Merge tag 'upstream/2.4.0'

Upstream version 2.4.0

1 files changed, 2884 insertions, 2477 deletions

diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index c233f2b..ae12832 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -5,7 +5,7 @@
  *             packet encryption, packet authentication, and
  *             packet compression.
  *
- *  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
+ *  Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
@@ -45,14 +45,14 @@
 #include "memdbg.h"
 
 const int proto_overhead[] = { /* indexed by PROTO_x */
-  0,
-  IPv4_UDP_HEADER_SIZE, /* IPv4 */
-  IPv4_TCP_HEADER_SIZE,
-  IPv4_TCP_HEADER_SIZE,
-  IPv6_UDP_HEADER_SIZE, /* IPv6 */
-  IPv6_TCP_HEADER_SIZE,
-  IPv6_TCP_HEADER_SIZE,
-  IPv6_TCP_HEADER_SIZE,
+    0,
+    IPv4_UDP_HEADER_SIZE, /* IPv4 */
+    IPv4_TCP_HEADER_SIZE,
+    IPv4_TCP_HEADER_SIZE,
+    IPv6_UDP_HEADER_SIZE, /* IPv6 */
+    IPv6_TCP_HEADER_SIZE,
+    IPv6_TCP_HEADER_SIZE,
+    IPv6_TCP_HEADER_SIZE,
 };
 
 /*
@@ -62,10 +62,14 @@ static unsigned int
 sf2gaf(const unsigned int getaddr_flags,
        const unsigned int sockflags)
 {
-  if (sockflags & SF_HOST_RANDOMIZE)
-    return getaddr_flags | GETADDR_RANDOMIZE;
-  else
-    return getaddr_flags;
+    if (sockflags & SF_HOST_RANDOMIZE)
+    {
+        return getaddr_flags | GETADDR_RANDOMIZE;
+    }
+    else
+    {
+        return getaddr_flags;
+    }
 }
 
 /*
@@ -78,201 +82,232 @@ sf2gaf(const unsigned int getaddr_flags,
  * resolve_retry_seconds seconds.
  */
 in_addr_t
-getaddr (unsigned int flags,
-         const char *hostname,
-         int resolve_retry_seconds,
-         bool *succeeded,
-         volatile int *signal_received)
-{
-  struct addrinfo *ai;
-  int status;
-  status = openvpn_getaddrinfo (flags & ~GETADDR_HOST_ORDER, hostname, NULL,
-                                resolve_retry_seconds, signal_received, AF_INET, &ai);
-  if(status==0) {
-    struct in_addr ia;
-    if(succeeded)
-      *succeeded=true;
-    ia = ((struct sockaddr_in*)ai->ai_addr)->sin_addr;
-    freeaddrinfo(ai);
-    return (flags & GETADDR_HOST_ORDER) ? ntohl (ia.s_addr) : ia.s_addr;
-  } else {
-    if(succeeded)
-      *succeeded =false;
-    return 0;
-  }
+getaddr(unsigned int flags,
+        const char *hostname,
+        int resolve_retry_seconds,
+        bool *succeeded,
+        volatile int *signal_received)
+{
+    struct addrinfo *ai;
+    int status;
+    status = openvpn_getaddrinfo(flags & ~GETADDR_HOST_ORDER, hostname, NULL,
+                                 resolve_retry_seconds, signal_received, AF_INET, &ai);
+    if (status==0)
+    {
+        struct in_addr ia;
+        if (succeeded)
+        {
+            *succeeded = true;
+        }
+        ia = ((struct sockaddr_in *)ai->ai_addr)->sin_addr;
+        freeaddrinfo(ai);
+        return (flags & GETADDR_HOST_ORDER) ? ntohl(ia.s_addr) : ia.s_addr;
+    }
+    else
+    {
+        if (succeeded)
+        {
+            *succeeded = false;
+        }
+        return 0;
+    }
 }
 
 static inline bool
-streqnull (const char* a, const char* b)
+streqnull(const char *a, const char *b)
 {
-  if (a == NULL && b == NULL)
-    return true;
-  else if (a == NULL || b == NULL)
-    return false;
-  else
-    return streq (a, b);
+    if (a == NULL && b == NULL)
+    {
+        return true;
+    }
+    else if (a == NULL || b == NULL)
+    {
+        return false;
+    }
+    else
+    {
+        return streq(a, b);
+    }
 }
 
 /*
-  get_cached_dns_entry return 0 on success and -1
-  otherwise. (like getaddrinfo)
+ * get_cached_dns_entry return 0 on success and -1
+ * otherwise. (like getaddrinfo)
  */
 static int
-get_cached_dns_entry (struct cached_dns_entry* dns_cache,
-		      const char* hostname,
-		      const char* servname,
-		      int ai_family,
-		      int resolve_flags,
-		      struct addrinfo **ai)
+get_cached_dns_entry(struct cached_dns_entry *dns_cache,
+                     const char *hostname,
+                     const char *servname,
+                     int ai_family,
+                     int resolve_flags,
+                     struct addrinfo **ai)
 {
-  struct cached_dns_entry *ph;
-  int flags;
+    struct cached_dns_entry *ph;
+    int flags;
 
-  /* Only use flags that are relevant for the structure */
-  flags = resolve_flags & GETADDR_CACHE_MASK;
+    /* Only use flags that are relevant for the structure */
+    flags = resolve_flags & GETADDR_CACHE_MASK;
 
-  for (ph = dns_cache; ph ; ph = ph->next)
+    for (ph = dns_cache; ph; ph = ph->next)
     {
-      if (streqnull (ph->hostname, hostname) &&
-	  streqnull (ph->servname, servname) &&
-	  ph->ai_family == ai_family &&
-	  ph->flags == flags)
-	{
-	  *ai = ph->ai;
-	  return 0;
-	}
+        if (streqnull(ph->hostname, hostname)
+            && streqnull(ph->servname, servname)
+            && ph->ai_family == ai_family
+            && ph->flags == flags)
+        {
+            *ai = ph->ai;
+            return 0;
+        }
     }
-  return -1;
+    return -1;
 }
 
 
 static int
-do_preresolve_host (struct context *c,
-		    const char *hostname,
-		    const char *servname,
-		    const int af,
-		    const int flags)
+do_preresolve_host(struct context *c,
+                   const char *hostname,
+                   const char *servname,
+                   const int af,
+                   const int flags)
 {
-  struct addrinfo *ai;
-  int status;
+    struct addrinfo *ai;
+    int status;
 
-  if (get_cached_dns_entry(c->c1.dns_cache,
-			   hostname,
-			   servname,
-			   af,
-			   flags,
-			   &ai) == 0 )
+    if (get_cached_dns_entry(c->c1.dns_cache,
+                             hostname,
+                             servname,
+                             af,
+                             flags,
+                             &ai) == 0)
     {
-      /* entry already cached, return success */
-      return 0;
+        /* entry already cached, return success */
+        return 0;
     }
 
-  status = openvpn_getaddrinfo (flags, hostname, servname,
-				c->options.resolve_retry_seconds, NULL,
-				af, &ai);
-  if (status == 0)
+    status = openvpn_getaddrinfo(flags, hostname, servname,
+                                 c->options.resolve_retry_seconds, NULL,
+                                 af, &ai);
+    if (status == 0)
     {
-      struct cached_dns_entry *ph;
+        struct cached_dns_entry *ph;
 
-      ALLOC_OBJ_CLEAR_GC (ph, struct cached_dns_entry, &c->gc);
-      ph->ai = ai;
-      ph->hostname = hostname;
-      ph->servname = servname;
-      ph->flags = flags & GETADDR_CACHE_MASK;
+        ALLOC_OBJ_CLEAR_GC(ph, struct cached_dns_entry, &c->gc);
+        ph->ai = ai;
+        ph->hostname = hostname;
+        ph->servname = servname;
+        ph->flags = flags & GETADDR_CACHE_MASK;
 
-      if (!c->c1.dns_cache)
-	c->c1.dns_cache = ph;
-      else
-	{
-	  struct cached_dns_entry *prev = c->c1.dns_cache;
-	  while (prev->next)
-	    prev = prev->next;
-	  prev->next = ph;
-	}
+        if (!c->c1.dns_cache)
+        {
+            c->c1.dns_cache = ph;
+        }
+        else
+        {
+            struct cached_dns_entry *prev = c->c1.dns_cache;
+            while (prev->next)
+                prev = prev->next;
+            prev->next = ph;
+        }
 
-      gc_addspecial (ai, &gc_freeaddrinfo_callback, &c->gc);
+        gc_addspecial(ai, &gc_freeaddrinfo_callback, &c->gc);
 
     }
-  return status;
+    return status;
 }
 
 void
-do_preresolve (struct context *c)
-{
-  int i;
-  struct connection_list *l = c->options.connection_list;
-  const unsigned int preresolve_flags = GETADDR_RESOLVE|
-    GETADDR_UPDATE_MANAGEMENT_STATE|
-    GETADDR_MENTION_RESOLVE_RETRY|
-    GETADDR_FATAL;
-
-
-  for (i = 0; i < l->len; ++i)
-    {
-      int status;
-      const char *remote;
-      int flags = preresolve_flags;
-
-      struct connection_entry* ce = c->options.connection_list->array[i];
-
-      if (proto_is_dgram(ce->proto))
-	  flags |= GETADDR_DATAGRAM;
-
-      if (c->options.sockflags & SF_HOST_RANDOMIZE)
-	  flags |= GETADDR_RANDOMIZE;
-
-      if (c->options.ip_remote_hint)
-	  remote = c->options.ip_remote_hint;
-      else
-	  remote = ce->remote;
-
-      /* HTTP remote hostname does not need to be resolved */
-      if (! ce->http_proxy_options)
-	{
-	  status = do_preresolve_host (c, remote, ce->remote_port, ce->af, flags);
-	  if (status != 0)
-	      goto err;
-	}
-
-      /* Preresolve proxy */
-      if (ce->http_proxy_options)
-	{
-	  status = do_preresolve_host (c,
-				       ce->http_proxy_options->server,
-				       ce->http_proxy_options->port,
-				       ce->af,
-				       preresolve_flags);
-
-	  if (status != 0)
-	      goto err;
-	}
-
-      if (ce->socks_proxy_server)
-	{
-	  status = do_preresolve_host (c,
-				       ce->socks_proxy_server,
-				       ce->socks_proxy_port,
-				       ce->af,
-				       flags);
-	  if (status != 0)
-	      goto err;
-	}
-
-      if (ce->bind_local)
-	{
-	  flags |= GETADDR_PASSIVE;
-	  flags &= ~GETADDR_RANDOMIZE;
-	  status = do_preresolve_host (c, ce->local, ce->local_port, ce->af, flags);
-	  if (status != 0)
-	      goto err;
-
-	}
+do_preresolve(struct context *c)
+{
+    int i;
+    struct connection_list *l = c->options.connection_list;
+    const unsigned int preresolve_flags = GETADDR_RESOLVE
+                                          |GETADDR_UPDATE_MANAGEMENT_STATE
+                                          |GETADDR_MENTION_RESOLVE_RETRY
+                                          |GETADDR_FATAL;
+
+
+    for (i = 0; i < l->len; ++i)
+    {
+        int status;
+        const char *remote;
+        int flags = preresolve_flags;
+
+        struct connection_entry *ce = c->options.connection_list->array[i];
+
+        if (proto_is_dgram(ce->proto))
+        {
+            flags |= GETADDR_DATAGRAM;
+        }
+
+        if (c->options.sockflags & SF_HOST_RANDOMIZE)
+        {
+            flags |= GETADDR_RANDOMIZE;
+        }
+
+        if (c->options.ip_remote_hint)
+        {
+            remote = c->options.ip_remote_hint;
+        }
+        else
+        {
+            remote = ce->remote;
+        }
+
+        /* HTTP remote hostname does not need to be resolved */
+        if (!ce->http_proxy_options)
+        {
+            status = do_preresolve_host(c, remote, ce->remote_port, ce->af, flags);
+            if (status != 0)
+            {
+                goto err;
+            }
+        }
+
+        /* Preresolve proxy */
+        if (ce->http_proxy_options)
+        {
+            status = do_preresolve_host(c,
+                                        ce->http_proxy_options->server,
+                                        ce->http_proxy_options->port,
+                                        ce->af,
+                                        preresolve_flags);
+
+            if (status != 0)
+            {
+                goto err;
+            }
+        }
+
+        if (ce->socks_proxy_server)
+        {
+            status = do_preresolve_host(c,
+                                        ce->socks_proxy_server,
+                                        ce->socks_proxy_port,
+                                        ce->af,
+                                        flags);
+            if (status != 0)
+            {
+                goto err;
+            }
+        }
+
+        if (ce->bind_local)
+        {
+            flags |= GETADDR_PASSIVE;
+            flags &= ~GETADDR_RANDOMIZE;
+            status = do_preresolve_host(c, ce->local, ce->local_port, ce->af, flags);
+            if (status != 0)
+            {
+                goto err;
+            }
+
+        }
 
     }
     return;
 
- err:
-  throw_signal_soft (SIGHUP, "Preresolving failed");
+err:
+    throw_signal_soft(SIGHUP, "Preresolving failed");
 }
 
 /*
@@ -280,185 +315,220 @@ do_preresolve (struct context *c)
  * If resolve error, try again for resolve_retry_seconds seconds.
  */
 int
-openvpn_getaddrinfo (unsigned int flags,
-                     const char *hostname,
-                     const char *servname,
-                     int resolve_retry_seconds,
-                     volatile int *signal_received,
-                     int ai_family,
-                     struct addrinfo **res)
+openvpn_getaddrinfo(unsigned int flags,
+                    const char *hostname,
+                    const char *servname,
+                    int resolve_retry_seconds,
+                    volatile int *signal_received,
+                    int ai_family,
+                    struct addrinfo **res)
 {
-  struct addrinfo hints;
-  int status;
-  int sigrec = 0;
-  int msglevel = (flags & GETADDR_FATAL) ? M_FATAL : D_RESOLVE_ERRORS;
-  struct gc_arena gc = gc_new ();
-  const char *print_hostname;
-  const char *print_servname;
+    struct addrinfo hints;
+    int status;
+    int sigrec = 0;
+    int msglevel = (flags & GETADDR_FATAL) ? M_FATAL : D_RESOLVE_ERRORS;
+    struct gc_arena gc = gc_new();
+    const char *print_hostname;
+    const char *print_servname;
 
-  ASSERT(res);
+    ASSERT(res);
 
-  ASSERT (hostname || servname);
-  ASSERT (!(flags & GETADDR_HOST_ORDER));
+    ASSERT(hostname || servname);
+    ASSERT(!(flags & GETADDR_HOST_ORDER));
 
-  if (hostname && (flags & GETADDR_RANDOMIZE))
-    hostname = hostname_randomize(hostname, &gc);
+    if (hostname && (flags & GETADDR_RANDOMIZE))
+    {
+        hostname = hostname_randomize(hostname, &gc);
+    }
 
-  if(hostname)
-    print_hostname = hostname;
-  else
-    print_hostname = "undefined";
+    if (hostname)
+    {
+        print_hostname = hostname;
+    }
+    else
+    {
+        print_hostname = "undefined";
+    }
 
-  if(servname)
-    print_servname = servname;
-  else
-    print_servname = "";
+    if (servname)
+    {
+        print_servname = servname;
+    }
+    else
+    {
+        print_servname = "";
+    }
 
-  if (flags & GETADDR_MSG_VIRT_OUT)
-    msglevel |= M_MSG_VIRT_OUT;
+    if (flags & GETADDR_MSG_VIRT_OUT)
+    {
+        msglevel |= M_MSG_VIRT_OUT;
+    }
 
-  if ((flags & (GETADDR_FATAL_ON_SIGNAL|GETADDR_WARN_ON_SIGNAL))
-      && !signal_received)
-    signal_received = &sigrec;
+    if ((flags & (GETADDR_FATAL_ON_SIGNAL|GETADDR_WARN_ON_SIGNAL))
+        && !signal_received)
+    {
+        signal_received = &sigrec;
+    }
 
-  /* try numeric ipv6 addr first */
-  CLEAR(hints);
-  hints.ai_family = ai_family;
-  hints.ai_flags = AI_NUMERICHOST;
+    /* try numeric ipv6 addr first */
+    CLEAR(hints);
+    hints.ai_family = ai_family;
+    hints.ai_flags = AI_NUMERICHOST;
 
-  if(flags & GETADDR_PASSIVE)
-      hints.ai_flags |= AI_PASSIVE;
+    if (flags & GETADDR_PASSIVE)
+    {
+        hints.ai_flags |= AI_PASSIVE;
+    }
 
-  if(flags & GETADDR_DATAGRAM)
-      hints.ai_socktype = SOCK_DGRAM;
-  else
-      hints.ai_socktype = SOCK_STREAM;
+    if (flags & GETADDR_DATAGRAM)
+    {
+        hints.ai_socktype = SOCK_DGRAM;
+    }
+    else
+    {
+        hints.ai_socktype = SOCK_STREAM;
+    }
 
-  status = getaddrinfo(hostname, servname, &hints, res);
+    status = getaddrinfo(hostname, servname, &hints, res);
 
-  if (status != 0) /* parse as numeric address failed? */
+    if (status != 0) /* parse as numeric address failed? */
     {
-      const int fail_wait_interval = 5; /* seconds */
-      /* Add +4 to cause integer division rounding up (1 + 4) = 5, (0+4)/5=0 */
-      int resolve_retries = (flags & GETADDR_TRY_ONCE) ? 1 :
-            ((resolve_retry_seconds + 4)/ fail_wait_interval);
-      const char *fmt;
-      int level = 0;
+        const int fail_wait_interval = 5; /* seconds */
+        /* Add +4 to cause integer division rounding up (1 + 4) = 5, (0+4)/5=0 */
+        int resolve_retries = (flags & GETADDR_TRY_ONCE) ? 1 :
+                              ((resolve_retry_seconds + 4)/ fail_wait_interval);
+        const char *fmt;
+        int level = 0;
 
-      fmt = "RESOLVE: Cannot resolve host address: %s:%s (%s)";
-      if ((flags & GETADDR_MENTION_RESOLVE_RETRY)
-          && !resolve_retry_seconds)
-        fmt = "RESOLVE: Cannot resolve host address: %s:%s (%s) (I would have retried this name query if you had specified the --resolv-retry option.)";
+        fmt = "RESOLVE: Cannot resolve host address: %s:%s (%s)";
+        if ((flags & GETADDR_MENTION_RESOLVE_RETRY)
+            && !resolve_retry_seconds)
+        {
+            fmt = "RESOLVE: Cannot resolve host address: %s:%s (%s) (I would have retried this name query if you had specified the --resolv-retry option.)";
+        }
 
-      if (!(flags & GETADDR_RESOLVE) || status == EAI_FAIL)
+        if (!(flags & GETADDR_RESOLVE) || status == EAI_FAIL)
         {
-          msg (msglevel, "RESOLVE: Cannot parse IP address: %s:%s (%s)",
-               print_hostname,print_servname, gai_strerror(status));
-          goto done;
+            msg(msglevel, "RESOLVE: Cannot parse IP address: %s:%s (%s)",
+                print_hostname,print_servname, gai_strerror(status));
+            goto done;
         }
 
 #ifdef ENABLE_MANAGEMENT
-      if (flags & GETADDR_UPDATE_MANAGEMENT_STATE)
+        if (flags & GETADDR_UPDATE_MANAGEMENT_STATE)
         {
-          if (management)
-            management_set_state (management,
-                                  OPENVPN_STATE_RESOLVE,
-                                  NULL,
-                                  NULL,
-                                  NULL,
-                                  NULL,
-                                  NULL);
+            if (management)
+            {
+                management_set_state(management,
+                                     OPENVPN_STATE_RESOLVE,
+                                     NULL,
+                                     NULL,
+                                     NULL,
+                                     NULL,
+                                     NULL);
+            }
         }
 #endif
 
-      /*
-       * Resolve hostname
-       */
-      while (true)
+        /*
+         * Resolve hostname
+         */
+        while (true)
         {
 #ifndef _WIN32
-	  res_init ();
+            res_init();
 #endif
-          /* try hostname lookup */
-          hints.ai_flags &= ~AI_NUMERICHOST;
-          dmsg (D_SOCKET_DEBUG, "GETADDRINFO flags=0x%04x ai_family=%d ai_socktype=%d",
-                flags, hints.ai_family, hints.ai_socktype);
-          status = getaddrinfo(hostname, servname, &hints, res);
+            /* try hostname lookup */
+            hints.ai_flags &= ~AI_NUMERICHOST;
+            dmsg(D_SOCKET_DEBUG, "GETADDRINFO flags=0x%04x ai_family=%d ai_socktype=%d",
+                 flags, hints.ai_family, hints.ai_socktype);
+            status = getaddrinfo(hostname, servname, &hints, res);
 
-          if (signal_received)
+            if (signal_received)
             {
-              get_signal (signal_received);
-              if (*signal_received) /* were we interrupted by a signal? */
+                get_signal(signal_received);
+                if (*signal_received) /* were we interrupted by a signal? */
                 {
-                  if (*signal_received == SIGUSR1) /* ignore SIGUSR1 */
+                    if (*signal_received == SIGUSR1) /* ignore SIGUSR1 */
                     {
-                      msg (level, "RESOLVE: Ignored SIGUSR1 signal received during DNS resolution attempt");
-                      *signal_received = 0;
+                        msg(level, "RESOLVE: Ignored SIGUSR1 signal received during DNS resolution attempt");
+                        *signal_received = 0;
                     }
-                  else
+                    else
                     {
-		      /* turn success into failure (interrupted syscall) */
-                      if (0 == status) {
-                          ASSERT(res);
-                          freeaddrinfo(*res);
-                          *res = NULL;
-                          status = EAI_AGAIN;	/* = temporary failure */
-                          errno = EINTR;
-                      }
-                      goto done;
+                        /* turn success into failure (interrupted syscall) */
+                        if (0 == status)
+                        {
+                            ASSERT(res);
+                            freeaddrinfo(*res);
+                            *res = NULL;
+                            status = EAI_AGAIN; /* = temporary failure */
+                            errno = EINTR;
+                        }
+                        goto done;
                     }
                 }
             }
 
-          /* success? */
-          if (0 == status)
-            break;
+            /* success? */
+            if (0 == status)
+            {
+                break;
+            }
 
-          /* resolve lookup failed, should we
-             continue or fail? */
-          level = msglevel;
-          if (resolve_retries > 0)
-            level = D_RESOLVE_ERRORS;
+            /* resolve lookup failed, should we
+             * continue or fail? */
+            level = msglevel;
+            if (resolve_retries > 0)
+            {
+                level = D_RESOLVE_ERRORS;
+            }
 
-          msg (level,
-               fmt,
-               print_hostname,
-               print_servname,
-               gai_strerror(status));
+            msg(level,
+                fmt,
+                print_hostname,
+                print_servname,
+                gai_strerror(status));
 
-          if (--resolve_retries <= 0)
-            goto done;
+            if (--resolve_retries <= 0)
+            {
+                goto done;
+            }
 
-          openvpn_sleep (fail_wait_interval);
+            openvpn_sleep(fail_wait_interval);
         }
 
-      ASSERT(res);
+        ASSERT(res);
 
-      /* hostname resolve succeeded */
+        /* hostname resolve succeeded */
 
-      /*
-       * Do not choose an IP Addresse by random or change the order *
-       * of IP addresses, doing so will break RFC 3484 address selection *
-       */
+        /*
+         * Do not choose an IP Addresse by random or change the order *
+         * of IP addresses, doing so will break RFC 3484 address selection *
+         */
     }
-  else
+    else
     {
-      /* IP address parse succeeded */
+        /* IP address parse succeeded */
     }
 
- done:
-  if (signal_received && *signal_received)
+done:
+    if (signal_received && *signal_received)
     {
-      int level = 0;
-      if (flags & GETADDR_FATAL_ON_SIGNAL)
-        level = M_FATAL;
-      else if (flags & GETADDR_WARN_ON_SIGNAL)
-        level = M_WARN;
-      msg (level, "RESOLVE: signal received during DNS resolution attempt");
+        int level = 0;
+        if (flags & GETADDR_FATAL_ON_SIGNAL)
+        {
+            level = M_FATAL;
+        }
+        else if (flags & GETADDR_WARN_ON_SIGNAL)
+        {
+            level = M_WARN;
+        }
+        msg(level, "RESOLVE: signal received during DNS resolution attempt");
     }
 
-  gc_free (&gc);
-  return status;
+    gc_free(&gc);
+    return status;
 }
 
 /*
@@ -466,220 +536,260 @@ openvpn_getaddrinfo (unsigned int flags,
  * isn't very good about error checking.
  */
 int
-openvpn_inet_aton (const char *dotted_quad, struct in_addr *addr)
+openvpn_inet_aton(const char *dotted_quad, struct in_addr *addr)
 {
-  unsigned int a, b, c, d;
+    unsigned int a, b, c, d;
 
-  CLEAR (*addr);
-  if (sscanf (dotted_quad, "%u.%u.%u.%u", &a, &b, &c, &d) == 4)
+    CLEAR(*addr);
+    if (sscanf(dotted_quad, "%u.%u.%u.%u", &a, &b, &c, &d) == 4)
+    {
+        if (a < 256 && b < 256 && c < 256 && d < 256)
+        {
+            addr->s_addr = htonl(a<<24 | b<<16 | c<<8 | d);
+            return OIA_IP; /* good dotted quad */
+        }
+    }
+    if (string_class(dotted_quad, CC_DIGIT|CC_DOT, 0))
+    {
+        return OIA_ERROR; /* probably a badly formatted dotted quad */
+    }
+    else
     {
-      if (a < 256 && b < 256 && c < 256 && d < 256)
-	{
-	  addr->s_addr = htonl (a<<24 | b<<16 | c<<8 | d);
-	  return OIA_IP; /* good dotted quad */
-	}
+        return OIA_HOSTNAME; /* probably a hostname */
     }
-  if (string_class (dotted_quad, CC_DIGIT|CC_DOT, 0))
-    return OIA_ERROR;    /* probably a badly formatted dotted quad */
-  else
-    return OIA_HOSTNAME; /* probably a hostname */
 }
 
 bool
-ip_addr_dotted_quad_safe (const char *dotted_quad)
+ip_addr_dotted_quad_safe(const char *dotted_quad)
 {
-  /* verify non-NULL */
-  if (!dotted_quad)
-    return false;
+    /* verify non-NULL */
+    if (!dotted_quad)
+    {
+        return false;
+    }
 
-  /* verify length is within limits */
-  if (strlen (dotted_quad) > 15)
-    return false;
+    /* verify length is within limits */
+    if (strlen(dotted_quad) > 15)
+    {
+        return false;
+    }
+
+    /* verify that all chars are either numeric or '.' and that no numeric
+     * substring is greater than 3 chars */
+    {
+        int nnum = 0;
+        const char *p = dotted_quad;
+        int c;
+
+        while ((c = *p++))
+        {
+            if (c >= '0' && c <= '9')
+            {
+                ++nnum;
+                if (nnum > 3)
+                {
+                    return false;
+                }
+            }
+            else if (c == '.')
+            {
+                nnum = 0;
+            }
+            else
+            {
+                return false;
+            }
+        }
+    }
 
-  /* verify that all chars are either numeric or '.' and that no numeric
-     substring is greater than 3 chars */
-  {
-    int nnum = 0;
-    const char *p = dotted_quad;
-    int c;
-
-    while ((c = *p++))
-      {
-	if (c >= '0' && c <= '9')
-	  {
-	    ++nnum;
-	    if (nnum > 3)
-	      return false;
-	  }
-	else if (c == '.')
-	  {
-	    nnum = 0;
-	  }
-	else
-	  return false;
-      }
-  }
-
-  /* verify that string will convert to IP address */
-  {
-    struct in_addr a;
-    return openvpn_inet_aton (dotted_quad, &a) == OIA_IP;
-  }
+    /* verify that string will convert to IP address */
+    {
+        struct in_addr a;
+        return openvpn_inet_aton(dotted_quad, &a) == OIA_IP;
+    }
 }
 
 bool
-ipv6_addr_safe (const char *ipv6_text_addr)
+ipv6_addr_safe(const char *ipv6_text_addr)
 {
-  /* verify non-NULL */
-  if (!ipv6_text_addr)
-    return false;
+    /* verify non-NULL */
+    if (!ipv6_text_addr)
+    {
+        return false;
+    }
 
