/*
  *  OpenVPN -- An application to securely tunnel IP networks
  *             over a single TCP/UDP port, with support for SSL/TLS-based
  *             session authentication and key exchange,
  *             packet encryption, packet authentication, and
  *             packet compression.
  *

  *  Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>

  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
  *  as published by the Free Software Foundation.
  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *

  *  You should have received a copy of the GNU General Public License along
  *  with this program; if not, write to the Free Software Foundation, Inc.,
  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

  */
 

 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #elif defined(_MSC_VER)
 #include "config-msvc.h"
 #endif
 

 #include "syshead.h"
 
 #include "push.h"
 #include "options.h"
 #include "ssl.h"

 #include "ssl_verify.h"

 #include "manage.h"
 
 #include "memdbg.h"
 
 #if P2MP
 

 static char push_reply_cmd[] = "PUSH_REPLY";
 

 /*
  * Auth username/password
  *
  * Client received an authentication failed message from server.
  * Runs on client.
  */
 void

 receive_auth_failed(struct context *c, const struct buffer *buffer)

 {

     msg(M_VERB0, "AUTH: Received control message: %s", BSTR(buffer));
     c->options.no_advance = true;
 
     if (c->options.pull)
     {
         switch (auth_retry_get())
         {
             case AR_NONE:
                 c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- Auth failure error */
                 break;
 
             case AR_INTERACT:
                 ssl_purge_auth(false);
 
             case AR_NOINTERACT:
                 c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- Auth failure error */
                 break;
 
             default:
                 ASSERT(0);
         }
         c->sig->signal_text = "auth-failure";

 #ifdef ENABLE_MANAGEMENT

         if (management)
         {
             const char *reason = NULL;
             struct buffer buf = *buffer;
             if (buf_string_compare_advance(&buf, "AUTH_FAILED,") && BLEN(&buf))
             {
                 reason = BSTR(&buf);
             }
             management_auth_failure(management, UP_TYPE_AUTH, reason);
         }

 #endif

         /*
          * Save the dynamic-challenge text even when management is defined
          */
         {

 #ifdef ENABLE_CLIENT_CR

             struct buffer buf = *buffer;
             if (buf_string_match_head_str(&buf, "AUTH_FAILED,CRV1:") && BLEN(&buf))
             {
                 buf_advance(&buf, 12); /* Length of "AUTH_FAILED," substring */
                 ssl_put_auth_challenge(BSTR(&buf));
             }

 #endif

         }

     }
 }
 

 /*
  * Act on received restart message from server
  */
 void

 server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)

 {

     if (c->options.pull)
     {
         struct buffer buf = *buffer;
         const char *m = "";
         if (buf_advance(&buf, adv) && buf_read_u8(&buf) == ',' && BLEN(&buf))
         {
             m = BSTR(&buf);
         }
 
         /* preserve cached passwords? */
         /* advance to next server? */
         {
             bool purge = true;
 
             if (m[0] == '[')
             {
                 int i;
                 for (i = 1; m[i] != '\0' && m[i] != ']'; ++i)
                 {
                     if (m[i] == 'P')
                     {
                         purge = false;
                     }
                     else if (m[i] == 'N')
                     {
                         /* next server? */
                         c->options.no_advance = false;
                     }
                 }
             }
             if (purge)
             {
                 ssl_purge_auth(true);
             }
         }
 
         if (restart)
         {
             msg(D_STREAM_ERRORS, "Connection reset command was pushed by server ('%s')", m);
             c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
             c->sig->signal_text = "server-pushed-connection-reset";
         }
         else
         {
             msg(D_STREAM_ERRORS, "Halt command was pushed by server ('%s')", m);
             c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- server-pushed halt */
             c->sig->signal_text = "server-pushed-halt";
         }

 #ifdef ENABLE_MANAGEMENT

         if (management)
         {
             management_notify(management, "info", c->sig->signal_text, m);
         }

 #endif

     }
 }
 

 #if P2MP_SERVER

 /**
  * Add an option to the given push list by providing a format string.
  *
  * The string added to the push options is allocated in o->gc, so the caller
  * does not have to preserve anything.
  *
  * @param gc        GC arena where options are allocated
  * @param push_list Push list containing options
  * @param msglevel  The message level to use when printing errors
  * @param fmt       Format string for the option
  * @param ...       Format string arguments
  *
  * @return true on success, false on failure.
  */
 static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list,

                             int msglevel, const char *fmt, ...)

