misc cleanup patches

index 1cb6068..5d6ff85 100644
@@ -858,6 +858,8 @@ init_options (struct options *o, const bool init_gc)
   o->pkcs11_pin_cache_period = -1;
 #endif			/* ENABLE_PKCS11 */
 
+/* tmp is only used in P2MP server context */    
+#if P2MP_SERVER
   /* Set default --tmp-dir */
 #ifdef WIN32
   /* On Windows, find temp dir via enviroment variables */

@@ -869,6 +871,7 @@ init_options (struct options *o, const bool init_gc)
           o->tmp_dir = "/tmp";
   }
 #endif /* WIN32 */
+#endif /* P2MP_SERVER */
 }
 
 void

@@ -2766,8 +2769,6 @@ options_postprocess_filechecks (struct options *options)
                              R_OK|X_OK, "--chroot directory");
   errs |= check_file_access (CHKACC_DIRPATH|CHKACC_FILEXSTWR, options->writepid,
                              R_OK|W_OK, "--writepid");
-  errs |= check_file_access (CHKACC_FILE, options->tmp_dir,
-                             R_OK|W_OK|X_OK, "Temporary directory (--tmp-dir)");
 
   /* ** Log related ** */
   errs |= check_file_access (CHKACC_DIRPATH|CHKACC_FILEXSTWR, options->status_file,

@@ -2781,6 +2782,8 @@ options_postprocess_filechecks (struct options *options)
 #if P2MP_SERVER
   errs |= check_file_access (CHKACC_FILE, options->client_config_dir,
                              R_OK|X_OK, "--client-config-dir");
+  errs |= check_file_access (CHKACC_FILE, options->tmp_dir,
+                             R_OK|W_OK|X_OK, "Temporary directory (--tmp-dir)");
 
   /* ** Script hooks that accept an optionally quoted and/or escaped executable path, ** */
   /* ** optionally followed by arguments ** */

index 9b6adea..ee0c69d 100644
@@ -399,11 +399,13 @@ struct options
   struct plugin_option_list *plugin_list;
 #endif
 
-  const char *tmp_dir;
+
 
 #if P2MP
 
 #if P2MP_SERVER
+  /* the tmp dir is for now only used in the P2P server context */
+  const char *tmp_dir;
   bool server_defined;
   in_addr_t server_network;
   in_addr_t server_netmask;

index 61fd2a6..eacb67d 100644
@@ -2462,12 +2462,6 @@ do_option_warnings (struct context *c)
 {
   const struct options *o = &c->options;
 
-#if 1 /* JYFIXME -- port warning */
-  if (!o->ce.port_option_used && (o->ce.local_port == OPENVPN_PORT && o->ce.remote_port == OPENVPN_PORT))
-    msg (M_WARN, "IMPORTANT: OpenVPN's default port number is now %d, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.",
-	 OPENVPN_PORT);
-#endif
-
   if (o->ping_send_timeout && !o->ping_rec_timeout)
     msg (M_WARN, "WARNING: --ping should normally be used with --ping-restart or --ping-exit");
 

index 5d6ff85..566268e 100644
@@ -4921,7 +4921,6 @@ add_option (struct options *options,
 	  msg (msglevel, "Bad port number: %s", p[1]);
 	  goto err;
 	}
-      options->ce.port_option_used = true;
       options->ce.local_port = options->ce.remote_port = port;
     }
   else if (streq (p[0], "lport") && p[1])

@@ -4936,7 +4935,6 @@ add_option (struct options *options,
 	  goto err;
 	}
       options->ce.local_port_defined = true;
-      options->ce.port_option_used = true;
       options->ce.local_port = port;
     }
   else if (streq (p[0], "rport") && p[1])

@@ -4950,7 +4948,6 @@ add_option (struct options *options,
 	  msg (msglevel, "Bad remote port number: %s", p[1]);
 	  goto err;
 	}
-      options->ce.port_option_used = true;
       options->ce.remote_port = port;
     }
   else if (streq (p[0], "bind"))

index ee0c69d..caa31b2 100644
@@ -90,7 +90,6 @@ struct connection_entry
   int local_port;
   bool local_port_defined;
   int remote_port;
-  bool port_option_used;
   const char *local;
   const char *remote;
   bool remote_float;

index de2d609..dd2c83f 100644
@@ -95,9 +95,7 @@ typedef unsigned long ptr_type;
  * A sort of pseudo-filename for data provided inline within
  * the configuration file.
  */
-#if ENABLE_INLINE_FILES
 #define INLINE_FILE_TAG "[[INLINE]]"
-#endif
 
 /*
  * Script security warning

index 03781fc..ac2eecd 100644
@@ -737,7 +737,6 @@ get_tls_handshake_key (const struct key_type *key_type,
       kt.cipher_length = 0;
       kt.cipher = NULL;
 
-#if ENABLE_INLINE_FILES
       if (flags & GHK_INLINE)
 	{
 	  /* key was specified inline, key text is in passphrase_file */

@@ -750,7 +749,6 @@ get_tls_handshake_key (const struct key_type *key_type,
 	    msg (M_FATAL, "INLINE tls-auth file lacks the requisite 2 keys");
 	}
       else
-#endif
       {
 	/* first try to parse as an OpenVPN static key file */
 	read_key_file (&key2, passphrase_file, 0);

@@ -857,7 +855,6 @@ read_key_file (struct key2 *key2, const char *file, const unsigned int flags)
    * Key can be provided as a filename in 'file' or if RKF_INLINE
    * is set, the actual key data itself in ascii form.
    */
-#if ENABLE_INLINE_FILES
   if (flags & RKF_INLINE) /* 'file' is a string containing ascii representation of key */
     {
       size = strlen (file) + 1;

@@ -865,7 +862,6 @@ read_key_file (struct key2 *key2, const char *file, const unsigned int flags)
       error_filename = INLINE_FILE_TAG;
     }
   else /* 'file' is a filename which refers to a file containing the ascii key */
-#endif
     {
       in = alloc_buf_gc (2048, &gc);
       fd = platform_open (file, O_RDONLY, 0);

@@ -979,9 +975,7 @@ read_key_file (struct key2 *key2, const char *file, const unsigned int flags)
     }
 
   /* zero file read buffer if not an inline file */
-#if ENABLE_INLINE_FILES
   if (!(flags & RKF_INLINE))
-#endif
     buf_clear (&in);
 
   if (key2->n)

index eacb67d..292c3a8 100644
@@ -2053,13 +2053,11 @@ do_init_crypto_static (struct context *c, const unsigned int flags)
 	unsigned int rkf_flags = RKF_MUST_SUCCEED;
 	const char *rkf_file = options->shared_secret_file;
 
-#if ENABLE_INLINE_FILES
 	if (options->shared_secret_file_inline)
 	  {
 	    rkf_file = options->shared_secret_file_inline;
 	    rkf_flags |= RKF_INLINE;
 	  }
-#endif
 	read_key_file (&key2, rkf_file, rkf_flags);
       }
 

