OpenVPN
options.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2023 OpenVPN Inc <sales@openvpn.net>
9  * Copyright (C) 2008-2023 David Sommerseth <dazo@eurephia.org>
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License version 2
13  * as published by the Free Software Foundation.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18  * GNU General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License along
21  * with this program; if not, write to the Free Software Foundation, Inc.,
22  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23  */
24 
25 /*
26  * 2004-01-28: Added Socks5 proxy support
27  * (Christof Meerwald, http://cmeerw.org)
28  */
29 
30 #ifdef HAVE_CONFIG_H
31 #include "config.h"
32 #endif
33 #ifdef HAVE_CONFIG_VERSION_H
34 #include "config-version.h"
35 #endif
36 
37 #include "syshead.h"
38 
39 #include "buffer.h"
40 #include "error.h"
41 #include "common.h"
42 #include "run_command.h"
43 #include "shaper.h"
44 #include "crypto.h"
45 #include "ssl.h"
46 #include "ssl_ncp.h"
47 #include "options.h"
48 #include "misc.h"
49 #include "socket.h"
50 #include "packet_id.h"
51 #include "pkcs11.h"
52 #include "win32.h"
53 #include "push.h"
54 #include "pool.h"
55 #include "proto.h"
56 #include "helper.h"
57 #include "manage.h"
58 #include "forward.h"
59 #include "ssl_verify.h"
60 #include "platform.h"
61 #include "xkey_common.h"
62 #include "dco.h"
63 #include <ctype.h>
64 
65 #include "memdbg.h"
66 
67 const char title_string[] =
69 #ifdef CONFIGURE_GIT_REVISION
70  " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS "]"
71 #endif
72  " " TARGET_ALIAS
73 #if defined(ENABLE_CRYPTO_MBEDTLS)
74  " [SSL (mbed TLS)]"
75 #elif defined(ENABLE_CRYPTO_OPENSSL)
76  " [SSL (OpenSSL)]"
77 #else
78  " [SSL]"
79 #endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
80 #ifdef USE_COMP
81 #ifdef ENABLE_LZO
82  " [LZO]"
83 #endif
84 #ifdef ENABLE_LZ4
85  " [LZ4]"
86 #endif
87 #ifdef ENABLE_COMP_STUB
88  " [COMP_STUB]"
89 #endif
90 #endif /* USE_COMP */
91 #if EPOLL
92  " [EPOLL]"
93 #endif
94 #ifdef PRODUCT_TAP_DEBUG
95  " [TAPDBG]"
96 #endif
97 #ifdef ENABLE_PKCS11
98  " [PKCS11]"
99 #endif
100 #if ENABLE_IP_PKTINFO
101 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
102  " [MH/PKTINFO]"
103 #elif defined(IP_RECVDSTADDR)
104  " [MH/RECVDA]"
105 #endif
106 #endif
107  " [AEAD]"
108 #ifdef ENABLE_DCO
109  " [DCO]"
110 #endif
111 #ifdef CONFIGURE_GIT_REVISION
112  " built on " __DATE__
113 #endif
114 ;
115 
116 #ifndef ENABLE_SMALL
117 
118 static const char usage_message[] =
119  "%s\n"
120  "\n"
121  "General Options:\n"
122  "--config file : Read configuration options from file.\n"
123  "--help : Show options.\n"
124  "--version : Show copyright and version information.\n"
125  "\n"
126  "Tunnel Options:\n"
127  "--local host : Local host name or ip address. Implies --bind.\n"
128  "--remote host [port] : Remote host name or ip address.\n"
129  "--remote-random : If multiple --remote options specified, choose one randomly.\n"
130  "--remote-random-hostname : Add a random string to remote DNS name.\n"
131  "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
132  "--proto p : Use protocol p for communicating with peer.\n"
133  " p = udp (default), tcp-server, tcp-client\n"
134  " udp4, tcp4-server, tcp4-client\n"
135  " udp6, tcp6-server, tcp6-client\n"
136  "--proto-force p : only consider protocol p in list of connection profiles.\n"
137  " p = udp or tcp\n"
138  "--connect-retry n [m] : For client, number of seconds to wait between\n"
139  " connection retries (default=%d). On repeated retries\n"
140  " the wait time is exponentially increased to a maximum of m\n"
141  " (default=%d).\n"
142  "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
143  "--http-proxy s p [up] [auth] : Connect to remote host\n"
144  " through an HTTP proxy at address s and port p.\n"
145  " If proxy authentication is required,\n"
146  " up is a file containing username/password on 2 lines, or\n"
147  " 'stdin' to prompt from console. Add auth='ntlm2' if\n"
148  " the proxy requires NTLM authentication.\n"
149  "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
150  " determine auth method and query for username/password\n"
151  " if needed. auto-nct disables weak proxy auth methods.\n"
152  "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
153  " Repeat to set multiple options.\n"
154  " VERSION version (default=1.0)\n"
155  " AGENT user-agent\n"
156  "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
157  " address s and port p (default port = 1080).\n"
158  " If proxy authentication is required,\n"
159  " up is a file containing username/password on 2 lines, or\n"
160  " 'stdin' to prompt for console.\n"
161  "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
162  "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
163  " resolve for n seconds before failing (disabled by default).\n"
164  " Set n=\"infinite\" to retry indefinitely.\n"
165  "--float : Allow remote to change its IP address/port, such as through\n"
166  " DHCP (this is the default if --remote is not used).\n"
167  "--ipchange cmd : Run command cmd on remote ip address initial\n"
168  " setting or change -- execute as: cmd ip-address port#\n"
169  "--port port : TCP/UDP port # for both local and remote.\n"
170  "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
171  "--rport port : TCP/UDP port # for remote (default=%s).\n"
172  "--bind : Bind to local address and port. (This is the default unless\n"
173  " --proto tcp-client"
174  " or --http-proxy"
175  " or --socks-proxy"
176  " is used).\n"
177  "--nobind : Do not bind to local address and port.\n"
178  "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n"
179  "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
180  " this option only if the tun/tap device used with --dev\n"
181  " does not begin with \"tun\" or \"tap\".\n"
182  "--dev-node node : Explicitly set the device node rather than using\n"
183  " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
184 #if defined(ENABLE_DCO)
185  "--disable-dco : Do not attempt using Data Channel Offload.\n"
186 #endif
187  "--lladdr hw : Set the link layer address of the tap device.\n"
188  "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
189 #ifdef ENABLE_IPROUTE
190  "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
191 #endif
192  "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
193  " endpoint and rn as a remote endpoint. l & rn should be\n"
194  " swapped on the other peer. l & rn must be private\n"
195  " addresses outside of the subnets used by either peer.\n"
196  " TAP: configure device to use IP address l as a local\n"
197  " endpoint and rn as a subnet mask.\n"
198  "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
199  " endpoint (as a /64) and r as remote endpoint\n"
200  "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
201  " pass --ifconfig parms by environment to scripts.\n"
202  "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
203  " connection doesn't match the remote side.\n"
204  "--route network [netmask] [gateway] [metric] :\n"
205  " Add route to routing table after connection\n"
206  " is established. Multiple routes can be specified.\n"
207  " netmask default: 255.255.255.255\n"
208  " gateway default: taken from --route-gateway or --ifconfig\n"
209  " Specify default by leaving blank or setting to \"default\".\n"
210  "--route-ipv6 network/bits [gateway] [metric] :\n"
211  " Add IPv6 route to routing table after connection\n"
212  " is established. Multiple routes can be specified.\n"
213  " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
214  " in --ifconfig-ipv6\n"
215  "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
216  "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
217  "--route-metric m : Specify a default metric for use with --route.\n"
218  "--route-delay n [w] : Delay n seconds after connection initiation before\n"
219  " adding routes (may be 0). If not specified, routes will\n"
220  " be added immediately after tun/tap open. On Windows, wait\n"
221  " up to w seconds for TUN/TAP adapter to come up.\n"
222  "--route-up cmd : Run command cmd after routes are added.\n"
223  "--route-pre-down cmd : Run command cmd before routes are removed.\n"
224  "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
225  " --route-up script using environmental variables.\n"
226  "--route-nopull : When used with --client or --pull, accept options pushed\n"
227  " by server EXCEPT for routes, dns, and dhcp options.\n"
228  "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
229  " --ifconfig, --route, and --route-gateway.\n"
230  "--redirect-gateway [flags]: Automatically execute routing\n"
231  " commands to redirect all outgoing IP traffic through the\n"
232  " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n"
233  " connected via a common subnet, such as with WiFi.\n"
234  " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
235  " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
236  " flag to add a direct route to DHCP server, bypassing tunnel.\n"
237  " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
238  "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
239  " the default gateway. Useful when pushing private subnets.\n"
240  "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
241  " ICMPv6 host unreachable messages on the client.\n"
242  " (Server) Instead of forwarding IPv6 packets send\n"
243  " ICMPv6 host unreachable packets to the client.\n"
244  "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
245  "--push-peer-info : (client only) push client info to server.\n"
246  "--setenv name value : Set a custom environmental variable to pass to script.\n"
247  "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
248  " directives for future OpenVPN versions to be ignored.\n"
249  "--ignore-unknown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
250  " these options to be ignored when unknown\n"
251  "--script-security level: Where level can be:\n"
252  " 0 -- strictly no calling of external programs\n"
253  " 1 -- (default) only call built-ins such as ifconfig\n"
254  " 2 -- allow calling of built-ins and scripts\n"
255  " 3 -- allow password to be passed to scripts via env\n"
256  "--shaper n : Restrict output to peer to n bytes per second.\n"
257  "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
258  " ping once every n seconds, restart if ping not received\n"
259  " for m seconds.\n"
260  "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
261  " produces a combined in/out byte count < bytes.\n"
262  "--session-timeout n: Limit connection time to n seconds.\n"
263  "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
264  "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
265  "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
266  " remote address.\n"
267  "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
268 #if ENABLE_IP_PKTINFO
269  "--multihome : Configure a multi-homed UDP server.\n"
270 #endif
271  "--fast-io : (experimental) Optimize TUN/TAP/UDP writes.\n"
272  "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
273  "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
274  "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
275  "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
276  "--persist-key : Don't re-read key files across SIGUSR1 or --ping-restart.\n"
277 #if PASSTOS_CAPABILITY
278  "--passtos : TOS passthrough (applies to IPv4 only).\n"
279 #endif
280  "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
281  " TCP/UDP MTU from it (default=%d).\n"
282  "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
283  " as n bytes more than the tun-mtu size on read\n"
284  " (default TUN=0 TAP=%d).\n"
285  "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
286  " from it.\n"
287  "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
288  " 'no' -- Never send DF (Don't Fragment) frames\n"
289  " 'maybe' -- Use per-route hints\n"
290  " 'yes' -- Always DF (Don't Fragment)\n"
291  "--mtu-test : Empirically measure and report MTU.\n"
292 #ifdef ENABLE_FRAGMENT
293  "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
294  " datagrams are sent which are larger than max bytes.\n"
295  " Adds 4 bytes of overhead per datagram.\n"
296 #endif
297  "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
298  " or --fragment max value, whichever is lower.\n"
299  "--sndbuf size : Set the TCP/UDP send buffer size.\n"
300  "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
301 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
302  "--mark value : Mark encrypted packets being sent with value. The mark value\n"
303  " can be matched in policy routing and packetfilter rules.\n"
304  "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
305  " listening for connections. This allows sending encrypted packets\n"
306  " via a VRF present on the system.\n"
307 #endif
308  "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
309 #ifdef ENABLE_MEMSTATS
310  "--memstats file : Write live usage stats to memory mapped binary file.\n"
311 #endif
312  "--mlock : Disable Paging -- ensures key material and tunnel\n"
313  " data will never be written to disk.\n"
314  "--up cmd : Run command cmd after successful tun device open.\n"
315  " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
316  " ifconfig-local-ip ifconfig-remote-ip\n"
317  " (pre --user or --group UID/GID change)\n"
318  "--up-delay : Delay tun/tap open and possible --up script execution\n"
319  " until after TCP/UDP connection establishment with peer.\n"
320  "--down cmd : Run command cmd after tun device close.\n"
321  " (post --user/--group UID/GID change and/or --chroot)\n"
322  " (command parameters are same as --up option)\n"
323  "--down-pre : Run --down command before TUN/TAP close.\n"
324  "--up-restart : Run up/down commands for all restarts including those\n"
325  " caused by --ping-restart or SIGUSR1\n"
326  "--user user : Set UID to user after initialization.\n"
327  "--group group : Set GID to group after initialization.\n"
328  "--chroot dir : Chroot to this directory after initialization.\n"
329 #ifdef ENABLE_SELINUX
330  "--setcon context: Apply this SELinux context after initialization.\n"
331 #endif
332  "--cd dir : Change to this directory before initialization.\n"
333  "--daemon [name] : Become a daemon after initialization.\n"
334  " The optional 'name' parameter will be passed\n"
335  " as the program name to the system logger.\n"
336  "--syslog [name] : Output to syslog, but do not become a daemon.\n"
337  " See --daemon above for a description of the 'name' parm.\n"
338  "--log file : Output log to file which is created/truncated on open.\n"
339  "--log-append file : Append log to file, or create file if nonexistent.\n"
340  "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
341  "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
342  "--writepid file : Write main process ID to file.\n"
343  "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
344  "--echo [parms ...] : Echo parameters to log output.\n"
345  "--verb n : Set output verbosity to n (default=%d):\n"
346  " (Level 3 is recommended if you want a good summary\n"
347  " of what's happening without being swamped by output).\n"
348  " : 0 -- no output except fatal errors\n"
349  " : 1 -- startup info + connection initiated messages +\n"
350  " non-fatal encryption & net errors\n"
351  " : 2,3 -- show TLS negotiations & route info\n"
352  " : 4 -- show parameters\n"
353  " : 5 -- show 'RrWw' chars on console for each packet sent\n"
354  " and received from TCP/UDP (caps) or tun/tap (lc)\n"
355  " : 6 to 11 -- debug messages of increasing verbosity\n"
356  "--mute n : Log at most n consecutive messages in the same category.\n"
357  "--status file [n] : Write operational status to file every n seconds.\n"
358  "--status-version [n] : Choose the status file format version number.\n"
359  " Currently, n can be 1, 2, or 3 (default=1).\n"
360  "--disable-occ : (DEPRECATED) Disable options consistency check between peers.\n"
361 #ifdef ENABLE_DEBUG
362  "--gremlin mask : Special stress testing mode (for debugging only).\n"
363 #endif
364 #if defined(USE_COMP)
365  "--compress alg : Use compression algorithm alg\n"
366  "--allow-compression: Specify whether compression should be allowed\n"
367 #if defined(ENABLE_LZO)
368  "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
369  " packet for incompressible data.\n"
370  "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
371  " is specified.\n"
372 #endif
373 #endif
374 #ifdef ENABLE_MANAGEMENT
375  "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
376  " management functions. pass is a password file\n"
377  " or 'stdin' to prompt from console.\n"
378 #if UNIX_SOCK_SUPPORT
379  " To listen on a unix domain socket, specific the pathname\n"
380  " in place of ip and use 'unix' as the port number.\n"
381 #endif
382  "--management-client : Management interface will connect as a TCP client to\n"
383  " ip/port rather than listen as a TCP server.\n"
384  "--management-query-passwords : Query management channel for private key\n"
385  " and auth-user-pass passwords.\n"
386  "--management-query-proxy : Query management channel for proxy information.\n"
387  "--management-query-remote : Query management channel for --remote directive.\n"
388  "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
389  " of the management interface explicitly starts it.\n"
390  "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
391  "--management-forget-disconnect : Forget passwords when management disconnect\n"
392  " event occurs.\n"
393  "--management-up-down : Report tunnel up/down events to management interface.\n"
394  "--management-log-cache n : Cache n lines of log file history for usage\n"
395  " by the management channel.\n"
396 #if UNIX_SOCK_SUPPORT
397  "--management-client-user u : When management interface is a unix socket, only\n"
398  " allow connections from user u.\n"
399  "--management-client-group g : When management interface is a unix socket, only\n"
400  " allow connections from group g.\n"
401 #endif
402  "--management-client-auth : gives management interface client the responsibility\n"
403  " to authenticate clients after their client certificate\n"
404  " has been verified.\n"
405 #endif /* ifdef ENABLE_MANAGEMENT */
406 #ifdef ENABLE_PLUGIN
407  "--plugin m [str]: Load plug-in module m passing str as an argument\n"
408  " to its initialization function.\n"
409 #endif
410  "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
411  "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
412  "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
413  "\n"
414  "Multi-Client Server options (when --mode server is used):\n"
415  "--server network netmask : Helper option to easily configure server mode.\n"
416  "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
417  "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
418  " easily configure ethernet bridging server mode.\n"
419  "--push \"option\" : Push a config file option back to the peer for remote\n"
420  " execution. Peer must specify --pull in its config file.\n"
421  "--push-reset : Don't inherit global push list for specific\n"
422  " client instance.\n"
423  "--push-remove opt : Remove options matching 'opt' from the push list for\n"
424  " a specific client instance.\n"
425  "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
426  " to be dynamically allocated to connecting clients.\n"
427  "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
428  " data to file, at seconds intervals (default=600).\n"
429  " If seconds=0, file will be treated as read-only.\n"
430  "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
431  " to be dynamically allocated to connecting clients.\n"
432  "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
433  " overrides --ifconfig-pool dynamic allocation.\n"
434  " Only valid in a client-specific config file.\n"
435  "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
436  " remote, overrides --ifconfig-ipv6-pool allocation.\n"
437  " Only valid in a client-specific config file.\n"
438  "--iroute network [netmask] : Route subnet to client.\n"
439  "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
440  " Sets up internal routes only.\n"
441  " Only valid in a client-specific config file.\n"
442  "--disable : Client is disabled.\n"
443  " Only valid in a client-specific config file.\n"
444  "--verify-client-cert [none|optional|require] : perform no, optional or\n"
445  " mandatory client certificate verification.\n"
446  " Default is to require the client to supply a certificate.\n"
447  "--username-as-common-name : For auth-user-pass authentication, use\n"
448  " the authenticated username as the common name,\n"
449  " rather than the common name from the client cert.\n"
450  "--auth-user-pass-verify cmd method: Query client for username/password and\n"
451  " run command cmd to verify. If method='via-env', pass\n"
452  " user/pass via environment, if method='via-file', pass\n"
453  " user/pass via temporary file.\n"
454  "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
455  " to each client, replacing the password. Useful when\n"
456  " OTP based two-factor auth mechanisms are in use and\n"
457  " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
458  " for generated tokens can be set.\n"
459  "--opt-verify : (DEPRECATED) Clients that connect with options that are incompatible\n"
460  " with those of the server will be disconnected.\n"
461  "--auth-user-pass-optional : Allow connections by clients that don't\n"
462  " specify a username/password.\n"
463  "--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n"
464  " any printable character.\n"
465  "--client-to-client : Internally route client-to-client traffic.\n"
466  "--duplicate-cn : Allow multiple clients with the same common name to\n"
467  " concurrently connect.\n"
468  "--client-connect cmd : Run command cmd on client connection.\n"
469  "--client-disconnect cmd : Run command cmd on client disconnection.\n"
470  "--client-config-dir dir : Directory for custom client config files.\n"
471  "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
472  "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
473  "--hash-size r v : Set the size of the real address hash table to r and the\n"
474  " virtual address table to v.\n"
475  "--bcast-buffers n : Allocate n broadcast buffers.\n"
476  "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
477  "--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server\n"
478  " as well as pushes it to connecting clients.\n"
479  "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
480  "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
481  "--connect-freq-initial n s : Allow a maximum of n replies for initial connections attempts per s seconds.\n"
482  "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
483  "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
484  "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
485  " older than n seconds. Run this check every t\n"
486  " seconds (defaults to n).\n"
487  "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
488  " clients. n = 1 - reconnect to same server,\n"
489  " 2 - advance to next server, default=1.\n"
490 #if PORT_SHARE
491  "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
492  " sessions to a web server at host:port. dir specifies an\n"
493  " optional directory to write origin IP:port data.\n"
494 #endif
495  "\n"
496  "Client options (when connecting to a multi-client server):\n"
497  "--client : Helper option to easily configure client mode.\n"
498  "--auth-user-pass [up] : Authenticate with server using username/password.\n"
499  " up is a file containing the username on the first line,\n"
500  " and a password on the second. If either the password or both\n"
501  " the username and the password are omitted OpenVPN will prompt\n"
502  " for them from console.\n"
503  "--pull : Accept certain config file options from the peer as if they\n"
504  " were part of the local config file. Must be specified\n"
505  " when connecting to a '--mode server' remote host.\n"
506  "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
507  " server if it starts with the text t. The action flag accept,\n"
508  " ignore or reject causes the option to be allowed, removed or\n"
509  " rejected with error. May be specified multiple times, and\n"
510  " each filter is applied in the order of appearance.\n"
511  "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
512  " Valid options are :\n"
513  " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n"
514  " resolve-domains <domain> [domain ...] : split domains\n"
515  " dnssec <yes|no|optional> : option to use DNSSEC\n"
516  " type <DoH|DoT> : query server over HTTPS / TLS\n"
517  " sni <domain> : DNS server name indication\n"
518  "--dns search-domains <domain> [domain ...]:\n"
519  " Add domains to DNS domain search list\n"
520  "--auth-retry t : How to handle auth failures. Set t to\n"
521  " none (default), interact, or nointeract.\n"
522  "--static-challenge t e : Enable static challenge/response protocol using\n"
523  " challenge text t, with e indicating echo flag (0|1)\n"
524  "--connect-timeout n : when polling possible remote servers to connect to\n"
525  " in a round-robin fashion, spend no more than n seconds\n"
526  " waiting for a response before trying the next server.\n"
527  "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
