Merge commit '86cc97e55fe346502462284d2e636a2b3708163e' as 'Sources/OpenVPN3'

Sources/OpenVPN3/openvpn/tun/client/dhcp_capture.hpp

@@ -0,0 +1,320 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#ifndef OPENVPN_TUN_CLIENT_DHCP_CAPTURE_H
+#define OPENVPN_TUN_CLIENT_DHCP_CAPTURE_H
+
+#include <cstring>
+
+#include <openvpn/common/socktypes.hpp>
+#include <openvpn/buffer/buffer.hpp>
+#include <openvpn/ip/ipcommon.hpp>
+#include <openvpn/ip/dhcp.hpp>
+#include <openvpn/tun/builder/capture.hpp>
+
+namespace openvpn {
+  class DHCPCapture
+  {
+  public:
+    // We take a TunBuilderCapture object with previously pushed
+    // options and augment it with additional options sniffed
+    // from the DHCP reply.
+    DHCPCapture(const TunBuilderCapture::Ptr& props_arg)
+      : props(props_arg)
+    {
+      if (props->vpn_ipv4() || props->vpn_ipv4())
+	OPENVPN_LOG("NOTE: pushed ifconfig directive is ignored in layer 2 mode");
+      if (!props->dns_servers.empty())
+	OPENVPN_LOG("NOTE: pushed DNS servers are ignored in layer 2 mode");
+      reset();
+    }
+
+    // returns true when router addr and DNS servers are captured
+    bool mod_reply(Buffer& buf)
+    {
+      if (buf.size() < sizeof(DHCPPacket))
+	return false;
+
+      DHCPPacket* dhcp = (DHCPPacket*)buf.data();
+      if (dhcp->ip.protocol == IPCommon::UDP
+	  && dhcp->udp.source == htons(DHCP::BOOTPS_PORT)
+	  && dhcp->udp.dest == htons(DHCP::BOOTPC_PORT)
+	  && dhcp->dhcp.op == DHCP::BOOTREPLY)
+	{
+	  const unsigned int optlen = buf.size() - sizeof(DHCPPacket);
+	  const int message_type = dhcp_message_type(dhcp, optlen);
+	  if (message_type == DHCP::DHCPACK || message_type == DHCP::DHCPOFFER)
+	    {
+	      /* get host IP address/netmask */
+	      const IPv4::Addr host = IPv4::Addr::from_uint32_net(dhcp->dhcp.yiaddr);
+	      const IPv4::Addr netmask = get_netmask(dhcp, optlen);
+	      const int prefix_len = netmask.prefix_len_nothrow();
+
+	      /* get the router IP address while padding out all DHCP router options */
+	      const IPv4::Addr router = extract_router(dhcp, optlen);
+
+	      /* get DNS server addresses */
+	      const std::vector<IPv4::Addr> dns_servers = get_dns(dhcp, optlen);
+
+	      /* recompute the UDP checksum */
+	      dhcp->udp.check = 0;
+	      dhcp->udp.check = htons(udp_checksum((uint8_t *)&dhcp->udp,
+						   sizeof(UDPHeader) + sizeof(DHCP) + optlen,
+						   (uint8_t *)&dhcp->ip.saddr,
+						   (uint8_t *)&dhcp->ip.daddr));
+
+	      /* only capture the extracted Router address if DHCPACK */
+	      if (message_type == DHCP::DHCPACK && !configured)
+		{
+		  bool complete = true;
+		  if (host.unspecified())
+		    {
+		      OPENVPN_LOG("NOTE: failed to obtain host address via DHCP");
+		      complete = false;
+		    }
+		  if (netmask.unspecified())
+		    {
+		      OPENVPN_LOG("NOTE: failed to obtain netmask via DHCP");
+		      complete = false;
+		    }
+		  if (prefix_len < 0)
+		    {
+		      OPENVPN_LOG("NOTE: bad netmask obtained via DHCP: " << netmask);
+		      complete = false;
+		    }
+		  if (router.unspecified())
+		    {
+		      OPENVPN_LOG("NOTE: failed to obtain router via DHCP");
+		      complete = false;
+		    }
+		  if (complete)
+		    {
+		      reset();
+		      props->tun_builder_add_address(host.to_string(), prefix_len, router.to_string(), false, false);
+		      if (dns_servers.empty())
+			OPENVPN_LOG("NOTE: failed to obtain DNS servers via DHCP");
+		      else
+			{
+			  for (const auto &a : dns_servers)
+			    props->tun_builder_add_dns_server(a.to_string(), false);
+			}
+		    }
+		  return configured = complete;
+		}
+	    }
+	}
+      return false;
+    }
+
+    const TunBuilderCapture& get_props() const
+    {
+      return *props;
+    }
+
+  private:
+    void reset()
+    {
+      props->reset_tunnel_addresses();
+      props->reset_dns_servers();
+    }
+
+    static int dhcp_message_type(const DHCPPacket* dhcp, const unsigned int optlen)
+    {
+      const std::uint8_t* p = dhcp->options;
+      for (unsigned int i = 0; i < optlen; ++i)
+	{
+	  const std::uint8_t type = p[i];
+	  const unsigned int room = optlen - i;
+
+	  if (type == DHCP::DHCP_END)           /* didn't find what we were looking for */
+	    return -1;
+	  else if (type == DHCP::DHCP_PAD)      /* no-operation */
+	    ;
+	  else if (type == DHCP::DHCP_MSG_TYPE) /* what we are looking for */
+	    {
+	      if (room >= 3)
+		{
+		  if (p[i+1] == 1)        /* option length should be 1 */
+		    return p[i+2];        /* return message type */
+		}
+	      return -1;
+	    }
+	  else                            /* some other option */
+	    {
+	      if (room >= 2)
+		{
+		  const unsigned int len = p[i+1]; /* get option length */
+		  i += (len + 1);                  /* advance to next option */
+		}
+	    }
+	}
+      return -1;
+    }
+
+    static IPv4::Addr extract_router(DHCPPacket* dhcp, const unsigned int optlen)
+    {
