new file mode 100644

@@ -0,0 +1 @@

+James Yonan <james@openvpn.net>      james <james@e7ae566f-a301-0410-adde-c780ea21d3b5>

new file mode 100644

@@ -0,0 +1 @@

+james = James Yonan <james@openvpn.net>

@@ -224,8 +224,8 @@ acx_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -m

 # pthread: Linux, etcetera

 # --thread-safe: KAI C++

-case "$target" in

-        *solaris*)

+case "$host" in

+        *-*-solaris*)

         # On Solaris (at least, for some versions), libc contains stubbed

         # (non-functional) versions of the pthreads routines, so link-based

@@ -321,9 +321,9 @@ if test "x$acx_pthread_ok" = xyes; then

         AC_MSG_CHECKING([if more special flags are required for pthreads])

         flag=no

-        case "$target" in

-                *-aix* | *-freebsd*)               flag="-D_THREAD_SAFE";;

-                *solaris* | alpha*-osf* | *linux*) flag="-D_REENTRANT";;

+        case "$host" in

+                *-*-aix* | *-freebsd*)               flag="-D_THREAD_SAFE";;

+                *-*-solaris* | alpha*-osf* | *linux*) flag="-D_REENTRANT";;

         esac

         AC_MSG_RESULT(${flag})

         if test "x$flag" != xno; then

@@ -32,7 +32,6 @@ AC_CONFIG_SRCDIR(syshead.h)

 dnl Guess host type.

 AC_CANONICAL_HOST

-AC_CANONICAL_SYSTEM

 AM_INIT_AUTOMAKE(openvpn, [$PACKAGE_VERSION])

 AC_ARG_WITH(cygwin-native,

@@ -48,7 +47,7 @@ case "${host}" in

 		WIN32="yes"

 		cross_compiling="yes"

 	;;

-	*-cygwin*)

+	*-*-cygwin*)

 		AC_MSG_CHECKING([cygwin mode to use])

 		if test "${CYGWIN_NATIVE}" = "yes"; then

 			AC_MSG_RESULT([Using native win32])

@@ -275,38 +274,38 @@ AC_ARG_WITH(mem-check,

 dnl fix search path, to allow compilers to find syshead.h

 CPPFLAGS="$CPPFLAGS -I${srcdir}"

-dnl check target OS

-openvpn_target=$target

-if test $target_alias; then

-  openvpn_target=$target_alias

+dnl check host OS

+openvpn_host=$host

+if test $host_alias; then

+  openvpn_host=$host_alias

 fi

-AC_DEFINE_UNQUOTED(TARGET_ALIAS, "$openvpn_target", [A string representing our target])

-case "$target" in

-*linux*)

+AC_DEFINE_UNQUOTED(TARGET_ALIAS, "$openvpn_host", [A string representing our host])

+case "$host" in

+*-*-linux*)

 	AC_DEFINE(TARGET_LINUX, 1, [Are we running on Linux?])

 	dnl RH9 SSL headers workaround

         if test -z $CS_HDR_DIR && test "$CRYPTO" = "yes"; then

            CPPFLAGS="$CPPFLAGS $(pkg-config --cflags openssl 2>/dev/null)"

         fi

 	;;

-*solaris*)

+*-*-solaris*)

 	AC_DEFINE(TARGET_SOLARIS, 1, [Are we running on Solaris?])

 	;;

-*openbsd*)

+*-*-openbsd*)

 	AC_DEFINE(TARGET_OPENBSD, 1, [Are we running on OpenBSD?])

 	;;

-*freebsd*)

+*-*-freebsd*)

 	AC_DEFINE(TARGET_FREEBSD, 1, [Are we running on FreeBSD?])

 	;;

-*netbsd*)

+*-*-netbsd*)

 	AC_DEFINE(TARGET_NETBSD, 1, [Are we running NetBSD?])

 	;;

-*darwin*)

+*-*-darwin*)

 	dnl some Mac OS X tendering (we use vararg macros...)

 	AC_DEFINE(TARGET_DARWIN, 1, [Are we running on Mac OS X?])