528  " incoming tun packets with same destination as host.\n"
529  "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
530  " server/remote. n = # of retries, default=1.\n"
531  "\n"
532  "Data Channel Encryption Options (must be compatible between peers):\n"
533  "(These options are meaningful for both Static Key & TLS-mode)\n"
534  "--auth alg : Authenticate packets with HMAC using message\n"
535  " digest algorithm alg (default=%s).\n"
536  " (usually adds 16 or 20 bytes per packet)\n"
537  " Set alg=none to disable authentication.\n"
538  "--cipher alg : Encrypt packets with cipher algorithm alg.\n"
539  " You should usually use --data-ciphers instead.\n"
540  " Set alg=none to disable encryption.\n"
541  "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
542 #ifndef ENABLE_CRYPTO_MBEDTLS
543  "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
544 #endif
545  "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
546  "--replay-window n [t] : Use a replay protection sliding window of size n\n"
547  " and a time window of t seconds.\n"
548  " Default n=%d t=%d\n"
549  "--replay-persist file : Persist replay-protection state across sessions\n"
550  " using file.\n"
551  "--test-crypto : Run a self-test of crypto features enabled.\n"
552  " For debugging only.\n"
553 #ifdef ENABLE_PREDICTION_RESISTANCE
554  "--use-prediction-resistance: Enable prediction resistance on the random\n"
555  " number generator.\n"
556 #endif
557  "\n"
558  "TLS Key Negotiation Options:\n"
559  "(These options are meaningful only for TLS-mode)\n"
560  "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
561  "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
562  "--ca file : Certificate authority file in .pem format containing\n"
563  " root certificate.\n"
564 #ifndef ENABLE_CRYPTO_MBEDTLS
565  "--capath dir : A directory of trusted certificates (CAs"
566  " and CRLs).\n"
567 #endif /* ENABLE_CRYPTO_MBEDTLS */
568  "--dh file : File containing Diffie Hellman parameters\n"
569  " in .pem format (for --tls-server only).\n"
570  " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
571  "--cert file : Local certificate in .pem format -- must be signed\n"
572  " by a Certificate Authority in --ca file.\n"
573  "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
574  "--key file : Local private key in .pem format.\n"
575  "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
576  " will accept from the peer. If version is unrecognized and 'or-highest'\n"
577  " is specified, require max TLS version supported by SSL implementation.\n"
578  "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
579 #ifndef ENABLE_CRYPTO_MBEDTLS
580  "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
581  " and optionally the root CA certificate.\n"
582 #endif
583 #ifdef ENABLE_X509ALTUSERNAME
584  "--x509-username-field : Field in x509 certificate containing the username.\n"
585  " Default is CN in the Subject field.\n"
586 #endif
587  "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
588  " Valid algo flags are SHA1 and SHA256. \n"
589 #ifdef _WIN32
590  "--cryptoapicert select-string : Load the certificate and private key from the\n"
591  " Windows Certificate System Store.\n"
592 #endif
593  "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
594  "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites separated by : (optional)\n"
595  " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
596  "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
597  " (default=legacy).\n"
598  "--providers l : A list l of OpenSSL providers to load.\n"
599  "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
600  " if no ACK from remote within n seconds (default=%d).\n"
601  "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
602  "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
603  "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
604  " and at least min (defaults to 90%% of max on servers and equal\n"
605  " to max on clients).\n"
606  "--hand-window n : Data channel key exchange must finalize within n seconds\n"
607  " of handshake initiation by any peer (default=%d).\n"
608  "--tran-window n : Transition window -- old key can live this many seconds\n"
609  " after new key renegotiation begins (default=%d).\n"
610  "--single-session: Allow only one session (reset state on restart).\n"
611  "--tls-exit : Exit on TLS negotiation failure.\n"
612  "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
613  " control channel to protect against attacks on the TLS stack\n"
614  " and DoS attacks.\n"
615  " f (required) is a shared-secret key file.\n"
616  " The optional d parameter controls key directionality.\n"
617  "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
618  " of the TLS control channel to hide the TLS certificate,\n"
619  " provide basic post-quantum security and protect against\n"
620  " attacks on the TLS stack and DoS attacks.\n"
621  " key (required) provides the pre-shared key file.\n"
622  "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
623  " For servers: use key to decrypt client-specific keys. For\n"
624  " key generation (--genkey tls-crypt-v2-client): use key to\n"
625  " encrypt generated client-specific key. (See --tls-crypt.)\n"
626  "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
627  " fresh tls-crypt-v2 client key, and store to\n"
628  " keyfile. If supplied, include metadata in wrapped key.\n"
629  "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
630  " fresh tls-crypt-v2 server key, and store to keyfile\n"
631  "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
632  " client-supplied tls-crypt-v2 client key\n"
633  "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
634  "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
635  "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
636  "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
637  " pending TLS connection that has otherwise passed all other\n"
638  " tests of certification. cmd should return 0 to allow\n"
639  " TLS handshake to proceed, or 1 to fail. (cmd is\n"
640  " executed as 'cmd certificate_depth subject')\n"
641  "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
642  " DN name. The remote host must also pass all other tests\n"
643  " of verification.\n"
644 #ifndef ENABLE_CRYPTO_MBEDTLS
645  "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
646  " an explicit nsCertType designation t = 'client' | 'server'.\n"
647 #endif
648  "--x509-track x : Save peer X509 attribute x in environment for use by\n"
649  " plugins and management interface.\n"
650 #ifdef HAVE_EXPORT_KEYING_MATERIAL
651  "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
652  " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
653 #endif
654  "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
655  " explicit key usage, you can specify more than one value.\n"
656  " value should be given in hex format.\n"
657  "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
658  " explicit extended key usage. Extended key usage can be encoded\n"
659  " as an object identifier or OpenSSL string representation.\n"
660  "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
661  " key usage and extended key usage based on RFC3280 TLS rules.\n"
662  " t = 'client' | 'server'.\n"
663 #ifdef ENABLE_PKCS11
664  "\n"
665  "PKCS#11 Options:\n"
666  "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
667  "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
668  " path. Set for each provider.\n"
669  "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
670  " 0 : Try to determine automatically (default).\n"
671  " 1 : Use Sign.\n"
672  " 2 : Use SignRecover.\n"
673  " 4 : Use Decrypt.\n"
674  " 8 : Use Unwrap.\n"
675  "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
676  " certificate can be accessed. Set for each provider.\n"
677  "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
678  " cache until token is removed.\n"
679  "--pkcs11-id-management : Acquire identity from management interface.\n"
680  "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
681 #endif /* ENABLE_PKCS11 */
682  "\n"
683  "SSL Library information:\n"
684  "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
685  "--show-digests : Show message digest algorithms to use with --auth option.\n"
686  "--show-engines : Show hardware crypto accelerator engines (if available).\n"
687  "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
688 #ifdef _WIN32
689  "\n"
690  "Windows Specific:\n"
691  "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
692  " from SystemRoot environment variable.\n"
693  "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
694  " IP address using method = manual, netsh, ipapi,\n"
695  " dynamic, or adaptive (default = adaptive).\n"
696  " Dynamic method allows two optional parameters:\n"
697  " offset: DHCP server address offset (> -256 and < 256).\n"
698  " If 0, use network address, if >0, take nth\n"
699  " address forward from network address, if <0,\n"
700  " take nth address backward from broadcast\n"
701  " address.\n"
702  " Default is 0.\n"
703  " lease-time: Lease time in seconds.\n"
704  " Default is one year.\n"
705  "--route-method : Which method to use for adding routes on Windows?\n"
706  " adaptive (default) -- Try ipapi then fall back to exe.\n"
707  " ipapi -- Use IP helper API.\n"
708  " exe -- Call the route.exe shell command.\n"
709  "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
710  " be used with --ip-win32 dynamic. For options\n"
711  " which allow multiple addresses,\n"
712  " --dhcp-option must be repeated.\n"
713  " DOMAIN name : Set DNS suffix\n"
714  " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
715  " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
716  " NTP : Set NTP server address(es)\n"
717  " NBDD : Set NBDD server address(es)\n"
718  " WINS addr : Set WINS server address(es)\n"
719  " NBT type : Set NetBIOS over TCP/IP Node type\n"
720  " 1: B, 2: P, 4: M, 8: H\n"
721  " NBS id : Set NetBIOS scope ID\n"
722  " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
723  "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
724  "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
725  " startup.\n"
726  "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
727  " on connection initiation.\n"
728  "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
729  " attempting to set adapter properties.\n"
730  "--pause-exit : When run from a console window, pause before exiting.\n"
731  "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n"
732  " service, and should not be used directly by end-users.\n"
733  " ex is the name of an event object which, when\n"
734  " signaled, will cause " PACKAGE_NAME " to exit. A second\n"
735  " optional parameter controls the initial state of ex.\n"
736  "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n"
737  " after TAP adapter is up and routes have been added.\n"
738  "--windows-driver : Which tun driver to use?\n"
739  " ovpn-dco (default)\n"
740  " tap-windows6\n"
741  " wintun\n"
742  "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
743  "Windows Standalone Options:\n"
744  "\n"
745  "--show-adapters : Show all TAP-Windows adapters.\n"
746  "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n"
747  "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
748  "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME " running without admin privileges\n"
749  " to access TAP adapter.\n"
750 #endif /* ifdef _WIN32 */
751  "\n"
752  "Generate a new key :\n"
753  "--genkey tls-auth file : Generate a new random key of type and write to file\n"
754  " (for use with --tls-auth or --tls-crypt)."
755 #ifdef ENABLE_FEATURE_TUN_PERSIST
756  "\n"
757  "Tun/tap config mode (available with linux 2.4+):\n"
758  "--mktun : Create a persistent tunnel.\n"
759  "--rmtun : Remove a persistent tunnel.\n"
760  "--dev tunX|tapX : tun/tap device\n"
761  "--dev-type dt : Device type. See tunnel options above for details.\n"
762  "--user user : User to set privilege to.\n"
763  "--group group : Group to set privilege to.\n"
764 #endif
765 #ifdef ENABLE_PKCS11
766  "\n"
767  "PKCS#11 standalone options:\n"
768 #ifdef DEFAULT_PKCS11_MODULE
769  "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
770 #else
771  "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
772 #endif
773  " --verb option can be added *BEFORE* this.\n"
774 #endif /* ENABLE_PKCS11 */
775  "\n"
776  "General Standalone Options:\n"
777 #ifdef ENABLE_DEBUG
778  "--show-gateway : Show info about default gateway.\n"
779 #endif
780 ;
781 
782 #endif /* !ENABLE_SMALL */
783 
784 /*
785  * This is where the options defaults go.
786  * Any option not explicitly set here
787  * will be set to 0.
788  */
789 void
790 init_options(struct options *o, const bool init_gc)
791 {
792  CLEAR(*o);
793  if (init_gc)
794  {
795  gc_init(&o->gc);
796  gc_init(&o->dns_options.gc);
797  o->gc_owned = true;
798  }
800  o->topology = TOP_NET30;
801  o->ce.proto = PROTO_UDP;
802  o->ce.af = AF_UNSPEC;
803  o->ce.bind_ipv6_only = false;
804  o->ce.connect_retry_seconds = 1;
805  o->ce.connect_retry_seconds_max = 300;
806  o->ce.connect_timeout = 120;
807  o->connect_retry_max = 0;
809  o->verbosity = 1;
810  o->status_file_update_freq = 60;
811  o->status_file_version = 1;
812  o->ce.bind_local = true;
814  o->ce.occ_mtu = 0;
817  o->ce.mtu_discover_type = -1;
818  o->ce.mssfix = 0;
819  o->ce.mssfix_default = true;
820  o->ce.mssfix_encap = true;
821  o->route_delay_window = 30;
823  o->resolve_in_advance = false;
824  o->proto_force = -1;
825  o->occ = true;
826 #ifdef ENABLE_MANAGEMENT
830 #endif
831 #ifdef ENABLE_FEATURE_TUN_PERSIST
832  o->persist_mode = 1;
833 #endif
834 #ifdef _WIN32
835 #if 0
837 #else
839 #endif
840  o->tuntap_options.dhcp_lease_time = 31536000; /* one year */
841  o->tuntap_options.dhcp_masq_offset = 0; /* use network address as internal DHCP server address */
843  o->block_outside_dns = false;
845 #endif
846  o->vlan_accept = VLAN_ALL;
847  o->vlan_pvid = 1;
848  o->real_hash_size = 256;
849  o->virtual_hash_size = 256;
850  o->n_bcast_buf = 256;
851  o->tcp_queue_limit = 64;
852  o->max_clients = 1024;
853  o->cf_initial_per = 10;
854  o->cf_initial_max = 100;
855  o->max_routes_per_client = 256;
859  o->authname = "SHA1";
863 #ifdef ENABLE_PREDICTION_RESISTANCE
864  o->use_prediction_resistance = false;
865 #endif
866  o->tls_timeout = 2;
867  o->renegotiate_bytes = -1;
868  o->renegotiate_seconds = 3600;
869  o->renegotiate_seconds_min = -1;
870  o->handshake_window = 60;
871  o->transition_window = 3600;
872  o->tls_cert_profile = NULL;
873  o->ecdh_curve = NULL;
874 #ifdef ENABLE_X509ALTUSERNAME
875  o->x509_username_field[0] = X509_USERNAME_FIELD_DEFAULT;
876 #endif
877 #ifdef ENABLE_PKCS11
878  o->pkcs11_pin_cache_period = -1;
879 #endif /* ENABLE_PKCS11 */
880 
881 /* P2MP server context features */
882  o->auth_token_generate = false;
883 
884  /* Set default --tmp-dir */
885 #ifdef _WIN32
886  /* On Windows, find temp dir via environment variables */
887  o->tmp_dir = win_get_tempdir();
888 
889  if (!o->tmp_dir)
890  {
891  /* Error out if we can't find a valid temporary directory, which should
892  * be very unlikely. */
893  msg(M_USAGE, "Could not find a suitable temporary directory."
894  " (GetTempPath() failed). Consider using --tmp-dir");
895  }
896 #else /* ifdef _WIN32 */
897  /* Non-windows platforms use $TMPDIR, and if not set, default to '/tmp' */
898  o->tmp_dir = getenv("TMPDIR");
899  if (!o->tmp_dir)
900  {
901  o->tmp_dir = "/tmp";
902  }
903 #endif /* _WIN32 */
904  o->allow_recursive_routing = false;
905 
906 #ifndef ENABLE_DCO
907  o->tuntap_options.disable_dco = true;
908 #endif /* ENABLE_DCO */
909 }
910 
911 void
913 {
914  if (o->connection_list)
915  {
916  CLEAR(*o->connection_list);
917  }
918  if (o->remote_list)
919  {
920  CLEAR(*o->remote_list);
921  }
922  if (o->gc_owned)
923  {
924  gc_free(&o->gc);
925  gc_free(&o->dns_options.gc);
926  }
927 }
928 
930 {
931 #define PUF_TYPE_UNDEF 0
932 #define PUF_TYPE_ACCEPT 1
933 #define PUF_TYPE_IGNORE 2
934 #define PUF_TYPE_REJECT 3
935  int type;
936  int size;
937  char *pattern;
938  struct pull_filter *next;
939 };
940 
942 {
943  struct pull_filter *head;
944  struct pull_filter *tail;
945 };
946 
947 #ifndef ENABLE_SMALL
948 
949 static const char *
951 {
952  if (type == PUF_TYPE_ACCEPT)
953  {
954  return "accept";
955  }
956  if (type == PUF_TYPE_IGNORE)
957  {
958  return "ignore";
959  }
960  if (type == PUF_TYPE_REJECT)
961  {
962  return "reject";
963  }
964  else
965  {
966  return "???";
967  }
968 }
969 
970 #define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
971 #define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
972 #define SHOW_STR_INLINE(var) SHOW_PARM(var, \
973  o->var ## _inline ? "[INLINE]" : \
974  (o->var ? o->var : "[UNDEF]"), \
975  "'%s'")
976 #define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
977 #define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
978 #define SHOW_INT64(var) SHOW_PARM(var, o->var, "%" PRIi64)
979 #define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
980 #define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
981 
982 #endif /* ifndef ENABLE_SMALL */
983 
984 static void
986  const struct connection_entry *e,
987  const int i)
988 {
989  setenv_str_i(es, "proto", proto2ascii(e->proto, e->af, false), i);
990  setenv_str_i(es, "local", e->local, i);
991  setenv_str_i(es, "local_port", e->local_port, i);
992  setenv_str_i(es, "remote", e->remote, i);
993  setenv_str_i(es, "remote_port", e->remote_port, i);
994 
995  if (e->http_proxy_options)
996  {
997  setenv_str_i(es, "http_proxy_server", e->http_proxy_options->server, i);
998  setenv_str_i(es, "http_proxy_port", e->http_proxy_options->port, i);
999  }
1000  if (e->socks_proxy_server)
1001  {
1002  setenv_str_i(es, "socks_proxy_server", e->socks_proxy_server, i);
1003  setenv_str_i(es, "socks_proxy_port", e->socks_proxy_port, i);
1004  }
1005 }
1006 
1007 void
1008 setenv_settings(struct env_set *es, const struct options *o)
1009 {
1010  setenv_str(es, "config", o->config);
1011  setenv_int(es, "verb", o->verbosity);
1012  setenv_int(es, "daemon", o->daemon);
1013  setenv_int(es, "daemon_log_redirect", o->log);
1014  setenv_long_long(es, "daemon_start_time", time(NULL));
1015  setenv_int(es, "daemon_pid", platform_getpid());
1016 
1017  if (o->connection_list)
1018  {
1019  int i;
1020  for (i = 0; i < o->connection_list->len; ++i)
1021  {
1023  }
1024  }
1025  else
1026  {
1027  setenv_connection_entry(es, &o->ce, 1);
1028  }
1029 
1030  if (!o->pull)
1031  {
1033  }
1034 }
1035 
1036 #ifndef _WIN32
1037 static void
1038 setenv_foreign_option(struct options *o, const char *argv[], int len, struct env_set *es)
1039 {
1040  if (len > 0)
1041  {
1042  struct gc_arena gc = gc_new();
1043  struct buffer name = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1044  struct buffer value = alloc_buf_gc(OPTION_PARM_SIZE, &gc);
1045  int i;
1046  bool first = true;
1047  bool good = true;
1048 
1049  good &= buf_printf(&name, "foreign_option_%d", o->foreign_option_index + 1);
1050  ++o->foreign_option_index;
1051  for (i = 0; i < len; ++i)
1052  {
1053  if (argv[i])
1054  {
1055  if (!first)
1056  {
1057  good &= buf_printf(&value, " ");
1058  }
1059  good &= buf_printf(&value, "%s", argv[i]);
1060  first = false;
1061  }
1062  }
1063  if (good)
1064  {
1065  setenv_str(es, BSTR(&name), BSTR(&value));
1066  }
1067  else
1068  {
1069  msg(M_WARN, "foreign_option: name/value overflow");
1070  }
1071  gc_free(&gc);
1072  }
1073 }
1074 #endif /* ifndef _WIN32 */
1075 
1076 static in_addr_t
1077 get_ip_addr(const char *ip_string, int msglevel, bool *error)
1078 {
1079  unsigned int flags = GETADDR_HOST_ORDER;
1080  bool succeeded = false;
1081  in_addr_t ret;
1082 
1083  if (msglevel & M_FATAL)
1084  {
1085  flags |= GETADDR_FATAL;
1086  }
1087 
1088  ret = getaddr(flags, ip_string, 0, &succeeded, NULL);
1089  if (!succeeded && error)
1090  {
1091  *error = true;
1092  }
1093  return ret;
1094 }
1095 
1101 static char *
1102 get_ipv6_addr_no_netbits(const char *addr, struct gc_arena *gc)
1103 {
1104  const char *end = strchr(addr, '/');
1105  char *ret = NULL;
1106  if (NULL == end)
1107  {
1108  ret = string_alloc(addr, gc);
1109  }
1110  else
1111  {
1112  size_t len = end - addr;
1113  ret = gc_malloc(len + 1, true, gc);
1114  memcpy(ret, addr, len);
1115  }
1116  return ret;
1117 }
1118 
1119 static bool
1120 ipv6_addr_safe_hexplusbits( const char *ipv6_prefix_spec )
1121 {
1122  struct in6_addr t_addr;
1123  unsigned int t_bits;
1124 
1125  return get_ipv6_addr( ipv6_prefix_spec, &t_addr, &t_bits, M_WARN );
1126 }
1127 
1128 static char *
1129 string_substitute(const char *src, int from, int to, struct gc_arena *gc)
1130 {
1131  char *ret = (char *) gc_malloc(strlen(src) + 1, true, gc);
1132  char *dest = ret;
1133  char c;
1134 
1135  do
1136  {
1137  c = *src++;
1138  if (c == from)
1139  {
1140  c = to;
1141  }
1142  *dest++ = c;
1143  }
1144  while (c);
1145  return ret;
1146 }
1147 
1157 static struct verify_hash_list *
1158 parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
1159 {
1160  int i = 0;
1161  const char *cp = str;
1162 
1163  struct verify_hash_list *ret;
1164  ALLOC_OBJ_CLEAR_GC(ret, struct verify_hash_list, gc);
1165 
1166  char term = 0;
1167  unsigned int byte;
1168 
1169  while (*cp && i < nbytes)
1170  {
1171  /* valid segments consist of exactly two hex digits, then ':' or EOS */
1172  if (!isxdigit(cp[0])
1173  || !isxdigit(cp[1])
1174  || (cp[2] != ':' && cp[2] != '\0')
1175  || sscanf(cp, "%x", &byte) != 1)
1176  {
1177  msg(msglevel, "format error in hash fingerprint: %s", str);
1178  break;
1179  }
1180 
1181  ret->hash[i++] = (uint8_t)byte;
1182 
1183  term = cp[2];
1184  if (term == '\0')
1185  {
1186  break;
1187  }
1188  cp += 3;
1189  }
1190  if (i < nbytes)
1191  {
1192  msg(msglevel, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes, i, str);
1193  }
1194  else if (term != '\0')
1195  {
1196  msg(msglevel, "hash fingerprint too long - expected only %d bytes: %s", nbytes, str);
1197  }
1198  return ret;
1199 }
1200 
1211 static struct verify_hash_list *
1212 parse_hash_fingerprint_multiline(const char *str, int nbytes, int msglevel,
1213  struct gc_arena *gc)
1214 {
1215  struct gc_arena gc_temp = gc_new();
1216  char *lines = string_alloc(str, &gc_temp);
1217 
1218  struct verify_hash_list *ret = NULL;
1219 
1220  const char *line;
1221  while ((line = strsep(&lines, "\n")))
1222  {
1223  /* ignore leading whitespace */
1224  while (isspace(*line))
1225  {
1226  line++;
1227  }
1228  /* skip empty lines and comment lines */
1229  if (strlen(line) == 0 || *line == '#' || *line == ';')
1230  {
1231  continue;
1232  }
1233 
1234  struct verify_hash_list *hash = parse_hash_fingerprint(line, nbytes,
1235  msglevel, gc);
1236 
1237  if (!hash)
1238  {
1239  gc_free(&gc_temp);
1240  return NULL;
1241  }
1242 
1243  hash->next = ret;
1244  ret = hash;
1245  }
1246  gc_free(&gc_temp);
1247 
1248  return ret;
1249 }
1250 #ifdef _WIN32
1251 
1252 #ifndef ENABLE_SMALL
1253 
1254 static void
1255 show_dhcp_option_list(const char *name, const char *const *array, int len)
1256 {
1257  int i;
1258  for (i = 0; i < len; ++i)
1259  {
1260  msg(D_SHOW_PARMS, " %s[%d] = %s", name, i, array[i] );
1261  }
1262 }
1263 
1264 static void
1265 show_dhcp_option_addrs(const char *name, const in_addr_t *array, int len)
1266 {
1267  struct gc_arena gc = gc_new();
1268  int i;
1269  for (i = 0; i < len; ++i)
1270  {
1271  msg(D_SHOW_PARMS, " %s[%d] = %s",
1272  name,
1273  i,
1274  print_in_addr_t(array[i], 0, &gc));
1275  }
1276  gc_free(&gc);
1277 }
1278 
1279 static void
1281 {
1282  SHOW_BOOL(ip_win32_defined);
1283  SHOW_INT(ip_win32_type);
1284  SHOW_INT(dhcp_masq_offset);
1285  SHOW_INT(dhcp_lease_time);
1286  SHOW_INT(tap_sleep);
1287  SHOW_UNSIGNED(dhcp_options);
1289  SHOW_BOOL(dhcp_pre_release);
1290  SHOW_STR(domain);
1291  SHOW_STR(netbios_scope);
1292  SHOW_INT(netbios_node_type);
1293  SHOW_BOOL(disable_nbt);
1294 
1295  show_dhcp_option_addrs("DNS", o->dns, o->dns_len);
1296  show_dhcp_option_addrs("WINS", o->wins, o->wins_len);
1297  show_dhcp_option_addrs("NTP", o->ntp, o->ntp_len);
1298  show_dhcp_option_addrs("NBDD", o->nbdd, o->nbdd_len);
1300 }
1301 
1302 #endif /* ifndef ENABLE_SMALL */
1303 #endif /* ifdef _WIN32 */
1304 
1305 #if defined(_WIN32) || defined(TARGET_ANDROID)
1306 static void
1307 dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel)
1308 {
1309  struct in6_addr addr;
1310  if (*len >= N_DHCP_ADDR)
1311  {
1312  msg(msglevel, "--dhcp-option DNS: maximum of %d IPv6 dns servers can be specified",
1313  N_DHCP_ADDR);
1314  }
1315  else if (get_ipv6_addr(parm, &addr, NULL, msglevel))
1316  {
1317  dns6_list[(*len)++] = addr;
1318  }
1319 }
1320 static void
1321 dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
1322 {
1323  if (*len >= N_DHCP_ADDR)
1324  {
1325  msg(msglevel, "--dhcp-option %s: maximum of %d %s servers can be specified",
1326  name,
1327  N_DHCP_ADDR,
1328  name);
1329  }
1330  else
1331  {
1332  if (ip_addr_dotted_quad_safe(parm)) /* FQDN -- IP address only */
1333  {
1334  bool error = false;
1335  const in_addr_t addr = get_ip_addr(parm, msglevel, &error);
1336  if (!error)
1337  {
1338  array[(*len)++] = addr;
1339  }
1340  }
1341  else
1342  {
1343  msg(msglevel, "dhcp-option parameter %s '%s' must be an IP address", name, parm);
1344  }
1345  }
1346 }
1347 
1348 /*
1349  * If DNS options are set use these for TUN/TAP options as well.
