@@ -240,6 +240,14 @@ argv_init (struct argv *a)

   a->argv = NULL;

 }

+struct argv

+argv_new (void)

+{

+  struct argv ret;

+  argv_init (&ret);

+  return ret;

+}

+

 void

 argv_reset (struct argv *a)

 {

@@ -266,6 +274,23 @@ argv_argc (const char *format)

   return argc;

 }

+struct argv

+argv_insert_head (const struct argv *a, const char *head)

+{

+  struct argv r;

+  size_t i;

+

+  r.argc = (a ? a->argc : 0) + 1;

+  ALLOC_ARRAY_CLEAR (r.argv, char *, r.argc + 1);

+  r.argv[0] = string_alloc (head, NULL);

+  if (a)

+    {

+      for (i = 0; i < a->argc; ++i)

+	r.argv[i+1] = string_alloc (a->argv[i], NULL);

+    }

+  return r;

+}

+

 char *

 argv_term (const char **f)

 {

@@ -324,6 +349,22 @@ argv_str (const struct argv *a, struct gc_arena *gc, const unsigned int flags)

 }

 void

+argv_msg (const int msglev, const struct argv *a)

+{

+  struct gc_arena gc = gc_new ();

+  msg (msglev, "%s", argv_str (a, &gc, 0));

+  gc_free (&gc);

+}

+

+void

+argv_msg_prefix (const int msglev, const struct argv *a, const char *prefix)

+{

+  struct gc_arena gc = gc_new ();

+  msg (msglev, "%s: %s", prefix, argv_str (a, &gc, 0));

+  gc_free (&gc);

+}

+

+void

 argv_printf (struct argv *a, const char *format, ...)

 {

   va_list arglist;

@@ -373,7 +414,10 @@ argv_printf_arglist (struct argv *a, const char *format, const unsigned int flag

 	{

 	  if (!strcmp (term, "%s"))

 	    {

-	      a->argv[argc++] = string_alloc (va_arg (arglist, char *), NULL);

+	      char *s = va_arg (arglist, char *);

+	      if (!s)

+		s = "";

+	      a->argv[argc++] = string_alloc (s, NULL);

 	    }

 	  else if (!strcmp (term, "%d"))

 	    {

@@ -387,6 +431,41 @@ argv_printf_arglist (struct argv *a, const char *format, const unsigned int flag

 	      openvpn_snprintf (numstr, sizeof (numstr), "%u", va_arg (arglist, unsigned int));

 	      a->argv[argc++] = string_alloc (numstr, NULL);

 	    }

+	  else if (!strcmp (term, "%s/%d"))

+	    {

+	      char numstr[64];

+	      char *s = va_arg (arglist, char *);

+

+	      if (!s)

+		s = "";

+

+	      openvpn_snprintf (numstr, sizeof (numstr), "%d", va_arg (arglist, int));

+

+	      {

+		const size_t len = strlen(s) + strlen(numstr) + 2;

+		char *combined = (char *) malloc (len);

+		check_malloc_return (combined);

+

+		strcpy (combined, s);

+		strcat (combined, "/");

+		strcat (combined, numstr);

+		a->argv[argc++] = combined;

+	      }

+	    }

+	  else if (!strcmp (term, "%s%s"))

+	    {

+	      char *s1 = va_arg (arglist, char *);

+	      char *s2 = va_arg (arglist, char *);

+	      char *combined;

+

+	      if (!s1) s1 = "";

+	      if (!s2) s2 = "";

+	      combined = (char *) malloc (strlen(s1) + strlen(s2) + 1);

+	      check_malloc_return (combined);

+	      strcpy (combined, s1);

+	      strcat (combined, s2);

+	      a->argv[argc++] = combined;

+	    }

 	  else

 	    ASSERT (0);

 	  free (term);

@@ -399,57 +478,6 @@ argv_printf_arglist (struct argv *a, const char *format, const unsigned int flag

   ASSERT (argc == a->argc);