-  /* verify length is within limits */
-  if (strlen (ipv6_text_addr) > INET6_ADDRSTRLEN )
-    return false;
+    /* verify length is within limits */
+    if (strlen(ipv6_text_addr) > INET6_ADDRSTRLEN)
+    {
+        return false;
+    }
 
-  /* verify that string will convert to IPv6 address */
-  {
-    struct in6_addr a6;
-    return inet_pton( AF_INET6, ipv6_text_addr, &a6 ) == 1;
-  }
+    /* verify that string will convert to IPv6 address */
+    {
+        struct in6_addr a6;
+        return inet_pton( AF_INET6, ipv6_text_addr, &a6 ) == 1;
+    }
 }
 
 static bool
-dns_addr_safe (const char *addr)
+dns_addr_safe(const char *addr)
 {
-  if (addr)
+    if (addr)
     {
-      const size_t len = strlen (addr);
-      return len > 0 && len <= 255 && string_class (addr, CC_ALNUM|CC_DASH|CC_DOT, 0);
+        const size_t len = strlen(addr);
+        return len > 0 && len <= 255 && string_class(addr, CC_ALNUM|CC_DASH|CC_DOT, 0);
+    }
+    else
+    {
+        return false;
     }
-  else
-    return false;
 }
 
 bool
-ip_or_dns_addr_safe (const char *addr, const bool allow_fqdn)
+ip_or_dns_addr_safe(const char *addr, const bool allow_fqdn)
 {
-  if (ip_addr_dotted_quad_safe (addr))
-    return true;
-  else if (allow_fqdn)
-    return dns_addr_safe (addr);
-  else
-    return false;
+    if (ip_addr_dotted_quad_safe(addr))
+    {
+        return true;
+    }
+    else if (allow_fqdn)
+    {
+        return dns_addr_safe(addr);
+    }
+    else
+    {
+        return false;
+    }
 }
 
 bool
-mac_addr_safe (const char *mac_addr)
+mac_addr_safe(const char *mac_addr)
 {
-  /* verify non-NULL */
-  if (!mac_addr)
-    return false;
+    /* verify non-NULL */
+    if (!mac_addr)
+    {
+        return false;
+    }
 
-  /* verify length is within limits */
-  if (strlen (mac_addr) > 17)
-    return false;
+    /* verify length is within limits */
+    if (strlen(mac_addr) > 17)
+    {
+        return false;
+    }
+
+    /* verify that all chars are either alphanumeric or ':' and that no
+     * alphanumeric substring is greater than 2 chars */
+    {
+        int nnum = 0;
+        const char *p = mac_addr;
+        int c;
+
+        while ((c = *p++))
+        {
+            if ( (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F') )
+            {
+                ++nnum;
+                if (nnum > 2)
+                {
+                    return false;
+                }
+            }
+            else if (c == ':')
+            {
+                nnum = 0;
+            }
+            else
+            {
+                return false;
+            }
+        }
+    }
 
-  /* verify that all chars are either alphanumeric or ':' and that no
-     alphanumeric substring is greater than 2 chars */
-  {
-    int nnum = 0;
-    const char *p = mac_addr;
-    int c;
-
-    while ((c = *p++))
-      {
-	if ( (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F') )
-	  {
-	    ++nnum;
-	    if (nnum > 2)
-	      return false;
-	  }
-	else if (c == ':')
-	  {
-	    nnum = 0;
-	  }
-	else
-	  return false;
-      }
-  }
-
-  /* error-checking is left to script invoked in lladdr.c */
-  return true;
+    /* error-checking is left to script invoked in lladdr.c */
+    return true;
 }
 
 static int
-socket_get_sndbuf (int sd)
+socket_get_sndbuf(int sd)
 {
 #if defined(HAVE_GETSOCKOPT) && defined(SOL_SOCKET) && defined(SO_SNDBUF)
-  int val;
-  socklen_t len;
+    int val;
+    socklen_t len;
 
-  len = sizeof (val);
-  if (getsockopt (sd, SOL_SOCKET, SO_SNDBUF, (void *) &val, &len) == 0
-      && len == sizeof (val))
-    return val;
+    len = sizeof(val);
+    if (getsockopt(sd, SOL_SOCKET, SO_SNDBUF, (void *) &val, &len) == 0
+        && len == sizeof(val))
+    {
+        return val;
+    }
 #endif
-  return 0;
+    return 0;
 }
 
 static void
-socket_set_sndbuf (int sd, int size)
+socket_set_sndbuf(int sd, int size)
 {
 #if defined(HAVE_SETSOCKOPT) && defined(SOL_SOCKET) && defined(SO_SNDBUF)
-  if (setsockopt (sd, SOL_SOCKET, SO_SNDBUF, (void *) &size, sizeof (size)) != 0)
+    if (setsockopt(sd, SOL_SOCKET, SO_SNDBUF, (void *) &size, sizeof(size)) != 0)
     {
-      msg (M_WARN, "NOTE: setsockopt SO_SNDBUF=%d failed", size);
+        msg(M_WARN, "NOTE: setsockopt SO_SNDBUF=%d failed", size);
     }
 #endif
 }
 
 static int
-socket_get_rcvbuf (int sd)
+socket_get_rcvbuf(int sd)
 {
 #if defined(HAVE_GETSOCKOPT) && defined(SOL_SOCKET) && defined(SO_RCVBUF)
-  int val;
-  socklen_t len;
+    int val;
+    socklen_t len;
 
-  len = sizeof (val);
-  if (getsockopt (sd, SOL_SOCKET, SO_RCVBUF, (void *) &val, &len) == 0
-      && len == sizeof (val))
-    return val;
+    len = sizeof(val);
+    if (getsockopt(sd, SOL_SOCKET, SO_RCVBUF, (void *) &val, &len) == 0
+        && len == sizeof(val))
+    {
+        return val;
+    }
 #endif
-  return 0;
+    return 0;
 }
 
 static bool
-socket_set_rcvbuf (int sd, int size)
+socket_set_rcvbuf(int sd, int size)
 {
 #if defined(HAVE_SETSOCKOPT) && defined(SOL_SOCKET) && defined(SO_RCVBUF)
-  if (setsockopt (sd, SOL_SOCKET, SO_RCVBUF, (void *) &size, sizeof (size)) != 0)
+    if (setsockopt(sd, SOL_SOCKET, SO_RCVBUF, (void *) &size, sizeof(size)) != 0)
     {
-      msg (M_WARN, "NOTE: setsockopt SO_RCVBUF=%d failed", size);
-      return false;
+        msg(M_WARN, "NOTE: setsockopt SO_RCVBUF=%d failed", size);
+        return false;
     }
-  return true;
+    return true;
 #endif
 }
 
 static void
-socket_set_buffers (int fd, const struct socket_buffer_size *sbs)
+socket_set_buffers(int fd, const struct socket_buffer_size *sbs)
 {
-  if (sbs)
+    if (sbs)
     {
-      const int sndbuf_old = socket_get_sndbuf (fd);
-      const int rcvbuf_old = socket_get_rcvbuf (fd);
+        const int sndbuf_old = socket_get_sndbuf(fd);
+        const int rcvbuf_old = socket_get_rcvbuf(fd);
 
-      if (sbs->sndbuf)
-	socket_set_sndbuf (fd, sbs->sndbuf);
+        if (sbs->sndbuf)
+        {
+            socket_set_sndbuf(fd, sbs->sndbuf);
+        }
+
+        if (sbs->rcvbuf)
+        {
+            socket_set_rcvbuf(fd, sbs->rcvbuf);
+        }
 
-      if (sbs->rcvbuf)
-	socket_set_rcvbuf (fd, sbs->rcvbuf);
-       
-      msg (D_OSBUF, "Socket Buffers: R=[%d->%d] S=[%d->%d]",
-	   rcvbuf_old,
-	   socket_get_rcvbuf (fd),
-	   sndbuf_old,
-	   socket_get_sndbuf (fd));
+        msg(D_OSBUF, "Socket Buffers: R=[%d->%d] S=[%d->%d]",
+            rcvbuf_old,
+            socket_get_rcvbuf(fd),
+            sndbuf_old,
+            socket_get_sndbuf(fd));
     }
 }
 
@@ -688,60 +798,70 @@ socket_set_buffers (int fd, const struct socket_buffer_size *sbs)
  */
 
 static bool
-socket_set_tcp_nodelay (int sd, int state)
+socket_set_tcp_nodelay(int sd, int state)
 {
 #if defined(_WIN32) || (defined(HAVE_SETSOCKOPT) && defined(IPPROTO_TCP) && defined(TCP_NODELAY))
-  if (setsockopt (sd, IPPROTO_TCP, TCP_NODELAY, (void *) &state, sizeof (state)) != 0)
+    if (setsockopt(sd, IPPROTO_TCP, TCP_NODELAY, (void *) &state, sizeof(state)) != 0)
     {
-      msg (M_WARN, "NOTE: setsockopt TCP_NODELAY=%d failed", state);
-      return false;
+        msg(M_WARN, "NOTE: setsockopt TCP_NODELAY=%d failed", state);
+        return false;
     }
-  else
+    else
     {
-      dmsg (D_OSBUF, "Socket flags: TCP_NODELAY=%d succeeded", state);
-      return true;
+        dmsg(D_OSBUF, "Socket flags: TCP_NODELAY=%d succeeded", state);
+        return true;
     }
-#else
-  msg (M_WARN, "NOTE: setsockopt TCP_NODELAY=%d failed (No kernel support)", state);
-  return false;
+#else  /* if defined(_WIN32) || (defined(HAVE_SETSOCKOPT) && defined(IPPROTO_TCP) && defined(TCP_NODELAY)) */
+    msg(M_WARN, "NOTE: setsockopt TCP_NODELAY=%d failed (No kernel support)", state);
+    return false;
 #endif
 }
 
 static inline void
-socket_set_mark (int sd, int mark)
+socket_set_mark(int sd, int mark)
 {
 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
-  if (mark && setsockopt (sd, SOL_SOCKET, SO_MARK, (void *) &mark, sizeof (mark)) != 0)
-    msg (M_WARN, "NOTE: setsockopt SO_MARK=%d failed", mark);
+    if (mark && setsockopt(sd, SOL_SOCKET, SO_MARK, (void *) &mark, sizeof(mark)) != 0)
+    {
+        msg(M_WARN, "NOTE: setsockopt SO_MARK=%d failed", mark);
+    }
 #endif
 }
 
 static bool
-socket_set_flags (int sd, unsigned int sockflags)
+socket_set_flags(int sd, unsigned int sockflags)
 {
-  if (sockflags & SF_TCP_NODELAY)
-    return socket_set_tcp_nodelay (sd, 1);
-  else
-    return true;
+    if (sockflags & SF_TCP_NODELAY)
+    {
+        return socket_set_tcp_nodelay(sd, 1);
+    }
+    else
+    {
+        return true;
+    }
 }
 
 bool
-link_socket_update_flags (struct link_socket *ls, unsigned int sockflags)
+link_socket_update_flags(struct link_socket *ls, unsigned int sockflags)
 {
-  if (ls && socket_defined (ls->sd))
-    return socket_set_flags (ls->sd, ls->sockflags = sockflags);
-  else
-    return false;
+    if (ls && socket_defined(ls->sd))
+    {
+        return socket_set_flags(ls->sd, ls->sockflags = sockflags);
+    }
+    else
+    {
+        return false;
+    }
 }
 
 void
-link_socket_update_buffer_sizes (struct link_socket *ls, int rcvbuf, int sndbuf)
+link_socket_update_buffer_sizes(struct link_socket *ls, int rcvbuf, int sndbuf)
 {
-  if (ls && socket_defined (ls->sd))
+    if (ls && socket_defined(ls->sd))
     {
-      ls->socket_buffer_sizes.sndbuf = sndbuf;
-      ls->socket_buffer_sizes.rcvbuf = rcvbuf;
-      socket_set_buffers (ls->sd, &ls->socket_buffer_sizes);
+        ls->socket_buffer_sizes.sndbuf = sndbuf;
+        ls->socket_buffer_sizes.rcvbuf = rcvbuf;
+        socket_set_buffers(ls->sd, &ls->socket_buffer_sizes);
     }
 }
 
@@ -751,140 +871,166 @@ link_socket_update_buffer_sizes (struct link_socket *ls, int rcvbuf, int sndbuf)
  */
 
 socket_descriptor_t
-create_socket_tcp (struct addrinfo* addrinfo)
+create_socket_tcp(struct addrinfo *addrinfo)
 {
-  socket_descriptor_t sd;
+    socket_descriptor_t sd;
 
-  ASSERT (addrinfo);
-  ASSERT (addrinfo->ai_socktype == SOCK_STREAM);
+    ASSERT(addrinfo);
+    ASSERT(addrinfo->ai_socktype == SOCK_STREAM);
 
-  if ((sd = socket (addrinfo->ai_family, addrinfo->ai_socktype, addrinfo->ai_protocol)) < 0)
-    msg (M_ERR, "Cannot create TCP socket");
+    if ((sd = socket(addrinfo->ai_family, addrinfo->ai_socktype, addrinfo->ai_protocol)) < 0)
+    {
+        msg(M_ERR, "Cannot create TCP socket");
+    }
 
 #ifndef _WIN32 /* using SO_REUSEADDR on Windows will cause bind to succeed on port conflicts! */
-  /* set SO_REUSEADDR on socket */
-  {
-    int on = 1;
-    if (setsockopt (sd, SOL_SOCKET, SO_REUSEADDR,
-		    (void *) &on, sizeof (on)) < 0)
-      msg (M_ERR, "TCP: Cannot setsockopt SO_REUSEADDR on TCP socket");
-  }
+    /* set SO_REUSEADDR on socket */
+    {
+        int on = 1;
+        if (setsockopt(sd, SOL_SOCKET, SO_REUSEADDR,
+                       (void *) &on, sizeof(on)) < 0)
+        {
+            msg(M_ERR, "TCP: Cannot setsockopt SO_REUSEADDR on TCP socket");
+        }
+    }
 #endif
 
-  return sd;
+    /* set socket file descriptor to not pass across execs, so that
+     * scripts don't have access to it */
+    set_cloexec(sd);
+
+    return sd;
 }
 
 static socket_descriptor_t
-create_socket_udp (struct addrinfo* addrinfo, const unsigned int flags)
+create_socket_udp(struct addrinfo *addrinfo, const unsigned int flags)
 {
-  socket_descriptor_t sd;
+    socket_descriptor_t sd;
 
-  ASSERT (addrinfo);
-  ASSERT (addrinfo->ai_socktype == SOCK_DGRAM);
+    ASSERT(addrinfo);
+    ASSERT(addrinfo->ai_socktype == SOCK_DGRAM);
 
-  if ((sd = socket (addrinfo->ai_family, addrinfo->ai_socktype, addrinfo->ai_protocol)) < 0)
-    msg (M_ERR, "UDP: Cannot create UDP/UDP6 socket");
+    if ((sd = socket(addrinfo->ai_family, addrinfo->ai_socktype, addrinfo->ai_protocol)) < 0)
+    {
+        msg(M_ERR, "UDP: Cannot create UDP/UDP6 socket");
+    }
 #if ENABLE_IP_PKTINFO
-  else if (flags & SF_USE_IP_PKTINFO)
+    else if (flags & SF_USE_IP_PKTINFO)
     {
-      int pad = 1;
-      if(addrinfo->ai_family == AF_INET)
+        int pad = 1;
+        if (addrinfo->ai_family == AF_INET)
         {
 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
-          if (setsockopt (sd, SOL_IP, IP_PKTINFO,
-                          (void*)&pad, sizeof(pad)) < 0)
-            msg(M_ERR, "UDP: failed setsockopt for IP_PKTINFO");
+            if (setsockopt(sd, SOL_IP, IP_PKTINFO,
+                           (void *)&pad, sizeof(pad)) < 0)
+            {
+                msg(M_ERR, "UDP: failed setsockopt for IP_PKTINFO");
+            }
 #elif defined(IP_RECVDSTADDR)
-          if (setsockopt (sd, IPPROTO_IP, IP_RECVDSTADDR,
-                          (void*)&pad, sizeof(pad)) < 0)
-            msg(M_ERR, "UDP: failed setsockopt for IP_RECVDSTADDR");
-#else
+            if (setsockopt(sd, IPPROTO_IP, IP_RECVDSTADDR,
+                           (void *)&pad, sizeof(pad)) < 0)
+            {
+                msg(M_ERR, "UDP: failed setsockopt for IP_RECVDSTADDR");
+            }
+#else  /* if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST) */
 #error ENABLE_IP_PKTINFO is set without IP_PKTINFO xor IP_RECVDSTADDR (fix syshead.h)
 #endif
         }
-      else if (addrinfo->ai_family == AF_INET6 )
+        else if (addrinfo->ai_family == AF_INET6)
         {
 #ifndef IPV6_RECVPKTINFO /* Some older Darwin platforms require this */
-          if (setsockopt (sd, IPPROTO_IPV6, IPV6_PKTINFO,
-                          (void*)&pad, sizeof(pad)) < 0)
+            if (setsockopt(sd, IPPROTO_IPV6, IPV6_PKTINFO,
+                           (void *)&pad, sizeof(pad)) < 0)
 #else
-          if (setsockopt (sd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
-                          (void*)&pad, sizeof(pad)) < 0)
+            if (setsockopt(sd, IPPROTO_IPV6, IPV6_RECVPKTINFO,
+                           (void *)&pad, sizeof(pad)) < 0)
 #endif
-            msg(M_ERR, "UDP: failed setsockopt for IPV6_RECVPKTINFO");
+            { msg(M_ERR, "UDP: failed setsockopt for IPV6_RECVPKTINFO");}
         }
     }
-#endif
-  return sd;
+#endif /* if ENABLE_IP_PKTINFO */
+
+    /* set socket file descriptor to not pass across execs, so that
+     * scripts don't have access to it */
+    set_cloexec(sd);
+
+    return sd;
 }
 
-static void bind_local (struct link_socket *sock, const sa_family_t ai_family)
+static void
+bind_local(struct link_socket *sock, const sa_family_t ai_family)
 {
     /* bind to local address/port */
     if (sock->bind_local)
-      {
+    {
         if (sock->socks_proxy && sock->info.proto == PROTO_UDP)
-            socket_bind (sock->ctrl_sd, sock->info.lsa->bind_local,
-			 ai_family, "SOCKS", false);
+        {
+            socket_bind(sock->ctrl_sd, sock->info.lsa->bind_local,
+                        ai_family, "SOCKS", false);
+        }
         else
-            socket_bind (sock->sd, sock->info.lsa->bind_local,
-			 ai_family,
-                         "TCP/UDP", sock->info.bind_ipv6_only);
-      }
+        {
+            socket_bind(sock->sd, sock->info.lsa->bind_local,
+                        ai_family,
+                        "TCP/UDP", sock->info.bind_ipv6_only);
+        }
+    }
 }
 
 static void
-create_socket (struct link_socket* sock, struct addrinfo* addr)
+create_socket(struct link_socket *sock, struct addrinfo *addr)
 {
-  if (addr->ai_protocol == IPPROTO_UDP || addr->ai_socktype == SOCK_DGRAM)
+    if (addr->ai_protocol == IPPROTO_UDP || addr->ai_socktype == SOCK_DGRAM)
     {
-      sock->sd = create_socket_udp (addr, sock->sockflags);
-      sock->sockflags |= SF_GETADDRINFO_DGRAM;
+        sock->sd = create_socket_udp(addr, sock->sockflags);
+        sock->sockflags |= SF_GETADDRINFO_DGRAM;
 
-      /* Assume that control socket and data socket to the socks proxy
-       * are using the same IP family */
-      if (sock->socks_proxy)
-	{
-	  /* Construct a temporary addrinfo to create the socket,
-	   * currently resolve two remote addresses is not supported,
-	   * TODO: Rewrite the whole resolve_remote */
-	  struct addrinfo addrinfo_tmp = *addr;
-	  addrinfo_tmp.ai_socktype = SOCK_STREAM;
-	  addrinfo_tmp.ai_protocol = IPPROTO_TCP;
-	  sock->ctrl_sd = create_socket_tcp (&addrinfo_tmp);
-	}
+        /* Assume that control socket and data socket to the socks proxy
+         * are using the same IP family */
+        if (sock->socks_proxy)
+        {
+            /* Construct a temporary addrinfo to create the socket,
+             * currently resolve two remote addresses is not supported,
+             * TODO: Rewrite the whole resolve_remote */
+            struct addrinfo addrinfo_tmp = *addr;
+            addrinfo_tmp.ai_socktype = SOCK_STREAM;
+            addrinfo_tmp.ai_protocol = IPPROTO_TCP;
+            sock->ctrl_sd = create_socket_tcp(&addrinfo_tmp);
+        }
     }
-  else if (addr->ai_protocol == IPPROTO_TCP || addr->ai_socktype == SOCK_STREAM)
+    else if (addr->ai_protocol == IPPROTO_TCP || addr->ai_socktype == SOCK_STREAM)
     {
-      sock->sd = create_socket_tcp (addr);
+        sock->sd = create_socket_tcp(addr);
     }
-  else
+    else
     {
-      ASSERT (0);
+        ASSERT(0);
     }
     /* set socket buffers based on --sndbuf and --rcvbuf options */
-    socket_set_buffers (sock->sd, &sock->socket_buffer_sizes);
+    socket_set_buffers(sock->sd, &sock->socket_buffer_sizes);
 
     /* set socket to --mark packets with given value */
-    socket_set_mark (sock->sd, sock->mark);
+    socket_set_mark(sock->sd, sock->mark);
 
-    bind_local (sock, addr->ai_family);
+    bind_local(sock, addr->ai_family);
 }
 
 #ifdef TARGET_ANDROID
-static void protect_fd_nonlocal (int fd, const struct sockaddr* addr)
+static void
+protect_fd_nonlocal(int fd, const struct sockaddr *addr)
 {
-  /* pass socket FD to management interface to pass on to VPNService API
-   * as "protected socket" (exempt from being routed into tunnel)
-   */
-  if (addr_local (addr)) {
-    msg(D_SOCKET_DEBUG, "Address is local, not protecting socket fd %d", fd);
-    return;
-  }
+    /* pass socket FD to management interface to pass on to VPNService API
+     * as "protected socket" (exempt from being routed into tunnel)
+     */
+    if (addr_local(addr))
+    {
+        msg(D_SOCKET_DEBUG, "Address is local, not protecting socket fd %d", fd);
+        return;
+    }
 
-  msg(D_SOCKET_DEBUG, "Protecting socket fd %d", fd);
-  management->connection.fdtosend = fd;
-  management_android_control (management, "PROTECTFD", __func__);
+    msg(D_SOCKET_DEBUG, "Protecting socket fd %d", fd);
+    management->connection.fdtosend = fd;
+    management_android_control(management, "PROTECTFD", __func__);
 }
 #endif
 
@@ -892,434 +1038,488 @@ static void protect_fd_nonlocal (int fd, const struct sockaddr* addr)
  * Functions used for establishing a TCP stream connection.
  */
 static void
-socket_do_listen (socket_descriptor_t sd,
-		  const struct addrinfo *local,
-		  bool do_listen,
-		  bool do_set_nonblock)
-{
-  struct gc_arena gc = gc_new ();
-  if (do_listen)
-    {
-      ASSERT(local);
-      msg (M_INFO, "Listening for incoming TCP connection on %s", 
-	   print_sockaddr (local->ai_addr, &gc));
-      if (listen (sd, 1))
-	msg (M_ERR, "TCP: listen() failed");
+socket_do_listen(socket_descriptor_t sd,
+                 const struct addrinfo *local,
+                 bool do_listen,
+                 bool do_set_nonblock)
+{
+    struct gc_arena gc = gc_new();
+    if (do_listen)
+    {
+        ASSERT(local);
+        msg(M_INFO, "Listening for incoming TCP connection on %s",
+            print_sockaddr(local->ai_addr, &gc));
+        if (listen(sd, 1))
+        {
+            msg(M_ERR, "TCP: listen() failed");
+        }
     }
 
-  /* set socket to non-blocking mode */
-  if (do_set_nonblock)
-    set_nonblock (sd);
+    /* set socket to non-blocking mode */
+    if (do_set_nonblock)
+    {
+        set_nonblock(sd);
+    }
 
-  gc_free (&gc);
+    gc_free(&gc);
 }
 
 socket_descriptor_t
-socket_do_accept (socket_descriptor_t sd,
-		  struct link_socket_actual *act,
-		  const bool nowait)
+socket_do_accept(socket_descriptor_t sd,
+                 struct link_socket_actual *act,
+                 const bool nowait)
 {
-  /* af_addr_size WILL return 0 in this case if AFs other than AF_INET
-   * are compiled because act is empty here.
-   * could use getsockname() to support later remote_len check
-   */
-  socklen_t remote_len_af = af_addr_size(act->dest.addr.sa.sa_family);
-  socklen_t remote_len = sizeof(act->dest.addr);
-  socket_descriptor_t new_sd = SOCKET_UNDEFINED;
+    /* af_addr_size WILL return 0 in this case if AFs other than AF_INET
+     * are compiled because act is empty here.
+     * could use getsockname() to support later remote_len check
+     */
+    socklen_t remote_len_af = af_addr_size(act->dest.addr.sa.sa_family);
+    socklen_t remote_len = sizeof(act->dest.addr);
+    socket_descriptor_t new_sd = SOCKET_UNDEFINED;
 
-  CLEAR (*act);
+    CLEAR(*act);
 
 #ifdef HAVE_GETPEERNAME
-  if (nowait)
+    if (nowait)
     {
-      new_sd = getpeername (sd, &act->dest.addr.sa, &remote_len);
+        new_sd = getpeername(sd, &act->dest.addr.sa, &remote_len);
 
-      if (!socket_defined (new_sd))
-	msg (D_LINK_ERRORS | M_ERRNO, "TCP: getpeername() failed");
-      else
-	new_sd = sd;
+        if (!socket_defined(new_sd))
+        {
+            msg(D_LINK_ERRORS | M_ERRNO, "TCP: getpeername() failed");
+        }
+        else
+        {
+            new_sd = sd;
+        }
+    }
+#else  /* ifdef HAVE_GETPEERNAME */
+    if (nowait)
+    {
+        msg(M_WARN, "TCP: this OS does not provide the getpeername() function");
     }
-#else
-  if (nowait)
-    msg (M_WARN, "TCP: this OS does not provide the getpeername() function");
 #endif
-  else
+    else
     {
-      new_sd = accept (sd, &act->dest.addr.sa, &remote_len);
+        new_sd = accept(sd, &act->dest.addr.sa, &remote_len);
     }
 
 #if 0 /* For debugging only, test the effect of accept() failures */
- {
-   static int foo = 0;
-   ++foo;
-   if (foo & 1)
-     new_sd = -1;
- }
+    {
+        static int foo = 0;
+        ++foo;
+        if (foo & 1)
+        {
+            new_sd = -1;
+        }
+    }
 #endif
 