+      std::uint8_t* p = dhcp->options;
+      IPv4::Addr ret = IPv4::Addr::from_zero();
+
+      for (unsigned int i = 0; i < optlen; )
+	{
+	  const std::uint8_t type = p[i];
+	  const unsigned int room = optlen - i;
+
+	  if (type == DHCP::DHCP_END)
+	    break;
+	  else if (type == DHCP::DHCP_PAD)
+	    ++i;
+	  else if (type == DHCP::DHCP_ROUTER)
+	    {
+	      if (room >= 2)
+		{
+		  const unsigned int len = p[i+1]; /* get option length */
+		  if (len <= (room-2))
+		    {
+		      /* get router IP address */
+		      if (ret.unspecified() && len >= 4 && (len & 3) == 0)
+			ret = IPv4::Addr::from_bytes_net(p + i + 2);
+
+		      /* delete the router option */
+		      std::uint8_t *dest = p + i;
+		      const unsigned int owlen = len + 2; /* len of data to overwrite */
+		      std::uint8_t *src = dest + owlen;
+		      std::uint8_t *end = p + optlen;
+		      const int movlen = end - src;
+		      if (movlen > 0)
+			std::memmove(dest, src, movlen);               /* overwrite router option */
+		      std::memset(end - owlen, DHCP::DHCP_PAD, owlen); /* pad tail */
+		    }
+		  else
+		    break;
+		}
+	      else
+		break;
+	    }
+	  else                                      /* some other option */
+	    {
+	      if (room >= 2)
+		{
+		  const unsigned int len = p[i+1];  /* get option length */
+		  i += (len + 2);                   /* advance to next option */
+		}
+	      else
+		break;
+	    }
+	}
+      return ret;
+    }
+
+    static IPv4::Addr get_netmask(const DHCPPacket* dhcp, const unsigned int optlen)
+    {
+      const std::uint8_t* p = dhcp->options;
+      IPv4::Addr ret = IPv4::Addr::from_zero();
+
+      for (unsigned int i = 0; i < optlen; )
+	{
+	  const std::uint8_t type = p[i];
+	  const unsigned int room = optlen - i;
+
+	  if (type == DHCP::DHCP_END)
+	    break;
+	  else if (type == DHCP::DHCP_PAD)
+	    ++i;
+	  else if (type == DHCP::DHCP_NETMASK)
+	    {
+	      if (room >= 2)
+		{
+		  const unsigned int len = p[i+1]; /* get option length */
+		  if (len <= (room-2) && len == 4)
+		    return IPv4::Addr::from_bytes_net(p + i + 2);
+		  else
+		    break;
+		}
+	      else
+		break;
+	    }
+	  else                                     /* some other option */
+	    {
+	      if (room >= 2)
+		{
+		  const unsigned int len = p[i+1]; /* get option length */
+		  i += (len + 2);                  /* advance to next option */
+		}
+	      else
+		break;
+	    }
+	}
+      return ret;
+    }
+
+    static std::vector<IPv4::Addr> get_dns(const DHCPPacket* dhcp, const unsigned int optlen)
+    {
+      const std::uint8_t* p = dhcp->options;
+      std::vector<IPv4::Addr> ret;
+
+      for (unsigned int i = 0; i < optlen; )
+	{
+	  const std::uint8_t type = p[i];
+	  const unsigned int room = optlen - i;
+
+	  if (type == DHCP::DHCP_END)
+	    break;
+	  else if (type == DHCP::DHCP_PAD)
+	    ++i;
+	  else if (type == DHCP::DHCP_DNS)
+	    {
+	      if (room >= 2)
+		{
+		  const unsigned int len = p[i+1]; /* get option length */
+		  if (len <= (room-2) && (len & 3) == 0)
+		    {
+		      /* get DNS addresses */
+		      for (unsigned int j = 0; j < len; j += 4)
+			ret.push_back(IPv4::Addr::from_bytes_net(p + i + j + 2));
+
+		      i += (len + 2);              /* advance to next option */
+		    }
+		  else
+		    break;
+		}
+	      else
+		break;
+	    }
+	  else                                     /* some other option */
+	    {
+	      if (room >= 2)
+		{
+		  const unsigned int len = p[i+1]; /* get option length */
+		  i += (len + 2);                  /* advance to next option */
+		}
+	      else
+		break;
+	    }
+	}
+      return ret;
+    }
+
+    TunBuilderCapture::Ptr props;
+    bool configured = false;
+  };
+}
+
+#endif

Sources/OpenVPN3/openvpn/tun/client/emuexr.hpp

@@ -0,0 +1,50 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Base classes for Emulate Excluded Routes
+
+#ifndef OPENVPN_TUN_CLIENT_EMUEXR_H
+#define OPENVPN_TUN_CLIENT_EMUEXR_H
+
+#include <openvpn/common/rc.hpp>
+#include <openvpn/client/ipverflags.hpp>
+#include <openvpn/tun/builder/base.hpp>
+
+namespace openvpn {
+  struct EmulateExcludeRoute : public RC<thread_unsafe_refcount>
+  {
+    typedef RCPtr<EmulateExcludeRoute> Ptr;
+
+    virtual void add_route(const bool add, const IP::Addr& addr, const int prefix_len) = 0;
+    virtual bool enabled(const IPVerFlags& ipv) const = 0;
+    virtual void emulate(TunBuilderBase* tb, IPVerFlags& ipv, const IP::Addr& server_addr) const = 0;
+    virtual void add_default_routes(bool ipv4, bool ipv6) = 0;
+  };
+
+  struct EmulateExcludeRouteFactory : public RC<thread_unsafe_refcount>
+  {
+    typedef RCPtr<EmulateExcludeRouteFactory> Ptr;
+
+    virtual EmulateExcludeRoute::Ptr new_obj() const = 0;
+  };
+}
+
+#endif

Sources/OpenVPN3/openvpn/tun/client/tunbase.hpp

@@ -0,0 +1,92 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Abstract base classes for client tun interface objects.