 	CPPFLAGS="$CPPFLAGS -no-cpp-precomp"

 	;;

-*mingw*)

+*-mingw*)

 	AC_DEFINE(TARGET_WIN32, 1, [Are we running WIN32?])

 	OPENVPN_ADD_LIBS(-lgdi32)

 	OPENVPN_ADD_LIBS(-lws2_32)

@@ -315,7 +314,7 @@ case "$target" in

 	OPENVPN_ADD_LIBS(-liphlpapi)

 	OPENVPN_ADD_LIBS(-lwinmm)

 	;;

-*dragonfly*)

+*-*-dragonfly*)

 	AC_DEFINE(TARGET_DRAGONFLY, 1, [Are we running on DragonFlyBSD?])

 	;;

@@ -574,7 +573,7 @@ if test "$PTHREAD" = "yes"; then

   AC_MSG_RESULT([********* WARNING: pthread support is experimental for OpenVPN 2.0])

   ACX_PTHREAD(

         [

-	    case "$target" in

+	    case "$host" in

 	    *openbsd*)

 		AC_MSG_RESULT([WARNING: pthread support on OpenBSD is unstable!])

 		CFLAGS="$CFLAGS -pthread"

new file mode 100644

@@ -0,0 +1,111 @@

+#!/bin/sh

+

+# Sample script to perform OCSP queries with OpenSSL

+# given a certificate serial number.

+

+# If you run your own CA, you can set up a very simple

+# OCSP server using the -port option to "openssl ocsp".

+

+# Full documentation and examples:

+# http://www.openssl.org/docs/apps/ocsp.html

+

+

+# Edit the following values to suit your needs

+

+# OCSP responder URL (mandatory)

+# YOU MUST UNCOMMENT ONE OF THESE AND SET IT TO A VALID SERVER

+#ocsp_url="http://ocsp.example.com/"

+#ocsp_url="https://ocsp.secure.example.com/"

+

+# Path to issuer certificate (mandatory)

+# YOU MUST SET THIS TO THE PATH TO THE CA CERTIFICATE

+issuer="/path/to/CAcert.crt"

+

+# use a nonce in the query, set to "-no_nonce" to not use it

+nonce="-nonce"

+

+# Verify the response

+# YOU MUST SET THIS TO THE PATH TO THE RESPONSE VERIFICATION CERT

+verify="/path/to/CAcert.crt"

+

+# Depth in the certificate chain where the cert to verify is.

+# Set to -1 to run the verification at every level (NOTE that

+# in that case you need a more complex script as the various

+# parameters for the query will likely be different at each level)

+# "0" is the usual value here, where the client certificate is

+check_depth=0

+

+cur_depth=$1     # this is the *CURRENT* depth

+common_name=$2   # CN in case you need it

+

+# minimal sanity checks

+

+err=0

+if [ -z "$issuer" ] || [ ! -e "$issuer" ]; then

+  echo "Error: issuer certificate undefined or not found!" >&2

+  err=1

+fi

+

+if [ -z "$verify" ] || [ ! -e "$verify" ]; then

+  echo "Error: verification certificate undefined or not found!" >&2

+  err=1

+fi

+

+if [ -z "$ocsp_url" ]; then

+  echo "Error: OCSP server URL not defined!" >&2

+  err=1

+fi

+

+if [ $err -eq 1 ]; then

+  echo "Did you forget to customize the variables in the script?" >&2

+  exit 1

+fi

+

+# begin

+if [ $check_depth -eq -1 ] || [ $cur_depth -eq $check_depth ]; then

+

+  eval serial="\$tls_serial_${cur_depth}"

+

+  # To successfully complete, the following must happen:

+  #

+  # - The serial number must not be empty

+  # - The exit status of "openssl ocsp" must be zero

+  # - The output of the above command must contain the line

+  #   "0x${serial}: good"

+  #

+  # Everything else fails with exit status 1.

+

+  if [ -n "$serial" ]; then

+

+    # This is only an example; you are encouraged to run this command (without

+    # redirections) manually against your or your CA's OCSP server to see how

+    # it responds, and adapt accordingly.