-  if (!socket_defined (new_sd))
+    if (!socket_defined(new_sd))
+    {
+        msg(D_LINK_ERRORS | M_ERRNO, "TCP: accept(%d) failed", sd);
+    }
+    /* only valid if we have remote_len_af!=0 */
+    else if (remote_len_af && remote_len != remote_len_af)
     {
-      msg (D_LINK_ERRORS | M_ERRNO, "TCP: accept(%d) failed", sd);
+        msg(D_LINK_ERRORS, "TCP: Received strange incoming connection with unknown address length=%d", remote_len);
+        openvpn_close_socket(new_sd);
+        new_sd = SOCKET_UNDEFINED;
     }
-  /* only valid if we have remote_len_af!=0 */
-  else if (remote_len_af && remote_len != remote_len_af)
+    else
     {
-      msg (D_LINK_ERRORS, "TCP: Received strange incoming connection with unknown address length=%d", remote_len);
-      openvpn_close_socket (new_sd);
-      new_sd = SOCKET_UNDEFINED;
+        /* set socket file descriptor to not pass across execs, so that
+         * scripts don't have access to it */
+        set_cloexec(sd);
     }
-  return new_sd;
+    return new_sd;
 }
 
 static void
-tcp_connection_established (const struct link_socket_actual *act)
+tcp_connection_established(const struct link_socket_actual *act)
 {
-  struct gc_arena gc = gc_new ();
-  msg (M_INFO, "TCP connection established with %s", 
-       print_link_socket_actual (act, &gc));
-  gc_free (&gc);
+    struct gc_arena gc = gc_new();
+    msg(M_INFO, "TCP connection established with %s",
+        print_link_socket_actual(act, &gc));
+    gc_free(&gc);
 }
 
 static int
-socket_listen_accept (socket_descriptor_t sd,
-		      struct link_socket_actual *act,
-		      const char *remote_dynamic,
-		      const struct addrinfo *local,
-		      bool do_listen,
-		      bool nowait,
-		      volatile int *signal_received)
-{
-  struct gc_arena gc = gc_new ();
-  /* struct openvpn_sockaddr *remote = &act->dest; */
-  struct openvpn_sockaddr remote_verify = act->dest;
-  int new_sd = SOCKET_UNDEFINED;
-
-  CLEAR (*act);
-  socket_do_listen (sd, local, do_listen, true);
-
-  while (true)
-    {
-      int status;
-      fd_set reads;
-      struct timeval tv;
-
-      FD_ZERO (&reads);
-      openvpn_fd_set (sd, &reads);
-      tv.tv_sec = 0;
-      tv.tv_usec = 0;
-
-      status = select (sd + 1, &reads, NULL, NULL, &tv);
-
-      get_signal (signal_received);
-      if (*signal_received)
-	{
-	  gc_free (&gc);
-	  return sd;
-	}
-
-      if (status < 0)
-	msg (D_LINK_ERRORS | M_ERRNO, "TCP: select() failed");
-
-      if (status <= 0)
-	{
-	  openvpn_sleep (1);
-	  continue;
-	}
-
-      new_sd = socket_do_accept (sd, act, nowait);
-
-      if (socket_defined (new_sd))
-	{
-          struct addrinfo* ai = NULL;
-          if(remote_dynamic)
-              openvpn_getaddrinfo(0, remote_dynamic, NULL, 1, NULL,
+socket_listen_accept(socket_descriptor_t sd,
+                     struct link_socket_actual *act,
+                     const char *remote_dynamic,
+                     const struct addrinfo *local,
+                     bool do_listen,
+                     bool nowait,
+                     volatile int *signal_received)
+{
+    struct gc_arena gc = gc_new();
+    /* struct openvpn_sockaddr *remote = &act->dest; */
+    struct openvpn_sockaddr remote_verify = act->dest;
+    int new_sd = SOCKET_UNDEFINED;
+
+    CLEAR(*act);
+    socket_do_listen(sd, local, do_listen, true);
+
+    while (true)
+    {
+        int status;
+        fd_set reads;
+        struct timeval tv;
+
+        FD_ZERO(&reads);
+        openvpn_fd_set(sd, &reads);
+        tv.tv_sec = 0;
+        tv.tv_usec = 0;
+
+        status = select(sd + 1, &reads, NULL, NULL, &tv);
+
+        get_signal(signal_received);
+        if (*signal_received)
+        {
+            gc_free(&gc);
+            return sd;
+        }
+
+        if (status < 0)
+        {
+            msg(D_LINK_ERRORS | M_ERRNO, "TCP: select() failed");
+        }
+
+        if (status <= 0)
+        {
+            openvpn_sleep(1);
+            continue;
+        }
+
+        new_sd = socket_do_accept(sd, act, nowait);
+
+        if (socket_defined(new_sd))
+        {
+            struct addrinfo *ai = NULL;
+            if (remote_dynamic)
+            {
+                openvpn_getaddrinfo(0, remote_dynamic, NULL, 1, NULL,
                                     remote_verify.addr.sa.sa_family, &ai);
+            }
 
-          if(ai && !addrlist_match(&remote_verify, ai))
+            if (ai && !addrlist_match(&remote_verify, ai))
             {
-              msg (M_WARN,
-                   "TCP NOTE: Rejected connection attempt from %s due to --remote setting",
-                   print_link_socket_actual (act, &gc));
-              if (openvpn_close_socket (new_sd))
-                  msg (M_ERR, "TCP: close socket failed (new_sd)");
-              freeaddrinfo(ai);
+                msg(M_WARN,
+                    "TCP NOTE: Rejected connection attempt from %s due to --remote setting",
+                    print_link_socket_actual(act, &gc));
+                if (openvpn_close_socket(new_sd))
+                {
+                    msg(M_ERR, "TCP: close socket failed (new_sd)");
+                }
+                freeaddrinfo(ai);
             }
-	  else
+            else
             {
-              if(ai)
-                  freeaddrinfo(ai);
-              break;
+                if (ai)
+                {
+                    freeaddrinfo(ai);
+                }
+                break;
             }
-	}
-      openvpn_sleep (1);
+        }
+        openvpn_sleep(1);
     }
 
-  if (!nowait && openvpn_close_socket (sd))
-    msg (M_ERR, "TCP: close socket failed (sd)");
+    if (!nowait && openvpn_close_socket(sd))
+    {
+        msg(M_ERR, "TCP: close socket failed (sd)");
+    }
 
-  tcp_connection_established (act);
+    tcp_connection_established(act);
 
-  gc_free (&gc);
-  return new_sd;
+    gc_free(&gc);
+    return new_sd;
 }
 
 /* older mingw versions and WinXP do not have this define,
  * but Vista and up support the functionality - just define it here
  */
 #ifdef _WIN32
-# ifndef IPV6_V6ONLY
-#  define IPV6_V6ONLY 27
-# endif
+#ifndef IPV6_V6ONLY
+#define IPV6_V6ONLY 27
+#endif
 #endif
 void
-socket_bind (socket_descriptor_t sd,
-             struct addrinfo *local,
-             int ai_family,
-	     const char *prefix,
-             bool ipv6only)
+socket_bind(socket_descriptor_t sd,
+            struct addrinfo *local,
+            int ai_family,
+            const char *prefix,
+            bool ipv6only)
 {
-  struct gc_arena gc = gc_new ();
+    struct gc_arena gc = gc_new();
 
-  /* FIXME (schwabe)
-   * getaddrinfo for the bind address might return multiple AF_INET/AF_INET6
-   * entries for the requested protocol.
-   * For example if an address has multiple A records
-   * What is the correct way to deal with it?
-   */
+    /* FIXME (schwabe)
+     * getaddrinfo for the bind address might return multiple AF_INET/AF_INET6
+     * entries for the requested protocol.
+     * For example if an address has multiple A records
+     * What is the correct way to deal with it?
+     */
 
-  struct addrinfo* cur;
+    struct addrinfo *cur;
 
-  ASSERT(local);
+    ASSERT(local);
 
 
-  /* find the first addrinfo with correct ai_family */
-  for (cur = local; cur; cur=cur->ai_next)
+    /* find the first addrinfo with correct ai_family */
+    for (cur = local; cur; cur = cur->ai_next)
     {
-      if(cur->ai_family == ai_family)
-          break;
+        if (cur->ai_family == ai_family)
+        {
+            break;
+        }
+    }
+    if (!cur)
+    {
+        msg(M_FATAL, "%s: Socket bind failed: Addr to bind has no %s record",
+            prefix, addr_family_name(ai_family));
     }
-  if (!cur)
-      msg (M_FATAL, "%s: Socket bind failed: Addr to bind has no %s record",
-           prefix, addr_family_name(ai_family));
 
-  if (ai_family == AF_INET6)
+    if (ai_family == AF_INET6)
     {
-      int v6only = ipv6only ? 1: 0;	/* setsockopt must have an "int" */
+        int v6only = ipv6only ? 1 : 0;  /* setsockopt must have an "int" */
 
-      msg (M_INFO, "setsockopt(IPV6_V6ONLY=%d)", v6only);
-      if (setsockopt (sd, IPPROTO_IPV6, IPV6_V6ONLY, (void *) &v6only, sizeof(v6only)))
-	{
-	  msg (M_NONFATAL|M_ERRNO, "Setting IPV6_V6ONLY=%d failed", v6only);
-	}
+        msg(M_INFO, "setsockopt(IPV6_V6ONLY=%d)", v6only);
+        if (setsockopt(sd, IPPROTO_IPV6, IPV6_V6ONLY, (void *) &v6only, sizeof(v6only)))
+        {
+            msg(M_NONFATAL|M_ERRNO, "Setting IPV6_V6ONLY=%d failed", v6only);
+        }
     }
-  if (bind (sd, cur->ai_addr, cur->ai_addrlen))
+    if (bind(sd, cur->ai_addr, cur->ai_addrlen))
     {
-      const int errnum = openvpn_errno ();
-      msg (M_FATAL, "%s: Socket bind failed on local address %s: %s",
-	   prefix,
-           print_sockaddr_ex (local->ai_addr, ":", PS_SHOW_PORT, &gc),
-           strerror_ts (errnum, &gc));
+        const int errnum = openvpn_errno();
+        msg(M_FATAL, "%s: Socket bind failed on local address %s: %s",
+            prefix,
+            print_sockaddr_ex(local->ai_addr, ":", PS_SHOW_PORT, &gc),
+            strerror_ts(errnum, &gc));
     }
-  gc_free (&gc);
+    gc_free(&gc);
 }
 
 int
-openvpn_connect (socket_descriptor_t sd,
-		 const struct sockaddr *remote,
-		 int connect_timeout,
-		 volatile int *signal_received)
+openvpn_connect(socket_descriptor_t sd,
+                const struct sockaddr *remote,
+                int connect_timeout,
+                volatile int *signal_received)
 {
-  int status = 0;
+    int status = 0;
 
 #ifdef TARGET_ANDROID
-  protect_fd_nonlocal(sd, remote);
+    protect_fd_nonlocal(sd, remote);
 #endif
 
 #ifdef CONNECT_NONBLOCK
-  set_nonblock (sd);
-  status = connect (sd, remote, af_addr_size(remote->sa_family));
-  if (status)
-    status = openvpn_errno ();
-  if (
+    set_nonblock(sd);
+    status = connect(sd, remote, af_addr_size(remote->sa_family));
+    if (status)
+    {
+        status = openvpn_errno();
+    }
+    if (
 #ifdef _WIN32
-    status == WSAEWOULDBLOCK
+        status == WSAEWOULDBLOCK
 #else
-    status == EINPROGRESS
+        status == EINPROGRESS
 #endif
-  )
+        )
     {
-      while (true)
-	{
+        while (true)
+        {
 #if POLL
-	  struct pollfd fds[1];
-	  fds[0].fd = sd;
-	  fds[0].events = POLLOUT;
-	  status = poll(fds, 1, 0);
+            struct pollfd fds[1];
+            fds[0].fd = sd;
+            fds[0].events = POLLOUT;
+            status = poll(fds, 1, 0);
 #else
-	  fd_set writes;
-	  struct timeval tv;
+            fd_set writes;
+            struct timeval tv;
 
-	  FD_ZERO (&writes);
-	  openvpn_fd_set (sd, &writes);
-	  tv.tv_sec = 0;
-	  tv.tv_usec = 0;
+            FD_ZERO(&writes);
+            openvpn_fd_set(sd, &writes);
+            tv.tv_sec = 0;
+            tv.tv_usec = 0;
 
-	  status = select (sd + 1, NULL, &writes, NULL, &tv);
+            status = select(sd + 1, NULL, &writes, NULL, &tv);
 #endif
-	  if (signal_received)
-	    {
-	      get_signal (signal_received);
-	      if (*signal_received)
-		{
-		  status = 0;
-		  break;
-		}
-	    }
-	  if (status < 0)
-	    {
-	      status = openvpn_errno ();
-	      break;
-	    }
-	  if (status <= 0)
-	    {
-	      if (--connect_timeout < 0)
-		{
+            if (signal_received)
+            {
+                get_signal(signal_received);
+                if (*signal_received)
+                {
+                    status = 0;
+                    break;
+                }
+            }
+            if (status < 0)
+            {
+                status = openvpn_errno();
+                break;
+            }
+            if (status <= 0)
+            {
+                if (--connect_timeout < 0)
+                {
 #ifdef _WIN32
-		  status = WSAETIMEDOUT;
+                    status = WSAETIMEDOUT;
 #else
-		  status = ETIMEDOUT;
+                    status = ETIMEDOUT;
 #endif
-		  break;
-		}
-	      openvpn_sleep (1);
-	      continue;
-	    }
-
-	  /* got it */
-	  {
-	    int val = 0;
-	    socklen_t len;
-
-	    len = sizeof (val);
-	    if (getsockopt (sd, SOL_SOCKET, SO_ERROR, (void *) &val, &len) == 0
-		&& len == sizeof (val))
-	      status = val;
-	    else
-	      status = openvpn_errno ();
-	    break;
-	  }
-	}
+                    break;
+                }
+                openvpn_sleep(1);
+                continue;
+            }
+
+            /* got it */
+            {
+                int val = 0;
+                socklen_t len;
+
+                len = sizeof(val);
+                if (getsockopt(sd, SOL_SOCKET, SO_ERROR, (void *) &val, &len) == 0
+                    && len == sizeof(val))
+                {
+                    status = val;
+                }
+                else
+                {
+                    status = openvpn_errno();
+                }
+                break;
+            }
+        }
     }
-#else
-  status = connect (sd, remote, af_addr_size(remote->sa_family));
-  if (status)
-    status = openvpn_errno ();
-#endif
+#else  /* ifdef CONNECT_NONBLOCK */
+    status = connect(sd, remote, af_addr_size(remote->sa_family));
+    if (status)
+    {
+        status = openvpn_errno();
+    }
+#endif /* ifdef CONNECT_NONBLOCK */
 
-  return status;
+    return status;
 }
 
-void set_actual_address (struct link_socket_actual* actual, struct addrinfo* ai)
+void
+set_actual_address(struct link_socket_actual *actual, struct addrinfo *ai)
 {
-    CLEAR (*actual);
-    ASSERT (ai);
+    CLEAR(*actual);
+    ASSERT(ai);
 
     if (ai->ai_family == AF_INET)
+    {
         actual->dest.addr.in4 =
-        *((struct sockaddr_in*) ai->ai_addr);
+            *((struct sockaddr_in *) ai->ai_addr);
+    }
     else if (ai->ai_family == AF_INET6)
+    {
         actual->dest.addr.in6 =
-        *((struct sockaddr_in6*) ai->ai_addr);
+            *((struct sockaddr_in6 *) ai->ai_addr);
+    }
     else
+    {
         ASSERT(0);
+    }
 
 }
 
 void
-socket_connect (socket_descriptor_t* sd,
-                const struct sockaddr* dest,
-                const int connect_timeout,
-                struct signal_info* sig_info)
+socket_connect(socket_descriptor_t *sd,
+               const struct sockaddr *dest,
+               const int connect_timeout,
+               struct signal_info *sig_info)
 {
-  struct gc_arena gc = gc_new ();
-  int status;
+    struct gc_arena gc = gc_new();
+    int status;
 
 #ifdef CONNECT_NONBLOCK
-  msg (M_INFO, "Attempting to establish TCP connection with %s [nonblock]",
-       print_sockaddr (dest, &gc));
+    msg(M_INFO, "Attempting to establish TCP connection with %s [nonblock]",
+        print_sockaddr(dest, &gc));
 #else
-  msg (M_INFO, "Attempting to establish TCP connection with %s",
-       print_sockaddr (dest, &gc));
+    msg(M_INFO, "Attempting to establish TCP connection with %s",
+        print_sockaddr(dest, &gc));
 #endif
 
 #ifdef ENABLE_MANAGEMENT
-  if (management)
-	management_set_state (management,
-			      OPENVPN_STATE_TCP_CONNECT,
-			      NULL,
-                              NULL,
-                              NULL,
-                              NULL,
-                              NULL);
+    if (management)
+    {
+        management_set_state(management,
+                             OPENVPN_STATE_TCP_CONNECT,
+                             NULL,
+                             NULL,
+                             NULL,
+                             NULL,
+                             NULL);
+    }
 #endif
 
-  /* Set the actual address */
-  status = openvpn_connect (*sd, dest, connect_timeout, &sig_info->signal_received);
+    /* Set the actual address */
+    status = openvpn_connect(*sd, dest, connect_timeout, &sig_info->signal_received);
 
-  get_signal (&sig_info->signal_received);
-  if (sig_info->signal_received)
-	goto done;
+    get_signal(&sig_info->signal_received);
+    if (sig_info->signal_received)
+    {
+        goto done;
+    }
 
-  if (status) {
+    if (status)
+    {
 
-    msg (D_LINK_ERRORS,
-         "TCP: connect to %s failed: %s",
-         print_sockaddr (dest, &gc),
-         strerror_ts (status, &gc));
+        msg(D_LINK_ERRORS,
+            "TCP: connect to %s failed: %s",
+            print_sockaddr(dest, &gc),
+            strerror_ts(status, &gc));
 
-    openvpn_close_socket (*sd);
-    *sd = SOCKET_UNDEFINED;
-    sig_info->signal_received = SIGUSR1;
-    sig_info->source = SIG_SOURCE_CONNECTION_FAILED;
-  } else {
-      msg (M_INFO, "TCP connection established with %s",
-        print_sockaddr (dest, &gc));
-  }
+        openvpn_close_socket(*sd);
+        *sd = SOCKET_UNDEFINED;
+        sig_info->signal_received = SIGUSR1;
+        sig_info->source = SIG_SOURCE_CONNECTION_FAILED;
+    }
+    else
+    {
+        msg(M_INFO, "TCP connection established with %s",
+            print_sockaddr(dest, &gc));
+    }
 
- done:
-  gc_free (&gc);
+done:
+    gc_free(&gc);
 }
 
 /* For stream protocols, allocate a buffer to build up packet.
-   Called after frame has been finalized. */
+ * Called after frame has been finalized. */
 
 static void
-socket_frame_init (const struct frame *frame, struct link_socket *sock)
+socket_frame_init(const struct frame *frame, struct link_socket *sock)
 {
 #ifdef _WIN32
-  overlapped_io_init (&sock->reads, frame, FALSE, false);
-  overlapped_io_init (&sock->writes, frame, TRUE, false);
-  sock->rw_handle.read = sock->reads.overlapped.hEvent;
-  sock->rw_handle.write = sock->writes.overlapped.hEvent;
+    overlapped_io_init(&sock->reads, frame, FALSE, false);
+    overlapped_io_init(&sock->writes, frame, TRUE, false);
+    sock->rw_handle.read = sock->reads.overlapped.hEvent;
+    sock->rw_handle.write = sock->writes.overlapped.hEvent;
 #endif
 
-  if (link_socket_connection_oriented (sock))
+    if (link_socket_connection_oriented(sock))
     {
 #ifdef _WIN32
-      stream_buf_init (&sock->stream_buf,
-		       &sock->reads.buf_init,
-		       sock->sockflags,
-		       sock->info.proto);
+        stream_buf_init(&sock->stream_buf,
+                        &sock->reads.buf_init,
+                        sock->sockflags,
+                        sock->info.proto);
 #else
-      alloc_buf_sock_tun (&sock->stream_buf_data,
-			  frame,
-			  false,
-			  FRAME_HEADROOM_MARKER_READ_STREAM);
-
-      stream_buf_init (&sock->stream_buf,
-		       &sock->stream_buf_data,
-		       sock->sockflags,
-		       sock->info.proto);
+        alloc_buf_sock_tun(&sock->stream_buf_data,
+                           frame,
+                           false,
+                           FRAME_HEADROOM_MARKER_READ_STREAM);
+
+        stream_buf_init(&sock->stream_buf,
+                        &sock->stream_buf_data,
+                        sock->sockflags,
+                        sock->info.proto);
 #endif
     }
 }
@@ -1329,798 +1529,864 @@ socket_frame_init (const struct frame *frame, struct link_socket *sock)
  * to us by the OS.
  */
 void
-frame_adjust_path_mtu (struct frame *frame, int pmtu, int proto)
+frame_adjust_path_mtu(struct frame *frame, int pmtu, int proto)
 {
-  frame_set_mtu_dynamic (frame, pmtu - datagram_overhead (proto), SET_MTU_UPPER_BOUND);
+    frame_set_mtu_dynamic(frame, pmtu - datagram_overhead(proto), SET_MTU_UPPER_BOUND);
 }
 
 static void
-resolve_bind_local (struct link_socket *sock, const sa_family_t af)
+resolve_bind_local(struct link_socket *sock, const sa_family_t af)
 {
-  struct gc_arena gc = gc_new ();
+    struct gc_arena gc = gc_new();
 
-  /* resolve local address if undefined */
-  if (!sock->info.lsa->bind_local)
+    /* resolve local address if undefined */
+    if (!sock->info.lsa->bind_local)
     {
-      int flags = GETADDR_RESOLVE | GETADDR_WARN_ON_SIGNAL |
-	GETADDR_FATAL | GETADDR_PASSIVE;
-      int status;
+        int flags = GETADDR_RESOLVE | GETADDR_WARN_ON_SIGNAL
+                    |GETADDR_FATAL | GETADDR_PASSIVE;
+        int status;
 
-      if(proto_is_dgram(sock->info.proto))
-	flags |= GETADDR_DATAGRAM;
+        if (proto_is_dgram(sock->info.proto))
+        {
+            flags |= GETADDR_DATAGRAM;
+        }
 
-      /* will return AF_{INET|INET6}from local_host */
-      status = get_cached_dns_entry (sock->dns_cache,
-				     sock->local_host,
-				     sock->local_port,
-				     af,
-				     flags,
-				     &sock->info.lsa->bind_local);
+        /* will return AF_{INET|INET6}from local_host */
+        status = get_cached_dns_entry(sock->dns_cache,
+                                      sock->local_host,
+                                      sock->local_port,
+                                      af,
+                                      flags,
+                                      &sock->info.lsa->bind_local);
 
-      if (status)
-	status = openvpn_getaddrinfo(flags, sock->local_host, sock->local_port, 0,
-				   NULL, af, &sock->info.lsa->bind_local);
+        if (status)
+        {
+            status = openvpn_getaddrinfo(flags, sock->local_host, sock->local_port, 0,
+                                         NULL, af, &sock->info.lsa->bind_local);
+        }
 
-      if(status !=0) {
-	msg (M_FATAL, "getaddrinfo() failed for local \"%s:%s\": %s",
-	     sock->local_host, sock->local_port,
-	     gai_strerror(status));
-      }
+        if (status !=0)
+        {
+            msg(M_FATAL, "getaddrinfo() failed for local \"%s:%s\": %s",
+                sock->local_host, sock->local_port,
+                gai_strerror(status));
+        }
     }
 
-  gc_free (&gc);
+    gc_free(&gc);
 }
 
 static void
-resolve_remote (struct link_socket *sock,
-		int phase,
-		const char **remote_dynamic,
-		volatile int *signal_received)
-{
-  struct gc_arena gc = gc_new ();
-
-  /* resolve remote address if undefined */
-  if (!sock->info.lsa->remote_list)
-    {
-      if (sock->remote_host)
-	{
-	  unsigned int flags = sf2gaf(GETADDR_RESOLVE|GETADDR_UPDATE_MANAGEMENT_STATE, sock->sockflags);
-	  int retry = 0;
-	  int status = -1;
-	  struct addrinfo* ai;
-	  if (proto_is_dgram(sock->info.proto))
-	    flags |= GETADDR_DATAGRAM;
-
-	  if (sock->resolve_retry_seconds == RESOLV_RETRY_INFINITE)
-	    {
-	      if (phase == 2)
-		flags |= (GETADDR_TRY_ONCE | GETADDR_FATAL);
-	      retry = 0;
-	    }
-	  else if (phase == 1)
-	    {
-	      if (sock->resolve_retry_seconds)
-		{
-		  retry = 0;
-		}
-	      else
-		{
-		  flags |= (GETADDR_FATAL | GETADDR_MENTION_RESOLVE_RETRY);
-		  retry = 0;
-		}
-	    }
-	  else if (phase == 2)
-	    {
-	      if (sock->resolve_retry_seconds)
-		{
-		  flags |= GETADDR_FATAL;
-		  retry = sock->resolve_retry_seconds;
-		}
-	      else
-		{
-		  ASSERT (0);
-		}
-	    }
-	  else
-	    {
-	      ASSERT (0);
-	    }
-
-
-	  status = get_cached_dns_entry (sock->dns_cache,
-					 sock->remote_host,
-					 sock->remote_port,
-					 sock->info.af,
-					 flags, &ai);
-	  if (status)
-	    status = openvpn_getaddrinfo (flags, sock->remote_host, sock->remote_port,
-					  retry, signal_received, sock->info.af, &ai);
-
-	  if(status == 0) {
-	    sock->info.lsa->remote_list = ai;
-	    sock->info.lsa->current_remote = ai;
-
-	    dmsg (D_SOCKET_DEBUG, "RESOLVE_REMOTE flags=0x%04x phase=%d rrs=%d sig=%d status=%d",
-		  flags,
-		  phase,
-		  retry,
-		  signal_received ? *signal_received : -1,
-		  status);
-	  }
-	  if (signal_received)
-	    {
-	      if (*signal_received)
-		goto done;
-	    }
-	      if (status!=0)
-		{
-		  if (signal_received)
-		    *signal_received = SIGUSR1;
-		  goto done;
-		}
-	}
-    }
-  
-  /* should we re-use previous active remote address? */
-  if (link_socket_actual_defined (&sock->info.lsa->actual))
-    {
-      msg (M_INFO, "TCP/UDP: Preserving recently used remote address: %s",
-	   print_link_socket_actual (&sock->info.lsa->actual, &gc));
-      if (remote_dynamic)
-	*remote_dynamic = NULL;
-    }
-  else
-    {
-      CLEAR (sock->info.lsa->actual);
-      if(sock->info.lsa->current_remote)
-	{
-	  set_actual_address (&sock->info.lsa->actual,
-			      sock->info.lsa->current_remote);
-	}
-    }
-
- done:
-  gc_free (&gc);
+resolve_remote(struct link_socket *sock,
+               int phase,
+               const char **remote_dynamic,
+               volatile int *signal_received)
+{
+    struct gc_arena gc = gc_new();
+
+    /* resolve remote address if undefined */
+    if (!sock->info.lsa->remote_list)
+    {
+        if (sock->remote_host)
+        {
+            unsigned int flags = sf2gaf(GETADDR_RESOLVE|GETADDR_UPDATE_MANAGEMENT_STATE, sock->sockflags);
+            int retry = 0;
+            int status = -1;
+            struct addrinfo *ai;
+            if (proto_is_dgram(sock->info.proto))
+            {
+                flags |= GETADDR_DATAGRAM;
+            }
+
+            if (sock->resolve_retry_seconds == RESOLV_RETRY_INFINITE)
+            {
+                if (phase == 2)
+                {
+                    flags |= (GETADDR_TRY_ONCE | GETADDR_FATAL);
+                }
+                retry = 0;
+            }
+            else if (phase == 1)
+            {
+                if (sock->resolve_retry_seconds)
+                {
+                    retry = 0;
+                }
+                else
+                {
+                    flags |= (GETADDR_FATAL | GETADDR_MENTION_RESOLVE_RETRY);
+                    retry = 0;
+                }
+            }
+            else if (phase == 2)
+            {
+                if (sock->resolve_retry_seconds)
+                {
+                    flags |= GETADDR_FATAL;
+                    retry = sock->resolve_retry_seconds;
+                }
+                else
+                {
+                    ASSERT(0);
+                }
+            }
+            else
+            {
+                ASSERT(0);
+            }
+
+
+            status = get_cached_dns_entry(sock->dns_cache,
+                                          sock->remote_host,
+                                          sock->remote_port,
+                                          sock->info.af,
+                                          flags, &ai);
+            if (status)
+            {
+                status = openvpn_getaddrinfo(flags, sock->remote_host, sock->remote_port,
+                                             retry, signal_received, sock->info.af, &ai);
+            }
+
+            if (status == 0)
+            {
+                sock->info.lsa->remote_list = ai;
+                sock->info.lsa->current_remote = ai;
+
+                dmsg(D_SOCKET_DEBUG, "RESOLVE_REMOTE flags=0x%04x phase=%d rrs=%d sig=%d status=%d",
+                     flags,
+                     phase,
+                     retry,
+                     signal_received ? *signal_received : -1,
+                     status);
+            }
+            if (signal_received)
+            {
+                if (*signal_received)
+                {
+                    goto done;
+                }
+            }
+            if (status!=0)
+            {
+                if (signal_received)
+                {
+                    *signal_received = SIGUSR1;
+                }
+                goto done;
+            }
+        }
+    }
+
+    /* should we re-use previous active remote address? */
+    if (link_socket_actual_defined(&sock->info.lsa->actual))
+    {
+        msg(M_INFO, "TCP/UDP: Preserving recently used remote address: %s",
+            print_link_socket_actual(&sock->info.lsa->actual, &gc));
+        if (remote_dynamic)
+        {
+            *remote_dynamic = NULL;
+        }
+    }
+    else
+    {
+        CLEAR(sock->info.lsa->actual);
+        if (sock->info.lsa->current_remote)
+        {
+            set_actual_address(&sock->info.lsa->actual,
+                               sock->info.lsa->current_remote);
+        }
+    }
+
+done:
+    gc_free(&gc);
 }
 
