2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
8 * Copyright (C) 2002-2022 OpenVPN Inc <sales@openvpn.net>
9 * Copyright (C) 2008-2022 David Sommerseth <dazo@eurephia.org>
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2
13 * as published by the Free Software Foundation.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, write to the Free Software Foundation, Inc.,
22 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 * 2004-01-28: Added Socks5 proxy support
27 * (Christof Meerwald, http://cmeerw.org)
32 #elif defined(_MSC_VER)
33 #include "config-msvc.h"
35 #ifdef HAVE_CONFIG_VERSION_H
36 #include "config-version.h"
44 #include "run_command.h"
52 #include "packet_id.h"
61 #include "ssl_verify.h"
63 #include "xkey_common.h"
69 const char title_string
[] =
71 #ifdef CONFIGURE_GIT_REVISION
72 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS
"]"
75 #if defined(ENABLE_CRYPTO_MBEDTLS)
77 #elif defined(ENABLE_CRYPTO_OPENSSL)
81 #endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
89 #ifdef ENABLE_COMP_STUB
96 #ifdef PRODUCT_TAP_DEBUG
102 #if ENABLE_IP_PKTINFO
103 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
105 #elif defined(IP_RECVDSTADDR)
113 #ifdef CONFIGURE_GIT_REVISION
114 " built on " __DATE__
120 static const char usage_message
[] =
124 "--config file : Read configuration options from file.\n"
125 "--help : Show options.\n"
126 "--version : Show copyright and version information.\n"
129 "--local host : Local host name or ip address. Implies --bind.\n"
130 "--remote host [port] : Remote host name or ip address.\n"
131 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
132 "--remote-random-hostname : Add a random string to remote DNS name.\n"
133 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
134 "--proto p : Use protocol p for communicating with peer.\n"
135 " p = udp (default), tcp-server, tcp-client\n"
136 " udp4, tcp4-server, tcp4-client\n"
137 " udp6, tcp6-server, tcp6-client\n"
138 "--proto-force p : only consider protocol p in list of connection profiles.\n"
140 "--connect-retry n [m] : For client, number of seconds to wait between\n"
141 " connection retries (default=%d). On repeated retries\n"
142 " the wait time is exponentially increased to a maximum of m\n"
144 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
145 "--http-proxy s p [up] [auth] : Connect to remote host\n"
146 " through an HTTP proxy at address s and port p.\n"
147 " If proxy authentication is required,\n"
148 " up is a file containing username/password on 2 lines, or\n"
149 " 'stdin' to prompt from console. Add auth='ntlm' if\n"
150 " the proxy requires NTLM authentication.\n"
151 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
152 " determine auth method and query for username/password\n"
153 " if needed. auto-nct disables weak proxy auth methods.\n"
154 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
155 " Repeat to set multiple options.\n"
156 " VERSION version (default=1.0)\n"
157 " AGENT user-agent\n"
158 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
159 " address s and port p (default port = 1080).\n"
160 " If proxy authentication is required,\n"
161 " up is a file containing username/password on 2 lines, or\n"
162 " 'stdin' to prompt for console.\n"
163 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
164 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
165 " resolve for n seconds before failing (disabled by default).\n"
166 " Set n=\"infinite\" to retry indefinitely.\n"
167 "--float : Allow remote to change its IP address/port, such as through\n"
168 " DHCP (this is the default if --remote is not used).\n"
169 "--ipchange cmd : Run command cmd on remote ip address initial\n"
170 " setting or change -- execute as: cmd ip-address port#\n"
171 "--port port : TCP/UDP port # for both local and remote.\n"
172 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
173 "--rport port : TCP/UDP port # for remote (default=%s).\n"
174 "--bind : Bind to local address and port. (This is the default unless\n"
175 " --proto tcp-client"
179 "--nobind : Do not bind to local address and port.\n"
180 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n"
181 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
182 " this option only if the tun/tap device used with --dev\n"
183 " does not begin with \"tun\" or \"tap\".\n"
184 "--dev-node node : Explicitly set the device node rather than using\n"
185 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
186 #if defined(ENABLE_DCO)
187 "--disable-dco : Do not attempt using Data Channel Offload.\n"
189 "--lladdr hw : Set the link layer address of the tap device.\n"
190 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
191 #ifdef ENABLE_IPROUTE
192 "--iproute cmd : Use this command instead of default " IPROUTE_PATH
".\n"
194 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
195 " endpoint and rn as a remote endpoint. l & rn should be\n"
196 " swapped on the other peer. l & rn must be private\n"
197 " addresses outside of the subnets used by either peer.\n"
198 " TAP: configure device to use IP address l as a local\n"
199 " endpoint and rn as a subnet mask.\n"
200 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
201 " endpoint (as a /64) and r as remote endpoint\n"
202 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
203 " pass --ifconfig parms by environment to scripts.\n"
204 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
205 " connection doesn't match the remote side.\n"
206 "--route network [netmask] [gateway] [metric] :\n"
207 " Add route to routing table after connection\n"
208 " is established. Multiple routes can be specified.\n"
209 " netmask default: 255.255.255.255\n"
210 " gateway default: taken from --route-gateway or --ifconfig\n"
211 " Specify default by leaving blank or setting to \"default\".\n"
212 "--route-ipv6 network/bits [gateway] [metric] :\n"
213 " Add IPv6 route to routing table after connection\n"
214 " is established. Multiple routes can be specified.\n"
215 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
216 " in --ifconfig-ipv6\n"
217 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
218 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
219 "--route-metric m : Specify a default metric for use with --route.\n"
220 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
221 " adding routes (may be 0). If not specified, routes will\n"
222 " be added immediately after tun/tap open. On Windows, wait\n"
223 " up to w seconds for TUN/TAP adapter to come up.\n"
224 "--route-up cmd : Run command cmd after routes are added.\n"
225 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
226 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
227 " --route-up script using environmental variables.\n"
228 "--route-nopull : When used with --client or --pull, accept options pushed\n"
229 " by server EXCEPT for routes, dns, and dhcp options.\n"
230 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
231 " --ifconfig, --route, and --route-gateway.\n"
232 "--redirect-gateway [flags]: Automatically execute routing\n"
233 " commands to redirect all outgoing IP traffic through the\n"
234 " VPN. Add 'local' flag if both " PACKAGE_NAME
" servers are directly\n"
235 " connected via a common subnet, such as with WiFi.\n"
236 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
237 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
238 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
239 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
240 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
241 " the default gateway. Useful when pushing private subnets.\n"
242 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
243 " ICMPv6 host unreachable messages on the client.\n"
244 " (Server) Instead of forwarding IPv6 packets send\n"
245 " ICMPv6 host unreachable packets to the client.\n"
246 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
247 "--push-peer-info : (client only) push client info to server.\n"
248 "--setenv name value : Set a custom environmental variable to pass to script.\n"
249 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
250 " directives for future OpenVPN versions to be ignored.\n"
251 "--ignore-unkown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
252 " these options to be ignored when unknown\n"
253 "--script-security level: Where level can be:\n"
254 " 0 -- strictly no calling of external programs\n"
255 " 1 -- (default) only call built-ins such as ifconfig\n"
256 " 2 -- allow calling of built-ins and scripts\n"
257 " 3 -- allow password to be passed to scripts via env\n"
258 "--shaper n : Restrict output to peer to n bytes per second.\n"
259 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
260 " ping once every n seconds, restart if ping not received\n"
262 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
263 " produces a combined in/out byte count < bytes.\n"
264 "--session-timeout n: Limit connection time to n seconds.\n"
265 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
266 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
267 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
269 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
270 #if ENABLE_IP_PKTINFO
271 "--multihome : Configure a multi-homed UDP server.\n"
273 "--fast-io : (experimental) Optimize TUN/TAP/UDP writes.\n"
274 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
275 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
276 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
277 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
278 "--persist-key : Don't re-read key files across SIGUSR1 or --ping-restart.\n"
279 #if PASSTOS_CAPABILITY
280 "--passtos : TOS passthrough (applies to IPv4 only).\n"
282 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
283 " TCP/UDP MTU from it (default=%d).\n"
284 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
285 " as n bytes more than the tun-mtu size on read\n"
286 " (default TUN=0 TAP=%d).\n"
287 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
289 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
290 " 'no' -- Never send DF (Don't Fragment) frames\n"
291 " 'maybe' -- Use per-route hints\n"
292 " 'yes' -- Always DF (Don't Fragment)\n"
293 "--mtu-test : Empirically measure and report MTU.\n"
294 #ifdef ENABLE_FRAGMENT
295 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
296 " datagrams are sent which are larger than max bytes.\n"
297 " Adds 4 bytes of overhead per datagram.\n"
299 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
300 " or --fragment max value, whichever is lower.\n"
301 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
302 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
303 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
304 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
305 " can be matched in policy routing and packetfilter rules.\n"
306 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
307 " listening for connections. This allows sending encrypted packets\n"
308 " via a VRF present on the system.\n"
310 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
311 #ifdef ENABLE_MEMSTATS
312 "--memstats file : Write live usage stats to memory mapped binary file.\n"
314 "--mlock : Disable Paging -- ensures key material and tunnel\n"
315 " data will never be written to disk.\n"
316 "--up cmd : Run command cmd after successful tun device open.\n"
317 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
318 " ifconfig-local-ip ifconfig-remote-ip\n"
319 " (pre --user or --group UID/GID change)\n"
320 "--up-delay : Delay tun/tap open and possible --up script execution\n"
321 " until after TCP/UDP connection establishment with peer.\n"
322 "--down cmd : Run command cmd after tun device close.\n"
323 " (post --user/--group UID/GID change and/or --chroot)\n"
324 " (command parameters are same as --up option)\n"
325 "--down-pre : Run --down command before TUN/TAP close.\n"
326 "--up-restart : Run up/down commands for all restarts including those\n"
327 " caused by --ping-restart or SIGUSR1\n"
328 "--user user : Set UID to user after initialization.\n"
329 "--group group : Set GID to group after initialization.\n"
330 "--chroot dir : Chroot to this directory after initialization.\n"
331 #ifdef ENABLE_SELINUX
332 "--setcon context: Apply this SELinux context after initialization.\n"
334 "--cd dir : Change to this directory before initialization.\n"
335 "--daemon [name] : Become a daemon after initialization.\n"
336 " The optional 'name' parameter will be passed\n"
337 " as the program name to the system logger.\n"
338 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
339 " See --daemon above for a description of the 'name' parm.\n"
340 "--log file : Output log to file which is created/truncated on open.\n"
341 "--log-append file : Append log to file, or create file if nonexistent.\n"
342 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
343 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
344 "--writepid file : Write main process ID to file.\n"
345 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
346 "--echo [parms ...] : Echo parameters to log output.\n"
347 "--verb n : Set output verbosity to n (default=%d):\n"
348 " (Level 3 is recommended if you want a good summary\n"
349 " of what's happening without being swamped by output).\n"
350 " : 0 -- no output except fatal errors\n"
351 " : 1 -- startup info + connection initiated messages +\n"
352 " non-fatal encryption & net errors\n"
353 " : 2,3 -- show TLS negotiations & route info\n"
354 " : 4 -- show parameters\n"
355 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
356 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
357 " : 6 to 11 -- debug messages of increasing verbosity\n"
358 "--mute n : Log at most n consecutive messages in the same category.\n"
359 "--status file [n] : Write operational status to file every n seconds.\n"
360 "--status-version [n] : Choose the status file format version number.\n"
361 " Currently, n can be 1, 2, or 3 (default=1).\n"
362 "--disable-occ : Disable options consistency check between peers.\n"
364 "--gremlin mask : Special stress testing mode (for debugging only).\n"
366 #if defined(USE_COMP)
367 "--compress alg : Use compression algorithm alg\n"
368 "--allow-compression: Specify whether compression should be allowed\n"
369 #if defined(ENABLE_LZO)
370 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
371 " packet for incompressible data.\n"
372 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
376 #ifdef ENABLE_MANAGEMENT
377 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
378 " management functions. pass is a password file\n"
379 " or 'stdin' to prompt from console.\n"
380 #if UNIX_SOCK_SUPPORT
381 " To listen on a unix domain socket, specific the pathname\n"
382 " in place of ip and use 'unix' as the port number.\n"
384 "--management-client : Management interface will connect as a TCP client to\n"
385 " ip/port rather than listen as a TCP server.\n"
386 "--management-query-passwords : Query management channel for private key\n"
387 " and auth-user-pass passwords.\n"
388 "--management-query-proxy : Query management channel for proxy information.\n"
389 "--management-query-remote : Query management channel for --remote directive.\n"
390 "--management-hold : Start " PACKAGE_NAME
" in a hibernating state, until a client\n"
391 " of the management interface explicitly starts it.\n"
392 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
393 "--management-forget-disconnect : Forget passwords when management disconnect\n"
395 "--management-up-down : Report tunnel up/down events to management interface.\n"
396 "--management-log-cache n : Cache n lines of log file history for usage\n"
397 " by the management channel.\n"
398 #if UNIX_SOCK_SUPPORT
399 "--management-client-user u : When management interface is a unix socket, only\n"
400 " allow connections from user u.\n"
401 "--management-client-group g : When management interface is a unix socket, only\n"
402 " allow connections from group g.\n"
404 "--management-client-auth : gives management interface client the responsibility\n"
405 " to authenticate clients after their client certificate\n"
406 " has been verified.\n"
407 #endif /* ifdef ENABLE_MANAGEMENT */
409 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
410 " to its initialization function.\n"
412 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
413 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
414 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
416 "Multi-Client Server options (when --mode server is used):\n"
417 "--server network netmask : Helper option to easily configure server mode.\n"
418 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
419 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
420 " easily configure ethernet bridging server mode.\n"
421 "--push \"option\" : Push a config file option back to the peer for remote\n"
422 " execution. Peer must specify --pull in its config file.\n"
423 "--push-reset : Don't inherit global push list for specific\n"
424 " client instance.\n"
425 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
426 " a specific client instance.\n"
427 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
428 " to be dynamically allocated to connecting clients.\n"
429 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
430 " data to file, at seconds intervals (default=600).\n"
431 " If seconds=0, file will be treated as read-only.\n"
432 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
433 " to be dynamically allocated to connecting clients.\n"
434 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
435 " overrides --ifconfig-pool dynamic allocation.\n"
436 " Only valid in a client-specific config file.\n"
437 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
438 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
439 " Only valid in a client-specific config file.\n"
440 "--iroute network [netmask] : Route subnet to client.\n"
441 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
442 " Sets up internal routes only.\n"
443 " Only valid in a client-specific config file.\n"
444 "--disable : Client is disabled.\n"
445 " Only valid in a client-specific config file.\n"
446 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
447 " mandatory client certificate verification.\n"
448 " Default is to require the client to supply a certificate.\n"
449 "--username-as-common-name : For auth-user-pass authentication, use\n"
450 " the authenticated username as the common name,\n"
451 " rather than the common name from the client cert.\n"
452 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
453 " run command cmd to verify. If method='via-env', pass\n"
454 " user/pass via environment, if method='via-file', pass\n"
455 " user/pass via temporary file.\n"
456 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
457 " to each client, replacing the password. Useful when\n"
458 " OTP based two-factor auth mechanisms are in use and\n"
459 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
460 " for generated tokens can be set.\n"
461 "--opt-verify : Clients that connect with options that are incompatible\n"
462 " with those of the server will be disconnected.\n"
463 "--auth-user-pass-optional : Allow connections by clients that don't\n"
464 " specify a username/password.\n"
465 "--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n"
466 " any printable character.\n"
467 "--client-to-client : Internally route client-to-client traffic.\n"
468 "--duplicate-cn : Allow multiple clients with the same common name to\n"
469 " concurrently connect.\n"
470 "--client-connect cmd : Run command cmd on client connection.\n"
471 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
472 "--client-config-dir dir : Directory for custom client config files.\n"
473 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
474 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
475 "--hash-size r v : Set the size of the real address hash table to r and the\n"
476 " virtual address table to v.\n"
477 "--bcast-buffers n : Allocate n broadcast buffers.\n"
478 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
479 "--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server\n"
480 " as well as pushes it to connecting clients.\n"
481 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
482 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
483 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
484 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
485 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
486 " older than n seconds. Run this check every t\n"
487 " seconds (defaults to n).\n"
488 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
489 " clients. n = 1 - reconnect to same server,\n"
490 " 2 - advance to next server, default=1.\n"
492 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
493 " sessions to a web server at host:port. dir specifies an\n"
494 " optional directory to write origin IP:port data.\n"
497 "Client options (when connecting to a multi-client server):\n"
498 "--client : Helper option to easily configure client mode.\n"
499 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
500 " up is a file containing the username on the first line,\n"
501 " and a password on the second. If either the password or both\n"
502 " the username and the password are omitted OpenVPN will prompt\n"
503 " for them from console.\n"
504 "--pull : Accept certain config file options from the peer as if they\n"
505 " were part of the local config file. Must be specified\n"
506 " when connecting to a '--mode server' remote host.\n"
507 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
508 " server if it starts with the text t. The action flag accept,\n"
509 " ignore or reject causes the option to be allowed, removed or\n"
510 " rejected with error. May be specified multiple times, and\n"
511 " each filter is applied in the order of appearance.\n"
512 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
513 " Valid options are :\n"
514 " address <addr[:port]> [addr[:port]] : server address 4/6\n"
515 " resolve-domains <domain> [domain ...] : split domains\n"
516 " exclude-domains <domain> [domain ...] : domains not to resolve\n"
517 " dnssec <yes|no|optional> : option to use DNSSEC\n"
518 " type <DoH|DoT> : query server over HTTPS / TLS\n"
519 " sni <domain> : DNS server name indication\n"
520 "--dns search-domains <domain> [domain ...]:\n"
521 " Add domains to DNS domain search list\n"
522 "--auth-retry t : How to handle auth failures. Set t to\n"
523 " none (default), interact, or nointeract.\n"
524 "--static-challenge t e : Enable static challenge/response protocol using\n"
525 " challenge text t, with e indicating echo flag (0|1)\n"
526 "--connect-timeout n : when polling possible remote servers to connect to\n"
527 " in a round-robin fashion, spend no more than n seconds\n"
528 " waiting for a response before trying the next server.\n"
529 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
530 " incoming tun packets with same destination as host.\n"
531 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
532 " server/remote. n = # of retries, default=1.\n"
534 "Data Channel Encryption Options (must be compatible between peers):\n"
535 "(These options are meaningful for both Static Key & TLS-mode)\n"
536 "--secret f [d] : (DEPRECATED) Enable Static Key encryption mode (non-TLS).\n"
537 " Use shared secret file f, generate with --genkey.\n"
538 " The optional d parameter controls key directionality.\n"
539 " If d is specified, use separate keys for each\n"
540 " direction, set d=0 on one side of the connection,\n"
541 " and d=1 on the other side.\n"
542 "--auth alg : Authenticate packets with HMAC using message\n"
543 " digest algorithm alg (default=%s).\n"
544 " (usually adds 16 or 20 bytes per packet)\n"
545 " Set alg=none to disable authentication.\n"
546 "--cipher alg : Encrypt packets with cipher algorithm alg\n"
548 " Set alg=none to disable encryption.\n"
549 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
550 #ifndef ENABLE_CRYPTO_MBEDTLS
551 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
553 "--no-replay : (DEPRECATED) Disable replay protection.\n"
554 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
555 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
556 " and a time window of t seconds.\n"
557 " Default n=%d t=%d\n"
558 "--replay-persist file : Persist replay-protection state across sessions\n"
560 "--test-crypto : Run a self-test of crypto features enabled.\n"
561 " For debugging only.\n"
562 #ifdef ENABLE_PREDICTION_RESISTANCE
563 "--use-prediction-resistance: Enable prediction resistance on the random\n"
564 " number generator.\n"
567 "TLS Key Negotiation Options:\n"
568 "(These options are meaningful only for TLS-mode)\n"
569 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
570 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
571 "--key-method m : (DEPRECATED) Data channel key exchange method. m should be a method\n"
572 " number, such as 1 (default), 2, etc.\n"
573 "--ca file : Certificate authority file in .pem format containing\n"
574 " root certificate.\n"
575 #ifndef ENABLE_CRYPTO_MBEDTLS
576 "--capath dir : A directory of trusted certificates (CAs"
578 #endif /* ENABLE_CRYPTO_MBEDTLS */
579 "--dh file : File containing Diffie Hellman parameters\n"
580 " in .pem format (for --tls-server only).\n"
581 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
582 "--cert file : Local certificate in .pem format -- must be signed\n"
583 " by a Certificate Authority in --ca file.\n"
584 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
585 "--key file : Local private key in .pem format.\n"
586 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
587 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
588 " is specified, require max TLS version supported by SSL implementation.\n"
589 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
590 #ifndef ENABLE_CRYPTO_MBEDTLS
591 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
592 " and optionally the root CA certificate.\n"
594 #ifdef ENABLE_X509ALTUSERNAME
595 "--x509-username-field : Field in x509 certificate containing the username.\n"
596 " Default is CN in the Subject field.\n"
598 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
599 " Valid algo flags are SHA1 and SHA256. \n"
601 "--cryptoapicert select-string : Load the certificate and private key from the\n"
602 " Windows Certificate System Store.\n"
604 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
605 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites seperated by : (optional)\n"
606 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
607 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
608 " (default=legacy).\n"
609 "--providers l : A list l of OpenSSL providers to load.\n"
610 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
611 " if no ACK from remote within n seconds (default=%d).\n"
612 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
613 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
614 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
615 " and at least min (defaults to 90%% of max on servers and equal\n"
616 " to max on clients).\n"
617 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
618 " of handshake initiation by any peer (default=%d).\n"
619 "--tran-window n : Transition window -- old key can live this many seconds\n"
620 " after new key renegotiation begins (default=%d).\n"
621 "--single-session: Allow only one session (reset state on restart).\n"
622 "--tls-exit : Exit on TLS negotiation failure.\n"
623 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
624 " control channel to protect against attacks on the TLS stack\n"
625 " and DoS attacks.\n"
626 " f (required) is a shared-secret key file.\n"
627 " The optional d parameter controls key directionality,\n"
628 " see --secret option for more info.\n"
629 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
630 " of the TLS control channel to hide the TLS certificate,\n"
631 " provide basic post-quantum security and protect against\n"
632 " attacks on the TLS stack and DoS attacks.\n"
633 " key (required) provides the pre-shared key file.\n"
634 " see --secret option for more info.\n"
635 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
636 " For servers: use key to decrypt client-specific keys. For\n"
637 " key generation (--genkey tls-crypt-v2-client): use key to\n"
638 " encrypt generated client-specific key. (See --tls-crypt.)\n"
639 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
640 " fresh tls-crypt-v2 client key, and store to\n"
641 " keyfile. If supplied, include metadata in wrapped key.\n"
642 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
643 " fresh tls-crypt-v2 server key, and store to keyfile\n"
644 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
645 " client-supplied tls-crypt-v2 client key\n"
646 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
647 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
648 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
649 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
650 " pending TLS connection that has otherwise passed all other\n"
651 " tests of certification. cmd should return 0 to allow\n"
652 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
653 " executed as 'cmd certificate_depth subject')\n"
654 "--tls-export-cert [directory] : Get peer cert in PEM format and store it \n"
655 " in an openvpn temporary file in [directory]. Peer cert is \n"
656 " stored before tls-verify script execution and deleted after.\n"
657 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
658 " DN name. The remote host must also pass all other tests\n"
659 " of verification.\n"
660 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
661 " an explicit nsCertType designation t = 'client' | 'server'.\n"
662 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
663 " plugins and management interface.\n"
664 #ifdef HAVE_EXPORT_KEYING_MATERIAL
665 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
666 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
668 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
669 " explicit key usage, you can specify more than one value.\n"
670 " value should be given in hex format.\n"
671 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
672 " explicit extended key usage. Extended key usage can be encoded\n"
673 " as an object identifier or OpenSSL string representation.\n"
674 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
675 " key usage and extended key usage based on RFC3280 TLS rules.\n"
676 " t = 'client' | 'server'.\n"
680 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
681 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
682 " path. Set for each provider.\n"
683 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
684 " 0 : Try to determine automatically (default).\n"
686 " 2 : Use SignRecover.\n"
687 " 4 : Use Decrypt.\n"
689 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
690 " certificate can be accessed. Set for each provider.\n"
691 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
692 " cache until token is removed.\n"
693 "--pkcs11-id-management : Acquire identity from management interface.\n"
694 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
695 #endif /* ENABLE_PKCS11 */
697 "SSL Library information:\n"
698 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
699 "--show-digests : Show message digest algorithms to use with --auth option.\n"
700 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
701 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
704 "Windows Specific:\n"
705 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
706 " from SystemRoot environment variable.\n"
707 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
708 " IP address using method = manual, netsh, ipapi,\n"
709 " dynamic, or adaptive (default = adaptive).\n"
710 " Dynamic method allows two optional parameters:\n"
711 " offset: DHCP server address offset (> -256 and < 256).\n"
712 " If 0, use network address, if >0, take nth\n"
713 " address forward from network address, if <0,\n"
714 " take nth address backward from broadcast\n"
717 " lease-time: Lease time in seconds.\n"
718 " Default is one year.\n"
719 "--route-method : Which method to use for adding routes on Windows?\n"
720 " adaptive (default) -- Try ipapi then fall back to exe.\n"
721 " ipapi -- Use IP helper API.\n"
722 " exe -- Call the route.exe shell command.\n"
723 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
724 " be used with --ip-win32 dynamic. For options\n"
725 " which allow multiple addresses,\n"
726 " --dhcp-option must be repeated.\n"
727 " DOMAIN name : Set DNS suffix\n"
728 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
729 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
730 " NTP : Set NTP server address(es)\n"
731 " NBDD : Set NBDD server address(es)\n"
732 " WINS addr : Set WINS server address(es)\n"
733 " NBT type : Set NetBIOS over TCP/IP Node type\n"
734 " 1: B, 2: P, 4: M, 8: H\n"
735 " NBS id : Set NetBIOS scope ID\n"
736 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
737 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
738 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
740 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
741 " on connection initiation.\n"
742 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
743 " attempting to set adapter properties.\n"
744 "--pause-exit : When run from a console window, pause before exiting.\n"
745 "--service ex [0|1] : For use when " PACKAGE_NAME
" is being instantiated by a\n"
746 " service, and should not be used directly by end-users.\n"
747 " ex is the name of an event object which, when\n"
748 " signaled, will cause " PACKAGE_NAME
" to exit. A second\n"
749 " optional parameter controls the initial state of ex.\n"
750 "--show-net-up : Show " PACKAGE_NAME
"'s view of routing table and net adapter list\n"
751 " after TAP adapter is up and routes have been added.\n"
752 "--windows-driver : Which tun driver to use?\n"
753 " ovpn-dco (default)\n"
756 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
757 "Windows Standalone Options:\n"
759 "--show-adapters : Show all TAP-Windows adapters.\n"
760 "--show-net : Show " PACKAGE_NAME
"'s view of routing table and net adapter list.\n"
761 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
762 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME
" running without admin privileges\n"
763 " to access TAP adapter.\n"
764 #endif /* ifdef _WIN32 */
766 "Generate a new key :\n"
767 "--genkey secret file : Generate a new random key of type and write to file\n"
768 " (for use with --secret, --tls-auth or --tls-crypt)."
769 #ifdef ENABLE_FEATURE_TUN_PERSIST
771 "Tun/tap config mode (available with linux 2.4+):\n"
772 "--mktun : Create a persistent tunnel.\n"
773 "--rmtun : Remove a persistent tunnel.\n"
774 "--dev tunX|tapX : tun/tap device\n"
775 "--dev-type dt : Device type. See tunnel options above for details.\n"
776 "--user user : User to set privilege to.\n"
777 "--group group : Group to set privilege to.\n"
781 "PKCS#11 standalone options:\n"
782 #ifdef DEFAULT_PKCS11_MODULE
783 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
785 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
787 " --verb option can be added *BEFORE* this.\n"
788 #endif /* ENABLE_PKCS11 */
790 "General Standalone Options:\n"
792 "--show-gateway : Show info about default gateway.\n"
796 #endif /* !ENABLE_SMALL */
799 * This is where the options defaults go.
800 * Any option not explicitly set here
804 init_options(struct options
*o
, const bool init_gc
)
810 gc_init(&o
->dns_options
.gc
);
813 o
->mode
= MODE_POINT_TO_POINT
;
814 o
->topology
= TOP_NET30
;
815 o
->ce
.proto
= PROTO_UDP
;
816 o
->ce
.af
= AF_UNSPEC
;
817 o
->ce
.bind_ipv6_only
= false;
818 o
->ce
.connect_retry_seconds
= 5;
819 o
->ce
.connect_retry_seconds_max
= 300;
820 o
->ce
.connect_timeout
= 120;
821 o
->connect_retry_max
= 0;
822 o
->ce
.local_port
= o
->ce
.remote_port
= OPENVPN_PORT
;
824 o
->status_file_update_freq
= 60;
825 o
->status_file_version
= 1;
826 o
->ce
.bind_local
= true;
827 o
->ce
.tun_mtu
= TUN_MTU_DEFAULT
;
829 o
->ce
.link_mtu
= LINK_MTU_DEFAULT
;
830 o
->ce
.tls_mtu
= TLS_MTU_DEFAULT
;
831 o
->ce
.mtu_discover_type
= -1;
833 o
->ce
.mssfix_default
= true;
834 o
->ce
.mssfix_encap
= true;
835 o
->route_delay_window
= 30;
836 o
->resolve_retry_seconds
= RESOLV_RETRY_INFINITE
;
837 o
->resolve_in_advance
= false;
840 #ifdef ENABLE_MANAGEMENT
841 o
->management_log_history_cache
= 250;
842 o
->management_echo_buffer_size
= 100;
843 o
->management_state_buffer_size
= 100;
845 #ifdef ENABLE_FEATURE_TUN_PERSIST
850 o
->tuntap_options
.ip_win32_type
= IPW32_SET_ADAPTIVE
;
852 o
->tuntap_options
.ip_win32_type
= IPW32_SET_DHCP_MASQ
;
854 o
->tuntap_options
.dhcp_lease_time
= 31536000; /* one year */
855 o
->tuntap_options
.dhcp_masq_offset
= 0; /* use network address as internal DHCP server address */
856 o
->route_method
= ROUTE_METHOD_ADAPTIVE
;
857 o
->block_outside_dns
= false;
858 o
->windows_driver
= WINDOWS_DRIVER_UNSPECIFIED
;
860 o
->vlan_accept
= VLAN_ALL
;
862 o
->real_hash_size
= 256;
863 o
->virtual_hash_size
= 256;
864 o
->n_bcast_buf
= 256;
865 o
->tcp_queue_limit
= 64;
866 o
->max_clients
= 1024;
867 o
->max_routes_per_client
= 256;
868 o
->stale_routes_check_interval
= 0;
869 o
->ifconfig_pool_persist_refresh_freq
= 600;
870 o
->scheduled_exit_interval
= 5;
871 o
->authname
= "SHA1";
873 o
->replay_window
= DEFAULT_SEQ_BACKTRACK
;
874 o
->replay_time
= DEFAULT_TIME_BACKTRACK
;
875 o
->key_direction
= KEY_DIRECTION_BIDIRECTIONAL
;
876 #ifdef ENABLE_PREDICTION_RESISTANCE
877 o
->use_prediction_resistance
= false;
880 o
->renegotiate_bytes
= -1;
881 o
->renegotiate_seconds
= 3600;
882 o
->renegotiate_seconds_min
= -1;
883 o
->handshake_window
= 60;
884 o
->transition_window
= 3600;
885 o
->tls_cert_profile
= NULL
;
886 o
->ecdh_curve
= NULL
;
887 #ifdef ENABLE_X509ALTUSERNAME
888 o
->x509_username_field
[0] = X509_USERNAME_FIELD_DEFAULT
;
891 o
->pkcs11_pin_cache_period
= -1;
892 #endif /* ENABLE_PKCS11 */
894 /* P2MP server context features */
895 o
->auth_token_generate
= false;
897 /* Set default --tmp-dir */
899 /* On Windows, find temp dir via environment variables */
900 o
->tmp_dir
= win_get_tempdir();
902 /* Non-windows platforms use $TMPDIR, and if not set, default to '/tmp' */
903 o
->tmp_dir
= getenv("TMPDIR");
909 o
->allow_recursive_routing
= false;
912 o
->tuntap_options
.disable_dco
= true;
913 #endif /* ENABLE_DCO */
917 uninit_options(struct options
*o
)
922 gc_free(&o
->dns_options
.gc
);
928 #define PUF_TYPE_UNDEF 0 /** undefined filter type */
929 #define PUF_TYPE_ACCEPT 1 /** filter type to accept a matching option */
930 #define PUF_TYPE_IGNORE 2 /** filter type to ignore a matching option */
931 #define PUF_TYPE_REJECT 3 /** filter type to reject and trigger SIGUSR1 */
935 struct pull_filter
*next
;
938 struct pull_filter_list
940 struct pull_filter
*head
;
941 struct pull_filter
*tail
;
947 pull_filter_type_name(int type
)
949 if (type
== PUF_TYPE_ACCEPT
)
953 if (type
== PUF_TYPE_IGNORE
)
957 if (type
== PUF_TYPE_REJECT
)
967 #define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
968 #define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
969 #define SHOW_STR_INLINE(var) SHOW_PARM(var, \
970 o->var ## _inline ? "[INLINE]" : \
971 (o->var ? o->var : "[UNDEF]"), \
973 #define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
974 #define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
975 #define SHOW_INT64(var) SHOW_PARM(var, o->var, "%" PRIi64)
976 #define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
977 #define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
979 #endif /* ifndef ENABLE_SMALL */
982 setenv_connection_entry(struct env_set
*es
,
983 const struct connection_entry
*e
,
986 setenv_str_i(es
, "proto", proto2ascii(e
->proto
, e
->af
, false), i
);
987 setenv_str_i(es
, "local", e
->local
, i
);
988 setenv_str_i(es
, "local_port", e
->local_port
, i
);
989 setenv_str_i(es
, "remote", e
->remote
, i
);
990 setenv_str_i(es
, "remote_port", e
->remote_port
, i
);
992 if (e
->http_proxy_options
)
994 setenv_str_i(es
, "http_proxy_server", e
->http_proxy_options
->server
, i
);
995 setenv_str_i(es
, "http_proxy_port", e
->http_proxy_options
->port
, i
);
997 if (e
->socks_proxy_server
)
999 setenv_str_i(es
, "socks_proxy_server", e
->socks_proxy_server
, i
);
1000 setenv_str_i(es
, "socks_proxy_port", e
->socks_proxy_port
, i
);
1005 setenv_settings(struct env_set
*es
, const struct options
*o
)
1007 setenv_str(es
, "config", o
->config
);
1008 setenv_int(es
, "verb", o
->verbosity
);
1009 setenv_int(es
, "daemon", o
->daemon
);
1010 setenv_int(es
, "daemon_log_redirect", o
->log
);
1011 setenv_long_long(es
, "daemon_start_time", time(NULL
));
1012 setenv_int(es
, "daemon_pid", platform_getpid());
1014 if (o
->connection_list
)
1017 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
1019 setenv_connection_entry(es
, o
->connection_list
->array
[i
], i
+1);
1024 setenv_connection_entry(es
, &o
->ce
, 1);
1029 setenv_dns_options(&o
->dns_options
, es
);
1034 setenv_foreign_option(struct options
*o
, const char *argv
[], int len
, struct env_set
*es
)
1038 struct gc_arena gc
= gc_new();
1039 struct buffer name
= alloc_buf_gc(OPTION_PARM_SIZE
, &gc
);
1040 struct buffer value
= alloc_buf_gc(OPTION_PARM_SIZE
, &gc
);
1045 good
&= buf_printf(&name
, "foreign_option_%d", o
->foreign_option_index
+ 1);
1046 ++o
->foreign_option_index
;
1047 for (i
= 0; i
< len
; ++i
)
1053 good
&= buf_printf(&value
, " ");
1055 good
&= buf_printf(&value
, "%s", argv
[i
]);
1061 setenv_str(es
, BSTR(&name
), BSTR(&value
));
1065 msg(M_WARN
, "foreign_option: name/value overflow");
1072 get_ip_addr(const char *ip_string
, int msglevel
, bool *error
)
1074 unsigned int flags
= GETADDR_HOST_ORDER
;
1075 bool succeeded
= false;
1078 if (msglevel
& M_FATAL
)
1080 flags
|= GETADDR_FATAL
;
1083 ret
= getaddr(flags
, ip_string
, 0, &succeeded
, NULL
);
1084 if (!succeeded
&& error
)
1092 * Returns newly allocated string containing address part without "/nn".
