aboutsummaryrefslogtreecommitdiff
path: root/options.c
diff options
context:
space:
mode:
authorjames <james@e7ae566f-a301-0410-adde-c780ea21d3b5>2008-06-11 10:48:50 +0000
committerjames <james@e7ae566f-a301-0410-adde-c780ea21d3b5>2008-06-11 10:48:50 +0000
commit4e9a51d78ffa0696cf7d14ff0292ca8863689f70 (patch)
tree0509760011393888bddef1bfc0330d6a5b670671 /options.c
parentUpdated version to 2.1_rc7e. (diff)
downloadopenvpn-4e9a51d78ffa0696cf7d14ff0292ca8863689f70.tar.xz
Merged connection profiles from
http://svn.openvpn.net/projects/openvpn/test/conn git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@2993 e7ae566f-a301-0410-adde-c780ea21d3b5
Diffstat (limited to 'options.c')
-rw-r--r--options.c827
1 files changed, 513 insertions, 314 deletions
diff --git a/options.c b/options.c
index 5328efb..f9252ed 100644
--- a/options.c
+++ b/options.c
@@ -619,21 +619,25 @@ static const char usage_message[] =
* will be set to 0.
*/
void
-init_options (struct options *o)
+init_options (struct options *o, const bool init_gc)
{
CLEAR (*o);
- gc_init (&o->gc);
+ if (init_gc)
+ {
+ gc_init (&o->gc);
+ o->gc_owned = true;
+ }
o->mode = MODE_POINT_TO_POINT;
o->topology = TOP_NET30;
- o->proto = PROTO_UDPv4;
- o->connect_retry_seconds = 5;
- o->connect_timeout = 10;
- o->connect_retry_max = 0;
- o->local_port = o->remote_port = OPENVPN_PORT;
+ o->ce.proto = PROTO_UDPv4;
+ o->ce.connect_retry_seconds = 5;
+ o->ce.connect_timeout = 10;
+ o->ce.connect_retry_max = 0;
+ o->ce.local_port = o->ce.remote_port = OPENVPN_PORT;
o->verbosity = 1;
o->status_file_update_freq = 60;
o->status_file_version = 1;
- o->bind_local = true;
+ o->ce.bind_local = true;
o->tun_mtu = TUN_MTU_DEFAULT;
o->link_mtu = LINK_MTU_DEFAULT;
o->mtu_discover_type = -1;
@@ -709,7 +713,8 @@ init_options (struct options *o)
void
uninit_options (struct options *o)
{
- gc_free (&o->gc);
+ if (o->gc_owned)
+ gc_free (&o->gc);
}
#ifdef ENABLE_DEBUG
@@ -724,46 +729,50 @@ uninit_options (struct options *o)
#endif
void
+setenv_connection_entry (struct env_set *es,
+ const struct connection_entry *e,
+ const int i)
+{
+ setenv_str_i (es, "proto", proto2ascii (e->proto, false), i);
+ setenv_str_i (es, "local", e->local, i);
+ setenv_int_i (es, "local_port", e->local_port, i);
+ setenv_str_i (es, "remote", e->local, i);
+ setenv_int_i (es, "remote_port", e->local_port, i);
+
+#ifdef ENABLE_HTTP_PROXY
+ if (e->http_proxy_options)
+ {
+ setenv_str_i (es, "http_proxy_server", e->http_proxy_options->server, i);
+ setenv_int_i (es, "http_proxy_port", e->http_proxy_options->port, i);
+ }
+#endif
+#ifdef ENABLE_SOCKS
+ if (e->socks_proxy_server)
+ {
+ setenv_str_i (es, "socks_proxy_server", e->socks_proxy_server, i);
+ setenv_int_i (es, "socks_proxy_port", e->socks_proxy_port, i);
+ }
+#endif
+}
+
+void
setenv_settings (struct env_set *es, const struct options *o)
{
setenv_str (es, "config", o->config);
- setenv_str (es, "proto", proto2ascii (o->proto, false));
- setenv_str (es, "local", o->local);
- setenv_int (es, "local_port", o->local_port);
setenv_int (es, "verb", o->verbosity);
setenv_int (es, "daemon", o->daemon);
setenv_int (es, "daemon_log_redirect", o->log);
- if (o->remote_list)
+#ifdef ENABLE_CONNECTION
+ if (o->connection_list)
{
int i;
-
- for (i = 0; i < o->remote_list->len; ++i)
- {
- char remote_string[64];
- char remote_port_string[64];
-
- openvpn_snprintf (remote_string, sizeof (remote_string), "remote_%d", i+1);
- openvpn_snprintf (remote_port_string, sizeof (remote_port_string), "remote_port_%d", i+1);
-
- setenv_str (es, remote_string, o->remote_list->array[i].hostname);
- setenv_int (es, remote_port_string, o->remote_list->array[i].port);
- }
+ for (i = 0; i < o->connection_list->len; ++i)
+ setenv_connection_entry (es, o->connection_list->array[i], i+1);
}
-#ifdef ENABLE_HTTP_PROXY
- if (o->http_proxy_options)
- {
- setenv_str (es, "http_proxy_server", o->http_proxy_options->server);
- setenv_int (es, "http_proxy_port", o->http_proxy_options->port);
- }
-#endif
-#ifdef ENABLE_SOCKS
- if(o->socks_proxy_server)
- {
- setenv_str (es, "socks_proxy_server", o->socks_proxy_server);
- setenv_int (es, "socks_proxy_port", o->socks_proxy_port);
- }
+ else
#endif
+ setenv_connection_entry (es, &o->ce, 1);
}
static in_addr_t
@@ -816,7 +825,7 @@ is_persist_option (const struct options *o)
bool
is_stateful_restart (const struct options *o)
{
- return is_persist_option (o) || (o->remote_list && o->remote_list->len > 1);
+ return is_persist_option (o) || connection_list_defined (o);
}
#ifdef WIN32
@@ -983,26 +992,6 @@ option_iroute (struct options *o,
#endif /* P2MP_SERVER */
#endif /* P2MP */
-#ifdef ENABLE_DEBUG
-static void
-show_remote_list (const struct remote_list *l)
-{
- if (l)
- {
- int i;
- for (i = 0; i < l->len; ++i)
- {
- msg (D_SHOW_PARMS, " remote_list[%d] = {'%s', %d}",