+
+#ifndef OPENVPN_TUN_CLIENT_TUNBASE_H
+#define OPENVPN_TUN_CLIENT_TUNBASE_H
+
+#include <string>
+
+#include <openvpn/io/io.hpp>
+
+#include <openvpn/common/rc.hpp>
+#include <openvpn/common/options.hpp>
+#include <openvpn/buffer/buffer.hpp>
+#include <openvpn/transport/client/transbase.hpp>
+
+namespace openvpn {
+
+  // Base class for objects that implement a client tun interface.
+  struct TunClient : public virtual RC<thread_unsafe_refcount>
+  {
+    typedef RCPtr<TunClient> Ptr;
+
+    virtual void tun_start(const OptionList&, TransportClient&, CryptoDCSettings&) = 0;
+    virtual void stop() = 0;
+    virtual void set_disconnect() = 0;
+    virtual bool tun_send(BufferAllocated& buf) = 0; // return true if send succeeded
+
+    virtual std::string tun_name() const = 0;
+
+    virtual std::string vpn_ip4() const = 0; // VPN IP addresses
+    virtual std::string vpn_ip6() const = 0;
+
+    virtual std::string vpn_gw4() const { return std::string(); } // VPN gateways
+    virtual std::string vpn_gw6() const { return std::string(); }
+  };
+
+  // Base class for parent of tun interface object, used to
+  // communicate received data packets, exceptions, and progress
+  // notifications.
+  struct TunClientParent
+  {
+    virtual void tun_recv(BufferAllocated& buf) = 0;
+    virtual void tun_error(const Error::Type fatal_err, const std::string& err_text) = 0;
+
+    // progress notifications
+    virtual void tun_pre_tun_config() = 0;
+    virtual void tun_pre_route_config() = 0;
+    virtual void tun_connected() = 0;
+  };
+
+  // Factory for tun interface objects.
+  struct TunClientFactory : public virtual RC<thread_unsafe_refcount>
+  {
+    typedef RCPtr<TunClientFactory> Ptr;
+
+    virtual TunClient::Ptr new_tun_client_obj(openvpn_io::io_context& io_context,
+					      TunClientParent& parent,
+					      TransportClient* transcli) = 0;
+
+    // return true if layer 2 tunnels are supported
+    virtual bool layer_2_supported() const { return false; }
+
+    // Called on TunClient close, after TunClient::stop has been called.
+    // disconnected ->
+    //   true: this is the final disconnect, or
+    //   false: we are in a pause/reconnecting state.
+    virtual void finalize(const bool disconnected) {}
+  };
+
+} // namespace openvpn
+
+#endif // OPENVPN_TUN_CLIENT_TUNBASE_H

Sources/OpenVPN3/openvpn/tun/client/tunnull.hpp

@@ -0,0 +1,120 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Null tun interface object, intended for testing.
+
+#ifndef OPENVPN_TUN_CLIENT_TUNNULL_H
+#define OPENVPN_TUN_CLIENT_TUNNULL_H
+
+#include <openvpn/tun/client/tunbase.hpp>
+
+namespace openvpn {
+  namespace TunNull {
+
+    class ClientConfig : public TunClientFactory
+    {
+    public:
+      typedef RCPtr<ClientConfig> Ptr;
+
+      Frame::Ptr frame;
+      SessionStats::Ptr stats;
+
+      static Ptr new_obj()
+      {
+	return new ClientConfig;
+      }
+
+      virtual TunClient::Ptr new_tun_client_obj(openvpn_io::io_context& io_context,
+						TunClientParent& parent,
+						TransportClient* transcli);
+    private:
+      ClientConfig() {}
+    };
+
+    class Client : public TunClient
+    {
+      friend class ClientConfig;  // calls constructor
+
+    public:
+      virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&)
+      {
+#ifdef TUN_NULL_EXIT
+	throw ErrorCode(Error::TUN_SETUP_FAILED, true, "TUN_NULL_EXIT");
+#else
+	// signal that we are "connected"
+	parent.tun_connected();
+#endif
+      }
+
+      virtual bool tun_send(BufferAllocated& buf)
+      {
+	config->stats->inc_stat(SessionStats::TUN_BYTES_OUT, buf.size());
+	config->stats->inc_stat(SessionStats::TUN_PACKETS_OUT, 1);
+	return true;
+      }
+
+      virtual std::string tun_name() const
+      {
+	return "TUN_NULL";
+      }
+
+      virtual std::string vpn_ip4() const
+      {
+	return "";
+      }
+
+      virtual std::string vpn_ip6() const
+      {
+	return "";
+      }
+
+      virtual void set_disconnect()
+      {
+      }
+
+      virtual void stop() {}
+
+    private:
+      Client(openvpn_io::io_context& io_context_arg,
+	     ClientConfig* config_arg,
+	     TunClientParent& parent_arg)
+	:  io_context(io_context_arg),
+	   config(config_arg),
+	   parent(parent_arg)
+      {
+      }
+
+      openvpn_io::io_context& io_context;
+      ClientConfig::Ptr config;
+      TunClientParent& parent;
+    };
+
+    inline TunClient::Ptr ClientConfig::new_tun_client_obj(openvpn_io::io_context& io_context,
+							   TunClientParent& parent,
+							   TransportClient* transcli)
+    {
+      return TunClient::Ptr(new Client(io_context, this, parent));
+    }
+
+  }
+} // namespace openvpn
+
+#endif // OPENVPN_TUN_CLIENT_TUNNULL_H

Sources/OpenVPN3/openvpn/tun/client/tunprop.hpp

@@ -0,0 +1,654 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Process tun interface properties.
