New upstream version 2.4.0upstream/2.4.0

1 files changed, 437 insertions, 385 deletions

diff --git a/src/openvpn/helper.c b/src/openvpn/helper.c
index 229523d..adcc4f8 100644
--- a/src/openvpn/helper.c
+++ b/src/openvpn/helper.c
@@ -5,7 +5,7 @@
  *             packet encryption, packet authentication, and
  *             packet compression.
  *
- *  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
+ *  Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
@@ -40,101 +40,107 @@
 #if P2MP_SERVER
 
 static const char *
-print_netmask (int netbits, struct gc_arena *gc)
+print_netmask(int netbits, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (128, gc);
-  const in_addr_t netmask = netbits_to_netmask (netbits);
+    struct buffer out = alloc_buf_gc(128, gc);
+    const in_addr_t netmask = netbits_to_netmask(netbits);
 
-  buf_printf (&out, "%s (/%d)", print_in_addr_t (netmask, 0, gc), netbits);
+    buf_printf(&out, "%s (/%d)", print_in_addr_t(netmask, 0, gc), netbits);
 
-  return BSTR (&out);
+    return BSTR(&out);
 }
 
 static const char *
-print_opt_route_gateway (const in_addr_t route_gateway, struct gc_arena *gc)
+print_opt_route_gateway(const in_addr_t route_gateway, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (128, gc);
-  ASSERT (route_gateway);
-  buf_printf (&out, "route-gateway %s", print_in_addr_t (route_gateway, 0, gc));
-  return BSTR (&out);
+    struct buffer out = alloc_buf_gc(128, gc);
+    ASSERT(route_gateway);
+    buf_printf(&out, "route-gateway %s", print_in_addr_t(route_gateway, 0, gc));
+    return BSTR(&out);
 }
 
 static const char *
-print_opt_route_gateway_dhcp (struct gc_arena *gc)
+print_opt_route_gateway_dhcp(struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (32, gc);
-  buf_printf (&out, "route-gateway dhcp");
-  return BSTR (&out);
+    struct buffer out = alloc_buf_gc(32, gc);
+    buf_printf(&out, "route-gateway dhcp");
+    return BSTR(&out);
 }
 
 static const char *
-print_opt_route (const in_addr_t network, const in_addr_t netmask, struct gc_arena *gc)
+print_opt_route(const in_addr_t network, const in_addr_t netmask, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (128, gc);
-  ASSERT (network);
-
-  if (netmask)
-    buf_printf (&out, "route %s %s",
-		print_in_addr_t (network, 0, gc),
-		print_in_addr_t (netmask, 0, gc));
-  else
-    buf_printf (&out, "route %s",
-		print_in_addr_t (network, 0, gc));
-
-  return BSTR (&out);
+    struct buffer out = alloc_buf_gc(128, gc);
+    ASSERT(network);
+
+    if (netmask)
+    {
+        buf_printf(&out, "route %s %s",
+                   print_in_addr_t(network, 0, gc),
+                   print_in_addr_t(netmask, 0, gc));
+    }
+    else
+    {
+        buf_printf(&out, "route %s",
+                   print_in_addr_t(network, 0, gc));
+    }
+
+    return BSTR(&out);
 }
 
 static const char *
-print_opt_topology (const int topology, struct gc_arena *gc)
+print_opt_topology(const int topology, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (128, gc);
+    struct buffer out = alloc_buf_gc(128, gc);
 
-  buf_printf (&out, "topology %s", print_topology (topology));
+    buf_printf(&out, "topology %s", print_topology(topology));
 
-  return BSTR (&out);
+    return BSTR(&out);
 }
 
 static const char *
-print_str_int (const char *str, const int i, struct gc_arena *gc)
+print_str_int(const char *str, const int i, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (128, gc);
-  buf_printf (&out, "%s %d", str, i);
-  return BSTR (&out);
+    struct buffer out = alloc_buf_gc(128, gc);
+    buf_printf(&out, "%s %d", str, i);
+    return BSTR(&out);
 }
 
 static const char *
-print_str (const char *str, struct gc_arena *gc)
+print_str(const char *str, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (128, gc);
-  buf_printf (&out, "%s", str);
-  return BSTR (&out);
+    struct buffer out = alloc_buf_gc(128, gc);
+    buf_printf(&out, "%s", str);
+    return BSTR(&out);
 }
 