 }

-#ifdef ARGV_TEST

-void

-argv_test (void)

-{

-  struct gc_arena gc = gc_new ();

-  char line[512];

-  const char *s;

-

-  struct argv a;

-  argv_init (&a);

-  argv_printf (&a, "this is a %s test of int %d unsigned %u", "FOO", -69, 42);

-  s = argv_str (&a, &gc, PA_BRACKET);

-  argv_reset (&a);

-  printf ("%s\n", s);

-

-  argv_init (&a);

-  argv_printf (&a, "foo bar %d", 99);

-  s = argv_str (&a, &gc, PA_BRACKET);

-  argv_reset (&a);

-  printf ("%s\n", s);

-

-  argv_init (&a);

-  s = argv_str (&a, &gc, PA_BRACKET);

-  argv_reset (&a);

-  printf ("%s\n", s);

-

-  argv_init (&a);

-  argv_printf (&a, "foo bar %d", 99);

-  argv_printf_cat (&a, "bar %d foo", 42);

-  argv_printf_cat (&a, "cool %s %d u", "frood", 4);

-  s = argv_str (&a, &gc, PA_BRACKET);

-  argv_reset (&a);

-  printf ("%s\n", s);

-

-  while (fgets (line, sizeof(line), stdin) != NULL)

-    {

-      char *term;

-      const char *f = line;

-      int i = 0;

-

-      while ((term = argv_term (&f)) != NULL) 

-	{

-	  printf ("[%d] '%s'\n", i, term);

-	  ++i;

-	  free (term);

-	}

-    }

-  gc_free (&gc);

-}

-#endif

-

 /*

  * write a string to the end of a buffer that was

  * truncated by buf_printf

@@ -234,10 +234,14 @@ int openvpn_snprintf(char *str, size_t size, const char *format, ...)

  * to execve.

  */

 void argv_init (struct argv *a);

+struct argv argv_new (void);

 void argv_reset (struct argv *a);

 size_t argv_argc (const char *format);

 char *argv_term (const char **f);

 const char *argv_str (const struct argv *a, struct gc_arena *gc, const unsigned int flags);

+struct argv argv_insert_head (const struct argv *a, const char *head);

+void argv_msg (const int msglev, const struct argv *a);

+void argv_msg_prefix (const int msglev, const struct argv *a, const char *prefix);

 #define APA_CAT (1<<0) /* concatentate onto existing struct argv list */

 void argv_printf_arglist (struct argv *a, const char *format, const unsigned int flags, va_list arglist);

@@ -462,7 +462,8 @@ AC_CHECK_FUNCS(daemon chroot getpwnam setuid nice system getpid dup dup2 dnl

 	       getpass strerror syslog openlog mlockall getgrnam setgid dnl

 	       setgroups stat flock readv writev setsockopt getsockopt dnl

 	       setsid chdir putenv getpeername unlink dnl

-	       poll chsize ftruncate sendmsg recvmsg getsockname)

+	       poll chsize ftruncate sendmsg recvmsg getsockname dnl

+	       execve)

 AC_CACHE_SAVE

 if test "${WIN32}" = "yes"; then

@@ -399,6 +399,24 @@

    obj:/lib/ld-2.5.so

    obj:/lib/ld-2.5.so

    obj:/lib/ld-2.5.so

+   obj:/lib/libc-2.5.so

+   obj:/lib/libdl-2.5.so

+   obj:/lib/ld-2.5.so

+   obj:/lib/libdl-2.5.so

+   fun:dlsym

+   fun:libdl_resolve_symbol

+   fun:plugin_list_init

+   fun:init_plugins

+   fun:main

+}

+

+{

+   <insert a suppression name here>

+   Memcheck:Cond

+   obj:/lib/ld-2.5.so

+   obj:/lib/ld-2.5.so

+   obj:/lib/ld-2.5.so

+   obj:/lib/ld-2.5.so

    obj:/lib/libdl-2.5.so

    obj:/lib/ld-2.5.so

    obj:/lib/libdl-2.5.so

@@ -370,7 +370,7 @@ init_port_share (struct context *c)

 bool

 init_static (void)

