2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
8 * Copyright (C) 2002-2022 OpenVPN Inc <sales@openvpn.net>
9 * Copyright (C) 2008-2022 David Sommerseth <dazo@eurephia.org>
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2
13 * as published by the Free Software Foundation.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, write to the Free Software Foundation, Inc.,
22 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 * 2004-01-28: Added Socks5 proxy support
27 * (Christof Meerwald, http://cmeerw.org)
32 #elif defined(_MSC_VER)
33 #include "config-msvc.h"
35 #ifdef HAVE_CONFIG_VERSION_H
36 #include "config-version.h"
44 #include "run_command.h"
52 #include "packet_id.h"
61 #include "ssl_verify.h"
63 #include "xkey_common.h"
69 const char title_string
[] =
71 #ifdef CONFIGURE_GIT_REVISION
72 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS
"]"
75 #if defined(ENABLE_CRYPTO_MBEDTLS)
77 #elif defined(ENABLE_CRYPTO_OPENSSL)
81 #endif /* defined(ENABLE_CRYPTO_MBEDTLS) */
89 #ifdef ENABLE_COMP_STUB
96 #ifdef PRODUCT_TAP_DEBUG
102 #if ENABLE_IP_PKTINFO
103 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
105 #elif defined(IP_RECVDSTADDR)
113 #ifdef CONFIGURE_GIT_REVISION
114 " built on " __DATE__
120 static const char usage_message
[] =
124 "--config file : Read configuration options from file.\n"
125 "--help : Show options.\n"
126 "--version : Show copyright and version information.\n"
129 "--local host : Local host name or ip address. Implies --bind.\n"
130 "--remote host [port] : Remote host name or ip address.\n"
131 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
132 "--remote-random-hostname : Add a random string to remote DNS name.\n"
133 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
134 "--proto p : Use protocol p for communicating with peer.\n"
135 " p = udp (default), tcp-server, tcp-client\n"
136 " udp4, tcp4-server, tcp4-client\n"
137 " udp6, tcp6-server, tcp6-client\n"
138 "--proto-force p : only consider protocol p in list of connection profiles.\n"
140 "--connect-retry n [m] : For client, number of seconds to wait between\n"
141 " connection retries (default=%d). On repeated retries\n"
142 " the wait time is exponentially increased to a maximum of m\n"
144 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
145 "--http-proxy s p [up] [auth] : Connect to remote host\n"
146 " through an HTTP proxy at address s and port p.\n"
147 " If proxy authentication is required,\n"
148 " up is a file containing username/password on 2 lines, or\n"
149 " 'stdin' to prompt from console. Add auth='ntlm' if\n"
150 " the proxy requires NTLM authentication.\n"
151 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
152 " determine auth method and query for username/password\n"
153 " if needed. auto-nct disables weak proxy auth methods.\n"
154 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
155 " Repeat to set multiple options.\n"
156 " VERSION version (default=1.0)\n"
157 " AGENT user-agent\n"
158 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
159 " address s and port p (default port = 1080).\n"
160 " If proxy authentication is required,\n"
161 " up is a file containing username/password on 2 lines, or\n"
162 " 'stdin' to prompt for console.\n"
163 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
164 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
165 " resolve for n seconds before failing (disabled by default).\n"
166 " Set n=\"infinite\" to retry indefinitely.\n"
167 "--float : Allow remote to change its IP address/port, such as through\n"
168 " DHCP (this is the default if --remote is not used).\n"
169 "--ipchange cmd : Run command cmd on remote ip address initial\n"
170 " setting or change -- execute as: cmd ip-address port#\n"
171 "--port port : TCP/UDP port # for both local and remote.\n"
172 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
173 "--rport port : TCP/UDP port # for remote (default=%s).\n"
174 "--bind : Bind to local address and port. (This is the default unless\n"
175 " --proto tcp-client"
179 "--nobind : Do not bind to local address and port.\n"
180 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n"
181 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
182 " this option only if the tun/tap device used with --dev\n"
183 " does not begin with \"tun\" or \"tap\".\n"
184 "--dev-node node : Explicitly set the device node rather than using\n"
185 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
186 #if defined(ENABLE_DCO)
187 "--disable-dco : Do not attempt using Data Channel Offload.\n"
189 "--lladdr hw : Set the link layer address of the tap device.\n"
190 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
191 #ifdef ENABLE_IPROUTE
192 "--iproute cmd : Use this command instead of default " IPROUTE_PATH
".\n"
194 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
195 " endpoint and rn as a remote endpoint. l & rn should be\n"
196 " swapped on the other peer. l & rn must be private\n"
197 " addresses outside of the subnets used by either peer.\n"
198 " TAP: configure device to use IP address l as a local\n"
199 " endpoint and rn as a subnet mask.\n"
200 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
201 " endpoint (as a /64) and r as remote endpoint\n"
202 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
203 " pass --ifconfig parms by environment to scripts.\n"
204 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
205 " connection doesn't match the remote side.\n"
206 "--route network [netmask] [gateway] [metric] :\n"
207 " Add route to routing table after connection\n"
208 " is established. Multiple routes can be specified.\n"
209 " netmask default: 255.255.255.255\n"
210 " gateway default: taken from --route-gateway or --ifconfig\n"
211 " Specify default by leaving blank or setting to \"default\".\n"
212 "--route-ipv6 network/bits [gateway] [metric] :\n"
213 " Add IPv6 route to routing table after connection\n"
214 " is established. Multiple routes can be specified.\n"
215 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
216 " in --ifconfig-ipv6\n"
217 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
218 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
219 "--route-metric m : Specify a default metric for use with --route.\n"
220 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
221 " adding routes (may be 0). If not specified, routes will\n"
222 " be added immediately after tun/tap open. On Windows, wait\n"
223 " up to w seconds for TUN/TAP adapter to come up.\n"
224 "--route-up cmd : Run command cmd after routes are added.\n"
225 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
226 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
227 " --route-up script using environmental variables.\n"
228 "--route-nopull : When used with --client or --pull, accept options pushed\n"
229 " by server EXCEPT for routes, dns, and dhcp options.\n"
230 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
231 " --ifconfig, --route, and --route-gateway.\n"
232 "--redirect-gateway [flags]: Automatically execute routing\n"
233 " commands to redirect all outgoing IP traffic through the\n"
234 " VPN. Add 'local' flag if both " PACKAGE_NAME
" servers are directly\n"
235 " connected via a common subnet, such as with WiFi.\n"
236 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
237 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
238 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
239 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
240 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
241 " the default gateway. Useful when pushing private subnets.\n"
242 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
243 " ICMPv6 host unreachable messages on the client.\n"
244 " (Server) Instead of forwarding IPv6 packets send\n"
245 " ICMPv6 host unreachable packets to the client.\n"
246 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
247 "--push-peer-info : (client only) push client info to server.\n"
248 "--setenv name value : Set a custom environmental variable to pass to script.\n"
249 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
250 " directives for future OpenVPN versions to be ignored.\n"
251 "--ignore-unkown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
252 " these options to be ignored when unknown\n"
253 "--script-security level: Where level can be:\n"
254 " 0 -- strictly no calling of external programs\n"
255 " 1 -- (default) only call built-ins such as ifconfig\n"
256 " 2 -- allow calling of built-ins and scripts\n"
257 " 3 -- allow password to be passed to scripts via env\n"
258 "--shaper n : Restrict output to peer to n bytes per second.\n"
259 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
260 " ping once every n seconds, restart if ping not received\n"
262 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
263 " produces a combined in/out byte count < bytes.\n"
264 "--session-timeout n: Limit connection time to n seconds.\n"
265 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
266 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
267 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
269 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
270 #if ENABLE_IP_PKTINFO
271 "--multihome : Configure a multi-homed UDP server.\n"
273 "--fast-io : (experimental) Optimize TUN/TAP/UDP writes.\n"
274 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
275 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
276 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
277 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
278 "--persist-key : Don't re-read key files across SIGUSR1 or --ping-restart.\n"
279 #if PASSTOS_CAPABILITY
280 "--passtos : TOS passthrough (applies to IPv4 only).\n"
282 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
283 " TCP/UDP MTU from it (default=%d).\n"
284 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
285 " as n bytes more than the tun-mtu size on read\n"
286 " (default TUN=0 TAP=%d).\n"
287 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
289 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
290 " 'no' -- Never send DF (Don't Fragment) frames\n"
291 " 'maybe' -- Use per-route hints\n"
292 " 'yes' -- Always DF (Don't Fragment)\n"
293 "--mtu-test : Empirically measure and report MTU.\n"
294 #ifdef ENABLE_FRAGMENT
295 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
296 " datagrams are sent which are larger than max bytes.\n"
297 " Adds 4 bytes of overhead per datagram.\n"
299 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
300 " or --fragment max value, whichever is lower.\n"
301 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
302 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
303 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
304 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
305 " can be matched in policy routing and packetfilter rules.\n"
306 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
307 " listening for connections. This allows sending encrypted packets\n"
308 " via a VRF present on the system.\n"
310 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
311 #ifdef ENABLE_MEMSTATS
312 "--memstats file : Write live usage stats to memory mapped binary file.\n"
314 "--mlock : Disable Paging -- ensures key material and tunnel\n"
315 " data will never be written to disk.\n"
316 "--up cmd : Run command cmd after successful tun device open.\n"
317 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
318 " ifconfig-local-ip ifconfig-remote-ip\n"
319 " (pre --user or --group UID/GID change)\n"
320 "--up-delay : Delay tun/tap open and possible --up script execution\n"
321 " until after TCP/UDP connection establishment with peer.\n"
322 "--down cmd : Run command cmd after tun device close.\n"
323 " (post --user/--group UID/GID change and/or --chroot)\n"
324 " (command parameters are same as --up option)\n"
325 "--down-pre : Run --down command before TUN/TAP close.\n"
326 "--up-restart : Run up/down commands for all restarts including those\n"
327 " caused by --ping-restart or SIGUSR1\n"
328 "--user user : Set UID to user after initialization.\n"
329 "--group group : Set GID to group after initialization.\n"
330 "--chroot dir : Chroot to this directory after initialization.\n"
331 #ifdef ENABLE_SELINUX
332 "--setcon context: Apply this SELinux context after initialization.\n"
334 "--cd dir : Change to this directory before initialization.\n"
335 "--daemon [name] : Become a daemon after initialization.\n"
336 " The optional 'name' parameter will be passed\n"
337 " as the program name to the system logger.\n"
338 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
339 " See --daemon above for a description of the 'name' parm.\n"
340 "--log file : Output log to file which is created/truncated on open.\n"
341 "--log-append file : Append log to file, or create file if nonexistent.\n"
342 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
343 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
344 "--writepid file : Write main process ID to file.\n"
345 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
346 "--echo [parms ...] : Echo parameters to log output.\n"
347 "--verb n : Set output verbosity to n (default=%d):\n"
348 " (Level 3 is recommended if you want a good summary\n"
349 " of what's happening without being swamped by output).\n"
350 " : 0 -- no output except fatal errors\n"
351 " : 1 -- startup info + connection initiated messages +\n"
352 " non-fatal encryption & net errors\n"
353 " : 2,3 -- show TLS negotiations & route info\n"
354 " : 4 -- show parameters\n"
355 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
356 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
357 " : 6 to 11 -- debug messages of increasing verbosity\n"
358 "--mute n : Log at most n consecutive messages in the same category.\n"
359 "--status file [n] : Write operational status to file every n seconds.\n"
360 "--status-version [n] : Choose the status file format version number.\n"
361 " Currently, n can be 1, 2, or 3 (default=1).\n"
362 "--disable-occ : Disable options consistency check between peers.\n"
364 "--gremlin mask : Special stress testing mode (for debugging only).\n"
366 #if defined(USE_COMP)
367 "--compress alg : Use compression algorithm alg\n"
368 "--allow-compression: Specify whether compression should be allowed\n"
369 #if defined(ENABLE_LZO)
370 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
371 " packet for incompressible data.\n"
372 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
376 #ifdef ENABLE_MANAGEMENT
377 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
378 " management functions. pass is a password file\n"
379 " or 'stdin' to prompt from console.\n"
380 #if UNIX_SOCK_SUPPORT
381 " To listen on a unix domain socket, specific the pathname\n"
382 " in place of ip and use 'unix' as the port number.\n"
384 "--management-client : Management interface will connect as a TCP client to\n"
385 " ip/port rather than listen as a TCP server.\n"
386 "--management-query-passwords : Query management channel for private key\n"
387 " and auth-user-pass passwords.\n"
388 "--management-query-proxy : Query management channel for proxy information.\n"
389 "--management-query-remote : Query management channel for --remote directive.\n"
390 "--management-hold : Start " PACKAGE_NAME
" in a hibernating state, until a client\n"
391 " of the management interface explicitly starts it.\n"
392 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
393 "--management-forget-disconnect : Forget passwords when management disconnect\n"
395 "--management-up-down : Report tunnel up/down events to management interface.\n"
396 "--management-log-cache n : Cache n lines of log file history for usage\n"
397 " by the management channel.\n"
398 #if UNIX_SOCK_SUPPORT
399 "--management-client-user u : When management interface is a unix socket, only\n"
400 " allow connections from user u.\n"
401 "--management-client-group g : When management interface is a unix socket, only\n"
402 " allow connections from group g.\n"
404 "--management-client-auth : gives management interface client the responsibility\n"
405 " to authenticate clients after their client certificate\n"
406 " has been verified.\n"
407 #endif /* ifdef ENABLE_MANAGEMENT */
409 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
410 " to its initialization function.\n"
412 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
413 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
414 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
416 "Multi-Client Server options (when --mode server is used):\n"
417 "--server network netmask : Helper option to easily configure server mode.\n"
418 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
419 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
420 " easily configure ethernet bridging server mode.\n"
421 "--push \"option\" : Push a config file option back to the peer for remote\n"
422 " execution. Peer must specify --pull in its config file.\n"
423 "--push-reset : Don't inherit global push list for specific\n"
424 " client instance.\n"
425 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
426 " a specific client instance.\n"
427 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
428 " to be dynamically allocated to connecting clients.\n"
429 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
430 " data to file, at seconds intervals (default=600).\n"
431 " If seconds=0, file will be treated as read-only.\n"
432 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
433 " to be dynamically allocated to connecting clients.\n"
434 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
435 " overrides --ifconfig-pool dynamic allocation.\n"
436 " Only valid in a client-specific config file.\n"
437 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
438 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
439 " Only valid in a client-specific config file.\n"
440 "--iroute network [netmask] : Route subnet to client.\n"
441 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
442 " Sets up internal routes only.\n"
443 " Only valid in a client-specific config file.\n"
444 "--disable : Client is disabled.\n"
445 " Only valid in a client-specific config file.\n"
446 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
447 " mandatory client certificate verification.\n"
448 " Default is to require the client to supply a certificate.\n"
449 "--username-as-common-name : For auth-user-pass authentication, use\n"
450 " the authenticated username as the common name,\n"
451 " rather than the common name from the client cert.\n"
452 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
453 " run command cmd to verify. If method='via-env', pass\n"
454 " user/pass via environment, if method='via-file', pass\n"
455 " user/pass via temporary file.\n"
456 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
457 " to each client, replacing the password. Useful when\n"
458 " OTP based two-factor auth mechanisms are in use and\n"
459 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
460 " for generated tokens can be set.\n"
461 "--opt-verify : Clients that connect with options that are incompatible\n"
462 " with those of the server will be disconnected.\n"
463 "--auth-user-pass-optional : Allow connections by clients that don't\n"
464 " specify a username/password.\n"
465 "--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n"
466 " any printable character.\n"
467 "--client-to-client : Internally route client-to-client traffic.\n"
468 "--duplicate-cn : Allow multiple clients with the same common name to\n"
469 " concurrently connect.\n"
470 "--client-connect cmd : Run command cmd on client connection.\n"
471 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
472 "--client-config-dir dir : Directory for custom client config files.\n"
473 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
474 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
475 "--hash-size r v : Set the size of the real address hash table to r and the\n"
476 " virtual address table to v.\n"
477 "--bcast-buffers n : Allocate n broadcast buffers.\n"
478 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
479 "--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server\n"
480 " as well as pushes it to connecting clients.\n"
481 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
482 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
483 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
484 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
485 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
486 " older than n seconds. Run this check every t\n"
487 " seconds (defaults to n).\n"
488 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
489 " clients. n = 1 - reconnect to same server,\n"
490 " 2 - advance to next server, default=1.\n"
492 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
493 " sessions to a web server at host:port. dir specifies an\n"
494 " optional directory to write origin IP:port data.\n"
497 "Client options (when connecting to a multi-client server):\n"
498 "--client : Helper option to easily configure client mode.\n"
499 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
500 " up is a file containing the username on the first line,\n"
501 " and a password on the second. If either the password or both\n"
502 " the username and the password are omitted OpenVPN will prompt\n"
503 " for them from console.\n"
504 "--pull : Accept certain config file options from the peer as if they\n"
505 " were part of the local config file. Must be specified\n"
506 " when connecting to a '--mode server' remote host.\n"
507 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
508 " server if it starts with the text t. The action flag accept,\n"
509 " ignore or reject causes the option to be allowed, removed or\n"
510 " rejected with error. May be specified multiple times, and\n"
511 " each filter is applied in the order of appearance.\n"
512 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
513 " Valid options are :\n"
514 " address <addr[:port]> [addr[:port]] : server address 4/6\n"
515 " resolve-domains <domain> [domain ...] : split domains\n"
516 " exclude-domains <domain> [domain ...] : domains not to resolve\n"
517 " dnssec <yes|no|optional> : option to use DNSSEC\n"
518 " type <DoH|DoT> : query server over HTTPS / TLS\n"
519 " sni <domain> : DNS server name indication\n"
520 "--dns search-domains <domain> [domain ...]:\n"
521 " Add domains to DNS domain search list\n"
522 "--auth-retry t : How to handle auth failures. Set t to\n"
523 " none (default), interact, or nointeract.\n"
524 "--static-challenge t e : Enable static challenge/response protocol using\n"
525 " challenge text t, with e indicating echo flag (0|1)\n"
526 "--connect-timeout n : when polling possible remote servers to connect to\n"
527 " in a round-robin fashion, spend no more than n seconds\n"
528 " waiting for a response before trying the next server.\n"
529 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
530 " incoming tun packets with same destination as host.\n"
531 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
532 " server/remote. n = # of retries, default=1.\n"
534 "Data Channel Encryption Options (must be compatible between peers):\n"
535 "(These options are meaningful for both Static Key & TLS-mode)\n"
536 "--secret f [d] : (DEPRECATED) Enable Static Key encryption mode (non-TLS).\n"
537 " Use shared secret file f, generate with --genkey.\n"
538 " The optional d parameter controls key directionality.\n"
539 " If d is specified, use separate keys for each\n"
540 " direction, set d=0 on one side of the connection,\n"
541 " and d=1 on the other side.\n"
542 "--auth alg : Authenticate packets with HMAC using message\n"
543 " digest algorithm alg (default=%s).\n"
544 " (usually adds 16 or 20 bytes per packet)\n"
545 " Set alg=none to disable authentication.\n"
546 "--cipher alg : Encrypt packets with cipher algorithm alg\n"
548 " Set alg=none to disable encryption.\n"
549 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
550 #ifndef ENABLE_CRYPTO_MBEDTLS
551 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
553 "--no-replay : (DEPRECATED) Disable replay protection.\n"
554 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
555 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
556 " and a time window of t seconds.\n"
557 " Default n=%d t=%d\n"
558 "--replay-persist file : Persist replay-protection state across sessions\n"
560 "--test-crypto : Run a self-test of crypto features enabled.\n"
561 " For debugging only.\n"
562 #ifdef ENABLE_PREDICTION_RESISTANCE
563 "--use-prediction-resistance: Enable prediction resistance on the random\n"
564 " number generator.\n"
567 "TLS Key Negotiation Options:\n"
568 "(These options are meaningful only for TLS-mode)\n"
569 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
570 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
571 "--key-method m : (DEPRECATED) Data channel key exchange method. m should be a method\n"
572 " number, such as 1 (default), 2, etc.\n"
573 "--ca file : Certificate authority file in .pem format containing\n"
574 " root certificate.\n"
575 #ifndef ENABLE_CRYPTO_MBEDTLS
576 "--capath dir : A directory of trusted certificates (CAs"
578 #endif /* ENABLE_CRYPTO_MBEDTLS */
579 "--dh file : File containing Diffie Hellman parameters\n"
580 " in .pem format (for --tls-server only).\n"
581 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
582 "--cert file : Local certificate in .pem format -- must be signed\n"
583 " by a Certificate Authority in --ca file.\n"
584 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
585 "--key file : Local private key in .pem format.\n"
586 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
587 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
588 " is specified, require max TLS version supported by SSL implementation.\n"
589 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
590 #ifndef ENABLE_CRYPTO_MBEDTLS
591 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
592 " and optionally the root CA certificate.\n"
594 #ifdef ENABLE_X509ALTUSERNAME
595 "--x509-username-field : Field in x509 certificate containing the username.\n"
596 " Default is CN in the Subject field.\n"
598 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
599 " Valid algo flags are SHA1 and SHA256. \n"
601 "--cryptoapicert select-string : Load the certificate and private key from the\n"
602 " Windows Certificate System Store.\n"
604 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
605 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites seperated by : (optional)\n"
606 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
607 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
608 " (default=legacy).\n"
609 "--providers l : A list l of OpenSSL providers to load.\n"
610 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
611 " if no ACK from remote within n seconds (default=%d).\n"
612 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
613 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
614 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
615 " and at least min (defaults to 90%% of max on servers and equal\n"
616 " to max on clients).\n"
617 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
618 " of handshake initiation by any peer (default=%d).\n"
619 "--tran-window n : Transition window -- old key can live this many seconds\n"
620 " after new key renegotiation begins (default=%d).\n"
621 "--single-session: Allow only one session (reset state on restart).\n"
622 "--tls-exit : Exit on TLS negotiation failure.\n"
623 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
624 " control channel to protect against attacks on the TLS stack\n"
625 " and DoS attacks.\n"
626 " f (required) is a shared-secret key file.\n"
627 " The optional d parameter controls key directionality,\n"
628 " see --secret option for more info.\n"
629 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
630 " of the TLS control channel to hide the TLS certificate,\n"
631 " provide basic post-quantum security and protect against\n"
632 " attacks on the TLS stack and DoS attacks.\n"
633 " key (required) provides the pre-shared key file.\n"
634 " see --secret option for more info.\n"
635 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
636 " For servers: use key to decrypt client-specific keys. For\n"
637 " key generation (--genkey tls-crypt-v2-client): use key to\n"
638 " encrypt generated client-specific key. (See --tls-crypt.)\n"
639 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
640 " fresh tls-crypt-v2 client key, and store to\n"
641 " keyfile. If supplied, include metadata in wrapped key.\n"
642 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
643 " fresh tls-crypt-v2 server key, and store to keyfile\n"
644 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
645 " client-supplied tls-crypt-v2 client key\n"
646 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
647 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
648 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
649 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
650 " pending TLS connection that has otherwise passed all other\n"
651 " tests of certification. cmd should return 0 to allow\n"
652 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
653 " executed as 'cmd certificate_depth subject')\n"
654 "--tls-export-cert [directory] : Get peer cert in PEM format and store it \n"
655 " in an openvpn temporary file in [directory]. Peer cert is \n"
656 " stored before tls-verify script execution and deleted after.\n"
657 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
658 " DN name. The remote host must also pass all other tests\n"
659 " of verification.\n"
660 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
661 " an explicit nsCertType designation t = 'client' | 'server'.\n"
662 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
663 " plugins and management interface.\n"
664 #ifdef HAVE_EXPORT_KEYING_MATERIAL
665 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
666 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
668 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
669 " explicit key usage, you can specify more than one value.\n"
670 " value should be given in hex format.\n"
671 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
672 " explicit extended key usage. Extended key usage can be encoded\n"
673 " as an object identifier or OpenSSL string representation.\n"
674 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
675 " key usage and extended key usage based on RFC3280 TLS rules.\n"
676 " t = 'client' | 'server'.\n"
680 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
681 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
682 " path. Set for each provider.\n"
683 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
684 " 0 : Try to determine automatically (default).\n"
686 " 2 : Use SignRecover.\n"
687 " 4 : Use Decrypt.\n"
689 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
690 " certificate can be accessed. Set for each provider.\n"
691 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
692 " cache until token is removed.\n"
693 "--pkcs11-id-management : Acquire identity from management interface.\n"
694 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
695 #endif /* ENABLE_PKCS11 */
697 "SSL Library information:\n"
698 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
699 "--show-digests : Show message digest algorithms to use with --auth option.\n"
700 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
701 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
704 "Windows Specific:\n"
705 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
706 " from SystemRoot environment variable.\n"
707 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
708 " IP address using method = manual, netsh, ipapi,\n"
709 " dynamic, or adaptive (default = adaptive).\n"
710 " Dynamic method allows two optional parameters:\n"
711 " offset: DHCP server address offset (> -256 and < 256).\n"
712 " If 0, use network address, if >0, take nth\n"
713 " address forward from network address, if <0,\n"
714 " take nth address backward from broadcast\n"
717 " lease-time: Lease time in seconds.\n"
718 " Default is one year.\n"
719 "--route-method : Which method to use for adding routes on Windows?\n"
720 " adaptive (default) -- Try ipapi then fall back to exe.\n"
721 " ipapi -- Use IP helper API.\n"
722 " exe -- Call the route.exe shell command.\n"
723 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
724 " be used with --ip-win32 dynamic. For options\n"
725 " which allow multiple addresses,\n"
726 " --dhcp-option must be repeated.\n"
727 " DOMAIN name : Set DNS suffix\n"
728 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
729 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
730 " NTP : Set NTP server address(es)\n"
731 " NBDD : Set NBDD server address(es)\n"
732 " WINS addr : Set WINS server address(es)\n"
733 " NBT type : Set NetBIOS over TCP/IP Node type\n"
734 " 1: B, 2: P, 4: M, 8: H\n"
735 " NBS id : Set NetBIOS scope ID\n"
736 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
737 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
738 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
740 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
741 " on connection initiation.\n"
742 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
743 " attempting to set adapter properties.\n"
744 "--pause-exit : When run from a console window, pause before exiting.\n"
745 "--service ex [0|1] : For use when " PACKAGE_NAME
" is being instantiated by a\n"
746 " service, and should not be used directly by end-users.\n"
747 " ex is the name of an event object which, when\n"
748 " signaled, will cause " PACKAGE_NAME
" to exit. A second\n"
749 " optional parameter controls the initial state of ex.\n"
750 "--show-net-up : Show " PACKAGE_NAME
"'s view of routing table and net adapter list\n"
751 " after TAP adapter is up and routes have been added.\n"
752 "--windows-driver : Which tun driver to use?\n"
753 " ovpn-dco (default)\n"
756 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
757 "Windows Standalone Options:\n"
759 "--show-adapters : Show all TAP-Windows adapters.\n"
760 "--show-net : Show " PACKAGE_NAME
"'s view of routing table and net adapter list.\n"
761 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
762 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME
" running without admin privileges\n"
763 " to access TAP adapter.\n"
764 #endif /* ifdef _WIN32 */
766 "Generate a new key :\n"
767 "--genkey secret file : Generate a new random key of type and write to file\n"
768 " (for use with --secret, --tls-auth or --tls-crypt)."
769 #ifdef ENABLE_FEATURE_TUN_PERSIST
771 "Tun/tap config mode (available with linux 2.4+):\n"
772 "--mktun : Create a persistent tunnel.\n"
773 "--rmtun : Remove a persistent tunnel.\n"
774 "--dev tunX|tapX : tun/tap device\n"
775 "--dev-type dt : Device type. See tunnel options above for details.\n"
776 "--user user : User to set privilege to.\n"
777 "--group group : Group to set privilege to.\n"
781 "PKCS#11 standalone options:\n"
782 #ifdef DEFAULT_PKCS11_MODULE
783 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
785 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
787 " --verb option can be added *BEFORE* this.\n"
788 #endif /* ENABLE_PKCS11 */
790 "General Standalone Options:\n"
792 "--show-gateway : Show info about default gateway.\n"
796 #endif /* !ENABLE_SMALL */
799 * This is where the options defaults go.
800 * Any option not explicitly set here
804 init_options(struct options
*o
, const bool init_gc
)
810 gc_init(&o
->dns_options
.gc
);
813 o
->mode
= MODE_POINT_TO_POINT
;
814 o
->topology
= TOP_NET30
;
815 o
->ce
.proto
= PROTO_UDP
;
816 o
->ce
.af
= AF_UNSPEC
;
817 o
->ce
.bind_ipv6_only
= false;
818 o
->ce
.connect_retry_seconds
= 1;
819 o
->ce
.connect_retry_seconds_max
= 300;
820 o
->ce
.connect_timeout
= 120;
821 o
->connect_retry_max
= 0;
822 o
->ce
.local_port
= o
->ce
.remote_port
= OPENVPN_PORT
;
824 o
->status_file_update_freq
= 60;
825 o
->status_file_version
= 1;
826 o
->ce
.bind_local
= true;
827 o
->ce
.tun_mtu
= TUN_MTU_DEFAULT
;
829 o
->ce
.link_mtu
= LINK_MTU_DEFAULT
;
830 o
->ce
.tls_mtu
= TLS_MTU_DEFAULT
;
831 o
->ce
.mtu_discover_type
= -1;
833 o
->ce
.mssfix_default
= true;
834 o
->ce
.mssfix_encap
= true;
835 o
->route_delay_window
= 30;
836 o
->resolve_retry_seconds
= RESOLV_RETRY_INFINITE
;
837 o
->resolve_in_advance
= false;
840 #ifdef ENABLE_MANAGEMENT
841 o
->management_log_history_cache
= 250;
842 o
->management_echo_buffer_size
= 100;
843 o
->management_state_buffer_size
= 100;
845 #ifdef ENABLE_FEATURE_TUN_PERSIST
850 o
->tuntap_options
.ip_win32_type
= IPW32_SET_ADAPTIVE
;
852 o
->tuntap_options
.ip_win32_type
= IPW32_SET_DHCP_MASQ
;
854 o
->tuntap_options
.dhcp_lease_time
= 31536000; /* one year */
855 o
->tuntap_options
.dhcp_masq_offset
= 0; /* use network address as internal DHCP server address */
856 o
->route_method
= ROUTE_METHOD_ADAPTIVE
;
857 o
->block_outside_dns
= false;
858 o
->windows_driver
= WINDOWS_DRIVER_UNSPECIFIED
;
860 o
->vlan_accept
= VLAN_ALL
;
862 o
->real_hash_size
= 256;
863 o
->virtual_hash_size
= 256;
864 o
->n_bcast_buf
= 256;
865 o
->tcp_queue_limit
= 64;
866 o
->max_clients
= 1024;
867 o
->max_routes_per_client
= 256;
868 o
->stale_routes_check_interval
= 0;
869 o
->ifconfig_pool_persist_refresh_freq
= 600;
870 o
->scheduled_exit_interval
= 5;
871 o
->authname
= "SHA1";
873 o
->replay_window
= DEFAULT_SEQ_BACKTRACK
;
874 o
->replay_time
= DEFAULT_TIME_BACKTRACK
;
875 o
->key_direction
= KEY_DIRECTION_BIDIRECTIONAL
;
876 #ifdef ENABLE_PREDICTION_RESISTANCE
877 o
->use_prediction_resistance
= false;
880 o
->renegotiate_bytes
= -1;
881 o
->renegotiate_seconds
= 3600;
882 o
->renegotiate_seconds_min
= -1;
883 o
->handshake_window
= 60;
884 o
->transition_window
= 3600;
885 o
->tls_cert_profile
= NULL
;
886 o
->ecdh_curve
= NULL
;
887 #ifdef ENABLE_X509ALTUSERNAME
888 o
->x509_username_field
[0] = X509_USERNAME_FIELD_DEFAULT
;
891 o
->pkcs11_pin_cache_period
= -1;
892 #endif /* ENABLE_PKCS11 */
894 /* P2MP server context features */
895 o
->auth_token_generate
= false;
897 /* Set default --tmp-dir */
899 /* On Windows, find temp dir via environment variables */
900 o
->tmp_dir
= win_get_tempdir();
902 /* Non-windows platforms use $TMPDIR, and if not set, default to '/tmp' */
903 o
->tmp_dir
= getenv("TMPDIR");
909 o
->allow_recursive_routing
= false;
912 o
->tuntap_options
.disable_dco
= true;
913 #endif /* ENABLE_DCO */
917 uninit_options(struct options
*o
)
922 gc_free(&o
->dns_options
.gc
);
928 #define PUF_TYPE_UNDEF 0 /** undefined filter type */
929 #define PUF_TYPE_ACCEPT 1 /** filter type to accept a matching option */
930 #define PUF_TYPE_IGNORE 2 /** filter type to ignore a matching option */
931 #define PUF_TYPE_REJECT 3 /** filter type to reject and trigger SIGUSR1 */
935 struct pull_filter
*next
;
938 struct pull_filter_list
940 struct pull_filter
*head
;
941 struct pull_filter
*tail
;
947 pull_filter_type_name(int type
)
949 if (type
== PUF_TYPE_ACCEPT
)
953 if (type
== PUF_TYPE_IGNORE
)
957 if (type
== PUF_TYPE_REJECT
)
967 #define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
968 #define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
969 #define SHOW_STR_INLINE(var) SHOW_PARM(var, \
970 o->var ## _inline ? "[INLINE]" : \
971 (o->var ? o->var : "[UNDEF]"), \
973 #define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
974 #define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
975 #define SHOW_INT64(var) SHOW_PARM(var, o->var, "%" PRIi64)
976 #define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
977 #define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
979 #endif /* ifndef ENABLE_SMALL */
982 setenv_connection_entry(struct env_set
*es
,
983 const struct connection_entry
*e
,
986 setenv_str_i(es
, "proto", proto2ascii(e
->proto
, e
->af
, false), i
);
987 setenv_str_i(es
, "local", e
->local
, i
);
988 setenv_str_i(es
, "local_port", e
->local_port
, i
);
989 setenv_str_i(es
, "remote", e
->remote
, i
);
990 setenv_str_i(es
, "remote_port", e
->remote_port
, i
);
992 if (e
->http_proxy_options
)
994 setenv_str_i(es
, "http_proxy_server", e
->http_proxy_options
->server
, i
);
995 setenv_str_i(es
, "http_proxy_port", e
->http_proxy_options
->port
, i
);
997 if (e
->socks_proxy_server
)
999 setenv_str_i(es
, "socks_proxy_server", e
->socks_proxy_server
, i
);
1000 setenv_str_i(es
, "socks_proxy_port", e
->socks_proxy_port
, i
);
1005 setenv_settings(struct env_set
*es
, const struct options
*o
)
1007 setenv_str(es
, "config", o
->config
);
1008 setenv_int(es
, "verb", o
->verbosity
);
1009 setenv_int(es
, "daemon", o
->daemon
);
1010 setenv_int(es
, "daemon_log_redirect", o
->log
);
1011 setenv_long_long(es
, "daemon_start_time", time(NULL
));
1012 setenv_int(es
, "daemon_pid", platform_getpid());
1014 if (o
->connection_list
)
1017 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
1019 setenv_connection_entry(es
, o
->connection_list
->array
[i
], i
+1);
1024 setenv_connection_entry(es
, &o
->ce
, 1);
1029 setenv_dns_options(&o
->dns_options
, es
);
1034 setenv_foreign_option(struct options
*o
, const char *argv
[], int len
, struct env_set
*es
)
1038 struct gc_arena gc
= gc_new();
1039 struct buffer name
= alloc_buf_gc(OPTION_PARM_SIZE
, &gc
);
1040 struct buffer value
= alloc_buf_gc(OPTION_PARM_SIZE
, &gc
);
1045 good
&= buf_printf(&name
, "foreign_option_%d", o
->foreign_option_index
+ 1);
1046 ++o
->foreign_option_index
;
1047 for (i
= 0; i
< len
; ++i
)
1053 good
&= buf_printf(&value
, " ");
1055 good
&= buf_printf(&value
, "%s", argv
[i
]);
1061 setenv_str(es
, BSTR(&name
), BSTR(&value
));
1065 msg(M_WARN
, "foreign_option: name/value overflow");
1072 get_ip_addr(const char *ip_string
, int msglevel
, bool *error
)
1074 unsigned int flags
= GETADDR_HOST_ORDER
;
1075 bool succeeded
= false;
1078 if (msglevel
& M_FATAL
)
1080 flags
|= GETADDR_FATAL
;
1083 ret
= getaddr(flags
, ip_string
, 0, &succeeded
, NULL
);
1084 if (!succeeded
&& error
)
1092 * Returns newly allocated string containing address part without "/nn".