- i, l->array[i].hostname, l->array[i].port);
- }
- }
- else
- {
- msg (D_SHOW_PARMS, " remote_list = NULL");
- }
-}
-#endif
-
#if defined(ENABLE_HTTP_PROXY) && defined(ENABLE_DEBUG)
static void
show_http_proxy_options (const struct http_proxy_options *o)
@@ -1042,6 +1031,55 @@ rol_check_alloc (struct options *options)
options->routes = new_route_option_list (&options->gc);
}
+#ifdef ENABLE_DEBUG
+static void
+show_connection_entry (const struct connection_entry *o)
+{
+ msg (D_SHOW_PARMS, " proto = %s", proto2ascii (o->proto, false));
+ SHOW_STR (local);
+ SHOW_INT (local_port);
+ SHOW_STR (remote);
+ SHOW_INT (remote_port);
+ SHOW_BOOL (remote_float);
+ SHOW_BOOL (bind_defined);
+ SHOW_BOOL (bind_local);
+ SHOW_INT (connect_retry_seconds);
+ SHOW_INT (connect_timeout);
+ SHOW_INT (connect_retry_max);
+
+#ifdef ENABLE_HTTP_PROXY
+ if (o->http_proxy_options)
+ show_http_proxy_options (o->http_proxy_options);
+#endif
+#ifdef ENABLE_SOCKS
+ SHOW_STR (socks_proxy_server);
+ SHOW_INT (socks_proxy_port);
+ SHOW_BOOL (socks_proxy_retry);
+#endif
+}
+
+static void
+show_connection_entries (const struct options *o)
+{
+ msg (D_SHOW_PARMS, "Connection profiles [default]:");
+ show_connection_entry (&o->ce);
+#ifdef ENABLE_CONNECTION
+ if (o->connection_list)
+ {
+ const struct connection_list *l = o->connection_list;
+ int i;
+ for (i = 0; i < l->len; ++i)
+ {
+ msg (D_SHOW_PARMS, "Connection profiles [%d]:", i);
+ show_connection_entry (l->array[i]);
+ }
+ }
+#endif
+ msg (D_SHOW_PARMS, "Connection profiles END");
+}
+
+#endif
+
void
show_settings (const struct options *o)
{
@@ -1068,17 +1106,11 @@ show_settings (const struct options *o)
#endif
#endif
- SHOW_INT (proto);
- SHOW_STR (local);
- show_remote_list (o->remote_list);
+ show_connection_entries (o);
+
SHOW_BOOL (remote_random);
- SHOW_INT (local_port);
- SHOW_INT (remote_port);
- SHOW_BOOL (remote_float);
SHOW_STR (ipchange);
- SHOW_BOOL (bind_defined);
- SHOW_BOOL (bind_local);
SHOW_STR (dev);
SHOW_STR (dev_type);
SHOW_STR (dev_node);
@@ -1135,9 +1167,6 @@ show_settings (const struct options *o)
#endif
SHOW_INT (resolve_retry_seconds);
- SHOW_INT (connect_retry_seconds);
- SHOW_INT (connect_timeout);
- SHOW_INT (connect_retry_max);
SHOW_STR (username);
SHOW_STR (groupname);
@@ -1170,17 +1199,6 @@ show_settings (const struct options *o)
SHOW_INT (sndbuf);
SHOW_INT (sockflags);
-#ifdef ENABLE_HTTP_PROXY
- if (o->http_proxy_options)
- show_http_proxy_options (o->http_proxy_options);
-#endif
-
-#ifdef ENABLE_SOCKS
- SHOW_STR (socks_proxy_server);
- SHOW_INT (socks_proxy_port);
- SHOW_BOOL (socks_proxy_retry);
-#endif
-
SHOW_BOOL (fast_io);
#ifdef USE_LZO
@@ -1318,32 +1336,89 @@ show_settings (const struct options *o)
struct http_proxy_options *
init_http_options_if_undefined (struct options *o)
{
- if (!o->http_proxy_options)
+ if (!o->ce.http_proxy_options)
{
- ALLOC_OBJ_CLEAR_GC (o->http_proxy_options, struct http_proxy_options, &o->gc);
+ ALLOC_OBJ_CLEAR_GC (o->ce.http_proxy_options, struct http_proxy_options, &o->gc);
/* http proxy defaults */
- o->http_proxy_options->timeout = 5;
- o->http_proxy_options->http_version = "1.0";
+ o->ce.http_proxy_options->timeout = 5;
+ o->ce.http_proxy_options->http_version = "1.0";
}
- return o->http_proxy_options;
+ return o->ce.http_proxy_options;
+}
+
+#endif
+
+#if ENABLE_CONNECTION
+
+static struct connection_list *
+alloc_connection_list_if_undef (struct options *options)
+{
+ if (!options->connection_list)
+ ALLOC_OBJ_CLEAR_GC (options->connection_list, struct connection_list, &options->gc);
+ return options->connection_list;
+}
+
+static struct connection_entry *
+alloc_connection_entry (struct options *options, const int msglevel)
+{
+ struct connection_list *l = alloc_connection_list_if_undef (options);
+ struct connection_entry *e;
+
+ if (l->len >= CONNECTION_LIST_SIZE)
+ {
+ msg (msglevel, "Maximum number of 'connection' options (%d) exceeded", CONNECTION_LIST_SIZE);
+ return NULL;
+ }
+ ALLOC_OBJ_GC (e, struct connection_entry, &options->gc);
+ l->array[l->len++] = e;
+ return e;
+}
+
+static struct remote_list *
+alloc_remote_list_if_undef (struct options *options)
+{
+ if (!options->remote_list)
+ ALLOC_OBJ_CLEAR_GC (options->remote_list, struct remote_list, &options->gc);
+ return options->remote_list;
+}
+
+static struct remote_entry *
+alloc_remote_entry (struct options *options, const int msglevel)
+{
+ struct remote_list *l = alloc_remote_list_if_undef (options);
+ struct remote_entry *e;
+
+ if (l->len >= CONNECTION_LIST_SIZE)
+ {
+ msg (msglevel, "Maximum number of 'remote' options (%d) exceeded", CONNECTION_LIST_SIZE);
+ return NULL;
+ }
+ ALLOC_OBJ_GC (e, struct remote_entry, &options->gc);
+ l->array[l->len++] = e;
+ return e;
}
#endif
-/*
- * Sanity check on options.