1350  * Applies to DNS, DNS6 and DOMAIN-SEARCH.
1351  * Existing options will be discarded.
1352  */
1353 static void
1355 {
1356  struct tuntap_options *tt = &o->tuntap_options;
1357  struct dns_options *dns = &o->dns_options;
1358 
1359  if (dns->search_domains)
1360  {
1361  tt->domain_search_list_len = 0;
1362  const struct dns_domain *domain = dns->search_domains;
1363  while (domain && tt->domain_search_list_len < N_SEARCH_LIST_LEN)
1364  {
1365  tt->domain_search_list[tt->domain_search_list_len++] = domain->name;
1366  domain = domain->next;
1367  }
1368  if (domain)
1369  {
1370  msg(M_WARN, "WARNING: couldn't copy all --dns search-domains to --dhcp-option");
1371  }
1373  }
1374 
1375  if (dns->servers)
1376  {
1377  tt->dns_len = 0;
1378  tt->dns6_len = 0;
1379  bool overflow = false;
1380  const struct dns_server *server = dns->servers;
1381  while (server)
1382  {
1383  for (int i = 0; i < server->addr_count; ++i)
1384  {
1385  if (server->addr[i].family == AF_INET)
1386  {
1387  if (tt->dns_len >= N_DHCP_ADDR)
1388  {
1389  overflow = true;
1390  continue;
1391  }
1392  tt->dns[tt->dns_len++] = server->addr[i].in.a4.s_addr;
1393  }
1394  else
1395  {
1396  if (tt->dns6_len >= N_DHCP_ADDR)
1397  {
1398  overflow = true;
1399  continue;
1400  }
1401  tt->dns6[tt->dns6_len++] = server->addr[i].in.a6;
1402  }
1403  }
1404  server = server->next;
1405  }
1406  if (overflow)
1407  {
1408  msg(M_WARN, "WARNING: couldn't copy all --dns server addresses to --dhcp-option");
1409  }
1411  }
1412 }
1413 #else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1414 static void
1415 foreign_options_copy_dns(struct options *o, struct env_set *es)
1416 {
1417  const struct dns_domain *domain = o->dns_options.search_domains;
1418  const struct dns_server *server = o->dns_options.servers;
1419  if (!domain && !server)
1420  {
1421  return;
1422  }
1423 
1424  /* reset the index since we're starting all over again */
1425  int opt_max = o->foreign_option_index;
1426  o->foreign_option_index = 0;
1427 
1428  for (int i = 1; i <= opt_max; ++i)
1429  {
1430  char name[32];
1431  openvpn_snprintf(name, sizeof(name), "foreign_option_%d", i);
1432 
1433  const char *env_str = env_set_get(es, name);
1434  const char *value = strchr(env_str, '=') + 1;
1435  if ((domain && strstr(value, "dhcp-option DOMAIN-SEARCH") == value)
1436  || (server && strstr(value, "dhcp-option DNS") == value))
1437  {
1438  setenv_del(es, name);
1439  }
1440  else
1441  {
1442  setenv_foreign_option(o, &value, 1, es);
1443  }
1444  }
1445 
1446  struct gc_arena gc = gc_new();
1447 
1448  while (server)
1449  {
1450  for (int i = 0; i < server->addr_count; ++i)
1451  {
1452  if (server->addr[i].family == AF_INET)
1453  {
1454  const char *argv[] = {
1455  "dhcp-option",
1456  "DNS",
1457  print_in_addr_t(server->addr[i].in.a4.s_addr, 0, &gc)
1458  };
1459  setenv_foreign_option(o, argv, 3, es);
1460  }
1461  else
1462  {
1463  const char *argv[] = {
1464  "dhcp-option",
1465  "DNS6",
1466  print_in6_addr(server->addr[i].in.a6, 0, &gc)
1467  };
1468  setenv_foreign_option(o, argv, 3, es);
1469  }
1470  }
1471  server = server->next;
1472  }
1473  while (domain)
1474  {
1475  const char *argv[] = { "dhcp-option", "DOMAIN-SEARCH", domain->name };
1476  setenv_foreign_option(o, argv, 3, es);
1477  domain = domain->next;
1478  }
1479 
1480  gc_free(&gc);
1481 
1482  /* remove old leftover entries */
1483  while (o->foreign_option_index < opt_max)
1484  {
1485  char name[32];
1486  openvpn_snprintf(name, sizeof(name), "foreign_option_%d", opt_max--);
1487  setenv_del(es, name);
1488  }
1489 }
1490 #endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1491 
1492 #ifndef ENABLE_SMALL
1493 static const char *
1495 {
1496  switch (mode)
1497  {
1498  case VLAN_ONLY_TAGGED:
1499  return "tagged";
1500 
1502  return "untagged";
1503 
1504  case VLAN_ALL:
1505  return "all";
1506  }
1507  return NULL;
1508 }
1509 
1510 static void
1511 show_p2mp_parms(const struct options *o)
1512 {
1513  struct gc_arena gc = gc_new();
1514 
1515  msg(D_SHOW_PARMS, " server_network = %s", print_in_addr_t(o->server_network, 0, &gc));
1516  msg(D_SHOW_PARMS, " server_netmask = %s", print_in_addr_t(o->server_netmask, 0, &gc));
1517  msg(D_SHOW_PARMS, " server_network_ipv6 = %s", print_in6_addr(o->server_network_ipv6, 0, &gc) );
1518  SHOW_INT(server_netbits_ipv6);
1519  msg(D_SHOW_PARMS, " server_bridge_ip = %s", print_in_addr_t(o->server_bridge_ip, 0, &gc));
1520  msg(D_SHOW_PARMS, " server_bridge_netmask = %s", print_in_addr_t(o->server_bridge_netmask, 0, &gc));
1521  msg(D_SHOW_PARMS, " server_bridge_pool_start = %s", print_in_addr_t(o->server_bridge_pool_start, 0, &gc));
1522  msg(D_SHOW_PARMS, " server_bridge_pool_end = %s", print_in_addr_t(o->server_bridge_pool_end, 0, &gc));
1523  if (o->push_list.head)
1524  {
1525  const struct push_entry *e = o->push_list.head;
1526  while (e)
1527  {
1528  if (e->enable)
1529  {
1530  msg(D_SHOW_PARMS, " push_entry = '%s'", e->option);
1531  }
1532  e = e->next;
1533  }
1534  }
1535  SHOW_BOOL(ifconfig_pool_defined);
1536  msg(D_SHOW_PARMS, " ifconfig_pool_start = %s", print_in_addr_t(o->ifconfig_pool_start, 0, &gc));
1537  msg(D_SHOW_PARMS, " ifconfig_pool_end = %s", print_in_addr_t(o->ifconfig_pool_end, 0, &gc));
1538  msg(D_SHOW_PARMS, " ifconfig_pool_netmask = %s", print_in_addr_t(o->ifconfig_pool_netmask, 0, &gc));
1539  SHOW_STR(ifconfig_pool_persist_filename);
1540  SHOW_INT(ifconfig_pool_persist_refresh_freq);
1541  SHOW_BOOL(ifconfig_ipv6_pool_defined);
1542  msg(D_SHOW_PARMS, " ifconfig_ipv6_pool_base = %s", print_in6_addr(o->ifconfig_ipv6_pool_base, 0, &gc));
1543  SHOW_INT(ifconfig_ipv6_pool_netbits);
1544  SHOW_INT(n_bcast_buf);
1545  SHOW_INT(tcp_queue_limit);
1546  SHOW_INT(real_hash_size);
1547  SHOW_INT(virtual_hash_size);
1548  SHOW_STR(client_connect_script);
1550  SHOW_STR(client_disconnect_script);
1551  SHOW_STR(client_crresponse_script);
1552  SHOW_STR(client_config_dir);
1553  SHOW_BOOL(ccd_exclusive);
1554  SHOW_STR(tmp_dir);
1555  SHOW_BOOL(push_ifconfig_defined);
1556  msg(D_SHOW_PARMS, " push_ifconfig_local = %s", print_in_addr_t(o->push_ifconfig_local, 0, &gc));
1557  msg(D_SHOW_PARMS, " push_ifconfig_remote_netmask = %s", print_in_addr_t(o->push_ifconfig_remote_netmask, 0, &gc));
1558  SHOW_BOOL(push_ifconfig_ipv6_defined);
1559  msg(D_SHOW_PARMS, " push_ifconfig_ipv6_local = %s/%d", print_in6_addr(o->push_ifconfig_ipv6_local, 0, &gc), o->push_ifconfig_ipv6_netbits );
1560  msg(D_SHOW_PARMS, " push_ifconfig_ipv6_remote = %s", print_in6_addr(o->push_ifconfig_ipv6_remote, 0, &gc));
1561  SHOW_BOOL(enable_c2c);
1562  SHOW_BOOL(duplicate_cn);
1563  SHOW_INT(cf_max);
1564  SHOW_INT(cf_per);
1565  SHOW_INT(cf_initial_max);
1566  SHOW_INT(cf_initial_per);
1567  SHOW_INT(max_clients);
1568  SHOW_INT(max_routes_per_client);
1569  SHOW_STR(auth_user_pass_verify_script);
1570  SHOW_BOOL(auth_user_pass_verify_script_via_file);
1571  SHOW_BOOL(auth_token_generate);
1572  SHOW_BOOL(force_key_material_export);
1573  SHOW_INT(auth_token_lifetime);
1574  SHOW_STR_INLINE(auth_token_secret_file);
1575 #if PORT_SHARE
1576  SHOW_STR(port_share_host);
1577  SHOW_STR(port_share_port);
1578 #endif
1579  SHOW_BOOL(vlan_tagging);
1580  msg(D_SHOW_PARMS, " vlan_accept = %s", print_vlan_accept(o->vlan_accept));
1581  SHOW_INT(vlan_pvid);
1582 
1583  SHOW_BOOL(client);
1584  SHOW_BOOL(pull);
1585  SHOW_STR_INLINE(auth_user_pass_file);
1586 
1587  gc_free(&gc);
1588 }
1589 
1590 #endif /* ! ENABLE_SMALL */
1591 
1592 static void
1594  const char *network_str,
1595  const char *netmask_str,
1596  int msglevel)
1597 {
1598  struct iroute *ir;
1599 
1600  ALLOC_OBJ_GC(ir, struct iroute, &o->gc);
1601  ir->network = getaddr(GETADDR_HOST_ORDER, network_str, 0, NULL, NULL);
1602  ir->netbits = 32; /* host route if no netmask given */
1603 
1604  if (netmask_str)
1605  {
1606  const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, netmask_str, 0, NULL, NULL);
1607  ir->netbits = netmask_to_netbits2(netmask);
1608 
1609  if (ir->netbits < 0)
1610  {
1611  msg(msglevel, "in --iroute %s %s : Bad network/subnet specification",
1612  network_str,
1613  netmask_str);
1614  return;
1615  }
1616  }
1617 
1618  ir->next = o->iroutes;
1619  o->iroutes = ir;
1620 }
1621 
1622 static void
1624  const char *prefix_str,
1625  int msglevel)
1626 {
1627  struct iroute_ipv6 *ir;
1628 
1629  ALLOC_OBJ_GC(ir, struct iroute_ipv6, &o->gc);
1630 
1631  if (!get_ipv6_addr(prefix_str, &ir->network, &ir->netbits, msglevel ))
1632  {
1633  msg(msglevel, "in --iroute-ipv6 %s: Bad IPv6 prefix specification",
1634  prefix_str);
1635  return;
1636  }
1637 
1638  ir->next = o->iroutes_ipv6;
1639  o->iroutes_ipv6 = ir;
1640 }
1641 
1642 #ifndef ENABLE_SMALL
1643 static void
1645 {
1646  int i;
1647  msg(D_SHOW_PARMS, "BEGIN http_proxy");
1648  SHOW_STR(server);
1649  SHOW_STR(port);
1650  SHOW_STR(auth_method_string);
1651  SHOW_STR(auth_file);
1652  SHOW_STR(auth_file_up);
1653  SHOW_BOOL(inline_creds);
1654  SHOW_STR(http_version);
1655  SHOW_STR(user_agent);
1656  for (i = 0; i < MAX_CUSTOM_HTTP_HEADER && o->custom_headers[i].name; i++)
1657  {
1658  if (o->custom_headers[i].content)
1659  {
1660  msg(D_SHOW_PARMS, " custom_header[%d] = %s: %s", i,
1661  o->custom_headers[i].name, o->custom_headers[i].content);
1662  }
1663  else
1664  {
1665  msg(D_SHOW_PARMS, " custom_header[%d] = %s", i,
1666  o->custom_headers[i].name);
1667  }
1668  }
1669  msg(D_SHOW_PARMS, "END http_proxy");
1670 }
1671 #endif /* ifndef ENABLE_SMALL */
1672 
1673 void
1675 {
1676  gc_detach(&o->gc);
1677  o->routes = NULL;
1678  o->client_nat = NULL;
1679  clone_push_list(o);
1680 }
1681 
1682 void
1684 {
1685  if (!options->routes)
1686  {
1688  }
1689 }
1690 
1691 static void
1693 {
1694  if (!options->routes_ipv6)
1695  {
1697  }
1698 }
1699 
1700 static void
1702 {
1703  if (!options->client_nat)
1704  {
1706  }
1707 }
1708 
1709 #ifndef ENABLE_SMALL
1710 static void
1712 {
1713  msg(D_SHOW_PARMS, " proto = %s", proto2ascii(o->proto, o->af, false));
1714  SHOW_STR(local);
1715  SHOW_STR(local_port);
1716  SHOW_STR(remote);
1717  SHOW_STR(remote_port);
1718  SHOW_BOOL(remote_float);
1719  SHOW_BOOL(bind_defined);
1721  SHOW_BOOL(bind_ipv6_only);
1722  SHOW_INT(connect_retry_seconds);
1723  SHOW_INT(connect_timeout);
1724 
1725  if (o->http_proxy_options)
1726  {
1728  }
1729  SHOW_STR(socks_proxy_server);
1730  SHOW_STR(socks_proxy_port);
1731  SHOW_INT(tun_mtu);
1732  SHOW_BOOL(tun_mtu_defined);
1733  SHOW_INT(link_mtu);
1734  SHOW_BOOL(link_mtu_defined);
1735  SHOW_INT(tun_mtu_extra);
1736  SHOW_BOOL(tun_mtu_extra_defined);
1737  SHOW_INT(tls_mtu);
1738 
1739  SHOW_INT(mtu_discover_type);
1740 
1741 #ifdef ENABLE_FRAGMENT
1742  SHOW_INT(fragment);
1743 #endif
1744  SHOW_INT(mssfix);
1745  SHOW_BOOL(mssfix_encap);
1746  SHOW_BOOL(mssfix_fixed);
1747 
1748  SHOW_INT(explicit_exit_notification);
1749 
1750  SHOW_STR_INLINE(tls_auth_file);
1751  SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true),
1752  "%s");
1753  SHOW_STR_INLINE(tls_crypt_file);
1754  SHOW_STR_INLINE(tls_crypt_v2_file);
1755 }
1756 
1757 
1758 static void
1760 {
1761  if (o->connection_list)
1762  {
1763  const struct connection_list *l = o->connection_list;
1764  int i;
1765  for (i = 0; i < l->len; ++i)
1766  {
1767  msg(D_SHOW_PARMS, "Connection profiles [%d]:", i);
1769  }
1770  }
1771  else
1772  {
1773  msg(D_SHOW_PARMS, "Connection profiles [default]:");
1775  }
1776  msg(D_SHOW_PARMS, "Connection profiles END");
1777 }
1778 
1779 static void
1781 {
1782  struct pull_filter *f;
1783  if (!l)
1784  {
1785  return;
1786  }
1787 
1788  msg(D_SHOW_PARMS, " Pull filters:");
1789  for (f = l->head; f; f = f->next)
1790  {
1791  msg(D_SHOW_PARMS, " %s \"%s\"", pull_filter_type_name(f->type), f->pattern);
1792  }
1793 }
1794 
1795 #endif /* ifndef ENABLE_SMALL */
1796 
1797 void
1798 show_settings(const struct options *o)
1799 {
1800 #ifndef ENABLE_SMALL
1801  msg(D_SHOW_PARMS, "Current Parameter Settings:");
1802 
1803  SHOW_STR(config);
1804 
1805  SHOW_INT(mode);
1806 
1807 #ifdef ENABLE_FEATURE_TUN_PERSIST
1808  SHOW_BOOL(persist_config);
1809  SHOW_INT(persist_mode);
1810 #endif
1811 
1812  SHOW_BOOL(show_ciphers);
1813  SHOW_BOOL(show_digests);
1814  SHOW_BOOL(show_engines);
1815  SHOW_BOOL(genkey);
1816  SHOW_STR(genkey_filename);
1817  SHOW_STR(key_pass_file);
1818  SHOW_BOOL(show_tls_ciphers);
1819 
1820  SHOW_INT(connect_retry_max);
1822 
1823  SHOW_BOOL(remote_random);
1824 
1825  SHOW_STR(ipchange);
1826  SHOW_STR(dev);
1827  SHOW_STR(dev_type);
1828  SHOW_STR(dev_node);
1829 #if defined(ENABLE_DCO)
1831 #endif
1832  SHOW_STR(lladdr);
1833  SHOW_INT(topology);
1834  SHOW_STR(ifconfig_local);
1835  SHOW_STR(ifconfig_remote_netmask);
1836  SHOW_BOOL(ifconfig_noexec);
1837  SHOW_BOOL(ifconfig_nowarn);
1838  SHOW_STR(ifconfig_ipv6_local);
1839  SHOW_INT(ifconfig_ipv6_netbits);
1840  SHOW_STR(ifconfig_ipv6_remote);
1841 
1842  SHOW_INT(shaper);
1843  SHOW_INT(mtu_test);
1844 
1845  SHOW_BOOL(mlock);
1846 
1847  SHOW_INT(keepalive_ping);
1848  SHOW_INT(keepalive_timeout);
1849  SHOW_INT(inactivity_timeout);
1850  SHOW_INT(session_timeout);
1851  SHOW_INT64(inactivity_minimum_bytes);
1852  SHOW_INT(ping_send_timeout);
1853  SHOW_INT(ping_rec_timeout);
1854  SHOW_INT(ping_rec_timeout_action);
1855  SHOW_BOOL(ping_timer_remote);
1856  SHOW_INT(remap_sigusr1);
1857  SHOW_BOOL(persist_tun);
1858  SHOW_BOOL(persist_local_ip);
1859  SHOW_BOOL(persist_remote_ip);
1860  SHOW_BOOL(persist_key);
1861 
1862 #if PASSTOS_CAPABILITY
1863  SHOW_BOOL(passtos);
1864 #endif
1865 
1866  SHOW_INT(resolve_retry_seconds);
