu = positive_atoi(p[1], msglevel);
6565 if (max_mtu < 68 || max_mtu > 65536)
6566 {
6567 msg(msglevel, "--tun-mtu-max value '%s' is invalid", p[1]);
6568 }
6569 else
6570 {
6571 options->ce.tun_mtu_max = max_mtu;
6572 }
6573 }
6574 else if (streq(p[0], "tun-mtu-extra") && p[1] && !p[2])
6575 {
6577 options->ce.tun_mtu_extra = positive_atoi(p[1], msglevel);
6579 }
6580 else if (streq(p[0], "max-packet-size") && p[1] && !p[2])
6581 {
6583 int maxmtu = positive_atoi(p[1], msglevel);
6585
6586 if (maxmtu < TLS_CHANNEL_MTU_MIN || maxmtu > TLS_CHANNEL_BUF_SIZE)
6587 {
6588 msg(M_WARN, "Note: max-packet-size value outside of allowed "
6589 "control channel packet size (%d to %d), will use %d "
6591 options->ce.tls_mtu);
6592 }
6593
6594 /* also set mssfix maxmtu mtu */
6595 options->ce.mssfix = maxmtu;
6596 options->ce.mssfix_default = false;
6597 options->ce.mssfix_encap = true;
6598 }
6599#ifdef ENABLE_FRAGMENT
6600 else if (streq(p[0], "mtu-dynamic"))
6601 {
6603 msg(msglevel, "--mtu-dynamic has been replaced by --fragment");
6604 goto err;
6605 }
6606 else if (streq(p[0], "fragment") && p[1] && !p[3])
6607 {
6609 options->ce.fragment = positive_atoi(p[1], msglevel);
6610
6611 if (options->ce.fragment < 68)
6612 {
6613 msg(msglevel, "--fragment needs to be at least 68");
6614 goto err;
6615 }
6616
6617 if (p[2] && streq(p[2], "mtu"))
6618 {
6619 options->ce.fragment_encap = true;
6620 }
6621 else if (p[2])
6622 {
6623 msg(msglevel, "Unknown parameter to --fragment: %s", p[2]);
6624 }
6625 }
6626#endif /* ifdef ENABLE_FRAGMENT */
6627 else if (streq(p[0], "mtu-disc") && p[1] && !p[2])
6628 {
6631 }
6632 else if (streq(p[0], "mtu-test") && !p[1])
6633 {
6635 options->mtu_test = true;
6636 }
6637 else if (streq(p[0], "nice") && p[1] && !p[2])
6638 {
6640 options->nice = atoi_warn(p[1], msglevel);
6641 }
6642 else if (streq(p[0], "rcvbuf") && p[1] && !p[2])
6643 {
6645 options->rcvbuf = positive_atoi(p[1], msglevel);
6646 }
6647 else if (streq(p[0], "sndbuf") && p[1] && !p[2])
6648 {
6650 options->sndbuf = positive_atoi(p[1], msglevel);
6651 }
6652 else if (streq(p[0], "mark") && p[1] && !p[2])
6653 {
6654#if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
6656 options->mark = atoi_warn(p[1], msglevel);
6657#endif
6658 }
6659 else if (streq(p[0], "socket-flags"))
6660 {
6661 int j;
6663 for (j = 1; j < MAX_PARMS && p[j]; ++j)
6664 {
6665 if (streq(p[j], "TCP_NODELAY"))
6666 {
6668 }
6669 else
6670 {
6671 msg(msglevel, "unknown socket flag: %s", p[j]);
6672 }
6673 }
6674 }
6675#ifdef TARGET_LINUX
6676 else if (streq(p[0], "bind-dev") && p[1])
6677 {
6679 options->bind_dev = p[1];
6680 }
6681#endif
6682 else if (streq(p[0], "txqueuelen") && p[1] && !p[2])
6683 {
6685#ifdef TARGET_LINUX
6686 options->tuntap_options.txqueuelen = positive_atoi(p[1], msglevel);
6687#else
6688 msg(msglevel, "--txqueuelen not supported on this OS");
6689 goto err;
6690#endif
6691 }
6692 else if (streq(p[0], "shaper") && p[1] && !p[2])
6693 {
6694 int shaper;
6695
6697 shaper = atoi_warn(p[1], msglevel);
6698 if (shaper < SHAPER_MIN || shaper > SHAPER_MAX)
6699 {
6700 msg(msglevel, "Bad shaper value, must be between %d and %d",
6702 goto err;
6703 }
6705 }
6706 else if (streq(p[0], "port") && p[1] && !p[2])
6707 {
6710 }
6711 else if (streq(p[0], "lport") && p[1] && !p[2])
6712 {
6714
6715 /* only trigger bind() if port is not 0 (or --local is used) */
6716 if (!streq(p[1], "0"))
6717 {
6719 }
6720 options->ce.local_port = p[1];
6721 }
6722 else if (streq(p[0], "rport") && p[1] && !p[2])
6723 {
6725 options->ce.remote_port = p[1];
6726 }
6727 else if (streq(p[0], "bind") && !p[2])
6728 {
6730 options->ce.bind_defined = true;
6731 if (p[1] && streq(p[1], "ipv6only"))
6732 {
6733 options->ce.bind_ipv6_only = true;
6734 }
6735
6736 }
6737 else if (streq(p[0], "nobind") && !p[1])
6738 {
6740 options->ce.bind_local = false;
6741 }
6742 else if (streq(p[0], "fast-io") && !p[1])
6743 {
6745 options->fast_io = true;
6746 }
6747 else if (streq(p[0], "inactive") && p[1] && !p[3])
6748 {
6750 options->inactivity_timeout = positive_atoi(p[1], msglevel);
6751 if (p[2])
6752 {
6753 int64_t val = atoll(p[2]);
6754 options->inactivity_minimum_bytes = (val < 0) ? 0 : val;
6755 if (options->inactivity_minimum_bytes > INT_MAX)
6756 {
6757 msg(M_WARN, "WARNING: '--inactive' with a 'bytes' value"
6758 " >2 Gbyte was silently ignored in older versions. If "
6759 " your VPN exits unexpectedly with 'Inactivity timeout'"
6760 " in %d seconds, revisit this value.",
6762 }
6763 }
6764 }
6765 else if (streq(p[0], "session-timeout") && p[1] && !p[2])
6766 {
6768 options->session_timeout = positive_atoi(p[1], msglevel);
6769 }
6770 else if (streq(p[0], "proto") && p[1] && !p[2])
6771 {
6772 int proto;
6775 proto = ascii2proto(p[1]);
6776 af = ascii2af(p[1]);
6777 if (proto < 0)
6778 {
6779 msg(msglevel,
6780 "Bad protocol: '%s'. Allowed protocols with --proto option: %s",
6781 p[1],
6783 goto err;
6784 }
6785 options->ce.proto = proto;
6786 options->ce.af = af;
6787 }
6788 else if (streq(p[0], "proto-force") && p[1] && !p[2])
6789 {
6790 int proto_force;
6792 proto_force = ascii2proto(p[1]);
6793 if (proto_force < 0)
6794 {
6795 msg(msglevel, "Bad --proto-force protocol: '%s'", p[1]);
6796 goto err;
6797 }
6798 options->proto_force = proto_force;
6799 }
6800 else if (streq(p[0], "http-proxy") && p[1] && !p[5])
6801 {
6802 struct http_proxy_options *ho;
6803
6805
6806 {
6807 if (!p[2])
6808 {
6809 msg(msglevel, "http-proxy port number not defined");
6810 goto err;
6811 }
6812
6814
6815 ho->server = p[1];
6816 ho->port = p[2];
6817 }
6818
6819 if (p[3])
6820 {
6821 /* auto -- try to figure out proxy addr, port, and type automatically */
6822 /* auto-nct -- disable proxy auth cleartext protocols (i.e. basic auth) */
6823 if (streq(p[3], "auto"))
6824 {
6825 ho->auth_retry = PAR_ALL;
6826 }
6827 else if (streq(p[3], "auto-nct"))
6828 {
6829 ho->auth_retry = PAR_NCT;
6830 }
6831 else
6832 {
6833 ho->auth_method_string = "basic";
6834 ho->auth_file = p[3];
6835
6836 if (p[4])
6837 {
6838 ho->auth_method_string = p[4];
6839 }
6840 }
6841 }
6842 else
6843 {
6844 ho->auth_method_string = "none";
6845 }
6846 }
6847 else if (streq(p[0], "http-proxy-user-pass") && p[1])
6848 {
6849 struct http_proxy_options *ho;
6852 ho->auth_file_up = p[1];
6853 ho->inline_creds = is_inline;
6854 }
6855 else if (streq(p[0], "http-proxy-retry") || streq(p[0], "socks-proxy-retry"))
6856 {
6858 msg(M_WARN, "DEPRECATED OPTION: http-proxy-retry and socks-proxy-retry: "
6859 "In OpenVPN 2.4 proxy connection retries are handled like regular connections. "
6860 "Use connect-retry-max 1 to get a similar behavior as before.");
6861 }
6862 else if (streq(p[0], "http-proxy-timeout") && p[1] && !p[2])
6863 {
6865 msg(M_WARN, "DEPRECATED OPTION: http-proxy-timeout: In OpenVPN 2.4 the timeout until a connection to a "
6866 "server is established is managed with a single timeout set by connect-timeout");
6867 }
6868 else if (streq(p[0], "http-proxy-option") && p[1] && !p[4])
6869 {
6870 struct http_proxy_options *ho;
6871
6874
6875 if (streq(p[1], "VERSION") && p[2] && !p[3])
6876 {
6877 ho->http_version = p[2];
6878 }
6879 else if (streq(p[1], "AGENT") && p[2] && !p[3])
6880 {
6881 ho->user_agent = p[2];
6882 }
6883 else if ((streq(p[1], "EXT1") || streq(p[1], "EXT2") || streq(p[1], "CUSTOM-HEADER"))
6884 && p[2])
6885 {
6886 /* In the wild patched versions use both EXT1/2 and CUSTOM-HEADER
6887 * with either two argument or one */
6888
6889 struct http_custom_header *custom_header = NULL;
6890 int i;
6891 /* Find the first free header */
6892 for (i = 0; i < MAX_CUSTOM_HTTP_HEADER; i++)
6893 {
6894 if (!ho->custom_headers[i].name)
6895 {
6896 custom_header = &ho->custom_headers[i];
6897 break;
6898 }
6899 }
6900 if (!custom_header)
6901 {
6902 msg(msglevel, "Cannot use more than %d http-proxy-option CUSTOM-HEADER : '%s'", MAX_CUSTOM_HTTP_HEADER, p[1]);
6903 }
6904 else
6905 {
6906 /* We will save p[2] and p[3], the proxy code will detect if
6907 * p[3] is NULL */
6908 custom_header->name = p[2];
6909 custom_header->content = p[3];
6910 }
6911 }
6912 else
6913 {
6914 msg(msglevel, "Bad http-proxy-option or missing or extra parameter: '%s'", p[1]);
6915 }
6916 }
6917 else if (streq(p[0], "socks-proxy") && p[1] && !p[4])
6918 {
6920
6921 if (p[2])
6922 {
6923 options->ce.socks_proxy_port = p[2];
6924 }
6925 else
6926 {
6927 options->ce.socks_proxy_port = "1080";
6928 }
6930 options->ce.socks_proxy_authfile = p[3]; /* might be NULL */
6931 }
6932 else if (streq(p[0], "keepalive") && p[1] && p[2] && !p[3])
6933 {
6935 options->keepalive_ping = atoi_warn(p[1], msglevel);
6936 options->keepalive_timeout = atoi_warn(p[2], msglevel);
6937 }
6938 else if (streq(p[0], "ping") && p[1] && !p[2])
6939 {
6941 options->ping_send_timeout = positive_atoi(p[1], msglevel);
6942 }
6943 else if (streq(p[0], "ping-exit") && p[1] && !p[2])
6944 {
6946 options->ping_rec_timeout = positive_atoi(p[1], msglevel);
6948 }
6949 else if (streq(p[0], "ping-restart") && p[1] && !p[2])
6950 {
6952 options->ping_rec_timeout = positive_atoi(p[1], msglevel);
6954 }
6955 else if (streq(p[0], "ping-timer-rem") && !p[1])
6956 {
6958 options->ping_timer_remote = true;
6959 }
6960 else if (streq(p[0], "explicit-exit-notify") && !p[2])
6961 {
6963 if (p[1])
6964 {
6966 }
6967 else
6968 {
6970 }
6971 }
6972 else if (streq(p[0], "persist-tun") && !p[1])
6973 {
6975 options->persist_tun = true;
6976 }
6977 else if (streq(p[0], "persist-key") && !p[1])
6978 {
6980 msg(M_WARN, "DEPRECATED: --persist-key option ignored. "
6981 "Keys are now always persisted across restarts. ");
6982 }
6983 else if (streq(p[0], "persist-local-ip") && !p[1])
6984 {
6986 options->persist_local_ip = true;
6987 }
6988 else if (streq(p[0], "persist-remote-ip") && !p[1])
6989 {
6991 options->persist_remote_ip = true;
6992 }
6993 else if (streq(p[0], "client-nat") && p[1] && p[2] && p[3] && p[4] && !p[5])
6994 {
6997 add_client_nat_to_option_list(options->client_nat, p[1], p[2], p[3], p[4], msglevel);
6998 }
6999 else if (streq(p[0], "route") && p[1] && !p[5])
7000 {
7003 if (pull_mode)
7004 {
7005 if (!ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn) && !is_special_addr(p[1])) /* FQDN -- may be DNS name */
7006 {
7007 msg(msglevel, "route parameter network/IP '%s' must be a valid address", p[1]);
7008 goto err;
7009 }
7010 if (p[2] && !ip_addr_dotted_quad_safe(p[2])) /* FQDN -- must be IP address */
7011 {
7012 msg(msglevel, "route parameter netmask '%s' must be an IP address", p[2]);
7013 goto err;
7014 }
7015 if (p[3] && !ip_or_dns_addr_safe(p[3], options->allow_pull_fqdn) && !is_special_addr(p[3])) /* FQDN -- may be DNS name */
7016 {
7017 msg(msglevel, "route parameter gateway '%s' must be a valid address", p[3]);
7018 goto err;
7019 }
7020 }
7021 add_route_to_option_list(options->routes, p[1], p[2], p[3], p[4]);
7022 }
7023 else if (streq(p[0], "route-ipv6") && p[1] && !p[4])
7024 {
7027 if (pull_mode)
7028 {
7029 if (!ipv6_addr_safe_hexplusbits(p[1]))
7030 {
7031 msg(msglevel, "route-ipv6 parameter network/IP '%s' must be a valid address", p[1]);
7032 goto err;
7033 }
7034 if (p[2] && !ipv6_addr_safe(p[2]))
7035 {
7036 msg(msglevel, "route-ipv6 parameter gateway '%s' must be a valid address", p[2]);
7037 goto err;
7038 }
7039 /* p[3] is metric, if present */
7040 }
7042 }
7043 else if (streq(p[0], "max-routes") && !p[2])
7044 {
7045 msg(M_WARN, "DEPRECATED OPTION: --max-routes option ignored. "
7046 "The number of routes is unlimited as of OpenVPN 2.4. "
7047 "This option will be removed in a future version, "
7048 "please remove it from your configuration.");
7049 }
7050 else if (streq(p[0], "route-gateway") && p[1] && !p[2])
7051 {
7053 if (streq(p[1], "dhcp"))
7054 {
7056 }
7057 else
7058 {
7059 if (ip_or_dns_addr_safe(p[1], options->allow_pull_fqdn) || is_special_addr(p[1])) /* FQDN -- may be DNS name */
7060 {
7062 }
7063 else
7064 {
7065 msg(msglevel, "route-gateway parm '%s' must be a valid address", p[1]);
7066 goto err;
7067 }
7068 }
7069 }
7070 else if (streq(p[0], "route-ipv6-gateway") && p[1] && !p[2])
7071 {
7072 if (ipv6_addr_safe(p[1]))
7073 {
7075 }
7076 else
7077 {
7078 msg(msglevel, "route-ipv6-gateway parm '%s' must be a valid address", p[1]);
7079 goto err;
7080 }
7081 }
7082 else if (streq(p[0], "route-metric") && p[1] && !p[2])
7083 {
7085 options->route_default_metric = positive_atoi(p[1], msglevel);
7086 }
7087 else if (streq(p[0], "route-delay") && !p[3])
7088 {
7091 if (p[1])
7092 {
7093 options->route_delay = positive_atoi(p[1], msglevel);
7094 if (p[2])
7095 {
7096 options->route_delay_window = positive_atoi(p[2], msglevel);
7097 }
7098 }
7099 else
7100 {
7101 options->route_delay = 0;
7102 }
7103 }
7104 else if (streq(p[0], "route-up") && p[1])
7105 {
7107 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7108 {
7109 goto err;
7110 }
7111 set_user_script(options, &options->route_script, p[1], "route-up", false);
7112 }
7113 else if (streq(p[0], "route-pre-down") && p[1])
7114 {
7116 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7117 {
7118 goto err;
7119 }
7122 p[1],
7123 "route-pre-down", true);
7124 }
7125 else if (streq(p[0], "route-noexec") && !p[1])
7126 {
7128 options->route_noexec = true;
7129 }
7130 else if (streq(p[0], "route-nopull") && !p[1])
7131 {
7133 options->route_nopull = true;
7134 }
7135 else if (streq(p[0], "pull-filter") && p[1] && p[2] && !p[3])
7136 {
7137 struct pull_filter *f;
7140
7141 if (strcmp("accept", p[1]) == 0)
7142 {
7143 f->type = PUF_TYPE_ACCEPT;
7144 }
7145 else if (strcmp("ignore", p[1]) == 0)
7146 {
7147 f->type = PUF_TYPE_IGNORE;
7148 }
7149 else if (strcmp("reject", p[1]) == 0)
7150 {
7151 f->type = PUF_TYPE_REJECT;
7152 }
7153 else
7154 {
7155 msg(msglevel, "Unknown --pull-filter type: %s", p[1]);
7156 goto err;
7157 }
7158 f->pattern = p[2];
7159 f->size = strlen(p[2]);
7160 }
7161 else if (streq(p[0], "allow-pull-fqdn") && !p[1])
7162 {
7164 options->allow_pull_fqdn = true;
7165 }
7166 else if (streq(p[0], "redirect-gateway") || streq(p[0], "redirect-private"))
7167 {
7168 int j;
7171
7172 if (options->routes->flags & RG_ENABLE)
7173 {
7174 msg(M_WARN,
7175 "WARNING: You have specified redirect-gateway and "
7176 "redirect-private at the same time (or the same option "
7177 "multiple times). This is not well supported and may lead to "
7178 "unexpected results");