 #ifdef __GNUC__
 #if __USE_MINGW_ANSI_STDIO

 __attribute__ ((format(gnu_printf, 4, 5)))

 #else

 __attribute__ ((format(__printf__, 4, 5)))

 #endif
 #endif

 ;

 /*
  * Send auth failed message from server to client.
  */

 void

 send_auth_failed(struct context *c, const char *client_reason)

 {

     struct gc_arena gc = gc_new();
     static const char auth_failed[] = "AUTH_FAILED";
     size_t len;

     schedule_exit(c, c->options.scheduled_exit_interval, SIGTERM);

     len = (client_reason ? strlen(client_reason)+1 : 0) + sizeof(auth_failed);
     if (len > PUSH_BUNDLE_SIZE)
     {
         len = PUSH_BUNDLE_SIZE;
     }

     {
         struct buffer buf = alloc_buf_gc(len, &gc);
         buf_printf(&buf, auth_failed);
         if (client_reason)
         {
             buf_printf(&buf, ",%s", client_reason);
         }
         send_control_channel_string(c, BSTR(&buf), D_PUSH);
     }

     gc_free(&gc);

 }

 
 /*
  * Send restart message from server to client.
  */
 void

 send_restart(struct context *c, const char *kill_msg)

 {

     schedule_exit(c, c->options.scheduled_exit_interval, SIGTERM);
     send_control_channel_string(c, kill_msg ? kill_msg : "RESTART", D_PUSH);

 }
 

 #endif /* if P2MP_SERVER */

 
 /*
  * Push/Pull
  */
 
 void

 incoming_push_message(struct context *c, const struct buffer *buffer)

 {

     struct gc_arena gc = gc_new();
     unsigned int option_types_found = 0;
     int status;
 
     msg(D_PUSH, "PUSH: Received control message: '%s'", sanitize_control_message(BSTR(buffer), &gc));
 
     status = process_incoming_push_msg(c,
                                        buffer,
                                        c->options.pull,
                                        pull_permission_mask(c),
                                        &option_types_found);
 
     if (status == PUSH_MSG_ERROR)
     {
         msg(D_PUSH_ERRORS, "WARNING: Received bad push/pull message: %s", sanitize_control_message(BSTR(buffer), &gc));
     }
     else if (status == PUSH_MSG_REPLY || status == PUSH_MSG_CONTINUATION)
     {
         c->options.push_option_types_found |= option_types_found;
 
         /* delay bringing tun/tap up until --push parms received from remote */
         if (status == PUSH_MSG_REPLY)
         {
             if (!do_up(c, true, c->options.push_option_types_found))
             {
                 msg(D_PUSH_ERRORS, "Failed to open tun/tap interface");
                 goto error;
             }
         }
         event_timeout_clear(&c->c2.push_request_interval);
     }
     else if (status == PUSH_MSG_REQUEST)
     {
         if (c->options.mode == MODE_SERVER)
         {
             struct tls_session *session = &c->c2.tls_multi->session[TM_ACTIVE];
             /* Do not regenerate keys if client send a second push request */
             if (!session->key[KS_PRIMARY].crypto_options.key_ctx_bi.initialized
                 && !tls_session_update_crypto_params(session, &c->options,
                                                      &c->c2.frame))
             {
                 msg(D_TLS_ERRORS, "TLS Error: initializing data channel failed");
                 goto error;
             }
         }
     }
 
     goto cleanup;

 error:

     register_signal(c, SIGUSR1, "process-push-msg-failed");

 cleanup:

     gc_free(&gc);

 }
 
 bool

 send_push_request(struct context *c)

