From: Frank Lichtenheld <frank@lichtenheld.com>
Date: Wed, 17 Sep 2025 17:04:19 +0000 (+0200)
Subject: Introduce msglvl_t to unify msglevel type handling
X-Git-Tag: v2.7_beta2~20
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cc8cd311749dc90bb056cfedd9129677090bc7b0;p=thirdparty%2Fopenvpn.git

Introduce msglvl_t to unify msglevel type handling

msglevel was definitely unsigned as the first
argument to msg(), but many parts of the code
had it as signed. So this produced a LOT of
warnings when enabling -Wsign-conversion.

Introduce a msglvl_t typedef and switch all
users to it. This includes any values that
are stored in the msglevel field, including
debug level and mute level.

There is one exception in struct status_output
where -1 is a valid value in the API. Only
positive values are translated into standard
message levels.

Change-Id: Id492cb774c6d022d06bb3cf5fec2a4bdd410e619
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1110
Message-Id: <20250917170428.3310-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg33028.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
---

diff --git a/src/openvpn/argv.c b/src/openvpn/argv.c
index 903fc0a57..79b541a97 100644
--- a/src/openvpn/argv.c
+++ b/src/openvpn/argv.c
@@ -235,14 +235,14 @@ argv_str(const struct argv *a, struct gc_arena *gc, const unsigned int flags)
 /**
  *  Write the arguments stored in a struct argv via the msg() command.
  *
- *  @param msglev  Integer with the message level used by msg().
- *  @param a       Valid pointer to the struct argv with the arguments to write.
+ *  @param msglevel  Integer with the message level used by msg().
+ *  @param a         Valid pointer to the struct argv with the arguments to write.
  */
 void
-argv_msg(const int msglev, const struct argv *a)
+argv_msg(const msglvl_t msglevel, const struct argv *a)
 {
     struct gc_arena gc = gc_new();
-    msg(msglev, "%s", argv_str(a, &gc, 0));
+    msg(msglevel, "%s", argv_str(a, &gc, 0));
     gc_free(&gc);
 }
 
@@ -250,16 +250,16 @@ argv_msg(const int msglev, const struct argv *a)
  *  Similar to argv_msg() but prefixes the messages being written with a
  *  given string.
  *
- *  @param msglev  Integer with the message level used by msg().
- *  @param a       Valid pointer to the struct argv with the arguments to write
- *  @param prefix  Valid pointer to the prefix string
+ *  @param msglevel  Integer with the message level used by msg().
+ *  @param a         Valid pointer to the struct argv with the arguments to write
+ *  @param prefix    Valid pointer to the prefix string
  *
  */
 void
-argv_msg_prefix(const int msglev, const struct argv *a, const char *prefix)
+argv_msg_prefix(const msglvl_t msglevel, const struct argv *a, const char *prefix)
 {
     struct gc_arena gc = gc_new();
-    msg(msglev, "%s: %s", prefix, argv_str(a, &gc, 0));
+    msg(msglevel, "%s: %s", prefix, argv_str(a, &gc, 0));
     gc_free(&gc);
 }
 
diff --git a/src/openvpn/argv.h b/src/openvpn/argv.h
index 056fe31ca..969d7b12c 100644
--- a/src/openvpn/argv.h
+++ b/src/openvpn/argv.h
@@ -47,9 +47,9 @@ const char *argv_str(const struct argv *a, struct gc_arena *gc, const unsigned i
 
 struct argv argv_insert_head(const struct argv *a, const char *head);
 
-void argv_msg(const int msglev, const struct argv *a);
+void argv_msg(const msglvl_t msglevel, const struct argv *a);
 
-void argv_msg_prefix(const int msglev, const struct argv *a, const char *prefix);
+void argv_msg_prefix(const msglvl_t msglevel, const struct argv *a, const char *prefix);
 
 void argv_parse_cmd(struct argv *a, const char *s);
 
diff --git a/src/openvpn/buffer.c b/src/openvpn/buffer.c
index 0f0d17e0f..c0b85b210 100644
--- a/src/openvpn/buffer.c
+++ b/src/openvpn/buffer.c
@@ -1127,7 +1127,7 @@ valign4(const struct buffer *buf, const char *file, const int line)
 {
     if (buf && buf->len)
     {
-        int msglevel = D_ALIGN_DEBUG;
+        msglvl_t msglevel = D_ALIGN_DEBUG;
         const unsigned int u = (unsigned int)BPTR(buf);
 
         if (u & (PAYLOAD_ALIGN - 1))
diff --git a/src/openvpn/clinat.c b/src/openvpn/clinat.c
index 48a205717..b49d4bb3e 100644
--- a/src/openvpn/clinat.c
+++ b/src/openvpn/clinat.c
@@ -47,7 +47,7 @@ add_entry(struct client_nat_option_list *dest, const struct client_nat_entry *e)
 }
 
 void
-print_client_nat_list(const struct client_nat_option_list *list, int msglevel)
+print_client_nat_list(const struct client_nat_option_list *list, msglvl_t msglevel)
 {
     struct gc_arena gc = gc_new();
     int i;
@@ -101,7 +101,7 @@ copy_client_nat_option_list(struct client_nat_option_list *dest,
 void
 add_client_nat_to_option_list(struct client_nat_option_list *dest, const char *type,
                               const char *network, const char *netmask, const char *foreign_network,
-                              int msglevel)
+                              msglvl_t msglevel)
 {
     struct client_nat_entry e;
     bool ok;
@@ -159,7 +159,7 @@ print_checksum(struct openvpn_iphdr *iph, const char *prefix)
 #endif
 
 static void
-print_pkt(struct openvpn_iphdr *iph, const char *prefix, const int direction, const int msglevel)
+print_pkt(struct openvpn_iphdr *iph, const char *prefix, const int direction, const msglvl_t msglevel)
 {
     struct gc_arena gc = gc_new();
 
diff --git a/src/openvpn/clinat.h b/src/openvpn/clinat.h
index abfa0b732..7d787e086 100644
--- a/src/openvpn/clinat.h
+++ b/src/openvpn/clinat.h
@@ -54,11 +54,11 @@ struct client_nat_option_list *clone_client_nat_option_list(
 void copy_client_nat_option_list(struct client_nat_option_list *dest,
                                  const struct client_nat_option_list *src);
 
-void print_client_nat_list(const struct client_nat_option_list *list, int msglevel);
+void print_client_nat_list(const struct client_nat_option_list *list, msglvl_t msglevel);
 
 void add_client_nat_to_option_list(struct client_nat_option_list *dest, const char *type,
                                    const char *network, const char *netmask,
-                                   const char *foreign_network, int msglevel);
+                                   const char *foreign_network, msglvl_t msglevel);
 
 void client_nat_transform(const struct client_nat_option_list *list, struct buffer *ipbuf,
                           const int direction);
diff --git a/src/openvpn/comp.c b/src/openvpn/comp.c
index 1a2e775c4..9d3514142 100644
--- a/src/openvpn/comp.c
+++ b/src/openvpn/comp.c
@@ -159,7 +159,7 @@ comp_generate_peer_info_string(const struct compress_options *opt, struct buffer
 #endif /* USE_COMP */
 
 bool
-check_compression_settings_valid(struct compress_options *info, int msglevel)
+check_compression_settings_valid(struct compress_options *info, msglvl_t msglevel)
 {
     /*
      * We also allow comp-stub-v2 here as it technically allows escaping of
diff --git a/src/openvpn/comp.h b/src/openvpn/comp.h
index 0354896fc..1717029ca 100644
--- a/src/openvpn/comp.h
+++ b/src/openvpn/comp.h
@@ -84,12 +84,14 @@ comp_non_stub_enabled(const struct compress_options *info)
            && info->alg != COMP_ALG_UNDEF;
 }
 
+#include "error.h"
+
 /**
  * Checks if the compression settings are valid. Takes into account the
  * flags of allow-compression and also the whether algorithms are compiled
  * in
  */
-bool check_compression_settings_valid(struct compress_options *info, int msglevel);
+bool check_compression_settings_valid(struct compress_options *info, msglvl_t msglevel);
 
 #ifdef USE_COMP
 #include "buffer.h"
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 4c0f684c7..0abcd7f43 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -1609,7 +1609,7 @@ must_have_n_keys(const char *filename, const char *option, const struct key2 *ke
 }
 
 int
-ascii2keydirection(int msglevel, const char *str)
+ascii2keydirection(msglvl_t msglevel, const char *str)
 {
     if (!str)
     {
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index efd7f6052..d69db59f1 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -618,7 +618,7 @@ void verify_fix_key2(struct key2 *key2, const struct key_type *kt, const char *s
 
 void must_have_n_keys(const char *filename, const char *option, const struct key2 *key2, int n);
 
-int ascii2keydirection(int msglevel, const char *str);
+int ascii2keydirection(msglvl_t msglevel, const char *str);
 
 const char *keydirection2ascii(int kd, bool remote, bool humanreadable);
 
diff --git a/src/openvpn/dco.c b/src/openvpn/dco.c
index 70a8c0a19..881459ce3 100644
--- a/src/openvpn/dco.c
+++ b/src/openvpn/dco.c
@@ -233,7 +233,7 @@ dco_update_keys(dco_context_t *dco, struct tls_multi *multi)
 }
 
 static bool
-dco_check_option_ce(const struct connection_entry *ce, int msglevel, int mode)
+dco_check_option_ce(const struct connection_entry *ce, msglvl_t msglevel, int mode)
 {
     if (ce->fragment)
     {
@@ -293,7 +293,7 @@ dco_check_option_ce(const struct connection_entry *ce, int msglevel, int mode)
 }
 
 bool
-dco_check_startup_option(int msglevel, const struct options *o)
+dco_check_startup_option(msglvl_t msglevel, const struct options *o)
 {
     /* check if no dev name was specified at all. In the case,
      * later logic will most likely stop OpenVPN, so no need to
@@ -430,7 +430,7 @@ dco_check_startup_option(int msglevel, const struct options *o)
 }
 
 bool
-dco_check_option(int msglevel, const struct options *o)
+dco_check_option(msglvl_t msglevel, const struct options *o)
 {
     /* At this point the ciphers have already been normalised */
     if (o->enable_ncp_fallback
@@ -480,7 +480,7 @@ dco_check_option(int msglevel, const struct options *o)
 }
 
 bool
-dco_check_pull_options(int msglevel, const struct options *o)
+dco_check_pull_options(msglvl_t msglevel, const struct options *o)
 {
     if (!o->use_peer_id)
     {
diff --git a/src/openvpn/dco.h b/src/openvpn/dco.h
index 59acb188c..a362977e1 100644
--- a/src/openvpn/dco.h
+++ b/src/openvpn/dco.h
@@ -55,7 +55,7 @@ struct tuntap;
  * @param msglevel      level to print messages to
  * @return              true if ovpn-dco is available, false otherwise
  */
-bool dco_available(int msglevel);
+bool dco_available(msglvl_t msglevel);
 
 
 /**
@@ -75,7 +75,7 @@ const char *dco_version_string(struct gc_arena *gc);
  * @param o         the options struct that hold the options
  * @return          true if no conflict was detected, false otherwise
  */
-bool dco_check_option(int msglevel, const struct options *o);
+bool dco_check_option(msglvl_t msglevel, const struct options *o);
 
 /**
  * Check whether the options struct has any further option that is not supported
@@ -87,7 +87,7 @@ bool dco_check_option(int msglevel, const struct options *o);
  * @param o         the options struct that hold the options
  * @return          true if no conflict was detected, false otherwise
  */
-bool dco_check_startup_option(int msglevel, const struct options *o);
+bool dco_check_startup_option(msglvl_t msglevel, const struct options *o);
 
 /**
  * Check whether any of the options pushed by the server is not supported by
@@ -98,7 +98,7 @@ bool dco_check_startup_option(int msglevel, const struct options *o);
  * @param o         the options struct that hold the options
  * @return          true if no conflict was detected, false otherwise
  */
-bool dco_check_pull_options(int msglevel, const struct options *o);
+bool dco_check_pull_options(msglvl_t msglevel, const struct options *o);
 