+
+#ifndef OPENVPN_TUN_CLIENT_TUNPROP_H
+#define OPENVPN_TUN_CLIENT_TUNPROP_H
+
+#include <string>
+
+#include <openvpn/common/size.hpp>
+#include <openvpn/common/rc.hpp>
+#include <openvpn/common/options.hpp>
+#include <openvpn/common/split.hpp>
+#include <openvpn/common/hostport.hpp>
+#include <openvpn/tun/builder/base.hpp>
+#include <openvpn/addr/addrpair.hpp>
+#include <openvpn/client/remotelist.hpp>
+#include <openvpn/client/ipverflags.hpp>
+#include <openvpn/tun/client/emuexr.hpp>
+#include <openvpn/tun/layer.hpp>
+
+namespace openvpn {
+  class TunProp {
+    // add_dns flags
+    enum {
+      F_ADD_DNS=(1<<0),
+    };
+
+    // render option flags
+    enum {
+      OPT_RENDER_FLAGS = Option::RENDER_TRUNC_64 | Option::RENDER_BRACKET
+    };
+
+    // maximum route metric
+    static constexpr int MAX_ROUTE_METRIC = 1000000;
+
+  public:
+    OPENVPN_EXCEPTION(tun_prop_error);
+    OPENVPN_EXCEPTION(tun_prop_route_error);
+    OPENVPN_EXCEPTION(tun_prop_dhcp_option_error);
+
+    struct Config
+    {
+      std::string session_name;
+      int mtu = 0;
+      bool google_dns_fallback = false;
+      bool allow_local_lan_access = false;
+      Layer layer{Layer::OSI_LAYER_3};
+
+      // If remote_bypass is true, obtain cached remote IPs from
+      // remote_list, and preconfigure exclude route rules for them.
+      // Note that the primary remote IP is not included in the
+      // exclusion list because existing pathways already exist
+      // (i.e. redirect-gateway) for routing this particular address.
+      // This feature is intended to work with tun_persist, so that
+      // the client is not locked out of contacting subsequent
+      // servers in the remote list after the routing configuration
+      // for the initial connection has taken effect.
+      RemoteList::Ptr remote_list;
+      bool remote_bypass = false;
+    };
+
+    struct State : public RC<thread_unsafe_refcount>
+    {
+      typedef RCPtr<State> Ptr;
+
+      std::string iface_name;
+      IP::Addr vpn_ip4_addr;
+      IP::Addr vpn_ip6_addr;
+      IP::Addr vpn_ip4_gw;
+      IP::Addr vpn_ip6_gw;
+      bool tun_prefix = false;
+    };
+
+    static void configure_builder(TunBuilderBase* tb,
+				  State* state,
+				  SessionStats* stats,
+				  const IP::Addr& server_addr,
+				  const Config& config,
+				  const OptionList& opt,
+				  const EmulateExcludeRouteFactory* eer_factory,
+				  const bool quiet)
+    {
+      // if eer_factory is defined, we must emulate exclude routes
+      EmulateExcludeRoute::Ptr eer;
+      if (eer_factory)
+	eer = eer_factory->new_obj();
+
+      // do ifconfig
+      IP::Addr::VersionMask ip_ver_flags = tun_ifconfig(tb, state, opt);
+
+      // with layer 2, either IPv4 or IPv6 might be supported
+      if (config.layer() == Layer::OSI_LAYER_2)
+	ip_ver_flags |= (IP::Addr::V4_MASK|IP::Addr::V6_MASK);
+
+      // verify IPv4/IPv6
+      if (!ip_ver_flags)
+	throw tun_prop_error("one of ifconfig or ifconfig-ipv6 must be specified");
+
+      // get IP version and redirect-gateway flags
+      IPVerFlags ipv(opt, ip_ver_flags);
+
+      // add default route-metric
+      add_route_metric_default(tb, opt, quiet);
+
+      // add remote bypass routes
+      if (config.remote_list && config.remote_bypass)
+	add_remote_bypass_routes(tb, *config.remote_list, server_addr, eer.get(), quiet);
+
+      // add routes
+      if (config.allow_local_lan_access)
+	{
+	  // query local lan exclude routes and then
+	  // copy option list to construct a copy with the excluded routes as route options
+	  OptionList excludedRoutesOptions = opt;
+	  for (const std::string& exRoute: tb->tun_builder_get_local_networks(false))
+	    {
+	      excludedRoutesOptions.add_item(Option{"route", exRoute, "", "net_gateway"});
+	    }
+
+	  for (const std::string& exRoute:  tb->tun_builder_get_local_networks(true))
+	    {
+	      excludedRoutesOptions.add_item(Option{"route-ipv6", exRoute, "", "net_gateway"});
+	    }
+
+	  add_routes(tb, excludedRoutesOptions, ipv, eer.get(), quiet);
+	}
+      else
+	{
+	  add_routes(tb, opt, ipv, eer.get(), quiet);
+	}
+
+
+      if (eer)
+	{
+	  // Route emulation needs to know if default routes are included
+	  // from redirect-gateway
+	  eer->add_default_routes(ipv.rgv4(), ipv.rgv6());
+	  // emulate exclude routes
+	  eer->emulate(tb, ipv, server_addr);
+	}
+      else
+	{
+	  // configure redirect-gateway
+	  if (!tb->tun_builder_reroute_gw(ipv.rgv4(), ipv.rgv6(), ipv.api_flags()))
+	      throw tun_prop_route_error("tun_builder_reroute_gw for redirect-gateway failed");
+	}
+
+      // add DNS servers and domain prefixes
+      const unsigned int dhcp_option_flags = add_dhcp_options(tb, opt, quiet);
+
+      // Block IPv6?