@@ -2153,13 +2151,11 @@ do_init_crypto_tls_c1 (struct context *c)
 	  unsigned int flags = 0;
 	  const char *file = options->tls_auth_file;
 
-#if ENABLE_INLINE_FILES
 	  if (options->tls_auth_file_inline)
 	    {
 	      flags |= GHK_INLINE;
 	      file = options->tls_auth_file_inline;
 	    }
-#endif
 	  get_tls_handshake_key (&c->c1.ks.key_type,
 				 &c->c1.ks.tls_auth_key,
 				 file,

index 2ded9bf..7f72939 100644
@@ -205,9 +205,7 @@ warn_if_group_others_accessible (const char* filename)
 {
 #ifndef WIN32
 #ifdef HAVE_STAT
-#if ENABLE_INLINE_FILES
   if (strcmp (filename, INLINE_FILE_TAG))
-#endif
     {
       struct stat st;
       if (stat (filename, &st))

@@ -1524,7 +1522,6 @@ make_arg_array (const char *first, const char *parms, struct gc_arena *gc)
   return (const char **)ret;
 }
 
-#if ENABLE_INLINE_FILES
 static const char **
 make_inline_array (const char *str, struct gc_arena *gc)
 {

@@ -1553,7 +1550,6 @@ make_inline_array (const char *str, struct gc_arena *gc)
   ret[i] = NULL;
   return (const char **)ret;
 }
-#endif
 
 static const char **
 make_arg_copy (char **p, struct gc_arena *gc)

@@ -1576,11 +1572,9 @@ const char **
 make_extended_arg_array (char **p, struct gc_arena *gc)
 {
   const int argc = string_array_len ((const char **)p);
-#if ENABLE_INLINE_FILES
   if (!strcmp (p[0], INLINE_FILE_TAG) && argc == 2)
     return make_inline_array (p[1], gc);
   else
-#endif
   if (argc == 0)
     return make_arg_array (NULL, NULL, gc);
   else if (argc == 1)

index 566268e..4b7a976 100644
@@ -3683,8 +3683,6 @@ bypass_doubledash (char **p)
     *p += 2;
 }
 
-#if ENABLE_INLINE_FILES
-
 struct in_src {
 # define IS_TYPE_FP 1
 # define IS_TYPE_BUF 2

@@ -3777,8 +3775,6 @@ check_inline_file_via_buf (struct buffer *multiline, char *p[], struct gc_arena
   return check_inline_file (&is, p, gc);
 }
 
-#endif
-
 static void
 add_option (struct options *options,
 	    char *p[],

@@ -3824,9 +3820,7 @@ read_config_file (struct options *options,
 	      if (parse_line (line, p, SIZE (p), file, line_num, msglevel, &options->gc))
 		{
 		  bypass_doubledash (&p[0]);
-#if ENABLE_INLINE_FILES
 		  check_inline_file_via_fp (fp, p, &options->gc);
-#endif
 		  add_option (options, p, file, line_num, level, msglevel, permission_mask, option_types_found, es);
 		}
 	    }

@@ -3869,9 +3863,7 @@ read_config_string (const char *prefix,
       if (parse_line (line, p, SIZE (p), prefix, line_num, msglevel, &options->gc))
 	{
 	  bypass_doubledash (&p[0]);
-#if ENABLE_INLINE_FILES
 	  check_inline_file_via_buf (&multiline, p, &options->gc);
-#endif
 	  add_option (options, p, NULL, line_num, 0, msglevel, permission_mask, option_types_found, es);
 	}
       CLEAR (p);

@@ -6270,13 +6262,11 @@ add_option (struct options *options,
   else if (streq (p[0], "secret") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->shared_secret_file_inline = p[2];
 	}
       else
-#endif
       if (p[2])
 	{
 	  int key_direction;

@@ -6467,12 +6457,10 @@ add_option (struct options *options,
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->ca_file = p[1];
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->ca_file_inline = p[2];
 	}
-#endif
     }
 #ifndef ENABLE_CRYPTO_POLARSSL
   else if (streq (p[0], "capath") && p[1])

@@ -6485,34 +6473,28 @@ add_option (struct options *options,
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->dh_file = p[1];
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->dh_file_inline = p[2];
 	}
-#endif
     }
   else if (streq (p[0], "cert") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->cert_file = p[1];
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->cert_file_inline = p[2];
 	}
-#endif
     }
   else if (streq (p[0], "extra-certs") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->extra_certs_file = p[1];
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->extra_certs_file_inline = p[2];
 	}
-#endif
     }
   else if (streq (p[0], "verify-hash") && p[1])
     {

@@ -6530,24 +6512,20 @@ add_option (struct options *options,
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->priv_key_file = p[1];
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->priv_key_file_inline = p[2];
 	}
-#endif
     }
 #ifndef ENABLE_CRYPTO_POLARSSL
   else if (streq (p[0], "pkcs12") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->pkcs12_file = p[1];
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->pkcs12_file_inline = p[2];
 	}
-#endif
     }
 #endif /* ENABLE_CRYPTO_POLARSSL */
   else if (streq (p[0], "askpass"))

@@ -6708,13 +6686,11 @@ add_option (struct options *options,
   else if (streq (p[0], "tls-auth") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
-#if ENABLE_INLINE_FILES
       if (streq (p[1], INLINE_FILE_TAG) && p[2])
 	{
 	  options->tls_auth_file_inline = p[2];
 	}
       else
-#endif
       if (p[2])
 	{
 	  int key_direction;

index caa31b2..a2e043d 100644
@@ -498,9 +498,7 @@ struct options
 #ifdef ENABLE_CRYPTO
   /* Cipher parms */
   const char *shared_secret_file;
-#if ENABLE_INLINE_FILES
   const char *shared_secret_file_inline;
-#endif
   int key_direction;
   bool ciphername_defined;
   const char *ciphername;

@@ -538,14 +536,12 @@ struct options
   const char *tls_remote;
   const char *crl_file;
 
-#if ENABLE_INLINE_FILES
   const char *ca_file_inline;
   const char *cert_file_inline;
   const char *extra_certs_file_inline;
   char *priv_key_file_inline;
   const char *dh_file_inline;
   const char *pkcs12_file_inline; /* contains the base64 encoding of pkcs12 file */
-#endif
 
   int ns_cert_type; /* set to 0, NS_CERT_CHECK_SERVER, or NS_CERT_CHECK_CLIENT */
   unsigned remote_cert_ku[MAX_PARMS];

@@ -592,9 +588,7 @@ struct options
 
   /* Special authentication MAC for TLS control channel */
   const char *tls_auth_file;		/* shared secret */
-#if ENABLE_INLINE_FILES
   const char *tls_auth_file_inline;
-#endif
 
   /* Allow only one session */
   bool single_session;

index f3e69dd..76cb0b9 100644
@@ -138,11 +138,8 @@ void tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers);
  * 				"[[INLINE]]" in the case of inline files.
  * @param dh_file_inline	A string containing the parameters
  */
-void tls_ctx_load_dh_params(struct tls_root_ctx *ctx, const char *dh_file
-#if ENABLE_INLINE_FILES
-    , const char *dh_file_inline
-#endif /* ENABLE_INLINE_FILES */
-    );
+void tls_ctx_load_dh_params(struct tls_root_ctx *ctx, const char *dh_file,
+    const char *dh_file_inline);
 