 {

-  configure_path ();

+  /* configure_path (); */

 #if defined(USE_CRYPTO) && defined(DMALLOC)

   openssl_dmalloc_init ();

@@ -921,8 +921,11 @@ do_route (const struct options *options,

   if (options->route_script)

     {

+      struct argv argv = argv_new ();

       setenv_str (es, "script_type", "route-up");

-      system_check (options->route_script, es, S_SCRIPT, "Route script failed");

+      argv_printf (&argv, "%s", options->route_script);

+      openvpn_execve_check (&argv, es, S_SCRIPT, "Route script failed");

+      argv_reset (&argv);

     }

 #ifdef WIN32

@@ -9,7 +9,7 @@

 int set_lladdr(const char *ifname, const char *lladdr,

 		const struct env_set *es)

 {

-  char cmd[256];

+  struct argv argv = argv_new ();

   int r;

   if (!ifname || !lladdr)

@@ -17,37 +17,45 @@ int set_lladdr(const char *ifname, const char *lladdr,

 #if defined(TARGET_LINUX)

 #ifdef CONFIG_FEATURE_IPROUTE

-  openvpn_snprintf (cmd, sizeof (cmd),

+  argv_printf (&argv,

 		    "%s link set addr %s dev %s",

 		    iproute_path, lladdr, ifname);

 #else

-  openvpn_snprintf (cmd, sizeof (cmd),

-		    IFCONFIG_PATH " %s hw ether %s",

+  argv_printf (&argv,

+		    "%s %s hw ether %s",

+		    IFCONFIG_PATH,

 		    ifname, lladdr);

 #endif

 #elif defined(TARGET_SOLARIS)

-  openvpn_snprintf (cmd, sizeof (cmd),

-		    IFCONFIG_PATH " %s ether %s",

+  argv_printf (&argv,

+		    "%s %s ether %s",

+		    IFCONFIG_PATH,

 		    ifname, lladdr);

 #elif defined(TARGET_OPENBSD)

-  openvpn_snprintf (cmd, sizeof (cmd),

-		    IFCONFIG_PATH " %s lladdr %s",

+  argv_printf (&argv,

+		    "%s %s lladdr %s",

+		    IFCONFIG_PATH,

 		    ifname, lladdr);

 #elif defined(TARGET_DARWIN)

-  openvpn_snprintf (cmd, sizeof (cmd),

-		    IFCONFIG_PATH " %s lladdr %s",

+  argv_printf (&argv,

+		    "%s %s lladdr %s",

+		    IFCONFIG_PATH,

 		    ifname, lladdr);

 #elif defined(TARGET_FREEBSD)

-  openvpn_snprintf (cmd, sizeof (cmd),

-		    IFCONFIG_PATH " %s ether %s",

+  argv_printf (&argv,

+		    "%s %s ether %s",

+		    IFCONFIG_PATH,

 		    ifname, lladdr);

 #else

       msg (M_WARN, "Sorry, but I don't know how to configure link layer addresses on this operating system.");

       return -1;

 #endif

-  r = system_check (cmd, es, M_WARN, "ERROR: Unable to set link layer address.");

+  argv_msg (M_INFO, &argv);

+  r = openvpn_execve_check (&argv, es, M_WARN, "ERROR: Unable to set link layer address.");

   if (r)

     msg (M_INFO, "TUN/TAP link layer address set to %s", lladdr);

+

+  argv_reset (&argv);

   return r;

 }

@@ -43,6 +43,9 @@

 const char *iproute_path = IPROUTE_PATH;

 #endif

+/* contains an SSEC_x value defined in misc.h */

+int script_security = SSEC_BUILT_IN; /* GLOBAL */

+

 /* Redefine the top level directory of the filesystem

    to restrict access to files for security */

 void

@@ -196,38 +199,36 @@ run_up_down (const char *command,

   if (plugin_defined (plugins, plugin_type))