 static void
-helper_add_route (const in_addr_t network, const in_addr_t netmask, struct options *o)
+helper_add_route(const in_addr_t network, const in_addr_t netmask, struct options *o)
 {
-  rol_check_alloc (o);
-  add_route_to_option_list (o->routes,
-			    print_in_addr_t (network, 0, &o->gc),
-			    print_in_addr_t (netmask, 0, &o->gc),
-			    NULL,
-			    NULL);
+    rol_check_alloc(o);
+    add_route_to_option_list(o->routes,
+                             print_in_addr_t(network, 0, &o->gc),
+                             print_in_addr_t(netmask, 0, &o->gc),
+                             NULL,
+                             NULL);
 }
 
 static void
-verify_common_subnet (const char *opt, const in_addr_t a, const in_addr_t b, const in_addr_t subnet)
+verify_common_subnet(const char *opt, const in_addr_t a, const in_addr_t b, const in_addr_t subnet)
 {
-  struct gc_arena gc = gc_new ();
-  if ((a & subnet) != (b & subnet))
-    msg (M_USAGE, "%s IP addresses %s and %s are not in the same %s subnet",
-	 opt,
-	 print_in_addr_t (a, 0, &gc),
-	 print_in_addr_t (b, 0, &gc),
-	 print_in_addr_t (subnet, 0, &gc));
-  gc_free (&gc);
+    struct gc_arena gc = gc_new();
+    if ((a & subnet) != (b & subnet))
+    {
+        msg(M_USAGE, "%s IP addresses %s and %s are not in the same %s subnet",
+            opt,
+            print_in_addr_t(a, 0, &gc),
+            print_in_addr_t(b, 0, &gc),
+            print_in_addr_t(subnet, 0, &gc));
+    }
+    gc_free(&gc);
 }
 
-#endif
+#endif /* if P2MP_SERVER */
 
 /*
  * Process server, server-bridge, and client helper
@@ -142,309 +148,349 @@ verify_common_subnet (const char *opt, const in_addr_t a, const in_addr_t b, con
  * parsed and placed in struct options.
  */
 void
-helper_client_server (struct options *o)
+helper_client_server(struct options *o)
 {
-  struct gc_arena gc = gc_new ();
+    struct gc_arena gc = gc_new();
 
 #if P2MP
 #if P2MP_SERVER
 
 /*
-   * Get tun/tap/null device type
-   */
-  const int dev = dev_type_enum (o->dev, o->dev_type);
-  const int topology = o->topology;
-
-  /* 
-   *
-   * HELPER DIRECTIVE for IPv6
-   *
-   * server-ipv6 2001:db8::/64
-   *
-   * EXPANDS TO:
-   *
-   * tun-ipv6
-   * push "tun-ipv6"
-   * ifconfig-ipv6 2001:db8::1 2001:db8::2
-   * if !nopool: 
-   *   ifconfig-ipv6-pool 2001:db8::1000/64
-   * 
-   */
-   if ( o->server_ipv6_defined )
-     {
-	if ( ! o->server_defined )
-	  {
-	    msg (M_USAGE, "--server-ipv6 must be used together with --server");
-	  }
-	if ( o->server_flags & SF_NOPOOL )
-	  {
-	    msg( M_USAGE, "--server-ipv6 is incompatible with 'nopool' option" );
-	  }
-	if ( o->ifconfig_ipv6_pool_defined )
-	  {
-	    msg( M_USAGE, "--server-ipv6 already defines an ifconfig-ipv6-pool, so you can't also specify --ifconfig-pool explicitly");
-	  }
+ * Get tun/tap/null device type
+ */
+    const int dev = dev_type_enum(o->dev, o->dev_type);
+    const int topology = o->topology;
+
+    /*
+     *
+     * HELPER DIRECTIVE for IPv6
+     *
+     * server-ipv6 2001:db8::/64
+     *
+     * EXPANDS TO:
+     *
+     * tun-ipv6
+     * push "tun-ipv6"
+     * ifconfig-ipv6 2001:db8::1 2001:db8::2
+     * if !nopool:
+     *   ifconfig-ipv6-pool 2001:db8::1000/64
+     *
+     */
+    if (o->server_ipv6_defined)
+    {
+        if (!o->server_defined)
+        {
+            msg(M_USAGE, "--server-ipv6 must be used together with --server");
+        }
+        if (o->server_flags & SF_NOPOOL)
+        {
+            msg( M_USAGE, "--server-ipv6 is incompatible with 'nopool' option" );
+        }
+        if (o->ifconfig_ipv6_pool_defined)
+        {
+            msg( M_USAGE, "--server-ipv6 already defines an ifconfig-ipv6-pool, so you can't also specify --ifconfig-pool explicitly");
+        }
 