1094 * If gc != NULL, the allocated memory is registered in the supplied gc.
1097 get_ipv6_addr_no_netbits(const char *addr
, struct gc_arena
*gc
)
1099 const char *end
= strchr(addr
, '/');
1103 ret
= string_alloc(addr
, gc
);
1107 size_t len
= end
- addr
;
1108 ret
= gc_malloc(len
+ 1, true, gc
);
1109 memcpy(ret
, addr
, len
);
1115 ipv6_addr_safe_hexplusbits( const char *ipv6_prefix_spec
)
1117 struct in6_addr t_addr
;
1118 unsigned int t_bits
;
1120 return get_ipv6_addr( ipv6_prefix_spec
, &t_addr
, &t_bits
, M_WARN
);
1124 string_substitute(const char *src
, int from
, int to
, struct gc_arena
*gc
)
1126 char *ret
= (char *) gc_malloc(strlen(src
) + 1, true, gc
);
1144 * Parses a hexstring and checks if the string has the correct length. Return
1145 * a verify_hash_list containing the parsed hash string.
1147 * @param str String to check/parse
1148 * @param nbytes Number of bytes expected in the hexstr (e.g. 20 for SHA1)
1149 * @param msglevel message level to use when printing warnings/errors
1150 * @param gc The returned object will be allocated in this gc
1152 static struct verify_hash_list
*
1153 parse_hash_fingerprint(const char *str
, int nbytes
, int msglevel
, struct gc_arena
*gc
)
1156 const char *cp
= str
;
1158 struct verify_hash_list
*ret
;
1159 ALLOC_OBJ_CLEAR_GC(ret
, struct verify_hash_list
, gc
);
1164 while (*cp
&& i
< nbytes
)
1166 /* valid segments consist of exactly two hex digits, then ':' or EOS */
1167 if (!isxdigit(cp
[0])
1169 || (cp
[2] != ':' && cp
[2] != '\0')
1170 || sscanf(cp
, "%x", &byte
) != 1)
1172 msg(msglevel
, "format error in hash fingerprint: %s", str
);
1176 ret
->hash
[i
++] = (uint8_t)byte
;
1187 msg(msglevel
, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes
, i
, str
);
1189 else if (term
!= '\0')
1191 msg(msglevel
, "hash fingerprint too long - expected only %d bytes: %s", nbytes
, str
);
1197 * Parses a string consisting of multiple lines of hexstrings and checks if each
1198 * string has the correct length. Empty lines are ignored. Returns
1199 * a linked list of (possibly) multiple verify_hash_list objects.
1201 * @param str String to check/parse
1202 * @param nbytes Number of bytes expected in the hexstring (e.g. 20 for SHA1)
1203 * @param msglevel message level to use when printing warnings/errors
1204 * @param gc The returned list items will be allocated in this gc
1206 static struct verify_hash_list
*
1207 parse_hash_fingerprint_multiline(const char *str
, int nbytes
, int msglevel
,
1208 struct gc_arena
*gc
)
1210 struct gc_arena gc_temp
= gc_new();
1211 char *lines
= string_alloc(str
, &gc_temp
);
1213 struct verify_hash_list
*ret
= NULL
;
1216 while ((line
= strsep(&lines
, "\n")))
1218 /* ignore leading whitespace */
1219 while (isspace(*line
))
1223 /* skip empty lines and comment lines */
1224 if (strlen(line
) == 0 || *line
== '#' || *line
== ';')
1229 struct verify_hash_list
*hash
= parse_hash_fingerprint(line
, nbytes
,
1247 #ifndef ENABLE_SMALL
1250 show_dhcp_option_list(const char *name
, const char *const *array
, int len
)
1253 for (i
= 0; i
< len
; ++i
)
1255 msg(D_SHOW_PARMS
, " %s[%d] = %s", name
, i
, array
[i
] );
1260 show_dhcp_option_addrs(const char *name
, const in_addr_t
*array
, int len
)
1262 struct gc_arena gc
= gc_new();
1264 for (i
= 0; i
< len
; ++i
)
1266 msg(D_SHOW_PARMS
, " %s[%d] = %s",
1269 print_in_addr_t(array
[i
], 0, &gc
));
1275 show_tuntap_options(const struct tuntap_options
*o
)
1277 SHOW_BOOL(ip_win32_defined
);
1278 SHOW_INT(ip_win32_type
);
1279 SHOW_INT(dhcp_masq_offset
);
1280 SHOW_INT(dhcp_lease_time
);
1281 SHOW_INT(tap_sleep
);
1282 SHOW_BOOL(dhcp_options
);
1283 SHOW_BOOL(dhcp_renew
);
1284 SHOW_BOOL(dhcp_pre_release
);
1286 SHOW_STR(netbios_scope
);
1287 SHOW_INT(netbios_node_type
);
1288 SHOW_BOOL(disable_nbt
);
1290 show_dhcp_option_addrs("DNS", o
->dns
, o
->dns_len
);
1291 show_dhcp_option_addrs("WINS", o
->wins
, o
->wins_len
);
1292 show_dhcp_option_addrs("NTP", o
->ntp
, o
->ntp_len
);
1293 show_dhcp_option_addrs("NBDD", o
->nbdd
, o
->nbdd_len
);
1294 show_dhcp_option_list("DOMAIN-SEARCH", o
->domain_search_list
, o
->domain_search_list_len
);
1297 #endif /* ifndef ENABLE_SMALL */
1298 #endif /* ifdef _WIN32 */
1300 #if defined(_WIN32) || defined(TARGET_ANDROID)
1302 dhcp_option_dns6_parse(const char *parm
, struct in6_addr
*dns6_list
, int *len
, int msglevel
)
1304 struct in6_addr addr
;
1305 if (*len
>= N_DHCP_ADDR
)
1307 msg(msglevel
, "--dhcp-option DNS: maximum of %d IPv6 dns servers can be specified",
1310 else if (get_ipv6_addr(parm
, &addr
, NULL
, msglevel
))
1312 dns6_list
[(*len
)++] = addr
;
1316 dhcp_option_address_parse(const char *name
, const char *parm
, in_addr_t
*array
, int *len
, int msglevel
)
1318 if (*len
>= N_DHCP_ADDR
)
1320 msg(msglevel
, "--dhcp-option %s: maximum of %d %s servers can be specified",
1327 if (ip_addr_dotted_quad_safe(parm
)) /* FQDN -- IP address only */
1330 const in_addr_t addr
= get_ip_addr(parm
, msglevel
, &error
);
1333 array
[(*len
)++] = addr
;
1338 msg(msglevel
, "dhcp-option parameter %s '%s' must be an IP address", name
, parm
);
1344 * If DNS options are set use these for TUN/TAP options as well.
1345 * Applies to DNS, DNS6 and DOMAIN-SEARCH.
1346 * Existing options will be discarded.
1349 tuntap_options_copy_dns(struct options
*o
)
1351 struct tuntap_options
*tt
= &o
->tuntap_options
;
1352 struct dns_options
*dns
= &o
->dns_options
;
1354 if (dns
->search_domains
)
1356 tt
->domain_search_list_len
= 0;
1357 const struct dns_domain
*domain
= dns
->search_domains
;
1358 while (domain
&& tt
->domain_search_list_len
< N_SEARCH_LIST_LEN
)
1360 tt
->domain_search_list
[tt
->domain_search_list_len
++] = domain
->name
;
1361 domain
= domain
->next
;
1365 msg(M_WARN
, "WARNING: couldn't copy all --dns search-domains to --dhcp-option");
1373 bool overflow
= false;
1374 const struct dns_server
*server
= dns
->servers
;
1377 if (server
->addr4_defined
&& tt
->dns_len
< N_DHCP_ADDR
)
1379 tt
->dns
[tt
->dns_len
++] = server
->addr4
.s_addr
;
1385 if (server
->addr6_defined
&& tt
->dns6_len
< N_DHCP_ADDR
)
1387 tt
->dns6
[tt
->dns6_len
++] = server
->addr6
;
1393 server
= server
->next
;
1397 msg(M_WARN
, "WARNING: couldn't copy all --dns server addresses to --dhcp-option");
1401 #else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1403 foreign_options_copy_dns(struct options
*o
, struct env_set
*es
)
1405 const struct dns_domain
*domain
= o
->dns_options
.search_domains
;
1406 const struct dns_server
*server
= o
->dns_options
.servers
;
1407 if (!domain
&& !server
)
1412 /* reset the index since we're starting all over again */
1413 int opt_max
= o
->foreign_option_index
;
1414 o
->foreign_option_index
= 0;
1416 for (int i
= 1; i
<= opt_max
; ++i
)
1419 openvpn_snprintf(name
, sizeof(name
), "foreign_option_%d", i
);
1421 const char *env_str
= env_set_get(es
, name
);
1422 const char *value
= strchr(env_str
, '=') + 1;
1423 if ((domain
&& strstr(value
, "dhcp-option DOMAIN-SEARCH") == value
)
1424 || (server
&& strstr(value
, "dhcp-option DNS") == value
))
1426 setenv_del(es
, name
);
1430 setenv_foreign_option(o
, &value
, 1, es
);
1434 struct gc_arena gc
= gc_new();
1438 if (server
->addr4_defined
)
1440 const char *argv
[] = {
1443 print_in_addr_t(server
->addr4
.s_addr
, 0, &gc
)
1445 setenv_foreign_option(o
, argv
, 3, es
);
1447 if (server
->addr6_defined
)
1449 const char *argv
[] = {
1452 print_in6_addr(server
->addr6
, 0, &gc
)
1454 setenv_foreign_option(o
, argv
, 3, es
);
1456 server
= server
->next
;
1460 const char *argv
[] = { "dhcp-option", "DOMAIN-SEARCH", domain
->name
};
1461 setenv_foreign_option(o
, argv
, 3, es
);
1462 domain
= domain
->next
;
1467 /* remove old leftover entries */
1468 while (o
->foreign_option_index
< opt_max
)
1471 openvpn_snprintf(name
, sizeof(name
), "foreign_option_%d", opt_max
--);
1472 setenv_del(es
, name
);
1475 #endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1477 #ifndef ENABLE_SMALL
1479 print_vlan_accept(enum vlan_acceptable_frames mode
)
1483 case VLAN_ONLY_TAGGED
:
1486 case VLAN_ONLY_UNTAGGED_OR_PRIORITY
:
1496 show_p2mp_parms(const struct options
*o
)
1498 struct gc_arena gc
= gc_new();
1500 msg(D_SHOW_PARMS
, " server_network = %s", print_in_addr_t(o
->server_network
, 0, &gc
));
1501 msg(D_SHOW_PARMS
, " server_netmask = %s", print_in_addr_t(o
->server_netmask
, 0, &gc
));
1502 msg(D_SHOW_PARMS
, " server_network_ipv6 = %s", print_in6_addr(o
->server_network_ipv6
, 0, &gc
) );
1503 SHOW_INT(server_netbits_ipv6
);
1504 msg(D_SHOW_PARMS
, " server_bridge_ip = %s", print_in_addr_t(o
->server_bridge_ip
, 0, &gc
));
1505 msg(D_SHOW_PARMS
, " server_bridge_netmask = %s", print_in_addr_t(o
->server_bridge_netmask
, 0, &gc
));
1506 msg(D_SHOW_PARMS
, " server_bridge_pool_start = %s", print_in_addr_t(o
->server_bridge_pool_start
, 0, &gc
));
1507 msg(D_SHOW_PARMS
, " server_bridge_pool_end = %s", print_in_addr_t(o
->server_bridge_pool_end
, 0, &gc
));
1508 if (o
->push_list
.head
)
1510 const struct push_entry
*e
= o
->push_list
.head
;
1515 msg(D_SHOW_PARMS
, " push_entry = '%s'", e
->option
);
1520 SHOW_BOOL(ifconfig_pool_defined
);
1521 msg(D_SHOW_PARMS
, " ifconfig_pool_start = %s", print_in_addr_t(o
->ifconfig_pool_start
, 0, &gc
));
1522 msg(D_SHOW_PARMS
, " ifconfig_pool_end = %s", print_in_addr_t(o
->ifconfig_pool_end
, 0, &gc
));
1523 msg(D_SHOW_PARMS
, " ifconfig_pool_netmask = %s", print_in_addr_t(o
->ifconfig_pool_netmask
, 0, &gc
));
1524 SHOW_STR(ifconfig_pool_persist_filename
);
1525 SHOW_INT(ifconfig_pool_persist_refresh_freq
);
1526 SHOW_BOOL(ifconfig_ipv6_pool_defined
);
1527 msg(D_SHOW_PARMS
, " ifconfig_ipv6_pool_base = %s", print_in6_addr(o
->ifconfig_ipv6_pool_base
, 0, &gc
));
1528 SHOW_INT(ifconfig_ipv6_pool_netbits
);
1529 SHOW_INT(n_bcast_buf
);
1530 SHOW_INT(tcp_queue_limit
);
1531 SHOW_INT(real_hash_size
);
1532 SHOW_INT(virtual_hash_size
);
1533 SHOW_STR(client_connect_script
);
1534 SHOW_STR(learn_address_script
);
1535 SHOW_STR(client_disconnect_script
);
1536 SHOW_STR(client_crresponse_script
);
1537 SHOW_STR(client_config_dir
);
1538 SHOW_BOOL(ccd_exclusive
);
1540 SHOW_BOOL(push_ifconfig_defined
);
1541 msg(D_SHOW_PARMS
, " push_ifconfig_local = %s", print_in_addr_t(o
->push_ifconfig_local
, 0, &gc
));
1542 msg(D_SHOW_PARMS
, " push_ifconfig_remote_netmask = %s", print_in_addr_t(o
->push_ifconfig_remote_netmask
, 0, &gc
));
1543 SHOW_BOOL(push_ifconfig_ipv6_defined
);
1544 msg(D_SHOW_PARMS
, " push_ifconfig_ipv6_local = %s/%d", print_in6_addr(o
->push_ifconfig_ipv6_local
, 0, &gc
), o
->push_ifconfig_ipv6_netbits
);
1545 msg(D_SHOW_PARMS
, " push_ifconfig_ipv6_remote = %s", print_in6_addr(o
->push_ifconfig_ipv6_remote
, 0, &gc
));
1546 SHOW_BOOL(enable_c2c
);
1547 SHOW_BOOL(duplicate_cn
);
1550 SHOW_INT(max_clients
);
1551 SHOW_INT(max_routes_per_client
);
1552 SHOW_STR(auth_user_pass_verify_script
);
1553 SHOW_BOOL(auth_user_pass_verify_script_via_file
);
1554 SHOW_BOOL(auth_token_generate
);
1555 SHOW_INT(auth_token_lifetime
);
1556 SHOW_STR_INLINE(auth_token_secret_file
);
1558 SHOW_STR(port_share_host
);
1559 SHOW_STR(port_share_port
);
1561 SHOW_BOOL(vlan_tagging
);
1562 msg(D_SHOW_PARMS
, " vlan_accept = %s", print_vlan_accept(o
->vlan_accept
));
1563 SHOW_INT(vlan_pvid
);
1567 SHOW_STR_INLINE(auth_user_pass_file
);
1572 #endif /* ! ENABLE_SMALL */
1575 option_iroute(struct options
*o
,
1576 const char *network_str
,
1577 const char *netmask_str
,
1582 ALLOC_OBJ_GC(ir
, struct iroute
, &o
->gc
);
1583 ir
->network
= getaddr(GETADDR_HOST_ORDER
, network_str
, 0, NULL
, NULL
);
1584 ir
->netbits
= 32; /* host route if no netmask given */
1588 const in_addr_t netmask
= getaddr(GETADDR_HOST_ORDER
, netmask_str
, 0, NULL
, NULL
);
1589 ir
->netbits
= netmask_to_netbits2(netmask
);
1591 if (ir
->netbits
< 0)
1593 msg(msglevel
, "in --iroute %s %s : Bad network/subnet specification",
1600 ir
->next
= o
->iroutes
;
1605 option_iroute_ipv6(struct options
*o
,
1606 const char *prefix_str
,
1609 struct iroute_ipv6
*ir
;
1611 ALLOC_OBJ_GC(ir
, struct iroute_ipv6
, &o
->gc
);
1613 if (!get_ipv6_addr(prefix_str
, &ir
->network
, &ir
->netbits
, msglevel
))
1615 msg(msglevel
, "in --iroute-ipv6 %s: Bad IPv6 prefix specification",
1620 ir
->next
= o
->iroutes_ipv6
;
1621 o
->iroutes_ipv6
= ir
;
1624 #ifndef ENABLE_SMALL
1626 show_http_proxy_options(const struct http_proxy_options
*o
)
1629 msg(D_SHOW_PARMS
, "BEGIN http_proxy");
1632 SHOW_STR(auth_method_string
);
1633 SHOW_STR(auth_file
);
1634 SHOW_STR(http_version
);
1635 SHOW_STR(user_agent
);
1636 for (i
= 0; i
< MAX_CUSTOM_HTTP_HEADER
&& o
->custom_headers
[i
].name
; i
++)
1638 if (o
->custom_headers
[i
].content
)
1640 msg(D_SHOW_PARMS
, " custom_header[%d] = %s: %s", i
,
1641 o
->custom_headers
[i
].name
, o
->custom_headers
[i
].content
);
1645 msg(D_SHOW_PARMS
, " custom_header[%d] = %s", i
,
1646 o
->custom_headers
[i
].name
);
1649 msg(D_SHOW_PARMS
, "END http_proxy");
1651 #endif /* ifndef ENABLE_SMALL */
1654 options_detach(struct options
*o
)
1658 o
->client_nat
= NULL
;
1663 rol_check_alloc(struct options
*options
)
1665 if (!options
->routes
)
1667 options
->routes
= new_route_option_list(&options
->gc
);
1672 rol6_check_alloc(struct options
*options
)
1674 if (!options
->routes_ipv6
)
1676 options
->routes_ipv6
= new_route_ipv6_option_list(&options
->gc
);
1681 cnol_check_alloc(struct options
*options
)
1683 if (!options
->client_nat
)
1685 options
->client_nat
= new_client_nat_list(&options
->gc
);
1689 #ifndef ENABLE_SMALL
1691 show_connection_entry(const struct connection_entry
*o
)
1693 msg(D_SHOW_PARMS
, " proto = %s", proto2ascii(o
->proto
, o
->af
, false));
1695 SHOW_STR(local_port
);
1697 SHOW_STR(remote_port
);
1698 SHOW_BOOL(remote_float
);
1699 SHOW_BOOL(bind_defined
);
1700 SHOW_BOOL(bind_local
);
1701 SHOW_BOOL(bind_ipv6_only
);
1702 SHOW_INT(connect_retry_seconds
);
1703 SHOW_INT(connect_timeout
);
1705 if (o
->http_proxy_options
)
1707 show_http_proxy_options(o
->http_proxy_options
);
1709 SHOW_STR(socks_proxy_server
);
1710 SHOW_STR(socks_proxy_port
);
1712 SHOW_BOOL(tun_mtu_defined
);
1714 SHOW_BOOL(link_mtu_defined
);
1715 SHOW_INT(tun_mtu_extra
);
1716 SHOW_BOOL(tun_mtu_extra_defined
);
1719 SHOW_INT(mtu_discover_type
);
1721 #ifdef ENABLE_FRAGMENT
1725 SHOW_BOOL(mssfix_encap
);
1726 SHOW_BOOL(mssfix_fixed
);
1728 SHOW_INT(explicit_exit_notification
);
1730 SHOW_STR_INLINE(tls_auth_file
);
1731 SHOW_PARM(key_direction
, keydirection2ascii(o
->key_direction
, false, true),
1733 SHOW_STR_INLINE(tls_crypt_file
);
1734 SHOW_STR_INLINE(tls_crypt_v2_file
);
1739 show_connection_entries(const struct options
*o
)
1741 if (o
->connection_list
)
1743 const struct connection_list
*l
= o
->connection_list
;
1745 for (i
= 0; i
< l
->len
; ++i
)
1747 msg(D_SHOW_PARMS
, "Connection profiles [%d]:", i
);
1748 show_connection_entry(l
->array
[i
]);
1753 msg(D_SHOW_PARMS
, "Connection profiles [default]:");
1754 show_connection_entry(&o
->ce
);
1756 msg(D_SHOW_PARMS
, "Connection profiles END");
1760 show_pull_filter_list(const struct pull_filter_list
*l
)
1762 struct pull_filter
*f
;
1768 msg(D_SHOW_PARMS
, " Pull filters:");
1769 for (f
= l
->head
; f
; f
= f
->next
)
1771 msg(D_SHOW_PARMS
, " %s \"%s\"", pull_filter_type_name(f
->type
), f
->pattern
);
1775 #endif /* ifndef ENABLE_SMALL */
1778 show_settings(const struct options
*o
)
1780 #ifndef ENABLE_SMALL
1781 msg(D_SHOW_PARMS
, "Current Parameter Settings:");
1787 #ifdef ENABLE_FEATURE_TUN_PERSIST
1788 SHOW_BOOL(persist_config
);
1789 SHOW_INT(persist_mode
);
1792 SHOW_BOOL(show_ciphers
);
1793 SHOW_BOOL(show_digests
);
1794 SHOW_BOOL(show_engines
);
1796 SHOW_STR(genkey_filename
);
1797 SHOW_STR(key_pass_file
);
1798 SHOW_BOOL(show_tls_ciphers
);
1800 SHOW_INT(connect_retry_max
);
1801 show_connection_entries(o
);
1803 SHOW_BOOL(remote_random
);
1809 #if defined(ENABLE_DCO)
1810 SHOW_BOOL(tuntap_options
.disable_dco
);
1814 SHOW_STR(ifconfig_local
);
1815 SHOW_STR(ifconfig_remote_netmask
);
1816 SHOW_BOOL(ifconfig_noexec
);
1817 SHOW_BOOL(ifconfig_nowarn
);
1818 SHOW_STR(ifconfig_ipv6_local
);
1819 SHOW_INT(ifconfig_ipv6_netbits
);
1820 SHOW_STR(ifconfig_ipv6_remote
);
1827 SHOW_INT(keepalive_ping
);
1828 SHOW_INT(keepalive_timeout
);
1829 SHOW_INT(inactivity_timeout
);
1830 SHOW_INT(session_timeout
);
1831 SHOW_INT64(inactivity_minimum_bytes
);
1832 SHOW_INT(ping_send_timeout
);
1833 SHOW_INT(ping_rec_timeout
);
1834 SHOW_INT(ping_rec_timeout_action
);
1835 SHOW_BOOL(ping_timer_remote
);
1836 SHOW_INT(remap_sigusr1
);
1837 SHOW_BOOL(persist_tun
);
1838 SHOW_BOOL(persist_local_ip
);
1839 SHOW_BOOL(persist_remote_ip
);
1840 SHOW_BOOL(persist_key
);
1842 #if PASSTOS_CAPABILITY
1846 SHOW_INT(resolve_retry_seconds
);
1847 SHOW_BOOL(resolve_in_advance
);
1850 SHOW_STR(groupname
);
1851 SHOW_STR(chroot_dir
);
1853 #ifdef ENABLE_SELINUX
1854 SHOW_STR(selinux_context
);
1857 SHOW_STR(up_script
);
1858 SHOW_STR(down_script
);
1859 SHOW_BOOL(down_pre
);
1860 SHOW_BOOL(up_restart
);
1861 SHOW_BOOL(up_delay
);
1864 SHOW_BOOL(suppress_timestamps
);
1865 SHOW_BOOL(machine_readable_output
);
1867 SHOW_INT(verbosity
);
1872 SHOW_STR(status_file
);
1873 SHOW_INT(status_file_version
);
1874 SHOW_INT(status_file_update_freq
);
1879 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
1882 SHOW_INT(sockflags
);
1888 SHOW_INT(comp
.flags
);
1891 SHOW_STR(route_script
);
1892 SHOW_STR(route_default_gateway
);
1893 SHOW_INT(route_default_metric
);
1894 SHOW_BOOL(route_noexec
);
1895 SHOW_INT(route_delay
);
1896 SHOW_INT(route_delay_window
);
1897 SHOW_BOOL(route_delay_defined
);
1898 SHOW_BOOL(route_nopull
);
1899 SHOW_BOOL(route_gateway_via_dhcp
);
1900 SHOW_BOOL(allow_pull_fqdn
);
1901 show_pull_filter_list(o
->pull_filter_list
);
1905 print_route_options(o
->routes
, D_SHOW_PARMS
);
1910 print_client_nat_list(o
->client_nat
, D_SHOW_PARMS
);
1913 show_dns_options(&o
->dns_options
);
1915 #ifdef ENABLE_MANAGEMENT
1916 SHOW_STR(management_addr
);
1917 SHOW_STR(management_port
);
1918 SHOW_STR(management_user_pass
);
1919 SHOW_INT(management_log_history_cache
);
1920 SHOW_INT(management_echo_buffer_size
);
1921 SHOW_STR(management_client_user
);
1922 SHOW_STR(management_client_group
);
1923 SHOW_INT(management_flags
);
1925 #ifdef ENABLE_PLUGIN
1928 plugin_option_list_print(o
->plugin_list
, D_SHOW_PARMS
);
1932 SHOW_STR_INLINE(shared_secret_file
);
1933 SHOW_PARM(key_direction
, keydirection2ascii(o
->key_direction
, false, true), "%s");
1934 SHOW_STR(ciphername
);
1935 SHOW_STR(ncp_ciphers
);
1937 #ifndef ENABLE_CRYPTO_MBEDTLS
1939 #endif /* ENABLE_CRYPTO_MBEDTLS */
1941 SHOW_BOOL(mute_replay_warnings
);
1942 SHOW_INT(replay_window
);
1943 SHOW_INT(replay_time
);
1944 SHOW_STR(packet_id_file
);
1945 SHOW_BOOL(test_crypto
);
1946 #ifdef ENABLE_PREDICTION_RESISTANCE
1947 SHOW_BOOL(use_prediction_resistance
);
1950 SHOW_BOOL(tls_server
);
1951 SHOW_BOOL(tls_client
);
1952 SHOW_STR_INLINE(ca_file
);
1954 SHOW_STR_INLINE(dh_file
);
1955 #ifdef ENABLE_MANAGEMENT
1956 if ((o
->management_flags
& MF_EXTERNAL_CERT
))
1958 SHOW_PARM("cert_file", "EXTERNAL_CERT", "%s");
1962 SHOW_STR_INLINE(cert_file
);
1963 SHOW_STR_INLINE(extra_certs_file
);
1965 #ifdef ENABLE_MANAGEMENT
1966 if ((o
->management_flags
& MF_EXTERNAL_KEY
))
1968 SHOW_PARM("priv_key_file", "EXTERNAL_PRIVATE_KEY", "%s");
1972 SHOW_STR_INLINE(priv_key_file
);
1973 #ifndef ENABLE_CRYPTO_MBEDTLS
1974 SHOW_STR_INLINE(pkcs12_file
);
1976 #ifdef ENABLE_CRYPTOAPI
1977 SHOW_STR(cryptoapi_cert
);
1979 SHOW_STR(cipher_list
);
1980 SHOW_STR(cipher_list_tls13
);
1981 SHOW_STR(tls_cert_profile
);
1982 SHOW_STR(tls_verify
);
1983 SHOW_STR(tls_export_cert
);
1984 SHOW_INT(verify_x509_type
);
1985 SHOW_STR(verify_x509_name
);
1986 SHOW_STR_INLINE(crl_file
);
1987 SHOW_INT(ns_cert_type
);
1990 for (i
= 0; i
<MAX_PARMS
; i
++)
1992 SHOW_INT(remote_cert_ku
[i
]);
1995 SHOW_STR(remote_cert_eku
);
1998 SHOW_INT(verify_hash_algo
);
1999 SHOW_INT(verify_hash_depth
);
2000 struct gc_arena gc
= gc_new();
2001 struct verify_hash_list
*hl
= o
->verify_hash
;
2002 int digest_len
= (o
->verify_hash_algo
== MD_SHA1
) ? SHA_DIGEST_LENGTH
:
2003 SHA256_DIGEST_LENGTH
;
2006 char *s
= format_hex_ex(hl
->hash
, digest_len
, 0,
2008 SHOW_PARM(verify_hash
, s
, "%s");
2013 SHOW_INT(ssl_flags
);
2015 SHOW_INT(tls_timeout
);
2017 SHOW_INT(renegotiate_bytes
);
2018 SHOW_INT(renegotiate_packets
);
2019 SHOW_INT(renegotiate_seconds
);
2021 SHOW_INT(handshake_window
);
2022 SHOW_INT(transition_window
);
2024 SHOW_BOOL(single_session
);
2025 SHOW_BOOL(push_peer_info
);
2026 SHOW_BOOL(tls_exit
);
2028 SHOW_STR(tls_crypt_v2_metadata
);
2030 #ifdef ENABLE_PKCS11
2033 for (i
= 0; i
<MAX_PARMS
&& o
->pkcs11_providers
[i
] != NULL
; i
++)
2035 SHOW_PARM(pkcs11_providers
, o
->pkcs11_providers
[i
], "%s");
2040 for (i
= 0; i
<MAX_PARMS
; i
++)
2042 SHOW_PARM(pkcs11_protected_authentication
, o
->pkcs11_protected_authentication
[i
] ? "ENABLED" : "DISABLED", "%s");
2047 for (i
= 0; i
<MAX_PARMS
; i
++)
2049 SHOW_PARM(pkcs11_private_mode
, o
->pkcs11_private_mode
[i
], "%08x");
2054 for (i
= 0; i
<MAX_PARMS
; i
++)
2056 SHOW_PARM(pkcs11_cert_private
, o
->pkcs11_cert_private
[i
] ? "ENABLED" : "DISABLED", "%s");
2059 SHOW_INT(pkcs11_pin_cache_period
);
2060 SHOW_STR(pkcs11_id
);
2061 SHOW_BOOL(pkcs11_id_management
);
2062 #endif /* ENABLE_PKCS11 */
2067 SHOW_BOOL(show_net_up
);
2068 SHOW_INT(route_method
);
2069 SHOW_BOOL(block_outside_dns
);
2070 show_tuntap_options(&o
->tuntap_options
);
2072 #endif /* ifndef ENABLE_SMALL */
2080 #ifdef ENABLE_MANAGEMENT
2082 static struct http_proxy_options
*
2083 parse_http_proxy_override(const char *server
,
2087 struct gc_arena
*gc
)
2091 struct http_proxy_options
*ho
;
2092 ALLOC_OBJ_CLEAR_GC(ho
, struct http_proxy_options
, gc
);
2093 ho
->server
= string_alloc(server
, gc
);
2095 if (flags
&& !strcmp(flags
, "nct"))
2097 ho
->auth_retry
= PAR_NCT
;
2101 ho
->auth_retry
= PAR_ALL
;
2103 ho
->http_version
= "1.0";
2104 ho
->user_agent
= "OpenVPN-Autoproxy/1.0";
2114 options_postprocess_http_proxy_override(struct options
*o
)
2116 const struct connection_list
*l
= o
->connection_list
;
2118 bool succeed
= false;
2119 for (i
= 0; i
< l
->len
; ++i
)
2121 struct connection_entry
*ce
= l
->array
[i
];
2122 if (ce
->proto
== PROTO_TCP_CLIENT
|| ce
->proto
== PROTO_TCP
)
2124 ce
->http_proxy_options
= o
->http_proxy_override
;
2130 for (i
= 0; i
< l
->len
; ++i
)
2132 struct connection_entry
*ce
= l
->array
[i
];
2133 if (ce
->proto
== PROTO_UDP
)
2135 ce
->flags
|= CE_DISABLED
;
2141 msg(M_WARN
, "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
2145 #endif /* ifdef ENABLE_MANAGEMENT */
2147 static struct connection_list
*
2148 alloc_connection_list_if_undef(struct options
*options
)
2150 if (!options
->connection_list
)
2152 ALLOC_OBJ_CLEAR_GC(options
->connection_list
, struct connection_list
, &options
->gc
);
2154 return options
->connection_list
;
2157 static struct connection_entry
*
2158 alloc_connection_entry(struct options
*options
, const int msglevel
)
2160 struct connection_list
*l
= alloc_connection_list_if_undef(options
);
2161 struct connection_entry
*e
;
2163 if (l
->len
>= CONNECTION_LIST_SIZE
)
2165 msg(msglevel
, "Maximum number of 'connection' options (%d) exceeded", CONNECTION_LIST_SIZE
);
2168 ALLOC_OBJ_GC(e
, struct connection_entry
, &options
->gc
);
2169 l
->array
[l
->len
++] = e
;
2173 static struct remote_list
*
2174 alloc_remote_list_if_undef(struct options
*options
)
2176 if (!options
->remote_list
)
2178 ALLOC_OBJ_CLEAR_GC(options
->remote_list
, struct remote_list
, &options
->gc
);
2180 return options
->remote_list
;
2183 static struct remote_entry
*
2184 alloc_remote_entry(struct options
*options
, const int msglevel
)
2186 struct remote_list
*l
= alloc_remote_list_if_undef(options
);
2187 struct remote_entry
*e
;
2189 if (l
->len
>= CONNECTION_LIST_SIZE
)
2191 msg(msglevel
, "Maximum number of 'remote' options (%d) exceeded", CONNECTION_LIST_SIZE
);
2194 ALLOC_OBJ_GC(e
, struct remote_entry
, &options
->gc
);
2195 l
->array
[l
->len
++] = e
;
2199 static struct pull_filter_list
*
2200 alloc_pull_filter_list(struct options
*o
)
2202 if (!o
->pull_filter_list
)
2204 ALLOC_OBJ_CLEAR_GC(o
->pull_filter_list
, struct pull_filter_list
, &o
->gc
);
2206 return o
->pull_filter_list
;
2209 static struct pull_filter
*
2210 alloc_pull_filter(struct options
*o
, const int msglevel
)
2212 struct pull_filter_list
*l
= alloc_pull_filter_list(o
);
2213 struct pull_filter
*f
;
2215 ALLOC_OBJ_CLEAR_GC(f
, struct pull_filter
, &o
->gc
);
2231 connection_entry_load_re(struct connection_entry
*ce
, const struct remote_entry
*re
)
2235 ce
->remote
= re
->remote
;
2237 if (re
->remote_port
)
2239 ce
->remote_port
= re
->remote_port
;
2243 ce
->proto
= re
->proto
;
2252 connection_entry_preload_key(const char **key_file
, bool *key_inline
,
2253 struct gc_arena
*gc
)
2255 if (key_file
&& *key_file
&& !(*key_inline
))
2257 struct buffer in
= buffer_read_from_file(*key_file
, gc
);
2258 if (!buf_valid(&in
))
2260 msg(M_FATAL
, "Cannot pre-load keyfile (%s)", *key_file
);
2263 *key_file
= (const char *) in
.data
;
2269 check_ca_required(const struct options
*options
)
2271 if (options
->verify_hash_no_ca
2272 || options
->pkcs12_file
2274 #ifndef ENABLE_CRYPTO_MBEDTLS
2282 const char *const str
= "You must define CA file (--ca)"
2283 #ifndef ENABLE_CRYPTO_MBEDTLS
2284 " or CA path (--capath)"
2286 " and/or peer fingerprint verification (--peer-fingerprint)";
2291 options_postprocess_verify_ce(const struct options
*options
,
2292 const struct connection_entry
*ce
)
2294 struct options defaults
;
2295 int dev
= DEV_TYPE_UNDEF
;
2298 init_options(&defaults
, true);
2300 if (options
->test_crypto
)
2302 notnull(options
->shared_secret_file
, "key file (--secret)");
2306 notnull(options
->dev
, "TUN/TAP device (--dev)");
2310 * Get tun/tap/null device type
2312 dev
= dev_type_enum(options
->dev
, options
->dev_type
);
2315 * If "proto tcp" is specified, make sure we know whether it is
2316 * tcp-client or tcp-server.
