2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
8 * Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <sales@openvpn.net>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program (see the file COPYING included with this
21 * distribution); if not, write to the Free Software Foundation, Inc.,
22 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26 * 2004-01-28: Added Socks5 proxy support
27 * (Christof Meerwald, http://cmeerw.org)
41 #include "packet_id.h"
51 const char title_string
[] =
62 " [LZO" LZO_VERSION_NUM
"]"
67 #ifdef PRODUCT_TAP_DEBUG
81 static const char usage_message
[] =
85 "--config file : Read configuration options from file.\n"
86 "--help : Show options.\n"
87 "--version : Show copyright and version information.\n"
90 "--local host : Local host name or ip address. Implies --bind.\n"
91 "--remote host [port] : Remote host name or ip address.\n"
92 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
93 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
94 "--proto p : Use protocol p for communicating with peer.\n"
95 " p = udp (default), tcp-server, or tcp-client\n"
96 "--connect-retry n : For --proto tcp-client, number of seconds to wait\n"
97 " between connection retries (default=%d).\n"
98 "--connect-timeout n : For --proto tcp-client, connection timeout (in seconds).\n"
99 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
100 #ifdef GENERAL_PROXY_SUPPORT
101 "--auto-proxy : Try to sense proxy settings (or lack thereof) automatically.\n"
103 #ifdef ENABLE_HTTP_PROXY
104 "--http-proxy s p [up] [auth] : Connect to remote host\n"
105 " through an HTTP proxy at address s and port p.\n"
106 " If proxy authentication is required,\n"
107 " up is a file containing username/password on 2 lines, or\n"
108 " 'stdin' to prompt from console. Add auth='ntlm' if\n"
109 " the proxy requires NTLM authentication.\n"
110 "--http-proxy s p 'auto': Like the above directive, but automatically determine\n"
111 " auth method and query for username/password if needed.\n"
112 "--http-proxy-retry : Retry indefinitely on HTTP proxy errors.\n"
113 "--http-proxy-timeout n : Proxy timeout in seconds, default=5.\n"
114 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
115 " Repeat to set multiple options.\n"
116 " VERSION version (default=1.0)\n"
117 " AGENT user-agent\n"
120 "--socks-proxy s [p]: Connect to remote host through a Socks5 proxy at address\n"
121 " s and port p (default port = 1080).\n"
122 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
124 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
125 " resolve for n seconds before failing (disabled by default).\n"
126 " Set n=\"infinite\" to retry indefinitely.\n"
127 "--float : Allow remote to change its IP address/port, such as through\n"
128 " DHCP (this is the default if --remote is not used).\n"
129 "--ipchange cmd : Execute shell command cmd on remote ip address initial\n"
130 " setting or change -- execute as: cmd ip-address port#\n"
131 "--port port : TCP/UDP port # for both local and remote.\n"
132 "--lport port : TCP/UDP port # for local (default=%d). Implies --bind.\n"
133 "--rport port : TCP/UDP port # for remote (default=%d).\n"
134 "--bind : Bind to local address and port. (This is the default unless\n"
135 " --proto tcp-client"
136 #ifdef ENABLE_HTTP_PROXY
143 "--nobind : Do not bind to local address and port.\n"
144 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n"
145 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
146 " this option only if the tun/tap device used with --dev\n"
147 " does not begin with \"tun\" or \"tap\".\n"
148 "--dev-node node : Explicitly set the device node rather than using\n"
149 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
150 "--lladdr hw : Set the link layer address of the tap device.\n"
151 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
152 "--tun-ipv6 : Build tun link capable of forwarding IPv6 traffic.\n"
153 #ifdef CONFIG_FEATURE_IPROUTE
154 "--iproute cmd : Use this command instead of default " IPROUTE_PATH
".\n"
156 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
157 " endpoint and rn as a remote endpoint. l & rn should be\n"
158 " swapped on the other peer. l & rn must be private\n"
159 " addresses outside of the subnets used by either peer.\n"
160 " TAP: configure device to use IP address l as a local\n"
161 " endpoint and rn as a subnet mask.\n"
162 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
163 " pass --ifconfig parms by environment to scripts.\n"
164 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
165 " connection doesn't match the remote side.\n"
166 "--route network [netmask] [gateway] [metric] :\n"
167 " Add route to routing table after connection\n"
168 " is established. Multiple routes can be specified.\n"
169 " netmask default: 255.255.255.255\n"
170 " gateway default: taken from --route-gateway or --ifconfig\n"
171 " Specify default by leaving blank or setting to \"nil\".\n"
172 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
173 "--route-metric m : Specify a default metric for use with --route.\n"
174 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
175 " adding routes (may be 0). If not specified, routes will\n"
176 " be added immediately after tun/tap open. On Windows, wait\n"
177 " up to w seconds for TUN/TAP adapter to come up.\n"
178 "--route-up cmd : Execute shell cmd after routes are added.\n"
179 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
180 " --route-up script using environmental variables.\n"
181 "--route-nopull : When used with --client or --pull, accept options pushed\n"
182 " by server EXCEPT for routes.\n"
183 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
184 " --ifconfig, --route, and --route-gateway.\n"
185 "--redirect-gateway [flags]: Automatically execute routing\n"
186 " commands to redirect all outgoing IP traffic through the\n"
187 " VPN. Add 'local' flag if both " PACKAGE_NAME
" servers are directly\n"
188 " connected via a common subnet, such as with WiFi.\n"
189 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
190 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
191 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
192 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
193 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
194 " the default gateway. Useful when pushing private subnets.\n"
195 "--setenv name value : Set a custom environmental variable to pass to script.\n"
196 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
197 " directives for future OpenVPN versions to be ignored.\n"
198 "--script-security level mode : mode='execve' (default) or 'system', level=\n"
199 " 0 -- strictly no calling of external programs\n"
200 " 1 -- (default) only call built-ins such as ifconfig\n"
201 " 2 -- allow calling of built-ins and scripts\n"
202 " 3 -- allow password to be passed to scripts via env\n"
203 "--shaper n : Restrict output to peer to n bytes per second.\n"
204 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
205 " ping once every n seconds, restart if ping not received\n"
207 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
208 " produces a combined in/out byte count < bytes.\n"
209 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
210 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
211 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
213 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
214 #if ENABLE_IP_PKTINFO
215 "--multihome : Configure a multi-homed UDP server.\n"
217 "--fast-io : (experimental) Optimize TUN/TAP/UDP writes.\n"
218 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
219 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
220 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
221 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
222 "--persist-key : Don't re-read key files across SIGUSR1 or --ping-restart.\n"
223 #if PASSTOS_CAPABILITY
224 "--passtos : TOS passthrough (applies to IPv4 only).\n"
226 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
227 " TCP/UDP MTU from it (default=%d).\n"
228 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
229 " as n bytes more than the tun-mtu size on read\n"
230 " (default TUN=0 TAP=%d).\n"
231 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
233 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
234 " 'no' -- Never send DF (Don't Fragment) frames\n"
235 " 'maybe' -- Use per-route hints\n"
236 " 'yes' -- Always DF (Don't Fragment)\n"
238 "--mtu-test : Empirically measure and report MTU.\n"
240 #ifdef ENABLE_FRAGMENT
241 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
242 " datagrams are sent which are larger than max bytes.\n"
243 " Adds 4 bytes of overhead per datagram.\n"
245 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
246 " or --fragment max value, whichever is lower.\n"
247 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
248 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
249 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
250 "--mlock : Disable Paging -- ensures key material and tunnel\n"
251 " data will never be written to disk.\n"
252 "--up cmd : Shell cmd to execute after successful tun device open.\n"
253 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
254 " ifconfig-local-ip ifconfig-remote-ip\n"
255 " (pre --user or --group UID/GID change)\n"