         /* local ifconfig is "base address + 1" and "+2" */
-	o->ifconfig_ipv6_local = 
-		print_in6_addr( add_in6_addr( o->server_network_ipv6, 1), 0, &o->gc );
-	o->ifconfig_ipv6_remote = 
-		print_in6_addr( add_in6_addr( o->server_network_ipv6, 2), 0, &o->gc );
-	o->ifconfig_ipv6_netbits = o->server_netbits_ipv6;
-
-	/* pool starts at "base address + 0x1000" - leave enough room */
-	ASSERT( o->server_netbits_ipv6 <= 112 );	/* want 16 bits */
-
-	o->ifconfig_ipv6_pool_defined = true;
-	o->ifconfig_ipv6_pool_base = 
-		add_in6_addr( o->server_network_ipv6, 0x1000 );
-	o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6;
-
-	push_option( o, "tun-ipv6", M_USAGE );
-     }
-
-  /*
-   *
-   * HELPER DIRECTIVE:
-   *
-   * server 10.8.0.0 255.255.255.0
-   *
-   * EXPANDS TO:
-   *
-   * mode server
-   * tls-server
-   * push "topology [topology]"
-   *
-   * if tun AND (topology == net30 OR topology == p2p):
-   *   ifconfig 10.8.0.1 10.8.0.2
-   *   if !nopool: 
-   *     ifconfig-pool 10.8.0.4 10.8.0.251
-   *   route 10.8.0.0 255.255.255.0
-   *   if client-to-client:
-   *     push "route 10.8.0.0 255.255.255.0"
-   *   else if topology == net30:
-   *     push "route 10.8.0.1"
-   *
-   * if tap OR (tun AND topology == subnet):
-   *   ifconfig 10.8.0.1 255.255.255.0
-   *   if !nopool: 
-   *     ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
-   *   push "route-gateway 10.8.0.1"
-   *   if route-gateway unset:
-   *     route-gateway 10.8.0.2
-   */
-
-  if (o->server_defined)
+        o->ifconfig_ipv6_local =
+            print_in6_addr( add_in6_addr( o->server_network_ipv6, 1), 0, &o->gc );
+        o->ifconfig_ipv6_remote =
+            print_in6_addr( add_in6_addr( o->server_network_ipv6, 2), 0, &o->gc );
+        o->ifconfig_ipv6_netbits = o->server_netbits_ipv6;
+
+        /* pool starts at "base address + 0x1000" - leave enough room */
+        ASSERT( o->server_netbits_ipv6 <= 112 );        /* want 16 bits */
+
+        o->ifconfig_ipv6_pool_defined = true;
+        o->ifconfig_ipv6_pool_base =
+            add_in6_addr( o->server_network_ipv6, 0x1000 );
+        o->ifconfig_ipv6_pool_netbits = o->server_netbits_ipv6;
+
+        push_option( o, "tun-ipv6", M_USAGE );
+    }
+
+    /*
+     *
+     * HELPER DIRECTIVE:
+     *
+     * server 10.8.0.0 255.255.255.0
+     *
+     * EXPANDS TO:
+     *
+     * mode server
+     * tls-server
+     * push "topology [topology]"
+     *
+     * if tun AND (topology == net30 OR topology == p2p):
+     *   ifconfig 10.8.0.1 10.8.0.2
+     *   if !nopool:
+     *     ifconfig-pool 10.8.0.4 10.8.0.251
+     *   route 10.8.0.0 255.255.255.0
+     *   if client-to-client:
+     *     push "route 10.8.0.0 255.255.255.0"
+     *   else if topology == net30:
+     *     push "route 10.8.0.1"
+     *
+     * if tap OR (tun AND topology == subnet):
+     *   ifconfig 10.8.0.1 255.255.255.0
+     *   if !nopool:
+     *     ifconfig-pool 10.8.0.2 10.8.0.253 255.255.255.0
+     *   push "route-gateway 10.8.0.1"
+     *   if route-gateway unset:
+     *     route-gateway 10.8.0.2
+     */
+
+    if (o->server_defined)
     {
-      int netbits = -2;
-      bool status = false;
-
-      if (o->client)
-	msg (M_USAGE, "--server and --client cannot be used together");
-
-      if (o->server_bridge_defined || o->server_bridge_proxy_dhcp)