 /**
  * Load PKCS #12 file for key, cert and (optionally) CA certs, and add to

@@ -157,10 +154,7 @@ void tls_ctx_load_dh_params(struct tls_root_ctx *ctx, const char *dh_file
  * 				successful.
  */
 int tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file,
-#if ENABLE_INLINE_FILES
-    const char *pkcs12_file_inline,
-#endif /* ENABLE_INLINE_FILES */
-    bool load_ca_file
+    const char *pkcs12_file_inline, bool load_ca_file
     );
 
 /**

@@ -190,10 +184,7 @@ void tls_ctx_load_cryptoapi(struct tls_root_ctx *ctx, const char *cryptoapi_cert
  * 				*x509 must be NULL.
  */
 void tls_ctx_load_cert_file (struct tls_root_ctx *ctx, const char *cert_file,
-#if ENABLE_INLINE_FILES
-    const char *cert_file_inline,
-#endif
-    openvpn_x509_cert_t **x509
+    const char *cert_file_inline, openvpn_x509_cert_t **x509
     );
 
 /**

@@ -214,10 +205,8 @@ void tls_ctx_free_cert_file (openvpn_x509_cert_t *x509);
  * @return 			1 if an error occurred, 0 if parsing was
  * 				successful.
  */
-int tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file
-#if ENABLE_INLINE_FILES
-    , const char *priv_key_file_inline
-#endif
+int tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file, 
+    const char *priv_key_file_inline
     );
 
 #ifdef MANAGMENT_EXTERNAL_KEY

@@ -234,9 +223,9 @@ int tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file
  * 				successful.
  */
 int tls_ctx_use_external_private_key (struct tls_root_ctx *ctx, openvpn_x509_cert_t *cert);
-
 #endif
 
+
 /**
  * Load certificate authority certificates from the given file or path.
  *

@@ -249,10 +238,7 @@ int tls_ctx_use_external_private_key (struct tls_root_ctx *ctx, openvpn_x509_cer
  * @param ca_path		The path to load the CAs from
  */
 void tls_ctx_load_ca (struct tls_root_ctx *ctx, const char *ca_file,
-#if ENABLE_INLINE_FILES
-    const char *ca_file_inline,
-#endif
-    const char *ca_path, bool tls_server
+    const char *ca_file_inline, const char *ca_path, bool tls_server
     );
 
 /**

@@ -266,10 +252,8 @@ void tls_ctx_load_ca (struct tls_root_ctx *ctx, const char *ca_file,
  * 					"[[INLINE]]" in the case of inline files.
  * @param extra_certs_file_inline	A string containing the certs
  */
-void tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file
-#if ENABLE_INLINE_FILES
-    , const char *extra_certs_file_inline
-#endif
+void tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file,
+    const char *extra_certs_file_inline
     );
 
 #ifdef ENABLE_CRYPTO_POLARSSL

index 8f35325..a727b60 100644
@@ -209,10 +209,8 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
 }
 
 void
-tls_ctx_load_dh_params (struct tls_root_ctx *ctx, const char *dh_file
-#if ENABLE_INLINE_FILES
-    , const char *dh_file_inline
-#endif /* ENABLE_INLINE_FILES */
+tls_ctx_load_dh_params (struct tls_root_ctx *ctx, const char *dh_file,
+    const char *dh_file_inline
     )
 {
   DH *dh;

@@ -220,14 +218,12 @@ tls_ctx_load_dh_params (struct tls_root_ctx *ctx, const char *dh_file
 
   ASSERT(NULL != ctx);
 
-#if ENABLE_INLINE_FILES
   if (!strcmp (dh_file, INLINE_FILE_TAG) && dh_file_inline)
     {
       if (!(bio = BIO_new_mem_buf ((char *)dh_file_inline, -1)))
 	msg (M_SSLERR, "Cannot open memory BIO for inline DH parameters");
     }
   else
-#endif /* ENABLE_INLINE_FILES */
     {
       /* Get Diffie Hellman Parameters */
       if (!(bio = BIO_new_file (dh_file, "r")))

@@ -250,9 +246,7 @@ tls_ctx_load_dh_params (struct tls_root_ctx *ctx, const char *dh_file
 
 int
 tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file,
-#if ENABLE_INLINE_FILES
     const char *pkcs12_file_inline,
-#endif /* ENABLE_INLINE_FILES */
     bool load_ca_file
     )
 {

@@ -266,7 +260,6 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file,
 
   ASSERT(NULL != ctx);
 
-#if ENABLE_INLINE_FILES
   if (!strcmp (pkcs12_file, INLINE_FILE_TAG) && pkcs12_file_inline)
     {
       BIO *b64 = BIO_new(BIO_f_base64());

@@ -281,7 +274,6 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file,
       BIO_free(bio);
     }
   else
-#endif
     {
       /* Load the PKCS #12 file */
       if (!(fp = platform_fopen(pkcs12_file, "rb")))

@@ -371,10 +363,7 @@ tls_ctx_add_extra_certs (struct tls_root_ctx *ctx, BIO *bio)
 
 void
 tls_ctx_load_cert_file (struct tls_root_ctx *ctx, const char *cert_file,
-#if ENABLE_INLINE_FILES
-    const char *cert_file_inline,
-#endif
-    X509 **x509
+    const char *cert_file_inline, X509 **x509
     )
 {
   BIO *in = NULL;

@@ -386,13 +375,11 @@ tls_ctx_load_cert_file (struct tls_root_ctx *ctx, const char *cert_file,
   if (NULL != x509)
     ASSERT (NULL == *x509);
 
-#if ENABLE_INLINE_FILES
   inline_file = (strcmp (cert_file, INLINE_FILE_TAG) == 0);
 
   if (inline_file && cert_file_inline)
     in = BIO_new_mem_buf ((char *)cert_file_inline, -1);
   else
-#endif /* ENABLE_INLINE_FILES */
     in = BIO_new_file (cert_file, "r");
 
   if (in == NULL)

@@ -437,10 +424,8 @@ tls_ctx_free_cert_file (X509 *x509)
 }
 
 int
-tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file
-#if ENABLE_INLINE_FILES
-    , const char *priv_key_file_inline
-#endif
+tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file,
+    const char *priv_key_file_inline
     )
 {
   int status;

@@ -453,11 +438,9 @@ tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file
 
   ssl_ctx = ctx->ctx;
 
-#if ENABLE_INLINE_FILES
   if (!strcmp (priv_key_file, INLINE_FILE_TAG) && priv_key_file_inline)
     in = BIO_new_mem_buf ((char *)priv_key_file_inline, -1);
   else
-#endif /* ENABLE_INLINE_FILES */
     in = BIO_new_file (priv_key_file, "r");
 
   if (!in)