2318 if (ce
->proto
== PROTO_TCP
)
2321 "--proto tcp is ambiguous in this context. Please specify "
2322 "--proto tcp-server or --proto tcp-client");
2325 if (options
->lladdr
&& dev
!= DEV_TYPE_TAP
)
2327 msg(M_USAGE
, "--lladdr can only be used in --dev tap mode");
2331 * Sanity check on MTU parameters
2333 if (options
->ce
.tun_mtu_defined
&& options
->ce
.link_mtu_defined
)
2335 msg(M_USAGE
, "only one of --tun-mtu or --link-mtu may be defined");
2338 if (!proto_is_udp(ce
->proto
) && options
->mtu_test
)
2340 msg(M_USAGE
, "--mtu-test only makes sense with --proto udp");
2343 /* will we be pulling options from server? */
2344 pull
= options
->pull
;
2347 * Sanity check on --local, --remote, and --ifconfig
2350 if (proto_is_net(ce
->proto
)
2351 && string_defined_equal(ce
->local
, ce
->remote
)
2352 && string_defined_equal(ce
->local_port
, ce
->remote_port
))
2354 msg(M_USAGE
, "--remote and --local addresses are the same");
2357 if (string_defined_equal(ce
->remote
, options
->ifconfig_local
)
2358 || string_defined_equal(ce
->remote
, options
->ifconfig_remote_netmask
))
2361 "--local and --remote addresses must be distinct from --ifconfig "
2365 if (string_defined_equal(ce
->local
, options
->ifconfig_local
)
2366 || string_defined_equal(ce
->local
, options
->ifconfig_remote_netmask
))
2369 "--local addresses must be distinct from --ifconfig addresses");
2372 if (string_defined_equal(options
->ifconfig_local
,
2373 options
->ifconfig_remote_netmask
))
2376 "local and remote/netmask --ifconfig addresses must be different");
2379 if (ce
->bind_defined
&& !ce
->bind_local
)
2381 msg(M_USAGE
, "--bind and --nobind can't be used together");
2384 if (ce
->local
&& !ce
->bind_local
)
2387 "--local and --nobind don't make sense when used together");
2390 if (ce
->local_port_defined
&& !ce
->bind_local
)
2393 "--lport and --nobind don't make sense when used together");
2396 if (!ce
->remote
&& !ce
->bind_local
)
2398 msg(M_USAGE
, "--nobind doesn't make sense unless used with --remote");
2402 * Check for consistency of management options
2404 #ifdef ENABLE_MANAGEMENT
2405 if (!options
->management_addr
2406 && (options
->management_flags
2407 || options
->management_log_history_cache
!= defaults
.management_log_history_cache
))
2409 msg(M_USAGE
, "--management is not specified, however one or more options which modify the behavior of --management were specified");
2412 if ((options
->management_client_user
|| options
->management_client_group
)
2413 && !(options
->management_flags
& MF_UNIX_SOCK
))
2415 msg(M_USAGE
, "--management-client-(user|group) can only be used on unix domain sockets");
2418 if (options
->management_addr
2419 && !(options
->management_flags
& MF_UNIX_SOCK
)
2420 && (!options
->management_user_pass
))
2422 msg(M_WARN
, "WARNING: Using --management on a TCP port WITHOUT "
2423 "passwords is STRONGLY discouraged and considered insecure");
2426 #endif /* ifdef ENABLE_MANAGEMENT */
2428 #if defined(ENABLE_MANAGEMENT) && !defined(HAVE_XKEY_PROVIDER)
2429 if ((tls_version_max() >= TLS_VER_1_3
)
2430 && (options
->management_flags
& MF_EXTERNAL_KEY
)
2431 && !(options
->management_flags
& (MF_EXTERNAL_KEY_NOPADDING
))
2434 msg(M_FATAL
, "management-external-key with TLS 1.3 or later requires "
2435 "nopadding argument/support");
2439 * Windows-specific options.
2443 if (dev
== DEV_TYPE_TUN
&& !(pull
|| (options
->ifconfig_local
&& options
->ifconfig_remote_netmask
)))
2445 msg(M_USAGE
, "On Windows, --ifconfig is required when --dev tun is used");
2448 if ((options
->tuntap_options
.ip_win32_defined
)
2449 && !(pull
|| (options
->ifconfig_local
&& options
->ifconfig_remote_netmask
)))
2451 msg(M_USAGE
, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
2454 if (options
->tuntap_options
.dhcp_options
2455 && options
->windows_driver
!= WINDOWS_DRIVER_WINTUN
2456 && options
->tuntap_options
.ip_win32_type
!= IPW32_SET_DHCP_MASQ
2457 && options
->tuntap_options
.ip_win32_type
!= IPW32_SET_ADAPTIVE
)
2459 msg(M_USAGE
, "--dhcp-option requires --ip-win32 dynamic or adaptive");
2462 if (options
->windows_driver
== WINDOWS_DRIVER_WINTUN
&& dev
!= DEV_TYPE_TUN
)
2464 msg(M_USAGE
, "--windows-driver wintun requires --dev tun");
2466 #endif /* ifdef _WIN32 */
2469 * Check that protocol options make sense.
2472 #ifdef ENABLE_FRAGMENT
2473 if (!proto_is_udp(ce
->proto
) && ce
->fragment
)
2475 msg(M_USAGE
, "--fragment can only be used with --proto udp");
2479 if (!ce
->remote
&& ce
->proto
== PROTO_TCP_CLIENT
)
2481 msg(M_USAGE
, "--remote MUST be used in TCP Client mode");
2484 if ((ce
->http_proxy_options
) && ce
->proto
!= PROTO_TCP_CLIENT
)
2487 "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
2491 if ((ce
->http_proxy_options
) && !ce
->http_proxy_options
->server
)
2494 "--http-proxy not specified but other http proxy options present");
2497 if (ce
->http_proxy_options
&& ce
->socks_proxy_server
)
2500 "--http-proxy can not be used together with --socks-proxy");
2503 if (ce
->socks_proxy_server
&& ce
->proto
== PROTO_TCP_SERVER
)
2505 msg(M_USAGE
, "--socks-proxy can not be used in TCP Server mode");
2508 if (ce
->proto
== PROTO_TCP_SERVER
&& (options
->connection_list
->len
> 1))
2510 msg(M_USAGE
, "TCP server mode allows at most one --remote address");
2514 * Check consistency of --mode server options.
2516 if (options
->mode
== MODE_SERVER
)
2518 #define USAGE_VALID_SERVER_PROTOS "--mode server currently only supports " \
2519 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
2520 #ifdef TARGET_ANDROID
2521 msg(M_FATAL
, "--mode server not supported on Android");
2523 if (!(dev
== DEV_TYPE_TUN
|| dev
== DEV_TYPE_TAP
))
2525 msg(M_USAGE
, "--mode server only works with --dev tun or --dev tap");
2529 msg(M_USAGE
, "--pull cannot be used with --mode server");
2531 if (options
->pull_filter_list
)
2533 msg(M_WARN
, "--pull-filter ignored for --mode server");
2535 if (!(proto_is_udp(ce
->proto
) || ce
->proto
== PROTO_TCP_SERVER
))
2537 msg(M_USAGE
, USAGE_VALID_SERVER_PROTOS
);
2540 if ((options
->port_share_host
|| options
->port_share_port
)
2541 && (ce
->proto
!= PROTO_TCP_SERVER
))
2543 msg(M_USAGE
, "--port-share only works in TCP server mode "
2544 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
2547 if (!options
->tls_server
)
2549 msg(M_USAGE
, "--mode server requires --tls-server");
2553 msg(M_USAGE
, "--remote cannot be used with --mode server");
2555 if (!ce
->bind_local
)
2557 msg(M_USAGE
, "--nobind cannot be used with --mode server");
2559 if (ce
->http_proxy_options
)
2561 msg(M_USAGE
, "--http-proxy cannot be used with --mode server");
2563 if (ce
->socks_proxy_server
)
2565 msg(M_USAGE
, "--socks-proxy cannot be used with --mode server");
2567 /* <connection> blocks force to have a remote embedded, so we check
2568 * for the --remote and bail out if it is present
2570 if (options
->connection_list
->len
>1
2571 || options
->connection_list
->array
[0]->remote
)
2573 msg(M_USAGE
, "<connection> cannot be used with --mode server");
2576 if (options
->shaper
)
2578 msg(M_USAGE
, "--shaper cannot be used with --mode server");
2580 if (options
->ipchange
)
2583 "--ipchange cannot be used with --mode server (use "
2584 "--client-connect instead)");
2586 if (!(proto_is_dgram(ce
->proto
) || ce
->proto
== PROTO_TCP_SERVER
))
2588 msg(M_USAGE
, USAGE_VALID_SERVER_PROTOS
);
2590 if (!proto_is_udp(ce
->proto
) && (options
->cf_max
|| options
->cf_per
))
2592 msg(M_USAGE
, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
2594 if (!(dev
== DEV_TYPE_TAP
|| (dev
== DEV_TYPE_TUN
&& options
->topology
== TOP_SUBNET
)) && options
->ifconfig_pool_netmask
)
2596 msg(M_USAGE
, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
2598 if (options
->routes
&& (options
->routes
->flags
& RG_ENABLE
))
2600 msg(M_USAGE
, "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
2602 if (options
->route_delay_defined
)
2604 msg(M_USAGE
, "--route-delay cannot be used with --mode server");
2606 if (options
->up_delay
)
2608 msg(M_USAGE
, "--up-delay cannot be used with --mode server");
2610 if (!options
->ifconfig_pool_defined
2611 && !options
->ifconfig_ipv6_pool_defined
2612 && options
->ifconfig_pool_persist_filename
)
2615 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
2617 if (options
->ifconfig_ipv6_pool_defined
&& !options
->ifconfig_ipv6_local
)
2619 msg(M_USAGE
, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
2621 if (options
->allow_recursive_routing
)
2623 msg(M_USAGE
, "--allow-recursive-routing cannot be used with --mode server");
2625 if (options
->auth_user_pass_file
)
2627 msg(M_USAGE
, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
2629 if (options
->ccd_exclusive
&& !options
->client_config_dir
)
2631 msg(M_USAGE
, "--ccd-exclusive must be used with --client-config-dir");
2633 if (options
->auth_token_generate
&& !options
->renegotiate_seconds
)
2635 msg(M_USAGE
, "--auth-gen-token needs a non-infinite "
2636 "--renegotiate_seconds setting");
2638 if (options
->auth_token_generate
&& options
->auth_token_renewal
2639 && options
->auth_token_renewal
< 2 * options
->handshake_window
)
2641 msg(M_USAGE
, "--auth-gen-token renewal time needs to be at least "
2642 " two times --hand-window (%d).",
2643 options
->handshake_window
);
2647 const bool ccnr
= (options
->auth_user_pass_verify_script
2648 || PLUGIN_OPTION_LIST(options
)
2649 || MAN_CLIENT_AUTH_ENABLED(options
));
2650 const char *postfix
= "must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
2651 if ((options
->ssl_flags
& (SSLF_CLIENT_CERT_NOT_REQUIRED
|SSLF_CLIENT_CERT_OPTIONAL
)) && !ccnr
)
2653 msg(M_USAGE
, "--verify-client-cert none|optional %s", postfix
);
2655 if ((options
->ssl_flags
& SSLF_USERNAME_AS_COMMON_NAME
) && !ccnr
)
2657 msg(M_USAGE
, "--username-as-common-name %s", postfix
);
2659 if ((options
->ssl_flags
& SSLF_AUTH_USER_PASS_OPTIONAL
) && !ccnr
)
2661 msg(M_USAGE
, "--auth-user-pass-optional %s", postfix
);
2665 if (options
->vlan_tagging
&& dev
!= DEV_TYPE_TAP
)
2667 msg(M_USAGE
, "--vlan-tagging must be used with --dev tap");
2669 if (!options
->vlan_tagging
)
2671 if (options
->vlan_accept
!= defaults
.vlan_accept
)
2673 msg(M_USAGE
, "--vlan-accept requires --vlan-tagging");
2675 if (options
->vlan_pvid
!= defaults
.vlan_pvid
)
2677 msg(M_USAGE
, "--vlan-pvid requires --vlan-tagging");
2684 * When not in server mode, err if parameters are
2685 * specified which require --mode server.
2687 if (options
->ifconfig_pool_defined
|| options
->ifconfig_pool_persist_filename
)
2689 msg(M_USAGE
, "--ifconfig-pool/--ifconfig-pool-persist requires --mode server");
2691 if (options
->ifconfig_ipv6_pool_defined
)
2693 msg(M_USAGE
, "--ifconfig-ipv6-pool requires --mode server");
2695 if (options
->real_hash_size
!= defaults
.real_hash_size
2696 || options
->virtual_hash_size
!= defaults
.virtual_hash_size
)
2698 msg(M_USAGE
, "--hash-size requires --mode server");
2700 if (options
->learn_address_script
)
2702 msg(M_USAGE
, "--learn-address requires --mode server");
2704 if (options
->client_connect_script
)
2706 msg(M_USAGE
, "--client-connect requires --mode server");
2708 if (options
->client_crresponse_script
)
2710 msg(M_USAGE
, "--client-crresponse requires --mode server");
2712 if (options
->client_disconnect_script
)
2714 msg(M_USAGE
, "--client-disconnect requires --mode server");
2716 if (options
->client_config_dir
|| options
->ccd_exclusive
)
2718 msg(M_USAGE
, "--client-config-dir/--ccd-exclusive requires --mode server");
2720 if (options
->enable_c2c
)
2722 msg(M_USAGE
, "--client-to-client requires --mode server");
2724 if (options
->duplicate_cn
)
2726 msg(M_USAGE
, "--duplicate-cn requires --mode server");
2728 if (options
->cf_max
|| options
->cf_per
)
2730 msg(M_USAGE
, "--connect-freq requires --mode server");
2732 if (options
->ssl_flags
& (SSLF_CLIENT_CERT_NOT_REQUIRED
|SSLF_CLIENT_CERT_OPTIONAL
))
2734 msg(M_USAGE
, "--verify-client-cert requires --mode server");
2736 if (options
->ssl_flags
& SSLF_USERNAME_AS_COMMON_NAME
)
2738 msg(M_USAGE
, "--username-as-common-name requires --mode server");
2740 if (options
->ssl_flags
& SSLF_AUTH_USER_PASS_OPTIONAL
)
2742 msg(M_USAGE
, "--auth-user-pass-optional requires --mode server");
2744 if (options
->ssl_flags
& SSLF_OPT_VERIFY
)
2746 msg(M_USAGE
, "--opt-verify requires --mode server");
2748 if (options
->server_flags
& SF_TCP_NODELAY_HELPER
)
2750 msg(M_WARN
, "WARNING: setting tcp-nodelay on the client side will not "
2751 "affect the server. To have TCP_NODELAY in both direction use "
2752 "tcp-nodelay in the server configuration instead.");
2754 if (options
->auth_user_pass_verify_script
)
2756 msg(M_USAGE
, "--auth-user-pass-verify requires --mode server");
2758 if (options
->auth_token_generate
)
2760 msg(M_USAGE
, "--auth-gen-token requires --mode server");
2763 if (options
->port_share_host
|| options
->port_share_port
)
2765 msg(M_USAGE
, "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2769 if (options
->stale_routes_check_interval
)
2771 msg(M_USAGE
, "--stale-routes-check requires --mode server");
2774 if (options
->vlan_tagging
)
2776 msg(M_USAGE
, "--vlan-tagging requires --mode server");
2781 * Check consistency of replay options
2783 if (!options
->replay
2784 && (options
->replay_window
!= defaults
.replay_window
2785 || options
->replay_time
!= defaults
.replay_time
))
2787 msg(M_USAGE
, "--replay-window doesn't make sense when replay protection is disabled with --no-replay");
2791 * SSL/TLS mode sanity checks.
2793 if (options
->tls_server
+ options
->tls_client
2794 +(options
->shared_secret_file
!= NULL
) > 1)
2796 msg(M_USAGE
, "specify only one of --tls-server, --tls-client, or --secret");
2799 if (!options
->tls_server
&& !options
->tls_client
)
2801 msg(M_INFO
, "DEPRECATION: No tls-client or tls-server option in "
2802 "configuration detected. OpenVPN 2.7 will remove the "
2803 "functionality to run a VPN without TLS. "
2804 "See the examples section in the manual page for "
2805 "examples of a similar quick setup with peer-fingerprint.");
2808 if (options
->ssl_flags
& (SSLF_CLIENT_CERT_NOT_REQUIRED
|SSLF_CLIENT_CERT_OPTIONAL
))
2810 msg(M_WARN
, "WARNING: POTENTIALLY DANGEROUS OPTION "
2811 "--verify-client-cert none|optional "
2812 "may accept clients which do not present a certificate");
2815 const int tls_version_max
=
2816 (options
->ssl_flags
>> SSLF_TLS_VERSION_MAX_SHIFT
)
2817 & SSLF_TLS_VERSION_MAX_MASK
;
2818 const int tls_version_min
=
2819 (options
->ssl_flags
>> SSLF_TLS_VERSION_MIN_SHIFT
)
2820 & SSLF_TLS_VERSION_MIN_MASK
;
2822 if (tls_version_max
> 0 && tls_version_max
< tls_version_min
)
2824 msg(M_USAGE
, "--tls-version-min bigger than --tls-version-max");
2827 if (options
->tls_server
|| options
->tls_client
)
2829 check_ca_required(options
);
2830 #ifdef ENABLE_PKCS11
2831 if (options
->pkcs11_providers
[0])
2833 if (options
->pkcs11_id_management
&& options
->pkcs11_id
!= NULL
)
2835 msg(M_USAGE
, "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2837 if (!options
->pkcs11_id_management
&& options
->pkcs11_id
== NULL
)
2839 msg(M_USAGE
, "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2841 if (options
->cert_file
)
2843 msg(M_USAGE
, "Parameter --cert cannot be used when --pkcs11-provider is also specified.");
2845 if (options
->priv_key_file
)
2847 msg(M_USAGE
, "Parameter --key cannot be used when --pkcs11-provider is also specified.");
2849 #ifdef ENABLE_MANAGEMENT
2850 if (options
->management_flags
& MF_EXTERNAL_KEY
)
2852 msg(M_USAGE
, "Parameter --management-external-key cannot be used when --pkcs11-provider is also specified.");
2854 if (options
->management_flags
& MF_EXTERNAL_CERT
)
2856 msg(M_USAGE
, "Parameter --management-external-cert cannot be used when --pkcs11-provider is also specified.");
2859 if (options
->pkcs12_file
)
2861 msg(M_USAGE
, "Parameter --pkcs12 cannot be used when --pkcs11-provider is also specified.");
2863 #ifdef ENABLE_CRYPTOAPI
2864 if (options
->cryptoapi_cert
)
2866 msg(M_USAGE
, "Parameter --cryptoapicert cannot be used when --pkcs11-provider is also specified.");
2871 #endif /* ifdef ENABLE_PKCS11 */
2872 #ifdef ENABLE_MANAGEMENT
2873 if ((options
->management_flags
& MF_EXTERNAL_KEY
) && options
->priv_key_file
)
2875 msg(M_USAGE
, "--key and --management-external-key are mutually exclusive");
2877 else if ((options
->management_flags
& MF_EXTERNAL_CERT
))
2879 if (options
->cert_file
)
2881 msg(M_USAGE
, "--cert and --management-external-cert are mutually exclusive");
2883 else if (!(options
->management_flags
& MF_EXTERNAL_KEY
))
2885 msg(M_USAGE
, "--management-external-cert must be used with --management-external-key");
2890 #ifdef ENABLE_CRYPTOAPI
2891 if (options
->cryptoapi_cert
)
2893 if (options
->cert_file
)
2895 msg(M_USAGE
, "Parameter --cert cannot be used when --cryptoapicert is also specified.");
2897 if (options
->priv_key_file
)
2899 msg(M_USAGE
, "Parameter --key cannot be used when --cryptoapicert is also specified.");
2901 if (options
->pkcs12_file
)
2903 msg(M_USAGE
, "Parameter --pkcs12 cannot be used when --cryptoapicert is also specified.");
2905 #ifdef ENABLE_MANAGEMENT
2906 if (options
->management_flags
& MF_EXTERNAL_KEY
)
2908 msg(M_USAGE
, "Parameter --management-external-key cannot be used when --cryptoapicert is also specified.");
2910 if (options
->management_flags
& MF_EXTERNAL_CERT
)
2912 msg(M_USAGE
, "Parameter --management-external-cert cannot be used when --cryptoapicert is also specified.");
2917 #endif /* ifdef ENABLE_CRYPTOAPI */
2918 if (options
->pkcs12_file
)
2920 #ifdef ENABLE_CRYPTO_MBEDTLS
2921 msg(M_USAGE
, "Parameter --pkcs12 cannot be used with the mbed TLS version version of OpenVPN.");
2923 if (options
->ca_path
)
2925 msg(M_USAGE
, "Parameter --capath cannot be used when --pkcs12 is also specified.");
2927 if (options
->cert_file
)
2929 msg(M_USAGE
, "Parameter --cert cannot be used when --pkcs12 is also specified.");
2931 if (options
->priv_key_file
)
2933 msg(M_USAGE
, "Parameter --key cannot be used when --pkcs12 is also specified.");
2935 #ifdef ENABLE_MANAGEMENT
2936 if (options
->management_flags
& MF_EXTERNAL_KEY
)
2938 msg(M_USAGE
, "Parameter --management-external-key cannot be used when --pkcs12 is also specified.");
2940 if (options
->management_flags
& MF_EXTERNAL_CERT
)
2942 msg(M_USAGE
, "Parameter --management-external-cert cannot be used when --pkcs12 is also specified.");
2945 #endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2949 #ifdef ENABLE_CRYPTO_MBEDTLS
2950 if (options
->ca_path
)
2952 msg(M_USAGE
, "Parameter --capath cannot be used with the mbed TLS version version of OpenVPN.");
2954 #endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2959 #ifdef ENABLE_MANAGEMENT
2960 ((options
->cert_file
!= NULL
) || (options
->management_flags
& MF_EXTERNAL_CERT
))
2961 +((options
->priv_key_file
!= NULL
) || (options
->management_flags
& MF_EXTERNAL_KEY
));
2963 (options
->cert_file
!= NULL
) + (options
->priv_key_file
!= NULL
);
2968 if (!options
->auth_user_pass_file
)
2970 msg(M_USAGE
, "No client-side authentication method is "
2971 "specified. You must use either "
2972 "--cert/--key, --pkcs12, or "
2973 "--auth-user-pass");
2981 msg(M_USAGE
, "If you use one of --cert or --key, you must use them both");
2986 #ifdef ENABLE_MANAGEMENT
2987 if (!(options
->management_flags
& MF_EXTERNAL_CERT
))
2989 notnull(options
->cert_file
, "certificate file (--cert) or PKCS#12 file (--pkcs12)");
2990 #ifdef ENABLE_MANAGEMENT
2991 if (!(options
->management_flags
& MF_EXTERNAL_KEY
))
2993 notnull(options
->priv_key_file
, "private key file (--key) or PKCS#12 file (--pkcs12)");
2996 if (ce
->tls_auth_file
&& ce
->tls_crypt_file
)
2998 msg(M_USAGE
, "--tls-auth and --tls-crypt are mutually exclusive");
3000 if (options
->tls_client
&& ce
->tls_crypt_v2_file
3001 && (ce
->tls_auth_file
|| ce
->tls_crypt_file
))
3003 msg(M_USAGE
, "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
3009 * Make sure user doesn't specify any TLS options
3010 * when in non-TLS mode.
3013 #define MUST_BE_UNDEF(parm) if (options->parm != defaults.parm) {msg(M_USAGE, err, #parm); \
3016 const char err
[] = "Parameter %s can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.";
3018 MUST_BE_UNDEF(ca_file
);
3019 MUST_BE_UNDEF(ca_path
);
3020 MUST_BE_UNDEF(dh_file
);
3021 MUST_BE_UNDEF(cert_file
);
3022 MUST_BE_UNDEF(priv_key_file
);
3023 #ifndef ENABLE_CRYPTO_MBEDTLS
3024 MUST_BE_UNDEF(pkcs12_file
);
3026 MUST_BE_UNDEF(cipher_list
);
3027 MUST_BE_UNDEF(cipher_list_tls13
);
3028 MUST_BE_UNDEF(tls_cert_profile
);
3029 MUST_BE_UNDEF(tls_verify
);
3030 MUST_BE_UNDEF(tls_export_cert
);
3031 MUST_BE_UNDEF(verify_x509_name
);
3032 MUST_BE_UNDEF(tls_timeout
);
3033 MUST_BE_UNDEF(renegotiate_bytes
);
3034 MUST_BE_UNDEF(renegotiate_packets
);
3035 MUST_BE_UNDEF(renegotiate_seconds
);
3036 MUST_BE_UNDEF(handshake_window
);
3037 MUST_BE_UNDEF(transition_window
);
3038 MUST_BE_UNDEF(tls_auth_file
);
3039 MUST_BE_UNDEF(tls_crypt_file
);
3040 MUST_BE_UNDEF(tls_crypt_v2_file
);
3041 MUST_BE_UNDEF(single_session
);
3042 MUST_BE_UNDEF(push_peer_info
);
3043 MUST_BE_UNDEF(tls_exit
);
3044 MUST_BE_UNDEF(crl_file
);
3045 MUST_BE_UNDEF(ns_cert_type
);
3046 MUST_BE_UNDEF(remote_cert_ku
[0]);
3047 MUST_BE_UNDEF(remote_cert_eku
);
3048 #ifdef ENABLE_PKCS11
3049 MUST_BE_UNDEF(pkcs11_providers
[0]);
3050 MUST_BE_UNDEF(pkcs11_private_mode
[0]);
3051 MUST_BE_UNDEF(pkcs11_id
);
3052 MUST_BE_UNDEF(pkcs11_id_management
);
3057 msg(M_USAGE
, err
, "--pull");
3060 #undef MUST_BE_UNDEF
3062 if (options
->auth_user_pass_file
&& !options
->pull
)
3064 msg(M_USAGE
, "--auth-user-pass requires --pull");
3067 uninit_options(&defaults
);
3071 options_postprocess_mutate_ce(struct options
*o
, struct connection_entry
*ce
)
3073 const int dev
= dev_type_enum(o
->dev
, o
->dev_type
);
3075 if (o
->server_defined
|| o
->server_bridge_defined
|| o
->server_bridge_proxy_dhcp
)
3077 if (ce
->proto
== PROTO_TCP
)
3079 ce
->proto
= PROTO_TCP_SERVER
;
3085 if (ce
->proto
== PROTO_TCP
)
3087 ce
->proto
= PROTO_TCP_CLIENT
;
3091 /* an option is present that requires local bind to enabled */
3092 bool need_bind
= ce
->local
|| ce
->local_port_defined
|| ce
->bind_defined
;
3094 /* socks proxy is enabled */
3095 bool uses_socks
= ce
->proto
== PROTO_UDP
&& ce
->socks_proxy_server
;
3097 /* If binding is not forced by an explicit option and we have (at least)
3098 * one of --tcp-client, --pull (or --client), or socks we do not bind
3099 * locally to have "normal" IP client behaviour of a random source port */
3100 if (!need_bind
&& (ce
->proto
== PROTO_TCP_CLIENT
|| uses_socks
|| o
->pull
))
3102 ce
->bind_local
= false;
3105 if (!ce
->bind_local
)
3107 ce
->local_port
= NULL
;
3110 /* if protocol forcing is enabled, disable all protocols
3111 * except for the forced one
3113 if (o
->proto_force
>= 0 && o
->proto_force
!= ce
->proto
)
3115 ce
->flags
|= CE_DISABLED
;
3118 /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
3119 * so fall back to IPv4-only (trac #1221)
3121 if (ce
->socks_proxy_server
&& proto_is_udp(ce
->proto
) && ce
->af
!= AF_INET
)
3123 if (ce
->af
== AF_INET6
)
3125 msg(M_INFO
, "WARNING: '--proto udp6' is not compatible with "
3126 "'--socks-proxy' today. Forcing IPv4 mode." );
3130 msg(M_INFO
, "NOTICE: dual-stack mode for '--proto udp' does not "
3131 "work correctly with '--socks-proxy' today. Forcing IPv4." );
3140 if (!ce
->tun_mtu_defined
&& !ce
->link_mtu_defined
)
3142 ce
->tun_mtu_defined
= true;
3144 if ((dev
== DEV_TYPE_TAP
) && !ce
->tun_mtu_extra_defined
)
3146 ce
->tun_mtu_extra_defined
= true;
3147 ce
->tun_mtu_extra
= TAP_MTU_EXTRA_DEFAULT
;
3152 * If --mssfix is supplied without a parameter or not specified at all,
3153 * default it to --fragment value, if --fragment is specified and otherwise
3154 * to the default if tun-mtu is 1500
3156 if (o
->ce
.mssfix_default
)
3158 #ifdef ENABLE_FRAGMENT
3161 ce
->mssfix
= ce
->fragment
;
3165 if (ce
->tun_mtu_defined
)
3167 if (o
->ce
.tun_mtu
== TUN_MTU_DEFAULT
)
3169 /* We want to only set mssfix default value if we use a default
3170 * MTU Size, otherwise the different size of tun should either
3171 * already solve the problem or mssfix might artifically make the
3172 * payload packets smaller without mssfix 0 */
3173 ce
->mssfix
= MSSFIX_DEFAULT
;
3174 ce
->mssfix_encap
= true;
3178 /* We still apply the mssfix value but only adjust it to the
3179 * size of the tun interface. */
3180 ce
->mssfix
= ce
->tun_mtu
;
3181 ce
->mssfix_fixed
= true;
3187 * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
3189 * At the end only one of these will be really set because the parser
3190 * logic prevents configurations where more are set.
3192 if (!ce
->tls_auth_file
&& !ce
->tls_crypt_file
&& !ce
->tls_crypt_v2_file
)
3194 ce
->tls_auth_file
= o
->tls_auth_file
;
3195 ce
->tls_auth_file_inline
= o
->tls_auth_file_inline
;
3196 ce
->key_direction
= o
->key_direction
;
3198 ce
->tls_crypt_file
= o
->tls_crypt_file
;
3199 ce
->tls_crypt_file_inline
= o
->tls_crypt_file_inline
;
3201 ce
->tls_crypt_v2_file
= o
->tls_crypt_v2_file
;
3202 ce
->tls_crypt_v2_file_inline
= o
->tls_crypt_v2_file_inline
;
3205 /* Pre-cache tls-auth/crypt(-v2) key file if persist-key was specified and
3206 * keys were not already embedded in the config file.
3210 connection_entry_preload_key(&ce
->tls_auth_file
,
3211 &ce
->tls_auth_file_inline
, &o
->gc
);
3212 connection_entry_preload_key(&ce
->tls_crypt_file
,
3213 &ce
->tls_crypt_file_inline
, &o
->gc
);
3214 connection_entry_preload_key(&ce
->tls_crypt_v2_file
,
3215 &ce
->tls_crypt_v2_file_inline
, &o
->gc
);
3218 if (!proto_is_udp(ce
->proto
) && ce
->explicit_exit_notification
)
3220 msg(M_WARN
, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
3221 ce
->explicit_exit_notification
= 0;
3226 /* If iservice is in use, we need def1 method for redirect-gateway */
3228 remap_redirect_gateway_flags(struct options
*opt
)
3231 && opt
->route_method
== ROUTE_METHOD_SERVICE
3232 && opt
->routes
->flags
& RG_REROUTE_GW
3233 && !(opt
->routes
->flags
& RG_DEF1
))
3235 msg(M_INFO
, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
3236 opt
->routes
->flags
|= RG_DEF1
;
3242 * Save/Restore certain option defaults before --pull is applied.
3246 pre_connect_save(struct options
*o
)
3248 ALLOC_OBJ_CLEAR_GC(o
->pre_connect
, struct options_pre_connect
, &o
->gc
);
3249 o
->pre_connect
->tuntap_options
= o
->tuntap_options
;
3250 o
->pre_connect
->tuntap_options_defined
= true;
3251 o
->pre_connect
->foreign_option_index
= o
->foreign_option_index
;
3255 o
->pre_connect
->routes
= clone_route_option_list(o
->routes
, &o
->gc
);
3256 o
->pre_connect
->routes_defined
= true;
3260 o
->pre_connect
->routes_ipv6
= clone_route_ipv6_option_list(o
->routes_ipv6
, &o
->gc
);
3261 o
->pre_connect
->routes_ipv6_defined
= true;
3265 o
->pre_connect
->client_nat
= clone_client_nat_option_list(o
->client_nat
, &o
->gc
);
3266 o
->pre_connect
->client_nat_defined
= true;
3269 o
->pre_connect
->route_default_gateway
= o
->route_default_gateway
;
3270 o
->pre_connect
->route_ipv6_default_gateway
= o
->route_ipv6_default_gateway
;
3272 o
->pre_connect
->dns_options
= clone_dns_options(o
->dns_options
, &o
->gc
);
3274 /* NCP related options that can be overwritten by a push */
3275 o
->pre_connect
->ciphername
= o
->ciphername
;
3276 o
->pre_connect
->authname
= o
->authname
;
3278 /* Ping related options should be reset to the config values on reconnect */
3279 o
->pre_connect
->ping_rec_timeout
= o
->ping_rec_timeout
;
3280 o
->pre_connect
->ping_rec_timeout_action
= o
->ping_rec_timeout_action
;
3281 o
->pre_connect
->ping_send_timeout
= o
->ping_send_timeout
;
3283 /* Miscellaneous Options */
3285 o
->pre_connect
->comp
= o
->comp
;
3290 pre_connect_restore(struct options
*o
, struct gc_arena
*gc
)
3292 const struct options_pre_connect
*pp
= o
->pre_connect
;
3295 CLEAR(o
->tuntap_options
);
3296 if (pp
->tuntap_options_defined
)
3298 o
->tuntap_options
= pp
->tuntap_options
;
3301 if (pp
->routes_defined
)
3304 copy_route_option_list(o
->routes
, pp
->routes
, gc
);
3311 if (pp
->routes_ipv6_defined
)
3313 rol6_check_alloc(o
);
3314 copy_route_ipv6_option_list(o
->routes_ipv6
, pp
->routes_ipv6
, gc
);
3318 o
->routes_ipv6
= NULL
;
3321 o
->route_default_gateway
= pp
->route_default_gateway
;
3322 o
->route_ipv6_default_gateway
= pp
->route_ipv6_default_gateway
;
3324 /* Free DNS options and reset them to pre-pull state */
3325 gc_free(&o
->dns_options
.gc
);
3326 struct gc_arena dns_gc
= gc_new();
3327 o
->dns_options
= clone_dns_options(pp
->dns_options
, &dns_gc
);
3328 o
->dns_options
.gc
= dns_gc
;
3330 if (pp
->client_nat_defined
)
3332 cnol_check_alloc(o
);
3333 copy_client_nat_option_list(o
->client_nat
, pp
->client_nat
);
3337 o
->client_nat
= NULL
;
3340 o
->foreign_option_index
= pp
->foreign_option_index
;
3342 o
->ciphername
= pp
->ciphername
;
3343 o
->authname
= pp
->authname
;
3345 o
->ping_rec_timeout
= pp
->ping_rec_timeout
;
3346 o
->ping_rec_timeout_action
= pp
->ping_rec_timeout_action
;
3347 o
->ping_send_timeout
= pp
->ping_send_timeout
;
3349 /* Miscellaneous Options */
3355 o
->push_continuation
= 0;
3356 o
->push_option_types_found
= 0;
3357 o
->imported_protocol_flags
= 0;
3361 options_postprocess_mutate_invariant(struct options
*options
)
3364 const int dev
= dev_type_enum(options
->dev
, options
->dev_type
);
3366 /* when using wintun/ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
3367 if ((options
->windows_driver
== WINDOWS_DRIVER_WINTUN
3368 || options
->windows_driver
== WINDOWS_DRIVER_DCO
)
3369 && (options
->tuntap_options
.ip_win32_type
== IPW32_SET_DHCP_MASQ
3370 || options
->tuntap_options
.ip_win32_type
== IPW32_SET_ADAPTIVE
))
3372 options
->tuntap_options
.ip_win32_type
= IPW32_SET_NETSH
;
3375 if ((dev
== DEV_TYPE_TUN
|| dev
== DEV_TYPE_TAP
) && !options
->route_delay_defined
)
3377 /* delay may only be necessary when we perform DHCP handshake */
3378 const bool dhcp
= (options
->tuntap_options
.ip_win32_type
== IPW32_SET_DHCP_MASQ
)
3379 || (options
->tuntap_options
.ip_win32_type
== IPW32_SET_ADAPTIVE
);
3380 if ((options
->mode
== MODE_POINT_TO_POINT
) && dhcp
)
3382 options
->route_delay_defined
= true;
3383 options
->route_delay
= 5; /* Vista sometimes has a race without this */
3387 if (options
->ifconfig_noexec
)
3389 options
->tuntap_options
.ip_win32_type
= IPW32_SET_MANUAL
;
3390 options
->ifconfig_noexec
= false;
3393 remap_redirect_gateway_flags(options
);
3396 * Check consistency of --mode server options.