1094 * If gc != NULL, the allocated memory is registered in the supplied gc.
1097 get_ipv6_addr_no_netbits(const char *addr
, struct gc_arena
*gc
)
1099 const char *end
= strchr(addr
, '/');
1103 ret
= string_alloc(addr
, gc
);
1107 size_t len
= end
- addr
;
1108 ret
= gc_malloc(len
+ 1, true, gc
);
1109 memcpy(ret
, addr
, len
);
1115 ipv6_addr_safe_hexplusbits( const char *ipv6_prefix_spec
)
1117 struct in6_addr t_addr
;
1118 unsigned int t_bits
;
1120 return get_ipv6_addr( ipv6_prefix_spec
, &t_addr
, &t_bits
, M_WARN
);
1124 string_substitute(const char *src
, int from
, int to
, struct gc_arena
*gc
)
1126 char *ret
= (char *) gc_malloc(strlen(src
) + 1, true, gc
);
1144 * Parses a hexstring and checks if the string has the correct length. Return
1145 * a verify_hash_list containing the parsed hash string.
1147 * @param str String to check/parse
1148 * @param nbytes Number of bytes expected in the hexstr (e.g. 20 for SHA1)
1149 * @param msglevel message level to use when printing warnings/errors
1150 * @param gc The returned object will be allocated in this gc
1152 static struct verify_hash_list
*
1153 parse_hash_fingerprint(const char *str
, int nbytes
, int msglevel
, struct gc_arena
*gc
)
1156 const char *cp
= str
;
1158 struct verify_hash_list
*ret
;
1159 ALLOC_OBJ_CLEAR_GC(ret
, struct verify_hash_list
, gc
);
1164 while (*cp
&& i
< nbytes
)
1166 /* valid segments consist of exactly two hex digits, then ':' or EOS */
1167 if (!isxdigit(cp
[0])
1169 || (cp
[2] != ':' && cp
[2] != '\0')
1170 || sscanf(cp
, "%x", &byte
) != 1)
1172 msg(msglevel
, "format error in hash fingerprint: %s", str
);
1176 ret
->hash
[i
++] = (uint8_t)byte
;
1187 msg(msglevel
, "hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes
, i
, str
);
1189 else if (term
!= '\0')
1191 msg(msglevel
, "hash fingerprint too long - expected only %d bytes: %s", nbytes
, str
);
1197 * Parses a string consisting of multiple lines of hexstrings and checks if each
1198 * string has the correct length. Empty lines are ignored. Returns
1199 * a linked list of (possibly) multiple verify_hash_list objects.
1201 * @param str String to check/parse
1202 * @param nbytes Number of bytes expected in the hexstring (e.g. 20 for SHA1)
1203 * @param msglevel message level to use when printing warnings/errors
1204 * @param gc The returned list items will be allocated in this gc
1206 static struct verify_hash_list
*
1207 parse_hash_fingerprint_multiline(const char *str
, int nbytes
, int msglevel
,
1208 struct gc_arena
*gc
)
1210 struct gc_arena gc_temp
= gc_new();
1211 char *lines
= string_alloc(str
, &gc_temp
);
1213 struct verify_hash_list
*ret
= NULL
;
1216 while ((line
= strsep(&lines
, "\n")))
1218 /* ignore leading whitespace */
1219 while (isspace(*line
))
1223 /* skip empty lines and comment lines */
1224 if (strlen(line
) == 0 || *line
== '#' || *line
== ';')
1229 struct verify_hash_list
*hash
= parse_hash_fingerprint(line
, nbytes
,
1247 #ifndef ENABLE_SMALL
1250 show_dhcp_option_list(const char *name
, const char *const *array
, int len
)
1253 for (i
= 0; i
< len
; ++i
)
1255 msg(D_SHOW_PARMS
, " %s[%d] = %s", name
, i
, array
[i
] );
1260 show_dhcp_option_addrs(const char *name
, const in_addr_t
*array
, int len
)
1262 struct gc_arena gc
= gc_new();
1264 for (i
= 0; i
< len
; ++i
)
1266 msg(D_SHOW_PARMS
, " %s[%d] = %s",
1269 print_in_addr_t(array
[i
], 0, &gc
));
1275 show_tuntap_options(const struct tuntap_options
*o
)
1277 SHOW_BOOL(ip_win32_defined
);
1278 SHOW_INT(ip_win32_type
);
1279 SHOW_INT(dhcp_masq_offset
);
1280 SHOW_INT(dhcp_lease_time
);
1281 SHOW_INT(tap_sleep
);
1282 SHOW_BOOL(dhcp_options
);
1283 SHOW_BOOL(dhcp_renew
);
1284 SHOW_BOOL(dhcp_pre_release
);
1286 SHOW_STR(netbios_scope
);
1287 SHOW_INT(netbios_node_type
);
1288 SHOW_BOOL(disable_nbt
);
1290 show_dhcp_option_addrs("DNS", o
->dns
, o
->dns_len
);
1291 show_dhcp_option_addrs("WINS", o
->wins
, o
->wins_len
);
1292 show_dhcp_option_addrs("NTP", o
->ntp
, o
->ntp_len
);
1293 show_dhcp_option_addrs("NBDD", o
->nbdd
, o
->nbdd_len
);
1294 show_dhcp_option_list("DOMAIN-SEARCH", o
->domain_search_list
, o
->domain_search_list_len
);
1297 #endif /* ifndef ENABLE_SMALL */
1298 #endif /* ifdef _WIN32 */
1300 #if defined(_WIN32) || defined(TARGET_ANDROID)
1302 dhcp_option_dns6_parse(const char *parm
, struct in6_addr
*dns6_list
, int *len
, int msglevel
)
1304 struct in6_addr addr
;
1305 if (*len
>= N_DHCP_ADDR
)
1307 msg(msglevel
, "--dhcp-option DNS: maximum of %d IPv6 dns servers can be specified",
1310 else if (get_ipv6_addr(parm
, &addr
, NULL
, msglevel
))
1312 dns6_list
[(*len
)++] = addr
;
1316 dhcp_option_address_parse(const char *name
, const char *parm
, in_addr_t
*array
, int *len
, int msglevel
)
1318 if (*len
>= N_DHCP_ADDR
)
1320 msg(msglevel
, "--dhcp-option %s: maximum of %d %s servers can be specified",
1327 if (ip_addr_dotted_quad_safe(parm
)) /* FQDN -- IP address only */
1330 const in_addr_t addr
= get_ip_addr(parm
, msglevel
, &error
);
1333 array
[(*len
)++] = addr
;
1338 msg(msglevel
, "dhcp-option parameter %s '%s' must be an IP address", name
, parm
);
1344 * If DNS options are set use these for TUN/TAP options as well.
1345 * Applies to DNS, DNS6 and DOMAIN-SEARCH.
1346 * Existing options will be discarded.
1349 tuntap_options_copy_dns(struct options
*o
)
1351 struct tuntap_options
*tt
= &o
->tuntap_options
;
1352 struct dns_options
*dns
= &o
->dns_options
;
1354 if (dns
->search_domains
)
1356 tt
->domain_search_list_len
= 0;
1357 const struct dns_domain
*domain
= dns
->search_domains
;
1358 while (domain
&& tt
->domain_search_list_len
< N_SEARCH_LIST_LEN
)
1360 tt
->domain_search_list
[tt
->domain_search_list_len
++] = domain
->name
;
1361 domain
= domain
->next
;
1365 msg(M_WARN
, "WARNING: couldn't copy all --dns search-domains to --dhcp-option");
1373 bool overflow
= false;
1374 const struct dns_server
*server
= dns
->servers
;
1377 if (server
->addr4_defined
&& tt
->dns_len
< N_DHCP_ADDR
)
1379 tt
->dns
[tt
->dns_len
++] = server
->addr4
.s_addr
;
1385 if (server
->addr6_defined
&& tt
->dns6_len
< N_DHCP_ADDR
)
1387 tt
->dns6
[tt
->dns6_len
++] = server
->addr6
;
1393 server
= server
->next
;
1397 msg(M_WARN
, "WARNING: couldn't copy all --dns server addresses to --dhcp-option");
1401 #else /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1403 foreign_options_copy_dns(struct options
*o
, struct env_set
*es
)
1405 const struct dns_domain
*domain
= o
->dns_options
.search_domains
;
1406 const struct dns_server
*server
= o
->dns_options
.servers
;
1407 if (!domain
&& !server
)
1412 /* reset the index since we're starting all over again */
1413 int opt_max
= o
->foreign_option_index
;
1414 o
->foreign_option_index
= 0;
1416 for (int i
= 1; i
<= opt_max
; ++i
)
1419 openvpn_snprintf(name
, sizeof(name
), "foreign_option_%d", i
);
1421 const char *env_str
= env_set_get(es
, name
);
1422 const char *value
= strchr(env_str
, '=') + 1;
1423 if ((domain
&& strstr(value
, "dhcp-option DOMAIN-SEARCH") == value
)
1424 || (server
&& strstr(value
, "dhcp-option DNS") == value
))
1426 setenv_del(es
, name
);
1430 setenv_foreign_option(o
, &value
, 1, es
);
1434 struct gc_arena gc
= gc_new();
1438 if (server
->addr4_defined
)
1440 const char *argv
[] = {
1443 print_in_addr_t(server
->addr4
.s_addr
, 0, &gc
)
1445 setenv_foreign_option(o
, argv
, 3, es
);
1447 if (server
->addr6_defined
)
1449 const char *argv
[] = {
1452 print_in6_addr(server
->addr6
, 0, &gc
)
1454 setenv_foreign_option(o
, argv
, 3, es
);
1456 server
= server
->next
;
1460 const char *argv
[] = { "dhcp-option", "DOMAIN-SEARCH", domain
->name
};
1461 setenv_foreign_option(o
, argv
, 3, es
);
1462 domain
= domain
->next
;
1467 /* remove old leftover entries */
1468 while (o
->foreign_option_index
< opt_max
)
1471 openvpn_snprintf(name
, sizeof(name
), "foreign_option_%d", opt_max
--);
1472 setenv_del(es
, name
);
1475 #endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
1477 #ifndef ENABLE_SMALL
1479 print_vlan_accept(enum vlan_acceptable_frames mode
)
1483 case VLAN_ONLY_TAGGED
:
1486 case VLAN_ONLY_UNTAGGED_OR_PRIORITY
:
1496 show_p2mp_parms(const struct options
*o
)
1498 struct gc_arena gc
= gc_new();
1500 msg(D_SHOW_PARMS
, " server_network = %s", print_in_addr_t(o
->server_network
, 0, &gc
));
1501 msg(D_SHOW_PARMS
, " server_netmask = %s", print_in_addr_t(o
->server_netmask
, 0, &gc
));
1502 msg(D_SHOW_PARMS
, " server_network_ipv6 = %s", print_in6_addr(o
->server_network_ipv6
, 0, &gc
) );
1503 SHOW_INT(server_netbits_ipv6
);
1504 msg(D_SHOW_PARMS
, " server_bridge_ip = %s", print_in_addr_t(o
->server_bridge_ip
, 0, &gc
));
1505 msg(D_SHOW_PARMS
, " server_bridge_netmask = %s", print_in_addr_t(o
->server_bridge_netmask
, 0, &gc
));
1506 msg(D_SHOW_PARMS
, " server_bridge_pool_start = %s", print_in_addr_t(o
->server_bridge_pool_start
, 0, &gc
));
1507 msg(D_SHOW_PARMS
, " server_bridge_pool_end = %s", print_in_addr_t(o
->server_bridge_pool_end
, 0, &gc
));
1508 if (o
->push_list
.head
)
1510 const struct push_entry
*e
= o
->push_list
.head
;
1515 msg(D_SHOW_PARMS
, " push_entry = '%s'", e
->option
);
1520 SHOW_BOOL(ifconfig_pool_defined
);
1521 msg(D_SHOW_PARMS
, " ifconfig_pool_start = %s", print_in_addr_t(o
->ifconfig_pool_start
, 0, &gc
));
1522 msg(D_SHOW_PARMS
, " ifconfig_pool_end = %s", print_in_addr_t(o
->ifconfig_pool_end
, 0, &gc
));
1523 msg(D_SHOW_PARMS
, " ifconfig_pool_netmask = %s", print_in_addr_t(o
->ifconfig_pool_netmask
, 0, &gc
));
1524 SHOW_STR(ifconfig_pool_persist_filename
);
1525 SHOW_INT(ifconfig_pool_persist_refresh_freq
);
1526 SHOW_BOOL(ifconfig_ipv6_pool_defined
);
1527 msg(D_SHOW_PARMS
, " ifconfig_ipv6_pool_base = %s", print_in6_addr(o
->ifconfig_ipv6_pool_base
, 0, &gc
));
1528 SHOW_INT(ifconfig_ipv6_pool_netbits
);
1529 SHOW_INT(n_bcast_buf
);
1530 SHOW_INT(tcp_queue_limit
);
1531 SHOW_INT(real_hash_size
);
1532 SHOW_INT(virtual_hash_size
);
1533 SHOW_STR(client_connect_script
);
1534 SHOW_STR(learn_address_script
);
1535 SHOW_STR(client_disconnect_script
);
1536 SHOW_STR(client_crresponse_script
);
1537 SHOW_STR(client_config_dir
);
1538 SHOW_BOOL(ccd_exclusive
);
1540 SHOW_BOOL(push_ifconfig_defined
);
1541 msg(D_SHOW_PARMS
, " push_ifconfig_local = %s", print_in_addr_t(o
->push_ifconfig_local
, 0, &gc
));
1542 msg(D_SHOW_PARMS
, " push_ifconfig_remote_netmask = %s", print_in_addr_t(o
->push_ifconfig_remote_netmask
, 0, &gc
));
1543 SHOW_BOOL(push_ifconfig_ipv6_defined
);
1544 msg(D_SHOW_PARMS
, " push_ifconfig_ipv6_local = %s/%d", print_in6_addr(o
->push_ifconfig_ipv6_local
, 0, &gc
), o
->push_ifconfig_ipv6_netbits
);
1545 msg(D_SHOW_PARMS
, " push_ifconfig_ipv6_remote = %s", print_in6_addr(o
->push_ifconfig_ipv6_remote
, 0, &gc
));
1546 SHOW_BOOL(enable_c2c
);
1547 SHOW_BOOL(duplicate_cn
);
1550 SHOW_INT(max_clients
);
1551 SHOW_INT(max_routes_per_client
);
1552 SHOW_STR(auth_user_pass_verify_script
);
1553 SHOW_BOOL(auth_user_pass_verify_script_via_file
);
1554 SHOW_BOOL(auth_token_generate
);
1555 SHOW_INT(auth_token_lifetime
);
1556 SHOW_STR_INLINE(auth_token_secret_file
);
1558 SHOW_STR(port_share_host
);
1559 SHOW_STR(port_share_port
);
1561 SHOW_BOOL(vlan_tagging
);
1562 msg(D_SHOW_PARMS
, " vlan_accept = %s", print_vlan_accept(o
->vlan_accept
));
1563 SHOW_INT(vlan_pvid
);
1567 SHOW_STR_INLINE(auth_user_pass_file
);
1572 #endif /* ! ENABLE_SMALL */
1575 option_iroute(struct options
*o
,
1576 const char *network_str
,
1577 const char *netmask_str
,
1582 ALLOC_OBJ_GC(ir
, struct iroute
, &o
->gc
);
1583 ir
->network
= getaddr(GETADDR_HOST_ORDER
, network_str
, 0, NULL
, NULL
);
1584 ir
->netbits
= 32; /* host route if no netmask given */
1588 const in_addr_t netmask
= getaddr(GETADDR_HOST_ORDER
, netmask_str
, 0, NULL
, NULL
);
1589 ir
->netbits
= netmask_to_netbits2(netmask
);
1591 if (ir
->netbits
< 0)
1593 msg(msglevel
, "in --iroute %s %s : Bad network/subnet specification",
1600 ir
->next
= o
->iroutes
;
1605 option_iroute_ipv6(struct options
*o
,
1606 const char *prefix_str
,
1609 struct iroute_ipv6
*ir
;
1611 ALLOC_OBJ_GC(ir
, struct iroute_ipv6
, &o
->gc
);
1613 if (!get_ipv6_addr(prefix_str
, &ir
->network
, &ir
->netbits
, msglevel
))
1615 msg(msglevel
, "in --iroute-ipv6 %s: Bad IPv6 prefix specification",
1620 ir
->next
= o
->iroutes_ipv6
;
1621 o
->iroutes_ipv6
= ir
;
1624 #ifndef ENABLE_SMALL
1626 show_http_proxy_options(const struct http_proxy_options
*o
)
1629 msg(D_SHOW_PARMS
, "BEGIN http_proxy");
1632 SHOW_STR(auth_method_string
);
1633 SHOW_STR(auth_file
);
1634 SHOW_STR(http_version
);
1635 SHOW_STR(user_agent
);
1636 for (i
= 0; i
< MAX_CUSTOM_HTTP_HEADER
&& o
->custom_headers
[i
].name
; i
++)
1638 if (o
->custom_headers
[i
].content
)
1640 msg(D_SHOW_PARMS
, " custom_header[%d] = %s: %s", i
,
1641 o
->custom_headers
[i
].name
, o
->custom_headers
[i
].content
);
1645 msg(D_SHOW_PARMS
, " custom_header[%d] = %s", i
,
1646 o
->custom_headers
[i
].name
);
1649 msg(D_SHOW_PARMS
, "END http_proxy");
1651 #endif /* ifndef ENABLE_SMALL */
1654 options_detach(struct options
*o
)
1658 o
->client_nat
= NULL
;
1663 rol_check_alloc(struct options
*options
)
1665 if (!options
->routes
)
1667 options
->routes
= new_route_option_list(&options
->gc
);
1672 rol6_check_alloc(struct options
*options
)
1674 if (!options
->routes_ipv6
)
1676 options
->routes_ipv6
= new_route_ipv6_option_list(&options
->gc
);
1681 cnol_check_alloc(struct options
*options
)
1683 if (!options
->client_nat
)
1685 options
->client_nat
= new_client_nat_list(&options
->gc
);
1689 #ifndef ENABLE_SMALL
1691 show_connection_entry(const struct connection_entry
*o
)
1693 msg(D_SHOW_PARMS
, " proto = %s", proto2ascii(o
->proto
, o
->af
, false));
1695 SHOW_STR(local_port
);
1697 SHOW_STR(remote_port
);
1698 SHOW_BOOL(remote_float
);
1699 SHOW_BOOL(bind_defined
);
1700 SHOW_BOOL(bind_local
);
1701 SHOW_BOOL(bind_ipv6_only
);
1702 SHOW_INT(connect_retry_seconds
);
1703 SHOW_INT(connect_timeout
);
1705 if (o
->http_proxy_options
)
1707 show_http_proxy_options(o
->http_proxy_options
);
1709 SHOW_STR(socks_proxy_server
);
1710 SHOW_STR(socks_proxy_port
);
1712 SHOW_BOOL(tun_mtu_defined
);
1714 SHOW_BOOL(link_mtu_defined
);
1715 SHOW_INT(tun_mtu_extra
);
1716 SHOW_BOOL(tun_mtu_extra_defined
);
1719 SHOW_INT(mtu_discover_type
);
1721 #ifdef ENABLE_FRAGMENT
1725 SHOW_BOOL(mssfix_encap
);
1726 SHOW_BOOL(mssfix_fixed
);
1728 SHOW_INT(explicit_exit_notification
);
1730 SHOW_STR_INLINE(tls_auth_file
);
1731 SHOW_PARM(key_direction
, keydirection2ascii(o
->key_direction
, false, true),
1733 SHOW_STR_INLINE(tls_crypt_file
);
1734 SHOW_STR_INLINE(tls_crypt_v2_file
);
1739 show_connection_entries(const struct options
*o
)
1741 if (o
->connection_list
)
1743 const struct connection_list
*l
= o
->connection_list
;
1745 for (i
= 0; i
< l
->len
; ++i
)
1747 msg(D_SHOW_PARMS
, "Connection profiles [%d]:", i
);
1748 show_connection_entry(l
->array
[i
]);
1753 msg(D_SHOW_PARMS
, "Connection profiles [default]:");
1754 show_connection_entry(&o
->ce
);
1756 msg(D_SHOW_PARMS
, "Connection profiles END");
1760 show_pull_filter_list(const struct pull_filter_list
*l
)
1762 struct pull_filter
*f
;
1768 msg(D_SHOW_PARMS
, " Pull filters:");
1769 for (f
= l
->head
; f
; f
= f
->next
)
1771 msg(D_SHOW_PARMS
, " %s \"%s\"", pull_filter_type_name(f
->type
), f
->pattern
);
1775 #endif /* ifndef ENABLE_SMALL */
1778 show_settings(const struct options
*o
)
1780 #ifndef ENABLE_SMALL
1781 msg(D_SHOW_PARMS
, "Current Parameter Settings:");
1787 #ifdef ENABLE_FEATURE_TUN_PERSIST
1788 SHOW_BOOL(persist_config
);
1789 SHOW_INT(persist_mode
);
1792 SHOW_BOOL(show_ciphers
);
1793 SHOW_BOOL(show_digests
);
1794 SHOW_BOOL(show_engines
);
1796 SHOW_STR(genkey_filename
);
1797 SHOW_STR(key_pass_file
);
1798 SHOW_BOOL(show_tls_ciphers
);
1800 SHOW_INT(connect_retry_max
);
1801 show_connection_entries(o
);
1803 SHOW_BOOL(remote_random
);
1809 #if defined(ENABLE_DCO)
1810 SHOW_BOOL(tuntap_options
.disable_dco
);
1814 SHOW_STR(ifconfig_local
);
1815 SHOW_STR(ifconfig_remote_netmask
);
1816 SHOW_BOOL(ifconfig_noexec
);
1817 SHOW_BOOL(ifconfig_nowarn
);
1818 SHOW_STR(ifconfig_ipv6_local
);
1819 SHOW_INT(ifconfig_ipv6_netbits
);
1820 SHOW_STR(ifconfig_ipv6_remote
);
1827 SHOW_INT(keepalive_ping
);
1828 SHOW_INT(keepalive_timeout
);
1829 SHOW_INT(inactivity_timeout
);
1830 SHOW_INT(session_timeout
);
1831 SHOW_INT64(inactivity_minimum_bytes
);
1832 SHOW_INT(ping_send_timeout
);
1833 SHOW_INT(ping_rec_timeout
);
1834 SHOW_INT(ping_rec_timeout_action
);
1835 SHOW_BOOL(ping_timer_remote
);
1836 SHOW_INT(remap_sigusr1
);
1837 SHOW_BOOL(persist_tun
);
1838 SHOW_BOOL(persist_local_ip
);
1839 SHOW_BOOL(persist_remote_ip
);
1840 SHOW_BOOL(persist_key
);
1842 #if PASSTOS_CAPABILITY
1846 SHOW_INT(resolve_retry_seconds
);
1847 SHOW_BOOL(resolve_in_advance
);
1850 SHOW_STR(groupname
);
1851 SHOW_STR(chroot_dir
);
1853 #ifdef ENABLE_SELINUX
1854 SHOW_STR(selinux_context
);
1857 SHOW_STR(up_script
);
1858 SHOW_STR(down_script
);
1859 SHOW_BOOL(down_pre
);
1860 SHOW_BOOL(up_restart
);
1861 SHOW_BOOL(up_delay
);
1864 SHOW_BOOL(suppress_timestamps
);
1865 SHOW_BOOL(machine_readable_output
);
1867 SHOW_INT(verbosity
);
1872 SHOW_STR(status_file
);
1873 SHOW_INT(status_file_version
);
1874 SHOW_INT(status_file_update_freq
);
1879 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
1882 SHOW_INT(sockflags
);
1888 SHOW_INT(comp
.flags
);
1891 SHOW_STR(route_script
);
1892 SHOW_STR(route_default_gateway
);
1893 SHOW_INT(route_default_metric
);
1894 SHOW_BOOL(route_noexec
);
1895 SHOW_INT(route_delay
);
1896 SHOW_INT(route_delay_window
);
1897 SHOW_BOOL(route_delay_defined
);
1898 SHOW_BOOL(route_nopull
);
1899 SHOW_BOOL(route_gateway_via_dhcp
);
1900 SHOW_BOOL(allow_pull_fqdn
);
1901 show_pull_filter_list(o
->pull_filter_list
);
1905 print_route_options(o
->routes
, D_SHOW_PARMS
);
1910 print_client_nat_list(o
->client_nat
, D_SHOW_PARMS
);
1913 show_dns_options(&o
->dns_options
);
1915 #ifdef ENABLE_MANAGEMENT
1916 SHOW_STR(management_addr
);
1917 SHOW_STR(management_port
);
1918 SHOW_STR(management_user_pass
);
1919 SHOW_INT(management_log_history_cache
);
1920 SHOW_INT(management_echo_buffer_size
);
1921 SHOW_STR(management_client_user
);
1922 SHOW_STR(management_client_group
);
1923 SHOW_INT(management_flags
);
1925 #ifdef ENABLE_PLUGIN
1928 plugin_option_list_print(o
->plugin_list
, D_SHOW_PARMS
);
1932 SHOW_STR_INLINE(shared_secret_file
);
1933 SHOW_PARM(key_direction
, keydirection2ascii(o
->key_direction
, false, true), "%s");
1934 SHOW_STR(ciphername
);
1935 SHOW_STR(ncp_ciphers
);
1937 #ifndef ENABLE_CRYPTO_MBEDTLS
1939 #endif /* ENABLE_CRYPTO_MBEDTLS */
1941 SHOW_BOOL(mute_replay_warnings
);
1942 SHOW_INT(replay_window
);
1943 SHOW_INT(replay_time
);
1944 SHOW_STR(packet_id_file
);
1945 SHOW_BOOL(test_crypto
);
1946 #ifdef ENABLE_PREDICTION_RESISTANCE
1947 SHOW_BOOL(use_prediction_resistance
);
1950 SHOW_BOOL(tls_server
);
1951 SHOW_BOOL(tls_client
);
1952 SHOW_STR_INLINE(ca_file
);
1954 SHOW_STR_INLINE(dh_file
);
1955 #ifdef ENABLE_MANAGEMENT
1956 if ((o
->management_flags
& MF_EXTERNAL_CERT
))
1958 SHOW_PARM("cert_file", "EXTERNAL_CERT", "%s");
1962 SHOW_STR_INLINE(cert_file
);
1963 SHOW_STR_INLINE(extra_certs_file
);
1965 #ifdef ENABLE_MANAGEMENT
1966 if ((o
->management_flags
& MF_EXTERNAL_KEY
))
1968 SHOW_PARM("priv_key_file", "EXTERNAL_PRIVATE_KEY", "%s");
1972 SHOW_STR_INLINE(priv_key_file
);
1973 #ifndef ENABLE_CRYPTO_MBEDTLS
1974 SHOW_STR_INLINE(pkcs12_file
);
1976 #ifdef ENABLE_CRYPTOAPI
1977 SHOW_STR(cryptoapi_cert
);
1979 SHOW_STR(cipher_list
);
1980 SHOW_STR(cipher_list_tls13
);
1981 SHOW_STR(tls_cert_profile
);
1982 SHOW_STR(tls_verify
);
1983 SHOW_STR(tls_export_cert
);
1984 SHOW_INT(verify_x509_type
);
1985 SHOW_STR(verify_x509_name
);
1986 SHOW_STR_INLINE(crl_file
);
1987 SHOW_INT(ns_cert_type
);
1990 for (i
= 0; i
<MAX_PARMS
; i
++)
1992 SHOW_INT(remote_cert_ku
[i
]);
1995 SHOW_STR(remote_cert_eku
);
1998 SHOW_INT(verify_hash_algo
);
1999 SHOW_INT(verify_hash_depth
);
2000 struct gc_arena gc
= gc_new();
2001 struct verify_hash_list
*hl
= o
->verify_hash
;
2002 int digest_len
= (o
->verify_hash_algo
== MD_SHA1
) ? SHA_DIGEST_LENGTH
:
2003 SHA256_DIGEST_LENGTH
;
2006 char *s
= format_hex_ex(hl
->hash
, digest_len
, 0,
2008 SHOW_PARM(verify_hash
, s
, "%s");
2013 SHOW_INT(ssl_flags
);
2015 SHOW_INT(tls_timeout
);
2017 SHOW_INT(renegotiate_bytes
);
2018 SHOW_INT(renegotiate_packets
);
2019 SHOW_INT(renegotiate_seconds
);
2021 SHOW_INT(handshake_window
);
2022 SHOW_INT(transition_window
);
2024 SHOW_BOOL(single_session
);
2025 SHOW_BOOL(push_peer_info
);
2026 SHOW_BOOL(tls_exit
);
2028 SHOW_STR(tls_crypt_v2_metadata
);
2030 #ifdef ENABLE_PKCS11
2033 for (i
= 0; i
<MAX_PARMS
&& o
->pkcs11_providers
[i
] != NULL
; i
++)
2035 SHOW_PARM(pkcs11_providers
, o
->pkcs11_providers
[i
], "%s");
2040 for (i
= 0; i
<MAX_PARMS
; i
++)
2042 SHOW_PARM(pkcs11_protected_authentication
, o
->pkcs11_protected_authentication
[i
] ? "ENABLED" : "DISABLED", "%s");
2047 for (i
= 0; i
<MAX_PARMS
; i
++)
2049 SHOW_PARM(pkcs11_private_mode
, o
->pkcs11_private_mode
[i
], "%08x");
2054 for (i
= 0; i
<MAX_PARMS
; i
++)
2056 SHOW_PARM(pkcs11_cert_private
, o
->pkcs11_cert_private
[i
] ? "ENABLED" : "DISABLED", "%s");
2059 SHOW_INT(pkcs11_pin_cache_period
);
2060 SHOW_STR(pkcs11_id
);
2061 SHOW_BOOL(pkcs11_id_management
);
2062 #endif /* ENABLE_PKCS11 */
2067 SHOW_BOOL(show_net_up
);
2068 SHOW_INT(route_method
);
2069 SHOW_BOOL(block_outside_dns
);
2070 show_tuntap_options(&o
->tuntap_options
);
2072 #endif /* ifndef ENABLE_SMALL */
2080 #ifdef ENABLE_MANAGEMENT
2082 static struct http_proxy_options
*
2083 parse_http_proxy_override(const char *server
,
2087 struct gc_arena
*gc
)
2091 struct http_proxy_options
*ho
;
2092 ALLOC_OBJ_CLEAR_GC(ho
, struct http_proxy_options
, gc
);
2093 ho
->server
= string_alloc(server
, gc
);
2095 if (flags
&& !strcmp(flags
, "nct"))
2097 ho
->auth_retry
= PAR_NCT
;
2101 ho
->auth_retry
= PAR_ALL
;
2103 ho
->http_version
= "1.0";
2104 ho
->user_agent
= "OpenVPN-Autoproxy/1.0";
2114 options_postprocess_http_proxy_override(struct options
*o
)
2116 const struct connection_list
*l
= o
->connection_list
;
2118 bool succeed
= false;
2119 for (i
= 0; i
< l
->len
; ++i
)
2121 struct connection_entry
*ce
= l
->array
[i
];
2122 if (ce
->proto
== PROTO_TCP_CLIENT
|| ce
->proto
== PROTO_TCP
)
2124 ce
->http_proxy_options
= o
->http_proxy_override
;
2130 for (i
= 0; i
< l
->len
; ++i
)
2132 struct connection_entry
*ce
= l
->array
[i
];
2133 if (ce
->proto
== PROTO_UDP
)
2135 ce
->flags
|= CE_DISABLED
;
2141 msg(M_WARN
, "Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
2145 #endif /* ifdef ENABLE_MANAGEMENT */
2147 static struct connection_list
*
2148 alloc_connection_list_if_undef(struct options
*options
)
2150 if (!options
->connection_list
)
2152 ALLOC_OBJ_CLEAR_GC(options
->connection_list
, struct connection_list
, &options
->gc
);
2154 return options
->connection_list
;
2157 static struct connection_entry
*
2158 alloc_connection_entry(struct options
*options
, const int msglevel
)
2160 struct connection_list
*l
= alloc_connection_list_if_undef(options
);
2161 struct connection_entry
*e
;
2163 if (l
->len
>= CONNECTION_LIST_SIZE
)
2165 msg(msglevel
, "Maximum number of 'connection' options (%d) exceeded", CONNECTION_LIST_SIZE
);
2168 ALLOC_OBJ_GC(e
, struct connection_entry
, &options
->gc
);
2169 l
->array
[l
->len
++] = e
;
2173 static struct remote_list
*
2174 alloc_remote_list_if_undef(struct options
*options
)
2176 if (!options
->remote_list
)
2178 ALLOC_OBJ_CLEAR_GC(options
->remote_list
, struct remote_list
, &options
->gc
);
2180 return options
->remote_list
;
2183 static struct remote_entry
*
2184 alloc_remote_entry(struct options
*options
, const int msglevel
)
2186 struct remote_list
*l
= alloc_remote_list_if_undef(options
);
2187 struct remote_entry
*e
;
2189 if (l
->len
>= CONNECTION_LIST_SIZE
)
2191 msg(msglevel
, "Maximum number of 'remote' options (%d) exceeded", CONNECTION_LIST_SIZE
);
2194 ALLOC_OBJ_GC(e
, struct remote_entry
, &options
->gc
);
2195 l
->array
[l
->len
++] = e
;
2199 static struct pull_filter_list
*
2200 alloc_pull_filter_list(struct options
*o
)
2202 if (!o
->pull_filter_list
)
2204 ALLOC_OBJ_CLEAR_GC(o
->pull_filter_list
, struct pull_filter_list
, &o
->gc
);
2206 return o
->pull_filter_list
;
2209 static struct pull_filter
*
2210 alloc_pull_filter(struct options
*o
, const int msglevel
)
2212 struct pull_filter_list
*l
= alloc_pull_filter_list(o
);
2213 struct pull_filter
*f
;
2215 ALLOC_OBJ_CLEAR_GC(f
, struct pull_filter
, &o
->gc
);
2231 connection_entry_load_re(struct connection_entry
*ce
, const struct remote_entry
*re
)
2235 ce
->remote
= re
->remote
;
2237 if (re
->remote_port
)
2239 ce
->remote_port
= re
->remote_port
;
2243 ce
->proto
= re
->proto
;
2252 connection_entry_preload_key(const char **key_file
, bool *key_inline
,
2253 struct gc_arena
*gc
)
2255 if (key_file
&& *key_file
&& !(*key_inline
))
2257 struct buffer in
= buffer_read_from_file(*key_file
, gc
);
2258 if (!buf_valid(&in
))
2260 msg(M_FATAL
, "Cannot pre-load keyfile (%s)", *key_file
);
2263 *key_file
= (const char *) in
.data
;
2269 check_ca_required(const struct options
*options
)
2271 if (options
->verify_hash_no_ca
2272 || options
->pkcs12_file
2274 #ifndef ENABLE_CRYPTO_MBEDTLS
2282 const char *const str
= "You must define CA file (--ca)"
2283 #ifndef ENABLE_CRYPTO_MBEDTLS
2284 " or CA path (--capath)"
2286 " and/or peer fingerprint verification (--peer-fingerprint)";
2291 options_postprocess_verify_ce(const struct options
*options
,
2292 const struct connection_entry
*ce
)
2294 struct options defaults
;
2295 int dev
= DEV_TYPE_UNDEF
;
2298 init_options(&defaults
, true);
2300 if (options
->test_crypto
)
2302 notnull(options
->shared_secret_file
, "key file (--secret)");
2306 notnull(options
->dev
, "TUN/TAP device (--dev)");
2310 * Get tun/tap/null device type
2312 dev
= dev_type_enum(options
->dev
, options
->dev_type
);
2315 * If "proto tcp" is specified, make sure we know whether it is
2316 * tcp-client or tcp-server.