 /**
  * Initialize the DCO context
@@ -261,7 +261,7 @@ dco_supports_epoch_data(struct context *c)
 typedef void *dco_context_t;
 
 static inline bool
-dco_available(int msglevel)
+dco_available(msglvl_t msglevel)
 {
     return false;
 }
@@ -273,19 +273,19 @@ dco_version_string(struct gc_arena *gc)
 }
 
 static inline bool
-dco_check_option(int msglevel, const struct options *o)
+dco_check_option(msglvl_t msglevel, const struct options *o)
 {
     return false;
 }
 
 static inline bool
-dco_check_startup_option(int msglevel, const struct options *o)
+dco_check_startup_option(msglvl_t msglevel, const struct options *o)
 {
     return false;
 }
 
 static inline bool
-dco_check_pull_options(int msglevel, const struct options *o)
+dco_check_pull_options(msglvl_t msglevel, const struct options *o)
 {
     return false;
 }
diff --git a/src/openvpn/dco_freebsd.c b/src/openvpn/dco_freebsd.c
index 65303cd4d..d5ca27767 100644
--- a/src/openvpn/dco_freebsd.c
+++ b/src/openvpn/dco_freebsd.c
@@ -658,7 +658,7 @@ dco_do_read(dco_context_t *dco)
 }
 
 bool
-dco_available(int msglevel)
+dco_available(msglvl_t msglevel)
 {
     struct if_clonereq ifcr;
     char *buf = NULL;
diff --git a/src/openvpn/dco_linux.c b/src/openvpn/dco_linux.c
index 40674e7f4..d8357ca89 100644
--- a/src/openvpn/dco_linux.c
+++ b/src/openvpn/dco_linux.c
@@ -74,7 +74,7 @@ typedef int (*ovpn_nl_cb)(struct nl_msg *msg, void *arg);
  * @return ID on success, negative error code on error
  */
 static int
-resolve_ovpn_netlink_id(int msglevel)
+resolve_ovpn_netlink_id(msglvl_t msglevel)
 {
     int ret;
     struct nl_sock *nl_sock = nl_socket_alloc();
@@ -1199,7 +1199,7 @@ dco_get_peer_stats_multi(dco_context_t *dco, const bool raise_sigusr1_on_err)
 }
 
 bool
-dco_available(int msglevel)
+dco_available(msglvl_t msglevel)
 {
     if (resolve_ovpn_netlink_id(D_DCO_DEBUG) < 0)
     {
diff --git a/src/openvpn/dco_win.c b/src/openvpn/dco_win.c
index 01ba017e1..2d08ed82b 100644
--- a/src/openvpn/dco_win.c
+++ b/src/openvpn/dco_win.c
@@ -599,7 +599,7 @@ dco_swap_keys(dco_context_t *dco, unsigned int peer_id)
 }
 
 bool
-dco_available(int msglevel)
+dco_available(msglvl_t msglevel)
 {
     /* try to open device by symbolic name */
     HANDLE h = CreateFile("\\\\.\\ovpn-dco", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING,
diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c
index 542100496..efb888ad1 100644
--- a/src/openvpn/dns.c
+++ b/src/openvpn/dns.c
@@ -200,7 +200,7 @@ dns_server_get(struct dns_server **entry, long priority, struct gc_arena *gc)
 }
 
 bool
-dns_options_verify(int msglevel, const struct dns_options *o)
+dns_options_verify(msglvl_t msglevel, const struct dns_options *o)
 {
     const struct dns_server *server = o->servers ? o->servers : o->servers_prepull;
     while (server)
diff --git a/src/openvpn/dns.h b/src/openvpn/dns.h
index 6d97b40b5..6cd98f297 100644
--- a/src/openvpn/dns.h
+++ b/src/openvpn/dns.h
@@ -166,7 +166,7 @@ bool dns_server_addr_parse(struct dns_server *server, const char *addr);
  * @param   o           Pointer to the DNS options to validate
  * @return              True if no error was found
  */
-bool dns_options_verify(int msglevel, const struct dns_options *o);
+bool dns_options_verify(msglvl_t msglevel, const struct dns_options *o);
 
 /**
  * Makes a deep copy of the passed DNS options.
diff --git a/src/openvpn/env_set.c b/src/openvpn/env_set.c
index 6c7df8ebd..2ae71ab43 100644
--- a/src/openvpn/env_set.c
+++ b/src/openvpn/env_set.c
@@ -209,7 +209,7 @@ env_set_get(const struct env_set *es, const char *name)
 }
 
 void
-env_set_print(int msglevel, const struct env_set *es)
+env_set_print(msglvl_t msglevel, const struct env_set *es)
 {
     if (check_debug_level(msglevel))
     {
diff --git a/src/openvpn/env_set.h b/src/openvpn/env_set.h
index 3973a4ee2..ddcfa144b 100644
--- a/src/openvpn/env_set.h
+++ b/src/openvpn/env_set.h
@@ -85,7 +85,7 @@ void env_set_add(struct env_set *es, const char *str);
 
 const char *env_set_get(const struct env_set *es, const char *name);
 
-void env_set_print(int msglevel, const struct env_set *es);
+void env_set_print(msglvl_t msglevel, const struct env_set *es);
 
 /**
  * Write a struct env_set to a file. Each item on one line.
diff --git a/src/openvpn/error.c b/src/openvpn/error.c
index 1b98235b1..58c2fd1d7 100644
--- a/src/openvpn/error.c
+++ b/src/openvpn/error.c
@@ -48,12 +48,12 @@
 #endif
 
 /* Globals */
-unsigned int x_debug_level; /* GLOBAL */
+msglvl_t x_debug_level; /* GLOBAL */
 
 /* Mute state */
-static int mute_cutoff;   /* GLOBAL */
-static int mute_count;    /* GLOBAL */
-static int mute_category; /* GLOBAL */
+static int mute_cutoff;        /* GLOBAL */
+static int mute_count;         /* GLOBAL */
+static msglvl_t mute_category; /* GLOBAL */
 
 /*
  * Output mode priorities are as follows:
@@ -103,16 +103,14 @@ msg_forked(void)
 bool
 set_debug_level(const int level, const unsigned int flags)
 {
-    const int ceiling = 15;
-
-    if (level >= 0 && level <= ceiling)
+    if (level >= 0 && level <= M_DEBUG_LEVEL)
     {
-        x_debug_level = level;
+        x_debug_level = (msglvl_t)level;
         return true;
     }
     else if (flags & SDL_CONSTRAIN)
     {
-        x_debug_level = constrain_int(level, 0, ceiling);
+        x_debug_level = (msglvl_t)constrain_int(level, 0, M_DEBUG_LEVEL);
         return true;
     }
     return false;
@@ -132,7 +130,7 @@ set_mute_cutoff(const int cutoff)
     }
 }
 
-int
+msglvl_t
 get_debug_level(void)
 {
     return x_debug_level;
@@ -190,7 +188,7 @@ errors_to_stderr(void)
  * Return a file to print messages to before syslog is opened.
  */
 FILE *
-msg_fp(const unsigned int flags)
+msg_fp(const msglvl_t flags)
 {
     FILE *fp = msgfp;
     if (!fp)
@@ -214,7 +212,7 @@ msg_fp(const unsigned int flags)
 int x_msg_line_num; /* GLOBAL */
 
 void
-x_msg(const unsigned int flags, const char *format, ...)
+x_msg(const msglvl_t flags, const char *format, ...)
 {
     va_list arglist;
     va_start(arglist, format);
@@ -235,7 +233,7 @@ openvpn_strerror(int err, bool crt_error, struct gc_arena *gc)
 }
 
 void
-x_msg_va(const unsigned int flags, const char *format, va_list arglist)
+x_msg_va(const msglvl_t flags, const char *format, va_list arglist)
 {
     struct gc_arena gc;
 #if SYSLOG_CAPABILITY
@@ -385,13 +383,13 @@ x_msg_va(const unsigned int flags, const char *format, va_list arglist)
  * Apply muting filter.
  */
 bool
-dont_mute(unsigned int flags)
+dont_mute(msglvl_t flags)
 {
     bool ret = true;
     if (mute_cutoff > 0 && !(flags & M_NOMUTE))
     {
-        const int mute_level = DECODE_MUTE_LEVEL(flags);
-        if (mute_level > 0 && mute_level == mute_category)
+        const msglvl_t mute_level = DECODE_MUTE_LEVEL(flags);
+        if (mute_level == mute_category)
         {
             if (mute_count == mute_cutoff)
             {
@@ -750,7 +748,7 @@ openvpn_exit(const int status)
  * Translate msg flags into a string
  */
 const char *
-msg_flags_string(const unsigned int flags, struct gc_arena *gc)
+msg_flags_string(const msglvl_t flags, struct gc_arena *gc)
 {
     struct buffer out = alloc_buf_gc(16, gc);
     if (flags == M_INFO)
diff --git a/src/openvpn/error.h b/src/openvpn/error.h
index 8388f82c9..2913498f5 100644
--- a/src/openvpn/error.h
+++ b/src/openvpn/error.h
@@ -74,31 +74,33 @@ const char *strerror_win32(DWORD errnum, struct gc_arena *gc);
 #define openvpn_errno() errno
 #endif
 
+typedef unsigned int msglvl_t;
+
 /*
  * These globals should not be accessed directly,
  * but rather through macros or inline functions defined below.
  */
-extern unsigned int x_debug_level;
+extern msglvl_t x_debug_level;
 extern int x_msg_line_num;
 
 /* msg() flags */
 
-#define M_DEBUG_LEVEL (0x0F) /* debug level mask */
+#define M_DEBUG_LEVEL (0x0Fu) /* debug level mask */
 
-#define M_FATAL    (1 << 4)  /* exit program */
-#define M_NONFATAL (1 << 5)  /* non-fatal error */
-#define M_WARN     (1 << 6)  /* call syslog with LOG_WARNING */
-#define M_DEBUG    (1 << 7)
+#define M_FATAL    (1u << 4)  /* exit program */
+#define M_NONFATAL (1u << 5)  /* non-fatal error */
+#define M_WARN     (1u << 6)  /* call syslog with LOG_WARNING */
+#define M_DEBUG    (1u << 7)
 
-#define M_ERRNO (1 << 8)         /* show errno description */
+#define M_ERRNO (1u << 8)         /* show errno description */
 
-#define M_NOMUTE       (1 << 11) /* don't do mute processing */
-#define M_NOPREFIX     (1 << 12) /* don't show date/time prefix */
-#define M_USAGE_SMALL  (1 << 13) /* fatal options error, call usage_small */
-#define M_MSG_VIRT_OUT (1 << 14) /* output message through msg_status_output callback */
-#define M_OPTERR       (1 << 15) /* print "Options error:" prefix */
-#define M_NOLF         (1 << 16) /* don't print new line */
-#define M_NOIPREFIX    (1 << 17) /* don't print instance prefix */
+#define M_NOMUTE       (1u << 11) /* don't do mute processing */
+#define M_NOPREFIX     (1u << 12) /* don't show date/time prefix */
+#define M_USAGE_SMALL  (1u << 13) /* fatal options error, call usage_small */
+#define M_MSG_VIRT_OUT (1u << 14) /* output message through msg_status_output callback */
+#define M_OPTERR       (1u << 15) /* print "Options error:" prefix */
+#define M_NOLF         (1u << 16) /* don't print new line */
+#define M_NOIPREFIX    (1u << 17) /* don't print instance prefix */
 
 /* flag combinations which are frequently used */
 #define M_ERR    (M_FATAL | M_ERRNO)
@@ -112,7 +114,7 @@ extern int x_msg_line_num;
  * A mute level of 0 is always printed.
  */
 #define MUTE_LEVEL_SHIFT 24
-#define MUTE_LEVEL_MASK  0xFF
+#define MUTE_LEVEL_MASK  0xFFu
 