3398 if (options
->mode
== MODE_SERVER
)
3401 * We need to explicitly set --tap-sleep because
3402 * we do not schedule event timers in the top-level context.
3404 options
->tuntap_options
.tap_sleep
= 10;
3405 if (options
->route_delay_defined
&& options
->route_delay
)
3407 options
->tuntap_options
.tap_sleep
= options
->route_delay
;
3409 options
->route_delay_defined
= false;
3411 #endif /* ifdef _WIN32 */
3413 #ifdef DEFAULT_PKCS11_MODULE
3414 /* If p11-kit is present on the system then load its p11-kit-proxy.so
3415 * by default if the user asks for PKCS#11 without otherwise specifying
3416 * the module to use. */
3417 if (!options
->pkcs11_providers
[0]
3418 && (options
->pkcs11_id
|| options
->pkcs11_id_management
))
3420 options
->pkcs11_providers
[0] = DEFAULT_PKCS11_MODULE
;
3426 options_postprocess_verify(const struct options
*o
)
3428 if (o
->connection_list
)
3431 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
3433 options_postprocess_verify_ce(o
, o
->connection_list
->array
[i
]);
3438 options_postprocess_verify_ce(o
, &o
->ce
);
3441 dns_options_verify(M_FATAL
, &o
->dns_options
);
3443 if (dco_enabled(o
) && o
->enable_c2c
)
3445 msg(M_WARN
, "Note: --client-to-client has no effect when using data "
3446 "channel offload: packets are always sent to the VPN "
3447 "interface and then routed based on the system routing table");
3452 * Checks for availibility of Chacha20-Poly1305 and sets
3453 * the ncp_cipher to either AES-256-GCM:AES-128-GCM or
3454 * AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305.
3457 options_postprocess_setdefault_ncpciphers(struct options
*o
)
3461 /* custom --data-ciphers set, keep list */
3465 /* check if crypto library supports chacha */
3466 bool can_do_chacha
= cipher_valid("CHACHA20-POLY1305");
3468 if (can_do_chacha
&& dco_enabled(o
))
3470 /* also make sure that dco supports chacha */
3471 can_do_chacha
= tls_item_in_cipher_list("CHACHA20-POLY1305", dco_get_supported_ciphers());
3476 o
->ncp_ciphers
= "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305";
3480 o
->ncp_ciphers
= "AES-256-GCM:AES-128-GCM";
3485 options_postprocess_cipher(struct options
*o
)
3487 if (!o
->pull
&& !(o
->mode
== MODE_SERVER
))
3489 /* If the cipher is not set, use the old default of BF-CBC. We will
3490 * warn that this is deprecated on cipher initialisation, no need
3491 * to warn here as well */
3494 o
->ciphername
= "BF-CBC";
3498 o
->enable_ncp_fallback
= true;
3503 /* pull or P2MP mode */
3506 /* We still need to set the ciphername to BF-CBC since various other
3507 * parts of OpenVPN assert that the ciphername is set */
3508 o
->ciphername
= "BF-CBC";
3510 msg(M_INFO
, "Note: --cipher is not set. OpenVPN versions before 2.5 "
3511 "defaulted to BF-CBC as fallback when cipher negotiation "
3512 "failed in this case. If you need this fallback please add "
3513 "'--data-ciphers-fallback BF-CBC' to your configuration "
3514 "and/or add BF-CBC to --data-ciphers.");
3516 else if (!o
->enable_ncp_fallback
3517 && !tls_item_in_cipher_list(o
->ciphername
, o
->ncp_ciphers
))
3519 msg(M_WARN
, "DEPRECATED OPTION: --cipher set to '%s' but missing in "
3520 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
3522 o
->ciphername
, o
->ncp_ciphers
);
3527 * The option --compat-mode is used to set up default settings to values
3528 * used on the specified openvpn version and earlier.
3530 * This function is used in various "default option" paths to test if the
3531 * user requested compatibility with a version before the one specified
3532 * as argument. This way some default settings can be automatically
3533 * altered to guarantee compatibility with the version specified by the
3534 * user via --compat-mode.
3536 * @param version need compatibility with openvpn versions before the
3537 * one specified (20401 = before 2.4.1)
3538 * @return whether compatibility should be enabled
3541 need_compatibility_before(const struct options
*o
, unsigned int version
)
3543 return o
->backwards_compatible
!= 0 && o
->backwards_compatible
< version
;
3547 * Changes default values so that OpenVPN can be compatible with the user
3551 options_set_backwards_compatible_options(struct options
*o
)
3553 /* TLS min version is not set */
3554 int tls_ver_min
= (o
->ssl_flags
>> SSLF_TLS_VERSION_MIN_SHIFT
)
3555 & SSLF_TLS_VERSION_MIN_MASK
;
3556 if (tls_ver_min
== 0)
3558 int tls_ver_max
= (o
->ssl_flags
>> SSLF_TLS_VERSION_MAX_SHIFT
)
3559 & SSLF_TLS_VERSION_MAX_MASK
;
3560 if (need_compatibility_before(o
, 20307))
3562 /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
3563 o
->ssl_flags
|= (TLS_VER_1_0
<< SSLF_TLS_VERSION_MIN_SHIFT
);
3565 else if (tls_ver_max
== 0 || tls_ver_max
>= TLS_VER_1_2
)
3567 /* Use TLS 1.2 as proper default */
3568 o
->ssl_flags
|= (TLS_VER_1_2
<< SSLF_TLS_VERSION_MIN_SHIFT
);
3572 /* Maximize the minimum version */
3573 o
->ssl_flags
|= (tls_ver_max
<< SSLF_TLS_VERSION_MIN_SHIFT
);
3577 if (need_compatibility_before(o
, 20400))
3581 /* If ciphername is not set default to BF-CBC when targeting these
3582 * old versions that do not have NCP */
3583 o
->ciphername
= "BF-CBC";
3585 /* Versions < 2.4.0 additionally might be compiled with --enable-small and
3586 * not have OCC strings required for "poor man's NCP" */
3587 o
->enable_ncp_fallback
= true;
3590 /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
3591 * Version 2.4 probably does not need it but NCP was not so
3592 * good with 2.4 and ncp-disable might be more common on 2.4 peers.
3593 * Only do this iff --cipher is set (explicitly or by compat mode
3594 * < 2.4.0, see above). This is not 100% correct backwards compatible
3595 * behaviour but 2.5 already behaved like this */
3596 if (o
->ciphername
&& need_compatibility_before(o
, 20500)
3597 && !tls_item_in_cipher_list(o
->ciphername
, o
->ncp_ciphers
))
3599 append_cipher_to_ncp_list(o
, o
->ciphername
);
3603 /* Compression is deprecated and we do not want to announce support for it
3604 * by default anymore, additionally DCO breaks with compression.
3606 * Disable compression by default starting with 2.6.0 if no other
3607 * compression related option has been explicitly set */
3608 if (!comp_non_stub_enabled(&o
->comp
) && !need_compatibility_before(o
, 20600)
3609 && (o
->comp
.flags
== 0))
3611 o
->comp
.flags
= COMP_F_ALLOW_STUB_ONLY
|COMP_F_ADVERTISE_STUBS_ONLY
;
3617 options_postprocess_mutate(struct options
*o
, struct env_set
*es
)
3621 * Process helper-type options which map to other, more complex
3622 * sequences of options.
3624 helper_client_server(o
);
3625 helper_keepalive(o
);
3626 helper_tcp_nodelay(o
);
3628 options_postprocess_setdefault_ncpciphers(o
);
3629 options_set_backwards_compatible_options(o
);
3631 options_postprocess_cipher(o
);
3632 o
->ncp_ciphers
= mutate_ncp_cipher_list(o
->ncp_ciphers
, &o
->gc
);
3633 if (o
->ncp_ciphers
== NULL
)
3635 msg(M_USAGE
, "--data-ciphers list contains unsupported ciphers or is too long.");
3638 if (o
->remote_list
&& !o
->connection_list
)
3641 * Convert remotes into connection list
3643 const struct remote_list
*rl
= o
->remote_list
;
3644 for (i
= 0; i
< rl
->len
; ++i
)
3646 const struct remote_entry
*re
= rl
->array
[i
];
3647 struct connection_entry ce
= o
->ce
;
3648 struct connection_entry
*ace
;
3651 connection_entry_load_re(&ce
, re
);
3652 ace
= alloc_connection_entry(o
, M_USAGE
);
3657 else if (!o
->remote_list
&& !o
->connection_list
)
3659 struct connection_entry
*ace
;
3660 ace
= alloc_connection_entry(o
, M_USAGE
);
3665 ASSERT(o
->connection_list
);
3666 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
3668 options_postprocess_mutate_ce(o
, o
->connection_list
->array
[i
]);
3673 /* Check that DH file is specified, or explicitly disabled */
3674 notnull(o
->dh_file
, "DH file (--dh)");
3675 if (streq(o
->dh_file
, "none"))
3680 else if (o
->dh_file
)
3682 /* DH file is only meaningful in a tls-server context. */
3683 msg(M_WARN
, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3684 "include this in your server configuration");
3687 #if ENABLE_MANAGEMENT
3688 if (o
->http_proxy_override
)
3690 options_postprocess_http_proxy_override(o
);
3693 if (!o
->ca_file
&& !o
->ca_path
&& o
->verify_hash
3694 && o
->verify_hash_depth
== 0)
3696 msg(M_INFO
, "Using certificate fingerprint to verify peer (no CA "
3698 o
->verify_hash_no_ca
= true;
3701 if (o
->config
&& streq(o
->config
, "stdin") && o
->remap_sigusr1
== SIGHUP
)
3703 msg(M_USAGE
, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3704 "incompatible with each other.");
3709 /* check if any option should force disabling DCO */
3710 o
->tuntap_options
.disable_dco
= !dco_check_option(D_DCO
, o
)
3711 || !dco_check_startup_option(D_DCO
, o
);
3717 o
->windows_driver
= WINDOWS_DRIVER_DCO
;
3721 if (o
->windows_driver
== WINDOWS_DRIVER_DCO
)
3723 msg(M_WARN
, "Option --windows-driver ovpn-dco is ignored because Data Channel Offload is disabled");
3724 o
->windows_driver
= WINDOWS_DRIVER_TAP_WINDOWS6
;
3726 else if (o
->windows_driver
== WINDOWS_DRIVER_UNSPECIFIED
)
3728 o
->windows_driver
= WINDOWS_DRIVER_TAP_WINDOWS6
;
3733 if (dco_enabled(o
) && o
->dev_node
)
3735 msg(M_WARN
, "Note: ignoring --dev-node as it has no effect when using "
3736 "data channel offload");
3740 /* this depends on o->windows_driver, which is set above */
3741 options_postprocess_mutate_invariant(o
);
3744 * Save certain parms before modifying options during connect, especially
3749 dns_options_preprocess_pull(&o
->dns_options
);
3753 #if defined(_WIN32) || defined(TARGET_ANDROID)
3754 tuntap_options_copy_dns(o
);
3756 foreign_options_copy_dns(o
, es
);
3759 if (o
->auth_token_generate
&& !o
->auth_token_renewal
)
3761 o
->auth_token_renewal
= o
->renegotiate_seconds
;
3763 pre_connect_save(o
);
3767 * Check file/directory sanity
3770 #ifndef ENABLE_SMALL /** Expect people using the stripped down version to know what they do */
3772 #define CHKACC_FILE (1<<0) /** Check for a file/directory presence */
3773 #define CHKACC_DIRPATH (1<<1) /** Check for directory presence where a file should reside */
3774 #define CHKACC_FILEXSTWR (1<<2) /** If file exists, is it writable? */
3775 #define CHKACC_ACPTSTDIN (1<<3) /** If filename is stdin, it's allowed and "exists" */
3776 #define CHKACC_PRIVATE (1<<4) /** Warn if this (private) file is group/others accessible */
3779 check_file_access(const int type
, const char *file
, const int mode
, const char *opt
)
3783 /* If no file configured, no errors to look for */
3789 /* If stdin is allowed and the file name is 'stdin', then do no
3790 * further checks as stdin is always available
3792 if ( (type
& CHKACC_ACPTSTDIN
) && streq(file
, "stdin") )
3797 /* Is the directory path leading to the given file accessible? */
3798 if (type
& CHKACC_DIRPATH
)
3800 char *fullpath
= string_alloc(file
, NULL
); /* POSIX dirname() implementation may modify its arguments */
3801 char *dirpath
= dirname(fullpath
);
3803 if (platform_access(dirpath
, mode
|X_OK
) != 0)
3810 /* Is the file itself accessible? */
3811 if (!errcode
&& (type
& CHKACC_FILE
) && (platform_access(file
, mode
) != 0) )
3816 /* If the file exists and is accessible, is it writable? */
3817 if (!errcode
&& (type
& CHKACC_FILEXSTWR
) && (platform_access(file
, F_OK
) == 0) )
3819 if (platform_access(file
, W_OK
) != 0)
3825 /* Warn if a given private file is group/others accessible. */
3826 if (type
& CHKACC_PRIVATE
)
3829 if (platform_stat(file
, &st
))
3831 msg(M_WARN
| M_ERRNO
, "WARNING: cannot stat file '%s'", file
);
3836 if (st
.st_mode
& (S_IRWXG
|S_IRWXO
))
3838 msg(M_WARN
, "WARNING: file '%s' is group or others accessible", file
);
3844 /* Scream if an error is found */
3847 msg(M_NOPREFIX
| M_OPTERR
| M_ERRNO
, "%s fails with '%s'", opt
, file
);
3850 /* Return true if an error occurred */
3851 return (errcode
!= 0 ? true : false);
3854 /* A wrapper for check_file_access() which also takes a chroot directory.
3855 * If chroot is NULL, behaviour is exactly the same as calling check_file_access() directly,
3856 * otherwise it will look for the file inside the given chroot directory instead.
3859 check_file_access_chroot(const char *chroot
, const int type
, const char *file
, const int mode
, const char *opt
)
3863 /* If no file configured, no errors to look for */
3869 /* If chroot is set, look for the file/directory inside the chroot */
3872 struct gc_arena gc
= gc_new();
3873 struct buffer chroot_file
;
3875 chroot_file
= prepend_dir(chroot
, file
, &gc
);
3876 ret
= check_file_access(type
, BSTR(&chroot_file
), mode
, opt
);
3881 /* No chroot in play, just call core file check function */
3882 ret
= check_file_access(type
, file
, mode
, opt
);
3888 * A wrapper for check_file_access_chroot() that returns false immediately if
3889 * the file is inline (and therefore there is no access to check)
3892 check_file_access_chroot_inline(bool is_inline
, const char *chroot
,
3893 const int type
, const char *file
,
3894 const int mode
, const char *opt
)
3901 return check_file_access_chroot(chroot
, type
, file
, mode
, opt
);
3905 * A wrapper for check_file_access() that returns false immediately if the file
3906 * is inline (and therefore there is no access to check)
3909 check_file_access_inline(bool is_inline
, const int type
, const char *file
,
3910 const int mode
, const char *opt
)
3917 return check_file_access(type
, file
, mode
, opt
);
3921 * Verifies that the path in the "command" that comes after certain script options (e.g., --up) is a
3922 * valid file with appropriate permissions.
3924 * "command" consists of a path, optionally followed by a space, which may be
3925 * followed by arbitrary arguments. It is NOT a full shell command line -- shell expansion is not
3928 * The path and arguments in "command" may be single- or double-quoted or escaped.
3930 * The path is extracted from "command", then check_file_access() is called to check it. The
3931 * arguments, if any, are ignored.
3933 * Note that the type, mode, and opt arguments to this routine are the same as the corresponding
3934 * check_file_access() arguments.
3937 check_cmd_access(const char *command
, const char *opt
, const char *chroot
)
3942 /* If no command was set, there are no errors to look for */
3948 /* Extract executable path and arguments */
3950 argv_parse_cmd(&argv
, command
);
3952 /* if an executable is specified then check it; otherwise, complain */
3955 /* Scripts requires R_OK as well, but that might fail on binaries which
3956 * only requires X_OK to function on Unix - a scenario not unlikely to
3957 * be seen on suid binaries.
3959 return_code
= check_file_access_chroot(chroot
, CHKACC_FILE
, argv
.argv
[0], X_OK
, opt
);
3963 msg(M_NOPREFIX
|M_OPTERR
, "%s fails with '%s': No path to executable.",
3974 * Sanity check of all file/dir options. Checks that file/dir
3975 * is accessible by OpenVPN
3978 options_postprocess_filechecks(struct options
*options
)
3982 /* ** SSL/TLS/crypto related files ** */
3983 errs
|= check_file_access_inline(options
->dh_file_inline
, CHKACC_FILE
,
3984 options
->dh_file
, R_OK
, "--dh");
3986 if (!options
->verify_hash_no_ca
)
3988 errs
|= check_file_access_inline(options
->ca_file_inline
, CHKACC_FILE
,
3989 options
->ca_file
, R_OK
, "--ca");
3992 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
,
3993 options
->ca_path
, R_OK
, "--capath");
3995 errs
|= check_file_access_inline(options
->cert_file_inline
, CHKACC_FILE
,
3996 options
->cert_file
, R_OK
, "--cert");
3998 errs
|= check_file_access_inline(options
->extra_certs_file
, CHKACC_FILE
,
3999 options
->extra_certs_file
, R_OK
,
4002 #ifdef ENABLE_MANAGMENT
4003 if (!(options
->management_flags
& MF_EXTERNAL_KEY
))
4006 errs
|= check_file_access_inline(options
->priv_key_file_inline
,
4007 CHKACC_FILE
|CHKACC_PRIVATE
,
4008 options
->priv_key_file
, R_OK
, "--key");
4011 errs
|= check_file_access_inline(options
->pkcs12_file_inline
,
4012 CHKACC_FILE
|CHKACC_PRIVATE
,
4013 options
->pkcs12_file
, R_OK
, "--pkcs12");
4015 if (options
->ssl_flags
& SSLF_CRL_VERIFY_DIR
)
4017 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
,
4018 options
->crl_file
, R_OK
|X_OK
,
4019 "--crl-verify directory");
4023 errs
|= check_file_access_chroot_inline(options
->crl_file_inline
,
4024 options
->chroot_dir
,
4025 CHKACC_FILE
, options
->crl_file
,
4026 R_OK
, "--crl-verify");
4029 ASSERT(options
->connection_list
);
4030 for (int i
= 0; i
< options
->connection_list
->len
; ++i
)
4032 struct connection_entry
*ce
= options
->connection_list
->array
[i
];
4034 errs
|= check_file_access_inline(ce
->tls_auth_file_inline
,
4035 CHKACC_FILE
|CHKACC_PRIVATE
,
4036 ce
->tls_auth_file
, R_OK
,
4038 errs
|= check_file_access_inline(ce
->tls_crypt_file_inline
,
4039 CHKACC_FILE
|CHKACC_PRIVATE
,
4040 ce
->tls_crypt_file
, R_OK
,
4042 errs
|= check_file_access_inline(ce
->tls_crypt_v2_file_inline
,
4043 CHKACC_FILE
|CHKACC_PRIVATE
,
4044 ce
->tls_crypt_v2_file
, R_OK
,
4048 errs
|= check_file_access_inline(options
->shared_secret_file_inline
,
4049 CHKACC_FILE
|CHKACC_PRIVATE
,
4050 options
->shared_secret_file
, R_OK
,
4053 errs
|= check_file_access(CHKACC_DIRPATH
|CHKACC_FILEXSTWR
,
4054 options
->packet_id_file
, R_OK
|W_OK
, "--replay-persist");
4056 /* ** Password files ** */
4057 errs
|= check_file_access(CHKACC_FILE
|CHKACC_ACPTSTDIN
|CHKACC_PRIVATE
,
4058 options
->key_pass_file
, R_OK
, "--askpass");
4059 #ifdef ENABLE_MANAGEMENT
4060 errs
|= check_file_access(CHKACC_FILE
|CHKACC_ACPTSTDIN
|CHKACC_PRIVATE
,
4061 options
->management_user_pass
, R_OK
,
4062 "--management user/password file");
4063 #endif /* ENABLE_MANAGEMENT */
4064 errs
|= check_file_access_inline(options
->auth_user_pass_file_inline
,
4065 CHKACC_FILE
|CHKACC_ACPTSTDIN
|CHKACC_PRIVATE
,
4066 options
->auth_user_pass_file
, R_OK
,
4067 "--auth-user-pass");
4068 /* ** System related ** */
4069 errs
|= check_file_access(CHKACC_FILE
, options
->chroot_dir
,
4070 R_OK
|X_OK
, "--chroot directory");
4071 errs
|= check_file_access(CHKACC_DIRPATH
|CHKACC_FILEXSTWR
, options
->writepid
,
4072 R_OK
|W_OK
, "--writepid");
4074 /* ** Log related ** */
4075 errs
|= check_file_access(CHKACC_DIRPATH
|CHKACC_FILEXSTWR
, options
->status_file
,
4076 R_OK
|W_OK
, "--status");
4078 /* ** Config related ** */
4079 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
, options
->tls_export_cert
,
4080 R_OK
|W_OK
|X_OK
, "--tls-export-cert");
4081 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
, options
->client_config_dir
,
4082 R_OK
|X_OK
, "--client-config-dir");
4083 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
, options
->tmp_dir
,
4084 R_OK
|W_OK
|X_OK
, "Temporary directory (--tmp-dir)");
4088 msg(M_USAGE
, "Please correct these errors.");
4091 #endif /* !ENABLE_SMALL */
4094 * Sanity check on options.
4095 * Also set some options based on other
4099 options_postprocess(struct options
*options
, struct env_set
*es
)
4101 options_postprocess_mutate(options
, es
);
4102 options_postprocess_verify(options
);
4103 #ifndef ENABLE_SMALL
4104 options_postprocess_filechecks(options
);
4105 #endif /* !ENABLE_SMALL */
4109 * Sanity check on options after more options were pulled from server.
4110 * Also time to modify some options based on other options.
4113 options_postprocess_pull(struct options
*o
, struct env_set
*es
)
4115 bool success
= dns_options_verify(D_PUSH_ERRORS
, &o
->dns_options
);
4118 dns_options_postprocess_pull(&o
->dns_options
);
4119 setenv_dns_options(&o
->dns_options
, es
);
4120 #if defined(_WIN32) || defined(TARGET_ANDROID)
4121 tuntap_options_copy_dns(o
);
4123 foreign_options_copy_dns(o
, es
);
4130 * Build an options string to represent data channel encryption options.
4131 * This string must match exactly between peers. The keysize is checked
4132 * separately by read_key().
4134 * The following options must match on both peers:
4138 * --dev tun|tap [unit number need not match]
4139 * --dev-type tun|tap
4144 * --proto tcp-client [matched with --proto tcp-server
4145 * on the other end of the connection]
4146 * --proto tcp-server [matched with --proto tcp-client on
4147 * the other end of the connection]
4149 * --ifconfig x y [matched with --ifconfig y x on
4150 * the other end of the connection]
4167 * --tls-client [matched with --tls-server on
4168 * the other end of the connection]
4169 * --tls-server [matched with --tls-client on
4170 * the other end of the connection]
4173 options_string(const struct options
*o
,
4174 const struct frame
*frame
,
4176 openvpn_net_ctx_t
*ctx
,
4178 struct gc_arena
*gc
)
4180 struct buffer out
= alloc_buf(OPTION_LINE_SIZE
);
4181 bool tt_local
= false;
4183 buf_printf(&out
, "V4");
4189 buf_printf(&out
, ",dev-type %s", dev_type_string(o
->dev
, o
->dev_type
));
4190 /* the link-mtu that we send has only a meaning if have a fixed
4191 * cipher (p2p) or have a fallback cipher configured for older non
4192 * ncp clients. But not sending it will make even 2.4 complain
4193 * about it being missing. So still send it. */
4194 buf_printf(&out
, ",link-mtu %u",
4195 (unsigned int) calc_options_string_link_mtu(o
, frame
));
4197 if (o
->ce
.occ_mtu
!= 0)
4199 buf_printf(&out
, ",tun-mtu %d", o
->ce
.occ_mtu
);
4203 buf_printf(&out
, ",tun-mtu %d", frame
->tun_mtu
);
4206 buf_printf(&out
, ",proto %s", proto_remote(o
->ce
.proto
, remote
));
4208 bool p2p_nopull
= o
->mode
== MODE_POINT_TO_POINT
&& !PULL_DEFINED(o
);
4209 /* send tun_ipv6 only in peer2peer mode - in client/server mode, it
4210 * is usually pushed by the server, triggering a non-helpful warning
4212 if (o
->ifconfig_ipv6_local
&& p2p_nopull
)
4214 buf_printf(&out
, ",tun-ipv6");
4218 * Try to get ifconfig parameters into the options string.
4219 * If tt is undefined, make a temporary instantiation.
4223 tt
= init_tun(o
->dev
,
4227 o
->ifconfig_remote_netmask
,
4228 o
->ifconfig_ipv6_local
,
4229 o
->ifconfig_ipv6_netbits
,
4230 o
->ifconfig_ipv6_remote
,
4243 if (tt
&& p2p_nopull
)
4245 const char *ios
= ifconfig_options_string(tt
, remote
, o
->ifconfig_nowarn
, gc
);
4246 if (ios
&& strlen(ios
))
4248 buf_printf(&out
, ",ifconfig %s", ios
);
4258 if (o
->comp
.alg
!= COMP_ALG_UNDEF
)
4260 buf_printf(&out
, ",comp-lzo"); /* for compatibility, this simply indicates that compression context is active, not necessarily LZO per-se */
4264 #ifdef ENABLE_FRAGMENT
4267 buf_printf(&out
, ",mtu-dynamic");
4271 #define TLS_CLIENT (o->tls_client)
4272 #define TLS_SERVER (o->tls_server)
4278 const char *kd
= keydirection2ascii(o
->key_direction
, remote
, false);
4281 buf_printf(&out
, ",keydir %s", kd
);
4288 if (o
->shared_secret_file
|| TLS_CLIENT
|| TLS_SERVER
)
4292 ASSERT((o
->shared_secret_file
!= NULL
)
4293 + (TLS_CLIENT
== true)
4294 + (TLS_SERVER
== true)
4297 /* Skip resolving BF-CBC to allow SSL libraries without BF-CBC
4298 * to work here in the default configuration */
4299 const char *ciphername
= o
->ciphername
;
4302 if (strcmp(o
->ciphername
, "BF-CBC") == 0)
4304 init_key_type(&kt
, "none", o
->authname
, true, false);
4309 init_key_type(&kt
, o
->ciphername
, o
->authname
, true, false);
4310 ciphername
= cipher_kt_name(kt
.cipher
);
4311 if (cipher_defined(o
->ciphername
))
4313 keysize
= cipher_kt_key_size(kt
.cipher
) * 8;
4316 /* Only announce the cipher to our peer if we are willing to
4318 if (p2p_nopull
|| tls_item_in_cipher_list(ciphername
, o
->ncp_ciphers
))
4320 buf_printf(&out
, ",cipher %s", ciphername
);
4322 buf_printf(&out
, ",auth %s", md_kt_name(kt
.digest
));
4323 buf_printf(&out
, ",keysize %d", keysize
);
4324 if (o
->shared_secret_file
)
4326 buf_printf(&out
, ",secret");
4330 buf_printf(&out
, ",no-replay");
4333 #ifdef ENABLE_PREDICTION_RESISTANCE
4334 if (o
->use_prediction_resistance
)
4336 buf_printf(&out
, ",use-prediction-resistance");
4345 if (TLS_CLIENT
|| TLS_SERVER
)
4347 if (o
->ce
.tls_auth_file
)
4349 buf_printf(&out
, ",tls-auth");
4351 /* Not adding tls-crypt here, because we won't reach this code if
4352 * tls-auth/tls-crypt does not match. Removing tls-auth here would
4353 * break stuff, so leaving that in place. */
4355 buf_printf(&out
, ",key-method %d", KEY_METHOD_2
);
4362 buf_printf(&out
, ",tls-server");
4364 else if (TLS_SERVER
)
4366 buf_printf(&out
, ",tls-client");
4373 buf_printf(&out
, ",tls-client");
4375 else if (TLS_SERVER
)
4377 buf_printf(&out
, ",tls-server");
4389 * Compare option strings for equality.
4390 * If the first two chars of the strings differ, it means that
4391 * we are looking at different versions of the options string,
4392 * therefore don't compare them and return true.
4396 options_cmp_equal(char *actual
, const char *expected
)
4398 return options_cmp_equal_safe(actual
, expected
, strlen(actual
) + 1);
4402 options_warning(char *actual
, const char *expected
)
4404 options_warning_safe(actual
, expected
, strlen(actual
) + 1);
4408 options_warning_extract_parm1(const char *option_string
,
4409 struct gc_arena
*gc_ret
)
4411 struct gc_arena gc
= gc_new();
4412 struct buffer b
= string_alloc_buf(option_string
, &gc
);
4413 char *p
= gc_malloc(OPTION_PARM_SIZE
, false, &gc
);
4416 buf_parse(&b
, ' ', p
, OPTION_PARM_SIZE
);
4417 ret
= string_alloc(p
, gc_ret
);
4423 options_warning_safe_scan2(const int msglevel
,
4425 const bool report_inconsistent
,
4427 const struct buffer
*b2_src
,
4428 const char *b1_name
,
4429 const char *b2_name
)
4431 /* We will stop sending 'key-method', 'keydir', 'proto' and 'tls-auth' in
4432 * OCC in a future version (because it's not useful). To reduce questions
4433 * when interoperating, we no longer printing a warning about it.
4435 if (strprefix(p1
, "key-method ")
4436 || strprefix(p1
, "keydir ")
4437 || strprefix(p1
, "proto ")
4438 || streq(p1
, "tls-auth")
4439 || strprefix(p1
, "tun-ipv6")
4440 || strprefix(p1
, "cipher "))
4447 struct gc_arena gc
= gc_new();
4448 struct buffer b2
= *b2_src
;
4449 const char *p1_prefix
= options_warning_extract_parm1(p1
, &gc
);
4450 char *p2
= gc_malloc(OPTION_PARM_SIZE
, false, &gc
);
4452 while (buf_parse(&b2
, delim
, p2
, OPTION_PARM_SIZE
))
4456 const char *p2_prefix
= options_warning_extract_parm1(p2
, &gc
);
4458 if (!strcmp(p1
, p2
))
4462 if (!strcmp(p1_prefix
, p2_prefix
))
4464 if (report_inconsistent
)
4466 msg(msglevel
, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
4467 safe_print(p1_prefix
, &gc
),
4469 safe_print(p1
, &gc
),
4471 safe_print(p2
, &gc
));
4478 msg(msglevel
, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
4479 safe_print(p1_prefix
, &gc
),
4483 safe_print(p1
, &gc
));
4491 options_warning_safe_scan1(const int msglevel
,
4493 const bool report_inconsistent
,
4494 const struct buffer
*b1_src
,
4495 const struct buffer
*b2_src
,
4496 const char *b1_name
,
4497 const char *b2_name
)
4499 struct gc_arena gc
= gc_new();
4500 struct buffer b
= *b1_src
;
4501 char *p
= gc_malloc(OPTION_PARM_SIZE
, true, &gc
);
4503 while (buf_parse(&b
, delim
, p
, OPTION_PARM_SIZE
))
4505 options_warning_safe_scan2(msglevel
, delim
, report_inconsistent
, p
, b2_src
, b1_name
, b2_name
);
4512 options_warning_safe_ml(const int msglevel
, char *actual
, const char *expected
, size_t actual_n
)
4514 struct gc_arena gc
= gc_new();
4518 struct buffer local
= alloc_buf_gc(OPTION_PARM_SIZE
+ 16, &gc
);
4519 struct buffer remote
= alloc_buf_gc(OPTION_PARM_SIZE
+ 16, &gc
);
4520 actual
[actual_n
- 1] = 0;
4522 buf_printf(&local
, "version %s", expected
);
4523 buf_printf(&remote
, "version %s", actual
);
4525 options_warning_safe_scan1(msglevel
, ',', true,
4529 options_warning_safe_scan1(msglevel
, ',', false,
4538 options_cmp_equal_safe(char *actual
, const char *expected
, size_t actual_n
)
4540 struct gc_arena gc
= gc_new();
4545 actual
[actual_n
- 1] = 0;
4546 #ifndef ENABLE_STRICT_OPTIONS_CHECK
4547 if (strncmp(actual
, expected
, 2))
4549 msg(D_SHOW_OCC
, "NOTE: Options consistency check may be skewed by version differences");
4550 options_warning_safe_ml(D_SHOW_OCC
, actual
, expected
, actual_n
);
4554 ret
= !strcmp(actual
, expected
);
4561 options_warning_safe(char *actual
, const char *expected
, size_t actual_n
)
4563 options_warning_safe_ml(M_WARN
, actual
, expected
, actual_n
);
4567 options_string_version(const char *s
, struct gc_arena
*gc
)
4569 struct buffer out
= alloc_buf_gc(4, gc
);
4570 strncpynt((char *) BPTR(&out
), s
, 3);
4575 options_string_extract_option(const char *options_string
, const char *opt_name
,
4576 struct gc_arena
*gc
)
4579 const size_t opt_name_len
= strlen(opt_name
);
4581 const char *p
= options_string
;
4584 if (0 == strncmp(p
, opt_name
, opt_name_len
)
4585 && strlen(p
) > (opt_name_len
+1) && p
[opt_name_len
] == ' ')
4587 /* option found, extract value */
4588 const char *start
= &p
[opt_name_len
+1];
4589 const char *end
= strchr(p
, ',');
4590 size_t val_len
= end
? end
- start
: strlen(start
);
4591 ret
= gc_malloc(val_len
+1, true, gc
);
4592 memcpy(ret
, start
, val_len
);
4598 p
++; /* skip delimiter */
4606 * Parses --windows-driver config option
4608 * @param str value of --windows-driver option
4609 * @param msglevel msglevel to report parsing error
4610 * @return enum windows_driver_type driver type, WINDOWS_DRIVER_UNSPECIFIED on unknown --windows-driver value
4612 static enum windows_driver_type
4613 parse_windows_driver(const char *str
, const int msglevel
)
4615 if (streq(str
, "tap-windows6"))
4617 return WINDOWS_DRIVER_TAP_WINDOWS6
;
4619 else if (streq(str
, "wintun"))
4621 return WINDOWS_DRIVER_WINTUN
;
4624 else if (streq(str
, "ovpn-dco"))
4626 return WINDOWS_DRIVER_DCO
;
4630 msg(msglevel
, "--windows-driver must be tap-windows6, wintun "
4632 return WINDOWS_DRIVER_UNSPECIFIED
;
4635 #endif /* ifdef _WIN32 */
4638 * parse/print topology coding
4642 parse_topology(const char *str
, const int msglevel
)
4644 if (streq(str
, "net30"))
4648 else if (streq(str
, "p2p"))
4652 else if (streq(str
, "subnet"))
4658 msg(msglevel
, "--topology must be net30, p2p, or subnet");
4664 print_topology(const int topology
)
4686 * Manage auth-retry variable
4689 static int global_auth_retry
; /* GLOBAL */
4692 auth_retry_get(void)
4694 return global_auth_retry
;
4698 auth_retry_set(const int msglevel
, const char *option
)
4700 if (streq(option
, "interact"))
4702 global_auth_retry
= AR_INTERACT
;
4704 else if (streq(option
, "nointeract"))
4706 global_auth_retry
= AR_NOINTERACT
;
4708 else if (streq(option
, "none"))
4710 global_auth_retry
= AR_NONE
;
4714 msg(msglevel
, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
4721 auth_retry_print(void)
4723 switch (global_auth_retry
)
4729 return "nointeract";
4740 * Print the help message.
