initial stretch branch release 2.4.0-6

author: Jörg Frings-Fürst <debian@jff-webhosting.net> 2017-06-27 13:56:16 +0200
committer: Jörg Frings-Fürst <debian@jff-webhosting.net> 2017-06-27 13:56:16 +0200
commit: 749384a154025e268b53cf3cc79eaeddde2b3ceb (patch)
tree: 27baa9e6aec76635d750405d90cd461440a656d1 /src
parent: db4f04c584f7d4e828b5d317cf40962b9d854ac5 (diff)
190 files changed, 1465 insertions, 3125 deletions
diff --git a/src/Makefile.in b/src/Makefile.in
index 526d549..b2e6c0e 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.13.4 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -25,17 +25,7 @@
 #  Copyright (C) 2006-2012 Alon Bar-Lev <alon.barlev@gmail.com>
 #
 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -99,6 +89,7 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = src
+DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/m4/ax_socklen_t.m4 \
@@ -109,7 +100,6 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/compat.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h \
 	$(top_builddir)/include/openvpn-plugin.h
@@ -170,7 +160,6 @@ am__define_uniq_tagged_files = \
 ETAGS = etags
 CTAGS = ctags
 DIST_SUBDIRS = $(SUBDIRS)
-am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 am__relativize = \
   dir0=`pwd`; \
@@ -244,7 +233,6 @@ LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 LZ4_CFLAGS = @LZ4_CFLAGS@
 LZ4_LIBS = @LZ4_LIBS@
 LZO_CFLAGS = @LZO_CFLAGS@
@@ -293,7 +281,6 @@ PKCS11_HELPER_LIBS = @PKCS11_HELPER_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PLUGINDIR = @PLUGINDIR@
 PLUGIN_AUTH_PAM_CFLAGS = @PLUGIN_AUTH_PAM_CFLAGS@
 PLUGIN_AUTH_PAM_LIBS = @PLUGIN_AUTH_PAM_LIBS@
 RANLIB = @RANLIB@
@@ -306,14 +293,12 @@ SHELL = @SHELL@
 SOCKETS_LIBS = @SOCKETS_LIBS@
 STRIP = @STRIP@
 SYSTEMD_ASK_PASSWORD = @SYSTEMD_ASK_PASSWORD@
-SYSTEMD_UNIT_DIR = @SYSTEMD_UNIT_DIR@
 TAP_CFLAGS = @TAP_CFLAGS@
 TAP_WIN_COMPONENT_ID = @TAP_WIN_COMPONENT_ID@
 TAP_WIN_MIN_MAJOR = @TAP_WIN_MIN_MAJOR@
 TAP_WIN_MIN_MINOR = @TAP_WIN_MIN_MINOR@
 TEST_CFLAGS = @TEST_CFLAGS@
 TEST_LDFLAGS = @TEST_LDFLAGS@
-TMPFILES_DIR = @TMPFILES_DIR@
 VENDOR_BUILD_ROOT = @VENDOR_BUILD_ROOT@
 VENDOR_DIST_ROOT = @VENDOR_DIST_ROOT@
 VENDOR_SRC_ROOT = @VENDOR_SRC_ROOT@
@@ -370,9 +355,7 @@ sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-systemdunitdir = @systemdunitdir@
 target_alias = @target_alias@
-tmpfilesdir = @tmpfilesdir@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
@@ -395,6 +378,7 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --foreign src/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -690,8 +674,6 @@ uninstall-am:
 	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
 	ps ps-am tags tags-am uninstall uninstall-am
 
-.PRECIOUS: Makefile
-
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/src/compat/Makefile.in b/src/compat/Makefile.in
index b264f40..e9d589f 100644
--- a/src/compat/Makefile.in
+++ b/src/compat/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.13.4 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -26,17 +26,7 @@
 #
 
 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -100,6 +90,8 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = src/compat
+DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
+	$(top_srcdir)/depcomp
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/m4/ax_socklen_t.m4 \
@@ -110,7 +102,6 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/compat.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h \
 	$(top_builddir)/include/openvpn-plugin.h
@@ -186,7 +177,6 @@ am__define_uniq_tagged_files = \
   done | $(am__uniquify_input)`
 ETAGS = etags
 CTAGS = ctags
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -235,7 +225,6 @@ LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 LZ4_CFLAGS = @LZ4_CFLAGS@
 LZ4_LIBS = @LZ4_LIBS@
 LZO_CFLAGS = @LZO_CFLAGS@
@@ -284,7 +273,6 @@ PKCS11_HELPER_LIBS = @PKCS11_HELPER_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PLUGINDIR = @PLUGINDIR@
 PLUGIN_AUTH_PAM_CFLAGS = @PLUGIN_AUTH_PAM_CFLAGS@
 PLUGIN_AUTH_PAM_LIBS = @PLUGIN_AUTH_PAM_LIBS@
 RANLIB = @RANLIB@
@@ -297,14 +285,12 @@ SHELL = @SHELL@
 SOCKETS_LIBS = @SOCKETS_LIBS@
 STRIP = @STRIP@
 SYSTEMD_ASK_PASSWORD = @SYSTEMD_ASK_PASSWORD@
-SYSTEMD_UNIT_DIR = @SYSTEMD_UNIT_DIR@
 TAP_CFLAGS = @TAP_CFLAGS@
 TAP_WIN_COMPONENT_ID = @TAP_WIN_COMPONENT_ID@
 TAP_WIN_MIN_MAJOR = @TAP_WIN_MIN_MAJOR@
 TAP_WIN_MIN_MINOR = @TAP_WIN_MIN_MINOR@
 TEST_CFLAGS = @TEST_CFLAGS@
 TEST_LDFLAGS = @TEST_LDFLAGS@
-TMPFILES_DIR = @TMPFILES_DIR@
 VENDOR_BUILD_ROOT = @VENDOR_BUILD_ROOT@
 VENDOR_DIST_ROOT = @VENDOR_DIST_ROOT@
 VENDOR_SRC_ROOT = @VENDOR_SRC_ROOT@
@@ -361,9 +347,7 @@ sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-systemdunitdir = @systemdunitdir@
 target_alias = @target_alias@
-tmpfilesdir = @tmpfilesdir@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
@@ -402,6 +386,7 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/compat/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --foreign src/compat/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -453,14 +438,14 @@ distclean-compile:
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -679,8 +664,6 @@ uninstall-am:
 	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
 	tags tags-am uninstall uninstall-am
 
-.PRECIOUS: Makefile
-
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/src/compat/compat-basename.c b/src/compat/compat-basename.c
index e66e225..b7b5c43 100644
--- a/src/compat/compat-basename.c
+++ b/src/compat/compat-basename.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/compat/compat-daemon.c b/src/compat/compat-daemon.c
index 4ef28fa..5093942 100644
--- a/src/compat/compat-daemon.c
+++ b/src/compat/compat-daemon.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -57,8 +58,7 @@ int
 daemon(int nochdir, int noclose)
 {
 #if defined(HAVE_FORK) && defined(HAVE_SETSID)
-    switch (fork())
-    {
+    switch (fork()) {
         case -1:
             return (-1);
 
diff --git a/src/compat/compat-dirname.c b/src/compat/compat-dirname.c
index c1523d9..7687108 100644
--- a/src/compat/compat-dirname.c
+++ b/src/compat/compat-dirname.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -43,8 +44,7 @@ __memrchr(const char *str, int c, size_t n)
     const char *end = str;
 
     end += n - 1; /* Go to the end of the string */
-    while (end >= str)
-    {
+    while (end >= str) {
         if (c == *end)
         {
             return end;
@@ -82,12 +82,10 @@ dirname(char *path)
         char *runp;
 
         for (runp = last_slash; runp != path; --runp)
-        {
             if (runp[-1] != separator)
             {
                 break;
             }
-        }
 
         /* The '/' is the last character, we have to look further.  */
         if (runp != path)
@@ -102,12 +100,10 @@ dirname(char *path)
         char *runp;
 
         for (runp = last_slash; runp != path; --runp)
-        {
             if (runp[-1] != separator)
             {
                 break;
             }
-        }
 
         /* Terminate the path.  */
         if (runp == path)
diff --git a/src/compat/compat-gettimeofday.c b/src/compat/compat-gettimeofday.c
index fb57f2d..d53e360 100644
--- a/src/compat/compat-gettimeofday.c
+++ b/src/compat/compat-gettimeofday.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/compat/compat-inet_ntop.c b/src/compat/compat-inet_ntop.c
index f2a181e..dd7abb5 100644
--- a/src/compat/compat-inet_ntop.c
+++ b/src/compat/compat-inet_ntop.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -51,8 +52,7 @@ inet_ntop(int af, const void *src, char *dst, socklen_t size)
     ZeroMemory(&ss, sizeof(ss));
     ss.ss_family = af;
 
-    switch (af)
-    {
+    switch (af) {
         case AF_INET:
             ((struct sockaddr_in *)&ss)->sin_addr = *(struct in_addr *)src;
             break;
diff --git a/src/compat/compat-inet_pton.c b/src/compat/compat-inet_pton.c
index 9d451cc..1e41fa2 100644
--- a/src/compat/compat-inet_pton.c
+++ b/src/compat/compat-inet_pton.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -58,8 +59,7 @@ inet_pton(int af, const char *src, void *dst)
 
     if (WSAStringToAddress(src_copy, af, NULL, (struct sockaddr *)&ss, &size) == 0)
     {
-        switch (af)
-        {
+        switch (af) {
             case AF_INET:
                 *(struct in_addr *)dst = ((struct sockaddr_in *)&ss)->sin_addr;
                 return 1;
diff --git a/src/compat/compat-versionhelpers.h b/src/compat/compat-versionhelpers.h
index 251fb04..a793056 100644
--- a/src/compat/compat-versionhelpers.h
+++ b/src/compat/compat-versionhelpers.h
@@ -30,74 +30,62 @@ IsWindowsVersionOrGreater(WORD major, WORD minor, WORD servpack)
 }
 
 VERSIONHELPERAPI
-IsWindowsXPOrGreater(void)
-{
+IsWindowsXPOrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WINXP), LOBYTE(_WIN32_WINNT_WINXP), 0);
 }
 
 VERSIONHELPERAPI
-IsWindowsXPSP1OrGreater(void)
-{
+IsWindowsXPSP1OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WINXP), LOBYTE(_WIN32_WINNT_WINXP), 1);
 }
 
 VERSIONHELPERAPI
-IsWindowsXPSP2OrGreater(void)
-{
+IsWindowsXPSP2OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WINXP), LOBYTE(_WIN32_WINNT_WINXP), 2);
 }
 
 VERSIONHELPERAPI
-IsWindowsXPSP3OrGreater(void)
-{
+IsWindowsXPSP3OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WINXP), LOBYTE(_WIN32_WINNT_WINXP), 3);
 }
 
 VERSIONHELPERAPI
-IsWindowsVistaOrGreater(void)
-{
+IsWindowsVistaOrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_VISTA), LOBYTE(_WIN32_WINNT_VISTA), 0);
 }
 
 VERSIONHELPERAPI
-IsWindowsVistaSP1OrGreater(void)
-{
+IsWindowsVistaSP1OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_VISTA), LOBYTE(_WIN32_WINNT_VISTA), 1);
 }
 
 VERSIONHELPERAPI
-IsWindowsVistaSP2OrGreater(void)
-{
+IsWindowsVistaSP2OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_VISTA), LOBYTE(_WIN32_WINNT_VISTA), 2);
 }
 
 VERSIONHELPERAPI
-IsWindows7OrGreater(void)
-{
+IsWindows7OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WIN7), LOBYTE(_WIN32_WINNT_WIN7), 0);
 }
 
 VERSIONHELPERAPI
-IsWindows7SP1OrGreater(void)
-{
+IsWindows7SP1OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WIN7), LOBYTE(_WIN32_WINNT_WIN7), 1);
 }
 
 VERSIONHELPERAPI
-IsWindows8OrGreater(void)
-{
+IsWindows8OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WIN8), LOBYTE(_WIN32_WINNT_WIN8), 0);
 }
 
 VERSIONHELPERAPI
-IsWindows8Point1OrGreater(void)
-{
+IsWindows8Point1OrGreater(void) {
     return IsWindowsVersionOrGreater(HIBYTE(_WIN32_WINNT_WINBLUE), LOBYTE(_WIN32_WINNT_WINBLUE), 0);
 }
 
 VERSIONHELPERAPI
-IsWindowsServer(void)
-{
+IsWindowsServer(void) {
     OSVERSIONINFOEXW vi = {sizeof(vi),0,0,0,0,{0},0,0,0,VER_NT_WORKSTATION};
     return !VerifyVersionInfoW(&vi, VER_PRODUCT_TYPE, VerSetConditionMask(0, VER_PRODUCT_TYPE, VER_EQUAL));
 }
diff --git a/src/compat/compat.h b/src/compat/compat.h
index d522898..75bfaed 100644
--- a/src/compat/compat.h
+++ b/src/compat/compat.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef COMPAT_H
diff --git a/src/openvpn/Makefile.am b/src/openvpn/Makefile.am
index fcc22d6..bea294b 100644
--- a/src/openvpn/Makefile.am
+++ b/src/openvpn/Makefile.am
@@ -27,9 +27,7 @@ AM_CFLAGS = \
 	$(OPTIONAL_CRYPTO_CFLAGS) \
 	$(OPTIONAL_LZO_CFLAGS) \
 	$(OPTIONAL_LZ4_CFLAGS) \
-	$(OPTIONAL_PKCS11_HELPER_CFLAGS) \
-	-DPLUGIN_LIBDIR=\"${plugindir}\"
-
+	$(OPTIONAL_PKCS11_HELPER_CFLAGS)
 if WIN32
 # we want unicode entry point but not the macro
 AM_CFLAGS += -municode -UUNICODE
@@ -81,7 +79,6 @@ openvpn_SOURCES = \
 	multi.c multi.h \
 	ntlm.c ntlm.h \
 	occ.c occ.h occ-inline.h \
-	openssl_compat.h \
 	pkcs11.c pkcs11.h pkcs11_backend.h \
 	pkcs11_openssl.c \
 	pkcs11_mbedtls.c \
diff --git a/src/openvpn/Makefile.in b/src/openvpn/Makefile.in
index ca4635b..95d4f59 100644
--- a/src/openvpn/Makefile.in
+++ b/src/openvpn/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.13.4 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -37,17 +37,7 @@
 # Required to build Windows resource file
 
 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -110,7 +100,8 @@ PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
-
+DIST_COMMON = $(top_srcdir)/build/ltrc.inc $(srcdir)/Makefile.in \
+	$(srcdir)/Makefile.am $(top_srcdir)/depcomp
 # we want unicode entry point but not the macro
 @WIN32_TRUE@am__append_1 = -municode -UUNICODE
 sbin_PROGRAMS = openvpn$(EXEEXT)
@@ -127,7 +118,6 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/compat.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h \
 	$(top_builddir)/include/openvpn-plugin.h
@@ -149,21 +139,21 @@ am__openvpn_SOURCES_DIST = argv.c argv.h base64.c base64.h basic.h \
 	console_builtin.c console_systemd.c mroute.c mroute.h mss.c \
 	mss.h mstats.c mstats.h mtcp.c mtcp.h mtu.c mtu.h mudp.c \
 	mudp.h multi.c multi.h ntlm.c ntlm.h occ.c occ.h occ-inline.h \
-	openssl_compat.h pkcs11.c pkcs11.h pkcs11_backend.h \
-	pkcs11_openssl.c pkcs11_mbedtls.c openvpn.c openvpn.h \
-	options.c options.h otime.c otime.h packet_id.c packet_id.h \
-	perf.c perf.h pf.c pf.h pf-inline.h ping.c ping.h \
-	ping-inline.h plugin.c plugin.h pool.c pool.h proto.c proto.h \
-	proxy.c proxy.h ps.c ps.h push.c push.h pushlist.h reliable.c \
-	reliable.h route.c route.h schedule.c schedule.h session_id.c \
-	session_id.h shaper.c shaper.h sig.c sig.h socket.c socket.h \
-	socks.c socks.h ssl.c ssl.h ssl_backend.h ssl_openssl.c \
-	ssl_openssl.h ssl_mbedtls.c ssl_mbedtls.h ssl_common.h \
-	ssl_verify.c ssl_verify.h ssl_verify_backend.h \
-	ssl_verify_openssl.c ssl_verify_openssl.h ssl_verify_mbedtls.c \
-	ssl_verify_mbedtls.h status.c status.h syshead.h tls_crypt.c \
-	tls_crypt.h tun.c tun.h win32.h win32.c cryptoapi.h \
-	cryptoapi.c openvpn_win32_resources.rc block_dns.c block_dns.h
+	pkcs11.c pkcs11.h pkcs11_backend.h pkcs11_openssl.c \
+	pkcs11_mbedtls.c openvpn.c openvpn.h options.c options.h \
+	otime.c otime.h packet_id.c packet_id.h perf.c perf.h pf.c \
+	pf.h pf-inline.h ping.c ping.h ping-inline.h plugin.c plugin.h \
+	pool.c pool.h proto.c proto.h proxy.c proxy.h ps.c ps.h push.c \
+	push.h pushlist.h reliable.c reliable.h route.c route.h \
+	schedule.c schedule.h session_id.c session_id.h shaper.c \
+	shaper.h sig.c sig.h socket.c socket.h socks.c socks.h ssl.c \
+	ssl.h ssl_backend.h ssl_openssl.c ssl_openssl.h ssl_mbedtls.c \
+	ssl_mbedtls.h ssl_common.h ssl_verify.c ssl_verify.h \
+	ssl_verify_backend.h ssl_verify_openssl.c ssl_verify_openssl.h \
+	ssl_verify_mbedtls.c ssl_verify_mbedtls.h status.c status.h \
+	syshead.h tls_crypt.c tls_crypt.h tun.c tun.h win32.h win32.c \
+	cryptoapi.h cryptoapi.c openvpn_win32_resources.rc block_dns.c \
+	block_dns.h
 @WIN32_TRUE@am__objects_1 = openvpn_win32_resources.$(OBJEXT) \
 @WIN32_TRUE@	block_dns.$(OBJEXT)
 am_openvpn_OBJECTS = argv.$(OBJEXT) base64.$(OBJEXT) buffer.$(OBJEXT) \
@@ -263,8 +253,6 @@ am__define_uniq_tagged_files = \
   done | $(am__uniquify_input)`
 ETAGS = etags
 CTAGS = ctags
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/build/ltrc.inc \
-	$(top_srcdir)/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -313,7 +301,6 @@ LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 LZ4_CFLAGS = @LZ4_CFLAGS@
 LZ4_LIBS = @LZ4_LIBS@
 LZO_CFLAGS = @LZO_CFLAGS@
@@ -362,7 +349,6 @@ PKCS11_HELPER_LIBS = @PKCS11_HELPER_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PLUGINDIR = @PLUGINDIR@
 PLUGIN_AUTH_PAM_CFLAGS = @PLUGIN_AUTH_PAM_CFLAGS@
 PLUGIN_AUTH_PAM_LIBS = @PLUGIN_AUTH_PAM_LIBS@
 RANLIB = @RANLIB@
@@ -375,14 +361,12 @@ SHELL = @SHELL@
 SOCKETS_LIBS = @SOCKETS_LIBS@
 STRIP = @STRIP@
 SYSTEMD_ASK_PASSWORD = @SYSTEMD_ASK_PASSWORD@
-SYSTEMD_UNIT_DIR = @SYSTEMD_UNIT_DIR@
 TAP_CFLAGS = @TAP_CFLAGS@
 TAP_WIN_COMPONENT_ID = @TAP_WIN_COMPONENT_ID@
 TAP_WIN_MIN_MAJOR = @TAP_WIN_MIN_MAJOR@
 TAP_WIN_MIN_MINOR = @TAP_WIN_MIN_MINOR@
 TEST_CFLAGS = @TEST_CFLAGS@
 TEST_LDFLAGS = @TEST_LDFLAGS@
-TMPFILES_DIR = @TMPFILES_DIR@
 VENDOR_BUILD_ROOT = @VENDOR_BUILD_ROOT@
 VENDOR_DIST_ROOT = @VENDOR_DIST_ROOT@
 VENDOR_SRC_ROOT = @VENDOR_SRC_ROOT@
@@ -439,9 +423,7 @@ sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-systemdunitdir = @systemdunitdir@
 target_alias = @target_alias@
-tmpfilesdir = @tmpfilesdir@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
@@ -462,8 +444,7 @@ AM_CPPFLAGS = \
 
 AM_CFLAGS = $(TAP_CFLAGS) $(OPTIONAL_CRYPTO_CFLAGS) \
 	$(OPTIONAL_LZO_CFLAGS) $(OPTIONAL_LZ4_CFLAGS) \
-	$(OPTIONAL_PKCS11_HELPER_CFLAGS) \
-	-DPLUGIN_LIBDIR=\"${plugindir}\" $(am__append_1)
+	$(OPTIONAL_PKCS11_HELPER_CFLAGS) $(am__append_1)
 openvpn_SOURCES = argv.c argv.h base64.c base64.h basic.h buffer.c \
 	buffer.h circ_list.h clinat.c clinat.h common.h comp.c comp.h \
 	compstub.c comp-lz4.c comp-lz4.h crypto.c crypto.h \
@@ -478,21 +459,20 @@ openvpn_SOURCES = argv.c argv.h base64.c base64.h basic.h buffer.c \
 	console_builtin.c console_systemd.c mroute.c mroute.h mss.c \
 	mss.h mstats.c mstats.h mtcp.c mtcp.h mtu.c mtu.h mudp.c \
 	mudp.h multi.c multi.h ntlm.c ntlm.h occ.c occ.h occ-inline.h \
-	openssl_compat.h pkcs11.c pkcs11.h pkcs11_backend.h \
-	pkcs11_openssl.c pkcs11_mbedtls.c openvpn.c openvpn.h \
-	options.c options.h otime.c otime.h packet_id.c packet_id.h \
-	perf.c perf.h pf.c pf.h pf-inline.h ping.c ping.h \
-	ping-inline.h plugin.c plugin.h pool.c pool.h proto.c proto.h \
-	proxy.c proxy.h ps.c ps.h push.c push.h pushlist.h reliable.c \
-	reliable.h route.c route.h schedule.c schedule.h session_id.c \
-	session_id.h shaper.c shaper.h sig.c sig.h socket.c socket.h \
-	socks.c socks.h ssl.c ssl.h ssl_backend.h ssl_openssl.c \
-	ssl_openssl.h ssl_mbedtls.c ssl_mbedtls.h ssl_common.h \
-	ssl_verify.c ssl_verify.h ssl_verify_backend.h \
-	ssl_verify_openssl.c ssl_verify_openssl.h ssl_verify_mbedtls.c \
-	ssl_verify_mbedtls.h status.c status.h syshead.h tls_crypt.c \
-	tls_crypt.h tun.c tun.h win32.h win32.c cryptoapi.h \
-	cryptoapi.c $(am__append_2)
+	pkcs11.c pkcs11.h pkcs11_backend.h pkcs11_openssl.c \
+	pkcs11_mbedtls.c openvpn.c openvpn.h options.c options.h \
+	otime.c otime.h packet_id.c packet_id.h perf.c perf.h pf.c \
+	pf.h pf-inline.h ping.c ping.h ping-inline.h plugin.c plugin.h \
+	pool.c pool.h proto.c proto.h proxy.c proxy.h ps.c ps.h push.c \
+	push.h pushlist.h reliable.c reliable.h route.c route.h \
+	schedule.c schedule.h session_id.c session_id.h shaper.c \
+	shaper.h sig.c sig.h socket.c socket.h socks.c socks.h ssl.c \
+	ssl.h ssl_backend.h ssl_openssl.c ssl_openssl.h ssl_mbedtls.c \
+	ssl_mbedtls.h ssl_common.h ssl_verify.c ssl_verify.h \
+	ssl_verify_backend.h ssl_verify_openssl.c ssl_verify_openssl.h \
+	ssl_verify_mbedtls.c ssl_verify_mbedtls.h status.c status.h \
+	syshead.h tls_crypt.c tls_crypt.h tun.c tun.h win32.h win32.c \
+	cryptoapi.h cryptoapi.c $(am__append_2)
 openvpn_LDADD = $(top_builddir)/src/compat/libcompat.la \
 	$(SOCKETS_LIBS) $(OPTIONAL_LZO_LIBS) $(OPTIONAL_LZ4_LIBS) \
 	$(OPTIONAL_PKCS11_HELPER_LIBS) $(OPTIONAL_CRYPTO_LIBS) \
@@ -514,6 +494,7 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am $(top_srcdir)/build/ltrc.inc $(am_
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/openvpn/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --foreign src/openvpn/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -522,7 +503,7 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
 	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
 	esac;
-$(top_srcdir)/build/ltrc.inc $(am__empty):
+$(top_srcdir)/build/ltrc.inc:
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
@@ -674,14 +655,14 @@ distclean-compile:
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -903,8 +884,6 @@ uninstall-am: uninstall-sbinPROGRAMS
 	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
 	tags tags-am uninstall uninstall-am uninstall-sbinPROGRAMS
 
-.PRECIOUS: Makefile
-
 
 .rc.lo:
 	$(LTRCCOMPILE) -i "$<" -o "$@"
diff --git a/src/openvpn/argv.c b/src/openvpn/argv.c
index a71d261..cc813ed 100644
--- a/src/openvpn/argv.c
+++ b/src/openvpn/argv.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  *
  *  A printf-like function (that only recognizes a subset of standard printf
@@ -59,9 +60,7 @@ argv_reset(struct argv *a)
 {
     size_t i;
     for (i = 0; i < a->argc; ++i)
-    {
         free(a->argv[i]);
-    }
     free(a->argv);
     argv_init(a);
 }
@@ -75,9 +74,7 @@ argv_extend(struct argv *a, const size_t newcap)
         size_t i;
         ALLOC_ARRAY_CLEAR(newargv, char *, newcap);
         for (i = 0; i < a->argc; ++i)
-        {
             newargv[i] = a->argv[i];
-        }
         free(a->argv);
         a->argv = newargv;
         a->capacity = newcap;
@@ -107,15 +104,11 @@ argv_clone(const struct argv *a, const size_t headroom)
 
     argv_init(&r);
     for (i = 0; i < headroom; ++i)
-    {
         argv_append(&r, NULL);
-    }
     if (a)
     {
         for (i = 0; i < a->argc; ++i)
-        {
             argv_append(&r, string_alloc(a->argv[i], NULL));
-        }
     }
     return r;
 }
@@ -339,9 +332,7 @@ argv_parse_cmd(struct argv *a, const char *s)
     {
         int i;
         for (i = 0; i < nparms; ++i)
-        {
             argv_append(a, string_alloc(parms[i], NULL));
-        }
     }
     else
     {
diff --git a/src/openvpn/argv.h b/src/openvpn/argv.h
index 7d0754c..1dd6dd7 100644
--- a/src/openvpn/argv.h
+++ b/src/openvpn/argv.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  *
  *  A printf-like function (that only recognizes a subset of standard printf
diff --git a/src/openvpn/base64.c b/src/openvpn/base64.c
index 0ac65e9..c799ede 100644
--- a/src/openvpn/base64.c
+++ b/src/openvpn/base64.c
@@ -69,8 +69,7 @@ openvpn_base64_encode(const void *data, int size, char **str)
     }
     q = (const unsigned char *) data;
     i = 0;
-    for (i = 0; i < size; )
-    {
+    for (i = 0; i < size; ) {
         c = q[i++];
         c *= 256;
         if (i < size)
@@ -108,12 +107,10 @@ pos(char c)
 {
     char *p;
     for (p = base64_chars; *p; p++)
-    {
         if (*p == c)
         {
             return p - base64_chars;
         }
-    }
     return -1;
 }
 
@@ -129,8 +126,7 @@ token_decode(const char *token)
     {
         return DECODE_ERROR;
     }
-    for (i = 0; i < 4; i++)
-    {
+    for (i = 0; i < 4; i++) {
         val *= 64;
         if (token[i] == '=')
         {
@@ -168,8 +164,7 @@ openvpn_base64_decode(const char *str, void *data, int size)
     {
         e = q + size;
     }
-    for (p = str; *p && (*p == '=' || strchr(base64_chars, *p)); p += 4)
-    {
+    for (p = str; *p && (*p == '=' || strchr(base64_chars, *p)); p += 4) {
         unsigned int val = token_decode(p);
         unsigned int marker = (val >> 24) & 0xff;
         if (val == DECODE_ERROR)
diff --git a/src/openvpn/basic.h b/src/openvpn/basic.h
index 3aa69ca..dac6f01 100644
--- a/src/openvpn/basic.h
+++ b/src/openvpn/basic.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef BASIC_H
diff --git a/src/openvpn/block_dns.c b/src/openvpn/block_dns.c
index d43cbcf..e31765e 100644
--- a/src/openvpn/block_dns.c
+++ b/src/openvpn/block_dns.c
@@ -18,9 +18,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -109,9 +110,6 @@ DEFINE_GUID(
 
 static WCHAR *FIREWALL_NAME = L"OpenVPN";
 
-VOID NETIOAPI_API_
-InitializeIpInterfaceEntry(PMIB_IPINTERFACE_ROW Row);
-
 /*
  * Default msg handler does nothing
  */
@@ -343,79 +341,4 @@ delete_block_dns_filters(HANDLE engine_handle)
     return err;
 }
 
-/*
- * Returns interface metric value for specified interface index.
- *
- * Arguments:
- *   index         : The index of TAP adapter.
- *   family        : Address family (AF_INET for IPv4 and AF_INET6 for IPv6).
- * Returns positive metric value or zero for automatic metric on success,
- * a less then zero error code on failure.
- */
-
-int
-get_interface_metric(const NET_IFINDEX index, const ADDRESS_FAMILY family)
-{
-    DWORD err = 0;
-    MIB_IPINTERFACE_ROW ipiface;
-    InitializeIpInterfaceEntry(&ipiface);
-    ipiface.Family = family;
-    ipiface.InterfaceIndex = index;
-    err = GetIpInterfaceEntry(&ipiface);
-    if (err == NO_ERROR)
-    {
-        if (ipiface.UseAutomaticMetric)
-        {
-            return 0;
-        }
-        return ipiface.Metric;
-    }
-    return -err;
-}
-
-/*
- * Sets interface metric value for specified interface index.
- *
- * Arguments:
- *   index         : The index of TAP adapter.
- *   family        : Address family (AF_INET for IPv4 and AF_INET6 for IPv6).
- *   metric        : Metric value. 0 for automatic metric.
- * Returns 0 on success, a non-zero status code of the last failed action on failure.
- */
-
-DWORD
-set_interface_metric(const NET_IFINDEX index, const ADDRESS_FAMILY family,
-                     const ULONG metric)
-{
-    DWORD err = 0;
-    MIB_IPINTERFACE_ROW ipiface;
-    InitializeIpInterfaceEntry(&ipiface);
-    ipiface.Family = family;
-    ipiface.InterfaceIndex = index;
-    err = GetIpInterfaceEntry(&ipiface);
-    if (err == NO_ERROR)
-    {
-        if (family == AF_INET)
-        {
-            /* required for IPv4 as per MSDN */
-            ipiface.SitePrefixLength = 0;
-        }
-        ipiface.Metric = metric;
-        if (metric == 0)
-        {
-            ipiface.UseAutomaticMetric = TRUE;
-        }
-        else
-        {
-            ipiface.UseAutomaticMetric = FALSE;
-        }
-        err = SetIpInterfaceEntry(&ipiface);
-        if (err == NO_ERROR)
-        {
-            return 0;
-        }
-    }
-    return err;
-}
-
 #endif /* ifdef _WIN32 */
diff --git a/src/openvpn/block_dns.h b/src/openvpn/block_dns.h
index c4b6693..a7dadc4 100644
--- a/src/openvpn/block_dns.h
+++ b/src/openvpn/block_dns.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef _WIN32
@@ -26,9 +27,6 @@
 #ifndef OPENVPN_BLOCK_DNS_H
 #define OPENVPN_BLOCK_DNS_H
 
-/* Any value less than 5 should work fine. 3 is choosen without any real reason. */
-#define BLOCK_DNS_IFACE_METRIC 3
-
 typedef void (*block_dns_msg_handler_t) (DWORD err, const char *msg);
 
 DWORD
@@ -38,32 +36,5 @@ DWORD
 add_block_dns_filters(HANDLE *engine, int iface_index, const WCHAR *exe_path,
                       block_dns_msg_handler_t msg_handler_callback);
 
-/**
- * Returns interface metric value for specified interface index.
- *
- * @param index The index of TAP adapter
- * @param family Address family (AF_INET for IPv4 and AF_INET6 for IPv6)
- *
- * @return positive metric value or zero for automatic metric on success,
- * a less then zero error code on failure.
- */
-
-int
-get_interface_metric(const NET_IFINDEX index, const ADDRESS_FAMILY family);
-
-/**
- * Sets interface metric value for specified interface index.
- *
- * @param index The index of TAP adapter
- * @param family Address family (AF_INET for IPv4 and AF_INET6 for IPv6)
- * @param metric Metric value. 0 for automatic metric
- *
- * @return 0 on success, a non-zero status code of the last failed action on failure.
- */
-
-DWORD
-set_interface_metric(const NET_IFINDEX index, const ADDRESS_FAMILY family,
-                     const ULONG metric);
-
 #endif
 #endif
diff --git a/src/openvpn/buffer.c b/src/openvpn/buffer.c
index 87e27ec..2defd18 100644
--- a/src/openvpn/buffer.c
+++ b/src/openvpn/buffer.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -442,9 +443,7 @@ gc_transfer(struct gc_arena *dest, struct gc_arena *src)
         if (e)
         {
             while (e->next != NULL)
-            {
                 e = e->next;
-            }
             e->next = dest->list;
             dest->list = src->list;
             src->list = NULL;
@@ -600,8 +599,7 @@ void
 rm_trailing_chars(char *str, const char *what_to_delete)
 {
     bool modified;
-    do
-    {
+    do {
         const int len = strlen(str);
         modified = false;
         if (len > 0)
@@ -684,9 +682,7 @@ string_array_len(const char **array)
     if (array)
     {
         while (array[i])
-        {
             ++i;
-        }
     }
     return i;
 }
@@ -1324,9 +1320,7 @@ buffer_list_file(const char *fn, int max_line_len)
         {
             bl = buffer_list_new(0);
             while (fgets(line, max_line_len, fp) != NULL)
-            {
                 buffer_list_push(bl, (unsigned char *)line);
-            }
             free(line);
         }
         fclose(fp);
diff --git a/src/openvpn/buffer.h b/src/openvpn/buffer.h
index 8bc4428..28b224e 100644
--- a/src/openvpn/buffer.h
+++ b/src/openvpn/buffer.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef BUFFER_H
@@ -403,9 +404,7 @@ secure_memzero(void *data, size_t len)
 #else
     volatile char *p = (volatile char *) data;
     while (len--)
-    {
         *p++ = 0;
-    }
 #endif
 }
 
diff --git a/src/openvpn/circ_list.h b/src/openvpn/circ_list.h
index 386e18d..ecf2a7f 100644
--- a/src/openvpn/circ_list.h
+++ b/src/openvpn/circ_list.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef CIRC_LIST_H
diff --git a/src/openvpn/clinat.c b/src/openvpn/clinat.c
index 633cec6..9158437 100644
--- a/src/openvpn/clinat.c
+++ b/src/openvpn/clinat.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/clinat.h b/src/openvpn/clinat.h
index e0cfad5..cdaf2a8 100644
--- a/src/openvpn/clinat.h
+++ b/src/openvpn/clinat.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #if !defined(CLINAT_H)
diff --git a/src/openvpn/common.h b/src/openvpn/common.h
index bb08c01..cd988d4 100644
--- a/src/openvpn/common.h
+++ b/src/openvpn/common.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef COMMON_H
diff --git a/src/openvpn/comp-lz4.c b/src/openvpn/comp-lz4.c
index 6e40c32..fa65f87 100644
--- a/src/openvpn/comp-lz4.c
+++ b/src/openvpn/comp-lz4.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -315,7 +316,6 @@ const struct compress_alg lz4v2_alg = {
 