2318 if (ce
->proto
== PROTO_TCP
)
2321 "--proto tcp is ambiguous in this context. Please specify "
2322 "--proto tcp-server or --proto tcp-client");
2325 if (options
->lladdr
&& dev
!= DEV_TYPE_TAP
)
2327 msg(M_USAGE
, "--lladdr can only be used in --dev tap mode");
2331 * Sanity check on MTU parameters
2333 if (options
->ce
.tun_mtu_defined
&& options
->ce
.link_mtu_defined
)
2335 msg(M_USAGE
, "only one of --tun-mtu or --link-mtu may be defined");
2338 if (!proto_is_udp(ce
->proto
) && options
->mtu_test
)
2340 msg(M_USAGE
, "--mtu-test only makes sense with --proto udp");
2343 /* will we be pulling options from server? */
2344 pull
= options
->pull
;
2347 * Sanity check on --local, --remote, and --ifconfig
2350 if (proto_is_net(ce
->proto
)
2351 && string_defined_equal(ce
->local
, ce
->remote
)
2352 && string_defined_equal(ce
->local_port
, ce
->remote_port
))
2354 msg(M_USAGE
, "--remote and --local addresses are the same");
2357 if (string_defined_equal(ce
->remote
, options
->ifconfig_local
)
2358 || string_defined_equal(ce
->remote
, options
->ifconfig_remote_netmask
))
2361 "--local and --remote addresses must be distinct from --ifconfig "
2365 if (string_defined_equal(ce
->local
, options
->ifconfig_local
)
2366 || string_defined_equal(ce
->local
, options
->ifconfig_remote_netmask
))
2369 "--local addresses must be distinct from --ifconfig addresses");
2372 if (string_defined_equal(options
->ifconfig_local
,
2373 options
->ifconfig_remote_netmask
))
2376 "local and remote/netmask --ifconfig addresses must be different");
2379 if (ce
->bind_defined
&& !ce
->bind_local
)
2381 msg(M_USAGE
, "--bind and --nobind can't be used together");
2384 if (ce
->local
&& !ce
->bind_local
)
2387 "--local and --nobind don't make sense when used together");
2390 if (ce
->local_port_defined
&& !ce
->bind_local
)
2393 "--lport and --nobind don't make sense when used together");
2396 if (!ce
->remote
&& !ce
->bind_local
)
2398 msg(M_USAGE
, "--nobind doesn't make sense unless used with --remote");
2402 * Check for consistency of management options
2404 #ifdef ENABLE_MANAGEMENT
2405 if (!options
->management_addr
2406 && (options
->management_flags
2407 || options
->management_log_history_cache
!= defaults
.management_log_history_cache
))
2409 msg(M_USAGE
, "--management is not specified, however one or more options which modify the behavior of --management were specified");
2412 if ((options
->management_client_user
|| options
->management_client_group
)
2413 && !(options
->management_flags
& MF_UNIX_SOCK
))
2415 msg(M_USAGE
, "--management-client-(user|group) can only be used on unix domain sockets");
2418 if (options
->management_addr
2419 && !(options
->management_flags
& MF_UNIX_SOCK
)
2420 && (!options
->management_user_pass
))
2422 msg(M_WARN
, "WARNING: Using --management on a TCP port WITHOUT "
2423 "passwords is STRONGLY discouraged and considered insecure");
2426 #endif /* ifdef ENABLE_MANAGEMENT */
2428 #if defined(ENABLE_MANAGEMENT) && !defined(HAVE_XKEY_PROVIDER)
2429 if ((tls_version_max() >= TLS_VER_1_3
)
2430 && (options
->management_flags
& MF_EXTERNAL_KEY
)
2431 && !(options
->management_flags
& (MF_EXTERNAL_KEY_NOPADDING
))
2434 msg(M_FATAL
, "management-external-key with TLS 1.3 or later requires "
2435 "nopadding argument/support");
2439 * Windows-specific options.
2443 if (dev
== DEV_TYPE_TUN
&& !(pull
|| (options
->ifconfig_local
&& options
->ifconfig_remote_netmask
)))
2445 msg(M_USAGE
, "On Windows, --ifconfig is required when --dev tun is used");
2448 if ((options
->tuntap_options
.ip_win32_defined
)
2449 && !(pull
|| (options
->ifconfig_local
&& options
->ifconfig_remote_netmask
)))
2451 msg(M_USAGE
, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
2454 if (options
->tuntap_options
.dhcp_options
2455 && options
->windows_driver
!= WINDOWS_DRIVER_WINTUN
2456 && options
->tuntap_options
.ip_win32_type
!= IPW32_SET_DHCP_MASQ
2457 && options
->tuntap_options
.ip_win32_type
!= IPW32_SET_ADAPTIVE
)
2459 msg(M_USAGE
, "--dhcp-option requires --ip-win32 dynamic or adaptive");
2462 if (options
->windows_driver
== WINDOWS_DRIVER_WINTUN
&& dev
!= DEV_TYPE_TUN
)
2464 msg(M_USAGE
, "--windows-driver wintun requires --dev tun");
2466 #endif /* ifdef _WIN32 */
2469 * Check that protocol options make sense.
2472 #ifdef ENABLE_FRAGMENT
2473 if (!proto_is_udp(ce
->proto
) && ce
->fragment
)
2475 msg(M_USAGE
, "--fragment can only be used with --proto udp");
2479 if (!ce
->remote
&& ce
->proto
== PROTO_TCP_CLIENT
)
2481 msg(M_USAGE
, "--remote MUST be used in TCP Client mode");
2484 if ((ce
->http_proxy_options
) && ce
->proto
!= PROTO_TCP_CLIENT
)
2487 "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
2491 if ((ce
->http_proxy_options
) && !ce
->http_proxy_options
->server
)
2494 "--http-proxy not specified but other http proxy options present");
2497 if (ce
->http_proxy_options
&& ce
->socks_proxy_server
)
2500 "--http-proxy can not be used together with --socks-proxy");
2503 if (ce
->socks_proxy_server
&& ce
->proto
== PROTO_TCP_SERVER
)
2505 msg(M_USAGE
, "--socks-proxy can not be used in TCP Server mode");
2508 if (ce
->proto
== PROTO_TCP_SERVER
&& (options
->connection_list
->len
> 1))
2510 msg(M_USAGE
, "TCP server mode allows at most one --remote address");
2514 * Check consistency of --mode server options.
2516 if (options
->mode
== MODE_SERVER
)
2518 #define USAGE_VALID_SERVER_PROTOS "--mode server currently only supports " \
2519 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
2520 #ifdef TARGET_ANDROID
2521 msg(M_FATAL
, "--mode server not supported on Android");
2523 if (!(dev
== DEV_TYPE_TUN
|| dev
== DEV_TYPE_TAP
))
2525 msg(M_USAGE
, "--mode server only works with --dev tun or --dev tap");
2529 msg(M_USAGE
, "--pull cannot be used with --mode server");
2531 if (options
->pull_filter_list
)
2533 msg(M_WARN
, "--pull-filter ignored for --mode server");
2535 if (!(proto_is_udp(ce
->proto
) || ce
->proto
== PROTO_TCP_SERVER
))
2537 msg(M_USAGE
, USAGE_VALID_SERVER_PROTOS
);
2540 if ((options
->port_share_host
|| options
->port_share_port
)
2541 && (ce
->proto
!= PROTO_TCP_SERVER
))
2543 msg(M_USAGE
, "--port-share only works in TCP server mode "
2544 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
2547 if (!options
->tls_server
)
2549 msg(M_USAGE
, "--mode server requires --tls-server");
2553 msg(M_USAGE
, "--remote cannot be used with --mode server");
2555 if (!ce
->bind_local
)
2557 msg(M_USAGE
, "--nobind cannot be used with --mode server");
2559 if (ce
->http_proxy_options
)
2561 msg(M_USAGE
, "--http-proxy cannot be used with --mode server");
2563 if (ce
->socks_proxy_server
)
2565 msg(M_USAGE
, "--socks-proxy cannot be used with --mode server");
2567 /* <connection> blocks force to have a remote embedded, so we check
2568 * for the --remote and bail out if it is present
2570 if (options
->connection_list
->len
>1
2571 || options
->connection_list
->array
[0]->remote
)
2573 msg(M_USAGE
, "<connection> cannot be used with --mode server");
2576 if (options
->shaper
)
2578 msg(M_USAGE
, "--shaper cannot be used with --mode server");
2580 if (options
->ipchange
)
2583 "--ipchange cannot be used with --mode server (use "
2584 "--client-connect instead)");
2586 if (!(proto_is_dgram(ce
->proto
) || ce
->proto
== PROTO_TCP_SERVER
))
2588 msg(M_USAGE
, USAGE_VALID_SERVER_PROTOS
);
2590 if (!proto_is_udp(ce
->proto
) && (options
->cf_max
|| options
->cf_per
))
2592 msg(M_USAGE
, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
2594 if (!(dev
== DEV_TYPE_TAP
|| (dev
== DEV_TYPE_TUN
&& options
->topology
== TOP_SUBNET
)) && options
->ifconfig_pool_netmask
)
2596 msg(M_USAGE
, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
2598 if (options
->routes
&& (options
->routes
->flags
& RG_ENABLE
))
2600 msg(M_USAGE
, "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
2602 if (options
->route_delay_defined
)
2604 msg(M_USAGE
, "--route-delay cannot be used with --mode server");
2606 if (options
->up_delay
)
2608 msg(M_USAGE
, "--up-delay cannot be used with --mode server");
2610 if (!options
->ifconfig_pool_defined
2611 && !options
->ifconfig_ipv6_pool_defined
2612 && options
->ifconfig_pool_persist_filename
)
2615 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
2617 if (options
->ifconfig_ipv6_pool_defined
&& !options
->ifconfig_ipv6_local
)
2619 msg(M_USAGE
, "--ifconfig-ipv6-pool needs --ifconfig-ipv6");
2621 if (options
->allow_recursive_routing
)
2623 msg(M_USAGE
, "--allow-recursive-routing cannot be used with --mode server");
2625 if (options
->auth_user_pass_file
)
2627 msg(M_USAGE
, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
2629 if (options
->ccd_exclusive
&& !options
->client_config_dir
)
2631 msg(M_USAGE
, "--ccd-exclusive must be used with --client-config-dir");
2633 if (options
->auth_token_generate
&& !options
->renegotiate_seconds
)
2635 msg(M_USAGE
, "--auth-gen-token needs a non-infinite "
2636 "--renegotiate_seconds setting");
2638 if (options
->auth_token_generate
&& options
->auth_token_renewal
2639 && options
->auth_token_renewal
< 2 * options
->handshake_window
)
2641 msg(M_USAGE
, "--auth-gen-token renewal time needs to be at least "
2642 " two times --hand-window (%d).",
2643 options
->handshake_window
);
2647 const bool ccnr
= (options
->auth_user_pass_verify_script
2648 || PLUGIN_OPTION_LIST(options
)
2649 || MAN_CLIENT_AUTH_ENABLED(options
));
2650 const char *postfix
= "must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
2651 if ((options
->ssl_flags
& (SSLF_CLIENT_CERT_NOT_REQUIRED
|SSLF_CLIENT_CERT_OPTIONAL
)) && !ccnr
)
2653 msg(M_USAGE
, "--verify-client-cert none|optional %s", postfix
);
2655 if ((options
->ssl_flags
& SSLF_USERNAME_AS_COMMON_NAME
) && !ccnr
)
2657 msg(M_USAGE
, "--username-as-common-name %s", postfix
);
2659 if ((options
->ssl_flags
& SSLF_AUTH_USER_PASS_OPTIONAL
) && !ccnr
)
2661 msg(M_USAGE
, "--auth-user-pass-optional %s", postfix
);
2665 if (options
->vlan_tagging
&& dev
!= DEV_TYPE_TAP
)
2667 msg(M_USAGE
, "--vlan-tagging must be used with --dev tap");
2669 if (!options
->vlan_tagging
)
2671 if (options
->vlan_accept
!= defaults
.vlan_accept
)
2673 msg(M_USAGE
, "--vlan-accept requires --vlan-tagging");
2675 if (options
->vlan_pvid
!= defaults
.vlan_pvid
)
2677 msg(M_USAGE
, "--vlan-pvid requires --vlan-tagging");
2684 * When not in server mode, err if parameters are
2685 * specified which require --mode server.
2687 if (options
->ifconfig_pool_defined
|| options
->ifconfig_pool_persist_filename
)
2689 msg(M_USAGE
, "--ifconfig-pool/--ifconfig-pool-persist requires --mode server");
2691 if (options
->ifconfig_ipv6_pool_defined
)
2693 msg(M_USAGE
, "--ifconfig-ipv6-pool requires --mode server");
2695 if (options
->real_hash_size
!= defaults
.real_hash_size
2696 || options
->virtual_hash_size
!= defaults
.virtual_hash_size
)
2698 msg(M_USAGE
, "--hash-size requires --mode server");
2700 if (options
->learn_address_script
)
2702 msg(M_USAGE
, "--learn-address requires --mode server");
2704 if (options
->client_connect_script
)
2706 msg(M_USAGE
, "--client-connect requires --mode server");
2708 if (options
->client_crresponse_script
)
2710 msg(M_USAGE
, "--client-crresponse requires --mode server");
2712 if (options
->client_disconnect_script
)
2714 msg(M_USAGE
, "--client-disconnect requires --mode server");
2716 if (options
->client_config_dir
|| options
->ccd_exclusive
)
2718 msg(M_USAGE
, "--client-config-dir/--ccd-exclusive requires --mode server");
2720 if (options
->enable_c2c
)
2722 msg(M_USAGE
, "--client-to-client requires --mode server");
2724 if (options
->duplicate_cn
)
2726 msg(M_USAGE
, "--duplicate-cn requires --mode server");
2728 if (options
->cf_max
|| options
->cf_per
)
2730 msg(M_USAGE
, "--connect-freq requires --mode server");
2732 if (options
->ssl_flags
& (SSLF_CLIENT_CERT_NOT_REQUIRED
|SSLF_CLIENT_CERT_OPTIONAL
))
2734 msg(M_USAGE
, "--verify-client-cert requires --mode server");
2736 if (options
->ssl_flags
& SSLF_USERNAME_AS_COMMON_NAME
)
2738 msg(M_USAGE
, "--username-as-common-name requires --mode server");
2740 if (options
->ssl_flags
& SSLF_AUTH_USER_PASS_OPTIONAL
)
2742 msg(M_USAGE
, "--auth-user-pass-optional requires --mode server");
2744 if (options
->ssl_flags
& SSLF_OPT_VERIFY
)
2746 msg(M_USAGE
, "--opt-verify requires --mode server");
2748 if (options
->server_flags
& SF_TCP_NODELAY_HELPER
)
2750 msg(M_WARN
, "WARNING: setting tcp-nodelay on the client side will not "
2751 "affect the server. To have TCP_NODELAY in both direction use "
2752 "tcp-nodelay in the server configuration instead.");
2754 if (options
->auth_user_pass_verify_script
)
2756 msg(M_USAGE
, "--auth-user-pass-verify requires --mode server");
2758 if (options
->auth_token_generate
)
2760 msg(M_USAGE
, "--auth-gen-token requires --mode server");
2763 if (options
->port_share_host
|| options
->port_share_port
)
2765 msg(M_USAGE
, "--port-share requires TCP server mode (--mode server --proto tcp-server)");
2769 if (options
->stale_routes_check_interval
)
2771 msg(M_USAGE
, "--stale-routes-check requires --mode server");
2774 if (options
->vlan_tagging
)
2776 msg(M_USAGE
, "--vlan-tagging requires --mode server");
2781 * Check consistency of replay options
2783 if (!options
->replay
2784 && (options
->replay_window
!= defaults
.replay_window
2785 || options
->replay_time
!= defaults
.replay_time
))
2787 msg(M_USAGE
, "--replay-window doesn't make sense when replay protection is disabled with --no-replay");
2791 * SSL/TLS mode sanity checks.
2793 if (options
->tls_server
+ options
->tls_client
2794 +(options
->shared_secret_file
!= NULL
) > 1)
2796 msg(M_USAGE
, "specify only one of --tls-server, --tls-client, or --secret");
2799 if (!options
->tls_server
&& !options
->tls_client
)
2801 msg(M_INFO
, "DEPRECATION: No tls-client or tls-server option in "
2802 "configuration detected. OpenVPN 2.7 will remove the "
2803 "functionality to run a VPN without TLS. "
2804 "See the examples section in the manual page for "
2805 "examples of a similar quick setup with peer-fingerprint.");
2808 if (options
->ssl_flags
& (SSLF_CLIENT_CERT_NOT_REQUIRED
|SSLF_CLIENT_CERT_OPTIONAL
))
2810 msg(M_WARN
, "WARNING: POTENTIALLY DANGEROUS OPTION "
2811 "--verify-client-cert none|optional "
2812 "may accept clients which do not present a certificate");
2815 const int tls_version_max
=
2816 (options
->ssl_flags
>> SSLF_TLS_VERSION_MAX_SHIFT
)
2817 & SSLF_TLS_VERSION_MAX_MASK
;
2818 const int tls_version_min
=
2819 (options
->ssl_flags
>> SSLF_TLS_VERSION_MIN_SHIFT
)
2820 & SSLF_TLS_VERSION_MIN_MASK
;
2822 if (tls_version_max
> 0 && tls_version_max
< tls_version_min
)
2824 msg(M_USAGE
, "--tls-version-min bigger than --tls-version-max");
2827 if (options
->tls_server
|| options
->tls_client
)
2829 check_ca_required(options
);
2830 #ifdef ENABLE_PKCS11
2831 if (options
->pkcs11_providers
[0])
2833 if (options
->pkcs11_id_management
&& options
->pkcs11_id
!= NULL
)
2835 msg(M_USAGE
, "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2837 if (!options
->pkcs11_id_management
&& options
->pkcs11_id
== NULL
)
2839 msg(M_USAGE
, "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2841 if (options
->cert_file
)
2843 msg(M_USAGE
, "Parameter --cert cannot be used when --pkcs11-provider is also specified.");
2845 if (options
->priv_key_file
)
2847 msg(M_USAGE
, "Parameter --key cannot be used when --pkcs11-provider is also specified.");
2849 #ifdef ENABLE_MANAGEMENT
2850 if (options
->management_flags
& MF_EXTERNAL_KEY
)
2852 msg(M_USAGE
, "Parameter --management-external-key cannot be used when --pkcs11-provider is also specified.");
2854 if (options
->management_flags
& MF_EXTERNAL_CERT
)
2856 msg(M_USAGE
, "Parameter --management-external-cert cannot be used when --pkcs11-provider is also specified.");
2859 if (options
->pkcs12_file
)
2861 msg(M_USAGE
, "Parameter --pkcs12 cannot be used when --pkcs11-provider is also specified.");
2863 #ifdef ENABLE_CRYPTOAPI
2864 if (options
->cryptoapi_cert
)
2866 msg(M_USAGE
, "Parameter --cryptoapicert cannot be used when --pkcs11-provider is also specified.");
2871 #endif /* ifdef ENABLE_PKCS11 */
2872 #ifdef ENABLE_MANAGEMENT
2873 if ((options
->management_flags
& MF_EXTERNAL_KEY
) && options
->priv_key_file
)
2875 msg(M_USAGE
, "--key and --management-external-key are mutually exclusive");
2877 else if ((options
->management_flags
& MF_EXTERNAL_CERT
))
2879 if (options
->cert_file
)
2881 msg(M_USAGE
, "--cert and --management-external-cert are mutually exclusive");
2883 else if (!(options
->management_flags
& MF_EXTERNAL_KEY
))
2885 msg(M_USAGE
, "--management-external-cert must be used with --management-external-key");
2890 #ifdef ENABLE_CRYPTOAPI
2891 if (options
->cryptoapi_cert
)
2893 if (options
->cert_file
)
2895 msg(M_USAGE
, "Parameter --cert cannot be used when --cryptoapicert is also specified.");
2897 if (options
->priv_key_file
)
2899 msg(M_USAGE
, "Parameter --key cannot be used when --cryptoapicert is also specified.");
2901 if (options
->pkcs12_file
)
2903 msg(M_USAGE
, "Parameter --pkcs12 cannot be used when --cryptoapicert is also specified.");
2905 #ifdef ENABLE_MANAGEMENT
2906 if (options
->management_flags
& MF_EXTERNAL_KEY
)
2908 msg(M_USAGE
, "Parameter --management-external-key cannot be used when --cryptoapicert is also specified.");
2910 if (options
->management_flags
& MF_EXTERNAL_CERT
)
2912 msg(M_USAGE
, "Parameter --management-external-cert cannot be used when --cryptoapicert is also specified.");
2917 #endif /* ifdef ENABLE_CRYPTOAPI */
2918 if (options
->pkcs12_file
)
2920 #ifdef ENABLE_CRYPTO_MBEDTLS
2921 msg(M_USAGE
, "Parameter --pkcs12 cannot be used with the mbed TLS version version of OpenVPN.");
2923 if (options
->ca_path
)
2925 msg(M_USAGE
, "Parameter --capath cannot be used when --pkcs12 is also specified.");
2927 if (options
->cert_file
)
2929 msg(M_USAGE
, "Parameter --cert cannot be used when --pkcs12 is also specified.");
2931 if (options
->priv_key_file
)
2933 msg(M_USAGE
, "Parameter --key cannot be used when --pkcs12 is also specified.");
2935 #ifdef ENABLE_MANAGEMENT
2936 if (options
->management_flags
& MF_EXTERNAL_KEY
)
2938 msg(M_USAGE
, "Parameter --management-external-key cannot be used when --pkcs12 is also specified.");
2940 if (options
->management_flags
& MF_EXTERNAL_CERT
)
2942 msg(M_USAGE
, "Parameter --management-external-cert cannot be used when --pkcs12 is also specified.");
2945 #endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2949 #ifdef ENABLE_CRYPTO_MBEDTLS
2950 if (options
->ca_path
)
2952 msg(M_USAGE
, "Parameter --capath cannot be used with the mbed TLS version version of OpenVPN.");
2954 #endif /* ifdef ENABLE_CRYPTO_MBEDTLS */
2959 #ifdef ENABLE_MANAGEMENT
2960 ((options
->cert_file
!= NULL
) || (options
->management_flags
& MF_EXTERNAL_CERT
))
2961 +((options
->priv_key_file
!= NULL
) || (options
->management_flags
& MF_EXTERNAL_KEY
));
2963 (options
->cert_file
!= NULL
) + (options
->priv_key_file
!= NULL
);
2968 if (!options
->auth_user_pass_file
)
2970 msg(M_USAGE
, "No client-side authentication method is "
2971 "specified. You must use either "
2972 "--cert/--key, --pkcs12, or "
2973 "--auth-user-pass");
2978 msg(M_USAGE
, "If you use one of --cert or --key, you must use them both");
2983 #ifdef ENABLE_MANAGEMENT
2984 if (!(options
->management_flags
& MF_EXTERNAL_CERT
))
2986 notnull(options
->cert_file
, "certificate file (--cert) or PKCS#12 file (--pkcs12)");
2987 #ifdef ENABLE_MANAGEMENT
2988 if (!(options
->management_flags
& MF_EXTERNAL_KEY
))
2990 notnull(options
->priv_key_file
, "private key file (--key) or PKCS#12 file (--pkcs12)");
2993 if (ce
->tls_auth_file
&& ce
->tls_crypt_file
)
2995 msg(M_USAGE
, "--tls-auth and --tls-crypt are mutually exclusive");
2997 if (options
->tls_client
&& ce
->tls_crypt_v2_file
2998 && (ce
->tls_auth_file
|| ce
->tls_crypt_file
))
3000 msg(M_USAGE
, "--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
3006 * Make sure user doesn't specify any TLS options
3007 * when in non-TLS mode.
3010 #define MUST_BE_UNDEF(parm) if (options->parm != defaults.parm) {msg(M_USAGE, err, #parm); \
3013 const char err
[] = "Parameter %s can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.";
3015 MUST_BE_UNDEF(ca_file
);
3016 MUST_BE_UNDEF(ca_path
);
3017 MUST_BE_UNDEF(dh_file
);
3018 MUST_BE_UNDEF(cert_file
);
3019 MUST_BE_UNDEF(priv_key_file
);
3020 #ifndef ENABLE_CRYPTO_MBEDTLS
3021 MUST_BE_UNDEF(pkcs12_file
);
3023 MUST_BE_UNDEF(cipher_list
);
3024 MUST_BE_UNDEF(cipher_list_tls13
);
3025 MUST_BE_UNDEF(tls_cert_profile
);
3026 MUST_BE_UNDEF(tls_verify
);
3027 MUST_BE_UNDEF(tls_export_cert
);
3028 MUST_BE_UNDEF(verify_x509_name
);
3029 MUST_BE_UNDEF(tls_timeout
);
3030 MUST_BE_UNDEF(renegotiate_bytes
);
3031 MUST_BE_UNDEF(renegotiate_packets
);
3032 MUST_BE_UNDEF(renegotiate_seconds
);
3033 MUST_BE_UNDEF(handshake_window
);
3034 MUST_BE_UNDEF(transition_window
);
3035 MUST_BE_UNDEF(tls_auth_file
);
3036 MUST_BE_UNDEF(tls_crypt_file
);
3037 MUST_BE_UNDEF(tls_crypt_v2_file
);
3038 MUST_BE_UNDEF(single_session
);
3039 MUST_BE_UNDEF(push_peer_info
);
3040 MUST_BE_UNDEF(tls_exit
);
3041 MUST_BE_UNDEF(crl_file
);
3042 MUST_BE_UNDEF(ns_cert_type
);
3043 MUST_BE_UNDEF(remote_cert_ku
[0]);
3044 MUST_BE_UNDEF(remote_cert_eku
);
3045 #ifdef ENABLE_PKCS11
3046 MUST_BE_UNDEF(pkcs11_providers
[0]);
3047 MUST_BE_UNDEF(pkcs11_private_mode
[0]);
3048 MUST_BE_UNDEF(pkcs11_id
);
3049 MUST_BE_UNDEF(pkcs11_id_management
);
3054 msg(M_USAGE
, err
, "--pull");
3057 #undef MUST_BE_UNDEF
3059 if (options
->auth_user_pass_file
&& !options
->pull
)
3061 msg(M_USAGE
, "--auth-user-pass requires --pull");
3064 uninit_options(&defaults
);
3068 options_postprocess_mutate_ce(struct options
*o
, struct connection_entry
*ce
)
3070 const int dev
= dev_type_enum(o
->dev
, o
->dev_type
);
3072 if (o
->server_defined
|| o
->server_bridge_defined
|| o
->server_bridge_proxy_dhcp
)
3074 if (ce
->proto
== PROTO_TCP
)
3076 ce
->proto
= PROTO_TCP_SERVER
;
3082 if (ce
->proto
== PROTO_TCP
)
3084 ce
->proto
= PROTO_TCP_CLIENT
;
3088 /* an option is present that requires local bind to enabled */
3089 bool need_bind
= ce
->local
|| ce
->local_port_defined
|| ce
->bind_defined
;
3091 /* socks proxy is enabled */
3092 bool uses_socks
= ce
->proto
== PROTO_UDP
&& ce
->socks_proxy_server
;
3094 /* If binding is not forced by an explicit option and we have (at least)
3095 * one of --tcp-client, --pull (or --client), or socks we do not bind
3096 * locally to have "normal" IP client behaviour of a random source port */
3097 if (!need_bind
&& (ce
->proto
== PROTO_TCP_CLIENT
|| uses_socks
|| o
->pull
))
3099 ce
->bind_local
= false;
3102 if (!ce
->bind_local
)
3104 ce
->local_port
= NULL
;
3107 /* if protocol forcing is enabled, disable all protocols
3108 * except for the forced one
3110 if (o
->proto_force
>= 0 && o
->proto_force
!= ce
->proto
)
3112 ce
->flags
|= CE_DISABLED
;
3115 /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)
3116 * so fall back to IPv4-only (trac #1221)
3118 if (ce
->socks_proxy_server
&& proto_is_udp(ce
->proto
) && ce
->af
!= AF_INET
)
3120 if (ce
->af
== AF_INET6
)
3122 msg(M_INFO
, "WARNING: '--proto udp6' is not compatible with "
3123 "'--socks-proxy' today. Forcing IPv4 mode." );
3127 msg(M_INFO
, "NOTICE: dual-stack mode for '--proto udp' does not "
3128 "work correctly with '--socks-proxy' today. Forcing IPv4." );
3137 if (!ce
->tun_mtu_defined
&& !ce
->link_mtu_defined
)
3139 ce
->tun_mtu_defined
= true;
3141 if ((dev
== DEV_TYPE_TAP
) && !ce
->tun_mtu_extra_defined
)
3143 ce
->tun_mtu_extra_defined
= true;
3144 ce
->tun_mtu_extra
= TAP_MTU_EXTRA_DEFAULT
;
3149 * If --mssfix is supplied without a parameter or not specified at all,
3150 * default it to --fragment value, if --fragment is specified and otherwise
3151 * to the default if tun-mtu is 1500
3153 if (o
->ce
.mssfix_default
)
3155 #ifdef ENABLE_FRAGMENT
3158 ce
->mssfix
= ce
->fragment
;
3162 if (ce
->tun_mtu_defined
)
3164 if (o
->ce
.tun_mtu
== TUN_MTU_DEFAULT
)
3166 /* We want to only set mssfix default value if we use a default
3167 * MTU Size, otherwise the different size of tun should either
3168 * already solve the problem or mssfix might artifically make the
3169 * payload packets smaller without mssfix 0 */
3170 ce
->mssfix
= MSSFIX_DEFAULT
;
3171 ce
->mssfix_encap
= true;
3175 /* We still apply the mssfix value but only adjust it to the
3176 * size of the tun interface. */
3177 ce
->mssfix
= ce
->tun_mtu
;
3178 ce
->mssfix_fixed
= true;
3184 * Set per-connection block tls-auth/crypt/crypto-v2 fields if undefined.
3186 * At the end only one of these will be really set because the parser
3187 * logic prevents configurations where more are set.
3189 if (!ce
->tls_auth_file
&& !ce
->tls_crypt_file
&& !ce
->tls_crypt_v2_file
)
3191 ce
->tls_auth_file
= o
->tls_auth_file
;
3192 ce
->tls_auth_file_inline
= o
->tls_auth_file_inline
;
3193 ce
->key_direction
= o
->key_direction
;
3195 ce
->tls_crypt_file
= o
->tls_crypt_file
;
3196 ce
->tls_crypt_file_inline
= o
->tls_crypt_file_inline
;
3198 ce
->tls_crypt_v2_file
= o
->tls_crypt_v2_file
;
3199 ce
->tls_crypt_v2_file_inline
= o
->tls_crypt_v2_file_inline
;
3202 /* Pre-cache tls-auth/crypt(-v2) key file if persist-key was specified and
3203 * keys were not already embedded in the config file.
3207 connection_entry_preload_key(&ce
->tls_auth_file
,
3208 &ce
->tls_auth_file_inline
, &o
->gc
);
3209 connection_entry_preload_key(&ce
->tls_crypt_file
,
3210 &ce
->tls_crypt_file_inline
, &o
->gc
);
3211 connection_entry_preload_key(&ce
->tls_crypt_v2_file
,
3212 &ce
->tls_crypt_v2_file_inline
, &o
->gc
);
3215 if (!proto_is_udp(ce
->proto
) && ce
->explicit_exit_notification
)
3217 msg(M_WARN
, "NOTICE: --explicit-exit-notify ignored for --proto tcp");
3218 ce
->explicit_exit_notification
= 0;
3223 /* If iservice is in use, we need def1 method for redirect-gateway */
3225 remap_redirect_gateway_flags(struct options
*opt
)
3228 && opt
->route_method
== ROUTE_METHOD_SERVICE
3229 && opt
->routes
->flags
& RG_REROUTE_GW
3230 && !(opt
->routes
->flags
& RG_DEF1
))
3232 msg(M_INFO
, "Flag 'def1' added to --redirect-gateway (iservice is in use)");
3233 opt
->routes
->flags
|= RG_DEF1
;
3239 * Save/Restore certain option defaults before --pull is applied.
3243 pre_connect_save(struct options
*o
)
3245 ALLOC_OBJ_CLEAR_GC(o
->pre_connect
, struct options_pre_connect
, &o
->gc
);
3246 o
->pre_connect
->tuntap_options
= o
->tuntap_options
;
3247 o
->pre_connect
->tuntap_options_defined
= true;
3248 o
->pre_connect
->foreign_option_index
= o
->foreign_option_index
;
3252 o
->pre_connect
->routes
= clone_route_option_list(o
->routes
, &o
->gc
);
3253 o
->pre_connect
->routes_defined
= true;
3257 o
->pre_connect
->routes_ipv6
= clone_route_ipv6_option_list(o
->routes_ipv6
, &o
->gc
);
3258 o
->pre_connect
->routes_ipv6_defined
= true;
3262 o
->pre_connect
->client_nat
= clone_client_nat_option_list(o
->client_nat
, &o
->gc
);
3263 o
->pre_connect
->client_nat_defined
= true;
3266 o
->pre_connect
->route_default_gateway
= o
->route_default_gateway
;
3267 o
->pre_connect
->route_ipv6_default_gateway
= o
->route_ipv6_default_gateway
;
3269 o
->pre_connect
->dns_options
= clone_dns_options(o
->dns_options
, &o
->gc
);
3271 /* NCP related options that can be overwritten by a push */
3272 o
->pre_connect
->ciphername
= o
->ciphername
;
3273 o
->pre_connect
->authname
= o
->authname
;
3275 /* Ping related options should be reset to the config values on reconnect */
3276 o
->pre_connect
->ping_rec_timeout
= o
->ping_rec_timeout
;
3277 o
->pre_connect
->ping_rec_timeout_action
= o
->ping_rec_timeout_action
;
3278 o
->pre_connect
->ping_send_timeout
= o
->ping_send_timeout
;
3280 /* Miscellaneous Options */
3282 o
->pre_connect
->comp
= o
->comp
;
3287 pre_connect_restore(struct options
*o
, struct gc_arena
*gc
)
3289 const struct options_pre_connect
*pp
= o
->pre_connect
;
3292 CLEAR(o
->tuntap_options
);
3293 if (pp
->tuntap_options_defined
)
3295 o
->tuntap_options
= pp
->tuntap_options
;
3298 if (pp
->routes_defined
)
3301 copy_route_option_list(o
->routes
, pp
->routes
, gc
);
3308 if (pp
->routes_ipv6_defined
)
3310 rol6_check_alloc(o
);
3311 copy_route_ipv6_option_list(o
->routes_ipv6
, pp
->routes_ipv6
, gc
);
3315 o
->routes_ipv6
= NULL
;
3318 o
->route_default_gateway
= pp
->route_default_gateway
;
3319 o
->route_ipv6_default_gateway
= pp
->route_ipv6_default_gateway
;
3321 /* Free DNS options and reset them to pre-pull state */
3322 gc_free(&o
->dns_options
.gc
);
3323 struct gc_arena dns_gc
= gc_new();
3324 o
->dns_options
= clone_dns_options(pp
->dns_options
, &dns_gc
);
3325 o
->dns_options
.gc
= dns_gc
;
3327 if (pp
->client_nat_defined
)
3329 cnol_check_alloc(o
);
3330 copy_client_nat_option_list(o
->client_nat
, pp
->client_nat
);
3334 o
->client_nat
= NULL
;
3337 o
->foreign_option_index
= pp
->foreign_option_index
;
3339 o
->ciphername
= pp
->ciphername
;
3340 o
->authname
= pp
->authname
;
3342 o
->ping_rec_timeout
= pp
->ping_rec_timeout
;
3343 o
->ping_rec_timeout_action
= pp
->ping_rec_timeout_action
;
3344 o
->ping_send_timeout
= pp
->ping_send_timeout
;
3346 /* Miscellaneous Options */
3352 o
->push_continuation
= 0;
3353 o
->push_option_types_found
= 0;
3354 o
->imported_protocol_flags
= 0;
3358 options_postprocess_mutate_invariant(struct options
*options
)
3361 const int dev
= dev_type_enum(options
->dev
, options
->dev_type
);
3363 /* when using wintun/ovpn-dco, kernel doesn't send DHCP requests, so don't use it */
3364 if ((options
->windows_driver
== WINDOWS_DRIVER_WINTUN
3365 || options
->windows_driver
== WINDOWS_DRIVER_DCO
)
3366 && (options
->tuntap_options
.ip_win32_type
== IPW32_SET_DHCP_MASQ
3367 || options
->tuntap_options
.ip_win32_type
== IPW32_SET_ADAPTIVE
))
3369 options
->tuntap_options
.ip_win32_type
= IPW32_SET_NETSH
;
3372 if ((dev
== DEV_TYPE_TUN
|| dev
== DEV_TYPE_TAP
) && !options
->route_delay_defined
)
3374 /* delay may only be necessary when we perform DHCP handshake */
3375 const bool dhcp
= (options
->tuntap_options
.ip_win32_type
== IPW32_SET_DHCP_MASQ
)
3376 || (options
->tuntap_options
.ip_win32_type
== IPW32_SET_ADAPTIVE
);
3377 if ((options
->mode
== MODE_POINT_TO_POINT
) && dhcp
)
3379 options
->route_delay_defined
= true;
3380 options
->route_delay
= 5; /* Vista sometimes has a race without this */
3384 if (options
->ifconfig_noexec
)
3386 options
->tuntap_options
.ip_win32_type
= IPW32_SET_MANUAL
;
3387 options
->ifconfig_noexec
= false;
3390 remap_redirect_gateway_flags(options
);
3393 * Check consistency of --mode server options.