@@ -639,9 +622,7 @@ sk_x509_name_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
 
 void
 tls_ctx_load_ca (struct tls_root_ctx *ctx, const char *ca_file,
-#if ENABLE_INLINE_FILES
     const char *ca_file_inline,
-#endif
     const char *ca_path, bool tls_server
     )
 {

@@ -662,11 +643,9 @@ tls_ctx_load_ca (struct tls_root_ctx *ctx, const char *ca_file,
   /* Try to add certificates and CRLs from ca_file */
   if (ca_file)
     {
-#if ENABLE_INLINE_FILES
       if (!strcmp (ca_file, INLINE_FILE_TAG) && ca_file_inline)
         in = BIO_new_mem_buf ((char *)ca_file_inline, -1);
       else
-#endif
         in = BIO_new_file (ca_file, "r");
 
       if (in)

@@ -739,18 +718,14 @@ tls_ctx_load_ca (struct tls_root_ctx *ctx, const char *ca_file,
 }
 
 void
-tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file
-#if ENABLE_INLINE_FILES
-    , const char *extra_certs_file_inline
-#endif
+tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file,
+    const char *extra_certs_file_inline
     )
 {
   BIO *in;
-#if ENABLE_INLINE_FILES
   if (!strcmp (extra_certs_file, INLINE_FILE_TAG) && extra_certs_file_inline)
     in = BIO_new_mem_buf ((char *)extra_certs_file_inline, -1);
   else
-#endif
     in = BIO_new_file (extra_certs_file, "r");
 
   if (in == NULL)

index fc8fa6e..6995958 100644
@@ -195,20 +195,16 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
 }
 
 void
-tls_ctx_load_dh_params (struct tls_root_ctx *ctx, const char *dh_file
-#if ENABLE_INLINE_FILES
-    , const char *dh_file_inline
-#endif /* ENABLE_INLINE_FILES */
+tls_ctx_load_dh_params (struct tls_root_ctx *ctx, const char *dh_file,
+    const char *dh_file_inline
     )
 {
-#if ENABLE_INLINE_FILES
   if (!strcmp (dh_file, INLINE_FILE_TAG) && dh_file_inline)
     {
       if (0 != x509parse_dhm(ctx->dhm_ctx, dh_file_inline, strlen(dh_file_inline)))
 	msg (M_FATAL, "Cannot read inline DH parameters");
   }
 else
-#endif /* ENABLE_INLINE_FILES */
   {
     if (0 != x509parse_dhmfile(ctx->dhm_ctx, dh_file))
       msg (M_FATAL, "Cannot read DH parameters from file %s", dh_file);

@@ -220,9 +216,7 @@ else
 
 int
 tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file,
-#if ENABLE_INLINE_FILES
     const char *pkcs12_file_inline,
-#endif /* ENABLE_INLINE_FILES */
     bool load_ca_file
     )
 {

@@ -240,9 +234,7 @@ tls_ctx_load_cryptoapi(struct tls_root_ctx *ctx, const char *cryptoapi_cert)
 
 void
 tls_ctx_load_cert_file (struct tls_root_ctx *ctx, const char *cert_file,
-#if ENABLE_INLINE_FILES
     const char *cert_file_inline,
-#endif
     openvpn_x509_cert_t **x509
     )
 {

@@ -250,7 +242,6 @@ tls_ctx_load_cert_file (struct tls_root_ctx *ctx, const char *cert_file,
   if (NULL != x509)
     ASSERT(NULL == *x509);
 
-#if ENABLE_INLINE_FILES
   if (!strcmp (cert_file, INLINE_FILE_TAG) && cert_file_inline)
     {
       if (0 != x509parse_crt(ctx->crt_chain, cert_file_inline,

@@ -258,7 +249,6 @@ tls_ctx_load_cert_file (struct tls_root_ctx *ctx, const char *cert_file,
         msg (M_FATAL, "Cannot load inline certificate file");
     }
   else
-#endif /* ENABLE_INLINE_FILES */
     {
       if (0 != x509parse_crtfile(ctx->crt_chain, cert_file))
 	msg (M_FATAL, "Cannot load certificate file %s", cert_file);

@@ -276,16 +266,13 @@ tls_ctx_free_cert_file (openvpn_x509_cert_t *x509)
 }
 
 int
-tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file
-#if ENABLE_INLINE_FILES
-    , const char *priv_key_file_inline
-#endif /* ENABLE_INLINE_FILES */
+tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file,
+    const char *priv_key_file_inline
     )
 {
   int status;
   ASSERT(NULL != ctx);
 
-#if ENABLE_INLINE_FILES
   if (!strcmp (priv_key_file, INLINE_FILE_TAG) && priv_key_file_inline)
     {
       status = x509parse_key(ctx->priv_key,

@@ -301,7 +288,6 @@ tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file
 	}
     }
   else
-#endif /* ENABLE_INLINE_FILES */
     {
       status = x509parse_keyfile(ctx->priv_key, priv_key_file, NULL);
       if (POLARSSL_ERR_PEM_PASSWORD_REQUIRED == status)

@@ -343,23 +329,19 @@ tls_ctx_use_external_private_key (struct tls_root_ctx *ctx, openvpn_x509_cert_t
 #endif
 
 void tls_ctx_load_ca (struct tls_root_ctx *ctx, const char *ca_file,
-#if ENABLE_INLINE_FILES
     const char *ca_file_inline,
-#endif
     const char *ca_path, bool tls_server
     )
 {
   if (ca_path)
       msg(M_FATAL, "ERROR: PolarSSL cannot handle the capath directive");
 
-#if ENABLE_INLINE_FILES
   if (ca_file && !strcmp (ca_file, INLINE_FILE_TAG) && ca_file_inline)
     {
       if (0 != x509parse_crt(ctx->ca_chain, ca_file_inline, strlen(ca_file_inline)));
 	msg (M_FATAL, "Cannot load inline CA certificates");
     }
   else
-#endif
     {
       /* Load CA file for verifying peer supplied certificate */
       if (0 != x509parse_crtfile(ctx->ca_chain, ca_file))

@@ -368,15 +350,12 @@ void tls_ctx_load_ca (struct tls_root_ctx *ctx, const char *ca_file,
 }
 
 void
-tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file
-#if ENABLE_INLINE_FILES
-    , const char *extra_certs_file_inline
-#endif
+tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file,
+    const char *extra_certs_file_inline
     )
 {
   ASSERT(NULL != ctx);
 
-#if ENABLE_INLINE_FILES
   if (!strcmp (extra_certs_file, INLINE_FILE_TAG) && extra_certs_file_inline)
     {
       if (0 != x509parse_crt(ctx->crt_chain, extra_certs_file_inline,

@@ -384,7 +363,6 @@ tls_ctx_load_extra_certs (struct tls_root_ctx *ctx, const char *extra_certs_file
         msg (M_FATAL, "Cannot load inline extra-certs file");
     }
   else
-#endif /* ENABLE_INLINE_FILES */
     {
       if (0 != x509parse_crtfile(ctx->crt_chain, extra_certs_file))
 	msg (M_FATAL, "Cannot load extra-certs file: %s", extra_certs_file);

index 3337764..b1d9584 100644
@@ -650,17 +650,9 @@ socket_defined (const socket_descriptor_t sd)
 #endif
 
