Don't deference type-punned pointers.

Fixes compiler warnings (oficially undefined behavior) by making the copy
explicit to comply to strict aliasing.

Signed-off-by: Steffan Karger <steffan@karger.me>
polarssl: add polar_log_err() and polar_ok(), to easily log PolarSSL errors

Signed-off-by: Steffan Karger <steffan@karger.me>
polarssl: Improve PolarSSL logging

Use the new polar_log_err() and polar_ok() functions introduced in the
previous commit to provide more log/debug output on SSL errors.

Signed-off-by: Steffan Karger <steffan@karger.me>
polarssl: don't ignore failed ssl_init(), but ASSERT() on failure

Since key_state_ssl_init() returns void, it *must* succeed. By changing the
'if(a) { success } else ignore' into 'ASSERT(a); success', we make sure we
don't fail (which we in practice don't do, because otherwise we would have
had complaining users with hard to trace errors).

This patch just changes the if() to an ASSERT(), but that causes a lot of
indenting changes, making this patch look a lot bigger than it really is.

Signed-off-by: Steffan Karger <steffan@karger.me>
openssl: add crypto_msg(), to easily log openssl errors

This works towards removing OpenSSL-specific error printing code from
error.c. The crypto_msg() functions provide convenience wrappers, specific
to OpenSSL. Instead of passing the magical 'M_SSLERR' flag to msg(), a
developer now just calls crypto_msg() to get OpenSSL errors dumped to log.

Signed-off-by: Steffan Karger <steffan@karger.me>
openssl: use crypto_msg(), get rid of openssl-specific code in error.c

Signed-off-by: Steffan Karger <steffan@karger.me>
openssl: add more descriptive message for "no shared cipher" error

Overzealous users using the --tls-cipher option, or users with actual
incompatible crypto libaries often waste quite some time debugging the
"no shared cipher" error from openssl. See e.g. trac ticket #359:
https://community.openvpn.net/openvpn/ticket/359

This change adds a more clear, verb 1 error message reporting the problem
directly to the user, instead of just printing the openssl error.

Signed-off-by: Steffan Karger <steffan@karger.me>
Add option to disable Diffie Hellman key exchange by setting "--dh none"

As requested on the mailing list and in trac ticket #410, add an option to
disable 'traditional' Diffie Hellman key exchange. People want to be able
to create ecdh-only configurations.

Also update the manpage to reflect the new behaviour, and while touching it
change the text to motivate users towards a more secure configuration.

Signed-off-by: Steffan Karger <steffan@karger.me>
Fix types in ntlm.c

This patch fixes the types used in ntlm.c. It does not change behaviour, but
removes a lot of implicit casts and makes the compiler much happier.

Signed-off-by: Steffan Karger <steffan@karger.me>
XXX Get rid of httpdigest.c type warnings
Add --tls-version-max

Because using TLS 1.2 breaks certain setups, a user might want to enforce
a maximum TLS version to use. This patch adds that option.

This patch removes a number of #ifdefs from ssl_polarssl.c, because the
polarssl versions we currently support (polar 1.2 for openvpn 2.3, and
polar 1.3 for openvpn-master) have all versions unconditionally enabled.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>