     {

-      struct buffer cmd = alloc_buf_gc (256, &gc);

-

+      struct argv argv = argv_new ();

       ASSERT (arg);

-

-      buf_printf (&cmd,

-		  "\"%s\" %d %d %s %s %s",

-		  arg,

-		  tun_mtu, link_mtu,

-		  ifconfig_local, ifconfig_remote,

-		  context);

-

-      if (plugin_call (plugins, plugin_type, BSTR (&cmd), NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS)

+      argv_printf (&argv,

+		   "%s %d %d %s %s %s",

+		   arg,

+		   tun_mtu, link_mtu,

+		   ifconfig_local, ifconfig_remote,

+		   context);

+

+      if (plugin_call (plugins, plugin_type, &argv, NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS)

 	msg (M_FATAL, "ERROR: up/down plugin call failed");

+

+      argv_reset (&argv);

     }

   if (command)

     {

-      struct buffer cmd = alloc_buf_gc (256, &gc);

-

+      struct argv argv = argv_new ();

       ASSERT (arg);

-

       setenv_str (es, "script_type", script_type);

-

-      buf_printf (&cmd,

-		  "%s \"%s\" %d %d %s %s %s",

+      argv_printf (&argv,

+		  "%s %s %d %d %s %s %s",

 		  command,

 		  arg,

 		  tun_mtu, link_mtu,

 		  ifconfig_local, ifconfig_remote,

 		  context);

-      msg (M_INFO, "%s", BSTR (&cmd));

-      system_check (BSTR (&cmd), es, S_SCRIPT|S_FATAL, "script failed");

+      argv_msg (M_INFO, &argv);

+      openvpn_execve_check (&argv, es, S_SCRIPT|S_FATAL, "script failed");

+      argv_reset (&argv);

     }

   gc_free (&gc);

@@ -375,59 +376,6 @@ save_inetd_socket_descriptor (void)

 }

 /*

- * Wrapper around the system() call.

- */

-int

-openvpn_system (const char *command, const struct env_set *es, unsigned int flags)

-{

-#ifdef HAVE_SYSTEM

-  int ret;

-

-  /*

-   * We need to bracket this code by mutex because system() doesn't

-   * accept an environment list, so we have to use the process-wide

-   * list which is shared between all threads.

-   */

-  mutex_lock_static (L_SYSTEM);

-  perf_push (PERF_SCRIPT);

-

-  /*

-   * add env_set to environment.

-   */

-  if (flags & S_SCRIPT)

-    env_set_add_to_environment (es);

-

-

-  /* debugging */

-  dmsg (D_SCRIPT, "SYSTEM[%u] '%s'", flags, command);

-  if (flags & S_SCRIPT)

-    env_set_print (D_SCRIPT, es);

-

-  /*

-   * execute the command

-   */

-  ret = system (command);

-

-  /* debugging */

-  dmsg (D_SCRIPT, "SYSTEM return=%u", ret);

-

-  /*

-   * remove env_set from environment

-   */

-  if (flags & S_SCRIPT)

-    env_set_remove_from_environment (es);

-

-  perf_pop ();

-  mutex_unlock_static (L_SYSTEM);

-  return ret;

-

-#else

-  msg (M_FATAL, "Sorry but I can't execute the shell command '%s' because this operating system doesn't appear to support the system() call", command);

-  return -1; /* NOTREACHED */

-#endif

-}

-

-/*

  * Warn if a given file is group/others accessible.