 #else  /* if defined(ENABLE_LZ4) */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_LZ4 */
diff --git a/src/openvpn/comp-lz4.h b/src/openvpn/comp-lz4.h
index c256ba5..8621e93 100644
--- a/src/openvpn/comp-lz4.h
+++ b/src/openvpn/comp-lz4.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef OPENVPN_COMP_LZ4_H
diff --git a/src/openvpn/comp.c b/src/openvpn/comp.c
index 4cda7e5..0182a7c 100644
--- a/src/openvpn/comp.c
+++ b/src/openvpn/comp.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/comp.h b/src/openvpn/comp.h
index e56fd2b..3c0b18e 100644
--- a/src/openvpn/comp.h
+++ b/src/openvpn/comp.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/compstub.c b/src/openvpn/compstub.c
index ca90924..5070c82 100644
--- a/src/openvpn/compstub.c
+++ b/src/openvpn/compstub.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -178,7 +179,6 @@ const struct compress_alg comp_stub_alg = {
 
 #else  /* if defined(USE_COMP) */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* USE_STUB */
diff --git a/src/openvpn/console.c b/src/openvpn/console.c
index eb6944d..90c8a94 100644
--- a/src/openvpn/console.c
+++ b/src/openvpn/console.c
@@ -18,9 +18,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -48,8 +49,7 @@ query_user_clear()
 {
     int i;
 
-    for (i = 0; i < QUERY_USER_NUMSLOTS; i++)
-    {
+    for (i = 0; i < QUERY_USER_NUMSLOTS; i++) {
         CLEAR(query_user[i]);
     }
 }
@@ -68,8 +68,7 @@ query_user_add(char *prompt, size_t prompt_len,
     ASSERT( prompt_len > 0 && prompt != NULL && resp_len > 0 && resp != NULL );
 
     /* Seek to the last unused slot */
-    for (i = 0; i < QUERY_USER_NUMSLOTS; i++)
-    {
+    for (i = 0; i < QUERY_USER_NUMSLOTS; i++) {
         if (query_user[i].prompt == NULL)
         {
             break;
diff --git a/src/openvpn/console.h b/src/openvpn/console.h
index aa51e6f..2c7f3e9 100644
--- a/src/openvpn/console.h
+++ b/src/openvpn/console.h
@@ -18,10 +18,11 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
 
 #ifndef CONSOLE_H
 #define CONSOLE_H
diff --git a/src/openvpn/console_builtin.c b/src/openvpn/console_builtin.c
index 7b95da9..13b9d7e 100644
--- a/src/openvpn/console_builtin.c
+++ b/src/openvpn/console_builtin.c
@@ -18,9 +18,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/console_systemd.c b/src/openvpn/console_systemd.c
index 8cee8c8..1c0aa4c 100644
--- a/src/openvpn/console_systemd.c
+++ b/src/openvpn/console_systemd.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 5f482d0..0dba7ca 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -64,8 +65,7 @@
 
 static void
 openvpn_encrypt_aead(struct buffer *buf, struct buffer work,
-                     struct crypto_options *opt)
-{
+                     struct crypto_options *opt) {
 #ifdef HAVE_AEAD_CIPHER_MODES
     struct gc_arena gc;
     int outlen = 0;
@@ -332,8 +332,7 @@ openvpn_encrypt(struct buffer *buf, struct buffer work,
 bool
 crypto_check_replay(struct crypto_options *opt,
                     const struct packet_id_net *pin, const char *error_prefix,
-                    struct gc_arena *gc)
-{
+                    struct gc_arena *gc) {
     bool ret = false;
     packet_id_reap_test(&opt->packet_id.rec);
     if (packet_id_test(&opt->packet_id.rec, pin))
@@ -808,10 +807,7 @@ init_key_type(struct key_type *kt, const char *ciphername,
     {
         if (warn)
         {
-            msg(M_WARN, "******* WARNING *******: '--cipher none' was specified. "
-                "This means NO encryption will be performed and tunnelled "
-                "data WILL be transmitted in clear text over the network! "
-                "PLEASE DO RECONSIDER THIS SETTING!");
+            msg(M_WARN, "******* WARNING *******: null cipher specified, no encryption will be used");
         }
     }
     if (strcmp(authname, "none") != 0)
@@ -831,11 +827,7 @@ init_key_type(struct key_type *kt, const char *ciphername,
     {
         if (warn)
         {
-            msg(M_WARN, "******* WARNING *******: '--auth none' was specified. "
-                "This means no authentication will be performed on received "
-                "packets, meaning you CANNOT trust that the data received by "
-                "the remote side have NOT been manipulated. "
-                "PLEASE DO RECONSIDER THIS SETTING!");
+            msg(M_WARN, "******* WARNING *******: null MAC specified, no authentication will be used");
         }
     }
 }
@@ -851,7 +843,7 @@ init_key_ctx(struct key_ctx *ctx, struct key *key,
     if (kt->cipher && kt->cipher_length > 0)
     {
 
-        ctx->cipher = cipher_ctx_new();
+        ALLOC_OBJ(ctx->cipher, cipher_ctx_t);
         cipher_ctx_init(ctx->cipher, key->cipher, kt->cipher_length,
                         kt->cipher, enc);
 
@@ -875,7 +867,7 @@ init_key_ctx(struct key_ctx *ctx, struct key *key,
     }
     if (kt->digest && kt->hmac_length > 0)
     {
-        ctx->hmac = hmac_ctx_new();
+        ALLOC_OBJ(ctx->hmac, hmac_ctx_t);
         hmac_ctx_init(ctx->hmac, key->hmac, kt->hmac_length, kt->digest);
 
         msg(D_HANDSHAKE,
@@ -900,13 +892,13 @@ free_key_ctx(struct key_ctx *ctx)
     if (ctx->cipher)
     {
         cipher_ctx_cleanup(ctx->cipher);
-        cipher_ctx_free(ctx->cipher);
+        free(ctx->cipher);
         ctx->cipher = NULL;
     }
     if (ctx->hmac)
     {
         hmac_ctx_cleanup(ctx->hmac);
-        hmac_ctx_free(ctx->hmac);
+        free(ctx->hmac);
         ctx->hmac = NULL;
     }
     ctx->implicit_iv_len = 0;
@@ -1030,8 +1022,7 @@ generate_key_random(struct key *key, const struct key_type *kt)
 
     struct gc_arena gc = gc_new();
 
-    do
-    {
+    do {
         CLEAR(*key);
         if (kt)
         {
@@ -1807,8 +1798,7 @@ get_random()
 }
 
 static const cipher_name_pair *
-get_cipher_name_pair(const char *cipher_name)
-{
+get_cipher_name_pair(const char *cipher_name) {
     const cipher_name_pair *pair;
     size_t i = 0;
 
@@ -1828,8 +1818,7 @@ get_cipher_name_pair(const char *cipher_name)
 }
 
 const char *
-translate_cipher_name_from_openvpn(const char *cipher_name)
-{
+translate_cipher_name_from_openvpn(const char *cipher_name) {
     const cipher_name_pair *pair = get_cipher_name_pair(cipher_name);
 
     if (NULL == pair)
@@ -1841,8 +1830,7 @@ translate_cipher_name_from_openvpn(const char *cipher_name)
 }
 
 const char *
-translate_cipher_name_to_openvpn(const char *cipher_name)
-{
+translate_cipher_name_to_openvpn(const char *cipher_name) {
     const cipher_name_pair *pair = get_cipher_name_pair(cipher_name);
 
     if (NULL == pair)
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index 8818c01..61e9b59 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -131,9 +132,9 @@
 #include "packet_id.h"
 #include "mtu.h"
 
-/** Wrapper struct to pass around SHA256 digests */
-struct sha256_digest {
-    uint8_t digest[SHA256_DIGEST_LENGTH];
+/** Wrapper struct to pass around MD5 digests */
+struct md5_digest {
+    uint8_t digest[MD5_DIGEST_LENGTH];
 };
 
 /*
@@ -495,8 +496,7 @@ void crypto_read_openvpn_key(const struct key_type *key_type,
  * Returns 0 when data is equal, non-zero otherwise.
  */
 static inline int
-memcmp_constant_time(const void *a, const void *b, size_t size)
-{
+memcmp_constant_time(const void *a, const void *b, size_t size) {
     const uint8_t *a1 = a;
     const uint8_t *b1 = b;
     int ret = 0;
diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h
index b7f519b..2c79baa 100644
--- a/src/openvpn/crypto_backend.h
+++ b/src/openvpn/crypto_backend.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -46,12 +47,6 @@
 /* Maximum HMAC digest size (bytes) */
 #define OPENVPN_MAX_HMAC_SIZE   64
 
-/** Types referencing specific message digest hashing algorithms */
-typedef enum {
-    MD_SHA1,
-    MD_SHA256
-} hash_algo_type ;
-
 /** Struct used in cipher name translation table */
 typedef struct {
     const char *openvpn_name;   /**< Cipher name used by OpenVPN */
@@ -300,20 +295,6 @@ bool cipher_kt_mode_aead(const cipher_kt_t *cipher);
  */
 
 /**
- * Allocate a new cipher context
- *
- * @return              a new cipher context
- */
-cipher_ctx_t *cipher_ctx_new(void);
-
-/**
- * Free a cipher context
- *
- * @param ctx           Cipher context.
- */
-void cipher_ctx_free(cipher_ctx_t *ctx);
-
-/**
  * Initialise a cipher context, based on the given key and key type.
  *
  * @param ctx           Cipher context. May not be NULL
@@ -521,20 +502,6 @@ int md_kt_size(const md_kt_t *kt);
 int md_full(const md_kt_t *kt, const uint8_t *src, int src_len, uint8_t *dst);
 
 /*
- * Allocate a new message digest context
- *
- * @return              a new zeroed MD context
- */
-md_ctx_t *md_ctx_new(void);
-
-/*
- * Free an existing, non-null message digest context
- *
- * @param ctx           Message digest context
- */
-void md_ctx_free(md_ctx_t *ctx);
-
-/*
  * Initialises the given message digest context.
  *
  * @param ctx           Message digest context
@@ -583,20 +550,6 @@ void md_ctx_final(md_ctx_t *ctx, uint8_t *dst);
  */
 
 /*
- * Create a new HMAC context
- *
- * @return              A new HMAC context
- */
-hmac_ctx_t *hmac_ctx_new(void);
-
-/*
- * Free an existing HMAC context
- *
- * @param  ctx           HMAC context to free
- */
-void hmac_ctx_free(hmac_ctx_t *ctx);
-
-/*
  * Initialises the given HMAC context, using the given digest
  * and key.
  *
diff --git a/src/openvpn/crypto_mbedtls.c b/src/openvpn/crypto_mbedtls.c
index 24bc315..942684c 100644
--- a/src/openvpn/crypto_mbedtls.c
+++ b/src/openvpn/crypto_mbedtls.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -508,19 +509,6 @@ cipher_kt_mode_aead(const cipher_kt_t *cipher)
  *
  */
 
-mbedtls_cipher_context_t *
-cipher_ctx_new(void)
-{
-    mbedtls_cipher_context_t *ctx;
-    ALLOC_OBJ(ctx, mbedtls_cipher_context_t);
-    return ctx;
-}
-
-void
-cipher_ctx_free(mbedtls_cipher_context_t *ctx)
-{
-    free(ctx);
-}
 
 void
 cipher_ctx_init(mbedtls_cipher_context_t *ctx, uint8_t *key, int key_len,
@@ -778,18 +766,6 @@ md_full(const md_kt_t *kt, const uint8_t *src, int src_len, uint8_t *dst)
     return 0 == mbedtls_md(kt, src, src_len, dst);
 }
 
-mbedtls_md_context_t *
-md_ctx_new(void)
-{
-    mbedtls_md_context_t *ctx;
-    ALLOC_OBJ_CLEAR(ctx, mbedtls_md_context_t);
-    return ctx;
-}
-
-void md_ctx_free(mbedtls_md_context_t *ctx)
-{
-    free(ctx);
-}
 
 void
 md_ctx_init(mbedtls_md_context_t *ctx, const mbedtls_md_info_t *kt)
@@ -840,21 +816,6 @@ md_ctx_final(mbedtls_md_context_t *ctx, uint8_t *dst)
 /*
  * TODO: re-enable dmsg for crypto debug
  */
-
-mbedtls_md_context_t *
-hmac_ctx_new(void)
-{
-    mbedtls_md_context_t *ctx;
-    ALLOC_OBJ(ctx, mbedtls_md_context_t);
-    return ctx;
-}
-
-void
-hmac_ctx_free(mbedtls_md_context_t *ctx)
-{
-    free(ctx);
-}
-
 void
 hmac_ctx_init(mbedtls_md_context_t *ctx, const uint8_t *key, int key_len,
               const mbedtls_md_info_t *kt)
diff --git a/src/openvpn/crypto_mbedtls.h b/src/openvpn/crypto_mbedtls.h
index a434ce3..d9b1446 100644
--- a/src/openvpn/crypto_mbedtls.h
+++ b/src/openvpn/crypto_mbedtls.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -72,7 +73,6 @@ typedef mbedtls_md_context_t hmac_ctx_t;
 #define MD4_DIGEST_LENGTH       16
 #define MD5_DIGEST_LENGTH       16
 #define SHA_DIGEST_LENGTH       20
-#define SHA256_DIGEST_LENGTH    32
 #define DES_KEY_LENGTH 8
 
 /**
@@ -122,8 +122,7 @@ bool mbed_log_func_line(unsigned int flags, int errval, const char *func,
 /** Wraps mbed_log_func_line() to prevent function calls for non-errors */
 static inline bool
 mbed_log_func_line_lite(unsigned int flags, int errval,
-                        const char *func, int line)
-{
+                        const char *func, int line) {
     if (errval)
     {
         return mbed_log_func_line(flags, errval, func, line);
diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
index a55e65c..b016d98 100644
--- a/src/openvpn/crypto_openssl.c
+++ b/src/openvpn/crypto_openssl.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -41,7 +42,6 @@
 #include "integer.h"
 #include "crypto.h"
 #include "crypto_backend.h"
-#include "openssl_compat.h"
 
 #include <openssl/des.h>
 #include <openssl/err.h>
@@ -186,14 +186,14 @@ crypto_clear_error(void)
 }
 
 void
-crypto_print_openssl_errors(const unsigned int flags)
-{
+crypto_print_openssl_errors(const unsigned int flags) {
     size_t err = 0;
 
     while ((err = ERR_get_error()))
     {
         /* Be more clear about frequently occurring "no shared cipher" error */
-        if (ERR_GET_REASON(err) == SSL_R_NO_SHARED_CIPHER)
+        if (err == ERR_PACK(ERR_LIB_SSL,SSL_F_SSL3_GET_CLIENT_HELLO,
+                            SSL_R_NO_SHARED_CIPHER))
         {
             msg(D_CRYPT_ERRORS, "TLS error: The server has no TLS ciphersuites "
                 "in common with the client. Your --tls-cipher setting might be "
@@ -286,7 +286,8 @@ show_available_ciphers()
     size_t i;
 
     /* If we ever exceed this, we must be more selective */
-    const EVP_CIPHER *cipher_list[1000];
+    const size_t cipher_list_len = 1000;
+    const EVP_CIPHER *cipher_list[cipher_list_len];
     size_t num_ciphers = 0;
 #ifndef ENABLE_SMALL
     printf("The following ciphers and cipher modes are available for use\n"
@@ -311,7 +312,7 @@ show_available_ciphers()
         {
             cipher_list[num_ciphers++] = cipher;
         }
-        if (num_ciphers == (sizeof(cipher_list)/sizeof(*cipher_list)))
+        if (num_ciphers == cipher_list_len)
         {
             msg(M_WARN, "WARNING: Too many ciphers, not showing all");
             break;
@@ -550,10 +551,8 @@ cipher_kt_iv_size(const EVP_CIPHER *cipher_kt)
 }
 
 int
-cipher_kt_block_size(const EVP_CIPHER *cipher)
-{
-    /*
-     * OpenSSL reports OFB/CFB/GCM cipher block sizes as '1 byte'.  To work
+cipher_kt_block_size(const EVP_CIPHER *cipher) {
+    /* OpenSSL reports OFB/CFB/GCM cipher block sizes as '1 byte'.  To work
      * around that, try to replace the mode with 'CBC' and return the block size
      * reported for that cipher, if possible.  If that doesn't work, just return
      * the value reported by OpenSSL.
@@ -650,19 +649,6 @@ cipher_kt_mode_aead(const cipher_kt_t *cipher)
  *
  */
 
-cipher_ctx_t *
-cipher_ctx_new(void)
-{
-    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
-    check_malloc_return(ctx);
-    return ctx;
-}
-
-void
-cipher_ctx_free(EVP_CIPHER_CTX *ctx)
-{
-    EVP_CIPHER_CTX_free(ctx);
-}
 
 void
 cipher_ctx_init(EVP_CIPHER_CTX *ctx, uint8_t *key, int key_len,
@@ -670,6 +656,8 @@ cipher_ctx_init(EVP_CIPHER_CTX *ctx, uint8_t *key, int key_len,
 {
     ASSERT(NULL != kt && NULL != ctx);
 
+    CLEAR(*ctx);
+
     EVP_CIPHER_CTX_init(ctx);
     if (!EVP_CipherInit(ctx, kt, NULL, NULL, enc))
     {
@@ -681,7 +669,7 @@ cipher_ctx_init(EVP_CIPHER_CTX *ctx, uint8_t *key, int key_len,
         crypto_msg(M_FATAL, "EVP set key size");
     }
 #endif
-    if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, NULL, enc))
+    if (!EVP_CipherInit(ctx, NULL, key, NULL, enc))
     {
         crypto_msg(M_FATAL, "EVP cipher init #2");
     }
@@ -734,7 +722,7 @@ cipher_ctx_get_cipher_kt(const cipher_ctx_t *ctx)
 int
 cipher_ctx_reset(EVP_CIPHER_CTX *ctx, uint8_t *iv_buf)
 {
-    return EVP_CipherInit_ex(ctx, NULL, NULL, NULL, iv_buf, -1);
+    return EVP_CipherInit(ctx, NULL, NULL, iv_buf, -1);
 }
 
 int
@@ -855,24 +843,13 @@ md_full(const EVP_MD *kt, const uint8_t *src, int src_len, uint8_t *dst)
     return EVP_Digest(src, src_len, dst, &in_md_len, kt, NULL);
 }
 
-EVP_MD_CTX *
-md_ctx_new(void)
-{
-    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
-    check_malloc_return(ctx);
-    return ctx;
-}
-
-void md_ctx_free(EVP_MD_CTX *ctx)
-{
-    EVP_MD_CTX_free(ctx);
-}
-
 void
 md_ctx_init(EVP_MD_CTX *ctx, const EVP_MD *kt)
 {
     ASSERT(NULL != ctx && NULL != kt);
 
+    CLEAR(*ctx);
+
     EVP_MD_CTX_init(ctx);
     EVP_DigestInit(ctx, kt);
 }
@@ -880,7 +857,7 @@ md_ctx_init(EVP_MD_CTX *ctx, const EVP_MD *kt)
 void
 md_ctx_cleanup(EVP_MD_CTX *ctx)
 {
-    EVP_MD_CTX_reset(ctx);
+    EVP_MD_CTX_cleanup(ctx);
 }
 
 int
@@ -910,19 +887,6 @@ md_ctx_final(EVP_MD_CTX *ctx, uint8_t *dst)
  *
  */
 
-HMAC_CTX *
-hmac_ctx_new(void)
-{
-    HMAC_CTX *ctx = HMAC_CTX_new();
-    check_malloc_return(ctx);
-    return ctx;
-}
-
-void
-hmac_ctx_free(HMAC_CTX *ctx)
-{
-    HMAC_CTX_free(ctx);
-}
 
 void
 hmac_ctx_init(HMAC_CTX *ctx, const uint8_t *key, int key_len,
@@ -930,6 +894,8 @@ hmac_ctx_init(HMAC_CTX *ctx, const uint8_t *key, int key_len,
 {
     ASSERT(NULL != kt && NULL != ctx);
 
+    CLEAR(*ctx);
+
     HMAC_CTX_init(ctx);
     HMAC_Init_ex(ctx, key, key_len, kt, NULL);
 
@@ -940,7 +906,7 @@ hmac_ctx_init(HMAC_CTX *ctx, const uint8_t *key, int key_len,
 void
 hmac_ctx_cleanup(HMAC_CTX *ctx)
 {
-    HMAC_CTX_reset(ctx);
+    HMAC_CTX_cleanup(ctx);
 }
 
 int
diff --git a/src/openvpn/crypto_openssl.h b/src/openvpn/crypto_openssl.h
index 60a2812..56ec6e1 100644
--- a/src/openvpn/crypto_openssl.h
+++ b/src/openvpn/crypto_openssl.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -32,7 +33,6 @@
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/md5.h>
-#include <openssl/sha.h>
 
 /** Generic cipher key type %context. */
 typedef EVP_CIPHER cipher_kt_t;
diff --git a/src/openvpn/cryptoapi.c b/src/openvpn/cryptoapi.c
index d90cc5d..69a5a32 100644
--- a/src/openvpn/cryptoapi.c
+++ b/src/openvpn/cryptoapi.c
@@ -281,9 +281,7 @@ rsa_priv_enc(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, i
     }
     /* and now, we have to reverse the byte-order in the result from CryptSignHash()... */
     for (i = 0; i < len; i++)
-    {
         to[i] = buf[len - i - 1];
-    }
     free(buf);
 
     CryptDestroyHash(hash);
@@ -391,9 +389,7 @@ find_certificate_in_store(const char *cert_prop, HCERTSTORE cert_store)
             }
             hash[i] = x;
             /* skip any space(s) between hex numbers */
-            for (p++; *p && *p == ' '; p++)
-            {
-            }
+            for (p++; *p && *p == ' '; p++) ;
         }
         blob.cbData = i;
         blob.pbData = (unsigned char *) &hash;
@@ -551,8 +547,7 @@ err:
 #else  /* ifdef ENABLE_CRYPTOAPI */
 #ifdef _MSC_VER  /* Dummy function needed to avoid empty file compiler warning in Microsoft VC */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif
 #endif                          /* _WIN32 */
diff --git a/src/openvpn/dhcp.c b/src/openvpn/dhcp.c
index a2a5454..c17a22e 100644
--- a/src/openvpn/dhcp.c
+++ b/src/openvpn/dhcp.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -159,20 +160,17 @@ udp_checksum(const uint8_t *buf,
 
     /* make 16 bit words out of every two adjacent 8 bit words and  */
     /* calculate the sum of all 16 bit words */
-    for (i = 0; i < len_udp; i += 2)
-    {
+    for (i = 0; i < len_udp; i += 2) {
         word16 = ((buf[i] << 8) & 0xFF00) + ((i + 1 < len_udp) ? (buf[i+1] & 0xFF) : 0);
         sum += word16;
     }
 
     /* add the UDP pseudo header which contains the IP source and destination addresses */
-    for (i = 0; i < 4; i += 2)
-    {
+    for (i = 0; i < 4; i += 2) {
         word16 = ((src_addr[i] << 8) & 0xFF00) + (src_addr[i+1] & 0xFF);
         sum += word16;
     }
-    for (i = 0; i < 4; i += 2)
-    {
+    for (i = 0; i < 4; i += 2) {
         word16 = ((dest_addr[i] << 8) & 0xFF00) + (dest_addr[i+1] & 0xFF);
         sum += word16;
     }
@@ -182,9 +180,7 @@ udp_checksum(const uint8_t *buf,
 
     /* keep only the last 16 bits of the 32 bit calculated sum and add the carries */
     while (sum >> 16)
-    {
         sum = (sum & 0xFFFF) + (sum >> 16);
-    }
 
     /* Take the one's complement of sum */
     return ((uint16_t) ~sum);
diff --git a/src/openvpn/dhcp.h b/src/openvpn/dhcp.h
index dc41658..d406870 100644
--- a/src/openvpn/dhcp.h
+++ b/src/openvpn/dhcp.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef DHCP_H
diff --git a/src/openvpn/errlevel.h b/src/openvpn/errlevel.h
index 5bb043b..c4dd518 100644
--- a/src/openvpn/errlevel.h
+++ b/src/openvpn/errlevel.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef ERRLEVEL_H
diff --git a/src/openvpn/error.c b/src/openvpn/error.c
index ce50ff9..e78f272 100644
--- a/src/openvpn/error.c
+++ b/src/openvpn/error.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -835,8 +836,7 @@ strerror_win32(DWORD errnum, struct gc_arena *gc)
      * Posix equivalents.
      */
 #if 1
-    switch (errnum)
-    {
+    switch (errnum) {
         /*
          * When the TAP-Windows driver returns STATUS_UNSUCCESSFUL, this code
          * gets returned to user space.
diff --git a/src/openvpn/error.h b/src/openvpn/error.h
index 14ef7e6..df4eee7 100644
--- a/src/openvpn/error.h
+++ b/src/openvpn/error.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef ERROR_H
@@ -393,8 +394,7 @@ ignore_sys_error(const int err)
 
 /** Convert fatal errors to nonfatal, don't touch other errors */
 static inline unsigned int
-nonfatal(const unsigned int err)
-{
+nonfatal(const unsigned int err) {
     return err & M_FATAL ? (err ^ M_FATAL) | M_NONFATAL : err;
 }
 
diff --git a/src/openvpn/event.c b/src/openvpn/event.c
index d123070..f4922e0 100644
--- a/src/openvpn/event.c
+++ b/src/openvpn/event.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -393,13 +394,11 @@ we_wait(struct event_set *es, const struct timeval *tv, struct event_set_return
     {
         int i;
         for (i = 0; i < wes->n_events; ++i)
-        {
             dmsg(D_EVENT_WAIT, "[%d] ev=%p rwflags=0x%04x arg=" ptr_format,
                  i,
                  wes->events[i],
                  wes->esr[i].rwflags,
                  (ptr_type)wes->esr[i].arg);
-        }
     }
 #endif
 
@@ -923,9 +922,7 @@ se_reset(struct event_set *es)
     FD_ZERO(&ses->readfds);
     FD_ZERO(&ses->writefds);
     for (i = 0; i <= ses->maxfd; ++i)
-    {
         ses->args[i] = NULL;
-    }
     ses->maxfd = -1;
 }
 
diff --git a/src/openvpn/event.h b/src/openvpn/event.h
index ff795f4..6a6e029 100644
--- a/src/openvpn/event.h
+++ b/src/openvpn/event.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef EVENT_H
diff --git a/src/openvpn/fdmisc.c b/src/openvpn/fdmisc.c
index 56e2250..401069d 100644
--- a/src/openvpn/fdmisc.c
+++ b/src/openvpn/fdmisc.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/fdmisc.h b/src/openvpn/fdmisc.h
index b6d7101..1e84a08 100644
--- a/src/openvpn/fdmisc.h
+++ b/src/openvpn/fdmisc.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef FD_MISC_H
diff --git a/src/openvpn/forward-inline.h b/src/openvpn/forward-inline.h
index ab83ea4..97e1cd6 100644
--- a/src/openvpn/forward-inline.h
+++ b/src/openvpn/forward-inline.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef FORWARD_INLINE_H
diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index 371ddca..2f3f3c5 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/forward.h b/src/openvpn/forward.h
index 9fde5a3..ae86e7a 100644
--- a/src/openvpn/forward.h
+++ b/src/openvpn/forward.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 
diff --git a/src/openvpn/fragment.c b/src/openvpn/fragment.c
index 38de62f..6fbfe08 100644
--- a/src/openvpn/fragment.c
+++ b/src/openvpn/fragment.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -43,9 +44,7 @@ fragment_list_buf_init(struct fragment_list *list, const struct frame *frame)
 {
     int i;
     for (i = 0; i < N_FRAG_BUF; ++i)
-    {
         list->fragments[i].buf = alloc_buf(BUF_SIZE(frame));
-    }
 }
 
 static void
@@ -53,9 +52,7 @@ fragment_list_buf_free(struct fragment_list *list)
 {
     int i;
     for (i = 0; i < N_FRAG_BUF; ++i)
-    {
         free_buf(&list->fragments[i].buf);
-    }
 }
 
 /*
@@ -70,9 +67,7 @@ fragment_list_get_buf(struct fragment_list *list, int seq_id)
     {
         int i;
         for (i = 0; i < N_FRAG_BUF; ++i)
-        {
             list->fragments[i].defined = false;
-        }
         list->index = 0;
         list->seq_id = seq_id;
         diff = 0;
@@ -438,7 +433,6 @@ fragment_wakeup(struct fragment_master *f, struct frame *frame)
 
 #else  /* ifdef ENABLE_FRAGMENT */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ifdef ENABLE_FRAGMENT */
diff --git a/src/openvpn/fragment.h b/src/openvpn/fragment.h
index 90ba8f7..a24b524 100644
--- a/src/openvpn/fragment.h
+++ b/src/openvpn/fragment.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef FRAGMENT_H
diff --git a/src/openvpn/gremlin.c b/src/openvpn/gremlin.c
index e85ce9c..5bff5e8 100644
--- a/src/openvpn/gremlin.c
+++ b/src/openvpn/gremlin.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -94,8 +95,7 @@ get_packet_flood_parms(int level)
  * Return true with probability 1/n
  */
 static bool
-flip(int n)
-{
+flip(int n) {
     return (get_random() % n) == 0;
 }
 
@@ -104,8 +104,7 @@ flip(int n)
  * low and high.
  */
 static int
-roll(int low, int high)
-{
+roll(int low, int high) {
     int ret;
     ASSERT(low <= high);
     ret = low + (get_random() % (high - low + 1));
@@ -182,8 +181,7 @@ ask_gremlin(int flags)
  * Possibly corrupt a packet.
  */
 void
-corrupt_gremlin(struct buffer *buf, int flags)
-{
+corrupt_gremlin(struct buffer *buf, int flags) {
     const int corrupt_level = GREMLIN_CORRUPT_LEVEL(flags);
     if (corrupt_level)
     {
@@ -196,8 +194,7 @@ corrupt_gremlin(struct buffer *buf, int flags)
                     uint8_t r = roll(0, 255);
                     int method = roll(0, 5);
 
-                    switch (method)
-                    {
+                    switch (method) {
                         case 0: /* corrupt the first byte */
                             *BPTR(buf) = r;
                             break;
@@ -235,7 +232,6 @@ corrupt_gremlin(struct buffer *buf, int flags)
 
 #else  /* ifdef ENABLE_DEBUG */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ifdef ENABLE_DEBUG */
diff --git a/src/openvpn/gremlin.h b/src/openvpn/gremlin.h
index 8b23b34..8f41864 100644
--- a/src/openvpn/gremlin.h
+++ b/src/openvpn/gremlin.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef GREMLIN_H
diff --git a/src/openvpn/helper.c b/src/openvpn/helper.c
index 17d1528..adcc4f8 100644
--- a/src/openvpn/helper.c
+++ b/src/openvpn/helper.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/helper.h b/src/openvpn/helper.h
index c5b438b..593d1ed 100644
--- a/src/openvpn/helper.h
+++ b/src/openvpn/helper.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/httpdigest.c b/src/openvpn/httpdigest.c
index c553f93..01301c0 100644
--- a/src/openvpn/httpdigest.c
+++ b/src/openvpn/httpdigest.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -43,8 +44,7 @@ CvtHex(
     unsigned short i;
     unsigned char j;
 
-    for (i = 0; i < HASHLEN; i++)
-    {
+    for (i = 0; i < HASHLEN; i++) {
         j = (Bin[i] >> 4) & 0xf;
         if (j <= 9)
         {
@@ -80,28 +80,27 @@ DigestCalcHA1(
     )
 {
     HASH HA1;
-    md_ctx_t *md5_ctx = md_ctx_new();
+    md_ctx_t md5_ctx;
     const md_kt_t *md5_kt = md_kt_get("MD5");
 
-    md_ctx_init(md5_ctx, md5_kt);
-    md_ctx_update(md5_ctx, (const uint8_t *) pszUserName, strlen(pszUserName));
-    md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-    md_ctx_update(md5_ctx, (const uint8_t *) pszRealm, strlen(pszRealm));
-    md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-    md_ctx_update(md5_ctx, (const uint8_t *) pszPassword, strlen(pszPassword));
-    md_ctx_final(md5_ctx, HA1);
+    md_ctx_init(&md5_ctx, md5_kt);
+    md_ctx_update(&md5_ctx, (const uint8_t *) pszUserName, strlen(pszUserName));
+    md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+    md_ctx_update(&md5_ctx, (const uint8_t *) pszRealm, strlen(pszRealm));
+    md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+    md_ctx_update(&md5_ctx, (const uint8_t *) pszPassword, strlen(pszPassword));
+    md_ctx_final(&md5_ctx, HA1);
     if (pszAlg && strcasecmp(pszAlg, "md5-sess") == 0)
     {
-        md_ctx_init(md5_ctx, md5_kt);
-        md_ctx_update(md5_ctx, HA1, HASHLEN);
-        md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-        md_ctx_update(md5_ctx, (const uint8_t *) pszNonce, strlen(pszNonce));
-        md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-        md_ctx_update(md5_ctx, (const uint8_t *) pszCNonce, strlen(pszCNonce));
-        md_ctx_final(md5_ctx, HA1);
+        md_ctx_init(&md5_ctx, md5_kt);
+        md_ctx_update(&md5_ctx, HA1, HASHLEN);
+        md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+        md_ctx_update(&md5_ctx, (const uint8_t *) pszNonce, strlen(pszNonce));
+        md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+        md_ctx_update(&md5_ctx, (const uint8_t *) pszCNonce, strlen(pszCNonce));
+        md_ctx_final(&md5_ctx, HA1);
     }
-    md_ctx_cleanup(md5_ctx);
-    md_ctx_free(md5_ctx);
+    md_ctx_cleanup(&md5_ctx);
     CvtHex(HA1, SessionKey);
 }
 
@@ -123,41 +122,40 @@ DigestCalcResponse(
     HASH RespHash;
     HASHHEX HA2Hex;
 
-    md_ctx_t *md5_ctx = md_ctx_new();
+    md_ctx_t md5_ctx;
     const md_kt_t *md5_kt = md_kt_get("MD5");
 
     /* calculate H(A2) */
-    md_ctx_init(md5_ctx, md5_kt);
-    md_ctx_update(md5_ctx, (const uint8_t *) pszMethod, strlen(pszMethod));
-    md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-    md_ctx_update(md5_ctx, (const uint8_t *) pszDigestUri, strlen(pszDigestUri));
+    md_ctx_init(&md5_ctx, md5_kt);
+    md_ctx_update(&md5_ctx, (const uint8_t *) pszMethod, strlen(pszMethod));
+    md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+    md_ctx_update(&md5_ctx, (const uint8_t *) pszDigestUri, strlen(pszDigestUri));
     if (strcasecmp(pszQop, "auth-int") == 0)
     {
-        md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-        md_ctx_update(md5_ctx, HEntity, HASHHEXLEN);
+        md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+        md_ctx_update(&md5_ctx, HEntity, HASHHEXLEN);
     }
-    md_ctx_final(md5_ctx, HA2);
+    md_ctx_final(&md5_ctx, HA2);
     CvtHex(HA2, HA2Hex);
 