- * Also set some options based on other
- * options.
- */
void
-options_postprocess (struct options *options, bool first_time)
+connection_entry_load_re (struct connection_entry *ce, const struct remote_entry *re)
+{
+ if (re->remote)
+ ce->remote = re->remote;
+ if (re->remote_port >= 0)
+ ce->remote_port = re->remote_port;
+ if (re->proto >= 0)
+ ce->proto = re->proto;
+}
+
+static void
+options_postprocess_verify_ce (const struct options *options, const struct connection_entry *ce)
{
struct options defaults;
int dev = DEV_TYPE_UNDEF;
- int i;
bool pull = false;
- init_options (&defaults);
+ init_options (&defaults, true);
#ifdef USE_CRYPTO
if (options->test_crypto)
@@ -1360,31 +1435,11 @@ options_postprocess (struct options *options, bool first_time)
dev = dev_type_enum (options->dev, options->dev_type);
/*
- * Fill in default port number for --remote list
- */
- if (options->remote_list)
- {
- for (i = 0; i < options->remote_list->len; ++i)
- {
- struct remote_entry *e = &options->remote_list->array[i];
- if (e->port < 0)
- e->port = options->remote_port;
- }
- }
-
- /*
- * If --mssfix is supplied without a parameter, default
- * it to --fragment value, if --fragment is specified.
+ * If "proto tcp" is specified, make sure we know whether it is
+ * tcp-client or tcp-server.
*/
- if (options->mssfix_default)
- {
-#ifdef ENABLE_FRAGMENT
- if (options->fragment)
- options->mssfix = options->fragment;
-#else
- msg (M_USAGE, "--mssfix must specify a parameter");
-#endif
- }
+ if (ce->proto == PROTO_TCPv4)
+ msg (M_USAGE, "--proto tcp is ambiguous in this context. Please specify --proto tcp-server or --proto tcp-client");
/*
* Sanity check on daemon/inetd modes
@@ -1393,13 +1448,13 @@ options_postprocess (struct options *options, bool first_time)
if (options->daemon && options->inetd)
msg (M_USAGE, "only one of --daemon or --inetd may be specified");
- if (options->inetd && (options->local || options->remote_list))
+ if (options->inetd && (ce->local || ce->remote))
msg (M_USAGE, "--local or --remote cannot be used with --inetd");
- if (options->inetd && options->proto == PROTO_TCPv4_CLIENT)
+ if (options->inetd && ce->proto == PROTO_TCPv4_CLIENT)
msg (M_USAGE, "--proto tcp-client cannot be used with --inetd");
- if (options->inetd == INETD_NOWAIT && options->proto != PROTO_TCPv4_SERVER)
+ if (options->inetd == INETD_NOWAIT && ce->proto != PROTO_TCPv4_SERVER)
msg (M_USAGE, "--inetd nowait can only be used with --proto tcp-server");
if (options->inetd == INETD_NOWAIT
@@ -1417,20 +1472,13 @@ options_postprocess (struct options *options, bool first_time)
msg (M_USAGE, "--lladdr can only be used in --dev tap mode");
/*
- * In forking TCP server mode, you don't need to ifconfig
- * the tap device (the assumption is that it will be bridged).
- */
- if (options->inetd == INETD_NOWAIT)
- options->ifconfig_noexec = true;
-
- /*
* Sanity check on TCP mode options
*/
- if (options->connect_retry_defined && options->proto != PROTO_TCPv4_CLIENT)
+ if (ce->connect_retry_defined && ce->proto != PROTO_TCPv4_CLIENT)
msg (M_USAGE, "--connect-retry doesn't make sense unless also used with --proto tcp-client");
- if (options->connect_timeout_defined && options->proto != PROTO_TCPv4_CLIENT)
+ if (ce->connect_timeout_defined && ce->proto != PROTO_TCPv4_CLIENT)
msg (M_USAGE, "--connect-timeout doesn't make sense unless also used with --proto tcp-client");
/*
@@ -1440,32 +1488,10 @@ options_postprocess (struct options *options, bool first_time)
msg (M_USAGE, "only one of --tun-mtu or --link-mtu may be defined (note that --ifconfig implies --link-mtu %d)", LINK_MTU_DEFAULT);
#ifdef ENABLE_OCC
- if (options->proto != PROTO_UDPv4 && options->mtu_test)
+ if (ce->proto != PROTO_UDPv4 && options->mtu_test)
msg (M_USAGE, "--mtu-test only makes sense with --proto udp");
#endif
- /*
- * Set MTU defaults
- */
- {
- if (!options->tun_mtu_defined && !options->link_mtu_defined)
- {
- options->tun_mtu_defined = true;
- }
- if ((dev == DEV_TYPE_TAP) && !options->tun_mtu_extra_defined)
- {
- options->tun_mtu_extra_defined = true;
- options->tun_mtu_extra = TAP_MTU_EXTRA_DEFAULT;
- }
- }
-
- /*
- * Process helper-type options which map to other, more complex
- * sequences of options.