-	msg (M_USAGE, "--server and --server-bridge cannot be used together");
-
-      if (o->shared_secret_file)
-	msg (M_USAGE, "--server and --secret cannot be used together (you must use SSL/TLS keys)");
-
-      if (!(o->server_flags & SF_NOPOOL) && o->ifconfig_pool_defined)
-	msg (M_USAGE, "--server already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly");
-
-      if (!(dev == DEV_TYPE_TAP || dev == DEV_TYPE_TUN))
-	msg (M_USAGE, "--server directive only makes sense with --dev tun or --dev tap");
-
-      status = netmask_to_netbits (o->server_network, o->server_netmask, &netbits);
-      if (!status)
-	msg (M_USAGE, "--server directive network/netmask combination is invalid");
-
-      if (netbits < 0)
-	msg (M_USAGE, "--server directive netmask is invalid");
-
-      if (netbits < IFCONFIG_POOL_MIN_NETBITS)
-	msg (M_USAGE, "--server directive netmask allows for too many host addresses (subnet must be %s or higher)",
-	     print_netmask (IFCONFIG_POOL_MIN_NETBITS, &gc));
-
-      if (dev == DEV_TYPE_TUN)
-	{
-	  int pool_end_reserve = 4;
-
-	  if (netbits > 29)
-	    msg (M_USAGE, "--server directive when used with --dev tun must define a subnet of %s or lower",
-		 print_netmask (29, &gc));
-
-	  if (netbits == 29)
-	    pool_end_reserve = 0;
-
-	  o->mode = MODE_SERVER;
-	  o->tls_server = true;
-
-	  if (topology == TOP_NET30 || topology == TOP_P2P)
-	    {
-	      o->ifconfig_local = print_in_addr_t (o->server_network + 1, 0, &o->gc);
-	      o->ifconfig_remote_netmask = print_in_addr_t (o->server_network + 2, 0, &o->gc);
-
-	      if (!(o->server_flags & SF_NOPOOL))
-		{
-		  o->ifconfig_pool_defined = true;
-		  o->ifconfig_pool_start = o->server_network + 4;
-		  o->ifconfig_pool_end = (o->server_network | ~o->server_netmask) - pool_end_reserve;
-		  ifconfig_pool_verify_range (M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
-		}
-
-	      helper_add_route (o->server_network, o->server_netmask, o);
-	      if (o->enable_c2c)
-		push_option (o, print_opt_route (o->server_network, o->server_netmask, &o->gc), M_USAGE);
-	      else if (topology == TOP_NET30)
-		push_option (o, print_opt_route (o->server_network + 1, 0, &o->gc), M_USAGE);
-	    }
-	  else if (topology == TOP_SUBNET)
-	    {
-	      o->ifconfig_local = print_in_addr_t (o->server_network + 1, 0, &o->gc);
-	      o->ifconfig_remote_netmask = print_in_addr_t (o->server_netmask, 0, &o->gc);
-
-	      if (!(o->server_flags & SF_NOPOOL))
-		{
-		  o->ifconfig_pool_defined = true;
-		  o->ifconfig_pool_start = o->server_network + 2;
-		  o->ifconfig_pool_end = (o->server_network | ~o->server_netmask) - 2;
-		  ifconfig_pool_verify_range (M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
-		}
-	      o->ifconfig_pool_netmask = o->server_netmask;
-
-	      push_option (o, print_opt_route_gateway (o->server_network + 1, &o->gc), M_USAGE);
-	      if (!o->route_default_gateway)
-		o->route_default_gateway = print_in_addr_t (o->server_network + 2, 0, &o->gc);
-	    }
-	  else
-	    ASSERT (0);
-
-	  push_option (o, print_opt_topology (topology, &o->gc), M_USAGE);
-	}
-      else if (dev == DEV_TYPE_TAP)
-	{
-	  if (netbits > 30)
-	    msg (M_USAGE, "--server directive when used with --dev tap must define a subnet of %s or lower",
-		 print_netmask (30, &gc));
-
-	  o->mode = MODE_SERVER;
-	  o->tls_server = true;