3395 if (options
->mode
== MODE_SERVER
)
3398 * We need to explicitly set --tap-sleep because
3399 * we do not schedule event timers in the top-level context.
3401 options
->tuntap_options
.tap_sleep
= 10;
3402 if (options
->route_delay_defined
&& options
->route_delay
)
3404 options
->tuntap_options
.tap_sleep
= options
->route_delay
;
3406 options
->route_delay_defined
= false;
3408 #endif /* ifdef _WIN32 */
3410 #ifdef DEFAULT_PKCS11_MODULE
3411 /* If p11-kit is present on the system then load its p11-kit-proxy.so
3412 * by default if the user asks for PKCS#11 without otherwise specifying
3413 * the module to use. */
3414 if (!options
->pkcs11_providers
[0]
3415 && (options
->pkcs11_id
|| options
->pkcs11_id_management
))
3417 options
->pkcs11_providers
[0] = DEFAULT_PKCS11_MODULE
;
3423 options_postprocess_verify(const struct options
*o
)
3425 if (o
->connection_list
)
3428 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
3430 options_postprocess_verify_ce(o
, o
->connection_list
->array
[i
]);
3435 options_postprocess_verify_ce(o
, &o
->ce
);
3438 dns_options_verify(M_FATAL
, &o
->dns_options
);
3440 if (dco_enabled(o
) && o
->enable_c2c
)
3442 msg(M_WARN
, "Note: --client-to-client has no effect when using data "
3443 "channel offload: packets are always sent to the VPN "
3444 "interface and then routed based on the system routing table");
3449 * Checks for availibility of Chacha20-Poly1305 and sets
3450 * the ncp_cipher to either AES-256-GCM:AES-128-GCM or
3451 * AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305.
3454 options_postprocess_setdefault_ncpciphers(struct options
*o
)
3458 /* custom --data-ciphers set, keep list */
3462 /* check if crypto library supports chacha */
3463 bool can_do_chacha
= cipher_valid("CHACHA20-POLY1305");
3465 if (can_do_chacha
&& dco_enabled(o
))
3467 /* also make sure that dco supports chacha */
3468 can_do_chacha
= tls_item_in_cipher_list("CHACHA20-POLY1305", dco_get_supported_ciphers());
3473 o
->ncp_ciphers
= "AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305";
3477 o
->ncp_ciphers
= "AES-256-GCM:AES-128-GCM";
3482 options_postprocess_cipher(struct options
*o
)
3484 if (!o
->pull
&& !(o
->mode
== MODE_SERVER
))
3486 /* If the cipher is not set, use the old default of BF-CBC. We will
3487 * warn that this is deprecated on cipher initialisation, no need
3488 * to warn here as well */
3491 o
->ciphername
= "BF-CBC";
3495 o
->enable_ncp_fallback
= true;
3500 /* pull or P2MP mode */
3503 /* We still need to set the ciphername to BF-CBC since various other
3504 * parts of OpenVPN assert that the ciphername is set */
3505 o
->ciphername
= "BF-CBC";
3507 msg(M_INFO
, "Note: --cipher is not set. OpenVPN versions before 2.5 "
3508 "defaulted to BF-CBC as fallback when cipher negotiation "
3509 "failed in this case. If you need this fallback please add "
3510 "'--data-ciphers-fallback BF-CBC' to your configuration "
3511 "and/or add BF-CBC to --data-ciphers.");
3513 else if (!o
->enable_ncp_fallback
3514 && !tls_item_in_cipher_list(o
->ciphername
, o
->ncp_ciphers
))
3516 msg(M_WARN
, "DEPRECATED OPTION: --cipher set to '%s' but missing in "
3517 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
3519 o
->ciphername
, o
->ncp_ciphers
);
3524 * The option --compat-mode is used to set up default settings to values
3525 * used on the specified openvpn version and earlier.
3527 * This function is used in various "default option" paths to test if the
3528 * user requested compatibility with a version before the one specified
3529 * as argument. This way some default settings can be automatically
3530 * altered to guarantee compatibility with the version specified by the
3531 * user via --compat-mode.
3533 * @param version need compatibility with openvpn versions before the
3534 * one specified (20401 = before 2.4.1)
3535 * @return whether compatibility should be enabled
3538 need_compatibility_before(const struct options
*o
, unsigned int version
)
3540 return o
->backwards_compatible
!= 0 && o
->backwards_compatible
< version
;
3544 * Changes default values so that OpenVPN can be compatible with the user
3548 options_set_backwards_compatible_options(struct options
*o
)
3550 /* TLS min version is not set */
3551 int tls_ver_min
= (o
->ssl_flags
>> SSLF_TLS_VERSION_MIN_SHIFT
)
3552 & SSLF_TLS_VERSION_MIN_MASK
;
3553 if (tls_ver_min
== 0)
3555 int tls_ver_max
= (o
->ssl_flags
>> SSLF_TLS_VERSION_MAX_SHIFT
)
3556 & SSLF_TLS_VERSION_MAX_MASK
;
3557 if (need_compatibility_before(o
, 20307))
3559 /* 2.3.6 and earlier have TLS 1.0 only, set minimum to TLS 1.0 */
3560 o
->ssl_flags
|= (TLS_VER_1_0
<< SSLF_TLS_VERSION_MIN_SHIFT
);
3562 else if (tls_ver_max
== 0 || tls_ver_max
>= TLS_VER_1_2
)
3564 /* Use TLS 1.2 as proper default */
3565 o
->ssl_flags
|= (TLS_VER_1_2
<< SSLF_TLS_VERSION_MIN_SHIFT
);
3569 /* Maximize the minimum version */
3570 o
->ssl_flags
|= (tls_ver_max
<< SSLF_TLS_VERSION_MIN_SHIFT
);
3574 if (need_compatibility_before(o
, 20400))
3578 /* If ciphername is not set default to BF-CBC when targeting these
3579 * old versions that do not have NCP */
3580 o
->ciphername
= "BF-CBC";
3582 /* Versions < 2.4.0 additionally might be compiled with --enable-small and
3583 * not have OCC strings required for "poor man's NCP" */
3584 o
->enable_ncp_fallback
= true;
3587 /* Versions < 2.5.0 do need --cipher in the list of accepted ciphers.
3588 * Version 2.4 probably does not need it but NCP was not so
3589 * good with 2.4 and ncp-disable might be more common on 2.4 peers.
3590 * Only do this iff --cipher is set (explicitly or by compat mode
3591 * < 2.4.0, see above). This is not 100% correct backwards compatible
3592 * behaviour but 2.5 already behaved like this */
3593 if (o
->ciphername
&& need_compatibility_before(o
, 20500)
3594 && !tls_item_in_cipher_list(o
->ciphername
, o
->ncp_ciphers
))
3596 append_cipher_to_ncp_list(o
, o
->ciphername
);
3600 /* Compression is deprecated and we do not want to announce support for it
3601 * by default anymore, additionally DCO breaks with compression.
3603 * Disable compression by default starting with 2.6.0 if no other
3604 * compression related option has been explicitly set */
3605 if (!comp_non_stub_enabled(&o
->comp
) && !need_compatibility_before(o
, 20600)
3606 && (o
->comp
.flags
== 0))
3608 o
->comp
.flags
= COMP_F_ALLOW_STUB_ONLY
|COMP_F_ADVERTISE_STUBS_ONLY
;
3614 options_postprocess_mutate(struct options
*o
, struct env_set
*es
)
3618 * Process helper-type options which map to other, more complex
3619 * sequences of options.
3621 helper_client_server(o
);
3622 helper_keepalive(o
);
3623 helper_tcp_nodelay(o
);
3625 options_postprocess_setdefault_ncpciphers(o
);
3626 options_set_backwards_compatible_options(o
);
3628 options_postprocess_cipher(o
);
3629 o
->ncp_ciphers
= mutate_ncp_cipher_list(o
->ncp_ciphers
, &o
->gc
);
3630 if (o
->ncp_ciphers
== NULL
)
3632 msg(M_USAGE
, "--data-ciphers list contains unsupported ciphers or is too long.");
3635 if (o
->remote_list
&& !o
->connection_list
)
3638 * Convert remotes into connection list
3640 const struct remote_list
*rl
= o
->remote_list
;
3641 for (i
= 0; i
< rl
->len
; ++i
)
3643 const struct remote_entry
*re
= rl
->array
[i
];
3644 struct connection_entry ce
= o
->ce
;
3645 struct connection_entry
*ace
;
3648 connection_entry_load_re(&ce
, re
);
3649 ace
= alloc_connection_entry(o
, M_USAGE
);
3654 else if (!o
->remote_list
&& !o
->connection_list
)
3656 struct connection_entry
*ace
;
3657 ace
= alloc_connection_entry(o
, M_USAGE
);
3662 ASSERT(o
->connection_list
);
3663 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
3665 options_postprocess_mutate_ce(o
, o
->connection_list
->array
[i
]);
3670 /* Check that DH file is specified, or explicitly disabled */
3671 notnull(o
->dh_file
, "DH file (--dh)");
3672 if (streq(o
->dh_file
, "none"))
3677 else if (o
->dh_file
)
3679 /* DH file is only meaningful in a tls-server context. */
3680 msg(M_WARN
, "WARNING: Ignoring option 'dh' in tls-client mode, please only "
3681 "include this in your server configuration");
3684 #if ENABLE_MANAGEMENT
3685 if (o
->http_proxy_override
)
3687 options_postprocess_http_proxy_override(o
);
3690 if (!o
->ca_file
&& !o
->ca_path
&& o
->verify_hash
3691 && o
->verify_hash_depth
== 0)
3693 msg(M_INFO
, "Using certificate fingerprint to verify peer (no CA "
3695 o
->verify_hash_no_ca
= true;
3698 if (o
->config
&& streq(o
->config
, "stdin") && o
->remap_sigusr1
== SIGHUP
)
3700 msg(M_USAGE
, "Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3701 "incompatible with each other.");
3706 /* check if any option should force disabling DCO */
3707 o
->tuntap_options
.disable_dco
= !dco_check_option(D_DCO
, o
)
3708 || !dco_check_startup_option(D_DCO
, o
);
3714 o
->windows_driver
= WINDOWS_DRIVER_DCO
;
3718 if (o
->windows_driver
== WINDOWS_DRIVER_DCO
)
3720 msg(M_WARN
, "Option --windows-driver ovpn-dco is ignored because Data Channel Offload is disabled");
3721 o
->windows_driver
= WINDOWS_DRIVER_TAP_WINDOWS6
;
3723 else if (o
->windows_driver
== WINDOWS_DRIVER_UNSPECIFIED
)
3725 o
->windows_driver
= WINDOWS_DRIVER_TAP_WINDOWS6
;
3730 if (dco_enabled(o
) && o
->dev_node
)
3732 msg(M_WARN
, "Note: ignoring --dev-node as it has no effect when using "
3733 "data channel offload");
3737 /* this depends on o->windows_driver, which is set above */
3738 options_postprocess_mutate_invariant(o
);
3741 * Save certain parms before modifying options during connect, especially
3746 dns_options_preprocess_pull(&o
->dns_options
);
3750 #if defined(_WIN32) || defined(TARGET_ANDROID)
3751 tuntap_options_copy_dns(o
);
3753 foreign_options_copy_dns(o
, es
);
3756 if (o
->auth_token_generate
&& !o
->auth_token_renewal
)
3758 o
->auth_token_renewal
= o
->renegotiate_seconds
;
3760 pre_connect_save(o
);
3764 * Check file/directory sanity
3767 #ifndef ENABLE_SMALL /** Expect people using the stripped down version to know what they do */
3769 #define CHKACC_FILE (1<<0) /** Check for a file/directory presence */
3770 #define CHKACC_DIRPATH (1<<1) /** Check for directory presence where a file should reside */
3771 #define CHKACC_FILEXSTWR (1<<2) /** If file exists, is it writable? */
3772 #define CHKACC_ACPTSTDIN (1<<3) /** If filename is stdin, it's allowed and "exists" */
3773 #define CHKACC_PRIVATE (1<<4) /** Warn if this (private) file is group/others accessible */
3776 check_file_access(const int type
, const char *file
, const int mode
, const char *opt
)
3780 /* If no file configured, no errors to look for */
3786 /* If stdin is allowed and the file name is 'stdin', then do no
3787 * further checks as stdin is always available
3789 if ( (type
& CHKACC_ACPTSTDIN
) && streq(file
, "stdin") )
3794 /* Is the directory path leading to the given file accessible? */
3795 if (type
& CHKACC_DIRPATH
)
3797 char *fullpath
= string_alloc(file
, NULL
); /* POSIX dirname() implementation may modify its arguments */
3798 char *dirpath
= dirname(fullpath
);
3800 if (platform_access(dirpath
, mode
|X_OK
) != 0)
3807 /* Is the file itself accessible? */
3808 if (!errcode
&& (type
& CHKACC_FILE
) && (platform_access(file
, mode
) != 0) )
3813 /* If the file exists and is accessible, is it writable? */
3814 if (!errcode
&& (type
& CHKACC_FILEXSTWR
) && (platform_access(file
, F_OK
) == 0) )
3816 if (platform_access(file
, W_OK
) != 0)
3822 /* Warn if a given private file is group/others accessible. */
3823 if (type
& CHKACC_PRIVATE
)
3826 if (platform_stat(file
, &st
))
3828 msg(M_WARN
| M_ERRNO
, "WARNING: cannot stat file '%s'", file
);
3833 if (st
.st_mode
& (S_IRWXG
|S_IRWXO
))
3835 msg(M_WARN
, "WARNING: file '%s' is group or others accessible", file
);
3841 /* Scream if an error is found */
3844 msg(M_NOPREFIX
| M_OPTERR
| M_ERRNO
, "%s fails with '%s'", opt
, file
);
3847 /* Return true if an error occurred */
3848 return (errcode
!= 0 ? true : false);
3851 /* A wrapper for check_file_access() which also takes a chroot directory.
3852 * If chroot is NULL, behaviour is exactly the same as calling check_file_access() directly,
3853 * otherwise it will look for the file inside the given chroot directory instead.
3856 check_file_access_chroot(const char *chroot
, const int type
, const char *file
, const int mode
, const char *opt
)
3860 /* If no file configured, no errors to look for */
3866 /* If chroot is set, look for the file/directory inside the chroot */
3869 struct gc_arena gc
= gc_new();
3870 struct buffer chroot_file
;
3872 chroot_file
= prepend_dir(chroot
, file
, &gc
);
3873 ret
= check_file_access(type
, BSTR(&chroot_file
), mode
, opt
);
3878 /* No chroot in play, just call core file check function */
3879 ret
= check_file_access(type
, file
, mode
, opt
);
3885 * A wrapper for check_file_access_chroot() that returns false immediately if
3886 * the file is inline (and therefore there is no access to check)
3889 check_file_access_chroot_inline(bool is_inline
, const char *chroot
,
3890 const int type
, const char *file
,
3891 const int mode
, const char *opt
)
3898 return check_file_access_chroot(chroot
, type
, file
, mode
, opt
);
3902 * A wrapper for check_file_access() that returns false immediately if the file
3903 * is inline (and therefore there is no access to check)
3906 check_file_access_inline(bool is_inline
, const int type
, const char *file
,
3907 const int mode
, const char *opt
)
3914 return check_file_access(type
, file
, mode
, opt
);
3918 * Verifies that the path in the "command" that comes after certain script options (e.g., --up) is a
3919 * valid file with appropriate permissions.
3921 * "command" consists of a path, optionally followed by a space, which may be
3922 * followed by arbitrary arguments. It is NOT a full shell command line -- shell expansion is not
3925 * The path and arguments in "command" may be single- or double-quoted or escaped.
3927 * The path is extracted from "command", then check_file_access() is called to check it. The
3928 * arguments, if any, are ignored.
3930 * Note that the type, mode, and opt arguments to this routine are the same as the corresponding
3931 * check_file_access() arguments.
3934 check_cmd_access(const char *command
, const char *opt
, const char *chroot
)
3939 /* If no command was set, there are no errors to look for */
3945 /* Extract executable path and arguments */
3947 argv_parse_cmd(&argv
, command
);
3949 /* if an executable is specified then check it; otherwise, complain */
3952 /* Scripts requires R_OK as well, but that might fail on binaries which
3953 * only requires X_OK to function on Unix - a scenario not unlikely to
3954 * be seen on suid binaries.
3956 return_code
= check_file_access_chroot(chroot
, CHKACC_FILE
, argv
.argv
[0], X_OK
, opt
);
3960 msg(M_NOPREFIX
|M_OPTERR
, "%s fails with '%s': No path to executable.",
3971 * Sanity check of all file/dir options. Checks that file/dir
3972 * is accessible by OpenVPN
3975 options_postprocess_filechecks(struct options
*options
)
3979 /* ** SSL/TLS/crypto related files ** */
3980 errs
|= check_file_access_inline(options
->dh_file_inline
, CHKACC_FILE
,
3981 options
->dh_file
, R_OK
, "--dh");
3983 if (!options
->verify_hash_no_ca
)
3985 errs
|= check_file_access_inline(options
->ca_file_inline
, CHKACC_FILE
,
3986 options
->ca_file
, R_OK
, "--ca");
3989 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
,
3990 options
->ca_path
, R_OK
, "--capath");
3992 errs
|= check_file_access_inline(options
->cert_file_inline
, CHKACC_FILE
,
3993 options
->cert_file
, R_OK
, "--cert");
3995 errs
|= check_file_access_inline(options
->extra_certs_file
, CHKACC_FILE
,
3996 options
->extra_certs_file
, R_OK
,
3999 #ifdef ENABLE_MANAGMENT
4000 if (!(options
->management_flags
& MF_EXTERNAL_KEY
))
4003 errs
|= check_file_access_inline(options
->priv_key_file_inline
,
4004 CHKACC_FILE
|CHKACC_PRIVATE
,
4005 options
->priv_key_file
, R_OK
, "--key");
4008 errs
|= check_file_access_inline(options
->pkcs12_file_inline
,
4009 CHKACC_FILE
|CHKACC_PRIVATE
,
4010 options
->pkcs12_file
, R_OK
, "--pkcs12");
4012 if (options
->ssl_flags
& SSLF_CRL_VERIFY_DIR
)
4014 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
,
4015 options
->crl_file
, R_OK
|X_OK
,
4016 "--crl-verify directory");
4020 errs
|= check_file_access_chroot_inline(options
->crl_file_inline
,
4021 options
->chroot_dir
,
4022 CHKACC_FILE
, options
->crl_file
,
4023 R_OK
, "--crl-verify");
4026 ASSERT(options
->connection_list
);
4027 for (int i
= 0; i
< options
->connection_list
->len
; ++i
)
4029 struct connection_entry
*ce
= options
->connection_list
->array
[i
];
4031 errs
|= check_file_access_inline(ce
->tls_auth_file_inline
,
4032 CHKACC_FILE
|CHKACC_PRIVATE
,
4033 ce
->tls_auth_file
, R_OK
,
4035 errs
|= check_file_access_inline(ce
->tls_crypt_file_inline
,
4036 CHKACC_FILE
|CHKACC_PRIVATE
,
4037 ce
->tls_crypt_file
, R_OK
,
4039 errs
|= check_file_access_inline(ce
->tls_crypt_v2_file_inline
,
4040 CHKACC_FILE
|CHKACC_PRIVATE
,
4041 ce
->tls_crypt_v2_file
, R_OK
,
4045 errs
|= check_file_access_inline(options
->shared_secret_file_inline
,
4046 CHKACC_FILE
|CHKACC_PRIVATE
,
4047 options
->shared_secret_file
, R_OK
,
4050 errs
|= check_file_access(CHKACC_DIRPATH
|CHKACC_FILEXSTWR
,
4051 options
->packet_id_file
, R_OK
|W_OK
, "--replay-persist");
4053 /* ** Password files ** */
4054 errs
|= check_file_access(CHKACC_FILE
|CHKACC_ACPTSTDIN
|CHKACC_PRIVATE
,
4055 options
->key_pass_file
, R_OK
, "--askpass");
4056 #ifdef ENABLE_MANAGEMENT
4057 errs
|= check_file_access(CHKACC_FILE
|CHKACC_ACPTSTDIN
|CHKACC_PRIVATE
,
4058 options
->management_user_pass
, R_OK
,
4059 "--management user/password file");
4060 #endif /* ENABLE_MANAGEMENT */
4061 errs
|= check_file_access_inline(options
->auth_user_pass_file_inline
,
4062 CHKACC_FILE
|CHKACC_ACPTSTDIN
|CHKACC_PRIVATE
,
4063 options
->auth_user_pass_file
, R_OK
,
4064 "--auth-user-pass");
4065 /* ** System related ** */
4066 errs
|= check_file_access(CHKACC_FILE
, options
->chroot_dir
,
4067 R_OK
|X_OK
, "--chroot directory");
4068 errs
|= check_file_access(CHKACC_DIRPATH
|CHKACC_FILEXSTWR
, options
->writepid
,
4069 R_OK
|W_OK
, "--writepid");
4071 /* ** Log related ** */
4072 errs
|= check_file_access(CHKACC_DIRPATH
|CHKACC_FILEXSTWR
, options
->status_file
,
4073 R_OK
|W_OK
, "--status");
4075 /* ** Config related ** */
4076 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
, options
->tls_export_cert
,
4077 R_OK
|W_OK
|X_OK
, "--tls-export-cert");
4078 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
, options
->client_config_dir
,
4079 R_OK
|X_OK
, "--client-config-dir");
4080 errs
|= check_file_access_chroot(options
->chroot_dir
, CHKACC_FILE
, options
->tmp_dir
,
4081 R_OK
|W_OK
|X_OK
, "Temporary directory (--tmp-dir)");
4085 msg(M_USAGE
, "Please correct these errors.");
4088 #endif /* !ENABLE_SMALL */
4091 * Sanity check on options.
4092 * Also set some options based on other
4096 options_postprocess(struct options
*options
, struct env_set
*es
)
4098 options_postprocess_mutate(options
, es
);
4099 options_postprocess_verify(options
);
4100 #ifndef ENABLE_SMALL
4101 options_postprocess_filechecks(options
);
4102 #endif /* !ENABLE_SMALL */
4106 * Sanity check on options after more options were pulled from server.
4107 * Also time to modify some options based on other options.
4110 options_postprocess_pull(struct options
*o
, struct env_set
*es
)
4112 bool success
= dns_options_verify(D_PUSH_ERRORS
, &o
->dns_options
);
4115 dns_options_postprocess_pull(&o
->dns_options
);
4116 setenv_dns_options(&o
->dns_options
, es
);
4117 #if defined(_WIN32) || defined(TARGET_ANDROID)
4118 tuntap_options_copy_dns(o
);
4120 foreign_options_copy_dns(o
, es
);
4127 * Build an options string to represent data channel encryption options.
4128 * This string must match exactly between peers. The keysize is checked
4129 * separately by read_key().
4131 * The following options must match on both peers:
4135 * --dev tun|tap [unit number need not match]
4136 * --dev-type tun|tap
4141 * --proto tcp-client [matched with --proto tcp-server
4142 * on the other end of the connection]
4143 * --proto tcp-server [matched with --proto tcp-client on
4144 * the other end of the connection]
4146 * --ifconfig x y [matched with --ifconfig y x on
4147 * the other end of the connection]
4164 * --tls-client [matched with --tls-server on
4165 * the other end of the connection]
4166 * --tls-server [matched with --tls-client on
4167 * the other end of the connection]
4170 options_string(const struct options
*o
,
4171 const struct frame
*frame
,
4173 openvpn_net_ctx_t
*ctx
,
4175 struct gc_arena
*gc
)
4177 struct buffer out
= alloc_buf(OPTION_LINE_SIZE
);
4178 bool tt_local
= false;
4180 buf_printf(&out
, "V4");
4186 buf_printf(&out
, ",dev-type %s", dev_type_string(o
->dev
, o
->dev_type
));
4187 /* the link-mtu that we send has only a meaning if have a fixed
4188 * cipher (p2p) or have a fallback cipher configured for older non
4189 * ncp clients. But not sending it will make even 2.4 complain
4190 * about it being missing. So still send it. */
4191 buf_printf(&out
, ",link-mtu %u",
4192 (unsigned int) calc_options_string_link_mtu(o
, frame
));
4194 if (o
->ce
.occ_mtu
!= 0)
4196 buf_printf(&out
, ",tun-mtu %d", o
->ce
.occ_mtu
);
4200 buf_printf(&out
, ",tun-mtu %d", frame
->tun_mtu
);
4203 buf_printf(&out
, ",proto %s", proto_remote(o
->ce
.proto
, remote
));
4205 bool p2p_nopull
= o
->mode
== MODE_POINT_TO_POINT
&& !PULL_DEFINED(o
);
4206 /* send tun_ipv6 only in peer2peer mode - in client/server mode, it
4207 * is usually pushed by the server, triggering a non-helpful warning
4209 if (o
->ifconfig_ipv6_local
&& p2p_nopull
)
4211 buf_printf(&out
, ",tun-ipv6");
4215 * Try to get ifconfig parameters into the options string.
4216 * If tt is undefined, make a temporary instantiation.
4220 tt
= init_tun(o
->dev
,
4224 o
->ifconfig_remote_netmask
,
4225 o
->ifconfig_ipv6_local
,
4226 o
->ifconfig_ipv6_netbits
,
4227 o
->ifconfig_ipv6_remote
,
4240 if (tt
&& p2p_nopull
)
4242 const char *ios
= ifconfig_options_string(tt
, remote
, o
->ifconfig_nowarn
, gc
);
4243 if (ios
&& strlen(ios
))
4245 buf_printf(&out
, ",ifconfig %s", ios
);
4255 if (o
->comp
.alg
!= COMP_ALG_UNDEF
)
4257 buf_printf(&out
, ",comp-lzo"); /* for compatibility, this simply indicates that compression context is active, not necessarily LZO per-se */
4261 #ifdef ENABLE_FRAGMENT
4264 buf_printf(&out
, ",mtu-dynamic");
4268 #define TLS_CLIENT (o->tls_client)
4269 #define TLS_SERVER (o->tls_server)
4275 const char *kd
= keydirection2ascii(o
->key_direction
, remote
, false);
4278 buf_printf(&out
, ",keydir %s", kd
);
4285 if (o
->shared_secret_file
|| TLS_CLIENT
|| TLS_SERVER
)
4289 ASSERT((o
->shared_secret_file
!= NULL
)
4290 + (TLS_CLIENT
== true)
4291 + (TLS_SERVER
== true)
4294 /* Skip resolving BF-CBC to allow SSL libraries without BF-CBC
4295 * to work here in the default configuration */
4296 const char *ciphername
= o
->ciphername
;
4299 if (strcmp(o
->ciphername
, "BF-CBC") == 0)
4301 init_key_type(&kt
, "none", o
->authname
, true, false);
4306 init_key_type(&kt
, o
->ciphername
, o
->authname
, true, false);
4307 ciphername
= cipher_kt_name(kt
.cipher
);
4308 if (cipher_defined(o
->ciphername
))
4310 keysize
= cipher_kt_key_size(kt
.cipher
) * 8;
4313 /* Only announce the cipher to our peer if we are willing to
4315 if (p2p_nopull
|| tls_item_in_cipher_list(ciphername
, o
->ncp_ciphers
))
4317 buf_printf(&out
, ",cipher %s", ciphername
);
4319 buf_printf(&out
, ",auth %s", md_kt_name(kt
.digest
));
4320 buf_printf(&out
, ",keysize %d", keysize
);
4321 if (o
->shared_secret_file
)
4323 buf_printf(&out
, ",secret");
4327 buf_printf(&out
, ",no-replay");
4330 #ifdef ENABLE_PREDICTION_RESISTANCE
4331 if (o
->use_prediction_resistance
)
4333 buf_printf(&out
, ",use-prediction-resistance");
4342 if (TLS_CLIENT
|| TLS_SERVER
)
4344 if (o
->ce
.tls_auth_file
)
4346 buf_printf(&out
, ",tls-auth");
4348 /* Not adding tls-crypt here, because we won't reach this code if
4349 * tls-auth/tls-crypt does not match. Removing tls-auth here would
4350 * break stuff, so leaving that in place. */
4352 buf_printf(&out
, ",key-method %d", KEY_METHOD_2
);
4359 buf_printf(&out
, ",tls-server");
4361 else if (TLS_SERVER
)
4363 buf_printf(&out
, ",tls-client");
4370 buf_printf(&out
, ",tls-client");
4372 else if (TLS_SERVER
)
4374 buf_printf(&out
, ",tls-server");
4386 * Compare option strings for equality.
4387 * If the first two chars of the strings differ, it means that
4388 * we are looking at different versions of the options string,
4389 * therefore don't compare them and return true.
4393 options_cmp_equal(char *actual
, const char *expected
)
4395 return options_cmp_equal_safe(actual
, expected
, strlen(actual
) + 1);
4399 options_warning(char *actual
, const char *expected
)
4401 options_warning_safe(actual
, expected
, strlen(actual
) + 1);
4405 options_warning_extract_parm1(const char *option_string
,
4406 struct gc_arena
*gc_ret
)
4408 struct gc_arena gc
= gc_new();
4409 struct buffer b
= string_alloc_buf(option_string
, &gc
);
4410 char *p
= gc_malloc(OPTION_PARM_SIZE
, false, &gc
);
4413 buf_parse(&b
, ' ', p
, OPTION_PARM_SIZE
);
4414 ret
= string_alloc(p
, gc_ret
);
4420 options_warning_safe_scan2(const int msglevel
,
4422 const bool report_inconsistent
,
4424 const struct buffer
*b2_src
,
4425 const char *b1_name
,
4426 const char *b2_name
)
4428 /* We will stop sending 'key-method', 'keydir', 'proto' and 'tls-auth' in
4429 * OCC in a future version (because it's not useful). To reduce questions
4430 * when interoperating, we no longer printing a warning about it.
4432 if (strprefix(p1
, "key-method ")
4433 || strprefix(p1
, "keydir ")
4434 || strprefix(p1
, "proto ")
4435 || streq(p1
, "tls-auth")
4436 || strprefix(p1
, "tun-ipv6")
4437 || strprefix(p1
, "cipher "))
4444 struct gc_arena gc
= gc_new();
4445 struct buffer b2
= *b2_src
;
4446 const char *p1_prefix
= options_warning_extract_parm1(p1
, &gc
);
4447 char *p2
= gc_malloc(OPTION_PARM_SIZE
, false, &gc
);
4449 while (buf_parse(&b2
, delim
, p2
, OPTION_PARM_SIZE
))
4453 const char *p2_prefix
= options_warning_extract_parm1(p2
, &gc
);
4455 if (!strcmp(p1
, p2
))
4459 if (!strcmp(p1_prefix
, p2_prefix
))
4461 if (report_inconsistent
)
4463 msg(msglevel
, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
4464 safe_print(p1_prefix
, &gc
),
4466 safe_print(p1
, &gc
),
4468 safe_print(p2
, &gc
));
4475 msg(msglevel
, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
4476 safe_print(p1_prefix
, &gc
),
4480 safe_print(p1
, &gc
));
4488 options_warning_safe_scan1(const int msglevel
,
4490 const bool report_inconsistent
,
4491 const struct buffer
*b1_src
,
4492 const struct buffer
*b2_src
,
4493 const char *b1_name
,
4494 const char *b2_name
)
4496 struct gc_arena gc
= gc_new();
4497 struct buffer b
= *b1_src
;
4498 char *p
= gc_malloc(OPTION_PARM_SIZE
, true, &gc
);
4500 while (buf_parse(&b
, delim
, p
, OPTION_PARM_SIZE
))
4502 options_warning_safe_scan2(msglevel
, delim
, report_inconsistent
, p
, b2_src
, b1_name
, b2_name
);
4509 options_warning_safe_ml(const int msglevel
, char *actual
, const char *expected
, size_t actual_n
)
4511 struct gc_arena gc
= gc_new();
4515 struct buffer local
= alloc_buf_gc(OPTION_PARM_SIZE
+ 16, &gc
);
4516 struct buffer remote
= alloc_buf_gc(OPTION_PARM_SIZE
+ 16, &gc
);
4517 actual
[actual_n
- 1] = 0;
4519 buf_printf(&local
, "version %s", expected
);
4520 buf_printf(&remote
, "version %s", actual
);
4522 options_warning_safe_scan1(msglevel
, ',', true,
4526 options_warning_safe_scan1(msglevel
, ',', false,
4535 options_cmp_equal_safe(char *actual
, const char *expected
, size_t actual_n
)
4537 struct gc_arena gc
= gc_new();
4542 actual
[actual_n
- 1] = 0;
4543 #ifndef ENABLE_STRICT_OPTIONS_CHECK
4544 if (strncmp(actual
, expected
, 2))
4546 msg(D_SHOW_OCC
, "NOTE: Options consistency check may be skewed by version differences");
4547 options_warning_safe_ml(D_SHOW_OCC
, actual
, expected
, actual_n
);
4551 ret
= !strcmp(actual
, expected
);
4558 options_warning_safe(char *actual
, const char *expected
, size_t actual_n
)
4560 options_warning_safe_ml(M_WARN
, actual
, expected
, actual_n
);
4564 options_string_version(const char *s
, struct gc_arena
*gc
)
4566 struct buffer out
= alloc_buf_gc(4, gc
);
4567 strncpynt((char *) BPTR(&out
), s
, 3);
4572 options_string_extract_option(const char *options_string
, const char *opt_name
,
4573 struct gc_arena
*gc
)
4576 const size_t opt_name_len
= strlen(opt_name
);
4578 const char *p
= options_string
;
4581 if (0 == strncmp(p
, opt_name
, opt_name_len
)
4582 && strlen(p
) > (opt_name_len
+1) && p
[opt_name_len
] == ' ')
4584 /* option found, extract value */
4585 const char *start
= &p
[opt_name_len
+1];
4586 const char *end
= strchr(p
, ',');
4587 size_t val_len
= end
? end
- start
: strlen(start
);
4588 ret
= gc_malloc(val_len
+1, true, gc
);
4589 memcpy(ret
, start
, val_len
);
4595 p
++; /* skip delimiter */
4603 * Parses --windows-driver config option
4605 * @param str value of --windows-driver option
4606 * @param msglevel msglevel to report parsing error
4607 * @return enum windows_driver_type driver type, WINDOWS_DRIVER_UNSPECIFIED on unknown --windows-driver value
4609 static enum windows_driver_type
4610 parse_windows_driver(const char *str
, const int msglevel
)
4612 if (streq(str
, "tap-windows6"))
4614 return WINDOWS_DRIVER_TAP_WINDOWS6
;
4616 else if (streq(str
, "wintun"))
4618 return WINDOWS_DRIVER_WINTUN
;
4621 else if (streq(str
, "ovpn-dco"))
4623 return WINDOWS_DRIVER_DCO
;
4627 msg(msglevel
, "--windows-driver must be tap-windows6, wintun "
4629 return WINDOWS_DRIVER_UNSPECIFIED
;
4632 #endif /* ifdef _WIN32 */
4635 * parse/print topology coding
4639 parse_topology(const char *str
, const int msglevel
)
4641 if (streq(str
, "net30"))
4645 else if (streq(str
, "p2p"))
4649 else if (streq(str
, "subnet"))
4655 msg(msglevel
, "--topology must be net30, p2p, or subnet");
4661 print_topology(const int topology
)
4683 * Manage auth-retry variable
4686 static int global_auth_retry
; /* GLOBAL */
4689 auth_retry_get(void)
4691 return global_auth_retry
;
4695 auth_retry_set(const int msglevel
, const char *option
)
4697 if (streq(option
, "interact"))
4699 global_auth_retry
= AR_INTERACT
;
4701 else if (streq(option
, "nointeract"))
4703 global_auth_retry
= AR_NOINTERACT
;
4705 else if (streq(option
, "none"))
4707 global_auth_retry
= AR_NONE
;
4711 msg(msglevel
, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
4718 auth_retry_print(void)
4720 switch (global_auth_retry
)
4726 return "nointeract";
4737 * Print the help message.