     /* calculate response */
-    md_ctx_init(md5_ctx, md5_kt);
-    md_ctx_update(md5_ctx, HA1, HASHHEXLEN);
-    md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-    md_ctx_update(md5_ctx, (const uint8_t *) pszNonce, strlen(pszNonce));
-    md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
+    md_ctx_init(&md5_ctx, md5_kt);
+    md_ctx_update(&md5_ctx, HA1, HASHHEXLEN);
+    md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+    md_ctx_update(&md5_ctx, (const uint8_t *) pszNonce, strlen(pszNonce));
+    md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
     if (*pszQop)
     {
-        md_ctx_update(md5_ctx, (const uint8_t *) pszNonceCount, strlen(pszNonceCount));
-        md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-        md_ctx_update(md5_ctx, (const uint8_t *) pszCNonce, strlen(pszCNonce));
-        md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
-        md_ctx_update(md5_ctx, (const uint8_t *) pszQop, strlen(pszQop));
-        md_ctx_update(md5_ctx, (const uint8_t *) ":", 1);
+        md_ctx_update(&md5_ctx, (const uint8_t *) pszNonceCount, strlen(pszNonceCount));
+        md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+        md_ctx_update(&md5_ctx, (const uint8_t *) pszCNonce, strlen(pszCNonce));
+        md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
+        md_ctx_update(&md5_ctx, (const uint8_t *) pszQop, strlen(pszQop));
+        md_ctx_update(&md5_ctx, (const uint8_t *) ":", 1);
     }
-    md_ctx_update(md5_ctx, HA2Hex, HASHHEXLEN);
-    md_ctx_final(md5_ctx, RespHash);
-    md_ctx_cleanup(md5_ctx);
-    md_ctx_free(md5_ctx);
+    md_ctx_update(&md5_ctx, HA2Hex, HASHHEXLEN);
+    md_ctx_final(&md5_ctx, RespHash);
+    md_ctx_cleanup(&md5_ctx);
     CvtHex(RespHash, Response);
 }
 
diff --git a/src/openvpn/httpdigest.h b/src/openvpn/httpdigest.h
index aae7b8c..b074fb2 100644
--- a/src/openvpn/httpdigest.h
+++ b/src/openvpn/httpdigest.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #if PROXY_DIGEST_AUTH
diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index 0652ef4..cf4a64c 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -251,42 +252,31 @@ ce_management_query_remote(struct context *c)
 {
     struct gc_arena gc = gc_new();
     volatile struct connection_entry *ce = &c->options.ce;
-    int ce_changed = true; /* presume the connection entry will be changed */
-
+    int ret = true;
     update_time();
     if (management)
     {
         struct buffer out = alloc_buf_gc(256, &gc);
-
-        buf_printf(&out, ">REMOTE:%s,%s,%s", np(ce->remote), ce->remote_port,
-                   proto2ascii(ce->proto, ce->af, false));
+        buf_printf(&out, ">REMOTE:%s,%s,%s", np(ce->remote), ce->remote_port, proto2ascii(ce->proto, ce->af, false));
         management_notify_generic(management, BSTR(&out));
-
-        ce->flags &= ~(CE_MAN_QUERY_REMOTE_MASK << CE_MAN_QUERY_REMOTE_SHIFT);
-        ce->flags |= (CE_MAN_QUERY_REMOTE_QUERY << CE_MAN_QUERY_REMOTE_SHIFT);
-        while (((ce->flags >> CE_MAN_QUERY_REMOTE_SHIFT)
-                & CE_MAN_QUERY_REMOTE_MASK) == CE_MAN_QUERY_REMOTE_QUERY)
+        ce->flags &= ~(CE_MAN_QUERY_REMOTE_MASK<<CE_MAN_QUERY_REMOTE_SHIFT);
+        ce->flags |= (CE_MAN_QUERY_REMOTE_QUERY<<CE_MAN_QUERY_REMOTE_SHIFT);
+        while (((ce->flags>>CE_MAN_QUERY_REMOTE_SHIFT) & CE_MAN_QUERY_REMOTE_MASK) == CE_MAN_QUERY_REMOTE_QUERY)
         {
             management_event_loop_n_seconds(management, 1);
             if (IS_SIG(c))
             {
-                ce_changed = false; /* connection entry have not been set */
+                ret = false;
                 break;
             }
         }
     }
-    gc_free(&gc);
-
-    if (ce_changed)
     {
-        /* If it is likely a connection entry was modified,
-         * check what changed in the flags and that it was not skipped
-         */
-        const int flags = ((ce->flags >> CE_MAN_QUERY_REMOTE_SHIFT)
-                           & CE_MAN_QUERY_REMOTE_MASK);
-        ce_changed = (flags != CE_MAN_QUERY_REMOTE_SKIP);
+        const int flags = ((ce->flags>>CE_MAN_QUERY_REMOTE_SHIFT) & CE_MAN_QUERY_REMOTE_MASK);
+        ret = (flags != CE_MAN_QUERY_REMOTE_SKIP);
     }
-    return ce_changed;
+    gc_free(&gc);
+    return ret;
 }
 #endif /* ENABLE_MANAGEMENT */
 
@@ -341,8 +331,7 @@ next_connection_entry(struct context *c)
     struct connection_entry *ce;
     int n_cycles = 0;
 
-    do
-    {
+    do {
         ce_defined = true;
         if (c->options.no_advance && l->current >= 0)
         {
@@ -414,7 +403,11 @@ next_connection_entry(struct context *c)
                 break;
             }
         }
-        else if (ce_defined && management && management_query_proxy_enabled(management))
+        else
+#endif
+
+#ifdef ENABLE_MANAGEMENT
+        if (ce_defined && management && management_query_proxy_enabled(management))
         {
             ce_defined = ce_management_query_proxy(c);
             if (IS_SIG(c))
@@ -540,10 +533,8 @@ context_init_1(struct context *c)
         int i;
         pkcs11_initialize(true, c->options.pkcs11_pin_cache_period);
         for (i = 0; i<MAX_PARMS && c->options.pkcs11_providers[i] != NULL; i++)
-        {
             pkcs11_addProvider(c->options.pkcs11_providers[i], c->options.pkcs11_protected_authentication[i],
                                c->options.pkcs11_private_mode[i], c->options.pkcs11_cert_private[i]);
-        }
     }
 #endif
 
@@ -561,15 +552,6 @@ context_init_1(struct context *c)
     }
 #endif
 
-#ifdef ENABLE_SYSTEMD
-    /* We can report the PID via getpid() to systemd here as OpenVPN will not
-     * do any fork due to daemon() a future call.
-     * See possibly_become_daemon() [init.c] for more details.
-     */
-    sd_notifyf(0, "READY=1\nSTATUS=Pre-connection initialization successful\nMAINPID=%lu",
-               (unsigned long) getpid());
-#endif
-
 }
 
 void
@@ -632,9 +614,7 @@ init_static(void)
     {
         int i;
         for (i = 0; i < argc; ++i)
-        {
             msg(M_INFO, "argv[%d] = '%s'", i, argv[i]);
-        }
     }
 #endif
 
@@ -780,9 +760,7 @@ init_static(void)
                 {
                     int i;
                     for (i = 0; i < SIZE(text); ++i)
-                    {
                         buffer_list_push(bl, (unsigned char *)text[i]);
-                    }
                 }
                 printf("[cap=%d i=%d] *************************\n", listcap, iter);
                 if (!(iter & 8))
@@ -805,9 +783,7 @@ init_static(void)
                         int c;
                         printf("'");
                         while ((c = buf_read_u8(buf)) >= 0)
-                        {
                             putchar(c);
-                        }
                         printf("'\n");
                         buffer_list_advance(bl, 0);
                     }
@@ -1050,6 +1026,24 @@ do_uid_gid_chroot(struct context *c, bool no_delay)
         {
             if (no_delay)
             {
+#ifdef ENABLE_SYSTEMD
+                /* If OpenVPN is started by systemd, the OpenVPN process needs
+                 * to provide a preliminary status report to systemd.  This is
+                 * needed as $NOTIFY_SOCKET will not be available inside the
+                 * chroot, which sd_notify()/sd_notifyf() depends on.
+                 *
+                 * This approach is the simplest and the most non-intrusive
+                 * solution right before the 2.4_rc2 release.
+                 *
+                 * TODO: Consider altnernative solutions - bind mount?
+                 * systemd does not grok OpenVPN configuration files, thus cannot
+                 * have a sane way to know if OpenVPN will chroot or not and to
+                 * which subdirectory it will chroot into.
+                 */
+                sd_notifyf(0, "READY=1\n"
+                           "STATUS=Entering chroot, most of the init completed successfully\n"
+                           "MAINPID=%lu", (unsigned long) getpid());
+#endif
                 platform_chroot(c->options.chroot_dir);
             }
             else if (c->first_time)
@@ -1382,21 +1376,6 @@ initialization_sequence_completed(struct context *c, const unsigned int flags)
     /* If we delayed UID/GID downgrade or chroot, do it now */
     do_uid_gid_chroot(c, true);
 
-
-#ifdef ENABLE_CRYPTO
-    /*
-     * In some cases (i.e. when receiving auth-token via
-     * push-reply) the auth-nocache option configured on the
-     * client is overridden; for this reason we have to wait
-     * for the push-reply message before attempting to wipe
-     * the user/pass entered by the user
-     */
-    if (c->options.mode == MODE_POINT_TO_POINT)
-    {
-        delayed_auth_pass_purge();
-    }
-#endif /* ENABLE_CRYPTO */
-
     /* Test if errors */
     if (flags & ISC_ERRORS)
     {
@@ -1414,7 +1393,7 @@ initialization_sequence_completed(struct context *c, const unsigned int flags)
     else
     {
 #ifdef ENABLE_SYSTEMD
-        sd_notifyf(0, "STATUS=%s", message);
+        sd_notifyf(0, "READY=1\nSTATUS=%s\nMAINPID=%lu", message, (unsigned long) getpid());
 #endif
         msg(M_INFO, "%s", message);
     }
@@ -1851,7 +1830,7 @@ do_close_tun(struct context *c, bool force)
 #if defined(_WIN32)
             if (c->options.block_outside_dns)
             {
-                if (!win_wfp_uninit(adapter_index, c->options.msg_channel))
+                if (!win_wfp_uninit(c->options.msg_channel))
                 {
                     msg(M_FATAL, "Uninitialising WFP failed!");
                 }
@@ -1891,7 +1870,7 @@ do_close_tun(struct context *c, bool force)
 #if defined(_WIN32)
             if (c->options.block_outside_dns)
             {
-                if (!win_wfp_uninit(adapter_index, c->options.msg_channel))
+                if (!win_wfp_uninit(c->options.msg_channel))
                 {
                     msg(M_FATAL, "Uninitialising WFP failed!");
                 }
@@ -1924,12 +1903,12 @@ tun_abort()
  * equal, or either one is all-zeroes.
  */
 static bool
-options_hash_changed_or_zero(const struct sha256_digest *a,
-                             const struct sha256_digest *b)
+options_hash_changed_or_zero(const struct md5_digest *a,
+                             const struct md5_digest *b)
 {
-    const struct sha256_digest zero = {{0}};
-    return memcmp(a, b, sizeof(struct sha256_digest))
-           || !memcmp(a, &zero, sizeof(struct sha256_digest));
+    const struct md5_digest zero = {{0}};
+    return memcmp(a, b, sizeof(struct md5_digest))
+           || !memcmp(a, &zero, sizeof(struct md5_digest));
 }
 #endif /* P2MP */
 
@@ -1940,7 +1919,7 @@ do_up(struct context *c, bool pulled_options, unsigned int option_types_found)
     {
         reset_coarse_timers(c);
 
-        if (pulled_options)
+        if (pulled_options && option_types_found)
         {
             if (!do_deferred_options(c, option_types_found))
             {
@@ -2646,7 +2625,6 @@ do_init_crypto_tls(struct context *c, const unsigned int flags)
     memmove(to.remote_cert_ku, options->remote_cert_ku, sizeof(to.remote_cert_ku));
     to.remote_cert_eku = options->remote_cert_eku;
     to.verify_hash = options->verify_hash;
-    to.verify_hash_algo = options->verify_hash_algo;
 #ifdef ENABLE_X509ALTUSERNAME
     to.x509_username_field = (char *) options->x509_username_field;
 #else
@@ -2774,10 +2752,7 @@ do_init_crypto_none(const struct context *c)
 {
     ASSERT(!c->options.test_crypto);
     msg(M_WARN,
-        "******* WARNING *******: All encryption and authentication features "
-        "disabled -- All data will be tunnelled as clear text and will not be "
-        "protected against man-in-the-middle changes. "
-        "PLEASE DO RECONSIDER THIS CONFIGURATION!");
+        "******* WARNING *******: all encryption and authentication features disabled -- all data will be tunnelled as cleartext");
 }
 #endif /* ifdef ENABLE_CRYPTO */
 
@@ -3022,10 +2997,6 @@ do_option_warnings(struct context *c)
     {
         msg(M_WARN, "WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.");
     }
-    if (o->ns_cert_type)
-    {
-        msg(M_WARN, "WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.");
-    }
 #endif /* ifdef ENABLE_CRYPTO */
 
     /* If a script is used, print appropiate warnings */
diff --git a/src/openvpn/init.h b/src/openvpn/init.h
index 15feb67..3b97d84 100644
--- a/src/openvpn/init.h
+++ b/src/openvpn/init.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef INIT_H
diff --git a/src/openvpn/integer.h b/src/openvpn/integer.h
index 240781b..bae8f16 100644
--- a/src/openvpn/integer.h
+++ b/src/openvpn/integer.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef INTEGER_H
diff --git a/src/openvpn/interval.c b/src/openvpn/interval.c
index 1634386..99e72a0 100644
--- a/src/openvpn/interval.c
+++ b/src/openvpn/interval.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/interval.h b/src/openvpn/interval.h
index 8095c0b..5ed64a9 100644
--- a/src/openvpn/interval.h
+++ b/src/openvpn/interval.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -105,8 +106,7 @@ interval_schedule_wakeup(struct interval *top, interval_t *wakeup)
  * In wakeup seconds, interval_test will return true once.
  */
 static inline void
-interval_future_trigger(struct interval *top, interval_t wakeup)
-{
+interval_future_trigger(struct interval *top, interval_t wakeup) {
     if (wakeup)
     {
 #if INTERVAL_DEBUG
diff --git a/src/openvpn/list.c b/src/openvpn/list.c
index edca6f7..fb9f664 100644
--- a/src/openvpn/list.c
+++ b/src/openvpn/list.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -475,8 +476,7 @@ list_test(void)
             int inc = 0;
             int count = 0;
 
-            for (base = 0; base < hash_n_buckets(hash); base += inc)
-            {
+            for (base = 0; base < hash_n_buckets(hash); base += inc) {
                 struct hash_iterator hi;
                 struct hash_element *he;
                 inc = (get_random() % 3) + 1;
@@ -670,7 +670,6 @@ hash_func(const uint8_t *k, uint32_t length, uint32_t initval)
 
 #else  /* if P2MP_SERVER */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* P2MP_SERVER */
diff --git a/src/openvpn/list.h b/src/openvpn/list.h
index c808efa..6270f88 100644
--- a/src/openvpn/list.h
+++ b/src/openvpn/list.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef LIST_H
diff --git a/src/openvpn/lladdr.c b/src/openvpn/lladdr.c
index ff71e48..dce05ad 100644
--- a/src/openvpn/lladdr.c
+++ b/src/openvpn/lladdr.c
@@ -50,7 +50,7 @@ set_lladdr(const char *ifname, const char *lladdr,
                 "%s %s lladdr %s",
                 IFCONFIG_PATH,
                 ifname, lladdr);
-#elif defined(TARGET_FREEBSD)
+#elif defined(TARGET_FREEBSD) || defined(__FreeBSD_kernel__)
     argv_printf(&argv,
                 "%s %s ether %s",
                 IFCONFIG_PATH,
diff --git a/src/openvpn/lzo.c b/src/openvpn/lzo.c
index f754865..3d6891e 100644
--- a/src/openvpn/lzo.c
+++ b/src/openvpn/lzo.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -266,7 +267,6 @@ const struct compress_alg lzo_alg = {
 
 #else  /* if defined(ENABLE_LZO) */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_LZO */
diff --git a/src/openvpn/lzo.h b/src/openvpn/lzo.h
index deaeb8d..85937b2 100644
--- a/src/openvpn/lzo.h
+++ b/src/openvpn/lzo.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef OPENVPN_LZO_H
diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index c2e8dc7..763f6c6 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -1983,9 +1984,7 @@ man_process_command(struct management *man, const char *line)
         {
             int i;
             for (i = 0; i < nparms; ++i)
-            {
                 msg(M_INFO, "[%d] '%s'", i, parms[i]);
-            }
         }
 #endif
 
@@ -3089,8 +3088,7 @@ management_io(struct management *man)
                 if (net_events & FD_READ)
                 {
                     while (man_read(man) > 0)
-                    {
-                    }
+                        ;
                     net_event_win32_clear_selected_events(&man->connection.ne32, FD_READ);
                 }
 
@@ -3313,8 +3311,7 @@ man_wait_for_client_connection(struct management *man,
         {
             msg(D_MANAGEMENT, "Need information from management interface, waiting...");
         }
-        do
-        {
+        do {
             man_standalone_event_loop(man, signal_received, expire);
             if (signal_received && *signal_received)
             {
@@ -3932,9 +3929,7 @@ log_history_free_contents(struct log_history *h)
 {
     int i;
     for (i = 0; i < h->size; ++i)
-    {
         log_entry_free_contents(&h->array[log_index(h, i)]);
-    }
     free(h->array);
 }
 
@@ -3978,9 +3973,7 @@ log_history_resize(struct log_history *h, const int capacity)
         log_history_obj_init(&newlog, capacity);
 
         for (i = 0; i < h->size; ++i)
-        {
             log_history_add(&newlog, &h->array[log_index(h, i)]);
-        }
 
         log_history_free_contents(h);
         *h = newlog;
@@ -4002,7 +3995,6 @@ log_history_ref(const struct log_history *h, const int index)
 
 #else  /* ifdef ENABLE_MANAGEMENT */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_MANAGEMENT */
diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h
index 542cc07..6e5cb9b 100644
--- a/src/openvpn/manage.h
+++ b/src/openvpn/manage.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef MANAGE_H
diff --git a/src/openvpn/mbuf.c b/src/openvpn/mbuf.c
index fafbce0..7a23e59 100644
--- a/src/openvpn/mbuf.c
+++ b/src/openvpn/mbuf.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -173,7 +174,6 @@ mbuf_dereference_instance(struct mbuf_set *ms, struct multi_instance *mi)
 
 #else  /* if P2MP */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* P2MP */
diff --git a/src/openvpn/mbuf.h b/src/openvpn/mbuf.h
index e0643de..cfaef58 100644
--- a/src/openvpn/mbuf.h
+++ b/src/openvpn/mbuf.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef MBUF_H
diff --git a/src/openvpn/memdbg.h b/src/openvpn/memdbg.h
index 0ba695f..ee30b15 100644
--- a/src/openvpn/memdbg.h
+++ b/src/openvpn/memdbg.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef MEMDBG_H
diff --git a/src/openvpn/misc.c b/src/openvpn/misc.c
index fbd9938..87f03be 100644
--- a/src/openvpn/misc.c
+++ b/src/openvpn/misc.c
@@ -18,9 +18,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -649,8 +650,7 @@ const char *
 env_set_get(const struct env_set *es, const char *name)
 {
     const struct env_item *item = es->list;
-    while (item && !env_string_equal(item->string, name))
-    {
+    while (item && !env_string_equal(item->string, name)) {
         item = item->next;
     }
     return item ? item->string : NULL;
@@ -700,6 +700,57 @@ env_set_inherit(struct env_set *es, const struct env_set *src)
     }
 }
 
+void
+env_set_add_to_environment(const struct env_set *es)
+{
+    if (es)
+    {
+        struct gc_arena gc = gc_new();
+        const struct env_item *e;
+
+        e = es->list;
+
+        while (e)
+        {
+            const char *name;
+            const char *value;
+
+            if (deconstruct_name_value(e->string, &name, &value, &gc))
+            {
+                setenv_str(NULL, name, value);
+            }
+
+            e = e->next;
+        }
+        gc_free(&gc);
+    }
+}
+
+void
+env_set_remove_from_environment(const struct env_set *es)
+{
+    if (es)
+    {
+        struct gc_arena gc = gc_new();
+        const struct env_item *e;
+
+        e = es->list;
+
+        while (e)
+        {
+            const char *name;
+            const char *value;
+
+            if (deconstruct_name_value(e->string, &name, &value, &gc))
+            {
+                setenv_del(NULL, name);
+            }
+
+            e = e->next;
+        }
+        gc_free(&gc);
+    }
+}
 
 /* add/modify/delete environmental strings */
 
@@ -1387,7 +1438,7 @@ get_user_pass_auto_userid(struct user_pass *up, const char *tag)
     static const uint8_t hashprefix[] = "AUTO_USERID_DIGEST";
 
     const md_kt_t *md5_kt = md_kt_get("MD5");
-    md_ctx_t *ctx;
+    md_ctx_t ctx;
 
     CLEAR(*up);
     buf_set_write(&buf, (uint8_t *)up->username, USER_PASS_LEN);
@@ -1395,13 +1446,11 @@ get_user_pass_auto_userid(struct user_pass *up, const char *tag)
     if (get_default_gateway_mac_addr(macaddr))
     {
         dmsg(D_AUTO_USERID, "GUPAU: macaddr=%s", format_hex_ex(macaddr, sizeof(macaddr), 0, 1, ":", &gc));
-        ctx = md_ctx_new();
-        md_ctx_init(ctx, md5_kt);
-        md_ctx_update(ctx, hashprefix, sizeof(hashprefix) - 1);
-        md_ctx_update(ctx, macaddr, sizeof(macaddr));
-        md_ctx_final(ctx, digest);
-        md_ctx_cleanup(ctx);
-        md_ctx_free(ctx);
+        md_ctx_init(&ctx, md5_kt);
+        md_ctx_update(&ctx, hashprefix, sizeof(hashprefix) - 1);
+        md_ctx_update(&ctx, macaddr, sizeof(macaddr));
+        md_ctx_final(&ctx, digest);
+        md_ctx_cleanup(&ctx)
         buf_printf(&buf, "%s", format_hex_ex(digest, sizeof(digest), 0, 256, " ", &gc));
     }
     else
@@ -1430,11 +1479,7 @@ purge_user_pass(struct user_pass *up, const bool force)
         secure_memzero(up, sizeof(*up));
         up->nocache = nocache;
     }
-    /*
-     * don't show warning if the pass has been replaced by a token: this is an
-     * artificial "auth-nocache"
-     */
-    else if (!warn_shown && (!up->tokenized))
+    else if (!warn_shown)
     {
         msg(M_WARN, "WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this");
         warn_shown = true;
@@ -1448,7 +1493,6 @@ set_auth_token(struct user_pass *up, const char *token)
     {
         CLEAR(up->password);
         strncpynt(up->password, token, USER_PASS_LEN);
-        up->tokenized = true;
     }
 }
 
@@ -1503,9 +1547,7 @@ make_env_array(const struct env_set *es,
     if (es)
     {
         for (e = es->list; e != NULL; e = e->next)
-        {
             ++n;
-        }
     }
 
     /* alloc return array */
@@ -1567,9 +1609,7 @@ make_inline_array(const char *str, struct gc_arena *gc)
 
     buf_set_read(&buf, (const uint8_t *) str, strlen(str));
     while (buf_parse(&buf, '\n', line, sizeof(line)))
-    {
         ++len;
-    }
 
     /* alloc return array */
     ALLOC_ARRAY_CLEAR_GC(ret, char *, len + 1, gc);
@@ -1599,9 +1639,7 @@ make_arg_copy(char **p, struct gc_arena *gc)
     ALLOC_ARRAY_CLEAR_GC(ret, char *, max_parms, gc);
 
     for (i = 0; i < len; ++i)
-    {
         ret[i] = p[i];
-    }
 
     return (const char **)ret;
 }
diff --git a/src/openvpn/misc.h b/src/openvpn/misc.h
index ce96549..16be621 100644
--- a/src/openvpn/misc.h
+++ b/src/openvpn/misc.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef MISC_H
@@ -160,6 +161,10 @@ void env_set_print(int msglevel, const struct env_set *es);
 
 void env_set_inherit(struct env_set *es, const struct env_set *src);
 
+void env_set_add_to_environment(const struct env_set *es);
+
+void env_set_remove_from_environment(const struct env_set *es);
+
 /* Make arrays of strings */
 
 const char **make_env_array(const struct env_set *es,
@@ -201,8 +206,6 @@ struct user_pass
 {
     bool defined;
     bool nocache;
-    bool tokenized; /* true if password has been substituted by a token */
-    bool wait_for_push; /* true if this object is waiting for a push-reply */
 
 /* max length of username/password */
 #ifdef ENABLE_PKCS11
diff --git a/src/openvpn/mroute.c b/src/openvpn/mroute.c
index 7b46a6a..8b466b6 100644
--- a/src/openvpn/mroute.c
+++ b/src/openvpn/mroute.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -561,7 +562,6 @@ mroute_helper_free(struct mroute_helper *mh)
 
 #else  /* if P2MP_SERVER */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* P2MP_SERVER */
diff --git a/src/openvpn/mroute.h b/src/openvpn/mroute.h
index e57a950..0698348 100644
--- a/src/openvpn/mroute.h
+++ b/src/openvpn/mroute.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef MROUTE_H
diff --git a/src/openvpn/mss.c b/src/openvpn/mss.c
index c36e004..5b110d2 100644
--- a/src/openvpn/mss.c
+++ b/src/openvpn/mss.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -119,12 +120,8 @@ mss_fixup_ipv6(struct buffer *buf, int maxmss)
         return;
     }
 
-    /* skip IPv6 header (40 bytes),
-     * verify remainder is large enough to contain a full TCP header
-     */
     newbuf = *buf;
-    if (buf_advance( &newbuf, 40 )
-        && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
+    if (buf_advance( &newbuf, 40 ) )
     {
         struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf);
         if (tc->flags & OPENVPN_TCPH_SYN_MASK)
@@ -148,10 +145,7 @@ mss_fixup_dowork(struct buffer *buf, uint16_t maxmss)
     int accumulate;
     struct openvpn_tcphdr *tc;
 
-    if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
-    {
-	return;
-    }
+    ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr));
 
     verify_align_4(buf);
     tc = (struct openvpn_tcphdr *) BPTR(buf);
@@ -166,9 +160,8 @@ mss_fixup_dowork(struct buffer *buf, uint16_t maxmss)
 
     for (olen = hlen - sizeof(struct openvpn_tcphdr),
          opt = (uint8_t *)(tc + 1);
-         olen > 1;
-         olen -= optlen, opt += optlen)
-    {
+         olen > 0;
+         olen -= optlen, opt += optlen) {
         if (*opt == OPENVPN_TCPOPT_EOL)
         {
             break;
diff --git a/src/openvpn/mss.h b/src/openvpn/mss.h
index 0de2042..afe7a32 100644
--- a/src/openvpn/mss.h
+++ b/src/openvpn/mss.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef MSS_H
diff --git a/src/openvpn/mstats.c b/src/openvpn/mstats.c
index 9b09188..8ab1d02 100644
--- a/src/openvpn/mstats.c
+++ b/src/openvpn/mstats.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/mstats.h b/src/openvpn/mstats.h
index 486035f..f87a858 100644
--- a/src/openvpn/mstats.h
+++ b/src/openvpn/mstats.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/mtcp.c b/src/openvpn/mtcp.c
index cb940d8..b5471b1 100644
--- a/src/openvpn/mtcp.c
+++ b/src/openvpn/mtcp.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -586,8 +587,7 @@ multi_tcp_action(struct multi_context *m, struct multi_instance *mi, int action,
 {
     bool tun_input_pending = false;
 
-    do
-    {
+    do {
         dmsg(D_MULTI_DEBUG, "MULTI TCP: multi_tcp_action a=%s p=%d",
              pract(action),
              poll);
diff --git a/src/openvpn/mtcp.h b/src/openvpn/mtcp.h
index 79dcb13..835b8fd 100644
--- a/src/openvpn/mtcp.h
+++ b/src/openvpn/mtcp.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/mtu.c b/src/openvpn/mtu.c
index 44bef68..73eab21 100644
--- a/src/openvpn/mtu.c
+++ b/src/openvpn/mtu.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/mtu.h b/src/openvpn/mtu.h
index d1e8c18..471e51e 100644
--- a/src/openvpn/mtu.h
+++ b/src/openvpn/mtu.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef MTU_H
diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index 793678d..64ce4d7 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/mudp.h b/src/openvpn/mudp.h
index b9ceaf7..a98d64d 100644
--- a/src/openvpn/mudp.h
+++ b/src/openvpn/mudp.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 8d3d67f..f6f3f5d 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -536,14 +537,10 @@ multi_del_iroutes(struct multi_context *m,
     if (TUNNEL_TYPE(mi->context.c1.tuntap) == DEV_TYPE_TUN)
     {
         for (ir = mi->context.options.iroutes; ir != NULL; ir = ir->next)
-        {
             mroute_helper_del_iroute46(m->route_helper, ir->netbits);
-        }
 
         for (ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next)
-        {
             mroute_helper_del_iroute46(m->route_helper, ir6->netbits);
-        }
     }
 }
 
@@ -822,8 +819,7 @@ multi_create_instance(struct multi_context *m, const struct mroute_addr *real)
     mi->did_iter = true;
 
 #ifdef MANAGEMENT_DEF_AUTH
-    do
-    {
+    do {
         mi->context.c2.mda_context.cid = m->cid_counter++;
     } while (!hash_add(m->cid_hash, &mi->context.c2.mda_context.cid, mi, false));
     mi->did_cid_hash = true;
@@ -2953,14 +2949,10 @@ gremlin_flood_clients(struct multi_context *m)
             parm.packet_size);
 
         for (i = 0; i < parm.packet_size; ++i)
-        {
             ASSERT(buf_write_u8(&buf, get_random() & 0xFF));
-        }
 
         for (i = 0; i < parm.n_packets; ++i)
-        {
             multi_bcast(m, &buf, NULL, NULL);
-        }
 
         gc_free(&gc);
     }
@@ -3383,7 +3375,6 @@ tunnel_server(struct context *top)
 
 #else  /* if P2MP_SERVER */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* P2MP_SERVER */
diff --git a/src/openvpn/multi.h b/src/openvpn/multi.h
index 63afbaf..b4ffd69 100644
--- a/src/openvpn/multi.h
+++ b/src/openvpn/multi.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/ntlm.c b/src/openvpn/ntlm.c
index 0b1163e..e78af9e 100644
--- a/src/openvpn/ntlm.c
+++ b/src/openvpn/ntlm.c
@@ -15,9 +15,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -85,13 +86,13 @@ static void
 gen_hmac_md5(const char *data, int data_len, const char *key, int key_len,char *result)
 {
     const md_kt_t *md5_kt = md_kt_get("MD5");
-    hmac_ctx_t *hmac_ctx = hmac_ctx_new();
+    hmac_ctx_t hmac_ctx;
+    CLEAR(hmac_ctx);
 
-    hmac_ctx_init(hmac_ctx, key, key_len, md5_kt);
-    hmac_ctx_update(hmac_ctx, (const unsigned char *)data, data_len);
-    hmac_ctx_final(hmac_ctx, (unsigned char *)result);
-    hmac_ctx_cleanup(hmac_ctx);
-    hmac_ctx_free(hmac_ctx);
+    hmac_ctx_init(&hmac_ctx, key, key_len, md5_kt);
+    hmac_ctx_update(&hmac_ctx, (const unsigned char *)data, data_len);
+    hmac_ctx_final(&hmac_ctx, (unsigned char *)result);
+    hmac_ctx_cleanup(&hmac_ctx);
 }
 
 static void
@@ -123,22 +124,19 @@ gen_nonce(unsigned char *nonce)
     /* Generates 8 random bytes to be used as client nonce */
     int i;
 
-    for (i = 0; i<8; i++)
-    {
+    for (i = 0; i<8; i++) {
         nonce[i] = (unsigned char)get_random();
     }
 }
 
-void
+unsigned char *
 my_strupr(unsigned char *str)
 {
     /* converts string to uppercase in place */
+    unsigned char *tmp = str;
 
-    while (*str)
-    {
-        *str = toupper(*str);
-        str++;
-    }
+    do *str = toupper(*str); while (*(++str));
+    return tmp;
 }
 
 static int
@@ -195,7 +193,7 @@ ntlm_phase_3(const struct http_proxy_info *p, const char *phase_2, struct gc_are
      */
 
     char pwbuf[sizeof(p->up.password) * 2]; /* for unicode password */
-    unsigned char buf2[128]; /* decoded reply from proxy */
+    char buf2[128]; /* decoded reply from proxy */
     unsigned char phase3[464];
 
     char md4_hash[MD4_DIGEST_LENGTH+5];
@@ -301,13 +299,7 @@ ntlm_phase_3(const struct http_proxy_info *p, const char *phase_2, struct gc_are
                 tib_len = 96;
             }
             {
-                char *tib_ptr;
-                int tib_pos = buf2[0x2c];
-                if (tib_pos + tib_len > sizeof(buf2))
-                {
-                    return NULL;
-                }
-                tib_ptr = buf2 + tib_pos;                               /* Get Target Information block pointer */
+                char *tib_ptr = buf2 + buf2[0x2c];           /* Get Target Information block pointer */
                 memcpy(&ntlmv2_blob[0x1c], tib_ptr, tib_len);           /* Copy Target Information block into the blob */
             }
         }
@@ -381,7 +373,6 @@ ntlm_phase_3(const struct http_proxy_info *p, const char *phase_2, struct gc_are
 
 #else  /* if NTLM */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* if NTLM */
diff --git a/src/openvpn/occ-inline.h b/src/openvpn/occ-inline.h
index 68e9098..84fe1ac 100644
--- a/src/openvpn/occ-inline.h
+++ b/src/openvpn/occ-inline.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef OCC_INLINE_H
diff --git a/src/openvpn/occ.c b/src/openvpn/occ.c
index 40f7e76..b4ccc4d 100644
--- a/src/openvpn/occ.c
+++ b/src/openvpn/occ.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -429,7 +430,6 @@ process_received_occ_msg(struct context *c)
 