-	  o->ifconfig_local = print_in_addr_t (o->server_network + 1, 0, &o->gc);
-	  o->ifconfig_remote_netmask = print_in_addr_t (o->server_netmask, 0, &o->gc);
-
-	  if (!(o->server_flags & SF_NOPOOL))
-	    {
-	      o->ifconfig_pool_defined = true;
-	      o->ifconfig_pool_start = o->server_network + 2;
-	      o->ifconfig_pool_end = (o->server_network | ~o->server_netmask) - 1;
-	      ifconfig_pool_verify_range (M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
-	    }
-	  o->ifconfig_pool_netmask = o->server_netmask;
-
-	  push_option (o, print_opt_route_gateway (o->server_network + 1, &o->gc), M_USAGE);
-	}
-      else
-	{
-	  ASSERT (0);
-	}
-
-      /* set push-ifconfig-constraint directive */
-      if ((dev == DEV_TYPE_TAP || topology == TOP_SUBNET))
-	{
-	  o->push_ifconfig_constraint_defined = true;
-	  o->push_ifconfig_constraint_network = o->server_network;
-	  o->push_ifconfig_constraint_netmask = o->server_netmask;
-	}
+        int netbits = -2;
+        bool status = false;
+
+        if (o->client)
+        {
+            msg(M_USAGE, "--server and --client cannot be used together");
+        }
+
+        if (o->server_bridge_defined || o->server_bridge_proxy_dhcp)
+        {
+            msg(M_USAGE, "--server and --server-bridge cannot be used together");
+        }
+
+        if (o->shared_secret_file)
+        {
+            msg(M_USAGE, "--server and --secret cannot be used together (you must use SSL/TLS keys)");
+        }
+
+        if (!(o->server_flags & SF_NOPOOL) && o->ifconfig_pool_defined)
+        {
+            msg(M_USAGE, "--server already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly");
+        }
+
+        if (!(dev == DEV_TYPE_TAP || dev == DEV_TYPE_TUN))
+        {
+            msg(M_USAGE, "--server directive only makes sense with --dev tun or --dev tap");
+        }
+
+        status = netmask_to_netbits(o->server_network, o->server_netmask, &netbits);
+        if (!status)
+        {
+            msg(M_USAGE, "--server directive network/netmask combination is invalid");
+        }
+
+        if (netbits < 0)
+        {
+            msg(M_USAGE, "--server directive netmask is invalid");
+        }
+
+        if (netbits < IFCONFIG_POOL_MIN_NETBITS)
+        {
+            msg(M_USAGE, "--server directive netmask allows for too many host addresses (subnet must be %s or higher)",
+                print_netmask(IFCONFIG_POOL_MIN_NETBITS, &gc));
+        }
+
+        if (dev == DEV_TYPE_TUN)
+        {
+            int pool_end_reserve = 4;
+
+            if (netbits > 29)
+            {
+                msg(M_USAGE, "--server directive when used with --dev tun must define a subnet of %s or lower",
+                    print_netmask(29, &gc));
+            }
+
+            if (netbits == 29)
+            {
+                pool_end_reserve = 0;
+            }
+
+            o->mode = MODE_SERVER;
+            o->tls_server = true;
+
+            if (topology == TOP_NET30 || topology == TOP_P2P)
+            {
+                o->ifconfig_local = print_in_addr_t(o->server_network + 1, 0, &o->gc);
+                o->ifconfig_remote_netmask = print_in_addr_t(o->server_network + 2, 0, &o->gc);
+
+                if (!(o->server_flags & SF_NOPOOL))
+                {
+                    o->ifconfig_pool_defined = true;
+                    o->ifconfig_pool_start = o->server_network + 4;