 #define ENCODE_MUTE_LEVEL(mute_level) (((mute_level) & MUTE_LEVEL_MASK) << MUTE_LEVEL_SHIFT)
 #define DECODE_MUTE_LEVEL(flags)      (((flags) >> MUTE_LEVEL_SHIFT) & MUTE_LEVEL_MASK)
@@ -135,7 +137,7 @@ extern int x_msg_line_num;
  */
 
 /** Check muting filter */
-bool dont_mute(unsigned int flags);
+bool dont_mute(msglvl_t flags);
 
 /* Macro to ensure (and teach static analysis tools) we exit on fatal errors */
 #define EXIT_FATAL(flags)      \
@@ -170,7 +172,7 @@ bool dont_mute(unsigned int flags);
 #define dmsg(flags, ...)
 #endif
 
-void x_msg(const unsigned int flags, const char *format, ...)
+void x_msg(const msglvl_t flags, const char *format, ...)
 #ifdef __GNUC__
 #if __USE_MINGW_ANSI_STDIO
     __attribute__((format(gnu_printf, 2, 3)))
@@ -180,7 +182,7 @@ void x_msg(const unsigned int flags, const char *format, ...)
 #endif
     ; /* should be called via msg above */
 
-void x_msg_va(const unsigned int flags, const char *format, va_list arglist);
+void x_msg_va(const msglvl_t flags, const char *format, va_list arglist);
 
 /*
  * Function prototypes
@@ -201,16 +203,16 @@ bool set_debug_level(const int level, const unsigned int flags);
 
 bool set_mute_cutoff(const int cutoff);
 
-int get_debug_level(void);
+msglvl_t get_debug_level(void);
 
 int get_mute_cutoff(void);
 
-const char *msg_flags_string(const unsigned int flags, struct gc_arena *gc);
+const char *msg_flags_string(const msglvl_t flags, struct gc_arena *gc);
 
 /*
  * File to print messages to before syslog is opened.
  */
-FILE *msg_fp(const unsigned int flags);
+FILE *msg_fp(const msglvl_t flags);
 
 /* Fatal logic errors */
 #ifndef ENABLE_SMALL
@@ -254,14 +256,14 @@ assert_failed(const char *filename, int line, const char *condition)
 /* Inline functions */
 
 static inline bool
-check_debug_level(unsigned int level)
+check_debug_level(msglvl_t level)
 {
     return (level & M_DEBUG_LEVEL) <= x_debug_level;
 }
 
 /** Return true if flags represent an enabled, not muted log level */
 static inline bool
-msg_test(unsigned int flags)
+msg_test(msglvl_t flags)
 {
     return check_debug_level(flags) && dont_mute(flags);
 }
@@ -400,8 +402,8 @@ ignore_sys_error(const int err, bool crt_error)
 }
 
 /** Convert fatal errors to nonfatal, don't touch other errors */
-static inline unsigned int
-nonfatal(const unsigned int err)
+static inline msglvl_t
+nonfatal(const msglvl_t err)
 {
     return err & M_FATAL ? (err ^ M_FATAL) | M_NONFATAL : err;
 }
diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index 5d22fa36a..12dd6a713 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -368,7 +368,8 @@ check_connection_established(struct context *c)
 }
 
 bool
-send_control_channel_string_dowork(struct tls_session *session, const char *str, int msglevel)
+send_control_channel_string_dowork(struct tls_session *session, const char *str,
+                                   msglvl_t msglevel)
 {
     struct gc_arena gc = gc_new();
     bool stat;
@@ -395,7 +396,7 @@ reschedule_multi_process(struct context *c)
 }
 
 bool
-send_control_channel_string(struct context *c, const char *str, int msglevel)
+send_control_channel_string(struct context *c, const char *str, msglvl_t msglevel)
 {
     if (c->c2.tls_multi)
     {
diff --git a/src/openvpn/forward.h b/src/openvpn/forward.h
index 79d0f8b5f..a575fafe4 100644
--- a/src/openvpn/forward.h
+++ b/src/openvpn/forward.h
@@ -285,7 +285,7 @@ void process_outgoing_tun(struct context *c, struct link_socket *in_sock);
  * @param str        - The message to be sent
  * @param msglevel   - Message level to use for logging
  */
-bool send_control_channel_string(struct context *c, const char *str, int msglevel);
+bool send_control_channel_string(struct context *c, const char *str, msglvl_t msglevel);
 
 /*
  * Send a string to remote over the TLS control channel.
@@ -303,7 +303,8 @@ bool send_control_channel_string(struct context *c, const char *str, int msgleve
  * @param msglevel   - Message level to use for logging
  */
 
-bool send_control_channel_string_dowork(struct tls_session *session, const char *str, int msglevel);
+bool send_control_channel_string_dowork(struct tls_session *session, const char *str,
+                                        msglvl_t msglevel);
 
 
 /**
diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index 2821cd445..0d7a2ec40 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -4273,7 +4273,7 @@ management_callback_status_p2p(void *arg, const int version, struct status_outpu
 }
 
 void
-management_show_net_callback(void *arg, const int msglevel)
+management_show_net_callback(void *arg, const msglvl_t msglevel)
 {
 #ifdef _WIN32
     show_routes(msglevel);
diff --git a/src/openvpn/init.h b/src/openvpn/init.h
index a807874c1..e89615bcb 100644
--- a/src/openvpn/init.h
+++ b/src/openvpn/init.h
@@ -136,7 +136,7 @@ bool open_management(struct context *c);
 
 void close_management(void);
 
-void management_show_net_callback(void *arg, const int msglevel);
+void management_show_net_callback(void *arg, const msglvl_t msglevel);
 
 #endif
 
diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 4decdfe97..c675e9530 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -1475,7 +1475,7 @@ man_dispatch_command(struct management *man, struct status_output *so, const cha
         }
         else
         {
-            msg(M_CLIENT, "SUCCESS: verb=%d", get_debug_level());
+            msg(M_CLIENT, "SUCCESS: verb=%u", get_debug_level());
         }
     }
     else if (streq(p[0], "mute"))
diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h
index 7c189ba7e..bff96d328 100644
--- a/src/openvpn/manage.h
+++ b/src/openvpn/manage.h
@@ -176,7 +176,7 @@ struct management_callback
     unsigned int flags;
 
     void (*status)(void *arg, const int version, struct status_output *so);
-    void (*show_net)(void *arg, const int msglevel);
+    void (*show_net)(void *arg, const msglvl_t msglevel);
     int (*kill_by_cn)(void *arg, const char *common_name);
     int (*kill_by_addr)(void *arg, const in_addr_t addr, const int port, const int proto);
     void (*delete_event)(void *arg, event_t event);
diff --git a/src/openvpn/mtu.c b/src/openvpn/mtu.c
index a419e32d6..9c1a7727d 100644
--- a/src/openvpn/mtu.c
+++ b/src/openvpn/mtu.c
@@ -187,7 +187,7 @@ calc_options_string_link_mtu(const struct options *o, const struct frame *frame)
 }
 
 void
-frame_print(const struct frame *frame, int level, const char *prefix)
+frame_print(const struct frame *frame, msglvl_t msglevel, const char *prefix)
 {
     struct gc_arena gc = gc_new();
     struct buffer out = alloc_buf_gc(256, &gc);
@@ -208,7 +208,7 @@ frame_print(const struct frame *frame, int level, const char *prefix)
     buf_printf(&out, " ET:%d", frame->extra_tun);
     buf_printf(&out, " ]");
 
-    msg(level, "%s", out.data);
+    msg(msglevel, "%s", out.data);
     gc_free(&gc);
 }
 
diff --git a/src/openvpn/mtu.h b/src/openvpn/mtu.h
index c092461d0..3bbff6f65 100644
--- a/src/openvpn/mtu.h
+++ b/src/openvpn/mtu.h
@@ -181,7 +181,7 @@ struct options;
  * Function prototypes.
  */
 
-void frame_print(const struct frame *frame, int level, const char *prefix);
+void frame_print(const struct frame *frame, msglvl_t msglevel, const char *prefix);
 
 void set_mtu_discover_type(socket_descriptor_t sd, int mtu_type, sa_family_t proto_af);
 
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 6e4cc4200..8676a0979 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -3316,7 +3316,7 @@ multi_process_incoming_dco(struct multi_context *m)
     }
     else
     {
-        int msglevel = D_DCO;
+        msglvl_t msglevel = D_DCO;
         if (dco->dco_message_type == OVPN_CMD_DEL_PEER
             && dco->dco_del_peer_reason == OVPN_DEL_PEER_REASON_USERSPACE)
         {
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index ae285d92e..f1f66b941 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -1107,7 +1107,7 @@ delete_all_dhcp_fo(struct options *o, struct env_item **list)
 #endif /* ifndef _WIN32 */
 
 static in_addr_t
-get_ip_addr(const char *ip_string, int msglevel, bool *error)
+get_ip_addr(const char *ip_string, msglvl_t msglevel, bool *error)
 {
     unsigned int flags = GETADDR_HOST_ORDER;
     bool succeeded = false;
@@ -1187,7 +1187,7 @@ string_substitute(const char *src, int from, int to, struct gc_arena *gc)
  * @param   gc          The returned object will be allocated in this gc
  */
 static struct verify_hash_list *
-parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
+parse_hash_fingerprint(const char *str, int nbytes, msglvl_t msglevel, struct gc_arena *gc)
 {
     int i = 0;
     const char *cp = str;
@@ -1240,7 +1240,8 @@ parse_hash_fingerprint(const char *str, int nbytes, int msglevel, struct gc_aren
  * @param   gc          The returned list items will be allocated in this gc
  */
 static struct verify_hash_list *
-parse_hash_fingerprint_multiline(const char *str, int nbytes, int msglevel, struct gc_arena *gc)
+parse_hash_fingerprint_multiline(const char *str, int nbytes, msglvl_t msglevel,
+                                 struct gc_arena *gc)
 {
     struct gc_arena gc_temp = gc_new();
     char *lines = string_alloc(str, &gc_temp);
@@ -1329,7 +1330,7 @@ show_tuntap_options(const struct tuntap_options *o)
 #endif /* ifdef _WIN32 */
 
 static void
-dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, int msglevel)
+dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, msglvl_t msglevel)
 {
     struct in6_addr addr;
     if (*len >= N_DHCP_ADDR)
@@ -1344,7 +1345,7 @@ dhcp_option_dns6_parse(const char *parm, struct in6_addr *dns6_list, int *len, i
 }
 static void
 dhcp_option_address_parse(const char *name, const char *parm, in_addr_t *array, int *len,
-                          int msglevel)
+                          msglvl_t msglevel)
 {
     if (*len >= N_DHCP_ADDR)
     {
@@ -1480,7 +1481,8 @@ show_p2mp_parms(const struct options *o)
 #endif /* ! ENABLE_SMALL */
 
 static void
-option_iroute(struct options *o, const char *network_str, const char *netmask_str, int msglevel)
+option_iroute(struct options *o, const char *network_str, const char *netmask_str,
+              msglvl_t msglevel)
 {
     struct iroute *ir;
 
@@ -1506,7 +1508,7 @@ option_iroute(struct options *o, const char *network_str, const char *netmask_st
 }
 
 static void
-option_iroute_ipv6(struct options *o, const char *prefix_str, int msglevel)
+option_iroute_ipv6(struct options *o, const char *prefix_str, msglvl_t msglevel)
 {
     struct iroute_ipv6 *ir;
 
