Added additional warning messages about --script-security 2

or higher being required to execute user-defined scripts or
executables.

git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@3436 e7ae566f-a301-0410-adde-c780ea21d3b5

diff --git a/common.h b/common.h
index 844108f0d6afa0a4b12b88b7784bd7706102585e..7aa70a5d562aaff0c151e6b8f8c3265bbbe43f22 100644 (file)
--- a/common.h
+++ b/common.h
@@ -81,4 +81,9 @@ typedef unsigned long ptr_type;
 #define INLINE_FILE_TAG "[[INLINE]]"
 #endif
 
+/*
+ * Script security warning
+ */
+#define SCRIPT_SECURITY_WARNING "openvpn_execve: external program may not be called unless '--script-security 2' or higher is enabled.  See --help text for detailed info."
+
 #endif

diff --git a/init.c b/init.c
index 968648391b62c108c60a927a04ad535bb726b8e1..fc37ac04170b9d45b973dbb76e80792cafaa2e45 100644 (file)
--- a/init.c
+++ b/init.c
@@ -1999,8 +1999,10 @@ do_option_warnings (struct context *c)
 
   if (script_security >= SSEC_SCRIPTS)
     msg (M_WARN, "NOTE: the current --script-security setting may allow this configuration to call user-defined scripts");
-  if (script_security >= SSEC_PW_ENV)
+  else if (script_security >= SSEC_PW_ENV)
     msg (M_WARN, "WARNING: the current --script-security setting may allow passwords to be passed to scripts via environmental variables");
+  else
+    msg (M_WARN, "NOTE: " PACKAGE_NAME " 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables");
 }
 
 static void

diff --git a/misc.c b/misc.c
index d6a57c184e660165f8f700ac71976c421b8686dd..911e911166942a51df458d84dfee953ff87be78e 100644 (file)
--- a/misc.c
+++ b/misc.c
@@ -528,7 +528,7 @@ openvpn_execve (const struct argv *a, const struct env_set *es, const unsigned i
        }
       else
        {
-         msg (M_WARN, "openvpn_execve: external program may not be called due to setting of --script-security level");
+         msg (M_WARN, SCRIPT_SECURITY_WARNING);
        }
 #else
       msg (M_WARN, "openvpn_execve: execve function not available");

diff --git a/win32.c b/win32.c
index f42732212499e68a666ac2731977cafac4d9892c..9272cb7e17df17ef8dffefd765268844d402390b 100644 (file)
--- a/win32.c
+++ b/win32.c
@@ -949,7 +949,7 @@ openvpn_execve (const struct argv *a, const struct env_set *es, const unsigned i
        }
       else
        {
-         msg (M_WARN, "openvpn_execve: external program may not be called due to setting of --script-security level");
+         msg (M_WARN, SCRIPT_SECURITY_WARNING);
        }
     }
   else