 #else  /* ifdef ENABLE_OCC */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ifdef ENABLE_OCC */
diff --git a/src/openvpn/occ.h b/src/openvpn/occ.h
index 12d7bc5..843ceb2 100644
--- a/src/openvpn/occ.h
+++ b/src/openvpn/occ.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef OCC_H
diff --git a/src/openvpn/openssl_compat.h b/src/openvpn/openssl_compat.h
deleted file mode 100644
index c765f0b..0000000
--- a/src/openvpn/openssl_compat.h
+++ /dev/null
@@ -1,657 +0,0 @@
-/*
- *  OpenVPN -- An application to securely tunnel IP networks
- *             over a single TCP/UDP port, with support for SSL/TLS-based
- *             session authentication and key exchange,
- *             packet encryption, packet authentication, and
- *             packet compression.
- *
- *  Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
- *  Copyright (C) 2010-2017 Fox Crypto B.V. <openvpn@fox-it.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2
- *  as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-/**
- * @file OpenSSL compatibility stub
- *
- * This file provide compatibility stubs for the OpenSSL libraries
- * prior to version 1.1. This version introduces many changes in the
- * library interface, including the fact that various objects and
- * structures are not fully opaque.
- */
-
-#ifndef OPENSSL_COMPAT_H_
-#define OPENSSL_COMPAT_H_
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#elif defined(_MSC_VER)
-#include "config-msvc.h"
-#endif
-
-#include "buffer.h"
-
-#include <openssl/ssl.h>
-#include <openssl/x509.h>
-
-#if !defined(HAVE_EVP_MD_CTX_RESET)
-/**
- * Reset a message digest context
- *
- * @param ctx                 The message digest context
- * @return                    1 on success, 0 on error
- */
-static inline int
-EVP_MD_CTX_reset(EVP_MD_CTX *ctx)
-{
-    EVP_MD_CTX_cleanup(ctx);
-    return 1;
-}
-#endif
-
-#if !defined(HAVE_EVP_MD_CTX_FREE)
-/**
- * Free an existing message digest context
- *
- * @param ctx                 The message digest context
- */
-static inline void
-EVP_MD_CTX_free(EVP_MD_CTX *ctx)
-{
-    free(ctx);
-}
-#endif
-
-#if !defined(HAVE_EVP_MD_CTX_NEW)
-/**
- * Allocate a new message digest object
- *
- * @return                    A zero'ed message digest object
- */
-static inline EVP_MD_CTX *
-EVP_MD_CTX_new(void)
-{
-    EVP_MD_CTX *ctx = NULL;
-    ALLOC_OBJ_CLEAR(ctx, EVP_MD_CTX);
-    return ctx;
-}
-#endif
-
-#if !defined(HAVE_EVP_CIPHER_CTX_FREE)
-/**
- * Free an existing cipher context
- *
- * @param ctx                 The cipher context
- */
-static inline void
-EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *c)
-{
-	free(c);
-}
-#endif
-
-#if !defined(HAVE_EVP_CIPHER_CTX_NEW)
-/**
- * Allocate a new cipher context object
- *
- * @return                    A zero'ed cipher context object
- */
-static inline EVP_CIPHER_CTX *
-EVP_CIPHER_CTX_new(void)
-{
-    EVP_CIPHER_CTX *ctx = NULL;
-    ALLOC_OBJ_CLEAR(ctx, EVP_CIPHER_CTX);
-    return ctx;
-}
-#endif
-
-#if !defined(HAVE_HMAC_CTX_RESET)
-/**
- * Reset a HMAC context
- *
- * @param ctx                 The HMAC context
- * @return                    1 on success, 0 on error
- */
-static inline int
-HMAC_CTX_reset(HMAC_CTX *ctx)
-{
-    HMAC_CTX_cleanup(ctx);
-    return 1;
-}
-#endif
-
-#if !defined(HAVE_HMAC_CTX_INIT)
-/**
- * Init a HMAC context
- *
- * @param ctx                 The HMAC context
- *
- * Contrary to many functions in this file, HMAC_CTX_init() is not
- * an OpenSSL 1.1 function: it comes from previous versions and was
- * removed in v1.1. As a consequence, there is no distincting in
- * v1.1 between a cleanup, and init and a reset. Yet, previous OpenSSL
- * version need this distinction.
- *
- * In order to respect previous OpenSSL versions, we implement init
- * as reset for OpenSSL 1.1+.
- */
-static inline void
-HMAC_CTX_init(HMAC_CTX *ctx)
-{
-    HMAC_CTX_reset(ctx);
-}
-#endif
-
-#if !defined(HAVE_HMAC_CTX_FREE)
-/**
- * Free an existing HMAC context
- *
- * @param ctx                 The HMAC context
- */
-static inline void
-HMAC_CTX_free(HMAC_CTX *c)
-{
-	free(c);
-}
-#endif
-
-#if !defined(HAVE_HMAC_CTX_NEW)
-/**
- * Allocate a new HMAC context object
- *
- * @return                    A zero'ed HMAC context object
- */
-static inline HMAC_CTX *
-HMAC_CTX_new(void)
-{
-    HMAC_CTX *ctx = NULL;
-    ALLOC_OBJ_CLEAR(ctx, HMAC_CTX);
-    return ctx;
-}
-#endif
-
-#if !defined(HAVE_SSL_CTX_GET_DEFAULT_PASSWD_CB_USERDATA)
-/**
- * Fetch the default password callback user data from the SSL context
- *
- * @param ctx                SSL context
- * @return                   The password callback user data
- */
-static inline void *
-SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx)
-{
-    return ctx ? ctx->default_passwd_callback_userdata : NULL;
-}
-#endif
-
-#if !defined(HAVE_SSL_CTX_GET_DEFAULT_PASSWD_CB)
-/**
- * Fetch the default password callback from the SSL context
- *
- * @param ctx                SSL context
- * @return                   The password callback
- */
-static inline pem_password_cb *
-SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx)
-{
-    return ctx ? ctx->default_passwd_callback : NULL;
-}
-#endif
-
-#if !defined(HAVE_X509_GET0_PUBKEY)
-/**
- * Get the public key from a X509 certificate
- *
- * @param x                  X509 certificate
- * @return                   The certificate public key
- */
-static inline EVP_PKEY *
-X509_get0_pubkey(const X509 *x)
-{
-    return (x && x->cert_info && x->cert_info->key) ?
-           x->cert_info->key->pkey : NULL;
-}
-#endif
-
-#if !defined(HAVE_X509_STORE_GET0_OBJECTS)
-/**
- * Fetch the X509 object stack from the X509 store
- *
- * @param store              X509 object store
- * @return                   the X509 object stack
- */
-static inline STACK_OF(X509_OBJECT) *
-X509_STORE_get0_objects(X509_STORE *store)
-{
-    return store ? store->objs : NULL;
-}
-#endif
-
-#if !defined(HAVE_X509_OBJECT_FREE)
-/**
- * Destroy a X509 object
- *
- * @param obj                X509 object
- */
-static inline void
-X509_OBJECT_free(X509_OBJECT *obj)
-{
-    if (obj)
-    {
-        X509_OBJECT_free_contents(obj);
-        OPENSSL_free(obj);
-    }
-}
-#endif
-
-#if !defined(HAVE_X509_OBJECT_GET_TYPE)
-/**
- * Get the type of an X509 object
- *
- * @param obj                X509 object
- * @return                   The underlying object type
- */
-static inline int
-X509_OBJECT_get_type(const X509_OBJECT *obj)
-{
-    return obj ? obj->type : X509_LU_FAIL;
-}
-#endif
-
-#if !defined(HAVE_EVP_PKEY_GET0_RSA)
-/**
- * Get the RSA object of a public key
- *
- * @param pkey                Public key object
- * @return                    The underlying RSA object
- */
-static inline RSA *
-EVP_PKEY_get0_RSA(EVP_PKEY *pkey)
-{
-    return pkey ? pkey->pkey.rsa : NULL;
-}
-#endif
-
-#if !defined(HAVE_EVP_PKEY_ID)
-/**
- * Get the PKEY type
- *
- * @param pkey                Public key object
- * @return                    The key type
- */
-static inline int
-EVP_PKEY_id(const EVP_PKEY *pkey)
-{
-    return pkey ? pkey->type : EVP_PKEY_NONE;
-}
-#endif
-
-#if !defined(HAVE_EVP_PKEY_GET0_DSA)
-/**
- * Get the DSA object of a public key
- *
- * @param pkey                Public key object
- * @return                    The underlying DSA object
- */
-static inline DSA *
-EVP_PKEY_get0_DSA(EVP_PKEY *pkey)
-{
-    return pkey ? pkey->pkey.dsa : NULL;
-}
-#endif
-
-#if !defined(HAVE_RSA_SET_FLAGS)
-/**
- * Set the RSA flags
- *
- * @param rsa                 The RSA object
- * @param flags               New flags value
- */
-static inline void
-RSA_set_flags(RSA *rsa, int flags)
-{
-    if (rsa)
-    {
-        rsa->flags = flags;
-    }
-}
-#endif
-
-#if !defined(HAVE_RSA_GET0_KEY)
-/**
- * Get the RSA parameters
- *
- * @param rsa                 The RSA object
- * @param n                   The @c n parameter
- * @param e                   The @c e parameter
- * @param d                   The @c d parameter
- */
-static inline void
-RSA_get0_key(const RSA *rsa, const BIGNUM **n,
-             const BIGNUM **e, const BIGNUM **d)
-{
-    if (n != NULL)
-    {
-        *n = rsa ? rsa->n : NULL;
-    }
-    if (e != NULL)
-    {
-        *e = rsa ? rsa->e : NULL;
-    }
-    if (d != NULL)
-    {
-        *d = rsa ? rsa->d : NULL;
-    }
-}
-#endif
-
-#if !defined(HAVE_RSA_SET0_KEY)
-/**
- * Set the RSA parameters
- *
- * @param rsa                 The RSA object
- * @param n                   The @c n parameter
- * @param e                   The @c e parameter
- * @param d                   The @c d parameter
- * @return                    1 on success, 0 on error
- */
-static inline int
-RSA_set0_key(RSA *rsa, BIGNUM *n, BIGNUM *e, BIGNUM *d)
-{
-    if ((rsa->n == NULL && n == NULL)
-        || (rsa->e == NULL && e == NULL))
-    {
-        return 0;
-    }
-
-    if (n != NULL)
-    {
-        BN_free(rsa->n);
-        rsa->n = n;
-    }
-    if (e != NULL)
-    {
-        BN_free(rsa->e);
-        rsa->e = e;
-    }
-    if (d != NULL)
-    {
-        BN_free(rsa->d);
-        rsa->d = d;
-    }
-
-    return 1;
-}
-#endif
-
-#if !defined(HAVE_RSA_BITS)
-/**
- * Number of significant RSA bits
- *
- * @param rsa                The RSA object ; shall not be NULL
- * @return                   The number of RSA bits or 0 on error
- */
-static inline int
-RSA_bits(const RSA *rsa)
-{
-    const BIGNUM *n = NULL;
-    RSA_get0_key(rsa, &n, NULL, NULL);
-    return n ? BN_num_bits(n) : 0;
-}
-#endif
-
-#if !defined(HAVE_DSA_GET0_PQG)
-/**
- * Get the DSA parameters
- *
- * @param dsa                 The DSA object
- * @param p                   The @c p parameter
- * @param q                   The @c q parameter
- * @param g                   The @c g parameter
- */
-static inline void
-DSA_get0_pqg(const DSA *dsa, const BIGNUM **p,
-             const BIGNUM **q, const BIGNUM **g)
-{
-    if (p != NULL)
-    {
-        *p = dsa ? dsa->p : NULL;
-    }
-    if (q != NULL)
-    {
-        *q = dsa ? dsa->q : NULL;
-    }
-    if (g != NULL)
-    {
-        *g = dsa ? dsa->g : NULL;
-    }
-}
-#endif
-
-#if !defined(HAVE_DSA_BITS)
-/**
- * Number of significant DSA bits
- *
- * @param rsa                The DSA object ; shall not be NULL
- * @return                   The number of DSA bits or 0 on error
- */
-static inline int
-DSA_bits(const DSA *dsa)
-{
-    const BIGNUM *p = NULL;
-    DSA_get0_pqg(dsa, &p, NULL, NULL);
-    return p ? BN_num_bits(p) : 0;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_NEW)
-/**
- * Allocate a new RSA method object
- *
- * @param name               The object name
- * @param flags              Configuration flags
- * @return                   A new RSA method object
- */
-static inline RSA_METHOD *
-RSA_meth_new(const char *name, int flags)
-{
-    RSA_METHOD *rsa_meth = NULL;
-    ALLOC_OBJ_CLEAR(rsa_meth, RSA_METHOD);
-    rsa_meth->name = string_alloc(name, NULL);
-    rsa_meth->flags = flags;
-    return rsa_meth;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_FREE)
-/**
- * Free an existing RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- */
-static inline void
-RSA_meth_free(RSA_METHOD *meth)
-{
-    if (meth)
-    {
-        /* OpenSSL defines meth->name to be a const pointer, yet we
-         * feed it with an allocated string (from RSA_meth_new()).
-         * Thus we are allowed to free it here. In order to avoid a
-         * "passing 'const char *' to parameter of type 'void *' discards
-         * qualifiers" warning, we force the pointer to be a non-const value.
-         */
-        free((char *)meth->name);
-        free(meth);
-    }
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_SET_PUB_ENC)
-/**
- * Set the public encoding function of an RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- * @param pub_enc            the public encoding function
- * @return                   1 on success, 0 on error
- */
-static inline int
-RSA_meth_set_pub_enc(RSA_METHOD *meth,
-                     int (*pub_enc) (int flen, const unsigned char *from,
-                                     unsigned char *to, RSA *rsa,
-                                     int padding))
-{
-    if (meth)
-    {
-        meth->rsa_pub_enc = pub_enc;
-        return 1;
-    }
-    return 0;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_SET_PUB_DEC)
-/**
- * Set the public decoding function of an RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- * @param pub_dec            the public decoding function
- * @return                   1 on success, 0 on error
- */
-static inline int
-RSA_meth_set_pub_dec(RSA_METHOD *meth,
-                     int (*pub_dec) (int flen, const unsigned char *from,
-                                     unsigned char *to, RSA *rsa,
-                                     int padding))
-{
-    if (meth)
-    {
-        meth->rsa_pub_dec = pub_dec;
-        return 1;
-    }
-    return 0;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_SET_PRIV_ENC)
-/**
- * Set the private encoding function of an RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- * @param priv_enc           the private encoding function
- * @return                   1 on success, 0 on error
- */
-static inline int
-RSA_meth_set_priv_enc(RSA_METHOD *meth,
-                      int (*priv_enc) (int flen, const unsigned char *from,
-                                       unsigned char *to, RSA *rsa,
-                                       int padding))
-{
-    if (meth)
-    {
-        meth->rsa_priv_enc = priv_enc;
-        return 1;
-    }
-    return 0;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_SET_PRIV_DEC)
-/**
- * Set the private decoding function of an RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- * @param priv_dec           the private decoding function
- * @return                   1 on success, 0 on error
- */
-static inline int
-RSA_meth_set_priv_dec(RSA_METHOD *meth,
-                      int (*priv_dec) (int flen, const unsigned char *from,
-                                       unsigned char *to, RSA *rsa,
-                                       int padding))
-{
-    if (meth)
-    {
-        meth->rsa_priv_dec = priv_dec;
-        return 1;
-    }
-    return 0;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_SET_INIT)
-/**
- * Set the init function of an RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- * @param init               the init function
- * @return                   1 on success, 0 on error
- */
-static inline int
-RSA_meth_set_init(RSA_METHOD *meth, int (*init) (RSA *rsa))
-{
-    if (meth)
-    {
-        meth->init = init;
-        return 1;
-    }
-    return 0;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_SET_FINISH)
-/**
- * Set the finish function of an RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- * @param finish             the finish function
- * @return                   1 on success, 0 on error
- */
-static inline int
-RSA_meth_set_finish(RSA_METHOD *meth, int (*finish) (RSA *rsa))
-{
-    if (meth)
-    {
-        meth->finish = finish;
-        return 1;
-    }
-    return 0;
-}
-#endif
-
-#if !defined(HAVE_RSA_METH_SET0_APP_DATA)
-/**
- * Set the application data of an RSA_METHOD object
- *
- * @param meth               The RSA_METHOD object
- * @param app_data           Application data
- * @return                   1 on success, 0 on error
- */
-static inline int
-RSA_meth_set0_app_data(RSA_METHOD *meth, void *app_data)
-{
-    if (meth)
-    {
-        meth->app_data = app_data;
-        return 1;
-    }
-    return 0;
-}
-#endif
-
-/* SSLeay symbols have been renamed in OpenSSL 1.1 */
-#if !defined(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT)
-#define RSA_F_RSA_OSSL_PRIVATE_ENCRYPT       RSA_F_RSA_EAY_PRIVATE_ENCRYPT
-#endif
-
-#endif /* OPENSSL_COMPAT_H_ */
diff --git a/src/openvpn/openvpn.c b/src/openvpn/openvpn.c
index 08c09e6..888acda 100644
--- a/src/openvpn/openvpn.c
+++ b/src/openvpn/openvpn.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -331,8 +332,7 @@ openvpn_main(int argc, char *argv[])
 
 #ifdef _WIN32
 int
-wmain(int argc, wchar_t *wargv[])
-{
+wmain(int argc, wchar_t *wargv[]) {
     char **argv;
     int ret;
     int i;
@@ -361,8 +361,7 @@ wmain(int argc, wchar_t *wargv[])
 }
 #else  /* ifdef _WIN32 */
 int
-main(int argc, char *argv[])
-{
+main(int argc, char *argv[]) {
     return openvpn_main(argc, argv);
 }
 #endif /* ifdef _WIN32 */
diff --git a/src/openvpn/openvpn.h b/src/openvpn/openvpn.h
index 9262e68..7ea0d17 100644
--- a/src/openvpn/openvpn.h
+++ b/src/openvpn/openvpn.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef OPENVPN_H
@@ -201,7 +202,7 @@ struct context_1
 #endif
 
     /* if client mode, hash of option strings we pulled from server */
-    struct sha256_digest pulled_options_digest_save;
+    struct md5_digest pulled_options_digest_save;
     /**< Hash of option strings received from the
      *   remote OpenVPN server.  Only used in
      *   client-mode. */
@@ -471,9 +472,9 @@ struct context_2
     bool did_pre_pull_restore;
 
     /* hash of pulled options, so we can compare when options change */
-    bool pulled_options_digest_init_done;
-    md_ctx_t *pulled_options_state;
-    struct sha256_digest pulled_options_digest;
+    bool pulled_options_md5_init_done;
+    md_ctx_t pulled_options_state;
+    struct md5_digest pulled_options_digest;
 
     struct event_timeout scheduled_exit;
     int scheduled_exit_signal;
diff --git a/src/openvpn/openvpn.vcxproj b/src/openvpn/openvpn.vcxproj
index d1c0fde..8dfbea5 100644
--- a/src/openvpn/openvpn.vcxproj
+++ b/src/openvpn/openvpn.vcxproj
@@ -99,16 +99,13 @@
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
-    <ClCompile Include="argv.c" />
     <ClCompile Include="base64.c" />
-    <ClCompile Include="block_dns.c" />
     <ClCompile Include="buffer.c" />
     <ClCompile Include="clinat.c" />
     <ClCompile Include="comp-lz4.c" />
     <ClCompile Include="comp.c" />
     <ClCompile Include="compstub.c" />
     <ClCompile Include="console.c" />
-    <ClCompile Include="console_builtin.c" />
     <ClCompile Include="crypto.c" />
     <ClCompile Include="crypto_openssl.c" />
     <ClCompile Include="cryptoapi.c" />
@@ -167,15 +164,12 @@
     <ClCompile Include="ssl_verify.c" />
     <ClCompile Include="ssl_verify_openssl.c" />
     <ClCompile Include="status.c" />
-    <ClCompile Include="tls_crypt.c" />
     <ClCompile Include="tun.c" />
     <ClCompile Include="win32.c" />
   </ItemGroup>
   <ItemGroup>
-    <ClInclude Include="argv.h" />
     <ClInclude Include="base64.h" />
     <ClInclude Include="basic.h" />
-    <ClInclude Include="block_dns.h" />
     <ClInclude Include="buffer.h" />
     <ClInclude Include="circ_list.h" />
     <ClInclude Include="clinat.h" />
@@ -255,7 +249,6 @@
     <ClInclude Include="ssl_verify_openssl.h" />
     <ClInclude Include="status.h" />
     <ClInclude Include="syshead.h" />
-    <ClInclude Include="tls_crypt.h" />
     <ClInclude Include="tun.h" />
     <ClInclude Include="win32.h" />
   </ItemGroup>
diff --git a/src/openvpn/openvpn.vcxproj.filters b/src/openvpn/openvpn.vcxproj.filters
index 30df5ec..8b6a269 100644
--- a/src/openvpn/openvpn.vcxproj.filters
+++ b/src/openvpn/openvpn.vcxproj.filters
@@ -216,18 +216,6 @@
     <ClCompile Include="comp-lz4.c">
       <Filter>Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="argv.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-    <ClCompile Include="block_dns.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-    <ClCompile Include="console_builtin.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-    <ClCompile Include="tls_crypt.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="base64.h">
@@ -476,22 +464,10 @@
     <ClInclude Include="win32.h">
       <Filter>Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="compstub.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
-    <ClInclude Include="argv.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
-    <ClInclude Include="block_dns.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
-    <ClInclude Include="tls_crypt.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <ResourceCompile Include="openvpn_win32_resources.rc">
       <Filter>Resource Files</Filter>
     </ResourceCompile>
   </ItemGroup>
-</Project>
-\ No newline at end of file
+</Project>
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index fef5e90..2f1b298 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -197,7 +198,7 @@ static const char usage_message[] =
     "                  is established.  Multiple routes can be specified.\n"
     "                  netmask default: 255.255.255.255\n"
     "                  gateway default: taken from --route-gateway or --ifconfig\n"
-    "                  Specify default by leaving blank or setting to \"nil\".\n"
+    "                  Specify default by leaving blank or setting to \"default\".\n"
     "--route-ipv6 network/bits [gateway] [metric] :\n"
     "                  Add IPv6 route to routing table after connection\n"
     "                  is established.  Multiple routes can be specified.\n"
@@ -591,8 +592,7 @@ static const char usage_message[] =
     "--x509-username-field : Field in x509 certificate containing the username.\n"
     "                        Default is CN in the Subject field.\n"
 #endif
-    "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
-    "                            Valid algo flags are SHA1 and SHA256. \n"
+    "--verify-hash   : Specify SHA1 fingerprint for level-1 cert.\n"
 #ifdef _WIN32
     "--cryptoapicert select-string : Load the certificate and private key from the\n"
     "                  Windows Certificate System Store.\n"
@@ -636,8 +636,8 @@ static const char usage_message[] =
     "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
     "                  DN name. The remote host must also pass all other tests\n"
     "                  of verification.\n"
-    "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
-    "                  an explicit nsCertType designation t = 'client' | 'server'.\n"
+    "--ns-cert-type t: Require that peer certificate was signed with an explicit\n"
+    "                  nsCertType designation t = 'client' | 'server'.\n"
     "--x509-track x  : Save peer X509 attribute x in environment for use by\n"
     "                  plugins and management interface.\n"
 #if defined(ENABLE_CRYPTO_OPENSSL) && OPENSSL_VERSION_NUMBER >= 0x10001000
@@ -716,6 +716,7 @@ static const char usage_message[] =
     "--dhcp-renew       : Ask Windows to renew the TAP adapter lease on startup.\n"
     "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
     "                       startup.\n"
+    "--dhcp-release     : Ask Windows to release the TAP adapter lease on shutdown.\n"
     "--register-dns  : Run ipconfig /flushdns and ipconfig /registerdns\n"
     "                  on connection initiation.\n"
     "--tap-sleep n   : Sleep for n seconds after TAP adapter open before\n"
@@ -998,9 +999,7 @@ setenv_settings(struct env_set *es, const struct options *o)
     {
         int i;
         for (i = 0; i < o->connection_list->len; ++i)
-        {
             setenv_connection_entry(es, o->connection_list->array[i], i+1);
-        }
     }
     else
     {
@@ -1215,6 +1214,7 @@ show_tuntap_options(const struct tuntap_options *o)
     SHOW_BOOL(dhcp_options);
     SHOW_BOOL(dhcp_renew);
     SHOW_BOOL(dhcp_pre_release);
+    SHOW_BOOL(dhcp_release);
     SHOW_STR(domain);
     SHOW_STR(netbios_scope);
     SHOW_INT(netbios_node_type);
@@ -1761,9 +1761,7 @@ show_settings(const struct options *o)
     {
         int i;
         for (i = 0; i<MAX_PARMS; i++)
-        {
             SHOW_INT(remote_cert_ku[i]);
-        }
     }
     SHOW_STR(remote_cert_eku);
     SHOW_INT(ssl_flags);
@@ -1791,30 +1789,22 @@ show_settings(const struct options *o)
     {
         int i;
         for (i = 0; i<MAX_PARMS && o->pkcs11_providers[i] != NULL; i++)
-        {
             SHOW_PARM(pkcs11_providers, o->pkcs11_providers[i], "%s");
-        }
     }
     {
         int i;
         for (i = 0; i<MAX_PARMS; i++)
-        {
             SHOW_PARM(pkcs11_protected_authentication, o->pkcs11_protected_authentication[i] ? "ENABLED" : "DISABLED", "%s");
-        }
     }
     {
         int i;
         for (i = 0; i<MAX_PARMS; i++)
-        {
             SHOW_PARM(pkcs11_private_mode, o->pkcs11_private_mode[i], "%08x");
-        }
     }
     {
         int i;
         for (i = 0; i<MAX_PARMS; i++)
-        {
             SHOW_PARM(pkcs11_cert_private, o->pkcs11_cert_private[i] ? "ENABLED" : "DISABLED", "%s");
-        }
     }
     SHOW_INT(pkcs11_pin_cache_period);
     SHOW_STR(pkcs11_id);
@@ -2949,9 +2939,7 @@ options_postprocess_verify(const struct options *o)
     {
         int i;
         for (i = 0; i < o->connection_list->len; ++i)
-        {
             options_postprocess_verify_ce(o, o->connection_list->array[i]);
-        }
     }
     else
     {
@@ -3002,9 +2990,7 @@ options_postprocess_mutate(struct options *o)
 
     ASSERT(o->connection_list);
     for (i = 0; i < o->connection_list->len; ++i)
-    {
         options_postprocess_mutate_ce(o, o->connection_list->array[i]);
-    }
 
 #ifdef ENABLE_CRYPTO
     if (o->tls_server)
@@ -3817,9 +3803,7 @@ options_warning_safe_scan1(const int msglevel,
     char *p = gc_malloc(OPTION_PARM_SIZE, true, &gc);
 
     while (buf_parse(&b, delim, p, OPTION_PARM_SIZE))
-    {
         options_warning_safe_scan2(msglevel, delim, report_inconsistent, p, b2_src, b1_name, b2_name);
-    }
 
     gc_free(&gc);
 }
@@ -4096,7 +4080,6 @@ usage(void)
     fprintf(fp, usage_message,
             title_string,
             o.ce.connect_retry_seconds,
-            o.ce.connect_retry_seconds_max,
             o.ce.local_port, o.ce.remote_port,
             TUN_MTU_DEFAULT, TAP_MTU_EXTRA_DEFAULT,
             o.verbosity);
@@ -4447,10 +4430,7 @@ read_inline_file(struct in_src *is, const char *close_tag, struct gc_arena *gc)
     {
         char *line_ptr = line;
         /* Remove leading spaces */
-        while (isspace(*line_ptr))
-        {
-            line_ptr++;
-        }
+        while (isspace(*line_ptr)) line_ptr++;
         if (!strncmp(line_ptr, close_tag, strlen(close_tag)))
         {
             endtagfound = true;
@@ -4546,7 +4526,7 @@ read_config_file(struct options *options,
     FILE *fp;
     int line_num;
     char line[OPTION_LINE_SIZE+1];
-    char *p[MAX_PARMS+1];
+    char *p[MAX_PARMS];
 
     ++level;
     if (level <= max_recursive_levels)
@@ -4578,7 +4558,7 @@ read_config_file(struct options *options,
                 {
                     offset = 3;
                 }
-                if (parse_line(line + offset, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
+                if (parse_line(line + offset, p, SIZE(p), file, line_num, msglevel, &options->gc))
                 {
                     bypass_doubledash(&p[0]);
                     check_inline_file_via_fp(fp, p, &options->gc);
@@ -4620,10 +4600,10 @@ read_config_string(const char *prefix,
 
     while (buf_parse(&multiline, '\n', line, sizeof(line)))
     {
-        char *p[MAX_PARMS+1];
+        char *p[MAX_PARMS];
         CLEAR(p);
         ++line_num;
-        if (parse_line(line, p, SIZE(p)-1, prefix, line_num, msglevel, &options->gc))
+        if (parse_line(line, p, SIZE(p), prefix, line_num, msglevel, &options->gc))
         {
             bypass_doubledash(&p[0]);
             check_inline_file_via_buf(&multiline, p, &options->gc);
@@ -4754,14 +4734,14 @@ apply_push_options(struct options *options,
 
     while (buf_parse(buf, ',', line, sizeof(line)))
     {
-        char *p[MAX_PARMS+1];
+        char *p[MAX_PARMS];
         CLEAR(p);
         ++line_num;
         if (!apply_pull_filter(options, line))
         {
             return false; /* Cause push/pull error and stop push processing */
         }
-        if (parse_line(line, p, SIZE(p)-1, file, line_num, msglevel, &options->gc))
+        if (parse_line(line, p, SIZE(p), file, line_num, msglevel, &options->gc))
         {
             add_option(options, p, file, line_num, 0, msglevel, permission_mask, option_types_found, es);
         }
@@ -5167,7 +5147,7 @@ add_option(struct options *options,
     }
 #endif /* ifdef ENABLE_MANAGEMENT */
 #ifdef ENABLE_PLUGIN
-    else if (streq(p[0], "plugin") && p[1])
+    else if (streq(p[0], "plugin") && p[1] && !p[3])
     {
         VERIFY_PERMISSION(OPT_P_PLUGIN);
         if (!options->plugin_list)
@@ -5317,14 +5297,12 @@ add_option(struct options *options,
             if (!sub.ce.remote)
             {
                 msg(msglevel, "Each 'connection' block must contain exactly one 'remote' directive");
-                uninit_options(&sub);
                 goto err;
             }
 
             e = alloc_connection_entry(options, msglevel);
             if (!e)
             {
-                uninit_options(&sub);
                 goto err;
             }
             *e = sub.ce;
@@ -5342,24 +5320,18 @@ add_option(struct options *options,
         VERIFY_PERMISSION(OPT_P_GENERAL);
         /* Find out how many options to be ignored */
         for (i = 1; p[i]; i++)
-        {
             numignored++;
-        }
 
         /* add number of options already ignored */
         for (i = 0; options->ignore_unknown_option
              && options->ignore_unknown_option[i]; i++)
-        {
             numignored++;
-        }
 
         /* Allocate array */
         ALLOC_ARRAY_GC(ignore, const char *, numignored+1, &options->gc);
         for (i = 0; options->ignore_unknown_option
              && options->ignore_unknown_option[i]; i++)
-        {
             ignore[i] = options->ignore_unknown_option[i];
-        }
 
         options->ignore_unknown_option = ignore;
 
@@ -6043,8 +6015,7 @@ add_option(struct options *options,
             struct http_custom_header *custom_header = NULL;
             int i;
             /* Find the first free header */
-            for (i = 0; i < MAX_CUSTOM_HTTP_HEADER; i++)
-            {
+            for (i = 0; i < MAX_CUSTOM_HTTP_HEADER; i++) {
                 if (!ho->custom_headers[i].name)
                 {
                     custom_header = &ho->custom_headers[i];
@@ -6818,6 +6789,20 @@ add_option(struct options *options,
         options->port_share_port = p[2];
         options->port_share_journal_dir = p[3];
     }
+  else if (streq (p[0], "pkcs11-id-type") ||
+           streq (p[0], "pkcs11-sign-mode") ||
+           streq (p[0], "pkcs11-slot") ||
+           streq (p[0], "pkcs11-slot-type") ||
+           streq (p[0], "show-pkcs11-objects") ||
+           streq (p[0], "show-pkcs11-slots"))
+    {
+      if (file)
+	msg (msglevel, "You are using an obsolete parameter in %s:%d: %s (%s).\nPlease see /usr/share/doc/openvpn/NEWS.Debian.gz for details.",
+             file, line, p[0], PACKAGE_VERSION);
+      else
+	msg (msglevel, "You are using an obsolete parameter: --%s (%s).\nPlease see /usr/share/doc/openvpn/NEWS.Debian.gz for details.",
+             p[0], PACKAGE_VERSION);
+    }
 #endif
     else if (streq(p[0], "client-to-client") && !p[1])
     {
@@ -7229,11 +7214,11 @@ add_option(struct options *options,
     {
         VERIFY_PERMISSION(OPT_P_IPWIN32);
         options->tuntap_options.dhcp_pre_release = true;
-        options->tuntap_options.dhcp_renew = true;
     }
     else if (streq(p[0], "dhcp-release") && !p[1])
     {
-        msg(M_WARN, "Obsolete option --dhcp-release detected. This is now on by default");
+        VERIFY_PERMISSION(OPT_P_IPWIN32);
+        options->tuntap_options.dhcp_release = true;
     }
     else if (streq(p[0], "dhcp-internal") && p[1] && !p[2]) /* standalone method for internal use */
     {
@@ -7705,25 +7690,10 @@ add_option(struct options *options,
             options->extra_certs_file_inline = p[2];
         }
     }
-    else if (streq(p[0], "verify-hash") && p[1] && !p[3])
+    else if (streq(p[0], "verify-hash") && p[1] && !p[2])
     {
         VERIFY_PERMISSION(OPT_P_GENERAL);
-
-        if (!p[2] || (p[2] && streq(p[2], "SHA1")))
-        {
-            options->verify_hash = parse_hash_fingerprint(p[1], SHA_DIGEST_LENGTH, msglevel, &options->gc);
-            options->verify_hash_algo = MD_SHA1;
-        }
-        else if (p[2] && streq(p[2], "SHA256"))
-        {
-            options->verify_hash = parse_hash_fingerprint(p[1], SHA256_DIGEST_LENGTH, msglevel, &options->gc);
-            options->verify_hash_algo = MD_SHA256;
-        }
-        else
-        {
-            msg(msglevel, "invalid or unsupported hashing algorithm: %s  (only SHA1 and SHA256 are valid)", p[2]);
-            goto err;
-        }
+        options->verify_hash = parse_hash_fingerprint(p[1], SHA_DIGEST_LENGTH, msglevel, &options->gc);
     }
 #ifdef ENABLE_CRYPTOAPI
     else if (streq(p[0], "cryptoapicert") && p[1] && !p[2])
@@ -7947,18 +7917,12 @@ add_option(struct options *options,
     }
     else if (streq(p[0], "remote-cert-ku"))
     {
+        int j;
+
         VERIFY_PERMISSION(OPT_P_GENERAL);
 
-        size_t j;
         for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
-        {
             sscanf(p[j], "%x", &(options->remote_cert_ku[j-1]));
-        }
-        if (j == 1)
-        {
-            /* No specific KU required, but require KU to be present */
-            options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
-        }
     }
     else if (streq(p[0], "remote-cert-eku") && p[1] && !p[2])
     {
@@ -7971,12 +7935,15 @@ add_option(struct options *options,
 
         if (streq(p[1], "server"))
         {
-            options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
+            options->remote_cert_ku[0] = 0xa0;
+            options->remote_cert_ku[1] = 0x88;
             options->remote_cert_eku = "TLS Web Server Authentication";
         }
         else if (streq(p[1], "client"))
         {
-            options->remote_cert_ku[0] = OPENVPN_KU_REQUIRED;
+            options->remote_cert_ku[0] = 0x80;
+            options->remote_cert_ku[1] = 0x08;
+            options->remote_cert_ku[2] = 0x88;
             options->remote_cert_eku = "TLS Web Client Authentication";
         }
         else
@@ -8084,25 +8051,15 @@ add_option(struct options *options,
         if (strncmp("ext:", s, 4) != 0)
         {
             size_t i = 0;
-            while (s[i] && !isupper(s[i]))
-            {
-                i++;
-            }
+            while (s[i] && !isupper(s[i])) i++;
             if (strlen(s) == i)
             {
-                while ((*s = toupper(*s)) != '\0')
-                {
-                    s++;
-                }
+                while ((*s = toupper(*s)) != '\0') s++;
                 msg(M_WARN, "DEPRECATED FEATURE: automatically upcased the "
                     "--x509-username-field parameter to '%s'; please update your"
                     "configuration", p[1]);
             }
         }
-        else if (!x509_username_field_ext_supported(s+4))
-        {
-            msg(msglevel, "Unsupported x509-username-field extension: %s", s);
-        }
         options->x509_username_field = p[1];
     }
 #endif /* ENABLE_X509ALTUSERNAME */
@@ -8151,9 +8108,7 @@ add_option(struct options *options,
         VERIFY_PERMISSION(OPT_P_GENERAL);
 
         for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
-        {
             options->pkcs11_providers[j-1] = p[j];
-        }
     }
     else if (streq(p[0], "pkcs11-protected-authentication"))
     {
@@ -8162,9 +8117,7 @@ add_option(struct options *options,
         VERIFY_PERMISSION(OPT_P_GENERAL);
 
         for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
-        {
             options->pkcs11_protected_authentication[j-1] = atoi(p[j]) != 0 ? 1 : 0;
-        }
     }
     else if (streq(p[0], "pkcs11-private-mode") && p[1])
     {
@@ -8173,9 +8126,7 @@ add_option(struct options *options,
         VERIFY_PERMISSION(OPT_P_GENERAL);
 
         for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
-        {
             sscanf(p[j], "%x", &(options->pkcs11_private_mode[j-1]));
-        }
     }
     else if (streq(p[0], "pkcs11-cert-private"))
     {
@@ -8184,9 +8135,7 @@ add_option(struct options *options,
         VERIFY_PERMISSION(OPT_P_GENERAL);
 
         for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j)
-        {
             options->pkcs11_cert_private[j-1] = atoi(p[j]) != 0 ? 1 : 0;
-        }
     }
     else if (streq(p[0], "pkcs11-pin-cache") && p[1] && !p[2])
     {
diff --git a/src/openvpn/options.h b/src/openvpn/options.h
index 67b9b94..b3ab029 100644
--- a/src/openvpn/options.h
+++ b/src/openvpn/options.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -41,10 +42,6 @@
 #include "comp.h"
 #include "pushlist.h"
 #include "clinat.h"
-#ifdef ENABLE_CRYPTO
-#include "crypto_backend.h"
-#endif
-
 
 /*
  * Maximum number of parameters associated with an option,
@@ -522,7 +519,6 @@ struct options
     unsigned remote_cert_ku[MAX_PARMS];
     const char *remote_cert_eku;
     uint8_t *verify_hash;
-    hash_algo_type verify_hash_algo;
     unsigned int ssl_flags; /* set to SSLF_x flags from ssl.h */
 
 #ifdef ENABLE_PKCS11
diff --git a/src/openvpn/otime.c b/src/openvpn/otime.c
index 3e576cc..22abda0 100644
--- a/src/openvpn/otime.c
+++ b/src/openvpn/otime.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/otime.h b/src/openvpn/otime.h
index 8731472..eede63d 100644
--- a/src/openvpn/otime.h
+++ b/src/openvpn/otime.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef OTIME_H
@@ -288,8 +289,7 @@ tv_within_sigma(const struct timeval *t1, const struct timeval *t2, unsigned int
  * called again.
  */
 static inline void
-interval_earliest_wakeup(interval_t *wakeup, time_t at, time_t current)
-{
+interval_earliest_wakeup(interval_t *wakeup, time_t at, time_t current) {
     if (at > current)
     {
         const interval_t delta = (interval_t) (at - current);
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 30ae8fb..6f70c5d 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -656,8 +657,7 @@ packet_id_interactive_test()
 
     packet_id_init(&pid, seq_backtrack, time_backtrack);
 