@@ -2063,7 +2065,7 @@ alloc_local_list_if_undef(struct connection_entry *ce, struct gc_arena *gc)
 }
 
 static struct local_entry *
-alloc_local_entry(struct connection_entry *ce, const int msglevel, struct gc_arena *gc)
+alloc_local_entry(struct connection_entry *ce, const msglvl_t msglevel, struct gc_arena *gc)
 {
     struct local_list *l = alloc_local_list_if_undef(ce, gc);
     struct local_entry *e;
@@ -2104,7 +2106,7 @@ alloc_connection_list_if_undef(struct options *options)
 }
 
 static struct connection_entry *
-alloc_connection_entry(struct options *options, const int msglevel)
+alloc_connection_entry(struct options *options, const msglvl_t msglevel)
 {
     struct connection_list *l = alloc_connection_list_if_undef(options);
     struct connection_entry *e;
@@ -2140,7 +2142,7 @@ alloc_remote_list_if_undef(struct options *options)
 }
 
 static struct remote_entry *
-alloc_remote_entry(struct options *options, const int msglevel)
+alloc_remote_entry(struct options *options, const msglvl_t msglevel)
 {
     struct remote_list *l = alloc_remote_list_if_undef(options);
     struct remote_entry *e;
@@ -2694,7 +2696,7 @@ options_postprocess_verify_ce(const struct options *options, const struct connec
 
     if (!options->tls_server && !options->tls_client)
     {
-        int msglevel = M_USAGE;
+        msglvl_t msglevel = M_USAGE;
         if (options->allow_deprecated_insecure_static_crypto)
         {
             msglevel = M_INFO;
@@ -4566,8 +4568,9 @@ options_warning_extract_parm1(const char *option_string, struct gc_arena *gc_ret
 }
 
 static void
-options_warning_safe_scan2(const int msglevel, const int delim, const bool report_inconsistent,
-                           const char *p1, const struct buffer *b2_src, const char *b1_name,
+options_warning_safe_scan2(const msglvl_t msglevel, const int delim,
+                           const bool report_inconsistent, const char *p1,
+                           const struct buffer *b2_src, const char *b1_name,
                            const char *b2_name)
 {
     /* We will stop sending 'key-method', 'keydir', 'proto' and 'tls-auth' in
@@ -4619,9 +4622,9 @@ done:
 }
 
 static void
-options_warning_safe_scan1(const int msglevel, const int delim, const bool report_inconsistent,
-                           const struct buffer *b1_src, const struct buffer *b2_src,
-                           const char *b1_name, const char *b2_name)
+options_warning_safe_scan1(const msglvl_t msglevel, const int delim,
+                           const bool report_inconsistent, const struct buffer *b1_src,
+                           const struct buffer *b2_src, const char *b1_name, const char *b2_name)
 {
     struct gc_arena gc = gc_new();
     struct buffer b = *b1_src;
@@ -4637,7 +4640,7 @@ options_warning_safe_scan1(const int msglevel, const int delim, const bool repor
 }
 
 static void
-options_warning_safe_ml(const int msglevel, char *actual, const char *expected, size_t actual_n)
+options_warning_safe_ml(const msglvl_t msglevel, char *actual, const char *expected, size_t actual_n)
 {
     struct gc_arena gc = gc_new();
 
@@ -4729,7 +4732,7 @@ options_string_extract_option(const char *options_string, const char *opt_name,
  */
 
 int
-parse_topology(const char *str, const int msglevel)
+parse_topology(const char *str, const msglvl_t msglevel)
 {
     if (streq(str, "net30"))
     {
@@ -4785,7 +4788,7 @@ auth_retry_get(void)
 }
 
 bool
-auth_retry_set(const int msglevel, const char *option)
+auth_retry_set(const msglvl_t msglevel, const char *option)
 {
     if (streq(option, "interact"))
     {
@@ -4942,7 +4945,7 @@ string_defined_equal(const char *s1, const char *s2)
 
 #if 0
 static void
-ping_rec_err(int msglevel)
+ping_rec_err(msglvl_t msglevel)
 {
     msg(msglevel, "only one of --ping-exit or --ping-restart options may be specified");
 }
@@ -4966,7 +4969,7 @@ space(char c)
 
 int
 parse_line(const char *line, char *p[], const int n, const char *file, const int line_num,
-           int msglevel, struct gc_arena *gc)
+           msglvl_t msglevel, struct gc_arena *gc)
 {
     const int STATE_INITIAL = 0;
     const int STATE_READING_QUOTED_PARM = 1;
@@ -5271,24 +5274,25 @@ check_inline_file_via_buf(struct buffer *multiline, char *p[], struct gc_arena *
 }
 
 static void add_option(struct options *options, char *p[], bool is_inline, const char *file,
-                       int line, const int level, const int msglevel,
+                       int line, const int level, const msglvl_t msglevel,
                        const unsigned int permission_mask, unsigned int *option_types_found,
                        struct env_set *es);
 
 static void remove_option(struct context *c, struct options *options, char *p[], bool is_inline,
-                          const char *file, int line, const int msglevel,
+                          const char *file, int line, const msglvl_t msglevel,
                           const unsigned int permission_mask, unsigned int *option_types_found,
                           struct env_set *es);
 
 static void update_option(struct context *c, struct options *options, char *p[], bool is_inline,
-                          const char *file, int line, const int level, const int msglevel,
+                          const char *file, int line, const int level, const msglvl_t msglevel,
                           const unsigned int permission_mask, unsigned int *option_types_found,
                           struct env_set *es, unsigned int *update_options_found);
 
 static void
 read_config_file(struct options *options, const char *file, int level, const char *top_file,
-                 const int top_line, const int msglevel, const unsigned int permission_mask,
-                 unsigned int *option_types_found, struct env_set *es)
+                 const int top_line, const msglvl_t msglevel,
+                 const unsigned int permission_mask, unsigned int *option_types_found,
+                 struct env_set *es)
 {
     const int max_recursive_levels = 10;
     FILE *fp;
@@ -5360,7 +5364,7 @@ read_config_file(struct options *options, const char *file, int level, const cha
 
 static void
 read_config_string(const char *prefix, struct options *options, const char *config,
-                   const int msglevel, const unsigned int permission_mask,
+                   const msglvl_t msglevel, const unsigned int permission_mask,
                    unsigned int *option_types_found, struct env_set *es)
 {
     char line[OPTION_LINE_SIZE];
@@ -5388,7 +5392,7 @@ read_config_string(const char *prefix, struct options *options, const char *conf
 }
 
 void
-parse_argv(struct options *options, const int argc, char *argv[], const int msglevel,
+parse_argv(struct options *options, const int argc, char *argv[], const msglvl_t msglevel,
            const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
 {
     /* usage message */
@@ -5457,7 +5461,7 @@ apply_push_options(struct context *c, struct options *options, struct buffer *bu
     char line[OPTION_PARM_SIZE];
     int line_num = 0;
     const char *file = "[PUSH-OPTIONS]";
-    const int msglevel = D_PUSH_ERRORS | M_OPTERR;
+    const msglvl_t msglevel = D_PUSH_ERRORS | M_OPTERR;
     unsigned int update_options_found = 0;
 
     while (buf_parse(buf, ',', line, sizeof(line)))
@@ -5514,7 +5518,7 @@ apply_push_options(struct context *c, struct options *options, struct buffer *bu
 }
 
 void
-options_server_import(struct options *o, const char *filename, int msglevel,
+options_server_import(struct options *o, const char *filename, msglvl_t msglevel,
                       unsigned int permission_mask, unsigned int *option_types_found,
                       struct env_set *es)
 {
@@ -5524,7 +5528,7 @@ options_server_import(struct options *o, const char *filename, int msglevel,
 }
 
 void
-options_string_import(struct options *options, const char *config, const int msglevel,
+options_string_import(struct options *options, const char *config, const msglvl_t msglevel,
                       const unsigned int permission_mask, unsigned int *option_types_found,
                       struct env_set *es)
 {
@@ -5543,7 +5547,7 @@ options_string_import(struct options *options, const char *config, const int msg
 
 static bool
 verify_permission(const char *name, const char *file, int line, const unsigned int type,
-                  const unsigned int allowed, unsigned int *found, const int msglevel,
+                  const unsigned int allowed, unsigned int *found, const msglvl_t msglevel,
                   struct options *options, bool is_inline)
 {
     if (!(type & allowed))
@@ -5595,7 +5599,7 @@ verify_permission(const char *name, const char *file, int line, const unsigned i
 #define NM_QUOTE_HINT (1 << 0)
 
 static bool
-no_more_than_n_args(const int msglevel, char *p[], const int max, const unsigned int flags)
+no_more_than_n_args(const msglvl_t msglevel, char *p[], const int max, const unsigned int flags)
 {
     const int len = string_array_len((const char **)p);
 
@@ -5619,8 +5623,8 @@ no_more_than_n_args(const int msglevel, char *p[], const int max, const unsigned
     }
 }
 
-static inline int
-msglevel_forward_compatible(struct options *options, const int msglevel)
+static inline msglvl_t
+msglevel_forward_compatible(struct options *options, const msglvl_t msglevel)
 {
     return options->forward_compatible ? M_WARN : msglevel;
 }
@@ -5654,10 +5658,11 @@ msglevel_forward_compatible(struct options *options, const int msglevel)
  */
 static void
 remove_option(struct context *c, struct options *options, char *p[], bool is_inline,
-              const char *file, int line, const int msglevel, const unsigned int permission_mask,
-              unsigned int *option_types_found, struct env_set *es)
+              const char *file, int line, const msglvl_t msglevel,
+              const unsigned int permission_mask, unsigned int *option_types_found,
+              struct env_set *es)
 {
-    int msglevel_fc = msglevel_forward_compatible(options, msglevel);
+    msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
 
     if (streq(p[0], "ifconfig") && !p[1])
     {
@@ -5792,11 +5797,10 @@ remove_option(struct context *c, struct options *options, char *p[], bool is_inl
 #endif
     else
     {
-        int i;
-        int msglevel_unknown = msglevel_fc;
+        msglvl_t msglevel_unknown = msglevel_fc;
         /* Check if an option is in --ignore-unknown-option and
          * set warning level to non fatal */
-        for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
+        for (int i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
         {
             if (streq(p[0], options->ignore_unknown_option[i]))
             {
@@ -5815,7 +5819,7 @@ err:
 
 
 static bool
-check_route_option(struct options *options, char *p[], const int msglevel, bool pull_mode)
+check_route_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
 {
     rol_check_alloc(options);
     if (pull_mode)
@@ -5843,7 +5847,7 @@ check_route_option(struct options *options, char *p[], const int msglevel, bool
 
 
 static bool
-check_route6_option(struct options *options, char *p[], const int msglevel, bool pull_mode)
+check_route6_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
 {
     rol6_check_alloc(options);
     if (pull_mode)
@@ -5864,7 +5868,7 @@ check_route6_option(struct options *options, char *p[], const int msglevel, bool
 }
 
 static bool
-check_dns_option(struct options *options, char *p[], const int msglevel, bool pull_mode)
+check_dns_option(struct options *options, char *p[], const msglvl_t msglevel, bool pull_mode)
 {
     if (streq(p[1], "search-domains") && p[2])
     {
@@ -5984,7 +5988,7 @@ check_dns_option(struct options *options, char *p[], const int msglevel, bool pu
  */
 static void
 update_option(struct context *c, struct options *options, char *p[], bool is_inline,
-              const char *file, int line, const int level, const int msglevel,
+              const char *file, int line, const int level, const msglvl_t msglevel,
               const unsigned int permission_mask, unsigned int *option_types_found,
               struct env_set *es, unsigned int *update_options_found)
 {
@@ -6169,12 +6173,12 @@ key_is_external(const struct options *options)
 
 static void
 add_option(struct options *options, char *p[], bool is_inline, const char *file, int line,
-           const int level, const int msglevel, const unsigned int permission_mask,
+           const int level, const msglvl_t msglevel, const unsigned int permission_mask,
            unsigned int *option_types_found, struct env_set *es)
 {
     struct gc_arena gc = gc_new();
     const bool pull_mode = BOOL_CAST(permission_mask & OPT_P_PULL_MODE);
-    int msglevel_fc = msglevel_forward_compatible(options, msglevel);
+    msglvl_t msglevel_fc = msglevel_forward_compatible(options, msglevel);
 