 {

     const int max_push_requests = c->options.handshake_window / PUSH_REQUEST_INTERVAL;
     if (++c->c2.n_sent_push_requests <= max_push_requests)

     {

         return send_control_channel_string(c, "PUSH_REQUEST", D_PUSH);

     }

     else

     {

         msg(D_STREAM_ERRORS, "No reply from server after sending %d push requests", max_push_requests);
         c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
         c->sig->signal_text = "no-push-reply";
         return false;

     }

 }
 
 #if P2MP_SERVER

 /**
  * Prepare push options, based on local options and available peer info.
  *

  * @param context       context structure storing data for VPN tunnel
  * @param gc            gc arena for allocating push options
  * @param push_list     push list to where options are added

  *
  * @return true on success, false on failure.
  */
 static bool

 prepare_push_reply(struct context *c, struct gc_arena *gc,
                    struct push_list *push_list)

 {

     const char *optstr = NULL;
     struct tls_multi *tls_multi = c->c2.tls_multi;
     const char *const peer_info = tls_multi->peer_info;
     struct options *o = &c->options;
 
     /* ipv6 */
     if (c->c2.push_ifconfig_ipv6_defined && !o->push_ifconfig_ipv6_blocked)
     {
         push_option_fmt(gc, push_list, M_USAGE, "ifconfig-ipv6 %s/%d %s",
                         print_in6_addr(c->c2.push_ifconfig_ipv6_local, 0, gc),
                         c->c2.push_ifconfig_ipv6_netbits,
                         print_in6_addr(c->c2.push_ifconfig_ipv6_remote,
                                        0, gc));
     }
 
     /* ipv4 */
     if (c->c2.push_ifconfig_defined && c->c2.push_ifconfig_local

         && c->c2.push_ifconfig_remote_netmask
         && !o->push_ifconfig_ipv4_blocked)

     {
         in_addr_t ifconfig_local = c->c2.push_ifconfig_local;
         if (c->c2.push_ifconfig_local_alias)
         {
             ifconfig_local = c->c2.push_ifconfig_local_alias;
         }
         push_option_fmt(gc, push_list, M_USAGE, "ifconfig %s %s",
                         print_in_addr_t(ifconfig_local, 0, gc),
                         print_in_addr_t(c->c2.push_ifconfig_remote_netmask,
                                         0, gc));
     }
 
     /* Send peer-id if client supports it */
     optstr = peer_info ? strstr(peer_info, "IV_PROTO=") : NULL;
     if (optstr)
     {
         int proto = 0;
         int r = sscanf(optstr, "IV_PROTO=%d", &proto);
         if ((r == 1) && (proto >= 2))
         {
             push_option_fmt(gc, push_list, M_USAGE, "peer-id %d",
                             tls_multi->peer_id);

             tls_multi->use_peer_id = true;

         }
     }
 
     /* Push cipher if client supports Negotiable Crypto Parameters */
     if (tls_peer_info_ncp_ver(peer_info) >= 2 && o->ncp_enabled)
     {

         /* if we have already created our key, we cannot *change* our own
          * cipher -> so log the fact and push the "what we have now" cipher
          * (so the client is always told what we expect it to use)

          */
         const struct tls_session *session = &tls_multi->session[TM_ACTIVE];
         if (session->key[KS_PRIMARY].crypto_options.key_ctx_bi.initialized)
         {
             msg( M_INFO, "PUSH: client wants to negotiate cipher (NCP), but "
                  "server has already generated data channel keys, "

                  "re-sending previously negotiated cipher '%s'",
                  o->ciphername );

         }
         else
         {
             /* Push the first cipher from --ncp-ciphers to the client.
              * TODO: actual negotiation, instead of server dictatorship. */
             char *push_cipher = string_alloc(o->ncp_ciphers, &o->gc);
             o->ciphername = strtok(push_cipher, ":");
         }

         push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);

     }
     else if (o->ncp_enabled)
     {
         tls_poor_mans_ncp(o, tls_multi->remote_ciphername);
     }
 