7179 }
7180
7182
7183 if (streq(p[0], "redirect-gateway"))
7184 {
7186 }
7187 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
7188 {
7189 if (streq(p[j], "local"))
7190 {
7192 }
7193 else if (streq(p[j], "autolocal"))
7194 {
7196 }
7197 else if (streq(p[j], "def1"))
7198 {
7200 }
7201 else if (streq(p[j], "bypass-dhcp"))
7202 {
7204 }
7205 else if (streq(p[j], "bypass-dns"))
7206 {
7208 }
7209 else if (streq(p[j], "block-local"))
7210 {
7212 }
7213 else if (streq(p[j], "ipv6"))
7214 {
7217 }
7218 else if (streq(p[j], "!ipv4"))
7219 {
7221 }
7222 else
7223 {
7224 msg(msglevel, "unknown --%s flag: %s", p[0], p[j]);
7225 goto err;
7226 }
7227 }
7228#ifdef _WIN32
7229 /* we need this here to handle pushed --redirect-gateway */
7231#endif
7232 }
7233 else if (streq(p[0], "block-ipv6") && !p[1])
7234 {
7236 options->block_ipv6 = true;
7237 }
7238 else if (streq(p[0], "remote-random-hostname") && !p[1])
7239 {
7242 }
7243 else if (streq(p[0], "setenv") && p[1] && !p[3])
7244 {
7246 if (streq(p[1], "REMOTE_RANDOM_HOSTNAME") && !p[2])
7247 {
7249 }
7250 else if (streq(p[1], "GENERIC_CONFIG"))
7251 {
7252 msg(msglevel, "this is a generic configuration and cannot directly be used");
7253 goto err;
7254 }
7255 else if (streq(p[1], "PUSH_PEER_INFO") && !p[2])
7256 {
7257 options->push_peer_info = true;
7258 }
7259 else if (streq(p[1], "SERVER_POLL_TIMEOUT") && p[2])
7260 {
7261 options->ce.connect_timeout = positive_atoi(p[2], msglevel);
7262 }
7263 else
7264 {
7265 if (streq(p[1], "FORWARD_COMPATIBLE") && p[2] && streq(p[2], "1"))
7266 {
7268 msglevel_fc = msglevel_forward_compatible(options, msglevel);
7269 }
7270 setenv_str(es, p[1], p[2] ? p[2] : "");
7271 }
7272 }
7273 else if (streq(p[0], "compat-mode") && p[1] && !p[3])
7274 {
7275 unsigned int major, minor, patch;
7276 if (!(sscanf(p[1], "%u.%u.%u", &major, &minor, &patch) == 3))
7277 {
7278 msg(msglevel, "cannot parse version number for --compat-mode: %s",
7279 p[1]);
7280 goto err;
7281 }
7282
7283 options->backwards_compatible = major * 10000 + minor * 100 + patch;
7284 }
7285 else if (streq(p[0], "setenv-safe") && p[1] && !p[3])
7286 {
7288 setenv_str_safe(es, p[1], p[2] ? p[2] : "");
7289 }
7290 else if (streq(p[0], "script-security") && p[1] && !p[2])
7291 {
7293 script_security_set(atoi_warn(p[1], msglevel));
7294 }
7295 else if (streq(p[0], "mssfix") && !p[3])
7296 {
7298 if (p[1])
7299 {
7300 int mssfix = positive_atoi(p[1], msglevel);
7301 /* can be 0, but otherwise it needs to be high enough so we can
7302 * substract room for headers. */
7303 if (mssfix != 0
7304 && (mssfix < TLS_CHANNEL_MTU_MIN || mssfix > UINT16_MAX))
7305 {
7306 msg(msglevel, "--mssfix value '%s' is invalid", p[1]);
7307 goto err;
7308 }
7309
7310 /* value specified, assume encapsulation is not
7311 * included unless "mtu" follows later */
7312 options->ce.mssfix = mssfix;
7313 options->ce.mssfix_encap = false;
7314 options->ce.mssfix_default = false;
7315 }
7316 else
7317 {
7318 /* Set MTU to default values */
7319 options->ce.mssfix_default = true;
7320 options->ce.mssfix_encap = true;
7321 options->ce.mssfix_fixed = false;
7322 }
7323
7324 if (p[2] && streq(p[2], "mtu"))
7325 {
7326 options->ce.mssfix_encap = true;
7327 }
7328 else if (p[2] && streq(p[2], "fixed"))
7329 {
7330 options->ce.mssfix_fixed = true;
7331 }
7332 else if (p[2])
7333 {
7334 msg(msglevel, "Unknown parameter to --mssfix: %s", p[2]);
7335 }
7336 }
7337 else if (streq(p[0], "disable-occ") && !p[1])
7338 {
7340 options->occ = false;
7341 }
7342 else if (streq(p[0], "server") && p[1] && p[2] && !p[4])
7343 {
7344 const int lev = M_WARN;
7345 bool error = false;
7346 in_addr_t network, netmask;
7347
7349 network = get_ip_addr(p[1], lev, &error);
7350 netmask = get_ip_addr(p[2], lev, &error);
7351 if (error || !network || !netmask)
7352 {
7353 msg(msglevel, "error parsing --server parameters");
7354 goto err;
7355 }
7356 options->server_defined = true;
7357 options->server_network = network;
7358 options->server_netmask = netmask;
7359
7360 if (p[3])
7361 {
7362 if (streq(p[3], "nopool"))
7363 {
7365 }
7366 else
7367 {
7368 msg(msglevel, "error parsing --server: %s is not a recognized flag", p[3]);
7369 goto err;
7370 }
7371 }
7372 }
7373 else if (streq(p[0], "server-ipv6") && p[1] && !p[2])
7374 {
7375 const int lev = M_WARN;
7376 struct in6_addr network;
7377 unsigned int netbits = 0;
7378
7380 if (!get_ipv6_addr(p[1], &network, &netbits, lev) )
7381 {
7382 msg(msglevel, "error parsing --server-ipv6 parameter");
7383 goto err;
7384 }
7385 if (netbits < 64 || netbits > 124)
7386 {
7387 msg(msglevel,
7388 "--server-ipv6 settings: network must be between /64 and /124 (not /%d)",
7389 netbits);
7390
7391 goto err;
7392 }
7394 options->server_network_ipv6 = network;
7395 options->server_netbits_ipv6 = netbits;
7396 }
7397 else if (streq(p[0], "server-bridge") && p[1] && p[2] && p[3] && p[4] && !p[5])
7398 {
7399 const int lev = M_WARN;
7400 bool error = false;
7401 in_addr_t ip, netmask, pool_start, pool_end;
7402
7404 ip = get_ip_addr(p[1], lev, &error);
7405 netmask = get_ip_addr(p[2], lev, &error);
7406 pool_start = get_ip_addr(p[3], lev, &error);
7407 pool_end = get_ip_addr(p[4], lev, &error);
7408 if (error || !ip || !netmask || !pool_start || !pool_end)
7409 {
7410 msg(msglevel, "error parsing --server-bridge parameters");
7411 goto err;
7412 }
7415 options->server_bridge_netmask = netmask;
7416 options->server_bridge_pool_start = pool_start;
7417 options->server_bridge_pool_end = pool_end;
7418 }
7419 else if (streq(p[0], "server-bridge") && p[1] && streq(p[1], "nogw") && !p[2])
7420 {
7424 }
7425 else if (streq(p[0], "server-bridge") && !p[1])
7426 {
7429 }
7430 else if (streq(p[0], "push") && p[1] && !p[2])
7431 {
7433 push_options(options, &p[1], msglevel, &options->gc);
7434 }
7435 else if (streq(p[0], "push-reset") && !p[1])
7436 {
7439 }
7440 else if (streq(p[0], "push-remove") && p[1] && !p[2])
7441 {
7443 msg(D_PUSH, "PUSH_REMOVE '%s'", p[1]);
7445 }
7446 else if (streq(p[0], "ifconfig-pool") && p[1] && p[2] && !p[4])
7447 {
7448 const int lev = M_WARN;
7449 bool error = false;
7450 in_addr_t start, end, netmask = 0;
7451
7453 start = get_ip_addr(p[1], lev, &error);
7454 end = get_ip_addr(p[2], lev, &error);
7455 if (p[3])
7456 {
7457 netmask = get_ip_addr(p[3], lev, &error);
7458 }
7459 if (error)
7460 {
7461 msg(msglevel, "error parsing --ifconfig-pool parameters");
7462 goto err;
7463 }
7464 if (!ifconfig_pool_verify_range(msglevel, start, end))
7465 {
7466 goto err;
7467 }
7468
7472 if (netmask)
7473 {
7474 options->ifconfig_pool_netmask = netmask;
7475 }
7476 }
7477 else if (streq(p[0], "ifconfig-pool-persist") && p[1] && !p[3])
7478 {
7481 if (p[2])
7482 {
7484 }
7485 }
7486 else if (streq(p[0], "ifconfig-ipv6-pool") && p[1] && !p[2])
7487 {
7488 const int lev = M_WARN;
7489 struct in6_addr network;
7490 unsigned int netbits = 0;
7491
7493 if (!get_ipv6_addr(p[1], &network, &netbits, lev ) )
7494 {
7495 msg(msglevel, "error parsing --ifconfig-ipv6-pool parameters");
7496 goto err;
7497 }
7498 if (netbits < 64 || netbits > 124)
7499 {
7500 msg(msglevel,
7501 "--ifconfig-ipv6-pool settings: network must be between /64 and /124 (not /%d)",
7502 netbits);
7503 goto err;
7504 }
7505
7509 }
7510 else if (streq(p[0], "hash-size") && p[1] && p[2] && !p[3])
7511 {
7512 int real, virtual;
7513
7515 real = atoi_warn(p[1], msglevel);
7516 virtual = atoi_warn(p[2], msglevel);
7517 if (real < 1 || virtual < 1)
7518 {
7519 msg(msglevel, "--hash-size sizes must be >= 1 (preferably a power of 2)");
7520 goto err;
7521 }
7522 options->real_hash_size = real;
7523 options->virtual_hash_size = real;
7524 }
7525 else if (streq(p[0], "connect-freq") && p[1] && p[2] && !p[3])
7526 {
7527 int cf_max, cf_per;
7528
7530 cf_max = atoi_warn(p[1], msglevel);
7531 cf_per = atoi_warn(p[2], msglevel);
7532 if (cf_max < 0 || cf_per < 0)
7533 {
7534 msg(msglevel, "--connect-freq parms must be > 0");
7535 goto err;
7536 }
7537 options->cf_max = cf_max;
7538 options->cf_per = cf_per;
7539 }
7540 else if (streq(p[0], "connect-freq-initial") && p[1] && p[2] && !p[3])
7541 {
7542 long cf_max, cf_per;
7543
7545 char *e1, *e2;
7546 cf_max = strtol(p[1], &e1, 10);
7547 cf_per = strtol(p[2], &e2, 10);
7548 if (cf_max < 0 || cf_per < 0 || *e1 != '\0' || *e2 != '\0')
7549 {
7550 msg(msglevel, "--connect-freq-initial parameters must be integers and >= 0");
7551 goto err;
7552 }
7553 options->cf_initial_max = cf_max;
7554 options->cf_initial_per = cf_per;
7555 }
7556 else if (streq(p[0], "max-clients") && p[1] && !p[2])
7557 {
7558 int max_clients;
7559
7561 max_clients = atoi_warn(p[1], msglevel);
7562 if (max_clients < 0)
7563 {
7564 msg(msglevel, "--max-clients must be at least 1");
7565 goto err;
7566 }
7567 if (max_clients >= MAX_PEER_ID) /* max peer-id value */
7568 {
7569 msg(msglevel, "--max-clients must be less than %d", MAX_PEER_ID);
7570 goto err;
7571 }
7572 options->max_clients = max_clients;
7573 }
7574 else if (streq(p[0], "max-routes-per-client") && p[1] && !p[2])
7575 {
7577 options->max_routes_per_client = max_int(positive_atoi(p[1], msglevel), 1);
7578 }
7579 else if (streq(p[0], "client-cert-not-required") && !p[1])
7580 {
7582 msg(M_FATAL, "REMOVED OPTION: --client-cert-not-required, use '--verify-client-cert none' instead");
7583 }
7584 else if (streq(p[0], "verify-client-cert") && !p[2])
7585 {
7587
7588 /* Reset any existing flags */
7589 options->ssl_flags &= ~SSLF_CLIENT_CERT_OPTIONAL;
7590 options->ssl_flags &= ~SSLF_CLIENT_CERT_NOT_REQUIRED;
7591 if (p[1])
7592 {
7593 if (streq(p[1], "none"))
7594 {
7596 }
7597 else if (streq(p[1], "optional"))
7598 {
7600 }
7601 else if (!streq(p[1], "require"))
7602 {
7603 msg(msglevel, "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
7604 goto err;
7605 }
7606 }
7607 }
7608 else if (streq(p[0], "username-as-common-name") && !p[1])
7609 {
7612 }
7613 else if (streq(p[0], "auth-user-pass-optional") && !p[1])
7614 {
7617 }
7618 else if (streq(p[0], "opt-verify") && !p[1])
7619 {
7621 msg(M_INFO, "DEPRECATION: opt-verify is deprecated and will be removed "
7622 "in OpenVPN 2.7");
7624 }
7625 else if (streq(p[0], "auth-user-pass-verify") && p[1])
7626 {
7628 if (!no_more_than_n_args(msglevel, p, 3, NM_QUOTE_HINT))
7629 {
7630 goto err;
7631 }
7632 if (p[2])
7633 {
7634 if (streq(p[2], "via-env"))
7635 {
7637 }
7638 else if (streq(p[2], "via-file"))
7639 {
7641 }
7642 else
7643 {
7644 msg(msglevel, "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
7645 goto err;
7646 }
7647 }
7648 else
7649 {
7650 msg(msglevel, "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
7651 goto err;
7652 }
7655 p[1], "auth-user-pass-verify", true);
7656 }
7657 else if (streq(p[0], "auth-gen-token"))
7658 {
7661 options->auth_token_lifetime = p[1] ? positive_atoi(p[1], msglevel) : 0;
7662
7663 for (int i = 2; i < MAX_PARMS && p[i] != NULL; i++)
7664 {
7665 /* the second parameter can be the renewal time */
7666 if (i == 2 && valid_integer(p[i], true))
7667 {
7668 options->auth_token_renewal = positive_atoi(p[i], msglevel);
7669 }
7670 else if (streq(p[i], "external-auth"))
7671 {
7673 }
7674 else
7675 {
7676 msg(msglevel, "Invalid argument to auth-gen-token: %s (%d)", p[i], i);
7677 }
7678 }
7679
7680 }
7681 else if (streq(p[0], "auth-gen-token-secret") && p[1] && !p[2])
7682 {
7686
7687 }
7688 else if (streq(p[0], "client-connect") && p[1])
7689 {
7691 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7692 {
7693 goto err;
7694 }
7696 p[1], "client-connect", true);
7697 }
7698 else if (streq(p[0], "client-crresponse") && p[1])
7699 {
7701 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7702 {
7703 goto err;
7704 }
7706 p[1], "client-crresponse", true);
7707 }
7708 else if (streq(p[0], "client-disconnect") && p[1])
7709 {
7711 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7712 {
7713 goto err;
7714 }
7716 p[1], "client-disconnect", true);
7717 }
7718 else if (streq(p[0], "learn-address") && p[1])
7719 {
7721 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
7722 {
7723 goto err;
7724 }
7726 p[1], "learn-address", true);
7727 }
7728 else if (streq(p[0], "tmp-dir") && p[1] && !p[2])
7729 {
7731 options->tmp_dir = p[1];
7732 }
7733 else if (streq(p[0], "client-config-dir") && p[1] && !p[2])
7734 {
7736 options->client_config_dir = p[1];
7737 }
7738 else if (streq(p[0], "ccd-exclusive") && !p[1])
7739 {
7741 options->ccd_exclusive = true;
7742 }
7743 else if (streq(p[0], "bcast-buffers") && p[1] && !p[2])
7744 {
7745 int n_bcast_buf;
7746
7748 n_bcast_buf = atoi_warn(p[1], msglevel);
7749 if (n_bcast_buf < 1)
7750 {
7751 msg(msglevel, "--bcast-buffers parameter must be > 0");
7752 }
7753 options->n_bcast_buf = n_bcast_buf;
7754 }
7755 else if (streq(p[0], "tcp-queue-limit") && p[1] && !p[2])
7756 {
7757 int tcp_queue_limit;
7758
7760 tcp_queue_limit = atoi_warn(p[1], msglevel);
7761 if (tcp_queue_limit < 1)
7762 {
7763 msg(msglevel, "--tcp-queue-limit parameter must be > 0");
7764 }
7765 options->tcp_queue_limit = tcp_queue_limit;
7766 }
7767#if PORT_SHARE
7768 else if (streq(p[0], "port-share") && p[1] && p[2] && !p[4])
7769 {
7771 options->port_share_host = p[1];
7772 options->port_share_port = p[2];
7773 options->port_share_journal_dir = p[3];
7774 }
7775#endif
7776 else if (streq(p[0], "client-to-client") && !p[1])
7777 {
7779 options->enable_c2c = true;
7780 }
7781 else if (streq(p[0], "duplicate-cn") && !p[1])
7782 {
7784 options->duplicate_cn = true;
7785 }
7786 else if (streq(p[0], "iroute") && p[1] && !p[3])
7787 {
7789 option_iroute(options, p[1], p[2], msglevel);
7790 }
7791 else if (streq(p[0], "iroute-ipv6") && p[1] && !p[2])
7792 {
7794 option_iroute_ipv6(options, p[1], msglevel);
7795 }
7796 else if (streq(p[0], "ifconfig-push") && p[1] && p[2] && !p[4])
7797 {
7798 in_addr_t local, remote_netmask;
7799
7801 local = getaddr(GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[1], 0, NULL, NULL);
7802 remote_netmask = getaddr(GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[2], 0, NULL, NULL);
7803 if (local && remote_netmask)
7804 {
7807 options->push_ifconfig_remote_netmask = remote_netmask;
7808 if (p[3])
7809 {
7811 }
7812 }
7813 else
7814 {
7815 msg(msglevel, "cannot parse --ifconfig-push addresses");
7816 goto err;
7817 }
7818 }
7819 else if (streq(p[0], "ifconfig-push-constraint") && p[1] && p[2] && !p[3])
7820 {