-    while (true)
-    {
+    while (true) {
         char buf[80];
         if (!fgets(buf, sizeof(buf), stdin))
         {
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index a370936..aceacf8 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/perf.c b/src/openvpn/perf.c
index 16cf749..51e051a 100644
--- a/src/openvpn/perf.c
+++ b/src/openvpn/perf.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -146,14 +147,12 @@ push_perf_index(int pindex)
     {
         int i;
         for (i = 0; i < sindex; ++i)
-        {
             if (perf_set.stack[i] == pindex)
             {
                 perf_print_state(M_INFO);
                 msg(M_FATAL, "PERF: push_perf_index %s failed",
                     metric_names [pindex]);
             }
-        }
 
         perf_set.stack[sindex] = pindex;
         perf_set.stack_len = newlen;
@@ -322,8 +321,7 @@ perf_print_state(int lev)
 #else  /* ifdef ENABLE_PERFORMANCE_METRICS */
 #ifdef _MSC_VER  /* Dummy function needed to avoid empty file compiler warning in Microsoft VC */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif
 #endif /* ifdef ENABLE_PERFORMANCE_METRICS */
diff --git a/src/openvpn/perf.h b/src/openvpn/perf.h
index ae5ae08..f0430a1 100644
--- a/src/openvpn/perf.h
+++ b/src/openvpn/perf.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -75,16 +76,13 @@ void perf_output_results(void);
 #else  /* ifdef ENABLE_PERFORMANCE_METRICS */
 
 static inline void
-perf_push(int type)
-{
+perf_push(int type) {
 }
 static inline void
-perf_pop(void)
-{
+perf_pop(void) {
 }
 static inline void
-perf_output_results(void)
-{
+perf_output_results(void) {
 }
 
 #endif /* ifdef ENABLE_PERFORMANCE_METRICS */
diff --git a/src/openvpn/pf-inline.h b/src/openvpn/pf-inline.h
index ac19ac4..a0f5cc7 100644
--- a/src/openvpn/pf-inline.h
+++ b/src/openvpn/pf-inline.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #if defined(ENABLE_PF) && !defined(PF_INLINE_H)
diff --git a/src/openvpn/pf.c b/src/openvpn/pf.c
index 5cb002b..56b6858 100644
--- a/src/openvpn/pf.c
+++ b/src/openvpn/pf.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /* packet filter functions */
diff --git a/src/openvpn/pf.h b/src/openvpn/pf.h
index 414c85b..3832683 100644
--- a/src/openvpn/pf.h
+++ b/src/openvpn/pf.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /* packet filter functions */
diff --git a/src/openvpn/ping-inline.h b/src/openvpn/ping-inline.h
index 0642b85..2fa1d5c 100644
--- a/src/openvpn/ping-inline.h
+++ b/src/openvpn/ping-inline.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef PING_INLINE_H
diff --git a/src/openvpn/ping.c b/src/openvpn/ping.c
index 728d6c2..0496b72 100644
--- a/src/openvpn/ping.c
+++ b/src/openvpn/ping.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/ping.h b/src/openvpn/ping.h
index 5bd5c08..e839ce7 100644
--- a/src/openvpn/ping.h
+++ b/src/openvpn/ping.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef PING_H
diff --git a/src/openvpn/pkcs11.c b/src/openvpn/pkcs11.c
index 6041828..6858846 100644
--- a/src/openvpn/pkcs11.c
+++ b/src/openvpn/pkcs11.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -44,24 +45,21 @@
 
 static
 time_t
-__mytime(void)
-{
+__mytime(void) {
     return openvpn_time(NULL);
 }
 
 #if !defined(_WIN32)
 static
 int
-__mygettimeofday(struct timeval *tv)
-{
+__mygettimeofday(struct timeval *tv) {
     return gettimeofday(tv, NULL);
 }
 #endif
 
 static
 void
-__mysleep(const unsigned long usec)
-{
+__mysleep(const unsigned long usec) {
 #if defined(_WIN32)
     Sleep(usec/1000);
 #else
@@ -86,12 +84,10 @@ static
 unsigned
 _pkcs11_msg_pkcs112openvpn(
     const unsigned flags
-    )
-{
+    ) {
     unsigned openvpn_flags;
 
-    switch (flags)
-    {
+    switch (flags) {
         case PKCS11H_LOG_DEBUG2:
             openvpn_flags = D_PKCS11_DEBUG;
             break;
@@ -128,8 +124,7 @@ static
 unsigned
 _pkcs11_msg_openvpn2pkcs11(
     const unsigned flags
-    )
-{
+    ) {
     unsigned pkcs11_flags;
 
     if ((flags & D_PKCS11_DEBUG) != 0)
@@ -171,8 +166,7 @@ _pkcs11_openvpn_log(
     unsigned flags,
     const char *const szFormat,
     va_list args
-    )
-{
+    ) {
     char Buffer[10*1024];
 
     (void)global_data;
@@ -190,8 +184,7 @@ _pkcs11_openvpn_token_prompt(
     void *const user_data,
     const pkcs11h_token_id_t token,
     const unsigned retry
-    )
-{
+    ) {
     struct user_pass token_resp;
 
     (void)global_data;
@@ -236,8 +229,7 @@ _pkcs11_openvpn_pin_prompt(
     const unsigned retry,
     char *const pin,
     const size_t pin_max
-    )
-{
+    ) {
     struct user_pass token_pass;
     char prompt[1024];
 
@@ -283,8 +275,7 @@ bool
 pkcs11_initialize(
     const bool protected_auth,
     const int nPINCachePeriod
-    )
-{
+    ) {
     CK_RV rv = CKR_FUNCTION_FAILED;
 
     dmsg(
@@ -356,8 +347,7 @@ cleanup:
 }
 
 void
-pkcs11_terminate()
-{
+pkcs11_terminate() {
     dmsg(
         D_PKCS11_DEBUG,
         "PKCS#11: pkcs11_terminate - entered"
@@ -377,8 +367,7 @@ pkcs11_addProvider(
     const bool protected_auth,
     const unsigned private_mode,
     const bool cert_private
-    )
-{
+    ) {
     CK_RV rv = CKR_OK;
 
     ASSERT(provider!=NULL);
@@ -422,14 +411,12 @@ pkcs11_addProvider(
 }
 
 int
-pkcs11_logout()
-{
+pkcs11_logout() {
     return pkcs11h_logout() == CKR_OK;
 }
 
 int
-pkcs11_management_id_count()
-{
+pkcs11_management_id_count() {
     pkcs11h_certificate_id_list_t id_list = NULL;
     pkcs11h_certificate_id_list_t t = NULL;
     CK_RV rv = CKR_OK;
@@ -454,8 +441,7 @@ pkcs11_management_id_count()
         goto cleanup;
     }
 
-    for (count = 0, t = id_list; t != NULL; t = t->next)
-    {
+    for (count = 0, t = id_list; t != NULL; t = t->next) {
         count++;
     }
 
@@ -481,8 +467,7 @@ pkcs11_management_id_get(
     const int index,
     char **id,
     char **base64
-    )
-{
+    ) {
     pkcs11h_certificate_id_list_t id_list = NULL;
     pkcs11h_certificate_id_list_t entry = NULL;
 #if 0 /* certificate_id seems to be unused -- JY */
@@ -526,8 +511,7 @@ pkcs11_management_id_get(
 
     entry = id_list;
     count = 0;
-    while (entry != NULL && count != index)
-    {
+    while (entry != NULL && count != index) {
         count++;
         entry = entry->next;
     }
@@ -669,8 +653,7 @@ tls_ctx_use_pkcs11(
     struct tls_root_ctx *const ssl_ctx,
     bool pkcs11_id_management,
     const char *const pkcs11_id
-    )
-{
+    ) {
     pkcs11h_certificate_id_t certificate_id = NULL;
     pkcs11h_certificate_t certificate = NULL;
     CK_RV rv = CKR_OK;
@@ -801,8 +784,7 @@ _pkcs11_openvpn_show_pkcs11_ids_pin_prompt(
     const unsigned retry,
     char *const pin,
     const size_t pin_max
-    )
-{
+    ) {
     struct gc_arena gc = gc_new();
     struct buffer pass_prompt = alloc_buf_gc(128, &gc);
 
@@ -835,8 +817,7 @@ void
 show_pkcs11_ids(
     const char *const provider,
     bool cert_private
-    )
-{
+    ) {
     struct gc_arena gc = gc_new();
     pkcs11h_certificate_id_list_t user_certificates = NULL;
     pkcs11h_certificate_id_list_t current = NULL;
@@ -907,8 +888,7 @@ show_pkcs11_ids(
             "--pkcs11-id option please remember to use single quote mark.\n"
         )
         );
-    for (current = user_certificates; current != NULL; current = current->next)
-    {
+    for (current = user_certificates; current != NULL; current = current->next) {
         pkcs11h_certificate_t certificate = NULL;
         char *dn = NULL;
         char serial[1024] = {0};
@@ -1026,8 +1006,7 @@ cleanup:
 #else  /* if defined(ENABLE_PKCS11) */
 #ifdef _MSC_VER  /* Dummy function needed to avoid empty file compiler warning in Microsoft VC */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif
 #endif /* ENABLE_PKCS11 */
diff --git a/src/openvpn/pkcs11.h b/src/openvpn/pkcs11.h
index f1722c0..3747d3a 100644
--- a/src/openvpn/pkcs11.h
+++ b/src/openvpn/pkcs11.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef OPENVPN_PKCS11_H
diff --git a/src/openvpn/pkcs11_backend.h b/src/openvpn/pkcs11_backend.h
index b47b757..9606899 100644
--- a/src/openvpn/pkcs11_backend.h
+++ b/src/openvpn/pkcs11_backend.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/pkcs11_mbedtls.c b/src/openvpn/pkcs11_mbedtls.c
index 45372e4..bdca893 100644
--- a/src/openvpn/pkcs11_mbedtls.c
+++ b/src/openvpn/pkcs11_mbedtls.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -38,7 +39,6 @@
 
 #include "errlevel.h"
 #include "pkcs11_backend.h"
-#include "ssl_verify_backend.h"
 #include <mbedtls/pkcs11.h>
 #include <mbedtls/x509.h>
 
@@ -82,6 +82,8 @@ char *
 pkcs11_certificate_dn(pkcs11h_certificate_t cert, struct gc_arena *gc)
 {
     char *ret = NULL;
+    char dn[1024] = {0};
+
     mbedtls_x509_crt mbed_crt = {0};
 
     if (mbedtls_pkcs11_x509_cert_bind(&mbed_crt, cert))
@@ -90,12 +92,14 @@ pkcs11_certificate_dn(pkcs11h_certificate_t cert, struct gc_arena *gc)
         goto cleanup;
     }
 
-    if (!(ret = x509_get_subject(&mbed_crt, gc)))
+    if (-1 == mbedtls_x509_dn_gets(dn, sizeof(dn), &mbed_crt.subject))
     {
         msg(M_FATAL, "PKCS#11: mbed TLS cannot parse subject");
         goto cleanup;
     }
 
+    ret = string_alloc(dn, gc);
+
 cleanup:
     mbedtls_x509_crt_free(&mbed_crt);
 
diff --git a/src/openvpn/pkcs11_openssl.c b/src/openvpn/pkcs11_openssl.c
index c37425b..6244cc7 100644
--- a/src/openvpn/pkcs11_openssl.c
+++ b/src/openvpn/pkcs11_openssl.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/platform.c b/src/openvpn/platform.c
index 2495523..952d633 100644
--- a/src/openvpn/platform.c
+++ b/src/openvpn/platform.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/platform.h b/src/openvpn/platform.h
index cd2bbc9..62396a9 100644
--- a/src/openvpn/platform.h
+++ b/src/openvpn/platform.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef PLATFORM_H
diff --git a/src/openvpn/plugin.c b/src/openvpn/plugin.c
index 557b6bc..17eb2d8 100644
--- a/src/openvpn/plugin.c
+++ b/src/openvpn/plugin.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -233,31 +234,23 @@ plugin_init_item(struct plugin *p, const struct plugin_option *o)
 #ifndef _WIN32
 
     p->handle = NULL;
-
-    /* If the plug-in filename is not an absolute path,
-     * or beginning with '.', it should use the PLUGIN_LIBDIR
-     * as the base directory for loading the plug-in.
-     *
-     * This means the following scenarios are loaded from these places:
-     *    --plugin fancyplug.so              -> $PLUGIN_LIBDIR/fancyplug.so
-     *    --plugin my/fancyplug.so           -> $PLUGIN_LIBDIR/my/fancyplug.so
-     *    --plugin ./fancyplug.so            -> $CWD/fancyplug.so
-     *    --plugin /usr/lib/my/fancyplug.so  -> /usr/lib/my/fancyplug.so
-     *
-     * Please note that $CWD means the directory OpenVPN is either started from
-     * or the directory OpenVPN have changed into using --cd before --plugin
-     * was parsed.
-     *
-     */
-    if (!absolute_pathname(p->so_pathname)
-        && p->so_pathname[0] != '.')
+#if defined(PLUGIN_LIBDIR)
+    if (!absolute_pathname(p->so_pathname))
     {
         char full[PATH_MAX];
 
         openvpn_snprintf(full, sizeof(full), "%s/%s", PLUGIN_LIBDIR, p->so_pathname);
         p->handle = dlopen(full, RTLD_NOW);
+#if defined(ENABLE_PLUGIN_SEARCH)
+        if (!p->handle)
+        {
+            rel = true;
+            p->handle = dlopen(p->so_pathname, RTLD_NOW);
+        }
+#endif
     }
     else
+#endif
     {
         rel = !absolute_pathname(p->so_pathname);
         p->handle = dlopen(p->so_pathname, RTLD_NOW);
@@ -409,8 +402,7 @@ plugin_log(openvpn_plugin_log_flags_t flags, const char *name, const char *forma
 
 static struct openvpn_plugin_callbacks callbacks = {
     plugin_log,
-    plugin_vlog,
-    secure_memzero   /* plugin_secure_memzero */
+    plugin_vlog
 };
 
 
@@ -753,9 +745,7 @@ plugin_common_close(struct plugin_common *pc)
         int i;
 
         for (i = 0; i < pc->n; ++i)
-        {
             plugin_close_item(&pc->plugins[i]);
-        }
         free(pc);
     }
 }
@@ -893,9 +883,7 @@ plugin_abort(void)
         int i;
 
         for (i = 0; i < pc->n; ++i)
-        {
             plugin_abort_item(&pc->plugins[i]);
-        }
     }
 }
 
@@ -976,9 +964,7 @@ plugin_return_get_column(const struct plugin_return *src,
 
     dest->n = 0;
     for (i = 0; i < src->n; ++i)
-    {
         dest->list[i] = openvpn_plugin_string_list_find(src->list[i], colname);
-    }
     dest->n = i;
 }
 
@@ -987,9 +973,7 @@ plugin_return_free(struct plugin_return *pr)
 {
     int i;
     for (i = 0; i < pr->n; ++i)
-    {
         openvpn_plugin_string_list_free(pr->list[i]);
-    }
     pr->n = 0;
 }
 
@@ -1019,7 +1003,6 @@ plugin_return_print(const int msglevel, const char *prefix, const struct plugin_
 
 #else  /* ifdef ENABLE_PLUGIN */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_PLUGIN */
diff --git a/src/openvpn/plugin.h b/src/openvpn/plugin.h
index 0cffee0..4ded529 100644
--- a/src/openvpn/plugin.h
+++ b/src/openvpn/plugin.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/pool.c b/src/openvpn/pool.c
index a8f15b9..aa0bc2b 100644
--- a/src/openvpn/pool.c
+++ b/src/openvpn/pool.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -214,9 +215,7 @@ ifconfig_pool_free(struct ifconfig_pool *pool)
     {
         int i;
         for (i = 0; i < pool->size; ++i)
-        {
             ifconfig_pool_entry_free(&pool->list[i], true);
-        }
         free(pool->list);
         free(pool);
     }
diff --git a/src/openvpn/pool.h b/src/openvpn/pool.h
index ee91d82..c3e1190 100644
--- a/src/openvpn/pool.h
+++ b/src/openvpn/pool.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef POOL_H
diff --git a/src/openvpn/proto.c b/src/openvpn/proto.c
index 2cbea3a..40e0714 100644
--- a/src/openvpn/proto.c
+++ b/src/openvpn/proto.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/proto.h b/src/openvpn/proto.h
index 57f25c9..bfcb36d 100644
--- a/src/openvpn/proto.h
+++ b/src/openvpn/proto.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef PROTO_H
diff --git a/src/openvpn/proxy.c b/src/openvpn/proxy.c
index 7a737ea..dd327a2 100644
--- a/src/openvpn/proxy.c
+++ b/src/openvpn/proxy.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -317,7 +318,6 @@ get_proxy_authenticate(socket_descriptor_t sd,
     {
         if (!recv_line(sd, buf, sizeof(buf), timeout, true, NULL, signal_received))
         {
-            free(*data);
             *data = NULL;
             return HTTP_AUTH_NONE;
         }
@@ -381,9 +381,7 @@ get_key_value(const char *str,       /* source string */
     bool escape = false;
 
     for (c = max_key_len-1; (*str && (*str != '=') && c--); )
-    {
         *key++ = *str++;
-    }
     *key = '\0';
 
     if ('=' != *str++)
@@ -477,9 +475,7 @@ get_pa_var(const char *key, const char *pa, struct gc_arena *gc)
             ++content;
         }
         while (*content && isspace(*content))
-        {
             ++content;
-        }
     }
 }
 
@@ -778,8 +774,7 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
 
             /* receive and discard everything else */
             while (recv_line(sd, NULL, 0, 2, true, NULL, signal_received))
-            {
-            }
+                ;
 
             /* now send the phase 3 reply */
 
@@ -875,13 +870,6 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
                 const char *algor = get_pa_var("algorithm", pa, &gc);
                 const char *opaque = get_pa_var("opaque", pa, &gc);
 
-                if ( !realm || !nonce )
-                {
-                    msg(D_LINK_ERRORS, "HTTP proxy: digest auth failed, malformed response "
-                            "from server: realm= or nonce= missing" );
-                    goto error;
-                }
-
                 /* generate a client nonce */
                 ASSERT(rand_bytes(cnonce_raw, sizeof(cnonce_raw)));
                 cnonce = make_base64_string2(cnonce_raw, sizeof(cnonce_raw), &gc);
@@ -998,7 +986,6 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
                 if (p->options.auth_retry == PAR_NCT && method == HTTP_AUTH_BASIC)
                 {
                     msg(D_PROXY, "HTTP proxy: support for basic auth and other cleartext proxy auth methods is disabled");
-                    free(pa);
                     goto error;
                 }
                 p->auth_method = method;
@@ -1054,8 +1041,7 @@ establish_http_proxy_passthru(struct http_proxy_info *p,
      * start of the OpenVPN data stream (put it in lookahead).
      */
     while (recv_line(sd, NULL, 0, 2, false, lookahead, signal_received))
-    {
-    }
+        ;
 
     /* reset queried_creds so that we don't think that the next creds request is due to an auth error */
     p->queried_creds = false;
diff --git a/src/openvpn/proxy.h b/src/openvpn/proxy.h
index 3ce79de..c20a676 100644
--- a/src/openvpn/proxy.h
+++ b/src/openvpn/proxy.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef PROXY_H
diff --git a/src/openvpn/ps.c b/src/openvpn/ps.c
index c2b05cd..21b12ca 100644
--- a/src/openvpn/ps.c
+++ b/src/openvpn/ps.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/ps.h b/src/openvpn/ps.h
index b8c6853..0fc1ee4 100644
--- a/src/openvpn/ps.h
+++ b/src/openvpn/ps.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef PS_H
diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index 5947a31..f515475 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -371,17 +372,15 @@ prepare_push_reply(struct context *c, struct gc_arena *gc,
     /* Push cipher if client supports Negotiable Crypto Parameters */
     if (tls_peer_info_ncp_ver(peer_info) >= 2 && o->ncp_enabled)
     {
-        /* if we have already created our key, we cannot *change* our own
-         * cipher -> so log the fact and push the "what we have now" cipher
-         * (so the client is always told what we expect it to use)
+        /* if we have already created our key, we cannot change our own
+         * cipher, so disable NCP and warn = explain why
          */
         const struct tls_session *session = &tls_multi->session[TM_ACTIVE];
         if (session->key[KS_PRIMARY].crypto_options.key_ctx_bi.initialized)
         {
             msg( M_INFO, "PUSH: client wants to negotiate cipher (NCP), but "
                  "server has already generated data channel keys, "
-                 "re-sending previously negotiated cipher '%s'",
-                 o->ciphername );
+                 "ignoring client request" );
         }
         else
         {
@@ -389,8 +388,8 @@ prepare_push_reply(struct context *c, struct gc_arena *gc,
              * TODO: actual negotiation, instead of server dictatorship. */
             char *push_cipher = string_alloc(o->ncp_ciphers, &o->gc);
             o->ciphername = strtok(push_cipher, ":");
+            push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
         }
-        push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
     }
     else if (o->ncp_enabled)
     {
@@ -693,8 +692,8 @@ push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
         {
             continue;
         }
-        md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
     }
+    md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
 }
 
 int
@@ -721,11 +720,10 @@ process_incoming_push_msg(struct context *c,
         if (ch == ',')
         {
             struct buffer buf_orig = buf;
-            if (!c->c2.pulled_options_digest_init_done)
+            if (!c->c2.pulled_options_md5_init_done)
             {
-                c->c2.pulled_options_state = md_ctx_new();
-                md_ctx_init(c->c2.pulled_options_state, md_kt_get("SHA256"));
-                c->c2.pulled_options_digest_init_done = true;
+                md_ctx_init(&c->c2.pulled_options_state, md_kt_get("MD5"));
+                c->c2.pulled_options_md5_init_done = true;
             }
             if (!c->c2.did_pre_pull_restore)
             {
@@ -738,17 +736,15 @@ process_incoming_push_msg(struct context *c,
                                    option_types_found,
                                    c->c2.es))
             {
-                push_update_digest(c->c2.pulled_options_state, &buf_orig,
+                push_update_digest(&c->c2.pulled_options_state, &buf_orig,
                                    &c->options);
                 switch (c->options.push_continuation)
                 {
                     case 0:
                     case 1:
-                        md_ctx_final(c->c2.pulled_options_state, c->c2.pulled_options_digest.digest);
-                        md_ctx_cleanup(c->c2.pulled_options_state);
-                        md_ctx_free(c->c2.pulled_options_state);
-                        c->c2.pulled_options_state = NULL;
-                        c->c2.pulled_options_digest_init_done = false;
+                        md_ctx_final(&c->c2.pulled_options_state, c->c2.pulled_options_digest.digest);
+                        md_ctx_cleanup(&c->c2.pulled_options_state);
+                        c->c2.pulled_options_md5_init_done = false;
                         ret = PUSH_MSG_REPLY;
                         break;
 
diff --git a/src/openvpn/push.h b/src/openvpn/push.h
index 4d42e81..86900c8 100644
--- a/src/openvpn/push.h
+++ b/src/openvpn/push.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef PUSH_H
diff --git a/src/openvpn/pushlist.h b/src/openvpn/pushlist.h
index 57216b2..58fc870 100644
--- a/src/openvpn/pushlist.h
+++ b/src/openvpn/pushlist.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #if !defined(PUSHLIST_H) && P2MP && P2MP_SERVER
diff --git a/src/openvpn/reliable.c b/src/openvpn/reliable.c
index 93541a9..57cdd78 100644
--- a/src/openvpn/reliable.c
+++ b/src/openvpn/reliable.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -111,12 +112,10 @@ reliable_ack_packet_id_present(struct reliable_ack *ack, packet_id_type pid)
 {
     int i;
     for (i = 0; i < ack->len; ++i)
-    {
         if (ack->packet_id[i] == pid)
         {
             return true;
         }
-    }
     return false;
 }
 
@@ -243,9 +242,7 @@ reliable_ack_write(struct reliable_ack *ack,
         ASSERT(session_id_defined(sid));
         ASSERT(session_id_write(sid, &sub));
         for (i = 0, j = n; j < ack->len; )
-        {
             ack->packet_id[i++] = ack->packet_id[j++];
-        }
         ack->len = i;
     }
 
@@ -805,7 +802,6 @@ reliable_debug_print(const struct reliable *rel, char *desc)
 
 #else  /* ifdef ENABLE_CRYPTO */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_CRYPTO */
diff --git a/src/openvpn/reliable.h b/src/openvpn/reliable.h
index aa34b02..455168a 100644
--- a/src/openvpn/reliable.h
+++ b/src/openvpn/reliable.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 
diff --git a/src/openvpn/route.c b/src/openvpn/route.c
index a1811f4..ea09d71 100644
--- a/src/openvpn/route.c
+++ b/src/openvpn/route.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -985,19 +986,11 @@ redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *tt, un
 
     if (rl && rl->flags & RG_ENABLE)
     {
-        bool local = rl->flags & RG_LOCAL;
-
         if (!(rl->spec.flags & RTSA_REMOTE_ENDPOINT) && (rl->flags & RG_REROUTE_GW))
         {
             msg(M_WARN, "%s VPN gateway parameter (--route-gateway or --ifconfig) is missing", err);
         }
-        /*
-         * check if a default route is defined, unless:
-         * - we are connecting to a remote host in our network
-         * - we are connecting to a non-IPv4 remote host (i.e. we use IPv6)
-         */
-        else if (!(rl->rgi.flags & RGI_ADDR_DEFINED) && !local
-                 && (rl->spec.remote_host != IPV4_INVALID_ADDR))
+        else if (!(rl->rgi.flags & RGI_ADDR_DEFINED))
         {
             msg(M_WARN, "%s Cannot read current default gateway from system", err);
         }
@@ -1008,6 +1001,7 @@ redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *tt, un
         else
         {
 #ifndef TARGET_ANDROID
+            bool local = BOOL_CAST(rl->flags & RG_LOCAL);
             if (rl->flags & RG_AUTO_LOCAL)
             {
                 const int tla = rl->spec.remote_host_local;
@@ -1072,13 +1066,14 @@ redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *tt, un
                 }
                 else
                 {
-                    /* don't try to remove the def route if it does not exist */
-                    if (rl->rgi.flags & RGI_ADDR_DEFINED)
-                    {
-                        /* delete default route */
-                        del_route3(0, 0, rl->rgi.gateway.addr, tt,
-                                   flags | ROUTE_REF_GW, &rl->rgi, es);
-                    }
+                    /* delete default route */
+                    del_route3(0,
+                               0,
+                               rl->rgi.gateway.addr,
+                               tt,
+                               flags | ROUTE_REF_GW,
+                               &rl->rgi,
+                               es);
 
                     /* add new default route */
                     add_route3(0,
@@ -1150,12 +1145,15 @@ undo_redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *t
                            flags,
                            &rl->rgi,
                            es);
-                /* restore original default route if there was any */
-                if (rl->rgi.flags & RGI_ADDR_DEFINED)
-                {
-                    add_route3(0, 0, rl->rgi.gateway.addr, tt,
-                               flags | ROUTE_REF_GW, &rl->rgi, es);
-                }
+
+                /* restore original default route */
+                add_route3(0,
+                           0,
+                           rl->rgi.gateway.addr,
+                           tt,
+                           flags | ROUTE_REF_GW,
+                           &rl->rgi,
+                           es);
             }
         }
 
@@ -1198,15 +1196,6 @@ add_routes(struct route_list *rl, struct route_ipv6_list *rl6, const struct tunt
     if (rl6 && !(rl6->iflags & RL_ROUTES_ADDED) )
     {
         struct route_ipv6 *r;
-
-        if (!tt->did_ifconfig_ipv6_setup)
-        {
-            msg(M_INFO, "WARNING: OpenVPN was configured to add an IPv6 "
-                "route over %s. However, no IPv6 has been configured for "
-                "this interface, therefore the route installation may "
-                "fail or may not work as expected.", tt->actual_name);
-        }
-
         for (r = rl6->routes_ipv6; r; r = r->next)
         {
             if (flags & ROUTE_DELETE_FIRST)
@@ -1292,9 +1281,7 @@ print_route_options(const struct route_option_list *rol,
             (rol->flags & RG_LOCAL) != 0);
     }
     for (ro = rol->routes; ro; ro = ro->next)
-    {
         print_route_option(ro, level);
-    }
 }
 
 void
@@ -1388,9 +1375,7 @@ print_routes(const struct route_list *rl, int level)
 {
     struct route_ipv4 *r;
     for (r = rl->routes; r; r = r->next)
-    {
         print_route(r, level);
-    }
 }
 
 static void
@@ -1419,9 +1404,7 @@ setenv_routes(struct env_set *es, const struct route_list *rl)
     int i = 1;
     struct route_ipv4 *r;
     for (r = rl->routes; r; r = r->next)
-    {
         setenv_route(es, r, i++);
-    }
 }
 
 static void
@@ -1450,9 +1433,7 @@ setenv_routes_ipv6(struct env_set *es, const struct route_ipv6_list *rl6)
     int i = 1;
     struct route_ipv6 *r6;
     for (r6 = rl6->routes_ipv6; r6; r6 = r6->next)
-    {
         setenv_route_ipv6(es, r6, i++);
-    }
 }
 
 /*
@@ -1689,7 +1670,7 @@ add_route(struct route_ipv4 *r,
     argv_msg(D_ROUTE, &argv);
     status = openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route add command failed");
 
-#elif defined(TARGET_FREEBSD)
+#elif defined(TARGET_FREEBSD) || defined(__FreeBSD_kernel__)
 
     argv_printf(&argv, "%s add",
                 ROUTE_PATH);
@@ -1875,7 +1856,7 @@ add_route_ipv6(struct route_ipv6 *r6, const struct tuntap *tt, unsigned int flag
     network = print_in6_addr( r6->network, 0, &gc);
     gateway = print_in6_addr( r6->gateway, 0, &gc);
 
-#if defined(TARGET_DARWIN)    \
+#if defined(TARGET_DARWIN) || defined(__FreeBSD_kernel__)    \
     || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)    \
     || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
 
@@ -1893,6 +1874,14 @@ add_route_ipv6(struct route_ipv6 *r6, const struct tuntap *tt, unsigned int flag
     }
 #endif
 
+    if (!tt->did_ifconfig_ipv6_setup)
+    {
+        msg( M_INFO, "add_route_ipv6(): not adding %s/%d: "
+             "no IPv6 address been configured on interface %s",
+             network, r6->netbits, device);
+        return;
+    }
+
     msg( M_INFO, "add_route_ipv6(%s/%d -> %s metric %d) dev %s",
          network, r6->netbits, gateway, r6->metric, device );
 
@@ -2043,7 +2032,7 @@ add_route_ipv6(struct route_ipv6 *r6, const struct tuntap *tt, unsigned int flag
     argv_msg(D_ROUTE, &argv);
     status = openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route add -inet6 command failed");
 
-#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)
+#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) || defined(__FreeBSD_kernel__)
 
     argv_printf(&argv, "%s add -inet6 %s/%d",
                 ROUTE_PATH,
@@ -2227,7 +2216,7 @@ delete_route(struct route_ipv4 *r,
     argv_msg(D_ROUTE, &argv);
     openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route delete command failed");
 
-#elif defined(TARGET_FREEBSD)
+#elif defined(TARGET_FREEBSD) || defined(__FreeBSD_kernel__)
 
     argv_printf(&argv, "%s delete -net %s %s %s",
                 ROUTE_PATH,
@@ -2334,7 +2323,7 @@ delete_route_ipv6(const struct route_ipv6 *r6, const struct tuntap *tt, unsigned
     network = print_in6_addr( r6->network, 0, &gc);
     gateway = print_in6_addr( r6->gateway, 0, &gc);
 
-#if defined(TARGET_DARWIN)    \
+#if defined(TARGET_DARWIN) || defined(__FreeBSD_kernel__)    \
     || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)    \
     || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
 
@@ -2469,7 +2458,7 @@ delete_route_ipv6(const struct route_ipv6 *r6, const struct tuntap *tt, unsigned
     argv_msg(D_ROUTE, &argv);
     openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route delete -inet6 command failed");
 
-#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)
+#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) || defined(__FreeBSD_kernel__)
 
     argv_printf(&argv, "%s delete -inet6 %s/%d",
                 ROUTE_PATH,
@@ -2634,9 +2623,7 @@ test_routes(const struct route_list *rl, const struct tuntap *tt)
         {
             struct route_ipv4 *r;
             for (r = rl->routes, len = 0; r; r = r->next, ++len)
-            {
                 test_route_helper(&ret, &count, &good, &ambig, adapters, r->gateway);
-            }
 
             if ((rl->flags & RG_ENABLE) && (rl->spec.flags & RTSA_REMOTE_ENDPOINT))
             {
@@ -3060,10 +3047,8 @@ do_route_ipv6_service(const bool add, const struct route_ipv6 *r, const struct t
 
     /* In TUN mode we use a special link-local address as the next hop.
      * The tapdrvr knows about it and will answer neighbor discovery packets.
-     * (only do this for routes actually using the tun/tap device)
      */
-    if (tt->type == DEV_TYPE_TUN
-	 && msg.iface.index == tt->adapter_index )
+    if (tt->type == DEV_TYPE_TUN)
     {
         inet_pton(AF_INET6, "fe80::8", &msg.gateway.ipv6);
     }
@@ -3514,7 +3499,8 @@ done:
 
 #elif defined(TARGET_DARWIN) || defined(TARGET_SOLARIS)    \
     || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)    \
-    || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
+    || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)    \
+    || defined(__FreeBSD_kernel__)
 
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -3596,9 +3582,6 @@ get_default_gateway(struct route_gateway_info *rgi)
     rtm.rtm_flags = RTF_UP | RTF_GATEWAY;
     rtm.rtm_version = RTM_VERSION;
     rtm.rtm_seq = ++seq;
-#ifdef TARGET_OPENBSD
-    rtm.rtm_tableid = getrtable();
-#endif
     rtm.rtm_addrs = rtm_addrs;
 
     so_dst.sa_family = AF_INET;
@@ -3626,8 +3609,7 @@ get_default_gateway(struct route_gateway_info *rgi)
         msg(M_WARN, "GDG: problem writing to routing socket");
         goto done;
     }
-    do
-    {
+    do {
         l = read(sockfd, (char *)&m_rtmsg, sizeof(m_rtmsg));
     } while (l > 0 && (rtm.rtm_seq != seq || rtm.rtm_pid != pid));
     close(sockfd);
@@ -3814,9 +3796,6 @@ get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6,
     rtm.rtm_flags = RTF_UP;
     rtm.rtm_version = RTM_VERSION;
     rtm.rtm_seq = ++seq;
-#ifdef TARGET_OPENBSD
-    rtm.rtm_tableid = getrtable();
-#endif
 
     so_dst.sin6_family = AF_INET6;
     so_mask.sin6_family = AF_INET6;
diff --git a/src/openvpn/route.h b/src/openvpn/route.h
index 6414d6c..03ee8cd 100644
--- a/src/openvpn/route.h
+++ b/src/openvpn/route.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -353,8 +354,7 @@ bool del_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt);
 
 #else  /* ifdef _WIN32 */
 static inline bool
-test_routes(const struct route_list *rl, const struct tuntap *tt)
-{
+test_routes(const struct route_list *rl, const struct tuntap *tt) {
     return true;
 }
 #endif
diff --git a/src/openvpn/schedule.c b/src/openvpn/schedule.c
index b1ba5d4..610bfa4 100644
--- a/src/openvpn/schedule.c
+++ b/src/openvpn/schedule.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -376,9 +377,7 @@ schedule_add_modify(struct schedule *s, struct schedule_entry *e)
      * keeps the tree balanced.  Move the node up the tree until
      * its own priority is greater than that of its parent */
     while (e->parent && e->parent->pri > e->pri)
-    {
         schedule_rotate_up(s, e);
-    }
 }
 