4742 FILE *fp
= msg_fp(0);
4746 fprintf(fp
, "Usage message not available\n");
4751 init_options(&o
, true);
4753 fprintf(fp
, usage_message
,
4755 o
.ce
.connect_retry_seconds
,
4756 o
.ce
.connect_retry_seconds_max
,
4757 o
.ce
.local_port
, o
.ce
.remote_port
,
4758 TUN_MTU_DEFAULT
, TAP_MTU_EXTRA_DEFAULT
,
4760 o
.authname
, o
.ciphername
,
4761 o
.replay_window
, o
.replay_time
,
4762 o
.tls_timeout
, o
.renegotiate_seconds
,
4763 o
.handshake_window
, o
.transition_window
);
4766 #endif /* ENABLE_SMALL */
4768 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
4774 msg(M_WARN
|M_NOPREFIX
, "Use --help for more information.");
4775 openvpn_exit(OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
4780 show_windows_version(const unsigned int flags
)
4782 struct gc_arena gc
= gc_new();
4783 msg(flags
, "Windows version %s", win32_version_string(&gc
, true));
4789 show_library_versions(const unsigned int flags
)
4792 #define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
4794 #define LZO_LIB_VER_STR "", ""
4797 msg(flags
, "library versions: %s%s%s", get_ssl_library_version(),
4800 #undef LZO_LIB_VER_STR
4806 msg(M_INFO
|M_NOPREFIX
, "%s", title_string
);
4807 show_library_versions( M_INFO
|M_NOPREFIX
);
4809 show_windows_version( M_INFO
|M_NOPREFIX
);
4811 msg(M_INFO
|M_NOPREFIX
, "Originally developed by James Yonan");
4812 msg(M_INFO
|M_NOPREFIX
, "Copyright (C) 2002-2022 OpenVPN Inc <sales@openvpn.net>");
4813 #ifndef ENABLE_SMALL
4814 #ifdef CONFIGURE_DEFINES
4815 msg(M_INFO
|M_NOPREFIX
, "Compile time defines: %s", CONFIGURE_DEFINES
);
4817 #ifdef CONFIGURE_SPECIAL_BUILD
4818 msg(M_INFO
|M_NOPREFIX
, "special build: %s", CONFIGURE_SPECIAL_BUILD
);
4821 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
);
4825 notnull(const char *arg
, const char *description
)
4829 msg(M_USAGE
, "You must define %s", description
);
4834 string_defined_equal(const char *s1
, const char *s2
)
4838 return !strcmp(s1
, s2
);
4848 ping_rec_err(int msglevel
)
4850 msg(msglevel
, "only one of --ping-exit or --ping-restart options may be specified");
4855 positive_atoi(const char *str
)
4857 const int i
= atoi(str
);
4858 return i
< 0 ? 0 : i
;
4861 #ifdef _WIN32 /* This function is only used when compiling on Windows */
4863 atou(const char *str
)
4865 unsigned int val
= 0;
4866 sscanf(str
, "%u", &val
);
4872 space(unsigned char c
)
4874 return c
== '\0' || isspace(c
);
4878 parse_line(const char *line
,
4884 struct gc_arena
*gc
)
4886 const int STATE_INITIAL
= 0;
4887 const int STATE_READING_QUOTED_PARM
= 1;
4888 const int STATE_READING_UNQUOTED_PARM
= 2;
4889 const int STATE_DONE
= 3;
4890 const int STATE_READING_SQUOTED_PARM
= 4;
4892 const char *error_prefix
= "";
4895 const char *c
= line
;
4896 int state
= STATE_INITIAL
;
4897 bool backslash
= false;
4900 char parm
[OPTION_PARM_SIZE
];
4901 unsigned int parm_len
= 0;
4903 msglevel
&= ~M_OPTERR
;
4905 if (msglevel
& M_MSG_VIRT_OUT
)
4907 error_prefix
= "ERROR: ";
4915 if (!backslash
&& in
== '\\' && state
!= STATE_READING_SQUOTED_PARM
)
4921 if (state
== STATE_INITIAL
)
4925 if (in
== ';' || in
== '#') /* comment */
4929 if (!backslash
&& in
== '\"')
4931 state
= STATE_READING_QUOTED_PARM
;
4933 else if (!backslash
&& in
== '\'')
4935 state
= STATE_READING_SQUOTED_PARM
;
4940 state
= STATE_READING_UNQUOTED_PARM
;
4944 else if (state
== STATE_READING_UNQUOTED_PARM
)
4946 if (!backslash
&& space(in
))
4955 else if (state
== STATE_READING_QUOTED_PARM
)
4957 if (!backslash
&& in
== '\"')
4966 else if (state
== STATE_READING_SQUOTED_PARM
)
4977 if (state
== STATE_DONE
)
4979 /* ASSERT (parm_len > 0); */
4980 p
[ret
] = gc_malloc(parm_len
+ 1, true, gc
);
4981 memcpy(p
[ret
], parm
, parm_len
);
4982 p
[ret
][parm_len
] = '\0';
4983 state
= STATE_INITIAL
;
4988 if (backslash
&& out
)
4990 if (!(out
== '\\' || out
== '\"' || space(out
)))
4993 msg(msglevel
, "%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix
, file
, line_num
);
4995 msg(msglevel
, "%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE
"\\\\static.key\"", error_prefix
, file
, line_num
);
5003 /* store parameter character */
5006 if (parm_len
>= SIZE(parm
))
5008 parm
[SIZE(parm
) - 1] = 0;
5009 msg(msglevel
, "%sOptions error: Parameter at %s:%d is too long (%d chars max): %s",
5010 error_prefix
, file
, line_num
, (int) SIZE(parm
), parm
);
5013 parm
[parm_len
++] = out
;
5016 /* avoid overflow if too many parms in one config file line */
5022 } while (*c
++ != '\0');
5024 if (state
== STATE_READING_QUOTED_PARM
)
5026 msg(msglevel
, "%sOptions error: No closing quotation (\") in %s:%d", error_prefix
, file
, line_num
);
5029 if (state
== STATE_READING_SQUOTED_PARM
)
5031 msg(msglevel
, "%sOptions error: No closing single quotation (\') in %s:%d", error_prefix
, file
, line_num
);
5034 if (state
!= STATE_INITIAL
)
5036 msg(msglevel
, "%sOptions error: Residual parse state (%d) in %s:%d", error_prefix
, state
, file
, line_num
);
5042 for (i
= 0; i
< ret
; ++i
)
5044 msg(M_INFO
|M_NOPREFIX
, "%s:%d ARG[%d] '%s'", file
, line_num
, i
, p
[i
]);
5052 bypass_doubledash(char **p
)
5054 if (strlen(*p
) >= 3 && !strncmp(*p
, "--", 2))
5061 #define IS_TYPE_FP 1
5062 #define IS_TYPE_BUF 2
5066 struct buffer
*multiline
;
5071 in_src_get(const struct in_src
*is
, char *line
, const int size
)
5073 if (is
->type
== IS_TYPE_FP
)
5075 return BOOL_CAST(fgets(line
, size
, is
->u
.fp
));
5077 else if (is
->type
== IS_TYPE_BUF
)
5079 bool status
= buf_parse(is
->u
.multiline
, '\n', line
, size
);
5080 if ((int) strlen(line
) + 1 < size
)
5094 read_inline_file(struct in_src
*is
, const char *close_tag
,
5095 int *num_lines
, struct gc_arena
*gc
)
5097 char line
[OPTION_LINE_SIZE
];
5098 struct buffer buf
= alloc_buf(8*OPTION_LINE_SIZE
);
5100 bool endtagfound
= false;
5102 while (in_src_get(is
, line
, sizeof(line
)))
5105 char *line_ptr
= line
;
5106 /* Remove leading spaces */
5107 while (isspace(*line_ptr
))
5111 if (!strncmp(line_ptr
, close_tag
, strlen(close_tag
)))
5116 if (!buf_safe(&buf
, strlen(line
)+1))
5118 /* Increase buffer size */
5119 struct buffer buf2
= alloc_buf(buf
.capacity
* 2);
5120 ASSERT(buf_copy(&buf2
, &buf
));
5125 buf_printf(&buf
, "%s", line
);
5129 msg(M_FATAL
, "ERROR: Endtag %s missing", close_tag
);
5131 ret
= string_alloc(BSTR(&buf
), gc
);
5134 secure_memzero(line
, sizeof(line
));
5139 check_inline_file(struct in_src
*is
, char *p
[], struct gc_arena
*gc
)
5141 int num_inline_lines
= 0;
5146 if (arg
[0] == '<' && arg
[strlen(arg
)-1] == '>')
5148 struct buffer close_tag
;
5150 arg
[strlen(arg
) - 1] = '\0';
5151 p
[0] = string_alloc(arg
+ 1, gc
);
5152 close_tag
= alloc_buf(strlen(p
[0]) + 4);
5153 buf_printf(&close_tag
, "</%s>", p
[0]);
5154 p
[1] = read_inline_file(is
, BSTR(&close_tag
), &num_inline_lines
, gc
);
5156 free_buf(&close_tag
);
5159 return num_inline_lines
;
5163 check_inline_file_via_fp(FILE *fp
, char *p
[], struct gc_arena
*gc
)
5166 is
.type
= IS_TYPE_FP
;
5168 return check_inline_file(&is
, p
, gc
);
5172 check_inline_file_via_buf(struct buffer
*multiline
, char *p
[],
5173 struct gc_arena
*gc
)
5176 is
.type
= IS_TYPE_BUF
;
5177 is
.u
.multiline
= multiline
;
5178 return check_inline_file(&is
, p
, gc
);
5182 add_option(struct options
*options
,
5189 const unsigned int permission_mask
,
5190 unsigned int *option_types_found
,
5191 struct env_set
*es
);
5194 read_config_file(struct options
*options
,
5197 const char *top_file
,
5200 const unsigned int permission_mask
,
5201 unsigned int *option_types_found
,
5204 const int max_recursive_levels
= 10;
5207 char line
[OPTION_LINE_SIZE
+1];
5208 char *p
[MAX_PARMS
+1];
5211 if (level
<= max_recursive_levels
)
5213 if (streq(file
, "stdin"))
5219 fp
= platform_fopen(file
, "r");
5224 while (fgets(line
, sizeof(line
), fp
))
5229 if (strlen(line
) == OPTION_LINE_SIZE
)
5231 msg(msglevel
, "In %s:%d: Maximum option line length (%d) exceeded, line starts with %s",
5232 file
, line_num
, OPTION_LINE_SIZE
, line
);
5235 /* Ignore UTF-8 BOM at start of stream */
5236 if (line_num
== 1 && strncmp(line
, "\xEF\xBB\xBF", 3) == 0)
5240 if (parse_line(line
+ offset
, p
, SIZE(p
)-1, file
, line_num
, msglevel
, &options
->gc
))
5242 bypass_doubledash(&p
[0]);
5243 int lines_inline
= check_inline_file_via_fp(fp
, p
, &options
->gc
);
5244 add_option(options
, p
, lines_inline
, file
, line_num
, level
,
5245 msglevel
, permission_mask
, option_types_found
,
5247 line_num
+= lines_inline
;
5257 msg(msglevel
, "In %s:%d: Error opening configuration file: %s", top_file
, top_line
, file
);
5262 msg(msglevel
, "In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file
, top_line
, file
);
5264 secure_memzero(line
, sizeof(line
));
5269 read_config_string(const char *prefix
,
5270 struct options
*options
,
5273 const unsigned int permission_mask
,
5274 unsigned int *option_types_found
,
5277 char line
[OPTION_LINE_SIZE
];
5278 struct buffer multiline
;
5281 buf_set_read(&multiline
, (uint8_t *)config
, strlen(config
));
5283 while (buf_parse(&multiline
, '\n', line
, sizeof(line
)))
5285 char *p
[MAX_PARMS
+1];
5288 if (parse_line(line
, p
, SIZE(p
)-1, prefix
, line_num
, msglevel
, &options
->gc
))
5290 bypass_doubledash(&p
[0]);
5291 int lines_inline
= check_inline_file_via_buf(&multiline
, p
, &options
->gc
);
5292 add_option(options
, p
, lines_inline
, prefix
, line_num
, 0, msglevel
,
5293 permission_mask
, option_types_found
, es
);
5294 line_num
+= lines_inline
;
5298 secure_memzero(line
, sizeof(line
));
5302 parse_argv(struct options
*options
,
5306 const unsigned int permission_mask
,
5307 unsigned int *option_types_found
,
5316 /* config filename specified only? */
5317 if (argc
== 2 && strncmp(argv
[1], "--", 2))
5319 char *p
[MAX_PARMS
+1];
5323 add_option(options
, p
, false, NULL
, 0, 0, msglevel
, permission_mask
,
5324 option_types_found
, es
);
5328 /* parse command line */
5329 for (int i
= 1; i
< argc
; ++i
)
5331 char *p
[MAX_PARMS
+1];
5334 if (strncmp(p
[0], "--", 2))
5336 msg(msglevel
, "I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p
[0]);
5344 for (j
= 1; j
< MAX_PARMS
; ++j
)
5348 char *arg
= argv
[i
+ j
];
5349 if (strncmp(arg
, "--", 2))
5359 add_option(options
, p
, false, NULL
, 0, 0, msglevel
, permission_mask
,
5360 option_types_found
, es
);
5367 * Filter an option line by all pull filters.
5369 * If a match is found, the line is modified depending on
5370 * the filter type, and returns true. If the filter type is
5371 * reject, SIGUSR1 is triggered and the return value is false.
5372 * In that case the caller must end the push processing.
5375 apply_pull_filter(const struct options
*o
, char *line
)
5377 struct pull_filter
*f
;
5379 if (!o
->pull_filter_list
)
5384 /* skip leading spaces matching the behaviour of parse_line */
5385 while (isspace(*line
))
5390 for (f
= o
->pull_filter_list
->head
; f
; f
= f
->next
)
5392 if (f
->type
== PUF_TYPE_ACCEPT
&& strncmp(line
, f
->pattern
, f
->size
) == 0)
5394 msg(D_LOW
, "Pushed option accepted by filter: '%s'", line
);
5397 else if (f
->type
== PUF_TYPE_IGNORE
&& strncmp(line
, f
->pattern
, f
->size
) == 0)
5399 msg(D_PUSH
, "Pushed option removed by filter: '%s'", line
);
5403 else if (f
->type
== PUF_TYPE_REJECT
&& strncmp(line
, f
->pattern
, f
->size
) == 0)
5405 msg(M_WARN
, "Pushed option rejected by filter: '%s'. Restarting.", line
);
5407 throw_signal_soft(SIGUSR1
, "Offending option received from server");
5415 apply_push_options(struct options
*options
,
5417 unsigned int permission_mask
,
5418 unsigned int *option_types_found
,
5421 char line
[OPTION_PARM_SIZE
];
5423 const char *file
= "[PUSH-OPTIONS]";
5424 const int msglevel
= D_PUSH_ERRORS
|M_OPTERR
;
5426 while (buf_parse(buf
, ',', line
, sizeof(line
)))
5428 char *p
[MAX_PARMS
+1];
5431 if (!apply_pull_filter(options
, line
))
5433 return false; /* Cause push/pull error and stop push processing */
5435 if (parse_line(line
, p
, SIZE(p
)-1, file
, line_num
, msglevel
, &options
->gc
))
5437 add_option(options
, p
, false, file
, line_num
, 0, msglevel
,
5438 permission_mask
, option_types_found
, es
);
5445 options_server_import(struct options
*o
,
5446 const char *filename
,
5448 unsigned int permission_mask
,
5449 unsigned int *option_types_found
,
5452 msg(D_PUSH
, "OPTIONS IMPORT: reading client specific options from: %s", filename
);
5465 options_string_import(struct options
*options
,
5468 const unsigned int permission_mask
,
5469 unsigned int *option_types_found
,
5472 read_config_string("[CONFIG-STRING]", options
, config
, msglevel
, permission_mask
, option_types_found
, es
);
5475 #define VERIFY_PERMISSION(mask) { \
5476 if (!verify_permission(p[0], file, line, (mask), permission_mask, \
5477 option_types_found, msglevel, options, is_inline)) \
5484 verify_permission(const char *name
,
5487 const unsigned int type
,
5488 const unsigned int allowed
,
5489 unsigned int *found
,
5491 struct options
*options
,
5494 if (!(type
& allowed
))
5496 msg(msglevel
, "option '%s' cannot be used in this context (%s)", name
, file
);
5500 if (is_inline
&& !(type
& OPT_P_INLINE
))
5502 msg(msglevel
, "option '%s' is not expected to be inline (%s:%d)", name
,
5512 #ifndef ENABLE_SMALL
5513 /* Check if this options is allowed in connection block,
5514 * but we are currently not in a connection block
5515 * unless this is a pushed option.
5516 * Parsing a connection block uses a temporary options struct without
5520 if ((type
& OPT_P_CONNECTION
) && options
->connection_list
5521 && !(allowed
& OPT_P_PULL_MODE
))
5525 msg(M_WARN
, "Option '%s' in %s:%d is ignored by previous <connection> blocks ", name
, file
, line
);
5529 msg(M_WARN
, "Option '%s' is ignored by previous <connection> blocks", name
);
5537 * Check that an option doesn't have too
5541 #define NM_QUOTE_HINT (1<<0)
5544 no_more_than_n_args(const int msglevel
,
5547 const unsigned int flags
)
5549 const int len
= string_array_len((const char **)p
);
5558 msg(msglevel
, "the --%s directive should have at most %d parameter%s.%s",
5561 max
>= 3 ? "s" : "",
5562 (flags
& NM_QUOTE_HINT
) ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")." : "");
5572 msglevel_forward_compatible(struct options
*options
, const int msglevel
)
5574 return options
->forward_compatible
? M_WARN
: msglevel
;
5578 set_user_script(struct options
*options
,
5579 const char **script
,
5580 const char *new_script
,
5586 msg(M_WARN
, "Multiple --%s scripts defined. "
5587 "The previously configured script is overridden.", type
);
5589 *script
= new_script
;
5590 options
->user_script_used
= true;
5592 #ifndef ENABLE_SMALL
5594 char script_name
[100];
5595 openvpn_snprintf(script_name
, sizeof(script_name
),
5596 "--%s script", type
);
5598 if (check_cmd_access(*script
, script_name
, (in_chroot
? options
->chroot_dir
: NULL
)))
5600 msg(M_USAGE
, "Please correct this error.");
5609 show_compression_warning(struct compress_options
*info
)
5611 if (comp_non_stub_enabled(info
))
5614 * Check if already displayed the strong warning and enabled full
5617 if (!(info
->flags
& COMP_F_ALLOW_COMPRESS
))
5619 msg(M_WARN
, "WARNING: Compression for receiving enabled. "
5620 "Compression has been used in the past to break encryption. "
5621 "Sent packets are not compressed unless \"allow-compression yes\" "
5629 key_is_external(const struct options
*options
)
5632 #ifdef ENABLE_MANAGEMENT
5633 ret
= ret
|| (options
->management_flags
& MF_EXTERNAL_KEY
);
5635 #ifdef ENABLE_PKCS11
5636 ret
= ret
|| (options
->pkcs11_providers
[0] != NULL
);
5638 #ifdef ENABLE_CRYPTOAPI
5639 ret
= ret
|| options
->cryptoapi_cert
;
5646 add_option(struct options
*options
,
5653 const unsigned int permission_mask
,
5654 unsigned int *option_types_found
,
5657 struct gc_arena gc
= gc_new();
5658 const bool pull_mode
= BOOL_CAST(permission_mask
& OPT_P_PULL_MODE
);
5659 int msglevel_fc
= msglevel_forward_compatible(options
, msglevel
);
5661 ASSERT(MAX_PARMS
>= 7);
5664 * If directive begins with "setenv opt" prefix, don't raise an error if
5665 * directive is unrecognized.
5667 if (streq(p
[0], "setenv") && p
[1] && streq(p
[1], "opt") && !(permission_mask
& OPT_P_PULL_MODE
))
5671 p
[2] = "setenv opt"; /* will trigger an error that includes setenv opt */
5674 msglevel_fc
= M_WARN
;
5679 file
= "[CMD-LINE]";
5682 if (streq(p
[0], "help"))
5684 VERIFY_PERMISSION(OPT_P_GENERAL
);
5688 msg(msglevel
, "--help does not accept any parameters");
5692 if (streq(p
[0], "version") && !p
[1])
5694 VERIFY_PERMISSION(OPT_P_GENERAL
);
5697 else if (streq(p
[0], "config") && p
[1] && !p
[2])
5699 VERIFY_PERMISSION(OPT_P_CONFIG
);
5701 /* save first config file only in options */
5702 if (!options
->config
)
5704 options
->config
= p
[1];
5707 read_config_file(options
, p
[1], level
, file
, line
, msglevel
, permission_mask
, option_types_found
, es
);
5709 #if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
5710 else if (streq(p
[0], "show-gateway") && !p
[2])
5712 struct route_gateway_info rgi
;
5713 struct route_ipv6_gateway_info rgi6
;
5714 struct in6_addr remote
= IN6ADDR_ANY_INIT
;
5715 openvpn_net_ctx_t net_ctx
;
5716 VERIFY_PERMISSION(OPT_P_GENERAL
);
5719 get_ipv6_addr(p
[1], &remote
, NULL
, M_WARN
);
5721 net_ctx_init(NULL
, &net_ctx
);
5722 get_default_gateway(&rgi
, &net_ctx
);
5723 get_default_gateway_ipv6(&rgi6
, &remote
, &net_ctx
);
5724 print_default_gateway(M_INFO
, &rgi
, &rgi6
);
5725 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
5728 else if (streq(p
[0], "echo") || streq(p
[0], "parameter"))
5730 struct buffer string
= alloc_buf_gc(OPTION_PARM_SIZE
, &gc
);
5734 VERIFY_PERMISSION(OPT_P_ECHO
);
5736 for (j
= 1; j
< MAX_PARMS
; ++j
)
5744 good
&= buf_printf(&string
, " ");
5746 good
&= buf_printf(&string
, "%s", p
[j
]);
5750 /* only message-related ECHO are logged, since other ECHOs
5751 * can potentially include security-sensitive strings */
5752 if (p
[1] && strncmp(p
[1], "msg", 3) == 0)
5754 msg(M_INFO
, "%s:%s",
5755 pull_mode
? "ECHO-PULL" : "ECHO",
5758 #ifdef ENABLE_MANAGEMENT
5761 management_echo(management
, BSTR(&string
), pull_mode
);
5767 msg(M_WARN
, "echo/parameter option overflow");
5770 #ifdef ENABLE_MANAGEMENT
5771 else if (streq(p
[0], "management") && p
[1] && p
[2] && !p
[4])
5773 VERIFY_PERMISSION(OPT_P_GENERAL
);
5774 if (streq(p
[2], "unix"))
5776 #if UNIX_SOCK_SUPPORT
5777 options
->management_flags
|= MF_UNIX_SOCK
;
5779 msg(msglevel
, "MANAGEMENT: this platform does not support unix domain sockets");
5784 options
->management_addr
= p
[1];
5785 options
->management_port
= p
[2];
5788 options
->management_user_pass
= p
[3];
5791 else if (streq(p
[0], "management-client-user") && p
[1] && !p
[2])
5793 VERIFY_PERMISSION(OPT_P_GENERAL
);
5794 options
->management_client_user
= p
[1];
5796 else if (streq(p
[0], "management-client-group") && p
[1] && !p
[2])
5798 VERIFY_PERMISSION(OPT_P_GENERAL
);
5799 options
->management_client_group
= p
[1];
5801 else if (streq(p
[0], "management-query-passwords") && !p
[1])
5803 VERIFY_PERMISSION(OPT_P_GENERAL
);
5804 options
->management_flags
|= MF_QUERY_PASSWORDS
;
5806 else if (streq(p
[0], "management-query-remote") && !p
[1])
5808 VERIFY_PERMISSION(OPT_P_GENERAL
);
5809 options
->management_flags
|= MF_QUERY_REMOTE
;
5811 else if (streq(p
[0], "management-query-proxy") && !p
[1])
5813 VERIFY_PERMISSION(OPT_P_GENERAL
);
5814 options
->management_flags
|= MF_QUERY_PROXY
;
5816 else if (streq(p
[0], "management-hold") && !p
[1])
5818 VERIFY_PERMISSION(OPT_P_GENERAL
);
5819 options
->management_flags
|= MF_HOLD
;
5821 else if (streq(p
[0], "management-signal") && !p
[1])
5823 VERIFY_PERMISSION(OPT_P_GENERAL
);
5824 options
->management_flags
|= MF_SIGNAL
;
5826 else if (streq(p
[0], "management-forget-disconnect") && !p
[1])
5828 VERIFY_PERMISSION(OPT_P_GENERAL
);
5829 options
->management_flags
|= MF_FORGET_DISCONNECT
;
5831 else if (streq(p
[0], "management-up-down") && !p
[1])
5833 VERIFY_PERMISSION(OPT_P_GENERAL
);
5834 options
->management_flags
|= MF_UP_DOWN
;
5836 else if (streq(p
[0], "management-client") && !p
[1])
5838 VERIFY_PERMISSION(OPT_P_GENERAL
);
5839 options
->management_flags
|= MF_CONNECT_AS_CLIENT
;
5841 #ifdef ENABLE_MANAGEMENT
5842 else if (streq(p
[0], "management-external-key"))
5844 VERIFY_PERMISSION(OPT_P_GENERAL
);
5845 for (int j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
5847 if (streq(p
[j
], "nopadding"))
5849 options
->management_flags
|= MF_EXTERNAL_KEY_NOPADDING
;
5851 else if (streq(p
[j
], "pkcs1"))
5853 options
->management_flags
|= MF_EXTERNAL_KEY_PKCS1PAD
;
5855 else if (streq(p
[j
], "pss"))
5857 options
->management_flags
|= MF_EXTERNAL_KEY_PSSPAD
;
5859 else if (streq(p
[j
], "digest"))
5861 options
->management_flags
|= MF_EXTERNAL_KEY_DIGEST
;
5865 msg(msglevel
, "Unknown management-external-key flag: %s", p
[j
]);
5869 * When no option is present, assume that only PKCS1
5870 * padding is supported
5872 if (!(options
->management_flags
5873 &(MF_EXTERNAL_KEY_NOPADDING
| MF_EXTERNAL_KEY_PKCS1PAD
)))
5875 options
->management_flags
|= MF_EXTERNAL_KEY_PKCS1PAD
;
5877 options
->management_flags
|= MF_EXTERNAL_KEY
;
5879 else if (streq(p
[0], "management-external-cert") && p
[1] && !p
[2])
5881 VERIFY_PERMISSION(OPT_P_GENERAL
);
5882 options
->management_flags
|= MF_EXTERNAL_CERT
;
5883 options
->management_certificate
= p
[1];
5885 else if (streq(p
[0], "management-client-auth") && !p
[1])
5887 VERIFY_PERMISSION(OPT_P_GENERAL
);
5888 options
->management_flags
|= MF_CLIENT_AUTH
;
5890 #endif /* ifdef ENABLE_MANAGEMENT */
5891 else if (streq(p
[0], "management-log-cache") && p
[1] && !p
[2])
5895 VERIFY_PERMISSION(OPT_P_GENERAL
);
5899 msg(msglevel
, "--management-log-cache parameter is out of range");
5902 options
->management_log_history_cache
= cache
;
5904 #endif /* ifdef ENABLE_MANAGEMENT */
5905 #ifdef ENABLE_PLUGIN
5906 else if (streq(p
[0], "plugin") && p
[1])
5908 VERIFY_PERMISSION(OPT_P_PLUGIN
);
5909 if (!options
->plugin_list
)
5911 options
->plugin_list
= plugin_option_list_new(&options
->gc
);
5913 if (!plugin_option_list_add(options
->plugin_list
, &p
[1], &options
->gc
))
5915 msg(msglevel
, "plugin add failed: %s", p
[1]);
5920 else if (streq(p
[0], "mode") && p
[1] && !p
[2])
5922 VERIFY_PERMISSION(OPT_P_GENERAL
);
5923 if (streq(p
[1], "p2p"))
5925 options
->mode
= MODE_POINT_TO_POINT
;
5927 else if (streq(p
[1], "server"))
5929 options
->mode
= MODE_SERVER
;
5933 msg(msglevel
, "Bad --mode parameter: %s", p
[1]);
5937 else if (streq(p
[0], "dev") && p
[1] && !p
[2])
5939 VERIFY_PERMISSION(OPT_P_GENERAL
);
5940 options
->dev
= p
[1];
5942 else if (streq(p
[0], "dev-type") && p
[1] && !p
[2])
5944 VERIFY_PERMISSION(OPT_P_GENERAL
);
5945 options
->dev_type
= p
[1];
5948 else if (streq(p
[0], "windows-driver") && p
[1] && !p
[2])
5950 VERIFY_PERMISSION(OPT_P_GENERAL
);
5951 options
->windows_driver
= parse_windows_driver(p
[1], M_FATAL
);
5954 else if (streq(p
[0], "disable-dco"))
5956 options
->tuntap_options
.disable_dco
= true;
5958 else if (streq(p
[0], "dev-node") && p
[1] && !p
[2])
5960 VERIFY_PERMISSION(OPT_P_GENERAL
);
5961 options
->dev_node
= p
[1];
5963 else if (streq(p
[0], "lladdr") && p
[1] && !p
[2])
5965 VERIFY_PERMISSION(OPT_P_UP
);
5966 if (mac_addr_safe(p
[1])) /* MAC address only */
5968 options
->lladdr
= p
[1];
5972 msg(msglevel
, "lladdr parm '%s' must be a MAC address", p
[1]);
5976 else if (streq(p
[0], "topology") && p
[1] && !p
[2])
5978 VERIFY_PERMISSION(OPT_P_UP
);
5979 options
->topology
= parse_topology(p
[1], msglevel
);
5981 else if (streq(p
[0], "tun-ipv6") && !p
[1])
5985 msg(M_WARN
, "Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.");
5988 #ifdef ENABLE_IPROUTE
5989 else if (streq(p
[0], "iproute") && p
[1] && !p
[2])
5991 VERIFY_PERMISSION(OPT_P_GENERAL
);
5992 iproute_path
= p
[1];
5995 else if (streq(p
[0], "ifconfig") && p
[1] && p
[2] && !p
[3])
5997 VERIFY_PERMISSION(OPT_P_UP
);
5998 if (ip_or_dns_addr_safe(p
[1], options
->allow_pull_fqdn
) && ip_or_dns_addr_safe(p
[2], options
->allow_pull_fqdn
)) /* FQDN -- may be DNS name */