4745 FILE *fp
= msg_fp(0);
4749 fprintf(fp
, "Usage message not available\n");
4754 init_options(&o
, true);
4756 fprintf(fp
, usage_message
,
4758 o
.ce
.connect_retry_seconds
,
4759 o
.ce
.connect_retry_seconds_max
,
4760 o
.ce
.local_port
, o
.ce
.remote_port
,
4761 TUN_MTU_DEFAULT
, TAP_MTU_EXTRA_DEFAULT
,
4763 o
.authname
, o
.ciphername
,
4764 o
.replay_window
, o
.replay_time
,
4765 o
.tls_timeout
, o
.renegotiate_seconds
,
4766 o
.handshake_window
, o
.transition_window
);
4769 #endif /* ENABLE_SMALL */
4771 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
4777 msg(M_WARN
|M_NOPREFIX
, "Use --help for more information.");
4778 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
4783 show_windows_version(const unsigned int flags
)
4785 struct gc_arena gc
= gc_new();
4786 msg(flags
, "Windows version %s", win32_version_string(&gc
, true));
4792 show_library_versions(const unsigned int flags
)
4795 #define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
4797 #define LZO_LIB_VER_STR "", ""
4800 msg(flags
, "library versions: %s%s%s", get_ssl_library_version(),
4803 #undef LZO_LIB_VER_STR
4809 msg(M_INFO
|M_NOPREFIX
, "%s", title_string
);
4810 show_library_versions( M_INFO
|M_NOPREFIX
);
4812 show_windows_version( M_INFO
|M_NOPREFIX
);
4814 msg(M_INFO
|M_NOPREFIX
, "Originally developed by James Yonan");
4815 msg(M_INFO
|M_NOPREFIX
, "Copyright (C) 2002-2022 OpenVPN Inc <sales@openvpn.net>");
4816 #ifndef ENABLE_SMALL
4817 #ifdef CONFIGURE_DEFINES
4818 msg(M_INFO
|M_NOPREFIX
, "Compile time defines: %s", CONFIGURE_DEFINES
);
4820 #ifdef CONFIGURE_SPECIAL_BUILD
4821 msg(M_INFO
|M_NOPREFIX
, "special build: %s", CONFIGURE_SPECIAL_BUILD
);
4824 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
);
4828 notnull(const char *arg
, const char *description
)
4832 msg(M_USAGE
, "You must define %s", description
);
4837 string_defined_equal(const char *s1
, const char *s2
)
4841 return !strcmp(s1
, s2
);
4851 ping_rec_err(int msglevel
)
4853 msg(msglevel
, "only one of --ping-exit or --ping-restart options may be specified");
4858 positive_atoi(const char *str
)
4860 const int i
= atoi(str
);
4861 return i
< 0 ? 0 : i
;
4864 #ifdef _WIN32 /* This function is only used when compiling on Windows */
4866 atou(const char *str
)
4868 unsigned int val
= 0;
4869 sscanf(str
, "%u", &val
);
4875 space(unsigned char c
)
4877 return c
== '\0' || isspace(c
);
4881 parse_line(const char *line
,
4887 struct gc_arena
*gc
)
4889 const int STATE_INITIAL
= 0;
4890 const int STATE_READING_QUOTED_PARM
= 1;
4891 const int STATE_READING_UNQUOTED_PARM
= 2;
4892 const int STATE_DONE
= 3;
4893 const int STATE_READING_SQUOTED_PARM
= 4;
4895 const char *error_prefix
= "";
4898 const char *c
= line
;
4899 int state
= STATE_INITIAL
;
4900 bool backslash
= false;
4903 char parm
[OPTION_PARM_SIZE
];
4904 unsigned int parm_len
= 0;
4906 msglevel
&= ~M_OPTERR
;
4908 if (msglevel
& M_MSG_VIRT_OUT
)
4910 error_prefix
= "ERROR: ";
4918 if (!backslash
&& in
== '\\' && state
!= STATE_READING_SQUOTED_PARM
)
4924 if (state
== STATE_INITIAL
)
4928 if (in
== ';' || in
== '#') /* comment */
4932 if (!backslash
&& in
== '\"')
4934 state
= STATE_READING_QUOTED_PARM
;
4936 else if (!backslash
&& in
== '\'')
4938 state
= STATE_READING_SQUOTED_PARM
;
4943 state
= STATE_READING_UNQUOTED_PARM
;
4947 else if (state
== STATE_READING_UNQUOTED_PARM
)
4949 if (!backslash
&& space(in
))
4958 else if (state
== STATE_READING_QUOTED_PARM
)
4960 if (!backslash
&& in
== '\"')
4969 else if (state
== STATE_READING_SQUOTED_PARM
)
4980 if (state
== STATE_DONE
)
4982 /* ASSERT (parm_len > 0); */
4983 p
[ret
] = gc_malloc(parm_len
+ 1, true, gc
);
4984 memcpy(p
[ret
], parm
, parm_len
);
4985 p
[ret
][parm_len
] = '\0';
4986 state
= STATE_INITIAL
;
4991 if (backslash
&& out
)
4993 if (!(out
== '\\' || out
== '\"' || space(out
)))
4996 msg(msglevel
, "%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix
, file
, line_num
);
4998 msg(msglevel
, "%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE
"\\\\static.key\"", error_prefix
, file
, line_num
);
5006 /* store parameter character */
5009 if (parm_len
>= SIZE(parm
))
5011 parm
[SIZE(parm
) - 1] = 0;
5012 msg(msglevel
, "%sOptions error: Parameter at %s:%d is too long (%d chars max): %s",
5013 error_prefix
, file
, line_num
, (int) SIZE(parm
), parm
);
5016 parm
[parm_len
++] = out
;
5019 /* avoid overflow if too many parms in one config file line */
5025 } while (*c
++ != '\0');
5027 if (state
== STATE_READING_QUOTED_PARM
)
5029 msg(msglevel
, "%sOptions error: No closing quotation (\") in %s:%d", error_prefix
, file
, line_num
);
5032 if (state
== STATE_READING_SQUOTED_PARM
)
5034 msg(msglevel
, "%sOptions error: No closing single quotation (\') in %s:%d", error_prefix
, file
, line_num
);
5037 if (state
!= STATE_INITIAL
)
5039 msg(msglevel
, "%sOptions error: Residual parse state (%d) in %s:%d", error_prefix
, state
, file
, line_num
);
5045 for (i
= 0; i
< ret
; ++i
)
5047 msg(M_INFO
|M_NOPREFIX
, "%s:%d ARG[%d] '%s'", file
, line_num
, i
, p
[i
]);
5055 bypass_doubledash(char **p
)
5057 if (strlen(*p
) >= 3 && !strncmp(*p
, "--", 2))
5064 #define IS_TYPE_FP 1
5065 #define IS_TYPE_BUF 2
5069 struct buffer
*multiline
;
5074 in_src_get(const struct in_src
*is
, char *line
, const int size
)
5076 if (is
->type
== IS_TYPE_FP
)
5078 return BOOL_CAST(fgets(line
, size
, is
->u
.fp
));
5080 else if (is
->type
== IS_TYPE_BUF
)
5082 bool status
= buf_parse(is
->u
.multiline
, '\n', line
, size
);
5083 if ((int) strlen(line
) + 1 < size
)
5097 read_inline_file(struct in_src
*is
, const char *close_tag
,
5098 int *num_lines
, struct gc_arena
*gc
)
5100 char line
[OPTION_LINE_SIZE
];
5101 struct buffer buf
= alloc_buf(8*OPTION_LINE_SIZE
);
5103 bool endtagfound
= false;
5105 while (in_src_get(is
, line
, sizeof(line
)))
5108 char *line_ptr
= line
;
5109 /* Remove leading spaces */
5110 while (isspace(*line_ptr
))
5114 if (!strncmp(line_ptr
, close_tag
, strlen(close_tag
)))
5119 if (!buf_safe(&buf
, strlen(line
)+1))
5121 /* Increase buffer size */
5122 struct buffer buf2
= alloc_buf(buf
.capacity
* 2);
5123 ASSERT(buf_copy(&buf2
, &buf
));
5128 buf_printf(&buf
, "%s", line
);
5132 msg(M_FATAL
, "ERROR: Endtag %s missing", close_tag
);
5134 ret
= string_alloc(BSTR(&buf
), gc
);
5137 secure_memzero(line
, sizeof(line
));
5142 check_inline_file(struct in_src
*is
, char *p
[], struct gc_arena
*gc
)
5144 int num_inline_lines
= 0;
5149 if (arg
[0] == '<' && arg
[strlen(arg
)-1] == '>')
5151 struct buffer close_tag
;
5153 arg
[strlen(arg
) - 1] = '\0';
5154 p
[0] = string_alloc(arg
+ 1, gc
);
5155 close_tag
= alloc_buf(strlen(p
[0]) + 4);
5156 buf_printf(&close_tag
, "</%s>", p
[0]);
5157 p
[1] = read_inline_file(is
, BSTR(&close_tag
), &num_inline_lines
, gc
);
5159 free_buf(&close_tag
);
5162 return num_inline_lines
;
5166 check_inline_file_via_fp(FILE *fp
, char *p
[], struct gc_arena
*gc
)
5169 is
.type
= IS_TYPE_FP
;
5171 return check_inline_file(&is
, p
, gc
);
5175 check_inline_file_via_buf(struct buffer
*multiline
, char *p
[],
5176 struct gc_arena
*gc
)
5179 is
.type
= IS_TYPE_BUF
;
5180 is
.u
.multiline
= multiline
;
5181 return check_inline_file(&is
, p
, gc
);
5185 add_option(struct options
*options
,
5192 const unsigned int permission_mask
,
5193 unsigned int *option_types_found
,
5194 struct env_set
*es
);
5197 read_config_file(struct options
*options
,
5200 const char *top_file
,
5203 const unsigned int permission_mask
,
5204 unsigned int *option_types_found
,
5207 const int max_recursive_levels
= 10;
5210 char line
[OPTION_LINE_SIZE
+1];
5211 char *p
[MAX_PARMS
+1];
5214 if (level
<= max_recursive_levels
)
5216 if (streq(file
, "stdin"))
5222 fp
= platform_fopen(file
, "r");
5227 while (fgets(line
, sizeof(line
), fp
))
5232 if (strlen(line
) == OPTION_LINE_SIZE
)
5234 msg(msglevel
, "In %s:%d: Maximum option line length (%d) exceeded, line starts with %s",
5235 file
, line_num
, OPTION_LINE_SIZE
, line
);
5238 /* Ignore UTF-8 BOM at start of stream */
5239 if (line_num
== 1 && strncmp(line
, "\xEF\xBB\xBF", 3) == 0)
5243 if (parse_line(line
+ offset
, p
, SIZE(p
)-1, file
, line_num
, msglevel
, &options
->gc
))
5245 bypass_doubledash(&p
[0]);
5246 int lines_inline
= check_inline_file_via_fp(fp
, p
, &options
->gc
);
5247 add_option(options
, p
, lines_inline
, file
, line_num
, level
,
5248 msglevel
, permission_mask
, option_types_found
,
5250 line_num
+= lines_inline
;
5260 msg(msglevel
, "In %s:%d: Error opening configuration file: %s", top_file
, top_line
, file
);
5265 msg(msglevel
, "In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file
, top_line
, file
);
5267 secure_memzero(line
, sizeof(line
));
5272 read_config_string(const char *prefix
,
5273 struct options
*options
,
5276 const unsigned int permission_mask
,
5277 unsigned int *option_types_found
,
5280 char line
[OPTION_LINE_SIZE
];
5281 struct buffer multiline
;
5284 buf_set_read(&multiline
, (uint8_t *)config
, strlen(config
));
5286 while (buf_parse(&multiline
, '\n', line
, sizeof(line
)))
5288 char *p
[MAX_PARMS
+1];
5291 if (parse_line(line
, p
, SIZE(p
)-1, prefix
, line_num
, msglevel
, &options
->gc
))
5293 bypass_doubledash(&p
[0]);
5294 int lines_inline
= check_inline_file_via_buf(&multiline
, p
, &options
->gc
);
5295 add_option(options
, p
, lines_inline
, prefix
, line_num
, 0, msglevel
,
5296 permission_mask
, option_types_found
, es
);
5297 line_num
+= lines_inline
;
5301 secure_memzero(line
, sizeof(line
));
5305 parse_argv(struct options
*options
,
5309 const unsigned int permission_mask
,
5310 unsigned int *option_types_found
,
5321 /* config filename specified only? */
5322 if (argc
== 2 && strncmp(argv
[1], "--", 2))
5328 add_option(options
, p
, false, NULL
, 0, 0, msglevel
, permission_mask
,
5329 option_types_found
, es
);
5333 /* parse command line */
5334 for (i
= 1; i
< argc
; ++i
)
5339 if (strncmp(p
[0], "--", 2))
5341 msg(msglevel
, "I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p
[0]);
5348 for (j
= 1; j
< MAX_PARMS
; ++j
)
5352 char *arg
= argv
[i
+ j
];
5353 if (strncmp(arg
, "--", 2))
5363 add_option(options
, p
, false, NULL
, 0, 0, msglevel
, permission_mask
,
5364 option_types_found
, es
);
5371 * Filter an option line by all pull filters.
5373 * If a match is found, the line is modified depending on
5374 * the filter type, and returns true. If the filter type is
5375 * reject, SIGUSR1 is triggered and the return value is false.
5376 * In that case the caller must end the push processing.
5379 apply_pull_filter(const struct options
*o
, char *line
)
5381 struct pull_filter
*f
;
5383 if (!o
->pull_filter_list
)
5388 for (f
= o
->pull_filter_list
->head
; f
; f
= f
->next
)
5390 if (f
->type
== PUF_TYPE_ACCEPT
&& strncmp(line
, f
->pattern
, f
->size
) == 0)
5392 msg(D_LOW
, "Pushed option accepted by filter: '%s'", line
);
5395 else if (f
->type
== PUF_TYPE_IGNORE
&& strncmp(line
, f
->pattern
, f
->size
) == 0)
5397 msg(D_PUSH
, "Pushed option removed by filter: '%s'", line
);
5401 else if (f
->type
== PUF_TYPE_REJECT
&& strncmp(line
, f
->pattern
, f
->size
) == 0)
5403 msg(M_WARN
, "Pushed option rejected by filter: '%s'. Restarting.", line
);
5405 throw_signal_soft(SIGUSR1
, "Offending option received from server");
5413 apply_push_options(struct options
*options
,
5415 unsigned int permission_mask
,
5416 unsigned int *option_types_found
,
5419 char line
[OPTION_PARM_SIZE
];
5421 const char *file
= "[PUSH-OPTIONS]";
5422 const int msglevel
= D_PUSH_ERRORS
|M_OPTERR
;
5424 while (buf_parse(buf
, ',', line
, sizeof(line
)))
5426 char *p
[MAX_PARMS
+1];
5429 if (!apply_pull_filter(options
, line
))
5431 return false; /* Cause push/pull error and stop push processing */
5433 if (parse_line(line
, p
, SIZE(p
)-1, file
, line_num
, msglevel
, &options
->gc
))
5435 add_option(options
, p
, false, file
, line_num
, 0, msglevel
,
5436 permission_mask
, option_types_found
, es
);
5443 options_server_import(struct options
*o
,
5444 const char *filename
,
5446 unsigned int permission_mask
,
5447 unsigned int *option_types_found
,
5450 msg(D_PUSH
, "OPTIONS IMPORT: reading client specific options from: %s", filename
);
5463 options_string_import(struct options
*options
,
5466 const unsigned int permission_mask
,
5467 unsigned int *option_types_found
,
5470 read_config_string("[CONFIG-STRING]", options
, config
, msglevel
, permission_mask
, option_types_found
, es
);
5473 #define VERIFY_PERMISSION(mask) { \
5474 if (!verify_permission(p[0], file, line, (mask), permission_mask, \
5475 option_types_found, msglevel, options, is_inline)) \
5482 verify_permission(const char *name
,
5485 const unsigned int type
,
5486 const unsigned int allowed
,
5487 unsigned int *found
,
5489 struct options
*options
,
5492 if (!(type
& allowed
))
5494 msg(msglevel
, "option '%s' cannot be used in this context (%s)", name
, file
);
5498 if (is_inline
&& !(type
& OPT_P_INLINE
))
5500 msg(msglevel
, "option '%s' is not expected to be inline (%s:%d)", name
,
5510 #ifndef ENABLE_SMALL
5511 /* Check if this options is allowed in connection block,
5512 * but we are currently not in a connection block
5513 * unless this is a pushed option.
5514 * Parsing a connection block uses a temporary options struct without
5518 if ((type
& OPT_P_CONNECTION
) && options
->connection_list
5519 && !(allowed
& OPT_P_PULL_MODE
))
5523 msg(M_WARN
, "Option '%s' in %s:%d is ignored by previous <connection> blocks ", name
, file
, line
);
5527 msg(M_WARN
, "Option '%s' is ignored by previous <connection> blocks", name
);
5535 * Check that an option doesn't have too
5539 #define NM_QUOTE_HINT (1<<0)
5542 no_more_than_n_args(const int msglevel
,
5545 const unsigned int flags
)
5547 const int len
= string_array_len((const char **)p
);
5556 msg(msglevel
, "the --%s directive should have at most %d parameter%s.%s",
5559 max
>= 3 ? "s" : "",
5560 (flags
& NM_QUOTE_HINT
) ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")." : "");
5570 msglevel_forward_compatible(struct options
*options
, const int msglevel
)
5572 return options
->forward_compatible
? M_WARN
: msglevel
;
5576 set_user_script(struct options
*options
,
5577 const char **script
,
5578 const char *new_script
,
5584 msg(M_WARN
, "Multiple --%s scripts defined. "
5585 "The previously configured script is overridden.", type
);
5587 *script
= new_script
;
5588 options
->user_script_used
= true;
5590 #ifndef ENABLE_SMALL
5592 char script_name
[100];
5593 openvpn_snprintf(script_name
, sizeof(script_name
),
5594 "--%s script", type
);
5596 if (check_cmd_access(*script
, script_name
, (in_chroot
? options
->chroot_dir
: NULL
)))
5598 msg(M_USAGE
, "Please correct this error.");
5607 show_compression_warning(struct compress_options
*info
)
5609 if (comp_non_stub_enabled(info
))
5612 * Check if already displayed the strong warning and enabled full
5615 if (!(info
->flags
& COMP_F_ALLOW_COMPRESS
))
5617 msg(M_WARN
, "WARNING: Compression for receiving enabled. "
5618 "Compression has been used in the past to break encryption. "
5619 "Sent packets are not compressed unless \"allow-compression yes\" "
5627 key_is_external(const struct options
*options
)
5630 #ifdef ENABLE_MANAGEMENT
5631 ret
= ret
|| (options
->management_flags
& MF_EXTERNAL_KEY
);
5633 #ifdef ENABLE_PKCS11
5634 ret
= ret
|| (options
->pkcs11_providers
[0] != NULL
);
5636 #ifdef ENABLE_CRYPTOAPI
5637 ret
= ret
|| options
->cryptoapi_cert
;
5644 add_option(struct options
*options
,
5651 const unsigned int permission_mask
,
5652 unsigned int *option_types_found
,
5655 struct gc_arena gc
= gc_new();
5656 const bool pull_mode
= BOOL_CAST(permission_mask
& OPT_P_PULL_MODE
);
5657 int msglevel_fc
= msglevel_forward_compatible(options
, msglevel
);
5659 ASSERT(MAX_PARMS
>= 7);
5662 * If directive begins with "setenv opt" prefix, don't raise an error if
5663 * directive is unrecognized.
5665 if (streq(p
[0], "setenv") && p
[1] && streq(p
[1], "opt") && !(permission_mask
& OPT_P_PULL_MODE
))
5669 p
[2] = "setenv opt"; /* will trigger an error that includes setenv opt */
5672 msglevel_fc
= M_WARN
;
5677 file
= "[CMD-LINE]";
5680 if (streq(p
[0], "help"))
5682 VERIFY_PERMISSION(OPT_P_GENERAL
);
5686 msg(msglevel
, "--help does not accept any parameters");
5690 if (streq(p
[0], "version") && !p
[1])
5692 VERIFY_PERMISSION(OPT_P_GENERAL
);
5695 else if (streq(p
[0], "config") && p
[1] && !p
[2])
5697 VERIFY_PERMISSION(OPT_P_CONFIG
);
5699 /* save first config file only in options */
5700 if (!options
->config
)
5702 options
->config
= p
[1];
5705 read_config_file(options
, p
[1], level
, file
, line
, msglevel
, permission_mask
, option_types_found
, es
);
5707 #if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
5708 else if (streq(p
[0], "show-gateway") && !p
[2])
5710 struct route_gateway_info rgi
;
5711 struct route_ipv6_gateway_info rgi6
;
5712 struct in6_addr remote
= IN6ADDR_ANY_INIT
;
5713 openvpn_net_ctx_t net_ctx
;
5714 VERIFY_PERMISSION(OPT_P_GENERAL
);
5717 get_ipv6_addr(p
[1], &remote
, NULL
, M_WARN
);
5719 net_ctx_init(NULL
, &net_ctx
);
5720 get_default_gateway(&rgi
, &net_ctx
);
5721 get_default_gateway_ipv6(&rgi6
, &remote
, &net_ctx
);
5722 print_default_gateway(M_INFO
, &rgi
, &rgi6
);
5723 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
5726 else if (streq(p
[0], "echo") || streq(p
[0], "parameter"))
5728 struct buffer string
= alloc_buf_gc(OPTION_PARM_SIZE
, &gc
);
5732 VERIFY_PERMISSION(OPT_P_ECHO
);
5734 for (j
= 1; j
< MAX_PARMS
; ++j
)
5742 good
&= buf_printf(&string
, " ");
5744 good
&= buf_printf(&string
, "%s", p
[j
]);
5748 /* only message-related ECHO are logged, since other ECHOs
5749 * can potentially include security-sensitive strings */
5750 if (p
[1] && strncmp(p
[1], "msg", 3) == 0)
5752 msg(M_INFO
, "%s:%s",
5753 pull_mode
? "ECHO-PULL" : "ECHO",
5756 #ifdef ENABLE_MANAGEMENT
5759 management_echo(management
, BSTR(&string
), pull_mode
);
5765 msg(M_WARN
, "echo/parameter option overflow");
5768 #ifdef ENABLE_MANAGEMENT
5769 else if (streq(p
[0], "management") && p
[1] && p
[2] && !p
[4])
5771 VERIFY_PERMISSION(OPT_P_GENERAL
);
5772 if (streq(p
[2], "unix"))
5774 #if UNIX_SOCK_SUPPORT
5775 options
->management_flags
|= MF_UNIX_SOCK
;
5777 msg(msglevel
, "MANAGEMENT: this platform does not support unix domain sockets");
5782 options
->management_addr
= p
[1];
5783 options
->management_port
= p
[2];
5786 options
->management_user_pass
= p
[3];
5789 else if (streq(p
[0], "management-client-user") && p
[1] && !p
[2])
5791 VERIFY_PERMISSION(OPT_P_GENERAL
);
5792 options
->management_client_user
= p
[1];
5794 else if (streq(p
[0], "management-client-group") && p
[1] && !p
[2])
5796 VERIFY_PERMISSION(OPT_P_GENERAL
);
5797 options
->management_client_group
= p
[1];
5799 else if (streq(p
[0], "management-query-passwords") && !p
[1])
5801 VERIFY_PERMISSION(OPT_P_GENERAL
);
5802 options
->management_flags
|= MF_QUERY_PASSWORDS
;
5804 else if (streq(p
[0], "management-query-remote") && !p
[1])
5806 VERIFY_PERMISSION(OPT_P_GENERAL
);
5807 options
->management_flags
|= MF_QUERY_REMOTE
;
5809 else if (streq(p
[0], "management-query-proxy") && !p
[1])
5811 VERIFY_PERMISSION(OPT_P_GENERAL
);
5812 options
->management_flags
|= MF_QUERY_PROXY
;
5814 else if (streq(p
[0], "management-hold") && !p
[1])
5816 VERIFY_PERMISSION(OPT_P_GENERAL
);
5817 options
->management_flags
|= MF_HOLD
;
5819 else if (streq(p
[0], "management-signal") && !p
[1])
5821 VERIFY_PERMISSION(OPT_P_GENERAL
);
5822 options
->management_flags
|= MF_SIGNAL
;
5824 else if (streq(p
[0], "management-forget-disconnect") && !p
[1])
5826 VERIFY_PERMISSION(OPT_P_GENERAL
);
5827 options
->management_flags
|= MF_FORGET_DISCONNECT
;
5829 else if (streq(p
[0], "management-up-down") && !p
[1])
5831 VERIFY_PERMISSION(OPT_P_GENERAL
);
5832 options
->management_flags
|= MF_UP_DOWN
;
5834 else if (streq(p
[0], "management-client") && !p
[1])
5836 VERIFY_PERMISSION(OPT_P_GENERAL
);
5837 options
->management_flags
|= MF_CONNECT_AS_CLIENT
;
5839 #ifdef ENABLE_MANAGEMENT
5840 else if (streq(p
[0], "management-external-key"))
5842 VERIFY_PERMISSION(OPT_P_GENERAL
);
5843 for (int j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
5845 if (streq(p
[j
], "nopadding"))
5847 options
->management_flags
|= MF_EXTERNAL_KEY_NOPADDING
;
5849 else if (streq(p
[j
], "pkcs1"))
5851 options
->management_flags
|= MF_EXTERNAL_KEY_PKCS1PAD
;
5853 else if (streq(p
[j
], "pss"))
5855 options
->management_flags
|= MF_EXTERNAL_KEY_PSSPAD
;
5857 else if (streq(p
[j
], "digest"))
5859 options
->management_flags
|= MF_EXTERNAL_KEY_DIGEST
;
5863 msg(msglevel
, "Unknown management-external-key flag: %s", p
[j
]);
5867 * When no option is present, assume that only PKCS1
5868 * padding is supported
5870 if (!(options
->management_flags
5871 &(MF_EXTERNAL_KEY_NOPADDING
| MF_EXTERNAL_KEY_PKCS1PAD
)))
5873 options
->management_flags
|= MF_EXTERNAL_KEY_PKCS1PAD
;
5875 options
->management_flags
|= MF_EXTERNAL_KEY
;
5877 else if (streq(p
[0], "management-external-cert") && p
[1] && !p
[2])
5879 VERIFY_PERMISSION(OPT_P_GENERAL
);
5880 options
->management_flags
|= MF_EXTERNAL_CERT
;
5881 options
->management_certificate
= p
[1];
5883 else if (streq(p
[0], "management-client-auth") && !p
[1])
5885 VERIFY_PERMISSION(OPT_P_GENERAL
);
5886 options
->management_flags
|= MF_CLIENT_AUTH
;
5888 #endif /* ifdef ENABLE_MANAGEMENT */
5889 else if (streq(p
[0], "management-log-cache") && p
[1] && !p
[2])
5893 VERIFY_PERMISSION(OPT_P_GENERAL
);
5897 msg(msglevel
, "--management-log-cache parameter is out of range");
5900 options
->management_log_history_cache
= cache
;
5902 #endif /* ifdef ENABLE_MANAGEMENT */
5903 #ifdef ENABLE_PLUGIN
5904 else if (streq(p
[0], "plugin") && p
[1])
5906 VERIFY_PERMISSION(OPT_P_PLUGIN
);
5907 if (!options
->plugin_list
)
5909 options
->plugin_list
= plugin_option_list_new(&options
->gc
);
5911 if (!plugin_option_list_add(options
->plugin_list
, &p
[1], &options
->gc
))
5913 msg(msglevel
, "plugin add failed: %s", p
[1]);
5918 else if (streq(p
[0], "mode") && p
[1] && !p
[2])
5920 VERIFY_PERMISSION(OPT_P_GENERAL
);
5921 if (streq(p
[1], "p2p"))
5923 options
->mode
= MODE_POINT_TO_POINT
;
5925 else if (streq(p
[1], "server"))
5927 options
->mode
= MODE_SERVER
;
5931 msg(msglevel
, "Bad --mode parameter: %s", p
[1]);
5935 else if (streq(p
[0], "dev") && p
[1] && !p
[2])
5937 VERIFY_PERMISSION(OPT_P_GENERAL
);
5938 options
->dev
= p
[1];
5940 else if (streq(p
[0], "dev-type") && p
[1] && !p
[2])
5942 VERIFY_PERMISSION(OPT_P_GENERAL
);
5943 options
->dev_type
= p
[1];
5946 else if (streq(p
[0], "windows-driver") && p
[1] && !p
[2])
5948 VERIFY_PERMISSION(OPT_P_GENERAL
);
5949 options
->windows_driver
= parse_windows_driver(p
[1], M_FATAL
);
5952 else if (streq(p
[0], "disable-dco"))
5954 options
->tuntap_options
.disable_dco
= true;
5956 else if (streq(p
[0], "dev-node") && p
[1] && !p
[2])
5958 VERIFY_PERMISSION(OPT_P_GENERAL
);
5959 options
->dev_node
= p
[1];
5961 else if (streq(p
[0], "lladdr") && p
[1] && !p
[2])
5963 VERIFY_PERMISSION(OPT_P_UP
);
5964 if (mac_addr_safe(p
[1])) /* MAC address only */
5966 options
->lladdr
= p
[1];
5970 msg(msglevel
, "lladdr parm '%s' must be a MAC address", p
[1]);
5974 else if (streq(p
[0], "topology") && p
[1] && !p
[2])
5976 VERIFY_PERMISSION(OPT_P_UP
);
5977 options
->topology
= parse_topology(p
[1], msglevel
);
5979 else if (streq(p
[0], "tun-ipv6") && !p
[1])
5983 msg(M_WARN
, "Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.");
5986 #ifdef ENABLE_IPROUTE
5987 else if (streq(p
[0], "iproute") && p
[1] && !p
[2])
5989 VERIFY_PERMISSION(OPT_P_GENERAL
);
5990 iproute_path
= p
[1];
5993 else if (streq(p
[0], "ifconfig") && p
[1] && p
[2] && !p
[3])
5995 VERIFY_PERMISSION(OPT_P_UP
);
5996 if (ip_or_dns_addr_safe(p
[1], options
->allow_pull_fqdn
) && ip_or_dns_addr_safe(p
[2], options
->allow_pull_fqdn
)) /* FQDN -- may be DNS name */
5998 options
->ifconfig_local
= p
[1];
5999 options
->ifconfig_remote_netmask
= p