1867  SHOW_BOOL(resolve_in_advance);
1868 
1869  SHOW_STR(username);
1870  SHOW_STR(groupname);
1871  SHOW_STR(chroot_dir);
1872  SHOW_STR(cd_dir);
1873 #ifdef ENABLE_SELINUX
1874  SHOW_STR(selinux_context);
1875 #endif
1876  SHOW_STR(writepid);
1877  SHOW_STR(up_script);
1878  SHOW_STR(down_script);
1879  SHOW_BOOL(down_pre);
1880  SHOW_BOOL(up_restart);
1881  SHOW_BOOL(up_delay);
1882  SHOW_BOOL(daemon);
1883  SHOW_BOOL(log);
1886  SHOW_INT(nice);
1887  SHOW_INT(verbosity);
1888  SHOW_INT(mute);
1889 #ifdef ENABLE_DEBUG
1890  SHOW_INT(gremlin);
1891 #endif
1892  SHOW_STR(status_file);
1893  SHOW_INT(status_file_version);
1894  SHOW_INT(status_file_update_freq);
1895 
1896  SHOW_BOOL(occ);
1897  SHOW_INT(rcvbuf);
1898  SHOW_INT(sndbuf);
1899 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
1900  SHOW_INT(mark);
1901 #endif
1902  SHOW_INT(sockflags);
1903 
1904  SHOW_BOOL(fast_io);
1905 
1906  SHOW_INT(comp.alg);
1907  SHOW_INT(comp.flags);
1908 
1909  SHOW_STR(route_script);
1910  SHOW_STR(route_default_gateway);
1911  SHOW_INT(route_default_metric);
1912  SHOW_BOOL(route_noexec);
1913  SHOW_INT(route_delay);
1914  SHOW_INT(route_delay_window);
1915  SHOW_BOOL(route_delay_defined);
1916  SHOW_BOOL(route_nopull);
1917  SHOW_BOOL(route_gateway_via_dhcp);
1918  SHOW_BOOL(allow_pull_fqdn);
1920 
1921  if (o->routes)
1922  {
1924  }
1925 
1926  if (o->client_nat)
1927  {
1929  }
1930 
1932 
1933 #ifdef ENABLE_MANAGEMENT
1934  SHOW_STR(management_addr);
1935  SHOW_STR(management_port);
1936  SHOW_STR(management_user_pass);
1937  SHOW_INT(management_log_history_cache);
1938  SHOW_INT(management_echo_buffer_size);
1939  SHOW_STR(management_client_user);
1940  SHOW_STR(management_client_group);
1941  SHOW_INT(management_flags);
1942 #endif
1943 #ifdef ENABLE_PLUGIN
1944  if (o->plugin_list)
1945  {
1947  }
1948 #endif
1949 
1950  SHOW_STR_INLINE(shared_secret_file);
1951  SHOW_PARM(key_direction, keydirection2ascii(o->key_direction, false, true), "%s");
1952  SHOW_STR(ciphername);
1953  SHOW_STR(ncp_ciphers);
1954  SHOW_STR(authname);
1955 #ifndef ENABLE_CRYPTO_MBEDTLS
1956  SHOW_BOOL(engine);
1957 #endif /* ENABLE_CRYPTO_MBEDTLS */
1958  SHOW_BOOL(mute_replay_warnings);
1959  SHOW_INT(replay_window);
1960  SHOW_INT(replay_time);
1961  SHOW_STR(packet_id_file);
1963 #ifdef ENABLE_PREDICTION_RESISTANCE
1964  SHOW_BOOL(use_prediction_resistance);
1965 #endif
1966 
1967  SHOW_BOOL(tls_server);
1968  SHOW_BOOL(tls_client);
1969  SHOW_STR_INLINE(ca_file);
1970  SHOW_STR(ca_path);
1971  SHOW_STR_INLINE(dh_file);
1973  {
1974  SHOW_PARM("cert_file", "EXTERNAL_CERT", "%s");
1975  }
1976  else
1977  {
1978  SHOW_STR_INLINE(cert_file);
1979  }
1980  SHOW_STR_INLINE(extra_certs_file);
1981 
1982  if ((o->management_flags & MF_EXTERNAL_KEY))
1983  {
1984  SHOW_PARM("priv_key_file", "EXTERNAL_PRIVATE_KEY", "%s");
1985  }
1986  else
1987  {
1988  SHOW_STR_INLINE(priv_key_file);
1989  }
1990 #ifndef ENABLE_CRYPTO_MBEDTLS
1991  SHOW_STR_INLINE(pkcs12_file);
1992 #endif
1993 #ifdef ENABLE_CRYPTOAPI
1994  SHOW_STR(cryptoapi_cert);
1995 #endif
1996  SHOW_STR(cipher_list);
1997  SHOW_STR(cipher_list_tls13);
1998  SHOW_STR(tls_cert_profile);
2000  SHOW_STR(tls_export_peer_cert_dir);
2001  SHOW_INT(verify_x509_type);
2002  SHOW_STR(verify_x509_name);
2003  SHOW_STR_INLINE(crl_file);
2004  SHOW_INT(ns_cert_type);
2005  {
2006  int i;
2007  for (i = 0; i<MAX_PARMS; i++)
2008  {
2009  SHOW_INT(remote_cert_ku[i]);
2010  }
2011  }
2012  SHOW_STR(remote_cert_eku);
2013  if (o->verify_hash)
2014  {
2015  SHOW_INT(verify_hash_algo);
2016  SHOW_INT(verify_hash_depth);
2017  struct gc_arena gc = gc_new();
2018  struct verify_hash_list *hl = o->verify_hash;
2019  int digest_len = (o->verify_hash_algo == MD_SHA1) ? SHA_DIGEST_LENGTH :
2021  while (hl)
2022  {
2023  char *s = format_hex_ex(hl->hash, digest_len, 0,
2024  1, ":", &gc);
2025  SHOW_PARM(verify_hash, s, "%s");
2026  hl = hl->next;
2027  }
2028  gc_free(&gc);
2029  }
2030  SHOW_INT(ssl_flags);
2031 
2032  SHOW_INT(tls_timeout);
2033 
2034  SHOW_INT(renegotiate_bytes);
2035  SHOW_INT(renegotiate_packets);
2036  SHOW_INT(renegotiate_seconds);
2037 
2038  SHOW_INT(handshake_window);
2039  SHOW_INT(transition_window);
2040 
2041  SHOW_BOOL(single_session);
2043  SHOW_BOOL(tls_exit);
2044 
2045  SHOW_STR(tls_crypt_v2_metadata);
2046 
2047 #ifdef ENABLE_PKCS11
2048  {
2049  int i;
2050  for (i = 0; i<MAX_PARMS && o->pkcs11_providers[i] != NULL; i++)
2051  {
2052  SHOW_PARM(pkcs11_providers, o->pkcs11_providers[i], "%s");
2053  }
2054  }
2055  {
2056  int i;
2057  for (i = 0; i<MAX_PARMS; i++)
2058  {
2059  SHOW_PARM(pkcs11_protected_authentication, o->pkcs11_protected_authentication[i] ? "ENABLED" : "DISABLED", "%s");
2060  }
2061  }
2062  {
2063  int i;
2064  for (i = 0; i<MAX_PARMS; i++)
2065  {
2066  SHOW_PARM(pkcs11_private_mode, o->pkcs11_private_mode[i], "%08x");
2067  }
2068  }
2069  {
2070  int i;
2071  for (i = 0; i<MAX_PARMS; i++)
2072  {
2073  SHOW_PARM(pkcs11_cert_private, o->pkcs11_cert_private[i] ? "ENABLED" : "DISABLED", "%s");
2074  }
2075  }
2076  SHOW_INT(pkcs11_pin_cache_period);
2077  SHOW_STR(pkcs11_id);
2079 #endif /* ENABLE_PKCS11 */
2080 
2081  show_p2mp_parms(o);
2082 
2083 #ifdef _WIN32
2084  SHOW_BOOL(show_net_up);
2085  SHOW_INT(route_method);
2086  SHOW_BOOL(block_outside_dns);
2088 #endif
2089 #endif /* ifndef ENABLE_SMALL */
2090 }
2091 
2092 #undef SHOW_PARM
2093 #undef SHOW_STR
2094 #undef SHOW_INT
2095 #undef SHOW_BOOL
2096 
2097 #ifdef ENABLE_MANAGEMENT
2098 
2099 static struct http_proxy_options *
2101  const char *port,
2102  const char *flags,
2103  const int msglevel,
2104  struct gc_arena *gc)
2105 {
2106  if (server && port)
2107  {
2108  struct http_proxy_options *ho;
2109  ALLOC_OBJ_CLEAR_GC(ho, struct http_proxy_options, gc);
2110  ho->server = string_alloc(server, gc);
2111  ho->port = port;
2112  if (flags && !strcmp(flags, "nct"))
2113  {
2114  ho->auth_retry = PAR_NCT;
2115  }
2116  else
2117  {
2118  ho->auth_retry = PAR_ALL;
2119  }
2120  ho->http_version = "1.0";
2121  ho->user_agent = "OpenVPN-Autoproxy/1.0";
2122  return ho;
2123  }
2124  else
2125  {
2126  return NULL;
2127  }
2128 }
2129 
2130 static void
2132 {
2133  const struct connection_list *l = o->connection_list;
2134  int i;
2135  bool succeed = false;
2136  for (i = 0; i < l->len; ++i)
2137  {
2138  struct connection_entry *ce = l->array[i];
2139  if (ce->proto == PROTO_TCP_CLIENT || ce->proto == PROTO_TCP)
2140  {
2142  succeed = true;
2143  }
2144  }
2145  if (succeed)
2146  {
2147  for (i = 0; i < l->len; ++i)
2148  {
2149  struct connection_entry *ce = l->array[i];
2150  if (ce->proto == PROTO_UDP)
2151  {
2152  ce->flags |= CE_DISABLED;
2153  }
2154  }
2155  }
2156  else
2157  {
2158  msg(M_WARN, "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
2159  }
2160 }
2161 
2162 #endif /* ifdef ENABLE_MANAGEMENT */
2163 
2164 static struct connection_list *
2166 {
2167  if (!options->connection_list)
2168  {
2170  }
2171  return options->connection_list;
2172 }
2173 
2174 static struct connection_entry *
2175 alloc_connection_entry(struct options *options, const int msglevel)
2176 {
2178  struct connection_entry *e;
2179 
2180  if (l->len == l->capacity)
2181  {
2182  int capacity = l->capacity + CONNECTION_LIST_SIZE;
2183  struct connection_entry **ce = gc_realloc(l->array, capacity*sizeof(struct connection_entry *), &options->gc);
2184  if (ce == NULL)
2185  {
2186  msg(msglevel, "Unable to process more connection options: out of memory. Number of entries = %d", l->len);
2187  return NULL;
2188  }
2189  l->array = ce;
2190  l->capacity = capacity;
2191  }
2192  ALLOC_OBJ_GC(e, struct connection_entry, &options->gc);
2193  l->array[l->len++] = e;
2194  return e;
2195 }
2196 
2197 static struct remote_list *
2199 {
2200  if (!options->remote_list)
2201  {
2203  }
2204  return options->remote_list;
2205 }
2206 
2207 static struct remote_entry *
2208 alloc_remote_entry(struct options *options, const int msglevel)
2209 {
2211  struct remote_entry *e;
2212 
2213  if (l->len == l->capacity)
2214  {
2215  int capacity = l->capacity + CONNECTION_LIST_SIZE;
2216  struct remote_entry **re = gc_realloc(l->array, capacity*sizeof(struct remote_entry *), &options->gc);
2217  if (re == NULL)
2218  {
2219  msg(msglevel, "Unable to process more remote options: out of memory. Number of entries = %d", l->len);
2220  return NULL;
2221  }
2222  l->array = re;
2223  l->capacity = capacity;
2224  }
2225  ALLOC_OBJ_GC(e, struct remote_entry, &options->gc);
2226  l->array[l->len++] = e;
2227  return e;
2228 }
2229 
2230 static struct pull_filter_list *
2232 {
2233  if (!o->pull_filter_list)
2234  {
2236  }
2237  return o->pull_filter_list;
2238 }
2239 
2240 static struct pull_filter *
2241 alloc_pull_filter(struct options *o, const int msglevel)
2242 {
2244  struct pull_filter *f;
2245 
2246  ALLOC_OBJ_CLEAR_GC(f, struct pull_filter, &o->gc);
2247  if (l->head)
2248  {
2249  ASSERT(l->tail);
2250  l->tail->next = f;
2251  }
2252  else
2253  {
2254  ASSERT(!l->tail);
2255  l->head = f;
2256  }
2257  l->tail = f;
2258  return f;
2259 }
2260 
2261 static void
2263 {
2264  if (re->remote)
2265  {
2266  ce->remote = re->remote;
2267  }
2268  if (re->remote_port)
2269  {
2270  ce->remote_port = re->remote_port;
2271  }
2272  if (re->proto >= 0)
2273  {
2274  ce->proto = re->proto;
2275  }
2276  if (re->af > 0)
2277  {
2278  ce->af = re->af;
2279  }
2280 }
2281 
2282 static void
2283 connection_entry_preload_key(const char **key_file, bool *key_inline,
2284  struct gc_arena *gc)
2285 {
2286  if (key_file && *key_file && !(*key_inline))
2287  {
2288  struct buffer in = buffer_read_from_file(*key_file, gc);
2289  if (!buf_valid(&in))
2290  {
2291  msg(M_FATAL, "Cannot pre-load keyfile (%s)", *key_file);
2292  }
2293 
2294  *key_file = (const char *) in.data;
2295  *key_inline = true;
2296  }
2297 }
2298 
2299 static void
2301 {
2303  || options->pkcs12_file
2304  || options->ca_file
2305 #ifndef ENABLE_CRYPTO_MBEDTLS
2306  || options->ca_path
2307 #endif
2308  )
2309  {
2310  return;
2311  }
2312 
2313  const char *const str = "You must define CA file (--ca)"
2314 #ifndef ENABLE_CRYPTO_MBEDTLS
2315  " or CA path (--capath)"
2316 #endif
2317  " and/or peer fingerprint verification (--peer-fingerprint)";
2318  msg(M_USAGE, "%s", str);
2319 }
2320 
2321 static void
2323  const struct connection_entry *ce)
2324 {
2325  struct options defaults;
2326  int dev = DEV_TYPE_UNDEF;
2327  bool pull = false;
2328 
2329  init_options(&defaults, true);
2330 
2331  if (options->test_crypto)
2332  {
2333  notnull(options->shared_secret_file, "key file (--secret)");
2334  }
2335  else
2336  {
2337  notnull(options->dev, "TUN/TAP device (--dev)");
2338  }
2339 
2340  /*
2341  * Get tun/tap/null device type
2342  */
2344 
2345  /*
2346  * If "proto tcp" is specified, make sure we know whether it is
2347  * tcp-client or tcp-server.
2348  */
2349  if (ce->proto == PROTO_TCP)
2350  {
2351  msg(M_USAGE,
2352  "--proto tcp is ambiguous in this context. Please specify "
2353  "--proto tcp-server or --proto tcp-client");
2354  }
2355 
2356  if (options->lladdr && dev != DEV_TYPE_TAP)
2357  {
2358  msg(M_USAGE, "--lladdr can only be used in --dev tap mode");
2359  }
2360 
2361  /*
2362  * Sanity check on MTU parameters
2363  */
2365  {
2366  msg(M_USAGE, "only one of --tun-mtu or --link-mtu may be defined");
2367  }
2368 
2369  if (!proto_is_udp(ce->proto) && options->mtu_test)
2370  {
2371  msg(M_USAGE, "--mtu-test only makes sense with --proto udp");
2372  }
2373 
2374  /* will we be pulling options from server? */
2375  pull = options->pull;
2376 
2377  /*
2378  * Sanity check on --local, --remote, and --ifconfig
2379  */
2380 
2381  if (proto_is_net(ce->proto)
2384  {
2385  msg(M_USAGE, "--remote and --local addresses are the same");
2386  }
2387 
2390  {
2391  msg(M_USAGE,
2392  "--local and --remote addresses must be distinct from --ifconfig "
2393  "addresses");
2394  }
2395 
2398  {
2399  msg(M_USAGE,
2400  "--local addresses must be distinct from --ifconfig addresses");
2401  }
2402 
2405  {
2406  msg(M_USAGE,
2407  "local and remote/netmask --ifconfig addresses must be different");
2408  }
2409 
2410  if (ce->bind_defined && !ce->bind_local)
2411  {
2412  msg(M_USAGE, "--bind and --nobind can't be used together");
2413  }
2414 
2415  if (ce->local && !ce->bind_local)
2416  {
2417  msg(M_USAGE,
2418  "--local and --nobind don't make sense when used together");
2419  }
2420 
2421  if (ce->local_port_defined && !ce->bind_local)
2422  {
2423  msg(M_USAGE,
2424  "--lport and --nobind don't make sense when used together");
2425  }
2426 
2427  if (!ce->remote && !ce->bind_local)
2428  {
2429  msg(M_USAGE, "--nobind doesn't make sense unless used with --remote");
2430  }
2431 
2432  /*
2433  * Check for consistency of management options
2434  */
2435 #ifdef ENABLE_MANAGEMENT
2436  if (!options->management_addr
2439  {
2440  msg(M_USAGE, "--management is not specified, however one or more options which modify the behavior of --management were specified");
2441  }
2442 
2445  {
2446  msg(M_USAGE, "--management-client-(user|group) can only be used on unix domain sockets");
2447  }
2448 
2452  {
2453  msg(M_WARN, "WARNING: Using --management on a TCP port WITHOUT "
2454  "passwords is STRONGLY discouraged and considered insecure");
2455  }
2456 
2457 #endif /* ifdef ENABLE_MANAGEMENT */
2458 
2459 #if !defined(HAVE_XKEY_PROVIDER)
2460  if ((tls_version_max() >= TLS_VER_1_3)
2463  )
2464  {
2465  msg(M_FATAL, "management-external-key with TLS 1.3 or later requires "
2466  "nopadding argument/support");
2467  }
2468 #endif
2469  /*
2470  * Windows-specific options.