  */

 void

@@ -489,35 +437,35 @@ system_error_message (int stat, struct gc_arena *gc)

   struct buffer out = alloc_buf_gc (256, gc);

 #ifdef WIN32

   if (stat == -1)

-    buf_printf (&out, "shell command did not execute -- ");

-  buf_printf (&out, "system() returned error code %d", stat);

+    buf_printf (&out, "external program did not execute -- ");

+  buf_printf (&out, "returned error code %d", stat);

 #else

   if (stat == -1)

-    buf_printf (&out, "shell command fork failed");

+    buf_printf (&out, "external program fork failed");

   else if (!WIFEXITED (stat))

-    buf_printf (&out, "shell command did not exit normally");

+    buf_printf (&out, "external program did not exit normally");

   else

     {

       const int cmd_ret = WEXITSTATUS (stat);

       if (!cmd_ret)

-	buf_printf (&out, "shell command exited normally");

+	buf_printf (&out, "external program exited normally");

       else if (cmd_ret == 127)

-	buf_printf (&out, "could not execute shell command");

+	buf_printf (&out, "could not execute external program");

       else

-	buf_printf (&out, "shell command exited with error status: %d", cmd_ret);

+	buf_printf (&out, "external program exited with error status: %d", cmd_ret);

     }

 #endif

   return (const char *)out.data;

 }

 /*

- * Run system(), exiting on error.

+ * Wrapper around openvpn_execve

  */

 bool

-system_check (const char *command, const struct env_set *es, unsigned int flags, const char *error_message)

+openvpn_execve_check (const struct argv *a, const struct env_set *es, const unsigned int flags, const char *error_message)

 {

   struct gc_arena gc = gc_new ();

-  const int stat = openvpn_system (command, es, flags);

+  const int stat = openvpn_execve (a, es, flags);

   int ret = false;

   if (system_ok (stat))

@@ -533,6 +481,69 @@ system_check (const char *command, const struct env_set *es, unsigned int flags,

   return ret;

 }

+bool

+openvpn_execve_allowed (const unsigned int flags)

+{

+  if (flags & S_SCRIPT)

+    return script_security >= SSEC_SCRIPTS;

+  else

+    return script_security >= SSEC_BUILT_IN;

+}

+

+#ifndef WIN32

+/*

+ * Run execve() inside a fork().  Designed to replicate the semantics of system() but

+ * in a safer way that doesn't require the invocation of a shell or the risks

+ * assocated with formatting and parsing a command line.

+ */

+int

+openvpn_execve (const struct argv *a, const struct env_set *es, const unsigned int flags)

+{

+  struct gc_arena gc = gc_new ();

+  int ret = -1;

+

+  if (a && a->argv[0])

+    {

+#if defined(ENABLE_EXECVE)

+      if (openvpn_execve_allowed (flags))

+	{

+	  const char *cmd = a->argv[0];

+	  char *const *argv = a->argv;

+	  char *const *envp = (char *const *)make_env_array (es, true, &gc);

+	  pid_t pid;

+

+	  pid = fork ();

+	  if (pid == (pid_t)0) /* child side */

+	    {

+	      execve (cmd, argv, envp);

+	      exit (127);

+	    }

+	  else if (pid < (pid_t)0) /* fork failed */

+	    ;

+	  else /* parent side */

+	    {

+	      if (waitpid (pid, &ret, 0) != pid)

+		ret = -1;

+	    }

+	}

+      else

+	{

+	  msg (M_WARN, "openvpn_execve: external program may not be called due to setting of --script-security level");

+	}

+#else

+      msg (M_WARN, "openvpn_execve: execve function not available");

+#endif

+    }

+  else

+    {

+      msg (M_WARN, "openvpn_execve: called with empty argv");

+    }

+

+  gc_free (&gc);

+  return ret;

+}

+#endif

+

 /*

  * Initialize random number seed.  random() is only used

  * when "weak" random numbers are acceptable.