6000 options
->ifconfig_local
= p
[1];
6001 options
->ifconfig_remote_netmask
= p
[2];
6005 msg(msglevel
, "ifconfig parms '%s' and '%s' must be valid addresses", p
[1], p
[2]);
6009 else if (streq(p
[0], "ifconfig-ipv6") && p
[1] && p
[2] && !p
[3])
6011 unsigned int netbits
;
6013 VERIFY_PERMISSION(OPT_P_UP
);
6014 if (get_ipv6_addr( p
[1], NULL
, &netbits
, msglevel
)
6015 && ipv6_addr_safe( p
[2] ) )
6017 if (netbits
< 64 || netbits
> 124)
6019 msg( msglevel
, "ifconfig-ipv6: /netbits must be between 64 and 124, not '/%d'", netbits
);
6023 options
->ifconfig_ipv6_local
= get_ipv6_addr_no_netbits(p
[1], &options
->gc
);
6024 options
->ifconfig_ipv6_netbits
= netbits
;
6025 options
->ifconfig_ipv6_remote
= p
[2];
6029 msg(msglevel
, "ifconfig-ipv6 parms '%s' and '%s' must be valid addresses", p
[1], p
[2]);
6033 else if (streq(p
[0], "ifconfig-noexec") && !p
[1])
6035 VERIFY_PERMISSION(OPT_P_UP
);
6036 options
->ifconfig_noexec
= true;
6038 else if (streq(p
[0], "ifconfig-nowarn") && !p
[1])
6040 VERIFY_PERMISSION(OPT_P_UP
);
6041 options
->ifconfig_nowarn
= true;
6043 else if (streq(p
[0], "local") && p
[1] && !p
[2])
6045 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6046 options
->ce
.local
= p
[1];
6048 else if (streq(p
[0], "remote-random") && !p
[1])
6050 VERIFY_PERMISSION(OPT_P_GENERAL
);
6051 options
->remote_random
= true;
6053 else if (streq(p
[0], "connection") && p
[1] && !p
[3])
6055 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
6059 struct connection_entry
*e
;
6061 init_options(&sub
, true);
6062 sub
.ce
= options
->ce
;
6063 read_config_string("[CONNECTION-OPTIONS]", &sub
, p
[1], msglevel
,
6064 OPT_P_CONNECTION
, option_types_found
, es
);
6067 msg(msglevel
, "Each 'connection' block must contain exactly one 'remote' directive");
6068 uninit_options(&sub
);
6072 e
= alloc_connection_entry(options
, msglevel
);
6075 uninit_options(&sub
);
6079 gc_transfer(&options
->gc
, &sub
.gc
);
6080 uninit_options(&sub
);
6083 else if (streq(p
[0], "ignore-unknown-option") && p
[1])
6088 const char **ignore
;
6090 VERIFY_PERMISSION(OPT_P_GENERAL
);
6091 /* Find out how many options to be ignored */
6092 for (i
= 1; p
[i
]; i
++)
6097 /* add number of options already ignored */
6098 for (i
= 0; options
->ignore_unknown_option
6099 && options
->ignore_unknown_option
[i
]; i
++)
6104 /* Allocate array */
6105 ALLOC_ARRAY_GC(ignore
, const char *, numignored
+1, &options
->gc
);
6106 for (i
= 0; options
->ignore_unknown_option
6107 && options
->ignore_unknown_option
[i
]; i
++)
6109 ignore
[i
] = options
->ignore_unknown_option
[i
];
6112 options
->ignore_unknown_option
= ignore
;
6114 for (j
= 1; p
[j
]; j
++)
6116 /* Allow the user to specify ignore-unknown-option --opt too */
6117 if (p
[j
][0]=='-' && p
[j
][1]=='-')
6119 options
->ignore_unknown_option
[i
] = (p
[j
]+2);
6123 options
->ignore_unknown_option
[i
] = p
[j
];
6128 options
->ignore_unknown_option
[i
] = NULL
;
6130 #if ENABLE_MANAGEMENT
6131 else if (streq(p
[0], "http-proxy-override") && p
[1] && p
[2] && !p
[4])
6133 VERIFY_PERMISSION(OPT_P_GENERAL
);
6134 options
->http_proxy_override
= parse_http_proxy_override(p
[1], p
[2], p
[3], msglevel
, &options
->gc
);
6135 if (!options
->http_proxy_override
)
6141 else if (streq(p
[0], "remote") && p
[1] && !p
[4])
6143 struct remote_entry re
;
6144 re
.remote
= re
.remote_port
= NULL
;
6148 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6152 re
.remote_port
= p
[2];
6155 const int proto
= ascii2proto(p
[3]);
6156 const sa_family_t af
= ascii2af(p
[3]);
6160 "remote: bad protocol associated with host %s: '%s'",
6168 if (permission_mask
& OPT_P_GENERAL
)
6170 struct remote_entry
*e
= alloc_remote_entry(options
, msglevel
);
6177 else if (permission_mask
& OPT_P_CONNECTION
)
6179 connection_entry_load_re(&options
->ce
, &re
);
6182 else if (streq(p
[0], "resolv-retry") && p
[1] && !p
[2])
6184 VERIFY_PERMISSION(OPT_P_GENERAL
);
6185 if (streq(p
[1], "infinite"))
6187 options
->resolve_retry_seconds
= RESOLV_RETRY_INFINITE
;
6191 options
->resolve_retry_seconds
= positive_atoi(p
[1]);
6194 else if ((streq(p
[0], "preresolve") || streq(p
[0], "ip-remote-hint")) && !p
[2])
6196 VERIFY_PERMISSION(OPT_P_GENERAL
);
6197 options
->resolve_in_advance
= true;
6198 /* Note the ip-remote-hint and the argument p[1] are for
6199 * backward compatibility */
6202 options
->ip_remote_hint
= p
[1];
6205 else if (streq(p
[0], "connect-retry") && p
[1] && !p
[3])
6207 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6208 options
->ce
.connect_retry_seconds
= positive_atoi(p
[1]);
6210 * Limit the base value of retry wait interval to 16 bits to avoid
6211 * overflow when scaled up for exponential backoff
6213 if (options
->ce
.connect_retry_seconds
> 0xFFFF)
6215 options
->ce
.connect_retry_seconds
= 0xFFFF;
6216 msg(M_WARN
, "connect retry wait interval truncated to %d",
6217 options
->ce
.connect_retry_seconds
);
6222 options
->ce
.connect_retry_seconds_max
=
6223 max_int(positive_atoi(p
[2]), options
->ce
.connect_retry_seconds
);
6226 else if ((streq(p
[0], "connect-timeout") || streq(p
[0], "server-poll-timeout"))
6229 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6230 options
->ce
.connect_timeout
= positive_atoi(p
[1]);
6232 else if (streq(p
[0], "connect-retry-max") && p
[1] && !p
[2])
6234 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6235 options
->connect_retry_max
= positive_atoi(p
[1]);
6237 else if (streq(p
[0], "ipchange") && p
[1])
6239 VERIFY_PERMISSION(OPT_P_SCRIPT
);
6240 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
6244 set_user_script(options
,
6246 string_substitute(p
[1], ',', ' ', &options
->gc
),
6249 else if (streq(p
[0], "float") && !p
[1])
6251 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6252 options
->ce
.remote_float
= true;
6255 else if (streq(p
[0], "gremlin") && p
[1] && !p
[2])
6257 VERIFY_PERMISSION(OPT_P_GENERAL
);
6258 options
->gremlin
= positive_atoi(p
[1]);
6261 else if (streq(p
[0], "chroot") && p
[1] && !p
[2])
6263 VERIFY_PERMISSION(OPT_P_GENERAL
);
6264 options
->chroot_dir
= p
[1];
6266 else if (streq(p
[0], "cd") && p
[1] && !p
[2])
6268 VERIFY_PERMISSION(OPT_P_GENERAL
);
6269 if (platform_chdir(p
[1]))
6271 msg(M_ERR
, "cd to '%s' failed", p
[1]);
6274 options
->cd_dir
= p
[1];
6276 #ifdef ENABLE_SELINUX
6277 else if (streq(p
[0], "setcon") && p
[1] && !p
[2])
6279 VERIFY_PERMISSION(OPT_P_GENERAL
);
6280 options
->selinux_context
= p
[1];
6283 else if (streq(p
[0], "writepid") && p
[1] && !p
[2])
6285 VERIFY_PERMISSION(OPT_P_GENERAL
);
6286 options
->writepid
= p
[1];
6288 else if (streq(p
[0], "up") && p
[1])
6290 VERIFY_PERMISSION(OPT_P_SCRIPT
);
6291 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
6295 set_user_script(options
, &options
->up_script
, p
[1], "up", false);
6297 else if (streq(p
[0], "down") && p
[1])
6299 VERIFY_PERMISSION(OPT_P_SCRIPT
);
6300 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
6304 set_user_script(options
, &options
->down_script
, p
[1], "down", true);
6306 else if (streq(p
[0], "down-pre") && !p
[1])
6308 VERIFY_PERMISSION(OPT_P_GENERAL
);
6309 options
->down_pre
= true;
6311 else if (streq(p
[0], "up-delay") && !p
[1])
6313 VERIFY_PERMISSION(OPT_P_GENERAL
);
6314 options
->up_delay
= true;
6316 else if (streq(p
[0], "up-restart") && !p
[1])
6318 VERIFY_PERMISSION(OPT_P_GENERAL
);
6319 options
->up_restart
= true;
6321 else if (streq(p
[0], "syslog") && !p
[2])
6323 VERIFY_PERMISSION(OPT_P_GENERAL
);
6324 open_syslog(p
[1], false);
6326 else if (streq(p
[0], "daemon") && !p
[2])
6329 VERIFY_PERMISSION(OPT_P_GENERAL
);
6330 if (!options
->daemon
)
6332 options
->daemon
= didit
= true;
6333 open_syslog(p
[1], false);
6339 msg(M_WARN
, "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)", p
[1]);
6344 else if (streq(p
[0], "log") && p
[1] && !p
[2])
6346 VERIFY_PERMISSION(OPT_P_GENERAL
);
6347 options
->log
= true;
6348 redirect_stdout_stderr(p
[1], false);
6350 else if (streq(p
[0], "suppress-timestamps") && !p
[1])
6352 VERIFY_PERMISSION(OPT_P_GENERAL
);
6353 options
->suppress_timestamps
= true;
6354 set_suppress_timestamps(true);
6356 else if (streq(p
[0], "machine-readable-output") && !p
[1])
6358 VERIFY_PERMISSION(OPT_P_GENERAL
);
6359 options
->machine_readable_output
= true;
6360 set_machine_readable_output(true);
6362 else if (streq(p
[0], "log-append") && p
[1] && !p
[2])
6364 VERIFY_PERMISSION(OPT_P_GENERAL
);
6365 options
->log
= true;
6366 redirect_stdout_stderr(p
[1], true);
6368 #ifdef ENABLE_MEMSTATS
6369 else if (streq(p
[0], "memstats") && p
[1] && !p
[2])
6371 VERIFY_PERMISSION(OPT_P_GENERAL
);
6372 options
->memstats_fn
= p
[1];
6375 else if (streq(p
[0], "mlock") && !p
[1])
6377 VERIFY_PERMISSION(OPT_P_GENERAL
);
6378 options
->mlock
= true;
6380 #if ENABLE_IP_PKTINFO
6381 else if (streq(p
[0], "multihome") && !p
[1])
6383 VERIFY_PERMISSION(OPT_P_GENERAL
);
6384 options
->sockflags
|= SF_USE_IP_PKTINFO
;
6387 else if (streq(p
[0], "verb") && p
[1] && !p
[2])
6389 VERIFY_PERMISSION(OPT_P_MESSAGES
);
6390 options
->verbosity
= positive_atoi(p
[1]);
6391 if (options
->verbosity
>= (D_TLS_DEBUG_MED
& M_DEBUG_LEVEL
))
6393 /* We pass this flag to the SSL library to avoid
6394 * mbed TLS always generating debug level logging */
6395 options
->ssl_flags
|= SSLF_TLS_DEBUG_ENABLED
;
6397 #if !defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
6398 /* Warn when a debug verbosity is supplied when built without debug support */
6399 if (options
->verbosity
>= 7)
6401 msg(M_WARN
, "NOTE: debug verbosity (--verb %d) is enabled but this build lacks debug support.",
6402 options
->verbosity
);
6406 else if (streq(p
[0], "mute") && p
[1] && !p
[2])
6408 VERIFY_PERMISSION(OPT_P_MESSAGES
);
6409 options
->mute
= positive_atoi(p
[1]);
6411 else if (streq(p
[0], "errors-to-stderr") && !p
[1])
6413 VERIFY_PERMISSION(OPT_P_MESSAGES
);
6416 else if (streq(p
[0], "status") && p
[1] && !p
[3])
6418 VERIFY_PERMISSION(OPT_P_GENERAL
);
6419 options
->status_file
= p
[1];
6422 options
->status_file_update_freq
= positive_atoi(p
[2]);
6425 else if (streq(p
[0], "status-version") && p
[1] && !p
[2])
6429 VERIFY_PERMISSION(OPT_P_GENERAL
);
6430 version
= atoi(p
[1]);
6431 if (version
< 1 || version
> 3)
6433 msg(msglevel
, "--status-version must be 1 to 3");
6436 options
->status_file_version
= version
;
6438 else if (streq(p
[0], "remap-usr1") && p
[1] && !p
[2])
6440 VERIFY_PERMISSION(OPT_P_GENERAL
);
6441 if (streq(p
[1], "SIGHUP"))
6443 options
->remap_sigusr1
= SIGHUP
;
6445 else if (streq(p
[1], "SIGTERM"))
6447 options
->remap_sigusr1
= SIGTERM
;
6451 msg(msglevel
, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
6455 else if ((streq(p
[0], "link-mtu") || streq(p
[0], "udp-mtu")) && p
[1] && !p
[2])
6457 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6458 options
->ce
.link_mtu
= positive_atoi(p
[1]);
6459 options
->ce
.link_mtu_defined
= true;
6461 else if (streq(p
[0], "tun-mtu") && p
[1] && !p
[3])
6463 VERIFY_PERMISSION(OPT_P_PUSH_MTU
|OPT_P_CONNECTION
);
6464 options
->ce
.tun_mtu
= positive_atoi(p
[1]);
6465 options
->ce
.tun_mtu_defined
= true;
6468 options
->ce
.occ_mtu
= positive_atoi(p
[2]);
6472 options
->ce
.occ_mtu
= 0;
6475 else if (streq(p
[0], "tun-mtu-max") && p
[1] && !p
[3])
6477 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6478 int max_mtu
= positive_atoi(p
[1]);
6479 if (max_mtu
< 68 || max_mtu
> 65536)
6481 msg(msglevel
, "--tun-mtu-max value '%s' is invalid", p
[1]);
6485 options
->ce
.tun_mtu_max
= max_mtu
;
6488 else if (streq(p
[0], "tun-mtu-extra") && p
[1] && !p
[2])
6490 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6491 options
->ce
.tun_mtu_extra
= positive_atoi(p
[1]);
6492 options
->ce
.tun_mtu_extra_defined
= true;
6494 else if (streq(p
[0], "max-packet-size") && p
[1] && !p
[2])
6496 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6497 int maxmtu
= positive_atoi(p
[1]);
6498 options
->ce
.tls_mtu
= constrain_int(maxmtu
, TLS_CHANNEL_MTU_MIN
, TLS_CHANNEL_BUF_SIZE
);
6500 if (maxmtu
< TLS_CHANNEL_MTU_MIN
|| maxmtu
> TLS_CHANNEL_BUF_SIZE
)
6502 msg(M_WARN
, "Note: max-packet-size value outside of allowed "
6503 "control channel packet size (%d to %d), will use %d "
6504 "instead.", TLS_CHANNEL_MTU_MIN
, TLS_CHANNEL_BUF_SIZE
,
6505 options
->ce
.tls_mtu
);
6508 /* also set mssfix maxmtu mtu */
6509 options
->ce
.mssfix
= maxmtu
;
6510 options
->ce
.mssfix_default
= false;
6511 options
->ce
.mssfix_encap
= true;
6513 #ifdef ENABLE_FRAGMENT
6514 else if (streq(p
[0], "mtu-dynamic"))
6516 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6517 msg(msglevel
, "--mtu-dynamic has been replaced by --fragment");
6520 else if (streq(p
[0], "fragment") && p
[1] && !p
[3])
6522 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6523 options
->ce
.fragment
= positive_atoi(p
[1]);
6525 if (p
[2] && streq(p
[2], "mtu"))
6527 options
->ce
.fragment_encap
= true;
6531 msg(msglevel
, "Unknown parameter to --fragment: %s", p
[2]);
6534 #endif /* ifdef ENABLE_FRAGMENT */
6535 else if (streq(p
[0], "mtu-disc") && p
[1] && !p
[2])
6537 VERIFY_PERMISSION(OPT_P_MTU
|OPT_P_CONNECTION
);
6538 options
->ce
.mtu_discover_type
= translate_mtu_discover_type_name(p
[1]);
6540 else if (streq(p
[0], "mtu-test") && !p
[1])
6542 VERIFY_PERMISSION(OPT_P_GENERAL
);
6543 options
->mtu_test
= true;
6545 else if (streq(p
[0], "nice") && p
[1] && !p
[2])
6547 VERIFY_PERMISSION(OPT_P_NICE
);
6548 options
->nice
= atoi(p
[1]);
6550 else if (streq(p
[0], "rcvbuf") && p
[1] && !p
[2])
6552 VERIFY_PERMISSION(OPT_P_SOCKBUF
);
6553 options
->rcvbuf
= positive_atoi(p
[1]);
6555 else if (streq(p
[0], "sndbuf") && p
[1] && !p
[2])
6557 VERIFY_PERMISSION(OPT_P_SOCKBUF
);
6558 options
->sndbuf
= positive_atoi(p
[1]);
6560 else if (streq(p
[0], "mark") && p
[1] && !p
[2])
6562 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
6563 VERIFY_PERMISSION(OPT_P_GENERAL
);
6564 options
->mark
= atoi(p
[1]);
6567 else if (streq(p
[0], "socket-flags"))
6570 VERIFY_PERMISSION(OPT_P_SOCKFLAGS
);
6571 for (j
= 1; j
< MAX_PARMS
&& p
[j
]; ++j
)
6573 if (streq(p
[j
], "TCP_NODELAY"))
6575 options
->sockflags
|= SF_TCP_NODELAY
;
6579 msg(msglevel
, "unknown socket flag: %s", p
[j
]);
6584 else if (streq(p
[0], "bind-dev") && p
[1])
6586 VERIFY_PERMISSION(OPT_P_SOCKFLAGS
);
6587 options
->bind_dev
= p
[1];
6590 else if (streq(p
[0], "txqueuelen") && p
[1] && !p
[2])
6592 VERIFY_PERMISSION(OPT_P_GENERAL
);
6594 options
->tuntap_options
.txqueuelen
= positive_atoi(p
[1]);
6596 msg(msglevel
, "--txqueuelen not supported on this OS");
6600 else if (streq(p
[0], "shaper") && p
[1] && !p
[2])
6604 VERIFY_PERMISSION(OPT_P_SHAPER
);
6605 shaper
= atoi(p
[1]);
6606 if (shaper
< SHAPER_MIN
|| shaper
> SHAPER_MAX
)
6608 msg(msglevel
, "Bad shaper value, must be between %d and %d",
6609 SHAPER_MIN
, SHAPER_MAX
);
6612 options
->shaper
= shaper
;
6614 else if (streq(p
[0], "port") && p
[1] && !p
[2])
6616 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6617 options
->ce
.local_port
= options
->ce
.remote_port
= p
[1];
6619 else if (streq(p
[0], "lport") && p
[1] && !p
[2])
6621 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6622 options
->ce
.local_port_defined
= true;
6623 options
->ce
.local_port
= p
[1];
6625 else if (streq(p
[0], "rport") && p
[1] && !p
[2])
6627 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6628 options
->ce
.remote_port
= p
[1];
6630 else if (streq(p
[0], "bind") && !p
[2])
6632 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6633 options
->ce
.bind_defined
= true;
6634 if (p
[1] && streq(p
[1], "ipv6only"))
6636 options
->ce
.bind_ipv6_only
= true;
6640 else if (streq(p
[0], "nobind") && !p
[1])
6642 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6643 options
->ce
.bind_local
= false;
6645 else if (streq(p
[0], "fast-io") && !p
[1])
6647 VERIFY_PERMISSION(OPT_P_GENERAL
);
6648 options
->fast_io
= true;
6650 else if (streq(p
[0], "inactive") && p
[1] && !p
[3])
6652 VERIFY_PERMISSION(OPT_P_TIMER
);
6653 options
->inactivity_timeout
= positive_atoi(p
[1]);
6656 int64_t val
= atoll(p
[2]);
6657 options
->inactivity_minimum_bytes
= (val
< 0) ? 0 : val
;
6658 if (options
->inactivity_minimum_bytes
> INT_MAX
)
6660 msg(M_WARN
, "WARNING: '--inactive' with a 'bytes' value"
6661 " >2 Gbyte was silently ignored in older versions. If "
6662 " your VPN exits unexpectedly with 'Inactivity timeout'"
6663 " in %d seconds, revisit this value.",
6664 options
->inactivity_timeout
);
6668 else if (streq(p
[0], "session-timeout") && p
[1] && !p
[2])
6670 VERIFY_PERMISSION(OPT_P_TIMER
);
6671 options
->session_timeout
= positive_atoi(p
[1]);
6673 else if (streq(p
[0], "proto") && p
[1] && !p
[2])
6677 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6678 proto
= ascii2proto(p
[1]);
6679 af
= ascii2af(p
[1]);
6683 "Bad protocol: '%s'. Allowed protocols with --proto option: %s",
6685 proto2ascii_all(&gc
));
6688 options
->ce
.proto
= proto
;
6689 options
->ce
.af
= af
;
6691 else if (streq(p
[0], "proto-force") && p
[1] && !p
[2])
6694 VERIFY_PERMISSION(OPT_P_GENERAL
);
6695 proto_force
= ascii2proto(p
[1]);
6696 if (proto_force
< 0)
6698 msg(msglevel
, "Bad --proto-force protocol: '%s'", p
[1]);
6701 options
->proto_force
= proto_force
;
6703 else if (streq(p
[0], "http-proxy") && p
[1] && !p
[5])
6705 struct http_proxy_options
*ho
;
6707 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6712 msg(msglevel
, "http-proxy port number not defined");
6716 ho
= init_http_proxy_options_once(&options
->ce
.http_proxy_options
, &options
->gc
);
6724 /* auto -- try to figure out proxy addr, port, and type automatically */
6725 /* semiauto -- given proxy addr:port, try to figure out type automatically */
6726 /* (auto|semiauto)-nct -- disable proxy auth cleartext protocols (i.e. basic auth) */
6727 if (streq(p
[3], "auto"))
6729 ho
->auth_retry
= PAR_ALL
;
6731 else if (streq(p
[3], "auto-nct"))
6733 ho
->auth_retry
= PAR_NCT
;
6737 ho
->auth_method_string
= "basic";
6738 ho
->auth_file
= p
[3];
6742 ho
->auth_method_string
= p
[4];
6748 ho
->auth_method_string
= "none";
6751 else if (streq(p
[0], "http-proxy-user-pass") && p
[1])
6753 struct http_proxy_options
*ho
;
6754 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
6755 ho
= init_http_proxy_options_once(&options
->ce
.http_proxy_options
, &options
->gc
);
6756 ho
->auth_file
= p
[1];
6757 ho
->inline_creds
= is_inline
;
6759 else if (streq(p
[0], "http-proxy-retry") || streq(p
[0], "socks-proxy-retry"))
6761 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6762 msg(M_WARN
, "DEPRECATED OPTION: http-proxy-retry and socks-proxy-retry: "
6763 "In OpenVPN 2.4 proxy connection retries are handled like regular connections. "
6764 "Use connect-retry-max 1 to get a similar behavior as before.");
6766 else if (streq(p
[0], "http-proxy-timeout") && p
[1] && !p
[2])
6768 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6769 msg(M_WARN
, "DEPRECATED OPTION: http-proxy-timeout: In OpenVPN 2.4 the timeout until a connection to a "
6770 "server is established is managed with a single timeout set by connect-timeout");
6772 else if (streq(p
[0], "http-proxy-option") && p
[1] && !p
[4])
6774 struct http_proxy_options
*ho
;
6776 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6777 ho
= init_http_proxy_options_once(&options
->ce
.http_proxy_options
, &options
->gc
);
6779 if (streq(p
[1], "VERSION") && p
[2] && !p
[3])
6781 ho
->http_version
= p
[2];
6783 else if (streq(p
[1], "AGENT") && p
[2] && !p
[3])
6785 ho
->user_agent
= p
[2];
6787 else if ((streq(p
[1], "EXT1") || streq(p
[1], "EXT2") || streq(p
[1], "CUSTOM-HEADER"))
6790 /* In the wild patched versions use both EXT1/2 and CUSTOM-HEADER
6791 * with either two argument or one */
6793 struct http_custom_header
*custom_header
= NULL
;
6795 /* Find the first free header */
6796 for (i
= 0; i
< MAX_CUSTOM_HTTP_HEADER
; i
++)
6798 if (!ho
->custom_headers
[i
].name
)
6800 custom_header
= &ho
->custom_headers
[i
];
6806 msg(msglevel
, "Cannot use more than %d http-proxy-option CUSTOM-HEADER : '%s'", MAX_CUSTOM_HTTP_HEADER
, p
[1]);
6810 /* We will save p[2] and p[3], the proxy code will detect if
6812 custom_header
->name
= p
[2];
6813 custom_header
->content
= p
[3];
6818 msg(msglevel
, "Bad http-proxy-option or missing or extra parameter: '%s'", p
[1]);
6821 else if (streq(p
[0], "socks-proxy") && p
[1] && !p
[4])
6823 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
6827 options
->ce
.socks_proxy_port
= p
[2];
6831 options
->ce
.socks_proxy_port
= "1080";
6833 options
->ce
.socks_proxy_server
= p
[1];
6834 options
->ce
.socks_proxy_authfile
= p
[3]; /* might be NULL */
6836 else if (streq(p
[0], "keepalive") && p
[1] && p
[2] && !p
[3])
6838 VERIFY_PERMISSION(OPT_P_GENERAL
);
6839 options
->keepalive_ping
= atoi(p
[1]);
6840 options
->keepalive_timeout
= atoi(p
[2]);
6842 else if (streq(p
[0], "ping") && p
[1] && !p
[2])
6844 VERIFY_PERMISSION(OPT_P_TIMER
);
6845 options
->ping_send_timeout
= positive_atoi(p
[1]);
6847 else if (streq(p
[0], "ping-exit") && p
[1] && !p
[2])
6849 VERIFY_PERMISSION(OPT_P_TIMER
);
6850 options
->ping_rec_timeout
= positive_atoi(p
[1]);
6851 options
->ping_rec_timeout_action
= PING_EXIT
;
6853 else if (streq(p
[0], "ping-restart") && p
[1] && !p
[2])
6855 VERIFY_PERMISSION(OPT_P_TIMER
);
6856 options
->ping_rec_timeout
= positive_atoi(p
[1]);
6857 options
->ping_rec_timeout_action
= PING_RESTART
;
6859 else if (streq(p
[0], "ping-timer-rem") && !p
[1])
6861 VERIFY_PERMISSION(OPT_P_TIMER
);
6862 options
->ping_timer_remote
= true;
6864 else if (streq(p
[0], "explicit-exit-notify") && !p
[2])
6866 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_EXPLICIT_NOTIFY
);
6869 options
->ce
.explicit_exit_notification
= positive_atoi(p
[1]);
6873 options
->ce
.explicit_exit_notification
= 1;
6876 else if (streq(p
[0], "persist-tun") && !p
[1])
6878 VERIFY_PERMISSION(OPT_P_PERSIST
);
6879 options
->persist_tun
= true;
6881 else if (streq(p
[0], "persist-key") && !p
[1])
6883 VERIFY_PERMISSION(OPT_P_PERSIST
);
6884 options
->persist_key
= true;
6886 else if (streq(p
[0], "persist-local-ip") && !p
[1])
6888 VERIFY_PERMISSION(OPT_P_PERSIST_IP
);
6889 options
->persist_local_ip
= true;
6891 else if (streq(p
[0], "persist-remote-ip") && !p
[1])
6893 VERIFY_PERMISSION(OPT_P_PERSIST_IP
);
6894 options
->persist_remote_ip
= true;
6896 else if (streq(p
[0], "client-nat") && p
[1] && p
[2] && p
[3] && p
[4] && !p
[5])
6898 VERIFY_PERMISSION(OPT_P_ROUTE
);
6899 cnol_check_alloc(options
);
6900 add_client_nat_to_option_list(options
->client_nat
, p
[1], p
[2], p
[3], p
[4], msglevel
);
6902 else if (streq(p
[0], "route") && p
[1] && !p
[5])
6904 VERIFY_PERMISSION(OPT_P_ROUTE
);
6905 rol_check_alloc(options
);
6908 if (!ip_or_dns_addr_safe(p
[1], options
->allow_pull_fqdn
) && !is_special_addr(p
[1])) /* FQDN -- may be DNS name */
6910 msg(msglevel
, "route parameter network/IP '%s' must be a valid address", p
[1]);
6913 if (p
[2] && !ip_addr_dotted_quad_safe(p
[2])) /* FQDN -- must be IP address */
6915 msg(msglevel
, "route parameter netmask '%s' must be an IP address", p
[2]);
6918 if (p
[3] && !ip_or_dns_addr_safe(p
[3], options
->allow_pull_fqdn
) && !is_special_addr(p
[3])) /* FQDN -- may be DNS name */
6920 msg(msglevel
, "route parameter gateway '%s' must be a valid address", p
[3]);
6924 add_route_to_option_list(options
->routes
, p
[1], p
[2], p
[3], p
[4]);
6926 else if (streq(p
[0], "route-ipv6") && p
[1] && !p
[4])
6928 VERIFY_PERMISSION(OPT_P_ROUTE
);
6929 rol6_check_alloc(options
);
6932 if (!ipv6_addr_safe_hexplusbits(p
[1]))
6934 msg(msglevel
, "route-ipv6 parameter network/IP '%s' must be a valid address", p
[1]);
6937 if (p
[2] && !ipv6_addr_safe(p
[2]))
6939 msg(msglevel
, "route-ipv6 parameter gateway '%s' must be a valid address", p
[2]);
6942 /* p[3] is metric, if present */
6944 add_route_ipv6_to_option_list(options
->routes_ipv6
, p
[1], p
[2], p
[3]);
6946 else if (streq(p
[0], "max-routes") && !p
[2])
6948 msg(M_WARN
, "DEPRECATED OPTION: --max-routes option ignored."