256 "--up-delay : Delay tun/tap open and possible --up script execution\n"
257 " until after TCP/UDP connection establishment with peer.\n"
258 "--down cmd : Shell cmd to run after tun device close.\n"
259 " (post --user/--group UID/GID change and/or --chroot)\n"
260 " (script parameters are same as --up option)\n"
261 "--down-pre : Call --down cmd/script before TUN/TAP close.\n"
262 "--up-restart : Run up/down scripts for all restarts including those\n"
263 " caused by --ping-restart or SIGUSR1\n"
264 "--user user : Set UID to user after initialization.\n"
265 "--group group : Set GID to group after initialization.\n"
266 "--chroot dir : Chroot to this directory after initialization.\n"
267 "--cd dir : Change to this directory before initialization.\n"
268 "--daemon [name] : Become a daemon after initialization.\n"
269 " The optional 'name' parameter will be passed\n"
270 " as the program name to the system logger.\n"
271 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
272 " See --daemon above for a description of the 'name' parm.\n"
273 "--inetd [name] ['wait'|'nowait'] : Run as an inetd or xinetd server.\n"
274 " See --daemon above for a description of the 'name' parm.\n"
275 "--log file : Output log to file which is created/truncated on open.\n"
276 "--log-append file : Append log to file, or create file if nonexistent.\n"
277 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
278 "--writepid file : Write main process ID to file.\n"
279 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
282 "--nice-work n : Change thread priority of work thread. The work\n"
283 " thread is used for background processing such as\n"
284 " RSA key number crunching.\n"
287 "--echo [parms ...] : Echo parameters to log output.\n"
288 "--verb n : Set output verbosity to n (default=%d):\n"
289 " (Level 3 is recommended if you want a good summary\n"
290 " of what's happening without being swamped by output).\n"
291 " : 0 -- no output except fatal errors\n"
292 " : 1 -- startup info + connection initiated messages +\n"
293 " non-fatal encryption & net errors\n"
294 " : 2,3 -- show TLS negotiations & route info\n"
295 " : 4 -- show parameters\n"
296 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
297 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
298 " : 6 to 11 -- debug messages of increasing verbosity\n"
299 "--mute n : Log at most n consecutive messages in the same category.\n"
300 "--status file n : Write operational status to file every n seconds.\n"
301 "--status-version [n] : Choose the status file format version number.\n"
302 " Currently, n can be 1, 2, or 3 (default=1).\n"
304 "--disable-occ : Disable options consistency check between peers.\n"
307 "--gremlin mask : Special stress testing mode (for debugging only).\n"
310 "--comp-lzo : Use fast LZO compression -- may add up to 1 byte per\n"
311 " packet for uncompressible data.\n"
312 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
315 #ifdef ENABLE_MANAGEMENT
316 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
317 " management functions. pass is a password file\n"
318 " or 'stdin' to prompt from console.\n"
319 #if UNIX_SOCK_SUPPORT
320 " To listen on a unix domain socket, specific the pathname\n"
321 " in place of ip and use 'unix' as the port number.\n"
323 "--management-client : Management interface will connect as a TCP client to\n"
324 " ip/port rather than listen as a TCP server.\n"
325 "--management-query-passwords : Query management channel for private key\n"
326 " and auth-user-pass passwords.\n"
327 "--management-hold : Start " PACKAGE_NAME
" in a hibernating state, until a client\n"
328 " of the management interface explicitly starts it.\n"
329 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
330 "--management-forget-disconnect : Forget passwords when management disconnect\n"
332 "--management-log-cache n : Cache n lines of log file history for usage\n"
333 " by the management channel.\n"
334 #if UNIX_SOCK_SUPPORT
335 "--management-client-user u : When management interface is a unix socket, only\n"
336 " allow connections from user u.\n"
337 "--management-client-group g : When management interface is a unix socket, only\n"
338 " allow connections from group g.\n"
340 #ifdef MANAGEMENT_DEF_AUTH
341 "--management-client-auth : gives management interface client the responsibility\n"
342 " to authenticate clients after their client certificate\n"
343 " has been verified.\n"
346 "--management-client-pf : management interface clients must specify a packet\n"
347 " filter file for each connecting client.\n"
351 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
352 " to its initialization function.\n"
357 "Multi-Client Server options (when --mode server is used):\n"
358 "--server network netmask : Helper option to easily configure server mode.\n"
359 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
360 " easily configure ethernet bridging server mode.\n"
361 "--push \"option\" : Push a config file option back to the peer for remote\n"
362 " execution. Peer must specify --pull in its config file.\n"
363 "--push-reset : Don't inherit global push list for specific\n"
364 " client instance.\n"
365 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
366 " to be dynamically allocated to connecting clients.\n"
367 "--ifconfig-pool-linear : Use individual addresses rather than /30 subnets\n"
368 " in tun mode. Not compatible with Windows clients.\n"
369 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
370 " data to file, at seconds intervals (default=600).\n"
371 " If seconds=0, file will be treated as read-only.\n"
372 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
373 " overrides --ifconfig-pool dynamic allocation.\n"
374 " Only valid in a client-specific config file.\n"
375 "--iroute network [netmask] : Route subnet to client.\n"
376 " Sets up internal routes only.\n"
377 " Only valid in a client-specific config file.\n"
378 "--disable : Client is disabled.\n"
379 " Only valid in a client-specific config file.\n"
380 "--client-cert-not-required : Don't require client certificate, client\n"
381 " will authenticate using username/password.\n"
382 "--username-as-common-name : For auth-user-pass authentication, use\n"
383 " the authenticated username as the common name,\n"
384 " rather than the common name from the client cert.\n"
385 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
386 " run script cmd to verify. If method='via-env', pass\n"
387 " user/pass via environment, if method='via-file', pass\n"
388 " user/pass via temporary file.\n"
389 "--opt-verify : Clients that connect with options that are incompatible\n"
390 " with those of the server will be disconnected.\n"
391 "--auth-user-pass-optional : Allow connections by clients that don't\n"
392 " specify a username/password.\n"
393 "--no-name-remapping : Allow Common Name and X509 Subject to include\n"
394 " any printable character.\n"
395 "--client-to-client : Internally route client-to-client traffic.\n"
396 "--duplicate-cn : Allow multiple clients with the same common name to\n"
397 " concurrently connect.\n"
398 "--client-connect cmd : Run script cmd on client connection.\n"
399 "--client-disconnect cmd : Run script cmd on client disconnection.\n"
400 "--client-config-dir dir : Directory for custom client config files.\n"
401 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
402 "--tmp-dir dir : Temporary directory, used for --client-connect return file.\n"
403 "--hash-size r v : Set the size of the real address hash table to r and the\n"
404 " virtual address table to v.\n"
405 "--bcast-buffers n : Allocate n broadcast buffers.\n"
406 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
407 "--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server\n"
408 " as well as pushes it to connecting clients.\n"
409 "--learn-address cmd : Run script cmd to validate client virtual addresses.\n"
410 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
411 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
412 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
414 "--port-share host port : When run in TCP mode, proxy incoming HTTPS sessions\n"
415 " to a web server at host:port.\n"
419 "Client options (when connecting to a multi-client server):\n"
420 "--client : Helper option to easily configure client mode.\n"
421 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
422 " up is a file containing username/password on 2 lines,\n"
423 " or omit to prompt from console.\n"
424 "--pull : Accept certain config file options from the peer as if they\n"
425 " were part of the local config file. Must be specified\n"
426 " when connecting to a '--mode server' remote host.\n"
427 "--auth-retry t : How to handle auth failures. Set t to\n"
428 " none (default), interact, or nointeract.\n"
431 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
432 " server/remote. n = # of retries, default=1.\n"
436 "Data Channel Encryption Options (must be compatible between peers):\n"
437 "(These options are meaningful for both Static Key & TLS-mode)\n"
438 "--secret f [d] : Enable Static Key encryption mode (non-TLS).\n"
439 " Use shared secret file f, generate with --genkey.\n"
440 " The optional d parameter controls key directionality.\n"
441 " If d is specified, use separate keys for each\n"
442 " direction, set d=0 on one side of the connection,\n"