- */
- helper_client_server (options);
- helper_keepalive (options);
-
/* will we be pulling options from server? */
#if P2MP
pull = options->pull;
@@ -1475,56 +1501,33 @@ options_postprocess (struct options *options, bool first_time)
* Sanity check on --local, --remote, and --ifconfig
*/
- if (options->remote_list)
- {
- int i;
- struct remote_list *l = options->remote_list;
-
- for (i = 0; i < l->len; ++i)
- {
- const char *remote = l->array[i].hostname;
- const int remote_port = l->array[i].port;
-
- if (string_defined_equal (options->local, remote)
- && options->local_port == remote_port)
- msg (M_USAGE, "--remote and --local addresses are the same");
-
- if (string_defined_equal (remote, options->ifconfig_local)
- || string_defined_equal (remote, options->ifconfig_remote_netmask))
- msg (M_USAGE, "--local and --remote addresses must be distinct from --ifconfig addresses");
- }
- }
+ if (string_defined_equal (ce->local, ce->remote)
+ && ce->local_port == ce->remote_port)
+ msg (M_USAGE, "--remote and --local addresses are the same");
+
+ if (string_defined_equal (ce->remote, options->ifconfig_local)
+ || string_defined_equal (ce->remote, options->ifconfig_remote_netmask))
+ msg (M_USAGE, "--local and --remote addresses must be distinct from --ifconfig addresses");
- if (string_defined_equal (options->local, options->ifconfig_local)
- || string_defined_equal (options->local, options->ifconfig_remote_netmask))
+ if (string_defined_equal (ce->local, options->ifconfig_local)
+ || string_defined_equal (ce->local, options->ifconfig_remote_netmask))
msg (M_USAGE, "--local addresses must be distinct from --ifconfig addresses");
if (string_defined_equal (options->ifconfig_local, options->ifconfig_remote_netmask))
msg (M_USAGE, "local and remote/netmask --ifconfig addresses must be different");
- if (options->bind_defined && !options->bind_local)
+ if (ce->bind_defined && !ce->bind_local)
msg (M_USAGE, "--bind and --nobind can't be used together");
- if (options->local && !options->bind_local)
+ if (ce->local && !ce->bind_local)
msg (M_USAGE, "--local and --nobind don't make sense when used together");
- if (options->local_port_defined && !options->bind_local)
+ if (ce->local_port_defined && !ce->bind_local)
msg (M_USAGE, "--lport and --nobind don't make sense when used together");
- if (!options->remote_list && !options->bind_local)
+ if (!ce->remote && !ce->bind_local)
msg (M_USAGE, "--nobind doesn't make sense unless used with --remote");
- if (options->proto == PROTO_TCPv4_CLIENT && !options->local && !options->local_port_defined && !options->bind_defined)
- options->bind_local = false;
-
-#ifdef ENABLE_SOCKS
- if (options->proto == PROTO_UDPv4 && options->socks_proxy_server && !options->local && !options->local_port_defined && !options->bind_defined)
- options->bind_local = false;
-#endif
-
- if (!options->bind_local)
- options->local_port = 0;
-
/*
* Check for consistency of management options
*/
@@ -1552,18 +1555,6 @@ options_postprocess (struct options *options, bool first_time)
&& options->tuntap_options.ip_win32_type != IPW32_SET_DHCP_MASQ
&& options->tuntap_options.ip_win32_type != IPW32_SET_ADAPTIVE)
msg (M_USAGE, "--dhcp-options requires --ip-win32 dynamic or adaptive");
-
- if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
- {
- options->route_delay_defined = true;
- options->route_delay = 5; /* Vista sometimes has a race without this */
- }
-
- if (options->ifconfig_noexec)
- {
- options->tuntap_options.ip_win32_type = IPW32_SET_MANUAL;
- options->ifconfig_noexec = false;
- }
#endif
/*
@@ -1571,34 +1562,34 @@ options_postprocess (struct options *options, bool first_time)
*/
#ifdef ENABLE_FRAGMENT
- if (options->proto != PROTO_UDPv4 && options->fragment)
+ if (ce->proto != PROTO_UDPv4 && options->fragment)
msg (M_USAGE, "--fragment can only be used with --proto udp");
#endif
#ifdef ENABLE_OCC
- if (options->proto != PROTO_UDPv4 && options->explicit_exit_notification)
+ if (ce->proto != PROTO_UDPv4 && options->explicit_exit_notification)
msg (M_USAGE, "--explicit-exit-notify can only be used with --proto udp");
#endif
- if (!options->remote_list && options->proto == PROTO_TCPv4_CLIENT)
+ if (!ce->remote && ce->proto == PROTO_TCPv4_CLIENT)
msg (M_USAGE, "--remote MUST be used in TCP Client mode");
#ifdef ENABLE_HTTP_PROXY
- if ((options->http_proxy_options || options->auto_proxy_info) && options->proto != PROTO_TCPv4_CLIENT)
+ if ((ce->http_proxy_options || options->auto_proxy_info) && ce->proto != PROTO_TCPv4_CLIENT)
msg (M_USAGE, "--http-proxy or --auto-proxy MUST be used in TCP Client mode (i.e. --proto tcp-client)");
#endif
#if defined(ENABLE_HTTP_PROXY) && defined(ENABLE_SOCKS)
- if (options->http_proxy_options && options->socks_proxy_server)
+ if (ce->http_proxy_options && ce->socks_proxy_server)
msg (M_USAGE, "--http-proxy can not be used together with --socks-proxy");
#endif
#ifdef ENABLE_SOCKS
- if (options->socks_proxy_server && options->proto == PROTO_TCPv4_SERVER)
+ if (ce->socks_proxy_server && ce->proto == PROTO_TCPv4_SERVER)
msg (M_USAGE, "--socks-proxy can not be used in TCP Server mode");
#endif
- if (options->proto == PROTO_TCPv4_SERVER && remote_list_len (options->remote_list) > 1)
+ if (ce->proto == PROTO_TCPv4_SERVER && connection_list_defined (options))
msg (M_USAGE, "TCP server mode allows at most one --remote address");
#if P2MP_SERVER
@@ -1608,41 +1599,34 @@ options_postprocess (struct options *options, bool first_time)
*/
if (options->mode == MODE_SERVER)
{
-#ifdef WIN32
- /*
- * We need to explicitly set --tap-sleep because
- * we do not schedule event timers in the top-level context.
