profile

type AuthFlow int

type DNSOptions struct {
	// Servers are dhcp-option DNS addresses, in preference order.
	Servers []string `json:"servers,omitempty"`
	// SearchDomains are dhcp-option DOMAIN; RouteDomains are DOMAIN-ROUTE.
	SearchDomains []string `json:"search_domains,omitempty"`
	RouteDomains  []string `json:"route_domains,omitempty"`
}

type Directive struct {
	// Name is the directive keyword, lowercased.
	Name string `json:"name"`
	// Args are the whitespace-separated arguments after the keyword, nil for
	// a bare directive.
	Args []string `json:"args,omitempty"`
	// Line is the 1-based line number, zero when the directive has no source
	// line.
	Line int `json:"line,omitempty"`
}

type Endpoint struct {
	// Host is the hostname or address. Required.
	Host string `json:"host"`
	// Port is zero for 1194.
	Port int `json:"port,omitempty"`
	// Proto is the transport in OpenVPN's spelling; empty means UDP.
	Proto string `json:"proto,omitempty"`
}

type FileRef struct {
	// Tag is the directive keyword: "ca", "cert" or "key".
	Tag string
	// Line is the 1-based line number the directive appeared on.
	Line int
	// Loaded reports that the file was read into the matching field.
	Loaded bool
	// Superseded reports that an inline block of the same tag was used
	// instead, and the file was not opened.
	Superseded bool
}

type InlineBlock struct {
	// Tag is the block's tag name, verbatim.
	Tag string
	// Line is the 1-based line number of the opening tag.
	Line int
}

type KeyDirection int

type MSSFixMode int

type Profile struct {
	// Remote, Port and Proto are Remotes[0].
	Remote string
	Port   int
	Proto  Proto

	// Remotes is every --remote line, in file order. Never empty in a parsed
	// profile.
	Remotes []Remote

	// CA, Cert and Key are PEM bodies, from inline blocks or referenced files.
	CA   []byte
	Cert []byte
	Key  []byte

	// FileRefs records every ca, cert or key directive that named a file, in
	// file order.
	FileRefs []FileRef

	// TLSAuth and TLSCrypt are the <tls-auth> and <tls-crypt> keys, or nil.
	// The parser loads both if both are present; the connect path refuses the
	// pair.
	TLSAuth  *StaticKey
	TLSCrypt *StaticKey
	// KeyDirection is --key-direction: 0, 1, or absent.
	KeyDirection KeyDirection

	// Cipher is the data-channel cipher name, e.g. "AES-256-GCM".
	Cipher string
	// Auth is the HMAC digest, e.g. "SHA256"; SHA1 when absent.
	Auth string
	// AuthSet reports whether the profile carried an explicit auth directive.
	AuthSet bool
	// Verb is OpenVPN's 0–11 verbosity; the default is 3. At 4 the verified
	// server certificate is logged on each handshake.
	Verb int

	// RenegSec is the key renegotiation interval in seconds; 3600 when
	// absent, and 0 disables client-initiated renegotiation.
	RenegSec int
	// RenegBytes is the renegotiation byte threshold; 0 means none.
	RenegBytes int64
	// BecomePrimarySec delays a renegotiated key becoming the send key; 0
	// uses the default derived from reneg-sec.
	BecomePrimarySec int

	// HandWindowSec is --hand-window; 0 means the reference's 60
	// (openvpn-2.6.22 src/openvpn/options.c:880).
	HandWindowSec int

	// PingInterval is the keepalive send interval in seconds, from ping or
	// keepalive; 0 means the client default.
	PingInterval int
	// PingTimeout is the dead-link timeout in seconds, from ping-restart,
	// ping-exit or keepalive. One field for all three, as in
	// openvpn-2.6.22 src/openvpn/options.c:6963-6975. PingTimeoutSet
	// distinguishes an explicit 0, which disables the timer, from an absent
	// directive, which leaves the client default.
	PingTimeout    int
	PingTimeoutSet bool
	// PingExit reports that PingTimeout came from ping-exit. Nothing acts on
	// it; the client's dead-link teardown is terminal either way.
	PingExit bool

	// ExplicitExitNotify is how many exit notifications a disconnect sends. A
	// bare directive means 1 (openvpn-2.4.12 src/openvpn/options.c:6133).
	ExplicitExitNotify int

	// Compression is the data-channel framing the profile asked for, from
	// comp-lzo or compress. The server does not push its own, so a client that
	// ignored this would send packets a comp-lzo peer drops.
	Compression compress.Mode
	// AllowCompression is the --allow-compression policy.
	AllowCompression compress.AllowCompression

	// TunMTU is --tun-mtu; 0 means 1500.
	TunMTU int

	// MSSFix is the --mssfix clamp and MSSFixMode how it is measured.
	// MSSFixSet distinguishes "mssfix 0", which disables clamping, from an
	// absent directive, which applies OpenVPN's default.
	MSSFix     int
	MSSFixMode MSSFixMode
	MSSFixSet  bool

	// RemoteRandom asks the dialer to shuffle Remotes on each attempt.
	// Remotes itself stays in file order.
	RemoteRandom bool

	// RandomHostname asks the dialer to prepend a random label to the
	// hostname; some deployments have no DNS record for the bare name.
	RandomHostname bool

	// VerifyX509Name is the subject DN or common name the server certificate
	// must present, empty for no check. It is not a hostname and is not
	// matched against a SAN.
	VerifyX509Name string
	// VerifyX509NameMatch says which part of the subject is compared.
	VerifyX509NameMatch X509NameMatch

	// AuthUserPass reports that the profile carried auth-user-pass.
	AuthUserPass bool
	// RemoteCertTLSServer and NSCertTypeServer report "remote-cert-tls server"
	// and "ns-cert-type server".
	RemoteCertTLSServer bool
	NSCertTypeServer    bool