     ASSERT(MAX_PARMS >= 7);
 
@@ -9869,7 +9873,7 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,
     else
     {
         int i;
-        int msglevel_unknown = msglevel_fc;
+        msglvl_t msglevel_unknown = msglevel_fc;
         /* Check if an option is in --ignore-unknown-option and
          * set warning level to non fatal */
         for (i = 0; options->ignore_unknown_option && options->ignore_unknown_option[i]; i++)
diff --git a/src/openvpn/options.h b/src/openvpn/options.h
index bb2c052e0..a737711bc 100644
--- a/src/openvpn/options.h
+++ b/src/openvpn/options.h
@@ -822,7 +822,7 @@ struct pull_filter_list
     struct pull_filter *tail;
 };
 
-void parse_argv(struct options *options, const int argc, char *argv[], const int msglevel,
+void parse_argv(struct options *options, const int argc, char *argv[], const msglvl_t msglevel,
                 const unsigned int permission_mask, unsigned int *option_types_found,
                 struct env_set *es);
 
@@ -888,7 +888,7 @@ bool apply_push_options(struct context *c, struct options *options, struct buffe
 
 void options_detach(struct options *o);
 
-void options_server_import(struct options *o, const char *filename, int msglevel,
+void options_server_import(struct options *o, const char *filename, msglvl_t msglevel,
                            unsigned int permission_mask, unsigned int *option_types_found,
                            struct env_set *es);
 
@@ -897,13 +897,13 @@ void pre_pull_default(struct options *o);
 void rol_check_alloc(struct options *options);
 
 int parse_line(const char *line, char *p[], const int n, const char *file, const int line_num,
-               int msglevel, struct gc_arena *gc);
+               msglvl_t msglevel, struct gc_arena *gc);
 
 /*
  * parse/print topology coding
  */
 
-int parse_topology(const char *str, const int msglevel);
+int parse_topology(const char *str, const msglvl_t msglevel);
 
 const char *print_topology(const int topology);
 
@@ -917,11 +917,11 @@ const char *print_topology(const int topology);
 
 int auth_retry_get(void);
 
-bool auth_retry_set(const int msglevel, const char *option);
+bool auth_retry_set(const msglvl_t msglevel, const char *option);
 
 const char *auth_retry_print(void);
 
-void options_string_import(struct options *options, const char *config, const int msglevel,
+void options_string_import(struct options *options, const char *config, const msglvl_t msglevel,
                            const unsigned int permission_mask, unsigned int *option_types_found,
                            struct env_set *es);
 
diff --git a/src/openvpn/options_util.c b/src/openvpn/options_util.c
index 5740ee5a3..cb4229ebe 100644
--- a/src/openvpn/options_util.c
+++ b/src/openvpn/options_util.c
@@ -117,7 +117,7 @@ valid_integer(const char *str, bool positive)
 }
 
 int
-positive_atoi(const char *str, int msglevel)
+positive_atoi(const char *str, msglvl_t msglevel)
 {
     char *endptr;
     long long i = strtoll(str, &endptr, 10);
@@ -132,7 +132,7 @@ positive_atoi(const char *str, int msglevel)
 }
 
 bool
-positive_atoll(const char *str, int64_t *value, const char *name, int msglevel)
+positive_atoll(const char *str, int64_t *value, const char *name, msglvl_t msglevel)
 {
     char *endptr;
     long long ll = strtoll(str, &endptr, 10);
@@ -148,7 +148,7 @@ positive_atoll(const char *str, int64_t *value, const char *name, int msglevel)
 }
 
 int
-atoi_warn(const char *str, int msglevel)
+atoi_warn(const char *str, msglvl_t msglevel)
 {
     char *endptr;
     long long i = strtoll(str, &endptr, 10);
@@ -163,7 +163,7 @@ atoi_warn(const char *str, int msglevel)
 }
 
 bool
-atoi_constrained(const char *str, int *value, const char *name, int min, int max, int msglevel)
+atoi_constrained(const char *str, int *value, const char *name, int min, int max, msglvl_t msglevel)
 {
     ASSERT(min < max);
 
diff --git a/src/openvpn/options_util.h b/src/openvpn/options_util.h
index 45417d9e5..1492eef2a 100644
--- a/src/openvpn/options_util.h
+++ b/src/openvpn/options_util.h
@@ -37,7 +37,7 @@ bool valid_integer(const char *str, bool positive);
  * Converts a str to a positive number if the string represents a postive
  * integer number. Otherwise print a warning with msglevel and return 0
  */
-int positive_atoi(const char *str, int msglevel);
+int positive_atoi(const char *str, msglvl_t msglevel);
 
 /**
  * Converts a str to an integer if the string can be represented as an
@@ -48,13 +48,13 @@ int positive_atoi(const char *str, int msglevel);
  *
  * @return \c true if the integer has been parsed and stored in value, \c false otherwise
  */
-bool positive_atoll(const char *str, int64_t *value, const char *name, int msglevel);
+bool positive_atoll(const char *str, int64_t *value, const char *name, msglvl_t msglevel);
 
 /**
  * Converts a str to an integer if the string can be represented as an
  * integer number. Otherwise print a warning with \p msglevel and return 0
  */
-int atoi_warn(const char *str, int msglevel);
+int atoi_warn(const char *str, msglvl_t msglevel);
 
 /**
  * Converts a str to an integer if the string can be represented as an
@@ -66,7 +66,7 @@ int atoi_warn(const char *str, int msglevel);
  * @return \c true if the integer has been parsed and stored in value, \c false otherwise
  */
 bool atoi_constrained(const char *str, int *value, const char *name, int min, int max,
-                      int msglevel);
+                      msglvl_t msglevel);
 
 /**
  * Filter an option line by all pull filters.
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 09696db2d..ca318eb98 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -53,15 +53,15 @@
 #define SEQ_EXPIRED ((time_t)1)
 
 #ifdef ENABLE_DEBUG
-static void packet_id_debug_print(int msglevel, const struct packet_id_rec *p,
+static void packet_id_debug_print(msglvl_t msglevel, const struct packet_id_rec *p,
                                   const struct packet_id_net *pin, const char *message,
                                   packet_id_print_type value);
 
 #endif /* ENABLE_DEBUG */
 
 static inline void
-packet_id_debug(int msglevel, const struct packet_id_rec *p, const struct packet_id_net *pin,
-                const char *message, uint64_t value)
+packet_id_debug(msglvl_t msglevel, const struct packet_id_rec *p,
+                const struct packet_id_net *pin, const char *message, uint64_t value)
 {
 #ifdef ENABLE_DEBUG
     if (unlikely(check_debug_level(msglevel)))
@@ -573,7 +573,8 @@ packet_id_persist_print(const struct packet_id_persist *p, struct gc_arena *gc)
 #ifdef ENABLE_DEBUG
 
 static void
-packet_id_debug_print(int msglevel, const struct packet_id_rec *p, const struct packet_id_net *pin,
+packet_id_debug_print(msglvl_t msglevel, const struct packet_id_rec *p,
+                      const struct packet_id_net *pin,
                       const char *message, packet_id_print_type value)
 {
     struct gc_arena gc = gc_new();
diff --git a/src/openvpn/pkcs11.c b/src/openvpn/pkcs11.c
index dfc87f6b5..8a7a3204e 100644
--- a/src/openvpn/pkcs11.c
+++ b/src/openvpn/pkcs11.c
@@ -72,10 +72,10 @@ static pkcs11h_engine_system_t s_pkcs11h_sys_engine = { malloc, free, __mytime,
 #endif
 };
 
-static unsigned
+static msglvl_t
 _pkcs11_msg_pkcs112openvpn(const unsigned flags)
 {
-    unsigned openvpn_flags;
+    msglvl_t openvpn_flags;
 
     switch (flags)
     {
@@ -112,7 +112,7 @@ _pkcs11_msg_pkcs112openvpn(const unsigned flags)
 }
 
 static unsigned
-_pkcs11_msg_openvpn2pkcs11(const unsigned flags)
+_pkcs11_msg_openvpn2pkcs11(const msglvl_t flags)
 {
     unsigned pkcs11_flags;
 
diff --git a/src/openvpn/plugin.c b/src/openvpn/plugin.c
index ea76a084c..a10505808 100644
--- a/src/openvpn/plugin.c
+++ b/src/openvpn/plugin.c
@@ -50,7 +50,7 @@
 static struct plugin_common *static_plugin_common = NULL; /* GLOBAL */
 
 static void
-plugin_show_string_array(int msglevel, const char *name, const char *array[])
+plugin_show_string_array(msglvl_t msglevel, const char *name, const char *array[])
 {
     int i;
     for (i = 0; array[i]; ++i)
@@ -63,7 +63,7 @@ plugin_show_string_array(int msglevel, const char *name, const char *array[])
 }
 
 static void
-plugin_show_args_env(int msglevel, const char *argv[], const char *envp[])
+plugin_show_args_env(msglvl_t msglevel, const char *argv[], const char *envp[])
 {
     if (check_debug_level(msglevel))
     {
@@ -184,7 +184,7 @@ plugin_option_list_add(struct plugin_option_list *list, char **p, struct gc_aren
 
 #ifndef ENABLE_SMALL
 void
-plugin_option_list_print(const struct plugin_option_list *list, int msglevel)
+plugin_option_list_print(const struct plugin_option_list *list, msglvl_t msglevel)
 {
     int i;
     struct gc_arena gc = gc_new();
@@ -995,7 +995,7 @@ plugin_return_free(struct plugin_return *pr)
 
 #ifdef ENABLE_DEBUG
 void
-plugin_return_print(const int msglevel, const char *prefix, const struct plugin_return *pr)
+plugin_return_print(const msglvl_t msglevel, const char *prefix, const struct plugin_return *pr)
 {
     int i;
     msg(msglevel, "PLUGIN_RETURN_PRINT %s", prefix);
diff --git a/src/openvpn/plugin.h b/src/openvpn/plugin.h
index 63999b667..81d3739f1 100644
--- a/src/openvpn/plugin.h
+++ b/src/openvpn/plugin.h
@@ -111,7 +111,7 @@ struct plugin_option_list *plugin_option_list_new(struct gc_arena *gc);
 bool plugin_option_list_add(struct plugin_option_list *list, char **p, struct gc_arena *gc);
 
 #ifndef ENABLE_SMALL
-void plugin_option_list_print(const struct plugin_option_list *list, int msglevel);
+void plugin_option_list_print(const struct plugin_option_list *list, msglvl_t msglevel);
 
 #endif
 
@@ -136,7 +136,7 @@ void plugin_return_get_column(const struct plugin_return *src, struct plugin_ret
 void plugin_return_free(struct plugin_return *pr);
 
 #ifdef ENABLE_DEBUG
-void plugin_return_print(const int msglevel, const char *prefix, const struct plugin_return *pr);
+void plugin_return_print(const msglvl_t msglevel, const char *prefix, const struct plugin_return *pr);
 
 #endif
 
diff --git a/src/openvpn/pool.c b/src/openvpn/pool.c
index fde6cea8d..28ddd2c8a 100644
--- a/src/openvpn/pool.c
+++ b/src/openvpn/pool.c
@@ -114,7 +114,7 @@ ifconfig_pool_find(struct ifconfig_pool *pool, const char *common_name)
  * Verify start/end range
  */
 bool
-ifconfig_pool_verify_range(const int msglevel, const in_addr_t start, const in_addr_t end)
+ifconfig_pool_verify_range(const msglvl_t msglevel, const in_addr_t start, const in_addr_t end)
 {
     struct gc_arena gc = gc_new();
     bool ret = true;
diff --git a/src/openvpn/pool.h b/src/openvpn/pool.h
index 6cecef0a0..36e9fcac2 100644
--- a/src/openvpn/pool.h
+++ b/src/openvpn/pool.h
@@ -78,7 +78,7 @@ struct ifconfig_pool *ifconfig_pool_init(const bool ipv4_pool, enum pool_type ty
 
 void ifconfig_pool_free(struct ifconfig_pool *pool);
 