+    # Sample output that is assumed here:

+    #

+    # Response verify OK

+    # 0x428740A5: good

+    #      This Update: Apr 24 19:38:49 2010 GMT

+    #      Next Update: May  2 14:23:42 2010 GMT

+    #

+    # NOTE: It is needed to check the exit code of OpenSSL explicitly.  OpenSSL

+    #       can in some circumstances give a "good" result if it could not

+    #       reach the the OSCP server.  In this case, the exit code will indicate

+    #       if OpenSSL itself failed or not.  If OpenSSL's exit code is not 0,

+    #       don't trust the OpenSSL status.

+

+    status=$(openssl ocsp -issuer "$issuer" \

+                    "$nonce" \

+                    -CAfile "$verify" \

+                    -url "$ocsp_url" \

+                    -serial "0x${serial}" 2>/dev/null)

+

+    if [ $? -eq 0 ]; then

+      # check that it's good

+      if echo "$status" | grep -Fq "0x${serial}: good"; then

+        exit 0

+      fi

+    fi

+  fi

+  # if we get here, something was wrong

+  exit 1

+fi

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Copyright (c) 2005-2010 OpenVPN Technologies, Inc.

 # Licensed under the GPL version 2

@@ -14,7 +14,6 @@

 # Place this in /etc/openvpn/client.down

 # Then, add the following to your /etc/openvpn/<clientconfig>.conf:

 #   client

-#   pull dhcp-options

 #   up /etc/openvpn/client.up

 #   down /etc/openvpn/client.down

 # Next, "chmod a+x /etc/openvpn/client.down"

@@ -23,8 +22,8 @@

 # Note that this script is best served with the companion "client.up"

 # script.

-# Only tested on Gentoo Linux 2005.0 with OpenVPN 2.0

-# It should work with any GNU/Linux with /etc/resolv.conf

+# Tested under Debian lenny with OpenVPN 2.1_rc11

+# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf

 # This runs with the context of the OpenVPN UID/GID 

 # at the time of execution. This generally means that

@@ -36,41 +35,12 @@

 # is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have

 # been WARNED.

-# init variables

-

-i=1

-j=1

-unset fopt

-unset dns

-unset opt

-

-# Convert ENVs to an array

-

-while fopt=foreign_option_$i; [ -n "${!fopt}" ]; do

-{

-	opt[i-1]=${!fopt}

-	case ${opt[i-1]} in

-		*DOMAIN* ) domain=`echo ${opt[i-1]} | \

-				sed -e 's/dhcp-option DOMAIN //g'` ;;

-		*DNS*    ) dns[j-1]=`echo ${opt[i-1]} | \

-				sed -e 's/dhcp-option DNS //g'`

-			       let j++ ;;

-	esac

-	let i++

-}

-done

-

-# Now, do the work

-

-if [ -n "${dns[*]}" ]; then

-	for i in "${dns[@]}"; do

-		sed -i -e "/nameserver ${i}/D" /etc/resolv.conf || die

-	done

-fi

-

-if [ -n "${domain}" ]; then

-	sed -i -e "/search ${domain}/D" /etc/resolv.conf || die

+if [ -x /sbin/resolvconf ] ; then

+  /sbin/resolvconf -d "${1}"

+elif [ -e /etc/resolv.conf.ovpnsave ] ; then

+  # cp + rm rather than mv in case it's a symlink

+  cp /etc/resolv.conf.ovpnsave /etc/resolv.conf

+  rm -f /etc/resolv.conf.ovpnsave

 fi

-# all done...

 exit 0

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Copyright (c) 2005-2010 OpenVPN Technologies, Inc.