7821 in_addr_t network, netmask;
7822
7824 network = getaddr(GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[1], 0, NULL, NULL);
7825 netmask = getaddr(GETADDR_HOST_ORDER, p[2], 0, NULL, NULL);
7826 if (network && netmask)
7827 {
7831 }
7832 else
7833 {
7834 msg(msglevel, "cannot parse --ifconfig-push-constraint addresses");
7835 goto err;
7836 }
7837 }
7838 else if (streq(p[0], "ifconfig-ipv6-push") && p[1] && !p[3])
7839 {
7840 struct in6_addr local, remote;
7841 unsigned int netbits;
7842
7844
7845 if (!get_ipv6_addr( p[1], &local, &netbits, msglevel ) )
7846 {
7847 msg(msglevel, "cannot parse --ifconfig-ipv6-push addresses");
7848 goto err;
7849 }
7850
7851 if (p[2])
7852 {
7853 if (!get_ipv6_addr( p[2], &remote, NULL, msglevel ) )
7854 {
7855 msg( msglevel, "cannot parse --ifconfig-ipv6-push addresses");
7856 goto err;
7857 }
7858 }
7859 else
7860 {
7863 NULL, msglevel ) )
7864 {
7865 msg( msglevel, "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
7866 goto err;
7867 }
7868 }
7869
7875 }
7876 else if (streq(p[0], "disable") && !p[1])
7877 {
7879 options->disable = true;
7880 }
7881 else if (streq(p[0], "override-username") && p[1] && !p[2])
7882 {
7884 if (strlen(p[1]) > USER_PASS_LEN)
7885 {
7886 msg(msglevel, "override-username exceeds the maximum length of %d "
7887 "characters", USER_PASS_LEN);
7888
7889 /* disable the connection since ignoring the request to
7890 * set another username might cause serious problems */
7891 options->disable = true;
7892 }
7893 else
7894 {
7895 options->override_username = p[1];
7896 }
7897 }
7898 else if (streq(p[0], "tcp-nodelay") && !p[1])
7899 {
7902 }
7903 else if (streq(p[0], "stale-routes-check") && p[1] && !p[3])
7904 {
7905 int ageing_time, check_interval;
7906
7908 ageing_time = atoi_warn(p[1], msglevel);
7909 if (p[2])
7910 {
7911 check_interval = atoi_warn(p[2], msglevel);
7912 }
7913 else
7914 {
7915 check_interval = ageing_time;
7916 }
7917
7918 if (ageing_time < 1 || check_interval < 1)
7919 {
7920 msg(msglevel, "--stale-routes-check aging time and check interval must be >= 1");
7921 goto err;
7922 }
7923 options->stale_routes_ageing_time = ageing_time;
7924 options->stale_routes_check_interval = check_interval;
7925 }
7926
7927 else if (streq(p[0], "client") && !p[1])
7928 {
7930 options->client = true;
7931 }
7932 else if (streq(p[0], "pull") && !p[1])
7933 {
7935 options->pull = true;
7936 }
7937 else if (streq(p[0], "push-continuation") && p[1] && !p[2])
7938 {
7940 options->push_continuation = atoi_warn(p[1], msglevel);
7941 }
7942 else if (streq(p[0], "auth-user-pass") && !p[2])
7943 {
7945 if (p[1])
7946 {
7949 }
7950 else
7951 {
7952 options->auth_user_pass_file = "stdin";
7953 }
7954 }
7955 else if (streq(p[0], "auth-retry") && p[1] && !p[2])
7956 {
7958 auth_retry_set(msglevel, p[1]);
7959 }
7960#ifdef ENABLE_MANAGEMENT
7961 else if (streq(p[0], "static-challenge") && p[1] && p[2] && !p[4])
7962 {
7965 if (atoi_warn(p[2], msglevel))
7966 {
7968 }
7969 if (p[3] && streq(p[3], "concat"))
7970 {
7972 }
7973 else if (p[3] && !streq(p[3], "scrv1"))
7974 {
7975 msg(msglevel, "--static-challenge: unknown format indicator '%s'", p[3]);
7976 goto err;
7977 }
7978 }
7979#endif
7980 else if (streq(p[0], "msg-channel") && p[1])
7981 {
7982#ifdef _WIN32
7984 HANDLE process = GetCurrentProcess();
7985 HANDLE handle = (HANDLE) ((intptr_t) atoll(p[1]));
7986 if (!DuplicateHandle(process, handle, process, &options->msg_channel, 0,
7987 FALSE, DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS))
7988 {
7989 msg(msglevel, "could not duplicate service pipe handle");
7990 goto err;
7991 }
7993#else /* ifdef _WIN32 */
7994 msg(msglevel, "--msg-channel is only supported on Windows");
7995 goto err;
7996#endif
7997 }
7998#ifdef _WIN32
7999 else if (streq(p[0], "win-sys") && p[1] && !p[2])
8000 {
8002 if (streq(p[1], "env"))
8003 {
8004 msg(M_INFO, "NOTE: --win-sys env is default from OpenVPN 2.3. "
8005 "This entry will now be ignored. "
8006 "Please remove this entry from your configuration file.");
8007 }
8008 else
8009 {
8010 set_win_sys_path(p[1], es);
8011 }
8012 }
8013 else if (streq(p[0], "route-method") && p[1] && !p[2])
8014 {
8016 if (streq(p[1], "adaptive"))
8017 {
8019 }
8020 else if (streq(p[1], "ipapi"))
8021 {
8023 }
8024 else if (streq(p[1], "exe"))
8025 {
8027 }
8028 else
8029 {
8030 msg(msglevel, "--route method must be 'adaptive', 'ipapi', or 'exe'");
8031 goto err;
8032 }
8033 }
8034 else if (streq(p[0], "ip-win32") && p[1] && !p[4])
8035 {
8036 const int index = ascii2ipset(p[1]);
8037 struct tuntap_options *to = &options->tuntap_options;
8038
8040
8041 if (index < 0)
8042 {
8043 msg(msglevel,
8044 "Bad --ip-win32 method: '%s'. Allowed methods: %s",
8045 p[1],
8047 goto err;
8048 }
8049
8050 if (index == IPW32_SET_ADAPTIVE)
8051 {
8053 }
8054
8055 if (index == IPW32_SET_DHCP_MASQ)
8056 {
8057 if (p[2])
8058 {
8059 if (!streq(p[2], "default"))
8060 {
8061 int offset = atoi_warn(p[2], msglevel);
8062
8063 if (!(offset > -256 && offset < 256))
8064 {
8065 msg(msglevel, "--ip-win32 dynamic [offset] [lease-time]: offset (%d) must be > -256 and < 256", offset);
8066 goto err;
8067 }
8068
8069 to->dhcp_masq_custom_offset = true;
8070 to->dhcp_masq_offset = offset;
8071 }
8072
8073 if (p[3])
8074 {
8075 const int min_lease = 30;
8076 int lease_time;
8077 lease_time = atoi_warn(p[3], msglevel);
8078 if (lease_time < min_lease)
8079 {
8080 msg(msglevel, "--ip-win32 dynamic [offset] [lease-time]: lease time parameter (%d) must be at least %d seconds", lease_time, min_lease);
8081 goto err;
8082 }
8083 to->dhcp_lease_time = lease_time;
8084 }
8085 }
8086 }
8087 to->ip_win32_type = index;
8088 to->ip_win32_defined = true;
8089 }
8090#endif /* ifdef _WIN32 */
8091 else if (streq(p[0], "dns") && p[1])
8092 {
8094
8095 if (streq(p[1], "search-domains") && p[2])
8096 {
8098 }
8099 else if (streq(p[1], "server") && p[2] && p[3] && p[4])
8100 {
8101 long priority;
8102 if (!dns_server_priority_parse(&priority, p[2], pull_mode))
8103 {
8104 msg(msglevel, "--dns server: invalid priority value '%s'", p[2]);
8105 goto err;
8106 }
8107
8109
8110 if (streq(p[3], "address") && p[4])
8111 {
8112 for (int i = 4; p[i]; ++i)
8113 {
8114 if (!dns_server_addr_parse(server, p[i]))
8115 {
8116 msg(msglevel, "--dns server %ld: malformed address or maximum exceeded '%s'", priority, p[i]);
8117 goto err;
8118 }
8119 }
8120 }
8121 else if (streq(p[3], "resolve-domains"))
8122 {
8124 }
8125 else if (streq(p[3], "dnssec") && !p[5])
8126 {
8127 if (streq(p[4], "yes"))
8128 {
8129 server->dnssec = DNS_SECURITY_YES;
8130 }
8131 else if (streq(p[4], "no"))
8132 {
8133 server->dnssec = DNS_SECURITY_NO;
8134 }
8135 else if (streq(p[4], "optional"))
8136 {
8137 server->dnssec = DNS_SECURITY_OPTIONAL;
8138 }
8139 else
8140 {
8141 msg(msglevel, "--dns server %ld: malformed dnssec value '%s'", priority, p[4]);
8142 goto err;
8143 }
8144 }
8145 else if (streq(p[3], "transport") && !p[5])
8146 {
8147 if (streq(p[4], "plain"))
8148 {
8150 }
8151 else if (streq(p[4], "DoH"))
8152 {
8154 }
8155 else if (streq(p[4], "DoT"))
8156 {
8157 server->transport = DNS_TRANSPORT_TLS;
8158 }
8159 else
8160 {
8161 msg(msglevel, "--dns server %ld: malformed transport value '%s'", priority, p[4]);
8162 goto err;
8163 }
8164 }
8165 else if (streq(p[3], "sni") && !p[5])
8166 {
8167 server->sni = p[4];
8168 }
8169 else
8170 {
8171 msg(msglevel, "--dns server %ld: unknown option type '%s' or missing or unknown parameter", priority, p[3]);
8172 goto err;
8173 }
8174 }
8175 else
8176 {
8177 msg(msglevel, "--dns: unknown option type '%s' or missing or unknown parameter", p[1]);
8178 goto err;
8179 }
8180 }
8181#if defined(_WIN32) || defined(TARGET_ANDROID)
8182 else if (streq(p[0], "dhcp-option") && p[1])
8183 {
8186
8187 if ((streq(p[1], "DOMAIN") || streq(p[1], "ADAPTER_DOMAIN_SUFFIX"))
8188 && p[2] && !p[3])
8189 {
8190 o->domain = p[2];
8192 }
8193 else if (streq(p[1], "NBS") && p[2] && !p[3])
8194 {
8195 o->netbios_scope = p[2];
8197 }
8198 else if (streq(p[1], "NBT") && p[2] && !p[3])
8199 {
8200 int t;
8201 t = atoi_warn(p[2], msglevel);
8202 if (!(t == 1 || t == 2 || t == 4 || t == 8))
8203 {
8204 msg(msglevel, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t);
8205 goto err;
8206 }
8207 o->netbios_node_type = t;
8209 }
8210 else if ((streq(p[1], "DNS") || streq(p[1], "DNS6")) && p[2] && !p[3]
8211 && (!strstr(p[2], ":") || ipv6_addr_safe(p[2])))
8212 {
8213 if (strstr(p[2], ":"))
8214 {
8215 dhcp_option_dns6_parse(p[2], o->dns6, &o->dns6_len, msglevel);
8216 }
8217 else
8218 {
8219 dhcp_option_address_parse("DNS", p[2], o->dns, &o->dns_len, msglevel);
8221 }
8222 }
8223 else if (streq(p[1], "WINS") && p[2] && !p[3])
8224 {
8225 dhcp_option_address_parse("WINS", p[2], o->wins, &o->wins_len, msglevel);
8227 }
8228 else if (streq(p[1], "NTP") && p[2] && !p[3])
8229 {
8230 dhcp_option_address_parse("NTP", p[2], o->ntp, &o->ntp_len, msglevel);
8232 }
8233 else if (streq(p[1], "NBDD") && p[2] && !p[3])
8234 {
8235 dhcp_option_address_parse("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel);
8237 }
8238 else if (streq(p[1], "DOMAIN-SEARCH") && p[2] && !p[3])
8239 {
8241 {
8243 }
8244 else
8245 {
8246 msg(msglevel, "--dhcp-option %s: maximum of %d search entries can be specified",
8247 p[1], N_SEARCH_LIST_LEN);
8248 }
8250 }
8251 else if (streq(p[1], "DISABLE-NBT") && !p[2])
8252 {
8253 o->disable_nbt = 1;
8255 }
8256#if defined(TARGET_ANDROID)
8257 else if (streq(p[1], "PROXY_HTTP") && p[3] && !p[4])
8258 {
8259 o->http_proxy_port = positive_atoi(p[3], msglevel);
8260 o->http_proxy = p[2];
8261 }
8262#endif
8263 else
8264 {
8265 msg(msglevel, "--dhcp-option: unknown option type '%s' or missing or unknown parameter", p[1]);
8266 goto err;
8267 }
8268 }
8269#endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
8270#ifdef _WIN32
8271 else if (streq(p[0], "show-adapters") && !p[1])
8272 {
8275 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8276 }
8277 else if (streq(p[0], "show-net") && !p[1])
8278 {
8282 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8283 }
8284 else if (streq(p[0], "show-net-up") && !p[1])
8285 {
8287 options->show_net_up = true;
8288 }
8289 else if (streq(p[0], "tap-sleep") && p[1] && !p[2])
8290 {
8291 int s;
8293 s = atoi_warn(p[1], msglevel);
8294 if (s < 0 || s >= 256)
8295 {
8296 msg(msglevel, "--tap-sleep parameter must be between 0 and 255");
8297 goto err;
8298 }
8300 }
8301 else if (streq(p[0], "dhcp-renew") && !p[1])
8302 {
8305 }
8306 else if (streq(p[0], "dhcp-pre-release") && !p[1])
8307 {
8311 }
8312 else if (streq(p[0], "dhcp-release") && !p[1])
8313 {
8314 msg(M_WARN, "Obsolete option --dhcp-release detected. This is now on by default");
8315 }
8316 else if (streq(p[0], "dhcp-internal") && p[1] && !p[2]) /* standalone method for internal use */
8317 {
8318 unsigned int adapter_index;
8321 adapter_index = atou(p[1]);
8324 {
8325 dhcp_release_by_adapter_index(adapter_index);
8326 }
8328 {
8329 dhcp_renew_by_adapter_index(adapter_index);
8330 }
8331 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8332 }
8333 else if (streq(p[0], "register-dns") && !p[1])
8334 {
8337 }
8338 else if (streq(p[0], "block-outside-dns") && !p[1])
8339 {
8341 options->block_outside_dns = true;
8342 }
8343 else if (streq(p[0], "rdns-internal") && !p[1])
8344 /* standalone method for internal use
8345 *
8346 * (if --register-dns is set, openvpn needs to call itself in a
8347 * sub-process to execute the required functions in a non-blocking
8348 * way, and uses --rdns-internal to signal that to itself)
8349 */
8350 {
8354 {
8356 }
8357 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8358 }
8359 else if (streq(p[0], "show-valid-subnets") && !p[1])
8360 {
8363 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8364 }
8365 else if (streq(p[0], "pause-exit") && !p[1])
8366 {
8369 }
8370 else if (streq(p[0], "service") && p[1] && !p[3])
8371 {
8373 options->exit_event_name = p[1];
8374 if (p[2])
8375 {
8376 options->exit_event_initial_state = (atoi_warn(p[2], msglevel) != 0);
8377 }
8378 }
8379 else if (streq(p[0], "allow-nonadmin") && !p[2])
8380 {
8383 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
8384 }
8385 else if (streq(p[0], "user") && p[1] && !p[2])
8386 {
8388 msg(M_WARN, "NOTE: --user option is not implemented on Windows");
8389 }
8390 else if (streq(p[0], "group") && p[1] && !p[2])
8391 {
8393 msg(M_WARN, "NOTE: --group option is not implemented on Windows");
8394 }
8395#else /* ifdef _WIN32 */
8396 else if (streq(p[0], "user") && p[1] && !p[2])
8397 {
8399 options->username = p[1];
8400 }
8401 else if (streq(p[0], "group") && p[1] && !p[2])
8402 {
8404 options->groupname = p[1];
8405 }
8406 else if (streq(p[0], "dhcp-option") && p[1] && !p[3])
8407 {
8409 setenv_foreign_option(options, (const char **)p, 3, es);
8410 }
8411 else if (streq(p[0], "route-method") && p[1] && !p[2]) /* ignore when pushed to non-Windows OS */
8412 {
8414 }
8415#endif /* ifdef _WIN32 */
8416#if PASSTOS_CAPABILITY
8417 else if (streq(p[0], "passtos") && !p[1])
8418 {
8420 options->passtos = true;
8421 }
8422#endif
8423 else if (streq(p[0], "allow-compression") && p[1] && !p[2])
8424 {
8426
8427 if (streq(p[1], "no"))
8428 {
8429 options->comp.flags =
8432 {
8433 msg(msglevel, "'--allow-compression no' conflicts with "
8434 " enabling compression");
8435 }
8436 }
8438 {
8439 /* Also printed on a push to hint at configuration problems */
8440 msg(msglevel, "Cannot set allow-compression to '%s' "
8441 "after set to 'no'", p[1]);
8442 goto err;
8443 }
8444 else if (streq(p[1], "asym"))
8445 {
8447 }
8448 else if (streq(p[1], "yes"))
8449 {
8450 msg(M_WARN, "DEPRECATED OPTION: \"--allow-compression yes\" has been removed. "
8451 "We will use \"asym\" mode instead. See the manual page for more information.");
8452
8454 }
8455 else
8456 {
8457 msg(msglevel, "bad allow-compression option: %s -- "
8458 "must be 'yes', 'no', or 'asym'", p[1]);
8459 goto err;
8460 }
8461 }
8462 else if (streq(p[0], "comp-lzo") && !p[2])
8463 {
8465
8466 /* All lzo variants do not use swap */
8467 options->comp.flags &= ~COMP_F_SWAP;
8469
8470 if (p[1])
8471 {
8472 if (streq(p[1], "no"))
8473 {
8475 }
8476 /* There is no actual difference anymore between these variants.
8477 * We never compress. On the server side we replace this with
8478 * --compress migrate later anyway.