@@ -1479,11 +1490,23 @@ safe_print (const char *str, struct gc_arena *gc)

   return string_mod_const (str, CC_PRINT, CC_CRLF, '.', gc);

 }

+static bool

+is_password_env_var (const char *str)

+{

+  return (strncmp (str, "password", 8) == 0);

+}

+

+bool

+env_allowed (const char *str)

+{

+  return (script_security >= SSEC_PW_ENV || !is_password_env_var (str));

+}

+

 bool

 env_safe_to_print (const char *str)

 {

 #ifndef UNSAFE_DEBUG

-  if (strncmp (str, "password", 8) == 0)

+  if (is_password_env_var (str))

     return false;

 #endif

   return true;

@@ -1492,7 +1515,9 @@ env_safe_to_print (const char *str)

 /* Make arrays of strings */

 const char **

-make_env_array (const struct env_set *es, struct gc_arena *gc)

+make_env_array (const struct env_set *es,

+		const bool check_allowed,

+		struct gc_arena *gc)

 {

   char **ret = NULL;

   struct env_item *e = NULL;

@@ -1511,12 +1536,14 @@ make_env_array (const struct env_set *es, struct gc_arena *gc)

   /* fill return array */

   if (es)

     {

-      e = es->list;

-      for (i = 0; i < n; ++i)

+      i = 0;

+      for (e = es->list; e != NULL; e = e->next)

 	{

-	  ASSERT (e);

-	  ret[i] = e->string;

-	  e = e->next;

+	  if (!check_allowed || env_allowed (e->string))

+	    {

+	      ASSERT (i < n);

+	      ret[i++] = e->string;

+	    }

 	}

     }

@@ -1631,6 +1658,7 @@ openvpn_sleep (const int n)

   sleep (n);

 }

+#if 0

 /*

  * Configure PATH.  On Windows, sometimes PATH is not set correctly

  * by default.

@@ -1672,3 +1700,72 @@ configure_path (void)

     }

 #endif

 }

+#endif

+

+#ifdef ARGV_TEST

+void

+argv_test (void)

+{

+  struct gc_arena gc = gc_new ();

+  char line[512];

+  const char *s;

+

+  struct argv a;

+  argv_init (&a);

+

+#ifdef WIN32

+  argv_printf (&a, "%s foo bar %s", "c:\\src\\test\\jyargs.exe", "foo bar");

+  //argv_printf (&a, "%s %s %s", "c:\\src\\test files\\batargs.bat", "foo", "bar");  

+#else

+  argv_printf (&a, "./myechox foo bar");

+#endif

+

+  argv_msg_prefix (M_INFO, &a, "ARGV");

+  openvpn_execve_check (&a, NULL, 0, "command failed");

+

+  argv_printf (&a, "this is a %s test of int %d unsigned %u", "FOO", -69, 42);

+  s = argv_str (&a, &gc, PA_BRACKET);

+  printf ("%s\n", s);

+

+  {

+    struct argv b = argv_insert_head (&a, "MARK");

+    s = argv_str (&b, &gc, PA_BRACKET);

+    argv_reset (&b);

+    printf ("%s\n", s);

+  }

+

+  argv_printf (&a, "foo bar %d", 99);

+  s = argv_str (&a, &gc, PA_BRACKET);

+  argv_reset (&a);

+  printf ("%s\n", s);

+

+  s = argv_str (&a, &gc, PA_BRACKET);

+  argv_reset (&a);

+  printf ("%s\n", s);

+

+  argv_printf (&a, "foo bar %d", 99);

+  argv_printf_cat (&a, "bar %d foo", 42);

+  argv_printf_cat (&a, "cool %s %d u %s/%d end", "frood", 4, "hello", 7);

+  s = argv_str (&a, &gc, PA_BRACKET);

+  printf ("%s\n", s);

+

+#if 0

+  while (fgets (line, sizeof(line), stdin) != NULL)

+    {

+      char *term;

+      const char *f = line;

+      int i = 0;

+

+      while ((term = argv_term (&f)) != NULL) 

+	{

+	  printf ("[%d] '%s'\n", i, term);

+	  ++i;

+	  free (term);

+	}

+    }

+#endif

+

+  argv_reset (&a);

+  gc_free (&gc);

+}

+#endif

@@ -117,17 +117,15 @@ void warn_if_group_others_accessible(const char* filename);

 #define S_SCRIPT (1<<0)

