openvpn: T8264: reject the raw options DCO cannot serve

Raw options are appended after --config and therefore override what the CLI
rendered, so they have to face the same checks. A single cipher the Kernel
module does not implement makes OpenVPN fall back to the userspace data path;
"ncp-ciphers" is the 2.4 name for the negotiation list, and outside server and
pull mode "cipher" becomes the fallback cipher. "dev-type" other than tun, an
AF_UNIX "dev-node" and, in server mode, a "topology" other than subnet drop
the offload just the same.

"DEFAULT" stands for the built-in list, which OpenVPN expands to AEAD ciphers
alone before it weighs the offload, and the migration drops the offload from
whatever stays rejected.

0 files changed, 0 insertions, 0 deletions