8479 */
8480 else if (!(streq(p[1], "yes") || streq(p[1], "adaptive")))
8481 {
8482 msg(msglevel, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'", p[1]);
8483 goto err;
8484 }
8485 }
8487 }
8488 else if (streq(p[0], "comp-noadapt") && !p[1])
8489 {
8490 /* NO-OP since we never compress anymore */
8491 }
8492 else if (streq(p[0], "compress") && !p[2])
8493 {
8495 const char *alg = "stub";
8496 if (p[1])
8497 {
8498 alg = p[1];
8499 }
8500
8501 if (streq(alg, "stub"))
8502 {
8505 }
8506 else if (streq(alg, "stub-v2"))
8507 {
8510 }
8511 else if (streq(alg, "migrate"))
8512 {
8515 }
8516 else if (streq(alg, "lzo"))
8517 {
8519 options->comp.flags &= ~COMP_F_SWAP;
8520 }
8521 else if (streq(alg, "lz4"))
8522 {
8525 }
8526 else if (streq(alg, "lz4-v2"))
8527 {
8529 }
8530 else
8531 {
8532 msg(msglevel, "bad comp option: %s", alg);
8533 goto err;
8534 }
8535
8537 }
8538 else if (streq(p[0], "show-ciphers") && !p[1])
8539 {
8541 options->show_ciphers = true;
8542 }
8543 else if (streq(p[0], "show-digests") && !p[1])
8544 {
8546 options->show_digests = true;
8547 }
8548 else if (streq(p[0], "show-engines") && !p[1])
8549 {
8551 options->show_engines = true;
8552 }
8553 else if (streq(p[0], "key-direction") && p[1] && !p[2])
8554 {
8555 int key_direction;
8556
8558
8559 key_direction = ascii2keydirection(msglevel, p[1]);
8560 if (key_direction >= 0)
8561 {
8562 if (permission_mask & OPT_P_GENERAL)
8563 {
8564 options->key_direction = key_direction;
8565 }
8566 else if (permission_mask & OPT_P_CONNECTION)
8567 {
8568 options->ce.key_direction = key_direction;
8569 }
8570 }
8571 else
8572 {
8573 goto err;
8574 }
8575 }
8576 else if (streq(p[0], "secret") && p[1] && !p[3])
8577 {
8578 msg(M_WARN, "DEPRECATED OPTION: The option --secret is deprecated.");
8582 if (!is_inline && p[2])
8583 {
8584 int key_direction;
8585
8586 key_direction = ascii2keydirection(msglevel, p[2]);
8587 if (key_direction >= 0)
8588 {
8589 options->key_direction = key_direction;
8590 }
8591 else
8592 {
8593 goto err;
8594 }
8595 }
8596 }
8597 else if (streq(p[0], "allow-deprecated-insecure-static-crypto"))
8598 {
8601
8602 }
8603 else if (streq(p[0], "genkey") && !p[4])
8604 {
8606 options->genkey = true;
8607 if (!p[1])
8608 {
8610 }
8611 else
8612 {
8613 if (streq(p[1], "secret") || streq(p[1], "tls-auth")
8614 || streq(p[1], "tls-crypt"))
8615 {
8617 }
8618 else if (streq(p[1], "tls-crypt-v2-server"))
8619 {
8621 }
8622 else if (streq(p[1], "tls-crypt-v2-client"))
8623 {
8625 if (p[3])
8626 {
8627 options->genkey_extra_data = p[3];
8628 }
8629 }
8630 else if (streq(p[1], "auth-token"))
8631 {
8633 }
8634 else
8635 {
8636 msg(msglevel, "unknown --genkey type: %s", p[1]);
8637 }
8638
8639 }
8640 if (p[2])
8641 {
8642 options->genkey_filename = p[2];
8643 }
8644 }
8645 else if (streq(p[0], "auth") && p[1] && !p[2])
8646 {
8648 options->authname = p[1];
8649 }
8650 else if (streq(p[0], "cipher") && p[1] && !p[2])
8651 {
8653 options->ciphername = p[1];
8654 }
8655 else if (streq(p[0], "data-ciphers-fallback") && p[1] && !p[2])
8656 {
8658 options->ciphername = p[1];
8660 }
8661 else if ((streq(p[0], "data-ciphers") || streq(p[0], "ncp-ciphers"))
8662 && p[1] && !p[2])
8663 {
8665 if (streq(p[0], "ncp-ciphers"))
8666 {
8667 msg(M_INFO, "Note: Treating option '--ncp-ciphers' as "
8668 " '--data-ciphers' (renamed in OpenVPN 2.5).");
8669 }
8670 options->ncp_ciphers = p[1];
8671 }
8672 else if (streq(p[0], "key-derivation") && p[1])
8673 {
8674 /* NCP only option that is pushed by the server to enable EKM,
8675 * should not be used by normal users in config files*/
8677#ifdef HAVE_EXPORT_KEYING_MATERIAL
8678 if (streq(p[1], "tls-ekm"))
8679 {
8681 }
8682 else
8683#endif
8684 {
8685 msg(msglevel, "Unknown key-derivation method %s", p[1]);
8686 }
8687 }
8688 else if (streq(p[0], "protocol-flags") && p[1])
8689 {
8690 /* NCP only option that is pushed by the server to enable protocol
8691 * features that are negotiated, should not be used by normal users
8692 * in config files */
8694 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
8695 {
8696 if (streq(p[j], "cc-exit"))
8697 {
8699 }
8700#ifdef HAVE_EXPORT_KEYING_MATERIAL
8701 else if (streq(p[j], "tls-ekm"))
8702 {
8704 }
8705 else if (streq(p[j], "dyn-tls-crypt"))
8706 {
8708 }
8709#endif
8710 else if (streq(p[j], "aead-epoch"))
8711 {
8713 }
8714 else
8715 {
8716 msg(msglevel, "Unknown protocol-flags flag: %s", p[j]);
8717 }
8718 }
8719 }
8720 else if (streq(p[0], "force-tls-key-material-export"))
8721 {
8724 }
8725 else if (streq(p[0], "prng") && p[1] && !p[3])
8726 {
8727 msg(M_WARN, "NOTICE: --prng option ignored (SSL library PRNG is used)");
8728 }
8729 else if (streq(p[0], "no-replay") && !p[1])
8730 {
8732 /* always error out, this breaks the connection */
8733 msg(M_FATAL, "--no-replay was removed in OpenVPN 2.7. "
8734 "Update your configuration.");
8735 }
8736 else if (streq(p[0], "replay-window") && !p[3])
8737 {
8739 if (p[1])
8740 {
8741 int replay_window;
8742
8743 replay_window = atoi_warn(p[1], msglevel);
8744 if (!(MIN_SEQ_BACKTRACK <= replay_window && replay_window <= MAX_SEQ_BACKTRACK))
8745 {
8746 msg(msglevel, "replay-window window size parameter (%d) must be between %d and %d",
8747 replay_window,
8750 goto err;
8751 }
8752 options->replay_window = replay_window;
8753
8754 if (p[2])
8755 {
8756 int replay_time;
8757
8758 replay_time = atoi_warn(p[2], msglevel);
8759 if (!(MIN_TIME_BACKTRACK <= replay_time && replay_time <= MAX_TIME_BACKTRACK))
8760 {
8761 msg(msglevel, "replay-window time window parameter (%d) must be between %d and %d",
8762 replay_time,
8765 goto err;
8766 }
8767 options->replay_time = replay_time;
8768 }
8769 }
8770 else
8771 {
8772 msg(msglevel, "replay-window option is missing window size parameter");
8773 goto err;
8774 }
8775 }
8776 else if (streq(p[0], "mute-replay-warnings") && !p[1])
8777 {
8780 }
8781 else if (streq(p[0], "replay-persist") && p[1] && !p[2])
8782 {
8784 options->packet_id_file = p[1];
8785 }
8786 else if (streq(p[0], "test-crypto") && !p[1])
8787 {
8789 options->test_crypto = true;
8790 }
8791#ifndef ENABLE_CRYPTO_MBEDTLS
8792 else if (streq(p[0], "engine") && !p[2])
8793 {
8795 if (p[1])
8796 {
8797 options->engine = p[1];
8798 }
8799 else
8800 {
8801 options->engine = "auto";
8802 }
8803 }
8804#endif /* ENABLE_CRYPTO_MBEDTLS */
8805 else if (streq(p[0], "providers") && p[1])
8806 {
8807 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; j++)
8808 {
8809 options->providers.names[j] = p[j];
8810 }
8811 }
8812#ifdef ENABLE_PREDICTION_RESISTANCE
8813 else if (streq(p[0], "use-prediction-resistance") && !p[1])
8814 {
8816 options->use_prediction_resistance = true;
8817 }
8818#endif
8819 else if (streq(p[0], "show-tls") && !p[1])
8820 {
8822 options->show_tls_ciphers = true;
8823 }
8824 else if ((streq(p[0], "show-curves") || streq(p[0], "show-groups")) && !p[1])
8825 {
8827 options->show_curves = true;
8828 }
8829 else if (streq(p[0], "ecdh-curve") && p[1] && !p[2])
8830 {
8832 msg(M_WARN, "Consider setting groups/curves preference with "
8833 "tls-groups instead of forcing a specific curve with "
8834 "ecdh-curve.");
8835 options->ecdh_curve = p[1];
8836 }
8837 else if (streq(p[0], "tls-server") && !p[1])
8838 {
8840 options->tls_server = true;
8841 }
8842 else if (streq(p[0], "tls-client") && !p[1])
8843 {
8845 options->tls_client = true;
8846 }
8847 else if (streq(p[0], "ca") && p[1] && !p[2])
8848 {
8850 options->ca_file = p[1];
8851 options->ca_file_inline = is_inline;
8852 }
8853#ifndef ENABLE_CRYPTO_MBEDTLS
8854 else if (streq(p[0], "capath") && p[1] && !p[2])
8855 {
8857 options->ca_path = p[1];
8858 }
8859#endif /* ENABLE_CRYPTO_MBEDTLS */
8860 else if (streq(p[0], "dh") && p[1] && !p[2])
8861 {
8863 options->dh_file = p[1];
8864 options->dh_file_inline = is_inline;
8865 }
8866 else if (streq(p[0], "cert") && p[1] && !p[2])
8867 {
8869 options->cert_file = p[1];
8870 options->cert_file_inline = is_inline;
8871 }
8872 else if (streq(p[0], "extra-certs") && p[1] && !p[2])
8873 {
8875 options->extra_certs_file = p[1];
8876 options->extra_certs_file_inline = is_inline;
8877 }
8878 else if ((streq(p[0], "verify-hash") && p[1] && !p[3])
8879 || (streq(p[0], "peer-fingerprint") && p[1] && !p[2]))
8880 {
8882
8883 int verify_hash_depth = 0;
8884 if (streq(p[0], "verify-hash"))
8885 {
8886 msg(M_WARN, "DEPRECATED OPTION: The option --verify-hash is deprecated. "
8887 "You should switch to the either use the level 1 certificate as "
8888 "--ca option, use --tls-verify or use --peer-fingerprint");
8889 /* verify level 1 cert, i.e. the CA that signed the leaf cert */
8890 verify_hash_depth = 1;
8891 }
8892
8894
8895 int digest_len = SHA256_DIGEST_LENGTH;
8896
8897 if (options->verify_hash && options->verify_hash_depth != verify_hash_depth)
8898 {
8899 msg(msglevel, "ERROR: Setting %s not allowed. --verify-hash and"
8900 " --peer-fingerprint are mutually exclusive", p[0]);
8901 goto err;
8902 }
8903
8904 if (streq(p[0], "verify-hash"))
8905 {
8906 if ((!p[2] && !is_inline) || (p[2] && streq(p[2], "SHA1")))
8907 {
8909 digest_len = SHA_DIGEST_LENGTH;
8910 }
8911 else if (p[2] && !streq(p[2], "SHA256"))
8912 {
8913 msg(msglevel, "invalid or unsupported hashing algorithm: %s "
8914 "(only SHA1 and SHA256 are supported)", p[2]);
8915 goto err;
8916 }
8917 }
8918
8919 struct verify_hash_list *newlist;
8920 newlist = parse_hash_fingerprint_multiline(p[1], digest_len,
8921 msglevel, &options->gc);
8922
8923 /* Append the new list to the end of our current list */
8924 if (!options->verify_hash)
8925 {
8926 options->verify_hash = newlist;
8927 options->verify_hash_depth = verify_hash_depth;
8928 }
8929 else
8930 {
8931 /* since both the old and new list can have multiple entries
8932 * we need to go to the end of one of them to concatenate them */
8933 struct verify_hash_list *listend = options->verify_hash;
8934 while (listend->next)
8935 {
8936 listend = listend->next;
8937 }
8938 listend->next = newlist;
8939 }
8940 }
8941#if defined(ENABLE_CRYPTOAPI) && defined(HAVE_XKEY_PROVIDER)
8942 else if (streq(p[0], "cryptoapicert") && p[1] && !p[2])
8943 {
8945 options->cryptoapi_cert = p[1];
8946 }
8947#endif
8948 else if (streq(p[0], "key") && p[1] && !p[2])
8949 {
8951 options->priv_key_file = p[1];
8952 options->priv_key_file_inline = is_inline;
8953 }
8954 else if (streq(p[0], "tls-version-min") && p[1] && !p[3])
8955 {
8956 int ver;
8958 ver = tls_version_parse(p[1], p[2]);
8959 if (ver == TLS_VER_BAD)
8960 {
8961 msg(msglevel, "unknown tls-version-min parameter: %s", p[1]);
8962 goto err;
8963 }
8964
8965#ifdef ENABLE_CRYPTO_MBEDTLS
8966 if (ver < TLS_VER_1_2)
8967 {
8968 msg(M_WARN, "--tls-version-min %s is not supported by mbedtls, using 1.2", p[1]);
8969 ver = TLS_VER_1_2;
8970 }
8971#endif
8972
8973 options->ssl_flags &=
8976 }
8977 else if (streq(p[0], "tls-version-max") && p[1] && !p[2])
8978 {
8979 int ver;
8981 ver = tls_version_parse(p[1], NULL);
8982 if (ver == TLS_VER_BAD)
8983 {
8984 msg(msglevel, "unknown tls-version-max parameter: %s", p[1]);
8985 goto err;
8986 }
8987 options->ssl_flags &=
8990 }
8991#ifndef ENABLE_CRYPTO_MBEDTLS
8992 else if (streq(p[0], "pkcs12") && p[1] && !p[2])
8993 {
8995 options->pkcs12_file = p[1];
8996 options->pkcs12_file_inline = is_inline;
8997 }
8998#endif /* ENABLE_CRYPTO_MBEDTLS */
8999 else if (streq(p[0], "askpass") && !p[2])
9000 {
9002 if (p[1])
9003 {
9004 options->key_pass_file = p[1];
9005 }
9006 else
9007 {
9008 options->key_pass_file = "stdin";
9009 }
9010 }
9011 else if (streq(p[0], "auth-nocache") && !p[1])
9012 {
9015 }
9016 else if (streq(p[0], "auth-token") && p[1] && !p[2])
9017 {
9019 ssl_set_auth_token(p[1]);
9020#ifdef ENABLE_MANAGEMENT
9021 if (management)
9022 {
9024 }
9025#endif
9026 }
9027 else if (streq(p[0], "auth-token-user") && p[1] && !p[2])
9028 {
9031 }
9032 else if (streq(p[0], "single-session") && !p[1])
9033 {
9035 options->single_session = true;
9036 }
9037 else if (streq(p[0], "push-peer-info") && !p[1])
9038 {
9040 options->push_peer_info = true;
9041 }
9042 else if (streq(p[0], "tls-exit") && !p[1])
9043 {
9045 options->tls_exit = true;
9046 }
9047 else if (streq(p[0], "tls-cipher") && p[1] && !p[2])
9048 {
9050 options->cipher_list = p[1];
9051 }
9052 else if (streq(p[0], "tls-cert-profile") && p[1] && !p[2])
9053 {
9055 options->tls_cert_profile = p[1];
9056 }
9057 else if (streq(p[0], "tls-ciphersuites") && p[1] && !p[2])
9058 {
9060 options->cipher_list_tls13 = p[1];
9061 }
9062 else if (streq(p[0], "tls-groups") && p[1] && !p[2])
9063 {
9065 options->tls_groups = p[1];
9066 }
9067 else if (streq(p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir"))
9068 || !p[2]))
9069 {
9071 if (p[2] && streq(p[2], "dir"))
9072 {
9074 }
9075 options->crl_file = p[1];
9076 options->crl_file_inline = is_inline;
9077 }
9078 else if (streq(p[0], "tls-verify") && p[1])
9079 {
9081 if (!no_more_than_n_args(msglevel, p, 2, NM_QUOTE_HINT))
9082 {
9083 goto err;
9084 }
9086 string_substitute(p[1], ',', ' ', &options->gc),
9087 "tls-verify", true);
9088 }
9089 else if (streq(p[0], "tls-export-cert") && p[1] && !p[2])
9090 {
9093 }
9094 else if (streq(p[0], "compat-names"))
9095 {
9097 msg(msglevel, "--compat-names was removed in OpenVPN 2.5. "
9098 "Update your configuration.");
9099 goto err;
9100 }
9101 else if (streq(p[0], "no-name-remapping") && !p[1])
9102 {
9104 msg(msglevel, "--no-name-remapping was removed in OpenVPN 2.5. "
9105 "Update your configuration.");
9106 goto err;
9107 }
9108 else if (streq(p[0], "verify-x509-name") && p[1] && strlen(p[1]) && !p[3])
9109 {
9110 int type = VERIFY_X509_SUBJECT_DN;
9112 if (p[2])
9113 {
9114 if (streq(p[2], "subject"))
9115 {
9117 }
9118 else if (streq(p[2], "name"))
9119 {
9121 }
9122 else if (streq(p[2], "name-prefix"))
9123 {
9125 }
9126 else
9127 {
9128 msg(msglevel, "unknown X.509 name type: %s", p[2]);
9129 goto err;
9130 }
9131 }
9132 options->verify_x509_type = type;
9133 options->verify_x509_name = p[1];
9134 }
9135 else if (streq(p[0], "ns-cert-type") && p[1] && !p[2])
9136 {
9137#ifdef ENABLE_CRYPTO_MBEDTLS
9138 msg(msglevel, "--ns-cert-type is not available with mbedtls.");
9139 goto err;
9140#else
9142 if (streq(p[1], "server"))
9143 {
9145 }
9146 else if (streq(p[1], "client"))
9147 {
9149 }
9150 else
9151 {
9152 msg(msglevel, "--ns-cert-type must be 'client' or 'server'");
9153 goto err;
9154 }
9155#endif /* ENABLE_CRYPTO_MBEDTLS */
9156 }
9157 else if (streq(p[0], "remote-cert-ku"))
9158 {
9160
9161 size_t j;
9162 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9163 {
9164 sscanf(p[j], "%x", &(options->remote_cert_ku[j-1]));
9165 }
9166 if (j == 1)
9167 {
9168 /* No specific KU required, but require KU to be present */
9170 }
9171 }
9172 else if (streq(p[0], "remote-cert-eku") && p[1] && !p[2])
9173 {
9175 options->remote_cert_eku = p[1];
9176 }
9177 else if (streq(p[0], "remote-cert-tls") && p[1] && !p[2])
9178 {
9180
9181 if (streq(p[1], "server"))
9182 {
9184 options->remote_cert_eku = "TLS Web Server Authentication";
9185 }
9186 else if (streq(p[1], "client"))
9187 {
9189 options->remote_cert_eku = "TLS Web Client Authentication";
9190 }
9191 else
9192 {
9193 msg(msglevel, "--remote-cert-tls must be 'client' or 'server'");
9194 goto err;
9195 }
9196 }
9197 else if (streq(p[0], "tls-timeout") && p[1] && !p[2])
9198 {
9200 options->tls_timeout = positive_atoi(p[1], msglevel);
9201 }
9202 else if (streq(p[0], "reneg-bytes") && p[1] && !p[2])
9203 {
9205 char *end;
9206 long long reneg_bytes = strtoll(p[1], &end, 10);
9207 if (*end != '\0' || reneg_bytes < 0)
9208 {
9209 msg(msglevel, "--reneg-bytes parameter must be an integer and >= 0");
9210 goto err;
9211 }
9212 options->renegotiate_bytes = reneg_bytes;
9213 }
9214 else if (streq(p[0], "reneg-pkts") && p[1] && !p[2])
9215 {
9217 char *end;
9218 long long pkt_max = strtoll(p[1], &end, 10);
9219 if (*end != '\0' || pkt_max < 0)
9220 {
9221 msg(msglevel, "--reneg-pkts parameter must be an integer and >= 0");
9222 goto err;
9223 }
9224 options->renegotiate_packets = pkt_max;
9225 }
9226 else if (streq(p[0], "reneg-sec") && p[1] && !p[3])
9227 {
9229 options->renegotiate_seconds = positive_atoi(p[1], msglevel);
9230 if (p[2])
9231 {
9233 }
9234 }
9235 else if (streq(p[0], "hand-window") && p[1] && !p[2])
9236 {
9238 options->handshake_window = positive_atoi(p[1], msglevel);
9239 }
9240 else if (streq(p[0], "tran-window") && p[1] && !p[2])
9241 {
9243 options->transition_window = positive_atoi(p[1], msglevel);
9244 }
9245 else if (streq(p[0], "tls-auth") && p[1] && !p[3])
9246 {
9247 int key_direction = -1;
9248
9250
9251 if (permission_mask & OPT_P_GENERAL)
9252 {
9253 options->tls_auth_file = p[1];
9254 options->tls_auth_file_inline = is_inline;
9255
9256 if (!is_inline && p[2])
9257 {
9258 key_direction = ascii2keydirection(msglevel, p[2]);
9259 if (key_direction < 0)
9260 {
9261 goto err;
9262 }
9263 options->key_direction = key_direction;
9264 }
9265
9266 }
9267 else if (permission_mask & OPT_P_CONNECTION)
9268 {
9269 options->ce.tls_auth_file = p[1];
9270 options->ce.tls_auth_file_inline = is_inline;
9272
9273 if (!is_inline && p[2])
9274 {
9275 key_direction = ascii2keydirection(msglevel, p[2]);
9276 if (key_direction < 0)
9277 {
9278 goto err;
9279 }
9280 options->ce.key_direction = key_direction;
9281 }
9282 }
9283 }
9284 else if (streq(p[0], "tls-crypt") && p[1] && !p[3])
9285 {
9287 if (permission_mask & OPT_P_GENERAL)
9288 {
9289 options->tls_crypt_file = p[1];
9290 options->tls_crypt_file_inline = is_inline;
9291 }
9292 else if (permission_mask & OPT_P_CONNECTION)
9293 {
9294 options->ce.tls_crypt_file = p[1];
9295 options->ce.tls_crypt_file_inline = is_inline;
9296 }
9297 }
9298 else if (streq(p[0], "tls-crypt-v2") && p[1] && !p[3])
9299 {
9301 if (permission_mask & OPT_P_GENERAL)
9302 {
9303 options->tls_crypt_v2_file = p[1];
9304 options->tls_crypt_v2_file_inline = is_inline;
9305 }
9306 else if (permission_mask & OPT_P_CONNECTION)
9307 {
9309 options->ce.tls_crypt_v2_file_inline = is_inline;
9310 }
9311
9312 if (p[2] && streq(p[2], "force-cookie"))
9313 {
9315 }
9316 else if (p[2] && streq(p[2], "allow-noncookie"))
9317 {
9319 }
9320 else if (p[2])
9321 {
9322 msg(msglevel, "Unsupported tls-crypt-v2 argument: %s", p[2]);
9323 }
9324 }
9325 else if (streq(p[0], "tls-crypt-v2-verify") && p[1] && !p[2])
9326 {
9329 }
9330 else if (streq(p[0], "x509-track") && p[1] && !p[2])
9331 {
9333 x509_track_add(&options->x509_track, p[1], msglevel, &options->gc);
9334 }
9335#ifdef ENABLE_X509ALTUSERNAME
9336 else if (streq(p[0], "x509-username-field") && p[1])
9337 {
9339 for (size_t j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9340 {
9341 char *s = p[j];
9342
9343 if (strncmp("ext:", s, 4) == 0 && !x509_username_field_ext_supported(s+4))
9344 {
9345 msg(msglevel, "Unsupported x509-username-field extension: %s", s);
9346 }
9347 options->x509_username_field[j-1] = p[j];
9348 }
9349 }
9350#endif /* ENABLE_X509ALTUSERNAME */
9351#ifdef ENABLE_PKCS11
9352 else if (streq(p[0], "show-pkcs11-ids") && !p[3])
9353 {
9354 char *provider = p[1];
9355 bool cert_private = (p[2] == NULL ? false : (atoi_warn(p[2], msglevel) != 0 ));
9356
9357#ifdef DEFAULT_PKCS11_MODULE
9358 if (!provider)
9359 {
9360 provider = DEFAULT_PKCS11_MODULE;
9361 }
9362 else if (!p[2])
9363 {
9364 char *endp = NULL;
9365 int i = strtol(provider, &endp, 10);
9366
9367 if (*endp == 0)
9368 {
9369 /* There was one argument, and it was purely numeric.