443 " and d=1 on the other side.\n"
444 "--auth alg : Authenticate packets with HMAC using message\n"
445 " digest algorithm alg (default=%s).\n"
446 " (usually adds 16 or 20 bytes per packet)\n"
447 " Set alg=none to disable authentication.\n"
448 "--cipher alg : Encrypt packets with cipher algorithm alg\n"
450 " Set alg=none to disable encryption.\n"
451 "--prng alg [nsl] : For PRNG, use digest algorithm alg, and\n"
452 " nonce_secret_len=nsl. Set alg=none to disable PRNG.\n"
453 #ifdef HAVE_EVP_CIPHER_CTX_SET_KEY_LENGTH
454 "--keysize n : Size of cipher key in bits (optional).\n"
455 " If unspecified, defaults to cipher-specific default.\n"
457 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
458 "--no-replay : Disable replay protection.\n"
459 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
460 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
461 " and a time window of t seconds.\n"
462 " Default n=%d t=%d\n"
463 "--no-iv : Disable cipher IV -- only allowed with CBC mode ciphers.\n"
464 "--replay-persist file : Persist replay-protection state across sessions\n"
466 "--test-crypto : Run a self-test of crypto features enabled.\n"
467 " For debugging only.\n"
470 "TLS Key Negotiation Options:\n"
471 "(These options are meaningful only for TLS-mode)\n"
472 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
473 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
474 "--key-method m : Data channel key exchange method. m should be a method\n"
475 " number, such as 1 (default), 2, etc.\n"
476 "--ca file : Certificate authority file in .pem format containing\n"
477 " root certificate.\n"
478 "--capath dir : A directory of trusted certificates (CAs"
479 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
483 " WARNING: no support of CRL available with this version.\n"
485 "--dh file : File containing Diffie Hellman parameters\n"
486 " in .pem format (for --tls-server only).\n"
487 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
488 "--cert file : Local certificate in .pem format -- must be signed\n"
489 " by a Certificate Authority in --ca file.\n"
490 "--key file : Local private key in .pem format.\n"
491 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
492 " and optionally the root CA certificate.\n"
494 "--cryptoapicert select-string : Load the certificate and private key from the\n"
495 " Windows Certificate System Store.\n"
497 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
498 " : Use --show-tls to see a list of supported TLS ciphers.\n"
499 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
500 " if no ACK from remote within n seconds (default=%d).\n"
501 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
502 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
503 "--reneg-sec n : Renegotiate data chan. key after n seconds (default=%d).\n"
504 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
505 " of handshake initiation by any peer (default=%d).\n"
506 "--tran-window n : Transition window -- old key can live this many seconds\n"
507 " after new key renegotiation begins (default=%d).\n"
508 "--single-session: Allow only one session (reset state on restart).\n"
509 "--tls-exit : Exit on TLS negotiation failure.\n"
510 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
511 " control channel to protect against DoS attacks.\n"
512 " f (required) is a shared-secret passphrase file.\n"
513 " The optional d parameter controls key directionality,\n"
514 " see --secret option for more info.\n"
515 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
516 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
517 "--crl-verify crl: Check peer certificate against a CRL.\n"
518 "--tls-verify cmd: Execute shell command cmd to verify the X509 name of a\n"
519 " pending TLS connection that has otherwise passed all other\n"
520 " tests of certification. cmd should return 0 to allow\n"
521 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
522 " executed as 'cmd certificate_depth X509_NAME_oneline')\n"
523 "--tls-remote x509name: Accept connections only from a host with X509 name\n"
524 " x509name. The remote host must also pass all other tests\n"
525 " of verification.\n"
526 "--ns-cert-type t: Require that peer certificate was signed with an explicit\n"
527 " nsCertType designation t = 'client' | 'server'.\n"
528 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
529 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
530 " explicit key usage, you can specify more than one value.\n"
531 " value should be given in hex format.\n"
532 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
533 " explicit extended key usage. Extended key usage can be encoded\n"
534 " as an object identifier or OpenSSL string representation.\n"
535 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
536 " key usage and extended key usage based on RFC3280 TLS rules.\n"
537 " t = 'client' | 'server'.\n"
538 #endif /* OPENSSL_VERSION_NUMBER */
543 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
544 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
545 " path. Set for each provider.\n"
546 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
547 " 0 : Try to determind automatically (default).\n"
549 " 2 : Use SignRecover.\n"
550 " 4 : Use Decrypt.\n"
552 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
553 " certificate can be accessed. Set for each provider.\n"
554 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
555 " cache until token is removed.\n"
556 "--pkcs11-id-management : Acquire identity from management interface.\n"
557 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
558 #endif /* ENABLE_PKCS11 */
560 "SSL Library information:\n"
561 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
562 "--show-digests : Show message digest algorithms to use with --auth option.\n"
563 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
565 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
569 "Windows Specific:\n"
570 "--win-sys path|'env' : Pathname of Windows system directory, C:\\WINDOWS by default.\n"
571 " If specified as 'env', read the pathname from SystemRoot env var.\n"
572 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Win32 adapter\n"
573 " IP address using method = manual, netsh, ipapi,\n"
574 " dynamic, or adaptive (default = adaptive).\n"
575 " Dynamic method allows two optional parameters:\n"
576 " offset: DHCP server address offset (> -256 and < 256).\n"
577 " If 0, use network address, if >0, take nth\n"
578 " address forward from network address, if <0,\n"
579 " take nth address backward from broadcast\n"
582 " lease-time: Lease time in seconds.\n"
583 " Default is one year.\n"
584 "--route-method : Which method to use for adding routes on Windows?\n"
585 " adaptive (default) -- Try ipapi then fall back to exe.\n"
586 " ipapi -- Use IP helper API.\n"
587 " exe -- Call the route.exe shell command.\n"
588 "--dhcp-option type [parm] : Set extended TAP-Win32 properties, must\n"
589 " be used with --ip-win32 dynamic. For options\n"
590 " which allow multiple addresses,\n"
591 " --dhcp-option must be repeated.\n"
592 " DOMAIN name : Set DNS suffix\n"
593 " DNS addr : Set domain name server address(es)\n"
594 " NTP : Set NTP server address(es)\n"
595 " NBDD : Set NBDD server address(es)\n"
596 " WINS addr : Set WINS server address(es)\n"
597 " NBT type : Set NetBIOS over TCP/IP Node type\n"
598 " 1: B, 2: P, 4: M, 8: H\n"
599 " NBS id : Set NetBIOS scope ID\n"
600 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
601 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
602 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
604 "--dhcp-release : Ask Windows to release the TAP adapter lease on shutdown.\n"
605 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
606 " attempting to set adapter properties.\n"
607 "--pause-exit : When run from a console window, pause before exiting.\n"
608 "--service ex [0|1] : For use when " PACKAGE_NAME
" is being instantiated by a\n"
609 " service, and should not be used directly by end-users.\n"
610 " ex is the name of an event object which, when\n"
611 " signaled, will cause " PACKAGE_NAME
" to exit. A second\n"
612 " optional parameter controls the initial state of ex.\n"
613 "--show-net-up : Show " PACKAGE_NAME
"'s view of routing table and net adapter list\n"
614 " after TAP adapter is up and routes have been added.\n"
615 "Windows Standalone Options:\n"
617 "--show-adapters : Show all TAP-Win32 adapters.\n"
618 "--show-net : Show " PACKAGE_NAME
"'s view of routing table and net adapter list.\n"
619 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
620 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME
" running without admin privileges\n"
621 " to access TAP adapter.\n"
624 "Generate a random key (only for non-TLS static key encryption mode):\n"
625 "--genkey : Generate a random key to be used as a shared secret,\n"
626 " for use with the --secret option.\n"
627 "--secret file : Write key to file.\n"
628 #endif /* USE_CRYPTO */
631 "Tun/tap config mode (available with linux 2.4+):\n"
632 "--mktun : Create a persistent tunnel.\n"
633 "--rmtun : Remove a persistent tunnel.\n"
634 "--dev tunX|tapX : tun/tap device\n"
635 "--dev-type dt : Device type. See tunnel options above for details.\n"
636 "--user user : User to set privilege to.\n"