 /*
@@ -624,9 +623,7 @@ schedule_print_work(struct schedule_entry *e, int indent)
     struct gc_arena gc = gc_new();
     int i;
     for (i = 0; i < indent; ++i)
-    {
         printf(" ");
-    }
     if (e)
     {
         printf("%s [%u] e=" ptr_format ", p=" ptr_format " lt=" ptr_format " gt=" ptr_format "\n",
diff --git a/src/openvpn/schedule.h b/src/openvpn/schedule.h
index e6c1b7e..f2a6813 100644
--- a/src/openvpn/schedule.h
+++ b/src/openvpn/schedule.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef SCHEDULE_H
diff --git a/src/openvpn/session_id.c b/src/openvpn/session_id.c
index dce42e7..b23f0f4 100644
--- a/src/openvpn/session_id.c
+++ b/src/openvpn/session_id.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -63,7 +64,6 @@ session_id_print(const struct session_id *sid, struct gc_arena *gc)
 
 #else  /* ifdef ENABLE_CRYPTO */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_CRYPTO */
diff --git a/src/openvpn/session_id.h b/src/openvpn/session_id.h
index 6611a3c..2b0ceb8 100644
--- a/src/openvpn/session_id.h
+++ b/src/openvpn/session_id.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/shaper.c b/src/openvpn/shaper.c
index 19dd54d..eb459ef 100644
--- a/src/openvpn/shaper.c
+++ b/src/openvpn/shaper.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -97,7 +98,6 @@ shaper_msg(struct shaper *s)
 
 #else  /* ifdef ENABLE_FEATURE_SHAPER */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_FEATURE_SHAPER */
diff --git a/src/openvpn/shaper.h b/src/openvpn/shaper.h
index 6fac16d..d97221a 100644
--- a/src/openvpn/shaper.h
+++ b/src/openvpn/shaper.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef SHAPER_H
diff --git a/src/openvpn/sig.c b/src/openvpn/sig.c
index 87cef71..9f4841a 100644
--- a/src/openvpn/sig.c
+++ b/src/openvpn/sig.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/sig.h b/src/openvpn/sig.h
index 7c41070..5783731 100644
--- a/src/openvpn/sig.h
+++ b/src/openvpn/sig.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef SIG_H
diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 4e7e3f9..ae12832 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -204,9 +205,7 @@ do_preresolve_host(struct context *c,
         {
             struct cached_dns_entry *prev = c->c1.dns_cache;
             while (prev->next)
-            {
                 prev = prev->next;
-            }
             prev->next = ph;
         }
 
@@ -337,6 +336,20 @@ openvpn_getaddrinfo(unsigned int flags,
     ASSERT(hostname || servname);
     ASSERT(!(flags & GETADDR_HOST_ORDER));
 
+    if (hostname && (flags & GETADDR_RANDOMIZE))
+    {
+        hostname = hostname_randomize(hostname, &gc);
+    }
+
+    if (hostname)
+    {
+        print_hostname = hostname;
+    }
+    else
+    {
+        print_hostname = "undefined";
+    }
+
     if (servname)
     {
         print_servname = servname;
@@ -387,20 +400,6 @@ openvpn_getaddrinfo(unsigned int flags,
         const char *fmt;
         int level = 0;
 
-        if (hostname && (flags & GETADDR_RANDOMIZE))
-        {
-            hostname = hostname_randomize(hostname, &gc);
-        }
-
-        if (hostname)
-        {
-            print_hostname = hostname;
-        }
-        else
-        {
-            print_hostname = "undefined";
-        }
-
         fmt = "RESOLVE: Cannot resolve host address: %s:%s (%s)";
         if ((flags & GETADDR_MENTION_RESOLVE_RETRY)
             && !resolve_retry_seconds)
@@ -511,10 +510,6 @@ openvpn_getaddrinfo(unsigned int flags,
     else
     {
         /* IP address parse succeeded */
-        if (flags & GETADDR_RANDOMIZE)
-        {
-            msg(M_WARN, "WARNING: ignoring --remote-random-hostname because the hostname is an IP address");
-        }
     }
 
 done:
@@ -1149,7 +1144,7 @@ tcp_connection_established(const struct link_socket_actual *act)
     gc_free(&gc);
 }
 
-static socket_descriptor_t
+static int
 socket_listen_accept(socket_descriptor_t sd,
                      struct link_socket_actual *act,
                      const char *remote_dynamic,
@@ -1161,7 +1156,7 @@ socket_listen_accept(socket_descriptor_t sd,
     struct gc_arena gc = gc_new();
     /* struct openvpn_sockaddr *remote = &act->dest; */
     struct openvpn_sockaddr remote_verify = act->dest;
-    socket_descriptor_t new_sd = SOCKET_UNDEFINED;
+    int new_sd = SOCKET_UNDEFINED;
 
     CLEAR(*act);
     socket_do_listen(sd, local, do_listen, true);
@@ -2013,8 +2008,7 @@ static void
 phase2_tcp_client(struct link_socket *sock, struct signal_info *sig_info)
 {
     bool proxy_retry = false;
-    do
-    {
+    do {
         socket_connect(&sock->sd,
                        sock->info.lsa->current_remote->ai_addr,
                        get_server_poll_remaining_time(sock->server_poll_timeout),
@@ -2370,8 +2364,7 @@ link_socket_bad_incoming_addr(struct buffer *buf,
                 (int)from_addr->dest.addr.sa.sa_family,
                 print_sockaddr_ex(info->lsa->remote_list->ai_addr,":",PS_SHOW_PORT, &gc));
             /* print additional remote addresses */
-            for (ai = info->lsa->remote_list->ai_next; ai; ai = ai->ai_next)
-            {
+            for (ai = info->lsa->remote_list->ai_next; ai; ai = ai->ai_next) {
                 msg(D_LINK_ERRORS,"or from peer address: %s",
                     print_sockaddr_ex(ai->ai_addr,":",PS_SHOW_PORT, &gc));
             }
@@ -3060,12 +3053,10 @@ ascii2proto(const char *proto_name)
 {
     int i;
     for (i = 0; i < SIZE(proto_names); ++i)
-    {
         if (!strcmp(proto_name, proto_names[i].short_form))
         {
             return proto_names[i].proto;
         }
-    }
     return -1;
 }
 
@@ -3074,12 +3065,10 @@ ascii2af(const char *proto_name)
 {
     int i;
     for (i = 0; i < SIZE(proto_names); ++i)
-    {
         if (!strcmp(proto_name, proto_names[i].short_form))
         {
             return proto_names[i].proto_af;
         }
-    }
     return 0;
 }
 
diff --git a/src/openvpn/socket.h b/src/openvpn/socket.h
index 2d7f218..63e601e 100644
--- a/src/openvpn/socket.h
+++ b/src/openvpn/socket.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef SOCKET_H
@@ -622,8 +623,7 @@ addr_defined(const struct openvpn_sockaddr *addr)
     {
         return 0;
     }
-    switch (addr->addr.sa.sa_family)
-    {
+    switch (addr->addr.sa.sa_family) {
         case AF_INET: return addr->addr.in4.sin_addr.s_addr != 0;
 
         case AF_INET6: return !IN6_IS_ADDR_UNSPECIFIED(&addr->addr.in6.sin6_addr);
@@ -639,8 +639,7 @@ addr_local(const struct sockaddr *addr)
     {
         return false;
     }
-    switch (addr->sa_family)
-    {
+    switch (addr->sa_family) {
         case AF_INET:
             return ((const struct sockaddr_in *)addr)->sin_addr.s_addr == htonl(INADDR_LOOPBACK);
 
@@ -661,8 +660,7 @@ addr_defined_ipi(const struct link_socket_actual *lsa)
     {
         return 0;
     }
-    switch (lsa->dest.addr.sa.sa_family)
-    {
+    switch (lsa->dest.addr.sa.sa_family) {
 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
         case AF_INET: return lsa->pi.in4.ipi_spec_dst.s_addr != 0;
 
@@ -689,8 +687,7 @@ link_socket_actual_defined(const struct link_socket_actual *act)
 static inline bool
 addr_match(const struct openvpn_sockaddr *a1, const struct openvpn_sockaddr *a2)
 {
-    switch (a1->addr.sa.sa_family)
-    {
+    switch (a1->addr.sa.sa_family) {
         case AF_INET:
             return a1->addr.in4.sin_addr.s_addr == a2->addr.in4.sin_addr.s_addr;
 
@@ -784,8 +781,7 @@ addrlist_port_match(const struct openvpn_sockaddr *a1, const struct addrinfo *a2
 static inline bool
 addr_port_match(const struct openvpn_sockaddr *a1, const struct openvpn_sockaddr *a2)
 {
-    switch (a1->addr.sa.sa_family)
-    {
+    switch (a1->addr.sa.sa_family) {
         case AF_INET:
             return a1->addr.in4.sin_addr.s_addr == a2->addr.in4.sin_addr.s_addr
                    && a1->addr.in4.sin_port == a2->addr.in4.sin_port;
@@ -822,8 +818,7 @@ addrlist_match_proto(const struct openvpn_sockaddr *a1,
 static inline void
 addr_zero_host(struct openvpn_sockaddr *addr)
 {
-    switch (addr->addr.sa.sa_family)
-    {
+    switch (addr->addr.sa.sa_family) {
         case AF_INET:
             addr->addr.in4.sin_addr.s_addr = 0;
             break;
@@ -851,8 +846,7 @@ int addr_guess_family(sa_family_t af,const char *name);
 static inline int
 af_addr_size(sa_family_t af)
 {
-    switch (af)
-    {
+    switch (af) {
         case AF_INET: return sizeof(struct sockaddr_in);
 
         case AF_INET6: return sizeof(struct sockaddr_in6);
@@ -925,8 +919,7 @@ link_socket_verify_incoming_addr(struct buffer *buf,
 {
     if (buf->len > 0)
     {
-        switch (from_addr->dest.addr.sa.sa_family)
-        {
+        switch (from_addr->dest.addr.sa.sa_family) {
             case AF_INET6:
             case AF_INET:
                 if (!link_socket_actual_defined(from_addr))
diff --git a/src/openvpn/socks.c b/src/openvpn/socks.c
index 92747ec..b50cac3 100644
--- a/src/openvpn/socks.c
+++ b/src/openvpn/socks.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/socks.h b/src/openvpn/socks.h
index 39b96c5..17e75e1 100644
--- a/src/openvpn/socks.h
+++ b/src/openvpn/socks.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 15cd94a..d94a421 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -18,9 +18,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -268,12 +269,10 @@ static void
 key_ctx_update_implicit_iv(struct key_ctx *ctx, uint8_t *key, size_t key_len);
 
 const tls_cipher_name_pair *
-tls_get_cipher_name_pair(const char *cipher_name, size_t len)
-{
+tls_get_cipher_name_pair(const char *cipher_name, size_t len) {
     const tls_cipher_name_pair *pair = tls_cipher_name_translation_table;
 
-    while (pair->openssl_name != NULL)
-    {
+    while (pair->openssl_name != NULL) {
         if ((strlen(pair->openssl_name) == len && 0 == memcmp(cipher_name, pair->openssl_name, len))
             || (strlen(pair->iana_name) == len && 0 == memcmp(cipher_name, pair->iana_name, len)))
         {
@@ -451,8 +450,6 @@ ssl_set_auth_nocache(void)
 {
     passbuf.nocache = true;
     auth_user_pass.nocache = true;
-    /* wait for push-reply, because auth-token may invert nocache */
-    auth_user_pass.wait_for_push = true;
 }
 
 /*
@@ -461,14 +458,6 @@ ssl_set_auth_nocache(void)
 void
 ssl_set_auth_token(const char *token)
 {
-    if (auth_user_pass.nocache)
-    {
-        msg(M_INFO,
-            "auth-token received, disabling auth-nocache for the "
-            "authentication token");
-        auth_user_pass.nocache = false;
-    }
-
     set_auth_token(&auth_user_pass, token);
 }
 
@@ -580,12 +569,12 @@ tls_ctx_reload_crl(struct tls_root_ctx *ssl_ctx, const char *crl_file,
      * Note: Windows does not support tv_nsec.
      */
     if ((ssl_ctx->crl_last_size == crl_stat.st_size)
-        && (ssl_ctx->crl_last_mtime == crl_stat.st_mtime))
+        && (ssl_ctx->crl_last_mtime.tv_sec == crl_stat.st_mtime))
     {
         return;
     }
 
-    ssl_ctx->crl_last_mtime = crl_stat.st_mtime;
+    ssl_ctx->crl_last_mtime.tv_sec = crl_stat.st_mtime;
     ssl_ctx->crl_last_size = crl_stat.st_size;
     backend_tls_ctx_reload_crl(ssl_ctx, crl_file, crl_file_inline);
 }
@@ -1072,9 +1061,7 @@ tls_session_init(struct tls_multi *multi, struct tls_session *session)
 
     /* Randomize session # if it is 0 */
     while (!session_id_defined(&session->session_id))
-    {
         session_id_random(&session->session_id);
-    }
 
     /* Are we a TLS server or client? */
     ASSERT(session->opt->key_method >= 1);
@@ -1136,9 +1123,7 @@ tls_session_free(struct tls_session *session, bool clear)
     free_buf(&session->tls_wrap.work);
 
     for (i = 0; i < KS_SIZE; ++i)
-    {
         key_state_free(&session->key[i], false);
-    }
 
     if (session->common_name)
     {
@@ -1195,8 +1180,7 @@ reset_session(struct tls_multi *multi, struct tls_session *session)
  * called again.
  */
 static inline void
-compute_earliest_wakeup(interval_t *earliest, interval_t seconds_from_now)
-{
+compute_earliest_wakeup(interval_t *earliest, interval_t seconds_from_now) {
     if (seconds_from_now < *earliest)
     {
         *earliest = seconds_from_now;
@@ -1366,9 +1350,7 @@ tls_multi_free(struct tls_multi *multi, bool clear)
     free(multi->remote_ciphername);
 
     for (i = 0; i < TM_SIZE; ++i)
-    {
         tls_session_free(&multi->session[i], false);
-    }
 
     if (clear)
     {
@@ -1616,8 +1598,8 @@ tls1_P_hash(const md_kt_t *md_kt,
 {
     struct gc_arena gc = gc_new();
     int chunk;
-    hmac_ctx_t *ctx;
-    hmac_ctx_t *ctx_tmp;
+    hmac_ctx_t ctx;
+    hmac_ctx_t ctx_tmp;
     uint8_t A1[MAX_HMAC_KEY_LENGTH];
     unsigned int A1_len;
 
@@ -1626,8 +1608,8 @@ tls1_P_hash(const md_kt_t *md_kt,
     const uint8_t *out_orig = out;
 #endif
 
-    ctx = hmac_ctx_new();
-    ctx_tmp = hmac_ctx_new();
+    CLEAR(ctx);
+    CLEAR(ctx_tmp);
 
     dmsg(D_SHOW_KEY_SOURCE, "tls1_P_hash sec: %s", format_hex(sec, sec_len, 0, &gc));
     dmsg(D_SHOW_KEY_SOURCE, "tls1_P_hash seed: %s", format_hex(seed, seed_len, 0, &gc));
@@ -1635,38 +1617,36 @@ tls1_P_hash(const md_kt_t *md_kt,
     chunk = md_kt_size(md_kt);
     A1_len = md_kt_size(md_kt);
 
-    hmac_ctx_init(ctx, sec, sec_len, md_kt);
-    hmac_ctx_init(ctx_tmp, sec, sec_len, md_kt);
+    hmac_ctx_init(&ctx, sec, sec_len, md_kt);
+    hmac_ctx_init(&ctx_tmp, sec, sec_len, md_kt);
 
-    hmac_ctx_update(ctx,seed,seed_len);
-    hmac_ctx_final(ctx, A1);
+    hmac_ctx_update(&ctx,seed,seed_len);
+    hmac_ctx_final(&ctx, A1);
 
     for (;; )
     {
-        hmac_ctx_reset(ctx);
-        hmac_ctx_reset(ctx_tmp);
-        hmac_ctx_update(ctx,A1,A1_len);
-        hmac_ctx_update(ctx_tmp,A1,A1_len);
-        hmac_ctx_update(ctx,seed,seed_len);
+        hmac_ctx_reset(&ctx);
+        hmac_ctx_reset(&ctx_tmp);
+        hmac_ctx_update(&ctx,A1,A1_len);
+        hmac_ctx_update(&ctx_tmp,A1,A1_len);
+        hmac_ctx_update(&ctx,seed,seed_len);
 
         if (olen > chunk)
         {
-            hmac_ctx_final(ctx, out);
+            hmac_ctx_final(&ctx, out);
             out += chunk;
             olen -= chunk;
-            hmac_ctx_final(ctx_tmp, A1); /* calc the next A1 value */
+            hmac_ctx_final(&ctx_tmp, A1); /* calc the next A1 value */
         }
         else    /* last one */
         {
-            hmac_ctx_final(ctx, A1);
+            hmac_ctx_final(&ctx, A1);
             memcpy(out,A1,olen);
             break;
         }
     }
-    hmac_ctx_cleanup(ctx);
-    hmac_ctx_free(ctx);
-    hmac_ctx_cleanup(ctx_tmp);
-    hmac_ctx_free(ctx_tmp);
+    hmac_ctx_cleanup(&ctx);
+    hmac_ctx_cleanup(&ctx_tmp);
     secure_memzero(A1, sizeof(A1));
 
     dmsg(D_SHOW_KEY_SOURCE, "tls1_P_hash out: %s", format_hex(out_orig, olen_orig, 0, &gc));
@@ -1718,9 +1698,7 @@ tls1_PRF(const uint8_t *label,
     tls1_P_hash(sha1,S2,len,label,label_len,out2,olen);
 
     for (i = 0; i<olen; i++)
-    {
         out1[i] ^= out2[i];
-    }
 
     secure_memzero(out2, olen);
 
@@ -1870,8 +1848,7 @@ exit:
 }
 
 static void
-key_ctx_update_implicit_iv(struct key_ctx *ctx, uint8_t *key, size_t key_len)
-{
+key_ctx_update_implicit_iv(struct key_ctx *ctx, uint8_t *key, size_t key_len) {
     const cipher_kt_t *cipher_kt = cipher_ctx_get_cipher_kt(ctx->cipher);
 
     /* Only use implicit IV in AEAD cipher mode, where HMAC key is not used */
@@ -1970,12 +1947,6 @@ tls_session_update_crypto_params(struct tls_session *session,
         return false;
     }
 
-    if (strcmp(options->ciphername, session->opt->config_ciphername))
-    {
-        msg(D_HANDSHAKE, "Data Channel: using negotiated cipher '%s'",
-            options->ciphername);
-    }
-
     init_key_type(&session->opt->key_type, options->ciphername,
                   options->authname, options->keysize, true, true);
 
@@ -2269,7 +2240,7 @@ push_peer_info(struct buffer *buf, struct tls_session *session)
         buf_printf(&out, "IV_PLAT=mac\n");
 #elif defined(TARGET_NETBSD)
         buf_printf(&out, "IV_PLAT=netbsd\n");
-#elif defined(TARGET_FREEBSD)
+#elif defined(TARGET_FREEBSD) || defined(__FreeBSD_kernel__)
         buf_printf(&out, "IV_PLAT=freebsd\n");
 #elif defined(TARGET_ANDROID)
         buf_printf(&out, "IV_PLAT=android\n");
@@ -2393,21 +2364,7 @@ key_method_2_write(struct buffer *buf, struct tls_session *session)
         {
             goto error;
         }
-        /* if auth-nocache was specified, the auth_user_pass object reaches
-         * a "complete" state only after having received the push-reply
-         * message.
-         * This is the case because auth-token statement in a push-reply would
-         * invert its nocache.
-         *
-         * For this reason, skip the purge operation here if no push-reply
-         * message has been received yet.
-         *
-         * This normally happens upon first negotiation only.
-         */
-        if (!auth_user_pass.wait_for_push)
-        {
-            purge_user_pass(&auth_user_pass, false);
-        }
+        purge_user_pass(&auth_user_pass, false);
     }
     else
     {
@@ -2523,7 +2480,7 @@ key_method_2_read(struct buffer *buf, struct tls_multi *multi, struct tls_sessio
 
     struct gc_arena gc = gc_new();
     char *options;
-    struct user_pass *up = NULL;
+    struct user_pass *up;
 
     /* allocate temporary objects */
     ALLOC_ARRAY_CLEAR_GC(options, char, TLS_OPTIONS_LEN, &gc);
@@ -2685,10 +2642,6 @@ key_method_2_read(struct buffer *buf, struct tls_multi *multi, struct tls_sessio
 
 error:
     secure_memzero(ks->key_src, sizeof(*ks->key_src));
-    if (up)
-    {
-        secure_memzero(up, sizeof(*up));
-    }
     buf_clear(buf);
     gc_free(&gc);
     return false;
@@ -2850,9 +2803,6 @@ tls_process(struct tls_multi *multi,
                                    session->opt->crl_file, session->opt->crl_file_inline);
             }
 
-            /* New connection, remove any old X509 env variables */
-            tls_x509_clear_env(session->opt->es);
-
             dmsg(D_TLS_DEBUG_MED, "STATE S_START");
         }
 
@@ -4106,8 +4056,7 @@ tls_peer_info_ncp_ver(const char *peer_info)
 }
 
 bool
-tls_check_ncp_cipher_list(const char *list)
-{
+tls_check_ncp_cipher_list(const char *list) {
     bool unsupported_cipher_found = false;
 
     ASSERT(list);
@@ -4250,16 +4199,8 @@ done:
     return BSTR(&out);
 }
 
-void
-delayed_auth_pass_purge(void)
-{
-    auth_user_pass.wait_for_push = false;
-    purge_user_pass(&auth_user_pass, false);
-}
-
 #else  /* if defined(ENABLE_CRYPTO) */
 static void
-dummy(void)
-{
+dummy(void) {
 }
 #endif /* ENABLE_CRYPTO */
diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h
index 56ea601..03688ca 100644
--- a/src/openvpn/ssl.h
+++ b/src/openvpn/ssl.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -598,8 +599,6 @@ void extract_x509_field_test(void);
  */
 bool is_hard_reset(int op, int key_method);
 
-void delayed_auth_pass_purge(void);
-
 #endif /* ENABLE_CRYPTO */
 
 #endif /* ifndef OPENVPN_SSL_H */
diff --git a/src/openvpn/ssl_backend.h b/src/openvpn/ssl_backend.h
index a738f0f..206400f 100644
--- a/src/openvpn/ssl_backend.h
+++ b/src/openvpn/ssl_backend.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index 25bffd5..9a16d77 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -270,7 +271,6 @@ struct tls_options
     unsigned remote_cert_ku[MAX_PARMS];
     const char *remote_cert_eku;
     uint8_t *verify_hash;
-    hash_algo_type verify_hash_algo;
     char *x509_username_field;
 
     /* allow openvpn config info to be
diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
index ef583e6..5c84e30 100644
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -18,9 +18,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -184,8 +185,7 @@ tls_ctx_set_options(struct tls_root_ctx *ctx, unsigned int ssl_flags)
 }
 
 static const char *
-tls_translate_cipher_name(const char *cipher_name)
-{
+tls_translate_cipher_name(const char *cipher_name) {
     const tls_cipher_name_pair *pair = tls_get_cipher_name_pair(cipher_name, strlen(cipher_name));
 
     if (NULL == pair)
@@ -222,12 +222,10 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
 
     /* Get number of ciphers */
     for (i = 0, cipher_count = 1; i < ciphers_len; i++)
-    {
         if (ciphers[i] == ':')
         {
             cipher_count++;
         }
-    }
 
     /* Allocate an array for them */
     ALLOC_ARRAY_CLEAR(ctx->allowed_ciphers, int, cipher_count+1)
@@ -835,8 +833,7 @@ tls_version_max(void)
  *                      Must be a valid pointer.
  */
 static void
-tls_version_to_major_minor(int tls_ver, int *major, int *minor)
-{
+tls_version_to_major_minor(int tls_ver, int *major, int *minor) {
     ASSERT(major);
     ASSERT(minor);
 
diff --git a/src/openvpn/ssl_mbedtls.h b/src/openvpn/ssl_mbedtls.h
index f69b610..1bc53ce 100644
--- a/src/openvpn/ssl_mbedtls.h
+++ b/src/openvpn/ssl_mbedtls.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -73,7 +74,7 @@ struct tls_root_ctx {
     mbedtls_x509_crt *ca_chain;         /**< CA chain for remote verification */
     mbedtls_pk_context *priv_key;       /**< Local private key */
     mbedtls_x509_crl *crl;              /**< Certificate Revocation List */
-    time_t crl_last_mtime;              /**< CRL last modification time */
+    struct timespec crl_last_mtime;     /**< CRL last modification time */
     off_t crl_last_size;                /**< size of last loaded CRL */
 #if defined(ENABLE_PKCS11)
     mbedtls_pkcs11_context *priv_key_pkcs11;    /**< PKCS11 private key */
diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
index e589dcd..eae1e22 100644
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -44,7 +45,6 @@
 #include "ssl_backend.h"
 #include "ssl_common.h"
 #include "base64.h"
-#include "openssl_compat.h"
 
 #ifdef ENABLE_CRYPTOAPI
 #include "cryptoapi.h"
@@ -321,8 +321,7 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
 
     /* Translate IANA cipher suite names to OpenSSL names */
     begin_of_cipher = end_of_cipher = 0;
-    for (; begin_of_cipher < strlen(ciphers); begin_of_cipher = end_of_cipher)
-    {
+    for (; begin_of_cipher < strlen(ciphers); begin_of_cipher = end_of_cipher) {
         end_of_cipher += strcspn(&ciphers[begin_of_cipher], ":");
         cipher_pair = tls_get_cipher_name_pair(&ciphers[begin_of_cipher], end_of_cipher - begin_of_cipher);
 
@@ -354,8 +353,7 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
         }
 
         /* Make sure new cipher name fits in cipher string */
-        if ((SIZE_MAX - openssl_ciphers_len) < current_cipher_len
-            || ((sizeof(openssl_ciphers)-1) < openssl_ciphers_len + current_cipher_len))
+        if (((sizeof(openssl_ciphers)-1) - openssl_ciphers_len) < current_cipher_len)
         {
             msg(M_FATAL,
                 "Failed to set restricted TLS cipher list, too long (>%d).",
@@ -509,18 +507,10 @@ tls_ctx_load_ecdh_params(struct tls_root_ctx *ctx, const char *curve_name
         const EC_GROUP *ecgrp = NULL;
         EVP_PKEY *pkey = NULL;
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
-        pkey = SSL_CTX_get0_privatekey(ctx->ctx);
-#else
         /* Little hack to get private key ref from SSL_CTX, yay OpenSSL... */
-        SSL *ssl = SSL_new(ctx->ctx);
-        if (!ssl)
-        {
-            crypto_msg(M_FATAL, "SSL_new failed");
-        }
-        pkey = SSL_get_privatekey(ssl);
-        SSL_free(ssl);
-#endif
+        SSL ssl;
+        ssl.cert = ctx->ctx->cert;
+        pkey = SSL_get_privatekey(&ssl);
 
         msg(D_TLS_DEBUG, "Extracting ECDH curve from private key");
 
@@ -659,8 +649,7 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file,
         {
             for (i = 0; i < sk_X509_num(ca); i++)
             {
-                X509_STORE *cert_store = SSL_CTX_get_cert_store(ctx->ctx);
-                if (!X509_STORE_add_cert(cert_store,sk_X509_value(ca, i)))
+                if (!X509_STORE_add_cert(ctx->ctx->cert_store,sk_X509_value(ca, i)))
                 {
                     crypto_msg(M_FATAL,"Cannot add certificate to certificate chain (X509_STORE_add_cert)");
                 }
@@ -762,9 +751,8 @@ tls_ctx_load_cert_file_and_copy(struct tls_root_ctx *ctx,
         goto end;
     }
 
-    x = PEM_read_bio_X509(in, NULL,
-                          SSL_CTX_get_default_passwd_cb(ctx->ctx),
-                          SSL_CTX_get_default_passwd_cb_userdata(ctx->ctx));
+    x = PEM_read_bio_X509(in, NULL, ctx->ctx->default_passwd_callback,
+                          ctx->ctx->default_passwd_callback_userdata);
     if (x == NULL)
     {
         SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_PEM_LIB);
@@ -846,8 +834,8 @@ tls_ctx_load_priv_file(struct tls_root_ctx *ctx, const char *priv_key_file,
     }
 
     pkey = PEM_read_bio_PrivateKey(in, NULL,
-                                   SSL_CTX_get_default_passwd_cb(ctx->ctx),
-                                   SSL_CTX_get_default_passwd_cb_userdata(ctx->ctx));
+                                   ssl_ctx->default_passwd_callback,
+                                   ssl_ctx->default_passwd_callback_userdata);
     if (!pkey)
     {
         goto end;
@@ -900,15 +888,15 @@ backend_tls_ctx_reload_crl(struct tls_root_ctx *ssl_ctx, const char *crl_file,
     /* Always start with a cleared CRL list, for that we
      * we need to manually find the CRL object from the stack
      * and remove it */
-    STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);
-    for (int i = 0; i < sk_X509_OBJECT_num(objs); i++)
+    for (int i = 0; i < sk_X509_OBJECT_num(store->objs); i++)
     {
-        X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);
+        X509_OBJECT *obj = sk_X509_OBJECT_value(store->objs, i);
         ASSERT(obj);
-        if (X509_OBJECT_get_type(obj) == X509_LU_CRL)
+        if (obj->type == X509_LU_CRL)
         {
-            sk_X509_OBJECT_delete(objs, i);
-            X509_OBJECT_free(obj);
+            sk_X509_OBJECT_delete(store->objs, i);
+            X509_OBJECT_free_contents(obj);
+            OPENSSL_free(obj);
         }
     }
 
@@ -976,13 +964,10 @@ rsa_priv_dec(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, i
 
 /* called at RSA_free */
 static int
-openvpn_extkey_rsa_finish(RSA *rsa)
+rsa_finish(RSA *rsa)
 {
-    /* meth was allocated in tls_ctx_use_external_private_key() ; since
-     * this function is called when the parent RSA object is destroyed,
-     * it is no longer used after this point so kill it. */
-    const RSA_METHOD *meth = RSA_get_method(rsa);
-    RSA_meth_free((RSA_METHOD *)meth);
+    free((void *)rsa->meth);
+    rsa->meth = NULL;
     return 1;
 }
 
@@ -998,7 +983,7 @@ rsa_priv_enc(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, i
 
     if (padding != RSA_PKCS1_PADDING)
     {
-        RSAerr(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
+        RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
         goto done;
     }
 
@@ -1056,16 +1041,16 @@ tls_ctx_use_external_private_key(struct tls_root_ctx *ctx,
     ASSERT(NULL != cert);
 
     /* allocate custom RSA method object */
-    rsa_meth = RSA_meth_new("OpenVPN external private key RSA Method",
-                            RSA_METHOD_FLAG_NO_CHECK);
-    check_malloc_return(rsa_meth);
-    RSA_meth_set_pub_enc(rsa_meth, rsa_pub_enc);
-    RSA_meth_set_pub_dec(rsa_meth, rsa_pub_dec);
-    RSA_meth_set_priv_enc(rsa_meth, rsa_priv_enc);
-    RSA_meth_set_priv_dec(rsa_meth, rsa_priv_dec);
-    RSA_meth_set_init(rsa_meth, NULL);
-    RSA_meth_set_finish(rsa_meth, openvpn_extkey_rsa_finish);
-    RSA_meth_set0_app_data(rsa_meth, NULL);
+    ALLOC_OBJ_CLEAR(rsa_meth, RSA_METHOD);
+    rsa_meth->name = "OpenVPN external private key RSA Method";
+    rsa_meth->rsa_pub_enc = rsa_pub_enc;
+    rsa_meth->rsa_pub_dec = rsa_pub_dec;
+    rsa_meth->rsa_priv_enc = rsa_priv_enc;
+    rsa_meth->rsa_priv_dec = rsa_priv_dec;
+    rsa_meth->init = NULL;
+    rsa_meth->finish = rsa_finish;
+    rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK;
+    rsa_meth->app_data = NULL;
 
     /* allocate RSA object */
     rsa = RSA_new();
@@ -1076,16 +1061,12 @@ tls_ctx_use_external_private_key(struct tls_root_ctx *ctx,
     }
 
     /* get the public key */
-    EVP_PKEY *pkey = X509_get0_pubkey(cert);
-    ASSERT(pkey); /* NULL before SSL_CTX_use_certificate() is called */
-    pub_rsa = EVP_PKEY_get0_RSA(pkey);
+    ASSERT(cert->cert_info->key->pkey); /* NULL before SSL_CTX_use_certificate() is called */
+    pub_rsa = cert->cert_info->key->pkey->pkey.rsa;
 
     /* initialize RSA object */
-    const BIGNUM *n = NULL;
-    const BIGNUM *e = NULL;
-    RSA_get0_key(pub_rsa, &n, &e, NULL);
-    RSA_set0_key(rsa, BN_dup(n), BN_dup(e), NULL);
-    RSA_set_flags(rsa, RSA_flags(rsa) | RSA_FLAG_EXT_PKEY);
+    rsa->n = BN_dup(pub_rsa->n);
+    rsa->flags |= RSA_FLAG_EXT_PKEY;
     if (!RSA_set_method(rsa, rsa_meth))
     {
         goto err;
@@ -1686,17 +1667,17 @@ print_details(struct key_state_ssl *ks_ssl, const char *prefix)
         EVP_PKEY *pkey = X509_get_pubkey(cert);
         if (pkey != NULL)
         {
-            if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA && EVP_PKEY_get0_RSA(pkey) != NULL)
+            if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
+                && pkey->pkey.rsa->n != NULL)
             {
-                RSA *rsa = EVP_PKEY_get0_RSA(pkey);
                 openvpn_snprintf(s2, sizeof(s2), ", %d bit RSA",
-                                 RSA_bits(rsa));
+                                 BN_num_bits(pkey->pkey.rsa->n));
             }
-            else if (EVP_PKEY_id(pkey) == EVP_PKEY_DSA && EVP_PKEY_get0_DSA(pkey) != NULL)
+            else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
+                     && pkey->pkey.dsa->p != NULL)
             {
-                DSA *dsa = EVP_PKEY_get0_DSA(pkey);
                 openvpn_snprintf(s2, sizeof(s2), ", %d bit DSA",
-                                 DSA_bits(dsa));
+                                 BN_num_bits(pkey->pkey.dsa->p));
             }
             EVP_PKEY_free(pkey);
         }
diff --git a/src/openvpn/ssl_openssl.h b/src/openvpn/ssl_openssl.h
index db4e1da..c64c65f 100644
--- a/src/openvpn/ssl_openssl.h
+++ b/src/openvpn/ssl_openssl.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -48,7 +49,7 @@
  */
 struct tls_root_ctx {
     SSL_CTX *ctx;
-    time_t crl_last_mtime;
+    struct timespec crl_last_mtime;
     off_t crl_last_size;
 };
 
diff --git a/src/openvpn/ssl_verify.c b/src/openvpn/ssl_verify.c
index 9cd36d7..c553484 100644
--- a/src/openvpn/ssl_verify.c
+++ b/src/openvpn/ssl_verify.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -273,9 +274,7 @@ cert_hash_free(struct cert_hash_set *chs)
     {
         int i;
         for (i = 0; i < MAX_CERT_DEPTH; ++i)
-        {
             free(chs->ch[i]);
-        }
         free(chs);
     }
 }
@@ -717,31 +716,8 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep
     /* verify level 1 cert, i.e. the CA that signed our leaf cert */
     if (cert_depth == 1 && opt->verify_hash)
     {
-        struct buffer ca_hash = {0};
-
-        switch (opt->verify_hash_algo)
-        {
-        case MD_SHA1:
-            ca_hash = x509_get_sha1_fingerprint(cert, &gc);
-            break;
-
-        case MD_SHA256:
-            ca_hash = x509_get_sha256_fingerprint(cert, &gc);
-            break;
-
-        default:
-            /* This should normally not happen at all; the algorithm used
-             * is parsed by add_option() [options.c] and set to a predefined
-             * value in an enumerated type.  So if this unlikely scenario
-             * happens, consider this a failure
-             */
-            msg(M_WARN, "Unexpected invalid algorithm used with "
-                "--verify-hash (%i)", opt->verify_hash_algo);
-            ret = FAILURE;
-            goto cleanup;
-        }
-
-        if (memcmp(BPTR(&ca_hash), opt->verify_hash, BLEN(&ca_hash)))
+        struct buffer sha1_hash = x509_get_sha1_fingerprint(cert, &gc);
+        if (memcmp(BPTR(&sha1_hash), opt->verify_hash, BLEN(&sha1_hash)))
         {
             msg(D_TLS_ERRORS, "TLS Error: level-1 certificate hash verification failed");
             goto cleanup;
@@ -1515,21 +1491,4 @@ verify_final_auth_checks(struct tls_multi *multi, struct tls_session *session)
         gc_free(&gc);
     }
 }
-
-void
-tls_x509_clear_env(struct env_set *es)
-{
-    struct env_item *item = es->list;
-    while (item)
-    {
-        struct env_item *next = item->next;
-        if (item->string
-            && 0 == strncmp("X509_", item->string, strlen("X509_")))
-        {
-            env_set_del(es, item->string);
-        }
-        item = next;
-    }
-}
-
 #endif /* ENABLE_CRYPTO */
diff --git a/src/openvpn/ssl_verify.h b/src/openvpn/ssl_verify.h
index f2d0d6c..ffab218 100644
--- a/src/openvpn/ssl_verify.h
+++ b/src/openvpn/ssl_verify.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -217,9 +218,6 @@ struct x509_track
 /** Do not perform Netscape certificate type verification */
 #define NS_CERT_CHECK_CLIENT (1<<1)
 