[2];
6003 msg(msglevel
, "ifconfig parms '%s' and '%s' must be valid addresses", p
[1], p
[2]);
6007 else if (streq(p
[0], "ifconfig-ipv6") && p
[1] && p
[2] && !p
[3])
6009 unsigned int netbits
;
6011 VERIFY_PERMISSION(OPT_P_UP
);
6012 if (get_ipv6_addr( p
[1], NULL
, &netbits
, msglevel
)
6013 && ipv6_addr_safe( p
[2] ) )
6015 if (netbits
< 64 || netbits
> 124)
6017 msg( msglevel
, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'", netbits
);
6021 options
->ifconfig_ipv6_local
= get_ipv6_addr_no_netbits(p
[1], &options
->gc
);
6022 options
->ifconfig_ipv6_netbits
= netbits
;
6023 options
->ifconfig_ipv6_remote
= p
[2];
6027 msg(msglevel
, "ifconfig-ipv6 parms '%s' and '%s' must be valid addresses", p
[1], p
[2]);
6031 else if (streq(p
[0], "ifconfig-noexec") && !p
[1])
6033 VERIFY_PERMISSION(OPT_P_UP
);
6034 options
->ifconfig_noexec
= true;
6036 else if (streq(p
[0], "ifconfig-nowarn") && !p
[1])
6038 VERIFY_PERMISSION(OPT_P_UP
);
6039 options
->ifconfig_nowarn
= true;
6041 else if (streq(p
[0], "local") && p
[1] && !p
[2])
6043 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6044 options
->ce
.local
= p
[1];
6046 else if (streq(p
[0], "remote-random") && !p
[1])
6048 VERIFY_PERMISSION(OPT_P_GENERAL
);
6049 options
->remote_random
= true;
6051 else if (streq(p
[0], "connection") && p
[1] && !p
[3])
6053 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
6057 struct connection_entry
*e
;
6059 init_options(&sub
, true);
6060 sub
.ce
= options
->ce
;
6061 read_config_string("[CONNECTION-OPTIONS]", &sub
, p
[1], msglevel
,
6062 OPT_P_CONNECTION
, option_types_found
, es
);
6065 msg(msglevel
, "Each 'connection' block must contain exactly one 'remote' directive");
6066 uninit_options(&sub
);
6070 e
= alloc_connection_entry(options
, msglevel
);
6073 uninit_options(&sub
);
6077 gc_transfer(&options
->gc
, &sub
.gc
);
6078 uninit_options(&sub
);
6081 else if (streq(p
[0], "ignore-unknown-option") && p
[1])
6086 const char **ignore
;
6088 VERIFY_PERMISSION(OPT_P_GENERAL
);
6089 /* Find out how many options to be ignored */
6090 for (i
= 1; p
[i
]; i
++)
6095 /* add number of options already ignored */
6096 for (i
= 0; options
->ignore_unknown_option
6097 && options
->ignore_unknown_option
[i
]; i
++)
6102 /* Allocate array */
6103 ALLOC_ARRAY_GC(ignore
, const char *, numignored
+1, &options
->gc
);
6104 for (i
= 0; options
->ignore_unknown_option
6105 && options
->ignore_unknown_option
[i
]; i
++)
6107 ignore
[i
] = options
->ignore_unknown_option
[i
];
6110 options
->ignore_unknown_option
= ignore
;
6112 for (j
= 1; p
[j
]; j
++)
6114 /* Allow the user to specify ignore-unknown-option --opt too */
6115 if (p
[j
][0]=='-' && p
[j
][1]=='-')
6117 options
->ignore_unknown_option
[i
] = (p
[j
]+2);
6121 options
->ignore_unknown_option
[i
] = p
[j
];
6126 options
->ignore_unknown_option
[i
] = NULL
;
6128 #if ENABLE_MANAGEMENT
6129 else if (streq(p
[0], "http-proxy-override") && p
[1] && p
[2] && !p
[4])
6131 VERIFY_PERMISSION(OPT_P_GENERAL
);
6132 options
->http_proxy_override
= parse_http_proxy_override(p
[1], p
[2], p
[3], msglevel
, &options
->gc
);
6133 if (!options
->http_proxy_override
)
6139 else if (streq(p
[0], "remote") && p
[1] && !p
[4])
6141 struct remote_entry re
;
6142 re
.remote
= re
.remote_port
= NULL
;
6146 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6150 re
.remote_port
= p
[2];
6153 const int proto
= ascii2proto(p
[3]);
6154 const sa_family_t af
= ascii2af(p
[3]);
6158 "remote: bad protocol associated with host %s: '%s'",
6166 if (permission_mask
& OPT_P_GENERAL
)
6168 struct remote_entry
*e
= alloc_remote_entry(options
, msglevel
);
6175 else if (permission_mask
& OPT_P_CONNECTION
)
6177 connection_entry_load_re(&options
->ce
, &re
);
6180 else if (streq(p
[0], "resolv-retry") && p
[1] && !p
[2])
6182 VERIFY_PERMISSION(OPT_P_GENERAL
);
6183 if (streq(p
[1], "infinite"))
6185 options
->resolve_retry_seconds
= RESOLV_RETRY_INFINITE
;
6189 options
->resolve_retry_seconds
= positive_atoi(p
[1]);
6192 else if ((streq(p
[0], "preresolve") || streq(p
[0], "ip-remote-hint")) && !p
[2])
6194 VERIFY_PERMISSION(OPT_P_GENERAL
);
6195 options
->resolve_in_advance
= true;
6196 /* Note the ip-remote-hint and the argument p[1] are for
6197 * backward compatibility */
6200 options
->ip_remote_hint
= p
[1];
6203 else if (streq(p
[0], "connect-retry") && p
[1] && !p
[3])
6205 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6206 options
->ce
.connect_retry_seconds
= positive_atoi(p
[1]);
6208 * Limit the base value of retry wait interval to 16 bits to avoid
6209 * overflow when scaled up for exponential backoff
6211 if (options
->ce
.connect_retry_seconds
> 0xFFFF)
6213 options
->ce
.connect_retry_seconds
= 0xFFFF;
6214 msg(M_WARN
, "connect retry wait interval truncated to %d",
6215 options
->ce
.connect_retry_seconds
);
6220 options
->ce
.connect_retry_seconds_max
=
6221 max_int(positive_atoi(p
[2]), options
->ce
.connect_retry_seconds
);
6224 else if ((streq(p
[0], "connect-timeout") || streq(p
[0], "server-poll-timeout"))
6227 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6228 options
->ce
.connect_timeout
= positive_atoi(p
[1]);
6230 else if (streq(p
[0], "connect-retry-max") && p
[1] && !p
[2])
6232 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6233 options
->connect_retry_max
= positive_atoi(p
[1]);
6235 else if (streq(p
[0], "ipchange") && p
[1])
6237 VERIFY_PERMISSION(OPT_P_SCRIPT
);
6238 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
6242 set_user_script(options
,
6244 string_substitute(p
[1], ',', ' ', &options
->gc
),
6247 else if (streq(p
[0], "float") && !p
[1])
6249 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6250 options
->ce
.remote_float
= true;
6253 else if (streq(p
[0], "gremlin") && p
[1] && !p
[2])
6255 VERIFY_PERMISSION(OPT_P_GENERAL
);
6256 options
->gremlin
= positive_atoi(p
[1]);
6259 else if (streq(p
[0], "chroot") && p
[1] && !p
[2])
6261 VERIFY_PERMISSION(OPT_P_GENERAL
);
6262 options
->chroot_dir
= p
[1];
6264 else if (streq(p
[0], "cd") && p
[1] && !p
[2])
6266 VERIFY_PERMISSION(OPT_P_GENERAL
);
6267 if (platform_chdir(p
[1]))
6269 msg(M_ERR
, "cd to '%s' failed", p
[1]);
6272 options
->cd_dir
= p
[1];
6274 #ifdef ENABLE_SELINUX
6275 else if (streq(p
[0], "setcon") && p
[1] && !p
[2])
6277 VERIFY_PERMISSION(OPT_P_GENERAL
);
6278 options
->selinux_context
= p
[1];
6281 else if (streq(p
[0], "writepid") && p
[1] && !p
[2])
6283 VERIFY_PERMISSION(OPT_P_GENERAL
);
6284 options
->writepid
= p
[1];
6286 else if (streq(p
[0], "up") && p
[1])
6288 VERIFY_PERMISSION(OPT_P_SCRIPT
);
6289 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
6293 set_user_script(options
, &options
->up_script
, p
[1], "up", false);
6295 else if (streq(p
[0], "down") && p
[1])
6297 VERIFY_PERMISSION(OPT_P_SCRIPT
);
6298 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
6302 set_user_script(options
, &options
->down_script
, p
[1], "down", true);
6304 else if (streq(p
[0], "down-pre") && !p
[1])
6306 VERIFY_PERMISSION(OPT_P_GENERAL
);
6307 options
->down_pre
= true;
6309 else if (streq(p
[0], "up-delay") && !p
[1])
6311 VERIFY_PERMISSION(OPT_P_GENERAL
);
6312 options
->up_delay
= true;
6314 else if (streq(p
[0], "up-restart") && !p
[1])
6316 VERIFY_PERMISSION(OPT_P_GENERAL
);
6317 options
->up_restart
= true;
6319 else if (streq(p
[0], "syslog") && !p
[2])
6321 VERIFY_PERMISSION(OPT_P_GENERAL
);
6322 open_syslog(p
[1], false);
6324 else if (streq(p
[0], "daemon") && !p
[2])
6327 VERIFY_PERMISSION(OPT_P_GENERAL
);
6328 if (!options
->daemon
)
6330 options
->daemon
= didit
= true;
6331 open_syslog(p
[1], false);
6337 msg(M_WARN
, "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)", p
[1]);
6342 else if (streq(p
[0], "log") && p
[1] && !p
[2])
6344 VERIFY_PERMISSION(OPT_P_GENERAL
);
6345 options
->log
= true;
6346 redirect_stdout_stderr(p
[1], false);
6348 else if (streq(p
[0], "suppress-timestamps") && !p
[1])
6350 VERIFY_PERMISSION(OPT_P_GENERAL
);
6351 options
->suppress_timestamps
= true;
6352 set_suppress_timestamps(true);
6354 else if (streq(p
[0], "machine-readable-output") && !p
[1])
6356 VERIFY_PERMISSION(OPT_P_GENERAL
);
6357 options
->machine_readable_output
= true;
6358 set_machine_readable_output(true);
6360 else if (streq(p
[0], "log-append") && p
[1] && !p
[2])
6362 VERIFY_PERMISSION(OPT_P_GENERAL
);
6363 options
->log
= true;
6364 redirect_stdout_stderr(p
[1], true);
6366 #ifdef ENABLE_MEMSTATS
6367 else if (streq(p
[0], "memstats") && p
[1] && !p
[2])
6369 VERIFY_PERMISSION(OPT_P_GENERAL
);
6370 options
->memstats_fn
= p
[1];
6373 else if (streq(p
[0], "mlock") && !p
[1])
6375 VERIFY_PERMISSION(OPT_P_GENERAL
);
6376 options
->mlock
= true;
6378 #if ENABLE_IP_PKTINFO
6379 else if (streq(p
[0], "multihome") && !p
[1])
6381 VERIFY_PERMISSION(OPT_P_GENERAL
);
6382 options
->sockflags
|= SF_USE_IP_PKTINFO
;
6385 else if (streq(p
[0], "verb") && p
[1] && !p
[2])
6387 VERIFY_PERMISSION(OPT_P_MESSAGES
);
6388 options
->verbosity
= positive_atoi(p
[1]);
6389 if (options
->verbosity
>= (D_TLS_DEBUG_MED
& M_DEBUG_LEVEL
))
6391 /* We pass this flag to the SSL library to avoid
6392 * mbed TLS always generating debug level logging */
6393 options
->ssl_flags
|= SSLF_TLS_DEBUG_ENABLED
;
6395 #if !defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
6396 /* Warn when a debug verbosity is supplied when built without debug support */
6397 if (options
->verbosity
>= 7)
6399 msg(M_WARN
, "NOTE: debug verbosity (--verb %d) is enabled but this build lacks debug support.",
6400 options
->verbosity
);
6404 else if (streq(p
[0], "mute") && p
[1] && !p
[2])
6406 VERIFY_PERMISSION(OPT_P_MESSAGES
);
6407 options
->mute
= positive_atoi(p
[1]);
6409 else if (streq(p
[0], "errors-to-stderr") && !p
[1])
6411 VERIFY_PERMISSION(OPT_P_MESSAGES
);
6414 else if (streq(p
[0], "status") && p
[1] && !p
[3])
6416 VERIFY_PERMISSION(OPT_P_GENERAL
);
6417 options
->status_file
= p
[1];
6420 options
->status_file_update_freq
= positive_atoi(p
[2]);
6423 else if (streq(p
[0], "status-version") && p
[1] && !p
[2])
6427 VERIFY_PERMISSION(OPT_P_GENERAL
);
6428 version
= atoi(p
[1]);
6429 if (version
< 1 || version
> 3)
6431 msg(msglevel
, "--status-version must be 1 to 3");
6434 options
->status_file_version
= version
;
6436 else if (streq(p
[0], "remap-usr1") && p
[1] && !p
[2])
6438 VERIFY_PERMISSION(OPT_P_GENERAL
);
6439 if (streq(p
[1], "SIGHUP"))
6441 options
->remap_sigusr1
= SIGHUP
;
6443 else if (streq(p
[1], "SIGTERM"))
6445 options
->remap_sigusr1
= SIGTERM
;
6449 msg(msglevel
, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
6453 else if ((streq(p
[0], "link-mtu") || streq(p
[0], "udp-mtu")) && p
[1] && !p
[2])
6455 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6456 options
->ce
.link_mtu
= positive_atoi(p
[1]);
6457 options
->ce
.link_mtu_defined
= true;
6459 else if (streq(p
[0], "tun-mtu") && p
[1] && !p
[3])
6461 VERIFY_PERMISSION(OPT_P_PUSH_MTU
|OPT_P_CONNECTION
);
6462 options
->ce
.tun_mtu
= positive_atoi(p
[1]);
6463 options
->ce
.tun_mtu_defined
= true;
6466 options
->ce
.occ_mtu
= positive_atoi(p
[2]);
6470 options
->ce
.occ_mtu
= 0;
6473 else if (streq(p
[0], "tun-mtu-max") && p
[1] && !p
[3])
6475 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6476 int max_mtu
= positive_atoi(p
[1]);
6477 if (max_mtu
< 68 || max_mtu
> 65536)
6479 msg(msglevel
, "--tun-mtu-max value '%s' is invalid", p
[1]);
6483 options
->ce
.tun_mtu_max
= max_mtu
;
6486 else if (streq(p
[0], "tun-mtu-extra") && p
[1] && !p
[2])
6488 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6489 options
->ce
.tun_mtu_extra
= positive_atoi(p
[1]);
6490 options
->ce
.tun_mtu_extra_defined
= true;
6492 else if (streq(p
[0], "max-packet-size") && p
[1] && !p
[2])
6494 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6495 int maxmtu
= positive_atoi(p
[1]);
6496 options
->ce
.tls_mtu
= constrain_int(maxmtu
, TLS_CHANNEL_MTU_MIN
, TLS_CHANNEL_BUF_SIZE
);
6498 if (maxmtu
< TLS_CHANNEL_MTU_MIN
|| maxmtu
> TLS_CHANNEL_BUF_SIZE
)
6500 msg(M_WARN
, "Note: max-packet-size value outside of allowed "
6501 "control channel packet size (%d to %d), will use %d "
6502 "instead.", TLS_CHANNEL_MTU_MIN
, TLS_CHANNEL_BUF_SIZE
,
6503 options
->ce
.tls_mtu
);
6506 /* also set mssfix maxmtu mtu */
6507 options
->ce
.mssfix
= maxmtu
;
6508 options
->ce
.mssfix_default
= false;
6509 options
->ce
.mssfix_encap
= true;
6511 #ifdef ENABLE_FRAGMENT
6512 else if (streq(p
[0], "mtu-dynamic"))
6514 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6515 msg(msglevel
, "--mtu-dynamic has been replaced by --fragment");
6518 else if (streq(p
[0], "fragment") && p
[1] && !p
[3])
6520 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6521 options
->ce
.fragment
= positive_atoi(p
[1]);
6523 if (p
[2] && streq(p
[2], "mtu"))
6525 options
->ce
.fragment_encap
= true;
6529 msg(msglevel
, "Unknown parameter to --fragment: %s", p
[2]);
6532 #endif /* ifdef ENABLE_FRAGMENT */
6533 else if (streq(p
[0], "mtu-disc") && p
[1] && !p
[2])
6535 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6536 options
->ce
.mtu_discover_type
= translate_mtu_discover_type_name(p
[1]);
6538 else if (streq(p
[0], "mtu-test") && !p
[1])
6540 VERIFY_PERMISSION(OPT_P_GENERAL
);
6541 options
->mtu_test
= true;
6543 else if (streq(p
[0], "nice") && p
[1] && !p
[2])
6545 VERIFY_PERMISSION(OPT_P_NICE
);
6546 options
->nice
= atoi(p
[1]);
6548 else if (streq(p
[0], "rcvbuf") && p
[1] && !p
[2])
6550 VERIFY_PERMISSION(OPT_P_SOCKBUF
);
6551 options
->rcvbuf
= positive_atoi(p
[1]);
6553 else if (streq(p
[0], "sndbuf") && p
[1] && !p
[2])
6555 VERIFY_PERMISSION(OPT_P_SOCKBUF
);
6556 options
->sndbuf
= positive_atoi(p
[1]);
6558 else if (streq(p
[0], "mark") && p
[1] && !p
[2])
6560 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
6561 VERIFY_PERMISSION(OPT_P_GENERAL
);
6562 options
->mark
= atoi(p
[1]);
6565 else if (streq(p
[0], "socket-flags"))
6568 VERIFY_PERMISSION(OPT_P_SOCKFLAGS
);
6569 for (j
= 1; j
< MAX_PARMS
&& p
[j
]; ++j
)
6571 if (streq(p
[j
], "TCP_NODELAY"))
6573 options
->sockflags
|= SF_TCP_NODELAY
;
6577 msg(msglevel
, "unknown socket flag: %s", p
[j
]);
6582 else if (streq(p
[0], "bind-dev") && p
[1])
6584 VERIFY_PERMISSION(OPT_P_SOCKFLAGS
);
6585 options
->bind_dev
= p
[1];
6588 else if (streq(p
[0], "txqueuelen") && p
[1] && !p
[2])
6590 VERIFY_PERMISSION(OPT_P_GENERAL
);
6592 options
->tuntap_options
.txqueuelen
= positive_atoi(p
[1]);
6594 msg(msglevel
, "--txqueuelen not supported on this OS");
6598 else if (streq(p
[0], "shaper") && p
[1] && !p
[2])
6602 VERIFY_PERMISSION(OPT_P_SHAPER
);
6603 shaper
= atoi(p
[1]);
6604 if (shaper
< SHAPER_MIN
|| shaper
> SHAPER_MAX
)
6606 msg(msglevel
, "Bad shaper value, must be between %d and %d",
6607 SHAPER_MIN
, SHAPER_MAX
);
6610 options
->shaper
= shaper
;
6612 else if (streq(p
[0], "port") && p
[1] && !p
[2])
6614 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6615 options
->ce
.local_port
= options
->ce
.remote_port
= p
[1];
6617 else if (streq(p
[0], "lport") && p
[1] && !p
[2])
6619 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6620 options
->ce
.local_port_defined
= true;
6621 options
->ce
.local_port
= p
[1];
6623 else if (streq(p
[0], "rport") && p
[1] && !p
[2])
6625 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6626 options
->ce
.remote_port
= p
[1];
6628 else if (streq(p
[0], "bind") && !p
[2])
6630 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6631 options
->ce
.bind_defined
= true;
6632 if (p
[1] && streq(p
[1], "ipv6only"))
6634 options
->ce
.bind_ipv6_only
= true;
6638 else if (streq(p
[0], "nobind") && !p
[1])
6640 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6641 options
->ce
.bind_local
= false;
6643 else if (streq(p
[0], "fast-io") && !p
[1])
6645 VERIFY_PERMISSION(OPT_P_GENERAL
);
6646 options
->fast_io
= true;
6648 else if (streq(p
[0], "inactive") && p
[1] && !p
[3])
6650 VERIFY_PERMISSION(OPT_P_TIMER
);
6651 options
->inactivity_timeout
= positive_atoi(p
[1]);
6654 int64_t val
= atoll(p
[2]);
6655 options
->inactivity_minimum_bytes
= (val
< 0) ? 0 : val
;
6656 if (options
->inactivity_minimum_bytes
> INT_MAX
)
6658 msg(M_WARN
, "WARNING: '--inactive' with a 'bytes' value"
6659 " >2 Gbyte was silently ignored in older versions. If "
6660 " your VPN exits unexpectedly with 'Inactivity timeout'"
6661 " in %d seconds, revisit this value.",
6662 options
->inactivity_timeout
);
6666 else if (streq(p
[0], "session-timeout") && p
[1] && !p
[2])
6668 VERIFY_PERMISSION(OPT_P_TIMER
);
6669 options
->session_timeout
= positive_atoi(p
[1]);
6671 else if (streq(p
[0], "proto") && p
[1] && !p
[2])
6675 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6676 proto
= ascii2proto(p
[1]);
6677 af
= ascii2af(p
[1]);
6681 "Bad protocol: '%s'. Allowed protocols with --proto option: %s",
6683 proto2ascii_all(&gc
));
6686 options
->ce
.proto
= proto
;
6687 options
->ce
.af
= af
;
6689 else if (streq(p
[0], "proto-force") && p
[1] && !p
[2])
6692 VERIFY_PERMISSION(OPT_P_GENERAL
);
6693 proto_force
= ascii2proto(p
[1]);
6694 if (proto_force
< 0)
6696 msg(msglevel
, "Bad --proto-force protocol: '%s'", p
[1]);
6699 options
->proto_force
= proto_force
;
6701 else if (streq(p
[0], "http-proxy") && p
[1] && !p
[5])
6703 struct http_proxy_options
*ho
;
6705 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6710 msg(msglevel
, "http-proxy port number not defined");
6714 ho
= init_http_proxy_options_once(&options
->ce
.http_proxy_options
, &options
->gc
);
6722 /* auto -- try to figure out proxy addr, port, and type automatically */
6723 /* semiauto -- given proxy addr:port, try to figure out type automatically */
6724 /* (auto|semiauto)-nct -- disable proxy auth cleartext protocols (i.e. basic auth) */
6725 if (streq(p
[3], "auto"))
6727 ho
->auth_retry
= PAR_ALL
;
6729 else if (streq(p
[3], "auto-nct"))
6731 ho
->auth_retry
= PAR_NCT
;
6735 ho
->auth_method_string
= "basic";
6736 ho
->auth_file
= p
[3];
6740 ho
->auth_method_string
= p
[4];
6746 ho
->auth_method_string
= "none";
6749 else if (streq(p
[0], "http-proxy-user-pass") && p
[1])
6751 struct http_proxy_options
*ho
;
6752 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
6753 ho
= init_http_proxy_options_once(&options
->ce
.http_proxy_options
, &options
->gc
);
6754 ho
->auth_file
= p
[1];
6755 ho
->inline_creds
= is_inline
;
6757 else if (streq(p
[0], "http-proxy-retry") || streq(p
[0], "socks-proxy-retry"))
6759 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6760 msg(M_WARN
, "DEPRECATED OPTION: http-proxy-retry and socks-proxy-retry: "
6761 "In OpenVPN 2.4 proxy connection retries are handled like regular connections. "
6762 "Use connect-retry-max 1 to get a similar behavior as before.");
6764 else if (streq(p
[0], "http-proxy-timeout") && p
[1] && !p
[2])
6766 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6767 msg(M_WARN
, "DEPRECATED OPTION: http-proxy-timeout: In OpenVPN 2.4 the timeout until a connection to a "
6768 "server is established is managed with a single timeout set by connect-timeout");
6770 else if (streq(p
[0], "http-proxy-option") && p
[1] && !p
[4])
6772 struct http_proxy_options
*ho
;
6774 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6775 ho
= init_http_proxy_options_once(&options
->ce
.http_proxy_options
, &options
->gc
);
6777 if (streq(p
[1], "VERSION") && p
[2] && !p
[3])
6779 ho
->http_version
= p
[2];
6781 else if (streq(p
[1], "AGENT") && p
[2] && !p
[3])
6783 ho
->user_agent
= p
[2];
6785 else if ((streq(p
[1], "EXT1") || streq(p
[1], "EXT2") || streq(p
[1], "CUSTOM-HEADER"))
6788 /* In the wild patched versions use both EXT1/2 and CUSTOM-HEADER
6789 * with either two argument or one */
6791 struct http_custom_header
*custom_header
= NULL
;
6793 /* Find the first free header */
6794 for (i
= 0; i
< MAX_CUSTOM_HTTP_HEADER
; i
++)
6796 if (!ho
->custom_headers
[i
].name
)
6798 custom_header
= &ho
->custom_headers
[i
];
6804 msg(msglevel
, "Cannot use more than %d http-proxy-option CUSTOM-HEADER : '%s'", MAX_CUSTOM_HTTP_HEADER
, p
[1]);
6808 /* We will save p[2] and p[3], the proxy code will detect if
6810 custom_header
->name
= p
[2];
6811 custom_header
->content
= p
[3];
6816 msg(msglevel
, "Bad http-proxy-option or missing or extra parameter: '%s'", p
[1]);
6819 else if (streq(p
[0], "socks-proxy") && p
[1] && !p
[4])
6821 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6825 options
->ce
.socks_proxy_port
= p
[2];
6829 options
->ce
.socks_proxy_port
= "1080";
6831 options
->ce
.socks_proxy_server
= p
[1];
6832 options
->ce
.socks_proxy_authfile
= p
[3]; /* might be NULL */
6834 else if (streq(p
[0], "keepalive") && p
[1] && p
[2] && !p
[3])
6836 VERIFY_PERMISSION(OPT_P_GENERAL
);
6837 options
->keepalive_ping
= atoi(p
[1]);
6838 options
->keepalive_timeout
= atoi(p
[2]);
6840 else if (streq(p
[0], "ping") && p
[1] && !p
[2])
6842 VERIFY_PERMISSION(OPT_P_TIMER
);
6843 options
->ping_send_timeout
= positive_atoi(p
[1]);
6845 else if (streq(p
[0], "ping-exit") && p
[1] && !p
[2])
6847 VERIFY_PERMISSION(OPT_P_TIMER
);
6848 options
->ping_rec_timeout
= positive_atoi(p
[1]);
6849 options
->ping_rec_timeout_action
= PING_EXIT
;
6851 else if (streq(p
[0], "ping-restart") && p
[1] && !p
[2])
6853 VERIFY_PERMISSION(OPT_P_TIMER
);
6854 options
->ping_rec_timeout
= positive_atoi(p
[1]);
6855 options
->ping_rec_timeout_action
= PING_RESTART
;
6857 else if (streq(p
[0], "ping-timer-rem") && !p
[1])
6859 VERIFY_PERMISSION(OPT_P_TIMER
);
6860 options
->ping_timer_remote
= true;
6862 else if (streq(p
[0], "explicit-exit-notify") && !p
[2])
6864 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_EXPLICIT_NOTIFY
);
6867 options
->ce
.explicit_exit_notification
= positive_atoi(p
[1]);
6871 options
->ce
.explicit_exit_notification
= 1;
6874 else if (streq(p
[0], "persist-tun") && !p
[1])
6876 VERIFY_PERMISSION(OPT_P_PERSIST
);
6877 options
->persist_tun
= true;
6879 else if (streq(p
[0], "persist-key") && !p
[1])
6881 VERIFY_PERMISSION(OPT_P_PERSIST
);
6882 options
->persist_key
= true;
6884 else if (streq(p
[0], "persist-local-ip") && !p
[1])
6886 VERIFY_PERMISSION(OPT_P_PERSIST_IP
);
6887 options
->persist_local_ip
= true;
6889 else if (streq(p
[0], "persist-remote-ip") && !p
[1])
6891 VERIFY_PERMISSION(OPT_P_PERSIST_IP
);
6892 options
->persist_remote_ip
= true;
6894 else if (streq(p
[0], "client-nat") && p
[1] && p
[2] && p
[3] && p
[4] && !p
[5])
6896 VERIFY_PERMISSION(OPT_P_ROUTE
);
6897 cnol_check_alloc(options
);
6898 add_client_nat_to_option_list(options
->client_nat
, p
[1], p
[2], p
[3], p
[4], msglevel
);
6900 else if (streq(p
[0], "route") && p
[1] && !p
[5])
6902 VERIFY_PERMISSION(OPT_P_ROUTE
);
6903 rol_check_alloc(options
);
6906 if (!ip_or_dns_addr_safe(p
[1], options
->allow_pull_fqdn
) && !is_special_addr(p
[1])) /* FQDN -- may be DNS name */
6908 msg(msglevel
, "route parameter network/IP '%s' must be a valid address", p
[1]);
6911 if (p
[2] && !ip_addr_dotted_quad_safe(p
[2])) /* FQDN -- must be IP address */
6913 msg(msglevel
, "route parameter netmask '%s' must be an IP address", p
[2]);
6916 if (p
[3] && !ip_or_dns_addr_safe(p
[3], options
->allow_pull_fqdn
) && !is_special_addr(p
[3])) /* FQDN -- may be DNS name */
6918 msg(msglevel
, "route parameter gateway '%s' must be a valid address", p
[3]);
6922 add_route_to_option_list(options
->routes
, p
[1], p
[2], p
[3], p
[4]);
6924 else if (streq(p
[0], "route-ipv6") && p
[1] && !p
[4])
6926 VERIFY_PERMISSION(OPT_P_ROUTE
);
6927 rol6_check_alloc(options
);
6930 if (!ipv6_addr_safe_hexplusbits(p
[1]))
6932 msg(msglevel
, "route-ipv6 parameter network/IP '%s' must be a valid address", p
[1]);
6935 if (p
[2] && !ipv6_addr_safe(p
[2]))
6937 msg(msglevel
, "route-ipv6 parameter gateway '%s' must be a valid address", p
[2]);
6940 /* p[3] is metric, if present */
6942 add_route_ipv6_to_option_list(options
->routes_ipv6
, p
[1], p
[2], p
[3]);
6944 else if (streq(p
[0], "max-routes") && !p
[2])
6946 msg(M_WARN
, "DEPRECATED OPTION: --max-routes option ignored."