 # Licensed under the GPL version 2

@@ -14,7 +14,6 @@

 # Place this in /etc/openvpn/client.up

 # Then, add the following to your /etc/openvpn/<clientconfig>.conf:

 #   client

-#   pull dhcp-options

 #   up /etc/openvpn/client.up

 # Next, "chmod a+x /etc/openvpn/client.up"

@@ -22,8 +21,8 @@

 # Note that this script is best served with the companion "client.down"

 # script.

-# Only tested on Gentoo Linux 2005.0 with OpenVPN 2.0

-# It should work with any GNU/Linux with /etc/resolv.conf

+# Tested under Debian lenny with OpenVPN 2.1_rc11

+# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf

 # This runs with the context of the OpenVPN UID/GID 

 # at the time of execution. This generally means that

@@ -38,38 +37,64 @@

 # init variables

 i=1

-j=1

-unset fopt

-unset dns

-unset opt

-

-# Convert ENVs to an array

-

-while fopt=foreign_option_$i; [ -n "${!fopt}" ]; do

-{

-	opt[i-1]=${!fopt}

-	case ${opt[i-1]} in

-		*DOMAIN* ) domain=`echo ${opt[i-1]} | \

-				sed -e 's/dhcp-option DOMAIN //g'` ;;

-		*DNS*    ) dns[j-1]=`echo ${opt[i-1]} | \

-				sed -e 's/dhcp-option DNS //g'`

-			       let j++ ;;

+domains=

+fopt=

+ndoms=0

+nns=0

+nl='

+'

+

+# $foreign_option_<n> is something like

+# "dhcp-option DOMAIN example.com" (multiple allowed)

+# or

+# "dhcp-option DNS 10.10.10.10" (multiple allowed)

+

+# each DNS option becomes a "nameserver" option in resolv.con

+# if we get one DOMAIN, that becomes "domain" in resolv.conf

+# if we get multiple DOMAINS, those become "search" lines in resolv.conf

+

+while true; do

+  eval fopt=\$foreign_option_${i}

+  [ -z "${fopt}" ] && break

+

+  case ${fopt} in

+		dhcp-option\ DOMAIN\ *)

+           ndoms=$((ndoms + 1))

+           domains="${domains} ${fopt#dhcp-option DOMAIN }"

+           ;;

+		dhcp-option\ DNS\ *)

+           nns=$((nns + 1))

+           if [ $nns -le 3 ]; then

+             dns="${dns}${dns:+$nl}nameserver ${fopt#dhcp-option DNS }"

+           else

+             printf "%s\n" "Too many nameservers - ignoring after third" >&2

+           fi

+           ;;

+        *)

+           printf "%s\n" "Unknown option \"${fopt}\" - ignored" >&2

+           ;;

 	esac

-	let i++

-}

+  i=$((i + 1))

 done

-# Now, do the work

-

-if [ -n "${dns[*]}" ]; then

-	for i in "${dns[@]}"; do

-		sed -i -e "1,1 i nameserver ${i}" /etc/resolv.conf || die

-	done

+ds=domain

+if [ $ndoms -gt 1 ]; then

+  ds=search

 fi

-if [ -n "${domain}" ]; then

-	sed -i -e "$j,1 i search ${domain}" /etc/resolv.conf || die

+# This is the complete file - "$domains" has a leading space already

+out="# resolv.conf autogenerated by ${0} (${1})${nl}${dns}${nl}${ds}${domains}"

+

+# use resolvconf if it's available

+if [ -x /sbin/resolvconf ] ; then

+  printf "%s\n" "${out}" | /sbin/resolvconf -a "${1}"

+else

+  # Preserve the existing resolv.conf

+  if [ -e /etc/resolv.conf ] ; then

+    cp /etc/resolv.conf /etc/resolv.conf.ovpnsave

+  fi

+  printf "%s\n" "${out}" > /etc/resolv.conf

+  chmod 644 /etc/resolv.conf

 fi

-# all done...

 exit 0

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 #

 # Build a root certificate

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Build Diffie-Hellman parameters for the server side

 # of an SSL/TLS connection.

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Make an intermediate CA certificate/private key pair using a locally generated

 # root certificate.

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Make a certificate/private key pair using a locally generated

 # root certificate.

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Similar to build-key, but protect the private key

 # with a password.

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Make a certificate/private key pair using a locally generated

 # root certificate and convert it to a PKCS #12 file including the

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Make a certificate/private key pair using a locally generated

 # root certificate.

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Build a certificate signing request and private key.  Use this

 # when your root certificate and key is not available locally.

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Like build-req, but protect your private key

 # with a password.

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Initialize the $KEY_DIR directory.