 
 
 struct link_socket *
-link_socket_new (void)
+link_socket_new(void)
 {
-  struct link_socket *sock;
+    struct link_socket *sock;
 
-  ALLOC_OBJ_CLEAR (sock, struct link_socket);
-  sock->sd = SOCKET_UNDEFINED;
-  sock->ctrl_sd = SOCKET_UNDEFINED;
-  return sock;
+    ALLOC_OBJ_CLEAR(sock, struct link_socket);
+    sock->sd = SOCKET_UNDEFINED;
+    sock->ctrl_sd = SOCKET_UNDEFINED;
+    return sock;
 }
 
 void
-link_socket_init_phase1 (struct link_socket *sock,
-			 const char *local_host,
-			 const char *local_port,
-			 const char *remote_host,
-			 const char *remote_port,
-			 struct cached_dns_entry *dns_cache,
-			 int proto,
-			 sa_family_t af,
-			 bool bind_ipv6_only,
-			 int mode,
-			 const struct link_socket *accept_from,
-			 struct http_proxy_info *http_proxy,
-			 struct socks_proxy_info *socks_proxy,
+link_socket_init_phase1(struct link_socket *sock,
+                        const char *local_host,
+                        const char *local_port,
+                        const char *remote_host,
+                        const char *remote_port,
+                        struct cached_dns_entry *dns_cache,
+                        int proto,
+                        sa_family_t af,
+                        bool bind_ipv6_only,
+                        int mode,
+                        const struct link_socket *accept_from,
+                        struct http_proxy_info *http_proxy,
+                        struct socks_proxy_info *socks_proxy,
 #ifdef ENABLE_DEBUG
-			 int gremlin,
+                        int gremlin,
 #endif
-			 bool bind_local,
-			 bool remote_float,
-			 int inetd,
-			 struct link_socket_addr *lsa,
-			 const char *ipchange_command,
-			 const struct plugin_list *plugins,
-			 int resolve_retry_seconds,
-			 int mtu_discover_type,
-			 int rcvbuf,
-			 int sndbuf,
-			 int mark,
-			 struct event_timeout* server_poll_timeout,
-			 unsigned int sockflags)
-{
-  ASSERT (sock);
-
-  sock->local_host = local_host;
-  sock->local_port = local_port;
-  sock->remote_host = remote_host;
-  sock->remote_port = remote_port;
-  sock->dns_cache = dns_cache;
-  sock->http_proxy = http_proxy;
-  sock->socks_proxy = socks_proxy;
-  sock->bind_local = bind_local;
-  sock->inetd = inetd;
-  sock->resolve_retry_seconds = resolve_retry_seconds;
-  sock->mtu_discover_type = mtu_discover_type;
+                        bool bind_local,
+                        bool remote_float,
+                        int inetd,
+                        struct link_socket_addr *lsa,
+                        const char *ipchange_command,
+                        const struct plugin_list *plugins,
+                        int resolve_retry_seconds,
+                        int mtu_discover_type,
+                        int rcvbuf,
+                        int sndbuf,
+                        int mark,
+                        struct event_timeout *server_poll_timeout,
+                        unsigned int sockflags)
+{
+    ASSERT(sock);
+
+    sock->local_host = local_host;
+    sock->local_port = local_port;
+    sock->remote_host = remote_host;
+    sock->remote_port = remote_port;
+    sock->dns_cache = dns_cache;
+    sock->http_proxy = http_proxy;
+    sock->socks_proxy = socks_proxy;
+    sock->bind_local = bind_local;
+    sock->inetd = inetd;
+    sock->resolve_retry_seconds = resolve_retry_seconds;
+    sock->mtu_discover_type = mtu_discover_type;
 
 #ifdef ENABLE_DEBUG
-  sock->gremlin = gremlin;
+    sock->gremlin = gremlin;
 #endif
 
-  sock->socket_buffer_sizes.rcvbuf = rcvbuf;
-  sock->socket_buffer_sizes.sndbuf = sndbuf;
+    sock->socket_buffer_sizes.rcvbuf = rcvbuf;
+    sock->socket_buffer_sizes.sndbuf = sndbuf;
 
-  sock->sockflags = sockflags;
-  sock->mark = mark;
+    sock->sockflags = sockflags;
+    sock->mark = mark;
 
-  sock->info.proto = proto;
-  sock->info.af = af;
-  sock->info.remote_float = remote_float;
-  sock->info.lsa = lsa;
-  sock->info.bind_ipv6_only = bind_ipv6_only;
-  sock->info.ipchange_command = ipchange_command;
-  sock->info.plugins = plugins;
-  sock->server_poll_timeout = server_poll_timeout;
+    sock->info.proto = proto;
+    sock->info.af = af;
+    sock->info.remote_float = remote_float;
+    sock->info.lsa = lsa;
+    sock->info.bind_ipv6_only = bind_ipv6_only;
+    sock->info.ipchange_command = ipchange_command;
+    sock->info.plugins = plugins;
+    sock->server_poll_timeout = server_poll_timeout;
 
-  sock->mode = mode;
-  if (mode == LS_MODE_TCP_ACCEPT_FROM)
+    sock->mode = mode;
+    if (mode == LS_MODE_TCP_ACCEPT_FROM)
     {
-      ASSERT (accept_from);
-      ASSERT (sock->info.proto == PROTO_TCP_SERVER);
-      ASSERT (!sock->inetd);
-      sock->sd = accept_from->sd;
+        ASSERT(accept_from);
+        ASSERT(sock->info.proto == PROTO_TCP_SERVER);
+        ASSERT(!sock->inetd);
+        sock->sd = accept_from->sd;
     }
 
-  /* are we running in HTTP proxy mode? */
-  if (sock->http_proxy)
+    /* are we running in HTTP proxy mode? */
+    if (sock->http_proxy)
     {
-      ASSERT (sock->info.proto == PROTO_TCP_CLIENT);
-      ASSERT (!sock->inetd);
+        ASSERT(sock->info.proto == PROTO_TCP_CLIENT);
+        ASSERT(!sock->inetd);
 
-      /* the proxy server */
-      sock->remote_host = http_proxy->options.server;
-      sock->remote_port = http_proxy->options.port;
+        /* the proxy server */
+        sock->remote_host = http_proxy->options.server;
+        sock->remote_port = http_proxy->options.port;
 
-      /* the OpenVPN server we will use the proxy to connect to */
-      sock->proxy_dest_host = remote_host;
-      sock->proxy_dest_port = remote_port;
+        /* the OpenVPN server we will use the proxy to connect to */
+        sock->proxy_dest_host = remote_host;
+        sock->proxy_dest_port = remote_port;
     }
-  /* or in Socks proxy mode? */
-  else if (sock->socks_proxy)
+    /* or in Socks proxy mode? */
+    else if (sock->socks_proxy)
     {
-      ASSERT (!sock->inetd);
+        ASSERT(!sock->inetd);
 
-      /* the proxy server */
-      sock->remote_host = socks_proxy->server;
-      sock->remote_port = socks_proxy->port;
+        /* the proxy server */
+        sock->remote_host = socks_proxy->server;
+        sock->remote_port = socks_proxy->port;
 
-      /* the OpenVPN server we will use the proxy to connect to */
-      sock->proxy_dest_host = remote_host;
-      sock->proxy_dest_port = remote_port;
+        /* the OpenVPN server we will use the proxy to connect to */
+        sock->proxy_dest_host = remote_host;
+        sock->proxy_dest_port = remote_port;
     }
-  else
+    else
     {
-      sock->remote_host = remote_host;
-      sock->remote_port = remote_port;
+        sock->remote_host = remote_host;
+        sock->remote_port = remote_port;
     }
 
-  /* bind behavior for TCP server vs. client */
-  if (sock->info.proto == PROTO_TCP_SERVER)
+    /* bind behavior for TCP server vs. client */
+    if (sock->info.proto == PROTO_TCP_SERVER)
     {
-      if (sock->mode == LS_MODE_TCP_ACCEPT_FROM)
-	sock->bind_local = false;
-      else
-	sock->bind_local = true;
+        if (sock->mode == LS_MODE_TCP_ACCEPT_FROM)
+        {
+            sock->bind_local = false;
+        }
+        else
+        {
+            sock->bind_local = true;
+        }
     }
 
-  /* were we started by inetd or xinetd? */
-  if (sock->inetd)
+    /* were we started by inetd or xinetd? */
+    if (sock->inetd)
     {
-      ASSERT (sock->info.proto != PROTO_TCP_CLIENT);
-      ASSERT (socket_defined (inetd_socket_descriptor));
-      sock->sd = inetd_socket_descriptor;
+        ASSERT(sock->info.proto != PROTO_TCP_CLIENT);
+        ASSERT(socket_defined(inetd_socket_descriptor));
+        sock->sd = inetd_socket_descriptor;
+        set_cloexec(sock->sd);          /* not created by create_socket*() */
     }
-  else if (mode != LS_MODE_TCP_ACCEPT_FROM)
+    else if (mode != LS_MODE_TCP_ACCEPT_FROM)
     {
-      if (sock->bind_local) {
-	  resolve_bind_local (sock, sock->info.af);
-      }
-      resolve_remote (sock, 1, NULL, NULL);
+        if (sock->bind_local)
+        {
+            resolve_bind_local(sock, sock->info.af);
+        }
+        resolve_remote(sock, 1, NULL, NULL);
     }
 }
 
 static
-void phase2_inetd (struct link_socket* sock, const struct frame *frame,
-		   const char *remote_dynamic, volatile int *signal_received)
+void
+phase2_inetd(struct link_socket *sock, const struct frame *frame,
+             const char *remote_dynamic, volatile int *signal_received)
 {
-  bool remote_changed = false;
+    bool remote_changed = false;
 
-  if (sock->info.proto == PROTO_TCP_SERVER) {
-    /* AF_INET as default (and fallback) for inetd */
-    sock->info.lsa->actual.dest.addr.sa.sa_family = AF_INET;
-#ifdef HAVE_GETSOCKNAME
+    if (sock->info.proto == PROTO_TCP_SERVER)
     {
-      /* inetd: hint family type for dest = local's */
-      struct openvpn_sockaddr local_addr;
-      socklen_t addrlen = sizeof(local_addr);
-      if (getsockname (sock->sd, &local_addr.addr.sa, &addrlen) == 0) {
-	sock->info.lsa->actual.dest.addr.sa.sa_family = local_addr.addr.sa.sa_family;
-	dmsg (D_SOCKET_DEBUG, "inetd(%s): using sa_family=%d from getsockname(%d)",
-	      proto2ascii(sock->info.proto, sock->info.af, false),
-	      local_addr.addr.sa.sa_family, sock->sd);
-      } else
-	msg (M_WARN, "inetd(%s): getsockname(%d) failed, using AF_INET",
-	     proto2ascii(sock->info.proto, sock->info.af, false), sock->sd);
-    }
-#else
-    msg (M_WARN, "inetd(%s): this OS does not provide the getsockname() "
-	 "function, using AF_INET",
-	 proto2ascii(sock->info.proto, false));
-#endif
-    sock->sd =
-      socket_listen_accept (sock->sd,
-			    &sock->info.lsa->actual,
-			    remote_dynamic,
-			    sock->info.lsa->bind_local,
-			    false,
-			    sock->inetd == INETD_NOWAIT,
-			    signal_received);
+        /* AF_INET as default (and fallback) for inetd */
+        sock->info.lsa->actual.dest.addr.sa.sa_family = AF_INET;
+#ifdef HAVE_GETSOCKNAME
+        {
+            /* inetd: hint family type for dest = local's */
+            struct openvpn_sockaddr local_addr;
+            socklen_t addrlen = sizeof(local_addr);
+            if (getsockname(sock->sd, &local_addr.addr.sa, &addrlen) == 0)
+            {
+                sock->info.lsa->actual.dest.addr.sa.sa_family = local_addr.addr.sa.sa_family;
+                dmsg(D_SOCKET_DEBUG, "inetd(%s): using sa_family=%d from getsockname(%d)",
+                     proto2ascii(sock->info.proto, sock->info.af, false),
+                     local_addr.addr.sa.sa_family, sock->sd);
+            }
+            else
+            {
+                msg(M_WARN, "inetd(%s): getsockname(%d) failed, using AF_INET",
+                    proto2ascii(sock->info.proto, sock->info.af, false), sock->sd);
+            }
+        }
+#else  /* ifdef HAVE_GETSOCKNAME */
+        msg(M_WARN, "inetd(%s): this OS does not provide the getsockname() "
+            "function, using AF_INET",
+            proto2ascii(sock->info.proto, false));
+#endif /* ifdef HAVE_GETSOCKNAME */
+        sock->sd =
+            socket_listen_accept(sock->sd,
+                                 &sock->info.lsa->actual,
+                                 remote_dynamic,
+                                 sock->info.lsa->bind_local,
+                                 false,
+                                 sock->inetd == INETD_NOWAIT,
+                                 signal_received);
 
-  }
-  ASSERT (!remote_changed);
+    }
+    ASSERT(!remote_changed);
 }
 
 static void
-phase2_set_socket_flags (struct link_socket* sock)
+phase2_set_socket_flags(struct link_socket *sock)
 {
-  /* set misc socket parameters */
-  socket_set_flags (sock->sd, sock->sockflags);
+    /* set misc socket parameters */
+    socket_set_flags(sock->sd, sock->sockflags);
 
-  /* set socket to non-blocking mode */
-  set_nonblock (sock->sd);
+    /* set socket to non-blocking mode */
+    set_nonblock(sock->sd);
 
-  /* set socket file descriptor to not pass across execs, so that
-     scripts don't have access to it */
-  set_cloexec (sock->sd);
-
-  if (socket_defined (sock->ctrl_sd))
-    set_cloexec (sock->ctrl_sd);
-
-  /* set Path MTU discovery options on the socket */
-  set_mtu_discover_type (sock->sd, sock->mtu_discover_type, sock->info.af);
+    /* set Path MTU discovery options on the socket */
+    set_mtu_discover_type(sock->sd, sock->mtu_discover_type, sock->info.af);
 
 #if EXTENDED_SOCKET_ERROR_CAPABILITY
-  /* if the OS supports it, enable extended error passing on the socket */
-  set_sock_extended_error_passing (sock->sd);
+    /* if the OS supports it, enable extended error passing on the socket */
+    set_sock_extended_error_passing(sock->sd);
 #endif
 }
 
 
 static void
-linksock_print_addr (struct link_socket *sock)
-{
-  struct gc_arena gc = gc_new ();
-  const int msglevel = (sock->mode == LS_MODE_TCP_ACCEPT_FROM) ? D_INIT_MEDIUM : M_INFO;
-
-  /* print local address */
- if (sock->inetd)
-    msg (msglevel, "%s link local: [inetd]", proto2ascii (sock->info.proto, sock->info.af, true));
-  else if (sock->bind_local)
-    {
-      sa_family_t ai_family = sock->info.lsa->actual.dest.addr.sa.sa_family;
-      /* Socket is always bound on the first matching address,
-       * For bound sockets with no remote addr this is the element of
-       * the list */
-      struct addrinfo *cur;
-      for (cur = sock->info.lsa->bind_local; cur; cur=cur->ai_next)
-	{
-	  if(!ai_family || ai_family == cur->ai_family)
-	    break;
-	}
-      ASSERT (cur);
-      msg (msglevel, "%s link local (bound): %s",
-	   proto2ascii (sock->info.proto, sock->info.af, true),
-	   print_sockaddr(cur->ai_addr,&gc));
-    }
-  else
-    msg (msglevel, "%s link local: (not bound)",
-	 proto2ascii (sock->info.proto, sock->info.af, true));
-
-  /* print active remote address */
-  msg (msglevel, "%s link remote: %s",
-       proto2ascii (sock->info.proto, sock->info.af, true),
-       print_link_socket_actual_ex (&sock->info.lsa->actual,
-				    ":",
-				    PS_SHOW_PORT_IF_DEFINED,
-				    &gc));
-  gc_free(&gc);
+linksock_print_addr(struct link_socket *sock)
+{
+    struct gc_arena gc = gc_new();
+    const int msglevel = (sock->mode == LS_MODE_TCP_ACCEPT_FROM) ? D_INIT_MEDIUM : M_INFO;
+
+    /* print local address */
+    if (sock->inetd)
+    {
+        msg(msglevel, "%s link local: [inetd]", proto2ascii(sock->info.proto, sock->info.af, true));
+    }
+    else if (sock->bind_local)
+    {
+        sa_family_t ai_family = sock->info.lsa->actual.dest.addr.sa.sa_family;
+        /* Socket is always bound on the first matching address,
+         * For bound sockets with no remote addr this is the element of
+         * the list */
+        struct addrinfo *cur;
+        for (cur = sock->info.lsa->bind_local; cur; cur = cur->ai_next)
+        {
+            if (!ai_family || ai_family == cur->ai_family)
+            {
+                break;
+            }
+        }
+        ASSERT(cur);
+        msg(msglevel, "%s link local (bound): %s",
+            proto2ascii(sock->info.proto, sock->info.af, true),
+            print_sockaddr(cur->ai_addr,&gc));
+    }
+    else
+    {
+        msg(msglevel, "%s link local: (not bound)",
+            proto2ascii(sock->info.proto, sock->info.af, true));
+    }
+
+    /* print active remote address */
+    msg(msglevel, "%s link remote: %s",
+        proto2ascii(sock->info.proto, sock->info.af, true),
+        print_link_socket_actual_ex(&sock->info.lsa->actual,
+                                    ":",
+                                    PS_SHOW_PORT_IF_DEFINED,
+                                    &gc));
+    gc_free(&gc);
 }
 
 static void
-phase2_tcp_server (struct link_socket *sock, const char *remote_dynamic,
-		   volatile int *signal_received)
-{
-  switch (sock->mode)
-    {
-    case LS_MODE_DEFAULT:
-      sock->sd = socket_listen_accept (sock->sd,
-				       &sock->info.lsa->actual,
-				       remote_dynamic,
-				       sock->info.lsa->bind_local,
-				       true,
-				       false,
-				       signal_received);
-      break;
-    case LS_MODE_TCP_LISTEN:
-      socket_do_listen (sock->sd,
-			sock->info.lsa->bind_local,
-			true,
-			false);
-      break;
-    case LS_MODE_TCP_ACCEPT_FROM:
-      sock->sd = socket_do_accept (sock->sd,
-				   &sock->info.lsa->actual,
-				   false);
-      if (!socket_defined (sock->sd))
-	{
-	  *signal_received = SIGTERM;
-	  return;
-	}
-      tcp_connection_established (&sock->info.lsa->actual);
-      break;
-    default:
-      ASSERT (0);
+phase2_tcp_server(struct link_socket *sock, const char *remote_dynamic,
+                  volatile int *signal_received)
+{
+    switch (sock->mode)
+    {
+        case LS_MODE_DEFAULT:
+            sock->sd = socket_listen_accept(sock->sd,
+                                            &sock->info.lsa->actual,
+                                            remote_dynamic,
+                                            sock->info.lsa->bind_local,
+                                            true,
+                                            false,
+                                            signal_received);
+            break;
+
+        case LS_MODE_TCP_LISTEN:
+            socket_do_listen(sock->sd,
+                             sock->info.lsa->bind_local,
+                             true,
+                             false);
+            break;
+
+        case LS_MODE_TCP_ACCEPT_FROM:
+            sock->sd = socket_do_accept(sock->sd,
+                                        &sock->info.lsa->actual,
+                                        false);
+            if (!socket_defined(sock->sd))
+            {
+                *signal_received = SIGTERM;
+                return;
+            }
+            tcp_connection_established(&sock->info.lsa->actual);
+            break;
+
+        default:
+            ASSERT(0);
     }
 }
 
 
 static void
-phase2_tcp_client (struct link_socket *sock, struct signal_info *sig_info)
+phase2_tcp_client(struct link_socket *sock, struct signal_info *sig_info)
 {
-  bool proxy_retry = false;
-  do {
-    socket_connect (&sock->sd,
-                   sock->info.lsa->current_remote->ai_addr,
-                   get_server_poll_remaining_time (sock->server_poll_timeout),
-                   sig_info);
+    bool proxy_retry = false;
+    do {
+        socket_connect(&sock->sd,
+                       sock->info.lsa->current_remote->ai_addr,
+                       get_server_poll_remaining_time(sock->server_poll_timeout),
+                       sig_info);
 
-    if (sig_info->signal_received)
-      return;
+        if (sig_info->signal_received)
+        {
+            return;
+        }
 
-    if (sock->http_proxy)
-      {
-	proxy_retry = establish_http_proxy_passthru (sock->http_proxy,
-						     sock->sd,
-						     sock->proxy_dest_host,
-						     sock->proxy_dest_port,
-						     sock->server_poll_timeout,
-						     &sock->stream_buf.residual,
-						     &sig_info->signal_received);
-      }
-    else if (sock->socks_proxy)
-      {
-	establish_socks_proxy_passthru (sock->socks_proxy,
-					sock->sd,
-					sock->proxy_dest_host,
-					sock->proxy_dest_port,
-					&sig_info->signal_received);
-      }
-    if (proxy_retry)
-      {
-	openvpn_close_socket (sock->sd);
-	sock->sd = create_socket_tcp (sock->info.lsa->current_remote);
-      }
+        if (sock->http_proxy)
+        {
+            proxy_retry = establish_http_proxy_passthru(sock->http_proxy,
+                                                        sock->sd,
+                                                        sock->proxy_dest_host,
+                                                        sock->proxy_dest_port,
+                                                        sock->server_poll_timeout,
+                                                        &sock->stream_buf.residual,
+                                                        &sig_info->signal_received);
+        }
+        else if (sock->socks_proxy)
+        {
+            establish_socks_proxy_passthru(sock->socks_proxy,
+                                           sock->sd,
+                                           sock->proxy_dest_host,
+                                           sock->proxy_dest_port,
+                                           &sig_info->signal_received);
+        }
+        if (proxy_retry)
+        {
+            openvpn_close_socket(sock->sd);
+            sock->sd = create_socket_tcp(sock->info.lsa->current_remote);
+        }
 
-  } while (proxy_retry);
+    } while (proxy_retry);
 
 }
 
 static void
-phase2_socks_client (struct link_socket *sock, struct signal_info *sig_info)
+phase2_socks_client(struct link_socket *sock, struct signal_info *sig_info)
 {
-    socket_connect (&sock->ctrl_sd,
-		    sock->info.lsa->current_remote->ai_addr,
-		    get_server_poll_remaining_time (sock->server_poll_timeout),
-		    sig_info);
+    socket_connect(&sock->ctrl_sd,
+                   sock->info.lsa->current_remote->ai_addr,
+                   get_server_poll_remaining_time(sock->server_poll_timeout),
+                   sig_info);
 
     if (sig_info->signal_received)
-	return;
+    {
+        return;
+    }
 
-    establish_socks_proxy_udpassoc (sock->socks_proxy,
-				    sock->ctrl_sd,
-				    sock->sd,
-				    &sock->socks_relay.dest,
-				    &sig_info->signal_received);
+    establish_socks_proxy_udpassoc(sock->socks_proxy,
+                                   sock->ctrl_sd,
+                                   sock->sd,
+                                   &sock->socks_relay.dest,
+                                   &sig_info->signal_received);
 
     if (sig_info->signal_received)
-	return;
+    {
+        return;
+    }
 
     sock->remote_host = sock->proxy_dest_host;
     sock->remote_port = sock->proxy_dest_port;
 
     addr_zero_host(&sock->info.lsa->actual.dest);
     if (sock->info.lsa->remote_list)
-      {
-	freeaddrinfo(sock->info.lsa->remote_list);
-	sock->info.lsa->current_remote = NULL;
-	sock->info.lsa->remote_list = NULL;
-      }
+    {
+        freeaddrinfo(sock->info.lsa->remote_list);
+        sock->info.lsa->current_remote = NULL;
+        sock->info.lsa->remote_list = NULL;
+    }
 
-    resolve_remote (sock, 1, NULL, &sig_info->signal_received);
+    resolve_remote(sock, 1, NULL, &sig_info->signal_received);
 }
 