2471  */
2472 
2473 #ifdef _WIN32
2475  {
2476  msg(M_USAGE, "On Windows, --ifconfig is required when --dev tun is used");
2477  }
2478 
2481  {
2482  msg(M_USAGE, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
2483  }
2484 
2486  {
2487  const char *prefix = "Some --dhcp-option or --dns options require DHCP server";
2489  {
2490  msg(M_USAGE, "%s, which is not supported by the selected %s driver",
2492  }
2495  {
2496  msg(M_USAGE, "%s, which requires --ip-win32 dynamic or adaptive",
2497  prefix);
2498  }
2499  }
2500 
2502  {
2503  msg(M_USAGE, "--windows-driver wintun requires --dev tun");
2504  }
2505 #endif /* ifdef _WIN32 */
2506 
2507  /*
2508  * Check that protocol options make sense.
2509  */
2510 
2511 #ifdef ENABLE_FRAGMENT
2512  if (!proto_is_udp(ce->proto) && ce->fragment)
2513  {
2514  msg(M_USAGE, "--fragment can only be used with --proto udp");
2515  }
2516 #endif
2517 
2518  if (!ce->remote && ce->proto == PROTO_TCP_CLIENT)
2519  {
2520  msg(M_USAGE, "--remote MUST be used in TCP Client mode");
2521  }
2522 
2524  {
2525  msg(M_USAGE,
2526  "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
2527  "tcp-client)");
2528  }
2529 
2531  {
2532  msg(M_USAGE,
2533  "--http-proxy not specified but other http proxy options present");
2534  }
2535 
2537  {
2538  msg(M_USAGE,
2539  "--http-proxy can not be used together with --socks-proxy");
2540  }
2541 
2543  {
2544  msg(M_USAGE, "--socks-proxy can not be used in TCP Server mode");
2545  }
2546 
2547  if (ce->proto == PROTO_TCP_SERVER && (options->connection_list->len > 1))
2548  {
2549  msg(M_USAGE, "TCP server mode allows at most one --remote address");
2550  }
2551 
2552  /*
2553  * Check consistency of --mode server options.
2554  */
2555  if (options->mode == MODE_SERVER)
2556  {
2557 #define USAGE_VALID_SERVER_PROTOS "--mode server currently only supports " \
2558  "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
2559 #ifdef TARGET_ANDROID
2560  msg(M_FATAL, "--mode server not supported on Android");
2561 #endif
2562  if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP))
2563  {
2564  msg(M_USAGE, "--mode server only works with --dev tun or --dev tap");
2565  }
2566  if (options->pull)
2567  {
2568  msg(M_USAGE, "--pull cannot be used with --mode server");
2569  }
2571  {
2572  msg(M_WARN, "--pull-filter ignored for --mode server");
2573  }
2574  if (!(proto_is_udp(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2575  {
2577  }
2578 #if PORT_SHARE
2579  if ((options->port_share_host || options->port_share_port)
2580  && (ce->proto != PROTO_TCP_SERVER))
2581  {
2582  msg(M_USAGE, "--port-share only works in TCP server mode "
2583  "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
2584  }
2585 #endif
2586  if (!options->tls_server)
2587  {
2588  msg(M_USAGE, "--mode server requires --tls-server");
2589  }
2590  if (ce->remote)
2591  {
2592  msg(M_USAGE, "--remote cannot be used with --mode server");
2593  }
2594  if (!ce->bind_local)
2595  {
2596  msg(M_USAGE, "--nobind cannot be used with --mode server");
2597  }
2598  if (ce->http_proxy_options)
2599  {
2600  msg(M_USAGE, "--http-proxy cannot be used with --mode server");
2601  }
2602  if (ce->socks_proxy_server)
2603  {
2604  msg(M_USAGE, "--socks-proxy cannot be used with --mode server");
2605  }
2606  /* <connection> blocks force to have a remote embedded, so we check
2607  * for the --remote and bail out if it is present
2608  */
2609  if (options->connection_list->len >1
2611  {
2612  msg(M_USAGE, "<connection> cannot be used with --mode server");
2613  }
2614 
2615  if (options->shaper)
2616  {
2617  msg(M_USAGE, "--shaper cannot be used with --mode server");
2618  }
2619  if (options->ipchange)
2620  {
2621  msg(M_USAGE,
2622  "--ipchange cannot be used with --mode server (use "
2623  "--client-connect instead)");
2624  }
2625  if (!(proto_is_dgram(ce->proto) || ce->proto == PROTO_TCP_SERVER))
2626  {
2628  }
2629  if (!proto_is_udp(ce->proto) && (options->cf_max || options->cf_per))
2630  {
2631  msg(M_USAGE, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
2632  }
2634  {
2635  msg(M_USAGE, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
2636  }
2637  if (options->routes && (options->routes->flags & RG_ENABLE))
2638  {
2639  msg(M_USAGE, "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
2640  }
2642  {
2643  msg(M_USAGE, "--route-delay cannot be used with --mode server");
2644  }
2645  if (options->up_delay)
2646  {
2647  msg(M_USAGE, "--up-delay cannot be used with --mode server");
2648  }
2652  {
2653  msg(M_USAGE,
2654  "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
2655  }
2657  {
2658  msg(M_USAGE, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
2659  }
2661  {
2662  msg(M_USAGE, "--allow-recursive-routing cannot be used with --mode server");
2663  }
2665  {
2666  msg(M_USAGE, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
2667  }
2669  {
2670  msg(M_USAGE, "--ccd-exclusive must be used with --client-config-dir");
2671  }
2673  {
2674  msg(M_USAGE, "--auth-gen-token needs a non-infinite "
2675  "--renegotiate_seconds setting");
2676  }
2679  {
2680  msg(M_USAGE, "--auth-gen-token renewal time needs to be at least "
2681  " two times --hand-window (%d).",
2683 
2684  }
2685  {
2686  const bool ccnr = (options->auth_user_pass_verify_script
2689  const char *postfix = "must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
2691  {
2692  msg(M_USAGE, "--verify-client-cert none|optional %s", postfix);
2693  }
2695  {
2696  msg(M_USAGE, "--username-as-common-name %s", postfix);
2697  }
2699  {
2700  msg(M_USAGE, "--auth-user-pass-optional %s", postfix);
2701  }
2702  }
2703 
2704  if (options->vlan_tagging && dev != DEV_TYPE_TAP)
2705  {
2706  msg(M_USAGE, "--vlan-tagging must be used with --dev tap");
2707  }
2708  if (!options->vlan_tagging)
2709  {
2710  if (options->vlan_accept != defaults.vlan_accept)
2711  {
2712  msg(M_USAGE, "--vlan-accept requires --vlan-tagging");
2713  }
2714  if (options->vlan_pvid != defaults.vlan_pvid)
2715  {
2716  msg(M_USAGE, "--vlan-pvid requires --vlan-tagging");
2717  }
2718  }
2719  }
2720  else
2721  {
2722  /*
2723  * When not in server mode, err if parameters are
2724  * specified which require --mode server.
2725  */
2727  {
2728  msg(M_USAGE, "--ifconfig-pool/--ifconfig-pool-persist requires --mode server");
2729  }
2731  {
2732  msg(M_USAGE, "--ifconfig-ipv6-pool requires --mode server");
2733  }
2734  if (options->real_hash_size != defaults.real_hash_size
2736  {
2737  msg(M_USAGE, "--hash-size requires --mode server");
2738  }
2740  {
2741  msg(M_USAGE, "--learn-address requires --mode server");
2742  }
2744  {
2745  msg(M_USAGE, "--client-connect requires --mode server");
2746  }
2748  {
2749  msg(M_USAGE, "--client-crresponse requires --mode server");
2750  }
2752  {
2753  msg(M_USAGE, "--client-disconnect requires --mode server");
2754  }
2756  {
2757  msg(M_USAGE, "--client-config-dir/--ccd-exclusive requires --mode server");
2758  }
2759  if (options->enable_c2c)
2760  {
2761  msg(M_USAGE, "--client-to-client requires --mode server");
2762  }
2763  if (options->duplicate_cn)
2764  {
2765  msg(M_USAGE, "--duplicate-cn requires --mode server");
2766  }
2767  if (options->cf_max || options->cf_per)
2768  {
2769  msg(M_USAGE, "--connect-freq requires --mode server");
2770  }
2772  {
2773  msg(M_USAGE, "--verify-client-cert requires --mode server");
2774  }
2776  {
2777  msg(M_USAGE, "--username-as-common-name requires --mode server");
2778  }
2780  {
2781  msg(M_USAGE, "--auth-user-pass-optional requires --mode server");
2782  }
2784  {
2785  msg(M_USAGE, "--opt-verify requires --mode server");
2786  }
2788  {
2789  msg(M_WARN, "WARNING: setting tcp-nodelay on the client side will not "
2790  "affect the server. To have TCP_NODELAY in both direction use "
2791  "tcp-nodelay in the server configuration instead.");
2792  }
2794  {
2795  msg(M_USAGE, "--auth-user-pass-verify requires --mode server");
2796  }
2798  {
2799  msg(M_USAGE, "--auth-gen-token requires --mode server");
2800  }
2801 #if PORT_SHARE
2802  if (options->port_share_host || options->port_share_port)
2803  {
2804  msg(M_USAGE, "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2805  }
2806 #endif
2807 
2809  {
2810  msg(M_USAGE, "--stale-routes-check requires --mode server");
2811  }
2812 
2813  if (options->vlan_tagging)
2814  {
2815  msg(M_USAGE, "--vlan-tagging requires --mode server");
2816  }
2817 
2819  {
2820  msg(M_USAGE, "--force-tls-key-material-export requires --mode server");
2821  }
2822  }
2823 
2824  /*
2825  * SSL/TLS mode sanity checks.
2826  */
2828  +(options->shared_secret_file != NULL) > 1)
2829  {
2830  msg(M_USAGE, "specify only one of --tls-server, --tls-client, or --secret");
2831  }
2832 
2833  if (!options->tls_server && !options->tls_client)
2834  {
2835  int msglevel = M_USAGE;
2837  {
2838  msglevel = M_INFO;
2839  }
2840 
2841  msg(msglevel, "DEPRECATION: No tls-client or tls-server option in "
2842  "configuration detected. OpenVPN 2.8 will remove the "
2843  "functionality to run a VPN without TLS. "
2844  "See the examples section in the manual page for "
2845  "examples of a similar quick setup with peer-fingerprint."
2846  "OpenVPN 2.7 allows using this configuration when using "
2847  "--allow-deprecated-insecure-static-crypto but you should move"
2848  "to a proper configuration using TLS as soon as possible."
2849  );
2850  }
2851 
2853  {
2854  msg(M_WARN, "WARNING: POTENTIALLY DANGEROUS OPTION "
2855  "--verify-client-cert none|optional "
2856  "may accept clients which do not present a certificate");
2857  }
2858 
2859  const int tls_version_max =
2862  const int tls_version_min =
2865 
2866  if (tls_version_max > 0 && tls_version_max < tls_version_min)
2867  {
2868  msg(M_USAGE, "--tls-version-min bigger than --tls-version-max");
2869  }
2870 
2872  {
2874 #ifdef ENABLE_PKCS11
2875  if (!options->pkcs11_providers[0] && options->pkcs11_id)
2876  {
2877  msg(M_WARN, "Option pkcs11-id is ignored as no pkcs11-providers are specified");
2878  }
2879  else if (!options->pkcs11_providers[0] && options->pkcs11_id_management)
2880  {
2881  msg(M_WARN, "Option pkcs11-id-management is ignored as no pkcs11-providers are specified");
2882  }
2883 
2884  if (options->pkcs11_providers[0])
2885  {
2886  if (options->pkcs11_id_management && options->pkcs11_id != NULL)
2887  {
2888  msg(M_USAGE, "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2889  }
2890  if (!options->pkcs11_id_management && options->pkcs11_id == NULL)
2891  {
2892  msg(M_USAGE, "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2893  }
2894  if (options->cert_file)
2895  {
2896  msg(M_USAGE, "Parameter --cert cannot be used when --pkcs11-provider is also specified.");
2897  }
2898  if (options->priv_key_file)
2899  {
2900  msg(M_USAGE, "Parameter --key cannot be used when --pkcs11-provider is also specified.");
2901  }
2903  {
2904  msg(M_USAGE, "Parameter --management-external-key cannot be used when --pkcs11-provider is also specified.");
2905  }
2907  {
2908  msg(M_USAGE, "Parameter --management-external-cert cannot be used when --pkcs11-provider is also specified.");
2909  }
2910  if (options->pkcs12_file)
2911  {
2912  msg(M_USAGE, "Parameter --pkcs12 cannot be used when --pkcs11-provider is also specified.");
2913  }
2914 #ifdef ENABLE_CRYPTOAPI
2915  if (options->cryptoapi_cert)
2916  {
2917  msg(M_USAGE, "Parameter --cryptoapicert cannot be used when --pkcs11-provider is also specified.");
2918  }
2919 #endif
2920  }
2921  else
2922 #endif /* ifdef ENABLE_PKCS11 */
2924  {
2925  msg(M_USAGE, "--key and --management-external-key are mutually exclusive");
2926  }
2928  {
2929  if (options->cert_file)
2930  {
2931  msg(M_USAGE, "--cert and --management-external-cert are mutually exclusive");
2932  }
2933  else if (!(options->management_flags & MF_EXTERNAL_KEY))
2934  {
2935  msg(M_USAGE, "--management-external-cert must be used with --management-external-key");
2936  }
2937  }
2938  else
2939 #ifdef ENABLE_CRYPTOAPI
2940  if (options->cryptoapi_cert)
2941  {
2942  if (options->cert_file)
2943  {
2944  msg(M_USAGE, "Parameter --cert cannot be used when --cryptoapicert is also specified.");
2945  }
2946  if (options->priv_key_file)
2947  {
2948  msg(M_USAGE, "Parameter --key cannot be used when --cryptoapicert is also specified.");
2949  }
2950  if (options->pkcs12_file)
2951  {
2952  msg(M_USAGE, "Parameter --pkcs12 cannot be used when --cryptoapicert is also specified.");
2953  }
2955  {
2956  msg(M_USAGE, "Parameter --management-external-key cannot be used when --cryptoapicert is also specified.");
2957  }
2959  {
2960  msg(M_USAGE, "Parameter --management-external-cert cannot be used when --cryptoapicert is also specified.");
2961  }
2962  }
2963  else
2964 #endif /* ifdef ENABLE_CRYPTOAPI */
2965  if (options->pkcs12_file)
2966  {
2967 #ifdef ENABLE_CRYPTO_MBEDTLS
2968  msg(M_USAGE, "Parameter --pkcs12 cannot be used with the mbed TLS version version of OpenVPN.");
2969 #else
2970  if (options->ca_path)
2971  {
2972  msg(M_USAGE, "Parameter --capath cannot be used when --pkcs12 is also specified.");
2973  }
2974  if (options->cert_file)
2975  {
2976  msg(M_USAGE, "Parameter --cert cannot be used when --pkcs12 is also specified.");
2977  }
2978  if (options->priv_key_file)
2979  {
2980  msg(M_USAGE, "Parameter --key cannot be used when --pkcs12 is also specified.");
2981  }
2983  {
2984  msg(M_USAGE, "Parameter --management-external-key cannot be used when --pkcs12 is also specified.");
2985  }
2987  {
2988  msg(M_USAGE, "Parameter --management-external-cert cannot be used when --pkcs12 is also specified.");
2989  }
2990 #endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2991  }
2992  else
2993  {
2994 #ifdef ENABLE_CRYPTO_MBEDTLS
2995  if (options->ca_path)
2996  {
2997  msg(M_USAGE, "Parameter --capath cannot be used with the mbed TLS version version of OpenVPN.");
2998  }
2999 #endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
3000  if (pull)
3001  {
3002 
3003  const int sum =
3006 
3007  if (sum == 0)
3008  {
3010  {
3011  msg(M_USAGE, "No client-side authentication method is "
3012  "specified. You must use either "
3013  "--cert/--key, --pkcs12, or "
3014  "--auth-user-pass");
3015  }
3016  }
3017  else if (sum != 2)
3018  {
3019  msg(M_USAGE, "If you use one of --cert or --key, you must use them both");
3020  }
3021  }
3022  else
3023  {
3025  {
3026  notnull(options->cert_file, "certificate file (--cert) or PKCS#12 file (--pkcs12)");
3027  }
3029  {
3030  notnull(options->priv_key_file, "private key file (--key) or PKCS#12 file (--pkcs12)");
3031  }
3032  }
3033  }
3034  if (ce->tls_auth_file && ce->tls_crypt_file)
3035  {
3036  msg(M_USAGE, "--tls-auth and --tls-crypt are mutually exclusive");
3037  }
3039  && (ce->tls_auth_file || ce->tls_crypt_file))
3040  {
3041  msg(M_USAGE, "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
3042  }
3043  }
3044  else
3045  {
3046  /*
3047  * Make sure user doesn't specify any TLS options
3048  * when in non-TLS mode.
3049  */
3050 
3051 #define MUST_BE_UNDEF(parm) if (options->parm != defaults.parm) {msg(M_USAGE, err, #parm); \
3052 }
3053 
3054  const char err[] = "Parameter %s can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.";
3055 
3061 #ifndef ENABLE_CRYPTO_MBEDTLS
3063 #endif
3086 #ifdef ENABLE_PKCS11
3087  MUST_BE_UNDEF(pkcs11_providers[0]);
3088  MUST_BE_UNDEF(pkcs11_private_mode[0]);
3089  MUST_BE_UNDEF(pkcs11_id);
3091 #endif
3092 
3093  if (pull)
3094  {
3095  msg(M_USAGE, err, "--pull");
3096  }
3097  }
3098 #undef MUST_BE_UNDEF
3099 
3101  {
3102  msg(M_USAGE, "--auth-user-pass requires --pull");
3103  }
3104 
3105  uninit_options(&defaults);
3106 }
3107 
3108 static void
3110 {
3111  const int dev = dev_type_enum(o->dev, o->dev_type);
3112 
3114  {
3115  if (ce->proto == PROTO_TCP)
3116  {
3118  }
3119  }
3120 
3121  if (o->client)
3122  {
3123  if (ce->proto == PROTO_TCP)
3124  {
3126  }
3127  }
3128 
3129  /* an option is present that requires local bind to enabled */
3130  bool need_bind = ce->local || ce->local_port_defined || ce->bind_defined;
3131 
3132  /* socks proxy is enabled */
3133  bool uses_socks = ce->proto == PROTO_UDP && ce->socks_proxy_server;
3134 
3135  /* If binding is not forced by an explicit option and we have (at least)
3136  * one of --tcp-client, --pull (or --client), or socks we do not bind
3137  * locally to have "normal" IP client behaviour of a random source port */
3138  if (!need_bind && (ce->proto == PROTO_TCP_CLIENT || uses_socks || o->pull))
3139  {
3140  ce->bind_local = false;
3141  }
3142 
3143  if (!ce->bind_local)
3144  {
3145  ce->local_port = NULL;
3146  }
3147 
3148  /* if protocol forcing is enabled, disable all protocols
3149  * except for the forced one
3150  */
3151  if (o->proto_force >= 0 && o->proto_force != ce->proto)
3152  {
3153  ce->flags |= CE_DISABLED;
3154  }
3155 
3156  /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
3157  * so fall back to IPv4-only (trac #1221)
3158  */
3159  if (ce->socks_proxy_server && proto_is_udp(ce->proto) && ce->af != AF_INET)
3160  {
3161  if (ce->af == AF_INET6)
3162  {
3163  msg(M_INFO, "WARNING: '--proto udp6' is not compatible with "
3164  "'--socks-proxy' today. Forcing IPv4 mode." );
3165  }
3166  else
3167  {
3168  msg(M_INFO, "NOTICE: dual-stack mode for '--proto udp' does not "
3169  "work correctly with '--socks-proxy' today. Forcing IPv4." );
3170  }
3171  ce->af = AF_INET;
3172  }
3173 
3174  /*
3175  * Set MTU defaults
3176  */
3177  {
3179  {
3180  ce->tun_mtu_defined = true;
3181  }
3182  if ((dev == DEV_TYPE_TAP) && !ce->tun_mtu_extra_defined)
3183  {
3184  ce->tun_mtu_extra_defined = true;
3186  }
3187  }
3188 
3189  /*
3190  * If --mssfix is supplied without a parameter or not specified at all,
3191  * default it to --fragment value, if --fragment is specified and otherwise
3192  * to the default if tun-mtu is 1500
3193  */
3194  if (o->ce.mssfix_default)
3195  {
3196 #ifdef ENABLE_FRAGMENT
3197  if (ce->fragment)
3198  {
3199  ce->mssfix = ce->fragment;
3200  }
3201  else
3202 #endif
3203  if (ce->tun_mtu_defined)
3204  {
3205  if (o->ce.tun_mtu == TUN_MTU_DEFAULT)
3206  {
3207  /* We want to only set mssfix default value if we use a default
3208  * MTU Size, otherwise the different size of tun should either
3209  * already solve the problem or mssfix might artifically make the
3210  * payload packets smaller without mssfix 0 */
3212  ce->mssfix_encap = true;
3213  }
3214  else
3215  {
3216  /* We still apply the mssfix value but only adjust it to the
3217  * size of the tun interface. */
3218  ce->mssfix = ce->tun_mtu;
3219  ce->mssfix_fixed = true;
3220  }
3221  }
3222  }
3223 
3224  /*
3225  * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
3226  *
3227  * At the end only one of these will be really set because the parser
3228  * logic prevents configurations where more are set.