+                    o->ifconfig_pool_end = (o->server_network | ~o->server_netmask) - pool_end_reserve;
+                    ifconfig_pool_verify_range(M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
+                }
+
+                helper_add_route(o->server_network, o->server_netmask, o);
+                if (o->enable_c2c)
+                {
+                    push_option(o, print_opt_route(o->server_network, o->server_netmask, &o->gc), M_USAGE);
+                }
+                else if (topology == TOP_NET30)
+                {
+                    push_option(o, print_opt_route(o->server_network + 1, 0, &o->gc), M_USAGE);
+                }
+            }
+            else if (topology == TOP_SUBNET)
+            {
+                o->ifconfig_local = print_in_addr_t(o->server_network + 1, 0, &o->gc);
+                o->ifconfig_remote_netmask = print_in_addr_t(o->server_netmask, 0, &o->gc);
+
+                if (!(o->server_flags & SF_NOPOOL))
+                {
+                    o->ifconfig_pool_defined = true;
+                    o->ifconfig_pool_start = o->server_network + 2;
+                    o->ifconfig_pool_end = (o->server_network | ~o->server_netmask) - 2;
+                    ifconfig_pool_verify_range(M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
+                }
+                o->ifconfig_pool_netmask = o->server_netmask;
+
+                push_option(o, print_opt_route_gateway(o->server_network + 1, &o->gc), M_USAGE);
+                if (!o->route_default_gateway)
+                {
+                    o->route_default_gateway = print_in_addr_t(o->server_network + 2, 0, &o->gc);
+                }
+            }
+            else
+            {
+                ASSERT(0);
+            }
+
+            push_option(o, print_opt_topology(topology, &o->gc), M_USAGE);
+        }
+        else if (dev == DEV_TYPE_TAP)
+        {
+            if (netbits > 30)
+            {
+                msg(M_USAGE, "--server directive when used with --dev tap must define a subnet of %s or lower",
+                    print_netmask(30, &gc));
+            }
+
+            o->mode = MODE_SERVER;
+            o->tls_server = true;
+            o->ifconfig_local = print_in_addr_t(o->server_network + 1, 0, &o->gc);
+            o->ifconfig_remote_netmask = print_in_addr_t(o->server_netmask, 0, &o->gc);
+
+            if (!(o->server_flags & SF_NOPOOL))
+            {
+                o->ifconfig_pool_defined = true;
+                o->ifconfig_pool_start = o->server_network + 2;
+                o->ifconfig_pool_end = (o->server_network | ~o->server_netmask) - 1;
+                ifconfig_pool_verify_range(M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
+            }
+            o->ifconfig_pool_netmask = o->server_netmask;
+
+            push_option(o, print_opt_route_gateway(o->server_network + 1, &o->gc), M_USAGE);
+        }
+        else
+        {
+            ASSERT(0);
+        }
+
+        /* set push-ifconfig-constraint directive */
+        if ((dev == DEV_TYPE_TAP || topology == TOP_SUBNET))
+        {
+            o->push_ifconfig_constraint_defined = true;
+            o->push_ifconfig_constraint_network = o->server_network;
+            o->push_ifconfig_constraint_netmask = o->server_netmask;
+        }
     }
 