-/** Require keyUsage to be present in cert (0xFFFF is an invalid KU value) */
-#define OPENVPN_KU_REQUIRED (0xFFFF)
-
 /*
  * TODO: document
  */
@@ -240,9 +238,6 @@ tls_client_reason(struct tls_multi *multi)
 #endif
 }
 
-/** Remove any X509_ env variables from env_set es */
-void tls_x509_clear_env(struct env_set *es);
-
 #endif /* ENABLE_CRYPTO */
 
 #endif /* SSL_VERIFY_H_ */
diff --git a/src/openvpn/ssl_verify_backend.h b/src/openvpn/ssl_verify_backend.h
index e8eaabe..c4330ba 100644
--- a/src/openvpn/ssl_verify_backend.h
+++ b/src/openvpn/ssl_verify_backend.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -124,14 +125,6 @@ struct buffer x509_get_sha256_fingerprint(openvpn_x509_cert_t *cert,
 result_t backend_x509_get_username(char *common_name, int cn_len,
                                    char *x509_username_field, openvpn_x509_cert_t *peer_cert);
 
-#ifdef ENABLE_X509ALTUSERNAME
-/**
- * Return true iff the supplied extension field is supported by the
- * --x509-username-field option.
- */
-bool x509_username_field_ext_supported(const char *extname);
-#endif
-
 /*
  * Return the certificate's serial number in decimal string representation.
  *
@@ -218,7 +211,7 @@ void x509_setenv_track(const struct x509_track *xt, struct env_set *es,
  *                      the expected bit set. \c FAILURE if the certificate does
  *                      not have NS cert type verification or the wrong bit set.
  */
-result_t x509_verify_ns_cert_type(openvpn_x509_cert_t *cert, const int usage);
+result_t x509_verify_ns_cert_type(const openvpn_x509_cert_t *cert, const int usage);
 
 /*
  * Verify X.509 key usage extension field.
diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c
index 838c217..f01569f 100644
--- a/src/openvpn/ssl_verify_mbedtls.c
+++ b/src/openvpn/ssl_verify_mbedtls.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -208,7 +209,7 @@ x509_get_fingerprint(const mbedtls_md_info_t *md_info, mbedtls_x509_crt *cert,
 {
     const size_t md_size = mbedtls_md_get_size(md_info);
     struct buffer fingerprint = alloc_buf_gc(md_size, gc);
-    mbedtls_md(md_info, cert->raw.p, cert->raw.len, BPTR(&fingerprint));
+    mbedtls_md(md_info, cert->raw.p, cert->tbs.len, BPTR(&fingerprint));
     ASSERT(buf_inc_len(&fingerprint, md_size));
     return fingerprint;
 }
@@ -267,21 +268,11 @@ asn1_buf_to_c_string(const mbedtls_asn1_buf *orig, struct gc_arena *gc)
     size_t i;
     char *val;
 
-    if (!(orig->tag == MBEDTLS_ASN1_UTF8_STRING
-          || orig->tag == MBEDTLS_ASN1_PRINTABLE_STRING
-          || orig->tag == MBEDTLS_ASN1_IA5_STRING))
-    {
-        /* Only support C-string compatible types */
-        return string_alloc("ERROR: unsupported ASN.1 string type", gc);
-    }
-
     for (i = 0; i < orig->len; ++i)
-    {
         if (orig->p[i] == '\0')
         {
-            return string_alloc("ERROR: embedded null value", gc);
+            return "ERROR: embedded null value";
         }
-    }
     val = gc_malloc(orig->len+1, false, gc);
     memcpy(val, orig->p, orig->len);
     val[orig->len] = '\0';
@@ -418,7 +409,7 @@ x509_setenv(struct env_set *es, int cert_depth, mbedtls_x509_crt *cert)
 }
 
 result_t
-x509_verify_ns_cert_type(mbedtls_x509_crt *cert, const int usage)
+x509_verify_ns_cert_type(const mbedtls_x509_crt *cert, const int usage)
 {
     if (usage == NS_CERT_CHECK_NONE)
     {
@@ -444,42 +435,32 @@ result_t
 x509_verify_cert_ku(mbedtls_x509_crt *cert, const unsigned *const expected_ku,
                     int expected_len)
 {
-    msg(D_HANDSHAKE, "Validating certificate key usage");
+    result_t fFound = FAILURE;
 
     if (!(cert->ext_types & MBEDTLS_X509_EXT_KEY_USAGE))
     {
-        msg(D_TLS_ERRORS,
-            "ERROR: Certificate does not have key usage extension");
-        return FAILURE;
+        msg(D_HANDSHAKE, "Certificate does not have key usage extension");
     }
-
-    if (expected_ku[0] == OPENVPN_KU_REQUIRED)
+    else
     {
-        /* Extension required, value checked by TLS library */
-        return SUCCESS;
-    }
+        int i;
+        unsigned nku = cert->key_usage;
 
-    result_t fFound = FAILURE;
-    for (size_t i = 0; SUCCESS != fFound && i<expected_len; i++)
-    {
-        if (expected_ku[i] != 0
-            && 0 == mbedtls_x509_crt_check_key_usage(cert, expected_ku[i]))
+        msg(D_HANDSHAKE, "Validating certificate key usage");
+        for (i = 0; SUCCESS != fFound && i<expected_len; i++)
         {
-            fFound = SUCCESS;
-        }
-    }
+            if (expected_ku[i] != 0)
+            {
+                msg(D_HANDSHAKE, "++ Certificate has key usage  %04x, expects "
+                    "%04x", nku, expected_ku[i]);
 
-    if (fFound != SUCCESS)
-    {
-        msg(D_TLS_ERRORS,
-            "ERROR: Certificate has key usage %04x, expected one of:",
-            cert->key_usage);
-        for (size_t i = 0; i < expected_len && expected_ku[i]; i++)
-        {
-            msg(D_TLS_ERRORS, " * %04x", expected_ku[i]);
+                if (nku == expected_ku[i])
+                {
+                    fFound = SUCCESS;
+                }
+            }
         }
     }
-
     return fFound;
 }
 
diff --git a/src/openvpn/ssl_verify_mbedtls.h b/src/openvpn/ssl_verify_mbedtls.h
index 8b0a5ae..3c71073 100644
--- a/src/openvpn/ssl_verify_mbedtls.h
+++ b/src/openvpn/ssl_verify_mbedtls.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c
index 468b495..e9692a0 100644
--- a/src/openvpn/ssl_verify_openssl.c
+++ b/src/openvpn/ssl_verify_openssl.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
@@ -42,7 +43,6 @@
 #include "ssl_openssl.h"
 #include "ssl_verify.h"
 #include "ssl_verify_backend.h"
-#include "openssl_compat.h"
 
 #include <openssl/x509v3.h>
 #include <openssl/err.h>
@@ -61,15 +61,14 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
     session = (struct tls_session *) SSL_get_ex_data(ssl, mydata_index);
     ASSERT(session);
 
-    X509 *current_cert = X509_STORE_CTX_get_current_cert(ctx);
-    struct buffer cert_hash = x509_get_sha256_fingerprint(current_cert, &gc);
-    cert_hash_remember(session, X509_STORE_CTX_get_error_depth(ctx), &cert_hash);
+    struct buffer cert_hash = x509_get_sha256_fingerprint(ctx->current_cert, &gc);
+    cert_hash_remember(session, ctx->error_depth, &cert_hash);
 
     /* did peer present cert which was signed by our root cert? */
     if (!preverify_ok)
     {
         /* get the X509 name */
-        char *subject = x509_get_subject(current_cert, &gc);
+        char *subject = x509_get_subject(ctx->current_cert, &gc);
 
         if (!subject)
         {
@@ -77,11 +76,11 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
         }
 
         /* Log and ignore missing CRL errors */
-        if (X509_STORE_CTX_get_error(ctx) == X509_V_ERR_UNABLE_TO_GET_CRL)
+        if (ctx->error == X509_V_ERR_UNABLE_TO_GET_CRL)
         {
             msg(D_TLS_DEBUG_LOW, "VERIFY WARNING: depth=%d, %s: %s",
-                X509_STORE_CTX_get_error_depth(ctx),
-                X509_verify_cert_error_string(X509_STORE_CTX_get_error(ctx)),
+                ctx->error_depth,
+                X509_verify_cert_error_string(ctx->error),
                 subject);
             ret = 1;
             goto cleanup;
@@ -89,8 +88,8 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
 
         /* Remote site specified a certificate, but it's not correct */
         msg(D_TLS_ERRORS, "VERIFY ERROR: depth=%d, error=%s: %s",
-            X509_STORE_CTX_get_error_depth(ctx),
-            X509_verify_cert_error_string(X509_STORE_CTX_get_error(ctx)),
+            ctx->error_depth,
+            X509_verify_cert_error_string(ctx->error),
             subject);
 
         ERR_clear_error();
@@ -99,7 +98,7 @@ verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
         goto cleanup;
     }
 
-    if (SUCCESS != verify_cert(session, current_cert, X509_STORE_CTX_get_error_depth(ctx)))
+    if (SUCCESS != verify_cert(session, ctx->current_cert, ctx->error_depth))
     {
         goto cleanup;
     }
@@ -113,29 +112,16 @@ cleanup:
 }
 
 #ifdef ENABLE_X509ALTUSERNAME
-bool x509_username_field_ext_supported(const char *fieldname)
-{
-    int nid = OBJ_txt2nid(fieldname);
-    return nid == NID_subject_alt_name || nid == NID_issuer_alt_name;
-}
-
 static
 bool
 extract_x509_extension(X509 *cert, char *fieldname, char *out, int size)
 {
     bool retval = false;
     char *buf = 0;
-
-    if (!x509_username_field_ext_supported(fieldname))
-    {
-        msg(D_TLS_ERRORS,
-            "ERROR: --x509-alt-username field 'ext:%s' not supported",
-            fieldname);
-        return false;
-    }
-
+    GENERAL_NAMES *extensions;
     int nid = OBJ_txt2nid(fieldname);
-    GENERAL_NAMES *extensions = X509_get_ext_d2i(cert, nid, NULL, NULL);
+
+    extensions = (GENERAL_NAMES *)X509_get_ext_d2i(cert, nid, NULL, NULL);
     if (extensions)
     {
         int numalts;
@@ -156,10 +142,7 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, int size)
             switch (name->type)
             {
                 case GEN_EMAIL:
-                    if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0)
-                    {
-                        continue;
-                    }
+                    ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5);
                     if (strlen(buf) != name->d.ia5->length)
                     {
                         msg(D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero");
@@ -179,7 +162,7 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, int size)
                     break;
             }
         }
-        GENERAL_NAMES_free(extensions);
+        sk_GENERAL_NAME_free(extensions);
     }
     return retval;
 }
@@ -206,24 +189,15 @@ extract_x509_field_ssl(X509_NAME *x509, const char *field_name, char *out,
     X509_NAME_ENTRY *x509ne = 0;
     ASN1_STRING *asn1 = 0;
     unsigned char *buf = NULL;
-    ASN1_OBJECT *field_name_obj = OBJ_txt2obj(field_name, 0);
-
-    if (field_name_obj == NULL)
-    {
-        msg(D_TLS_ERRORS, "Invalid X509 attribute name '%s'", field_name);
-        return FAILURE;
-    }
+    int nid = OBJ_txt2nid(field_name);
 
     ASSERT(size > 0);
     *out = '\0';
-    do
-    {
+    do {
         lastpos = tmp;
-        tmp = X509_NAME_get_index_by_OBJ(x509, field_name_obj, lastpos);
+        tmp = X509_NAME_get_index_by_NID(x509, nid, lastpos);
     } while (tmp > -1);
 
-    ASN1_OBJECT_free(field_name_obj);
-
     /* Nothing found */
     if (lastpos == -1)
     {
@@ -241,7 +215,8 @@ extract_x509_field_ssl(X509_NAME *x509, const char *field_name, char *out,
     {
         return FAILURE;
     }
-    if (ASN1_STRING_to_UTF8(&buf, asn1) < 0)
+    tmp = ASN1_STRING_to_UTF8(&buf, asn1);
+    if (tmp <= 0)
     {
         return FAILURE;
     }
@@ -308,20 +283,18 @@ backend_x509_get_serial_hex(openvpn_x509_cert_t *cert, struct gc_arena *gc)
 struct buffer
 x509_get_sha1_fingerprint(X509 *cert, struct gc_arena *gc)
 {
-    const EVP_MD *sha1 = EVP_sha1();
-    struct buffer hash = alloc_buf_gc(EVP_MD_size(sha1), gc);
-    X509_digest(cert, EVP_sha1(), BPTR(&hash), NULL);
-    ASSERT(buf_inc_len(&hash, EVP_MD_size(sha1)));
+    struct buffer hash = alloc_buf_gc(sizeof(cert->sha1_hash), gc);
+    memcpy(BPTR(&hash), cert->sha1_hash, sizeof(cert->sha1_hash));
+    ASSERT(buf_inc_len(&hash, sizeof(cert->sha1_hash)));
     return hash;
 }
 
 struct buffer
 x509_get_sha256_fingerprint(X509 *cert, struct gc_arena *gc)
 {
-    const EVP_MD *sha256 = EVP_sha256();
-    struct buffer hash = alloc_buf_gc(EVP_MD_size(sha256), gc);
+    struct buffer hash = alloc_buf_gc((EVP_sha256())->md_size, gc);
     X509_digest(cert, EVP_sha256(), BPTR(&hash), NULL);
-    ASSERT(buf_inc_len(&hash, EVP_MD_size(sha256)));
+    ASSERT(buf_inc_len(&hash, (EVP_sha256())->md_size));
     return hash;
 }
 
@@ -331,6 +304,7 @@ x509_get_subject(X509 *cert, struct gc_arena *gc)
     BIO *subject_bio = NULL;
     BUF_MEM *subject_mem;
     char *subject = NULL;
+    int maxlen = 0;
 
     /*
      * Generate the subject string in OpenSSL proprietary format,
@@ -361,10 +335,11 @@ x509_get_subject(X509 *cert, struct gc_arena *gc)
 
     BIO_get_mem_ptr(subject_bio, &subject_mem);
 
-    subject = gc_malloc(subject_mem->length + 1, false, gc);
+    maxlen = subject_mem->length + 1;
+    subject = gc_malloc(maxlen, false, gc);
 
-    memcpy(subject, subject_mem->data, subject_mem->length);
-    subject[subject_mem->length] = '\0';
+    memcpy(subject, subject_mem->data, maxlen);
+    subject[maxlen - 1] = '\0';
 
 err:
     if (subject_bio)
@@ -482,7 +457,7 @@ x509_setenv_track(const struct x509_track *xt, struct env_set *es, const int dep
                             ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent);
                             unsigned char *buf;
                             buf = (unsigned char *)1; /* bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8 requires this workaround */
-                            if (ASN1_STRING_to_UTF8(&buf, val) >= 0)
+                            if (ASN1_STRING_to_UTF8(&buf, val) > 0)
                             {
                                 do_setenv_x509(es, xt->name, (char *)buf, depth);
                                 OPENSSL_free(buf);
@@ -570,7 +545,7 @@ x509_setenv(struct env_set *es, int cert_depth, openvpn_x509_cert_t *peer_cert)
             continue;
         }
         buf = (unsigned char *)1; /* bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8 requires this workaround */
-        if (ASN1_STRING_to_UTF8(&buf, val) < 0)
+        if (ASN1_STRING_to_UTF8(&buf, val) <= 0)
         {
             continue;
         }
@@ -588,7 +563,7 @@ x509_setenv(struct env_set *es, int cert_depth, openvpn_x509_cert_t *peer_cert)
 }
 
 result_t
-x509_verify_ns_cert_type(openvpn_x509_cert_t *peer_cert, const int usage)
+x509_verify_ns_cert_type(const openvpn_x509_cert_t *peer_cert, const int usage)
 {
     if (usage == NS_CERT_CHECK_NONE)
     {
@@ -596,59 +571,13 @@ x509_verify_ns_cert_type(openvpn_x509_cert_t *peer_cert, const int usage)
     }
     if (usage == NS_CERT_CHECK_CLIENT)
     {
-        /*
-         * Unfortunately, X509_check_purpose() does some weird thing that
-         * prevent it to take a const argument
-         */
-        result_t result = X509_check_purpose(peer_cert, X509_PURPOSE_SSL_CLIENT, 0) ?
-	       SUCCESS : FAILURE;
-
-        /*
-         * old versions of OpenSSL allow us to make the less strict check we used to
-         * do. If this less strict check pass, warn user that this might not be the
-         * case when its distribution will update to OpenSSL 1.1
-         */
-        if (result == FAILURE)
-        {
-            ASN1_BIT_STRING *ns;
-            ns = X509_get_ext_d2i(peer_cert, NID_netscape_cert_type, NULL, NULL);
-            result = (ns && ns->length > 0 && (ns->data[0] & NS_SSL_CLIENT)) ? SUCCESS : FAILURE;
-            if (result == SUCCESS)
-            {
-                msg(M_WARN, "X509: Certificate is a client certificate yet it's purpose "
-                    "cannot be verified (check may fail in the future)");
-            }
-            ASN1_BIT_STRING_free(ns);
-        }
-        return result;
+        return ((peer_cert->ex_flags & EXFLAG_NSCERT)
+                && (peer_cert->ex_nscert & NS_SSL_CLIENT)) ? SUCCESS : FAILURE;
     }
     if (usage == NS_CERT_CHECK_SERVER)
     {
-        /*
-         * Unfortunately, X509_check_purpose() does some weird thing that
-         * prevent it to take a const argument
-         */
-        result_t result = X509_check_purpose(peer_cert, X509_PURPOSE_SSL_SERVER, 0) ?
-	       SUCCESS : FAILURE;
-
-        /*
-         * old versions of OpenSSL allow us to make the less strict check we used to
-         * do. If this less strict check pass, warn user that this might not be the
-         * case when its distribution will update to OpenSSL 1.1
-         */
-        if (result == FAILURE)
-        {
-            ASN1_BIT_STRING *ns;
-            ns = X509_get_ext_d2i(peer_cert, NID_netscape_cert_type, NULL, NULL);
-            result = (ns && ns->length > 0 && (ns->data[0] & NS_SSL_SERVER)) ? SUCCESS : FAILURE;
-            if (result == SUCCESS)
-            {
-                msg(M_WARN, "X509: Certificate is a server certificate yet it's purpose "
-                    "cannot be verified (check may fail in the future)");
-            }
-            ASN1_BIT_STRING_free(ns);
-        }
-        return result;
+        return ((peer_cert->ex_flags & EXFLAG_NSCERT)
+                && (peer_cert->ex_nscert & NS_SSL_SERVER))  ? SUCCESS : FAILURE;
     }
 
     return FAILURE;
@@ -658,59 +587,54 @@ result_t
 x509_verify_cert_ku(X509 *x509, const unsigned *const expected_ku,
                     int expected_len)
 {
-    ASN1_BIT_STRING *ku = X509_get_ext_d2i(x509, NID_key_usage, NULL, NULL);
-
-    if (ku == NULL)
-    {
-        msg(D_TLS_ERRORS, "Certificate does not have key usage extension");
-        return FAILURE;
-    }
+    ASN1_BIT_STRING *ku = NULL;
+    result_t fFound = FAILURE;
 
-    if (expected_ku[0] == OPENVPN_KU_REQUIRED)
+    if ((ku = (ASN1_BIT_STRING *) X509_get_ext_d2i(x509, NID_key_usage, NULL,
+                                                   NULL)) == NULL)
     {
-        /* Extension required, value checked by TLS library */
-        ASN1_BIT_STRING_free(ku);
-        return SUCCESS;
+        msg(D_HANDSHAKE, "Certificate does not have key usage extension");
     }
-
-    unsigned nku = 0;
-    for (size_t i = 0; i < 8; i++)
+    else
     {
-        if (ASN1_BIT_STRING_get_bit(ku, i))
+        unsigned nku = 0;
+        int i;
+        for (i = 0; i < 8; i++)
         {
-            nku |= 1 << (7 - i);
+            if (ASN1_BIT_STRING_get_bit(ku, i))
+            {
+                nku |= 1 << (7 - i);
+            }
         }
-    }
-
-    /*
-     * Fixup if no LSB bits
-     */
-    if ((nku & 0xff) == 0)
-    {
-        nku >>= 8;
-    }
 
-    msg(D_HANDSHAKE, "Validating certificate key usage");
-    result_t fFound = FAILURE;
-    for (size_t i = 0; fFound != SUCCESS && i < expected_len; i++)
-    {
-        if (expected_ku[i] != 0 && (nku & expected_ku[i]) == expected_ku[i])
+        /*
+         * Fixup if no LSB bits
+         */
+        if ((nku & 0xff) == 0)
         {
-            fFound = SUCCESS;
+            nku >>= 8;
         }
-    }
 
-    if (fFound != SUCCESS)
-    {
-        msg(D_TLS_ERRORS,
-            "ERROR: Certificate has key usage %04x, expected one of:", nku);
-        for (size_t i = 0; i < expected_len && expected_ku[i]; i++)
+        msg(D_HANDSHAKE, "Validating certificate key usage");
+        for (i = 0; fFound != SUCCESS && i < expected_len; i++)
         {
-            msg(D_TLS_ERRORS, " * %04x", expected_ku[i]);
+            if (expected_ku[i] != 0)
+            {
+                msg(D_HANDSHAKE, "++ Certificate has key usage  %04x, expects "
+                    "%04x", nku, expected_ku[i]);
+
+                if (nku == expected_ku[i])
+                {
+                    fFound = SUCCESS;
+                }
+            }
         }
     }
 
-    ASN1_BIT_STRING_free(ku);
+    if (ku != NULL)
+    {
+        ASN1_BIT_STRING_free(ku);
+    }
 
     return fFound;
 }
@@ -790,12 +714,11 @@ tls_verify_crl_missing(const struct tls_options *opt)
         crypto_msg(M_FATAL, "Cannot get certificate store");
     }
 
-    STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);
-    for (int i = 0; i < sk_X509_OBJECT_num(objs); i++)
+    for (int i = 0; i < sk_X509_OBJECT_num(store->objs); i++)
     {
-        X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);
+        X509_OBJECT *obj = sk_X509_OBJECT_value(store->objs, i);
         ASSERT(obj);
-        if (X509_OBJECT_get_type(obj) == X509_LU_CRL)
+        if (obj->type == X509_LU_CRL)
         {
             return false;
         }
diff --git a/src/openvpn/ssl_verify_openssl.h b/src/openvpn/ssl_verify_openssl.h
index 4c8dbeb..1db6fe6 100644
--- a/src/openvpn/ssl_verify_openssl.h
+++ b/src/openvpn/ssl_verify_openssl.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/status.c b/src/openvpn/status.c
index a163408..e47f35c 100644
--- a/src/openvpn/status.c
+++ b/src/openvpn/status.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
diff --git a/src/openvpn/status.h b/src/openvpn/status.h
index 8199935..590ae41 100644
--- a/src/openvpn/status.h
+++ b/src/openvpn/status.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef STATUS_H
diff --git a/src/openvpn/syshead.h b/src/openvpn/syshead.h
index 2973b5a..078ed3a 100644
--- a/src/openvpn/syshead.h
+++ b/src/openvpn/syshead.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef SYSHEAD_H
@@ -287,17 +288,13 @@
 #include <netinet/ip.h>
 #endif
 
-#ifdef HAVE_NETINET_TCP_H
-#include <netinet/tcp.h>
-#endif
-
 #ifdef HAVE_NET_IF_TUN_H
 #include <net/if_tun.h>
 #endif
 
 #endif /* TARGET_OPENBSD */
 
-#ifdef TARGET_FREEBSD
+#if defined(TARGET_FREEBSD) || defined(__FreeBSD_kernel__)
 
 #ifdef HAVE_SYS_UIO_H
 #include <sys/uio.h>
@@ -592,7 +589,9 @@ socket_defined(const socket_descriptor_t sd)
 /*
  * Should we include OCC (options consistency check) code?
  */
+#ifndef ENABLE_SMALL
 #define ENABLE_OCC
+#endif
 
 /*
  * Should we include NTLM proxy functionality
diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index e13bb4e..4c7170f 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef HAVE_CONFIG_H
@@ -43,14 +44,15 @@ tls_crypt_buf_overhead(void)
 
 void
 tls_crypt_init_key(struct key_ctx_bi *key, const char *key_file,
-                   const char *key_inline, bool tls_server)
-{
+                   const char *key_inline, bool tls_server) {
     const int key_direction = tls_server ?
                               KEY_DIRECTION_NORMAL : KEY_DIRECTION_INVERSE;
 
     struct key_type kt;
     kt.cipher = cipher_kt_get("AES-256-CTR");
+    kt.cipher_length = cipher_kt_key_size(kt.cipher);
     kt.digest = md_kt_get("SHA256");
+    kt.hmac_length = md_kt_size(kt.digest);
 
     if (!kt.cipher)
     {
@@ -61,9 +63,6 @@ tls_crypt_init_key(struct key_ctx_bi *key, const char *key_file,
         msg(M_FATAL, "ERROR: --tls-crypt requires HMAC-SHA-256 support.");
     }
 
-    kt.cipher_length = cipher_kt_key_size(kt.cipher);
-    kt.hmac_length = md_kt_size(kt.digest);
-
     crypto_read_openvpn_key(&kt, key, key_file, key_inline, key_direction,
                             "Control Channel Encryption", "tls-crypt");
 }
@@ -80,8 +79,7 @@ tls_crypt_adjust_frame_parameters(struct frame *frame)
 
 bool
 tls_crypt_wrap(const struct buffer *src, struct buffer *dst,
-               struct crypto_options *opt)
-{
+               struct crypto_options *opt) {
     const struct key_ctx *ctx = &opt->key_ctx_bi.encrypt;
     struct gc_arena gc;
 
diff --git a/src/openvpn/tls_crypt.h b/src/openvpn/tls_crypt.h
index e8080df..47f75d0 100644
--- a/src/openvpn/tls_crypt.h
+++ b/src/openvpn/tls_crypt.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /**
diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c
index 75a156c..a4f7779 100644
--- a/src/openvpn/tun.c
+++ b/src/openvpn/tun.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -559,9 +560,7 @@ is_tun_p2p(const struct tuntap *tt)
 {
     bool tun = false;
 
-    if (tt->type == DEV_TYPE_TAP
-          || (tt->type == DEV_TYPE_TUN && tt->topology == TOP_SUBNET)
-          || tt->type == DEV_TYPE_NULL )
+    if (tt->type == DEV_TYPE_TAP || (tt->type == DEV_TYPE_TUN && tt->topology == TOP_SUBNET))
     {
         tun = false;
     }
@@ -695,8 +694,7 @@ init_tun(const char *dev,        /* --dev option */
              * make sure they do not clash with our virtual subnet.
              */
 
-            for (curele = local_public; curele; curele = curele->ai_next)
-            {
+            for (curele = local_public; curele; curele = curele->ai_next) {
                 if (curele->ai_family == AF_INET)
                 {
                     check_addr_clash("local",
@@ -707,8 +705,7 @@ init_tun(const char *dev,        /* --dev option */
                 }
             }
 
-            for (curele = remote_public; curele; curele = curele->ai_next)
-            {
+            for (curele = remote_public; curele; curele = curele->ai_next) {
                 if (curele->ai_family == AF_INET)
                 {
                     check_addr_clash("remote",
@@ -843,7 +840,7 @@ delete_route_connected_v6_net(struct tuntap *tt,
 #endif /* if defined(_WIN32) || defined(TARGET_DARWIN) || defined(TARGET_NETBSD) || defined(TARGET_OPENBSD) */
 
 #if defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)  \
-    || defined(TARGET_OPENBSD)
+    || defined(TARGET_OPENBSD) || defined(__FreeBSD_kernel__)
 /* we can't use true subnet mode on tun on all platforms, as that
  * conflicts with IPv6 (wants to use ND then, which we don't do),
  * but the OSes want "a remote address that is different from ours"
@@ -1039,8 +1036,7 @@ do_ifconfig(struct tuntap *tt,
         struct buffer out = alloc_buf_gc(64, &gc);
 
         char *top;
-        switch (tt->topology)
-        {
+        switch (tt->topology) {
             case TOP_NET30:
                 top = "net30";
                 break;
@@ -1412,7 +1408,7 @@ do_ifconfig(struct tuntap *tt,
             add_route_connected_v6_net(tt, es);
         }
 
-#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)
+#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) || defined(__FreeBSD_kernel__)
 
         in_addr_t remote_end;           /* for "virtual" subnet topology */
 
@@ -1653,11 +1649,11 @@ write_tun_header(struct tuntap *tt, uint8_t *buf, int len)
     {
         u_int32_t type;
         struct iovec iv[2];
-        struct openvpn_iphdr *iph;
+        struct ip *iph;
 
-        iph = (struct openvpn_iphdr *) buf;
+        iph = (struct ip *) buf;
 
-        if (OPENVPN_IPH_GET_VER(iph->version_len) == 6)
+        if (iph->ip_v == 6)
         {
             type = htonl(AF_INET6);
         }
@@ -1839,14 +1835,12 @@ open_tun(const char *dev, const char *dev_type, const char *dev_node, struct tun
 
     /* Prefer IPv6 DNS servers,
      * Android will use the DNS server in the order we specify*/
-    for (int i = 0; i < tt->options.dns6_len; i++)
-    {
+    for (int i = 0; i < tt->options.dns6_len; i++) {
         management_android_control(management, "DNS6SERVER",
                                    print_in6_addr(tt->options.dns6[i], 0, &gc));
     }
 
-    for (int i = 0; i < tt->options.dns_len; i++)
-    {
+    for (int i = 0; i < tt->options.dns_len; i++) {
         management_android_control(management, "DNSSERVER",
                                    print_in_addr_t(tt->options.dns[i], 0, &gc));
     }
@@ -2260,9 +2254,7 @@ open_tun(const char *dev, const char *dev_type, const char *dev_node, struct tun
     {
         ptr = dev;
         while (*ptr && !isdigit((int) *ptr))
-        {
             ptr++;
-        }
         ppa = atoi(ptr);
     }
 
@@ -2770,7 +2762,7 @@ read_tun(struct tuntap *tt, uint8_t *buf, int len)
     }
 }
 
-#elif defined(TARGET_FREEBSD)
+#elif defined(TARGET_FREEBSD)||defined(__FreeBSD_kernel__)
 
 static inline int
 freebsd_modify_read_write_return(int len)
@@ -3285,10 +3277,7 @@ open_tun(const char *dev, const char *dev_type, const char *dev_node, struct tun
     {
         /* ensure that dev name is "tap+<digits>" *only* */
         p = &dev[3];
-        while (isdigit(*p) )
-        {
-            p++;
-        }
+        while (isdigit(*p) ) p++;
         if (*p != '\0')
         {
             msg( M_FATAL, "TAP device name must be '--dev tapNNNN'" );
@@ -5466,9 +5455,7 @@ write_dhcp_u32_array(struct buffer *buf, const int type, const uint32_t *data, c
         buf_write_u8(buf, type);
         buf_write_u8(buf, size);
         for (i = 0; i < len; ++i)
-        {
             buf_write_u32(buf, data[i]);
-        }
     }
 }
 
@@ -6237,7 +6224,10 @@ close_tun(struct tuntap *tt)
         }
 #endif
 
-        dhcp_release(tt);
+        if (tt->options.dhcp_release)
+        {
+            dhcp_release(tt);
+        }
 
         if (tt->hand != NULL)
         {
@@ -6297,12 +6287,10 @@ ascii2ipset(const char *name)
     int i;
     ASSERT(IPW32_SET_N == SIZE(ipset_names));
     for (i = 0; i < IPW32_SET_N; ++i)
-    {
         if (!strcmp(name, ipset_names[i].short_form))
         {
             return i;
         }
-    }
     return -1;
 }
 
diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
index 8782d69..f4b600c 100644
--- a/src/openvpn/tun.h
+++ b/src/openvpn/tun.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef TUN_H
@@ -103,6 +104,7 @@ struct tuntap_options {
 
     bool dhcp_renew;
     bool dhcp_pre_release;
+    bool dhcp_release;
 
     bool register_dns;
 
diff --git a/src/openvpn/win32.c b/src/openvpn/win32.c
index d0b10ba..e26f54d 100644
--- a/src/openvpn/win32.c
+++ b/src/openvpn/win32.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -60,12 +61,6 @@
 static HANDLE m_hEngineHandle = NULL; /* GLOBAL */
 
 /*
- * TAP adapter original metric value
- */
-static int tap_metric_v4 = -1; /* GLOBAL */
-static int tap_metric_v6 = -1; /* GLOBAL */
-
-/*
  * Windows internal socket API state (opaque).
  */
 static struct WSAData wsa_state; /* GLOBAL */
@@ -574,8 +569,7 @@ win32_keyboard_get(struct win32_signal *ws)
     if (HANDLE_DEFINED(ws->in.read))
     {
         INPUT_RECORD ir;
-        do
-        {
+        do {
             DWORD n;
             if (!keyboard_input_available(ws))
             {
@@ -687,8 +681,7 @@ win32_pause(struct win32_signal *ws)
     {
         int status;
         msg(M_INFO|M_NOPREFIX, "Press any key to continue...");
-        do
-        {
+        do {
             status = WaitForSingleObject(ws->in.read, INFINITE);
         } while (!win32_keyboard_get(ws));
     }
@@ -991,9 +984,7 @@ env_block(const struct env_set *es)
         bool path_seen = false;
 
         for (e = es->list; e != NULL; e = e->next)
-        {
             nchars += strlen(e->string) + 1;
-        }
 
         nchars += strlen(force_path)+1;
 
@@ -1333,8 +1324,8 @@ win_wfp_block_dns(const NET_IFINDEX index, const HANDLE msg_channel)
         goto out;
     }
 