9370 * Interpret it as the cert_private argument */
9371 provider = DEFAULT_PKCS11_MODULE;
9372 cert_private = i;
9373 }
9374 }
9375#else /* ifdef DEFAULT_PKCS11_MODULE */
9376 if (!provider)
9377 {
9378 msg(msglevel, "--show-pkcs11-ids requires a provider parameter");
9379 goto err;
9380 }
9381#endif /* ifdef DEFAULT_PKCS11_MODULE */
9383
9385 show_pkcs11_ids(provider, cert_private);
9386 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD); /* exit point */
9387 }
9388 else if (streq(p[0], "pkcs11-providers") && p[1])
9389 {
9390 int j;
9391
9393
9394 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9395 {
9396 options->pkcs11_providers[j-1] = p[j];
9397 }
9398 }
9399 else if (streq(p[0], "pkcs11-protected-authentication"))
9400 {
9401 int j;
9402
9404
9405 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9406 {
9407 options->pkcs11_protected_authentication[j-1] = atoi_warn(p[j], msglevel) != 0 ? 1 : 0;
9408 }
9409 }
9410 else if (streq(p[0], "pkcs11-private-mode") && p[1])
9411 {
9412 int j;
9413
9415
9416 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9417 {
9418 sscanf(p[j], "%x", &(options->pkcs11_private_mode[j-1]));
9419 }
9420 }
9421 else if (streq(p[0], "pkcs11-cert-private"))
9422 {
9423 int j;
9424
9426
9427 for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
9428 {
9429 options->pkcs11_cert_private[j-1] = (bool) (atoi_warn(p[j], msglevel));
9430 }
9431 }
9432 else if (streq(p[0], "pkcs11-pin-cache") && p[1] && !p[2])
9433 {
9435 options->pkcs11_pin_cache_period = atoi_warn(p[1], msglevel);
9436 }
9437 else if (streq(p[0], "pkcs11-id") && p[1] && !p[2])
9438 {
9440 options->pkcs11_id = p[1];
9441 }
9442 else if (streq(p[0], "pkcs11-id-management") && !p[1])
9443 {
9445 options->pkcs11_id_management = true;
9446 }
9447#endif /* ifdef ENABLE_PKCS11 */
9448 else if (streq(p[0], "rmtun") && !p[1])
9449 {
9451 options->persist_config = true;
9452 options->persist_mode = 0;
9453 }
9454 else if (streq(p[0], "mktun") && !p[1])
9455 {
9457 options->persist_config = true;
9458 options->persist_mode = 1;
9459 }
9460 else if (streq(p[0], "peer-id") && p[1] && !p[2])
9461 {
9463 options->use_peer_id = true;
9464 options->peer_id = atoi_warn(p[1], msglevel);
9465 }
9466#ifdef HAVE_EXPORT_KEYING_MATERIAL
9467 else if (streq(p[0], "keying-material-exporter") && p[1] && p[2])
9468 {
9469 int ekm_length = positive_atoi(p[2], msglevel);
9470
9472
9473 if (strncmp(p[1], "EXPORTER", 8))
9474 {
9475 msg(msglevel, "Keying material exporter label must begin with "
9476 "\"EXPORTER\"");
9477 goto err;
9478 }
9479 if (streq(p[1], EXPORT_KEY_DATA_LABEL))
9480 {
9481 msg(msglevel, "Keying material exporter label must not be '"
9483 }
9484 if (ekm_length < 16 || ekm_length > 4095)
9485 {
9486 msg(msglevel, "Invalid keying material exporter length");
9487 goto err;
9488 }
9489
9490 options->keying_material_exporter_label = p[1];
9491 options->keying_material_exporter_length = ekm_length;
9492 }
9493#endif /* HAVE_EXPORT_KEYING_MATERIAL */
9494 else if (streq(p[0], "allow-recursive-routing") && !p[1])
9495 {
9498 }
9499 else if (streq(p[0], "vlan-tagging") && !p[1])
9500 {
9502 options->vlan_tagging = true;
9503 }
9504 else if (streq(p[0], "vlan-accept") && p[1] && !p[2])
9505 {
9507 if (streq(p[1], "tagged"))
9508 {
9510 }
9511 else if (streq(p[1], "untagged"))
9512 {
9514 }
9515 else if (streq(p[1], "all"))
9516 {
9518 }
9519 else
9520 {
9521 msg(msglevel, "--vlan-accept must be 'tagged', 'untagged' or 'all'");
9522 goto err;
9523 }
9524 }
9525 else if (streq(p[0], "vlan-pvid") && p[1] && !p[2])
9526 {
9528 options->vlan_pvid = positive_atoi(p[1], msglevel);
9531 {
9532 msg(msglevel,
9533 "the parameter of --vlan-pvid parameters must be >= %u and <= %u",
9535 goto err;
9536 }
9537 }
9538 else
9539 {
9540 int i;
9541 int msglevel_unknown = msglevel_fc;
9542 /* Check if an option is in --ignore-unknown-option and
9543 * set warning level to non fatal */
9545 {
9546 if (streq(p[0], options->ignore_unknown_option[i]))
9547 {
9548 msglevel_unknown = M_WARN;
9549 break;
9550 }
9551 }
9552 if (file)
9553 {
9554 msg(msglevel_unknown, "Unrecognized option or missing or extra parameter(s) in %s:%d: %s (%s)", file, line, p[0], PACKAGE_VERSION);
9555 }
9556 else
9557 {
9558 msg(msglevel_unknown, "Unrecognized option or missing or extra parameter(s): --%s (%s)", p[0], PACKAGE_VERSION);
9559 }
9560 }
9561err:
9562 gc_free(&gc);
9563}
9564
9565bool
9567{
9568 if (options->ce.local_list)
9569 {
9570 for (int i = 0; i < options->ce.local_list->len; i++)
9571 {
9573 {
9574 return true;
9575 }
9576 }
9577 }
9578
9579 return false;
9580}
void argv_parse_cmd(struct argv *argres, const char *cmdstr)
Parses a command string, tokenizes it and puts each element into a separate struct argv argument slot...
Definition argv.c:483
void argv_free(struct argv *a)
Frees all memory allocations allocated by the struct argv related functions.
Definition argv.c:102
struct argv argv_new(void)
Allocates a new struct argv and ensures it is initialised.
Definition argv.c:88
void free_buf(struct buffer *buf)
Definition buffer.c:183
void buf_clear(struct buffer *buf)
Definition buffer.c:162
bool buf_printf(struct buffer *buf, const char *format,...)
Definition buffer.c:240
void gc_transfer(struct gc_arena *dest, struct gc_arena *src)
Definition buffer.c:460
void * gc_realloc(void *ptr, size_t size, struct gc_arena *a)
allows to realloc a pointer previously allocated by gc_malloc or gc_realloc
Definition buffer.c:370
char * format_hex_ex(const uint8_t *data, int size, int maxoutput, unsigned int space_break_flags, const char *separator, struct gc_arena *gc)
Definition buffer.c:483
void * gc_malloc(size_t size, bool clear, struct gc_arena *a)
Definition buffer.c:336
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:88
struct buffer alloc_buf(size_t size)
Definition buffer.c:62
int string_array_len(const char **array)
Definition buffer.c:703
struct buffer buffer_read_from_file(const char *filename, struct gc_arena *gc)
buffer_read_from_file - copy the content of a file into a buffer
Definition buffer.c:1358
bool buf_parse(struct buffer *buf, const int delim, char *line, const int size)
Definition buffer.c:825
char * string_alloc(const char *str, struct gc_arena *gc)
Definition buffer.c:649
struct buffer string_alloc_buf(const char *str, struct gc_arena *gc)
Definition buffer.c:752
static void gc_detach(struct gc_arena *a)
Definition buffer.h:1019
#define BSTR(buf)
Definition buffer.h:129
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition buffer.h:712
#define BPTR(buf)
Definition buffer.h:124
#define ALLOC_ARRAY_GC(dptr, type, n, gc)
Definition buffer.h:1071
static bool buf_valid(const struct buffer *buf)
Definition buffer.h:234
static void gc_init(struct gc_arena *a)
Definition buffer.h:1012
static bool buf_safe(const struct buffer *buf, size_t len)
Definition buffer.h:520
static void buf_set_read(struct buffer *buf, const uint8_t *data, size_t size)
Definition buffer.h:348
static void secure_memzero(void *data, size_t len)
Securely zeroise memory.
Definition buffer.h:414
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Definition buffer.h:1097
#define ALLOC_OBJ_GC(dptr, type, gc)
Definition buffer.h:1092
static void strncpynt(char *dest, const char *src, size_t maxlen)
Definition buffer.h:361
static void gc_free(struct gc_arena *a)
Definition buffer.h:1033
static bool strprefix(const char *str, const char *prefix)
Return true iff str starts with prefix.
Definition buffer.h:977
static struct gc_arena gc_new(void)
Definition buffer.h:1025
void print_client_nat_list(const struct client_nat_option_list *list, int msglevel)
Definition clinat.c:52
void add_client_nat_to_option_list(struct client_nat_option_list *dest, const char *type, const char *network, const char *netmask, const char *foreign_network, int msglevel)
Definition clinat.c:106
struct client_nat_option_list * new_client_nat_list(struct gc_arena *gc)
Definition clinat.c:75
struct client_nat_option_list * clone_client_nat_option_list(const struct client_nat_option_list *src, struct gc_arena *gc)
Definition clinat.c:83
void copy_client_nat_option_list(struct client_nat_option_list *dest, const struct client_nat_option_list *src)
Definition clinat.c:92
#define TLS_CHANNEL_BUF_SIZE
Definition common.h:69
#define TLS_CHANNEL_MTU_MIN
Definition common.h:82
bool check_compression_settings_valid(struct compress_options *info, int msglevel)
Checks if the compression settings are valid.
Definition comp.c:163
#define COMP_F_ALLOW_STUB_ONLY
Only accept stub compression, even with COMP_F_ADVERTISE_STUBS_ONLY we still accept other compression...
Definition comp.h:45
#define COMP_F_SWAP
initial command byte is swapped with last byte in buffer to preserve payload alignment
Definition comp.h:40
#define COMP_ALG_LZ4
LZ4 algorithm.
Definition comp.h:59
#define COMP_ALGV2_LZ4
Definition comp.h:64
#define COMP_F_ALLOW_NOCOMP_ONLY
Do not allow compression framing (breaks DCO)
Definition comp.h:51
#define COMP_F_ALLOW_ASYM
Compression was explicitly set to allow asymetric compression.
Definition comp.h:49
#define COMP_ALGV2_UNCOMPRESSED
Definition comp.h:63
#define COMP_ALG_STUB
support compression command byte and framing without actual compression
Definition comp.h:56
#define COMP_ALG_LZO
LZO algorithm.
Definition comp.h:57
#define COMP_F_ADVERTISE_STUBS_ONLY
tell server that we only support compression stubs
Definition comp.h:42
#define COMP_F_MIGRATE
push stub-v2 or comp-lzo no when we see a client with comp-lzo in occ
Definition comp.h:47
static bool comp_non_stub_enabled(const struct compress_options *info)
Definition comp.h:81
#define COMP_ALG_UNDEF
Definition comp.h:54
int daemon(int nochdir, int noclose)
char * dirname(char *path)
char * strsep(char **stringp, const char *delim)
#define PACKAGE_NAME
Definition config.h:492
#define IPROUTE_PATH
Definition config.h:468
#define PACKAGE_VERSION
Definition config.h:504
#define CONFIGURE_DEFINES
Definition config.h:5
#define PACKAGE_STRING
Definition config.h:495
#define PACKAGE
Definition config.h:486
#define TARGET_ALIAS
Definition config.h:558
void init_key_type(struct key_type *kt, const char *ciphername, const char *authname, bool tls_mode, bool warn)
Initialize a key_type structure with.
Definition crypto.c:893
int ascii2keydirection(int msglevel, const char *str)
Definition crypto.c:1653
const char * keydirection2ascii(int kd, bool remote, bool humanreadable)
Definition crypto.c:1676
bool check_tls_prf_working(void)
Checks if the current TLS library supports the TLS 1.0 PRF with MD5+SHA1 that OpenVPN uses when TLS K...
Definition crypto.c:1941
void test_crypto(struct crypto_options *co, struct frame *frame)
Definition crypto.c:1229
Data Channel Cryptography Module.
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition crypto.h:356
#define CO_USE_DYNAMIC_TLS_CRYPT
Bit-flag indicating that renegotiations are using tls-crypt with a TLS-EKM derived key.
Definition crypto.h:372
#define CO_EPOCH_DATA_KEY_FORMAT
Bit-flag indicating the epoch the data format.
Definition crypto.h:376
#define KEY_DIRECTION_BIDIRECTIONAL
Definition crypto.h:230
#define CO_USE_CC_EXIT_NOTIFY
Bit-flag indicating that explicit exit notifies should be sent via the control channel instead of usi...
Definition crypto.h:368
@ MD_SHA256
@ MD_SHA1
static bool cipher_defined(const char *ciphername)
Checks if the cipher is defined and is not the null (none) cipher.
const char * md_kt_name(const char *mdname)
Retrieve a string describing the digest digest (e.g.
const char * cipher_kt_name(const char *ciphername)
Retrieve a normalised string describing the cipher (e.g.
int cipher_kt_key_size(const char *ciphername)
Returns the size of keys used by the cipher, in bytes.
#define SHA_DIGEST_LENGTH
#define SHA256_DIGEST_LENGTH
static bool dco_check_startup_option(int msglevel, const struct options *o)
Definition dco.h:288
static bool dco_check_option(int msglevel, const struct options *o)
Definition dco.h:282
static const char * dco_version_string(struct gc_arena *gc)
Definition dco.h:276
bool dns_options_verify(int msglevel, const struct dns_options *o)
Checks validity of DNS options.
Definition dns.c:203
void dns_domain_list_append(struct dns_domain **entry, char **domains, struct gc_arena *gc)
Appends DNS domain parameters to a linked list.
Definition dns.c:147
void dns_options_postprocess_pull(struct dns_options *o)
Merges pulled DNS servers with static ones into an ordered list.
Definition dns.c:277
bool dns_server_addr_parse(struct dns_server *server, const char *addr)
Parses a string IPv4 or IPv6 address and optional colon separated port, into a in_addr or in6_addr re...
Definition dns.c:61
struct dns_server * dns_server_get(struct dns_server **entry, long priority, struct gc_arena *gc)
Find or create DNS server with priority in a linked list.
Definition dns.c:181
bool dns_server_priority_parse(long *priority, const char *str, bool pulled)
Parses a string DNS server priority and validates it.
Definition dns.c:166
struct dns_options clone_dns_options(const struct dns_options *o, struct gc_arena *gc)
Makes a deep copy of the passed DNS options.
Definition dns.c:257
void setenv_dns_options(const struct dns_options *o, struct env_set *es)
Puts the DNS options into an environment set.
Definition dns.c:376
void show_dns_options(const struct dns_options *o)
Prints configured DNS options.
Definition dns.c:554
void dns_options_preprocess_pull(struct dns_options *o)
Saves and resets the server options, so that pulled ones don't mix in.
Definition dns.c:270
@ DNS_SECURITY_NO
Definition dns.h:33
@ DNS_SECURITY_YES
Definition dns.h:34
@ DNS_SECURITY_OPTIONAL
Definition dns.h:35
@ DNS_TRANSPORT_PLAIN
Definition dns.h:40
@ DNS_TRANSPORT_TLS
Definition dns.h:42
@ DNS_TRANSPORT_HTTPS
Definition dns.h:41
void setenv_int(struct env_set *es, const char *name, int value)
Definition env_set.c:267
void setenv_str_i(struct env_set *es, const char *name, const char *value, const int i)
Definition env_set.c:404
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition env_set.c:283
const char * env_set_get(const struct env_set *es, const char *name)
Definition env_set.c:201
void setenv_str_safe(struct env_set *es, const char *name, const char *value)
Definition env_set.c:289
void setenv_long_long(struct env_set *es, const char *name, long long value)
Definition env_set.c:275
void setenv_del(struct env_set *es, const char *name)
Definition env_set.c:328
#define D_SHOW_OCC
Definition errlevel.h:151
#define D_PUSH
Definition errlevel.h:83
#define D_TLS_DEBUG_MED
Definition errlevel.h:157
#define D_DCO
Definition errlevel.h:94
#define D_SHOW_PARMS
Definition errlevel.h:96
#define D_PUSH_ERRORS
Definition errlevel.h:67
#define D_TLS_ERRORS
Definition errlevel.h:59
#define D_LOW
Definition errlevel.h:97
#define M_INFO
Definition errlevel.h:55
Interface functions to the internal and external multiplexers.
void helper_setdefault_topology(struct options *o)
Set –topology default depending on –mode.