6947 "The number of routes is unlimited as of OpenVPN 2.4. "
6948 "This option will be removed in a future version, "
6949 "please remove it from your configuration.");
6951 else if (streq(p
[0], "route-gateway") && p
[1] && !p
[2])
6953 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
6954 if (streq(p
[1], "dhcp"))
6956 options
->route_gateway_via_dhcp
= true;
6960 if (ip_or_dns_addr_safe(p
[1], options
->allow_pull_fqdn
) || is_special_addr(p
[1])) /* FQDN -- may be DNS name */
6962 options
->route_default_gateway
= p
[1];
6966 msg(msglevel
, "route-gateway parm '%s' must be a valid address", p
[1]);
6971 else if (streq(p
[0], "route-ipv6-gateway") && p
[1] && !p
[2])
6973 if (ipv6_addr_safe(p
[1]))
6975 options
->route_ipv6_default_gateway
= p
[1];
6979 msg(msglevel
, "route-ipv6-gateway parm '%s' must be a valid address", p
[1]);
6983 else if (streq(p
[0], "route-metric") && p
[1] && !p
[2])
6985 VERIFY_PERMISSION(OPT_P_ROUTE
);
6986 options
->route_default_metric
= positive_atoi(p
[1]);
6988 else if (streq(p
[0], "route-delay") && !p
[3])
6990 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
6991 options
->route_delay_defined
= true;
6994 options
->route_delay
= positive_atoi(p
[1]);
6997 options
->route_delay_window
= positive_atoi(p
[2]);
7002 options
->route_delay
= 0;
7005 else if (streq(p
[0], "route-up") && p
[1])
7007 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7008 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7012 set_user_script(options
, &options
->route_script
, p
[1], "route-up", false);
7014 else if (streq(p
[0], "route-pre-down") && p
[1])
7016 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7017 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7021 set_user_script(options
,
7022 &options
->route_predown_script
,
7024 "route-pre-down", true);
7026 else if (streq(p
[0], "route-noexec") && !p
[1])
7028 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7029 options
->route_noexec
= true;
7031 else if (streq(p
[0], "route-nopull") && !p
[1])
7033 VERIFY_PERMISSION(OPT_P_GENERAL
);
7034 options
->route_nopull
= true;
7036 else if (streq(p
[0], "pull-filter") && p
[1] && p
[2] && !p
[3])
7038 struct pull_filter
*f
;
7039 VERIFY_PERMISSION(OPT_P_GENERAL
)
7040 f
= alloc_pull_filter(options
, msglevel
);
7042 if (strcmp("accept", p
[1]) == 0)
7044 f
->type
= PUF_TYPE_ACCEPT
;
7046 else if (strcmp("ignore", p
[1]) == 0)
7048 f
->type
= PUF_TYPE_IGNORE
;
7050 else if (strcmp("reject", p
[1]) == 0)
7052 f
->type
= PUF_TYPE_REJECT
;
7056 msg(msglevel
, "Unknown --pull-filter type: %s", p
[1]);
7060 f
->size
= strlen(p
[2]);
7062 else if (streq(p
[0], "allow-pull-fqdn") && !p
[1])
7064 VERIFY_PERMISSION(OPT_P_GENERAL
);
7065 options
->allow_pull_fqdn
= true;
7067 else if (streq(p
[0], "redirect-gateway") || streq(p
[0], "redirect-private"))
7070 VERIFY_PERMISSION(OPT_P_ROUTE
);
7071 rol_check_alloc(options
);
7073 if (options
->routes
->flags
& RG_ENABLE
)
7076 "WARNING: You have specified redirect-gateway and "
7077 "redirect-private at the same time (or the same option "
7078 "multiple times). This is not well supported and may lead to "
7079 "unexpected results");
7082 options
->routes
->flags
|= RG_ENABLE
;
7084 if (streq(p
[0], "redirect-gateway"))
7086 options
->routes
->flags
|= RG_REROUTE_GW
;
7088 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
7090 if (streq(p
[j
], "local"))
7092 options
->routes
->flags
|= RG_LOCAL
;
7094 else if (streq(p
[j
], "autolocal"))
7096 options
->routes
->flags
|= RG_AUTO_LOCAL
;
7098 else if (streq(p
[j
], "def1"))
7100 options
->routes
->flags
|= RG_DEF1
;
7102 else if (streq(p
[j
], "bypass-dhcp"))
7104 options
->routes
->flags
|= RG_BYPASS_DHCP
;
7106 else if (streq(p
[j
], "bypass-dns"))
7108 options
->routes
->flags
|= RG_BYPASS_DNS
;
7110 else if (streq(p
[j
], "block-local"))
7112 options
->routes
->flags
|= RG_BLOCK_LOCAL
;
7114 else if (streq(p
[j
], "ipv6"))
7116 rol6_check_alloc(options
);
7117 options
->routes_ipv6
->flags
|= RG_REROUTE_GW
;
7119 else if (streq(p
[j
], "!ipv4"))
7121 options
->routes
->flags
&= ~(RG_REROUTE_GW
| RG_ENABLE
);
7125 msg(msglevel
, "unknown --%s flag: %s", p
[0], p
[j
]);
7130 /* we need this here to handle pushed --redirect-gateway */
7131 remap_redirect_gateway_flags(options
);
7134 else if (streq(p
[0], "block-ipv6") && !p
[1])
7136 VERIFY_PERMISSION(OPT_P_ROUTE
);
7137 options
->block_ipv6
= true;
7139 else if (streq(p
[0], "remote-random-hostname") && !p
[1])
7141 VERIFY_PERMISSION(OPT_P_GENERAL
);
7142 options
->sockflags
|= SF_HOST_RANDOMIZE
;
7144 else if (streq(p
[0], "setenv") && p
[1] && !p
[3])
7146 VERIFY_PERMISSION(OPT_P_GENERAL
);
7147 if (streq(p
[1], "REMOTE_RANDOM_HOSTNAME") && !p
[2])
7149 options
->sockflags
|= SF_HOST_RANDOMIZE
;
7151 else if (streq(p
[1], "GENERIC_CONFIG"))
7153 msg(msglevel
, "this is a generic configuration and cannot directly be used");
7156 else if (streq(p
[1], "PUSH_PEER_INFO") && !p
[2])
7158 options
->push_peer_info
= true;
7160 else if (streq(p
[1], "SERVER_POLL_TIMEOUT") && p
[2])
7162 options
->ce
.connect_timeout
= positive_atoi(p
[2]);
7166 if (streq(p
[1], "FORWARD_COMPATIBLE") && p
[2] && streq(p
[2], "1"))
7168 options
->forward_compatible
= true;
7169 msglevel_fc
= msglevel_forward_compatible(options
, msglevel
);
7171 setenv_str(es
, p
[1], p
[2] ? p
[2] : "");
7174 else if (streq(p
[0], "compat-mode") && p
[1] && !p
[3])
7176 unsigned int major
, minor
, patch
;
7177 if (!(sscanf(p
[1], "%u.%u.%u", &major
, &minor
, &patch
) == 3))
7179 msg(msglevel
, "cannot parse version number for --compat-mode: %s",
7184 options
->backwards_compatible
= major
* 10000 + minor
* 100 + patch
;
7186 else if (streq(p
[0], "setenv-safe") && p
[1] && !p
[3])
7188 VERIFY_PERMISSION(OPT_P_SETENV
);
7189 setenv_str_safe(es
, p
[1], p
[2] ? p
[2] : "");
7191 else if (streq(p
[0], "script-security") && p
[1] && !p
[2])
7193 VERIFY_PERMISSION(OPT_P_GENERAL
);
7194 script_security_set(atoi(p
[1]));
7196 else if (streq(p
[0], "mssfix") && !p
[3])
7198 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
7201 /* value specified, assume encapsulation is not
7202 * included unless "mtu" follows later */
7203 options
->ce
.mssfix
= positive_atoi(p
[1]);
7204 options
->ce
.mssfix_encap
= false;
7205 options
->ce
.mssfix_default
= false;
7209 /* Set MTU to default values */
7210 options
->ce
.mssfix_default
= true;
7211 options
->ce
.mssfix_encap
= true;
7212 options
->ce
.mssfix_fixed
= false;
7215 if (p
[2] && streq(p
[2], "mtu"))
7217 options
->ce
.mssfix_encap
= true;
7219 else if (p
[2] && streq(p
[2], "fixed"))
7221 options
->ce
.mssfix_fixed
= true;
7225 msg(msglevel
, "Unknown parameter to --mssfix: %s", p
[2]);
7228 else if (streq(p
[0], "disable-occ") && !p
[1])
7230 VERIFY_PERMISSION(OPT_P_GENERAL
);
7231 options
->occ
= false;
7233 else if (streq(p
[0], "server") && p
[1] && p
[2] && !p
[4])
7235 const int lev
= M_WARN
;
7237 in_addr_t network
, netmask
;
7239 VERIFY_PERMISSION(OPT_P_GENERAL
);
7240 network
= get_ip_addr(p
[1], lev
, &error
);
7241 netmask
= get_ip_addr(p
[2], lev
, &error
);
7242 if (error
|| !network
|| !netmask
)
7244 msg(msglevel
, "error parsing --server parameters");
7247 options
->server_defined
= true;
7248 options
->server_network
= network
;
7249 options
->server_netmask
= netmask
;
7253 if (streq(p
[3], "nopool"))
7255 options
->server_flags
|= SF_NOPOOL
;
7259 msg(msglevel
, "error parsing --server: %s is not a recognized flag", p
[3]);
7264 else if (streq(p
[0], "server-ipv6") && p
[1] && !p
[2])
7266 const int lev
= M_WARN
;
7267 struct in6_addr network
;
7268 unsigned int netbits
= 0;
7270 VERIFY_PERMISSION(OPT_P_GENERAL
);
7271 if (!get_ipv6_addr(p
[1], &network
, &netbits
, lev
) )
7273 msg(msglevel
, "error parsing --server-ipv6 parameter");
7276 if (netbits
< 64 || netbits
> 124)
7279 "--server-ipv6 settings: network must be between /64 and /124 (not /%d)",
7284 options
->server_ipv6_defined
= true;
7285 options
->server_network_ipv6
= network
;
7286 options
->server_netbits_ipv6
= netbits
;
7288 else if (streq(p
[0], "server-bridge") && p
[1] && p
[2] && p
[3] && p
[4] && !p
[5])
7290 const int lev
= M_WARN
;
7292 in_addr_t ip
, netmask
, pool_start
, pool_end
;
7294 VERIFY_PERMISSION(OPT_P_GENERAL
);
7295 ip
= get_ip_addr(p
[1], lev
, &error
);
7296 netmask
= get_ip_addr(p
[2], lev
, &error
);
7297 pool_start
= get_ip_addr(p
[3], lev
, &error
);
7298 pool_end
= get_ip_addr(p
[4], lev
, &error
);
7299 if (error
|| !ip
|| !netmask
|| !pool_start
|| !pool_end
)
7301 msg(msglevel
, "error parsing --server-bridge parameters");
7304 options
->server_bridge_defined
= true;
7305 options
->server_bridge_ip
= ip
;
7306 options
->server_bridge_netmask
= netmask
;
7307 options
->server_bridge_pool_start
= pool_start
;
7308 options
->server_bridge_pool_end
= pool_end
;
7310 else if (streq(p
[0], "server-bridge") && p
[1] && streq(p
[1], "nogw") && !p
[2])
7312 VERIFY_PERMISSION(OPT_P_GENERAL
);
7313 options
->server_bridge_proxy_dhcp
= true;
7314 options
->server_flags
|= SF_NO_PUSH_ROUTE_GATEWAY
;
7316 else if (streq(p
[0], "server-bridge") && !p
[1])
7318 VERIFY_PERMISSION(OPT_P_GENERAL
);
7319 options
->server_bridge_proxy_dhcp
= true;
7321 else if (streq(p
[0], "push") && p
[1] && !p
[2])
7323 VERIFY_PERMISSION(OPT_P_PUSH
);
7324 push_options(options
, &p
[1], msglevel
, &options
->gc
);
7326 else if (streq(p
[0], "push-reset") && !p
[1])
7328 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7329 push_reset(options
);
7331 else if (streq(p
[0], "push-remove") && p
[1] && !p
[2])
7333 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7334 msg(D_PUSH
, "PUSH_REMOVE '%s'", p
[1]);
7335 push_remove_option(options
, p
[1]);
7337 else if (streq(p
[0], "ifconfig-pool") && p
[1] && p
[2] && !p
[4])
7339 const int lev
= M_WARN
;
7341 in_addr_t start
, end
, netmask
= 0;
7343 VERIFY_PERMISSION(OPT_P_GENERAL
);
7344 start
= get_ip_addr(p
[1], lev
, &error
);
7345 end
= get_ip_addr(p
[2], lev
, &error
);
7348 netmask
= get_ip_addr(p
[3], lev
, &error
);
7352 msg(msglevel
, "error parsing --ifconfig-pool parameters");
7355 if (!ifconfig_pool_verify_range(msglevel
, start
, end
))
7360 options
->ifconfig_pool_defined
= true;
7361 options
->ifconfig_pool_start
= start
;
7362 options
->ifconfig_pool_end
= end
;
7365 options
->ifconfig_pool_netmask
= netmask
;
7368 else if (streq(p
[0], "ifconfig-pool-persist") && p
[1] && !p
[3])
7370 VERIFY_PERMISSION(OPT_P_GENERAL
);
7371 options
->ifconfig_pool_persist_filename
= p
[1];
7374 options
->ifconfig_pool_persist_refresh_freq
= positive_atoi(p
[2]);
7377 else if (streq(p
[0], "ifconfig-ipv6-pool") && p
[1] && !p
[2])
7379 const int lev
= M_WARN
;
7380 struct in6_addr network
;
7381 unsigned int netbits
= 0;
7383 VERIFY_PERMISSION(OPT_P_GENERAL
);
7384 if (!get_ipv6_addr(p
[1], &network
, &netbits
, lev
) )
7386 msg(msglevel
, "error parsing --ifconfig-ipv6-pool parameters");
7389 if (netbits
< 64 || netbits
> 124)
7392 "--ifconfig-ipv6-pool settings: network must be between /64 and /124 (not /%d)",
7397 options
->ifconfig_ipv6_pool_defined
= true;
7398 options
->ifconfig_ipv6_pool_base
= network
;
7399 options
->ifconfig_ipv6_pool_netbits
= netbits
;
7401 else if (streq(p
[0], "hash-size") && p
[1] && p
[2] && !p
[3])
7405 VERIFY_PERMISSION(OPT_P_GENERAL
);
7407 virtual = atoi(p
[2]);
7408 if (real
< 1 || virtual < 1)
7410 msg(msglevel
, "--hash-size sizes must be >= 1 (preferably a power of 2)");
7413 options
->real_hash_size
= real
;
7414 options
->virtual_hash_size
= real
;
7416 else if (streq(p
[0], "connect-freq") && p
[1] && p
[2] && !p
[3])
7420 VERIFY_PERMISSION(OPT_P_GENERAL
);
7421 cf_max
= atoi(p
[1]);
7422 cf_per
= atoi(p
[2]);
7423 if (cf_max
< 0 || cf_per
< 0)
7425 msg(msglevel
, "--connect-freq parms must be > 0");
7428 options
->cf_max
= cf_max
;
7429 options
->cf_per
= cf_per
;
7431 else if (streq(p
[0], "max-clients") && p
[1] && !p
[2])
7435 VERIFY_PERMISSION(OPT_P_GENERAL
);
7436 max_clients
= atoi(p
[1]);
7437 if (max_clients
< 0)
7439 msg(msglevel
, "--max-clients must be at least 1");
7442 if (max_clients
>= MAX_PEER_ID
) /* max peer-id value */
7444 msg(msglevel
, "--max-clients must be less than %d", MAX_PEER_ID
);
7447 options
->max_clients
= max_clients
;
7449 else if (streq(p
[0], "max-routes-per-client") && p
[1] && !p
[2])
7451 VERIFY_PERMISSION(OPT_P_INHERIT
);
7452 options
->max_routes_per_client
= max_int(atoi(p
[1]), 1);
7454 else if (streq(p
[0], "client-cert-not-required") && !p
[1])
7456 VERIFY_PERMISSION(OPT_P_GENERAL
);
7457 msg(M_FATAL
, "REMOVED OPTION: --client-cert-not-required, use '--verify-client-cert none' instead");
7459 else if (streq(p
[0], "verify-client-cert") && !p
[2])
7461 VERIFY_PERMISSION(OPT_P_GENERAL
);
7463 /* Reset any existing flags */
7464 options
->ssl_flags
&= ~SSLF_CLIENT_CERT_OPTIONAL
;
7465 options
->ssl_flags
&= ~SSLF_CLIENT_CERT_NOT_REQUIRED
;
7468 if (streq(p
[1], "none"))
7470 options
->ssl_flags
|= SSLF_CLIENT_CERT_NOT_REQUIRED
;
7472 else if (streq(p
[1], "optional"))
7474 options
->ssl_flags
|= SSLF_CLIENT_CERT_OPTIONAL
;
7476 else if (!streq(p
[1], "require"))
7478 msg(msglevel
, "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
7483 else if (streq(p
[0], "username-as-common-name") && !p
[1])
7485 VERIFY_PERMISSION(OPT_P_GENERAL
);
7486 options
->ssl_flags
|= SSLF_USERNAME_AS_COMMON_NAME
;
7488 else if (streq(p
[0], "auth-user-pass-optional") && !p
[1])
7490 VERIFY_PERMISSION(OPT_P_GENERAL
);
7491 options
->ssl_flags
|= SSLF_AUTH_USER_PASS_OPTIONAL
;
7493 else if (streq(p
[0], "opt-verify") && !p
[1])
7495 VERIFY_PERMISSION(OPT_P_GENERAL
);
7496 options
->ssl_flags
|= SSLF_OPT_VERIFY
;
7498 else if (streq(p
[0], "auth-user-pass-verify") && p
[1])
7500 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7501 if (!no_more_than_n_args(msglevel
, p
, 3, NM_QUOTE_HINT
))
7507 if (streq(p
[2], "via-env"))
7509 options
->auth_user_pass_verify_script_via_file
= false;
7511 else if (streq(p
[2], "via-file"))
7513 options
->auth_user_pass_verify_script_via_file
= true;
7517 msg(msglevel
, "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
7523 msg(msglevel
, "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
7526 set_user_script(options
,
7527 &options
->auth_user_pass_verify_script
,
7528 p
[1], "auth-user-pass-verify", true);
7530 else if (streq(p
[0], "auth-gen-token"))
7532 VERIFY_PERMISSION(OPT_P_GENERAL
);
7533 options
->auth_token_generate
= true;
7534 options
->auth_token_lifetime
= p
[1] ? positive_atoi(p
[1]) : 0;
7536 for (int i
= 2; i
< MAX_PARMS
&& p
[i
] != NULL
; i
++)
7538 /* the second parameter can be the renewal time */
7539 if (i
== 2 && positive_atoi(p
[i
]))
7541 options
->auth_token_renewal
= positive_atoi(p
[i
]);
7543 else if (streq(p
[i
], "external-auth"))
7545 options
->auth_token_call_auth
= true;
7549 msg(msglevel
, "Invalid argument to auth-gen-token: %s (%d)", p
[i
], i
);
7554 else if (streq(p
[0], "auth-gen-token-secret") && p
[1] && !p
[2])
7556 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
7557 options
->auth_token_secret_file
= p
[1];
7558 options
->auth_token_secret_file_inline
= is_inline
;
7561 else if (streq(p
[0], "client-connect") && p
[1])
7563 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7564 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7568 set_user_script(options
, &options
->client_connect_script
,
7569 p
[1], "client-connect", true);
7571 else if (streq(p
[0], "client-crresponse") && p
[1])
7573 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7574 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7578 set_user_script(options
, &options
->client_crresponse_script
,
7579 p
[1], "client-crresponse", true);
7581 else if (streq(p
[0], "client-disconnect") && p
[1])
7583 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7584 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7588 set_user_script(options
, &options
->client_disconnect_script
,
7589 p
[1], "client-disconnect", true);
7591 else if (streq(p
[0], "learn-address") && p
[1])
7593 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7594 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7598 set_user_script(options
, &options
->learn_address_script
,
7599 p
[1], "learn-address", true);
7601 else if (streq(p
[0], "tmp-dir") && p
[1] && !p
[2])
7603 VERIFY_PERMISSION(OPT_P_GENERAL
);
7604 options
->tmp_dir
= p
[1];
7606 else if (streq(p
[0], "client-config-dir") && p
[1] && !p
[2])
7608 VERIFY_PERMISSION(OPT_P_GENERAL
);
7609 options
->client_config_dir
= p
[1];
7611 else if (streq(p
[0], "ccd-exclusive") && !p
[1])
7613 VERIFY_PERMISSION(OPT_P_GENERAL
);
7614 options
->ccd_exclusive
= true;
7616 else if (streq(p
[0], "bcast-buffers") && p
[1] && !p
[2])
7620 VERIFY_PERMISSION(OPT_P_GENERAL
);
7621 n_bcast_buf
= atoi(p
[1]);
7622 if (n_bcast_buf
< 1)
7624 msg(msglevel
, "--bcast-buffers parameter must be > 0");
7626 options
->n_bcast_buf
= n_bcast_buf
;
7628 else if (streq(p
[0], "tcp-queue-limit") && p
[1] && !p
[2])
7630 int tcp_queue_limit
;
7632 VERIFY_PERMISSION(OPT_P_GENERAL
);
7633 tcp_queue_limit
= atoi(p
[1]);
7634 if (tcp_queue_limit
< 1)
7636 msg(msglevel
, "--tcp-queue-limit parameter must be > 0");
7638 options
->tcp_queue_limit
= tcp_queue_limit
;
7641 else if (streq(p
[0], "port-share") && p
[1] && p
[2] && !p
[4])
7643 VERIFY_PERMISSION(OPT_P_GENERAL
);
7644 options
->port_share_host
= p
[1];
7645 options
->port_share_port
= p
[2];
7646 options
->port_share_journal_dir
= p
[3];
7649 else if (streq(p
[0], "client-to-client") && !p
[1])
7651 VERIFY_PERMISSION(OPT_P_GENERAL
);
7652 options
->enable_c2c
= true;
7654 else if (streq(p
[0], "duplicate-cn") && !p
[1])
7656 VERIFY_PERMISSION(OPT_P_GENERAL
);
7657 options
->duplicate_cn
= true;
7659 else if (streq(p
[0], "iroute") && p
[1] && !p
[3])
7661 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7662 option_iroute(options
, p
[1], p
[2], msglevel
);
7664 else if (streq(p
[0], "iroute-ipv6") && p
[1] && !p
[2])
7666 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7667 option_iroute_ipv6(options
, p
[1], msglevel
);
7669 else if (streq(p
[0], "ifconfig-push") && p
[1] && p
[2] && !p
[4])
7671 in_addr_t local
, remote_netmask
;
7673 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7674 local
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[1], 0, NULL
, NULL
);
7675 remote_netmask
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[2], 0, NULL
, NULL
);
7676 if (local
&& remote_netmask
)
7678 options
->push_ifconfig_defined
= true;
7679 options
->push_ifconfig_local
= local
;
7680 options
->push_ifconfig_remote_netmask
= remote_netmask
;
7683 options
->push_ifconfig_local_alias
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[3], 0, NULL
, NULL
);
7688 msg(msglevel
, "cannot parse --ifconfig-push addresses");
7692 else if (streq(p
[0], "ifconfig-push-constraint") && p
[1] && p
[2] && !p
[3])
7694 in_addr_t network
, netmask
;
7696 VERIFY_PERMISSION(OPT_P_GENERAL
);
7697 network
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[1], 0, NULL
, NULL
);
7698 netmask
= getaddr(GETADDR_HOST_ORDER
, p
[2], 0, NULL
, NULL
);
7699 if (network
&& netmask
)
7701 options
->push_ifconfig_constraint_defined
= true;
7702 options
->push_ifconfig_constraint_network
= network
;
7703 options
->push_ifconfig_constraint_netmask
= netmask
;
7707 msg(msglevel
, "cannot parse --ifconfig-push-constraint addresses");
7711 else if (streq(p
[0], "ifconfig-ipv6-push") && p
[1] && !p
[3])
7713 struct in6_addr local
, remote
;
7714 unsigned int netbits
;
7716 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7718 if (!get_ipv6_addr( p
[1], &local
, &netbits
, msglevel
) )
7720 msg(msglevel
, "cannot parse --ifconfig-ipv6-push addresses");
7726 if (!get_ipv6_addr( p
[2], &remote
, NULL
, msglevel
) )
7728 msg( msglevel
, "cannot parse --ifconfig-ipv6-push addresses");
7734 if (!options
->ifconfig_ipv6_local
7735 || !get_ipv6_addr( options
->ifconfig_ipv6_local
, &remote
,
7738 msg( msglevel
, "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
7743 options
->push_ifconfig_ipv6_defined
= true;
7744 options
->push_ifconfig_ipv6_local
= local
;
7745 options
->push_ifconfig_ipv6_netbits
= netbits
;
7746 options
->push_ifconfig_ipv6_remote
= remote
;
7747 options
->push_ifconfig_ipv6_blocked
= false;
7749 else if (streq(p
[0], "disable") && !p
[1])
7751 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7752 options
->disable
= true;
7754 else if (streq(p
[0], "tcp-nodelay") && !p
[1])
7756 VERIFY_PERMISSION(OPT_P_GENERAL
);
7757 options
->server_flags
|= SF_TCP_NODELAY_HELPER
;
7759 else if (streq(p
[0], "stale-routes-check") && p
[1] && !p
[3])
7761 int ageing_time
, check_interval
;
7763 VERIFY_PERMISSION(OPT_P_GENERAL
);
7764 ageing_time
= atoi(p
[1]);
7767 check_interval
= atoi(p
[2]);
7771 check_interval
= ageing_time
;
7774 if (ageing_time
< 1 || check_interval
< 1)
7776 msg(msglevel
, "--stale-routes-check aging time and check interval must be >= 1");
7779 options
->stale_routes_ageing_time
= ageing_time
;
7780 options
->stale_routes_check_interval
= check_interval
;
7783 else if (streq(p
[0], "client") && !p
[1])
7785 VERIFY_PERMISSION(OPT_P_GENERAL
);
7786 options
->client
= true;
7788 else if (streq(p
[0], "pull") && !p
[1])
7790 VERIFY_PERMISSION(OPT_P_GENERAL
);
7791 options
->pull
= true;
7793 else if (streq(p
[0], "push-continuation") && p
[1] && !p
[2])
7795 VERIFY_PERMISSION(OPT_P_PULL_MODE
);
7796 options
->push_continuation
= atoi(p
[1]);
7798 else if (streq(p
[0], "auth-user-pass") && !p
[2])
7800 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
7803 options
->auth_user_pass_file
= p
[1];
7804 options
->auth_user_pass_file_inline
= is_inline
;
7808 options
->auth_user_pass_file
= "stdin";
7811 else if (streq(p
[0], "auth-retry") && p
[1] && !p
[2])
7813 VERIFY_PERMISSION(OPT_P_GENERAL
);
7814 auth_retry_set(msglevel
, p
[1]);
7816 #ifdef ENABLE_MANAGEMENT
7817 else if (streq(p
[0], "static-challenge") && p
[1] && p
[2] && !p
[3])
7819 VERIFY_PERMISSION(OPT_P_GENERAL
);
7820 options
->sc_info
.challenge_text
= p
[1];
7823 options
->sc_info
.flags
|= SC_ECHO
;
7827 else if (streq(p
[0], "msg-channel") && p
[1])
7830 VERIFY_PERMISSION(OPT_P_GENERAL
);
7831 HANDLE process
= GetCurrentProcess();
7832 HANDLE handle
= (HANDLE
) atoll(p
[1]);
7833 if (!DuplicateHandle(process
, handle
, process
, &options
->msg_channel
, 0,
7834 FALSE
, DUPLICATE_CLOSE_SOURCE
| DUPLICATE_SAME_ACCESS
))
7836 msg(msglevel
, "could not duplicate service pipe handle");
7839 options
->route_method
= ROUTE_METHOD_SERVICE
;
7840 #else /* ifdef _WIN32 */
7841 msg(msglevel
, "--msg-channel is only supported on Windows");
7846 else if (streq(p
[0], "win-sys") && p
[1] && !p
[2])
7848 VERIFY_PERMISSION(OPT_P_GENERAL
);
7849 if (streq(p
[1], "env"))
7851 msg(M_INFO
, "NOTE: --win-sys env is default from OpenVPN 2.3. "
7852 "This entry will now be ignored. "
7853 "Please remove this entry from your configuration file.");
7857 set_win_sys_path(p
[1], es
);
7860 else if (streq(p
[0], "route-method") && p
[1] && !p
[2])
7862 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
7863 if (streq(p
[1], "adaptive"))
7865 options
->route_method
= ROUTE_METHOD_ADAPTIVE
;
7867 else if (streq(p
[1], "ipapi"))
7869 options
->route_method
= ROUTE_METHOD_IPAPI
;
7871 else if (streq(p
[1], "exe"))
7873 options
->route_method
= ROUTE_METHOD_EXE
;
7877 msg(msglevel
, "--route method must be 'adaptive', 'ipapi', or 'exe'");
7881 else if (streq(p
[0], "ip-win32") && p
[1] && !p
[4])
7883 const int index
= ascii2ipset(p
[1]);
7884 struct tuntap_options
*to
= &options
->tuntap_options
;
7886 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
7891 "Bad --ip-win32 method: '%s'. Allowed methods: %s",
7893 ipset2ascii_all(&gc
));
7897 if (index
== IPW32_SET_ADAPTIVE
)
7899 options
->route_delay_window
= IPW32_SET_ADAPTIVE_DELAY_WINDOW
;
7902 if (index
== IPW32_SET_DHCP_MASQ
)
7906 if (!streq(p
[2], "default"))
7908 int offset
= atoi(p
[2]);
7910 if (!(offset
> -256 && offset
< 256))
7912 msg(msglevel
, "--ip-win32 dynamic [offset] [lease-time]: offset (%d) must be > -256 and < 256", offset
);
7916 to
->dhcp_masq_custom_offset
= true;
7917 to
->dhcp_masq_offset
= offset
;
7922 const int min_lease
= 30;
7924 lease_time
= atoi(p
[3]);
7925 if (lease_time
< min_lease
)
7927 msg(msglevel
, "--ip-win32 dynamic [offset] [lease-time]: lease time parameter (%d) must be at least %d seconds", lease_time
, min_lease
);
7930 to
->dhcp_lease_time
= lease_time
;
7934 to
->ip_win32_type
= index
;
7935 to
->ip_win32_defined
= true;
7937 #endif /* ifdef _WIN32 */
7938 else if (streq(p
[0], "dns") && p
[1])
7940 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
7942 if (streq(p
[1], "search-domains") && p
[2])
7944 dns_domain_list_append(&options
->dns_options
.search_domains
, &p
[2], &options
->dns_options
.gc
);
7946 else if (streq(p
[1], "server") && p
[2] && p
[3] && p
[4])
7949 if (!dns_server_priority_parse(&priority
, p
[2], pull_mode
))
7951 msg(msglevel
, "--dns server: invalid priority value '%s'", p
[2]);
7955 struct dns_server
*server
= dns_server_get(&options
->dns_options
.servers
, priority
, &options
->dns_options
.gc
);
7957 if (streq(p
[3], "address") && !p
[6])
7959 for (int i
= 4; p
[i
]; i
++)
7961 if (!dns_server_addr_parse(server
, p
[i
]))
7963 msg(msglevel
, "--dns server %ld: malformed or duplicate address '%s'", priority
, p
[i
]);
7968 else if (streq(p
[3], "resolve-domains"))
7970 if (server
->domain_type
== DNS_EXCLUDE_DOMAINS
)
7972 msg(msglevel
, "--dns server %ld: cannot use resolve-domains and exclude-domains", priority
);
7975 server
->domain_type
= DNS_RESOLVE_DOMAINS
;
7976 dns_domain_list_append(&server
->domains
, &p
[4], &options
->dns_options
.gc
);
7978 else if (streq(p
[3], "exclude-domains"))
7980 if (server
->domain_type
== DNS_RESOLVE_DOMAINS
)
7982 msg(msglevel
, "--dns server %ld: cannot use exclude-domains and resolve-domains", priority
);
7985 server
->domain_type
= DNS_EXCLUDE_DOMAINS
;
7986 dns_domain_list_append(&server
->domains
, &p
[4], &options
->dns_options
.gc
);
7988 else if (streq(p
[3], "dnssec") && !p
[5])
7990 if (streq(p
[4], "yes"))
7992 server
->dnssec
= DNS_SECURITY_YES
;
7994 else if (streq(p
[4], "no"))
7996 server
->dnssec
= DNS_SECURITY_NO
;
7998 else if (streq(p
[4], "optional"))
8000 server
->dnssec
= DNS_SECURITY_OPTIONAL
;
8004 msg(msglevel
, "--dns server %ld: malformed dnssec value '%s'", priority
, p
[4]);
8008 else if (streq(p
[3], "transport") && !p
[5])
8010 if (streq(p
[4], "plain"))
8012 server
->transport
= DNS_TRANSPORT_PLAIN
;
8014 else if (streq(p
[4], "DoH"))
8016 server
->transport
= DNS_TRANSPORT_HTTPS
;
8018 else if (streq(p
[4], "DoT"))
8020 server
->transport
= DNS_TRANSPORT_TLS
;
8024 msg(msglevel
, "--dns server %ld: malformed transport value '%s'", priority
, p
[4]);
8028 else if (streq(p
[3], "sni") && !p
[5])
8034 msg(msglevel
, "--dns server %ld: unknown option type '%s' or missing or unknown parameter", priority
, p
[3]);
8040 msg(msglevel
, "--dns: unknown option type '%s' or missing or unknown parameter", p
[1]);
8044 #if defined(_WIN32) || defined(TARGET_ANDROID)
8045 else if (streq(p
[0], "dhcp-option") && p
[1])
8047 struct tuntap_options
*o
= &options
->tuntap_options
;
8048 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8049 bool ipv6dns
= false;
8051 if ((streq(p
[1], "DOMAIN") || streq(p
[1], "ADAPTER_DOMAIN_SUFFIX"))
8056 else if (streq(p
[1], "NBS") && p
[2] && !p
[3])
8058 o
->netbios_scope
= p
[2];
8060 else if (streq(p
[1], "NBT") && p
[2] && !p
[3])
8064 if (!(t
== 1 || t
== 2 || t
== 4 || t
== 8))
8066 msg(msglevel
, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t
);
8069 o
->netbios_node_type
= t
;
8071 else if ((streq(p
[1], "DNS") || streq(p
[1], "DNS6")) && p
[2] && !p
[3]
8072 && (!strstr(p
[2], ":") || ipv6_addr_safe(p
[2])))
8074 if (strstr(p
[2], ":"))
8077 dhcp_option_dns6_parse(p
[2], o
->dns6
, &o
->dns6_len
, msglevel
);
8081 dhcp_option_address_parse("DNS", p
[2], o
->dns
, &o
->dns_len
, msglevel
);
8084 else if (streq(p
[1], "WINS") && p
[2] && !p
[3])
8086 dhcp_option_address_parse("WINS", p
[2], o
->wins
, &o
->wins_len
, msglevel
);
8088 else if (streq(p
[1], "NTP") && p
[2] && !p
[3])
8090 dhcp_option_address_parse("NTP", p
[2], o
->ntp
, &o
->ntp_len
, msglevel
);
8092 else if (streq(p
[1], "NBDD") && p
[2] && !p
[3])
8094 dhcp_option_address_parse("NBDD", p
[2], o
->nbdd
, &o
->nbdd_len
, msglevel
);
8096 else if (streq(p
[1], "DOMAIN-SEARCH") && p
[2] && !p
[3])
8098 if (o
->domain_search_list_len
< N_SEARCH_LIST_LEN
)
8100 o
->domain_search_list
[o
->domain_search_list_len
++] = p
[2];
8104 msg(msglevel
, "--dhcp-option %s: maximum of %d search entries can be specified",
8105 p
[1], N_SEARCH_LIST_LEN
);
8108 else if (streq(p
[1], "DISABLE-NBT") && !p
[2])
8112 #if defined(TARGET_ANDROID)
8113 else if (streq(p
[1], "PROXY_HTTP") && p
[3] && !p
[4])
8115 o
->http_proxy_port
= atoi(p
[3]);
8116 o
->http_proxy
= p
[2];
8121 msg(msglevel
, "--dhcp-option: unknown option type '%s' or missing or unknown parameter", p
[1]);
8125 /* flag that we have options to give to the TAP driver's DHCPv4 server
8126 * - skipped for "DNS6", as that's not a DHCPv4 option
8130 o
->dhcp_options
= true;
8133 #endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
8135 else if (streq(p
[0], "show-adapters") && !p
[1])
8137 VERIFY_PERMISSION(OPT_P_GENERAL
);
8138 show_tap_win_adapters(M_INFO
|M_NOPREFIX
, M_WARN
|M_NOPREFIX
);
8139 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8141 else if (streq(p
[0], "show-net") && !p
[1])
8143 VERIFY_PERMISSION(OPT_P_GENERAL
);
8144 show_routes(M_INFO
|M_NOPREFIX
);
8145 show_adapters(M_INFO
|M_NOPREFIX
);
8146 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8148 else if (streq(p
[0], "show-net-up") && !p
[1])
8150 VERIFY_PERMISSION(OPT_P_UP
);
8151 options
->show_net_up
= true;
8153 else if (streq(p
[0], "tap-sleep") && p
[1] && !p
[2])
8156 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8158 if (s
< 0 || s
>= 256)
8160 msg(msglevel
, "--tap-sleep parameter must be between 0 and 255");
8163 options
->tuntap_options
.tap_sleep
= s
;
8165 else if (streq(p
[0], "dhcp-renew") && !p
[1])
8167 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8168 options
->tuntap_options
.dhcp_renew
= true;
8170 else if (streq(p
[0], "dhcp-pre-release") && !p
[1])
8172 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8173 options
->tuntap_options
.dhcp_pre_release
= true;
8174 options
->tuntap_options
.dhcp_renew
= true;
8176 else if (streq(p
[0], "dhcp-release") && !p
[1])
8178 msg(M_WARN
, "Obsolete option --dhcp-release detected. This is now on by default");
8180 else if (streq(p
[0], "dhcp-internal") && p
[1] && !p
[2]) /* standalone method for internal use */
8182 unsigned int adapter_index
;
8183 VERIFY_PERMISSION(OPT_P_GENERAL
);
8184 set_debug_level(options
->verbosity
, SDL_CONSTRAIN
);
8185 adapter_index
= atou(p
[1]);
8186 sleep(options
->tuntap_options
.tap_sleep
);
8187 if (options
->tuntap_options
.dhcp_pre_release
)
8189 dhcp_release_by_adapter_index(adapter_index
);
8191 if (options
->tuntap_options
.dhcp_renew
)
8193 dhcp_renew_by_adapter_index(adapter_index
);
8195 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8197 else if (streq(p
[0], "register-dns") && !p
[1])
8199 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8200 options
->tuntap_options
.register_dns
= true;
8202 else if (streq(p
[0], "block-outside-dns") && !p
[1])
8204 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8205 options
->block_outside_dns
= true;
8207 else if (streq(p
[0], "rdns-internal") && !p
[1])
8208 /* standalone method for internal use