 /* finalize socket initialization */
 void
-link_socket_init_phase2 (struct link_socket *sock,
-			 const struct frame *frame,
-			 struct signal_info *sig_info)
-{
-  const char *remote_dynamic = NULL;
-  int sig_save = 0;
-
-  ASSERT (sock);
-  ASSERT (sig_info);
-
-  if (sig_info->signal_received)
-    {
-      sig_save = sig_info->signal_received;
-      sig_info->signal_received = 0;
-    }
-
-  /* initialize buffers */
-  socket_frame_init (frame, sock);
-
-  /*
-   * Pass a remote name to connect/accept so that
-   * they can test for dynamic IP address changes
-   * and throw a SIGUSR1 if appropriate.
-   */
-  if (sock->resolve_retry_seconds)
-    remote_dynamic = sock->remote_host;
-
-  /* were we started by inetd or xinetd? */
-  if (sock->inetd)
-    {
-      phase2_inetd (sock, frame, remote_dynamic,  &sig_info->signal_received);
-      if (sig_info->signal_received)
-	goto done;
-
-    }
-  else
-    {
-      /* Second chance to resolv/create socket */
-      resolve_remote (sock, 2, &remote_dynamic,  &sig_info->signal_received);
-
-      /* If a valid remote has been found, create the socket with its addrinfo */
-      if (sock->info.lsa->current_remote)
-	  create_socket (sock, sock->info.lsa->current_remote);
-
-      /* If socket has not already been created create it now */
-      if (sock->sd == SOCKET_UNDEFINED)
-	{
-	  /* If we have no --remote and have still not figured out the
-	   * protocol family to use we will use the first of the bind */
-
-	  if (sock->bind_local  && !sock->remote_host && sock->info.lsa->bind_local)
-	    {
-	      /* Warn if this is because neither v4 or v6 was specified
-	       * and we should not connect a remote */
-	      if (sock->info.af == AF_UNSPEC)
-	        {
-		  msg (M_WARN, "Could not determine IPv4/IPv6 protocol. Using %s",
-		     addr_family_name(sock->info.lsa->bind_local->ai_family));
-		  sock->info.af = sock->info.lsa->bind_local->ai_family;
-		}
-
-	      create_socket (sock, sock->info.lsa->bind_local);
-	    }
-	}
-
-      /* Socket still undefined, give a warning and abort connection */
-      if (sock->sd == SOCKET_UNDEFINED)
-	{
-	  msg (M_WARN, "Could not determine IPv4/IPv6 protocol");
-	  sig_info->signal_received = SIGUSR1;
-	  goto done;
-	}
-
-      if (sig_info->signal_received)
-	goto done;
-
-      if (sock->info.proto == PROTO_TCP_SERVER)
-	{
-	  phase2_tcp_server (sock, remote_dynamic,
-			     &sig_info->signal_received);
-	}
-      else if (sock->info.proto == PROTO_TCP_CLIENT)
-	{
-	  phase2_tcp_client (sock, sig_info);
-
-	}
-      else if (sock->info.proto == PROTO_UDP && sock->socks_proxy)
-	{
-	  phase2_socks_client (sock, sig_info);
-	}
+link_socket_init_phase2(struct link_socket *sock,
+                        const struct frame *frame,
+                        struct signal_info *sig_info)
+{
+    const char *remote_dynamic = NULL;
+    int sig_save = 0;
+
+    ASSERT(sock);
+    ASSERT(sig_info);
+
+    if (sig_info->signal_received)
+    {
+        sig_save = sig_info->signal_received;
+        sig_info->signal_received = 0;
+    }
+
+    /* initialize buffers */
+    socket_frame_init(frame, sock);
+
+    /*
+     * Pass a remote name to connect/accept so that
+     * they can test for dynamic IP address changes
+     * and throw a SIGUSR1 if appropriate.
+     */
+    if (sock->resolve_retry_seconds)
+    {
+        remote_dynamic = sock->remote_host;
+    }
+
+    /* were we started by inetd or xinetd? */
+    if (sock->inetd)
+    {
+        phase2_inetd(sock, frame, remote_dynamic,  &sig_info->signal_received);
+        if (sig_info->signal_received)
+        {
+            goto done;
+        }
+
+    }
+    else
+    {
+        /* Second chance to resolv/create socket */
+        resolve_remote(sock, 2, &remote_dynamic,  &sig_info->signal_received);
+
+        /* If a valid remote has been found, create the socket with its addrinfo */
+        if (sock->info.lsa->current_remote)
+        {
+            create_socket(sock, sock->info.lsa->current_remote);
+        }
+
+        /* If socket has not already been created create it now */
+        if (sock->sd == SOCKET_UNDEFINED)
+        {
+            /* If we have no --remote and have still not figured out the
+             * protocol family to use we will use the first of the bind */
+
+            if (sock->bind_local  && !sock->remote_host && sock->info.lsa->bind_local)
+            {
+                /* Warn if this is because neither v4 or v6 was specified
+                 * and we should not connect a remote */
+                if (sock->info.af == AF_UNSPEC)
+                {
+                    msg(M_WARN, "Could not determine IPv4/IPv6 protocol. Using %s",
+                        addr_family_name(sock->info.lsa->bind_local->ai_family));
+                    sock->info.af = sock->info.lsa->bind_local->ai_family;
+                }
+
+                create_socket(sock, sock->info.lsa->bind_local);
+            }
+        }
+
+        /* Socket still undefined, give a warning and abort connection */
+        if (sock->sd == SOCKET_UNDEFINED)
+        {
+            msg(M_WARN, "Could not determine IPv4/IPv6 protocol");
+            sig_info->signal_received = SIGUSR1;
+            goto done;
+        }
+
+        if (sig_info->signal_received)
+        {
+            goto done;
+        }
+
+        if (sock->info.proto == PROTO_TCP_SERVER)
+        {
+            phase2_tcp_server(sock, remote_dynamic,
+                              &sig_info->signal_received);
+        }
+        else if (sock->info.proto == PROTO_TCP_CLIENT)
+        {
+            phase2_tcp_client(sock, sig_info);
+
+        }
+        else if (sock->info.proto == PROTO_UDP && sock->socks_proxy)
+        {
+            phase2_socks_client(sock, sig_info);
+        }
 #ifdef TARGET_ANDROID
-      if (sock->sd != -1)
-	protect_fd_nonlocal (sock->sd, &sock->info.lsa->actual.dest.addr.sa);
+        if (sock->sd != -1)
+        {
+            protect_fd_nonlocal(sock->sd, &sock->info.lsa->actual.dest.addr.sa);
+        }
 #endif
-      if (sig_info->signal_received)
-	goto done;
+        if (sig_info->signal_received)
+        {
+            goto done;
+        }
     }
 
-  phase2_set_socket_flags(sock);
-  linksock_print_addr(sock);
+    phase2_set_socket_flags(sock);
+    linksock_print_addr(sock);
 
- done:
-  if (sig_save)
+done:
+    if (sig_save)
     {
-      if (!sig_info->signal_received)
-	sig_info->signal_received = sig_save;
+        if (!sig_info->signal_received)
+        {
+            sig_info->signal_received = sig_save;
+        }
     }
 }
 
 void
-link_socket_close (struct link_socket *sock)
+link_socket_close(struct link_socket *sock)
 {
-  if (sock)
+    if (sock)
     {
 #ifdef ENABLE_DEBUG
-      const int gremlin = GREMLIN_CONNECTION_FLOOD_LEVEL (sock->gremlin);
+        const int gremlin = GREMLIN_CONNECTION_FLOOD_LEVEL(sock->gremlin);
 #else
-      const int gremlin = 0;
+        const int gremlin = 0;
 #endif
 
-      if (socket_defined (sock->sd))
-	{
+        if (socket_defined(sock->sd))
+        {
 #ifdef _WIN32
-	  close_net_event_win32 (&sock->listen_handle, sock->sd, 0);
+            close_net_event_win32(&sock->listen_handle, sock->sd, 0);
 #endif
-	  if (!gremlin)
-	    {
-	      msg (D_LOW, "TCP/UDP: Closing socket");
-	      if (openvpn_close_socket (sock->sd))
-		msg (M_WARN | M_ERRNO, "TCP/UDP: Close Socket failed");
-	    }
-	  sock->sd = SOCKET_UNDEFINED;
+            if (!gremlin)
+            {
+                msg(D_LOW, "TCP/UDP: Closing socket");
+                if (openvpn_close_socket(sock->sd))
+                {
+                    msg(M_WARN | M_ERRNO, "TCP/UDP: Close Socket failed");
+                }
+            }
+            sock->sd = SOCKET_UNDEFINED;
 #ifdef _WIN32
-	  if (!gremlin)
-	    {
-	      overlapped_io_close (&sock->reads);
-	      overlapped_io_close (&sock->writes);
-	    }
+            if (!gremlin)
+            {
+                overlapped_io_close(&sock->reads);
+                overlapped_io_close(&sock->writes);
+            }
 #endif
-	}
+        }
 
-      if (socket_defined (sock->ctrl_sd))
-	{
-	  if (openvpn_close_socket (sock->ctrl_sd))
-	    msg (M_WARN | M_ERRNO, "TCP/UDP: Close Socket (ctrl_sd) failed");
-	  sock->ctrl_sd = SOCKET_UNDEFINED;
-	}
+        if (socket_defined(sock->ctrl_sd))
+        {
+            if (openvpn_close_socket(sock->ctrl_sd))
+            {
+                msg(M_WARN | M_ERRNO, "TCP/UDP: Close Socket (ctrl_sd) failed");
+            }
+            sock->ctrl_sd = SOCKET_UNDEFINED;
+        }
 
-      stream_buf_close (&sock->stream_buf);
-      free_buf (&sock->stream_buf_data);
-      if (!gremlin)
-	free (sock);
+        stream_buf_close(&sock->stream_buf);
+        free_buf(&sock->stream_buf_data);
+        if (!gremlin)
+        {
+            free(sock);
+        }
     }
 }
 
 /* for stream protocols, allow for packet length prefix */
 void
-socket_adjust_frame_parameters (struct frame *frame, int proto)
+socket_adjust_frame_parameters(struct frame *frame, int proto)
 {
-  if (link_socket_proto_connection_oriented (proto))
-    frame_add_to_extra_frame (frame, sizeof (packet_size_type));
+    if (link_socket_proto_connection_oriented(proto))
+    {
+        frame_add_to_extra_frame(frame, sizeof(packet_size_type));
+    }
 }
 
 void
-setenv_trusted (struct env_set *es, const struct link_socket_info *info)
+setenv_trusted(struct env_set *es, const struct link_socket_info *info)
 {
-  setenv_link_socket_actual (es, "trusted", &info->lsa->actual, SA_IP_PORT);
+    setenv_link_socket_actual(es, "trusted", &info->lsa->actual, SA_IP_PORT);
 }
 
 static void
-ipchange_fmt (const bool include_cmd, struct argv *argv, const struct link_socket_info *info, struct gc_arena *gc)
+ipchange_fmt(const bool include_cmd, struct argv *argv, const struct link_socket_info *info, struct gc_arena *gc)
 {
-  const char *host = print_sockaddr_ex (&info->lsa->actual.dest.addr.sa, " ", PS_SHOW_PORT , gc);
-  if (include_cmd)
+    const char *host = print_sockaddr_ex(&info->lsa->actual.dest.addr.sa, " ", PS_SHOW_PORT, gc);
+    if (include_cmd)
     {
-      argv_parse_cmd (argv, info->ipchange_command);
-      argv_printf_cat (argv, "%s", host);
+        argv_parse_cmd(argv, info->ipchange_command);
+        argv_printf_cat(argv, "%s", host);
+    }
+    else
+    {
+        argv_printf(argv, "%s", host);
     }
-  else
-    argv_printf (argv, "%s", host);
 
 }
 
 void
-link_socket_connection_initiated (const struct buffer *buf,
-				  struct link_socket_info *info,
-				  const struct link_socket_actual *act,
-				  const char *common_name,
-				  struct env_set *es)
+link_socket_connection_initiated(const struct buffer *buf,
+                                 struct link_socket_info *info,
+                                 const struct link_socket_actual *act,
+                                 const char *common_name,
+                                 struct env_set *es)
 {
-  struct gc_arena gc = gc_new ();
-  
-  info->lsa->actual = *act; /* Note: skip this line for --force-dest */
-  setenv_trusted (es, info);
-  info->connection_established = true;
+    struct gc_arena gc = gc_new();
+
+    info->lsa->actual = *act; /* Note: skip this line for --force-dest */
+    setenv_trusted(es, info);
+    info->connection_established = true;
 
-  /* Print connection initiated message, with common name if available */
-  {
-    struct buffer out = alloc_buf_gc (256, &gc);
-    if (common_name)
-      buf_printf (&out, "[%s] ", common_name);
-    buf_printf (&out, "Peer Connection Initiated with %s", print_link_socket_actual (&info->lsa->actual, &gc));
-    msg (M_INFO, "%s", BSTR (&out));
-  }
+    /* Print connection initiated message, with common name if available */
+    {
+        struct buffer out = alloc_buf_gc(256, &gc);
+        if (common_name)
+        {
+            buf_printf(&out, "[%s] ", common_name);
+        }
+        buf_printf(&out, "Peer Connection Initiated with %s", print_link_socket_actual(&info->lsa->actual, &gc));
+        msg(M_INFO, "%s", BSTR(&out));
+    }
 
-  /* set environmental vars */
-  setenv_str (es, "common_name", common_name);
+    /* set environmental vars */
+    setenv_str(es, "common_name", common_name);
 
-  /* Process --ipchange plugin */
-  if (plugin_defined (info->plugins, OPENVPN_PLUGIN_IPCHANGE))
+    /* Process --ipchange plugin */
+    if (plugin_defined(info->plugins, OPENVPN_PLUGIN_IPCHANGE))
     {
-      struct argv argv = argv_new ();
-      ipchange_fmt (false, &argv, info, &gc);
-      if (plugin_call (info->plugins, OPENVPN_PLUGIN_IPCHANGE, &argv, NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS)
-	msg (M_WARN, "WARNING: ipchange plugin call failed");
-      argv_reset (&argv);
+        struct argv argv = argv_new();
+        ipchange_fmt(false, &argv, info, &gc);
+        if (plugin_call(info->plugins, OPENVPN_PLUGIN_IPCHANGE, &argv, NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS)
+        {
+            msg(M_WARN, "WARNING: ipchange plugin call failed");
+        }
+        argv_reset(&argv);
     }
 
-  /* Process --ipchange option */
-  if (info->ipchange_command)
+    /* Process --ipchange option */
+    if (info->ipchange_command)
     {
-      struct argv argv = argv_new ();
-      setenv_str (es, "script_type", "ipchange");
-      ipchange_fmt (true, &argv, info, &gc);
-      openvpn_run_script (&argv, es, 0, "--ipchange");
-      argv_reset (&argv);
+        struct argv argv = argv_new();
+        setenv_str(es, "script_type", "ipchange");
+        ipchange_fmt(true, &argv, info, &gc);
+        openvpn_run_script(&argv, es, 0, "--ipchange");
+        argv_reset(&argv);
     }
 
-  gc_free (&gc);
+    gc_free(&gc);
 }
 
 void
-link_socket_bad_incoming_addr (struct buffer *buf,
-			       const struct link_socket_info *info,
-			       const struct link_socket_actual *from_addr)
-{
-  struct gc_arena gc = gc_new ();
-  struct addrinfo* ai;
-
-  switch(from_addr->dest.addr.sa.sa_family)
-    {
-    case AF_INET:
-    case AF_INET6:
-      msg (D_LINK_ERRORS,
-	   "TCP/UDP: Incoming packet rejected from %s[%d], expected peer address: %s (allow this incoming source address/port by removing --remote or adding --float)",
-	   print_link_socket_actual (from_addr, &gc),
-	   (int)from_addr->dest.addr.sa.sa_family,
-	   print_sockaddr_ex (info->lsa->remote_list->ai_addr,":" ,PS_SHOW_PORT, &gc));
-          /* print additional remote addresses */
-          for(ai=info->lsa->remote_list->ai_next;ai;ai=ai->ai_next) {
-             msg(D_LINK_ERRORS,"or from peer address: %s",
-                 print_sockaddr_ex(ai->ai_addr,":",PS_SHOW_PORT, &gc));
-          }
-      break;
+link_socket_bad_incoming_addr(struct buffer *buf,
+                              const struct link_socket_info *info,
+                              const struct link_socket_actual *from_addr)
+{
+    struct gc_arena gc = gc_new();
+    struct addrinfo *ai;
+
+    switch (from_addr->dest.addr.sa.sa_family)
+    {
+        case AF_INET:
+        case AF_INET6:
+            msg(D_LINK_ERRORS,
+                "TCP/UDP: Incoming packet rejected from %s[%d], expected peer address: %s (allow this incoming source address/port by removing --remote or adding --float)",
+                print_link_socket_actual(from_addr, &gc),
+                (int)from_addr->dest.addr.sa.sa_family,
+                print_sockaddr_ex(info->lsa->remote_list->ai_addr,":",PS_SHOW_PORT, &gc));
+            /* print additional remote addresses */
+            for (ai = info->lsa->remote_list->ai_next; ai; ai = ai->ai_next) {
+                msg(D_LINK_ERRORS,"or from peer address: %s",
+                    print_sockaddr_ex(ai->ai_addr,":",PS_SHOW_PORT, &gc));
+            }
+            break;
     }
-  buf->len = 0;
-  gc_free (&gc);
+    buf->len = 0;
+    gc_free(&gc);
 }
 
 void
-link_socket_bad_outgoing_addr (void)
+link_socket_bad_outgoing_addr(void)
 {
-  dmsg (D_READ_WRITE, "TCP/UDP: No outgoing address to send packet");
+    dmsg(D_READ_WRITE, "TCP/UDP: No outgoing address to send packet");
 }
 
 in_addr_t
-link_socket_current_remote (const struct link_socket_info *info)
+link_socket_current_remote(const struct link_socket_info *info)
 {
-  const struct link_socket_addr *lsa = info->lsa;
+    const struct link_socket_addr *lsa = info->lsa;
 
-/* 
- * This logic supports "redirect-gateway" semantic, which 
+/*
+ * This logic supports "redirect-gateway" semantic, which
  * makes sense only for PF_INET routes over PF_INET endpoints
  *
  * Maybe in the future consider PF_INET6 endpoints also ...
@@ -2129,22 +2395,30 @@ link_socket_current_remote (const struct link_socket_info *info)
  * For --remote entries with multiple addresses this
  * only return the actual endpoint we have sucessfully connected to
  */
-  if (lsa->actual.dest.addr.sa.sa_family != AF_INET)
-    return IPV4_INVALID_ADDR;
-
-  if (link_socket_actual_defined (&lsa->actual))
-    return ntohl (lsa->actual.dest.addr.in4.sin_addr.s_addr);
-  else if (lsa->current_remote)
-    return ntohl (((struct sockaddr_in*)lsa->current_remote->ai_addr)
-                    ->sin_addr.s_addr);
-  else
-    return 0;
+    if (lsa->actual.dest.addr.sa.sa_family != AF_INET)
+    {
+        return IPV4_INVALID_ADDR;
+    }
+
+    if (link_socket_actual_defined(&lsa->actual))
+    {
+        return ntohl(lsa->actual.dest.addr.in4.sin_addr.s_addr);
+    }
+    else if (lsa->current_remote)
+    {
+        return ntohl(((struct sockaddr_in *)lsa->current_remote->ai_addr)
+                     ->sin_addr.s_addr);
+    }
+    else
+    {
+        return 0;
+    }
 }
 
 const struct in6_addr *
-link_socket_current_remote_ipv6 (const struct link_socket_info *info)
+link_socket_current_remote_ipv6(const struct link_socket_info *info)
 {
-  const struct link_socket_addr *lsa = info->lsa;
+    const struct link_socket_addr *lsa = info->lsa;
 
 /* This logic supports "redirect-gateway" semantic,
  * for PF_INET6 routes over PF_INET6 endpoints
@@ -2152,50 +2426,58 @@ link_socket_current_remote_ipv6 (const struct link_socket_info *info)
  * For --remote entries with multiple addresses this
  * only return the actual endpoint we have sucessfully connected to
  */
-  if (lsa->actual.dest.addr.sa.sa_family != AF_INET6)
-    return NULL;
+    if (lsa->actual.dest.addr.sa.sa_family != AF_INET6)
+    {
+        return NULL;
+    }
 
-  if (link_socket_actual_defined (&lsa->actual))
-    return &(lsa->actual.dest.addr.in6.sin6_addr);
-  else if (lsa->current_remote)
-    return &(((struct sockaddr_in6*)lsa->current_remote->ai_addr) ->sin6_addr);
-  else
-    return NULL;
+    if (link_socket_actual_defined(&lsa->actual))
+    {
+        return &(lsa->actual.dest.addr.in6.sin6_addr);
+    }
+    else if (lsa->current_remote)
+    {
+        return &(((struct sockaddr_in6 *)lsa->current_remote->ai_addr)->sin6_addr);
+    }
+    else
+    {
+        return NULL;
+    }
 }
 
 /*
  * Return a status string describing socket state.
  */
 const char *
-socket_stat (const struct link_socket *s, unsigned int rwflags, struct gc_arena *gc)
+socket_stat(const struct link_socket *s, unsigned int rwflags, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (64, gc);
-  if (s)
+    struct buffer out = alloc_buf_gc(64, gc);
+    if (s)
     {
-      if (rwflags & EVENT_READ)
-	{
-	  buf_printf (&out, "S%s",
-		      (s->rwflags_debug & EVENT_READ) ? "R" : "r");
+        if (rwflags & EVENT_READ)
+        {
+            buf_printf(&out, "S%s",
+                       (s->rwflags_debug & EVENT_READ) ? "R" : "r");
 #ifdef _WIN32
-	  buf_printf (&out, "%s",
-		      overlapped_io_state_ascii (&s->reads));
+            buf_printf(&out, "%s",
+                       overlapped_io_state_ascii(&s->reads));
 #endif
-	}
-      if (rwflags & EVENT_WRITE)
-	{
-	  buf_printf (&out, "S%s",
-		      (s->rwflags_debug & EVENT_WRITE) ? "W" : "w");
+        }
+        if (rwflags & EVENT_WRITE)
+        {
+            buf_printf(&out, "S%s",
+                       (s->rwflags_debug & EVENT_WRITE) ? "W" : "w");
 #ifdef _WIN32
-	  buf_printf (&out, "%s",
-		      overlapped_io_state_ascii (&s->writes));
+            buf_printf(&out, "%s",
+                       overlapped_io_state_ascii(&s->writes));
 #endif
-	}
+        }
     }
-  else
+    else
     {
-      buf_printf (&out, "S?");
+        buf_printf(&out, "S?");
     }
-  return BSTR (&out);
+    return BSTR(&out);
 }
 
 /*
@@ -2204,152 +2486,160 @@ socket_stat (const struct link_socket *s, unsigned int rwflags, struct gc_arena
  */
 
 static inline void
-stream_buf_reset (struct stream_buf *sb)
+stream_buf_reset(struct stream_buf *sb)
 {
-  dmsg (D_STREAM_DEBUG, "STREAM: RESET");
-  sb->residual_fully_formed = false;
-  sb->buf = sb->buf_init;
-  buf_reset (&sb->next);
-  sb->len = -1;
+    dmsg(D_STREAM_DEBUG, "STREAM: RESET");
+    sb->residual_fully_formed = false;
+    sb->buf = sb->buf_init;
+    buf_reset(&sb->next);
+    sb->len = -1;
 }
 
 void
-stream_buf_init (struct stream_buf *sb,
-		 struct buffer *buf,
-		 const unsigned int sockflags,
-		 const int proto)
-{
-  sb->buf_init = *buf;
-  sb->maxlen = sb->buf_init.len;
-  sb->buf_init.len = 0;
-  sb->residual = alloc_buf (sb->maxlen);
-  sb->error = false;
+stream_buf_init(struct stream_buf *sb,
+                struct buffer *buf,
+                const unsigned int sockflags,
+                const int proto)
+{
+    sb->buf_init = *buf;
+    sb->maxlen = sb->buf_init.len;
+    sb->buf_init.len = 0;
+    sb->residual = alloc_buf(sb->maxlen);
+    sb->error = false;
 #if PORT_SHARE
-  sb->port_share_state = ((sockflags & SF_PORT_SHARE) && (proto == PROTO_TCP_SERVER))
-    ? PS_ENABLED
-    : PS_DISABLED;
+    sb->port_share_state = ((sockflags & SF_PORT_SHARE) && (proto == PROTO_TCP_SERVER))
+                           ? PS_ENABLED
+                           : PS_DISABLED;
 #endif
-  stream_buf_reset (sb);
+    stream_buf_reset(sb);
 
-  dmsg (D_STREAM_DEBUG, "STREAM: INIT maxlen=%d", sb->maxlen);
+    dmsg(D_STREAM_DEBUG, "STREAM: INIT maxlen=%d", sb->maxlen);
 }
 
 static inline void
-stream_buf_set_next (struct stream_buf *sb)
+stream_buf_set_next(struct stream_buf *sb)
 {
-  /* set up 'next' for next i/o read */
-  sb->next = sb->buf;
-  sb->next.offset = sb->buf.offset + sb->buf.len;
-  sb->next.len = (sb->len >= 0 ? sb->len : sb->maxlen) - sb->buf.len;
-  dmsg (D_STREAM_DEBUG, "STREAM: SET NEXT, buf=[%d,%d] next=[%d,%d] len=%d maxlen=%d",
-       sb->buf.offset, sb->buf.len,
-       sb->next.offset, sb->next.len,
-       sb->len, sb->maxlen);
-  ASSERT (sb->next.len > 0);
-  ASSERT (buf_safe (&sb->buf, sb->next.len));
+    /* set up 'next' for next i/o read */
+    sb->next = sb->buf;
+    sb->next.offset = sb->buf.offset + sb->buf.len;
+    sb->next.len = (sb->len >= 0 ? sb->len : sb->maxlen) - sb->buf.len;
+    dmsg(D_STREAM_DEBUG, "STREAM: SET NEXT, buf=[%d,%d] next=[%d,%d] len=%d maxlen=%d",
+         sb->buf.offset, sb->buf.len,
+         sb->next.offset, sb->next.len,
+         sb->len, sb->maxlen);
+    ASSERT(sb->next.len > 0);
+    ASSERT(buf_safe(&sb->buf, sb->next.len));
 }
 
 static inline void
-stream_buf_get_final (struct stream_buf *sb, struct buffer *buf)
+stream_buf_get_final(struct stream_buf *sb, struct buffer *buf)
 {
-  dmsg (D_STREAM_DEBUG, "STREAM: GET FINAL len=%d",
-       buf_defined (&sb->buf) ? sb->buf.len : -1);
-  ASSERT (buf_defined (&sb->buf));
-  *buf = sb->buf;
+    dmsg(D_STREAM_DEBUG, "STREAM: GET FINAL len=%d",
+         buf_defined(&sb->buf) ? sb->buf.len : -1);
+    ASSERT(buf_defined(&sb->buf));
+    *buf = sb->buf;
 }
 
 static inline void
-stream_buf_get_next (struct stream_buf *sb, struct buffer *buf)
+stream_buf_get_next(struct stream_buf *sb, struct buffer *buf)
 {
-  dmsg (D_STREAM_DEBUG, "STREAM: GET NEXT len=%d",
-       buf_defined (&sb->next) ? sb->next.len : -1);
-  ASSERT (buf_defined (&sb->next));
-  *buf = sb->next;
+    dmsg(D_STREAM_DEBUG, "STREAM: GET NEXT len=%d",
+         buf_defined(&sb->next) ? sb->next.len : -1);
+    ASSERT(buf_defined(&sb->next));
+    *buf = sb->next;
 }
 
 bool
-stream_buf_read_setup_dowork (struct link_socket* sock)
+stream_buf_read_setup_dowork(struct link_socket *sock)
 {
-  if (sock->stream_buf.residual.len && !sock->stream_buf.residual_fully_formed)
+    if (sock->stream_buf.residual.len && !sock->stream_buf.residual_fully_formed)
     {
-      ASSERT (buf_copy (&sock->stream_buf.buf, &sock->stream_buf.residual));
-      ASSERT (buf_init (&sock->stream_buf.residual, 0));
-      sock->stream_buf.residual_fully_formed = stream_buf_added (&sock->stream_buf, 0);
-      dmsg (D_STREAM_DEBUG, "STREAM: RESIDUAL FULLY FORMED [%s], len=%d",
-	   sock->stream_buf.residual_fully_formed ? "YES" : "NO",
-	   sock->stream_buf.residual.len);
+        ASSERT(buf_copy(&sock->stream_buf.buf, &sock->stream_buf.residual));
+        ASSERT(buf_init(&sock->stream_buf.residual, 0));
+        sock->stream_buf.residual_fully_formed = stream_buf_added(&sock->stream_buf, 0);
+        dmsg(D_STREAM_DEBUG, "STREAM: RESIDUAL FULLY FORMED [%s], len=%d",
+             sock->stream_buf.residual_fully_formed ? "YES" : "NO",
+             sock->stream_buf.residual.len);
     }
 
-  if (!sock->stream_buf.residual_fully_formed)
-    stream_buf_set_next (&sock->stream_buf);
-  return !sock->stream_buf.residual_fully_formed;
+    if (!sock->stream_buf.residual_fully_formed)
+    {
+        stream_buf_set_next(&sock->stream_buf);
+    }
+    return !sock->stream_buf.residual_fully_formed;
 }
 
 bool
-stream_buf_added (struct stream_buf *sb,
-		  int length_added)
+stream_buf_added(struct stream_buf *sb,
+                 int length_added)
 {
-  dmsg (D_STREAM_DEBUG, "STREAM: ADD length_added=%d", length_added);
-  if (length_added > 0)
-    sb->buf.len += length_added;
+    dmsg(D_STREAM_DEBUG, "STREAM: ADD length_added=%d", length_added);
+    if (length_added > 0)
+    {
+        sb->buf.len += length_added;
+    }
 
-  /* if length unknown, see if we can get the length prefix from
-     the head of the buffer */
-  if (sb->len < 0 && sb->buf.len >= (int) sizeof (packet_size_type))
+    /* if length unknown, see if we can get the length prefix from
+     * the head of the buffer */
+    if (sb->len < 0 && sb->buf.len >= (int) sizeof(packet_size_type))
     {
-      packet_size_type net_size;
+        packet_size_type net_size;
 
 #if PORT_SHARE
-      if (sb->port_share_state == PS_ENABLED)
-	{
-	  if (!is_openvpn_protocol (&sb->buf))
-	    {
-	      msg (D_STREAM_ERRORS, "Non-OpenVPN client protocol detected");
-	      sb->port_share_state = PS_FOREIGN;
-	      sb->error = true;
-	      return false;
-	    }
-	  else
-	    sb->port_share_state = PS_DISABLED;
-	}
+        if (sb->port_share_state == PS_ENABLED)
+        {
+            if (!is_openvpn_protocol(&sb->buf))
+            {
+                msg(D_STREAM_ERRORS, "Non-OpenVPN client protocol detected");
+                sb->port_share_state = PS_FOREIGN;
+                sb->error = true;
+                return false;
+            }
+            else
+            {
+                sb->port_share_state = PS_DISABLED;
+            }
+        }
 #endif
 