-  /*
-   * HELPER DIRECTIVE:
-   *
-   * server-bridge 10.8.0.4 255.255.255.0 10.8.0.128 10.8.0.254
-   *
-   * EXPANDS TO:
-   *
-   * mode server
-   * tls-server
-   *
-   * ifconfig-pool 10.8.0.128 10.8.0.254 255.255.255.0
-   * push "route-gateway 10.8.0.4"
-   *
-   * OR
-   *
-   * server-bridge
-   *
-   * EXPANDS TO:
-   *
-   * mode server
-   * tls-server
-   *
-   * if !nogw:
-   *   push "route-gateway dhcp"
-   */
-  else if (o->server_bridge_defined | o->server_bridge_proxy_dhcp)
+    /*
+     * HELPER DIRECTIVE:
+     *
+     * server-bridge 10.8.0.4 255.255.255.0 10.8.0.128 10.8.0.254
+     *
+     * EXPANDS TO:
+     *
+     * mode server
+     * tls-server
+     *
+     * ifconfig-pool 10.8.0.128 10.8.0.254 255.255.255.0
+     * push "route-gateway 10.8.0.4"
+     *
+     * OR
+     *
+     * server-bridge
+     *
+     * EXPANDS TO:
+     *
+     * mode server
+     * tls-server
+     *
+     * if !nogw:
+     *   push "route-gateway dhcp"
+     */
+    else if (o->server_bridge_defined | o->server_bridge_proxy_dhcp)
     {
-      if (o->client)
-	msg (M_USAGE, "--server-bridge and --client cannot be used together");
-
-      if (!(o->server_flags & SF_NOPOOL) && o->ifconfig_pool_defined)
-	msg (M_USAGE, "--server-bridge already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly");
-
-      if (o->shared_secret_file)
-	msg (M_USAGE, "--server-bridge and --secret cannot be used together (you must use SSL/TLS keys)");
-
-      if (dev != DEV_TYPE_TAP)
-	msg (M_USAGE, "--server-bridge directive only makes sense with --dev tap");
-
-      if (o->server_bridge_defined)
-	{
-	  verify_common_subnet ("--server-bridge", o->server_bridge_ip, o->server_bridge_pool_start, o->server_bridge_netmask); 
-	  verify_common_subnet ("--server-bridge", o->server_bridge_pool_start, o->server_bridge_pool_end, o->server_bridge_netmask); 
-	  verify_common_subnet ("--server-bridge", o->server_bridge_ip, o->server_bridge_pool_end, o->server_bridge_netmask); 
-	}
-
-      o->mode = MODE_SERVER;
-      o->tls_server = true;
-
-      if (o->server_bridge_defined)
-	{
-	  o->ifconfig_pool_defined = true;
-	  o->ifconfig_pool_start = o->server_bridge_pool_start;
-	  o->ifconfig_pool_end = o->server_bridge_pool_end;
-	  ifconfig_pool_verify_range (M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
-	  o->ifconfig_pool_netmask = o->server_bridge_netmask;
-	  push_option (o, print_opt_route_gateway (o->server_bridge_ip, &o->gc), M_USAGE);
-	}
-      else if (o->server_bridge_proxy_dhcp && !(o->server_flags & SF_NO_PUSH_ROUTE_GATEWAY))
-	{
-	  push_option (o, print_opt_route_gateway_dhcp (&o->gc), M_USAGE);
-	}
+        if (o->client)
+        {
+            msg(M_USAGE, "--server-bridge and --client cannot be used together");
+        }
+
+        if (!(o->server_flags & SF_NOPOOL) && o->ifconfig_pool_defined)
+        {
+            msg(M_USAGE, "--server-bridge already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly");
+        }
+
+        if (o->shared_secret_file)
+        {
+            msg(M_USAGE, "--server-bridge and --secret cannot be used together (you must use SSL/TLS keys)");
+        }
+
+        if (dev != DEV_TYPE_TAP)
+        {
+            msg(M_USAGE, "--server-bridge directive only makes sense with --dev tap");
+        }
+
+        if (o->server_bridge_defined)
+        {
+            verify_common_subnet("--server-bridge", o->server_bridge_ip, o->server_bridge_pool_start, o->server_bridge_netmask);
+            verify_common_subnet("--server-bridge", o->server_bridge_pool_start, o->server_bridge_pool_end, o->server_bridge_netmask);
+            verify_common_subnet("--server-bridge", o->server_bridge_ip, o->server_bridge_pool_end, o->server_bridge_netmask);
+        }
+
+        o->mode = MODE_SERVER;
+        o->tls_server = true;
+
+        if (o->server_bridge_defined)
+        {
+            o->ifconfig_pool_defined = true;
+            o->ifconfig_pool_start = o->server_bridge_pool_start;
+            o->ifconfig_pool_end = o->server_bridge_pool_end;
+            ifconfig_pool_verify_range(M_USAGE, o->ifconfig_pool_start, o->ifconfig_pool_end);
+            o->ifconfig_pool_netmask = o->server_bridge_netmask;
+            push_option(o, print_opt_route_gateway(o->server_bridge_ip, &o->gc), M_USAGE);
+        }
+        else if (o->server_bridge_proxy_dhcp && !(o->server_flags & SF_NO_PUSH_ROUTE_GATEWAY))
+        {
+            push_option(o, print_opt_route_gateway_dhcp(&o->gc), M_USAGE);
+        }
     }
-  else
+    else
 #endif /* P2MP_SERVER */
 