     /* If server uses --auth-gen-token and we have an auth token
      * to send to the client
      */
     if (false == tls_multi->auth_token_sent && NULL != tls_multi->auth_token)
     {
         push_option_fmt(gc, push_list, M_USAGE,
                         "auth-token %s", tls_multi->auth_token);
         tls_multi->auth_token_sent = true;
     }
     return true;

 }
 
 static bool

 send_push_options(struct context *c, struct buffer *buf,
                   struct push_list *push_list, int safe_cap,
                   bool *push_sent, bool *multi_push)

 {

     struct push_entry *e = push_list->head;
 
     while (e)
     {
         if (e->enable)
         {
             const int l = strlen(e->option);
             if (BLEN(buf) + l >= safe_cap)
             {
                 buf_printf(buf, ",push-continuation 2");
                 {
                     const bool status = send_control_channel_string(c, BSTR(buf), D_PUSH);
                     if (!status)
                     {
                         return false;
                     }
                     *push_sent = true;
                     *multi_push = true;
                     buf_reset_len(buf);
                     buf_printf(buf, "%s", push_reply_cmd);
                 }
             }
             if (BLEN(buf) + l >= safe_cap)
             {
                 msg(M_WARN, "--push option is too long");
                 return false;
             }
             buf_printf(buf, ",%s", e->option);
         }
         e = e->next;
     }
     return true;

 }
 
 static bool

 send_push_reply(struct context *c, struct push_list *per_client_push_list)

 {

     struct gc_arena gc = gc_new();
     struct buffer buf = alloc_buf_gc(PUSH_BUNDLE_SIZE, &gc);
     bool multi_push = false;
     const int extra = 84; /* extra space for possible trailing ifconfig and push-continuation */
     const int safe_cap = BCAP(&buf) - extra;
     bool push_sent = false;
 
     buf_printf(&buf, "%s", push_reply_cmd);
 
     /* send options which are common to all clients */
     if (!send_push_options(c, &buf, &c->options.push_list, safe_cap,
                            &push_sent, &multi_push))
     {
         goto fail;
     }

     /* send client-specific options */
     if (!send_push_options(c, &buf, per_client_push_list, safe_cap,
                            &push_sent, &multi_push))

     {

         goto fail;
     }
 

     if (multi_push)

     {

         buf_printf(&buf, ",push-continuation 1");
     }

     if (BLEN(&buf) > sizeof(push_reply_cmd)-1)
     {
         const bool status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
         if (!status)
         {
             goto fail;
         }
         push_sent = true;

     }

     /* If nothing have been pushed, send an empty push,
      * as the client is expecting a response
      */
     if (!push_sent)
     {
         bool status = false;
 
         buf_reset_len(&buf);
         buf_printf(&buf, "%s", push_reply_cmd);
         status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
         if (!status)
         {
             goto fail;
         }
     }

     gc_free(&gc);
     return true;
 
 fail:
     gc_free(&gc);
     return false;

 }
 

 static void

 push_option_ex(struct gc_arena *gc, struct push_list *push_list,
                const char *opt, bool enable, int msglevel)

 {

     if (!string_class(opt, CC_ANY, CC_COMMA))
     {
         msg(msglevel, "PUSH OPTION FAILED (illegal comma (',') in string): '%s'", opt);
     }
     else
     {
         struct push_entry *e;
         ALLOC_OBJ_CLEAR_GC(e, struct push_entry, gc);
         e->enable = true;
         e->option = opt;
         if (push_list->head)
         {
             ASSERT(push_list->tail);
             push_list->tail->next = e;
             push_list->tail = e;
         }
         else
         {
             ASSERT(!push_list->tail);
             push_list->head = e;
             push_list->tail = e;
         }

     }
 }
 
 void

 push_option(struct options *o, const char *opt, int msglevel)

 {

     push_option_ex(&o->gc, &o->push_list, opt, true, msglevel);

 }
 
 void

 clone_push_list(struct options *o)

 {

     if (o->push_list.head)

     {

         const struct push_entry *e = o->push_list.head;
         push_reset(o);
         while (e)
         {
             push_option_ex(&o->gc, &o->push_list,
                            string_alloc(e->option, &o->gc), true, M_FATAL);
             e = e->next;
         }

     }
 }
 
 void

 push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)

 {

     const char **argv = make_extended_arg_array(p, gc);
     char *opt = print_argv(argv, gc, 0);
     push_option(o, opt, msglevel);

 }
 

 static bool
 push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
                 int msglevel, const char *format, ...)