- */
- options->tuntap_options.tap_sleep = 10;
- if (options->route_delay_defined && options->route_delay)
- options->tuntap_options.tap_sleep = options->route_delay;
- options->route_delay_defined = false;
-#endif
-
if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP))
msg (M_USAGE, "--mode server only works with --dev tun or --dev tap");
if (options->pull)
msg (M_USAGE, "--pull cannot be used with --mode server");
- if (!(options->proto == PROTO_UDPv4 || options->proto == PROTO_TCPv4_SERVER))
+ if (!(ce->proto == PROTO_UDPv4 || ce->proto == PROTO_TCPv4_SERVER))
msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server");
#if PORT_SHARE
- if ((options->port_share_host || options->port_share_port) && options->proto != PROTO_TCPv4_SERVER)
+ if ((options->port_share_host || options->port_share_port) && ce->proto != PROTO_TCPv4_SERVER)
msg (M_USAGE, "--port-share only works in TCP server mode (--proto tcp-server)");
#endif
if (!options->tls_server)
msg (M_USAGE, "--mode server requires --tls-server");
- if (options->remote_list)
+ if (ce->remote)
msg (M_USAGE, "--remote cannot be used with --mode server");
- if (!options->bind_local)
+ if (!ce->bind_local)
msg (M_USAGE, "--nobind cannot be used with --mode server");
#ifdef ENABLE_HTTP_PROXY
- if (options->http_proxy_options)
+ if (ce->http_proxy_options)
msg (M_USAGE, "--http-proxy cannot be used with --mode server");
#endif
#ifdef ENABLE_SOCKS
- if (options->socks_proxy_server)
+ if (ce->socks_proxy_server)
msg (M_USAGE, "--socks-proxy cannot be used with --mode server");
#endif
+#ifdef ENABLE_CONNECTION
+ if (options->connection_list)
+ msg (M_USAGE, "<connection> cannot be used with --mode server");
+#endif
if (options->tun_ipv6)
msg (M_USAGE, "--tun-ipv6 cannot be used with --mode server");
if (options->shaper)
@@ -1651,9 +1635,9 @@ options_postprocess (struct options *options, bool first_time)
msg (M_USAGE, "--inetd cannot be used with --mode server");
if (options->ipchange)
msg (M_USAGE, "--ipchange cannot be used with --mode server (use --client-connect instead)");
- if (!(options->proto == PROTO_UDPv4 || options->proto == PROTO_TCPv4_SERVER))
+ if (!(ce->proto == PROTO_UDPv4 || ce->proto == PROTO_TCPv4_SERVER))
msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server");
- if (options->proto != PROTO_UDPv4 && (options->cf_max || options->cf_per))
+ if (ce->proto != PROTO_UDPv4 && (options->cf_max || options->cf_per))
msg (M_USAGE, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
if (!(dev == DEV_TYPE_TAP || (dev == DEV_TYPE_TUN && options->topology == TOP_SUBNET)) && options->ifconfig_pool_netmask)
msg (M_USAGE, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
@@ -1733,7 +1717,7 @@ options_postprocess (struct options *options, bool first_time)
/*
* Check consistency of replay options
*/
- if ((options->proto != PROTO_UDPv4)
+ if ((ce->proto != PROTO_UDPv4)
&& (options->replay_window != defaults.replay_window
|| options->replay_time != defaults.replay_time))
msg (M_USAGE, "--replay-window only makes sense with --proto udp");
@@ -1743,13 +1727,6 @@ options_postprocess (struct options *options, bool first_time)
|| options->replay_time != defaults.replay_time))
msg (M_USAGE, "--replay-window doesn't make sense when replay protection is disabled with --no-replay");
- /*
- * Don't use replay window for TCP mode (i.e. require that packets
- * be strictly in sequence).
- */
- if (link_socket_proto_connection_oriented (options->proto))
- options->replay_window = options->replay_time = 0;
-
/*
* SSL/TLS mode sanity checks.