 /*
- * Should we allow ca/cert/key files to be
- * included inline, in the configuration file?
- */
-#define ENABLE_INLINE_FILES 1
-
-/*
  * Support "connection" directive
  */
-#if ENABLE_INLINE_FILES
 #define ENABLE_CONNECTION 1
-#endif
 
 /*
  * Should we include http proxy fallback functionality

index 292c3a8..f67745f 100644
@@ -206,8 +206,6 @@ management_callback_http_proxy_fallback_cmd (void *arg, const char *server, cons
 
 #endif
 
-#if MANAGEMENT_QUERY_REMOTE
-
 static bool
 management_callback_remote_cmd (void *arg, const char **p)
 {

@@ -288,15 +286,12 @@ ce_management_query_remote (struct context *c, const char *remote_ip_hint)
   return ret;
 }
 
-#endif
-
 /*
  * Initialize and possibly randomize connection list.
  */
 static void
 init_connection_list (struct context *c)
 {
-#ifdef ENABLE_CONNECTION
   struct connection_list *l = c->options.connection_list;
   if (l)
     {

@@ -317,7 +312,6 @@ init_connection_list (struct context *c)
 	    }
 	}
     }
-#endif
 }
 
 #if 0 /* fixme -- disable for production */

@@ -350,7 +344,6 @@ show_connection_list (const struct connection_list *l)
 static void
 next_connection_entry (struct context *c)
 {
-#ifdef ENABLE_CONNECTION
   struct connection_list *l = c->options.connection_list;
   if (l)
     {

@@ -404,7 +397,6 @@ next_connection_entry (struct context *c)
 
 	c->options.ce = *ce;
 
-#if MANAGEMENT_QUERY_REMOTE
 	if (ce_defined && management && management_query_remote_enabled(management))
 	  {
 	    /* allow management interface to override connection entry details */

@@ -412,7 +404,6 @@ next_connection_entry (struct context *c)
 	    if (IS_SIG (c))
 	      break;
 	  } else
-#endif
 	if (remote_ip_hint)
 	  c->options.ce.remote = remote_ip_hint;
 

@@ -424,7 +415,6 @@ next_connection_entry (struct context *c)
 #endif
       } while (!ce_defined);
     }
-#endif
   update_options_ce_post (&c->options);
 }
 

@@ -3178,9 +3168,7 @@ init_management_callback_p2p (struct context *c)
 #if HTTP_PROXY_FALLBACK
       cb.http_proxy_fallback_cmd = management_callback_http_proxy_fallback_cmd;
 #endif
-#if MANAGEMENT_QUERY_REMOTE
       cb.remote_cmd = management_callback_remote_cmd;
-#endif
       management_set_callback (management, &cb);
     }
 #endif

index 1dddd41..ef5d32c 100644
@@ -92,9 +92,7 @@ man_help ()
   msg (M_CLIENT, "                         where action is reply string.");
   msg (M_CLIENT, "net                    : (Windows only) Show network info and routing table.");
   msg (M_CLIENT, "password type p        : Enter password p for a queried OpenVPN password.");
-#if MANAGEMENT_QUERY_REMOTE
   msg (M_CLIENT, "remote type [host port] : Override remote directive, type=ACCEPT|MOD|SKIP.");
-#endif
   msg (M_CLIENT, "pid                    : Show process ID of the current OpenVPN process.");
 #ifdef ENABLE_PKCS11
   msg (M_CLIENT, "pkcs11-id-count        : Get number of available PKCS#11 identities.");

@@ -1098,8 +1096,6 @@ man_http_proxy_fallback (struct management *man, const char *server, const char
 
 #endif
 
-#if MANAGEMENT_QUERY_REMOTE
-
 static void
 man_remote (struct management *man, const char **p)
 {

@@ -1121,8 +1117,6 @@ man_remote (struct management *man, const char **p)
     }
 }
 
-#endif
-
 static void
 man_dispatch_command (struct management *man, struct status_output *so, const char **p, const int nparms)
 {

@@ -1352,13 +1346,11 @@ man_dispatch_command (struct management *man, struct status_output *so, const ch
       man_http_proxy_fallback (man, NULL, NULL, NULL);
     }
 #endif
-#if MANAGEMENT_QUERY_REMOTE
   else if (streq (p[0], "remote"))
     {
       if (man_need (man, p, 1, MN_AT_LEAST))
 	man_remote (man, p);
     }
-#endif
 #if 1
   else if (streq (p[0], "test"))
     {

index f681f8d..f387c74 100644
@@ -174,9 +174,7 @@ struct management_callback
 #if HTTP_PROXY_FALLBACK
   bool (*http_proxy_fallback_cmd) (void *arg, const char *server, const char *port, const char *flags);
 #endif
-#if MANAGEMENT_QUERY_REMOTE
   bool (*remote_cmd) (void *arg, const char **p);
-#endif
 };
 
 /*

@@ -336,9 +334,7 @@ struct management *management_init (void);
 # define MF_EXTERNAL_KEY    (1<<9)
 #endif
 #define MF_UP_DOWN          (1<<10)
-#if MANAGEMENT_QUERY_REMOTE
 #define MF_QUERY_REMOTE     (1<<11)
-#endif
 
 bool management_open (struct management *man,
 		      const char *addr,

@@ -427,13 +423,11 @@ management_query_user_pass_enabled (const struct management *man)
   return BOOL_CAST(man->settings.flags & MF_QUERY_PASSWORDS);
 }
 
-#if MANAGEMENT_QUERY_REMOTE
 static inline bool
 management_query_remote_enabled (const struct management *man)
 {
   return BOOL_CAST(man->settings.flags & MF_QUERY_REMOTE);
 }
-#endif
 
 #ifdef MANAGEMENT_PF
 static inline bool

index 4b7a976..ea60826 100644
@@ -381,9 +381,7 @@ static const char usage_message[] =
   "                      ip/port rather than listen as a TCP server.\n"
   "--management-query-passwords : Query management channel for private key\n"
   "                  and auth-user-pass passwords.\n"
-#if MANAGEMENT_QUERY_REMOTE
   "--management-query-remote : Query management channel for --remote directive.\n"
-#endif
   "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
   "                    of the management interface explicitly starts it.\n"
   "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"

@@ -931,7 +929,6 @@ setenv_settings (struct env_set *es, const struct options *o)
   setenv_unsigned (es, "daemon_start_time", time(NULL));
   setenv_int (es, "daemon_pid", platform_getpid());
 
-#ifdef ENABLE_CONNECTION
   if (o->connection_list)
     {
       int i;

@@ -939,7 +936,6 @@ setenv_settings (struct env_set *es, const struct options *o)
 	setenv_connection_entry (es, o->connection_list->array[i], i+1);
     }
   else
-#endif
     setenv_connection_entry (es, &o->ce, 1);
 }
 