+      tb->tun_builder_set_block_ipv6(opt.exists("block-ipv6"));
+
+      // DNS fallback
+      if (ipv.rgv4() && !(dhcp_option_flags & F_ADD_DNS))
+	{
+	  if (config.google_dns_fallback)
+	    {
+	      if (!quiet)
+		OPENVPN_LOG("Google DNS fallback enabled");
+	      add_google_dns(tb);
+	    }
+	  else if (stats && (config.layer() != Layer::OSI_LAYER_2))
+	    stats->error(Error::REROUTE_GW_NO_DNS);
+	}
+
+      // set remote server address
+      if (!tb->tun_builder_set_remote_address(server_addr.to_string(),
+					      server_addr.version() == IP::Addr::V6))
+	throw tun_prop_error("tun_builder_set_remote_address failed");
+
+      // set layer
+      if (!tb->tun_builder_set_layer(config.layer.value()))
+	throw tun_prop_error("tun_builder_set_layer failed");
+
+      // set MTU
+      if (config.mtu)
+	{
+	  if (!tb->tun_builder_set_mtu(config.mtu))
+	    throw tun_prop_error("tun_builder_set_mtu failed");
+	}
+
+      // set session name
+      if (!config.session_name.empty())
+	{
+	  if (!tb->tun_builder_set_session_name(config.session_name))
+	    throw tun_prop_error("tun_builder_set_session_name failed");
+	}
+    }
+
+  private:
+
+    static void add_route_metric_default(TunBuilderBase* tb,
+					 const OptionList& opt,
+					 const bool quiet)
+    {
+      try {
+	const Option* o = opt.get_ptr("route-metric"); // DIRECTIVE
+	if (o)
+	  {
+	    const int metric = o->get_num<int>(1);
+	    if (metric < 0 || metric > MAX_ROUTE_METRIC)
+	      throw tun_prop_error("route-metric is out of range");
+	    if (!tb->tun_builder_set_route_metric_default(metric))
+	      throw tun_prop_error("tun_builder_set_route_metric_default failed");
+	  }
+      }
+      catch (const std::exception& e)
+	{
+	  if (!quiet)
+	    OPENVPN_LOG("exception processing route-metric: " << e.what());
+	}
+    }
+
+    static IP::Addr route_gateway(const OptionList& opt)
+    {
+      IP::Addr gateway;
+      const Option* o = opt.get_ptr("route-gateway"); // DIRECTIVE
+      if (o)
+	{
+	  gateway = IP::Addr::from_string(o->get(1, 256), "route-gateway");
+	  if (gateway.version() != IP::Addr::V4)
+	    throw tun_prop_error("route-gateway is not IPv4 (IPv6 route-gateway is passed with ifconfig-ipv6 directive)");
+	}
+      return gateway;
+    }
+
+    static IP::Addr::VersionMask tun_ifconfig(TunBuilderBase* tb,
+					      State* state,
+					      const OptionList& opt)
+    {
+      enum Topology {
+	NET30,
+	SUBNET,
+      };
+
+      IP::Addr::VersionMask ip_ver_flags = 0;
+
+      // get topology
+      Topology top = NET30;
+      {
+	const Option* o = opt.get_ptr("topology"); // DIRECTIVE
+	if (o)
+	  {
+	    const std::string& topstr = o->get(1, 16);
+	    if (topstr == "subnet")
+	      top = SUBNET;
+	    else if (topstr == "net30")
+	      top = NET30;
+	    else
+	      throw option_error("only topology 'subnet' and 'net30' supported");
+	  }
+      }
+
+      // configure tun interface
+      {
+	const Option* o;
+	o = opt.get_ptr("ifconfig"); // DIRECTIVE
+	if (o)
+	  {
+	    if (top == SUBNET)
+	      {
+		const IP::AddrMaskPair pair = IP::AddrMaskPair::from_string(o->get(1, 256), o->get_optional(2, 256), "ifconfig");
+		const IP::Addr gateway = route_gateway(opt);
+		if (pair.version() != IP::Addr::V4)
+		  throw tun_prop_error("ifconfig address is not IPv4 (topology subnet)");