Definition helper.c:144
void helper_tcp_nodelay(struct options *o)
Definition helper.c:600
void helper_client_server(struct options *o)
Definition helper.c:172
void helper_keepalive(struct options *o)
Definition helper.c:541
static int max_int(int x, int y)
Definition integer.h:89
static int constrain_int(int x, int min, int max)
Definition integer.h:115
static SERVICE_STATUS status
Definition interactive.c:53
static int tls_verify(struct openvpn_plugin_args_func_in const *args)
void management_auth_token(struct management *man, const char *token)
Definition manage.c:3105
void management_echo(struct management *man, const char *string, const bool pull)
Definition manage.c:3027
#define MF_FORGET_DISCONNECT
Definition manage.h:32
#define MF_EXTERNAL_KEY_PKCS1PAD
Definition manage.h:39
#define MF_CLIENT_AUTH
Definition manage.h:34
#define MF_EXTERNAL_KEY_PSSPAD
Definition manage.h:44
#define MF_EXTERNAL_KEY_NOPADDING
Definition manage.h:38
#define MF_QUERY_PROXY
Definition manage.h:42
#define MF_EXTERNAL_KEY
Definition manage.h:37
#define MF_QUERY_REMOTE
Definition manage.h:41
#define MF_QUERY_PASSWORDS
Definition manage.h:29
#define MF_EXTERNAL_CERT
Definition manage.h:43
#define MF_EXTERNAL_KEY_DIGEST
Definition manage.h:45
#define MF_UP_DOWN
Definition manage.h:40
#define MF_HOLD
Definition manage.h:30
#define MF_SIGNAL
Definition manage.h:31
#define MF_UNIX_SOCK
Definition manage.h:36
#define MF_CONNECT_AS_CLIENT
Definition manage.h:33
struct buffer prepend_dir(const char *dir, const char *path, struct gc_arena *gc)
Prepend a directory to a path.
Definition misc.c:793
const char * safe_print(const char *str, struct gc_arena *gc)
Definition misc.c:557
#define USER_PASS_LEN
Definition misc.h:69
#define SC_CONCAT
Definition misc.h:95
#define SC_ECHO
Definition misc.h:94
int translate_mtu_discover_type_name(const char *name)
Definition mtu.c:261
size_t calc_options_string_link_mtu(const struct options *o, const struct frame *frame)
Calculate the link-mtu to advertise to our peer.
Definition mtu.c:152
#define MSSFIX_DEFAULT
Definition mtu.h:80
#define TAP_MTU_EXTRA_DEFAULT
Definition mtu.h:75
#define LINK_MTU_DEFAULT
Definition mtu.h:65
#define TUN_MTU_DEFAULT
Definition mtu.h:70
#define TLS_MTU_DEFAULT
Definition mtu.h:85
static bool learn_address_script(const struct multi_context *m, const struct multi_instance *mi, const char *op, const struct mroute_addr *addr)
Definition multi.c:95
static int net_ctx_init(struct context *c, openvpn_net_ctx_t *ctx)
Definition networking.h:48
void * openvpn_net_ctx_t
Definition networking.h:39
#define BOOL_CAST(x)
Definition basic.h:27
#define CLEAR(x)
Definition basic.h:33
#define SIZE(x)
Definition basic.h:30
void errors_to_stderr(void)
Definition error.c:185
void open_syslog(const char *pgmname, bool stdio_to_null)
Definition error.c:467
void redirect_stdout_stderr(const char *file, bool append)
Definition error.c:515
FILE * msg_fp(const unsigned int flags)
Definition error.c:194
void openvpn_exit(const int status)
Definition error.c:735
static bool machine_readable_output
Definition error.c:78
void set_suppress_timestamps(bool suppressed)
Definition error.c:149
void set_machine_readable_output(bool parsable)
Definition error.c:155
bool set_debug_level(const int level, const unsigned int flags)
Definition error.c:105
static bool suppress_timestamps
Definition error.c:81
#define M_OPTERR
Definition error.h:100
#define SDL_CONSTRAIN
Definition error.h:177
#define M_NOPREFIX
Definition error.h:97
#define M_DEBUG_LEVEL
Definition error.h:87
#define M_USAGE
Definition error.h:106
#define OPENVPN_EXIT_STATUS_USAGE
Definition error.h:55
#define OPENVPN_EXIT_STATUS_GOOD
Definition error.h:53
#define M_FATAL
Definition error.h:89
#define M_ERR
Definition error.h:105
#define msg(flags,...)
Definition error.h:144
#define ASSERT(x)
Definition error.h:195
#define M_WARN
Definition error.h:91
#define M_MSG_VIRT_OUT
Definition error.h:99
#define M_ERRNO
Definition error.h:94
#define MAX_PEER_ID
Definition openvpn.h:546
bool options_cmp_equal(char *actual, const char *expected)
Definition options.c:4460
static void options_warning_safe_ml(const int msglevel, char *actual, const char *expected, size_t actual_n)
Definition options.c:4576
#define PUF_TYPE_ACCEPT
filter type to accept a matching option
Definition options.c:948
static void rol6_check_alloc(struct options *options)
Definition options.c:1724
#define CHKACC_PRIVATE
Warn if this (private) file is group/others accessible.
Definition options.c:3827
static bool check_file_access_chroot_inline(bool is_inline, const char *chroot, const int type, const char *file, const int mode, const char *opt)
A wrapper for check_file_access_chroot() that returns false immediately if the file is inline (and th...
Definition options.c:3959
static bool check_file_access_chroot(const char *chroot, const int type, const char *file, const int mode, const char *opt)
Definition options.c:3926
static void options_warning_safe_scan2(const int msglevel, const int delim, const bool report_inconsistent, const char *p1, const struct buffer *b2_src, const char *b1_name, const char *b2_name)
Definition options.c:4487
static void options_postprocess_verify_ce(const struct options *options, const struct connection_entry *ce)
Definition options.c:2405
static int msglevel_forward_compatible(struct options *options, const int msglevel)
Definition options.c:5643
static struct local_entry * alloc_local_entry(struct connection_entry *ce, const int msglevel, struct gc_arena *gc)
Definition options.c:2214
#define NM_QUOTE_HINT
Definition options.c:5612
static void options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
Definition options.c:3062
static void usage_version(void)
Definition options.c:4881
static bool in_src_get(const struct in_src *is, char *line, const int size)
Definition options.c:5142
static struct pull_filter * alloc_pull_filter(struct options *o)
Definition options.c:2312
void options_server_import(struct options *o, const char *filename, int msglevel, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5516
#define USAGE_VALID_SERVER_PROTOS
#define SHOW_BOOL(var)
Definition options.c:996
#define CHKACC_DIRPATH
Check for directory presence where a file should reside.
Definition options.c:3824
static void pre_connect_save(struct options *o)
Definition options.c:3258
#define CHKACC_ACPTSTDIN
If filename is stdin, it's allowed and "exists".
Definition options.c:3826
static enum tun_driver_type parse_windows_driver(const char *str, const int msglevel)
Parses –windows-driver config option.
Definition options.c:4677
#define TLS_CLIENT
static void setenv_connection_entry(struct env_set *es, const struct connection_entry *e, const int i)
Definition options.c:1001
static int check_inline_file_via_buf(struct buffer *multiline, char *p[], struct gc_arena *gc)
Definition options.c:5243
static int global_auth_retry
Definition options.c:4753
#define IS_TYPE_BUF
Definition options.c:5133
bool options_postprocess_pull(struct options *o, struct env_set *es)
Definition options.c:4183
void uninit_options(struct options *o)
Definition options.c:928
static void connection_entry_load_re(struct connection_entry *ce, const struct remote_entry *re)
Definition options.c:2333
#define SHOW_STR(var)
Definition options.c:987
static int check_inline_file(struct in_src *is, char *p[], struct gc_arena *gc)
Definition options.c:5210
static bool verify_permission(const char *name, const char *file, int line, const unsigned int type, const unsigned int allowed, unsigned int *found, const int msglevel, struct options *options, bool is_inline)
Definition options.c:5555
static void read_config_file(struct options *options, const char *file, int level, const char *top_file, const int top_line, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5265
void show_windows_version(const unsigned int flags)
Definition options.c:4847
#define VERIFY_PERMISSION(mask)
Definition options.c:5546
static const char * options_warning_extract_parm1(const char *option_string, struct gc_arena *gc_ret)
Definition options.c:4472
bool key_is_external(const struct options *options)
Definition options.c:5691
static bool no_more_than_n_args(const int msglevel, char *p[], const int max, const unsigned int flags)
Definition options.c:5615
static void check_ca_required(const struct options *options)
Definition options.c:2371
bool auth_retry_set(const int msglevel, const char *option)
Definition options.c:4762
static struct http_proxy_options * parse_http_proxy_override(const char *server, const char *port, const char *flags, struct gc_arena *gc)
Definition options.c:2140
static void read_config_string(const char *prefix, struct options *options, const char *config, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5340
static void bypass_doubledash(char **p)
Definition options.c:5123
#define CHKACC_FILEXSTWR
If file exists, is it writable?
Definition options.c:3825
static char * get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
Returns newly allocated string containing address part without "/nn".
Definition options.c:1133
#define PUF_TYPE_IGNORE
filter type to ignore a matching option
Definition options.c:949
void show_dco_version(const unsigned int flags)
Definition options.c:4856
static bool apply_pull_filter(const struct options *o, char *line)
Filter an option line by all pull filters.
Definition options.c:5446
void rol_check_alloc(struct options *options)
Definition options.c:1715
static struct local_list * alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
Definition options.c:2204
#define SHOW_UNSIGNED(var)
Definition options.c:995
void show_settings(const struct options *o)
Definition options.c:1839
static void set_user_script(struct options *options, const char **script, const char *new_script, const char *type, bool in_chroot)
Definition options.c:5649
static in_addr_t get_ip_addr(const char *ip_string, int msglevel, bool *error)
Definition options.c:1108
#define LZO_LIB_VER_STR
bool apply_push_options(struct options *options, struct buffer *buf, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5486
static void show_dhcp_option_list(const char *name, const char *const *array, int len)
Definition options.c:1286
static void show_connection_entries(const struct options *o)
Definition options.c:1800
static void options_postprocess_mutate_le(struct connection_entry *ce, struct local_entry *le, int mode)
Definition options.c:3222
static void option_iroute_ipv6(struct options *o, const char *prefix_str, int msglevel)
Definition options.c:1654
bool options_cmp_equal_safe(char *actual, const char *expected, size_t actual_n)
Definition options.c:4602
void parse_argv(struct options *options, const int argc, char *argv[], const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5373
#define PUF_TYPE_REJECT
filter type to reject and trigger SIGUSR1
Definition options.c:950
bool string_defined_equal(const char *s1, const char *s2)
Definition options.c:4912
static bool check_file_access_inline(bool is_inline, const int type, const char *file, const int mode, const char *opt)
A wrapper for check_file_access() that returns false immediately if the file is inline (and therefore...
Definition options.c:3976
void options_postprocess(struct options *options, struct env_set *es)
Definition options.c:4169
int parse_topology(const char *str, const int msglevel)
Definition options.c:4706
static void show_dhcp_option_addrs(const char *name, const in_addr_t *array, int len)
Definition options.c:1296
void usage_small(void)
Definition options.c:4839
const char * auth_retry_print(void)
Definition options.c:4785
static void show_http_proxy_options(const struct http_proxy_options *o)
Definition options.c:1675
static void options_postprocess_filechecks(struct options *options)
Definition options.c:4045
static void show_connection_entry(const struct connection_entry *o)
Definition options.c:1743
void options_warning_safe(char *actual, const char *expected, size_t actual_n)
Definition options.c:4625
void show_library_versions(const unsigned int flags)
Definition options.c:4866
void setenv_settings(struct env_set *es, const struct options *o)
Definition options.c:1031
#define CHKACC_ACCEPT_URI
Do not check URIs, unless they start with file:
Definition options.c:3828
static const char usage_message[]
Definition options.c:120
static char * string_substitute(const char *src, int from, int to, struct gc_arena *gc)
Definition options.c:1160
static struct verify_hash_list * parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
Parses a hexstring and checks if the string has the correct length.
Definition options.c:1189
static struct connection_list * alloc_connection_list_if_undef(struct options *options)
Definition options.c:2236
static bool space(unsigned char c)
Definition options.c:4943
static bool check_cmd_access(const char *command, const char *opt, const char *chroot)
Definition options.c:4004
static void options_warning_safe_scan1(const int msglevel, const int delim, const bool report_inconsistent, const struct buffer *b1_src, const struct buffer *b2_src, const char *b1_name, const char *b2_name)
Definition options.c:4555
#define SHOW_INT64(var)
Definition options.c:994
static struct connection_entry * alloc_connection_entry(struct options *options, const int msglevel)
Definition options.c:2246
static void dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel)
Definition options.c:1338
static bool check_file_access(const int type, const char *file, const int mode, const char *opt)
Definition options.c:3831
static void show_p2mp_parms(const struct options *o)
Definition options.c:1542
static const char * pull_filter_type_name(int type)
Definition options.c:966
static void cnol_check_alloc(struct options *options)
Definition options.c:1733
int parse_line(const char *line, char *p[], const int n, const char *file, const int line_num, int msglevel, struct gc_arena *gc)
Definition options.c:4949
static int check_inline_file_via_fp(FILE *fp, char *p[], struct gc_arena *gc)
Definition options.c:5234
static struct remote_entry * alloc_remote_entry(struct options *options, const int msglevel)
Definition options.c:2279
static void options_postprocess_mutate(struct options *o, struct env_set *es)
Definition options.c:3621
void options_detach(struct options *o)
Definition options.c:1706
static unsigned int atou(const char *str)
Definition options.c:4934
void pre_connect_restore(struct options *o, struct gc_arena *gc)
Definition options.c:3300
static void dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
Definition options.c:1352
static struct pull_filter_list * alloc_pull_filter_list(struct options *o)
Definition options.c:2302
const char * print_topology(const int topology)
Definition options.c:4728
void options_string_import(struct options *options, const char *config, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5536
char * options_string_extract_option(const char *options_string, const char *opt_name, struct gc_arena *gc)
Given an OpenVPN options string, extract the value of an option.
Definition options.c:4639
#define SHOW_STR_INLINE(var)
Definition options.c:988
static void options_postprocess_cipher(struct options *o)
Definition options.c:3460
static void options_set_backwards_compatible_options(struct options *o)
Changes default values so that OpenVPN can be compatible with the user specified version.
Definition options.c:3527
static void show_tuntap_options(const struct tuntap_options *o)
Definition options.c:1311
void init_options(struct options *o, const bool init_gc)
Definition options.c:805
#define MUST_BE_FALSE(condition, parm_name)
Definition options.c:2401
#define MUST_BE_UNDEF(parm, parm_name)
Definition options.c:2399
static const char * print_vlan_accept(enum vlan_acceptable_frames mode)
Definition options.c:1525
#define SHOW_PARM(name, value, format)
Definition options.c:986
static void options_postprocess_http_proxy_override(struct options *o)
Definition options.c:2170
#define IS_TYPE_FP
Definition options.c:5132
void options_warning(char *actual, const char *expected)
Definition options.c:4466
static void show_pull_filter_list(const struct pull_filter_list *l)
Definition options.c:1821
#define CHKACC_FILE
Check for a file/directory presence.
Definition options.c:3823
const char * options_string_version(const char *s, struct gc_arena *gc)
Definition options.c:4631
static void options_postprocess_mutate_invariant(struct options *options)
Definition options.c:3369
static bool ipv6_addr_safe_hexplusbits(const char *ipv6_prefix_spec)
Definition options.c:1151
const char title_string[]
Definition options.c:69
static void setenv_local_entry(struct env_set *es, const struct local_entry *e, const int i)
Definition options.c:1021
static void remap_redirect_gateway_flags(struct options *opt)
Definition options.c:3240
#define TLS_SERVER
static void usage(void)
Definition options.c:4807
int auth_retry_get(void)
Definition options.c:4756
static void add_option(struct options *options, char *p[], bool is_inline, const char *file, int line, const int level, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition options.c:5706
static struct verify_hash_list * parse_hash_fingerprint_multiline(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
Parses a string consisting of multiple lines of hexstrings and checks if each string has the correct ...
Definition options.c:1243
static struct remote_list * alloc_remote_list_if_undef(struct options *options)
Definition options.c:2269
void notnull(const char *arg, const char *description)
Definition options.c:4903
static void tuntap_options_copy_dns(struct options *o)
Definition options.c:1385
static void show_compression_warning(struct compress_options *info)
Definition options.c:5679
static void options_process_mutate_prf(struct options *o)
Definition options.c:3597
bool has_udp_in_local_list(const struct options *options)
Definition options.c:9566
static void option_iroute(struct options *o, const char *network_str, const char *netmask_str, int msglevel)
Definition options.c:1624
char * options_string(const struct options *o, const struct frame *frame, struct tuntap *tt, openvpn_net_ctx_t *ctx, bool remote, struct gc_arena *gc)
Definition options.c:4241
static char * read_inline_file(struct in_src *is, const char *close_tag, int *num_lines, struct gc_arena *gc)
Definition options.c:5165
static void options_postprocess_verify(const struct options *o)
Definition options.c:3434
static void connection_entry_preload_key(const char **key_file, bool *key_inline, struct gc_arena *gc)
Definition options.c:2354
#define SHOW_INT(var)
Definition options.c:992
static bool need_compatibility_before(const struct options *o, unsigned int version)
The option –compat-mode is used to set up default settings to values used on the specified openvpn ve...
Definition options.c:3517
#define MODE_POINT_TO_POINT
Definition options.h:258
#define OPT_P_SCRIPT
Definition options.h:735
#define OPT_P_PUSH
Definition options.h:747
#define SF_TCP_NODELAY_HELPER
Definition options.h:475
#define OPT_P_UP
Definition options.h:732
#define OPT_P_CONNECTION
Definition options.h:758
#define OPT_P_INSTANCE
allowed in ccd, client-connect etc
Definition options.h:748
#define OPT_P_NCP
Negotiable crypto parameters.