*/
@@ -1887,30 +1864,211 @@ options_postprocess (struct options *options, bool first_time)
#endif /* USE_SSL */
#if P2MP
+ if (options->auth_user_pass_file && !options->pull)
+ msg (M_USAGE, "--auth-user-pass requires --pull");
+#endif
+
+ uninit_options (&defaults);
+}
+
+static void
+options_postprocess_mutate_ce (struct options *o, struct connection_entry *ce)
+{
+#if P2MP_SERVER
+ if (o->server_defined || o->server_bridge_defined)
+ {
+ if (ce->proto == PROTO_TCPv4)
+ ce->proto = PROTO_TCPv4_SERVER;
+ }
+#endif
+#if P2MP
+ if (o->client)
+ {
+ if (ce->proto == PROTO_TCPv4)
+ ce->proto = PROTO_TCPv4_CLIENT;
+ }
+#endif
+
+ if (ce->proto == PROTO_TCPv4_CLIENT && !ce->local && !ce->local_port_defined && !ce->bind_defined)
+ ce->bind_local = false;
+
+#ifdef ENABLE_SOCKS
+ if (ce->proto == PROTO_UDPv4 && ce->socks_proxy_server && !ce->local && !ce->local_port_defined && !ce->bind_defined)
+ ce->bind_local = false;
+#endif
+
+ if (!ce->bind_local)
+ ce->local_port = 0;
+}
+
+static void
+options_postprocess_mutate_invariant (struct options *options)
+{
+ const int dev = dev_type_enum (options->dev, options->dev_type);
+
/*
- * In pull mode, we usually import --ping/--ping-restart parameters from
- * the server. However we should also set an initial default --ping-restart
- * for the period of time before we pull the --ping-restart parameter
- * from the server.
+ * If --mssfix is supplied without a parameter, default
+ * it to --fragment value, if --fragment is specified.
*/
- if (options->pull
- && options->ping_rec_timeout_action == PING_UNDEF
- && options->proto == PROTO_UDPv4)
+ if (options->mssfix_default)
{
- options->ping_rec_timeout = PRE_PULL_INITIAL_PING_RESTART;
- options->ping_rec_timeout_action = PING_RESTART;
+#ifdef ENABLE_FRAGMENT
+ if (options->fragment)
+ options->mssfix = options->fragment;
+#else
+ msg (M_USAGE, "--mssfix must specify a parameter");
+#endif
}
- if (options->auth_user_pass_file && !options->pull)
- msg (M_USAGE, "--auth-user-pass requires --pull");
+ /*
+ * In forking TCP server mode, you don't need to ifconfig
+ * the tap device (the assumption is that it will be bridged).
+ */
+ if (options->inetd == INETD_NOWAIT)
+ options->ifconfig_noexec = true;
/*
+ * Set MTU defaults
+ */
+ {
+ if (!options->tun_mtu_defined && !options->link_mtu_defined)
+ {
+ options->tun_mtu_defined = true;
+ }
+ if ((dev == DEV_TYPE_TAP) && !options->tun_mtu_extra_defined)
+ {
+ options->tun_mtu_extra_defined = true;
+ options->tun_mtu_extra = TAP_MTU_EXTRA_DEFAULT;
+ }
+ }
+
+#ifdef WIN32
+ if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined)
+ {
+ if (options->mode == MODE_POINT_TO_POINT)
+ {
+ options->route_delay_defined = true;
+ options->route_delay = 5; /* Vista sometimes has a race without this */
+ }
+ }
+
+ if (options->ifconfig_noexec)
+ {
+ options->tuntap_options.ip_win32_type = IPW32_SET_MANUAL;
+ options->ifconfig_noexec = false;
+ }
+#endif
+
+#if P2MP_SERVER
+ /*
+ * Check consistency of --mode server options.
+ */
+ if (options->mode == MODE_SERVER)
+ {
+#ifdef WIN32
+ /*
+ * We need to explicitly set --tap-sleep because
+ * we do not schedule event timers in the top-level context.
+ */
+ options->tuntap_options.tap_sleep = 10;
+ if (options->route_delay_defined && options->route_delay)
+ options->tuntap_options.tap_sleep = options->route_delay;
+ options->route_delay_defined = false;
+#endif
+ }
+#endif
+}
+
+static void
+options_postprocess_verify (const struct options *o)
+{
+#ifdef ENABLE_CONNECTION
+ if (o->connection_list)
+ {
+ int i;
+ for (i = 0; i < o->connection_list->len; ++i)
+ options_postprocess_verify_ce (o, o->connection_list->array[i]);
+ }
+ else
+#endif
+ options_postprocess_verify_ce (o, &o->ce);
+}
+
+static void
+options_postprocess_mutate (struct options *o)
+{
+ /*
+ * Process helper-type options which map to other, more complex
+ * sequences of options.
+ */
+ helper_client_server (o);
+ helper_keepalive (o);
+
+ options_postprocess_mutate_invariant (o);
+
+#ifdef ENABLE_CONNECTION
+ if (o->remote_list && !o->connection_list)
+ {
+ /*
+ * For compatibility with 2.0.x, map multiple --remote options
+ * into connection list (connection lists added in 2.1).
+ */
+ if (o->remote_list->len > 1)
+ {
+ const struct remote_list *rl = o->remote_list;
+ int i;
+ for (i = 0; i < rl->len; ++i)
+ {
+ const struct remote_entry *re = rl->array[i];
+ struct connection_entry ce = o->ce;
+ struct connection_entry *ace;
+
+ ASSERT (re->remote);
+ connection_entry_load_re (&ce, re);
+ ace = alloc_connection_entry (o, M_USAGE);
+ ASSERT (ace);
+ *ace = ce;
+ }
+ }
+ else if (o->remote_list->len == 1) /* one --remote option specfied */
+ {
+ connection_entry_load_re (&o->ce, o->remote_list->array[0]);
+ }
+ else
+ {
+ ASSERT (0);
+ }
+ }
+ if (o->connection_list)
+ {
+ int i;
+ for (i = 0; i < o->connection_list->len; ++i)
+ options_postprocess_mutate_ce (o, o->connection_list->array[i]);
+ }
+ else
+#endif
+ options_postprocess_mutate_ce (o, &o->ce);
+
+#if P2MP
+ /*
* Save certain parms before modifying options via --pull
*/
- pre_pull_save (options);
+ pre_pull_save (o);
#endif
}
+/*
+ * Sanity check on options.
+ * Also set some options based on other
+ * options.