-bool ifconfig_pool_verify_range(const int msglevel, const in_addr_t start, const in_addr_t end);
+bool ifconfig_pool_verify_range(const msglvl_t msglevel, const in_addr_t start, const in_addr_t end);
 
 ifconfig_pool_handle ifconfig_pool_acquire(struct ifconfig_pool *pool, in_addr_t *local,
                                            in_addr_t *remote, struct in6_addr *remote_ipv6,
diff --git a/src/openvpn/proto.c b/src/openvpn/proto.c
index 34b33787c..ab7788753 100644
--- a/src/openvpn/proto.c
+++ b/src/openvpn/proto.c
@@ -183,7 +183,7 @@ ipv4_packet_size_verify(const uint8_t *data, const int size, const int tunnel_ty
             int hlen;
             int totlen;
             const char *msgstr = "PACKET SIZE INFO";
-            unsigned int msglevel = D_PACKET_TRUNC_DEBUG;
+            msglvl_t msglevel = D_PACKET_TRUNC_DEBUG;
 
             if (BLEN(&buf) < (int)sizeof(struct openvpn_iphdr))
             {
diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index 1ea7ed99f..60ca25fef 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -373,8 +373,8 @@ receive_auth_pending(struct context *c, const struct buffer *buffer)
  *
  * @return true on success, false on failure.
  */
-static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list, int msglevel,
-                            const char *fmt, ...)
+static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
+                            msglvl_t msglevel, const char *fmt, ...)
 #ifdef __GNUC__
 #if __USE_MINGW_ANSI_STDIO
     __attribute__((format(gnu_printf, 4, 5)))
@@ -853,7 +853,7 @@ fail:
 
 static void
 push_option_ex(struct gc_arena *gc, struct push_list *push_list, const char *opt, bool enable,
-               int msglevel)
+               msglvl_t msglevel)
 {
     if (!string_class(opt, CC_ANY, CC_COMMA))
     {
@@ -881,7 +881,7 @@ push_option_ex(struct gc_arena *gc, struct push_list *push_list, const char *opt
 }
 
 void
-push_option(struct options *o, const char *opt, int msglevel)
+push_option(struct options *o, const char *opt, msglvl_t msglevel)
 {
     push_option_ex(&o->gc, &o->push_list, opt, true, msglevel);
 }
@@ -902,7 +902,7 @@ clone_push_list(struct options *o)
 }
 
 void
-push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
+push_options(struct options *o, char **p, msglvl_t msglevel, struct gc_arena *gc)
 {
     const char **argv = make_extended_arg_array(p, false, gc);
     char *opt = print_argv(argv, gc, 0);
@@ -910,8 +910,8 @@ push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
 }
 
 static bool
-push_option_fmt(struct gc_arena *gc, struct push_list *push_list, int msglevel, const char *format,
-                ...)
+push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
+                msglvl_t msglevel, const char *format, ...)
 {
     va_list arglist;
     char tmp[256] = { 0 };
diff --git a/src/openvpn/push.h b/src/openvpn/push.h
index 8ffd0c298..6b3275e40 100644
--- a/src/openvpn/push.h
+++ b/src/openvpn/push.h
@@ -99,9 +99,9 @@ void incoming_push_message(struct context *c, const struct buffer *buffer);
 
 void clone_push_list(struct options *o);
 
-void push_option(struct options *o, const char *opt, int msglevel);
+void push_option(struct options *o, const char *opt, msglvl_t msglevel);
 
-void push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc);
+void push_options(struct options *o, char **p, msglvl_t msglevel, struct gc_arena *gc);
 
 void push_reset(struct options *o);
 
diff --git a/src/openvpn/route.c b/src/openvpn/route.c
index e5044850f..aa5ce6902 100644
--- a/src/openvpn/route.c
+++ b/src/openvpn/route.c
@@ -1228,28 +1228,28 @@ show_opt(const char *option)
 }
 
 static void
-print_route_option(const struct route_option *ro, int level)
+print_route_option(const struct route_option *ro, msglvl_t msglevel)
 {
-    msg(level, "  route %s/%s/%s/%s", show_opt(ro->network), show_opt(ro->netmask),
+    msg(msglevel, "  route %s/%s/%s/%s", show_opt(ro->network), show_opt(ro->netmask),
         show_opt(ro->gateway), show_opt(ro->metric));
 }
 
 void
-print_route_options(const struct route_option_list *rol, int level)
+print_route_options(const struct route_option_list *rol, msglvl_t msglevel)
 {
     struct route_option *ro;
     if (rol->flags & RG_ENABLE)
     {
-        msg(level, "  [redirect_default_gateway local=%d]", (rol->flags & RG_LOCAL) != 0);
+        msg(msglevel, "  [redirect_default_gateway local=%d]", (rol->flags & RG_LOCAL) != 0);
     }
     for (ro = rol->routes; ro; ro = ro->next)
     {
-        print_route_option(ro, level);
+        print_route_option(ro, msglevel);
     }
 }
 
 void
-print_default_gateway(const int msglevel, const struct route_gateway_info *rgi,
+print_default_gateway(const msglvl_t msglevel, const struct route_gateway_info *rgi,
                       const struct route_ipv6_gateway_info *rgi6)
 {
     struct gc_arena gc = gc_new();
@@ -1323,23 +1323,23 @@ print_default_gateway(const int msglevel, const struct route_gateway_info *rgi,
 #endif /* ifndef ENABLE_SMALL */
 
 static void
-print_route(const struct route_ipv4 *r, int level)
+print_route(const struct route_ipv4 *r, msglvl_t msglevel)
 {
     struct gc_arena gc = gc_new();
     if (r->flags & RT_DEFINED)
     {
-        msg(level, "%s", route_string(r, &gc));
+        msg(msglevel, "%s", route_string(r, &gc));
     }
     gc_free(&gc);
 }
 
 void
-print_routes(const struct route_list *rl, int level)
+print_routes(const struct route_list *rl, msglvl_t msglevel)
 {
     struct route_ipv4 *r;
     for (r = rl->routes; r; r = r->next)
     {
-        print_route(r, level);
+        print_route(r, msglevel);
     }
 }
 
@@ -3059,18 +3059,18 @@ format_route_entry(const MIB_IPFORWARDROW *r, struct gc_arena *gc)
  * Show current routing table
  */
 void
-show_routes(int msglev)
+show_routes(msglvl_t msglevel)
 {
     struct gc_arena gc = gc_new();
 
     const MIB_IPFORWARDTABLE *rt = get_windows_routing_table(&gc);
 
-    msg(msglev, "SYSTEM ROUTING TABLE");
+    msg(msglevel, "SYSTEM ROUTING TABLE");
     if (rt)
     {
         for (DWORD i = 0; i < rt->dwNumEntries; ++i)
         {
-            msg(msglev, "%s", format_route_entry(&rt->table[i], &gc));
+            msg(msglevel, "%s", format_route_entry(&rt->table[i], &gc));
         }
     }
     gc_free(&gc);
diff --git a/src/openvpn/route.h b/src/openvpn/route.h
index 9b6a47e59..c5006aec3 100644
--- a/src/openvpn/route.h
+++ b/src/openvpn/route.h
@@ -356,7 +356,7 @@ void get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn
 void get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi, const struct in6_addr *dest,
                               openvpn_net_ctx_t *ctx);
 
-void print_default_gateway(const int msglevel, const struct route_gateway_info *rgi,
+void print_default_gateway(const msglvl_t msglevel, const struct route_gateway_info *rgi,
                            const struct route_ipv6_gateway_info *rgi6);
 
 /*
@@ -371,15 +371,15 @@ void print_default_gateway(const int msglevel, const struct route_gateway_info *
 int test_local_addr(const in_addr_t addr, const struct route_gateway_info *rgi);
 
 #ifndef ENABLE_SMALL
-void print_route_options(const struct route_option_list *rol, int level);
+void print_route_options(const struct route_option_list *rol, msglvl_t msglevel);
 
 #endif
 
-void print_routes(const struct route_list *rl, int level);
+void print_routes(const struct route_list *rl, msglvl_t msglevel);
 
 #ifdef _WIN32
 
-void show_routes(int msglev);
+void show_routes(msglvl_t msglevel);
 
 bool test_routes(const struct route_list *rl, const struct tuntap *tt);
 
diff --git a/src/openvpn/run_command.c b/src/openvpn/run_command.c
index 4a1ef2286..a0c948416 100644
--- a/src/openvpn/run_command.c
+++ b/src/openvpn/run_command.c
@@ -107,7 +107,7 @@ system_error_message(int stat, struct gc_arena *gc)
 
 #ifndef WIN32
 bool
-openvpn_waitpid_check(pid_t pid, const char *msg_prefix, int msglevel)
+openvpn_waitpid_check(pid_t pid, const char *msg_prefix, msglvl_t msglevel)
 {
     if (pid == 0)
     {
diff --git a/src/openvpn/run_command.h b/src/openvpn/run_command.h
index afd1b88a6..234055ee2 100644
--- a/src/openvpn/run_command.h
+++ b/src/openvpn/run_command.h
@@ -71,13 +71,13 @@ int openvpn_execve_check(const struct argv *a, const struct env_set *es, const u
  * This function is currently not implemented for Windows as the helper
  * macros used by this function are not available.
  *
- * @param pid               pid of the process to be checked
+ * @param pid            pid of the process to be checked
  * @param msg_prefix     prefixed of the message that be printed
- * @param msglevel          msglevel of the messages to be printed
- * @return                  true if the process is still running, false if
- *                          an error condition occurred
+ * @param msglevel       msglevel of the messages to be printed
+ * @return               true if the process is still running, false if
+ *                       an error condition occurred
  */
-bool openvpn_waitpid_check(pid_t pid, const char *msg_prefix, int msglevel);
+bool openvpn_waitpid_check(pid_t pid, const char *msg_prefix, msglvl_t msglevel);
 
 #endif
 
diff --git a/src/openvpn/sig.c b/src/openvpn/sig.c
index ecea6353e..42ad823d8 100644
--- a/src/openvpn/sig.c
+++ b/src/openvpn/sig.c
@@ -287,7 +287,7 @@ signal_reset(struct signal_info *si, int signum)
 }
 
 void
-print_signal(const struct signal_info *si, const char *title, int msglevel)
+print_signal(const struct signal_info *si, const char *title, msglvl_t msglevel)
 {
     if (si)
     {
diff --git a/src/openvpn/sig.h b/src/openvpn/sig.h
index 7e5dd9f7a..b5d81fc0a 100644
--- a/src/openvpn/sig.h
+++ b/src/openvpn/sig.h
@@ -66,7 +66,7 @@ void post_init_signal_catch(void);
 
 void restore_signal_state(void);
 
-void print_signal(const struct signal_info *si, const char *title, int msglevel);
+void print_signal(const struct signal_info *si, const char *title, msglvl_t msglevel);
 
 void print_status(struct context *c, struct status_output *so);
 
diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 306170c5b..eeb42d177 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -78,7 +78,7 @@ sf2gaf(const unsigned int getaddr_flags, const unsigned int sockflags)
 static int
 get_addr_generic(sa_family_t af, unsigned int flags, const char *hostname, void *network,
                  unsigned int *netbits, int resolve_retry_seconds, struct signal_info *sig_info,
-                 int msglevel)
+                 msglvl_t msglevel)
 {
     char *endp, *sep, *var_host = NULL;
     struct addrinfo *ai = NULL;
@@ -211,7 +211,8 @@ getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, boo
 }
 
 bool
-get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits, int msglevel)
+get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits,
+              msglvl_t msglevel)
 {
     if (get_addr_generic(AF_INET6, GETADDR_RESOLVE, hostname, network, netbits, 0, NULL, msglevel)
         < 0)
@@ -1516,7 +1517,7 @@ static void
 linksock_print_addr(struct link_socket *sock)
 {
     struct gc_arena gc = gc_new();
-    const int msglevel = (sock->mode == LS_MODE_TCP_ACCEPT_FROM) ? D_INIT_MEDIUM : M_INFO;
+    const msglvl_t msglevel = (sock->mode == LS_MODE_TCP_ACCEPT_FROM) ? D_INIT_MEDIUM : M_INFO;
 