 #define S_FATAL  (1<<1)

-/* wrapper around the system() call. */

-int openvpn_system (const char *command, const struct env_set *es, unsigned int flags);

-

-/* interpret the status code returned by system() */

+/* interpret the status code returned by system()/execve() */

 bool system_ok(int);

 int system_executed (int stat);

 const char *system_error_message (int, struct gc_arena *gc);

-/* run system() with error check, return true if success,

-   false if error, exit if error and fatal==true */

-bool system_check (const char *command, const struct env_set *es, unsigned int flags, const char *error_message);

+/* wrapper around the execve() call */

+int openvpn_execve (const struct argv *a, const struct env_set *es, const unsigned int flags);

+bool openvpn_execve_check (const struct argv *a, const struct env_set *es, const unsigned int flags, const char *error_message);

+bool openvpn_execve_allowed (const unsigned int flags);

 #ifdef HAVE_STRERROR

 /* a thread-safe version of strerror */

@@ -184,7 +182,10 @@ void env_set_remove_from_environment (const struct env_set *es);

 /* Make arrays of strings */

-const char **make_env_array (const struct env_set *es, struct gc_arena *gc);

+const char **make_env_array (const struct env_set *es,

+			     const bool check_allowed,

+			     struct gc_arena *gc);

+

 const char **make_arg_array (const char *first, const char *parms, struct gc_arena *gc);

 const char **make_extended_arg_array (char **p, struct gc_arena *gc);

@@ -271,6 +272,9 @@ const char *safe_print (const char *str, struct gc_arena *gc);

 /* returns true if environmental variable safe to print to log */

 bool env_safe_to_print (const char *str);

+/* returns true if environmental variable may be passed to an external program */

+bool env_allowed (const char *str);

+

 /*

  * A sleep function that services the management layer for n

  * seconds rather than doing nothing.

@@ -290,4 +294,10 @@ void get_user_pass_auto_userid (struct user_pass *up, const char *tag);

 extern const char *iproute_path;

 #endif

+#define SSEC_NONE      0 /* strictly no calling of external programs */

+#define SSEC_BUILT_IN  1 /* only call built-in programs such as ifconfig, route, netsh, etc.*/

+#define SSEC_SCRIPTS   2 /* allow calling of built-in programs and user-defined scripts */

+#define SSEC_PW_ENV    3 /* allow calling of built-in programs and user-defined scripts that may receive a password as an environmental variable */

+extern int script_security; /* GLOBAL */

+

 #endif

@@ -85,36 +85,33 @@ learn_address_script (const struct multi_context *m,

   if (plugin_defined (plugins, OPENVPN_PLUGIN_LEARN_ADDRESS))

     {

-      struct buffer cmd = alloc_buf_gc (256, &gc);

-

-      buf_printf (&cmd, "\"%s\" \"%s\"",

-		  op,

-		  mroute_addr_print (addr, &gc));

+      struct argv argv = argv_new ();

+      argv_printf (&argv, "%s %s",

+		   op,

+		   mroute_addr_print (addr, &gc));

       if (mi)

-	buf_printf (&cmd, " \"%s\"", tls_common_name (mi->context.c2.tls_multi, false));

-

-      if (plugin_call (plugins, OPENVPN_PLUGIN_LEARN_ADDRESS, BSTR (&cmd), NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS)

+	argv_printf_cat (&argv, "%s", tls_common_name (mi->context.c2.tls_multi, false));

+      if (plugin_call (plugins, OPENVPN_PLUGIN_LEARN_ADDRESS, &argv, NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS)

 	{

 	  msg (M_WARN, "WARNING: learn-address plugin call failed");

 	  ret = false;

 	}

+      argv_reset (&argv);

     }

   if (m->top.options.learn_address_script)

     {

-      struct buffer cmd = alloc_buf_gc (256, &gc);

-

+      struct argv argv = argv_new ();

       setenv_str (es, "script_type", "learn-address");