+ */
+void
+options_postprocess (struct options *options)
+{
+ options_postprocess_mutate (options);
+ options_postprocess_verify (options);
+}
+
#if P2MP
/*
@@ -2023,7 +2181,7 @@ options_string (const struct options *o,
buf_printf (&out, ",dev-type %s", dev_type_string (o->dev, o->dev_type));
buf_printf (&out, ",link-mtu %d", EXPANDED_SIZE (frame));
buf_printf (&out, ",tun-mtu %d", PAYLOAD_SIZE (frame));
- buf_printf (&out, ",proto %s", proto2ascii (proto_remote (o->proto, remote), true));
+ buf_printf (&out, ",proto %s", proto2ascii (proto_remote (o->ce.proto, remote), true));
if (o->tun_ipv6)
buf_printf (&out, ",tun-ipv6");
@@ -2451,13 +2609,13 @@ usage (void)
#else
struct options o;
- init_options (&o);
+ init_options (&o, true);
#if defined(USE_CRYPTO) && defined(USE_SSL)
fprintf (fp, usage_message,
title_string,
- o.connect_retry_seconds,
- o.local_port, o.remote_port,
+ o.ce.connect_retry_seconds,
+ o.ce.local_port, o.ce.remote_port,
TUN_MTU_DEFAULT, TAP_MTU_EXTRA_DEFAULT,
o.verbosity,
o.authname, o.ciphername,
@@ -2467,8 +2625,8 @@ usage (void)
#elif defined(USE_CRYPTO)
fprintf (fp, usage_message,
title_string,
- o.connect_retry_seconds,
- o.local_port, o.remote_port,
+ o.ce.connect_retry_seconds,
+ o.ce.local_port, o.ce.remote_port,
TUN_MTU_DEFAULT, TAP_MTU_EXTRA_DEFAULT,
o.verbosity,
o.authname, o.ciphername,
@@ -2476,8 +2634,8 @@ usage (void)
#else
fprintf (fp, usage_message,
title_string,
- o.connect_retry_seconds,
- o.local_port, o.remote_port,
+ o.ce.connect_retry_seconds,
+ o.ce.local_port, o.ce.remote_port,
TUN_MTU_DEFAULT, TAP_MTU_EXTRA_DEFAULT,
o.verbosity);
#endif
@@ -2857,14 +3015,14 @@ read_config_file (struct options *options,
}
static void
-read_config_string (struct options *options,
+read_config_string (const char *prefix,
+ struct options *options,
const char *config,
const int msglevel,
const unsigned int permission_mask,
unsigned int *option_types_found,
struct env_set *es)
{
- const char *file = "[CONFIG-STRING]";
char line[OPTION_LINE_SIZE];
struct buffer multiline;
int line_num = 0;
@@ -2876,7 +3034,7 @@ read_config_string (struct options *options,
char *p[MAX_PARMS];
CLEAR (p);
++line_num;
- if (parse_line (line, p, SIZE (p), file, line_num, msglevel, &options->gc))
+ if (parse_line (line, p, SIZE (p), prefix, line_num, msglevel, &options->gc))
{
bypass_doubledash (&p[0]);
#if ENABLE_INLINE_FILES
@@ -2997,7 +3155,7 @@ void options_string_import (struct options *options,
unsigned int *option_types_found,
struct env_set *es)
{
- read_config_string (options, config, msglevel, permission_mask, option_types_found, es);
+ read_config_string ("[CONFIG-STRING]", options, config, msglevel, permission_mask, option_types_found, es);
}
#if P2MP
@@ -3281,41 +3439,82 @@ add_option (struct options *options,
}
else if (streq (p[0], "local") && p[1])
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->local = p[1];
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.local = p[1];
}
else if (streq (p[0], "remote-random"))
{
VERIFY_PERMISSION (OPT_P_GENERAL);
options->remote_random = true;
}
- else if (streq (p[0], "remote") && p[1])
+#if ENABLE_CONNECTION
+ else if (streq (p[0], "connection") && p[1])
{
- struct remote_list *l;
- struct remote_entry e;
-
VERIFY_PERMISSION (OPT_P_GENERAL);
- if (!options->remote_list)
- ALLOC_OBJ_CLEAR_GC (options->remote_list, struct remote_list, &options->gc);
- l = options->remote_list;
- if (l->len >= REMOTE_LIST_SIZE)
+ if (streq (p[1], INLINE_FILE_TAG) && p[2])
{
- msg (msglevel, "Maximum number of --remote options (%d) exceeded", REMOTE_LIST_SIZE);
- goto err;
+ struct options sub;
+ struct connection_entry *e;
+
+ init_options (&sub, true);
+ sub.ce = options->ce;
+ read_config_string ("[CONNECTION-OPTIONS]", &sub, p[2], msglevel, OPT_P_CONNECTION, option_types_found, es);
+ if (!sub.ce.remote)
+ {
+ msg (msglevel, "Each 'connection' block must contain exactly one 'remote' directive");
+ goto err;
+ }
+
+ e = alloc_connection_entry (options, msglevel);
+ if (!e)
+ goto err;
+ *e = sub.ce;
+ gc_transfer (&options->gc, &sub.gc);
+ uninit_options (&sub);
}
- e.hostname = p[1];
+ }
+#endif
+ else if (streq (p[0], "remote") && p[1])
+ {
+ struct remote_entry re;
+ re.remote = NULL;
+ re.remote_port = re.proto = -1;
+
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ re.remote = p[1];
if (p[2])
{
- e.port = atoi (p[2]);
- if (!legal_ipv4_port (e.port))
+ const int port = atoi (p[2]);
+ if (!legal_ipv4_port (port))
{
- msg (msglevel, "port number associated with host %s is out of range", e.hostname);
+ msg (msglevel, "remote: port number associated with host %s is out of range", p[1]);
goto err;
}
+ re.remote_port = port;
+ if (p[3])
+ {
+ const int proto = ascii2proto (p[3]);
+ if (proto < 0)
+ {
+ msg (msglevel, "remote: bad protocol associated with host %s: '%s'", p[1], p[3]);
+ goto err;
+ }
+ re.proto = proto;
+ }
+ }
+#ifdef ENABLE_CONNECTION
+ if (permission_mask & OPT_P_GENERAL)
+ {
+ struct remote_entry *e = alloc_remote_entry (options, msglevel);
+ if (!e)
+ goto err;
+ *e = re;
+ }
+ else if (permission_mask & OPT_P_CONNECTION)
+#endif
+ {
+ connection_entry_load_re (&options->ce, &re);
}
- else
- e.port = -1;