637 "--group group : Group to set privilege to.\n"
641 "PKCS#11 standalone options:\n"
642 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
643 " --verb option can be added *BEFORE* this.\n"
644 #endif /* ENABLE_PKCS11 */
647 #endif /* !ENABLE_SMALL */
650 * This is where the options defaults go.
651 * Any option not explicitly set here
655 init_options (struct options
*o
, const bool init_gc
)
663 o
->mode
= MODE_POINT_TO_POINT
;
664 o
->topology
= TOP_NET30
;
665 o
->ce
.proto
= PROTO_UDPv4
;
666 o
->ce
.connect_retry_seconds
= 5;
667 o
->ce
.connect_timeout
= 10;
668 o
->ce
.connect_retry_max
= 0;
669 o
->ce
.local_port
= o
->ce
.remote_port
= OPENVPN_PORT
;
671 o
->status_file_update_freq
= 60;
672 o
->status_file_version
= 1;
673 o
->ce
.bind_local
= true;
674 o
->tun_mtu
= TUN_MTU_DEFAULT
;
675 o
->link_mtu
= LINK_MTU_DEFAULT
;
676 o
->mtu_discover_type
= -1;
677 o
->mssfix
= MSSFIX_DEFAULT
;
678 o
->route_delay_window
= 30;
679 o
->resolve_retry_seconds
= RESOLV_RETRY_INFINITE
;
683 #ifdef ENABLE_MANAGEMENT
684 o
->management_log_history_cache
= 250;
685 o
->management_echo_buffer_size
= 100;
686 o
->management_state_buffer_size
= 100;
696 o
->tuntap_options
.txqueuelen
= 100;
700 o
->tuntap_options
.ip_win32_type
= IPW32_SET_ADAPTIVE
;
702 o
->tuntap_options
.ip_win32_type
= IPW32_SET_DHCP_MASQ
;
704 o
->tuntap_options
.dhcp_lease_time
= 31536000; /* one year */
705 o
->tuntap_options
.dhcp_masq_offset
= 0; /* use network address as internal DHCP server address */
706 o
->route_method
= ROUTE_METHOD_ADAPTIVE
;
712 o
->real_hash_size
= 256;
713 o
->virtual_hash_size
= 256;
714 o
->n_bcast_buf
= 256;
715 o
->tcp_queue_limit
= 64;
716 o
->max_clients
= 1024;
717 o
->max_routes_per_client
= 256;
718 o
->ifconfig_pool_persist_refresh_freq
= 600;
721 o
->scheduled_exit_interval
= 5;
724 o
->ciphername
= "BF-CBC";
725 o
->ciphername_defined
= true;
726 o
->authname
= "SHA1";
727 o
->authname_defined
= true;
728 o
->prng_hash
= "SHA1";
729 o
->prng_nonce_secret_len
= 16;
731 o
->replay_window
= DEFAULT_SEQ_BACKTRACK
;
732 o
->replay_time
= DEFAULT_TIME_BACKTRACK
;
734 o
->key_direction
= KEY_DIRECTION_BIDIRECTIONAL
;
738 o
->renegotiate_seconds
= 3600;
739 o
->handshake_window
= 60;
740 o
->transition_window
= 3600;
744 o
->pkcs11_pin_cache_period
= -1;
745 #endif /* ENABLE_PKCS11 */
749 uninit_options (struct options
*o
)
757 #define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
758 #define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
759 #define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
760 #define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
761 #define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
762 #define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
767 setenv_connection_entry (struct env_set
*es
,
768 const struct connection_entry
*e
,
771 setenv_str_i (es
, "proto", proto2ascii (e
->proto
, false), i
);
772 setenv_str_i (es
, "local", e
->local
, i
);
773 setenv_int_i (es
, "local_port", e
->local_port
, i
);
774 setenv_str_i (es
, "remote", e
->remote
, i
);
775 setenv_int_i (es
, "remote_port", e
->remote_port
, i
);
777 #ifdef ENABLE_HTTP_PROXY
778 if (e
->http_proxy_options
)
780 setenv_str_i (es
, "http_proxy_server", e
->http_proxy_options
->server
, i
);
781 setenv_int_i (es
, "http_proxy_port", e
->http_proxy_options
->port
, i
);
785 if (e
->socks_proxy_server
)
787 setenv_str_i (es
, "socks_proxy_server", e
->socks_proxy_server
, i
);
788 setenv_int_i (es
, "socks_proxy_port", e
->socks_proxy_port
, i
);
794 setenv_settings (struct env_set
*es
, const struct options
*o
)
796 setenv_str (es
, "config", o
->config
);
797 setenv_int (es
, "verb", o
->verbosity
);
798 setenv_int (es
, "daemon", o
->daemon
);
799 setenv_int (es
, "daemon_log_redirect", o
->log
);
800 setenv_unsigned (es
, "daemon_start_time", time(NULL
));
801 setenv_int (es
, "daemon_pid", openvpn_getpid());
803 #ifdef ENABLE_CONNECTION
804 if (o
->connection_list
)
807 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
808 setenv_connection_entry (es
, o
->connection_list
->array
[i
], i
+1);
812 setenv_connection_entry (es
, &o
->ce
, 1);
816 get_ip_addr (const char *ip_string
, int msglevel
, bool *error
)
818 unsigned int flags
= GETADDR_HOST_ORDER
;
819 bool succeeded
= false;
822 if (msglevel
& M_FATAL
)
823 flags
|= GETADDR_FATAL
;
825 ret
= getaddr (flags
, ip_string
, 0, &succeeded
, NULL
);
826 if (!succeeded
&& error
)
832 string_substitute (const char *src
, int from
, int to
, struct gc_arena
*gc
)
834 char *ret
= (char *) gc_malloc (strlen (src
) + 1, true, gc
);
850 is_persist_option (const struct options
*o
)
852 return o
->persist_tun
854 || o
->persist_local_ip
855 || o
->persist_remote_ip
863 is_stateful_restart (const struct options
*o
)
865 return is_persist_option (o
) || connection_list_defined (o
);
873 show_dhcp_option_addrs (const char *name
, const in_addr_t
*array
, int len
)
875 struct gc_arena gc
= gc_new ();
877 for (i
= 0; i
< len
; ++i
)
879 msg (D_SHOW_PARMS
, " %s[%d] = %s",
882 print_in_addr_t (array
[i
], 0, &gc
));
888 show_tuntap_options (const struct tuntap_options
*o
)
890 SHOW_BOOL (ip_win32_defined
);
891 SHOW_INT (ip_win32_type
);
892 SHOW_INT (dhcp_masq_offset
);
893 SHOW_INT (dhcp_lease_time
);
894 SHOW_INT (tap_sleep
);
895 SHOW_BOOL (dhcp_options
);
896 SHOW_BOOL (dhcp_renew
);
897 SHOW_BOOL (dhcp_pre_release
);
898 SHOW_BOOL (dhcp_release
);
900 SHOW_STR (netbios_scope
);
901 SHOW_INT (netbios_node_type
);
902 SHOW_BOOL (disable_nbt
);
904 show_dhcp_option_addrs ("DNS", o
->dns
, o
->dns_len
);
905 show_dhcp_option_addrs ("WINS", o
->wins
, o
->wins_len
);
906 show_dhcp_option_addrs ("NTP", o
->ntp
, o
->ntp_len
);
907 show_dhcp_option_addrs ("NBDD", o
->nbdd
, o
->nbdd_len
);
913 dhcp_option_address_parse (const char *name
, const char *parm
, in_addr_t
*array
, int *len
, int msglevel
)
915 if (*len
>= N_DHCP_ADDR
)
917 msg (msglevel
, "--dhcp-option %s: maximum of %d %s servers can be specified",
924 if (ip_addr_dotted_quad_safe (parm
)) /* FQDN -- IP address only */
927 const in_addr_t addr
= get_ip_addr (parm
, msglevel
, &error
);
929 array
[(*len
)++] = addr
;
933 msg (msglevel
, "dhcp-option parameter %s '%s' must be an IP address", name
, parm
);
945 show_p2mp_parms (const struct options
*o
)
947 struct gc_arena gc
= gc_new ();
950 msg (D_SHOW_PARMS
, " server_network = %s", print_in_addr_t (o
->server_network
, 0, &gc
));
951 msg (D_SHOW_PARMS
, " server_netmask = %s", print_in_addr_t (o
->server_netmask
, 0, &gc
));
952 msg (D_SHOW_PARMS
, " server_bridge_ip = %s", print_in_addr_t (o
->server_bridge_ip
, 0, &gc
));
953 msg (D_SHOW_PARMS
, " server_bridge_netmask = %s", print_in_addr_t (o
->server_bridge_netmask
, 0, &gc
));
954 msg (D_SHOW_PARMS
, " server_bridge_pool_start = %s", print_in_addr_t (o
->server_bridge_pool_start
, 0, &gc
));
955 msg (D_SHOW_PARMS
, " server_bridge_pool_end = %s", print_in_addr_t (o
->server_bridge_pool_end
, 0, &gc
));
958 const struct push_list
*l
= o
->push_list
;
959 const char *printable_push_list
= l
->options
;
960 msg (D_SHOW_PARMS
, " push_list = '%s'", printable_push_list
);
962 SHOW_BOOL (ifconfig_pool_defined
);
963 msg (D_SHOW_PARMS
, " ifconfig_pool_start = %s", print_in_addr_t (o
->ifconfig_pool_start
, 0, &gc
));
964 msg (D_SHOW_PARMS
, " ifconfig_pool_end = %s", print_in_addr_t (o
->ifconfig_pool_end
, 0, &gc
));
965 msg (D_SHOW_PARMS
, " ifconfig_pool_netmask = %s", print_in_addr_t (o
->ifconfig_pool_netmask
, 0, &gc
));
966 SHOW_STR (ifconfig_pool_persist_filename
);
967 SHOW_INT (ifconfig_pool_persist_refresh_freq
);
968 SHOW_INT (n_bcast_buf
);
969 SHOW_INT (tcp_queue_limit
);
970 SHOW_INT (real_hash_size
);
971 SHOW_INT (virtual_hash_size
);
972 SHOW_STR (client_connect_script
);
973 SHOW_STR (learn_address_script
);
974 SHOW_STR (client_disconnect_script
);
975 SHOW_STR (client_config_dir
);
976 SHOW_BOOL (ccd_exclusive
);
978 SHOW_BOOL (push_ifconfig_defined
);
979 msg (D_SHOW_PARMS
, " push_ifconfig_local = %s", print_in_addr_t (o
->push_ifconfig_local
, 0, &gc
));
980 msg (D_SHOW_PARMS
, " push_ifconfig_remote_netmask = %s", print_in_addr_t (o
->push_ifconfig_remote_netmask
, 0, &gc
));
981 SHOW_BOOL (enable_c2c
);
982 SHOW_BOOL (duplicate_cn
);
985 SHOW_INT (max_clients
);
986 SHOW_INT (max_routes_per_client
);
987 SHOW_STR (auth_user_pass_verify_script
);
988 SHOW_BOOL (auth_user_pass_verify_script_via_file
);
989 SHOW_INT (ssl_flags
);
991 SHOW_STR (port_share_host
);
992 SHOW_INT (port_share_port
);
994 #endif /* P2MP_SERVER */
998 SHOW_STR (auth_user_pass_file
);
1003 #endif /* ENABLE_DEBUG */
1008 option_iroute (struct options
*o
,
1009 const char *network_str
,
1010 const char *netmask_str
,
1015 ALLOC_OBJ_GC (ir
, struct iroute
, &o
->gc
);
1016 ir
->network
= getaddr (GETADDR_HOST_ORDER
, network_str
, 0, NULL
, NULL
);
1021 const in_addr_t netmask
= getaddr (GETADDR_HOST_ORDER
, netmask_str
, 0, NULL
, NULL
);
1022 if (!netmask_to_netbits (ir
->network
, netmask
, &ir
->netbits
))
1024 msg (msglevel
, "in --iroute %s %s : Bad network/subnet specification",
1031 ir
->next
= o
->iroutes
;
1035 #endif /* P2MP_SERVER */
1038 #if defined(ENABLE_HTTP_PROXY) && defined(ENABLE_DEBUG)
1040 show_http_proxy_options (const struct http_proxy_options
*o
)
1042 msg (D_SHOW_PARMS
, "BEGIN http_proxy");
1045 SHOW_STR (auth_method_string