 # Note that this script does a

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Build a new PKI which is rooted on an intermediate certificate generated

 # by ./build-inter or ./pkitool --inter from a parent PKI.  The new PKI should

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # list revoked certificates

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # revoke a certificate, regenerate CRL,

 # and verify revocation

@@ -1,4 +1,4 @@

-#!/bin/bash

+#!/bin/sh

 # Sign a certificate signing request (a .csr file)

 # with a local root certificate and key.

@@ -766,7 +766,7 @@ process_incoming_link (struct context *c)

   /* log incoming packet */

 #ifdef LOG_RW

-  if (c->c2.log_rw)

+  if (c->c2.log_rw && c->c2.buf.len > 0)

     fprintf (stderr, "R");

 #endif

   msg (D_LINK_RW, "%s READ [%d] from %s: %s",

@@ -976,7 +976,7 @@ process_incoming_tun (struct context *c)

     c->c2.tun_read_bytes += c->c2.buf.len;

 #ifdef LOG_RW

-  if (c->c2.log_rw)

+  if (c->c2.log_rw && c->c2.buf.len > 0)

     fprintf (stderr, "r");

 #endif

@@ -615,7 +615,7 @@ init_static (void)

 #ifdef STATUS_PRINTF_TEST

   {

     struct gc_arena gc = gc_new ();

-    const char *tmp_file = create_temp_filename ("/tmp", "foo", &gc);

+    const char *tmp_file = create_temp_file ("/tmp", "foo", &gc);

     struct status_output *so = status_open (tmp_file, 0, -1, NULL, STATUS_OUTPUT_WRITE);

     status_printf (so, "%s", "foo");

     status_printf (so, "%s", "bar");

@@ -1165,25 +1165,57 @@ test_file (const char *filename)

 /* create a temporary filename in directory */

 const char *

-create_temp_filename (const char *directory, const char *prefix, struct gc_arena *gc)

+create_temp_file (const char *directory, const char *prefix, struct gc_arena *gc)

 {

   static unsigned int counter;

   struct buffer fname = alloc_buf_gc (256, gc);

+  int fd;

+  const char *retfname = NULL;

+  unsigned int attempts = 0;

-  mutex_lock_static (L_CREATE_TEMP);

-  ++counter;

-  mutex_unlock_static (L_CREATE_TEMP);

-

-  {

-    uint8_t rndbytes[16];

-    const char *rndstr;

-

-    prng_bytes (rndbytes, sizeof (rndbytes));

-    rndstr = format_hex_ex (rndbytes, sizeof (rndbytes), 40, 0, NULL, gc);

-    buf_printf (&fname, PACKAGE "_%s_%s.tmp", prefix, rndstr);

-  }

+  do

+    {

+      uint8_t rndbytes[16];

+      const char *rndstr;

+

+      ++attempts;

+      mutex_lock_static (L_CREATE_TEMP);

+      ++counter;

+      mutex_unlock_static (L_CREATE_TEMP);

+

+      prng_bytes (rndbytes, sizeof rndbytes);

+      rndstr = format_hex_ex (rndbytes, sizeof rndbytes, 40, 0, NULL, gc);

+      buf_printf (&fname, PACKAGE "_%s_%s.tmp", prefix, rndstr);

+

+      retfname = gen_path (directory, BSTR (&fname), gc);

+      if (!retfname)

+        {

+          msg (M_FATAL, "Failed to create temporary filename and path");

+          return NULL;

+        }

+

+      /* Atomically create the file.  Errors out if the file already

+         exists.  */

+      fd = open (retfname, O_CREAT | O_EXCL | O_WRONLY, S_IRUSR | S_IWUSR);

+      if (fd != -1)

+        {

+          close (fd);