- l->array[l->len++] = e;
}
else if (streq (p[0], "resolv-retry") && p[1])
{
@@ -3327,20 +3526,20 @@ add_option (struct options *options,
}
else if (streq (p[0], "connect-retry") && p[1])
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->connect_retry_seconds = positive_atoi (p[1]);
- options->connect_retry_defined = true;
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.connect_retry_seconds = positive_atoi (p[1]);
+ options->ce.connect_retry_defined = true;
}
else if (streq (p[0], "connect-timeout") && p[1])
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->connect_timeout = positive_atoi (p[1]);
- options->connect_timeout_defined = true;
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.connect_timeout = positive_atoi (p[1]);
+ options->ce.connect_timeout_defined = true;
}
else if (streq (p[0], "connect-retry-max") && p[1])
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->connect_retry_max = positive_atoi (p[1]);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.connect_retry_max = positive_atoi (p[1]);
}
else if (streq (p[0], "ipchange") && p[1])
{
@@ -3351,8 +3550,8 @@ add_option (struct options *options,
}
else if (streq (p[0], "float"))
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->remote_float = true;
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.remote_float = true;
}
#ifdef ENABLE_DEBUG
else if (streq (p[0], "gremlin") && p[1])
@@ -3687,54 +3886,54 @@ add_option (struct options *options,
{
int port;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
port = atoi (p[1]);
if (!legal_ipv4_port (port))
{
msg (msglevel, "Bad port number: %s", p[1]);
goto err;
}
- options->port_option_used = true;
- options->local_port = options->remote_port = port;
+ options->ce.port_option_used = true;
+ options->ce.local_port = options->ce.remote_port = port;
}
else if (streq (p[0], "lport") && p[1])
{
int port;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
port = atoi (p[1]);
if (!legal_ipv4_port (port))
{
msg (msglevel, "Bad local port number: %s", p[1]);
goto err;
}
- options->local_port_defined = true;
- options->port_option_used = true;
- options->local_port = port;
+ options->ce.local_port_defined = true;
+ options->ce.port_option_used = true;
+ options->ce.local_port = port;
}
else if (streq (p[0], "rport") && p[1])
{
int port;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
port = atoi (p[1]);
if (!legal_ipv4_port (port))
{
msg (msglevel, "Bad remote port number: %s", p[1]);
goto err;
}
- options->port_option_used = true;
- options->remote_port = port;
+ options->ce.port_option_used = true;
+ options->ce.remote_port = port;
}
else if (streq (p[0], "bind"))
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->bind_defined = true;
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.bind_defined = true;
}
else if (streq (p[0], "nobind"))
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->bind_local = false;
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.bind_local = false;
}
else if (streq (p[0], "fast-io"))
{
@@ -3751,7 +3950,7 @@ add_option (struct options *options,
else if (streq (p[0], "proto") && p[1])
{
int proto;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
proto = ascii2proto (p[1]);
if (proto < 0)
{
@@ -3760,7 +3959,7 @@ add_option (struct options *options,
proto2ascii_all (&gc));
goto err;
}
- options->proto = proto;
+ options->ce.proto = proto;
}
#ifdef GENERAL_PROXY_SUPPORT
else if (streq (p[0], "auto-proxy"))
@@ -3799,7 +3998,7 @@ add_option (struct options *options,
{
struct http_proxy_options *ho;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
{
int port;
@@ -3844,7 +4043,7 @@ add_option (struct options *options,
else if (streq (p[0], "http-proxy-retry"))
{
struct http_proxy_options *ho;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
ho = init_http_options_if_undefined (options);
ho->retry = true;
}
@@ -3852,7 +4051,7 @@ add_option (struct options *options,
{
struct http_proxy_options *ho;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
ho = init_http_options_if_undefined (options);
ho->timeout = positive_atoi (p[1]);
}
@@ -3860,7 +4059,7 @@ add_option (struct options *options,
{
struct http_proxy_options *ho;
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
ho = init_http_options_if_undefined (options);
if (streq (p[1], "VERSION") && p[2])
@@ -3880,7 +4079,7 @@ add_option (struct options *options,
#ifdef ENABLE_SOCKS
else if (streq (p[0], "socks-proxy") && p[1])
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
if (p[2])
{
@@ -3891,18 +4090,18 @@ add_option (struct options *options,
msg (msglevel, "Bad socks-proxy port number: %s", p[2]);
goto err;
}
- options->socks_proxy_port = port;
+ options->ce.socks_proxy_port = port;
}
else
{
- options->socks_proxy_port = 1080;
+ options->ce.socks_proxy_port = 1080;
}
- options->socks_proxy_server = p[1];
+ options->ce.socks_proxy_server = p[1];
}
else if (streq (p[0], "socks-proxy-retry"))
{
- VERIFY_PERMISSION (OPT_P_GENERAL);
- options->socks_proxy_retry = true;
+ VERIFY_PERMISSION (OPT_P_GENERAL|OPT_P_CONNECTION);
+ options->ce.socks_proxy_retry = true;
}
#endif
else if (streq (p[0], "keepalive") && p[1] && p[2])