+		if (!tb->tun_builder_add_address(pair.addr.to_string(),
+						 pair.netmask.prefix_len(),
+						 gateway.to_string(),
+						 false,  // IPv6
+						 false)) // net30
+		  throw tun_prop_error("tun_builder_add_address IPv4 failed (topology subnet)");
+		if (state)
+		  {
+		    state->vpn_ip4_addr = pair.addr;
+		    state->vpn_ip4_gw = gateway;
+		  }
+		ip_ver_flags |= IP::Addr::V4_MASK;
+	      }
+	    else if (top == NET30)
+	      {
+		const IP::Addr remote = IP::Addr::from_string(o->get(2, 256));
+		const IP::Addr local = IP::Addr::from_string(o->get(1, 256));
+		const IP::Addr netmask = IP::Addr::from_string("255.255.255.252");
+		if (local.version() != IP::Addr::V4 || remote.version() != IP::Addr::V4)
+		  throw tun_prop_error("ifconfig address is not IPv4 (topology net30)");
+		if ((local & netmask) != (remote & netmask))
+		  throw tun_prop_error("ifconfig addresses are not in the same /30 subnet (topology net30)");
+		if (!tb->tun_builder_add_address(local.to_string(),
+						 netmask.prefix_len(),
+						 remote.to_string(),
+						 false, // IPv6
+						 true)) // net30
+		  throw tun_prop_error("tun_builder_add_address IPv4 failed (topology net30)");
+		if (state)
+		  {
+		    state->vpn_ip4_addr = local;
+		    state->vpn_ip4_gw = remote;
+		  }
+		ip_ver_flags |= IP::Addr::V4_MASK;
+	      }
+	    else
+	      throw option_error("internal topology error");
+	  }
+
+	o = opt.get_ptr("ifconfig-ipv6"); // DIRECTIVE
+	if (o)
+	  {
+	    // We don't check topology setting here since it doesn't really affect IPv6
+	    const IP::AddrMaskPair pair = IP::AddrMaskPair::from_string(o->get(1, 256), "ifconfig-ipv6");
+	    if (pair.version() != IP::Addr::V6)
+	      throw tun_prop_error("ifconfig-ipv6 address is not IPv6");
+	    std::string gateway_str;
+	    if (o->size() >= 3)
+	      {
+		const IP::Addr gateway = IP::Addr::from_string(o->get(2, 256), "ifconfig-ipv6");
+		if (gateway.version() != IP::Addr::V6)
+		  throw tun_prop_error("ifconfig-ipv6 gateway is not IPv6");
+		gateway_str = gateway.to_string();
+		if (state)
+		  state->vpn_ip6_gw = gateway;
+	      }
+	    if (!tb->tun_builder_add_address(pair.addr.to_string(),
+					     pair.netmask.prefix_len(),
+					     gateway_str,
+					     true,   // IPv6
+					     false)) // net30
+	      throw tun_prop_error("tun_builder_add_address IPv6 failed");
+	    if (state)
+	      state->vpn_ip6_addr = pair.addr;
+	    ip_ver_flags |= IP::Addr::V6_MASK;
+	  }
+
+	return ip_ver_flags;
+      }
+    }
+
+    static void add_exclude_route(TunBuilderBase* tb, 
+				  bool add,
+				  const IP::Addr& addr,
+				  int prefix_length,
+				  int metric,
+				  bool ipv6,
+				  EmulateExcludeRoute* eer)
+    {
+      const std::string addr_str = addr.to_string();
+      if (eer)
+	eer->add_route(add, addr, prefix_length);
+      else if (add)
+	{
+	  if (!tb->tun_builder_add_route(addr_str, prefix_length, metric, ipv6))
+	    throw tun_prop_route_error("tun_builder_add_route failed");
+	}
+      else if (!eer)
+	{
+	  if (!tb->tun_builder_exclude_route(addr_str, prefix_length, metric, ipv6))
+	    throw tun_prop_route_error("tun_builder_exclude_route failed");
+	}
+
+    }
+
+    // Check the target of a route.
+    // Return true if route should be added or false if route should be excluded.