-      ASSERT (buf_read (&sb->buf, &net_size, sizeof (net_size)));
-      sb->len = ntohps (net_size);
+        ASSERT(buf_read(&sb->buf, &net_size, sizeof(net_size)));
+        sb->len = ntohps(net_size);
 
-      if (sb->len < 1 || sb->len > sb->maxlen)
-	{
-	  msg (M_WARN, "WARNING: Bad encapsulated packet length from peer (%d), which must be > 0 and <= %d -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]", sb->len, sb->maxlen);
-	  stream_buf_reset (sb);
-	  sb->error = true;
-	  return false;
-	}
+        if (sb->len < 1 || sb->len > sb->maxlen)
+        {
+            msg(M_WARN, "WARNING: Bad encapsulated packet length from peer (%d), which must be > 0 and <= %d -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]", sb->len, sb->maxlen);
+            stream_buf_reset(sb);
+            sb->error = true;
+            return false;
+        }
     }
 
-  /* is our incoming packet fully read? */
-  if (sb->len > 0 && sb->buf.len >= sb->len)
+    /* is our incoming packet fully read? */
+    if (sb->len > 0 && sb->buf.len >= sb->len)
     {
-      /* save any residual data that's part of the next packet */
-      ASSERT (buf_init (&sb->residual, 0));
-      if (sb->buf.len > sb->len)
-	  ASSERT (buf_copy_excess (&sb->residual, &sb->buf, sb->len));
-      dmsg (D_STREAM_DEBUG, "STREAM: ADD returned TRUE, buf_len=%d, residual_len=%d",
-	   BLEN (&sb->buf),
-	   BLEN (&sb->residual));
-      return true;
+        /* save any residual data that's part of the next packet */
+        ASSERT(buf_init(&sb->residual, 0));
+        if (sb->buf.len > sb->len)
+        {
+            ASSERT(buf_copy_excess(&sb->residual, &sb->buf, sb->len));
+        }
+        dmsg(D_STREAM_DEBUG, "STREAM: ADD returned TRUE, buf_len=%d, residual_len=%d",
+             BLEN(&sb->buf),
+             BLEN(&sb->residual));
+        return true;
     }
-  else
+    else
     {
-      dmsg (D_STREAM_DEBUG, "STREAM: ADD returned FALSE (have=%d need=%d)", sb->buf.len, sb->len);
-      stream_buf_set_next (sb);
-      return false;
+        dmsg(D_STREAM_DEBUG, "STREAM: ADD returned FALSE (have=%d need=%d)", sb->buf.len, sb->len);
+        stream_buf_set_next(sb);
+        return false;
     }
 }
 
 void
-stream_buf_close (struct stream_buf* sb)
+stream_buf_close(struct stream_buf *sb)
 {
-  free_buf (&sb->residual);
+    free_buf(&sb->residual);
 }
 
 /*
@@ -2358,14 +2648,16 @@ stream_buf_close (struct stream_buf* sb)
  * TCP socket, for use in server mode.
  */
 event_t
-socket_listen_event_handle (struct link_socket *s)
+socket_listen_event_handle(struct link_socket *s)
 {
 #ifdef _WIN32
-  if (!defined_net_event_win32 (&s->listen_handle))
-    init_net_event_win32 (&s->listen_handle, FD_ACCEPT, s->sd, 0);
-  return &s->listen_handle;
-#else
-  return s->sd;
+    if (!defined_net_event_win32(&s->listen_handle))
+    {
+        init_net_event_win32(&s->listen_handle, FD_ACCEPT, s->sd, 0);
+    }
+    return &s->listen_handle;
+#else  /* ifdef _WIN32 */
+    return s->sd;
 #endif
 }
 
@@ -2374,72 +2666,90 @@ socket_listen_event_handle (struct link_socket *s)
  */
 
 const char *
-print_sockaddr_ex (const struct sockaddr *sa,
-				   const char* separator,
-				   const unsigned int flags,
-				   struct gc_arena *gc)
-{
-  struct buffer out = alloc_buf_gc (128, gc);
-  bool addr_is_defined = false;
-  char hostaddr[NI_MAXHOST] = "";
-  char servname[NI_MAXSERV] = "";
-  int status;
+print_sockaddr_ex(const struct sockaddr *sa,
+                  const char *separator,
+                  const unsigned int flags,
+                  struct gc_arena *gc)
+{
+    struct buffer out = alloc_buf_gc(128, gc);
+    bool addr_is_defined = false;
+    char hostaddr[NI_MAXHOST] = "";
+    char servname[NI_MAXSERV] = "";
+    int status;
+
+    socklen_t salen = 0;
+    switch (sa->sa_family)
+    {
+        case AF_INET:
+            if (!(flags & PS_DONT_SHOW_FAMILY))
+            {
+                buf_puts(&out, "[AF_INET]");
+            }
+            salen = sizeof(struct sockaddr_in);
+            addr_is_defined = ((struct sockaddr_in *) sa)->sin_addr.s_addr != 0;
+            break;
 
-  socklen_t salen = 0;
-  switch(sa->sa_family)
-    {
-    case AF_INET:
-      if (!(flags & PS_DONT_SHOW_FAMILY))
-        buf_puts (&out, "[AF_INET]");
-      salen = sizeof (struct sockaddr_in);
-      addr_is_defined = ((struct sockaddr_in*) sa)->sin_addr.s_addr != 0;
-      break;
-    case AF_INET6:
-      if (!(flags & PS_DONT_SHOW_FAMILY))
-        buf_puts (&out, "[AF_INET6]");
-      salen = sizeof (struct sockaddr_in6);
-      addr_is_defined = !IN6_IS_ADDR_UNSPECIFIED(&((struct sockaddr_in6*) sa)->sin6_addr);
-      break;
-    case AF_UNSPEC:
-      if (!(flags & PS_DONT_SHOW_FAMILY))
-        return "[AF_UNSPEC]";
-      else
-        return "";
-    default:
-      ASSERT(0);
+        case AF_INET6:
+            if (!(flags & PS_DONT_SHOW_FAMILY))
+            {
+                buf_puts(&out, "[AF_INET6]");
+            }
+            salen = sizeof(struct sockaddr_in6);
+            addr_is_defined = !IN6_IS_ADDR_UNSPECIFIED(&((struct sockaddr_in6 *) sa)->sin6_addr);
+            break;
+
+        case AF_UNSPEC:
+            if (!(flags & PS_DONT_SHOW_FAMILY))
+            {
+                return "[AF_UNSPEC]";
+            }
+            else
+            {
+                return "";
+            }
+
+        default:
+            ASSERT(0);
     }
 
-  status = getnameinfo(sa, salen, hostaddr, sizeof (hostaddr),
-              servname, sizeof(servname), NI_NUMERICHOST | NI_NUMERICSERV);
+    status = getnameinfo(sa, salen, hostaddr, sizeof(hostaddr),
+                         servname, sizeof(servname), NI_NUMERICHOST | NI_NUMERICSERV);
 
-  if(status!=0) {
-      buf_printf(&out,"[nameinfo() err: %s]",gai_strerror(status));
-      return BSTR(&out);
-  }
+    if (status!=0)
+    {
+        buf_printf(&out,"[nameinfo() err: %s]",gai_strerror(status));
+        return BSTR(&out);
+    }
 
-  if (!(flags & PS_DONT_SHOW_ADDR))
+    if (!(flags & PS_DONT_SHOW_ADDR))
     {
-      if (addr_is_defined)
-        buf_puts (&out, hostaddr);
-      else
-        buf_puts (&out, "[undef]");
+        if (addr_is_defined)
+        {
+            buf_puts(&out, hostaddr);
+        }
+        else
+        {
+            buf_puts(&out, "[undef]");
+        }
     }
 
-  if ((flags & PS_SHOW_PORT) || (flags & PS_SHOW_PORT_IF_DEFINED))
+    if ((flags & PS_SHOW_PORT) || (flags & PS_SHOW_PORT_IF_DEFINED))
     {
-      if (separator)
-        buf_puts (&out, separator);
+        if (separator)
+        {
+            buf_puts(&out, separator);
+        }
 
-      buf_puts (&out, servname);
+        buf_puts(&out, servname);
     }
 
-  return BSTR (&out);
+    return BSTR(&out);
 }
 
 const char *
-print_link_socket_actual (const struct link_socket_actual *act, struct gc_arena *gc)
+print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
 {
-  return print_link_socket_actual_ex (act, ":", PS_SHOW_PORT|PS_SHOW_PKTINFO, gc);
+    return print_link_socket_actual_ex(act, ":", PS_SHOW_PORT|PS_SHOW_PKTINFO, gc);
 }
 
 #ifndef IF_NAMESIZE
@@ -2447,62 +2757,69 @@ print_link_socket_actual (const struct link_socket_actual *act, struct gc_arena
 #endif
 
 const char *
-print_link_socket_actual_ex (const struct link_socket_actual *act,
-			     const char *separator,
-			     const unsigned int flags,
-			     struct gc_arena *gc)
+print_link_socket_actual_ex(const struct link_socket_actual *act,
+                            const char *separator,
+                            const unsigned int flags,
+                            struct gc_arena *gc)
 {
-  if (act)
+    if (act)
     {
-      char ifname[IF_NAMESIZE] = "[undef]";
-      struct buffer out = alloc_buf_gc (128, gc);
-      buf_printf (&out, "%s", print_sockaddr_ex (&act->dest.addr.sa, separator, flags, gc));
+        char ifname[IF_NAMESIZE] = "[undef]";
+        struct buffer out = alloc_buf_gc(128, gc);
+        buf_printf(&out, "%s", print_sockaddr_ex(&act->dest.addr.sa, separator, flags, gc));
 #if ENABLE_IP_PKTINFO
-      if ((flags & PS_SHOW_PKTINFO) && addr_defined_ipi(act))
-	{
-	  switch(act->dest.addr.sa.sa_family)
-	    {
-	    case AF_INET:
-		{
-		  struct openvpn_sockaddr sa;
-		  CLEAR (sa);
-		  sa.addr.in4.sin_family = AF_INET;
+        if ((flags & PS_SHOW_PKTINFO) && addr_defined_ipi(act))
+        {
+            switch (act->dest.addr.sa.sa_family)
+            {
+                case AF_INET:
+                {
+                    struct openvpn_sockaddr sa;
+                    CLEAR(sa);
+                    sa.addr.in4.sin_family = AF_INET;
 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
-		  sa.addr.in4.sin_addr = act->pi.in4.ipi_spec_dst;
-		  if_indextoname(act->pi.in4.ipi_ifindex, ifname);
+                    sa.addr.in4.sin_addr = act->pi.in4.ipi_spec_dst;
+                    if_indextoname(act->pi.in4.ipi_ifindex, ifname);
 #elif defined(IP_RECVDSTADDR)
-		  sa.addr.in4.sin_addr = act->pi.in4;
-		  ifname[0]=0;
-#else
+                    sa.addr.in4.sin_addr = act->pi.in4;
+                    ifname[0] = 0;
+#else  /* if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST) */
 #error ENABLE_IP_PKTINFO is set without IP_PKTINFO xor IP_RECVDSTADDR (fix syshead.h)
 #endif
-		  buf_printf (&out, " (via %s%%%s)",
-			      print_sockaddr_ex (&sa.addr.sa, separator, 0, gc),
-			      ifname);
-		}
-	      break;
-	    case AF_INET6:
-		{
-		  struct sockaddr_in6 sin6;
-		  char buf[INET6_ADDRSTRLEN] = "[undef]";
-		  CLEAR(sin6);
-		  sin6.sin6_family = AF_INET6;
-		  sin6.sin6_addr = act->pi.in6.ipi6_addr;
-		  if_indextoname(act->pi.in6.ipi6_ifindex, ifname);
-		  if (getnameinfo((struct sockaddr *)&sin6, sizeof (struct sockaddr_in6),
-				  buf, sizeof (buf), NULL, 0, NI_NUMERICHOST) == 0)
-		    buf_printf (&out, " (via %s%%%s)", buf, ifname);
-		  else
-		    buf_printf (&out, " (via [getnameinfo() err]%%%s)", ifname);
-		}
-	      break;
-	    }
-	}
-#endif
-      return BSTR (&out);
+                    buf_printf(&out, " (via %s%%%s)",
+                               print_sockaddr_ex(&sa.addr.sa, separator, 0, gc),
+                               ifname);
+                }
+                break;
+
+                case AF_INET6:
+                {
+                    struct sockaddr_in6 sin6;
+                    char buf[INET6_ADDRSTRLEN] = "[undef]";
+                    CLEAR(sin6);
+                    sin6.sin6_family = AF_INET6;
+                    sin6.sin6_addr = act->pi.in6.ipi6_addr;
+                    if_indextoname(act->pi.in6.ipi6_ifindex, ifname);
+                    if (getnameinfo((struct sockaddr *)&sin6, sizeof(struct sockaddr_in6),
+                                    buf, sizeof(buf), NULL, 0, NI_NUMERICHOST) == 0)
+                    {
+                        buf_printf(&out, " (via %s%%%s)", buf, ifname);
+                    }
+                    else
+                    {
+                        buf_printf(&out, " (via [getnameinfo() err]%%%s)", ifname);
+                    }
+                }
+                break;
+            }
+        }
+#endif /* if ENABLE_IP_PKTINFO */
+        return BSTR(&out);
+    }
+    else
+    {
+        return "[NULL]";
     }
-  else
-    return "[NULL]";
 }
 
 /*
@@ -2510,19 +2827,19 @@ print_link_socket_actual_ex (const struct link_socket_actual *act,
  * to an ascii dotted quad.
  */
 const char *
-print_in_addr_t (in_addr_t addr, unsigned int flags, struct gc_arena *gc)
+print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
 {
-  struct in_addr ia;
-  struct buffer out = alloc_buf_gc (64, gc);
+    struct in_addr ia;
+    struct buffer out = alloc_buf_gc(64, gc);
 
-  if (addr || !(flags & IA_EMPTY_IF_UNDEF))
+    if (addr || !(flags & IA_EMPTY_IF_UNDEF))
     {
-      CLEAR (ia);
-      ia.s_addr = (flags & IA_NET_ORDER) ? addr : htonl (addr);
+        CLEAR(ia);
+        ia.s_addr = (flags & IA_NET_ORDER) ? addr : htonl(addr);
 
-      buf_printf (&out, "%s", inet_ntoa (ia));
+        buf_printf(&out, "%s", inet_ntoa(ia));
     }
-  return BSTR (&out);
+    return BSTR(&out);
 }
 
 /*
@@ -2530,133 +2847,139 @@ print_in_addr_t (in_addr_t addr, unsigned int flags, struct gc_arena *gc)
  * to an ascii representation of an IPv6 address
  */
 const char *
-print_in6_addr (struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
+print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (64, gc);
-  char tmp_out_buf[64];		/* inet_ntop wants pointer to buffer */
+    struct buffer out = alloc_buf_gc(64, gc);
+    char tmp_out_buf[64];       /* inet_ntop wants pointer to buffer */
 
-  if ( memcmp(&a6, &in6addr_any, sizeof(a6)) != 0 || 
-       !(flags & IA_EMPTY_IF_UNDEF))
+    if (memcmp(&a6, &in6addr_any, sizeof(a6)) != 0
+        || !(flags & IA_EMPTY_IF_UNDEF))
     {
-      inet_ntop (AF_INET6, &a6, tmp_out_buf, sizeof(tmp_out_buf)-1);
-      buf_printf (&out, "%s", tmp_out_buf );
+        inet_ntop(AF_INET6, &a6, tmp_out_buf, sizeof(tmp_out_buf)-1);
+        buf_printf(&out, "%s", tmp_out_buf );
     }
-  return BSTR (&out);
+    return BSTR(&out);
 }
 
 #ifndef UINT8_MAX
-# define UINT8_MAX 0xff
+#define UINT8_MAX 0xff
 #endif
 
 /* add some offset to an ipv6 address
  * (add in steps of 8 bits, taking overflow into next round)
  */
-struct in6_addr add_in6_addr( struct in6_addr base, uint32_t add )
+struct in6_addr
+add_in6_addr( struct in6_addr base, uint32_t add )
 {
     int i;
 
-    for( i=15; i>=0 && add > 0 ; i-- )
+    for (i = 15; i>=0 && add > 0; i--)
     {
-	register int carry;
-	register uint32_t h;
+        register int carry;
+        register uint32_t h;
 
-	h = (unsigned char) base.s6_addr[i];
-	base.s6_addr[i] = (h+add) & UINT8_MAX;
+        h = (unsigned char) base.s6_addr[i];
+        base.s6_addr[i] = (h+add) & UINT8_MAX;
 
-	/* using explicit carry for the 8-bit additions will catch
+        /* using explicit carry for the 8-bit additions will catch
          * 8-bit and(!) 32-bit overruns nicely
          */
-	carry = ((h & 0xff)  + (add & 0xff)) >> 8;
-	add = (add>>8) + carry;
+        carry = ((h & 0xff)  + (add & 0xff)) >> 8;
+        add = (add>>8) + carry;
     }
     return base;
 }
 
 /* set environmental variables for ip/port in *addr */
 void
-setenv_sockaddr (struct env_set *es, const char *name_prefix, const struct openvpn_sockaddr *addr, const unsigned int flags)
-{
-  char name_buf[256];
-
-  char buf[128];
-  switch(addr->addr.sa.sa_family)
-    {
-    case AF_INET:
-      if (flags & SA_IP_PORT)
-	openvpn_snprintf (name_buf, sizeof (name_buf), "%s_ip", name_prefix);
-      else
-	openvpn_snprintf (name_buf, sizeof (name_buf), "%s", name_prefix);
-
-      setenv_str (es, name_buf, inet_ntoa (addr->addr.in4.sin_addr));
-
-      if ((flags & SA_IP_PORT) && addr->addr.in4.sin_port)
-	{
-	  openvpn_snprintf (name_buf, sizeof (name_buf), "%s_port", name_prefix);
-	  setenv_int (es, name_buf, ntohs (addr->addr.in4.sin_port));
-	}
-      break;
-    case AF_INET6:
-      if ( IN6_IS_ADDR_V4MAPPED( &addr->addr.in6.sin6_addr ))
-	{
-	  struct in_addr ia;
-	  memcpy (&ia.s_addr, &addr->addr.in6.sin6_addr.s6_addr[12],
-	      sizeof (ia.s_addr));
-	  openvpn_snprintf (name_buf, sizeof (name_buf), "%s_ip", name_prefix);
-	  openvpn_snprintf (buf, sizeof(buf), "%s", inet_ntoa(ia) );
-	}
-      else
-        {
-	  openvpn_snprintf (name_buf, sizeof (name_buf), "%s_ip6", name_prefix);
-	  getnameinfo(&addr->addr.sa, sizeof (struct sockaddr_in6),
-		      buf, sizeof(buf), NULL, 0, NI_NUMERICHOST);
-	}
-      setenv_str (es, name_buf, buf);
-
-      if ((flags & SA_IP_PORT) && addr->addr.in6.sin6_port)
-	{
-	  openvpn_snprintf (name_buf, sizeof (name_buf), "%s_port", name_prefix);
-	  setenv_int (es, name_buf, ntohs (addr->addr.in6.sin6_port));
-	}
-      break;
+setenv_sockaddr(struct env_set *es, const char *name_prefix, const struct openvpn_sockaddr *addr, const unsigned int flags)
+{
+    char name_buf[256];
+
+    char buf[128];
+    switch (addr->addr.sa.sa_family)
+    {
+        case AF_INET:
+            if (flags & SA_IP_PORT)
+            {
+                openvpn_snprintf(name_buf, sizeof(name_buf), "%s_ip", name_prefix);
+            }
+            else
+            {
+                openvpn_snprintf(name_buf, sizeof(name_buf), "%s", name_prefix);
+            }
+
+            setenv_str(es, name_buf, inet_ntoa(addr->addr.in4.sin_addr));
+
+            if ((flags & SA_IP_PORT) && addr->addr.in4.sin_port)
+            {
+                openvpn_snprintf(name_buf, sizeof(name_buf), "%s_port", name_prefix);
+                setenv_int(es, name_buf, ntohs(addr->addr.in4.sin_port));
+            }
+            break;
+
+        case AF_INET6:
+            if (IN6_IS_ADDR_V4MAPPED( &addr->addr.in6.sin6_addr ))
+            {
+                struct in_addr ia;
+                memcpy(&ia.s_addr, &addr->addr.in6.sin6_addr.s6_addr[12],
+                       sizeof(ia.s_addr));
+                openvpn_snprintf(name_buf, sizeof(name_buf), "%s_ip", name_prefix);
+                openvpn_snprintf(buf, sizeof(buf), "%s", inet_ntoa(ia) );
+            }
+            else
+            {
+                openvpn_snprintf(name_buf, sizeof(name_buf), "%s_ip6", name_prefix);
+                getnameinfo(&addr->addr.sa, sizeof(struct sockaddr_in6),
+                            buf, sizeof(buf), NULL, 0, NI_NUMERICHOST);
+            }
+            setenv_str(es, name_buf, buf);
+
+            if ((flags & SA_IP_PORT) && addr->addr.in6.sin6_port)
+            {
+                openvpn_snprintf(name_buf, sizeof(name_buf), "%s_port", name_prefix);
+                setenv_int(es, name_buf, ntohs(addr->addr.in6.sin6_port));
+            }
+            break;
     }
 }
 
 void
-setenv_in_addr_t (struct env_set *es, const char *name_prefix, in_addr_t addr, const unsigned int flags)
+setenv_in_addr_t(struct env_set *es, const char *name_prefix, in_addr_t addr, const unsigned int flags)
 {
-  if (addr || !(flags & SA_SET_IF_NONZERO))
+    if (addr || !(flags & SA_SET_IF_NONZERO))
     {
-      struct openvpn_sockaddr si;
-      CLEAR (si);
-      si.addr.in4.sin_family = AF_INET;
-      si.addr.in4.sin_addr.s_addr = htonl (addr);
-      setenv_sockaddr (es, name_prefix, &si, flags);
+        struct openvpn_sockaddr si;
+        CLEAR(si);
+        si.addr.in4.sin_family = AF_INET;
+        si.addr.in4.sin_addr.s_addr = htonl(addr);
+        setenv_sockaddr(es, name_prefix, &si, flags);
     }
 }
 
 void
-setenv_in6_addr (struct env_set *es,
-                 const char *name_prefix,
-                 const struct in6_addr *addr,
-                 const unsigned int flags)
+setenv_in6_addr(struct env_set *es,
+                const char *name_prefix,
+                const struct in6_addr *addr,
+                const unsigned int flags)
 {
-  if (!IN6_IS_ADDR_UNSPECIFIED (addr) || !(flags & SA_SET_IF_NONZERO))
+    if (!IN6_IS_ADDR_UNSPECIFIED(addr) || !(flags & SA_SET_IF_NONZERO))
     {
-      struct openvpn_sockaddr si;
-      CLEAR (si);
-      si.addr.in6.sin6_family = AF_INET6;
-      si.addr.in6.sin6_addr = *addr;
-      setenv_sockaddr (es, name_prefix, &si, flags);
+        struct openvpn_sockaddr si;
+        CLEAR(si);
+        si.addr.in6.sin6_family = AF_INET6;
+        si.addr.in6.sin6_addr = *addr;
+        setenv_sockaddr(es, name_prefix, &si, flags);
     }
 }
 
 void
-setenv_link_socket_actual (struct env_set *es,
-			   const char *name_prefix,
-			   const struct link_socket_actual *act,
-			   const unsigned int flags)
+setenv_link_socket_actual(struct env_set *es,
+                          const char *name_prefix,
+                          const struct link_socket_actual *act,
+                          const unsigned int flags)
 {
-  setenv_sockaddr (es, name_prefix, &act->dest, flags);
+    setenv_sockaddr(es, name_prefix, &act->dest, flags);
 }
 
 /*
@@ -2664,37 +2987,39 @@ setenv_link_socket_actual (struct env_set *es,
  */
 
 struct proto_names {
-  const char *short_form;
-  const char *display_form;
-  sa_family_t proto_af;
-  int proto;
+    const char *short_form;
+    const char *display_form;
+    sa_family_t proto_af;
+    int proto;
 };
 
 /* Indexed by PROTO_x */
 static const struct proto_names proto_names[] = {
-  {"proto-uninitialized",        "proto-NONE", AF_UNSPEC, PROTO_NONE},
-  /* try IPv4 and IPv6 (client), bind dual-stack (server) */
-  {"udp",        "UDP", AF_UNSPEC, PROTO_UDP},
-  {"tcp-server", "TCP_SERVER", AF_UNSPEC, PROTO_TCP_SERVER},
-  {"tcp-client", "TCP_CLIENT", AF_UNSPEC, PROTO_TCP_CLIENT},
-  {"tcp",        "TCP", AF_UNSPEC, PROTO_TCP},
-  /* force IPv4 */
-  {"udp4",       "UDPv4", AF_INET, PROTO_UDP},
-  {"tcp4-server","TCPv4_SERVER", AF_INET, PROTO_TCP_SERVER},
-  {"tcp4-client","TCPv4_CLIENT", AF_INET, PROTO_TCP_CLIENT},
-  {"tcp4",       "TCPv4", AF_INET, PROTO_TCP},
-  /* force IPv6 */
-  {"udp6"       ,"UDPv6", AF_INET6, PROTO_UDP},
-  {"tcp6-server","TCPv6_SERVER", AF_INET6, PROTO_TCP_SERVER},
-  {"tcp6-client","TCPv6_CLIENT", AF_INET6, PROTO_TCP_CLIENT},
-  {"tcp6"       ,"TCPv6", AF_INET6, PROTO_TCP},
+    {"proto-uninitialized",        "proto-NONE", AF_UNSPEC, PROTO_NONE},
+    /* try IPv4 and IPv6 (client), bind dual-stack (server) */
+    {"udp",        "UDP", AF_UNSPEC, PROTO_UDP},
+    {"tcp-server", "TCP_SERVER", AF_UNSPEC, PROTO_TCP_SERVER},
+    {"tcp-client", "TCP_CLIENT", AF_UNSPEC, PROTO_TCP_CLIENT},
+    {"tcp",        "TCP", AF_UNSPEC, PROTO_TCP},
+    /* force IPv4 */
+    {"udp4",       "UDPv4", AF_INET, PROTO_UDP},
+    {"tcp4-server","TCPv4_SERVER", AF_INET, PROTO_TCP_SERVER},
+    {"tcp4-client","TCPv4_CLIENT", AF_INET, PROTO_TCP_CLIENT},
+    {"tcp4",       "TCPv4", AF_INET, PROTO_TCP},
+    /* force IPv6 */
+    {"udp6","UDPv6", AF_INET6, PROTO_UDP},
+    {"tcp6-server","TCPv6_SERVER", AF_INET6, PROTO_TCP_SERVER},
+    {"tcp6-client","TCPv6_CLIENT", AF_INET6, PROTO_TCP_CLIENT},
+    {"tcp6","TCPv6", AF_INET6, PROTO_TCP},
 };
 
 bool
 proto_is_net(int proto)
 {
-  if (proto < 0 || proto >= PROTO_N)
-    ASSERT(0);
+    if (proto < 0 || proto >= PROTO_N)
+    {
+        ASSERT(0);
+    }
     return proto != PROTO_NONE;
 }
 bool
@@ -2706,81 +3031,96 @@ proto_is_dgram(int proto)
 bool
 proto_is_udp(int proto)
 {
-  if (proto < 0 || proto >= PROTO_N)
-    ASSERT(0);
-  return proto == PROTO_UDP;
+    if (proto < 0 || proto >= PROTO_N)
+    {
+        ASSERT(0);
+    }
+    return proto == PROTO_UDP;
 }
 
 bool
 proto_is_tcp(int proto)
 {
-  if (proto < 0 || proto >= PROTO_N)
-    ASSERT(0);
-  return proto == PROTO_TCP_CLIENT || proto == PROTO_TCP_SERVER;
+    if (proto < 0 || proto >= PROTO_N)
+    {
+        ASSERT(0);
+    }
+    return proto == PROTO_TCP_CLIENT || proto == PROTO_TCP_SERVER;
 }
 
 int
-ascii2proto (const char* proto_name)
+ascii2proto(const char *proto_name)
 {
-  int i;
-  for (i = 0; i < SIZE (proto_names); ++i)
-    if (!strcmp (proto_name, proto_names[i].short_form))
-      return proto_names[i].proto;
-  return -1;
+    int i;
+    for (i = 0; i < SIZE(proto_names); ++i)
+        if (!strcmp(proto_name, proto_names[i].short_form))
+        {
+            return proto_names[i].proto;
+        }
+    return -1;
 }
 
 sa_family_t
-ascii2af (const char* proto_name)
+ascii2af(const char *proto_name)
 {
     int i;
-    for (i = 0; i < SIZE (proto_names); ++i)
-        if (!strcmp (proto_name, proto_names[i].short_form))
+    for (i = 0; i < SIZE(proto_names); ++i)
+        if (!strcmp(proto_name, proto_names[i].short_form))
+        {
             return proto_names[i].proto_af;
+        }
     return 0;
 }
 
 const char *
-proto2ascii (int proto, sa_family_t af, bool display_form)
+proto2ascii(int proto, sa_family_t af, bool display_form)
 {
-  unsigned int i;
-  for (i = 0; i < SIZE (proto_names); ++i)
+    unsigned int i;
+    for (i = 0; i < SIZE(proto_names); ++i)
     {
-      if(proto_names[i].proto_af == af && proto_names[i].proto == proto)
+        if (proto_names[i].proto_af == af && proto_names[i].proto == proto)
         {
-          if(display_form)
-              return proto_names[i].display_form;
-          else
-              return proto_names[i].short_form;
+            if (display_form)
+            {
+                return proto_names[i].display_form;
+            }
+            else
+            {
+                return proto_names[i].short_form;
+            }
         }
     }
 