-

-      buf_printf (&cmd, "%s \"%s\" \"%s\"",

-		  m->top.options.learn_address_script,

-		  op,

-		  mroute_addr_print (addr, &gc));

+      argv_printf (&argv, "%s %s %s",

+		   m->top.options.learn_address_script,

+		   op,

+		   mroute_addr_print (addr, &gc));

       if (mi)

-	buf_printf (&cmd, " \"%s\"", tls_common_name (mi->context.c2.tls_multi, false));

-

-      if (!system_check (BSTR (&cmd), es, S_SCRIPT, "WARNING: learn-address command failed"))

+	argv_printf_cat (&argv, "%s", tls_common_name (mi->context.c2.tls_multi, false));

+      if (!openvpn_execve_check (&argv, es, S_SCRIPT, "WARNING: learn-address command failed"))

 	ret = false;

+      argv_reset (&argv);

     }

   gc_free (&gc);

@@ -474,16 +471,11 @@ multi_client_disconnect_script (struct multi_context *m,

       if (mi->context.options.client_disconnect_script)

 	{

-	  struct gc_arena gc = gc_new ();

-	  struct buffer cmd = alloc_buf_gc (256, &gc);

-

+	  struct argv argv = argv_new ();

 	  setenv_str (mi->context.c2.es, "script_type", "client-disconnect");

-	  

-	  buf_printf (&cmd, "%s", mi->context.options.client_disconnect_script);

-

-	  system_check (BSTR (&cmd), mi->context.c2.es, S_SCRIPT, "client-disconnect command failed");

-	  

-	  gc_free (&gc);

+	  argv_printf (&argv, "%s", mi->context.options.client_disconnect_script);

+	  openvpn_execve_check (&argv, mi->context.c2.es, S_SCRIPT, "client-disconnect command failed");

+	  argv_reset (&argv);

 	}

 #ifdef MANAGEMENT_DEF_AUTH

       if (management)

@@ -1523,11 +1515,11 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

       /* deprecated callback, use a file for passing back return info */

       if (plugin_defined (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT))

 	{

+	  struct argv argv = argv_new ();

 	  const char *dc_file = create_temp_filename (mi->context.options.tmp_dir, "cc", &gc);

-

+	  argv_printf (&argv, "%s", dc_file);

 	  delete_file (dc_file);

-

-	  if (plugin_call (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, dc_file, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS)

+	  if (plugin_call (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, &argv, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS)

 	    {

 	      msg (M_WARN, "WARNING: client-connect plugin call failed");

 	      cc_succeeded = false;

@@ -1537,6 +1529,7 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

 	      multi_client_connect_post (m, mi, dc_file, option_permissions_mask, &option_types_found);

 	      ++cc_succeeded_count;

 	    }

+	  argv_reset (&argv);

 	}

       /* V2 callback, use a plugin_return struct for passing back return info */

@@ -1566,7 +1559,7 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

        */

       if (mi->context.options.client_connect_script && cc_succeeded)

 	{

-	  struct buffer cmd = alloc_buf_gc (256, &gc);

+	  struct argv argv = argv_new ();

 	  const char *dc_file = NULL;

 	  setenv_str (mi->context.c2.es, "script_type", "client-connect");

@@ -1575,17 +1568,19 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

 	  delete_file (dc_file);

-	  buf_printf (&cmd, "%s %s",

-		      mi->context.options.client_connect_script,

-		      dc_file);

+	  argv_printf (&argv, "%s %s",

+		       mi->context.options.client_connect_script,

+		       dc_file);

-	  if (system_check (BSTR (&cmd), mi->context.c2.es, S_SCRIPT, "client-connect command failed"))

+	  if (openvpn_execve_check (&argv, mi->context.c2.es, S_SCRIPT, "client-connect command failed"))

 	    {

 	      multi_client_connect_post (m, mi, dc_file, option_permissions_mask, &option_types_found);

 	      ++cc_succeeded_count;

 	    }

 	  else

 	    cc_succeeded = false;

+