+    static bool route_target(const Option& o, const size_t target_index)
+    {
+      if (o.size() >= (target_index+1))
+	{
+	  const std::string& target = o.ref(target_index);
+	  if (target == "vpn_gateway")
+	    return true;
+	  else if (target == "net_gateway")
+	    return false;
+	  else
+	    throw tun_prop_route_error("route destinations other than vpn_gateway or net_gateway are not supported");
+	}
+      else
+	return true;
+    }
+
+    static void add_routes(TunBuilderBase* tb,
+			   const OptionList& opt,
+			   const IPVerFlags& ipv,
+			   EmulateExcludeRoute* eer,
+			   const bool quiet)
+    {
+      // add IPv4 routes
+      if (ipv.v4())
+	{
+	  OptionList::IndexMap::const_iterator dopt = opt.map().find("route"); // DIRECTIVE
+	  if (dopt != opt.map().end())
+	    {
+	      for (OptionList::IndexList::const_iterator i = dopt->second.begin(); i != dopt->second.end(); ++i)
+		{
+		  const Option& o = opt[*i];
+		  try {
+		    const IP::AddrMaskPair pair = IP::AddrMaskPair::from_string(o.get(1, 256), o.get_optional(2, 256), "route");
+		    const int metric = o.get_num<int>(4, -1, 0, MAX_ROUTE_METRIC);
+		    if (!pair.is_canonical())
+		      throw tun_prop_error("route is not canonical");
+		    if (pair.version() != IP::Addr::V4)
+		      throw tun_prop_error("route is not IPv4");
+		    const bool add = route_target(o, 3);
+		    add_exclude_route(tb, add, pair.addr, pair.netmask.prefix_len(), metric, false, eer);
+		  }
+		  catch (const std::exception& e)
+		    {
+		      if (!quiet)
+			OPENVPN_LOG("exception parsing IPv4 route: " << o.render(OPT_RENDER_FLAGS) << " : " << e.what());
+		    }
+		}
+	    }
+	}
+
+      // add IPv6 routes
+      if (ipv.v6())
+	{
+	  OptionList::IndexMap::const_iterator dopt = opt.map().find("route-ipv6"); // DIRECTIVE
+	  if (dopt != opt.map().end())
+	    {
+	      for (OptionList::IndexList::const_iterator i = dopt->second.begin(); i != dopt->second.end(); ++i)
+		{
+		  const Option& o = opt[*i];
+		  try {
+		    const IP::AddrMaskPair pair = IP::AddrMaskPair::from_string(o.get(1, 256), "route-ipv6");
+		    const int metric = o.get_num<int>(3, -1, 0, MAX_ROUTE_METRIC);
+		    if (!pair.is_canonical())
+		      throw tun_prop_error("route is not canonical");
+		    if (pair.version() != IP::Addr::V6)
+		      throw tun_prop_error("route is not IPv6");
+		    const bool add = route_target(o, 2);
+		    add_exclude_route(tb, add, pair.addr, pair.netmask.prefix_len(), metric, true, eer);
+		  }
+		  catch (const std::exception& e)
+		    {
+		      if (!quiet)
+			OPENVPN_LOG("exception parsing IPv6 route: " << o.render(OPT_RENDER_FLAGS) << " : " << e.what());
+		    }
+		}
+	    }
+	}
+    }
+
+    static void add_remote_bypass_routes(TunBuilderBase* tb,
+					 const RemoteList& remote_list,
+					 const IP::Addr& server_addr,
+					 EmulateExcludeRoute* eer,
+					 const bool quiet)
+    {
+      IP::AddrList addrlist;
+      remote_list.cached_ip_address_list(addrlist);
+      for (IP::AddrList::const_iterator i = addrlist.begin(); i != addrlist.end(); ++i)
+	{
+	  const IP::Addr& addr = *i;
+	  if (addr != server_addr)
+	    {
+	      try {
+		const IP::Addr::Version ver = addr.version();
+		add_exclude_route(tb, false, addr, IP::Addr::version_size(ver), -1, ver == IP::Addr::V6, eer);
+	      }
+	      catch (const std::exception& e)
+		{
+		  if (!quiet)
+		    OPENVPN_LOG("exception adding remote bypass route: " << addr.to_string() << " : " << e.what());
+		}
+	    }
+	}
+    }
+
+    static unsigned int add_dhcp_options(TunBuilderBase* tb, const OptionList& opt, const bool quiet)
+    {
+      // Example:
+      //   [dhcp-option] [DNS] [172.16.0.23]
+      //   [dhcp-option] [WINS] [172.16.0.23]
+      //   [dhcp-option] [DOMAIN] [openvpn.net]
+      //   [dhcp-option] [DOMAIN] [example.com]
+      //   [dhcp-option] [DOMAIN] [foo1.com foo2.com foo3.com ...]
+      //   [dhcp-option] [DOMAIN] [bar1.com] [bar2.com] [bar3.com] ...
+      //   [dhcp-option] [ADAPTER_DOMAIN_SUFFIX] [mycompany.com]
+      //   [dhcp-option] [PROXY_HTTP] [foo.bar.gov] [1234]
+      //   [dhcp-option] [PROXY_HTTPS] [foo.bar.gov] [1234]
+      //   [dhcp-option] [PROXY_BYPASS] [server1] [server2] ...
+      //   [dhcp-option] [PROXY_AUTO_CONFIG_URL] [http://...]