@@ -1386,7 +1382,6 @@ show_connection_entries (const struct options *o)
 {
   msg (D_SHOW_PARMS, "Connection profiles [default]:");
   show_connection_entry (&o->ce);
-#ifdef ENABLE_CONNECTION
  if (o->connection_list)
    {
      const struct connection_list *l = o->connection_list;

@@ -1397,7 +1392,6 @@ show_connection_entries (const struct options *o)
 	 show_connection_entry (l->array[i]);
        }
    }
-#endif
   msg (D_SHOW_PARMS, "Connection profiles END");
 }
 

@@ -1822,8 +1816,6 @@ options_postprocess_http_proxy_override (struct options *o)
 
 #endif
 
-#if ENABLE_CONNECTION
-
 static struct connection_list *
 alloc_connection_list_if_undef (struct options *options)
 {

@@ -1872,8 +1864,6 @@ alloc_remote_entry (struct options *options, const int msglevel)
   return e;
 }
 
-#endif
-
 void
 connection_entry_load_re (struct connection_entry *ce, const struct remote_entry *re)
 {

@@ -2112,10 +2102,8 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
       if (ce->socks_proxy_server)
 	msg (M_USAGE, "--socks-proxy cannot be used with --mode server");
 #endif
-#ifdef ENABLE_CONNECTION
       if (options->connection_list)
 	msg (M_USAGE, "<connection> cannot be used with --mode server");
-#endif
 #if 0
       if (options->tun_ipv6)
 	msg (M_USAGE, "--tun-ipv6 cannot be used with --mode server");

@@ -2516,7 +2504,6 @@ options_postprocess_mutate_invariant (struct options *options)
 static void
 options_postprocess_verify (const struct options *o)
 {
-#ifdef ENABLE_CONNECTION
   if (o->connection_list)
     {
       int i;

@@ -2524,7 +2511,6 @@ options_postprocess_verify (const struct options *o)
 	options_postprocess_verify_ce (o, o->connection_list->array[i]);
     }
   else
-#endif
     options_postprocess_verify_ce (o, &o->ce);
 }
 

@@ -2541,7 +2527,6 @@ options_postprocess_mutate (struct options *o)
 
   options_postprocess_mutate_invariant (o);
 
-#ifdef ENABLE_CONNECTION
   if (o->remote_list && !o->connection_list)
     {
       /*

@@ -2588,7 +2573,6 @@ options_postprocess_mutate (struct options *o)
 #endif
     }
   else
-#endif
     options_postprocess_mutate_ce (o, &o->ce);  
 
 #if P2MP

@@ -4224,13 +4208,11 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->management_flags |= MF_QUERY_PASSWORDS;
     }
-#if MANAGEMENT_QUERY_REMOTE
   else if (streq (p[0], "management-query-remote"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->management_flags |= MF_QUERY_REMOTE;
     }
-#endif
   else if (streq (p[0], "management-hold"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);

@@ -4434,7 +4416,6 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->remote_random = true;
     }
-#if ENABLE_CONNECTION
   else if (streq (p[0], "connection") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);

@@ -4460,14 +4441,11 @@ add_option (struct options *options,
 	  uninit_options (&sub);
 	}
     }
-#endif
-#ifdef ENABLE_CONNECTION
   else if (streq (p[0], "remote-ip-hint") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->remote_ip_hint = p[1];
     }
-#endif
 #if HTTP_PROXY_FALLBACK
   else if (streq (p[0], "http-proxy-fallback"))
     {

@@ -4512,7 +4490,6 @@ add_option (struct options *options,
 	      re.proto = proto;
 	    }
 	}
-#ifdef ENABLE_CONNECTION
       if (permission_mask & OPT_P_GENERAL)
 	{
 	  struct remote_entry *e = alloc_remote_entry (options, msglevel);

@@ -4521,7 +4498,6 @@ add_option (struct options *options,
 	  *e = re;
 	}
       else if (permission_mask & OPT_P_CONNECTION)
-#endif
 	{
 	  connection_entry_load_re (&options->ce, &re);
 	}

index a2e043d..65ecf7f 100644
@@ -133,7 +133,6 @@ struct connection_entry
 # define CE_HTTP_PROXY_FALLBACK (1<<1)
   time_t ce_http_proxy_fallback_timestamp; /* time when fallback http_proxy_options was last updated */
 #endif
-#if MANAGEMENT_QUERY_REMOTE
 # define CE_MAN_QUERY_REMOTE_UNDEF  0
 # define CE_MAN_QUERY_REMOTE_QUERY  1
 # define CE_MAN_QUERY_REMOTE_ACCEPT 2

@@ -141,7 +140,6 @@ struct connection_entry
 # define CE_MAN_QUERY_REMOTE_SKIP   4
 # define CE_MAN_QUERY_REMOTE_MASK   (0x07)
 # define CE_MAN_QUERY_REMOTE_SHIFT  (2)
-#endif
   unsigned int flags;
 };
 

@@ -152,8 +150,6 @@ struct remote_entry
   int proto;
 };
 
-#ifdef ENABLE_CONNECTION
-
 #define CONNECTION_LIST_SIZE 64
 
 struct connection_list

@@ -171,8 +167,6 @@ struct remote_list
   struct remote_entry *array[CONNECTION_LIST_SIZE];
 };
 
-#endif
-
 #if HTTP_PROXY_FALLBACK
 struct hpo_store
 {

@@ -181,13 +175,11 @@ struct hpo_store
 };
 #endif
 
-#if MANAGEMENT_QUERY_REMOTE
 struct remote_host_store
 {
 # define RH_HOST_LEN 80
   char host[RH_HOST_LEN];
 };
-#endif
 
 /* Command line options */
 struct options

@@ -223,13 +215,10 @@ struct options
 
   /* Networking parms */
   struct connection_entry ce;
-
-#ifdef ENABLE_CONNECTION
   char *remote_ip_hint;
   struct connection_list *connection_list;
   struct remote_list *remote_list;
   bool force_connection_list;
-#endif
 
 #if HTTP_PROXY_FALLBACK
   bool http_proxy_fallback;

@@ -237,9 +226,7 @@ struct options
   struct hpo_store *hpo_store; /* used to store dynamic proxy info given by management interface */
 #endif
 
-#if MANAGEMENT_QUERY_REMOTE
   struct remote_host_store *rh_store;
-#endif
 
   bool remote_random;
   const char *ipchange;

@@ -801,20 +788,14 @@ bool get_ipv6_addr( const char * prefix_str, struct in6_addr *network,
 static inline bool
 connection_list_defined (const struct options *o)
 {
-#ifdef ENABLE_CONNECTION
   return o->connection_list != NULL;
-#else
-  return false;
-#endif
 }
 
 static inline void
 connection_list_set_no_advance (struct options *o)
 {
-#ifdef ENABLE_CONNECTION
   if (o->connection_list)
     o->connection_list->no_advance = true;
-#endif
 }
 
 #if HTTP_PROXY_FALLBACK

index b1d9584..cecc91e 100644
@@ -650,29 +650,15 @@ socket_defined (const socket_descriptor_t sd)
 #endif
 