-  /*
-   * HELPER DIRECTIVE:
-   *
-   * client
-   *
-   * EXPANDS TO:
-   *
-   * pull
-   * tls-client
-   */
-  if (o->client)
+    /*
+     * HELPER DIRECTIVE:
+     *
+     * client
+     *
+     * EXPANDS TO:
+     *
+     * pull
+     * tls-client
+     */
+    if (o->client)
     {
-      if (o->key_method != 2)
-	msg (M_USAGE, "--client requires --key-method 2");
+        if (o->key_method != 2)
+        {
+            msg(M_USAGE, "--client requires --key-method 2");
+        }
 
-      o->pull = true;
-      o->tls_client = true;
+        o->pull = true;
+        o->tls_client = true;
     }
 
 #endif /* P2MP */
 
-  gc_free (&gc);
+    gc_free(&gc);
 }
 
 /*
@@ -465,45 +511,51 @@ helper_client_server (struct options *o)
  *   ping-restart 60
  */
 void
-helper_keepalive (struct options *o)
+helper_keepalive(struct options *o)
 {
-  if (o->keepalive_ping || o->keepalive_timeout)
+    if (o->keepalive_ping || o->keepalive_timeout)
     {
-      /*
-       * Sanity checks.
-       */
-      if (o->keepalive_ping <= 0 || o->keepalive_timeout <= 0)
-	msg (M_USAGE, "--keepalive parameters must be > 0");
-      if (o->keepalive_ping * 2 > o->keepalive_timeout)
-	msg (M_USAGE, "the second parameter to --keepalive (restart timeout=%d) must be at least twice the value of the first parameter (ping interval=%d).  A ratio of 1:5 or 1:6 would be even better.  Recommended setting is --keepalive 10 60.",
-	     o->keepalive_timeout,
-	     o->keepalive_ping);
-      if (o->ping_send_timeout || o->ping_rec_timeout)
-	msg (M_USAGE, "--keepalive conflicts with --ping, --ping-exit, or --ping-restart.  If you use --keepalive, you don't need any of the other --ping directives.");
-
-      /*
-       * Expand.
-       */
-      if (o->mode == MODE_POINT_TO_POINT)
-	{
-	  o->ping_rec_timeout_action = PING_RESTART;
-	  o->ping_send_timeout = o->keepalive_ping;
-	  o->ping_rec_timeout = o->keepalive_timeout;
-	}
+        /*
+         * Sanity checks.
+         */
+        if (o->keepalive_ping <= 0 || o->keepalive_timeout <= 0)
+        {
+            msg(M_USAGE, "--keepalive parameters must be > 0");
+        }
+        if (o->keepalive_ping * 2 > o->keepalive_timeout)
+        {
+            msg(M_USAGE, "the second parameter to --keepalive (restart timeout=%d) must be at least twice the value of the first parameter (ping interval=%d).  A ratio of 1:5 or 1:6 would be even better.  Recommended setting is --keepalive 10 60.",
+                o->keepalive_timeout,
+                o->keepalive_ping);
+        }
+        if (o->ping_send_timeout || o->ping_rec_timeout)
+        {
+            msg(M_USAGE, "--keepalive conflicts with --ping, --ping-exit, or --ping-restart.  If you use --keepalive, you don't need any of the other --ping directives.");
+        }
+
+        /*
+         * Expand.
+         */
+        if (o->mode == MODE_POINT_TO_POINT)
+        {
+            o->ping_rec_timeout_action = PING_RESTART;
+            o->ping_send_timeout = o->keepalive_ping;
+            o->ping_rec_timeout = o->keepalive_timeout;
+        }
 #if P2MP_SERVER
-      else if (o->mode == MODE_SERVER)
-	{
-	  o->ping_rec_timeout_action = PING_RESTART;
-	  o->ping_send_timeout = o->keepalive_ping;
-	  o->ping_rec_timeout = o->keepalive_timeout * 2;
-	  push_option (o, print_str_int ("ping", o->keepalive_ping, &o->gc), M_USAGE);
-	  push_option (o, print_str_int ("ping-restart", o->keepalive_timeout, &o->gc), M_USAGE);
-	}
+        else if (o->mode == MODE_SERVER)
+        {
+            o->ping_rec_timeout_action = PING_RESTART;
+            o->ping_send_timeout = o->keepalive_ping;
+            o->ping_rec_timeout = o->keepalive_timeout * 2;
+            push_option(o, print_str_int("ping", o->keepalive_ping, &o->gc), M_USAGE);
+            push_option(o, print_str_int("ping-restart", o->keepalive_timeout, &o->gc), M_USAGE);
+        }
 #endif
-      else
-	{
-	  ASSERT (0);
-	}
+        else
+        {
+            ASSERT(0);
+        }
     }
 }
 
@@ -520,20 +572,20 @@ helper_keepalive (struct options *o)
  *   push "socket-flags TCP_NODELAY"
  */
 void
-helper_tcp_nodelay (struct options *o)
+helper_tcp_nodelay(struct options *o)
 {
 #if P2MP_SERVER
-  if (o->server_flags & SF_TCP_NODELAY_HELPER)
+    if (o->server_flags & SF_TCP_NODELAY_HELPER)
     {
-      if (o->mode == MODE_SERVER)
-	{
-	  o->sockflags |= SF_TCP_NODELAY;	  
-	  push_option (o, print_str ("socket-flags TCP_NODELAY", &o->gc), M_USAGE);
-	}
-      else
-	{
-	  o->sockflags |= SF_TCP_NODELAY;
-	}
+        if (o->mode == MODE_SERVER)
+        {
+            o->sockflags |= SF_TCP_NODELAY;
+            push_option(o, print_str("socket-flags TCP_NODELAY", &o->gc), M_USAGE);
+        }
+        else
+        {
+            o->sockflags |= SF_TCP_NODELAY;
+        }
     }
 #endif
 }