3229  */
3231  {
3235 
3238 
3241  }
3242 
3243  /* Pre-cache tls-auth/crypt(-v2) key file if persist-key was specified and
3244  * keys were not already embedded in the config file.
3245  */
3246  if (o->persist_key)
3247  {
3249  &ce->tls_auth_file_inline, &o->gc);
3251  &ce->tls_crypt_file_inline, &o->gc);
3253  &ce->tls_crypt_v2_file_inline, &o->gc);
3254  }
3255 
3257  {
3258  msg(M_WARN, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
3260  }
3261 }
3262 
3263 #ifdef _WIN32
3264 /* If iservice is in use, we need def1 method for redirect-gateway */
3265 static void
3267 {
3268  if (opt->routes
3270  && opt->routes->flags & RG_REROUTE_GW
3271  && !(opt->routes->flags & RG_DEF1))
3272  {
3273  msg(M_INFO, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
3274  opt->routes->flags |= RG_DEF1;
3275  }
3276 }
3277 #endif
3278 
3279 /*
3280  * Save/Restore certain option defaults before --pull is applied.
3281  */
3282 
3283 static void
3285 {
3290 
3291  if (o->routes)
3292  {
3294  o->pre_connect->routes_defined = true;
3295  }
3296  if (o->routes_ipv6)
3297  {
3299  o->pre_connect->routes_ipv6_defined = true;
3300  }
3301  if (o->client_nat)
3302  {
3304  o->pre_connect->client_nat_defined = true;
3305  }
3306 
3309 
3311 
3312  /* NCP related options that can be overwritten by a push */
3314  o->pre_connect->authname = o->authname;
3315 
3316  /* Ping related options should be reset to the config values on reconnect */
3320 
3321  /* Miscellaneous Options */
3322  o->pre_connect->comp = o->comp;
3323 }
3324 
3325 void
3327 {
3328  const struct options_pre_connect *pp = o->pre_connect;
3329  if (pp)
3330  {
3331  CLEAR(o->tuntap_options);
3332  if (pp->tuntap_options_defined)
3333  {
3334  o->tuntap_options = pp->tuntap_options;
3335  }
3336 
3337  if (pp->routes_defined)
3338  {
3339  rol_check_alloc(o);
3340  copy_route_option_list(o->routes, pp->routes, gc);
3341  }
3342  else
3343  {
3344  o->routes = NULL;
3345  }
3346 
3347  if (pp->routes_ipv6_defined)
3348  {
3349  rol6_check_alloc(o);
3351  }
3352  else
3353  {
3354  o->routes_ipv6 = NULL;
3355  }
3356 
3359 
3360  /* Free DNS options and reset them to pre-pull state */
3361  gc_free(&o->dns_options.gc);
3362  struct gc_arena dns_gc = gc_new();
3363  o->dns_options = clone_dns_options(pp->dns_options, &dns_gc);
3364  o->dns_options.gc = dns_gc;
3365 
3366  if (pp->client_nat_defined)
3367  {
3368  cnol_check_alloc(o);
3370  }
3371  else
3372  {
3373  o->client_nat = NULL;
3374  }
3375 
3377 
3378  o->ciphername = pp->ciphername;
3379  o->authname = pp->authname;
3380 
3384 
3385  /* Miscellaneous Options */
3386  o->comp = pp->comp;
3387  }
3388 
3389  o->push_continuation = 0;
3390  o->push_option_types_found = 0;
3391  o->imported_protocol_flags = 0;
3392 }
3393 
3394 static void
3396 {
3397 #ifdef _WIN32
3398  const int dev = dev_type_enum(options->dev, options->dev_type);
3399 
3400  /* when using wintun/ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
3405  {
3407  }
3408 
3409  if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
3410  {
3411  /* delay may only be necessary when we perform DHCP handshake */
3414  if ((options->mode == MODE_POINT_TO_POINT) && dhcp)
3415  {
3416  options->route_delay_defined = true;
3417  options->route_delay = 5; /* Vista sometimes has a race without this */
3418  }
3419  }
3420 
3421  if (options->ifconfig_noexec)
3422  {
3424  options->ifconfig_noexec = false;
3425  }
3426 
3428 
3429  /*
3430  * Check consistency of --mode server options.
3431  */
3432  if (options->mode == MODE_SERVER)
3433  {
3434  /*
3435  * We need to explicitly set --tap-sleep because
3436  * we do not schedule event timers in the top-level context.
3437  */
3440  {
3442  }
3443  options->route_delay_defined = false;
3444  }
3445 #endif /* ifdef _WIN32 */
3446 
3447 #ifdef DEFAULT_PKCS11_MODULE
3448  /* If p11-kit is present on the system then load its p11-kit-proxy.so
3449  * by default if the user asks for PKCS#11 without otherwise specifying
3450  * the module to use. */
3451  if (!options->pkcs11_providers[0]
3452  && (options->pkcs11_id || options->pkcs11_id_management))
3453  {
3454  options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
3455  }
3456 #endif
3457 }
3458 
3459 static void
3461 {
3462  if (o->connection_list)
3463  {
3464  int i;
3465  for (i = 0; i < o->connection_list->len; ++i)
3466  {
3468  }
3469  }
3470  else
3471  {
3473  }
3474 
3476 
3477  if (dco_enabled(o) && o->enable_c2c)
3478  {
3479  msg(M_WARN, "Note: --client-to-client has no effect when using data "
3480  "channel offload: packets are always sent to the VPN "
3481  "interface and then routed based on the system routing table");
3482  }
3483 }
3484 
3490 static void
3492 {
3493  if (o->ncp_ciphers)
3494  {
3495  /* custom --data-ciphers set, keep list */
3496  return;
3497  }
3498 
3499  /* check if crypto library supports chacha */
3500  bool can_do_chacha = cipher_valid("CHACHA20-POLY1305");
3501 
3502  if (can_do_chacha && dco_enabled(o))
3503  {
3504  /* also make sure that dco supports chacha */
3505  can_do_chacha = tls_item_in_cipher_list("CHACHA20-POLY1305", dco_get_supported_ciphers());
3506  }
3507 
3508  if (can_do_chacha)
3509  {
3510  o->ncp_ciphers = "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305";
3511  }
3512  else
3513  {
3514  o->ncp_ciphers = "AES-256-GCM:AES-128-GCM";
3515  }
3516 }
3517 
3518 static void
3520 {
3521  if (!o->pull && !(o->mode == MODE_SERVER))
3522  {
3523  /* If the cipher is not set, use the old default of BF-CBC. We will
3524  * warn that this is deprecated on cipher initialisation, no need
3525  * to warn here as well */
3526  if (!o->ciphername)
3527  {
3528  o->ciphername = "BF-CBC";
3529  }
3530  else
3531  {
3532  o->enable_ncp_fallback = true;
3533  }
3534  return;
3535  }
3536 
3537  /* pull or P2MP mode */
3538  if (!o->ciphername)
3539  {
3540  /* We still need to set the ciphername to BF-CBC since various other
3541  * parts of OpenVPN assert that the ciphername is set */
3542  o->ciphername = "BF-CBC";
3543 
3544  msg(M_INFO, "Note: --cipher is not set. OpenVPN versions before 2.5 "
3545  "defaulted to BF-CBC as fallback when cipher negotiation "
3546  "failed in this case. If you need this fallback please add "
3547  "'--data-ciphers-fallback BF-CBC' to your configuration "
3548  "and/or add BF-CBC to --data-ciphers.");
3549  }
3550  else if (!o->enable_ncp_fallback
3552  {
3553  msg(M_WARN, "DEPRECATED OPTION: --cipher set to '%s' but missing in "
3554  "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
3555  "negotiations. ",
3556  o->ciphername, o->ncp_ciphers);
3557  }
3558 }
3559 
3574 static bool
3575 need_compatibility_before(const struct options *o, unsigned int version)
3576 {
3577  return o->backwards_compatible != 0 && o->backwards_compatible < version;
3578 }
3579 
3584 static void
3586 {
3587  /* TLS min version is not set */
3588  int tls_ver_min = (o->ssl_flags >> SSLF_TLS_VERSION_MIN_SHIFT)
3590  if (tls_ver_min == 0)
3591  {
3592  int tls_ver_max = (o->ssl_flags >> SSLF_TLS_VERSION_MAX_SHIFT)
3594  if (need_compatibility_before(o, 20307))
3595  {
3596  /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
3598  }
3599  else if (tls_ver_max == 0 || tls_ver_max >= TLS_VER_1_2)
3600  {
3601  /* Use TLS 1.2 as proper default */
3603  }
3604  else
3605  {
3606  /* Maximize the minimum version */
3607  o->ssl_flags |= (tls_ver_max << SSLF_TLS_VERSION_MIN_SHIFT);
3608  }
3609  }
3610 
3611  if (need_compatibility_before(o, 20400))
3612  {
3613  if (!o->ciphername)
3614  {
3615  /* If ciphername is not set default to BF-CBC when targeting these
3616  * old versions that do not have NCP */
3617  o->ciphername = "BF-CBC";
3618  }
3619  /* Versions < 2.4.0 additionally might be compiled with --enable-small and
3620  * not have OCC strings required for "poor man's NCP" */
3621  o->enable_ncp_fallback = true;
3622  }
3623 
3624  /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
3625  * Version 2.4 probably does not need it but NCP was not so
3626  * good with 2.4 and ncp-disable might be more common on 2.4 peers.
3627  * Only do this iff --cipher is set (explicitly or by compat mode
3628  * < 2.4.0, see above). This is not 100% correct backwards compatible
3629  * behaviour but 2.5 already behaved like this */
3630  if (o->ciphername && need_compatibility_before(o, 20500)
3632  {
3634  }
3635 
3636 #ifdef USE_COMP
3637  /* Compression is deprecated and we do not want to announce support for it
3638  * by default anymore, additionally DCO breaks with compression.
3639  *
3640  * Disable compression by default starting with 2.6.0 if no other
3641  * compression related option has been explicitly set */
3642  if (!need_compatibility_before(o, 20600) && (o->comp.flags == 0))
3643  {
3644  if (!comp_non_stub_enabled(&o->comp))
3645  {
3647  }
3648  }
3649 #else /* ifdef USE_COMP */
3651 #endif
3652 }
3653 
3654 static void
3656 {
3657  if (!check_tls_prf_working())
3658  {
3659  msg(D_TLS_ERRORS, "Warning: TLS 1.0 PRF with MD5+SHA1 PRF is not "
3660  "supported by the TLS library. Your system does not support this "
3661  "calculation anymore or your security policy (e.g. FIPS 140-2) "
3662  "forbids it. Connections will only work with peers running "
3663  "OpenVPN 2.6.0 or higher)");
3664 #ifndef HAVE_EXPORT_KEYING_MATERIAL
3665  msg(M_FATAL, "Keying Material Exporters (RFC 5705) not available either. "
3666  "No way to generate data channel keys left.");
3667 #endif
3668  if (o->mode == MODE_SERVER)
3669  {
3670  msg(M_WARN, "Automatically enabling option "
3671  "--force-tls-key-material-export");
3672  o->force_key_material_export = true;
3673  }
3674 
3675  }
3676 }
3677 
3678 static void
3680 {
3681  int i;
3682  /*
3683  * Process helper-type options which map to other, more complex
3684  * sequences of options.
3685  */
3687  helper_keepalive(o);
3688  helper_tcp_nodelay(o);
3689 
3693 
3696  if (o->ncp_ciphers == NULL)
3697  {
3698  msg(M_USAGE, "--data-ciphers list contains unsupported ciphers or is too long.");
3699  }
3700 
3701  if (o->remote_list && !o->connection_list)
3702  {
3703  /*
3704  * Convert remotes into connection list
3705  */
3706  const struct remote_list *rl = o->remote_list;
3707  for (i = 0; i < rl->len; ++i)
3708  {
3709  const struct remote_entry *re = rl->array[i];
3710  struct connection_entry ce = o->ce;
3711  struct connection_entry *ace;
3712 
3713  ASSERT(re->remote);
3714  connection_entry_load_re(&ce, re);
3715  ace = alloc_connection_entry(o, M_USAGE);
3716  ASSERT(ace);
3717  *ace = ce;
3718  }
3719  }
3720  else if (!o->remote_list && !o->connection_list)
3721  {
3722  struct connection_entry *ace;
3723  ace = alloc_connection_entry(o, M_USAGE);
3724  ASSERT(ace);
3725  *ace = o->ce;
3726  }
3727 
3728  ASSERT(o->connection_list);
3729  for (i = 0; i < o->connection_list->len; ++i)
3730  {
3732  }
3733 
3734  if (o->tls_server)
3735  {
3736  /* Check that DH file is specified, or explicitly disabled */
3737  notnull(o->dh_file, "DH file (--dh)");
3738  if (streq(o->dh_file, "none"))
3739  {
3740  o->dh_file = NULL;
3741  }
3742  }
3743  else if (o->dh_file)
3744  {
3745  /* DH file is only meaningful in a tls-server context. */
3746  msg(M_WARN, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3747  "include this in your server configuration");
3748  o->dh_file = NULL;
3749  }
3750 #if ENABLE_MANAGEMENT
3751  if (o->http_proxy_override)
3752  {
3754  }
3755 #endif
3756  if (!o->ca_file && !o->ca_path && o->verify_hash
3757  && o->verify_hash_depth == 0)
3758  {
3759  msg(M_INFO, "Using certificate fingerprint to verify peer (no CA "
3760  "option set). ");
3761  o->verify_hash_no_ca = true;
3762  }
3763 
3764  if (o->config && streq(o->config, "stdin") && o->remap_sigusr1 == SIGHUP)
3765  {
3766  msg(M_USAGE, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3767  "incompatible with each other.");
3768  }
3769 
3770  if (dco_enabled(o))
3771  {
3772  /* check if any option should force disabling DCO */
3775  }
3776 #ifdef USE_COMP
3777  if (dco_enabled(o))
3778  {
3780  }
3781 #endif
3782 
3783 #ifdef _WIN32
3784  if (dco_enabled(o))
3785  {
3787  }
3788  else
3789  {
3791  {
3792  msg(M_WARN, "Option --windows-driver ovpn-dco is ignored because Data Channel Offload is disabled");
3794  }
3796  {
3798  }
3799  }
3800 #else /* _WIN32 */
3801  if (dco_enabled(o) && o->dev_node)
3802  {
3803  msg(M_WARN, "Note: ignoring --dev-node as it has no effect when using "
3804  "data channel offload");
3805  o->dev_node = NULL;
3806  }
3807 #endif /* _WIN32 */
3808 
3809  /* this depends on o->windows_driver, which is set above */
3811 
3812  /* check that compression settings in the options are okay */
3814 
3815  /*
3816  * Save certain parms before modifying options during connect, especially
3817  * when using --pull
3818  */
3819  if (o->pull)
3820  {
3822  }
3823  else
3824  {
3825 #if defined(_WIN32) || defined(TARGET_ANDROID)
3827 #else
3828  foreign_options_copy_dns(o, es);
3829 #endif
3830  }
3832  {
3834  }
3835  pre_connect_save(o);
3836 }
3837 
3838 /*
3839  * Check file/directory sanity
3840  *
3841  */
3842 #ifndef ENABLE_SMALL
3844 #define CHKACC_FILE (1<<0)
3845 #define CHKACC_DIRPATH (1<<1)
3846 #define CHKACC_FILEXSTWR (1<<2)
3847 #define CHKACC_ACPTSTDIN (1<<3)
3848 #define CHKACC_PRIVATE (1<<4)
3850 static bool
3851 check_file_access(const int type, const char *file, const int mode, const char *opt)
3852 {
3853  int errcode = 0;
3854 
3855  /* If no file configured, no errors to look for */
3856  if (!file)
3857  {
3858  return false;
3859  }
3860 
3861  /* If stdin is allowed and the file name is 'stdin', then do no
3862  * further checks as stdin is always available
3863  */
3864  if ( (type & CHKACC_ACPTSTDIN) && streq(file, "stdin") )
3865  {
3866  return false;
3867  }
3868 
3869  /* Is the directory path leading to the given file accessible? */
3870  if (type & CHKACC_DIRPATH)
3871  {
3872  char *fullpath = string_alloc(file, NULL); /* POSIX dirname() implementation may modify its arguments */
3873  char *dirpath = dirname(fullpath);
3874 
3875  if (platform_access(dirpath, mode|X_OK) != 0)
3876  {
3877  errcode = errno;
3878  }
3879  free(fullpath);
3880  }
3881 
3882  /* Is the file itself accessible? */
3883  if (!errcode && (type & CHKACC_FILE) && (platform_access(file, mode) != 0) )
3884  {
3885  errcode = errno;
3886  }
3887 
3888  /* If the file exists and is accessible, is it writable? */
3889  if (!errcode && (type & CHKACC_FILEXSTWR) && (platform_access(file, F_OK) == 0) )
3890  {
3891  if (platform_access(file, W_OK) != 0)
3892  {
3893  errcode = errno;
3894  }
3895  }
3896 
3897  /* Warn if a given private file is group/others accessible. */
3898  if (type & CHKACC_PRIVATE)
3899  {
3900  platform_stat_t st;
3901  if (platform_stat(file, &st))
3902  {
3903  msg(M_WARN | M_ERRNO, "WARNING: cannot stat file '%s'", file);
3904  }
3905 #ifndef _WIN32
3906  else
3907  {
3908  if (st.st_mode & (S_IRWXG|S_IRWXO))
3909  {
3910  msg(M_WARN, "WARNING: file '%s' is group or others accessible", file);
3911  }
3912  }
3913 #endif
3914  }
3915 
3916  /* Scream if an error is found */
3917  if (errcode > 0)
3918  {
3919  msg(M_NOPREFIX | M_OPTERR | M_ERRNO, "%s fails with '%s'", opt, file);
3920  }
3921 
3922  /* Return true if an error occurred */
3923  return (errcode != 0 ? true : false);
3924 }
3925 
3926 /* A wrapper for check_file_access() which also takes a chroot directory.
3927  * If chroot is NULL, behaviour is exactly the same as calling check_file_access() directly,
3928  * otherwise it will look for the file inside the given chroot directory instead.
3929  */
3930 static bool
3931 check_file_access_chroot(const char *chroot, const int type, const char *file, const int mode, const char *opt)
3932 {
3933  bool ret = false;
3934 
3935  /* If no file configured, no errors to look for */
3936  if (!file)
3937  {
3938  return false;
3939  }
3940 
3941  /* If chroot is set, look for the file/directory inside the chroot */
3942  if (chroot)
3943  {
3944  struct gc_arena gc = gc_new();
3945  struct buffer chroot_file;
3946 
3947  chroot_file = prepend_dir(chroot, file, &gc);
3948  ret = check_file_access(type, BSTR(&chroot_file), mode, opt);
3949  gc_free(&gc);
3950  }
3951  else
3952  {
3953  /* No chroot in play, just call core file check function */
3954  ret = check_file_access(type, file, mode, opt);
3955  }
3956  return ret;
3957 }
3958 
3963 static bool
3964 check_file_access_chroot_inline(bool is_inline, const char *chroot,
3965  const int type, const char *file,
3966  const int mode, const char *opt)
3967 {
3968  if (is_inline)
3969  {
3970  return false;
3971  }
3972 
3973  return check_file_access_chroot(chroot, type, file, mode, opt);
3974 }
3975 
3980 static bool
3981 check_file_access_inline(bool is_inline, const int type, const char *file,
3982  const int mode, const char *opt)
3983 {
3984  if (is_inline)
3985  {
3986  return false;
3987  }
3988 
3989  return check_file_access(type, file, mode, opt);
3990 }
3991 
3992 /*
3993  * Verifies that the path in the "command" that comes after certain script options (e.g., --up) is a
3994  * valid file with appropriate permissions.
3995  *
3996  * "command" consists of a path, optionally followed by a space, which may be
3997  * followed by arbitrary arguments. It is NOT a full shell command line -- shell expansion is not
3998  * performed.
3999  *
4000  * The path and arguments in "command" may be single- or double-quoted or escaped.
4001  *
4002  * The path is extracted from "command", then check_file_access() is called to check it. The
4003  * arguments, if any, are ignored.
4004  *
4005  * Note that the type, mode, and opt arguments to this routine are the same as the corresponding
4006  * check_file_access() arguments.