 {

     va_list arglist;
     char tmp[256] = {0};
     int len;
     va_start(arglist, format);
     len = vsnprintf(tmp, sizeof(tmp), format, arglist);
     va_end(arglist);
     if (len > sizeof(tmp)-1)
     {
         return false;
     }
     push_option_ex(gc, push_list, string_alloc(tmp, gc), true, msglevel);
     return true;

 }
 

 void

 push_reset(struct options *o)

 {

     CLEAR(o->push_list);

 }

 
 void

 push_remove_option(struct options *o, const char *p)

 {

     msg(D_PUSH_DEBUG, "PUSH_REMOVE searching for: '%s'", p);

     /* ifconfig is special, as not part of the push list */
     if (streq(p, "ifconfig"))
     {
         o->push_ifconfig_ipv4_blocked = true;
         return;
     }
 

     /* ifconfig-ipv6 is special, as not part of the push list */
     if (streq( p, "ifconfig-ipv6" ))

     {

         o->push_ifconfig_ipv6_blocked = true;
         return;

     }
 

     if (o && o->push_list.head)

     {

         struct push_entry *e = o->push_list.head;
 
         /* cycle through the push list */
         while (e)
         {
             if (e->enable
                 && strncmp( e->option, p, strlen(p) ) == 0)
             {
                 msg(D_PUSH_DEBUG, "PUSH_REMOVE removing: '%s'", e->option);
                 e->enable = false;
             }
 
             e = e->next;
         }

     }
 }

 #endif /* if P2MP_SERVER */

 #if P2MP_SERVER

 int

 process_incoming_push_request(struct context *c)

 {

     int ret = PUSH_MSG_ERROR;

 
 #ifdef ENABLE_ASYNC_PUSH

     c->c2.push_request_received = true;

 #endif

     if (tls_authentication_status(c->c2.tls_multi, 0) == TLS_AUTHENTICATION_FAILED || c->c2.context_auth == CAS_FAILED)

     {

         const char *client_reason = tls_client_reason(c->c2.tls_multi);
         send_auth_failed(c, client_reason);
         ret = PUSH_MSG_AUTH_FAILURE;

     }

     else if (!c->c2.push_reply_deferred && c->c2.context_auth == CAS_SUCCEEDED)

     {

         time_t now;
 
         openvpn_time(&now);
         if (c->c2.sent_push_reply_expiry > now)
         {
             ret = PUSH_MSG_ALREADY_REPLIED;
         }
         else
         {
             /* per-client push options - peer-id, cipher, ifconfig, ipv6-ifconfig */
             struct push_list push_list;
             struct gc_arena gc = gc_new();
 
             CLEAR(push_list);
             if (prepare_push_reply(c, &gc, &push_list)
                 && send_push_reply(c, &push_list))
             {
                 ret = PUSH_MSG_REQUEST;
                 c->c2.sent_push_reply_expiry = now + 30;
             }
             gc_free(&gc);
         }

     }

     else

     {

         ret = PUSH_MSG_REQUEST_DEFERRED;

     }
 

     return ret;

 }

 #endif /* if P2MP_SERVER */

 static void

 push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)

 {

     char line[OPTION_PARM_SIZE];
     while (buf_parse(buf, ',', line, sizeof(line)))

     {

         /* peer-id might change on restart and this should not trigger reopening tun */

         if (strprefix(line, "peer-id "))

         {

             continue;
         }
         /* tun reopen only needed if cipher change can change tun MTU */
         if (strprefix(line, "cipher ") && !opt->ce.tun_mtu_defined)
         {
             continue;

         }

         md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);