8210 * (if --register-dns is set, openvpn needs to call itself in a
8211 * sub-process to execute the required functions in a non-blocking
8212 * way, and uses --rdns-internal to signal that to itself)
8215 VERIFY_PERMISSION(OPT_P_GENERAL
);
8216 set_debug_level(options
->verbosity
, SDL_CONSTRAIN
);
8217 if (options
->tuntap_options
.register_dns
)
8219 ipconfig_register_dns(NULL
);
8221 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8223 else if (streq(p
[0], "show-valid-subnets") && !p
[1])
8225 VERIFY_PERMISSION(OPT_P_GENERAL
);
8226 show_valid_win32_tun_subnets();
8227 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8229 else if (streq(p
[0], "pause-exit") && !p
[1])
8231 VERIFY_PERMISSION(OPT_P_GENERAL
);
8232 set_pause_exit_win32();
8234 else if (streq(p
[0], "service") && p
[1] && !p
[3])
8236 VERIFY_PERMISSION(OPT_P_GENERAL
);
8237 options
->exit_event_name
= p
[1];
8240 options
->exit_event_initial_state
= (atoi(p
[2]) != 0);
8243 else if (streq(p
[0], "allow-nonadmin") && !p
[2])
8245 VERIFY_PERMISSION(OPT_P_GENERAL
);
8246 tap_allow_nonadmin_access(p
[1]);
8247 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8249 else if (streq(p
[0], "user") && p
[1] && !p
[2])
8251 VERIFY_PERMISSION(OPT_P_GENERAL
);
8252 msg(M_WARN
, "NOTE: --user option is not implemented on Windows");
8254 else if (streq(p
[0], "group") && p
[1] && !p
[2])
8256 VERIFY_PERMISSION(OPT_P_GENERAL
);
8257 msg(M_WARN
, "NOTE: --group option is not implemented on Windows");
8259 #else /* ifdef _WIN32 */
8260 else if (streq(p
[0], "user") && p
[1] && !p
[2])
8262 VERIFY_PERMISSION(OPT_P_GENERAL
);
8263 options
->username
= p
[1];
8265 else if (streq(p
[0], "group") && p
[1] && !p
[2])
8267 VERIFY_PERMISSION(OPT_P_GENERAL
);
8268 options
->groupname
= p
[1];
8270 else if (streq(p
[0], "dhcp-option") && p
[1] && !p
[3])
8272 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8273 setenv_foreign_option(options
, (const char **)p
, 3, es
);
8275 else if (streq(p
[0], "route-method") && p
[1] && !p
[2]) /* ignore when pushed to non-Windows OS */
8277 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
8279 #endif /* ifdef _WIN32 */
8280 #if PASSTOS_CAPABILITY
8281 else if (streq(p
[0], "passtos") && !p
[1])
8283 VERIFY_PERMISSION(OPT_P_GENERAL
);
8284 options
->passtos
= true;
8287 #if defined(USE_COMP)
8288 else if (streq(p
[0], "allow-compression") && p
[1] && !p
[2])
8290 VERIFY_PERMISSION(OPT_P_GENERAL
);
8292 if (streq(p
[1], "no"))
8294 options
->comp
.flags
=
8295 COMP_F_ALLOW_STUB_ONLY
|COMP_F_ADVERTISE_STUBS_ONLY
;
8296 if (comp_non_stub_enabled(&options
->comp
))
8298 msg(msglevel
, "'--allow-compression no' conflicts with "
8299 " enabling compression");
8302 else if (options
->comp
.flags
& COMP_F_ALLOW_STUB_ONLY
)
8304 /* Also printed on a push to hint at configuration problems */
8305 msg(msglevel
, "Cannot set allow-compression to '%s' "
8306 "after set to 'no'", p
[1]);
8309 else if (streq(p
[1], "asym"))
8311 options
->comp
.flags
&= ~COMP_F_ALLOW_COMPRESS
;
8312 options
->comp
.flags
|= COMP_F_ALLOW_ASYM
;
8314 else if (streq(p
[1], "yes"))
8316 msg(M_WARN
, "WARNING: Compression for sending and receiving enabled. Compression has "
8317 "been used in the past to break encryption. Allowing compression allows "
8318 "attacks that break encryption. Using \"--allow-compression yes\" is "
8319 "strongly discouraged for common usage. See --compress in the manual "
8320 "page for more information ");
8322 options
->comp
.flags
|= COMP_F_ALLOW_COMPRESS
;
8326 msg(msglevel
, "bad allow-compression option: %s -- "
8327 "must be 'yes', 'no', or 'asym'", p
[1]);
8331 else if (streq(p
[0], "comp-lzo") && !p
[2])
8333 VERIFY_PERMISSION(OPT_P_COMP
);
8335 /* All lzo variants do not use swap */
8336 options
->comp
.flags
&= ~COMP_F_SWAP
;
8337 #if defined(ENABLE_LZO)
8338 if (p
[1] && streq(p
[1], "no"))
8341 options
->comp
.alg
= COMP_ALG_STUB
;
8342 options
->comp
.flags
&= ~COMP_F_ADAPTIVE
;
8344 #if defined(ENABLE_LZO)
8345 else if (options
->comp
.flags
& COMP_F_ALLOW_STUB_ONLY
)
8347 /* Also printed on a push to hint at configuration problems */
8348 msg(msglevel
, "Cannot set comp-lzo to '%s', "
8349 "allow-compression is set to 'no'", p
[1]);
8354 if (streq(p
[1], "yes"))
8356 options
->comp
.alg
= COMP_ALG_LZO
;
8357 options
->comp
.flags
&= ~COMP_F_ADAPTIVE
;
8359 else if (streq(p
[1], "adaptive"))
8361 options
->comp
.alg
= COMP_ALG_LZO
;
8362 options
->comp
.flags
|= COMP_F_ADAPTIVE
;
8366 msg(msglevel
, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'", p
[1]);
8372 options
->comp
.alg
= COMP_ALG_LZO
;
8373 options
->comp
.flags
|= COMP_F_ADAPTIVE
;
8375 show_compression_warning(&options
->comp
);
8376 #endif /* if defined(ENABLE_LZO) */
8378 else if (streq(p
[0], "comp-noadapt") && !p
[1])
8381 * We do not need to check here if we allow compression since
8382 * it only modifies a flag if compression is enabled
8384 VERIFY_PERMISSION(OPT_P_COMP
);
8385 options
->comp
.flags
&= ~COMP_F_ADAPTIVE
;
8387 else if (streq(p
[0], "compress") && !p
[2])
8389 VERIFY_PERMISSION(OPT_P_COMP
);
8392 if (streq(p
[1], "stub"))
8394 options
->comp
.alg
= COMP_ALG_STUB
;
8395 options
->comp
.flags
|= (COMP_F_SWAP
|COMP_F_ADVERTISE_STUBS_ONLY
);
8397 else if (streq(p
[1], "stub-v2"))
8399 options
->comp
.alg
= COMP_ALGV2_UNCOMPRESSED
;
8400 options
->comp
.flags
|= COMP_F_ADVERTISE_STUBS_ONLY
;
8402 else if (streq(p
[1], "migrate"))
8404 options
->comp
.alg
= COMP_ALG_UNDEF
;
8405 options
->comp
.flags
= COMP_F_MIGRATE
;
8408 else if (options
->comp
.flags
& COMP_F_ALLOW_STUB_ONLY
)
8410 /* Also printed on a push to hint at configuration problems */
8411 msg(msglevel
, "Cannot set compress to '%s', "
8412 "allow-compression is set to 'no'", p
[1]);
8415 #if defined(ENABLE_LZO)
8416 else if (streq(p
[1], "lzo"))
8418 options
->comp
.alg
= COMP_ALG_LZO
;
8419 options
->comp
.flags
&= ~(COMP_F_ADAPTIVE
| COMP_F_SWAP
);
8422 #if defined(ENABLE_LZ4)
8423 else if (streq(p
[1], "lz4"))
8425 options
->comp
.alg
= COMP_ALG_LZ4
;
8426 options
->comp
.flags
|= COMP_F_SWAP
;
8428 else if (streq(p
[1], "lz4-v2"))
8430 options
->comp
.alg
= COMP_ALGV2_LZ4
;
8435 msg(msglevel
, "bad comp option: %s", p
[1]);
8441 options
->comp
.alg
= COMP_ALG_STUB
;
8442 options
->comp
.flags
|= COMP_F_SWAP
;
8444 show_compression_warning(&options
->comp
);
8446 #endif /* USE_COMP */
8447 else if (streq(p
[0], "show-ciphers") && !p
[1])
8449 VERIFY_PERMISSION(OPT_P_GENERAL
);
8450 options
->show_ciphers
= true;
8452 else if (streq(p
[0], "show-digests") && !p
[1])
8454 VERIFY_PERMISSION(OPT_P_GENERAL
);
8455 options
->show_digests
= true;
8457 else if (streq(p
[0], "show-engines") && !p
[1])
8459 VERIFY_PERMISSION(OPT_P_GENERAL
);
8460 options
->show_engines
= true;
8462 else if (streq(p
[0], "key-direction") && p
[1] && !p
[2])
8466 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
8468 key_direction
= ascii2keydirection(msglevel
, p
[1]);
8469 if (key_direction
>= 0)
8471 if (permission_mask
& OPT_P_GENERAL
)
8473 options
->key_direction
= key_direction
;
8475 else if (permission_mask
& OPT_P_CONNECTION
)
8477 options
->ce
.key_direction
= key_direction
;
8485 else if (streq(p
[0], "secret") && p
[1] && !p
[3])
8487 msg(M_WARN
, "DEPRECATED OPTION: The option --secret is deprecated.");
8488 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8489 options
->shared_secret_file
= p
[1];
8490 options
->shared_secret_file_inline
= is_inline
;
8491 if (!is_inline
&& p
[2])
8495 key_direction
= ascii2keydirection(msglevel
, p
[2]);
8496 if (key_direction
>= 0)
8498 options
->key_direction
= key_direction
;
8506 else if (streq(p
[0], "genkey") && !p
[4])
8508 VERIFY_PERMISSION(OPT_P_GENERAL
);
8509 options
->genkey
= true;
8512 options
->genkey_type
= GENKEY_SECRET
;
8516 if (streq(p
[1], "secret") || streq(p
[1], "tls-auth")
8517 || streq(p
[1], "tls-crypt"))
8519 options
->genkey_type
= GENKEY_SECRET
;
8521 else if (streq(p
[1], "tls-crypt-v2-server"))
8523 options
->genkey_type
= GENKEY_TLS_CRYPTV2_SERVER
;
8525 else if (streq(p
[1], "tls-crypt-v2-client"))
8527 options
->genkey_type
= GENKEY_TLS_CRYPTV2_CLIENT
;
8530 options
->genkey_extra_data
= p
[3];
8533 else if (streq(p
[1], "auth-token"))
8535 options
->genkey_type
= GENKEY_AUTH_TOKEN
;
8539 msg(msglevel
, "unknown --genkey type: %s", p
[1]);
8545 options
->genkey_filename
= p
[2];
8548 else if (streq(p
[0], "auth") && p
[1] && !p
[2])
8550 VERIFY_PERMISSION(OPT_P_GENERAL
);
8551 options
->authname
= p
[1];
8553 else if (streq(p
[0], "cipher") && p
[1] && !p
[2])
8555 VERIFY_PERMISSION(OPT_P_NCP
|OPT_P_INSTANCE
);
8556 options
->ciphername
= p
[1];
8558 else if (streq(p
[0], "data-ciphers-fallback") && p
[1] && !p
[2])
8560 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INSTANCE
);
8561 options
->ciphername
= p
[1];
8562 options
->enable_ncp_fallback
= true;
8564 else if ((streq(p
[0], "data-ciphers") || streq(p
[0], "ncp-ciphers"))
8567 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INSTANCE
);
8568 if (streq(p
[0], "ncp-ciphers"))
8570 msg(M_INFO
, "Note: Treating option '--ncp-ciphers' as "
8571 " '--data-ciphers' (renamed in OpenVPN 2.5).");
8573 options
->ncp_ciphers
= p
[1];
8575 else if (streq(p
[0], "key-derivation") && p
[1])
8577 /* NCP only option that is pushed by the server to enable EKM,
8578 * should not be used by normal users in config files*/
8579 VERIFY_PERMISSION(OPT_P_NCP
)
8580 #ifdef HAVE_EXPORT_KEYING_MATERIAL
8581 if (streq(p
[1], "tls-ekm"))
8583 options
->imported_protocol_flags
|= CO_USE_TLS_KEY_MATERIAL_EXPORT
;
8588 msg(msglevel
, "Unknown key-derivation method %s", p
[1]);
8591 else if (streq(p
[0], "protocol-flags") && p
[1])
8593 /* NCP only option that is pushed by the server to enable protocol
8594 * features that are negotiated, should not be used by normal users
8595 * in config files */
8596 VERIFY_PERMISSION(OPT_P_NCP
)
8597 for (size_t j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; j
++)
8599 if (streq(p
[j
], "cc-exit"))
8601 options
->imported_protocol_flags
|= CO_USE_CC_EXIT_NOTIFY
;
8603 #ifdef HAVE_EXPORT_KEYING_MATERIAL
8604 else if (streq(p
[j
], "tls-ekm"))
8606 options
->imported_protocol_flags
|= CO_USE_TLS_KEY_MATERIAL_EXPORT
;
8611 msg(msglevel
, "Unknown protocol-flags flag: %s", p
[j
]);
8615 else if (streq(p
[0], "prng") && p
[1] && !p
[3])
8617 msg(M_WARN
, "NOTICE: --prng option ignored (SSL library PRNG is used)");
8619 else if (streq(p
[0], "no-replay") && !p
[1])
8621 VERIFY_PERMISSION(OPT_P_GENERAL
);
8622 options
->replay
= false;
8624 else if (streq(p
[0], "replay-window") && !p
[3])
8626 VERIFY_PERMISSION(OPT_P_GENERAL
);
8631 replay_window
= atoi(p
[1]);
8632 if (!(MIN_SEQ_BACKTRACK
<= replay_window
&& replay_window
<= MAX_SEQ_BACKTRACK
))
8634 msg(msglevel
, "replay-window window size parameter (%d) must be between %d and %d",
8640 options
->replay_window
= replay_window
;
8646 replay_time
= atoi(p
[2]);
8647 if (!(MIN_TIME_BACKTRACK
<= replay_time
&& replay_time
<= MAX_TIME_BACKTRACK
))
8649 msg(msglevel
, "replay-window time window parameter (%d) must be between %d and %d",
8652 MAX_TIME_BACKTRACK
);
8655 options
->replay_time
= replay_time
;
8660 msg(msglevel
, "replay-window option is missing window size parameter");
8664 else if (streq(p
[0], "mute-replay-warnings") && !p
[1])
8666 VERIFY_PERMISSION(OPT_P_GENERAL
);
8667 options
->mute_replay_warnings
= true;
8669 else if (streq(p
[0], "replay-persist") && p
[1] && !p
[2])
8671 VERIFY_PERMISSION(OPT_P_GENERAL
);
8672 options
->packet_id_file
= p
[1];
8674 else if (streq(p
[0], "test-crypto") && !p
[1])
8676 VERIFY_PERMISSION(OPT_P_GENERAL
);
8677 options
->test_crypto
= true;
8679 #ifndef ENABLE_CRYPTO_MBEDTLS
8680 else if (streq(p
[0], "engine") && !p
[2])
8682 VERIFY_PERMISSION(OPT_P_GENERAL
);
8685 options
->engine
= p
[1];
8689 options
->engine
= "auto";
8692 #endif /* ENABLE_CRYPTO_MBEDTLS */
8693 else if (streq(p
[0], "providers") && p
[1])
8695 for (size_t j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; j
++)
8697 options
->providers
.names
[j
] = p
[j
];
8700 #ifdef ENABLE_PREDICTION_RESISTANCE
8701 else if (streq(p
[0], "use-prediction-resistance") && !p
[1])
8703 VERIFY_PERMISSION(OPT_P_GENERAL
);
8704 options
->use_prediction_resistance
= true;
8707 else if (streq(p
[0], "show-tls") && !p
[1])
8709 VERIFY_PERMISSION(OPT_P_GENERAL
);
8710 options
->show_tls_ciphers
= true;
8712 else if ((streq(p
[0], "show-curves") || streq(p
[0], "show-groups")) && !p
[1])
8714 VERIFY_PERMISSION(OPT_P_GENERAL
);
8715 options
->show_curves
= true;
8717 else if (streq(p
[0], "ecdh-curve") && p
[1] && !p
[2])
8719 VERIFY_PERMISSION(OPT_P_GENERAL
);
8720 msg(M_WARN
, "Consider setting groups/curves preference with "
8721 "tls-groups instead of forcing a specific curve with "
8723 options
->ecdh_curve
= p
[1];
8725 else if (streq(p
[0], "tls-server") && !p
[1])
8727 VERIFY_PERMISSION(OPT_P_GENERAL
);
8728 options
->tls_server
= true;
8730 else if (streq(p
[0], "tls-client") && !p
[1])
8732 VERIFY_PERMISSION(OPT_P_GENERAL
);
8733 options
->tls_client
= true;
8735 else if (streq(p
[0], "ca") && p
[1] && !p
[2])
8737 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8738 options
->ca_file
= p
[1];
8739 options
->ca_file_inline
= is_inline
;
8741 #ifndef ENABLE_CRYPTO_MBEDTLS
8742 else if (streq(p
[0], "capath") && p
[1] && !p
[2])
8744 VERIFY_PERMISSION(OPT_P_GENERAL
);
8745 options
->ca_path
= p
[1];
8747 #endif /* ENABLE_CRYPTO_MBEDTLS */
8748 else if (streq(p
[0], "dh") && p
[1] && !p
[2])
8750 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8751 options
->dh_file
= p
[1];
8752 options
->dh_file_inline
= is_inline
;
8754 else if (streq(p
[0], "cert") && p
[1] && !p
[2])
8756 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8757 options
->cert_file
= p
[1];
8758 options
->cert_file_inline
= is_inline
;
8760 else if (streq(p
[0], "extra-certs") && p
[1] && !p
[2])
8762 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8763 options
->extra_certs_file
= p
[1];
8764 options
->extra_certs_file_inline
= is_inline
;
8766 else if ((streq(p
[0], "verify-hash") && p
[1] && !p
[3])
8767 || (streq(p
[0], "peer-fingerprint") && p
[1] && !p
[2]))
8769 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8771 int verify_hash_depth
= 0;
8772 if (streq(p
[0], "verify-hash"))
8774 msg(M_WARN
, "DEPRECATED OPTION: The option --verify-hash is deprecated. "
8775 "You should switch to the either use the level 1 certificate as "
8776 "--ca option, use --tls-verify or use --peer-fingerprint");
8777 /* verify level 1 cert, i.e. the CA that signed the leaf cert */
8778 verify_hash_depth
= 1;
8781 options
->verify_hash_algo
= MD_SHA256
;
8783 int digest_len
= SHA256_DIGEST_LENGTH
;
8785 if (options
->verify_hash
&& options
->verify_hash_depth
!= verify_hash_depth
)
8787 msg(msglevel
, "ERROR: Setting %s not allowed. --verify-hash and"
8788 " --peer-fingerprint are mutually exclusive", p
[0]);
8792 if (streq(p
[0], "verify-hash"))
8794 if ((!p
[2] && !is_inline
) || (p
[2] && streq(p
[2], "SHA1")))
8796 options
->verify_hash_algo
= MD_SHA1
;
8797 digest_len
= SHA_DIGEST_LENGTH
;
8799 else if (p
[2] && !streq(p
[2], "SHA256"))
8801 msg(msglevel
, "invalid or unsupported hashing algorithm: %s "
8802 "(only SHA1 and SHA256 are supported)", p
[2]);
8807 struct verify_hash_list
*newlist
;
8808 newlist
= parse_hash_fingerprint_multiline(p
[1], digest_len
,
8809 msglevel
, &options
->gc
);
8811 /* Append the new list to the end of our current list */
8812 if (!options
->verify_hash
)
8814 options
->verify_hash
= newlist
;
8815 options
->verify_hash_depth
= verify_hash_depth
;
8819 /* since both the old and new list can have multiple entries
8820 * we need to go to the end of one of them to concatenate them */
8821 struct verify_hash_list
*listend
= options
->verify_hash
;
8822 while (listend
->next
)
8824 listend
= listend
->next
;
8826 listend
->next
= newlist
;
8829 #ifdef ENABLE_CRYPTOAPI
8830 else if (streq(p
[0], "cryptoapicert") && p
[1] && !p
[2])
8832 VERIFY_PERMISSION(OPT_P_GENERAL
);
8833 options
->cryptoapi_cert
= p
[1];
8836 else if (streq(p
[0], "key") && p
[1] && !p
[2])
8838 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8839 options
->priv_key_file
= p
[1];
8840 options
->priv_key_file_inline
= is_inline
;
8842 else if (streq(p
[0], "tls-version-min") && p
[1] && !p
[3])
8845 VERIFY_PERMISSION(OPT_P_GENERAL
);
8846 ver
= tls_version_parse(p
[1], p
[2]);
8847 if (ver
== TLS_VER_BAD
)
8849 msg(msglevel
, "unknown tls-version-min parameter: %s", p
[1]);
8852 options
->ssl_flags
&=
8853 ~(SSLF_TLS_VERSION_MIN_MASK
<< SSLF_TLS_VERSION_MIN_SHIFT
);
8854 options
->ssl_flags
|= (ver
<< SSLF_TLS_VERSION_MIN_SHIFT
);
8856 else if (streq(p
[0], "tls-version-max") && p
[1] && !p
[2])
8859 VERIFY_PERMISSION(OPT_P_GENERAL
);
8860 ver
= tls_version_parse(p
[1], NULL
);
8861 if (ver
== TLS_VER_BAD
)
8863 msg(msglevel
, "unknown tls-version-max parameter: %s", p
[1]);
8866 options
->ssl_flags
&=
8867 ~(SSLF_TLS_VERSION_MAX_MASK
<< SSLF_TLS_VERSION_MAX_SHIFT
);
8868 options
->ssl_flags
|= (ver
<< SSLF_TLS_VERSION_MAX_SHIFT
);
8870 #ifndef ENABLE_CRYPTO_MBEDTLS
8871 else if (streq(p
[0], "pkcs12") && p
[1] && !p
[2])
8873 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8874 options
->pkcs12_file
= p
[1];
8875 options
->pkcs12_file_inline
= is_inline
;
8877 #endif /* ENABLE_CRYPTO_MBEDTLS */
8878 else if (streq(p
[0], "askpass") && !p
[2])
8880 VERIFY_PERMISSION(OPT_P_GENERAL
);
8883 options
->key_pass_file
= p
[1];
8887 options
->key_pass_file
= "stdin";
8890 else if (streq(p
[0], "auth-nocache") && !p
[1])
8892 VERIFY_PERMISSION(OPT_P_GENERAL
);
8893 ssl_set_auth_nocache();
8895 else if (streq(p
[0], "auth-token") && p
[1] && !p
[2])
8897 VERIFY_PERMISSION(OPT_P_ECHO
);
8898 ssl_set_auth_token(p
[1]);
8899 #ifdef ENABLE_MANAGEMENT
8902 management_auth_token(management
, p
[1]);
8906 else if (streq(p
[0], "auth-token-user") && p
[1] && !p
[2])
8908 VERIFY_PERMISSION(OPT_P_ECHO
);
8909 ssl_set_auth_token_user(p
[1]);
8911 else if (streq(p
[0], "single-session") && !p
[1])
8913 VERIFY_PERMISSION(OPT_P_GENERAL
);
8914 options
->single_session
= true;
8916 else if (streq(p
[0], "push-peer-info") && !p
[1])
8918 VERIFY_PERMISSION(OPT_P_GENERAL
);
8919 options
->push_peer_info
= true;
8921 else if (streq(p
[0], "tls-exit") && !p
[1])
8923 VERIFY_PERMISSION(OPT_P_GENERAL
);
8924 options
->tls_exit
= true;
8926 else if (streq(p
[0], "tls-cipher") && p
[1] && !p
[2])
8928 VERIFY_PERMISSION(OPT_P_GENERAL
);
8929 options
->cipher_list
= p
[1];
8931 else if (streq(p
[0], "tls-cert-profile") && p
[1] && !p
[2])
8933 VERIFY_PERMISSION(OPT_P_GENERAL
);
8934 options
->tls_cert_profile
= p
[1];
8936 else if (streq(p
[0], "tls-ciphersuites") && p
[1] && !p
[2])
8938 VERIFY_PERMISSION(OPT_P_GENERAL
);
8939 options
->cipher_list_tls13
= p
[1];
8941 else if (streq(p
[0], "tls-groups") && p
[1] && !p
[2])
8943 VERIFY_PERMISSION(OPT_P_GENERAL
);
8944 options
->tls_groups
= p
[1];
8946 else if (streq(p
[0], "crl-verify") && p
[1] && ((p
[2] && streq(p
[2], "dir"))
8949 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8950 if (p
[2] && streq(p
[2], "dir"))
8952 options
->ssl_flags
|= SSLF_CRL_VERIFY_DIR
;
8954 options
->crl_file
= p
[1];
8955 options
->crl_file_inline
= is_inline
;
8957 else if (streq(p
[0], "tls-verify") && p
[1])
8959 VERIFY_PERMISSION(OPT_P_SCRIPT
);
8960 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
8964 set_user_script(options
, &options
->tls_verify
,
8965 string_substitute(p
[1], ',', ' ', &options
->gc
),
8966 "tls-verify", true);
8968 #ifndef ENABLE_CRYPTO_MBEDTLS
8969 else if (streq(p
[0], "tls-export-cert") && p
[1] && !p
[2])
8971 VERIFY_PERMISSION(OPT_P_GENERAL
);
8972 options
->tls_export_cert
= p
[1];
8975 else if (streq(p
[0], "compat-names"))
8977 VERIFY_PERMISSION(OPT_P_GENERAL
);
8978 msg(msglevel
, "--compat-names was removed in OpenVPN 2.5. "
8979 "Update your configuration.");
8982 else if (streq(p
[0], "no-name-remapping") && !p
[1])
8984 VERIFY_PERMISSION(OPT_P_GENERAL
);
8985 msg(msglevel
, "--no-name-remapping was removed in OpenVPN 2.5. "
8986 "Update your configuration.");
8989 else if (streq(p
[0], "verify-x509-name") && p
[1] && strlen(p
[1]) && !p
[3])
8991 int type
= VERIFY_X509_SUBJECT_DN
;
8992 VERIFY_PERMISSION(OPT_P_GENERAL
);
8995 if (streq(p
[2], "subject"))
8997 type
= VERIFY_X509_SUBJECT_DN
;
8999 else if (streq(p
[2], "name"))
9001 type
= VERIFY_X509_SUBJECT_RDN
;
9003 else if (streq(p
[2], "name-prefix"))
9005 type
= VERIFY_X509_SUBJECT_RDN_PREFIX
;
9009 msg(msglevel
, "unknown X.509 name type: %s", p
[2]);
9013 options
->verify_x509_type
= type
;
9014 options
->verify_x509_name
= p
[1];
9016 else if (streq(p
[0], "ns-cert-type") && p
[1] && !p
[2])
9018 VERIFY_PERMISSION(OPT_P_GENERAL
);
9019 if (streq(p
[1], "server"))
9021 options
->ns_cert_type
= NS_CERT_CHECK_SERVER
;
9023 else if (streq(p
[1], "client"))
9025 options
->ns_cert_type
= NS_CERT_CHECK_CLIENT
;
9029 msg(msglevel
, "--ns-cert-type must be 'client' or 'server'");
9033 else if (streq(p
[0], "remote-cert-ku"))
9035 VERIFY_PERMISSION(OPT_P_GENERAL
);
9038 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9040 sscanf(p
[j
], "%x", &(options
->remote_cert_ku
[j
-1]));
9044 /* No specific KU required, but require KU to be present */
9045 options
->remote_cert_ku
[0] = OPENVPN_KU_REQUIRED
;
9048 else if (streq(p
[0], "remote-cert-eku") && p
[1] && !p
[2])
9050 VERIFY_PERMISSION(OPT_P_GENERAL
);
9051 options
->remote_cert_eku
= p
[1];
9053 else if (streq(p
[0], "remote-cert-tls") && p
[1] && !p
[2])
9055 VERIFY_PERMISSION(OPT_P_GENERAL
);
9057 if (streq(p
[1], "server"))
9059 options
->remote_cert_ku
[0] = OPENVPN_KU_REQUIRED
;
9060 options
->remote_cert_eku
= "TLS Web Server Authentication";
9062 else if (streq(p
[1], "client"))
9064 options
->remote_cert_ku
[0] = OPENVPN_KU_REQUIRED
;
9065 options
->remote_cert_eku
= "TLS Web Client Authentication";
9069 msg(msglevel
, "--remote-cert-tls must be 'client' or 'server'");
9073 else if (streq(p
[0], "tls-timeout") && p
[1] && !p
[2])
9075 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9076 options
->tls_timeout
= positive_atoi(p
[1]);
9078 else if (streq(p
[0], "reneg-bytes") && p
[1] && !p
[2])
9080 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9081 options
->renegotiate_bytes
= positive_atoi(p
[1]);
9083 else if (streq(p
[0], "reneg-pkts") && p
[1] && !p
[2])
9085 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9086 options
->renegotiate_packets
= positive_atoi(p
[1]);
9088 else if (streq(p
[0], "reneg-sec") && p
[1] && !p
[3])
9090 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9091 options
->renegotiate_seconds
= positive_atoi(p
[1]);
9094 options
->renegotiate_seconds_min
= positive_atoi(p
[2]);
9097 else if (streq(p
[0], "hand-window") && p
[1] && !p
[2])
9099 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9100 options
->handshake_window
= positive_atoi(p
[1]);
9102 else if (streq(p
[0], "tran-window") && p
[1] && !p
[2])
9104 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9105 options
->transition_window
= positive_atoi(p
[1]);
9107 else if (streq(p
[0], "tls-auth") && p
[1] && !p
[3])
9109 int key_direction
= -1;
9111 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_INLINE
);
9113 if (permission_mask
& OPT_P_GENERAL
)
9115 options
->tls_auth_file
= p
[1];
9116 options
->tls_auth_file_inline
= is_inline
;
9118 if (!is_inline
&& p
[2])
9120 key_direction
= ascii2keydirection(msglevel
, p
[2]);
9121 if (key_direction
< 0)
9125 options
->key_direction
= key_direction
;
9129 else if (permission_mask
& OPT_P_CONNECTION
)
9131 options
->ce
.tls_auth_file
= p
[1];
9132 options
->ce
.tls_auth_file_inline
= is_inline
;
9133 options
->ce
.key_direction
= KEY_DIRECTION_BIDIRECTIONAL
;
9135 if (!is_inline
&& p
[2])
9137 key_direction
= ascii2keydirection(msglevel
, p
[2]);
9138 if (key_direction
< 0)
9142 options
->ce
.key_direction
= key_direction
;
9146 else if (streq(p
[0], "tls-crypt") && p
[1] && !p
[3])
9148 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_INLINE
);
9149 if (permission_mask
& OPT_P_GENERAL
)
9151 options
->tls_crypt_file
= p
[1];
9152 options
->tls_crypt_file_inline
= is_inline
;
9154 else if (permission_mask
& OPT_P_CONNECTION
)
9156 options
->ce
.tls_crypt_file
= p
[1];
9157 options
->ce
.tls_crypt_file_inline
= is_inline
;
9160 else if (streq(p
[0], "tls-crypt-v2") && p
[1] && !p
[3])
9162 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_INLINE
);
9163 if (permission_mask
& OPT_P_GENERAL
)
9165 options
->tls_crypt_v2_file
= p
[1];
9166 options
->tls_crypt_v2_file_inline
= is_inline
;
9168 else if (permission_mask
& OPT_P_CONNECTION
)
9170 options
->ce
.tls_crypt_v2_file
= p
[1];
9171 options
->ce
.tls_crypt_v2_file_inline
= is_inline
;
9174 if (p
[2] && streq(p
[2], "force-cookie"))
9176 options
->ce
.tls_crypt_v2_force_cookie
= true;
9178 else if (p
[2] && streq(p
[2], "allow-noncookie"))
9180 options
->ce
.tls_crypt_v2_force_cookie
= false;
9184 msg(msglevel
, "Unsupported tls-crypt-v2 argument: %s", p
[2]);
9187 else if (streq(p
[0], "tls-crypt-v2-verify") && p
[1] && !p
[2])
9189 VERIFY_PERMISSION(OPT_P_GENERAL
);
9190 options
->tls_crypt_v2_verify_script
= p
[1];
9192 else if (streq(p
[0], "x509-track") && p
[1] && !p
[2])
9194 VERIFY_PERMISSION(OPT_P_GENERAL
);
9195 x509_track_add(&options
->x509_track
, p
[1], msglevel
, &options
->gc
);
9197 #ifdef ENABLE_X509ALTUSERNAME
9198 else if (streq(p
[0], "x509-username-field") && p
[1])
9200 /* This option used to automatically upcase the fieldnames passed as the
9201 * option arguments, e.g., "ou" became "OU". Now, this "helpfulness" is
9202 * fine-tuned by only upcasing Subject field attribute names which consist
9203 * of all lower-case characters. Mixed-case attributes such as
9204 * "emailAddress" are left as-is. An option parameter having the "ext:"
9205 * prefix for matching X.509v3 extended fields will also remain unchanged.
9207 VERIFY_PERMISSION(OPT_P_GENERAL
);
9208 for (size_t j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9212 if (strncmp("ext:", s
, 4) != 0)
9215 while (s
[i
] && !isupper(s
[i
]))
9221 while ((*s
= toupper(*s
)) != '\0')
9225 msg(M_WARN
, "DEPRECATED FEATURE: automatically upcased the "
9226 "--x509-username-field parameter to '%s'; please update your"
9227 "configuration", p
[j
]);
9230 else if (!x509_username_field_ext_supported(s
+4))
9232 msg(msglevel
, "Unsupported x509-username-field extension: %s", s
);
9234 options
->x509_username_field
[j
-1] = p
[j
];
9237 #endif /* ENABLE_X509ALTUSERNAME */
9238 #ifdef ENABLE_PKCS11
9239 else if (streq(p
[0], "show-pkcs11-ids") && !p
[3])
9241 char *provider
= p
[1];
9242 bool cert_private
= (p
[2] == NULL
? false : ( atoi(p
[2]) != 0 ));
9244 #ifdef DEFAULT_PKCS11_MODULE
9247 provider
= DEFAULT_PKCS11_MODULE
;
9252 int i
= strtol(provider
, &endp
, 10);
9256 /* There was one argument, and it was purely numeric.
9257 * Interpret it as the cert_private argument */
9258 provider
= DEFAULT_PKCS11_MODULE
;
9262 #else /* ifdef DEFAULT_PKCS11_MODULE */
9265 msg(msglevel
, "--show-pkcs11-ids requires a provider parameter");
9268 #endif /* ifdef DEFAULT_PKCS11_MODULE */
9269 VERIFY_PERMISSION(OPT_P_GENERAL
);
9271 set_debug_level(options
->verbosity
, SDL_CONSTRAIN
);
9272 show_pkcs11_ids(provider
, cert_private
);
9273 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
9275 else if (streq(p
[0], "pkcs11-providers") && p
[1])
9279 VERIFY_PERMISSION(OPT_P_GENERAL
);
9281 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9283 options
->pkcs11_providers
[j
-1] = p
[j
];
9286 else if (streq(p
[0], "pkcs11-protected-authentication"))
9290 VERIFY_PERMISSION(OPT_P_GENERAL
);
9292 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9294 options
->pkcs11_protected_authentication
[j
-1] = atoi(p
[j
]) != 0 ? 1 : 0;
9297 else if (streq(p
[0], "pkcs11-private-mode") && p
[1])
9301 VERIFY_PERMISSION(OPT_P_GENERAL
);
9303 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9305 sscanf(p
[j
], "%x", &(options
->pkcs11_private_mode
[j
-1]));
9308 else if (streq(p
[0], "pkcs11-cert-private"))
9312 VERIFY_PERMISSION(OPT_P_GENERAL
);
9314 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9316 options
->pkcs11_cert_private
[j
-1] = atoi(p
[j
]) != 0 ? 1 : 0;
9319 else if (streq(p
[0], "pkcs11-pin-cache") && p
[1] && !p
[2])
9321 VERIFY_PERMISSION(OPT_P_GENERAL
);
9322 options
->pkcs11_pin_cache_period
= atoi(p
[1]);
9324 else if (streq(p
[0], "pkcs11-id") && p
[1] && !p
[2])
9326 VERIFY_PERMISSION(OPT_P_GENERAL
);
9327 options
->pkcs11_id
= p
[1];
9329 else if (streq(p
[0], "pkcs11-id-management") && !p
[1])
9331 VERIFY_PERMISSION(OPT_P_GENERAL
);
9332 options
->pkcs11_id_management
= true;
9334 #endif /* ifdef ENABLE_PKCS11 */
9335 else if (streq(p
[0], "rmtun") && !p
[1])
9337 VERIFY_PERMISSION(OPT_P_GENERAL
);
9338 options
->persist_config
= true;
9339 options
->persist_mode
= 0;
9341 else if (streq(p
[0], "mktun") && !p
[1])
9343 VERIFY_PERMISSION(OPT_P_GENERAL
);
9344 options
->persist_config
= true;
9345 options
->persist_mode
= 1;
9347 else if (streq(p
[0], "peer-id") && p
[1] && !p
[2])
9349 VERIFY_PERMISSION(OPT_P_PEER_ID
);
9350 options
->use_peer_id
= true;
9351 options
->peer_id
= atoi(p
[1]);
9353 #ifdef HAVE_EXPORT_KEYING_MATERIAL
9354 else if (streq(p
[0], "keying-material-exporter") && p
[1] && p
[2])
9356 int ekm_length
= positive_atoi(p
[2]);
9358 VERIFY_PERMISSION(OPT_P_GENERAL
);
9360 if (strncmp(p
[1], "EXPORTER", 8))
9362 msg(msglevel
, "Keying material exporter label must begin with "
9366 if (streq(p
[1], EXPORT_KEY_DATA_LABEL
))
9368 msg(msglevel
, "Keying material exporter label must not be '"
9369 EXPORT_KEY_DATA_LABEL
"'.");
9371 if (ekm_length
< 16 || ekm_length
> 4095)
9373 msg(msglevel
, "Invalid keying material exporter length");
9377 options
->keying_material_exporter_label
= p
[1];
9378 options
->keying_material_exporter_length
= ekm_length
;
9380 #endif /* HAVE_EXPORT_KEYING_MATERIAL */
9381 else if (streq(p
[0], "allow-recursive-routing") && !p
[1])
9383 VERIFY_PERMISSION(OPT_P_GENERAL
);
9384 options
->allow_recursive_routing
= true;
9386 else if (streq(p
[0], "vlan-tagging") && !p
[1])
9388 VERIFY_PERMISSION(OPT_P_GENERAL
);
9389 options
->vlan_tagging
= true;
9391 else if (streq(p
[0], "vlan-accept") && p
[1] && !p
[2])
9393 VERIFY_PERMISSION(OPT_P_GENERAL
);
9394 if (streq(p
[1], "tagged"))
9396 options
->vlan_accept
= VLAN_ONLY_TAGGED
;
9398 else if (streq(p
[1], "untagged"))
9400 options
->vlan_accept
= VLAN_ONLY_UNTAGGED_OR_PRIORITY
;
9402 else if (streq(p
[1], "all"))
9404 options
->vlan_accept
= VLAN_ALL
;
9408 msg(msglevel
, "--vlan-accept must be 'tagged', 'untagged' or 'all'");
9412 else if (streq(p
[0], "vlan-pvid") && p
[1] && !p
[2])
9414 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INSTANCE
);
9415 options
->vlan_pvid
= positive_atoi(p
[1]);
9416 if (options
->vlan_pvid
< OPENVPN_8021Q_MIN_VID
9417 || options
->vlan_pvid
> OPENVPN_8021Q_MAX_VID
)
9420 "the parameter of --vlan-pvid parameters must be >= %u and <= %u",
9421 OPENVPN_8021Q_MIN_VID
, OPENVPN_8021Q_MAX_VID
);
9428 int msglevel
= msglevel_fc
;
9429 /* Check if an option is in --ignore-unknown-option and
9430 * set warning level to non fatal */
9431 for (i
= 0; options
->ignore_unknown_option
&& options
->ignore_unknown_option
[i
]; i
++)
9433 if (streq(p
[0], options
->ignore_unknown_option
[i
]))
9441 msg(msglevel
, "Unrecognized option or missing or extra parameter(s) in %s:%d: %s (%s)", file
, line
, p
[0], PACKAGE_VERSION
);
9445 msg(msglevel
, "Unrecognized option or missing or extra parameter(s): --%s (%s)", p
[0], PACKAGE_VERSION
);