-  return "[unknown protocol]";
+    return "[unknown protocol]";
 }
 
 const char *
-proto2ascii_all (struct gc_arena *gc)
+proto2ascii_all(struct gc_arena *gc)
 {
-  struct buffer out = alloc_buf_gc (256, gc);
-  int i;
+    struct buffer out = alloc_buf_gc(256, gc);
+    int i;
 
-  for (i = 0; i < SIZE (proto_names); ++i)
+    for (i = 0; i < SIZE(proto_names); ++i)
     {
-      if (i)
-	buf_printf(&out, " ");
-      buf_printf(&out, "[%s]", proto_names[i].short_form);
+        if (i)
+        {
+            buf_printf(&out, " ");
+        }
+        buf_printf(&out, "[%s]", proto_names[i].short_form);
     }
-  return BSTR (&out);
+    return BSTR(&out);
 }
 
 const char *
-addr_family_name (int af) 
+addr_family_name(int af)
 {
-  switch (af)
+    switch (af)
     {
-    case AF_INET:  return "AF_INET";
-    case AF_INET6: return "AF_INET6";
+        case AF_INET:  return "AF_INET";
+
+        case AF_INET6: return "AF_INET6";
     }
-  return "AF_UNSPEC";
+    return "AF_UNSPEC";
 }
 
 /*
@@ -2795,22 +3135,28 @@ addr_family_name (int af)
  * has always sent UDPv4, TCPv4 over the wire. Keep these
  * strings for backward compatbility
  */
-const char*
-proto_remote (int proto, bool remote)
+const char *
+proto_remote(int proto, bool remote)
 {
-  ASSERT (proto >= 0 && proto < PROTO_N);
-  if (proto == PROTO_UDP)
-	return "UDPv4";
+    ASSERT(proto >= 0 && proto < PROTO_N);
+    if (proto == PROTO_UDP)
+    {
+        return "UDPv4";
+    }
 
-  if ( (remote && proto == PROTO_TCP_CLIENT) ||
-       (!remote && proto == PROTO_TCP_SERVER))
-	return "TCPv4_SERVER";
-  if ( (remote && proto == PROTO_TCP_SERVER) ||
-       (!remote && proto == PROTO_TCP_CLIENT))
-	return "TCPv4_CLIENT";
+    if ( (remote && proto == PROTO_TCP_CLIENT)
+         || (!remote && proto == PROTO_TCP_SERVER))
+    {
+        return "TCPv4_SERVER";
+    }
+    if ( (remote && proto == PROTO_TCP_SERVER)
+         || (!remote && proto == PROTO_TCP_CLIENT))
+    {
+        return "TCPv4_CLIENT";
+    }
 
-  ASSERT (0);
-  return ""; /* Make the compiler happy */
+    ASSERT(0);
+    return ""; /* Make the compiler happy */
 }
 
 /*
@@ -2818,11 +3164,11 @@ proto_remote (int proto, bool remote)
  * we expect are considered to be fatal errors.
  */
 void
-bad_address_length (int actual, int expected)
+bad_address_length(int actual, int expected)
 {
-  msg (M_FATAL, "ERROR: received strange incoming packet with an address length of %d -- we only accept address lengths of %d.",
-       actual,
-       expected);
+    msg(M_FATAL, "ERROR: received strange incoming packet with an address length of %d -- we only accept address lengths of %d.",
+        actual,
+        expected);
 }
 
 /*
@@ -2830,36 +3176,42 @@ bad_address_length (int actual, int expected)
  */
 
 int
-link_socket_read_tcp (struct link_socket *sock,
-		      struct buffer *buf)
+link_socket_read_tcp(struct link_socket *sock,
+                     struct buffer *buf)
 {
-  int len = 0;
+    int len = 0;
 
-  if (!sock->stream_buf.residual_fully_formed)
+    if (!sock->stream_buf.residual_fully_formed)
     {
 #ifdef _WIN32
-      len = socket_finalize (sock->sd, &sock->reads, buf, NULL);
+        len = socket_finalize(sock->sd, &sock->reads, buf, NULL);
 #else
-      struct buffer frag;
-      stream_buf_get_next (&sock->stream_buf, &frag);
-      len = recv (sock->sd, BPTR (&frag), BLEN (&frag), MSG_NOSIGNAL);
+        struct buffer frag;
+        stream_buf_get_next(&sock->stream_buf, &frag);
+        len = recv(sock->sd, BPTR(&frag), BLEN(&frag), MSG_NOSIGNAL);
 #endif
 
-      if (!len)
-	sock->stream_reset = true;
-      if (len <= 0)
-	return buf->len = len;
+        if (!len)
+        {
+            sock->stream_reset = true;
+        }
+        if (len <= 0)
+        {
+            return buf->len = len;
+        }
     }
 
-  if (sock->stream_buf.residual_fully_formed
-      || stream_buf_added (&sock->stream_buf, len)) /* packet complete? */
+    if (sock->stream_buf.residual_fully_formed
+        || stream_buf_added(&sock->stream_buf, len)) /* packet complete? */
+    {
+        stream_buf_get_final(&sock->stream_buf, buf);
+        stream_buf_reset(&sock->stream_buf);
+        return buf->len;
+    }
+    else
     {
-      stream_buf_get_final (&sock->stream_buf, buf);
-      stream_buf_reset (&sock->stream_buf);
-      return buf->len;
+        return buf->len = 0; /* no error, but packet is still incomplete */
     }
-  else
-    return buf->len = 0; /* no error, but packet is still incomplete */
 }
 
 #ifndef _WIN32
@@ -2870,202 +3222,208 @@ link_socket_read_tcp (struct link_socket *sock,
  * both IPv4 and IPv6 destination addresses, plus padding (see RFC 2292)
  */
 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
-#define PKTINFO_BUF_SIZE max_int( CMSG_SPACE(sizeof (struct in6_pktinfo)), \
-				  CMSG_SPACE(sizeof (struct in_pktinfo)) )
+#define PKTINFO_BUF_SIZE max_int( CMSG_SPACE(sizeof(struct in6_pktinfo)), \
+                                  CMSG_SPACE(sizeof(struct in_pktinfo)) )
 #else
-#define PKTINFO_BUF_SIZE max_int( CMSG_SPACE(sizeof (struct in6_pktinfo)), \
-				  CMSG_SPACE(sizeof (struct in_addr)) )
+#define PKTINFO_BUF_SIZE max_int( CMSG_SPACE(sizeof(struct in6_pktinfo)), \
+                                  CMSG_SPACE(sizeof(struct in_addr)) )
 #endif
 
 static socklen_t
-link_socket_read_udp_posix_recvmsg (struct link_socket *sock,
-				    struct buffer *buf,
-				    struct link_socket_actual *from)
-{
-  struct iovec iov;
-  uint8_t pktinfo_buf[PKTINFO_BUF_SIZE];
-  struct msghdr mesg;
-  socklen_t fromlen = sizeof (from->dest.addr);
-
-  iov.iov_base = BPTR (buf);
-  iov.iov_len = buf_forward_capacity_total (buf);
-  mesg.msg_iov = &iov;
-  mesg.msg_iovlen = 1;
-  mesg.msg_name = &from->dest.addr;
-  mesg.msg_namelen = fromlen;
-  mesg.msg_control = pktinfo_buf;
-  mesg.msg_controllen = sizeof pktinfo_buf;
-  buf->len = recvmsg (sock->sd, &mesg, 0);
-  if (buf->len >= 0)
-    {
-      struct cmsghdr *cmsg;
-      fromlen = mesg.msg_namelen;
-      cmsg = CMSG_FIRSTHDR (&mesg);
-      if (cmsg != NULL
-	  && CMSG_NXTHDR (&mesg, cmsg) == NULL
+link_socket_read_udp_posix_recvmsg(struct link_socket *sock,
+                                   struct buffer *buf,
+                                   struct link_socket_actual *from)
+{
+    struct iovec iov;
+    uint8_t pktinfo_buf[PKTINFO_BUF_SIZE];
+    struct msghdr mesg;
+    socklen_t fromlen = sizeof(from->dest.addr);
+
+    iov.iov_base = BPTR(buf);
+    iov.iov_len = buf_forward_capacity_total(buf);
+    mesg.msg_iov = &iov;
+    mesg.msg_iovlen = 1;
+    mesg.msg_name = &from->dest.addr;
+    mesg.msg_namelen = fromlen;
+    mesg.msg_control = pktinfo_buf;
+    mesg.msg_controllen = sizeof pktinfo_buf;
+    buf->len = recvmsg(sock->sd, &mesg, 0);
+    if (buf->len >= 0)
+    {
+        struct cmsghdr *cmsg;
+        fromlen = mesg.msg_namelen;
+        cmsg = CMSG_FIRSTHDR(&mesg);
+        if (cmsg != NULL
+            && CMSG_NXTHDR(&mesg, cmsg) == NULL
 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
-	  && cmsg->cmsg_level == SOL_IP 
-	  && cmsg->cmsg_type == IP_PKTINFO
-	  && cmsg->cmsg_len >= CMSG_LEN(sizeof(struct in_pktinfo)) )
+            && cmsg->cmsg_level == SOL_IP
+            && cmsg->cmsg_type == IP_PKTINFO
+            && cmsg->cmsg_len >= CMSG_LEN(sizeof(struct in_pktinfo)) )
 #elif defined(IP_RECVDSTADDR)
-	  && cmsg->cmsg_level == IPPROTO_IP
-	  && cmsg->cmsg_type == IP_RECVDSTADDR
-	  && cmsg->cmsg_len >= CMSG_LEN(sizeof(struct in_addr)) )
-#else
+            && cmsg->cmsg_level == IPPROTO_IP
+            && cmsg->cmsg_type == IP_RECVDSTADDR
+            && cmsg->cmsg_len >= CMSG_LEN(sizeof(struct in_addr)) )
+#else  /* if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST) */
 #error ENABLE_IP_PKTINFO is set without IP_PKTINFO xor IP_RECVDSTADDR (fix syshead.h)
 #endif
-	{
+        {
 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
-	  struct in_pktinfo *pkti = (struct in_pktinfo *) CMSG_DATA (cmsg);
-	  from->pi.in4.ipi_ifindex = pkti->ipi_ifindex;
-	  from->pi.in4.ipi_spec_dst = pkti->ipi_spec_dst;
+            struct in_pktinfo *pkti = (struct in_pktinfo *) CMSG_DATA(cmsg);
+            from->pi.in4.ipi_ifindex = pkti->ipi_ifindex;
+            from->pi.in4.ipi_spec_dst = pkti->ipi_spec_dst;
 #elif defined(IP_RECVDSTADDR)
-	  from->pi.in4 = *(struct in_addr*) CMSG_DATA (cmsg);
-#else
+            from->pi.in4 = *(struct in_addr *) CMSG_DATA(cmsg);
+#else  /* if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST) */
 #error ENABLE_IP_PKTINFO is set without IP_PKTINFO xor IP_RECVDSTADDR (fix syshead.h)
 #endif
-	}
-      else if (cmsg != NULL
-	  && CMSG_NXTHDR (&mesg, cmsg) == NULL
-	  && cmsg->cmsg_level == IPPROTO_IPV6 
-	  && cmsg->cmsg_type == IPV6_PKTINFO
-	  && cmsg->cmsg_len >= CMSG_LEN(sizeof(struct in6_pktinfo)) )
-	{
-	  struct in6_pktinfo *pkti6 = (struct in6_pktinfo *) CMSG_DATA (cmsg);
-	  from->pi.in6.ipi6_ifindex = pkti6->ipi6_ifindex;
-	  from->pi.in6.ipi6_addr = pkti6->ipi6_addr;
-	}
-      else if (cmsg != NULL)
-	{
-	  msg(M_WARN, "CMSG received that cannot be parsed (cmsg_level=%d, cmsg_type=%d, cmsg=len=%d)", (int)cmsg->cmsg_level, (int)cmsg->cmsg_type, (int)cmsg->cmsg_len );
-	}
-    }
-
-  return fromlen;
+        }
+        else if (cmsg != NULL
+                 && CMSG_NXTHDR(&mesg, cmsg) == NULL
+                 && cmsg->cmsg_level == IPPROTO_IPV6
+                 && cmsg->cmsg_type == IPV6_PKTINFO
+                 && cmsg->cmsg_len >= CMSG_LEN(sizeof(struct in6_pktinfo)) )
+        {
+            struct in6_pktinfo *pkti6 = (struct in6_pktinfo *) CMSG_DATA(cmsg);
+            from->pi.in6.ipi6_ifindex = pkti6->ipi6_ifindex;
+            from->pi.in6.ipi6_addr = pkti6->ipi6_addr;
+        }
+        else if (cmsg != NULL)
+        {
+            msg(M_WARN, "CMSG received that cannot be parsed (cmsg_level=%d, cmsg_type=%d, cmsg=len=%d)", (int)cmsg->cmsg_level, (int)cmsg->cmsg_type, (int)cmsg->cmsg_len );
+        }
+    }
+
+    return fromlen;
 }
-#endif
+#endif /* if ENABLE_IP_PKTINFO */
 
 int
-link_socket_read_udp_posix (struct link_socket *sock,
-			    struct buffer *buf,
-			    struct link_socket_actual *from)
+link_socket_read_udp_posix(struct link_socket *sock,
+                           struct buffer *buf,
+                           struct link_socket_actual *from)
 {
-  socklen_t fromlen = sizeof (from->dest.addr);
-  socklen_t expectedlen = af_addr_size(sock->info.af);
-  addr_zero_host(&from->dest);
+    socklen_t fromlen = sizeof(from->dest.addr);
+    socklen_t expectedlen = af_addr_size(sock->info.af);
+    addr_zero_host(&from->dest);
 #if ENABLE_IP_PKTINFO
-  /* Both PROTO_UDPv4 and PROTO_UDPv6 */
-  if (sock->info.proto == PROTO_UDP && sock->sockflags & SF_USE_IP_PKTINFO)
-    fromlen = link_socket_read_udp_posix_recvmsg (sock, buf, from);
-  else
+    /* Both PROTO_UDPv4 and PROTO_UDPv6 */
+    if (sock->info.proto == PROTO_UDP && sock->sockflags & SF_USE_IP_PKTINFO)
+    {
+        fromlen = link_socket_read_udp_posix_recvmsg(sock, buf, from);
+    }
+    else
 #endif
-    buf->len = recvfrom (sock->sd, BPTR (buf), buf_forward_capacity(buf), 0,
-			 &from->dest.addr.sa, &fromlen);
-  /* FIXME: won't do anything when sock->info.af == AF_UNSPEC */
-  if (buf->len >= 0 && expectedlen && fromlen != expectedlen)
-    bad_address_length (fromlen, expectedlen);
-  return buf->len;
+    buf->len = recvfrom(sock->sd, BPTR(buf), buf_forward_capacity(buf), 0,
+                        &from->dest.addr.sa, &fromlen);
+    /* FIXME: won't do anything when sock->info.af == AF_UNSPEC */
+    if (buf->len >= 0 && expectedlen && fromlen != expectedlen)
+    {
+        bad_address_length(fromlen, expectedlen);
+    }
+    return buf->len;
 }
 
-#endif
+#endif /* ifndef _WIN32 */
 
 /*
  * Socket Write Routines
  */
 
 int
-link_socket_write_tcp (struct link_socket *sock,
-		       struct buffer *buf,
-		       struct link_socket_actual *to)
-{
-  packet_size_type len = BLEN (buf);
-  dmsg (D_STREAM_DEBUG, "STREAM: WRITE %d offset=%d", (int)len, buf->offset);
-  ASSERT (len <= sock->stream_buf.maxlen);
-  len = htonps (len);
-  ASSERT (buf_write_prepend (buf, &len, sizeof (len)));
+link_socket_write_tcp(struct link_socket *sock,
+                      struct buffer *buf,
+                      struct link_socket_actual *to)
+{
+    packet_size_type len = BLEN(buf);
+    dmsg(D_STREAM_DEBUG, "STREAM: WRITE %d offset=%d", (int)len, buf->offset);
+    ASSERT(len <= sock->stream_buf.maxlen);
+    len = htonps(len);
+    ASSERT(buf_write_prepend(buf, &len, sizeof(len)));
 #ifdef _WIN32
-  return link_socket_write_win32 (sock, buf, to);
+    return link_socket_write_win32(sock, buf, to);
 #else
-  return link_socket_write_tcp_posix (sock, buf, to);  
+    return link_socket_write_tcp_posix(sock, buf, to);
 #endif
 }
 
 #if ENABLE_IP_PKTINFO
 
 size_t
-link_socket_write_udp_posix_sendmsg (struct link_socket *sock,
-				     struct buffer *buf,
-				     struct link_socket_actual *to)
-{
-  struct iovec iov;
-  struct msghdr mesg;
-  struct cmsghdr *cmsg;
-  uint8_t pktinfo_buf[PKTINFO_BUF_SIZE];
-
-  iov.iov_base = BPTR (buf);
-  iov.iov_len = BLEN (buf);
-  mesg.msg_iov = &iov;
-  mesg.msg_iovlen = 1;
-  switch (to->dest.addr.sa.sa_family)
-    {
-    case AF_INET:
-      {
-        mesg.msg_name = &to->dest.addr.sa;
-        mesg.msg_namelen = sizeof (struct sockaddr_in);
-        mesg.msg_control = pktinfo_buf;
-        mesg.msg_flags = 0;
+link_socket_write_udp_posix_sendmsg(struct link_socket *sock,
+                                    struct buffer *buf,
+                                    struct link_socket_actual *to)
+{
+    struct iovec iov;
+    struct msghdr mesg;
+    struct cmsghdr *cmsg;
+    uint8_t pktinfo_buf[PKTINFO_BUF_SIZE];
+
+    iov.iov_base = BPTR(buf);
+    iov.iov_len = BLEN(buf);
+    mesg.msg_iov = &iov;
+    mesg.msg_iovlen = 1;
+    switch (to->dest.addr.sa.sa_family)
+    {
+        case AF_INET:
+        {
+            mesg.msg_name = &to->dest.addr.sa;
+            mesg.msg_namelen = sizeof(struct sockaddr_in);
+            mesg.msg_control = pktinfo_buf;
+            mesg.msg_flags = 0;
 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
-        mesg.msg_controllen = CMSG_SPACE(sizeof (struct in_pktinfo));
-        cmsg = CMSG_FIRSTHDR (&mesg);
-        cmsg->cmsg_len = CMSG_LEN(sizeof (struct in_pktinfo));
-        cmsg->cmsg_level = SOL_IP;
-        cmsg->cmsg_type = IP_PKTINFO;
-	{
-        struct in_pktinfo *pkti;
-        pkti = (struct in_pktinfo *) CMSG_DATA (cmsg);
-        pkti->ipi_ifindex = to->pi.in4.ipi_ifindex;
-        pkti->ipi_spec_dst = to->pi.in4.ipi_spec_dst;
-        pkti->ipi_addr.s_addr = 0;
-	}
+            mesg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
+            cmsg = CMSG_FIRSTHDR(&mesg);
+            cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
+            cmsg->cmsg_level = SOL_IP;
+            cmsg->cmsg_type = IP_PKTINFO;
+            {
+                struct in_pktinfo *pkti;
+                pkti = (struct in_pktinfo *) CMSG_DATA(cmsg);
+                pkti->ipi_ifindex = to->pi.in4.ipi_ifindex;
+                pkti->ipi_spec_dst = to->pi.in4.ipi_spec_dst;
+                pkti->ipi_addr.s_addr = 0;
+            }
 #elif defined(IP_RECVDSTADDR)
-	ASSERT( CMSG_SPACE(sizeof (struct in_addr)) <= sizeof(pktinfo_buf) );
-        mesg.msg_controllen = CMSG_SPACE(sizeof (struct in_addr));
-        cmsg = CMSG_FIRSTHDR (&mesg);
-        cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
-        cmsg->cmsg_level = IPPROTO_IP;
-        cmsg->cmsg_type = IP_RECVDSTADDR;
-        *(struct in_addr *) CMSG_DATA (cmsg) = to->pi.in4;
-#else
+            ASSERT( CMSG_SPACE(sizeof(struct in_addr)) <= sizeof(pktinfo_buf) );
+            mesg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr));
+            cmsg = CMSG_FIRSTHDR(&mesg);
+            cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
+            cmsg->cmsg_level = IPPROTO_IP;
+            cmsg->cmsg_type = IP_RECVDSTADDR;
+            *(struct in_addr *) CMSG_DATA(cmsg) = to->pi.in4;
+#else  /* if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST) */
 #error ENABLE_IP_PKTINFO is set without IP_PKTINFO xor IP_RECVDSTADDR (fix syshead.h)
-#endif
-        break;
-      }
-    case AF_INET6:
-      {
-        struct in6_pktinfo *pkti6;
-        mesg.msg_name = &to->dest.addr.sa;
-        mesg.msg_namelen = sizeof (struct sockaddr_in6);
-
-        ASSERT( CMSG_SPACE(sizeof (struct in6_pktinfo)) <= sizeof(pktinfo_buf) );
-        mesg.msg_control = pktinfo_buf;
-        mesg.msg_controllen = CMSG_SPACE(sizeof (struct in6_pktinfo));
-        mesg.msg_flags = 0;
-        cmsg = CMSG_FIRSTHDR (&mesg);
-        cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
-        cmsg->cmsg_level = IPPROTO_IPV6;
-        cmsg->cmsg_type = IPV6_PKTINFO;
-
-        pkti6 = (struct in6_pktinfo *) CMSG_DATA (cmsg);
-        pkti6->ipi6_ifindex = to->pi.in6.ipi6_ifindex;
-        pkti6->ipi6_addr = to->pi.in6.ipi6_addr;
-        break;
-      }
-    default: ASSERT(0);
-    }
-  return sendmsg (sock->sd, &mesg, 0);
+#endif /* if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST) */
+            break;
+        }
+
+        case AF_INET6:
+        {
+            struct in6_pktinfo *pkti6;
+            mesg.msg_name = &to->dest.addr.sa;
+            mesg.msg_namelen = sizeof(struct sockaddr_in6);
+
+            ASSERT( CMSG_SPACE(sizeof(struct in6_pktinfo)) <= sizeof(pktinfo_buf) );
+            mesg.msg_control = pktinfo_buf;
+            mesg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
+            mesg.msg_flags = 0;
+            cmsg = CMSG_FIRSTHDR(&mesg);
+            cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
+            cmsg->cmsg_level = IPPROTO_IPV6;
+            cmsg->cmsg_type = IPV6_PKTINFO;
+
+            pkti6 = (struct in6_pktinfo *) CMSG_DATA(cmsg);
+            pkti6->ipi6_ifindex = to->pi.in6.ipi6_ifindex;
+            pkti6->ipi6_addr = to->pi.in6.ipi6_addr;
+            break;
+        }
+
+        default: ASSERT(0);
+    }
+    return sendmsg(sock->sd, &mesg, 0);
 }
 