Definition options.h:743
#define OPT_P_ECHO
Definition options.h:751
#define OPT_P_CONFIG
Definition options.h:749
#define MODE_SERVER
Definition options.h:259
#define CONNECTION_LIST_SIZE
Definition options.h:187
#define streq(x, y)
Definition options.h:726
#define OPT_P_EXPLICIT_NOTIFY
Definition options.h:750
#define AR_INTERACT
Definition options.h:904
#define OPT_P_SHAPER
Definition options.h:737
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition options.h:928
#define OPT_P_SOCKFLAGS
Definition options.h:757
#define SF_NOPOOL
Definition options.h:474
#define OPT_P_MESSAGES
Definition options.h:742
#define OPT_P_SETENV
Definition options.h:736
#define OPT_P_SOCKBUF
Definition options.h:756
#define OPT_P_PLUGIN
Definition options.h:755
#define OPTION_PARM_SIZE
Definition options.h:57
#define OPT_P_TIMER
Definition options.h:738
#define OPT_P_GENERAL
Definition options.h:731
#define PING_RESTART
Definition options.h:354
#define OPT_P_DHCPDNS
Definition options.h:734
#define OPT_P_PULL_MODE
Definition options.h:754
@ GENKEY_AUTH_TOKEN
Definition options.h:237
@ GENKEY_SECRET
Definition options.h:234
@ GENKEY_TLS_CRYPTV2_SERVER
Definition options.h:236
@ GENKEY_TLS_CRYPTV2_CLIENT
Definition options.h:235
#define OPT_P_PUSH_MTU
Definition options.h:761
#define AR_NONE
Definition options.h:903
#define AR_NOINTERACT
Definition options.h:905
#define SF_NO_PUSH_ROUTE_GATEWAY
Definition options.h:476
#define OPT_P_PERSIST
Definition options.h:739
#define MAX_PARMS
Definition options.h:52
#define PULL_DEFINED(opt)
Definition options.h:765
#define PLUGIN_OPTION_LIST(opt)
Definition options.h:785
#define OPTION_LINE_SIZE
Definition options.h:58
#define PING_EXIT
Definition options.h:353
#define OPT_P_COMP
Definition options.h:741
#define OPT_P_PERSIST_IP
Definition options.h:740
#define OPT_P_MTU
Definition options.h:745
#define OPT_P_ROUTE_EXTRAS
Definition options.h:753
#define OPT_P_NICE
Definition options.h:746
#define OPT_P_PEER_ID
Definition options.h:759
#define OPT_P_INHERIT
Definition options.h:752
#define OPT_P_TLS_PARMS
Definition options.h:744
#define OPT_P_ROUTE
Definition options.h:733
#define MAN_CLIENT_AUTH_ENABLED(opt)
Definition options.h:791
#define CE_DISABLED
Definition options.h:150
#define OPT_P_INLINE
Definition options.h:760
vlan_acceptable_frames
Definition options.h:219
@ VLAN_ONLY_UNTAGGED_OR_PRIORITY
Definition options.h:221
@ VLAN_ALL
Definition options.h:222
@ VLAN_ONLY_TAGGED
Definition options.h:220
int positive_atoi(const char *str, int msglevel)
Converts a str to a positive number if the string represents a postive integer number.
int atoi_warn(const char *str, int msglevel)
Converts a str to an integer if the string can be represented as an integer number.
bool valid_integer(const char *str, bool positive)
Checks if the string is a valid integer by checking if it can be converted to an integer.
#define MAX_SEQ_BACKTRACK
Definition packet_id.h:86
#define MIN_SEQ_BACKTRACK
Definition packet_id.h:85
#define DEFAULT_SEQ_BACKTRACK
Definition packet_id.h:87
#define MAX_TIME_BACKTRACK
Definition packet_id.h:95
#define DEFAULT_TIME_BACKTRACK
Definition packet_id.h:96
#define MIN_TIME_BACKTRACK
Definition packet_id.h:94
unsigned int platform_getpid(void)
Definition platform.c:333
int platform_access(const char *path, int mode)
Definition platform.c:458
FILE * platform_fopen(const char *path, const char *mode)
Definition platform.c:501
int platform_chdir(const char *dir)
Definition platform.c:393
int platform_stat(const char *path, platform_stat_t *buf)
Definition platform.c:527
struct _stat platform_stat_t
Definition platform.h:142
struct plugin_option_list * plugin_option_list_new(struct gc_arena *gc)
Definition plugin.c:160
bool plugin_option_list_add(struct plugin_option_list *list, char **p, struct gc_arena *gc)
Definition plugin.c:168
void plugin_option_list_print(const struct plugin_option_list *list, int msglevel)
Definition plugin.c:189
bool ifconfig_pool_verify_range(const int msglevel, const in_addr_t start, const in_addr_t end)
Definition pool.c:121
#define OPENVPN_8021Q_MIN_VID
Definition proto.h:311
#define OPENVPN_8021Q_MAX_VID
Definition proto.h:312
#define DEV_TYPE_TAP
Definition proto.h:37
#define TOP_UNDEF
Definition proto.h:41
#define DEV_TYPE_UNDEF
Definition proto.h:35
#define TOP_NET30
Definition proto.h:42
#define DEV_TYPE_TUN
Definition proto.h:36
#define TOP_P2P
Definition proto.h:43
#define TOP_SUBNET
Definition proto.h:44
struct http_proxy_options * init_http_proxy_options_once(struct http_proxy_options **hpo, struct gc_arena *gc)
Definition proxy.c:46
#define PAR_NCT
Definition proxy.h:50
#define MAX_CUSTOM_HTTP_HEADER
Definition proxy.h:43
#define PAR_ALL
Definition proxy.h:49
void push_reset(struct options *o)
Definition push.c:933
void clone_push_list(struct options *o)
Definition push.c:891
void push_remove_option(struct options *o, const char *p)
Definition push.c:939
void push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
Definition push.c:907
bool is_special_addr(const char *addr_str)
Definition route.c:306
struct route_option_list * clone_route_option_list(const struct route_option_list *src, struct gc_arena *a)
Definition route.c:155
int netmask_to_netbits2(in_addr_t netmask)
Definition route.c:4139
struct route_ipv6_option_list * new_route_ipv6_option_list(struct gc_arena *a)
Definition route.c:139
void add_route_ipv6_to_option_list(struct route_ipv6_option_list *l, const char *prefix, const char *gateway, const char *metric)
Definition route.c:528
void get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest, openvpn_net_ctx_t *ctx)
Definition route.c:2886
void show_routes(int msglev)
Definition route.c:3308
void print_route_options(const struct route_option_list *rol, int level)
Definition route.c:1319
void add_route_to_option_list(struct route_option_list *l, const char *network, const char *netmask, const char *gateway, const char *metric)
Definition route.c:510
void print_default_gateway(const int msglevel, const struct route_gateway_info *rgi, const struct route_ipv6_gateway_info *rgi6)
Definition route.c:1335
void copy_route_option_list(struct route_option_list *dest, const struct route_option_list *src, struct gc_arena *a)
Definition route.c:173
void copy_route_ipv6_option_list(struct route_ipv6_option_list *dest, const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:180
void get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
Retrieves the best gateway for a given destination based on the routing table.
Definition route.c:2785
struct route_ipv6_option_list * clone_route_ipv6_option_list(const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:164
struct route_option_list * new_route_option_list(struct gc_arena *a)
Definition route.c:130
#define RG_LOCAL
Definition route.h:85
#define RG_BYPASS_DHCP
Definition route.h:87
#define ROUTE_METHOD_SERVICE
Definition route.h:43
#define ROUTE_METHOD_IPAPI
Definition route.h:41
#define ROUTE_METHOD_EXE
Definition route.h:42
#define RG_DEF1
Definition route.h:86
#define RG_BYPASS_DNS
Definition route.h:88
#define RG_ENABLE
Definition route.h:84
#define RG_REROUTE_GW
Definition route.h:89
#define ROUTE_METHOD_ADAPTIVE
Definition route.h:40
#define RG_AUTO_LOCAL
Definition route.h:90
#define RG_BLOCK_LOCAL
Definition route.h:91
void script_security_set(int level)
Definition run_command.c:49
#define SHAPER_MAX
Definition shaper.h:41
#define SHAPER_MIN
Definition shaper.h:40
void throw_signal_soft(const int signum, const char *signal_text)
Throw a soft global signal.
Definition sig.c:206
const char * proto2ascii(int proto, sa_family_t af, bool display_form)
Definition socket.c:3215
bool get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits, int msglevel)
Translate an IPv6 addr or hostname from string form to in6_addr.
Definition socket.c:226
bool mac_addr_safe(const char *mac_addr)
Definition socket.c:840
const char * proto2ascii_all(struct gc_arena *gc)
Definition socket.c:3236
static void bind_local(struct link_socket *sock, const sa_family_t ai_family)
Definition socket.c:1140
sa_family_t ascii2af(const char *proto_name)
Definition socket.c:3202
const char * proto_remote(int proto, bool remote)
Definition socket.c:3276
bool ipv6_addr_safe(const char *ipv6_text_addr)
Definition socket.c:787
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition socket.c:3017
bool ip_or_dns_addr_safe(const char *addr, const bool allow_fqdn)
Definition socket.c:823
int ascii2proto(const char *proto_name)
Definition socket.c:3189
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition socket.c:2997
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, struct signal_info *sig_info)
Translate an IPv4 addr or hostname from string form to in_addr_t.
Definition socket.c:195
bool ip_addr_dotted_quad_safe(const char *dotted_quad)
Definition socket.c:737
static bool proto_is_net(int proto)
Definition socket.h:576
static bool proto_is_udp(int proto)
Returns if the protocol being used is UDP.
Definition socket.h:586
#define GETADDR_FATAL
Definition socket.h:518
@ PROTO_NONE
Definition socket.h:567
@ PROTO_UDP
Definition socket.h:568
@ PROTO_TCP
Definition socket.h:569
@ PROTO_TCP_CLIENT
Definition socket.h:571
@ PROTO_TCP_SERVER
Definition socket.h:570
#define GETADDR_HOST_ORDER
Definition socket.h:519
#define SF_TCP_NODELAY
Definition socket.h:222
#define RESOLV_RETRY_INFINITE
Definition socket.h:48
#define OPENVPN_PORT
Definition socket.h:42
#define SF_USE_IP_PKTINFO
Definition socket.h:221
static bool proto_is_dgram(int proto)
Return if the protocol is datagram (UDP)
Definition socket.h:597
#define SF_HOST_RANDOMIZE
Definition socket.h:224
#define GETADDR_RESOLVE
Definition socket.h:517
void ssl_set_auth_token_user(const char *username)
Definition ssl.c:372
void ssl_set_auth_nocache(void)
Definition ssl.c:347
int tls_version_parse(const char *vstr, const char *extra)
Definition ssl.c:431
void ssl_set_auth_token(const char *token)
Definition ssl.c:366
bool ssl_get_auth_nocache(void)
Definition ssl.c:357
static bool push_peer_info(struct buffer *buf, struct tls_session *session)
Prepares the IV_ and UV_ variables that are part of the exchange to signal the peer's capabilities.
Definition ssl.c:1950
Control Channel SSL/Data channel negotiation module.
#define X509_USERNAME_FIELD_DEFAULT
Definition ssl.h:117
#define KEY_METHOD_2
Definition ssl.h:119
const char * get_ssl_library_version(void)
return a pointer to a static memory area containing the name and version number of the SSL library in...
#define TLS_VER_BAD
Parse a TLS version specifier.
#define TLS_VER_1_0
#define EXPORT_KEY_DATA_LABEL
#define TLS_VER_1_2
#define TLS_VER_1_3
int tls_version_max(void)
Return the maximum TLS version (as a TLS_VER_x constant) supported by current SSL implementation.
#define SSLF_TLS_VERSION_MAX_SHIFT
Definition ssl_common.h:426
#define SSLF_CLIENT_CERT_OPTIONAL
Definition ssl_common.h:419
#define SSLF_AUTH_USER_PASS_OPTIONAL
Definition ssl_common.h:421
#define SSLF_CLIENT_CERT_NOT_REQUIRED
Definition ssl_common.h:418
#define SSLF_CRL_VERIFY_DIR
Definition ssl_common.h:423
#define SSLF_TLS_DEBUG_ENABLED
Definition ssl_common.h:428
#define SSLF_TLS_VERSION_MAX_MASK
Definition ssl_common.h:427
#define SSLF_TLS_VERSION_MIN_SHIFT
Definition ssl_common.h:424
#define SSLF_TLS_VERSION_MIN_MASK
Definition ssl_common.h:425
#define SSLF_USERNAME_AS_COMMON_NAME
Definition ssl_common.h:420
#define SSLF_OPT_VERIFY
Definition ssl_common.h:422
void options_postprocess_setdefault_ncpciphers(struct options *o)
Checks for availibility of Chacha20-Poly1305 and sets the ncp_cipher to either AES-256-GCM:AES-128-GC...
Definition ssl_ncp.c:591
bool tls_item_in_cipher_list(const char *item, const char *list)
Return true iff item is present in the colon-separated zero-terminated cipher list.
Definition ssl_ncp.c:210
void append_cipher_to_ncp_list(struct options *o, const char *ciphername)
Appends the cipher specified by the ciphernamer parameter to to the o->ncp_ciphers list.
Definition ssl_ncp.c:198
char * mutate_ncp_cipher_list(const char *list, struct gc_arena *gc)
Check whether the ciphers in the supplied list are supported.
Definition ssl_ncp.c:98
Control Channel SSL/Data dynamic negotiation Module This file is split from ssl.h to be able to unit ...
Control Channel Verification Module.
#define OPENVPN_KU_REQUIRED
Require keyUsage to be present in cert (0xFFFF is an invalid KU value)
Definition ssl_verify.h:262
#define VERIFY_X509_SUBJECT_DN
Definition ssl_verify.h:68
#define VERIFY_X509_SUBJECT_RDN
Definition ssl_verify.h:69
#define NS_CERT_CHECK_CLIENT
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:259
#define VERIFY_X509_SUBJECT_RDN_PREFIX
Definition ssl_verify.h:70
#define NS_CERT_CHECK_SERVER
Do not perform Netscape certificate type verification.
Definition ssl_verify.h:257
void x509_track_add(const struct x509_track **ll_head, const char *name, int msglevel, struct gc_arena *gc)
Definition argv.h:35
char ** argv
Definition argv.h:39
Wrapper structure for dynamically allocated memory.
Definition buffer.h:61
int capacity
Size in bytes of memory allocated by malloc().
Definition buffer.h:62
uint8_t * data
Pointer to the allocated memory.
Definition buffer.h:68
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:66
unsigned int flags
Definition comp.h:77
Definition options.h:105
struct local_list * local_list
Definition options.h:106
int tun_mtu_max
Definition options.h:127
int connect_retry_seconds
Definition options.h:117
bool tls_crypt_v2_force_cookie
Definition options.h:176
int link_mtu
Definition options.h:132
bool link_mtu_defined
Definition options.h:133
int tun_mtu_extra
Definition options.h:130
int connect_retry_seconds_max
Definition options.h:118
bool bind_local
Definition options.h:116
int mssfix
Definition options.h:142
const char * tls_crypt_file
Definition options.h:167
const char * tls_crypt_v2_file
Definition options.h:172
bool tun_mtu_extra_defined
Definition options.h:131
const char * remote
Definition options.h:112
int connect_timeout
Definition options.h:119
const char * socks_proxy_port
Definition options.h:122
bool mssfix_default
Definition options.h:143
bool mssfix_encap
Definition options.h:144
int occ_mtu
Definition options.h:126
struct http_proxy_options * http_proxy_options
Definition options.h:120
bool tls_crypt_file_inline
Definition options.h:168
bool tls_auth_file_inline
Definition options.h:163
bool bind_ipv6_only
Definition options.h:115
bool tun_mtu_defined
Definition options.h:129
bool remote_float
Definition options.h:113
int tls_mtu
Definition options.h:134
int explicit_exit_notification
Definition options.h:148
const char * socks_proxy_authfile
Definition options.h:123
const char * remote_port
Definition options.h:111
bool fragment_encap
Definition options.h:140
const char * socks_proxy_server
Definition options.h:121
int fragment
Definition options.h:139
int mtu_discover_type
Definition options.h:137
int proto
Definition options.h:107
sa_family_t af
Definition options.h:108
const char * tls_auth_file
Definition options.h:162
bool local_port_defined
Definition options.h:110
int tun_mtu
Definition options.h:125
bool bind_defined
Definition options.h:114
const char * local_port
Definition options.h:109
int key_direction
Definition options.h:164
bool tls_crypt_v2_file_inline
Definition options.h:173
unsigned int flags
Definition options.h:159
bool mssfix_fixed
Definition options.h:146
struct connection_entry ** array
Definition options.h:200
Definition dhcp.h:53
struct dns_domain * next
Definition dns.h:46
const char * name
Definition dns.h:47
struct dns_server * servers
Definition dns.h:74
struct gc_arena gc
Definition dns.h:75
struct dns_domain * search_domains
Definition dns.h:72
struct in_addr a4
Definition dns.h:53
union dns_server_addr::@0 in
sa_family_t family
Definition dns.h:56
struct in6_addr a6
Definition dns.h:54
struct dns_server_addr addr[8]
Definition dns.h:64
enum dns_security dnssec
Definition dns.h:66
struct dns_server * next
Definition dns.h:61
long priority
Definition dns.h:62
size_t addr_count
Definition dns.h:63
struct dns_domain * domains
Definition dns.h:65
enum dns_server_transport transport
Definition dns.h:67
const char * sni
Definition dns.h:68
Structure for reassembling one incoming fragmented packet.
Definition fragment.h:65
Packet geometry parameters.
Definition mtu.h:98
int tun_mtu
the (user) configured tun-mtu.
Definition mtu.h:131
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:117
Definition list.h:57
const char * name
Definition proxy.h:39
const char * content
Definition proxy.h:40
const char * auth_file
Definition proxy.h:54
const char * http_version
Definition proxy.h:56
const char * port
Definition proxy.h:46
bool inline_creds
Definition proxy.h:59
const char * user_agent
Definition proxy.h:57
const char * auth_method_string
Definition proxy.h:53
struct http_custom_header custom_headers[MAX_CUSTOM_HTTP_HEADER]
Definition proxy.h:58
const char * auth_file_up
Definition proxy.h:55
const char * server
Definition proxy.h:45
struct buffer * multiline
Definition options.c:5137
union in_src::@9 u
FILE * fp
Definition options.c:5136
int type
Definition options.c:5134
struct iroute_ipv6 * next
Definition route.h:250
unsigned int netbits
Definition route.h:249
struct in6_addr network
Definition route.h:248
in_addr_t network
Definition route.h:242
int netbits
Definition route.h:243
struct iroute * next
Definition route.h:244
const char * cipher
const name of the cipher
Definition crypto.h:142
const char * digest
Message digest static parameters.
Definition crypto.h:143
Definition options.h:98
const char * port
Definition options.h:100
int proto
Definition options.h:101
const char * local
Definition options.h:99
struct local_entry * array[CONNECTION_LIST_SIZE]
Definition options.h:192
struct tuntap_options tuntap_options
Definition options.h:66
int ping_rec_timeout_action
Definition options.h:87
bool tuntap_options_defined
Definition options.h:65
bool routes_ipv6_defined
Definition options.h:71
struct route_option_list * routes
Definition options.h:69
struct compress_options comp
Definition options.h:90
const char * ciphername
Definition options.h:82
struct dns_options dns_options
Definition options.h:80
const char * route_default_gateway
Definition options.h:74
const char * authname
Definition options.h:83
struct route_ipv6_option_list * routes_ipv6
Definition options.h:72
bool client_nat_defined
Definition options.h:77
struct client_nat_option_list * client_nat
Definition options.h:78
const char * route_ipv6_default_gateway
Definition options.h:75
int resolve_retry_seconds
Definition options.h:365
int rcvbuf
Definition options.h:414
bool resolve_in_advance
Definition options.h:366
bool route_nopull
Definition options.h:437
const char * genkey_extra_data
Definition options.h:284
struct compress_options comp
Definition options.h:411
struct http_proxy_options * http_proxy_override
Definition options.h:307
int push_ifconfig_ipv6_netbits
Definition options.h:523
int proto_force
Definition options.h:330
bool persist_config
Definition options.h:272
struct connection_list * connection_list
Definition options.h:289
const char * management_port
Definition options.h:447
bool tls_crypt_file_inline
Definition options.h:668
const char * ifconfig_ipv6_remote
Definition options.h:325
int max_routes_per_client
Definition options.h:536
const char * ncp_ciphers_conf
The original ncp_ciphers specified by the user in the configuration.