     /* print local address */
     if (sock->bind_local)
diff --git a/src/openvpn/socket_util.c b/src/openvpn/socket_util.c
index 9b7312d19..fa566e7dc 100644
--- a/src/openvpn/socket_util.c
+++ b/src/openvpn/socket_util.c
@@ -541,7 +541,7 @@ openvpn_getaddrinfo(unsigned int flags, const char *hostname, const char *servna
     struct addrinfo hints;
     int status;
     struct signal_info sigrec = { 0 };
-    int msglevel = (flags & GETADDR_FATAL) ? M_FATAL : D_RESOLVE_ERRORS;
+    msglvl_t msglevel = (flags & GETADDR_FATAL) ? M_FATAL : D_RESOLVE_ERRORS;
     struct gc_arena gc = gc_new();
     const char *print_hostname;
     const char *print_servname;
@@ -604,7 +604,7 @@ openvpn_getaddrinfo(unsigned int flags, const char *hostname, const char *servna
         int resolve_retries =
             (flags & GETADDR_TRY_ONCE) ? 1 : ((resolve_retry_seconds + 4) / fail_wait_interval);
         const char *fmt;
-        int level = 0;
+        msglvl_t level = 0;
 
         /* this is not a numeric IP, therefore force resolution using the
          * provided ai_family */
@@ -739,7 +739,7 @@ openvpn_getaddrinfo(unsigned int flags, const char *hostname, const char *servna
 done:
     if (sig_info && sig_info->signal_received)
     {
-        int level = 0;
+        msglvl_t level = 0;
         if (flags & GETADDR_FATAL_ON_SIGNAL)
         {
             level = M_FATAL;
diff --git a/src/openvpn/socket_util.h b/src/openvpn/socket_util.h
index 361edff47..ada52a4f9 100644
--- a/src/openvpn/socket_util.h
+++ b/src/openvpn/socket_util.h
@@ -142,7 +142,7 @@ in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_se
  * Translate an IPv6 addr or hostname from string form to in6_addr
  */
 bool get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits,
-                   int msglevel);
+                   msglvl_t msglevel);
 
 int openvpn_getaddrinfo(unsigned int flags, const char *hostname, const char *servname,
                         int resolve_retry_seconds, struct signal_info *sig_info, int ai_family,
diff --git a/src/openvpn/ssl_verify_backend.h b/src/openvpn/ssl_verify_backend.h
index a0559c984..2bad3eb66 100644
--- a/src/openvpn/ssl_verify_backend.h
+++ b/src/openvpn/ssl_verify_backend.h
@@ -193,8 +193,8 @@ void x509_setenv(struct env_set *es, int cert_depth, openvpn_x509_cert_t *cert);
  * @param gc            Garbage collection arena for temp data
  *
  */
-void x509_track_add(const struct x509_track **ll_head, const char *name, int msglevel,
-                    struct gc_arena *gc);
+void x509_track_add(const struct x509_track **ll_head, const char *name,
+                    msglvl_t msglevel, struct gc_arena *gc);
 
 /*
  * Save X509 fields to environment, using the naming convention:
diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c
index cfcfb253c..358807165 100644
--- a/src/openvpn/ssl_verify_mbedtls.c
+++ b/src/openvpn/ssl_verify_mbedtls.c
@@ -350,7 +350,7 @@ do_setenv_name(struct env_set *es, const struct x509_track *xt, const mbedtls_x5
 }
 
 void
-x509_track_add(const struct x509_track **ll_head, const char *name, int msglevel,
+x509_track_add(const struct x509_track **ll_head, const char *name, msglvl_t msglevel,
                struct gc_arena *gc)
 {
     struct x509_track *xt;
diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c
index 6de7e2ab7..0f257e2df 100644
--- a/src/openvpn/ssl_verify_openssl.c
+++ b/src/openvpn/ssl_verify_openssl.c
@@ -414,7 +414,7 @@ err:
  */
 
 void
-x509_track_add(const struct x509_track **ll_head, const char *name, int msglevel,
+x509_track_add(const struct x509_track **ll_head, const char *name, msglvl_t msglevel,
                struct gc_arena *gc)
 {
     struct x509_track *xt;
diff --git a/src/openvpn/status.c b/src/openvpn/status.c
index 34e5a2fea..cea31f53f 100644
--- a/src/openvpn/status.c
+++ b/src/openvpn/status.c
@@ -230,14 +230,13 @@ status_printf(struct status_output *so, const char *format, ...)
 
         if (so->msglevel >= 0 && !so->errors)
         {
-            msg(so->msglevel, "%s", buf);
+            msg((msglvl_t)so->msglevel, "%s", buf);
         }
 
         if (so->fd >= 0 && !so->errors)
         {
-            int len;
             strcat(buf, "\n");
-            len = strlen(buf);
+            size_t len = strlen(buf);
             if (len > 0)
             {
                 if (write(so->fd, buf, len) != len)
diff --git a/src/openvpn/status.h b/src/openvpn/status.h
index 0c7a86917..25e1663d0 100644
--- a/src/openvpn/status.h
+++ b/src/openvpn/status.h
@@ -53,6 +53,7 @@ struct status_output
 
     char *filename;
     int fd;
+    /* NB: -1 is used to indicate that output should only go to the file */
     int msglevel;
     const struct virtual_output *vout;
 
diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c
index ee0733ae5..9618301bc 100644
--- a/src/openvpn/tun.c
+++ b/src/openvpn/tun.c
@@ -105,9 +105,9 @@ static void windows_set_mtu(const int iface_index, const short family, const int
 static void netsh_set_dns6_servers(const struct in6_addr *addr_list, const int addr_len,
                                    DWORD adapter_index);
 
-static void netsh_command(const struct argv *a, int n, int msglevel);
+static void netsh_command(const struct argv *a, int n, msglvl_t msglevel);
 
-static void exec_command(const char *prefix, const struct argv *a, int n, int msglevel);
+static void exec_command(const char *prefix, const struct argv *a, int n, msglvl_t msglevel);
 
 static const char *netsh_get_id(const char *dev_node, struct gc_arena *gc);
 
@@ -4001,7 +4001,7 @@ show_valid_win32_tun_subnets(void)
 }
 
 void
-show_tap_win_adapters(int msglev, int warnlev)
+show_tap_win_adapters(msglvl_t msglevel, msglvl_t warnlevel)
 {
     struct gc_arena gc = gc_new();
 
@@ -4018,7 +4018,7 @@ show_tap_win_adapters(int msglev, int warnlev)
     const struct tap_reg *tap_reg = get_tap_reg(&gc);
     const struct panel_reg *panel_reg = get_panel_reg(&gc);
 
-    msg(msglev, "Available adapters [name, GUID, driver]:");
+    msg(msglevel, "Available adapters [name, GUID, driver]:");
 
     /* loop through each TAP-Windows adapter registry entry */
     for (tr = tap_reg; tr != NULL; tr = tr->next)
@@ -4030,7 +4030,7 @@ show_tap_win_adapters(int msglev, int warnlev)
         {
             if (!strcmp(tr->guid, pr->guid))
             {
-                msg(msglev, "'%s' %s %s", pr->name, tr->guid,
+                msg(msglevel, "'%s' %s %s", pr->name, tr->guid,
                     print_tun_backend_driver(tr->windows_driver));
                 ++links;
             }
@@ -4045,7 +4045,7 @@ show_tap_win_adapters(int msglev, int warnlev)
             /* a TAP adapter exists without a link from the network
              * connections control panel */
             warn_panel_null = true;
-            msg(msglev, "[NULL] %s", tr->guid);
+            msg(msglevel, "[NULL] %s", tr->guid);
         }
     }
 
@@ -4064,18 +4064,18 @@ show_tap_win_adapters(int msglev, int warnlev)
     /* warn on registry inconsistencies */
     if (warn_tap_dup)
     {
-        msg(warnlev, "WARNING: Some TAP-Windows adapters have duplicate GUIDs");
+        msg(warnlevel, "WARNING: Some TAP-Windows adapters have duplicate GUIDs");
     }
 
     if (warn_panel_dup)
     {
-        msg(warnlev,
+        msg(warnlevel,
             "WARNING: Some TAP-Windows adapters have duplicate links from the Network Connections control panel");
     }
 
     if (warn_panel_null)
     {
-        msg(warnlev,
+        msg(warnlevel,
             "WARNING: Some TAP-Windows adapters have no link from the Network Connections control panel");
     }
 
@@ -4805,31 +4805,31 @@ format_ip_addr_string(const IP_ADDR_STRING *ip, struct gc_arena *gc)
  * Show info for a single adapter
  */
 static void
-show_adapter(int msglev, const IP_ADAPTER_INFO *a, struct gc_arena *gc)
-{
-    msg(msglev, "%s", a->Description);
-    msg(msglev, "  Index = %d", (int)a->Index);
-    msg(msglev, "  GUID = %s", a->AdapterName);
-    msg(msglev, "  IP = %s", format_ip_addr_string(&a->IpAddressList, gc));
-    msg(msglev, "  MAC = %s", format_hex_ex(a->Address, a->AddressLength, 0, 1, ":", gc));
-    msg(msglev, "  GATEWAY = %s", format_ip_addr_string(&a->GatewayList, gc));
+show_adapter(msglvl_t msglevel, const IP_ADAPTER_INFO *a, struct gc_arena *gc)
+{
+    msg(msglevel, "%s", a->Description);
+    msg(msglevel, "  Index = %d", (int)a->Index);
+    msg(msglevel, "  GUID = %s", a->AdapterName);
+    msg(msglevel, "  IP = %s", format_ip_addr_string(&a->IpAddressList, gc));
+    msg(msglevel, "  MAC = %s", format_hex_ex(a->Address, a->AddressLength, 0, 1, ":", gc));
+    msg(msglevel, "  GATEWAY = %s", format_ip_addr_string(&a->GatewayList, gc));
     if (a->DhcpEnabled)
     {
-        msg(msglev, "  DHCP SERV = %s", format_ip_addr_string(&a->DhcpServer, gc));
-        msg(msglev, "  DHCP LEASE OBTAINED = %s", time_string(a->LeaseObtained, 0, false, gc));
-        msg(msglev, "  DHCP LEASE EXPIRES  = %s", time_string(a->LeaseExpires, 0, false, gc));
+        msg(msglevel, "  DHCP SERV = %s", format_ip_addr_string(&a->DhcpServer, gc));
+        msg(msglevel, "  DHCP LEASE OBTAINED = %s", time_string(a->LeaseObtained, 0, false, gc));
+        msg(msglevel, "  DHCP LEASE EXPIRES  = %s", time_string(a->LeaseExpires, 0, false, gc));
     }
     if (a->HaveWins)
     {
-        msg(msglev, "  PRI WINS = %s", format_ip_addr_string(&a->PrimaryWinsServer, gc));
-        msg(msglev, "  SEC WINS = %s", format_ip_addr_string(&a->SecondaryWinsServer, gc));
+        msg(msglevel, "  PRI WINS = %s", format_ip_addr_string(&a->PrimaryWinsServer, gc));
+        msg(msglevel, "  SEC WINS = %s", format_ip_addr_string(&a->SecondaryWinsServer, gc));
     }
 