-#endif
+#endif /* if ENABLE_IP_PKTINFO */
 
 /*
  * Win32 overlapped socket I/O functions.
@@ -3074,335 +3432,347 @@ link_socket_write_udp_posix_sendmsg (struct link_socket *sock,
 #ifdef _WIN32
 
 int
-socket_recv_queue (struct link_socket *sock, int maxsize)
-{
-  if (sock->reads.iostate == IOSTATE_INITIAL)
-    {
-      WSABUF wsabuf[1];
-      int status;
-
-      /* reset buf to its initial state */
-      if (proto_is_udp(sock->info.proto))
-	{
-	  sock->reads.buf = sock->reads.buf_init;
-	}
-      else if (proto_is_tcp(sock->info.proto))
-	{
-	  stream_buf_get_next (&sock->stream_buf, &sock->reads.buf);
-	}
-      else
-	{
-	  ASSERT (0);
-	}
-
-      /* Win32 docs say it's okay to allocate the wsabuf on the stack */
-      wsabuf[0].buf = BPTR (&sock->reads.buf);
-      wsabuf[0].len = maxsize ? maxsize : BLEN (&sock->reads.buf);
-
-      /* check for buffer overflow */
-      ASSERT (wsabuf[0].len <= BLEN (&sock->reads.buf));
-
-      /* the overlapped read will signal this event on I/O completion */
-      ASSERT (ResetEvent (sock->reads.overlapped.hEvent));
-      sock->reads.flags = 0;
-
-      if (proto_is_udp(sock->info.proto))
-	{
-	  sock->reads.addr_defined = true;
-	  sock->reads.addrlen = sizeof (sock->reads.addr6);
-	  status = WSARecvFrom(
-			       sock->sd,
-			       wsabuf,
-			       1,
-			       &sock->reads.size,
-			       &sock->reads.flags,
-			       (struct sockaddr *) &sock->reads.addr,
-			       &sock->reads.addrlen,
-			       &sock->reads.overlapped,
-			       NULL);
-	}
-      else if (proto_is_tcp(sock->info.proto))
-	{
-	  sock->reads.addr_defined = false;
-	  status = WSARecv(
-			   sock->sd,
-			   wsabuf,
-			   1,
-			   &sock->reads.size,
-			   &sock->reads.flags,
-			   &sock->reads.overlapped,
-			   NULL);
-	}
-      else
-	{
-	  status = 0;
-	  ASSERT (0);
-	}
-
-      if (!status) /* operation completed immediately? */
-	{
-	  /* FIXME: won't do anything when sock->info.af == AF_UNSPEC */
-	  int af_len = af_addr_size (sock->info.af);
-	  if (sock->reads.addr_defined && af_len && sock->reads.addrlen != af_len)
-	    bad_address_length (sock->reads.addrlen, af_len);
-	  sock->reads.iostate = IOSTATE_IMMEDIATE_RETURN;
-
-	  /* since we got an immediate return, we must signal the event object ourselves */
-	  ASSERT (SetEvent (sock->reads.overlapped.hEvent));
-	  sock->reads.status = 0;
-
-	  dmsg (D_WIN32_IO, "WIN32 I/O: Socket Receive immediate return [%d,%d]",
-	       (int) wsabuf[0].len,
-	       (int) sock->reads.size);	       
-	}
-      else
-	{
-	  status = WSAGetLastError (); 
-	  if (status == WSA_IO_PENDING) /* operation queued? */
-	    {
-	      sock->reads.iostate = IOSTATE_QUEUED;
-	      sock->reads.status = status;
-	      dmsg (D_WIN32_IO, "WIN32 I/O: Socket Receive queued [%d]",
-		   (int) wsabuf[0].len);
-	    }
-	  else /* error occurred */
-	    {
-	      struct gc_arena gc = gc_new ();
-	      ASSERT (SetEvent (sock->reads.overlapped.hEvent));
-	      sock->reads.iostate = IOSTATE_IMMEDIATE_RETURN;
-	      sock->reads.status = status;
-	      dmsg (D_WIN32_IO, "WIN32 I/O: Socket Receive error [%d]: %s",
-		   (int) wsabuf[0].len,
-		   strerror_win32 (status, &gc));
-	      gc_free (&gc);
-	    }
-	}
-    }
-  return sock->reads.iostate;
+socket_recv_queue(struct link_socket *sock, int maxsize)
+{
+    if (sock->reads.iostate == IOSTATE_INITIAL)
+    {
+        WSABUF wsabuf[1];
+        int status;
+
+        /* reset buf to its initial state */
+        if (proto_is_udp(sock->info.proto))
+        {
+            sock->reads.buf = sock->reads.buf_init;
+        }
+        else if (proto_is_tcp(sock->info.proto))
+        {
+            stream_buf_get_next(&sock->stream_buf, &sock->reads.buf);
+        }
+        else
+        {
+            ASSERT(0);
+        }
+
+        /* Win32 docs say it's okay to allocate the wsabuf on the stack */
+        wsabuf[0].buf = BPTR(&sock->reads.buf);
+        wsabuf[0].len = maxsize ? maxsize : BLEN(&sock->reads.buf);
+
+        /* check for buffer overflow */
+        ASSERT(wsabuf[0].len <= BLEN(&sock->reads.buf));
+
+        /* the overlapped read will signal this event on I/O completion */
+        ASSERT(ResetEvent(sock->reads.overlapped.hEvent));
+        sock->reads.flags = 0;
+
+        if (proto_is_udp(sock->info.proto))
+        {
+            sock->reads.addr_defined = true;
+            sock->reads.addrlen = sizeof(sock->reads.addr6);
+            status = WSARecvFrom(
+                sock->sd,
+                wsabuf,
+                1,
+                &sock->reads.size,
+                &sock->reads.flags,
+                (struct sockaddr *) &sock->reads.addr,
+                &sock->reads.addrlen,
+                &sock->reads.overlapped,
+                NULL);
+        }
+        else if (proto_is_tcp(sock->info.proto))
+        {
+            sock->reads.addr_defined = false;
+            status = WSARecv(
+                sock->sd,
+                wsabuf,
+                1,
+                &sock->reads.size,
+                &sock->reads.flags,
+                &sock->reads.overlapped,
+                NULL);
+        }
+        else
+        {
+            status = 0;
+            ASSERT(0);
+        }
+
+        if (!status) /* operation completed immediately? */
+        {
+            /* FIXME: won't do anything when sock->info.af == AF_UNSPEC */
+            int af_len = af_addr_size(sock->info.af);
+            if (sock->reads.addr_defined && af_len && sock->reads.addrlen != af_len)
+            {
+                bad_address_length(sock->reads.addrlen, af_len);
+            }
+            sock->reads.iostate = IOSTATE_IMMEDIATE_RETURN;
+
+            /* since we got an immediate return, we must signal the event object ourselves */
+            ASSERT(SetEvent(sock->reads.overlapped.hEvent));
+            sock->reads.status = 0;
+
+            dmsg(D_WIN32_IO, "WIN32 I/O: Socket Receive immediate return [%d,%d]",
+                 (int) wsabuf[0].len,
+                 (int) sock->reads.size);
+        }
+        else
+        {
+            status = WSAGetLastError();
+            if (status == WSA_IO_PENDING) /* operation queued? */
+            {
+                sock->reads.iostate = IOSTATE_QUEUED;
+                sock->reads.status = status;
+                dmsg(D_WIN32_IO, "WIN32 I/O: Socket Receive queued [%d]",
+                     (int) wsabuf[0].len);
+            }
+            else /* error occurred */
+            {
+                struct gc_arena gc = gc_new();
+                ASSERT(SetEvent(sock->reads.overlapped.hEvent));
+                sock->reads.iostate = IOSTATE_IMMEDIATE_RETURN;
+                sock->reads.status = status;
+                dmsg(D_WIN32_IO, "WIN32 I/O: Socket Receive error [%d]: %s",
+                     (int) wsabuf[0].len,
+                     strerror_win32(status, &gc));
+                gc_free(&gc);
+            }
+        }
+    }
+    return sock->reads.iostate;
 }
 
 int
-socket_send_queue (struct link_socket *sock, struct buffer *buf, const struct link_socket_actual *to)
-{
-  if (sock->writes.iostate == IOSTATE_INITIAL)
-    {
-      WSABUF wsabuf[1];
-      int status;
- 
-      /* make a private copy of buf */
-      sock->writes.buf = sock->writes.buf_init;
-      sock->writes.buf.len = 0;
-      ASSERT (buf_copy (&sock->writes.buf, buf));
-
-      /* Win32 docs say it's okay to allocate the wsabuf on the stack */
-      wsabuf[0].buf = BPTR (&sock->writes.buf);
-      wsabuf[0].len = BLEN (&sock->writes.buf);
-
-      /* the overlapped write will signal this event on I/O completion */
-      ASSERT (ResetEvent (sock->writes.overlapped.hEvent));
-      sock->writes.flags = 0;
-
-      if (proto_is_udp(sock->info.proto))
-	{
-	  /* set destination address for UDP writes */
-	  sock->writes.addr_defined = true;
-	  if (to->dest.addr.sa.sa_family == AF_INET6)
-	    {
-	      sock->writes.addr6 = to->dest.addr.in6;
-	      sock->writes.addrlen = sizeof (sock->writes.addr6);
-	    }
-	  else
-	    {
-	      sock->writes.addr = to->dest.addr.in4;
-	      sock->writes.addrlen = sizeof (sock->writes.addr);
-	    }
-
-	  status = WSASendTo(
-			       sock->sd,
-			       wsabuf,
-			       1,
-			       &sock->writes.size,
-			       sock->writes.flags,
-			       (struct sockaddr *) &sock->writes.addr,
-			       sock->writes.addrlen,
-			       &sock->writes.overlapped,
-			       NULL);
-	}
-      else if (proto_is_tcp(sock->info.proto))
-	{
-	  /* destination address for TCP writes was established on connection initiation */
-	  sock->writes.addr_defined = false;
-
-	  status = WSASend(
-			   sock->sd,
-			   wsabuf,
-			   1,
-			   &sock->writes.size,
-			   sock->writes.flags,
-			   &sock->writes.overlapped,
-			   NULL);
-	}
-      else 
-	{
-	  status = 0;
-	  ASSERT (0);
-	}
-
-      if (!status) /* operation completed immediately? */
-	{
-	  sock->writes.iostate = IOSTATE_IMMEDIATE_RETURN;
-
-	  /* since we got an immediate return, we must signal the event object ourselves */
-	  ASSERT (SetEvent (sock->writes.overlapped.hEvent));
-
-	  sock->writes.status = 0;
-
-	  dmsg (D_WIN32_IO, "WIN32 I/O: Socket Send immediate return [%d,%d]",
-	       (int) wsabuf[0].len,
-	       (int) sock->writes.size);	       
-	}
-      else
-	{
-	  status = WSAGetLastError (); 
-	  if (status == WSA_IO_PENDING) /* operation queued? */
-	    {
-	      sock->writes.iostate = IOSTATE_QUEUED;
-	      sock->writes.status = status;
-	      dmsg (D_WIN32_IO, "WIN32 I/O: Socket Send queued [%d]",
-		   (int) wsabuf[0].len);
-	    }
-	  else /* error occurred */
-	    {
-	      struct gc_arena gc = gc_new ();
-	      ASSERT (SetEvent (sock->writes.overlapped.hEvent));
-	      sock->writes.iostate = IOSTATE_IMMEDIATE_RETURN;
-	      sock->writes.status = status;
-
-	      dmsg (D_WIN32_IO, "WIN32 I/O: Socket Send error [%d]: %s",
-		   (int) wsabuf[0].len,
-		   strerror_win32 (status, &gc));
-
-	      gc_free (&gc);
-	    }
-	}
-    }
-  return sock->writes.iostate;
+socket_send_queue(struct link_socket *sock, struct buffer *buf, const struct link_socket_actual *to)
+{
+    if (sock->writes.iostate == IOSTATE_INITIAL)
+    {
+        WSABUF wsabuf[1];
+        int status;
+
+        /* make a private copy of buf */
+        sock->writes.buf = sock->writes.buf_init;
+        sock->writes.buf.len = 0;
+        ASSERT(buf_copy(&sock->writes.buf, buf));
+
+        /* Win32 docs say it's okay to allocate the wsabuf on the stack */
+        wsabuf[0].buf = BPTR(&sock->writes.buf);
+        wsabuf[0].len = BLEN(&sock->writes.buf);
+
+        /* the overlapped write will signal this event on I/O completion */
+        ASSERT(ResetEvent(sock->writes.overlapped.hEvent));
+        sock->writes.flags = 0;
+
+        if (proto_is_udp(sock->info.proto))
+        {
+            /* set destination address for UDP writes */
+            sock->writes.addr_defined = true;
+            if (to->dest.addr.sa.sa_family == AF_INET6)
+            {
+                sock->writes.addr6 = to->dest.addr.in6;
+                sock->writes.addrlen = sizeof(sock->writes.addr6);
+            }
+            else
+            {
+                sock->writes.addr = to->dest.addr.in4;
+                sock->writes.addrlen = sizeof(sock->writes.addr);
+            }
+
+            status = WSASendTo(
+                sock->sd,
+                wsabuf,
+                1,
+                &sock->writes.size,
+                sock->writes.flags,
+                (struct sockaddr *) &sock->writes.addr,
+                sock->writes.addrlen,
+                &sock->writes.overlapped,
+                NULL);
+        }
+        else if (proto_is_tcp(sock->info.proto))
+        {
+            /* destination address for TCP writes was established on connection initiation */
+            sock->writes.addr_defined = false;
+
+            status = WSASend(
+                sock->sd,
+                wsabuf,
+                1,
+                &sock->writes.size,
+                sock->writes.flags,
+                &sock->writes.overlapped,
+                NULL);
+        }
+        else
+        {
+            status = 0;
+            ASSERT(0);
+        }
+
+        if (!status) /* operation completed immediately? */
+        {
+            sock->writes.iostate = IOSTATE_IMMEDIATE_RETURN;
+
+            /* since we got an immediate return, we must signal the event object ourselves */
+            ASSERT(SetEvent(sock->writes.overlapped.hEvent));
+
+            sock->writes.status = 0;
+
+            dmsg(D_WIN32_IO, "WIN32 I/O: Socket Send immediate return [%d,%d]",
+                 (int) wsabuf[0].len,
+                 (int) sock->writes.size);
+        }
+        else
+        {
+            status = WSAGetLastError();
+            if (status == WSA_IO_PENDING) /* operation queued? */
+            {
+                sock->writes.iostate = IOSTATE_QUEUED;
+                sock->writes.status = status;
+                dmsg(D_WIN32_IO, "WIN32 I/O: Socket Send queued [%d]",
+                     (int) wsabuf[0].len);
+            }
+            else /* error occurred */
+            {
+                struct gc_arena gc = gc_new();
+                ASSERT(SetEvent(sock->writes.overlapped.hEvent));
+                sock->writes.iostate = IOSTATE_IMMEDIATE_RETURN;
+                sock->writes.status = status;
+
+                dmsg(D_WIN32_IO, "WIN32 I/O: Socket Send error [%d]: %s",
+                     (int) wsabuf[0].len,
+                     strerror_win32(status, &gc));
+
+                gc_free(&gc);
+            }
+        }
+    }
+    return sock->writes.iostate;
 }
 
 int
-socket_finalize (SOCKET s,
-		 struct overlapped_io *io,
-		 struct buffer *buf,
-		 struct link_socket_actual *from)
-{
-  int ret = -1;
-  BOOL status;
-
-  switch (io->iostate)
-    {
-    case IOSTATE_QUEUED:
-      status = WSAGetOverlappedResult(
-				      s,
-				      &io->overlapped,
-				      &io->size,
-				      FALSE,
-				      &io->flags
-				      );
-      if (status)
-	{
-	  /* successful return for a queued operation */
-	  if (buf)
-	    *buf = io->buf;
-	  ret = io->size;
-	  io->iostate = IOSTATE_INITIAL;
-	  ASSERT (ResetEvent (io->overlapped.hEvent));
-
-	  dmsg (D_WIN32_IO, "WIN32 I/O: Socket Completion success [%d]", ret);
-	}
-      else
-	{
-	  /* error during a queued operation */
-	  ret = -1;
-	  if (WSAGetLastError() != WSA_IO_INCOMPLETE)
-	    {
-	      /* if no error (i.e. just not finished yet), then DON'T execute this code */
-	      io->iostate = IOSTATE_INITIAL;
-	      ASSERT (ResetEvent (io->overlapped.hEvent));
-	      msg (D_WIN32_IO | M_ERRNO, "WIN32 I/O: Socket Completion error");
-	    }
-	}
-      break;
-
-    case IOSTATE_IMMEDIATE_RETURN:
-      io->iostate = IOSTATE_INITIAL;
-      ASSERT (ResetEvent (io->overlapped.hEvent));
-      if (io->status)
-	{
-	  /* error return for a non-queued operation */
-	  WSASetLastError (io->status);
-	  ret = -1;
-	  msg (D_WIN32_IO | M_ERRNO, "WIN32 I/O: Socket Completion non-queued error");
-	}
-      else
-	{
-	  /* successful return for a non-queued operation */
-	  if (buf)
-	    *buf = io->buf;
-	  ret = io->size;
-	  dmsg (D_WIN32_IO, "WIN32 I/O: Socket Completion non-queued success [%d]", ret);
-	}
-      break;
-
-    case IOSTATE_INITIAL: /* were we called without proper queueing? */
-      WSASetLastError (WSAEINVAL);
-      ret = -1;
-      dmsg (D_WIN32_IO, "WIN32 I/O: Socket Completion BAD STATE");
-      break;
-
-    default:
-      ASSERT (0);
-    }
-  
-  /* return from address if requested */
-  if (from)
-    {
-      if (ret >= 0 && io->addr_defined)
-	{
-	  /* TODO(jjo): streamline this mess */
-	  /* in this func we dont have relevant info about the PF_ of this
-	   * endpoint, as link_socket_actual will be zero for the 1st received packet
-	   *
-	   * Test for inets PF_ possible sizes
-	   */
-	  switch (io->addrlen)
-	    {
-	    case sizeof(struct sockaddr_in):
-	    case sizeof(struct sockaddr_in6):
-	    /* TODO(jjo): for some reason (?) I'm getting 24,28 for AF_INET6
-	     * under _WIN32*/
-	    case sizeof(struct sockaddr_in6)-4:
-	      break;
-	    default:
-	      bad_address_length (io->addrlen, af_addr_size(io->addr.sin_family));
-	    }
-
-	  switch (io->addr.sin_family)
-	    {
-	    case AF_INET:
-	      from->dest.addr.in4 = io->addr;
-	      break;
-	    case AF_INET6:
-	      from->dest.addr.in6 = io->addr6;
-	      break;
-	    }
-	}
-      else
-	CLEAR (from->dest.addr);
-    }
-  
-  if (buf)
-    buf->len = ret;
-  return ret;
+socket_finalize(SOCKET s,
+                struct overlapped_io *io,
+                struct buffer *buf,
+                struct link_socket_actual *from)
+{
+    int ret = -1;
+    BOOL status;
+
+    switch (io->iostate)
+    {
+        case IOSTATE_QUEUED:
+            status = WSAGetOverlappedResult(
+                s,
+                &io->overlapped,
+                &io->size,
+                FALSE,
+                &io->flags
+                );
+            if (status)
+            {
+                /* successful return for a queued operation */
+                if (buf)
+                {
+                    *buf = io->buf;
+                }
+                ret = io->size;
+                io->iostate = IOSTATE_INITIAL;
+                ASSERT(ResetEvent(io->overlapped.hEvent));
+
+                dmsg(D_WIN32_IO, "WIN32 I/O: Socket Completion success [%d]", ret);
+            }
+            else
+            {
+                /* error during a queued operation */
+                ret = -1;
+                if (WSAGetLastError() != WSA_IO_INCOMPLETE)
+                {
+                    /* if no error (i.e. just not finished yet), then DON'T execute this code */
+                    io->iostate = IOSTATE_INITIAL;
+                    ASSERT(ResetEvent(io->overlapped.hEvent));
+                    msg(D_WIN32_IO | M_ERRNO, "WIN32 I/O: Socket Completion error");
+                }
+            }
+            break;
+
+        case IOSTATE_IMMEDIATE_RETURN:
+            io->iostate = IOSTATE_INITIAL;
+            ASSERT(ResetEvent(io->overlapped.hEvent));
+            if (io->status)
+            {
+                /* error return for a non-queued operation */
+                WSASetLastError(io->status);
+                ret = -1;
+                msg(D_WIN32_IO | M_ERRNO, "WIN32 I/O: Socket Completion non-queued error");
+            }
+            else
+            {
+                /* successful return for a non-queued operation */
+                if (buf)
+                {
+                    *buf = io->buf;
+                }
+                ret = io->size;
+                dmsg(D_WIN32_IO, "WIN32 I/O: Socket Completion non-queued success [%d]", ret);
+            }
+            break;
+
+        case IOSTATE_INITIAL: /* were we called without proper queueing? */
+            WSASetLastError(WSAEINVAL);
+            ret = -1;
+            dmsg(D_WIN32_IO, "WIN32 I/O: Socket Completion BAD STATE");
+            break;
+
+        default:
+            ASSERT(0);
+    }
+
+    /* return from address if requested */
+    if (from)
+    {
+        if (ret >= 0 && io->addr_defined)
+        {
+            /* TODO(jjo): streamline this mess */
+            /* in this func we dont have relevant info about the PF_ of this
+             * endpoint, as link_socket_actual will be zero for the 1st received packet
+             *
+             * Test for inets PF_ possible sizes
+             */
+            switch (io->addrlen)
+            {
+                case sizeof(struct sockaddr_in):
+                case sizeof(struct sockaddr_in6):
+                /* TODO(jjo): for some reason (?) I'm getting 24,28 for AF_INET6
+                 * under _WIN32*/
+                case sizeof(struct sockaddr_in6)-4:
+                    break;
+
+                default:
+                    bad_address_length(io->addrlen, af_addr_size(io->addr.sin_family));
+            }
+
+            switch (io->addr.sin_family)
+            {
+                case AF_INET:
+                    from->dest.addr.in4 = io->addr;
+                    break;
+
+                case AF_INET6:
+                    from->dest.addr.in6 = io->addr6;
+                    break;
+            }
+        }
+        else
+        {
+            CLEAR(from->dest.addr);
+        }
+    }
+
+    if (buf)
+    {
+        buf->len = ret;
+    }
+    return ret;
 }
 
 #endif /* _WIN32 */
@@ -3412,45 +3782,49 @@ socket_finalize (SOCKET s,
  */
 
 unsigned int
-socket_set (struct link_socket *s,
-	    struct event_set *es,
-	    unsigned int rwflags,
-	    void *arg,
-	    unsigned int *persistent)
-{
-  if (s)
-    {
-      if ((rwflags & EVENT_READ) && !stream_buf_read_setup (s))
-	{
-	  ASSERT (!persistent);
-	  rwflags &= ~EVENT_READ;
-	}
-      
+socket_set(struct link_socket *s,
+           struct event_set *es,
+           unsigned int rwflags,
+           void *arg,
+           unsigned int *persistent)
+{
+    if (s)
+    {
+        if ((rwflags & EVENT_READ) && !stream_buf_read_setup(s))
+        {
+            ASSERT(!persistent);
+            rwflags &= ~EVENT_READ;
+        }
+
 #ifdef _WIN32
-      if (rwflags & EVENT_READ)
-	socket_recv_queue (s, 0);
+        if (rwflags & EVENT_READ)
+        {
+            socket_recv_queue(s, 0);
+        }
 #endif
 
-      /* if persistent is defined, call event_ctl only if rwflags has changed since last call */
-      if (!persistent || *persistent != rwflags)
-	{
-	  event_ctl (es, socket_event_handle (s), rwflags, arg);
-	  if (persistent)
-	    *persistent = rwflags;
-	}
+        /* if persistent is defined, call event_ctl only if rwflags has changed since last call */
+        if (!persistent || *persistent != rwflags)
+        {
+            event_ctl(es, socket_event_handle(s), rwflags, arg);
+            if (persistent)
+            {
+                *persistent = rwflags;
+            }
+        }
 
-      s->rwflags_debug = rwflags;
+        s->rwflags_debug = rwflags;
     }
-  return rwflags;
+    return rwflags;
 }
 
 void
-sd_close (socket_descriptor_t *sd)
+sd_close(socket_descriptor_t *sd)
 {
-  if (sd && socket_defined (*sd))
+    if (sd && socket_defined(*sd))
     {
-      openvpn_close_socket (*sd);
-      *sd = SOCKET_UNDEFINED;
+        openvpn_close_socket(*sd);
+        *sd = SOCKET_UNDEFINED;
     }
 }
 
@@ -3461,117 +3835,150 @@ sd_close (socket_descriptor_t *sd)
  */
 
 const char *
-sockaddr_unix_name (const struct sockaddr_un *local, const char *null)
+sockaddr_unix_name(const struct sockaddr_un *local, const char *null)
 {
-  if (local && local->sun_family == PF_UNIX)
-    return local->sun_path;
-  else
-    return null;
+    if (local && local->sun_family == PF_UNIX)
+    {
+        return local->sun_path;
+    }
+    else
+    {
+        return null;
+    }
 }
 
 socket_descriptor_t
-create_socket_unix (void)
+create_socket_unix(void)
 {
-  socket_descriptor_t sd;
+    socket_descriptor_t sd;
 
-  if ((sd = socket (PF_UNIX, SOCK_STREAM, 0)) < 0)
-    msg (M_ERR, "Cannot create unix domain socket");
-  return sd;
+    if ((sd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
+    {
+        msg(M_ERR, "Cannot create unix domain socket");
+    }
+
+    /* set socket file descriptor to not pass across execs, so that
+     * scripts don't have access to it */
+    set_cloexec(sd);
+
+    return sd;
 }
 
 void
-socket_bind_unix (socket_descriptor_t sd,
-		  struct sockaddr_un *local,
-		  const char *prefix)
+socket_bind_unix(socket_descriptor_t sd,
+                 struct sockaddr_un *local,
+                 const char *prefix)
 {
-  struct gc_arena gc = gc_new ();
+    struct gc_arena gc = gc_new();
 
 #ifdef HAVE_UMASK
-  const mode_t orig_umask = umask (0);
+    const mode_t orig_umask = umask(0);
 #endif
 
-  if (bind (sd, (struct sockaddr *) local, sizeof (struct sockaddr_un)))
+    if (bind(sd, (struct sockaddr *) local, sizeof(struct sockaddr_un)))
     {
-      const int errnum = openvpn_errno ();
-      msg (M_FATAL, "%s: Socket bind[%d] failed on unix domain socket %s: %s",
-	   prefix,
-	   (int)sd,
-           sockaddr_unix_name (local, "NULL"),
-           strerror_ts (errnum, &gc));
+        const int errnum = openvpn_errno();
+        msg(M_FATAL, "%s: Socket bind[%d] failed on unix domain socket %s: %s",
+            prefix,
+            (int)sd,
+            sockaddr_unix_name(local, "NULL"),
+            strerror_ts(errnum, &gc));
     }
 
 #ifdef HAVE_UMASK
-  umask (orig_umask);
+    umask(orig_umask);
 #endif
 
-  gc_free (&gc);
+    gc_free(&gc);
 }
 
 socket_descriptor_t
-socket_accept_unix (socket_descriptor_t sd,
-		    struct sockaddr_un *remote)
+socket_accept_unix(socket_descriptor_t sd,
+                   struct sockaddr_un *remote)
 {
-  socklen_t remote_len = sizeof (struct sockaddr_un);
-  socket_descriptor_t ret;
+    socklen_t remote_len = sizeof(struct sockaddr_un);
+    socket_descriptor_t ret;
 
-  CLEAR (*remote);
-  ret = accept (sd, (struct sockaddr *) remote, &remote_len);
-  return ret;
+    CLEAR(*remote);
+    ret = accept(sd, (struct sockaddr *) remote, &remote_len);
+    if (ret >= 0)
+    {
+        /* set socket file descriptor to not pass across execs, so that
+         * scripts don't have access to it */
+        set_cloexec(ret);
+    }
+    return ret;
 }
 
 int
-socket_connect_unix (socket_descriptor_t sd,
-		     struct sockaddr_un *remote)
+socket_connect_unix(socket_descriptor_t sd,
+                    struct sockaddr_un *remote)
 {
-  int status = connect (sd, (struct sockaddr *) remote, sizeof (struct sockaddr_un));
-  if (status)
-    status = openvpn_errno ();
-  return status;
+    int status = connect(sd, (struct sockaddr *) remote, sizeof(struct sockaddr_un));
+    if (status)
+    {
+        status = openvpn_errno();
+    }
+    return status;
 }
 
 void
-sockaddr_unix_init (struct sockaddr_un *local, const char *path)
+sockaddr_unix_init(struct sockaddr_un *local, const char *path)
 {
-  local->sun_family = PF_UNIX;
-  strncpynt (local->sun_path, path, sizeof (local->sun_path));
+    local->sun_family = PF_UNIX;
+    strncpynt(local->sun_path, path, sizeof(local->sun_path));
 }
 
 void
-socket_delete_unix (const struct sockaddr_un *local)
+socket_delete_unix(const struct sockaddr_un *local)
 {
-  const char *name = sockaddr_unix_name (local, NULL);
+    const char *name = sockaddr_unix_name(local, NULL);
 #ifdef HAVE_UNLINK
-  if (name && strlen (name))
-    unlink (name);
+    if (name && strlen(name))
+    {
+        unlink(name);
+    }
 #endif
 }
 
 bool
-unix_socket_get_peer_uid_gid (const socket_descriptor_t sd, int *uid, int *gid)
+unix_socket_get_peer_uid_gid(const socket_descriptor_t sd, int *uid, int *gid)
 {
 #ifdef HAVE_GETPEEREID
-  uid_t u;
-  gid_t g;
-  if (getpeereid (sd, &u, &g) == -1) 
-    return false;
-  if (uid)
-    *uid = u;
-  if (gid)
-    *gid = g;
-  return true;
+    uid_t u;
+    gid_t g;
+    if (getpeereid(sd, &u, &g) == -1)
+    {
+        return false;
+    }
+    if (uid)
+    {
+        *uid = u;
+    }
+    if (gid)
+    {
+        *gid = g;
+    }
+    return true;
 #elif defined(SO_PEERCRED)
-  struct ucred peercred;
-  socklen_t so_len = sizeof(peercred);
-  if (getsockopt(sd, SOL_SOCKET, SO_PEERCRED, &peercred, &so_len) == -1) 
+    struct ucred peercred;
+    socklen_t so_len = sizeof(peercred);
+    if (getsockopt(sd, SOL_SOCKET, SO_PEERCRED, &peercred, &so_len) == -1)
+    {
+        return false;
+    }
+    if (uid)
+    {
+        *uid = peercred.uid;
+    }
+    if (gid)
+    {
+        *gid = peercred.gid;
+    }
+    return true;
+#else  /* ifdef HAVE_GETPEEREID */
     return false;
-  if (uid)
-    *uid = peercred.uid;
-  if (gid)
-    *gid = peercred.gid;
-  return true;
-#else
-  return false;
-#endif
+#endif /* ifdef HAVE_GETPEEREID */
 }
 
-#endif
+#endif /* if UNIX_SOCK_SUPPORT */