);
1046 SHOW_STR (auth_file
);
1049 SHOW_STR (http_version
);
1050 SHOW_STR (user_agent
);
1051 msg (D_SHOW_PARMS
, "END http_proxy");
1056 options_detach (struct options
*o
)
1061 if (o
->push_list
) /* clone push_list */
1063 const struct push_list
*old
= o
->push_list
;
1064 ALLOC_OBJ_GC (o
->push_list
, struct push_list
, &o
->gc
);
1065 strcpy (o
->push_list
->options
, old
->options
);
1071 rol_check_alloc (struct options
*options
)
1073 if (!options
->routes
)
1074 options
->routes
= new_route_option_list (&options
->gc
);
1079 show_connection_entry (const struct connection_entry
*o
)
1081 msg (D_SHOW_PARMS
, " proto = %s", proto2ascii (o
->proto
, false));
1083 SHOW_INT (local_port
);
1085 SHOW_INT (remote_port
);
1086 SHOW_BOOL (remote_float
);
1087 SHOW_BOOL (bind_defined
);
1088 SHOW_BOOL (bind_local
);
1089 SHOW_INT (connect_retry_seconds
);
1090 SHOW_INT (connect_timeout
);
1091 SHOW_INT (connect_retry_max
);
1093 #ifdef ENABLE_HTTP_PROXY
1094 if (o
->http_proxy_options
)
1095 show_http_proxy_options (o
->http_proxy_options
);
1098 SHOW_STR (socks_proxy_server
);
1099 SHOW_INT (socks_proxy_port
);
1100 SHOW_BOOL (socks_proxy_retry
);
1105 show_connection_entries (const struct options
*o
)
1107 msg (D_SHOW_PARMS
, "Connection profiles [default]:");
1108 show_connection_entry (&o
->ce
);
1109 #ifdef ENABLE_CONNECTION
1110 if (o
->connection_list
)
1112 const struct connection_list
*l
= o
->connection_list
;
1114 for (i
= 0; i
< l
->len
; ++i
)
1116 msg (D_SHOW_PARMS
, "Connection profiles [%d]:", i
);
1117 show_connection_entry (l
->array
[i
]);
1121 msg (D_SHOW_PARMS
, "Connection profiles END");
1127 show_settings (const struct options
*o
)
1130 msg (D_SHOW_PARMS
, "Current Parameter Settings:");
1136 #ifdef TUNSETPERSIST
1137 SHOW_BOOL (persist_config
);
1138 SHOW_INT (persist_mode
);
1142 SHOW_BOOL (show_ciphers
);
1143 SHOW_BOOL (show_digests
);
1144 SHOW_BOOL (show_engines
);
1147 SHOW_STR (key_pass_file
);
1148 SHOW_BOOL (show_tls_ciphers
);
1152 show_connection_entries (o
);
1154 SHOW_BOOL (remote_random
);
1156 SHOW_STR (ipchange
);
1158 SHOW_STR (dev_type
);
1159 SHOW_STR (dev_node
);
1161 SHOW_INT (topology
);
1162 SHOW_BOOL (tun_ipv6
);
1163 SHOW_STR (ifconfig_local
);
1164 SHOW_STR (ifconfig_remote_netmask
);
1165 SHOW_BOOL (ifconfig_noexec
);
1166 SHOW_BOOL (ifconfig_nowarn
);
1168 #ifdef HAVE_GETTIMEOFDAY
1172 SHOW_BOOL (tun_mtu_defined
);
1173 SHOW_INT (link_mtu
);
1174 SHOW_BOOL (link_mtu_defined
);
1175 SHOW_INT (tun_mtu_extra
);
1176 SHOW_BOOL (tun_mtu_extra_defined
);
1178 #ifdef ENABLE_FRAGMENT
1179 SHOW_INT (fragment
);
1182 SHOW_INT (mtu_discover_type
);
1185 SHOW_INT (mtu_test
);
1190 SHOW_INT (keepalive_ping
);
1191 SHOW_INT (keepalive_timeout
);
1192 SHOW_INT (inactivity_timeout
);
1193 SHOW_INT (ping_send_timeout
);
1194 SHOW_INT (ping_rec_timeout
);
1195 SHOW_INT (ping_rec_timeout_action
);
1196 SHOW_BOOL (ping_timer_remote
);
1197 SHOW_INT (remap_sigusr1
);
1199 SHOW_INT (explicit_exit_notification
);
1201 SHOW_BOOL (persist_tun
);
1202 SHOW_BOOL (persist_local_ip
);
1203 SHOW_BOOL (persist_remote_ip
);
1204 SHOW_BOOL (persist_key
);
1208 #if PASSTOS_CAPABILITY
1209 SHOW_BOOL (passtos
);
1212 SHOW_INT (resolve_retry_seconds
);
1214 SHOW_STR (username
);
1215 SHOW_STR (groupname
);
1216 SHOW_STR (chroot_dir
);
1218 SHOW_STR (writepid
);
1219 SHOW_STR (up_script
);
1220 SHOW_STR (down_script
);
1221 SHOW_BOOL (down_pre
);
1222 SHOW_BOOL (up_restart
);
1223 SHOW_BOOL (up_delay
);
1227 SHOW_BOOL (suppress_timestamps
);
1229 SHOW_INT (verbosity
);
1234 SHOW_STR (status_file
);
1235 SHOW_INT (status_file_version
);
1236 SHOW_INT (status_file_update_freq
);
1243 SHOW_INT (sockflags
);
1245 SHOW_BOOL (fast_io
);
1251 SHOW_STR (route_script
);
1252 SHOW_STR (route_default_gateway
);
1253 SHOW_INT (route_default_metric
);
1254 SHOW_BOOL (route_noexec
);
1255 SHOW_INT (route_delay
);
1256 SHOW_INT (route_delay_window
);
1257 SHOW_BOOL (route_delay_defined
);
1258 SHOW_BOOL (route_nopull
);
1259 SHOW_BOOL (route_gateway_via_dhcp
);
1260 SHOW_BOOL (allow_pull_fqdn
);
1262 print_route_options (o
->routes
, D_SHOW_PARMS
);
1264 #ifdef ENABLE_MANAGEMENT
1265 SHOW_STR (management_addr
);
1266 SHOW_INT (management_port
);
1267 SHOW_STR (management_user_pass
);
1268 SHOW_INT (management_log_history_cache
);
1269 SHOW_INT (management_echo_buffer_size
);
1270 SHOW_STR (management_write_peer_info_file
);
1271 SHOW_STR (management_client_user
);
1272 SHOW_STR (management_client_group
);
1273 SHOW_INT (management_flags
);
1275 #ifdef ENABLE_PLUGIN
1277 plugin_option_list_print (o
->plugin_list
, D_SHOW_PARMS
);
1281 SHOW_STR (shared_secret_file
);
1282 SHOW_INT (key_direction
);
1283 SHOW_BOOL (ciphername_defined
);
1284 SHOW_STR (ciphername
);
1285 SHOW_BOOL (authname_defined
);
1286 SHOW_STR (authname
);
1287 SHOW_STR (prng_hash
);
1288 SHOW_INT (prng_nonce_secret_len
);
1292 SHOW_BOOL (mute_replay_warnings
);
1293 SHOW_INT (replay_window
);
1294 SHOW_INT (replay_time
);
1295 SHOW_STR (packet_id_file
);
1297 SHOW_BOOL (test_crypto
);
1300 SHOW_BOOL (tls_server
);
1301 SHOW_BOOL (tls_client
);
1302 SHOW_INT (key_method
);
1306 SHOW_STR (cert_file
);
1307 SHOW_STR (priv_key_file
);
1308 SHOW_STR (pkcs12_file
);
1310 SHOW_STR (cryptoapi_cert
);
1312 SHOW_STR (cipher_list
);
1313 SHOW_STR (tls_verify
);
1314 SHOW_STR (tls_remote
);
1315 SHOW_STR (crl_file
);
1316 SHOW_INT (ns_cert_type
);
1319 for (i
=0;i
<MAX_PARMS
;i
++)
1320 SHOW_INT (remote_cert_ku
[i
]);
1322 SHOW_STR (remote_cert_eku
);
1324 SHOW_INT (tls_timeout
);
1326 SHOW_INT (renegotiate_bytes
);
1327 SHOW_INT (renegotiate_packets
);
1328 SHOW_INT (renegotiate_seconds
);
1330 SHOW_INT (handshake_window
);
1331 SHOW_INT (transition_window
);
1333 SHOW_BOOL (single_session
);
1334 SHOW_BOOL (tls_exit
);
1336 SHOW_STR (tls_auth_file
);
1340 #ifdef ENABLE_PKCS11
1343 for (i
=0;i
<MAX_PARMS
&& o
->pkcs11_providers
[i
] != NULL
;i
++)
1344 SHOW_PARM (pkcs11_providers
, o
->pkcs11_providers
[i
], "%s");
1348 for (i
=0;i
<MAX_PARMS
;i
++)
1349 SHOW_PARM (pkcs11_protected_authentication
, o
->pkcs11_protected_authentication
[i
] ? "ENABLED" : "DISABLED", "%s");
1353 for (i
=0;i
<MAX_PARMS
;i
++)
1354 SHOW_PARM (pkcs11_private_mode
, o
->pkcs11_private_mode
[i
], "%08x");
1358 for (i
=0;i
<MAX_PARMS
;i
++)
1359 SHOW_PARM (pkcs11_cert_private
, o
->pkcs11_cert_private
[i
] ? "ENABLED" : "DISABLED", "%s");
1361 SHOW_INT (pkcs11_pin_cache_period
);
1362 SHOW_STR (pkcs11_id
);
1363 SHOW_BOOL (pkcs11_id_management
);
1364 #endif /* ENABLE_PKCS11 */
1367 show_p2mp_parms (o
);
1371 SHOW_BOOL (show_net_up
);
1372 SHOW_INT (route_method
);
1373 show_tuntap_options (&o
->tuntap_options
);
1383 #ifdef ENABLE_HTTP_PROXY
1385 struct http_proxy_options
*
1386 init_http_options_if_undefined (struct options
*o
)
1388 if (!o
->ce
.http_proxy_options
)
1390 ALLOC_OBJ_CLEAR_GC (o
->ce
.http_proxy_options
, struct http_proxy_options
, &o
->gc
);
1391 /* http proxy defaults */
1392 o
->ce
.http_proxy_options
->timeout
= 5;
1393 o
->ce
.http_proxy_options
->http_version
= "1.0";
1395 return o
->ce
.http_proxy_options
;
1400 #if ENABLE_CONNECTION
1402 static struct connection_list
*
1403 alloc_connection_list_if_undef (struct options
*options
)
1405 if (!options
->connection_list
)
1406 ALLOC_OBJ_CLEAR_GC (options
->connection_list
, struct connection_list
, &options
->gc
);
1407 return options
->connection_list
;
1410 static struct connection_entry
*
1411 alloc_connection_entry (struct options
*options
, const int msglevel
)
1413 struct connection_list
*l
= alloc_connection_list_if_undef (options
);
1414 struct connection_entry
*e
;
1416 if (l
->len
>= CONNECTION_LIST_SIZE
)
1418 msg (msglevel
, "Maximum number of 'connection' options (%d) exceeded", CONNECTION_LIST_SIZE
);
1421 ALLOC_OBJ_GC (e
, struct connection_entry
, &options
->gc
);
1422 l
->array
[l
->len
++] = e
;
1426 static struct remote_list
*
1427 alloc_remote_list_if_undef (struct options
*options
)
1429 if (!options
->remote_list
)
1430 ALLOC_OBJ_CLEAR_GC (options
->remote_list
, struct remote_list
, &options
->gc
);
1431 return options
->remote_list
;
1434 static struct remote_entry
*
1435 alloc_remote_entry (struct options
*options
, const int msglevel
)
1437 struct remote_list
*l
= alloc_remote_list_if_undef (options
);
1438 struct remote_entry
*e
;
1440 if (l
->len
>= CONNECTION_LIST_SIZE
)
1442 msg (msglevel
, "Maximum number of 'remote' options (%d) exceeded", CONNECTION_LIST_SIZE
);
1445 ALLOC_OBJ_GC (e
, struct remote_entry
, &options
->gc
);
1446 l
->array
[l
->len
++] = e
;
1453 connection_entry_load_re (struct connection_entry
*ce
, const struct remote_entry
*re
)
1456 ce
->remote
= re
->remote
;
1457 if (re
->remote_port
>= 0)
1458 ce
->remote_port
= re
->remote_port
;
1460 ce
->proto
= re
->proto
;
1464 options_postprocess_verify_ce (const struct options
*options
, const struct connection_entry
*ce
)
1466 struct options defaults
;
1467 int dev
= DEV_TYPE_UNDEF
;
1470 init_options (&defaults
, true);
1473 if (options
->test_crypto
)
1475 notnull (options
->shared_secret_file
, "key file (--secret)");
1479 notnull (options
->dev
, "TUN/TAP device (--dev)");
1482 * Get tun/tap/null device type
1484 dev
= dev_type_enum (options
->dev
, options
->dev_type
);
1487 * If "proto tcp" is specified, make sure we know whether it is
1488 * tcp-client or tcp-server.