     {
         const IP_PER_ADAPTER_INFO *pai = get_per_adapter_info(a->Index, gc);
         if (pai)
         {
-            msg(msglev, "  DNS SERV = %s", format_ip_addr_string(&pai->DnsServerList, gc));
+            msg(msglevel, "  DNS SERV = %s", format_ip_addr_string(&pai->DnsServerList, gc));
         }
     }
 }
@@ -4838,12 +4838,12 @@ show_adapter(int msglev, const IP_ADAPTER_INFO *a, struct gc_arena *gc)
  * Show current adapter list
  */
 void
-show_adapters(int msglev)
+show_adapters(msglvl_t msglevel)
 {
     struct gc_arena gc = gc_new();
     const IP_ADAPTER_INFO *ai = get_adapter_info_list(&gc);
 
-    msg(msglev, "SYSTEM ADAPTER LIST");
+    msg(msglevel, "SYSTEM ADAPTER LIST");
     if (ai)
     {
         const IP_ADAPTER_INFO *a;
@@ -4851,7 +4851,7 @@ show_adapters(int msglev)
         /* find index in the linked list */
         for (a = ai; a != NULL; a = a->Next)
         {
-            show_adapter(msglev, a, &gc);
+            show_adapter(msglevel, a, &gc);
         }
     }
     gc_free(&gc);
@@ -5048,7 +5048,7 @@ dhcp_renew(const struct tuntap *tt)
 }
 
 static void
-exec_command(const char *prefix, const struct argv *a, int n, int msglevel)
+exec_command(const char *prefix, const struct argv *a, int n, msglvl_t msglevel)
 {
     int i;
     for (i = 0; i < n; ++i)
@@ -5069,7 +5069,7 @@ exec_command(const char *prefix, const struct argv *a, int n, int msglevel)
 }
 
 static void
-netsh_command(const struct argv *a, int n, int msglevel)
+netsh_command(const struct argv *a, int n, msglvl_t msglevel)
 {
     exec_command("NETSH", a, n, msglevel);
 }
diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
index 06fc729cd..6562c22f8 100644
--- a/src/openvpn/tun.h
+++ b/src/openvpn/tun.h
@@ -445,9 +445,9 @@ bool is_ip_in_adapter_subnet(const IP_ADAPTER_INFO *ai, const in_addr_t ip,
 DWORD adapter_index_of_ip(const IP_ADAPTER_INFO *list, const in_addr_t ip, int *count,
                           in_addr_t *netmask);
 
-void show_tap_win_adapters(int msglev, int warnlev);
+void show_tap_win_adapters(msglvl_t msglevel, msglvl_t warnlevel);
 
-void show_adapters(int msglev);
+void show_adapters(msglvl_t msglevel);
 
 void tap_allow_nonadmin_access(const char *dev_node);
 
diff --git a/tests/unit_tests/openvpn/mock_msg.c b/tests/unit_tests/openvpn/mock_msg.c
index 603520b90..69d2d1da1 100644
--- a/tests/unit_tests/openvpn/mock_msg.c
+++ b/tests/unit_tests/openvpn/mock_msg.c
@@ -38,8 +38,8 @@
 #include "error.h"
 #include "mock_msg.h"
 
-unsigned int x_debug_level = 0; /* Default to (almost) no debugging output */
-unsigned int print_x_debug_level = 0;
+msglvl_t x_debug_level = 0; /* Default to (almost) no debugging output */
+msglvl_t print_x_debug_level = 0;
 
 bool fatal_error_triggered = false;
 
@@ -47,31 +47,31 @@ char mock_msg_buf[MOCK_MSG_BUF];
 
 
 void
-mock_set_debug_level(int level)
+mock_set_debug_level(msglvl_t level)
 {
     x_debug_level = level;
 }
 
-int
+msglvl_t
 mock_get_debug_level(void)
 {
     return x_debug_level;
 }
 
 void
-mock_set_print_debug_level(int level)
+mock_set_print_debug_level(msglvl_t level)
 {
     print_x_debug_level = level;
 }
 
-int
+msglvl_t
 get_debug_level(void)
 {
     return x_debug_level;
 }
 
 void
-x_msg_va(const unsigned int flags, const char *format, va_list arglist)
+x_msg_va(const msglvl_t flags, const char *format, va_list arglist)
 {
     if (flags & M_FATAL)
     {
@@ -89,7 +89,7 @@ x_msg_va(const unsigned int flags, const char *format, va_list arglist)
 }
 
 void
-x_msg(const unsigned int flags, const char *format, ...)
+x_msg(const msglvl_t flags, const char *format, ...)
 {
     va_list arglist;
     va_start(arglist, format);
@@ -128,7 +128,7 @@ out_of_memory(void)
 }
 
 bool
-dont_mute(unsigned int flags)
+dont_mute(msglvl_t flags)
 {
     return true;
 }
diff --git a/tests/unit_tests/openvpn/mock_msg.h b/tests/unit_tests/openvpn/mock_msg.h
index f4ebc235a..6dddf0b93 100644
--- a/tests/unit_tests/openvpn/mock_msg.h
+++ b/tests/unit_tests/openvpn/mock_msg.h
@@ -28,17 +28,15 @@
  * this function from your test driver to increase debug output when you
  * need debug output.
  */
-void mock_set_debug_level(int level);
+void mock_set_debug_level(msglvl_t level);
 
 #define MOCK_MSG_BUF 2048
 
 extern bool fatal_error_triggered;
 extern char mock_msg_buf[MOCK_MSG_BUF];
 
-void mock_set_debug_level(int level);
+msglvl_t mock_get_debug_level(void);
 
-int mock_get_debug_level(void);
-
-void mock_set_print_debug_level(int level);
+void mock_set_print_debug_level(msglvl_t level);
 
 #endif /* MOCK_MSG */
diff --git a/tests/unit_tests/openvpn/mock_ssl_dependencies.c b/tests/unit_tests/openvpn/mock_ssl_dependencies.c
index 7333c473e..f2fa93aec 100644
--- a/tests/unit_tests/openvpn/mock_ssl_dependencies.c
+++ b/tests/unit_tests/openvpn/mock_ssl_dependencies.c
@@ -38,7 +38,7 @@
 
 int
 parse_line(const char *line, char **p, const int n, const char *file, const int line_num,
-           int msglevel, struct gc_arena *gc)
+           msglvl_t msglevel, struct gc_arena *gc)
 {
     /* Dummy function to get the linker happy, should never be called */
     assert_true(false);
diff --git a/tests/unit_tests/openvpn/test_argv.c b/tests/unit_tests/openvpn/test_argv.c
index a65857b3b..a04fabcba 100644
--- a/tests/unit_tests/openvpn/test_argv.c
+++ b/tests/unit_tests/openvpn/test_argv.c
@@ -23,7 +23,7 @@
 
 int
 __wrap_parse_line(const char *line, char **p, const int n, const char *file, const int line_num,
-                  int msglevel, struct gc_arena *gc)
+                  msglvl_t msglevel, struct gc_arena *gc)
 {
     p[0] = PATH1 PATH2;
     p[1] = PARAM1;
diff --git a/tests/unit_tests/openvpn/test_misc.c b/tests/unit_tests/openvpn/test_misc.c
index 93e2460af..dbfdd5624 100644
--- a/tests/unit_tests/openvpn/test_misc.c
+++ b/tests/unit_tests/openvpn/test_misc.c
@@ -339,8 +339,8 @@ test_atoi_variants(void **state)
     assert_false(valid_integer("-2147483653", false));
 
 
-    int msglevel = D_LOW;
-    int saved_log_level = mock_get_debug_level();
+    msglvl_t msglevel = D_LOW;
+    msglvl_t saved_log_level = mock_get_debug_level();
     mock_set_debug_level(D_LOW);
 
     /* check happy path */
diff --git a/tests/unit_tests/openvpn/test_pkcs11.c b/tests/unit_tests/openvpn/test_pkcs11.c
index 9ba6cfc20..d56886590 100644
--- a/tests/unit_tests/openvpn/test_pkcs11.c
+++ b/tests/unit_tests/openvpn/test_pkcs11.c
@@ -59,7 +59,7 @@ crypto_print_openssl_errors(const unsigned int flags)
 /* stubs for some unused functions instead of pulling in too many dependencies */
 int
 parse_line(const char *line, char **p, const int n, const char *file, const int line_num,
-           int msglevel, struct gc_arena *gc)
+           msglvl_t msglevel, struct gc_arena *gc)
 {
     assert_true(0);
     return 0;
diff --git a/tests/unit_tests/openvpn/test_pkt.c b/tests/unit_tests/openvpn/test_pkt.c
index 512276624..b6c612b43 100644
--- a/tests/unit_tests/openvpn/test_pkt.c
+++ b/tests/unit_tests/openvpn/test_pkt.c
@@ -45,7 +45,7 @@
 
 int
 parse_line(const char *line, char **p, const int n, const char *file, const int line_num,
-           int msglevel, struct gc_arena *gc)
+           msglvl_t msglevel, struct gc_arena *gc)
 {
     /* Dummy function to get the linker happy, should never be called */
     assert_true(false);
diff --git a/tests/unit_tests/openvpn/test_push_update_msg.c b/tests/unit_tests/openvpn/test_push_update_msg.c
index 87329b14f..8a5beebc5 100644
--- a/tests/unit_tests/openvpn/test_push_update_msg.c
+++ b/tests/unit_tests/openvpn/test_push_update_msg.c
@@ -111,7 +111,7 @@ tls_common_name(const struct tls_multi *multi, const bool null)
 
 #ifndef ENABLE_MANAGEMENT
 bool
-send_control_channel_string(struct context *c, const char *str, int msglevel)
+send_control_channel_string(struct context *c, const char *str, msglvl_t msglevel)
 {
     return true;
 }
@@ -120,7 +120,7 @@ char **res;
 int i;
 
 bool
-send_control_channel_string(struct context *c, const char *str, int msglevel)
+send_control_channel_string(struct context *c, const char *str, msglvl_t msglevel)
 {
     if (res && res[i] && strcmp(res[i], str))
     {
diff --git a/tests/unit_tests/openvpn/test_socket.c b/tests/unit_tests/openvpn/test_socket.c
index 2da2529c2..7f740ac7b 100644
--- a/tests/unit_tests/openvpn/test_socket.c
+++ b/tests/unit_tests/openvpn/test_socket.c
@@ -59,7 +59,7 @@ win32_signal_get(struct win32_signal *ws)
 
 int
 parse_line(const char *line, char **p, const int n, const char *file, const int line_num,
-           int msglevel, struct gc_arena *gc)
+           msglvl_t msglevel, struct gc_arena *gc)
 {
     assert_true(0);
     return 0;
diff --git a/tests/unit_tests/openvpn/test_tls_crypt.c b/tests/unit_tests/openvpn/test_tls_crypt.c
index 532bfcda3..44d51fef1 100644
--- a/tests/unit_tests/openvpn/test_tls_crypt.c
+++ b/tests/unit_tests/openvpn/test_tls_crypt.c
@@ -98,7 +98,7 @@ static const char *test_client_key_metadata =
 
 int
 __wrap_parse_line(const char *line, char **p, const int n, const char *file, const int line_num,
-                  int msglevel, struct gc_arena *gc)
+                  msglvl_t msglevel, struct gc_arena *gc)
 {
     p[0] = PATH1 PATH2;
     p[1] = PARAM1;
diff --git a/tests/unit_tests/openvpn/test_user_pass.c b/tests/unit_tests/openvpn/test_user_pass.c
index 460b37fca..32ec59f1c 100644
--- a/tests/unit_tests/openvpn/test_user_pass.c
+++ b/tests/unit_tests/openvpn/test_user_pass.c
@@ -73,7 +73,7 @@ management_query_user_pass(struct management *man, struct user_pass *up, const c
 /* stubs for some unused functions instead of pulling in too many dependencies */
 int
 parse_line(const char *line, char **p, const int n, const char *file, const int line_num,
-           int msglevel, struct gc_arena *gc)
+           msglvl_t msglevel, struct gc_arena *gc)
 {
     assert_true(0);
     return 0;