 /*
- * Support "connection" directive
- */
-#define ENABLE_CONNECTION 1
-
-/*
  * Should we include http proxy fallback functionality
  */
-#if defined(ENABLE_CONNECTION) && defined(ENABLE_MANAGEMENT) && defined(ENABLE_HTTP_PROXY)
+#if defined(ENABLE_MANAGEMENT) && defined(ENABLE_HTTP_PROXY)
 #define HTTP_PROXY_FALLBACK 1
 #else
 #define HTTP_PROXY_FALLBACK 0
 #endif
 
 /*
- * Should we include --management-query-remote functionality
- */
-#if defined(ENABLE_CONNECTION) && defined(ENABLE_MANAGEMENT)
-#define MANAGEMENT_QUERY_REMOTE 1
-#else
-#define MANAGEMENT_QUERY_REMOTE 0
-#endif
-
-/*
  * Reduce sensitivity to system clock instability
  * and backtracks.
  */

index ac2eecd..a898ffb 100644
@@ -1010,7 +1010,6 @@ read_passphrase_hash (const char *passphrase_file,
 		      uint8_t *output,
 		      int len)
 {
-  unsigned int outlen = 0;
   md_ctx_t md;
 
   ASSERT (len >= md_kt_size(digest));

@@ -1343,7 +1342,6 @@ prng_bytes (uint8_t *output, int len)
       const int md_size = md_kt_size (nonce_md);
       while (len > 0)
 	{
-	  unsigned int outlen = 0;
 	  const int blen = min_int (len, md_size);
 	  md_full(nonce_md, nonce_data, md_size + nonce_secret_len, nonce_data);
 	  memcpy (output, nonce_data, blen);

index aecb702..5449a9b 100644
@@ -522,29 +522,25 @@ void
 mroute_helper_add_iroute6 (struct mroute_helper *mh, 
                            const struct iroute_ipv6 *ir6)
 {
-  if (ir6->netbits >= 0)
-    {
-      ASSERT (ir6->netbits < MR_HELPER_NET_LEN);
-      ++mh->cache_generation;
-      ++mh->net_len_refcount[ir6->netbits];
-      if (mh->net_len_refcount[ir6->netbits] == 1)
+  ASSERT (ir6->netbits < MR_HELPER_NET_LEN);
+  ++mh->cache_generation;
+  ++mh->net_len_refcount[ir6->netbits];
+  if (mh->net_len_refcount[ir6->netbits] == 1)
 	mroute_helper_regenerate (mh);
-    }
+
 }
 
 void
 mroute_helper_del_iroute6 (struct mroute_helper *mh, 
 			   const struct iroute_ipv6 *ir6)
 {
-  if (ir6->netbits >= 0)
-    {
-      ASSERT (ir6->netbits < MR_HELPER_NET_LEN);
-      ++mh->cache_generation;
-      --mh->net_len_refcount[ir6->netbits];
-      ASSERT (mh->net_len_refcount[ir6->netbits] >= 0);
-      if (!mh->net_len_refcount[ir6->netbits])
-	mroute_helper_regenerate (mh);
-    }
+   ASSERT (ir6->netbits < MR_HELPER_NET_LEN);
+   ++mh->cache_generation;
+   --mh->net_len_refcount[ir6->netbits];
+   ASSERT (mh->net_len_refcount[ir6->netbits] >= 0);
+   if (!mh->net_len_refcount[ir6->netbits])
+     mroute_helper_regenerate (mh);
+
 }
 
 void

index 9876b80..1a17869 100644
@@ -1164,15 +1164,10 @@ multi_add_iroutes (struct multi_context *m,
 	}
       for ( ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next )
 	{
-	  if (ir6->netbits >= 0)
-	    msg (D_MULTI_LOW, "MULTI: internal route %s/%d -> %s",
+      msg (D_MULTI_LOW, "MULTI: internal route %s/%d -> %s",
 		 print_in6_addr (ir6->network, 0, &gc),
 		 ir6->netbits,
 		 multi_instance_string (mi, false, &gc));
-	  else
-	    msg (D_MULTI_LOW, "MULTI: internal route %s -> %s",
-		 print_in6_addr (ir6->network, 0, &gc),
-		 multi_instance_string (mi, false, &gc));
 
 	  mroute_helper_add_iroute6 (m->route_helper, ir6);
       

index ea60826..64e42aa 100644
@@ -2455,8 +2455,6 @@ options_postprocess_mutate_ce (struct options *o, struct connection_entry *ce)
 static void
 options_postprocess_mutate_invariant (struct options *options)
 {
-  const int dev = dev_type_enum (options->dev, options->dev_type);
-
   /*
    * In forking TCP server mode, you don't need to ifconfig
    * the tap device (the assumption is that it will be bridged).

index d967d4f..4999e66 100644
@@ -2864,7 +2864,6 @@ get_default_gateway (struct route_gateway_info *rgi)
 	{
 	  /* get interface name */
 	  const struct sockaddr_dl *adl = (struct sockaddr_dl *) ifp;
-	  int len = adl->sdl_nlen;
 	  if (adl->sdl_nlen && adl->sdl_nlen < sizeof(rgi->iface))
 	    {
 	      memcpy (rgi->iface, adl->sdl_data, adl->sdl_nlen);

index 19512c0..0272805 100644
@@ -1585,7 +1585,6 @@ key_method_1_write (struct buffer *buf, struct tls_session *session)
 {
   struct key key;
   struct key_state *ks = &session->key[KS_PRIMARY]; 	   /* primary key */
-  struct key_state *ks_lame = &session->key[KS_LAME_DUCK]; /* retiring key */
 
   ASSERT (session->opt->key_method == 1);
   ASSERT (buf_init (buf, 0));

@@ -1697,7 +1696,6 @@ static bool
 key_method_2_write (struct buffer *buf, struct tls_session *session)
 {
   struct key_state *ks = &session->key[KS_PRIMARY]; 	   /* primary key */
-  struct key_state *ks_lame = &session->key[KS_LAME_DUCK]; /* retiring key */
 
   ASSERT (session->opt->key_method == 2);
   ASSERT (buf_init (buf, 0));

@@ -1781,7 +1779,6 @@ key_method_1_read (struct buffer *buf, struct tls_session *session)
   int status;
   struct key key;
   struct key_state *ks = &session->key[KS_PRIMARY]; 	   /* primary key */
-  struct key_state *ks_lame = &session->key[KS_LAME_DUCK]; /* retiring key */
 
   ASSERT (session->opt->key_method == 1);
 