1490 if (ce
->proto
== PROTO_TCPv4
)
1491 msg (M_USAGE
, "--proto tcp is ambiguous in this context. Please specify --proto tcp-server or --proto tcp-client");
1494 * Sanity check on daemon/inetd modes
1497 if (options
->daemon
&& options
->inetd
)
1498 msg (M_USAGE
, "only one of --daemon or --inetd may be specified");
1500 if (options
->inetd
&& (ce
->local
|| ce
->remote
))
1501 msg (M_USAGE
, "--local or --remote cannot be used with --inetd");
1503 if (options
->inetd
&& ce
->proto
== PROTO_TCPv4_CLIENT
)
1504 msg (M_USAGE
, "--proto tcp-client cannot be used with --inetd");
1506 if (options
->inetd
== INETD_NOWAIT
&& ce
->proto
!= PROTO_TCPv4_SERVER
)
1507 msg (M_USAGE
, "--inetd nowait can only be used with --proto tcp-server");
1509 if (options
->inetd
== INETD_NOWAIT
1510 #if defined(USE_CRYPTO) && defined(USE_SSL)
1511 && !(options
->tls_server
|| options
->tls_client
)
1514 msg (M_USAGE
, "--inetd nowait can only be used in TLS mode");
1516 if (options
->inetd
== INETD_NOWAIT
&& dev
!= DEV_TYPE_TAP
)
1517 msg (M_USAGE
, "--inetd nowait only makes sense in --dev tap mode");
1520 if (options
->lladdr
&& dev
!= DEV_TYPE_TAP
)
1521 msg (M_USAGE
, "--lladdr can only be used in --dev tap mode");
1524 * Sanity check on TCP mode options
1527 if (ce
->connect_retry_defined
&& ce
->proto
!= PROTO_TCPv4_CLIENT
)
1528 msg (M_USAGE
, "--connect-retry doesn't make sense unless also used with --proto tcp-client");
1530 if (ce
->connect_timeout_defined
&& ce
->proto
!= PROTO_TCPv4_CLIENT
)
1531 msg (M_USAGE
, "--connect-timeout doesn't make sense unless also used with --proto tcp-client");
1534 * Sanity check on MTU parameters
1536 if (options
->tun_mtu_defined
&& options
->link_mtu_defined
)
1537 msg (M_USAGE
, "only one of --tun-mtu or --link-mtu may be defined (note that --ifconfig implies --link-mtu %d)", LINK_MTU_DEFAULT
);
1540 if (ce
->proto
!= PROTO_UDPv4
&& options
->mtu_test
)
1541 msg (M_USAGE
, "--mtu-test only makes sense with --proto udp");
1544 /* will we be pulling options from server? */
1546 pull
= options
->pull
;
1550 * Sanity check on --local, --remote, and --ifconfig
1553 if (string_defined_equal (ce
->local
, ce
->remote
)
1554 && ce
->local_port
== ce
->remote_port
)
1555 msg (M_USAGE
, "--remote and --local addresses are the same");
1557 if (string_defined_equal (ce
->remote
, options
->ifconfig_local
)
1558 || string_defined_equal (ce
->remote
, options
->ifconfig_remote_netmask
))
1559 msg (M_USAGE
, "--local and --remote addresses must be distinct from --ifconfig addresses");
1561 if (string_defined_equal (ce
->local
, options
->ifconfig_local
)
1562 || string_defined_equal (ce
->local
, options
->ifconfig_remote_netmask
))
1563 msg (M_USAGE
, "--local addresses must be distinct from --ifconfig addresses");
1565 if (string_defined_equal (options
->ifconfig_local
, options
->ifconfig_remote_netmask
))
1566 msg (M_USAGE
, "local and remote/netmask --ifconfig addresses must be different");
1568 if (ce
->bind_defined
&& !ce
->bind_local
)
1569 msg (M_USAGE
, "--bind and --nobind can't be used together");
1571 if (ce
->local
&& !ce
->bind_local
)
1572 msg (M_USAGE
, "--local and --nobind don't make sense when used together");
1574 if (ce
->local_port_defined
&& !ce
->bind_local
)
1575 msg (M_USAGE
, "--lport and --nobind don't make sense when used together");
1577 if (!ce
->remote
&& !ce
->bind_local
)
1578 msg (M_USAGE
, "--nobind doesn't make sense unless used with --remote");
1581 * Check for consistency of management options
1583 #ifdef ENABLE_MANAGEMENT
1584 if (!options
->management_addr
&&
1585 (options
->management_flags
1586 || options
->management_write_peer_info_file
1587 || options
->management_log_history_cache
!= defaults
.management_log_history_cache
))
1588 msg (M_USAGE
, "--management is not specified, however one or more options which modify the behavior of --management were specified");
1590 if ((options
->management_client_user
|| options
->management_client_group
)
1591 && !(options
->management_flags
& MF_UNIX_SOCK
))
1592 msg (M_USAGE
, "--management-client-(user|group) can only be used on unix domain sockets");
1596 * Windows-specific options.
1600 if (dev
== DEV_TYPE_TUN
&& !(pull
|| (options
->ifconfig_local
&& options
->ifconfig_remote_netmask
)))
1601 msg (M_USAGE
, "On Windows, --ifconfig is required when --dev tun is used");
1603 if ((options
->tuntap_options
.ip_win32_defined
)
1604 && !(pull
|| (options
->ifconfig_local
&& options
->ifconfig_remote_netmask
)))
1605 msg (M_USAGE
, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
1607 if (options
->tuntap_options
.dhcp_options
1608 && options
->tuntap_options
.ip_win32_type
!= IPW32_SET_DHCP_MASQ
1609 && options
->tuntap_options
.ip_win32_type
!= IPW32_SET_ADAPTIVE
)
1610 msg (M_USAGE
, "--dhcp-options requires --ip-win32 dynamic or adaptive");
1614 * Check that protocol options make sense.
1617 #ifdef ENABLE_FRAGMENT
1618 if (ce
->proto
!= PROTO_UDPv4
&& options
->fragment
)
1619 msg (M_USAGE
, "--fragment can only be used with --proto udp");
1623 if (ce
->proto
!= PROTO_UDPv4
&& options
->explicit_exit_notification
)
1624 msg (M_USAGE
, "--explicit-exit-notify can only be used with --proto udp");
1627 if (!ce
->remote
&& ce
->proto
== PROTO_TCPv4_CLIENT
)
1628 msg (M_USAGE
, "--remote MUST be used in TCP Client mode");
1630 #ifdef ENABLE_HTTP_PROXY
1631 if ((ce
->http_proxy_options
|| options
->auto_proxy_info
) && ce
->proto
!= PROTO_TCPv4_CLIENT
)
1632 msg (M_USAGE
, "--http-proxy or --auto-proxy MUST be used in TCP Client mode (i.e. --proto tcp-client)");
1635 #if defined(ENABLE_HTTP_PROXY) && defined(ENABLE_SOCKS)
1636 if (ce
->http_proxy_options
&& ce
->socks_proxy_server
)
1637 msg (M_USAGE
, "--http-proxy can not be used together with --socks-proxy");
1641 if (ce
->socks_proxy_server
&& ce
->proto
== PROTO_TCPv4_SERVER
)
1642 msg (M_USAGE
, "--socks-proxy can not be used in TCP Server mode");
1645 if (ce
->proto
== PROTO_TCPv4_SERVER
&& connection_list_defined (options
))
1646 msg (M_USAGE
, "TCP server mode allows at most one --remote address");
1651 * Check consistency of --mode server options.
1653 if (options
->mode
== MODE_SERVER
)
1655 if (!(dev
== DEV_TYPE_TUN
|| dev
== DEV_TYPE_TAP
))
1656 msg (M_USAGE
, "--mode server only works with --dev tun or --dev tap");
1658 msg (M_USAGE
, "--pull cannot be used with --mode server");
1659 if (!(ce
->proto
== PROTO_UDPv4
|| ce
->proto
== PROTO_TCPv4_SERVER
))
1660 msg (M_USAGE
, "--mode server currently only supports --proto udp or --proto tcp-server");
1662 if ((options
->port_share_host
|| options
->port_share_port
) && ce
->proto
!= PROTO_TCPv4_SERVER
)
1663 msg (M_USAGE
, "--port-share only works in TCP server mode (--proto tcp-server)");
1665 if (!options
->tls_server
)
1666 msg (M_USAGE
, "--mode server requires --tls-server");
1668 msg (M_USAGE
, "--remote cannot be used with --mode server");
1669 if (!ce
->bind_local
)
1670 msg (M_USAGE
, "--nobind cannot be used with --mode server");
1671 #ifdef ENABLE_HTTP_PROXY
1672 if (ce
->http_proxy_options
)
1673 msg (M_USAGE
, "--http-proxy cannot be used with --mode server");
1676 if (ce
->socks_proxy_server
)
1677 msg (M_USAGE
, "--socks-proxy cannot be used with --mode server");
1679 #ifdef ENABLE_CONNECTION
1680 if (options
->connection_list
)
1681 msg (M_USAGE
, "<connection> cannot be used with --mode server");
1683 if (options
->tun_ipv6
)
1684 msg (M_USAGE
, "--tun-ipv6 cannot be used with --mode server");
1685 if (options
->shaper
)
1686 msg (M_USAGE
, "--shaper cannot be used with --mode server");
1688 msg (M_USAGE
, "--inetd cannot be used with --mode server");
1689 if (options
->ipchange
)
1690 msg (M_USAGE
, "--ipchange cannot be used with --mode server (use --client-connect instead)");
1691 if (!(ce
->proto
== PROTO_UDPv4
|| ce
->proto
== PROTO_TCPv4_SERVER
))
1692 msg (M_USAGE
, "--mode server currently only supports --proto udp or --proto tcp-server");
1693 if (ce
->proto
!= PROTO_UDPv4
&& (options
->cf_max
|| options
->cf_per
))
1694 msg (M_USAGE
, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
1695 if (!(dev
== DEV_TYPE_TAP
|| (dev
== DEV_TYPE_TUN
&& options
->topology
== TOP_SUBNET
)) && options
->ifconfig_pool_netmask
)
1696 msg (M_USAGE
, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
1698 if (options
->explicit_exit_notification
)
1699 msg (M_USAGE
, "--explicit-exit-notify cannot be used with --mode server");
1701 if (options
->routes
&& (options
->routes
->flags
& RG_ENABLE
))
1702 msg (M_USAGE
, "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
1703 if (options
->route_delay_defined
)
1704 msg (M_USAGE
, "--route-delay cannot be used with --mode server");
1705 if (options
->up_delay
)
1706 msg (M_USAGE
, "--up-delay cannot be used with --mode server");
1707 if (!options
->ifconfig_pool_defined
&& options
->ifconfig_pool_persist_filename
)
1708 msg (M_USAGE
, "--ifconfig-pool-persist must be used with --ifconfig-pool");
1709 if (options
->auth_user_pass_file
)
1710 msg (M_USAGE
, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
1711 if (options
->ccd_exclusive
&& !options
->client_config_dir
)
1712 msg (M_USAGE
, "--ccd-exclusive must be used with --client-config-dir");
1713 if (options
->key_method
!= 2)
1714 msg (M_USAGE
, "--mode server requires --key-method 2");
1717 const bool ccnr
= (options
->auth_user_pass_verify_script
1718 || PLUGIN_OPTION_LIST (options
)
1719 || MAN_CLIENT_AUTH_ENABLED (options
));
1720 const char *postfix
= "must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
1721 if ((options
->ssl_flags
& SSLF_CLIENT_CERT_NOT_REQUIRED
) && !ccnr
)
1722 msg (M_USAGE
, "--client-cert-not-required %s", postfix
);
1723 if ((options
->ssl_flags
& SSLF_USERNAME_AS_COMMON_NAME
) && !ccnr
)
1724 msg (M_USAGE
, "--username-as-common-name %s", postfix
);
1725 if ((options
->ssl_flags
& SSLF_AUTH_USER_PASS_OPTIONAL
) && !ccnr
)
1726 msg (M_USAGE
, "--auth-user-pass-optional %s", postfix
);
1729 if ((options
->ssl_flags
& SSLF_NO_NAME_REMAPPING
) && script_method
== SM_SYSTEM
)
1730 msg (M_USAGE
, "--script-security method='system' cannot be combined with --no-name-remapping");
1735 * When not in server mode, err if parameters are
1736 * specified which require --mode server.