4007  */
4008 static bool
4009 check_cmd_access(const char *command, const char *opt, const char *chroot)
4010 {
4011  struct argv argv;
4012  bool return_code;
4013 
4014  /* If no command was set, there are no errors to look for */
4015  if (!command)
4016  {
4017  return false;
4018  }
4019 
4020  /* Extract executable path and arguments */
4021  argv = argv_new();
4022  argv_parse_cmd(&argv, command);
4023 
4024  /* if an executable is specified then check it; otherwise, complain */
4025  if (argv.argv[0])
4026  {
4027  /* Scripts requires R_OK as well, but that might fail on binaries which
4028  * only requires X_OK to function on Unix - a scenario not unlikely to
4029  * be seen on suid binaries.
4030  */
4031  return_code = check_file_access_chroot(chroot, CHKACC_FILE, argv.argv[0], X_OK, opt);
4032  }
4033  else
4034  {
4035  msg(M_NOPREFIX|M_OPTERR, "%s fails with '%s': No path to executable.",
4036  opt, command);
4037  return_code = true;
4038  }
4039 
4040  argv_free(&argv);
4041 
4042  return return_code;
4043 }
4044 
4045 /*
4046  * Sanity check of all file/dir options. Checks that file/dir
4047  * is accessible by OpenVPN
4048  */
4049 static void
4051 {
4052  bool errs = false;
4053 
4054  /* ** SSL/TLS/crypto related files ** */
4056  options->dh_file, R_OK, "--dh");
4057 
4058  if (!options->verify_hash_no_ca)
4059  {
4061  options->ca_file, R_OK, "--ca");
4062  }
4063 
4065  options->ca_path, R_OK, "--capath");
4066 
4068  options->cert_file, R_OK, "--cert");
4069 
4071  options->extra_certs_file, R_OK,
4072  "--extra-certs");
4073 
4075  {
4078  options->priv_key_file, R_OK, "--key");
4079  }
4080 
4083  options->pkcs12_file, R_OK, "--pkcs12");
4084 
4086  {
4088  options->crl_file, R_OK|X_OK,
4089  "--crl-verify directory");
4090  }
4091  else
4092  {
4096  R_OK, "--crl-verify");
4097  }
4098 
4100  {
4103  W_OK, "--tls-export-cert");
4104  }
4105 
4107  for (int i = 0; i < options->connection_list->len; ++i)
4108  {
4109  struct connection_entry *ce = options->connection_list->array[i];
4110 
4113  ce->tls_auth_file, R_OK,
4114  "--tls-auth");
4117  ce->tls_crypt_file, R_OK,
4118  "--tls-crypt");
4121  ce->tls_crypt_v2_file, R_OK,
4122  "--tls-crypt-v2");
4123  }
4124 
4127  options->shared_secret_file, R_OK,
4128  "--secret");
4129 
4131  options->packet_id_file, R_OK|W_OK, "--replay-persist");
4132 
4133  /* ** Password files ** */
4135  options->key_pass_file, R_OK, "--askpass");
4136 #ifdef ENABLE_MANAGEMENT
4139  "--management user/password file");
4140 #endif /* ENABLE_MANAGEMENT */
4144  "--auth-user-pass");
4145  /* ** System related ** */
4147  R_OK|X_OK, "--chroot directory");
4149  R_OK|W_OK, "--writepid");
4150 
4151  /* ** Log related ** */
4153  R_OK|W_OK, "--status");
4154 
4155  /* ** Config related ** */
4157  R_OK|X_OK, "--client-config-dir");
4159  R_OK|W_OK|X_OK, "Temporary directory (--tmp-dir)");
4160 
4161  if (errs)
4162  {
4163  msg(M_USAGE, "Please correct these errors.");
4164  }
4165 }
4166 #endif /* !ENABLE_SMALL */
4167 
4168 /*
4169  * Sanity check on options.
4170  * Also set some options based on other
4171  * options.
4172  */
4173 void
4175 {
4178 #ifndef ENABLE_SMALL
4180 #endif /* !ENABLE_SMALL */
4181 }
4182 
4183 /*
4184  * Sanity check on options after more options were pulled from server.
4185  * Also time to modify some options based on other options.
4186  */
4187 bool
4189 {
4190  bool success = dns_options_verify(D_PUSH_ERRORS, &o->dns_options);
4191  if (success)
4192  {
4195 #if defined(_WIN32) || defined(TARGET_ANDROID)
4197 #else
4198  foreign_options_copy_dns(o, es);
4199 #endif
4200  }
4201  return success;
4202 }
4203 
4204 /*
4205  * Build an options string to represent data channel encryption options.
4206  * This string must match exactly between peers. The keysize is checked
4207  * separately by read_key().
4208  *
4209  * The following options must match on both peers:
4210  *
4211  * Tunnel options:
4212  *
4213  * --dev tun|tap [unit number need not match]
4214  * --dev-type tun|tap
4215  * --link-mtu
4216  * --udp-mtu
4217  * --tun-mtu
4218  * --proto udp
4219  * --proto tcp-client [matched with --proto tcp-server
4220  * on the other end of the connection]
4221  * --proto tcp-server [matched with --proto tcp-client on
4222  * the other end of the connection]
4223  * --tun-ipv6
4224  * --ifconfig x y [matched with --ifconfig y x on
4225  * the other end of the connection]
4226  *
4227  * --comp-lzo
4228  * --compress alg
4229  * --fragment
4230  *
4231  * Crypto Options:
4232  *
4233  * --cipher
4234  * --auth
4235  * --secret
4236  *
4237  * SSL Options:
4238  *
4239  * --tls-auth
4240  * --tls-client [matched with --tls-server on
4241  * the other end of the connection]
4242  * --tls-server [matched with --tls-client on
4243  * the other end of the connection]
4244  */
4245 char *
4246 options_string(const struct options *o,
4247  const struct frame *frame,
4248  struct tuntap *tt,
4249  openvpn_net_ctx_t *ctx,
4250  bool remote,
4251  struct gc_arena *gc)
4252 {
4253  struct buffer out = alloc_buf(OPTION_LINE_SIZE);
4254  bool tt_local = false;
4255 
4256  buf_printf(&out, "V4");
4257 
4258  /*
4259  * Tunnel Options
4260  */
4261 
4262  buf_printf(&out, ",dev-type %s", dev_type_string(o->dev, o->dev_type));
4263  /* the link-mtu that we send has only a meaning if have a fixed
4264  * cipher (p2p) or have a fallback cipher configured for older non
4265  * ncp clients. But not sending it will make even 2.4 complain
4266  * about it being missing. So still send it. */
4267  buf_printf(&out, ",link-mtu %u",
4268  (unsigned int) calc_options_string_link_mtu(o, frame));
4269 
4270  if (o->ce.occ_mtu != 0)
4271  {
4272  buf_printf(&out, ",tun-mtu %d", o->ce.occ_mtu);
4273  }
4274  else
4275  {
4276  buf_printf(&out, ",tun-mtu %d", frame->tun_mtu);
4277  }
4278 
4279  buf_printf(&out, ",proto %s", proto_remote(o->ce.proto, remote));
4280 
4281  bool p2p_nopull = o->mode == MODE_POINT_TO_POINT && !PULL_DEFINED(o);
4282  /* send tun_ipv6 only in peer2peer mode - in client/server mode, it
4283  * is usually pushed by the server, triggering a non-helpful warning
4284  */
4285  if (o->ifconfig_ipv6_local && p2p_nopull)
4286  {
4287  buf_printf(&out, ",tun-ipv6");
4288  }
4289 
4290  /*
4291  * Try to get ifconfig parameters into the options string.
4292  * If tt is undefined, make a temporary instantiation.
4293  */
4294  if (!tt)
4295  {
4296  tt = init_tun(o->dev,
4297  o->dev_type,
4298  o->topology,
4299  o->ifconfig_local,
4304  NULL,
4305  NULL,
4306  false,
4307  NULL,
4308  ctx,
4309  NULL);
4310  if (tt)
4311  {
4312  tt_local = true;
4313  }
4314  }
4315 
4316  if (tt && p2p_nopull)
4317  {
4318  const char *ios = ifconfig_options_string(tt, remote, o->ifconfig_nowarn, gc);
4319  if (ios && strlen(ios))
4320  {
4321  buf_printf(&out, ",ifconfig %s", ios);
4322  }
4323  }
4324  if (tt_local)
4325  {
4326  free(tt);
4327  tt = NULL;
4328  }
4329 
4330 #ifdef USE_COMP
4331  if (o->comp.alg != COMP_ALG_UNDEF)
4332  {
4333  buf_printf(&out, ",comp-lzo"); /* for compatibility, this simply indicates that compression context is active, not necessarily LZO per-se */
4334  }
4335 #endif
4336 
4337 #ifdef ENABLE_FRAGMENT
4338  if (o->ce.fragment)
4339  {
4340  buf_printf(&out, ",mtu-dynamic");
4341  }
4342 #endif
4343 
4344 #define TLS_CLIENT (o->tls_client)
4345 #define TLS_SERVER (o->tls_server)
4346 
4347  /*
4348  * Key direction
4349  */
4350  {
4351  const char *kd = keydirection2ascii(o->key_direction, remote, false);
4352  if (kd)
4353  {
4354  buf_printf(&out, ",keydir %s", kd);
4355  }
4356  }
4357 
4358  /*
4359  * Crypto Options
4360  */
4362  {
4363  struct key_type kt;
4364 
4365  ASSERT((o->shared_secret_file != NULL)
4366  + (TLS_CLIENT == true)
4367  + (TLS_SERVER == true)
4368  <= 1);
4369 
4370  /* Skip resolving BF-CBC to allow SSL libraries without BF-CBC
4371  * to work here in the default configuration */
4372  const char *ciphername = o->ciphername;
4373  int keysize = 0;
4374 
4375  if (strcmp(o->ciphername, "BF-CBC") == 0)
4376  {
4377  init_key_type(&kt, "none", o->authname, true, false);
4378  keysize = 128;
4379  }
4380  else
4381  {
4382  init_key_type(&kt, o->ciphername, o->authname, true, false);
4383  ciphername = cipher_kt_name(kt.cipher);
4384  if (cipher_defined(o->ciphername))
4385  {
4386  keysize = cipher_kt_key_size(kt.cipher) * 8;
4387  }
4388  }
4389  /* Only announce the cipher to our peer if we are willing to
4390  * support it */
4391  if (p2p_nopull || tls_item_in_cipher_list(ciphername, o->ncp_ciphers))
4392  {
4393  buf_printf(&out, ",cipher %s", ciphername);
4394  }
4395  buf_printf(&out, ",auth %s", md_kt_name(kt.digest));
4396  buf_printf(&out, ",keysize %d", keysize);
4397  if (o->shared_secret_file)
4398  {
4399  buf_printf(&out, ",secret");
4400  }
4401 
4402 #ifdef ENABLE_PREDICTION_RESISTANCE
4403  if (o->use_prediction_resistance)
4404  {
4405  buf_printf(&out, ",use-prediction-resistance");
4406  }
4407 #endif
4408  }
4409 
4410  /*
4411  * SSL Options
4412  */
4413  {
4414  if (TLS_CLIENT || TLS_SERVER)
4415  {
4416  if (o->ce.tls_auth_file)
4417  {
4418  buf_printf(&out, ",tls-auth");
4419  }
4420  /* Not adding tls-crypt here, because we won't reach this code if
4421  * tls-auth/tls-crypt does not match. Removing tls-auth here would
4422  * break stuff, so leaving that in place. */
4423 
4424  buf_printf(&out, ",key-method %d", KEY_METHOD_2);
4425  }
4426 
4427  if (remote)
4428  {
4429  if (TLS_CLIENT)
4430  {
4431  buf_printf(&out, ",tls-server");
4432  }
4433  else if (TLS_SERVER)
4434  {
4435  buf_printf(&out, ",tls-client");
4436  }
4437  }
4438  else
4439  {
4440  if (TLS_CLIENT)
4441  {
4442  buf_printf(&out, ",tls-client");
4443  }
4444  else if (TLS_SERVER)
4445  {
4446  buf_printf(&out, ",tls-server");
4447  }
4448  }
4449  }
4450 
4451 #undef TLS_CLIENT
4452 #undef TLS_SERVER
4453 
4454  return BSTR(&out);
4455 }
4456 
4457 /*
4458  * Compare option strings for equality.
4459  * If the first two chars of the strings differ, it means that
4460  * we are looking at different versions of the options string,
4461  * therefore don't compare them and return true.
4462  */
4463 
4464 bool
4465 options_cmp_equal(char *actual, const char *expected)
4466 {
4467  return options_cmp_equal_safe(actual, expected, strlen(actual) + 1);
4468 }
4469 
4470 void
4471 options_warning(char *actual, const char *expected)
4472 {
4473  options_warning_safe(actual, expected, strlen(actual) + 1);
4474 }
4475 
4476 static const char *
4477 options_warning_extract_parm1(const char *option_string,
4478  struct gc_arena *gc_ret)
4479 {
4480  struct gc_arena gc = gc_new();
4481  struct buffer b = string_alloc_buf(option_string, &gc);
4482  char *p = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4483  const char *ret;
4484 
4485  buf_parse(&b, ' ', p, OPTION_PARM_SIZE);
4486  ret = string_alloc(p, gc_ret);
4487  gc_free(&gc);
4488  return ret;
4489 }
4490 
4491 static void
4492 options_warning_safe_scan2(const int msglevel,
4493  const int delim,
4494  const bool report_inconsistent,
4495  const char *p1,
4496  const struct buffer *b2_src,
4497  const char *b1_name,
4498  const char *b2_name)
4499 {
4500  /* We will stop sending 'key-method', 'keydir', 'proto' and 'tls-auth' in
4501  * OCC in a future version (because it's not useful). To reduce questions
4502  * when interoperating, we no longer printing a warning about it.
4503  */
4504  if (strprefix(p1, "key-method ")
4505  || strprefix(p1, "keydir ")
4506  || strprefix(p1, "proto ")
4507  || streq(p1, "tls-auth")
4508  || strprefix(p1, "tun-ipv6")
4509  || strprefix(p1, "cipher "))
4510  {
4511  return;
4512  }
4513 
4514  if (strlen(p1) > 0)
4515  {
4516  struct gc_arena gc = gc_new();
4517  struct buffer b2 = *b2_src;
4518  const char *p1_prefix = options_warning_extract_parm1(p1, &gc);
4519  char *p2 = gc_malloc(OPTION_PARM_SIZE, false, &gc);
4520 
4521  while (buf_parse(&b2, delim, p2, OPTION_PARM_SIZE))
4522  {
4523  if (strlen(p2))
4524  {
4525  const char *p2_prefix = options_warning_extract_parm1(p2, &gc);
4526 
4527  if (!strcmp(p1, p2))
4528  {
4529  goto done;
4530  }
4531  if (!strcmp(p1_prefix, p2_prefix))
4532  {
4533  if (report_inconsistent)
4534  {
4535  msg(msglevel, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
4536  safe_print(p1_prefix, &gc),
4537  b1_name,
4538  safe_print(p1, &gc),
4539  b2_name,
4540  safe_print(p2, &gc));
4541  }
4542  goto done;
4543  }
4544  }
4545  }
4546 
4547  msg(msglevel, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
4548  safe_print(p1_prefix, &gc),
4549  b1_name,
4550  b2_name,
4551  b1_name,
4552  safe_print(p1, &gc));
4553 
4554 done:
4555  gc_free(&gc);
4556  }
4557 }
4558 
4559 static void
4560 options_warning_safe_scan1(const int msglevel,
4561  const int delim,
4562  const bool report_inconsistent,
4563  const struct buffer *b1_src,
4564  const struct buffer *b2_src,
4565  const char *b1_name,
4566  const char *b2_name)
4567 {
4568  struct gc_arena gc = gc_new();
4569  struct buffer b = *b1_src;
4570  char *p = gc_malloc(OPTION_PARM_SIZE, true, &gc);
4571 
4572  while (buf_parse(&b, delim, p, OPTION_PARM_SIZE))
4573  {
4574  options_warning_safe_scan2(msglevel, delim, report_inconsistent, p, b2_src, b1_name, b2_name);
4575  }
4576 
4577  gc_free(&gc);
4578 }
4579 
4580 static void
4581 options_warning_safe_ml(const int msglevel, char *actual, const char *expected, size_t actual_n)
4582 {
4583  struct gc_arena gc = gc_new();
4584 
4585  if (actual_n > 0)
4586  {
4587  struct buffer local = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4588  struct buffer remote = alloc_buf_gc(OPTION_PARM_SIZE + 16, &gc);
4589  actual[actual_n - 1] = 0;
4590 
4591  buf_printf(&local, "version %s", expected);
4592  buf_printf(&remote, "version %s", actual);
4593 
4594  options_warning_safe_scan1(msglevel, ',', true,
4595  &local, &remote,
4596  "local", "remote");
4597 
4598  options_warning_safe_scan1(msglevel, ',', false,
4599  &remote, &local,
4600  "remote", "local");
4601  }
4602 
4603  gc_free(&gc);
4604 }
4605 
4606 bool
4607 options_cmp_equal_safe(char *actual, const char *expected, size_t actual_n)
4608 {
4609  struct gc_arena gc = gc_new();
4610  bool ret = true;
4611 
4612  if (actual_n > 0)
4613  {
4614  actual[actual_n - 1] = 0;
4615  if (strncmp(actual, expected, 2))
4616  {
4617  msg(D_SHOW_OCC, "NOTE: Options consistency check may be skewed by version differences");
4618  options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4619  }
4620  else
4621  {
4622  ret = !strcmp(actual, expected);
4623  }
4624  }
4625  gc_free(&gc);
4626  return ret;
4627 }
4628 
4629 void
4630 options_warning_safe(char *actual, const char *expected, size_t actual_n)
4631 {
4632  options_warning_safe_ml(D_SHOW_OCC, actual, expected, actual_n);
4633 }
4634 
4635 const char *
4636 options_string_version(const char *s, struct gc_arena *gc)
4637 {
4638  struct buffer out = alloc_buf_gc(4, gc);
4639  strncpynt((char *) BPTR(&out), s, 3);
4640  return BSTR(&out);
4641 }
4642 
4643 char *
4644 options_string_extract_option(const char *options_string, const char *opt_name,
4645  struct gc_arena *gc)
4646 {
4647  char *ret = NULL;
4648  const size_t opt_name_len = strlen(opt_name);
4649 
4650  const char *p = options_string;
4651  while (p)
4652  {
4653  if (0 == strncmp(p, opt_name, opt_name_len)
4654  && strlen(p) > (opt_name_len+1) && p[opt_name_len] == ' ')
4655  {
4656  /* option found, extract value */
4657  const char *start = &p[opt_name_len+1];
4658  const char *end = strchr(p, ',');
4659  size_t val_len = end ? end - start : strlen(start);
4660  ret = gc_malloc(val_len+1, true, gc);
4661  memcpy(ret, start, val_len);
4662  break;
4663  }
4664  p = strchr(p, ',');
4665  if (p)
4666  {
4667  p++; /* skip delimiter */
4668  }
4669  }
4670  return ret;
4671 }
4672 
4673 #ifdef _WIN32
4674 
4681 static enum windows_driver_type
4682 parse_windows_driver(const char *str, const int msglevel)
4683 {
4684  if (streq(str, "tap-windows6"))
4685  {
4687  }
4688  else if (streq(str, "wintun"))
4689  {
4690  return WINDOWS_DRIVER_WINTUN;
4691  }
4692 
4693  else if (streq(str, "ovpn-dco"))
4694  {
4695  return WINDOWS_DRIVER_DCO;
4696  }
4697  else
4698  {
4699  msg(msglevel, "--windows-driver must be tap-windows6, wintun "
4700  "or ovpn-dco");
4702  }
4703 }
4704 #endif /* ifdef _WIN32 */
4705 
4706 /*
4707  * parse/print topology coding
4708  */
4709 
4710 int
4711 parse_topology(const char *str, const int msglevel)
4712 {
4713  if (streq(str, "net30"))
4714  {
4715  return TOP_NET30;
4716  }
4717  else if (streq(str, "p2p"))
4718  {
4719  return TOP_P2P;
4720  }
4721  else if (streq(str, "subnet"))
4722  {
4723  return TOP_SUBNET;
4724  }
4725  else
4726  {
4727  msg(msglevel, "--topology must be net30, p2p, or subnet");
4728  return TOP_UNDEF;
4729  }
4730 }
4731 
4732 const char *
4733 print_topology(const int topology)
4734 {
4735  switch (topology)
4736  {
4737  case TOP_UNDEF:
4738  return "undef";
4739 
4740  case TOP_NET30:
4741  return "net30";
4742 
4743  case TOP_P2P:
4744  return "p2p";
4745 
4746  case TOP_SUBNET:
4747  return "subnet";
4748 
4749  default:
4750  return "unknown";
4751  }
4752 }
4753 
4754 /*
4755  * Manage auth-retry variable
4756  */
4757 
4758 static int global_auth_retry; /* GLOBAL */
4759 
4760 int
4762 {
4763  return global_auth_retry;
4764 }
4765 
4766 bool
4767 auth_retry_set(const int msglevel, const char *option)
4768 {
4769  if (streq(option, "interact"))
4770  {
4772  }
4773  else if (streq(option, "nointeract"))
4774  {
4776  }
4777  else if (streq(option, "none"))
4778  {
4780  }
4781  else
4782  {
4783  msg(msglevel, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
4784  return false;
4785  }
4786  return true;
4787 }
4788 
4789 const char *
4791 {
4792  switch (global_auth_retry)
4793  {
4794  case AR_NONE:
4795  return "none";
4796 
4797  case AR_NOINTERACT:
4798  return "nointeract";
4799 
4800  case AR_INTERACT:
4801  return "interact";
4802 
4803  default:
4804  return "???";
4805  }
4806 }
4807 
4808 /*
4809  * Print the help message.