	// Federated is set by auth-federate or "x-go-openvpn-flow saml" (formerly
	// x-openlawsvpn-flow): authenticate against an identity provider.
	Federated bool

	// DNS is the resolver configuration from the profile's dhcp-option
	// directives. What the server pushes wins where the two overlap.
	DNS dns.Config

	// Directives records every directive line in file order, including those
	// the parser ignores, for the capability preflight.
	Directives []Directive

	// InlineBlocks records every inline block's tag and line, in file order,
	// for the capability preflight.
	InlineBlocks []InlineBlock
}

type Proto int

type Remote struct {
	// Host is the hostname or address as written in the profile.
	Host string
	// Port is the port to dial.
	Port int
	// Proto is the transport to dial.
	Proto Proto
	// ProtoSet reports whether the remote line named a protocol itself.
	ProtoSet bool
}

type Spec struct {
	// Remotes is the --remote list, in dial order. At least one is required.
	Remotes []Endpoint `json:"remotes,omitempty"`

	// CA, Cert and Key are the PEM bodies of the <ca>, <cert> and <key>
	// blocks.
	CA   []byte `json:"ca,omitempty"`
	Cert []byte `json:"cert,omitempty"`
	Key  []byte `json:"key,omitempty"`

	// TLSAuth and TLSCrypt are the bodies of <tls-auth> and <tls-crypt>, as
	// "openvpn --genkey" writes them.
	TLSAuth  []byte `json:"tls_auth,omitempty"`
	TLSCrypt []byte `json:"tls_crypt,omitempty"`
	// KeyDirection is --key-direction. KeyDirectionAbsent uses the whole key
	// in both directions.
	KeyDirection KeyDirection `json:"key_direction,omitempty"`

	// AuthUserPass asks for a username and password, which the client's
	// CredentialsFn supplies.
	AuthUserPass bool `json:"auth_user_pass,omitempty"`
	// AuthFederate is auth-federate: use the SAML/CRV1 flow.
	AuthFederate bool `json:"auth_federate,omitempty"`

	// Cipher is --cipher; empty means AES-256-GCM.
	Cipher string `json:"cipher,omitempty"`
	// Auth is --auth; empty means absent, and SHA1 applies.
	Auth string `json:"auth,omitempty"`

	// RemoteCertTLSServer is "remote-cert-tls server"; NSCertTypeServer is
	// "ns-cert-type server".
	RemoteCertTLSServer bool `json:"remote_cert_tls_server,omitempty"`
	NSCertTypeServer    bool `json:"ns_cert_type_server,omitempty"`
	// VerifyX509Name and VerifyX509NameMatch are --verify-x509-name.
	VerifyX509Name      string        `json:"verify_x509_name,omitempty"`
	VerifyX509NameMatch X509NameMatch `json:"verify_x509_name_match,omitempty"`

	// Compression is the compression directive: "comp-lzo", "comp-lzo no",
	// "compress", "compress lz4", "compress lz4-v2" or "compress stub-v2".
	// Empty means none.
	Compression string `json:"compression,omitempty"`
	// AllowCompression is --allow-compression: "no", "asym" or "yes".
	AllowCompression string `json:"allow_compression,omitempty"`

	// TunMTU is --tun-mtu.
	TunMTU int `json:"tun_mtu,omitempty"`
	// MSSFix is --mssfix N, with MSSFixMode its optional second word.
	// MSSFixOff is an explicit "mssfix 0".
	MSSFix     int        `json:"mssfix,omitempty"`
	MSSFixMode MSSFixMode `json:"mssfix_mode,omitempty"`
	MSSFixOff  bool       `json:"mssfix_off,omitempty"`

	// RenegSec is --reneg-sec; zero means 3600. NoReneg is an explicit
	// "reneg-sec 0", which disables client-initiated renegotiation.
	RenegSec   int   `json:"reneg_sec,omitempty"`
	NoReneg    bool  `json:"no_reneg,omitempty"`
	RenegBytes int64 `json:"reneg_bytes,omitempty"`
	// HandWindow is --hand-window; BecomePrimary is --become-primary.
	HandWindow    int `json:"hand_window,omitempty"`
	BecomePrimary int `json:"become_primary,omitempty"`

	// Ping is the keepalive send interval and PingTimeout the dead-link
	// timeout, in seconds. PingTimeoutOff is an explicit "ping-restart 0",
	// which disables the dead-link timer. PingExit ends the session on
	// timeout instead of restarting it, and needs PingTimeout or
	// PingTimeoutOff.
	Ping           int  `json:"ping,omitempty"`
	PingTimeout    int  `json:"ping_timeout,omitempty"`
	PingTimeoutOff bool `json:"ping_timeout_off,omitempty"`
	PingExit       bool `json:"ping_exit,omitempty"`
	// ExplicitExitNotify is how many exit notifications a disconnect sends.
	ExplicitExitNotify int `json:"explicit_exit_notify,omitempty"`

	// RemoteRandom is --remote-random; RemoteRandomHostname is
	// --remote-random-hostname.
	RemoteRandom         bool `json:"remote_random,omitempty"`
	RemoteRandomHostname bool `json:"remote_random_hostname,omitempty"`

	// DNS is the resolver configuration, as dhcp-option DNS, DOMAIN and
	// DOMAIN-ROUTE.
	DNS DNSOptions `json:"dns,omitzero"`

	// Extra carries directives no field above covers, applied after them. A
	// directive a field covers is refused.
	Extra []Directive `json:"extra,omitempty"`
}

type StaticKey [StaticKeySize]byte

type X509NameMatch int