1738 if (options
->ifconfig_pool_defined
|| options
->ifconfig_pool_persist_filename
)
1739 msg (M_USAGE
, "--ifconfig-pool/--ifconfig-pool-persist requires --mode server");
1740 if (options
->real_hash_size
!= defaults
.real_hash_size
1741 || options
->virtual_hash_size
!= defaults
.virtual_hash_size
)
1742 msg (M_USAGE
, "--hash-size requires --mode server");
1743 if (options
->learn_address_script
)
1744 msg (M_USAGE
, "--learn-address requires --mode server");
1745 if (options
->client_connect_script
)
1746 msg (M_USAGE
, "--client-connect requires --mode server");
1747 if (options
->client_disconnect_script
)
1748 msg (M_USAGE
, "--client-disconnect requires --mode server");
1749 if (options
->tmp_dir
)
1750 msg (M_USAGE
, "--tmp-dir requires --mode server");
1751 if (options
->client_config_dir
|| options
->ccd_exclusive
)
1752 msg (M_USAGE
, "--client-config-dir/--ccd-exclusive requires --mode server");
1753 if (options
->enable_c2c
)
1754 msg (M_USAGE
, "--client-to-client requires --mode server");
1755 if (options
->duplicate_cn
)
1756 msg (M_USAGE
, "--duplicate-cn requires --mode server");
1757 if (options
->cf_max
|| options
->cf_per
)
1758 msg (M_USAGE
, "--connect-freq requires --mode server");
1759 if (options
->ssl_flags
& SSLF_CLIENT_CERT_NOT_REQUIRED
)
1760 msg (M_USAGE
, "--client-cert-not-required requires --mode server");
1761 if (options
->ssl_flags
& SSLF_USERNAME_AS_COMMON_NAME
)
1762 msg (M_USAGE
, "--username-as-common-name requires --mode server");
1763 if (options
->ssl_flags
& SSLF_AUTH_USER_PASS_OPTIONAL
)
1764 msg (M_USAGE
, "--auth-user-pass-optional requires --mode server");
1765 if (options
->ssl_flags
& SSLF_NO_NAME_REMAPPING
)
1766 msg (M_USAGE
, "--no-name-remapping requires --mode server");
1767 if (options
->ssl_flags
& SSLF_OPT_VERIFY
)
1768 msg (M_USAGE
, "--opt-verify requires --mode server");
1769 if (options
->server_flags
& SF_TCP_NODELAY_HELPER
)
1770 msg (M_USAGE
, "--tcp-nodelay requires --mode server");
1771 if (options
->auth_user_pass_verify_script
)
1772 msg (M_USAGE
, "--auth-user-pass-verify requires --mode server");
1774 if (options
->port_share_host
|| options
->port_share_port
)
1775 msg (M_USAGE
, "--port-share requires TCP server mode (--mode server --proto tcp-server)");
1779 #endif /* P2MP_SERVER */
1784 * Check consistency of replay options
1786 if ((ce
->proto
!= PROTO_UDPv4
)
1787 && (options
->replay_window
!= defaults
.replay_window
1788 || options
->replay_time
!= defaults
.replay_time
))
1789 msg (M_USAGE
, "--replay-window only makes sense with --proto udp");
1791 if (!options
->replay
1792 && (options
->replay_window
!= defaults
.replay_window
1793 || options
->replay_time
!= defaults
.replay_time
))
1794 msg (M_USAGE
, "--replay-window doesn't make sense when replay protection is disabled with --no-replay");
1797 * SSL/TLS mode sanity checks.
1801 if (options
->tls_server
+ options
->tls_client
+
1802 (options
->shared_secret_file
!= NULL
) > 1)
1803 msg (M_USAGE
, "specify only one of --tls-server, --tls-client, or --secret");
1805 if (options
->tls_server
)
1807 notnull (options
->dh_file
, "DH file (--dh)");
1809 if (options
->tls_server
|| options
->tls_client
)
1811 #ifdef ENABLE_PKCS11
1812 if (options
->pkcs11_providers
[0])
1814 notnull (options
->ca_file
, "CA file (--ca)");
1816 if (options
->pkcs11_id_management
&& options
->pkcs11_id
!= NULL
)
1817 msg(M_USAGE
, "Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
1818 if (!options
->pkcs11_id_management
&& options
->pkcs11_id
== NULL
)
1819 msg(M_USAGE
, "Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
1820 if (options
->cert_file
)
1821 msg(M_USAGE
, "Parameter --cert cannot be used when --pkcs11-provider is also specified.");
1822 if (options
->priv_key_file
)
1823 msg(M_USAGE
, "Parameter --key cannot be used when --pkcs11-provider is also specified.");
1824 if (options
->pkcs12_file
)
1825 msg(M_USAGE
, "Parameter --pkcs12 cannot be used when --pkcs11-provider is also specified.");
1827 if (options
->cryptoapi_cert
)
1828 msg(M_USAGE
, "Parameter --cryptoapicert cannot be used when --pkcs11-provider is also specified.");
1834 if (options
->cryptoapi_cert
)
1836 if ((!(options
->ca_file
)) && (!(options
->ca_path
)))
1837 msg(M_USAGE
, "You must define CA file (--ca) or CA path (--capath)");
1838 if (options
->cert_file
)
1839 msg(M_USAGE
, "Parameter --cert cannot be used when --cryptoapicert is also specified.");
1840 if (options
->priv_key_file
)
1841 msg(M_USAGE
, "Parameter --key cannot be used when --cryptoapicert is also specified.");
1842 if (options
->pkcs12_file
)
1843 msg(M_USAGE
, "Parameter --pkcs12 cannot be used when --cryptoapicert is also specified.");
1847 if (options
->pkcs12_file
)
1849 if (options
->ca_path
)
1850 msg(M_USAGE
, "Parameter --capath cannot be used when --pkcs12 is also specified.");
1851 if (options
->cert_file
)
1852 msg(M_USAGE
, "Parameter --cert cannot be used when --pkcs12 is also specified.");
1853 if (options
->priv_key_file
)
1854 msg(M_USAGE
, "Parameter --key cannot be used when --pkcs12 is also specified.");
1858 if ((!(options
->ca_file
)) && (!(options
->ca_path
)))
1859 msg(M_USAGE
, "You must define CA file (--ca) or CA path (--capath)");
1862 const int sum
= (options
->cert_file
!= NULL
) + (options
->priv_key_file
!= NULL
);
1866 if (!options
->auth_user_pass_file
)
1868 msg (M_USAGE
, "No client-side authentication method is specified. You must use either --cert/--key, --pkcs12, or --auth-user-pass");
1874 msg (M_USAGE
, "If you use one of --cert or --key, you must use them both");
1879 notnull (options
->cert_file
, "certificate file (--cert) or PKCS#12 file (--pkcs12)");
1880 notnull (options
->priv_key_file
, "private key file (--key) or PKCS#12 file (--pkcs12)");
1887 * Make sure user doesn't specify any TLS options
1888 * when in non-TLS mode.
1891 #define MUST_BE_UNDEF(parm) if (options->parm != defaults.parm) msg (M_USAGE, err, #parm);
1893 const char err
[] = "Parameter %s can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.";
1895 MUST_BE_UNDEF (ca_file
);
1896 MUST_BE_UNDEF (ca_path
);
1897 MUST_BE_UNDEF (dh_file
);
1898 MUST_BE_UNDEF (cert_file
);
1899 MUST_BE_UNDEF (priv_key_file
);
1900 MUST_BE_UNDEF (pkcs12_file
);
1901 MUST_BE_UNDEF (cipher_list
);
1902 MUST_BE_UNDEF (tls_verify
);
1903 MUST_BE_UNDEF (tls_remote
);
1904 MUST_BE_UNDEF (tls_timeout
);
1905 MUST_BE_UNDEF (renegotiate_bytes
);
1906 MUST_BE_UNDEF (renegotiate_packets
);
1907 MUST_BE_UNDEF (renegotiate_seconds
);
1908 MUST_BE_UNDEF (handshake_window
);
1909 MUST_BE_UNDEF (transition_window
);
1910 MUST_BE_UNDEF (tls_auth_file
);
1911 MUST_BE_UNDEF (single_session
);
1912 MUST_BE_UNDEF (tls_exit
);
1913 MUST_BE_UNDEF (crl_file
);
1914 MUST_BE_UNDEF (key_method
);
1915 MUST_BE_UNDEF (ns_cert_type
);
1916 MUST_BE_UNDEF (remote_cert_ku
[0]);
1917 MUST_BE_UNDEF (remote_cert_eku
);
1918 #ifdef ENABLE_PKCS11
1919 MUST_BE_UNDEF (pkcs11_providers
[0]);
1920 MUST_BE_UNDEF (pkcs11_private_mode
[0]);
1921 MUST_BE_UNDEF (pkcs11_id
);
1922 MUST_BE_UNDEF (pkcs11_id_management
);
1926 msg (M_USAGE
, err
, "--pull");
1928 #undef MUST_BE_UNDEF
1929 #endif /* USE_CRYPTO */
1930 #endif /* USE_SSL */
1933 if (options
->auth_user_pass_file
&& !options
->pull
)
1934 msg (M_USAGE
, "--auth-user-pass requires --pull");
1937 uninit_options (&defaults
);
1941 options_postprocess_mutate_ce (struct options
*o
, struct connection_entry
*ce
)
1944 if (o
->server_defined
|| o
->server_bridge_defined
|| o
->server_bridge_proxy_dhcp
)
1946 if (ce
->proto
== PROTO_TCPv4
)
1947 ce
->proto
= PROTO_TCPv4_SERVER
;
1953 if (ce
->proto
== PROTO_TCPv4
)
1954 ce
->proto
= PROTO_TCPv4_CLIENT
;
1958 if (ce
->proto
== PROTO_TCPv4_CLIENT
&& !ce
->local
&& !ce
->local_port_defined
&& !ce
->bind_defined
)
1959 ce
->bind_local
= false;
1962 if (ce
->proto
== PROTO_UDPv4
&& ce
->socks_proxy_server
&& !ce
->local
&& !ce
->local_port_defined
&& !ce
->bind_defined
)
1963 ce
->bind_local
= false;
1966 if (!ce
->bind_local
)
1971 options_postprocess_mutate_invariant (struct options
*options
)
1973 const int dev
= dev_type_enum (options
->dev
, options
->dev_type
);
1976 * If --mssfix is supplied without a parameter, default
1977 * it to --fragment value, if --fragment is specified.