     }
 }
 

 int

 process_incoming_push_msg(struct context *c,
                           const struct buffer *buffer,
                           bool honor_received_options,
                           unsigned int permission_mask,
                           unsigned int *option_types_found)

 {

     int ret = PUSH_MSG_ERROR;
     struct buffer buf = *buffer;

 
 #if P2MP_SERVER

     if (buf_string_compare_advance(&buf, "PUSH_REQUEST"))

     {

         ret = process_incoming_push_request(c);

     }

     else

 #endif
 

     if (honor_received_options && buf_string_compare_advance(&buf, "PUSH_REPLY"))
     {
         const uint8_t ch = buf_read_u8(&buf);
         if (ch == ',')
         {
             struct buffer buf_orig = buf;

             if (!c->c2.pulled_options_digest_init_done)

             {

                 c->c2.pulled_options_state = md_ctx_new();
                 md_ctx_init(c->c2.pulled_options_state, md_kt_get("SHA256"));

                 c->c2.pulled_options_digest_init_done = true;

             }
             if (!c->c2.did_pre_pull_restore)
             {
                 pre_pull_restore(&c->options, &c->c2.gc);
                 c->c2.did_pre_pull_restore = true;
             }
             if (apply_push_options(&c->options,
                                    &buf,
                                    permission_mask,
                                    option_types_found,
                                    c->c2.es))
             {

                 push_update_digest(c->c2.pulled_options_state, &buf_orig,

                                    &c->options);

                 switch (c->options.push_continuation)
                 {
                     case 0:
                     case 1:

                         md_ctx_final(c->c2.pulled_options_state, c->c2.pulled_options_digest.digest);
                         md_ctx_cleanup(c->c2.pulled_options_state);
                         md_ctx_free(c->c2.pulled_options_state);
                         c->c2.pulled_options_state = NULL;

                         c->c2.pulled_options_digest_init_done = false;

                         ret = PUSH_MSG_REPLY;
                         break;
 
                     case 2:
                         ret = PUSH_MSG_CONTINUATION;
                         break;
                 }
             }
         }
         else if (ch == '\0')
         {
             ret = PUSH_MSG_REPLY;
         }
         /* show_settings (&c->options); */
     }
     return ret;

 }
 
 #if P2MP_SERVER

 /*
  * Remove iroutes from the push_list.
  */
 void

 remove_iroutes_from_push_route_list(struct options *o)

 {

     if (o && o->push_list.head && o->iroutes)
     {
         struct gc_arena gc = gc_new();
         struct push_entry *e = o->push_list.head;
 
         /* cycle through the push list */
         while (e)
         {
             char *p[MAX_PARMS];
             bool enable = true;
 
             /* parse the push item */
             CLEAR(p);
             if (e->enable
                 && parse_line(e->option, p, SIZE(p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
             {
                 /* is the push item a route directive? */
                 if (p[0] && !strcmp(p[0], "route") && !p[3])
                 {
                     /* get route parameters */
                     bool status1, status2;
                     const in_addr_t network = getaddr(GETADDR_HOST_ORDER, p[1], 0, &status1, NULL);
                     const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, p[2] ? p[2] : "255.255.255.255", 0, &status2, NULL);
 
                     /* did route parameters parse correctly? */
                     if (status1 && status2)
                     {
                         const struct iroute *ir;
 
                         /* does route match an iroute? */
                         for (ir = o->iroutes; ir != NULL; ir = ir->next)
                         {
                             if (network == ir->network && netmask == netbits_to_netmask(ir->netbits >= 0 ? ir->netbits : 32))
                             {
                                 enable = false;
                                 break;
                             }
                         }
                     }
                 }
 
                 /* should we copy the push item? */
                 e->enable = enable;
                 if (!enable)
                 {
                     msg(D_PUSH, "REMOVE PUSH ROUTE: '%s'", e->option);
                 }
             }
 
             e = e->next;
         }
 
         gc_free(&gc);

     }
 }

 #endif /* if P2MP_SERVER */

 #endif /* if P2MP */