+          return retfname;

+        }

+      else if (fd == -1 && errno != EEXIST)

+        {

+          /* Something else went wrong, no need to retry.  */

+          struct gc_arena gcerr = gc_new ();

+          msg (M_FATAL, "Could not create temporary file '%s': %s",

+               retfname, strerror_ts (errno, &gcerr));

+          gc_free (&gcerr);

+          return NULL;

+        }

+    }

+  while (attempts < 6);

-  return gen_path (directory, BSTR (&fname), gc);

+  msg (M_FATAL, "Failed to create temporary file after %i attempts", attempts);

+  return NULL;

 }

 /*

@@ -1562,14 +1594,16 @@ void

 purge_user_pass (struct user_pass *up, const bool force)

 {

   const bool nocache = up->nocache;

+  static bool warn_shown = false;

   if (nocache || force)

     {

       CLEAR (*up);

       up->nocache = nocache;

     }

-  else

+  else if (!warn_shown)

     {

       msg (M_WARN, "WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this");

+      warn_shown = true;

     }

 }

@@ -218,8 +218,8 @@ long int get_random(void);

 /* return true if filename can be opened for read */

 bool test_file (const char *filename);

-/* create a temporary filename in directory */

-const char *create_temp_filename (const char *directory, const char *prefix, struct gc_arena *gc);

+/* create a temporary file in directory, returns the filename of the created file */

+const char *create_temp_file (const char *directory, const char *prefix, struct gc_arena *gc);

 /* put a directory and filename together */

 const char *gen_path (const char *directory, const char *filename, struct gc_arena *gc);

@@ -1530,9 +1530,14 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

       if (plugin_defined (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT))

 	{

 	  struct argv argv = argv_new ();

-	  const char *dc_file = create_temp_filename (mi->context.options.tmp_dir, "cc", &gc);

+	  const char *dc_file = create_temp_file (mi->context.options.tmp_dir, "cc", &gc);

+

+          if( !dc_file ) {

+            cc_succeeded = false;

+            goto script_depr_failed;

+          }

+

 	  argv_printf (&argv, "%s", dc_file);

-	  delete_file (dc_file);

 	  if (plugin_call (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, &argv, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS)

 	    {

 	      msg (M_WARN, "WARNING: client-connect plugin call failed");

@@ -1543,6 +1548,7 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

 	      multi_client_connect_post (m, mi, dc_file, option_permissions_mask, &option_types_found);

 	      ++cc_succeeded_count;

 	    }

+        script_depr_failed:

 	  argv_reset (&argv);

 	}

@@ -1578,9 +1584,11 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

 	  setenv_str (mi->context.c2.es, "script_type", "client-connect");

-	  dc_file = create_temp_filename (mi->context.options.tmp_dir, "cc", &gc);

-

-	  delete_file (dc_file);

+	  dc_file = create_temp_file (mi->context.options.tmp_dir, "cc", &gc);

+          if( !dc_file ) {

+            cc_succeeded = false;

+            goto script_failed;

+          }

 	  argv_printf (&argv, "%sc %s",

 		       mi->context.options.client_connect_script,

@@ -1593,7 +1601,7 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi

 	    }

 	  else

 	    cc_succeeded = false;

-

+        script_failed:

 	  argv_reset (&argv);

 	}

@@ -97,25 +97,25 @@ with a relatively lightweight footprint.

 .SH OPTIONS

 OpenVPN allows any option to be placed either on the command line

 or in a configuration file.  Though all command line options are preceded

-by a double-leading-dash ("--"), this prefix can be removed when

+by a double-leading-dash ("\-\-"), this prefix can be removed when

 an option is placed in a configuration file.

 .\"*********************************************************

 .TP

-.B --help

+.B \-\-help

 Show options.

 .\"*********************************************************

 .TP

-.B --config file

+.B \-\-config file

 Load additional config options from

 .B file

 where each line corresponds to one command line option,

-but with the leading '--' removed.

+but with the leading '\-\-' removed.