6949 "The number of routes is unlimited as of OpenVPN 2.4. "
6950 "This option will be removed in a future version, "
6951 "please remove it from your configuration.");
6953 else if (streq(p
[0], "route-gateway") && p
[1] && !p
[2])
6955 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
6956 if (streq(p
[1], "dhcp"))
6958 options
->route_gateway_via_dhcp
= true;
6962 if (ip_or_dns_addr_safe(p
[1], options
->allow_pull_fqdn
) || is_special_addr(p
[1])) /* FQDN -- may be DNS name */
6964 options
->route_default_gateway
= p
[1];
6968 msg(msglevel
, "route-gateway parm '%s' must be a valid address", p
[1]);
6973 else if (streq(p
[0], "route-ipv6-gateway") && p
[1] && !p
[2])
6975 if (ipv6_addr_safe(p
[1]))
6977 options
->route_ipv6_default_gateway
= p
[1];
6981 msg(msglevel
, "route-ipv6-gateway parm '%s' must be a valid address", p
[1]);
6985 else if (streq(p
[0], "route-metric") && p
[1] && !p
[2])
6987 VERIFY_PERMISSION(OPT_P_ROUTE
);
6988 options
->route_default_metric
= positive_atoi(p
[1]);
6990 else if (streq(p
[0], "route-delay") && !p
[3])
6992 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
6993 options
->route_delay_defined
= true;
6996 options
->route_delay
= positive_atoi(p
[1]);
6999 options
->route_delay_window
= positive_atoi(p
[2]);
7004 options
->route_delay
= 0;
7007 else if (streq(p
[0], "route-up") && p
[1])
7009 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7010 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7014 set_user_script(options
, &options
->route_script
, p
[1], "route-up", false);
7016 else if (streq(p
[0], "route-pre-down") && p
[1])
7018 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7019 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7023 set_user_script(options
,
7024 &options
->route_predown_script
,
7026 "route-pre-down", true);
7028 else if (streq(p
[0], "route-noexec") && !p
[1])
7030 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7031 options
->route_noexec
= true;
7033 else if (streq(p
[0], "route-nopull") && !p
[1])
7035 VERIFY_PERMISSION(OPT_P_GENERAL
);
7036 options
->route_nopull
= true;
7038 else if (streq(p
[0], "pull-filter") && p
[1] && p
[2] && !p
[3])
7040 struct pull_filter
*f
;
7041 VERIFY_PERMISSION(OPT_P_GENERAL
)
7042 f
= alloc_pull_filter(options
, msglevel
);
7044 if (strcmp("accept", p
[1]) == 0)
7046 f
->type
= PUF_TYPE_ACCEPT
;
7048 else if (strcmp("ignore", p
[1]) == 0)
7050 f
->type
= PUF_TYPE_IGNORE
;
7052 else if (strcmp("reject", p
[1]) == 0)
7054 f
->type
= PUF_TYPE_REJECT
;
7058 msg(msglevel
, "Unknown --pull-filter type: %s", p
[1]);
7062 f
->size
= strlen(p
[2]);
7064 else if (streq(p
[0], "allow-pull-fqdn") && !p
[1])
7066 VERIFY_PERMISSION(OPT_P_GENERAL
);
7067 options
->allow_pull_fqdn
= true;
7069 else if (streq(p
[0], "redirect-gateway") || streq(p
[0], "redirect-private"))
7072 VERIFY_PERMISSION(OPT_P_ROUTE
);
7073 rol_check_alloc(options
);
7075 if (options
->routes
->flags
& RG_ENABLE
)
7078 "WARNING: You have specified redirect-gateway and "
7079 "redirect-private at the same time (or the same option "
7080 "multiple times). This is not well supported and may lead to "
7081 "unexpected results");
7084 options
->routes
->flags
|= RG_ENABLE
;
7086 if (streq(p
[0], "redirect-gateway"))
7088 options
->routes
->flags
|= RG_REROUTE_GW
;
7090 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
7092 if (streq(p
[j
], "local"))
7094 options
->routes
->flags
|= RG_LOCAL
;
7096 else if (streq(p
[j
], "autolocal"))
7098 options
->routes
->flags
|= RG_AUTO_LOCAL
;
7100 else if (streq(p
[j
], "def1"))
7102 options
->routes
->flags
|= RG_DEF1
;
7104 else if (streq(p
[j
], "bypass-dhcp"))
7106 options
->routes
->flags
|= RG_BYPASS_DHCP
;
7108 else if (streq(p
[j
], "bypass-dns"))
7110 options
->routes
->flags
|= RG_BYPASS_DNS
;
7112 else if (streq(p
[j
], "block-local"))
7114 options
->routes
->flags
|= RG_BLOCK_LOCAL
;
7116 else if (streq(p
[j
], "ipv6"))
7118 rol6_check_alloc(options
);
7119 options
->routes_ipv6
->flags
|= RG_REROUTE_GW
;
7121 else if (streq(p
[j
], "!ipv4"))
7123 options
->routes
->flags
&= ~(RG_REROUTE_GW
| RG_ENABLE
);
7127 msg(msglevel
, "unknown --%s flag: %s", p
[0], p
[j
]);
7132 /* we need this here to handle pushed --redirect-gateway */
7133 remap_redirect_gateway_flags(options
);
7136 else if (streq(p
[0], "block-ipv6") && !p
[1])
7138 VERIFY_PERMISSION(OPT_P_ROUTE
);
7139 options
->block_ipv6
= true;
7141 else if (streq(p
[0], "remote-random-hostname") && !p
[1])
7143 VERIFY_PERMISSION(OPT_P_GENERAL
);
7144 options
->sockflags
|= SF_HOST_RANDOMIZE
;
7146 else if (streq(p
[0], "setenv") && p
[1] && !p
[3])
7148 VERIFY_PERMISSION(OPT_P_GENERAL
);
7149 if (streq(p
[1], "REMOTE_RANDOM_HOSTNAME") && !p
[2])
7151 options
->sockflags
|= SF_HOST_RANDOMIZE
;
7153 else if (streq(p
[1], "GENERIC_CONFIG"))
7155 msg(msglevel
, "this is a generic configuration and cannot directly be used");
7158 else if (streq(p
[1], "PUSH_PEER_INFO") && !p
[2])
7160 options
->push_peer_info
= true;
7162 else if (streq(p
[1], "SERVER_POLL_TIMEOUT") && p
[2])
7164 options
->ce
.connect_timeout
= positive_atoi(p
[2]);
7168 if (streq(p
[1], "FORWARD_COMPATIBLE") && p
[2] && streq(p
[2], "1"))
7170 options
->forward_compatible
= true;
7171 msglevel_fc
= msglevel_forward_compatible(options
, msglevel
);
7173 setenv_str(es
, p
[1], p
[2] ? p
[2] : "");
7176 else if (streq(p
[0], "compat-mode") && p
[1] && !p
[3])
7178 unsigned int major
, minor
, patch
;
7179 if (!(sscanf(p
[1], "%u.%u.%u", &major
, &minor
, &patch
) == 3))
7181 msg(msglevel
, "cannot parse version number for --compat-mode: %s",
7186 options
->backwards_compatible
= major
* 10000 + minor
* 100 + patch
;
7188 else if (streq(p
[0], "setenv-safe") && p
[1] && !p
[3])
7190 VERIFY_PERMISSION(OPT_P_SETENV
);
7191 setenv_str_safe(es
, p
[1], p
[2] ? p
[2] : "");
7193 else if (streq(p
[0], "script-security") && p
[1] && !p
[2])
7195 VERIFY_PERMISSION(OPT_P_GENERAL
);
7196 script_security_set(atoi(p
[1]));
7198 else if (streq(p
[0], "mssfix") && !p
[3])
7200 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
7203 /* value specified, assume encapsulation is not
7204 * included unless "mtu" follows later */
7205 options
->ce
.mssfix
= positive_atoi(p
[1]);
7206 options
->ce
.mssfix_encap
= false;
7207 options
->ce
.mssfix_default
= false;
7211 /* Set MTU to default values */
7212 options
->ce
.mssfix_default
= true;
7213 options
->ce
.mssfix_encap
= true;
7214 options
->ce
.mssfix_fixed
= false;
7217 if (p
[2] && streq(p
[2], "mtu"))
7219 options
->ce
.mssfix_encap
= true;
7221 else if (p
[2] && streq(p
[2], "fixed"))
7223 options
->ce
.mssfix_fixed
= true;
7227 msg(msglevel
, "Unknown parameter to --mssfix: %s", p
[2]);
7230 else if (streq(p
[0], "disable-occ") && !p
[1])
7232 VERIFY_PERMISSION(OPT_P_GENERAL
);
7233 options
->occ
= false;
7235 else if (streq(p
[0], "server") && p
[1] && p
[2] && !p
[4])
7237 const int lev
= M_WARN
;
7239 in_addr_t network
, netmask
;
7241 VERIFY_PERMISSION(OPT_P_GENERAL
);
7242 network
= get_ip_addr(p
[1], lev
, &error
);
7243 netmask
= get_ip_addr(p
[2], lev
, &error
);
7244 if (error
|| !network
|| !netmask
)
7246 msg(msglevel
, "error parsing --server parameters");
7249 options
->server_defined
= true;
7250 options
->server_network
= network
;
7251 options
->server_netmask
= netmask
;
7255 if (streq(p
[3], "nopool"))
7257 options
->server_flags
|= SF_NOPOOL
;
7261 msg(msglevel
, "error parsing --server: %s is not a recognized flag", p
[3]);
7266 else if (streq(p
[0], "server-ipv6") && p
[1] && !p
[2])
7268 const int lev
= M_WARN
;
7269 struct in6_addr network
;
7270 unsigned int netbits
= 0;
7272 VERIFY_PERMISSION(OPT_P_GENERAL
);
7273 if (!get_ipv6_addr(p
[1], &network
, &netbits
, lev
) )
7275 msg(msglevel
, "error parsing --server-ipv6 parameter");
7278 if (netbits
< 64 || netbits
> 124)
7281 "--server-ipv6 settings: network must be between /64 and /124 (not /%d)",
7286 options
->server_ipv6_defined
= true;
7287 options
->server_network_ipv6
= network
;
7288 options
->server_netbits_ipv6
= netbits
;
7290 else if (streq(p
[0], "server-bridge") && p
[1] && p
[2] && p
[3] && p
[4] && !p
[5])
7292 const int lev
= M_WARN
;
7294 in_addr_t ip
, netmask
, pool_start
, pool_end
;
7296 VERIFY_PERMISSION(OPT_P_GENERAL
);
7297 ip
= get_ip_addr(p
[1], lev
, &error
);
7298 netmask
= get_ip_addr(p
[2], lev
, &error
);
7299 pool_start
= get_ip_addr(p
[3], lev
, &error
);
7300 pool_end
= get_ip_addr(p
[4], lev
, &error
);
7301 if (error
|| !ip
|| !netmask
|| !pool_start
|| !pool_end
)
7303 msg(msglevel
, "error parsing --server-bridge parameters");
7306 options
->server_bridge_defined
= true;
7307 options
->server_bridge_ip
= ip
;
7308 options
->server_bridge_netmask
= netmask
;
7309 options
->server_bridge_pool_start
= pool_start
;
7310 options
->server_bridge_pool_end
= pool_end
;
7312 else if (streq(p
[0], "server-bridge") && p
[1] && streq(p
[1], "nogw") && !p
[2])
7314 VERIFY_PERMISSION(OPT_P_GENERAL
);
7315 options
->server_bridge_proxy_dhcp
= true;
7316 options
->server_flags
|= SF_NO_PUSH_ROUTE_GATEWAY
;
7318 else if (streq(p
[0], "server-bridge") && !p
[1])
7320 VERIFY_PERMISSION(OPT_P_GENERAL
);
7321 options
->server_bridge_proxy_dhcp
= true;
7323 else if (streq(p
[0], "push") && p
[1] && !p
[2])
7325 VERIFY_PERMISSION(OPT_P_PUSH
);
7326 push_options(options
, &p
[1], msglevel
, &options
->gc
);
7328 else if (streq(p
[0], "push-reset") && !p
[1])
7330 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7331 push_reset(options
);
7333 else if (streq(p
[0], "push-remove") && p
[1] && !p
[2])
7335 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7336 msg(D_PUSH
, "PUSH_REMOVE '%s'", p
[1]);
7337 push_remove_option(options
, p
[1]);
7339 else if (streq(p
[0], "ifconfig-pool") && p
[1] && p
[2] && !p
[4])
7341 const int lev
= M_WARN
;
7343 in_addr_t start
, end
, netmask
= 0;
7345 VERIFY_PERMISSION(OPT_P_GENERAL
);
7346 start
= get_ip_addr(p
[1], lev
, &error
);
7347 end
= get_ip_addr(p
[2], lev
, &error
);
7350 netmask
= get_ip_addr(p
[3], lev
, &error
);
7354 msg(msglevel
, "error parsing --ifconfig-pool parameters");
7357 if (!ifconfig_pool_verify_range(msglevel
, start
, end
))
7362 options
->ifconfig_pool_defined
= true;
7363 options
->ifconfig_pool_start
= start
;
7364 options
->ifconfig_pool_end
= end
;
7367 options
->ifconfig_pool_netmask
= netmask
;
7370 else if (streq(p
[0], "ifconfig-pool-persist") && p
[1] && !p
[3])
7372 VERIFY_PERMISSION(OPT_P_GENERAL
);
7373 options
->ifconfig_pool_persist_filename
= p
[1];
7376 options
->ifconfig_pool_persist_refresh_freq
= positive_atoi(p
[2]);
7379 else if (streq(p
[0], "ifconfig-ipv6-pool") && p
[1] && !p
[2])
7381 const int lev
= M_WARN
;
7382 struct in6_addr network
;
7383 unsigned int netbits
= 0;
7385 VERIFY_PERMISSION(OPT_P_GENERAL
);
7386 if (!get_ipv6_addr(p
[1], &network
, &netbits
, lev
) )
7388 msg(msglevel
, "error parsing --ifconfig-ipv6-pool parameters");
7391 if (netbits
< 64 || netbits
> 124)
7394 "--ifconfig-ipv6-pool settings: network must be between /64 and /124 (not /%d)",
7399 options
->ifconfig_ipv6_pool_defined
= true;
7400 options
->ifconfig_ipv6_pool_base
= network
;
7401 options
->ifconfig_ipv6_pool_netbits
= netbits
;
7403 else if (streq(p
[0], "hash-size") && p
[1] && p
[2] && !p
[3])
7407 VERIFY_PERMISSION(OPT_P_GENERAL
);
7409 virtual = atoi(p
[2]);
7410 if (real
< 1 || virtual < 1)
7412 msg(msglevel
, "--hash-size sizes must be >= 1 (preferably a power of 2)");
7415 options
->real_hash_size
= real
;
7416 options
->virtual_hash_size
= real
;
7418 else if (streq(p
[0], "connect-freq") && p
[1] && p
[2] && !p
[3])
7422 VERIFY_PERMISSION(OPT_P_GENERAL
);
7423 cf_max
= atoi(p
[1]);
7424 cf_per
= atoi(p
[2]);
7425 if (cf_max
< 0 || cf_per
< 0)
7427 msg(msglevel
, "--connect-freq parms must be > 0");
7430 options
->cf_max
= cf_max
;
7431 options
->cf_per
= cf_per
;
7433 else if (streq(p
[0], "max-clients") && p
[1] && !p
[2])
7437 VERIFY_PERMISSION(OPT_P_GENERAL
);
7438 max_clients
= atoi(p
[1]);
7439 if (max_clients
< 0)
7441 msg(msglevel
, "--max-clients must be at least 1");
7444 if (max_clients
>= MAX_PEER_ID
) /* max peer-id value */
7446 msg(msglevel
, "--max-clients must be less than %d", MAX_PEER_ID
);
7449 options
->max_clients
= max_clients
;
7451 else if (streq(p
[0], "max-routes-per-client") && p
[1] && !p
[2])
7453 VERIFY_PERMISSION(OPT_P_INHERIT
);
7454 options
->max_routes_per_client
= max_int(atoi(p
[1]), 1);
7456 else if (streq(p
[0], "client-cert-not-required") && !p
[1])
7458 VERIFY_PERMISSION(OPT_P_GENERAL
);
7459 msg(M_FATAL
, "REMOVED OPTION: --client-cert-not-required, use '--verify-client-cert none' instead");
7461 else if (streq(p
[0], "verify-client-cert") && !p
[2])
7463 VERIFY_PERMISSION(OPT_P_GENERAL
);
7465 /* Reset any existing flags */
7466 options
->ssl_flags
&= ~SSLF_CLIENT_CERT_OPTIONAL
;
7467 options
->ssl_flags
&= ~SSLF_CLIENT_CERT_NOT_REQUIRED
;
7470 if (streq(p
[1], "none"))
7472 options
->ssl_flags
|= SSLF_CLIENT_CERT_NOT_REQUIRED
;
7474 else if (streq(p
[1], "optional"))
7476 options
->ssl_flags
|= SSLF_CLIENT_CERT_OPTIONAL
;
7478 else if (!streq(p
[1], "require"))
7480 msg(msglevel
, "parameter to --verify-client-cert must be 'none', 'optional' or 'require'");
7485 else if (streq(p
[0], "username-as-common-name") && !p
[1])
7487 VERIFY_PERMISSION(OPT_P_GENERAL
);
7488 options
->ssl_flags
|= SSLF_USERNAME_AS_COMMON_NAME
;
7490 else if (streq(p
[0], "auth-user-pass-optional") && !p
[1])
7492 VERIFY_PERMISSION(OPT_P_GENERAL
);
7493 options
->ssl_flags
|= SSLF_AUTH_USER_PASS_OPTIONAL
;
7495 else if (streq(p
[0], "opt-verify") && !p
[1])
7497 VERIFY_PERMISSION(OPT_P_GENERAL
);
7498 options
->ssl_flags
|= SSLF_OPT_VERIFY
;
7500 else if (streq(p
[0], "auth-user-pass-verify") && p
[1])
7502 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7503 if (!no_more_than_n_args(msglevel
, p
, 3, NM_QUOTE_HINT
))
7509 if (streq(p
[2], "via-env"))
7511 options
->auth_user_pass_verify_script_via_file
= false;
7513 else if (streq(p
[2], "via-file"))
7515 options
->auth_user_pass_verify_script_via_file
= true;
7519 msg(msglevel
, "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
7525 msg(msglevel
, "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
7528 set_user_script(options
,
7529 &options
->auth_user_pass_verify_script
,
7530 p
[1], "auth-user-pass-verify", true);
7532 else if (streq(p
[0], "auth-gen-token"))
7534 VERIFY_PERMISSION(OPT_P_GENERAL
);
7535 options
->auth_token_generate
= true;
7536 options
->auth_token_lifetime
= p
[1] ? positive_atoi(p
[1]) : 0;
7538 for (int i
= 2; i
< MAX_PARMS
&& p
[i
] != NULL
; i
++)
7540 /* the second parameter can be the renewal time */
7541 if (i
== 2 && positive_atoi(p
[i
]))
7543 options
->auth_token_renewal
= positive_atoi(p
[i
]);
7545 else if (streq(p
[i
], "external-auth"))
7547 options
->auth_token_call_auth
= true;
7551 msg(msglevel
, "Invalid argument to auth-gen-token: %s (%d)", p
[i
], i
);
7556 else if (streq(p
[0], "auth-gen-token-secret") && p
[1] && !p
[2])
7558 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
7559 options
->auth_token_secret_file
= p
[1];
7560 options
->auth_token_secret_file_inline
= is_inline
;
7563 else if (streq(p
[0], "client-connect") && p
[1])
7565 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7566 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7570 set_user_script(options
, &options
->client_connect_script
,
7571 p
[1], "client-connect", true);
7573 else if (streq(p
[0], "client-crresponse") && p
[1])
7575 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7576 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7580 set_user_script(options
, &options
->client_crresponse_script
,
7581 p
[1], "client-crresponse", true);
7583 else if (streq(p
[0], "client-disconnect") && p
[1])
7585 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7586 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7590 set_user_script(options
, &options
->client_disconnect_script
,
7591 p
[1], "client-disconnect", true);
7593 else if (streq(p
[0], "learn-address") && p
[1])
7595 VERIFY_PERMISSION(OPT_P_SCRIPT
);
7596 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
7600 set_user_script(options
, &options
->learn_address_script
,
7601 p
[1], "learn-address", true);
7603 else if (streq(p
[0], "tmp-dir") && p
[1] && !p
[2])
7605 VERIFY_PERMISSION(OPT_P_GENERAL
);
7606 options
->tmp_dir
= p
[1];
7608 else if (streq(p
[0], "client-config-dir") && p
[1] && !p
[2])
7610 VERIFY_PERMISSION(OPT_P_GENERAL
);
7611 options
->client_config_dir
= p
[1];
7613 else if (streq(p
[0], "ccd-exclusive") && !p
[1])
7615 VERIFY_PERMISSION(OPT_P_GENERAL
);
7616 options
->ccd_exclusive
= true;
7618 else if (streq(p
[0], "bcast-buffers") && p
[1] && !p
[2])
7622 VERIFY_PERMISSION(OPT_P_GENERAL
);
7623 n_bcast_buf
= atoi(p
[1]);
7624 if (n_bcast_buf
< 1)
7626 msg(msglevel
, "--bcast-buffers parameter must be > 0");
7628 options
->n_bcast_buf
= n_bcast_buf
;
7630 else if (streq(p
[0], "tcp-queue-limit") && p
[1] && !p
[2])
7632 int tcp_queue_limit
;
7634 VERIFY_PERMISSION(OPT_P_GENERAL
);
7635 tcp_queue_limit
= atoi(p
[1]);
7636 if (tcp_queue_limit
< 1)
7638 msg(msglevel
, "--tcp-queue-limit parameter must be > 0");
7640 options
->tcp_queue_limit
= tcp_queue_limit
;
7643 else if (streq(p
[0], "port-share") && p
[1] && p
[2] && !p
[4])
7645 VERIFY_PERMISSION(OPT_P_GENERAL
);
7646 options
->port_share_host
= p
[1];
7647 options
->port_share_port
= p
[2];
7648 options
->port_share_journal_dir
= p
[3];
7651 else if (streq(p
[0], "client-to-client") && !p
[1])
7653 VERIFY_PERMISSION(OPT_P_GENERAL
);
7654 options
->enable_c2c
= true;
7656 else if (streq(p
[0], "duplicate-cn") && !p
[1])
7658 VERIFY_PERMISSION(OPT_P_GENERAL
);
7659 options
->duplicate_cn
= true;
7661 else if (streq(p
[0], "iroute") && p
[1] && !p
[3])
7663 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7664 option_iroute(options
, p
[1], p
[2], msglevel
);
7666 else if (streq(p
[0], "iroute-ipv6") && p
[1] && !p
[2])
7668 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7669 option_iroute_ipv6(options
, p
[1], msglevel
);
7671 else if (streq(p
[0], "ifconfig-push") && p
[1] && p
[2] && !p
[4])
7673 in_addr_t local
, remote_netmask
;
7675 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7676 local
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[1], 0, NULL
, NULL
);
7677 remote_netmask
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[2], 0, NULL
, NULL
);
7678 if (local
&& remote_netmask
)
7680 options
->push_ifconfig_defined
= true;
7681 options
->push_ifconfig_local
= local
;
7682 options
->push_ifconfig_remote_netmask
= remote_netmask
;
7685 options
->push_ifconfig_local_alias
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[3], 0, NULL
, NULL
);
7690 msg(msglevel
, "cannot parse --ifconfig-push addresses");
7694 else if (streq(p
[0], "ifconfig-push-constraint") && p
[1] && p
[2] && !p
[3])
7696 in_addr_t network
, netmask
;
7698 VERIFY_PERMISSION(OPT_P_GENERAL
);
7699 network
= getaddr(GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[1], 0, NULL
, NULL
);
7700 netmask
= getaddr(GETADDR_HOST_ORDER
, p
[2], 0, NULL
, NULL
);
7701 if (network
&& netmask
)
7703 options
->push_ifconfig_constraint_defined
= true;
7704 options
->push_ifconfig_constraint_network
= network
;
7705 options
->push_ifconfig_constraint_netmask
= netmask
;
7709 msg(msglevel
, "cannot parse --ifconfig-push-constraint addresses");
7713 else if (streq(p
[0], "ifconfig-ipv6-push") && p
[1] && !p
[3])
7715 struct in6_addr local
, remote
;
7716 unsigned int netbits
;
7718 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7720 if (!get_ipv6_addr( p
[1], &local
, &netbits
, msglevel
) )
7722 msg(msglevel
, "cannot parse --ifconfig-ipv6-push addresses");
7728 if (!get_ipv6_addr( p
[2], &remote
, NULL
, msglevel
) )
7730 msg( msglevel
, "cannot parse --ifconfig-ipv6-push addresses");
7736 if (!options
->ifconfig_ipv6_local
7737 || !get_ipv6_addr( options
->ifconfig_ipv6_local
, &remote
,
7740 msg( msglevel
, "second argument to --ifconfig-ipv6-push missing and no global --ifconfig-ipv6 address set");
7745 options
->push_ifconfig_ipv6_defined
= true;
7746 options
->push_ifconfig_ipv6_local
= local
;
7747 options
->push_ifconfig_ipv6_netbits
= netbits
;
7748 options
->push_ifconfig_ipv6_remote
= remote
;
7749 options
->push_ifconfig_ipv6_blocked
= false;
7751 else if (streq(p
[0], "disable") && !p
[1])
7753 VERIFY_PERMISSION(OPT_P_INSTANCE
);
7754 options
->disable
= true;
7756 else if (streq(p
[0], "tcp-nodelay") && !p
[1])
7758 VERIFY_PERMISSION(OPT_P_GENERAL
);
7759 options
->server_flags
|= SF_TCP_NODELAY_HELPER
;
7761 else if (streq(p
[0], "stale-routes-check") && p
[1] && !p
[3])
7763 int ageing_time
, check_interval
;
7765 VERIFY_PERMISSION(OPT_P_GENERAL
);
7766 ageing_time
= atoi(p
[1]);
7769 check_interval
= atoi(p
[2]);
7773 check_interval
= ageing_time
;
7776 if (ageing_time
< 1 || check_interval
< 1)
7778 msg(msglevel
, "--stale-routes-check aging time and check interval must be >= 1");
7781 options
->stale_routes_ageing_time
= ageing_time
;
7782 options
->stale_routes_check_interval
= check_interval
;
7785 else if (streq(p
[0], "client") && !p
[1])
7787 VERIFY_PERMISSION(OPT_P_GENERAL
);
7788 options
->client
= true;
7790 else if (streq(p
[0], "pull") && !p
[1])
7792 VERIFY_PERMISSION(OPT_P_GENERAL
);
7793 options
->pull
= true;
7795 else if (streq(p
[0], "push-continuation") && p
[1] && !p
[2])
7797 VERIFY_PERMISSION(OPT_P_PULL_MODE
);
7798 options
->push_continuation
= atoi(p
[1]);
7800 else if (streq(p
[0], "auth-user-pass") && !p
[2])
7802 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
7805 options
->auth_user_pass_file
= p
[1];
7806 options
->auth_user_pass_file_inline
= is_inline
;
7810 options
->auth_user_pass_file
= "stdin";
7813 else if (streq(p
[0], "auth-retry") && p
[1] && !p
[2])
7815 VERIFY_PERMISSION(OPT_P_GENERAL
);
7816 auth_retry_set(msglevel
, p
[1]);
7818 #ifdef ENABLE_MANAGEMENT
7819 else if (streq(p
[0], "static-challenge") && p
[1] && p
[2] && !p
[3])
7821 VERIFY_PERMISSION(OPT_P_GENERAL
);
7822 options
->sc_info
.challenge_text
= p
[1];
7825 options
->sc_info
.flags
|= SC_ECHO
;
7829 else if (streq(p
[0], "msg-channel") && p
[1])
7832 VERIFY_PERMISSION(OPT_P_GENERAL
);
7833 HANDLE process
= GetCurrentProcess();
7834 HANDLE handle
= (HANDLE
) atoll(p
[1]);
7835 if (!DuplicateHandle(process
, handle
, process
, &options
->msg_channel
, 0,
7836 FALSE
, DUPLICATE_CLOSE_SOURCE
| DUPLICATE_SAME_ACCESS
))
7838 msg(msglevel
, "could not duplicate service pipe handle");
7841 options
->route_method
= ROUTE_METHOD_SERVICE
;
7842 #else /* ifdef _WIN32 */
7843 msg(msglevel
, "--msg-channel is only supported on Windows");
7848 else if (streq(p
[0], "win-sys") && p
[1] && !p
[2])
7850 VERIFY_PERMISSION(OPT_P_GENERAL
);
7851 if (streq(p
[1], "env"))
7853 msg(M_INFO
, "NOTE: --win-sys env is default from OpenVPN 2.3. "
7854 "This entry will now be ignored. "
7855 "Please remove this entry from your configuration file.");
7859 set_win_sys_path(p
[1], es
);
7862 else if (streq(p
[0], "route-method") && p
[1] && !p
[2])
7864 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
7865 if (streq(p
[1], "adaptive"))
7867 options
->route_method
= ROUTE_METHOD_ADAPTIVE
;
7869 else if (streq(p
[1], "ipapi"))
7871 options
->route_method
= ROUTE_METHOD_IPAPI
;
7873 else if (streq(p
[1], "exe"))
7875 options
->route_method
= ROUTE_METHOD_EXE
;
7879 msg(msglevel
, "--route method must be 'adaptive', 'ipapi', or 'exe'");
7883 else if (streq(p
[0], "ip-win32") && p
[1] && !p
[4])
7885 const int index
= ascii2ipset(p
[1]);
7886 struct tuntap_options
*to
= &options
->tuntap_options
;
7888 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
7893 "Bad --ip-win32 method: '%s'. Allowed methods: %s",
7895 ipset2ascii_all(&gc
));
7899 if (index
== IPW32_SET_ADAPTIVE
)
7901 options
->route_delay_window
= IPW32_SET_ADAPTIVE_DELAY_WINDOW
;
7904 if (index
== IPW32_SET_DHCP_MASQ
)
7908 if (!streq(p
[2], "default"))
7910 int offset
= atoi(p
[2]);
7912 if (!(offset
> -256 && offset
< 256))
7914 msg(msglevel
, "--ip-win32 dynamic [offset] [lease-time]: offset (%d) must be > -256 and < 256", offset
);
7918 to
->dhcp_masq_custom_offset
= true;
7919 to
->dhcp_masq_offset
= offset
;
7924 const int min_lease
= 30;
7926 lease_time
= atoi(p
[3]);
7927 if (lease_time
< min_lease
)
7929 msg(msglevel
, "--ip-win32 dynamic [offset] [lease-time]: lease time parameter (%d) must be at least %d seconds", lease_time
, min_lease
);
7932 to
->dhcp_lease_time
= lease_time
;
7936 to
->ip_win32_type
= index
;
7937 to
->ip_win32_defined
= true;
7939 #endif /* ifdef _WIN32 */
7940 else if (streq(p
[0], "dns") && p
[1])
7942 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
7944 if (streq(p
[1], "search-domains") && p
[2])
7946 dns_domain_list_append(&options
->dns_options
.search_domains
, &p
[2], &options
->dns_options
.gc
);
7948 else if (streq(p
[1], "server") && p
[2] && p
[3] && p
[4])
7951 if (!dns_server_priority_parse(&priority
, p
[2], pull_mode
))
7953 msg(msglevel
, "--dns server: invalid priority value '%s'", p
[2]);
7957 struct dns_server
*server
= dns_server_get(&options
->dns_options
.servers
, priority
, &options
->dns_options
.gc
);
7959 if (streq(p
[3], "address") && !p
[6])
7961 for (int i
= 4; p
[i
]; i
++)
7963 if (!dns_server_addr_parse(server
, p
[i
]))
7965 msg(msglevel
, "--dns server %ld: malformed or duplicate address '%s'", priority
, p
[i
]);
7970 else if (streq(p
[3], "resolve-domains"))
7972 if (server
->domain_type
== DNS_EXCLUDE_DOMAINS
)
7974 msg(msglevel
, "--dns server %ld: cannot use resolve-domains and exclude-domains", priority
);
7977 server
->domain_type
= DNS_RESOLVE_DOMAINS
;
7978 dns_domain_list_append(&server
->domains
, &p
[4], &options
->dns_options
.gc
);
7980 else if (streq(p
[3], "exclude-domains"))
7982 if (server
->domain_type
== DNS_RESOLVE_DOMAINS
)
7984 msg(msglevel
, "--dns server %ld: cannot use exclude-domains and resolve-domains", priority
);
7987 server
->domain_type
= DNS_EXCLUDE_DOMAINS
;
7988 dns_domain_list_append(&server
->domains
, &p
[4], &options
->dns_options
.gc
);
7990 else if (streq(p
[3], "dnssec") && !p
[5])
7992 if (streq(p
[4], "yes"))
7994 server
->dnssec
= DNS_SECURITY_YES
;
7996 else if (streq(p
[4], "no"))
7998 server
->dnssec
= DNS_SECURITY_NO
;
8000 else if (streq(p
[4], "optional"))
8002 server
->dnssec
= DNS_SECURITY_OPTIONAL
;
8006 msg(msglevel
, "--dns server %ld: malformed dnssec value '%s'", priority
, p
[4]);
8010 else if (streq(p
[3], "transport") && !p
[5])
8012 if (streq(p
[4], "plain"))
8014 server
->transport
= DNS_TRANSPORT_PLAIN
;
8016 else if (streq(p
[4], "DoH"))
8018 server
->transport
= DNS_TRANSPORT_HTTPS
;
8020 else if (streq(p
[4], "DoT"))
8022 server
->transport
= DNS_TRANSPORT_TLS
;
8026 msg(msglevel
, "--dns server %ld: malformed transport value '%s'", priority
, p
[4]);
8030 else if (streq(p
[3], "sni") && !p
[5])
8036 msg(msglevel
, "--dns server %ld: unknown option type '%s' or missing or unknown parameter", priority
, p
[3]);
8042 msg(msglevel
, "--dns: unknown option type '%s' or missing or unknown parameter", p
[1]);
8046 #if defined(_WIN32) || defined(TARGET_ANDROID)
8047 else if (streq(p
[0], "dhcp-option") && p
[1])
8049 struct tuntap_options
*o
= &options
->tuntap_options
;
8050 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8051 bool ipv6dns
= false;
8053 if ((streq(p
[1], "DOMAIN") || streq(p
[1], "ADAPTER_DOMAIN_SUFFIX"))
8058 else if (streq(p
[1], "NBS") && p
[2] && !p
[3])
8060 o
->netbios_scope
= p
[2];
8062 else if (streq(p
[1], "NBT") && p
[2] && !p
[3])
8066 if (!(t
== 1 || t
== 2 || t
== 4 || t
== 8))
8068 msg(msglevel
, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t
);
8071 o
->netbios_node_type
= t
;
8073 else if ((streq(p
[1], "DNS") || streq(p
[1], "DNS6")) && p
[2] && !p
[3]
8074 && (!strstr(p
[2], ":") || ipv6_addr_safe(p
[2])))
8076 if (strstr(p
[2], ":"))
8079 dhcp_option_dns6_parse(p
[2], o
->dns6
, &o
->dns6_len
, msglevel
);
8083 dhcp_option_address_parse("DNS", p
[2], o
->dns
, &o
->dns_len
, msglevel
);
8086 else if (streq(p
[1], "WINS") && p
[2] && !p
[3])
8088 dhcp_option_address_parse("WINS", p
[2], o
->wins
, &o
->wins_len
, msglevel
);
8090 else if (streq(p
[1], "NTP") && p
[2] && !p
[3])
8092 dhcp_option_address_parse("NTP", p
[2], o
->ntp
, &o
->ntp_len
, msglevel
);
8094 else if (streq(p
[1], "NBDD") && p
[2] && !p
[3])
8096 dhcp_option_address_parse("NBDD", p
[2], o
->nbdd
, &o
->nbdd_len
, msglevel
);
8098 else if (streq(p
[1], "DOMAIN-SEARCH") && p
[2] && !p
[3])
8100 if (o
->domain_search_list_len
< N_SEARCH_LIST_LEN
)
8102 o
->domain_search_list
[o
->domain_search_list_len
++] = p
[2];
8106 msg(msglevel
, "--dhcp-option %s: maximum of %d search entries can be specified",
8107 p
[1], N_SEARCH_LIST_LEN
);
8110 else if (streq(p
[1], "DISABLE-NBT") && !p
[2])
8114 #if defined(TARGET_ANDROID)
8115 else if (streq(p
[1], "PROXY_HTTP") && p
[3] && !p
[4])
8117 o
->http_proxy_port
= atoi(p
[3]);
8118 o
->http_proxy
= p
[2];
8123 msg(msglevel
, "--dhcp-option: unknown option type '%s' or missing or unknown parameter", p
[1]);
8127 /* flag that we have options to give to the TAP driver's DHCPv4 server
8128 * - skipped for "DNS6", as that's not a DHCPv4 option
8132 o
->dhcp_options
= true;
8135 #endif /* if defined(_WIN32) || defined(TARGET_ANDROID) */
8137 else if (streq(p
[0], "show-adapters") && !p
[1])
8139 VERIFY_PERMISSION(OPT_P_GENERAL
);
8140 show_tap_win_adapters(M_INFO
|M_NOPREFIX
, M_WARN
|M_NOPREFIX
);
8141 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8143 else if (streq(p
[0], "show-net") && !p
[1])
8145 VERIFY_PERMISSION(OPT_P_GENERAL
);
8146 show_routes(M_INFO
|M_NOPREFIX
);
8147 show_adapters(M_INFO
|M_NOPREFIX
);
8148 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8150 else if (streq(p
[0], "show-net-up") && !p
[1])
8152 VERIFY_PERMISSION(OPT_P_UP
);
8153 options
->show_net_up
= true;
8155 else if (streq(p
[0], "tap-sleep") && p
[1] && !p
[2])
8158 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8160 if (s
< 0 || s
>= 256)
8162 msg(msglevel
, "--tap-sleep parameter must be between 0 and 255");
8165 options
->tuntap_options
.tap_sleep
= s
;
8167 else if (streq(p
[0], "dhcp-renew") && !p
[1])
8169 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8170 options
->tuntap_options
.dhcp_renew
= true;
8172 else if (streq(p
[0], "dhcp-pre-release") && !p
[1])
8174 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8175 options
->tuntap_options
.dhcp_pre_release
= true;
8176 options
->tuntap_options
.dhcp_renew
= true;
8178 else if (streq(p
[0], "dhcp-release") && !p
[1])
8180 msg(M_WARN
, "Obsolete option --dhcp-release detected. This is now on by default");
8182 else if (streq(p
[0], "dhcp-internal") && p
[1] && !p
[2]) /* standalone method for internal use */
8184 unsigned int adapter_index
;
8185 VERIFY_PERMISSION(OPT_P_GENERAL
);
8186 set_debug_level(options
->verbosity
, SDL_CONSTRAIN
);
8187 adapter_index
= atou(p
[1]);
8188 sleep(options
->tuntap_options
.tap_sleep
);
8189 if (options
->tuntap_options
.dhcp_pre_release
)
8191 dhcp_release_by_adapter_index(adapter_index
);
8193 if (options
->tuntap_options
.dhcp_renew
)
8195 dhcp_renew_by_adapter_index(adapter_index
);
8197 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8199 else if (streq(p
[0], "register-dns") && !p
[1])
8201 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8202 options
->tuntap_options
.register_dns
= true;
8204 else if (streq(p
[0], "block-outside-dns") && !p
[1])
8206 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8207 options
->block_outside_dns
= true;
8209 else if (streq(p
[0], "rdns-internal") && !p
[1])