Definition options.h:577
int status_file_version
Definition options.h:405
enum vlan_acceptable_frames vlan_accept
Definition options.h:713
int auth_token_renewal
Definition options.h:545
in_addr_t push_ifconfig_constraint_network
Definition options.h:518
const char * tmp_dir
Definition options.h:466
bool push_peer_info
Definition options.h:682
bool daemon
Definition options.h:389
struct options_pre_connect * pre_connect
Definition options.h:561
int route_default_metric
Definition options.h:429
int renegotiate_seconds_min
Definition options.h:648
const char * auth_token_secret_file
Definition options.h:546
unsigned int imported_protocol_flags
Definition options.h:723
const char * tls_export_peer_cert_dir
Definition options.h:613
bool crl_file_inline
Definition options.h:617
const char * cryptoapi_cert
Definition options.h:639
const char * down_script
Definition options.h:384
unsigned int backwards_compatible
What version we should try to be compatible with as major * 10000 + minor * 100 + patch,...
Definition options.h:266
hash_algo_type verify_hash_algo
Definition options.h:623
int scheduled_exit_interval
Definition options.h:563
int stale_routes_ageing_time
Definition options.h:538
bool pkcs12_file_inline
Definition options.h:606
int replay_time
Definition options.h:584
unsigned int push_option_types_found
Definition options.h:558
int management_state_buffer_size
Definition options.h:451
const char * ca_file
Definition options.h:594
const char * tls_auth_file
Definition options.h:663
struct provider_list providers
Definition options.h:581
bool duplicate_cn
Definition options.h:527
struct in6_addr server_network_ipv6
Definition options.h:471
int shaper
Definition options.h:328
int management_echo_buffer_size
Definition options.h:450
in_addr_t server_network
Definition options.h:468
bool show_net_up
Definition options.h:695
bool verify_hash_no_ca
Definition options.h:625
bool allow_pull_fqdn
Definition options.h:439
bool use_peer_id
Definition options.h:701
unsigned remote_cert_ku[MAX_PARMS]
Definition options.h:620
bool server_bridge_defined
Definition options.h:481
const char * status_file
Definition options.h:404
unsigned int ssl_flags
Definition options.h:626
bool route_noexec
Definition options.h:430
bool ifconfig_nowarn
Definition options.h:327
const char * remote_cert_eku
Definition options.h:621
in_addr_t ifconfig_pool_netmask
Definition options.h:491
in_addr_t server_netmask
Definition options.h:469
int tls_timeout
Definition options.h:642
bool test_crypto
Definition options.h:586
bool up_delay
Definition options.h:387
bool server_bridge_proxy_dhcp
Definition options.h:479
bool allow_recursive_routing
Definition options.h:720
const char * authname
Definition options.h:579
const char * exit_event_name
Definition options.h:693
const char * ifconfig_ipv6_local
Definition options.h:323
int cf_max
Definition options.h:529
bool dh_file_inline
Definition options.h:598
int replay_window
Definition options.h:583
bool disable
Definition options.h:507
int mute
Definition options.h:398
bool auth_user_pass_verify_script_via_file
Definition options.h:541
const char * dev_type
Definition options.h:317
int persist_mode
Definition options.h:273
int ifconfig_pool_persist_refresh_freq
Definition options.h:493
bool show_digests
Definition options.h:277
const char * up_script
Definition options.h:383
bool single_session
Definition options.h:680
bool push_ifconfig_defined
Definition options.h:513
bool ifconfig_pool_defined
Definition options.h:488
int verify_hash_depth
Definition options.h:624
bool route_delay_defined
Definition options.h:433
const char * packet_id_file
Definition options.h:585
const char * tls_crypt_v2_file
Definition options.h:672
int management_log_history_cache
Definition options.h:449
in_addr_t server_bridge_netmask
Definition options.h:483
const char * ip_remote_hint
Definition options.h:367
bool vlan_tagging
Definition options.h:712
uint32_t peer_id
Definition options.h:702
struct route_option_list * routes
Definition options.h:434
in_addr_t ifconfig_pool_end
Definition options.h:490
int keepalive_timeout
Definition options.h:341
const char * writepid
Definition options.h:382
int64_t inactivity_minimum_bytes
Definition options.h:344
bool ifconfig_ipv6_pool_defined
Definition options.h:495
bool fast_io
Definition options.h:409
unsigned int server_flags
Definition options.h:477
bool block_outside_dns
Definition options.h:697
bool push_ifconfig_ipv6_blocked
Definition options.h:525
bool tls_exit
Definition options.h:684
const char * pkcs12_file
Definition options.h:605
const char * client_disconnect_script
Definition options.h:502
bool show_engines
Definition options.h:278
struct remote_list * remote_list
Definition options.h:291
HANDLE msg_channel
Definition options.h:692
const char * key_pass_file
Definition options.h:275
bool mute_replay_warnings
Definition options.h:582
const char * tls_crypt_file
Definition options.h:667
int inactivity_timeout
Definition options.h:343
int n_bcast_buf
Definition options.h:509
int handshake_window
Definition options.h:652
bool server_defined
Definition options.h:467
const char * ifconfig_local
Definition options.h:321
struct connection_entry ce
Definition options.h:288
struct iroute_ipv6 * iroutes_ipv6
Definition options.h:512
struct push_list push_list
Definition options.h:487
bool user_script_used
Definition options.h:385
const char * tls_groups
Definition options.h:609
bool show_tls_ciphers
Definition options.h:279
struct tuntap_options tuntap_options
Definition options.h:369
int route_method
Definition options.h:696
struct verify_hash_list * verify_hash
Definition options.h:622
const char * tls_cert_profile
Definition options.h:610
int64_t renegotiate_packets
Definition options.h:646
unsigned int management_flags
Definition options.h:459
int push_continuation
Definition options.h:557
const char * route_default_gateway
Definition options.h:427
in_addr_t push_ifconfig_local_alias
Definition options.h:516
struct dns_options dns_options
Definition options.h:312
bool exit_event_initial_state
Definition options.h:694
struct static_challenge_info sc_info
Definition options.h:566
bool auth_token_call_auth
Definition options.h:543
const char * ipchange
Definition options.h:315
int topology
Definition options.h:320
bool disable_dco
Definition options.h:372
const char * ncp_ciphers
Definition options.h:578
bool genkey
Definition options.h:281
const char * learn_address_script
Definition options.h:503
const char * ciphername
Definition options.h:573
const char * auth_user_pass_file
Definition options.h:559
bool forward_compatible
Definition options.h:263
const char * username
Definition options.h:375
int cf_initial_max
Definition options.h:532
int stale_routes_check_interval
Definition options.h:537
struct plugin_option_list * plugin_list
Definition options.h:462
int auth_token_lifetime
Definition options.h:544
uint16_t vlan_pvid
Definition options.h:714
int ns_cert_type
Definition options.h:619
const char * tls_crypt_v2_verify_script
Definition options.h:677
int mode
Definition options.h:260
bool tls_server
Definition options.h:592
const char * auth_user_pass_verify_script
Definition options.h:540
int connect_retry_max
Definition options.h:287
char * bind_dev
Definition options.h:419
const char * extra_certs_file
Definition options.h:601
bool client
Definition options.h:555
bool pull
Definition options.h:556
int ifconfig_ipv6_pool_netbits
Definition options.h:497
in_addr_t push_ifconfig_constraint_netmask
Definition options.h:519
bool show_curves
Definition options.h:280
const char * route_ipv6_default_gateway
Definition options.h:428
bool tls_client
Definition options.h:593
bool ping_timer_remote
Definition options.h:350
bool auth_token_generate
Definition options.h:542
bool priv_key_file_inline
Definition options.h:604
const char * tls_verify
Definition options.h:612
const char * crl_file
Definition options.h:616
int ping_rec_timeout_action
Definition options.h:355
bool auth_user_pass_file_inline
Definition options.h:560
bool show_ciphers
Definition options.h:276
bool enable_ncp_fallback
If defined fall back to ciphername if NCP fails.
Definition options.h:574
int real_hash_size
Definition options.h:499
const char * route_predown_script
Definition options.h:426
const char * dh_file
Definition options.h:597
int route_delay_window
Definition options.h:432
in_addr_t push_ifconfig_local
Definition options.h:514
bool mlock
Definition options.h:338
const char ** ignore_unknown_option
Definition options.h:269
int sndbuf
Definition options.h:415
int foreign_option_index
Definition options.h:689
struct gc_arena gc
Definition options.h:251
bool gc_owned
Definition options.h:252
bool down_pre
Definition options.h:386
bool persist_tun
Definition options.h:357
bool ca_file_inline
Definition options.h:595
bool auth_token_secret_file_inline
Definition options.h:547
bool block_ipv6
Definition options.h:436
const char * config
Definition options.h:255
bool extra_certs_file_inline
Definition options.h:602
bool push_ifconfig_constraint_defined
Definition options.h:517
int mark
Definition options.h:418
int cf_initial_per
Definition options.h:533
bool suppress_timestamps
Definition options.h:394
bool force_key_material_export
Definition options.h:710
bool mtu_test
Definition options.h:332
struct iroute * iroutes
Definition options.h:511
int verify_x509_type
Definition options.h:614
const char * cipher_list_tls13
Definition options.h:608
const char * ecdh_curve
Definition options.h:611
int status_file_update_freq
Definition options.h:406
const char * management_client_user
Definition options.h:453
const char * cipher_list
Definition options.h:607
bool ccd_exclusive
Definition options.h:506
bool allow_deprecated_insecure_static_crypto
Definition options.h:571
struct pull_filter_list * pull_filter_list
Definition options.h:716
const char * management_certificate
Definition options.h:456
const char * genkey_filename
Definition options.h:283
const struct x509_track * x509_track
Definition options.h:686
const char * chroot_dir
Definition options.h:377
bool log
Definition options.h:393
bool shared_secret_file_inline
Definition options.h:570
struct in6_addr push_ifconfig_ipv6_remote
Definition options.h:524
const char * ca_path
Definition options.h:596
int renegotiate_seconds
Definition options.h:647
int ping_rec_timeout
Definition options.h:349
unsigned int sockflags
Definition options.h:422
const char * engine
Definition options.h:580
const char * management_addr
Definition options.h:446
const char * client_connect_script
Definition options.h:501
const char * verify_x509_name
Definition options.h:615
int ping_send_timeout
Definition options.h:348
bool route_gateway_via_dhcp
Definition options.h:438
bool remote_random
Definition options.h:314
bool push_ifconfig_ipv6_defined
Definition options.h:521
int tcp_queue_limit
Definition options.h:510
int route_delay
Definition options.h:431
const char * dev_node
Definition options.h:318
const char * override_username
Definition options.h:508
const char * client_crresponse_script
Definition options.h:504
struct route_ipv6_option_list * routes_ipv6
Definition options.h:435
bool machine_readable_output
Definition options.h:395
int key_direction
Definition options.h:572
bool server_ipv6_defined
Definition options.h:470
const char * priv_key_file
Definition options.h:603
bool persist_remote_ip
Definition options.h:359
bool up_restart
Definition options.h:388
int keepalive_ping
Definition options.h:340
int virtual_hash_size
Definition options.h:500
bool tls_auth_file_inline
Definition options.h:664
bool tls_crypt_v2_file_inline
Definition options.h:673
const char * groupname
Definition options.h:376
in_addr_t server_bridge_pool_start
Definition options.h:484
const char * cd_dir
Definition options.h:378
struct client_nat_option_list * client_nat
Definition options.h:440
struct in6_addr push_ifconfig_ipv6_local
Definition options.h:522
int nice
Definition options.h:396
int max_clients
Definition options.h:535
int transition_window
Definition options.h:660
const char * ifconfig_remote_netmask
Definition options.h:322
const char * lladdr
Definition options.h:319
int verbosity
Definition options.h:397
int session_timeout
Definition options.h:346
const char * cert_file
Definition options.h:599
bool enable_c2c
Definition options.h:526
in_addr_t server_bridge_pool_end
Definition options.h:485
int cf_per
Definition options.h:530
enum tun_driver_type windows_driver
Definition options.h:698
bool cert_file_inline
Definition options.h:600
int remap_sigusr1
Definition options.h:391
int64_t renegotiate_bytes
Definition options.h:645
const char * route_script
Definition options.h:425
in_addr_t ifconfig_pool_start
Definition options.h:489
const char * management_user_pass
Definition options.h:448
unsigned int server_netbits_ipv6
Definition options.h:472
in_addr_t push_ifconfig_remote_netmask
Definition options.h:515
bool occ
Definition options.h:443
in_addr_t server_bridge_ip
Definition options.h:482
const char * shared_secret_file
Definition options.h:569
bool ifconfig_noexec
Definition options.h:326
const char * dev
Definition options.h:316
const char * management_client_group
Definition options.h:454
struct in6_addr ifconfig_ipv6_pool_base
Definition options.h:496
const char * client_config_dir
Definition options.h:505
enum genkey_type genkey_type
Definition options.h:282
const char * ifconfig_pool_persist_filename
Definition options.h:492
int ifconfig_ipv6_netbits
Definition options.h:324
bool persist_local_ip
Definition options.h:358
const char * names[MAX_PARMS]
Definition options.h:213
struct pull_filter * tail
Definition options.c:960
struct pull_filter * head
Definition options.c:959
struct pull_filter * next
Definition options.c:954
char * pattern
Definition options.c:953
Definition pushlist.h:29
struct push_entry * next
Definition pushlist.h:30
bool enable
Definition pushlist.h:31
const char * option
Definition pushlist.h:32
struct push_entry * head
Definition pushlist.h:36
Definition options.h:180
int proto
Definition options.h:183
const char * remote
Definition options.h:181
const char * remote_port
Definition options.h:182
sa_family_t af
Definition options.h:184
struct remote_entry ** array
Definition options.h:207
int capacity
Definition options.h:205
unsigned int flags
Definition route.h:107
unsigned int flags
Definition route.h:94
unsigned int flags
Definition misc.h:96
const char * challenge_text
Definition misc.h:98
int wins_len
Definition tun.h:119
struct in6_addr dns6[N_DHCP_ADDR]
Definition tun.h:143
in_addr_t nbdd[N_DHCP_ADDR]
Definition tun.h:126
int dns_len
Definition tun.h:115
int dns6_len
Definition tun.h:144
in_addr_t ntp[N_DHCP_ADDR]
Definition tun.h:122
int ntp_len
Definition tun.h:123
in_addr_t wins[N_DHCP_ADDR]
Definition tun.h:118
int tap_sleep
Definition tun.h:99
int dhcp_lease_time
Definition tun.h:96
in_addr_t dns[N_DHCP_ADDR]
Definition tun.h:114
const char * netbios_scope
Definition tun.h:107
int nbdd_len
Definition tun.h:127
bool ip_win32_defined
Definition tun.h:79
bool dhcp_masq_custom_offset
Definition tun.h:94
const char * domain
Definition tun.h:105
int domain_search_list_len
Definition tun.h:133
bool dhcp_renew
Definition tun.h:138
const char * domain_search_list[N_SEARCH_LIST_LEN]
Definition tun.h:132
int dhcp_masq_offset
Definition tun.h:95
int netbios_node_type
Definition tun.h:109
int ip_win32_type
Definition tun.h:87
bool dhcp_pre_release
Definition tun.h:139
bool register_dns
Definition tun.h:141
bool disable_nbt
Definition tun.h:136
int dhcp_options
Definition tun.h:103
Definition tun.h:181
struct verify_hash_list * next
Definition options.h:245
uint8_t hash[SHA256_DIGEST_LENGTH]
Definition options.h:244
unsigned short sa_family_t
Definition syshead.h:395
#define sleep(x)
Definition syshead.h:43
struct env_set * es
static bool pkcs11_id_management
struct gc_arena gc
Definition test_ssl.c:155
void ipconfig_register_dns(const struct env_set *es)
Definition tun.c:5356
int dev_type_enum(const char *dev, const char *dev_type)
Definition tun.c:554
bool dhcp_renew_by_adapter_index(const DWORD adapter_index)
Definition tun.c:5290
int ascii2ipset(const char *name)
Definition tun.c:7107
struct tuntap * init_tun(const char *dev, const char *dev_type, int topology, const char *ifconfig_local_parm, const char *ifconfig_remote_netmask_parm, const char *ifconfig_ipv6_local_parm, int ifconfig_ipv6_netbits_parm, const char *ifconfig_ipv6_remote_parm, struct addrinfo *local_public, struct addrinfo *remote_public, const bool strict_warn, struct env_set *es, openvpn_net_ctx_t *ctx, struct tuntap *tt)
Definition tun.c:881
void show_tap_win_adapters(int msglev, int warnlev)
Definition tun.c:4244
void show_adapters(int msglev)
Definition tun.c:5099
bool dhcp_release_by_adapter_index(const DWORD adapter_index)
Definition tun.c:5250
const char * dev_type_string(const char *dev, const char *dev_type)
Definition tun.c:573
void tap_allow_nonadmin_access(const char *dev_node)
Definition tun.c:5148
static bool dhcp_renew(const struct tuntap *tt)
Definition tun.c:5316
const char * ifconfig_options_string(const struct tuntap *tt, bool remote, bool disable, struct gc_arena *gc)
Definition tun.c:740
const char * ipset2ascii_all(struct gc_arena *gc)
Definition tun.c:7136
void show_valid_win32_tun_subnets(void)
Definition tun.c:4211
const char * print_tun_backend_driver(enum tun_driver_type driver)
Return a string representation of the tun backed driver type.
Definition tun.c:59
#define IPW32_SET_NETSH
Definition tun.h:82
#define IPW32_SET_ADAPTIVE
Definition tun.h:85
#define DHCP_OPTIONS_DHCP_REQUIRED
Definition tun.h:75
#define N_SEARCH_LIST_LEN
Definition tun.h:129
#define IPW32_SET_DHCP_MASQ
Definition tun.h:84
#define IPW32_SET_MANUAL
Definition tun.h:81
tun_driver_type
Definition tun.h:45
@ WINDOWS_DRIVER_WINTUN
Definition tun.h:48
@ WINDOWS_DRIVER_UNSPECIFIED
Definition tun.h:46
@ WINDOWS_DRIVER_TAP_WINDOWS6
Definition tun.h:47
@ DRIVER_DCO
Definition tun.h:55
#define IPW32_SET_ADAPTIVE_DELAY_WINDOW
Definition tun.h:70
#define N_DHCP_ADDR
Definition tun.h:111
#define DHCP_OPTIONS_DHCP_OPTIONAL
Definition tun.h:74
const char * win_get_tempdir(void)
Definition win32-util.c:152
void set_win_sys_path(const char *newpath, struct env_set *es)
Definition win32.c:1120
const char * win32_version_string(struct gc_arena *gc)
Get Windows version string with architecture info.
Definition win32.c:1390
void set_pause_exit_win32(void)
Definition win32.c:146