 If

-.B --config file

+.B \-\-config file

 is the only option to the openvpn command,

 the

-.B --config

+.B \-\-config

 can be removed, and the command can be given as

 .B openvpn file

@@ -187,25 +187,25 @@ secret static.key

 .\"*********************************************************

 .SS Tunnel Options:

 .TP

-.B --mode m

+.B \-\-mode m

 Set OpenVPN major mode.  By default, OpenVPN runs in

 point-to-point mode ("p2p").  OpenVPN 2.0 introduces

 a new mode ("server") which implements a multi-client

 server capability.

 .\"*********************************************************

 .TP

-.B --local host

+.B \-\-local host

 Local host name or IP address for bind.

 If specified, OpenVPN will bind to this address only.

 If unspecified, OpenVPN will bind to all interfaces.

 .\"*********************************************************

 .TP

-.B --remote host [port] [proto]

+.B \-\-remote host [port] [proto]

 Remote host name or IP address.  On the client, multiple

-.B --remote

+.B \-\-remote

 options may be specified for redundancy, each referring

 to a different OpenVPN server.  Specifying multiple

-.B --remote

+.B \-\-remote

 options for this purpose is a special case of the more

 general connection-profile feature.  See the

 .B <connection>

@@ -214,7 +214,7 @@ documentation below.

 The OpenVPN client will try to connect to a server at

 .B host:port

 in the order specified by the list of

-.B --remote

+.B \-\-remote

 options.

 .B proto

@@ -229,18 +229,18 @@ one server.

 Note that since UDP is connectionless, connection failure

 is defined by the

-.B --ping

+.B \-\-ping

 and

-.B --ping-restart

+.B \-\-ping-restart

 options.

 Note the following corner case:  If you use multiple

-.B --remote

+.B \-\-remote

 options, AND you are dropping root privileges on

 the client with

-.B --user

+.B \-\-user

 and/or

-.B --group,

+.B \-\-group,

 AND the client is running a non-Windows OS, if the client needs

 to switch to a different server, and that server pushes

 back different TUN/TAP or route settings, the client may lack

@@ -248,7 +248,7 @@ the necessary privileges to close and reopen the TUN/TAP interface.

 This could cause the client to exit with a fatal error.

 If

-.B --remote

+.B \-\-remote

 is unspecified, OpenVPN will listen

 for packets from any IP address, but will not act on those packets unless

 they pass all authentication tests.  This requirement for authentication

@@ -257,7 +257,7 @@ trusted IP addresses (it is very easy to forge a source IP address on

 a UDP packet).

 When used in TCP mode, 

-.B --remote

+.B \-\-remote

 will act as a filter, rejecting connections from any host which does

 not match

 .B host.

@@ -283,7 +283,7 @@ and

 An OpenVPN client will try each connection profile sequentially

 until it achieves a successful connection.  

-.B --remote-random

+.B \-\-remote-random

 can be used to initially "scramble" the connection

 list.

@@ -381,15 +381,15 @@ blocks below it.

 .\"*********************************************************

 .TP

-.B --remote-random

+.B \-\-remote-random

 When multiple

-.B --remote

+.B \-\-remote

 address/ports are specified, or if connection profiles are being

 used, initially randomize the order of the list

 as a kind of basic load-balancing measure.

 .\"*********************************************************

 .TP

-.B --proto p

+.B \-\-proto p

 Use protocol

 .B p

 for communicating with remote host.

@@ -403,17 +403,17 @@ or

 The default protocol is

 .B udp

 when

-.B --proto

+.B \-\-proto

 is not specified.

 For UDP operation,

-.B --proto udp

+.B \-\-proto udp

 should be specified on both peers.

 For TCP operation, one peer must use

-.B --proto tcp-server

+.B \-\-proto tcp-server

 and the other must use

-.B --proto tcp-client.

+.B \-\-proto tcp-client.

 A peer started with

 .B tcp-server

 will wait indefinitely for an incoming connection.  A peer

@@ -421,9 +421,9 @@ started with

 .B tcp-client

 will attempt to connect, and if that fails, will sleep for 5