@@ -1840,7 +1837,6 @@ static bool
 key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_session *session)
 {
   struct key_state *ks = &session->key[KS_PRIMARY]; 	   /* primary key */
-  struct key_state *ks_lame = &session->key[KS_LAME_DUCK]; /* retiring key */
 
   int key_method_flags;
   bool username_status, password_status;

index a727b60..57285fa 100644
@@ -428,7 +428,6 @@ tls_ctx_load_priv_file (struct tls_root_ctx *ctx, const char *priv_key_file,
     const char *priv_key_file_inline
     )
 {
-  int status;
   SSL_CTX *ssl_ctx = NULL;
   BIO *in = NULL;
   EVP_PKEY *pkey = NULL;

index f5dce0d..219d0a7 100644
@@ -241,7 +241,7 @@ x509_get_serial (openvpn_x509_cert_t *cert, struct gc_arena *gc)
 unsigned char *
 x509_get_sha1_hash (X509 *cert, struct gc_arena *gc)
 {
-  char *hash = gc_malloc(SHA_DIGEST_LENGTH, false, gc);
+  unsigned char *hash = gc_malloc(SHA_DIGEST_LENGTH, false, gc);
   memcpy(hash, cert->sha1_hash, SHA_DIGEST_LENGTH);
   return hash;
 }

index 78b8344..61d4280 100644
@@ -76,20 +76,20 @@ DigestCalcHA1(
   const md_kt_t *md5_kt = md_kt_get("MD5");
 
   md_ctx_init(&md5_ctx, md5_kt);
-  md_ctx_update(&md5_ctx, pszUserName, strlen(pszUserName));
-  md_ctx_update(&md5_ctx, ":", 1);
-  md_ctx_update(&md5_ctx, pszRealm, strlen(pszRealm));
-  md_ctx_update(&md5_ctx, ":", 1);
-  md_ctx_update(&md5_ctx, pszPassword, strlen(pszPassword));
+  md_ctx_update(&md5_ctx, (const uint8_t*) pszUserName, strlen(pszUserName));
+  md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+  md_ctx_update(&md5_ctx, (const uint8_t*) pszRealm, strlen(pszRealm));
+  md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+  md_ctx_update(&md5_ctx, (const uint8_t*) pszPassword, strlen(pszPassword));
   md_ctx_final(&md5_ctx, HA1);
   if (pszAlg && strcasecmp(pszAlg, "md5-sess") == 0)
     {
       md_ctx_init(&md5_ctx, md5_kt);
       md_ctx_update(&md5_ctx, HA1, HASHLEN);
-      md_ctx_update(&md5_ctx, ":", 1);
-      md_ctx_update(&md5_ctx, pszNonce, strlen(pszNonce));
-      md_ctx_update(&md5_ctx, ":", 1);
-      md_ctx_update(&md5_ctx, pszCNonce, strlen(pszCNonce));
+      md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+      md_ctx_update(&md5_ctx, (const uint8_t*) pszNonce, strlen(pszNonce));
+      md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+      md_ctx_update(&md5_ctx, (const uint8_t*) pszCNonce, strlen(pszCNonce));
       md_ctx_final(&md5_ctx, HA1);
     };
   md_ctx_cleanup(&md5_ctx);

@@ -119,12 +119,12 @@ DigestCalcResponse(
 
   /* calculate H(A2) */
   md_ctx_init(&md5_ctx, md5_kt);
-  md_ctx_update(&md5_ctx, pszMethod, strlen(pszMethod));
-  md_ctx_update(&md5_ctx, ":", 1);
-  md_ctx_update(&md5_ctx, pszDigestUri, strlen(pszDigestUri));
+  md_ctx_update(&md5_ctx, (const uint8_t*) pszMethod, strlen(pszMethod));
+  md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+  md_ctx_update(&md5_ctx, (const uint8_t*) pszDigestUri, strlen(pszDigestUri));
   if (strcasecmp(pszQop, "auth-int") == 0)
     {
-      md_ctx_update(&md5_ctx, ":", 1);
+      md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
       md_ctx_update(&md5_ctx, HEntity, HASHHEXLEN);
     };
   md_ctx_final(&md5_ctx, HA2);

@@ -133,17 +133,17 @@ DigestCalcResponse(
   /* calculate response */
   md_ctx_init(&md5_ctx, md5_kt);
   md_ctx_update(&md5_ctx, HA1, HASHHEXLEN);
-  md_ctx_update(&md5_ctx, ":", 1);
-  md_ctx_update(&md5_ctx, pszNonce, strlen(pszNonce));
-  md_ctx_update(&md5_ctx, ":", 1);
+  md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+  md_ctx_update(&md5_ctx, (const uint8_t*) pszNonce, strlen(pszNonce));
+  md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
   if (*pszQop)
     {
-      md_ctx_update(&md5_ctx, pszNonceCount, strlen(pszNonceCount));
-      md_ctx_update(&md5_ctx, ":", 1);
-      md_ctx_update(&md5_ctx, pszCNonce, strlen(pszCNonce));
-      md_ctx_update(&md5_ctx, ":", 1);
-      md_ctx_update(&md5_ctx, pszQop, strlen(pszQop));
-      md_ctx_update(&md5_ctx, ":", 1);
+      md_ctx_update(&md5_ctx, (const uint8_t*) pszNonceCount, strlen(pszNonceCount));
+      md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+      md_ctx_update(&md5_ctx, (const uint8_t*) pszCNonce, strlen(pszCNonce));
+      md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
+      md_ctx_update(&md5_ctx, (const uint8_t*) pszQop, strlen(pszQop));
+      md_ctx_update(&md5_ctx, (const uint8_t*) ":", 1);
     };
   md_ctx_update(&md5_ctx, HA2Hex, HASHHEXLEN);
   md_ctx_final(&md5_ctx, RespHash);

index 3390bdd..c7cf3d4 100644
@@ -77,9 +77,9 @@ gen_md4_hash (const char* data, int data_len, char *result)
 {
   /* result is 16 byte md4 hash */
   const md_kt_t *md4_kt = md_kt_get("MD4");
-  char md[MD4_DIGEST_LENGTH];
+  unsigned char md[MD4_DIGEST_LENGTH];
 
-  md_full(md4_kt, data, data_len, md);
+  md_full(md4_kt, (const uint8_t*) data, data_len, md);
   memcpy (result, md, MD4_DIGEST_LENGTH);
 }
 

@@ -90,7 +90,7 @@ gen_hmac_md5 (const char* data, int data_len, const char* key, int key_len,char
 	hmac_ctx_t hmac_ctx;
 	CLEAR(hmac_ctx);
 
-	hmac_ctx_init(&hmac_ctx, key, key_len, md5_kt);
+	hmac_ctx_init(&hmac_ctx, (const uint8_t*) key, key_len, md5_kt);
 	hmac_ctx_update(&hmac_ctx, (const unsigned char *)data, data_len);
 	hmac_ctx_final(&hmac_ctx, (unsigned char *)result);
 	hmac_ctx_cleanup(&hmac_ctx);

@@ -197,7 +197,7 @@ ntlm_phase_3 (const struct http_proxy_info *p, const char *phase_2, struct gc_ar
   unsigned char phase3[464];
 
   char md4_hash[MD4_DIGEST_LENGTH+5];
-  char challenge[8], ntlm_response[24];
+  unsigned char challenge[8], ntlm_response[24];
   int i, ret_val;
 
 	char ntlmv2_response[144];