-    status = GetModuleFileNameW(NULL, openvpnpath, _countof(openvpnpath));
-    if (status == 0 || status == _countof(openvpnpath))
+    status = GetModuleFileNameW(NULL, openvpnpath, sizeof(openvpnpath));
+    if (status == 0 || status == sizeof(openvpnpath))
     {
         msg(M_WARN|M_ERRNO, "block_dns: cannot get executable path");
         goto out;
@@ -1342,27 +1333,6 @@ win_wfp_block_dns(const NET_IFINDEX index, const HANDLE msg_channel)
 
     status = add_block_dns_filters(&m_hEngineHandle, index, openvpnpath,
                                    block_dns_msg_handler);
-    if (status == 0)
-    {
-        tap_metric_v4 = get_interface_metric(index, AF_INET);
-        tap_metric_v6 = get_interface_metric(index, AF_INET6);
-        if (tap_metric_v4 < 0)
-        {
-            /* error, should not restore metric */
-            tap_metric_v4 = -1;
-        }
-        if (tap_metric_v6 < 0)
-        {
-            /* error, should not restore metric */
-            tap_metric_v6 = -1;
-        }
-        status = set_interface_metric(index, AF_INET, BLOCK_DNS_IFACE_METRIC);
-        if (!status)
-        {
-            set_interface_metric(index, AF_INET6, BLOCK_DNS_IFACE_METRIC);
-        }
-    }
-
     ret = (status == 0);
 
 out:
@@ -1371,27 +1341,19 @@ out:
 }
 
 bool
-win_wfp_uninit(const NET_IFINDEX index, const HANDLE msg_channel)
+win_wfp_uninit(const HANDLE msg_channel)
 {
     dmsg(D_LOW, "Uninitializing WFP");
 
     if (msg_channel)
     {
         msg(D_LOW, "Using service to delete block dns filters");
-        win_block_dns_service(false, index, msg_channel);
+        win_block_dns_service(false, -1, msg_channel);
     }
     else
     {
         delete_block_dns_filters(m_hEngineHandle);
         m_hEngineHandle = NULL;
-        if (tap_metric_v4 >= 0)
-        {
-            set_interface_metric(index, AF_INET, tap_metric_v4);
-        }
-        if (tap_metric_v6 >= 0)
-        {
-            set_interface_metric(index, AF_INET6, tap_metric_v6);
-        }
     }
 
     return true;
diff --git a/src/openvpn/win32.h b/src/openvpn/win32.h
index 21a1021..4ee44fd 100644
--- a/src/openvpn/win32.h
+++ b/src/openvpn/win32.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifdef _WIN32
@@ -292,7 +293,7 @@ WCHAR *wide_string(const char *utf8, struct gc_arena *gc);
 
 bool win_wfp_block_dns(const NET_IFINDEX index, const HANDLE msg_channel);
 
-bool win_wfp_uninit(const NET_IFINDEX index, const HANDLE msg_channel);
+bool win_wfp_uninit(const HANDLE msg_channel);
 
 #define WIN_XP 0
 #define WIN_VISTA 1
diff --git a/src/openvpnserv/Makefile.in b/src/openvpnserv/Makefile.in
index 234a927..e113fee 100644
--- a/src/openvpnserv/Makefile.in
+++ b/src/openvpnserv/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.13.4 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -37,17 +37,7 @@
 # Required to build Windows resource file
 
 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -110,6 +100,8 @@ PRE_UNINSTALL = :
 POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
+DIST_COMMON = $(top_srcdir)/build/ltrc.inc $(srcdir)/Makefile.in \
+	$(srcdir)/Makefile.am $(top_srcdir)/depcomp
 @WIN32_TRUE@sbin_PROGRAMS = openvpnserv$(EXEEXT)
 subdir = src/openvpnserv
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
@@ -122,7 +114,6 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/compat.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h \
 	$(top_builddir)/include/openvpn-plugin.h
@@ -205,8 +196,6 @@ am__define_uniq_tagged_files = \
   done | $(am__uniquify_input)`
 ETAGS = etags
 CTAGS = ctags
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/build/ltrc.inc \
-	$(top_srcdir)/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -255,7 +244,6 @@ LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 LZ4_CFLAGS = @LZ4_CFLAGS@
 LZ4_LIBS = @LZ4_LIBS@
 LZO_CFLAGS = @LZO_CFLAGS@
@@ -304,7 +292,6 @@ PKCS11_HELPER_LIBS = @PKCS11_HELPER_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PLUGINDIR = @PLUGINDIR@
 PLUGIN_AUTH_PAM_CFLAGS = @PLUGIN_AUTH_PAM_CFLAGS@
 PLUGIN_AUTH_PAM_LIBS = @PLUGIN_AUTH_PAM_LIBS@
 RANLIB = @RANLIB@
@@ -317,14 +304,12 @@ SHELL = @SHELL@
 SOCKETS_LIBS = @SOCKETS_LIBS@
 STRIP = @STRIP@
 SYSTEMD_ASK_PASSWORD = @SYSTEMD_ASK_PASSWORD@
-SYSTEMD_UNIT_DIR = @SYSTEMD_UNIT_DIR@
 TAP_CFLAGS = @TAP_CFLAGS@
 TAP_WIN_COMPONENT_ID = @TAP_WIN_COMPONENT_ID@
 TAP_WIN_MIN_MAJOR = @TAP_WIN_MIN_MAJOR@
 TAP_WIN_MIN_MINOR = @TAP_WIN_MIN_MINOR@
 TEST_CFLAGS = @TEST_CFLAGS@
 TEST_LDFLAGS = @TEST_LDFLAGS@
-TMPFILES_DIR = @TMPFILES_DIR@
 VENDOR_BUILD_ROOT = @VENDOR_BUILD_ROOT@
 VENDOR_DIST_ROOT = @VENDOR_DIST_ROOT@
 VENDOR_SRC_ROOT = @VENDOR_SRC_ROOT@
@@ -381,9 +366,7 @@ sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-systemdunitdir = @systemdunitdir@
 target_alias = @target_alias@
-tmpfilesdir = @tmpfilesdir@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
@@ -430,6 +413,7 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am $(top_srcdir)/build/ltrc.inc $(am_
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/openvpnserv/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --foreign src/openvpnserv/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -438,7 +422,7 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
 	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
 	esac;
-$(top_srcdir)/build/ltrc.inc $(am__empty):
+$(top_srcdir)/build/ltrc.inc:
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
@@ -520,14 +504,14 @@ distclean-compile:
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -833,8 +817,6 @@ uninstall-am: uninstall-sbinPROGRAMS
 	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
 	tags tags-am uninstall uninstall-am uninstall-sbinPROGRAMS
 
-.PRECIOUS: Makefile
-
 
 .rc.lo:
 	$(LTRCCOMPILE) -i "$<" -o "$@"
diff --git a/src/openvpnserv/automatic.c b/src/openvpnserv/automatic.c
index 4123d0f..6be6c6d 100644
--- a/src/openvpnserv/automatic.c
+++ b/src/openvpnserv/automatic.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -292,8 +293,7 @@ ServiceStartAutomatic(DWORD dwArgc, LPTSTR *lpszArgv)
         /*
          * Loop over each config file
          */
-        do
-        {
+        do {
             HANDLE log_handle = NULL;
             STARTUPINFO start_info;
             PROCESS_INFORMATION proc_info;
diff --git a/src/openvpnserv/common.c b/src/openvpnserv/common.c
index 0c9098f..3b9b396 100644
--- a/src/openvpnserv/common.c
+++ b/src/openvpnserv/common.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #include <service.h>
diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c
index 607c8a9..dbe2b9b 100644
--- a/src/openvpnserv/interactive.c
+++ b/src/openvpnserv/interactive.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 
@@ -93,13 +94,6 @@ typedef enum {
 } undo_type_t;
 typedef list_item_t *undo_lists_t[_undo_type_max];
 
-typedef struct {
-    HANDLE engine;
-    int index;
-    int metric_v4;
-    int metric_v6;
-} block_dns_data_t;
-
 
 static DWORD
 AddListItem(list_item_t **pfirst, LPVOID data)
@@ -221,9 +215,7 @@ AsyncPipeOp(async_op_t op, HANDLE pipe, LPVOID buffer, DWORD size, DWORD count,
 
     handles[0] = io_event;
     for (i = 0; i < count; i++)
-    {
         handles[i + 1] = events[i];
-    }
 
     res = WaitForMultipleObjects(count + 1, handles, FALSE,
                                  op == peek ? INFINITE : IO_TIMEOUT);
@@ -891,7 +883,6 @@ static DWORD
 HandleBlockDNSMessage(const block_dns_message_t *msg, undo_lists_t *lists)
 {
     DWORD err = 0;
-    block_dns_data_t *interface_data;
     HANDLE engine = NULL;
     LPCWSTR exe_path;
 
@@ -908,57 +899,16 @@ HandleBlockDNSMessage(const block_dns_message_t *msg, undo_lists_t *lists)
         err = add_block_dns_filters(&engine, msg->iface.index, exe_path, BlockDNSErrHandler);
         if (!err)
         {
-            interface_data = malloc(sizeof(block_dns_data_t));
-            if (!interface_data)
-            {
-                return ERROR_OUTOFMEMORY;
-            }
-            interface_data->engine = engine;
-            interface_data->index = msg->iface.index;
-            interface_data->metric_v4 = get_interface_metric(msg->iface.index,
-                                                             AF_INET);
-            if (interface_data->metric_v4 < 0)
-            {
-                interface_data->metric_v4 = -1;
-            }
-            interface_data->metric_v6 = get_interface_metric(msg->iface.index,
-                                                             AF_INET6);
-            if (interface_data->metric_v6 < 0)
-            {
-                interface_data->metric_v6 = -1;
-            }
-            err = AddListItem(&(*lists)[block_dns], interface_data);
-            if (!err)
-            {
-                err = set_interface_metric(msg->iface.index, AF_INET,
-                                           BLOCK_DNS_IFACE_METRIC);
-                if (!err)
-                {
-                    set_interface_metric(msg->iface.index, AF_INET6,
-                                         BLOCK_DNS_IFACE_METRIC);
-                }
-            }
+            err = AddListItem(&(*lists)[block_dns], engine);
         }
     }
     else
     {
-        interface_data = RemoveListItem(&(*lists)[block_dns], CmpEngine, NULL);
-        if (interface_data)
+        engine = RemoveListItem(&(*lists)[block_dns], CmpEngine, NULL);
+        if (engine)
         {
-            engine = interface_data->engine;
             err = delete_block_dns_filters(engine);
             engine = NULL;
-            if (interface_data->metric_v4 >= 0)
-            {
-                set_interface_metric(msg->iface.index, AF_INET,
-                                     interface_data->metric_v4);
-            }
-            if (interface_data->metric_v6 >= 0)
-            {
-                set_interface_metric(msg->iface.index, AF_INET6,
-                                     interface_data->metric_v6);
-            }
-            free(interface_data);
         }
         else
         {
@@ -1373,7 +1323,6 @@ static VOID
 Undo(undo_lists_t *lists)
 {
     undo_type_t type;
-    block_dns_data_t *interface_data;
     for (type = 0; type < _undo_type_max; type++)
     {
         list_item_t **pnext = &(*lists)[type];
@@ -1399,18 +1348,8 @@ Undo(undo_lists_t *lists)
                     break;
 
                 case block_dns:
-                    interface_data = (block_dns_data_t*)(item->data);
-                    delete_block_dns_filters(interface_data->engine);
-                    if (interface_data->metric_v4 >= 0)
-                    {
-                        set_interface_metric(interface_data->index, AF_INET,
-                                             interface_data->metric_v4);
-                    }
-                    if (interface_data->metric_v6 >= 0)
-                    {
-                        set_interface_metric(interface_data->index, AF_INET6,
-                                             interface_data->metric_v6);
-                    }
+                    delete_block_dns_filters(item->data);
+                    item->data = NULL;
                     break;
             }
 
@@ -1536,7 +1475,7 @@ RunOpenvpn(LPVOID p)
     }
 
     /* Check user is authorized or options are white-listed */
-    if (!IsAuthorizedUser(ovpn_user->User.Sid, imp_token, settings.ovpn_admin_group)
+    if (!IsAuthorizedUser(ovpn_user->User.Sid, &settings)
         && !ValidateOptions(pipe, sud.directory, sud.options))
     {
         goto out;
@@ -1901,8 +1840,7 @@ ServiceStartInteractive(DWORD dwArgc, LPTSTR *lpszArgv)
     PHANDLE handles = NULL;
     DWORD handle_count;
     BOOL
-    CmpHandle(LPVOID item, LPVOID hnd)
-    {
+    CmpHandle(LPVOID item, LPVOID hnd) {
         return item == hnd;
     }
 
diff --git a/src/openvpnserv/service.h b/src/openvpnserv/service.h
index 9fe573e..b1130c9 100644
--- a/src/openvpnserv/service.h
+++ b/src/openvpnserv/service.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef _SERVICE_H
diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c
index f6a97e9..c9c3855 100644
--- a/src/openvpnserv/validate.c
+++ b/src/openvpnserv/validate.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #include "validate.h"
@@ -48,9 +49,6 @@ static const WCHAR *white_list[] =
     NULL                                /* last value */
 };
 
-static BOOL IsUserInGroup(PSID sid, const PTOKEN_GROUPS groups, const WCHAR *group_name);
-static PTOKEN_GROUPS GetTokenGroups(const HANDLE token);
-
 /*
  * Check workdir\fname is inside config_dir
  * The logic here is simple: we may reject some valid paths if ..\ is in any of the strings
@@ -149,16 +147,21 @@ GetBuiltinAdminGroupName(WCHAR *name, DWORD nlen)
 
 /*
  * Check whether user is a member of Administrators group or
- * the group specified in ovpn_admin_group
+ * the group specified in s->ovpn_admin_group
  */
 BOOL
-IsAuthorizedUser(PSID sid, const HANDLE token, const WCHAR *ovpn_admin_group)
+IsAuthorizedUser(SID *sid, settings_t *s)
 {
+    LOCALGROUP_USERS_INFO_0 *groups = NULL;
+    DWORD nread;
+    DWORD nmax;
+    WCHAR *tmp = NULL;
     const WCHAR *admin_group[2];
     WCHAR username[MAX_NAME];
     WCHAR domain[MAX_NAME];
     WCHAR sysadmin_group[MAX_NAME];
-    DWORD len = MAX_NAME;
+    DWORD err, len = MAX_NAME;
+    int i;
     BOOL ret = FALSE;
     SID_NAME_USE sid_type;
 
@@ -166,9 +169,17 @@ IsAuthorizedUser(PSID sid, const HANDLE token, const WCHAR *ovpn_admin_group)
     if (!LookupAccountSidW(NULL, sid, username, &len, domain, &len, &sid_type))
     {
         MsgToEventLog(M_SYSERR, TEXT("LookupAccountSid"));
-        /* not fatal as this is now used only for logging */
-        username[0] = '\0';
-        domain[0] = '\0';
+        goto out;
+    }
+
+    /* Get an array of groups the user is member of */
+    err = NetUserGetLocalGroups(NULL, username, 0, LG_INCLUDE_INDIRECT, (LPBYTE *) &groups,
+                                MAX_PREFERRED_LENGTH, &nread, &nmax);
+    if (err && err != ERROR_MORE_DATA)
+    {
+        SetLastError(err);
+        MsgToEventLog(M_SYSERR, TEXT("NetUserGetLocalGroups"));
+        goto out;
     }
 
     if (GetBuiltinAdminGroupName(sysadmin_group, _countof(sysadmin_group)))
@@ -181,136 +192,41 @@ IsAuthorizedUser(PSID sid, const HANDLE token, const WCHAR *ovpn_admin_group)
         /* use the default value */
         admin_group[0] = SYSTEM_ADMIN_GROUP;
     }
-    admin_group[1] = ovpn_admin_group;
-
-    PTOKEN_GROUPS token_groups = GetTokenGroups(token);
-    for (int i = 0; i < 2; ++i)
-    {
-        ret = IsUserInGroup(sid, token_groups, admin_group[i]);
-        if (ret)
-        {
-            MsgToEventLog(M_INFO, TEXT("Authorizing user '%s@%s' by virtue of membership in group '%s'"),
-                          username, domain, admin_group[i]);
-            goto out;
-        }
-    }
-
-out:
-    free(token_groups);
-    return ret;
-}
-
-/**
- * Get a list of groups in token.
- * Returns a pointer to TOKEN_GROUPS struct or NULL on error.
- * The caller should free the returned pointer.
- */
-static PTOKEN_GROUPS
-GetTokenGroups(const HANDLE token)
-{
-    PTOKEN_GROUPS groups = NULL;
-    DWORD buf_size = 0;
-
-    if (!GetTokenInformation(token, TokenGroups, groups, buf_size, &buf_size)
-        && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
-    {
-        groups = malloc(buf_size);
-    }
-    if (!groups)
-    {
-        MsgToEventLog(M_SYSERR, L"GetTokenGroups");
-    }
-    else if (!GetTokenInformation(token, TokenGroups, groups, buf_size, &buf_size))
-    {
-        MsgToEventLog(M_SYSERR, L"GetTokenInformation");
-        free(groups);
-    }
-    return groups;
-}
 
-/*
- * Find SID from name
- *
- * On input sid buffer should have space for at least sid_size bytes.
- * Returns true on success, false on failure.
- * Suggest: in caller allocate sid to hold SECURITY_MAX_SID_SIZE bytes
- */
-static BOOL
-LookupSID(const WCHAR *name, PSID sid, DWORD sid_size)
-{
-    SID_NAME_USE su;
-    WCHAR domain[MAX_NAME];
-    DWORD dlen = _countof(domain);
-
-    if (!LookupAccountName(NULL, name, sid, &sid_size, domain, &dlen, &su))
-    {
-        return FALSE; /* not fatal as the group may not exist */
-    }
-    return TRUE;
-}
-
-/**
- * User is in group if the token groups contain the SID of the group
- * of if the user is a direct member of the group. The latter check
- * catches dynamic changes in group membership in the local user
- * database not reflected in the token.
- * If token_groups or sid is NULL the corresponding check is skipped.
- *
- * Using sid and list of groups in token avoids reference to domains so that
- * this could be completed without access to a Domain Controller.
- *
- * Returns true if the user is in the group, false otherwise.
- */
-static BOOL
-IsUserInGroup(PSID sid, const PTOKEN_GROUPS token_groups, const WCHAR *group_name)
-{
-    BOOL ret = FALSE;
-    DWORD_PTR resume = 0;
-    DWORD err;
-    BYTE grp_sid[SECURITY_MAX_SID_SIZE];
-    int nloop = 0; /* a counter used to not get stuck in the do .. while() */
-
-    /* first check in the token groups */
-    if (token_groups && LookupSID(group_name, (PSID) grp_sid, _countof(grp_sid)))
+#ifdef UNICODE
+    admin_group[1] = s->ovpn_admin_group;
+#else
+    tmp = NULL;
+    len = MultiByteToWideChar(CP_UTF8, 0, s->ovpn_admin_group, -1, NULL, 0);
+    if (len == 0 || (tmp = malloc(len*sizeof(WCHAR))) == NULL)
     {
-        for (DWORD i = 0; i < token_groups->GroupCount; ++i)
-        {
-            if (EqualSid((PSID) grp_sid, token_groups->Groups[i].Sid))
-            {
-                return TRUE;
-            }
-        }
+        MsgToEventLog(M_SYSERR, TEXT("Failed to convert admin group name to WideChar"));
+        goto out;
     }
+    MultiByteToWideChar(CP_UTF8, 0, s->ovpn_admin_group, -1, tmp, len);
+    admin_group[1] = tmp;
+#endif
 
-    /* check user's SID is a member of the group */
-    if (!sid)
-    {
-        return FALSE;
-    }
-    do
+    /* Check if user's groups include any of the admin groups */
+    for (i = 0; i < nread; i++)
     {
-        DWORD nread, nmax;
-        LOCALGROUP_MEMBERS_INFO_0 *members = NULL;
-        err = NetLocalGroupGetMembers(NULL, group_name, 0, (LPBYTE *) &members,
-                                      MAX_PREFERRED_LENGTH, &nread, &nmax, &resume);
-        if ((err != NERR_Success && err != ERROR_MORE_DATA))
+        if (wcscmp(groups[i].lgrui0_name, admin_group[0]) == 0
+            || wcscmp(groups[i].lgrui0_name, admin_group[1]) == 0
+            )
         {
+            MsgToEventLog(M_INFO, TEXT("Authorizing user %s by virtue of membership in group %s"),
+                          username, groups[i].lgrui0_name);
+            ret = TRUE;
             break;
         }
-        /* If a match is already found, ret == TRUE and the loop is skipped */
-        for (int i = 0; i < nread && !ret; ++i)
-        {
-            ret = EqualSid(members[i].lgrmi0_sid, sid);
-        }
-        NetApiBufferFree(members);
-    /* MSDN says the lookup should always iterate until err != ERROR_MORE_DATA */
-    } while (err == ERROR_MORE_DATA && nloop++ < 100);
+    }
 
-    if (err != NERR_Success && err != NERR_GroupNotFound)
+out:
+    if (groups)
     {
-        SetLastError(err);
-        MsgToEventLog(M_SYSERR, TEXT("In NetLocalGroupGetMembers for group '%s'"), group_name);
+        NetApiBufferFree(groups);
     }
+    free(tmp);
 
     return ret;
 }
diff --git a/src/openvpnserv/validate.h b/src/openvpnserv/validate.h
index cc443e6..ece8704 100644
--- a/src/openvpnserv/validate.h
+++ b/src/openvpnserv/validate.h
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef VALIDATE_H
@@ -33,7 +34,7 @@
 /* The last one may be reset in registry: HKLM\Software\OpenVPN\ovpn_admin_group */
 
 BOOL
-IsAuthorizedUser(PSID sid, const HANDLE token, const WCHAR *ovpn_admin_group);
+IsAuthorizedUser(SID *sid, settings_t *s);
 
 BOOL
 CheckOption(const WCHAR *workdir, int narg, WCHAR *argv[], const settings_t *s);
diff --git a/src/plugins/Makefile.in b/src/plugins/Makefile.in
index d63b407..4f7a821 100644
--- a/src/plugins/Makefile.in
+++ b/src/plugins/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.13.4 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -25,17 +25,7 @@
 #  Copyright (C) 2006-2012 Alon Bar-Lev <alon.barlev@gmail.com>
 #
 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -99,6 +89,7 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = src/plugins
+DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/m4/ax_socklen_t.m4 \
@@ -109,7 +100,6 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/compat.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h \
 	$(top_builddir)/include/openvpn-plugin.h
@@ -170,7 +160,6 @@ am__define_uniq_tagged_files = \
 ETAGS = etags
 CTAGS = ctags
 DIST_SUBDIRS = $(SUBDIRS)
-am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 am__relativize = \
   dir0=`pwd`; \
@@ -244,7 +233,6 @@ LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 LZ4_CFLAGS = @LZ4_CFLAGS@
 LZ4_LIBS = @LZ4_LIBS@
 LZO_CFLAGS = @LZO_CFLAGS@
@@ -293,7 +281,6 @@ PKCS11_HELPER_LIBS = @PKCS11_HELPER_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PLUGINDIR = @PLUGINDIR@
 PLUGIN_AUTH_PAM_CFLAGS = @PLUGIN_AUTH_PAM_CFLAGS@
 PLUGIN_AUTH_PAM_LIBS = @PLUGIN_AUTH_PAM_LIBS@
 RANLIB = @RANLIB@
@@ -306,14 +293,12 @@ SHELL = @SHELL@
 SOCKETS_LIBS = @SOCKETS_LIBS@
 STRIP = @STRIP@
 SYSTEMD_ASK_PASSWORD = @SYSTEMD_ASK_PASSWORD@
-SYSTEMD_UNIT_DIR = @SYSTEMD_UNIT_DIR@
 TAP_CFLAGS = @TAP_CFLAGS@
 TAP_WIN_COMPONENT_ID = @TAP_WIN_COMPONENT_ID@
 TAP_WIN_MIN_MAJOR = @TAP_WIN_MIN_MAJOR@
 TAP_WIN_MIN_MINOR = @TAP_WIN_MIN_MINOR@
 TEST_CFLAGS = @TEST_CFLAGS@
 TEST_LDFLAGS = @TEST_LDFLAGS@
-TMPFILES_DIR = @TMPFILES_DIR@
 VENDOR_BUILD_ROOT = @VENDOR_BUILD_ROOT@
 VENDOR_DIST_ROOT = @VENDOR_DIST_ROOT@
 VENDOR_SRC_ROOT = @VENDOR_SRC_ROOT@
@@ -370,9 +355,7 @@ sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-systemdunitdir = @systemdunitdir@
 target_alias = @target_alias@
-tmpfilesdir = @tmpfilesdir@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
@@ -395,6 +378,7 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/plugins/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --foreign src/plugins/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -690,8 +674,6 @@ uninstall-am:
 	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
 	ps ps-am tags tags-am uninstall uninstall-am
 
-.PRECIOUS: Makefile
-
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/src/plugins/auth-pam/Makefile.in b/src/plugins/auth-pam/Makefile.in
index 50b7523..90d5058 100644
--- a/src/plugins/auth-pam/Makefile.in
+++ b/src/plugins/auth-pam/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.13.4 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -22,17 +22,7 @@
 
 
 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -96,6 +86,8 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = src/plugins/auth-pam
+DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
+	$(top_srcdir)/depcomp $(am__dist_doc_DATA_DIST)
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/m4/ax_socklen_t.m4 \
@@ -106,8 +98,6 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/compat.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__dist_doc_DATA_DIST) \
-	$(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h \
 	$(top_builddir)/include/openvpn-plugin.h
@@ -219,7 +209,6 @@ am__define_uniq_tagged_files = \
   done | $(am__uniquify_input)`
 ETAGS = etags
 CTAGS = ctags
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -268,7 +257,6 @@ LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 LZ4_CFLAGS = @LZ4_CFLAGS@
 LZ4_LIBS = @LZ4_LIBS@
 LZO_CFLAGS = @LZO_CFLAGS@
@@ -317,7 +305,6 @@ PKCS11_HELPER_LIBS = @PKCS11_HELPER_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PLUGINDIR = @PLUGINDIR@
 PLUGIN_AUTH_PAM_CFLAGS = @PLUGIN_AUTH_PAM_CFLAGS@
 PLUGIN_AUTH_PAM_LIBS = @PLUGIN_AUTH_PAM_LIBS@
 RANLIB = @RANLIB@
@@ -330,14 +317,12 @@ SHELL = @SHELL@
 SOCKETS_LIBS = @SOCKETS_LIBS@
 STRIP = @STRIP@
 SYSTEMD_ASK_PASSWORD = @SYSTEMD_ASK_PASSWORD@
-SYSTEMD_UNIT_DIR = @SYSTEMD_UNIT_DIR@
 TAP_CFLAGS = @TAP_CFLAGS@
 TAP_WIN_COMPONENT_ID = @TAP_WIN_COMPONENT_ID@
 TAP_WIN_MIN_MAJOR = @TAP_WIN_MIN_MAJOR@
 TAP_WIN_MIN_MINOR = @TAP_WIN_MIN_MINOR@
 TEST_CFLAGS = @TEST_CFLAGS@
 TEST_LDFLAGS = @TEST_LDFLAGS@
-TMPFILES_DIR = @TMPFILES_DIR@
 VENDOR_BUILD_ROOT = @VENDOR_BUILD_ROOT@
 VENDOR_DIST_ROOT = @VENDOR_DIST_ROOT@
 VENDOR_SRC_ROOT = @VENDOR_SRC_ROOT@
@@ -394,9 +379,7 @@ sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-systemdunitdir = @systemdunitdir@
 target_alias = @target_alias@
-tmpfilesdir = @tmpfilesdir@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
@@ -439,6 +422,7 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/plugins/auth-pam/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --foreign src/plugins/auth-pam/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -510,14 +494,14 @@ distclean-compile:
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -762,8 +746,6 @@ uninstall-am: uninstall-dist_docDATA uninstall-pluginLTLIBRARIES
 	tags tags-am uninstall uninstall-am uninstall-dist_docDATA \
 	uninstall-pluginLTLIBRARIES
 
-.PRECIOUS: Makefile
-
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/src/plugins/auth-pam/auth-pam.c b/src/plugins/auth-pam/auth-pam.c
index ae514d7..1767d1e 100644
--- a/src/plugins/auth-pam/auth-pam.c
+++ b/src/plugins/auth-pam/auth-pam.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -62,9 +63,6 @@
 #define RESPONSE_VERIFY_SUCCEEDED 12
 #define RESPONSE_VERIFY_FAILED    13
 
-/* Pointers to functions exported from openvpn */
-static plugin_secure_memzero_t plugin_secure_memzero = NULL;
-
 /*
  * Plugin state, used by foreground
  */
@@ -276,10 +274,8 @@ name_value_match(const char *query, const char *match)
     return strncasecmp(match, query, strlen(match)) == 0;
 }
 
-OPENVPN_EXPORT int
-openvpn_plugin_open_v3(const int v3structver,
-                       struct openvpn_plugin_args_open_in const *args,
-                       struct openvpn_plugin_args_open_return *ret)
+OPENVPN_EXPORT openvpn_plugin_handle_t
+openvpn_plugin_open_v1(unsigned int *type_mask, const char *argv[], const char *envp[])
 {
     pid_t pid;
     int fd[2];
@@ -289,16 +285,6 @@ openvpn_plugin_open_v3(const int v3structver,
 
     const int base_parms = 2;
 
-    const char **argv = args->argv;
-    const char **envp = args->envp;
-
-    /* Check API compatibility -- struct version 4 or higher needed */
-    if (v3structver < 4)
-    {
-        fprintf(stderr, "AUTH-PAM: This plugin is incompatible with the running version of OpenVPN\n");
-        return OPENVPN_PLUGIN_FUNC_ERROR;
-    }
-
     /*
      * Allocate our context
      */
@@ -312,10 +298,7 @@ openvpn_plugin_open_v3(const int v3structver,
     /*
      * Intercept the --auth-user-pass-verify callback.
      */
-    ret->type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY);
-
-    /* Save global pointers to functions exported from openvpn */
-    plugin_secure_memzero = args->callbacks->plugin_secure_memzero;
+    *type_mask = OPENVPN_PLUGIN_MASK(OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY);
 
     /*
      * Make sure we have two string arguments: the first is the .so name,
@@ -403,8 +386,7 @@ openvpn_plugin_open_v3(const int v3structver,
         if (status == RESPONSE_INIT_SUCCEEDED)
         {
             context->foreground_fd = fd[0];
-            ret->handle = (openvpn_plugin_handle_t *) context;
-            return OPENVPN_PLUGIN_FUNC_SUCCESS;
+            return (openvpn_plugin_handle_t) context;
         }
     }
     else
@@ -438,7 +420,7 @@ error:
     {
         free(context);
     }
-    return OPENVPN_PLUGIN_FUNC_ERROR;
+    return NULL;
 }
 
 OPENVPN_EXPORT int
@@ -716,7 +698,7 @@ pam_server(int fd, const char *service, int verb, const struct name_value_list *
     struct user_pass up;
     int command;
 #ifdef USE_PAM_DLOPEN
-    static const char pam_so[] = "libpam.so";
+    static const char pam_so[] = "libpam.so.0";
 #endif
 
     /*
@@ -803,7 +785,6 @@ pam_server(int fd, const char *service, int verb, const struct name_value_list *
                         goto done;
                     }
                 }
-                plugin_secure_memzero(up.password, sizeof(up.password));
                 break;
 
             case COMMAND_EXIT:
@@ -821,7 +802,6 @@ pam_server(int fd, const char *service, int verb, const struct name_value_list *
     }
 done:
 
-    plugin_secure_memzero(up.password, sizeof(up.password));
 #ifdef USE_PAM_DLOPEN
     dlclose_pam();
 #endif
diff --git a/src/plugins/auth-pam/auth-pam.exports b/src/plugins/auth-pam/auth-pam.exports
index 597e33f..b07937c 100644
--- a/src/plugins/auth-pam/auth-pam.exports
+++ b/src/plugins/auth-pam/auth-pam.exports
@@ -1,4 +1,4 @@
-openvpn_plugin_open_v3
+openvpn_plugin_open_v1
 openvpn_plugin_func_v1
 openvpn_plugin_close_v1
 openvpn_plugin_abort_v1
diff --git a/src/plugins/auth-pam/utils.c b/src/plugins/auth-pam/utils.c
index 4b900c7..4f8fb0a 100644
--- a/src/plugins/auth-pam/utils.c
+++ b/src/plugins/auth-pam/utils.c
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -77,8 +78,7 @@ searchandreplace(const char *tosearch, const char *searchfor, const char *replac
         return strdup(tosearch);
     }
 
-    while (scratch)
-    {
+    while (scratch) {
         strncat(temp,searching,scratch-searching);
         strcat(temp,replacewith);
 
@@ -117,9 +117,7 @@ string_array_len(const char *array[])
     if (array)
     {
         while (array[i])
-        {
             ++i;
-        }
     }
     return i;
 }
diff --git a/src/plugins/auth-pam/utils.h b/src/plugins/auth-pam/utils.h
index c0b4b10..fbc9705 100644
--- a/src/plugins/auth-pam/utils.h
+++ b/src/plugins/auth-pam/utils.h
@@ -16,9 +16,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #ifndef _PLUGIN_AUTH_PAM_UTILS__H
diff --git a/src/plugins/down-root/Makefile.in b/src/plugins/down-root/Makefile.in
index f1a840a..e5c0ad5 100644
--- a/src/plugins/down-root/Makefile.in
+++ b/src/plugins/down-root/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.13.4 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -22,17 +22,7 @@
 
 
 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -96,6 +86,8 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = src/plugins/down-root
+DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
+	$(top_srcdir)/depcomp $(am__dist_doc_DATA_DIST)
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/m4/ax_socklen_t.m4 \
@@ -106,8 +98,6 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_emptyarray.m4 \
 	$(top_srcdir)/compat.m4 $(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__dist_doc_DATA_DIST) \
-	$(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h \
 	$(top_builddir)/include/openvpn-plugin.h
@@ -218,7 +208,6 @@ am__define_uniq_tagged_files = \
   done | $(am__uniquify_input)`
 ETAGS = etags
 CTAGS = ctags
-am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -267,7 +256,6 @@ LIBTOOL = @LIBTOOL@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 LZ4_CFLAGS = @LZ4_CFLAGS@
 LZ4_LIBS = @LZ4_LIBS@
 LZO_CFLAGS = @LZO_CFLAGS@
@@ -316,7 +304,6 @@ PKCS11_HELPER_LIBS = @PKCS11_HELPER_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
 PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-PLUGINDIR = @PLUGINDIR@
 PLUGIN_AUTH_PAM_CFLAGS = @PLUGIN_AUTH_PAM_CFLAGS@
 PLUGIN_AUTH_PAM_LIBS = @PLUGIN_AUTH_PAM_LIBS@
 RANLIB = @RANLIB@
@@ -329,14 +316,12 @@ SHELL = @SHELL@
 SOCKETS_LIBS = @SOCKETS_LIBS@
 STRIP = @STRIP@
 SYSTEMD_ASK_PASSWORD = @SYSTEMD_ASK_PASSWORD@
-SYSTEMD_UNIT_DIR = @SYSTEMD_UNIT_DIR@
 TAP_CFLAGS = @TAP_CFLAGS@
 TAP_WIN_COMPONENT_ID = @TAP_WIN_COMPONENT_ID@
 TAP_WIN_MIN_MAJOR = @TAP_WIN_MIN_MAJOR@
 TAP_WIN_MIN_MINOR = @TAP_WIN_MIN_MINOR@
 TEST_CFLAGS = @TEST_CFLAGS@
 TEST_LDFLAGS = @TEST_LDFLAGS@
-TMPFILES_DIR = @TMPFILES_DIR@
 VENDOR_BUILD_ROOT = @VENDOR_BUILD_ROOT@
 VENDOR_DIST_ROOT = @VENDOR_DIST_ROOT@
 VENDOR_SRC_ROOT = @VENDOR_SRC_ROOT@
@@ -393,9 +378,7 @@ sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-systemdunitdir = @systemdunitdir@
 target_alias = @target_alias@
-tmpfilesdir = @tmpfilesdir@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
@@ -432,6 +415,7 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/plugins/down-root/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --foreign src/plugins/down-root/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -501,14 +485,14 @@ distclean-compile:
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -753,8 +737,6 @@ uninstall-am: uninstall-dist_docDATA uninstall-pluginLTLIBRARIES
 	tags tags-am uninstall uninstall-am uninstall-dist_docDATA \
 	uninstall-pluginLTLIBRARIES
 
-.PRECIOUS: Makefile
-
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/src/plugins/down-root/down-root.c b/src/plugins/down-root/down-root.c
index 4198184..ae85ecb 100644
--- a/src/plugins/down-root/down-root.c
+++ b/src/plugins/down-root/down-root.c
@@ -17,9 +17,10 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program (see the file COPYING included with this
+ *  distribution); if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 /*
@@ -115,9 +116,7 @@ string_array_len(const char *array[])
     if (array)
     {
         while (array[i])
-        {
             ++i;
-        }
     }
     return i;
 }
author	Jörg Frings-Fürst <debian@jff-webhosting.net>	2017-06-27 13:56:16 +0200
committer	Jörg Frings-Fürst <debian@jff-webhosting.net>	2017-06-27 13:56:16 +0200
commit	749384a154025e268b53cf3cc79eaeddde2b3ceb (patch)
tree	27baa9e6aec76635d750405d90cd461440a656d1 /src
parent	db4f04c584f7d4e828b5d317cf40962b9d854ac5 (diff)