+      unsigned int flags = 0;
+      OptionList::IndexMap::const_iterator dopt = opt.map().find("dhcp-option"); // DIRECTIVE
+      if (dopt != opt.map().end())
+	{
+	  std::string auto_config_url;
+	  std::string http_host;
+	  unsigned int http_port = 0;
+	  std::string https_host;
+	  unsigned int https_port = 0;
+	  for (OptionList::IndexList::const_iterator i = dopt->second.begin(); i != dopt->second.end(); ++i)
+	    {
+	      const Option& o = opt[*i];
+	      try {
+		const std::string& type = o.get(1, 64);
+		if (type == "DNS" || type == "DNS6")
+		  {
+		    o.exact_args(3);
+		    const IP::Addr ip = IP::Addr::from_string(o.get(2, 256), "dns-server-ip");
+		    if (!tb->tun_builder_add_dns_server(ip.to_string(),
+							ip.version() == IP::Addr::V6))
+		      throw tun_prop_dhcp_option_error("tun_builder_add_dns_server failed");
+		    flags |= F_ADD_DNS;
+		  }
+		else if (type == "DOMAIN")
+		  {
+		    o.min_args(3);
+		    for (size_t j = 2; j < o.size(); ++j)
+		      {
+			typedef std::vector<std::string> strvec;
+			strvec v = Split::by_space<strvec, StandardLex, SpaceMatch, Split::NullLimit>(o.get(j, 256));
+			for (size_t k = 0; k < v.size(); ++k)
+			  {
+			    if (!tb->tun_builder_add_search_domain(v[k]))
+			      throw tun_prop_dhcp_option_error("tun_builder_add_search_domain failed");
+			  }
+		      }
+		  }
+		else if (type == "ADAPTER_DOMAIN_SUFFIX")
+		  {
+		    o.exact_args(3);
+		    const std::string& adapter_domain_suffix = o.get(2, 256);
+		    if (!tb->tun_builder_set_adapter_domain_suffix(adapter_domain_suffix))
+		      throw tun_prop_dhcp_option_error("tun_builder_set_adapter_domain_suffix");
+		  }
+		else if (type == "PROXY_BYPASS")
+		  {
+		    o.min_args(3);
+		    for (size_t j = 2; j < o.size(); ++j)
+		      {
+			typedef std::vector<std::string> strvec;
+			strvec v = Split::by_space<strvec, StandardLex, SpaceMatch, Split::NullLimit>(o.get(j, 256));
+			for (size_t k = 0; k < v.size(); ++k)
+			  {
+			    if (!tb->tun_builder_add_proxy_bypass(v[k]))
+			      throw tun_prop_dhcp_option_error("tun_builder_add_proxy_bypass");
+			  }
+		      }
+		  }
+		else if (type == "PROXY_AUTO_CONFIG_URL")
+		  {
+		    o.exact_args(3);
+		    auto_config_url = o.get(2, 256);
+		  }
+		else if (type == "PROXY_HTTP")
+		  {
+		    o.exact_args(4);
+		    http_host = o.get(2, 256);
+		    HostPort::validate_port(o.get(3, 256), "PROXY_HTTP", &http_port);
+		  }
+		else if (type == "PROXY_HTTPS")
+		  {
+		    o.exact_args(4);
+		    https_host = o.get(2, 256);
+		    HostPort::validate_port(o.get(3, 256), "PROXY_HTTPS", &https_port);
+		  }
+		else if (type == "WINS")
+		  {
+		    o.exact_args(3);
+		    const IP::Addr ip = IP::Addr::from_string(o.get(2, 256), "wins-server-ip");
+		    if (ip.version() != IP::Addr::V4)
+		      throw tun_prop_dhcp_option_error("WINS addresses must be IPv4");
+		    if (!tb->tun_builder_add_wins_server(ip.to_string()))
+		      throw tun_prop_dhcp_option_error("tun_builder_add_wins_server failed");
+		  }
+		else if (!quiet)
+		  OPENVPN_LOG("Unknown pushed DHCP option: " << o.render(OPT_RENDER_FLAGS));
+	      }
+	      catch (const std::exception& e)
+		{
+		  if (!quiet)
+		    OPENVPN_LOG("exception parsing dhcp-option: " << o.render(OPT_RENDER_FLAGS) << " : " << e.what());
+		}
+	    }
+	  try {
+	    if (!http_host.empty())
+	      {
+		if (!tb->tun_builder_set_proxy_http(http_host, http_port))
+		  throw tun_prop_dhcp_option_error("tun_builder_set_proxy_http");
+	      }
+	    if (!https_host.empty())
+	      {
+		if (!tb->tun_builder_set_proxy_https(https_host, https_port))
+		  throw tun_prop_dhcp_option_error("tun_builder_set_proxy_https");
+	      }
+	    if (!auto_config_url.empty())
+	      {
+		if (!tb->tun_builder_set_proxy_auto_config_url(auto_config_url))
+		  throw tun_prop_dhcp_option_error("tun_builder_set_proxy_auto_config_url");
+	      }
+	  }
+	  catch (const std::exception& e)
+	    {
+	      if (!quiet)
+		OPENVPN_LOG("exception setting dhcp-option for proxy: " << e.what());
+	    }
+	}
+      return flags;
+    }
+
+    static bool search_domains_exist(const OptionList& opt, const bool quiet)
+    {
+      OptionList::IndexMap::const_iterator dopt = opt.map().find("dhcp-option"); // DIRECTIVE
+      if (dopt != opt.map().end())
+	{
+	  for (OptionList::IndexList::const_iterator i = dopt->second.begin(); i != dopt->second.end(); ++i)
+	    {
+	      const Option& o = opt[*i];
+	      try {
+		const std::string& type = o.get(1, 64);
+		if (type == "DOMAIN")
+		  return true;
+	      }
+	      catch (const std::exception& e)
+		{
+		  if (!quiet)
+		    OPENVPN_LOG("exception parsing dhcp-option: " << o.render(OPT_RENDER_FLAGS) << " : " << e.what());
+		}
+	    }
+	}
+      return false;
+    }
+
+    static void add_google_dns(TunBuilderBase* tb)
+    {
+      if (!tb->tun_builder_add_dns_server("8.8.8.8", false)
+	  || !tb->tun_builder_add_dns_server("8.8.4.4", false))
+	throw tun_prop_dhcp_option_error("tun_builder_add_dns_server failed for Google DNS");
+    }
+  };
+} // namespace openvpn
+
+#endif // OPENVPN_TUN_CLIENT_TUNPROP_H