8210 /* standalone method for internal use
8212 * (if --register-dns is set, openvpn needs to call itself in a
8213 * sub-process to execute the required functions in a non-blocking
8214 * way, and uses --rdns-internal to signal that to itself)
8217 VERIFY_PERMISSION(OPT_P_GENERAL
);
8218 set_debug_level(options
->verbosity
, SDL_CONSTRAIN
);
8219 if (options
->tuntap_options
.register_dns
)
8221 ipconfig_register_dns(NULL
);
8223 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8225 else if (streq(p
[0], "show-valid-subnets") && !p
[1])
8227 VERIFY_PERMISSION(OPT_P_GENERAL
);
8228 show_valid_win32_tun_subnets();
8229 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8231 else if (streq(p
[0], "pause-exit") && !p
[1])
8233 VERIFY_PERMISSION(OPT_P_GENERAL
);
8234 set_pause_exit_win32();
8236 else if (streq(p
[0], "service") && p
[1] && !p
[3])
8238 VERIFY_PERMISSION(OPT_P_GENERAL
);
8239 options
->exit_event_name
= p
[1];
8242 options
->exit_event_initial_state
= (atoi(p
[2]) != 0);
8245 else if (streq(p
[0], "allow-nonadmin") && !p
[2])
8247 VERIFY_PERMISSION(OPT_P_GENERAL
);
8248 tap_allow_nonadmin_access(p
[1]);
8249 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
8251 else if (streq(p
[0], "user") && p
[1] && !p
[2])
8253 VERIFY_PERMISSION(OPT_P_GENERAL
);
8254 msg(M_WARN
, "NOTE: --user option is not implemented on Windows");
8256 else if (streq(p
[0], "group") && p
[1] && !p
[2])
8258 VERIFY_PERMISSION(OPT_P_GENERAL
);
8259 msg(M_WARN
, "NOTE: --group option is not implemented on Windows");
8261 #else /* ifdef _WIN32 */
8262 else if (streq(p
[0], "user") && p
[1] && !p
[2])
8264 VERIFY_PERMISSION(OPT_P_GENERAL
);
8265 options
->username
= p
[1];
8267 else if (streq(p
[0], "group") && p
[1] && !p
[2])
8269 VERIFY_PERMISSION(OPT_P_GENERAL
);
8270 options
->groupname
= p
[1];
8272 else if (streq(p
[0], "dhcp-option") && p
[1] && !p
[3])
8274 VERIFY_PERMISSION(OPT_P_DHCPDNS
);
8275 setenv_foreign_option(options
, (const char **)p
, 3, es
);
8277 else if (streq(p
[0], "route-method") && p
[1] && !p
[2]) /* ignore when pushed to non-Windows OS */
8279 VERIFY_PERMISSION(OPT_P_ROUTE_EXTRAS
);
8281 #endif /* ifdef _WIN32 */
8282 #if PASSTOS_CAPABILITY
8283 else if (streq(p
[0], "passtos") && !p
[1])
8285 VERIFY_PERMISSION(OPT_P_GENERAL
);
8286 options
->passtos
= true;
8289 #if defined(USE_COMP)
8290 else if (streq(p
[0], "allow-compression") && p
[1] && !p
[2])
8292 VERIFY_PERMISSION(OPT_P_GENERAL
);
8294 if (streq(p
[1], "no"))
8296 options
->comp
.flags
=
8297 COMP_F_ALLOW_STUB_ONLY
|COMP_F_ADVERTISE_STUBS_ONLY
;
8298 if (comp_non_stub_enabled(&options
->comp
))
8300 msg(msglevel
, "'--allow-compression no' conflicts with "
8301 " enabling compression");
8304 else if (options
->comp
.flags
& COMP_F_ALLOW_STUB_ONLY
)
8306 /* Also printed on a push to hint at configuration problems */
8307 msg(msglevel
, "Cannot set allow-compression to '%s' "
8308 "after set to 'no'", p
[1]);
8311 else if (streq(p
[1], "asym"))
8313 options
->comp
.flags
&= ~COMP_F_ALLOW_COMPRESS
;
8314 options
->comp
.flags
|= COMP_F_ALLOW_ASYM
;
8316 else if (streq(p
[1], "yes"))
8318 msg(M_WARN
, "WARNING: Compression for sending and receiving enabled. Compression has "
8319 "been used in the past to break encryption. Allowing compression allows "
8320 "attacks that break encryption. Using \"--allow-compression yes\" is "
8321 "strongly discouraged for common usage. See --compress in the manual "
8322 "page for more information ");
8324 options
->comp
.flags
|= COMP_F_ALLOW_COMPRESS
;
8328 msg(msglevel
, "bad allow-compression option: %s -- "
8329 "must be 'yes', 'no', or 'asym'", p
[1]);
8333 else if (streq(p
[0], "comp-lzo") && !p
[2])
8335 VERIFY_PERMISSION(OPT_P_COMP
);
8337 /* All lzo variants do not use swap */
8338 options
->comp
.flags
&= ~COMP_F_SWAP
;
8339 #if defined(ENABLE_LZO)
8340 if (p
[1] && streq(p
[1], "no"))
8343 options
->comp
.alg
= COMP_ALG_STUB
;
8344 options
->comp
.flags
&= ~COMP_F_ADAPTIVE
;
8346 #if defined(ENABLE_LZO)
8347 else if (options
->comp
.flags
& COMP_F_ALLOW_STUB_ONLY
)
8349 /* Also printed on a push to hint at configuration problems */
8350 msg(msglevel
, "Cannot set comp-lzo to '%s', "
8351 "allow-compression is set to 'no'", p
[1]);
8356 if (streq(p
[1], "yes"))
8358 options
->comp
.alg
= COMP_ALG_LZO
;
8359 options
->comp
.flags
&= ~COMP_F_ADAPTIVE
;
8361 else if (streq(p
[1], "adaptive"))
8363 options
->comp
.alg
= COMP_ALG_LZO
;
8364 options
->comp
.flags
|= COMP_F_ADAPTIVE
;
8368 msg(msglevel
, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'", p
[1]);
8374 options
->comp
.alg
= COMP_ALG_LZO
;
8375 options
->comp
.flags
|= COMP_F_ADAPTIVE
;
8377 show_compression_warning(&options
->comp
);
8378 #endif /* if defined(ENABLE_LZO) */
8380 else if (streq(p
[0], "comp-noadapt") && !p
[1])
8383 * We do not need to check here if we allow compression since
8384 * it only modifies a flag if compression is enabled
8386 VERIFY_PERMISSION(OPT_P_COMP
);
8387 options
->comp
.flags
&= ~COMP_F_ADAPTIVE
;
8389 else if (streq(p
[0], "compress") && !p
[2])
8391 VERIFY_PERMISSION(OPT_P_COMP
);
8394 if (streq(p
[1], "stub"))
8396 options
->comp
.alg
= COMP_ALG_STUB
;
8397 options
->comp
.flags
|= (COMP_F_SWAP
|COMP_F_ADVERTISE_STUBS_ONLY
);
8399 else if (streq(p
[1], "stub-v2"))
8401 options
->comp
.alg
= COMP_ALGV2_UNCOMPRESSED
;
8402 options
->comp
.flags
|= COMP_F_ADVERTISE_STUBS_ONLY
;
8404 else if (streq(p
[1], "migrate"))
8406 options
->comp
.alg
= COMP_ALG_UNDEF
;
8407 options
->comp
.flags
= COMP_F_MIGRATE
;
8410 else if (options
->comp
.flags
& COMP_F_ALLOW_STUB_ONLY
)
8412 /* Also printed on a push to hint at configuration problems */
8413 msg(msglevel
, "Cannot set compress to '%s', "
8414 "allow-compression is set to 'no'", p
[1]);
8417 #if defined(ENABLE_LZO)
8418 else if (streq(p
[1], "lzo"))
8420 options
->comp
.alg
= COMP_ALG_LZO
;
8421 options
->comp
.flags
&= ~(COMP_F_ADAPTIVE
| COMP_F_SWAP
);
8424 #if defined(ENABLE_LZ4)
8425 else if (streq(p
[1], "lz4"))
8427 options
->comp
.alg
= COMP_ALG_LZ4
;
8428 options
->comp
.flags
|= COMP_F_SWAP
;
8430 else if (streq(p
[1], "lz4-v2"))
8432 options
->comp
.alg
= COMP_ALGV2_LZ4
;
8437 msg(msglevel
, "bad comp option: %s", p
[1]);
8443 options
->comp
.alg
= COMP_ALG_STUB
;
8444 options
->comp
.flags
|= COMP_F_SWAP
;
8446 show_compression_warning(&options
->comp
);
8448 #endif /* USE_COMP */
8449 else if (streq(p
[0], "show-ciphers") && !p
[1])
8451 VERIFY_PERMISSION(OPT_P_GENERAL
);
8452 options
->show_ciphers
= true;
8454 else if (streq(p
[0], "show-digests") && !p
[1])
8456 VERIFY_PERMISSION(OPT_P_GENERAL
);
8457 options
->show_digests
= true;
8459 else if (streq(p
[0], "show-engines") && !p
[1])
8461 VERIFY_PERMISSION(OPT_P_GENERAL
);
8462 options
->show_engines
= true;
8464 else if (streq(p
[0], "key-direction") && p
[1] && !p
[2])
8468 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
);
8470 key_direction
= ascii2keydirection(msglevel
, p
[1]);
8471 if (key_direction
>= 0)
8473 if (permission_mask
& OPT_P_GENERAL
)
8475 options
->key_direction
= key_direction
;
8477 else if (permission_mask
& OPT_P_CONNECTION
)
8479 options
->ce
.key_direction
= key_direction
;
8487 else if (streq(p
[0], "secret") && p
[1] && !p
[3])
8489 msg(M_WARN
, "DEPRECATED OPTION: The option --secret is deprecated.");
8490 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8491 options
->shared_secret_file
= p
[1];
8492 options
->shared_secret_file_inline
= is_inline
;
8493 if (!is_inline
&& p
[2])
8497 key_direction
= ascii2keydirection(msglevel
, p
[2]);
8498 if (key_direction
>= 0)
8500 options
->key_direction
= key_direction
;
8508 else if (streq(p
[0], "genkey") && !p
[4])
8510 VERIFY_PERMISSION(OPT_P_GENERAL
);
8511 options
->genkey
= true;
8514 options
->genkey_type
= GENKEY_SECRET
;
8518 if (streq(p
[1], "secret") || streq(p
[1], "tls-auth")
8519 || streq(p
[1], "tls-crypt"))
8521 options
->genkey_type
= GENKEY_SECRET
;
8523 else if (streq(p
[1], "tls-crypt-v2-server"))
8525 options
->genkey_type
= GENKEY_TLS_CRYPTV2_SERVER
;
8527 else if (streq(p
[1], "tls-crypt-v2-client"))
8529 options
->genkey_type
= GENKEY_TLS_CRYPTV2_CLIENT
;
8532 options
->genkey_extra_data
= p
[3];
8535 else if (streq(p
[1], "auth-token"))
8537 options
->genkey_type
= GENKEY_AUTH_TOKEN
;
8541 msg(msglevel
, "unknown --genkey type: %s", p
[1]);
8547 options
->genkey_filename
= p
[2];
8550 else if (streq(p
[0], "auth") && p
[1] && !p
[2])
8552 VERIFY_PERMISSION(OPT_P_GENERAL
);
8553 options
->authname
= p
[1];
8555 else if (streq(p
[0], "cipher") && p
[1] && !p
[2])
8557 VERIFY_PERMISSION(OPT_P_NCP
|OPT_P_INSTANCE
);
8558 options
->ciphername
= p
[1];
8560 else if (streq(p
[0], "data-ciphers-fallback") && p
[1] && !p
[2])
8562 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INSTANCE
);
8563 options
->ciphername
= p
[1];
8564 options
->enable_ncp_fallback
= true;
8566 else if ((streq(p
[0], "data-ciphers") || streq(p
[0], "ncp-ciphers"))
8569 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INSTANCE
);
8570 if (streq(p
[0], "ncp-ciphers"))
8572 msg(M_INFO
, "Note: Treating option '--ncp-ciphers' as "
8573 " '--data-ciphers' (renamed in OpenVPN 2.5).");
8575 options
->ncp_ciphers
= p
[1];
8577 else if (streq(p
[0], "key-derivation") && p
[1])
8579 /* NCP only option that is pushed by the server to enable EKM,
8580 * should not be used by normal users in config files*/
8581 VERIFY_PERMISSION(OPT_P_NCP
)
8582 #ifdef HAVE_EXPORT_KEYING_MATERIAL
8583 if (streq(p
[1], "tls-ekm"))
8585 options
->imported_protocol_flags
|= CO_USE_TLS_KEY_MATERIAL_EXPORT
;
8590 msg(msglevel
, "Unknown key-derivation method %s", p
[1]);
8593 else if (streq(p
[0], "protocol-flags") && p
[1])
8595 /* NCP only option that is pushed by the server to enable protocol
8596 * features that are negotiated, should not be used by normal users
8597 * in config files */
8598 VERIFY_PERMISSION(OPT_P_NCP
)
8599 for (size_t j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; j
++)
8601 if (streq(p
[j
], "cc-exit"))
8603 options
->imported_protocol_flags
|= CO_USE_CC_EXIT_NOTIFY
;
8605 #ifdef HAVE_EXPORT_KEYING_MATERIAL
8606 else if (streq(p
[j
], "tls-ekm"))
8608 options
->imported_protocol_flags
|= CO_USE_TLS_KEY_MATERIAL_EXPORT
;
8613 msg(msglevel
, "Unknown protocol-flags flag: %s", p
[j
]);
8617 else if (streq(p
[0], "prng") && p
[1] && !p
[3])
8619 msg(M_WARN
, "NOTICE: --prng option ignored (SSL library PRNG is used)");
8621 else if (streq(p
[0], "no-replay") && !p
[1])
8623 VERIFY_PERMISSION(OPT_P_GENERAL
);
8624 options
->replay
= false;
8626 else if (streq(p
[0], "replay-window") && !p
[3])
8628 VERIFY_PERMISSION(OPT_P_GENERAL
);
8633 replay_window
= atoi(p
[1]);
8634 if (!(MIN_SEQ_BACKTRACK
<= replay_window
&& replay_window
<= MAX_SEQ_BACKTRACK
))
8636 msg(msglevel
, "replay-window window size parameter (%d) must be between %d and %d",
8642 options
->replay_window
= replay_window
;
8648 replay_time
= atoi(p
[2]);
8649 if (!(MIN_TIME_BACKTRACK
<= replay_time
&& replay_time
<= MAX_TIME_BACKTRACK
))
8651 msg(msglevel
, "replay-window time window parameter (%d) must be between %d and %d",
8654 MAX_TIME_BACKTRACK
);
8657 options
->replay_time
= replay_time
;
8662 msg(msglevel
, "replay-window option is missing window size parameter");
8666 else if (streq(p
[0], "mute-replay-warnings") && !p
[1])
8668 VERIFY_PERMISSION(OPT_P_GENERAL
);
8669 options
->mute_replay_warnings
= true;
8671 else if (streq(p
[0], "replay-persist") && p
[1] && !p
[2])
8673 VERIFY_PERMISSION(OPT_P_GENERAL
);
8674 options
->packet_id_file
= p
[1];
8676 else if (streq(p
[0], "test-crypto") && !p
[1])
8678 VERIFY_PERMISSION(OPT_P_GENERAL
);
8679 options
->test_crypto
= true;
8681 #ifndef ENABLE_CRYPTO_MBEDTLS
8682 else if (streq(p
[0], "engine") && !p
[2])
8684 VERIFY_PERMISSION(OPT_P_GENERAL
);
8687 options
->engine
= p
[1];
8691 options
->engine
= "auto";
8694 #endif /* ENABLE_CRYPTO_MBEDTLS */
8695 else if (streq(p
[0], "providers") && p
[1])
8697 for (size_t j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; j
++)
8699 options
->providers
.names
[j
] = p
[j
];
8702 #ifdef ENABLE_PREDICTION_RESISTANCE
8703 else if (streq(p
[0], "use-prediction-resistance") && !p
[1])
8705 VERIFY_PERMISSION(OPT_P_GENERAL
);
8706 options
->use_prediction_resistance
= true;
8709 else if (streq(p
[0], "show-tls") && !p
[1])
8711 VERIFY_PERMISSION(OPT_P_GENERAL
);
8712 options
->show_tls_ciphers
= true;
8714 else if ((streq(p
[0], "show-curves") || streq(p
[0], "show-groups")) && !p
[1])
8716 VERIFY_PERMISSION(OPT_P_GENERAL
);
8717 options
->show_curves
= true;
8719 else if (streq(p
[0], "ecdh-curve") && p
[1] && !p
[2])
8721 VERIFY_PERMISSION(OPT_P_GENERAL
);
8722 msg(M_WARN
, "Consider setting groups/curves preference with "
8723 "tls-groups instead of forcing a specific curve with "
8725 options
->ecdh_curve
= p
[1];
8727 else if (streq(p
[0], "tls-server") && !p
[1])
8729 VERIFY_PERMISSION(OPT_P_GENERAL
);
8730 options
->tls_server
= true;
8732 else if (streq(p
[0], "tls-client") && !p
[1])
8734 VERIFY_PERMISSION(OPT_P_GENERAL
);
8735 options
->tls_client
= true;
8737 else if (streq(p
[0], "ca") && p
[1] && !p
[2])
8739 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8740 options
->ca_file
= p
[1];
8741 options
->ca_file_inline
= is_inline
;
8743 #ifndef ENABLE_CRYPTO_MBEDTLS
8744 else if (streq(p
[0], "capath") && p
[1] && !p
[2])
8746 VERIFY_PERMISSION(OPT_P_GENERAL
);
8747 options
->ca_path
= p
[1];
8749 #endif /* ENABLE_CRYPTO_MBEDTLS */
8750 else if (streq(p
[0], "dh") && p
[1] && !p
[2])
8752 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8753 options
->dh_file
= p
[1];
8754 options
->dh_file_inline
= is_inline
;
8756 else if (streq(p
[0], "cert") && p
[1] && !p
[2])
8758 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8759 options
->cert_file
= p
[1];
8760 options
->cert_file_inline
= is_inline
;
8762 else if (streq(p
[0], "extra-certs") && p
[1] && !p
[2])
8764 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8765 options
->extra_certs_file
= p
[1];
8766 options
->extra_certs_file_inline
= is_inline
;
8768 else if ((streq(p
[0], "verify-hash") && p
[1] && !p
[3])
8769 || (streq(p
[0], "peer-fingerprint") && p
[1] && !p
[2]))
8771 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8773 int verify_hash_depth
= 0;
8774 if (streq(p
[0], "verify-hash"))
8776 msg(M_WARN
, "DEPRECATED OPTION: The option --verify-hash is deprecated. "
8777 "You should switch to the either use the level 1 certificate as "
8778 "--ca option, use --tls-verify or use --peer-fingerprint");
8779 /* verify level 1 cert, i.e. the CA that signed the leaf cert */
8780 verify_hash_depth
= 1;
8783 options
->verify_hash_algo
= MD_SHA256
;
8785 int digest_len
= SHA256_DIGEST_LENGTH
;
8787 if (options
->verify_hash
&& options
->verify_hash_depth
!= verify_hash_depth
)
8789 msg(msglevel
, "ERROR: Setting %s not allowed. --verify-hash and"
8790 " --peer-fingerprint are mutually exclusive", p
[0]);
8794 if (streq(p
[0], "verify-hash"))
8796 if ((!p
[2] && !is_inline
) || (p
[2] && streq(p
[2], "SHA1")))
8798 options
->verify_hash_algo
= MD_SHA1
;
8799 digest_len
= SHA_DIGEST_LENGTH
;
8801 else if (p
[2] && !streq(p
[2], "SHA256"))
8803 msg(msglevel
, "invalid or unsupported hashing algorithm: %s "
8804 "(only SHA1 and SHA256 are supported)", p
[2]);
8809 struct verify_hash_list
*newlist
;
8810 newlist
= parse_hash_fingerprint_multiline(p
[1], digest_len
,
8811 msglevel
, &options
->gc
);
8813 /* Append the new list to the end of our current list */
8814 if (!options
->verify_hash
)
8816 options
->verify_hash
= newlist
;
8817 options
->verify_hash_depth
= verify_hash_depth
;
8821 /* since both the old and new list can have multiple entries
8822 * we need to go to the end of one of them to concatenate them */
8823 struct verify_hash_list
*listend
= options
->verify_hash
;
8824 while (listend
->next
)
8826 listend
= listend
->next
;
8828 listend
->next
= newlist
;
8831 #ifdef ENABLE_CRYPTOAPI
8832 else if (streq(p
[0], "cryptoapicert") && p
[1] && !p
[2])
8834 VERIFY_PERMISSION(OPT_P_GENERAL
);
8835 options
->cryptoapi_cert
= p
[1];
8838 else if (streq(p
[0], "key") && p
[1] && !p
[2])
8840 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8841 options
->priv_key_file
= p
[1];
8842 options
->priv_key_file_inline
= is_inline
;
8844 else if (streq(p
[0], "tls-version-min") && p
[1] && !p
[3])
8847 VERIFY_PERMISSION(OPT_P_GENERAL
);
8848 ver
= tls_version_parse(p
[1], p
[2]);
8849 if (ver
== TLS_VER_BAD
)
8851 msg(msglevel
, "unknown tls-version-min parameter: %s", p
[1]);
8854 options
->ssl_flags
&=
8855 ~(SSLF_TLS_VERSION_MIN_MASK
<< SSLF_TLS_VERSION_MIN_SHIFT
);
8856 options
->ssl_flags
|= (ver
<< SSLF_TLS_VERSION_MIN_SHIFT
);
8858 else if (streq(p
[0], "tls-version-max") && p
[1] && !p
[2])
8861 VERIFY_PERMISSION(OPT_P_GENERAL
);
8862 ver
= tls_version_parse(p
[1], NULL
);
8863 if (ver
== TLS_VER_BAD
)
8865 msg(msglevel
, "unknown tls-version-max parameter: %s", p
[1]);
8868 options
->ssl_flags
&=
8869 ~(SSLF_TLS_VERSION_MAX_MASK
<< SSLF_TLS_VERSION_MAX_SHIFT
);
8870 options
->ssl_flags
|= (ver
<< SSLF_TLS_VERSION_MAX_SHIFT
);
8872 #ifndef ENABLE_CRYPTO_MBEDTLS
8873 else if (streq(p
[0], "pkcs12") && p
[1] && !p
[2])
8875 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8876 options
->pkcs12_file
= p
[1];
8877 options
->pkcs12_file_inline
= is_inline
;
8879 #endif /* ENABLE_CRYPTO_MBEDTLS */
8880 else if (streq(p
[0], "askpass") && !p
[2])
8882 VERIFY_PERMISSION(OPT_P_GENERAL
);
8885 options
->key_pass_file
= p
[1];
8889 options
->key_pass_file
= "stdin";
8892 else if (streq(p
[0], "auth-nocache") && !p
[1])
8894 VERIFY_PERMISSION(OPT_P_GENERAL
);
8895 ssl_set_auth_nocache();
8897 else if (streq(p
[0], "auth-token") && p
[1] && !p
[2])
8899 VERIFY_PERMISSION(OPT_P_ECHO
);
8900 ssl_set_auth_token(p
[1]);
8901 #ifdef ENABLE_MANAGEMENT
8904 management_auth_token(management
, p
[1]);
8908 else if (streq(p
[0], "auth-token-user") && p
[1] && !p
[2])
8910 VERIFY_PERMISSION(OPT_P_ECHO
);
8911 ssl_set_auth_token_user(p
[1]);
8913 else if (streq(p
[0], "single-session") && !p
[1])
8915 VERIFY_PERMISSION(OPT_P_GENERAL
);
8916 options
->single_session
= true;
8918 else if (streq(p
[0], "push-peer-info") && !p
[1])
8920 VERIFY_PERMISSION(OPT_P_GENERAL
);
8921 options
->push_peer_info
= true;
8923 else if (streq(p
[0], "tls-exit") && !p
[1])
8925 VERIFY_PERMISSION(OPT_P_GENERAL
);
8926 options
->tls_exit
= true;
8928 else if (streq(p
[0], "tls-cipher") && p
[1] && !p
[2])
8930 VERIFY_PERMISSION(OPT_P_GENERAL
);
8931 options
->cipher_list
= p
[1];
8933 else if (streq(p
[0], "tls-cert-profile") && p
[1] && !p
[2])
8935 VERIFY_PERMISSION(OPT_P_GENERAL
);
8936 options
->tls_cert_profile
= p
[1];
8938 else if (streq(p
[0], "tls-ciphersuites") && p
[1] && !p
[2])
8940 VERIFY_PERMISSION(OPT_P_GENERAL
);
8941 options
->cipher_list_tls13
= p
[1];
8943 else if (streq(p
[0], "tls-groups") && p
[1] && !p
[2])
8945 VERIFY_PERMISSION(OPT_P_GENERAL
);
8946 options
->tls_groups
= p
[1];
8948 else if (streq(p
[0], "crl-verify") && p
[1] && ((p
[2] && streq(p
[2], "dir"))
8951 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INLINE
);
8952 if (p
[2] && streq(p
[2], "dir"))
8954 options
->ssl_flags
|= SSLF_CRL_VERIFY_DIR
;
8956 options
->crl_file
= p
[1];
8957 options
->crl_file_inline
= is_inline
;
8959 else if (streq(p
[0], "tls-verify") && p
[1])
8961 VERIFY_PERMISSION(OPT_P_SCRIPT
);
8962 if (!no_more_than_n_args(msglevel
, p
, 2, NM_QUOTE_HINT
))
8966 set_user_script(options
, &options
->tls_verify
,
8967 string_substitute(p
[1], ',', ' ', &options
->gc
),
8968 "tls-verify", true);
8970 #ifndef ENABLE_CRYPTO_MBEDTLS
8971 else if (streq(p
[0], "tls-export-cert") && p
[1] && !p
[2])
8973 VERIFY_PERMISSION(OPT_P_GENERAL
);
8974 options
->tls_export_cert
= p
[1];
8977 else if (streq(p
[0], "compat-names"))
8979 VERIFY_PERMISSION(OPT_P_GENERAL
);
8980 msg(msglevel
, "--compat-names was removed in OpenVPN 2.5. "
8981 "Update your configuration.");
8984 else if (streq(p
[0], "no-name-remapping") && !p
[1])
8986 VERIFY_PERMISSION(OPT_P_GENERAL
);
8987 msg(msglevel
, "--no-name-remapping was removed in OpenVPN 2.5. "
8988 "Update your configuration.");
8991 else if (streq(p
[0], "verify-x509-name") && p
[1] && strlen(p
[1]) && !p
[3])
8993 int type
= VERIFY_X509_SUBJECT_DN
;
8994 VERIFY_PERMISSION(OPT_P_GENERAL
);
8997 if (streq(p
[2], "subject"))
8999 type
= VERIFY_X509_SUBJECT_DN
;
9001 else if (streq(p
[2], "name"))
9003 type
= VERIFY_X509_SUBJECT_RDN
;
9005 else if (streq(p
[2], "name-prefix"))
9007 type
= VERIFY_X509_SUBJECT_RDN_PREFIX
;
9011 msg(msglevel
, "unknown X.509 name type: %s", p
[2]);
9015 options
->verify_x509_type
= type
;
9016 options
->verify_x509_name
= p
[1];
9018 else if (streq(p
[0], "ns-cert-type") && p
[1] && !p
[2])
9020 VERIFY_PERMISSION(OPT_P_GENERAL
);
9021 if (streq(p
[1], "server"))
9023 options
->ns_cert_type
= NS_CERT_CHECK_SERVER
;
9025 else if (streq(p
[1], "client"))
9027 options
->ns_cert_type
= NS_CERT_CHECK_CLIENT
;
9031 msg(msglevel
, "--ns-cert-type must be 'client' or 'server'");
9035 else if (streq(p
[0], "remote-cert-ku"))
9037 VERIFY_PERMISSION(OPT_P_GENERAL
);
9040 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9042 sscanf(p
[j
], "%x", &(options
->remote_cert_ku
[j
-1]));
9046 /* No specific KU required, but require KU to be present */
9047 options
->remote_cert_ku
[0] = OPENVPN_KU_REQUIRED
;
9050 else if (streq(p
[0], "remote-cert-eku") && p
[1] && !p
[2])
9052 VERIFY_PERMISSION(OPT_P_GENERAL
);
9053 options
->remote_cert_eku
= p
[1];
9055 else if (streq(p
[0], "remote-cert-tls") && p
[1] && !p
[2])
9057 VERIFY_PERMISSION(OPT_P_GENERAL
);
9059 if (streq(p
[1], "server"))
9061 options
->remote_cert_ku
[0] = OPENVPN_KU_REQUIRED
;
9062 options
->remote_cert_eku
= "TLS Web Server Authentication";
9064 else if (streq(p
[1], "client"))
9066 options
->remote_cert_ku
[0] = OPENVPN_KU_REQUIRED
;
9067 options
->remote_cert_eku
= "TLS Web Client Authentication";
9071 msg(msglevel
, "--remote-cert-tls must be 'client' or 'server'");
9075 else if (streq(p
[0], "tls-timeout") && p
[1] && !p
[2])
9077 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9078 options
->tls_timeout
= positive_atoi(p
[1]);
9080 else if (streq(p
[0], "reneg-bytes") && p
[1] && !p
[2])
9082 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9083 options
->renegotiate_bytes
= positive_atoi(p
[1]);
9085 else if (streq(p
[0], "reneg-pkts") && p
[1] && !p
[2])
9087 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9088 options
->renegotiate_packets
= positive_atoi(p
[1]);
9090 else if (streq(p
[0], "reneg-sec") && p
[1] && !p
[3])
9092 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9093 options
->renegotiate_seconds
= positive_atoi(p
[1]);
9096 options
->renegotiate_seconds_min
= positive_atoi(p
[2]);
9099 else if (streq(p
[0], "hand-window") && p
[1] && !p
[2])
9101 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9102 options
->handshake_window
= positive_atoi(p
[1]);
9104 else if (streq(p
[0], "tran-window") && p
[1] && !p
[2])
9106 VERIFY_PERMISSION(OPT_P_TLS_PARMS
);
9107 options
->transition_window
= positive_atoi(p
[1]);
9109 else if (streq(p
[0], "tls-auth") && p
[1] && !p
[3])
9111 int key_direction
= -1;
9113 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_INLINE
);
9115 if (permission_mask
& OPT_P_GENERAL
)
9117 options
->tls_auth_file
= p
[1];
9118 options
->tls_auth_file_inline
= is_inline
;
9120 if (!is_inline
&& p
[2])
9122 key_direction
= ascii2keydirection(msglevel
, p
[2]);
9123 if (key_direction
< 0)
9127 options
->key_direction
= key_direction
;
9131 else if (permission_mask
& OPT_P_CONNECTION
)
9133 options
->ce
.tls_auth_file
= p
[1];
9134 options
->ce
.tls_auth_file_inline
= is_inline
;
9135 options
->ce
.key_direction
= KEY_DIRECTION_BIDIRECTIONAL
;
9137 if (!is_inline
&& p
[2])
9139 key_direction
= ascii2keydirection(msglevel
, p
[2]);
9140 if (key_direction
< 0)
9144 options
->ce
.key_direction
= key_direction
;
9148 else if (streq(p
[0], "tls-crypt") && p
[1] && !p
[3])
9150 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_INLINE
);
9151 if (permission_mask
& OPT_P_GENERAL
)
9153 options
->tls_crypt_file
= p
[1];
9154 options
->tls_crypt_file_inline
= is_inline
;
9156 else if (permission_mask
& OPT_P_CONNECTION
)
9158 options
->ce
.tls_crypt_file
= p
[1];
9159 options
->ce
.tls_crypt_file_inline
= is_inline
;
9162 else if (streq(p
[0], "tls-crypt-v2") && p
[1] && !p
[3])
9164 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_CONNECTION
|OPT_P_INLINE
);
9165 if (permission_mask
& OPT_P_GENERAL
)
9167 options
->tls_crypt_v2_file
= p
[1];
9168 options
->tls_crypt_v2_file_inline
= is_inline
;
9170 else if (permission_mask
& OPT_P_CONNECTION
)
9172 options
->ce
.tls_crypt_v2_file
= p
[1];
9173 options
->ce
.tls_crypt_v2_file_inline
= is_inline
;
9176 if (p
[2] && streq(p
[2], "force-cookie"))
9178 options
->ce
.tls_crypt_v2_force_cookie
= true;
9180 else if (p
[2] && streq(p
[2], "allow-noncookie"))
9182 options
->ce
.tls_crypt_v2_force_cookie
= false;
9186 msg(msglevel
, "Unsupported tls-crypt-v2 argument: %s", p
[2]);
9189 else if (streq(p
[0], "tls-crypt-v2-verify") && p
[1] && !p
[2])
9191 VERIFY_PERMISSION(OPT_P_GENERAL
);
9192 options
->tls_crypt_v2_verify_script
= p
[1];
9194 else if (streq(p
[0], "x509-track") && p
[1] && !p
[2])
9196 VERIFY_PERMISSION(OPT_P_GENERAL
);
9197 x509_track_add(&options
->x509_track
, p
[1], msglevel
, &options
->gc
);
9199 #ifdef ENABLE_X509ALTUSERNAME
9200 else if (streq(p
[0], "x509-username-field") && p
[1])
9202 /* This option used to automatically upcase the fieldnames passed as the
9203 * option arguments, e.g., "ou" became "OU". Now, this "helpfulness" is
9204 * fine-tuned by only upcasing Subject field attribute names which consist
9205 * of all lower-case characters. Mixed-case attributes such as
9206 * "emailAddress" are left as-is. An option parameter having the "ext:"
9207 * prefix for matching X.509v3 extended fields will also remain unchanged.
9209 VERIFY_PERMISSION(OPT_P_GENERAL
);
9210 for (size_t j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9214 if (strncmp("ext:", s
, 4) != 0)
9217 while (s
[i
] && !isupper(s
[i
]))
9223 while ((*s
= toupper(*s
)) != '\0')
9227 msg(M_WARN
, "DEPRECATED FEATURE: automatically upcased the "
9228 "--x509-username-field parameter to '%s'; please update your"
9229 "configuration", p
[j
]);
9232 else if (!x509_username_field_ext_supported(s
+4))
9234 msg(msglevel
, "Unsupported x509-username-field extension: %s", s
);
9236 options
->x509_username_field
[j
-1] = p
[j
];
9239 #endif /* ENABLE_X509ALTUSERNAME */
9240 #ifdef ENABLE_PKCS11
9241 else if (streq(p
[0], "show-pkcs11-ids") && !p
[3])
9243 char *provider
= p
[1];
9244 bool cert_private
= (p
[2] == NULL
? false : ( atoi(p
[2]) != 0 ));
9246 #ifdef DEFAULT_PKCS11_MODULE
9249 provider
= DEFAULT_PKCS11_MODULE
;
9254 int i
= strtol(provider
, &endp
, 10);
9258 /* There was one argument, and it was purely numeric.
9259 * Interpret it as the cert_private argument */
9260 provider
= DEFAULT_PKCS11_MODULE
;
9264 #else /* ifdef DEFAULT_PKCS11_MODULE */
9267 msg(msglevel
, "--show-pkcs11-ids requires a provider parameter");
9270 #endif /* ifdef DEFAULT_PKCS11_MODULE */
9271 VERIFY_PERMISSION(OPT_P_GENERAL
);
9273 set_debug_level(options
->verbosity
, SDL_CONSTRAIN
);
9274 show_pkcs11_ids(provider
, cert_private
);
9275 openvpn_exit(OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
9277 else if (streq(p
[0], "pkcs11-providers") && p
[1])
9281 VERIFY_PERMISSION(OPT_P_GENERAL
);
9283 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9285 options
->pkcs11_providers
[j
-1] = p
[j
];
9288 else if (streq(p
[0], "pkcs11-protected-authentication"))
9292 VERIFY_PERMISSION(OPT_P_GENERAL
);
9294 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9296 options
->pkcs11_protected_authentication
[j
-1] = atoi(p
[j
]) != 0 ? 1 : 0;
9299 else if (streq(p
[0], "pkcs11-private-mode") && p
[1])
9303 VERIFY_PERMISSION(OPT_P_GENERAL
);
9305 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9307 sscanf(p
[j
], "%x", &(options
->pkcs11_private_mode
[j
-1]));
9310 else if (streq(p
[0], "pkcs11-cert-private"))
9314 VERIFY_PERMISSION(OPT_P_GENERAL
);
9316 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
9318 options
->pkcs11_cert_private
[j
-1] = atoi(p
[j
]) != 0 ? 1 : 0;
9321 else if (streq(p
[0], "pkcs11-pin-cache") && p
[1] && !p
[2])
9323 VERIFY_PERMISSION(OPT_P_GENERAL
);
9324 options
->pkcs11_pin_cache_period
= atoi(p
[1]);
9326 else if (streq(p
[0], "pkcs11-id") && p
[1] && !p
[2])
9328 VERIFY_PERMISSION(OPT_P_GENERAL
);
9329 options
->pkcs11_id
= p
[1];
9331 else if (streq(p
[0], "pkcs11-id-management") && !p
[1])
9333 VERIFY_PERMISSION(OPT_P_GENERAL
);
9334 options
->pkcs11_id_management
= true;
9336 #endif /* ifdef ENABLE_PKCS11 */
9337 else if (streq(p
[0], "rmtun") && !p
[1])
9339 VERIFY_PERMISSION(OPT_P_GENERAL
);
9340 options
->persist_config
= true;
9341 options
->persist_mode
= 0;
9343 else if (streq(p
[0], "mktun") && !p
[1])
9345 VERIFY_PERMISSION(OPT_P_GENERAL
);
9346 options
->persist_config
= true;
9347 options
->persist_mode
= 1;
9349 else if (streq(p
[0], "peer-id") && p
[1] && !p
[2])
9351 VERIFY_PERMISSION(OPT_P_PEER_ID
);
9352 options
->use_peer_id
= true;
9353 options
->peer_id
= atoi(p
[1]);
9355 #ifdef HAVE_EXPORT_KEYING_MATERIAL
9356 else if (streq(p
[0], "keying-material-exporter") && p
[1] && p
[2])
9358 int ekm_length
= positive_atoi(p
[2]);
9360 VERIFY_PERMISSION(OPT_P_GENERAL
);
9362 if (strncmp(p
[1], "EXPORTER", 8))
9364 msg(msglevel
, "Keying material exporter label must begin with "
9368 if (streq(p
[1], EXPORT_KEY_DATA_LABEL
))
9370 msg(msglevel
, "Keying material exporter label must not be '"
9371 EXPORT_KEY_DATA_LABEL
"'.");
9373 if (ekm_length
< 16 || ekm_length
> 4095)
9375 msg(msglevel
, "Invalid keying material exporter length");
9379 options
->keying_material_exporter_label
= p
[1];
9380 options
->keying_material_exporter_length
= ekm_length
;
9382 #endif /* HAVE_EXPORT_KEYING_MATERIAL */
9383 else if (streq(p
[0], "allow-recursive-routing") && !p
[1])
9385 VERIFY_PERMISSION(OPT_P_GENERAL
);
9386 options
->allow_recursive_routing
= true;
9388 else if (streq(p
[0], "vlan-tagging") && !p
[1])
9390 VERIFY_PERMISSION(OPT_P_GENERAL
);
9391 options
->vlan_tagging
= true;
9393 else if (streq(p
[0], "vlan-accept") && p
[1] && !p
[2])
9395 VERIFY_PERMISSION(OPT_P_GENERAL
);
9396 if (streq(p
[1], "tagged"))
9398 options
->vlan_accept
= VLAN_ONLY_TAGGED
;
9400 else if (streq(p
[1], "untagged"))
9402 options
->vlan_accept
= VLAN_ONLY_UNTAGGED_OR_PRIORITY
;
9404 else if (streq(p
[1], "all"))
9406 options
->vlan_accept
= VLAN_ALL
;
9410 msg(msglevel
, "--vlan-accept must be 'tagged', 'untagged' or 'all'");
9414 else if (streq(p
[0], "vlan-pvid") && p
[1] && !p
[2])
9416 VERIFY_PERMISSION(OPT_P_GENERAL
|OPT_P_INSTANCE
);
9417 options
->vlan_pvid
= positive_atoi(p
[1]);
9418 if (options
->vlan_pvid
< OPENVPN_8021Q_MIN_VID
9419 || options
->vlan_pvid
> OPENVPN_8021Q_MAX_VID
)
9422 "the parameter of --vlan-pvid parameters must be >= %u and <= %u",
9423 OPENVPN_8021Q_MIN_VID
, OPENVPN_8021Q_MAX_VID
);
9430 int msglevel
= msglevel_fc
;
9431 /* Check if an option is in --ignore-unknown-option and
9432 * set warning level to non fatal */
9433 for (i
= 0; options
->ignore_unknown_option
&& options
->ignore_unknown_option
[i
]; i
++)
9435 if (streq(p
[0], options
->ignore_unknown_option
[i
]))
9443 msg(msglevel
, "Unrecognized option or missing or extra parameter(s) in %s:%d: %s (%s)", file
, line
, p
[0], PACKAGE_VERSION
);
9447 msg(msglevel
, "Unrecognized option or missing or extra parameter(s): --%s (%s)", p
[0], PACKAGE_VERSION
);