4810  */
4811 static void
4812 usage(void)
4813 {
4814  FILE *fp = msg_fp(0);
4815 
4816 #ifdef ENABLE_SMALL
4817 
4818  fprintf(fp, "Usage message not available\n");
4819 
4820 #else
4821 
4822  struct options o;
4823  init_options(&o, true);
4824 
4825  fprintf(fp, usage_message,
4826  title_string,
4829  o.ce.local_port, o.ce.remote_port,
4831  o.verbosity,
4832  o.authname,
4836  fflush(fp);
4837 
4838 #endif /* ENABLE_SMALL */
4839 
4840  openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4841 }
4842 
4843 void
4845 {
4846  msg(M_WARN|M_NOPREFIX, "Use --help for more information.");
4847  openvpn_exit(OPENVPN_EXIT_STATUS_USAGE); /* exit point */
4848 }
4849 
4850 #ifdef _WIN32
4851 void
4852 show_windows_version(const unsigned int flags)
4853 {
4854  struct gc_arena gc = gc_new();
4855  msg(flags, "Windows version %s", win32_version_string(&gc, true));
4856  gc_free(&gc);
4857 }
4858 #endif
4859 
4860 void
4861 show_dco_version(const unsigned int flags)
4862 {
4863 #ifdef ENABLE_DCO
4864  struct gc_arena gc = gc_new();
4865  msg(flags, "DCO version: %s", dco_version_string(&gc));
4866  gc_free(&gc);
4867 #endif
4868 }
4869 
4870 void
4871 show_library_versions(const unsigned int flags)
4872 {
4873 #ifdef ENABLE_LZO
4874 #define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
4875 #else
4876 #define LZO_LIB_VER_STR "", ""
4877 #endif
4878 
4879  msg(flags, "library versions: %s%s%s", get_ssl_library_version(),
4880  LZO_LIB_VER_STR);
4881 
4882 #undef LZO_LIB_VER_STR
4883 }
4884 
4885 static void
4887 {
4890 #ifdef _WIN32
4892 #endif
4894  msg(M_INFO|M_NOPREFIX, "Originally developed by James Yonan");
4895  msg(M_INFO|M_NOPREFIX, "Copyright (C) 2002-2023 OpenVPN Inc <sales@openvpn.net>");
4896 #ifndef ENABLE_SMALL
4897 #ifdef CONFIGURE_DEFINES
4898  msg(M_INFO|M_NOPREFIX, "Compile time defines: %s", CONFIGURE_DEFINES);
4899 #endif
4900 #ifdef CONFIGURE_SPECIAL_BUILD
4901  msg(M_INFO|M_NOPREFIX, "special build: %s", CONFIGURE_SPECIAL_BUILD);
4902 #endif
4903 #endif
4905 }
4906 
4907 void
4908 notnull(const char *arg, const char *description)
4909 {
4910  if (!arg)
4911  {
4912  msg(M_USAGE, "You must define %s", description);
4913  }
4914 }
4915 
4916 bool
4917 string_defined_equal(const char *s1, const char *s2)
4918 {
4919  if (s1 && s2)
4920  {
4921  return !strcmp(s1, s2);
4922  }
4923  else
4924  {
4925  return false;
4926  }
4927 }
4928 
4929 #if 0
4930 static void
4931 ping_rec_err(int msglevel)
4932 {
4933  msg(msglevel, "only one of --ping-exit or --ping-restart options may be specified");
4934 }
4935 #endif
4936 
4937 static int
4938 positive_atoi(const char *str)
4939 {
4940  const int i = atoi(str);
4941  return i < 0 ? 0 : i;
4942 }
4943 
4944 #ifdef _WIN32 /* This function is only used when compiling on Windows */
4945 static unsigned int
4946 atou(const char *str)
4947 {
4948  unsigned int val = 0;
4949  sscanf(str, "%u", &val);
4950  return val;
4951 }
4952 #endif
4953 
4954 static inline bool
4955 space(unsigned char c)
4956 {
4957  return c == '\0' || isspace(c);
4958 }
4959 
4960 int
4961 parse_line(const char *line,
4962  char *p[],
4963  const int n,
4964  const char *file,
4965  const int line_num,
4966  int msglevel,
4967  struct gc_arena *gc)
4968 {
4969  const int STATE_INITIAL = 0;
4970  const int STATE_READING_QUOTED_PARM = 1;
4971  const int STATE_READING_UNQUOTED_PARM = 2;
4972  const int STATE_DONE = 3;
4973  const int STATE_READING_SQUOTED_PARM = 4;
4974 
4975  const char *error_prefix = "";
4976 
4977  int ret = 0;
4978  const char *c = line;
4979  int state = STATE_INITIAL;
4980  bool backslash = false;
4981  char in, out;
4982 
4983  char parm[OPTION_PARM_SIZE];
4984  unsigned int parm_len = 0;
4985 
4986  msglevel &= ~M_OPTERR;
4987 
4988  if (msglevel & M_MSG_VIRT_OUT)
4989  {
4990  error_prefix = "ERROR: ";
4991  }
4992 
4993  do
4994  {
4995  in = *c;
4996  out = 0;
4997 
4998  if (!backslash && in == '\\' && state != STATE_READING_SQUOTED_PARM)
4999  {
5000  backslash = true;
5001  }
5002  else
5003  {
5004  if (state == STATE_INITIAL)
5005  {
5006  if (!space(in))
5007  {
5008  if (in == ';' || in == '#') /* comment */
5009  {
5010  break;
5011  }
5012  if (!backslash && in == '\"')
5013  {
5014  state = STATE_READING_QUOTED_PARM;
5015  }
5016  else if (!backslash && in == '\'')
5017  {
5018  state = STATE_READING_SQUOTED_PARM;
5019  }
5020  else
5021  {
5022  out = in;
5023  state = STATE_READING_UNQUOTED_PARM;
5024  }
5025  }
5026  }
5027  else if (state == STATE_READING_UNQUOTED_PARM)
5028  {
5029  if (!backslash && space(in))
5030  {
5031  state = STATE_DONE;
5032  }
5033  else
5034  {
5035  out = in;
5036  }
5037  }
5038  else if (state == STATE_READING_QUOTED_PARM)
5039  {
5040  if (!backslash && in == '\"')
5041  {
5042  state = STATE_DONE;
5043  }
5044  else
5045  {
5046  out = in;
5047  }
5048  }
5049  else if (state == STATE_READING_SQUOTED_PARM)
5050  {
5051  if (in == '\'')
5052  {
5053  state = STATE_DONE;
5054  }
5055  else
5056  {
5057  out = in;
5058  }
5059  }
5060  if (state == STATE_DONE)
5061  {
5062  /* ASSERT (parm_len > 0); */
5063  p[ret] = gc_malloc(parm_len + 1, true, gc);
5064  memcpy(p[ret], parm, parm_len);
5065  p[ret][parm_len] = '\0';
5066  state = STATE_INITIAL;
5067  parm_len = 0;
5068  ++ret;
5069  }
5070 
5071  if (backslash && out)
5072  {
5073  if (!(out == '\\' || out == '\"' || space(out)))
5074  {
5075 #ifdef ENABLE_SMALL
5076  msg(msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix, file, line_num);
5077 #else
5078  msg(msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE "\\\\static.key\"", error_prefix, file, line_num);
5079 #endif
5080  return 0;
5081  }
5082  }
5083  backslash = false;
5084  }
5085 
5086  /* store parameter character */
5087  if (out)
5088  {
5089  if (parm_len >= SIZE(parm))
5090  {
5091  parm[SIZE(parm) - 1] = 0;
5092  msg(msglevel, "%sOptions error: Parameter at %s:%d is too long (%d chars max): %s",
5093  error_prefix, file, line_num, (int) SIZE(parm), parm);
5094  return 0;
5095  }
5096  parm[parm_len++] = out;
5097  }
5098 
5099  /* avoid overflow if too many parms in one config file line */
5100  if (ret >= n)
5101  {
5102  break;
5103  }
5104 
5105  } while (*c++ != '\0');
5106 
5107  if (state == STATE_READING_QUOTED_PARM)
5108  {
5109  msg(msglevel, "%sOptions error: No closing quotation (\") in %s:%d", error_prefix, file, line_num);
5110  return 0;
5111  }
5112  if (state == STATE_READING_SQUOTED_PARM)
5113  {
5114  msg(msglevel, "%sOptions error: No closing single quotation (\') in %s:%d", error_prefix, file, line_num);
5115  return 0;
5116  }
5117  if (state != STATE_INITIAL)
5118  {
5119  msg(msglevel, "%sOptions error: Residual parse state (%d) in %s:%d", error_prefix, state, file, line_num);
5120  return 0;
5121  }
5122 #if 0
5123  {
5124  int i;
5125  for (i = 0; i < ret; ++i)
5126  {
5127  msg(M_INFO|M_NOPREFIX, "%s:%d ARG[%d] '%s'", file, line_num, i, p[i]);
5128  }
5129  }
5130 #endif
5131  return ret;
5132 }
5133 
5134 static void
5136 {
5137  if (strlen(*p) >= 3 && !strncmp(*p, "--", 2))
5138  {
5139  *p += 2;
5140  }
5141 }
5142 
5143 struct in_src {
5144 #define IS_TYPE_FP 1
5145 #define IS_TYPE_BUF 2
5146  int type;
5147  union {
5148  FILE *fp;
5150  } u;
5151 };
5152 
5153 static bool
5154 in_src_get(const struct in_src *is, char *line, const int size)
5155 {
5156  if (is->type == IS_TYPE_FP)
5157  {
5158  return BOOL_CAST(fgets(line, size, is->u.fp));
5159  }
5160  else if (is->type == IS_TYPE_BUF)
5161  {
5162  bool status = buf_parse(is->u.multiline, '\n', line, size);
5163  if ((int) strlen(line) + 1 < size)
5164  {
5165  strcat(line, "\n");
5166  }
5167  return status;
5168  }
5169  else
5170  {
5171  ASSERT(0);
5172  return false;
5173  }
5174 }
5175 
5176 static char *
5177 read_inline_file(struct in_src *is, const char *close_tag,
5178  int *num_lines, struct gc_arena *gc)
5179 {
5180  char line[OPTION_LINE_SIZE];
5181  struct buffer buf = alloc_buf(8*OPTION_LINE_SIZE);
5182  char *ret;
5183  bool endtagfound = false;
5184 
5185  while (in_src_get(is, line, sizeof(line)))
5186  {
5187  (*num_lines)++;
5188  char *line_ptr = line;
5189  /* Remove leading spaces */
5190  while (isspace(*line_ptr))
5191  {
5192  line_ptr++;
5193  }
5194  if (!strncmp(line_ptr, close_tag, strlen(close_tag)))
5195  {
5196  endtagfound = true;
5197  break;
5198  }
5199  if (!buf_safe(&buf, strlen(line)+1))
5200  {
5201  /* Increase buffer size */
5202  struct buffer buf2 = alloc_buf(buf.capacity * 2);
5203  ASSERT(buf_copy(&buf2, &buf));
5204  buf_clear(&buf);
5205  free_buf(&buf);
5206  buf = buf2;
5207  }
5208  buf_printf(&buf, "%s", line);
5209  }
5210  if (!endtagfound)
5211  {
5212  msg(M_FATAL, "ERROR: Endtag %s missing", close_tag);
5213  }
5214  ret = string_alloc(BSTR(&buf), gc);
5215  buf_clear(&buf);
5216  free_buf(&buf);
5217  secure_memzero(line, sizeof(line));
5218  return ret;
5219 }
5220 
5221 static int
5222 check_inline_file(struct in_src *is, char *p[], struct gc_arena *gc)
5223 {
5224  int num_inline_lines = 0;
5225 
5226  if (p[0] && !p[1])
5227  {
5228  char *arg = p[0];
5229  if (arg[0] == '<' && arg[strlen(arg)-1] == '>')
5230  {
5231  struct buffer close_tag;
5232 
5233  arg[strlen(arg) - 1] = '\0';
5234  p[0] = string_alloc(arg + 1, gc);
5235  close_tag = alloc_buf(strlen(p[0]) + 4);
5236  buf_printf(&close_tag, "</%s>", p[0]);
5237  p[1] = read_inline_file(is, BSTR(&close_tag), &num_inline_lines, gc);
5238  p[2] = NULL;
5239  free_buf(&close_tag);
5240  }
5241  }
5242  return num_inline_lines;
5243 }
5244 
5245 static int
5246 check_inline_file_via_fp(FILE *fp, char *p[], struct gc_arena *gc)
5247 {
5248  struct in_src is;
5249  is.type = IS_TYPE_FP;
5250  is.u.fp = fp;
5251  return check_inline_file(&is, p, gc);
5252 }
5253 
5254 static int
5256  struct gc_arena *gc)
5257 {
5258  struct in_src is;
5259  is.type = IS_TYPE_BUF;
5260  is.u.multiline = multiline;
5261  return check_inline_file(&is, p, gc);
5262 }
5263 
5264 static void
5265 add_option(struct options *options,
5266  char *p[],
5267  bool is_inline,
5268  const char *file,
5269  int line,
5270  const int level,
5271  const int msglevel,
5272  const unsigned int permission_mask,
5273  unsigned int *option_types_found,
5274  struct env_set *es);
5275 
5276 static void
5278  const char *file,
5279  int level,
5280  const char *top_file,
5281  const int top_line,
5282  const int msglevel,
5283  const unsigned int permission_mask,
5284  unsigned int *option_types_found,
5285  struct env_set *es)
5286 {
5287  const int max_recursive_levels = 10;
5288  FILE *fp;
5289  int line_num;
5290  char line[OPTION_LINE_SIZE+1];
5291  char *p[MAX_PARMS+1];
5292 
5293  ++level;
5294  if (level <= max_recursive_levels)
5295  {
5296  if (streq(file, "stdin"))
5297  {
5298  fp = stdin;
5299  }
5300  else
5301  {
5302  fp = platform_fopen(file, "r");
5303  }
5304  if (fp)
5305  {
5306  line_num = 0;
5307  while (fgets(line, sizeof(line), fp))
5308  {
5309  int offset = 0;
5310  CLEAR(p);
5311  ++line_num;
5312  if (strlen(line) == OPTION_LINE_SIZE)
5313  {
5314  msg(msglevel, "In %s:%d: Maximum option line length (%d) exceeded, line starts with %s",
5315  file, line_num, OPTION_LINE_SIZE, line);
5316  }
5317 
5318  /* Ignore UTF-8 BOM at start of stream */
5319  if (line_num == 1 && strncmp(line, "\xEF\xBB\xBF", 3) == 0)
5320  {
5321  offset = 3;
5322  }
5323  if (parse_line(line + offset, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
5324  {
5325  bypass_doubledash(&p[0]);
5326  int lines_inline = check_inline_file_via_fp(fp, p, &options->gc);
5327  add_option(options, p, lines_inline, file, line_num, level,
5328  msglevel, permission_mask, option_types_found,
5329  es);
5330  line_num += lines_inline;
5331  }
5332  }
5333  if (fp != stdin)
5334  {
5335  fclose(fp);
5336  }
5337  }
5338  else
5339  {
5340  msg(msglevel, "In %s:%d: Error opening configuration file: %s", top_file, top_line, file);
5341  }
5342  }
5343  else
5344  {
5345  msg(msglevel, "In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file, top_line, file);
5346  }
5347  secure_memzero(line, sizeof(line));
5348  CLEAR(p);
5349 }
5350 
5351 static void
5352 read_config_string(const char *prefix,
5353  struct options *options,
5354  const char *config,
5355  const int msglevel,
5356  const unsigned int permission_mask,
5357  unsigned int *option_types_found,
5358  struct env_set *es)
5359 {
5360  char line[OPTION_LINE_SIZE];
5361  struct buffer multiline;
5362  int line_num = 0;
5363 
5364  buf_set_read(&multiline, (uint8_t *)config, strlen(config));
5365 
5366  while (buf_parse(&multiline, '\n', line, sizeof(line)))
5367  {
5368  char *p[MAX_PARMS+1];
5369  CLEAR(p);
5370  ++line_num;
5371  if (parse_line(line, p, SIZE(p)-1, prefix, line_num, msglevel, &options->gc))
5372  {
5373  bypass_doubledash(&p[0]);
5374  int lines_inline = check_inline_file_via_buf(&multiline, p, &options->gc);
5375  add_option(options, p, lines_inline, prefix, line_num, 0, msglevel,
5376  permission_mask, option_types_found, es);
5377  line_num += lines_inline;
5378  }
5379  CLEAR(p);
5380  }
5381  secure_memzero(line, sizeof(line));
5382 }
5383 
5384 void
5386  const int argc,
5387  char *argv[],
5388  const int msglevel,
5389  const unsigned int permission_mask,
5390  unsigned int *option_types_found,
5391  struct env_set *es)
5392 {
5393  /* usage message */
5394  if (argc <= 1)
5395  {
5396  usage();
5397  }
5398 
5399  /* config filename specified only? */
5400  if (argc == 2 && strncmp(argv[1], "--", 2))
5401  {
5402  char *p[MAX_PARMS+1];
5403  CLEAR(p);
5404  p[0] = "config";
5405  p[1] = argv[1];
5406  add_option(options, p, false, NULL, 0, 0, msglevel, permission_mask,
5407  option_types_found, es);
5408  }
5409  else
5410  {
5411  /* parse command line */
5412  for (int i = 1; i < argc; ++i)
5413  {
5414  char *p[MAX_PARMS+1];
5415  CLEAR(p);
5416  p[0] = argv[i];
5417  if (strncmp(p[0], "--", 2))
5418  {
5419  msg(msglevel, "I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p[0]);
5420  }
5421  else
5422  {
5423  p[0] += 2;
5424  }
5425 
5426  int j;
5427  for (j = 1; j < MAX_PARMS; ++j)
5428  {
5429  if (i + j < argc)
5430  {
5431  char *arg = argv[i + j];
5432  if (strncmp(arg, "--", 2))
5433  {
5434  p[j] = arg;
5435  }
5436  else
5437  {
5438  break;
5439  }
5440  }
5441  }
5442  add_option(options, p, false, NULL, 0, 0, msglevel, permission_mask,
5443  option_types_found, es);
5444  i += j - 1;
5445  }
5446  }
5447 }
5448 
5457 static bool
5458 apply_pull_filter(const struct options *o, char *line)
5459 {
5460  struct pull_filter *f;
5461 
5462  if (!o->pull_filter_list)
5463  {
5464  return true;
5465  }
5466 
5467  /* skip leading spaces matching the behaviour of parse_line */
5468  while (isspace(*line))
5469  {
5470  line++;
5471  }
5472 
5473  for (f = o->pull_filter_list->head; f; f = f->next)
5474  {
5475  if (f->type == PUF_TYPE_ACCEPT && strncmp(line, f->pattern, f->size) == 0)
5476  {
5477  msg(D_LOW, "Pushed option accepted by filter: '%s'", line);
5478  return true;
5479  }
5480  else if (f->type == PUF_TYPE_IGNORE && strncmp(line, f->pattern, f->size) == 0)
5481  {
5482  msg(D_PUSH, "Pushed option removed by filter: '%s'", line);
5483  *line = '\0';
5484  return true;
5485  }
5486  else if (f->type == PUF_TYPE_REJECT && strncmp(line, f->pattern, f->size) == 0)
5487  {
5488  msg(M_WARN, "Pushed option rejected by filter: '%s'. Restarting.", line);
5489  *line = '\0';
5490  throw_signal_soft(SIGUSR1, "Offending option received from server");
5491  return false;
5492  }
5493  }
5494  return true;
5495 }
5496 
5497 bool
5499  struct buffer *buf,
5500  unsigned int permission_mask,
5501  unsigned int *option_types_found,
5502  struct env_set *es)
5503 {
5504  char line[OPTION_PARM_SIZE];
5505  int line_num = 0;
5506  const char *file = "[PUSH-OPTIONS]";
5507  const int msglevel = D_PUSH_ERRORS|M_OPTERR;
5508 
5509  while (buf_parse(buf, ',', line, sizeof(line)))
5510  {
5511  char *p[MAX_PARMS+1];
5512  CLEAR(p);
5513  ++line_num;
5514  if (!apply_pull_filter(options, line))
5515  {
5516  return false; /* Cause push/pull error and stop push processing */
5517  }
5518  if (parse_line(line, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
5519  {
5520  add_option(options, p, false, file, line_num, 0, msglevel,
5521  permission_mask, option_types_found, es);
5522  }
5523  }
5524  return true;
5525 }
5526 
5527 void
5529  const char *filename,
5530  int msglevel,
5531  unsigned int permission_mask,
5532