1979 if (options
->mssfix_default
)
1981 #ifdef ENABLE_FRAGMENT
1982 if (options
->fragment
)
1983 options
->mssfix
= options
->fragment
;
1985 msg (M_USAGE
, "--mssfix must specify a parameter");
1990 * In forking TCP server mode, you don't need to ifconfig
1991 * the tap device (the assumption is that it will be bridged).
1993 if (options
->inetd
== INETD_NOWAIT
)
1994 options
->ifconfig_noexec
= true;
2000 if (!options
->tun_mtu_defined
&& !options
->link_mtu_defined
)
2002 options
->tun_mtu_defined
= true;
2004 if ((dev
== DEV_TYPE_TAP
) && !options
->tun_mtu_extra_defined
)
2006 options
->tun_mtu_extra_defined
= true;
2007 options
->tun_mtu_extra
= TAP_MTU_EXTRA_DEFAULT
;
2012 if ((dev
== DEV_TYPE_TUN
|| dev
== DEV_TYPE_TAP
) && !options
->route_delay_defined
)
2014 if (options
->mode
== MODE_POINT_TO_POINT
)
2016 options
->route_delay_defined
= true;
2017 options
->route_delay
= 5; /* Vista sometimes has a race without this */
2021 if (options
->ifconfig_noexec
)
2023 options
->tuntap_options
.ip_win32_type
= IPW32_SET_MANUAL
;
2024 options
->ifconfig_noexec
= false;
2030 * Check consistency of --mode server options.
2032 if (options
->mode
== MODE_SERVER
)
2036 * We need to explicitly set --tap-sleep because
2037 * we do not schedule event timers in the top-level context.
2039 options
->tuntap_options
.tap_sleep
= 10;
2040 if (options
->route_delay_defined
&& options
->route_delay
)
2041 options
->tuntap_options
.tap_sleep
= options
->route_delay
;
2042 options
->route_delay_defined
= false;
2049 options_postprocess_verify (const struct options
*o
)
2051 #ifdef ENABLE_CONNECTION
2052 if (o
->connection_list
)
2055 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
2056 options_postprocess_verify_ce (o
, o
->connection_list
->array
[i
]);
2060 options_postprocess_verify_ce (o
, &o
->ce
);
2064 options_postprocess_mutate (struct options
*o
)
2067 * Process helper-type options which map to other, more complex
2068 * sequences of options.
2070 helper_client_server (o
);
2071 helper_keepalive (o
);
2072 helper_tcp_nodelay (o
);
2074 options_postprocess_mutate_invariant (o
);
2076 #ifdef ENABLE_CONNECTION
2077 if (o
->remote_list
&& !o
->connection_list
)
2080 * For compatibility with 2.0.x, map multiple --remote options
2081 * into connection list (connection lists added in 2.1).
2083 if (o
->remote_list
->len
> 1)
2085 const struct remote_list
*rl
= o
->remote_list
;
2087 for (i
= 0; i
< rl
->len
; ++i
)
2089 const struct remote_entry
*re
= rl
->array
[i
];
2090 struct connection_entry ce
= o
->ce
;
2091 struct connection_entry
*ace
;
2093 ASSERT (re
->remote
);
2094 connection_entry_load_re (&ce
, re
);
2095 ace
= alloc_connection_entry (o
, M_USAGE
);
2100 else if (o
->remote_list
->len
== 1) /* one --remote option specfied */
2102 connection_entry_load_re (&o
->ce
, o
->remote_list
->array
[0]);
2109 if (o
->connection_list
)
2112 for (i
= 0; i
< o
->connection_list
->len
; ++i
)
2113 options_postprocess_mutate_ce (o
, o
->connection_list
->array
[i
]);
2117 options_postprocess_mutate_ce (o
, &o
->ce
);
2121 * Save certain parms before modifying options via --pull
2128 * Sanity check on options.
2129 * Also set some options based on other
2133 options_postprocess (struct options
*options
)
2135 options_postprocess_mutate (options
);
2136 options_postprocess_verify (options
);
2142 * Save/Restore certain option defaults before --pull is applied.
2146 pre_pull_save (struct options
*o
)
2150 ALLOC_OBJ_CLEAR_GC (o
->pre_pull
, struct options_pre_pull
, &o
->gc
);
2151 o
->pre_pull
->tuntap_options
= o
->tuntap_options
;
2152 o
->pre_pull
->tuntap_options_defined
= true;
2153 o
->pre_pull
->foreign_option_index
= o
->foreign_option_index
;
2156 o
->pre_pull
->routes
= *o
->routes
;
2157 o
->pre_pull
->routes_defined
= true;
2163 pre_pull_restore (struct options
*o
)
2165 const struct options_pre_pull
*pp
= o
->pre_pull
;
2168 CLEAR (o
->tuntap_options
);
2169 if (pp
->tuntap_options_defined
)
2170 o
->tuntap_options
= pp
->tuntap_options
;
2172 if (pp
->routes_defined
)
2174 rol_check_alloc (o
);
2175 *o
->routes
= pp
->routes
;
2180 o
->foreign_option_index
= pp
->foreign_option_index
;
2189 * Build an options string to represent data channel encryption options.
2190 * This string must match exactly between peers. The keysize is checked
2191 * separately by read_key().
2193 * The following options must match on both peers:
2197 * --dev tun|tap [unit number need not match]
2198 * --dev-type tun|tap
2203 * --proto tcp-client [matched with --proto tcp-server
2204 * on the other end of the connection]
2205 * --proto tcp-server [matched with --proto tcp-client on
2206 * the other end of the connection]
2208 * --ifconfig x y [matched with --ifconfig y x on
2209 * the other end of the connection]
2226 * --tls-client [matched with --tls-server on
2227 * the other end of the connection]
2228 * --tls-server [matched with --tls-client on
2229 * the other end of the connection]
2233 options_string (const struct options
*o
,
2234 const struct frame
*frame
,
2237 struct gc_arena
*gc
)
2239 struct buffer out
= alloc_buf (OPTION_LINE_SIZE
);
2240 bool tt_local
= false;
2242 buf_printf (&out
, "V4");
2248 buf_printf (&out
, ",dev-type %s", dev_type_string (o
->dev
, o
->dev_type
));
2249 buf_printf (&out
, ",link-mtu %d", EXPANDED_SIZE (frame
));
2250 buf_printf (&out
, ",tun-mtu %d", PAYLOAD_SIZE (frame
));
2251 buf_printf (&out
, ",proto %s", proto2ascii (proto_remote (o
->ce
.proto
, remote
), true));
2253 buf_printf (&out
, ",tun-ipv6");
2256 * Try to get ifconfig parameters into the options string.
2257 * If tt is undefined, make a temporary instantiation.
2261 tt
= init_tun (o
->dev
,
2265 o
->ifconfig_remote_netmask
,
2274 if (tt
&& o
->mode
== MODE_POINT_TO_POINT
&& !PULL_DEFINED(o
))
2276 const char *ios
= ifconfig_options_string (tt
, remote
, o
->ifconfig_nowarn
, gc
);
2277 if (ios
&& strlen (ios
))
2278 buf_printf (&out
, ",ifconfig %s", ios
);
2287 if (o
->lzo
& LZO_SELECTED
)
2288 buf_printf (&out
, ",comp-lzo");
2291 #ifdef ENABLE_FRAGMENT
2293 buf_printf (&out
, ",mtu-dynamic");
2299 #define TLS_CLIENT (o->tls_client)
2300 #define TLS_SERVER (o->tls_server)
2302 #define TLS_CLIENT (false)
2303 #define TLS_SERVER (false)
2310 const char *kd
= keydirection2ascii (o
->key_direction
, remote
);
2312 buf_printf (&out
, ",keydir %s", kd
);
2318 if (o
->shared_secret_file
|| TLS_CLIENT
|| TLS_SERVER
)
2322 ASSERT ((o
->shared_secret_file
!= NULL
)
2323 + (TLS_CLIENT
== true)
2324 + (TLS_SERVER
== true)
2327 init_key_type (&kt
, o
->ciphername
, o
->ciphername_defined
,
2328 o
->authname
, o
->authname_defined
,
2329 o
->keysize
, true, false);
2331 buf_printf (&out
, ",cipher %s", kt_cipher_name (&kt
));
2332 buf_printf (&out
, ",auth %s", kt_digest_name (&kt
));
2333 buf_printf (&out
, ",keysize %d", kt_key_size (&kt
));
2334 if (o
->shared_secret_file
)
2335 buf_printf (&out
, ",secret");
2337 buf_printf (&out
, ",no-replay");
2339 buf_printf (&out
, ",no-iv");
2347 if (TLS_CLIENT
|| TLS_SERVER
)
2349 if (o
->tls_auth_file
)
2350 buf_printf (&out
, ",tls-auth");
2352 if (o
->key_method
> 1)
2353 buf_printf (&out
, ",key-method %d", o
->key_method
);
2359 buf_printf (&out
, ",tls-server");
2360 else if (TLS_SERVER
)
2361 buf_printf (&out
, ",tls-client");
2366 buf_printf (&out
, ",tls-client");
2367 else if (TLS_SERVER
)
2368 buf_printf (&out
, ",tls-server");
2371 #endif /* USE_SSL */
2376 #endif /* USE_CRYPTO */
2382 * Compare option strings for equality.
2383 * If the first two chars of the strings differ, it means that
2384 * we are looking at different versions of the options string,
2385 * therefore don't compare them and return true.
2389 options_cmp_equal (char *actual
, const char *expected
)
2391 return options_cmp_equal_safe (actual
, expected
, strlen (actual
) + 1);
2395 options_warning (char *actual
, const char *expected
)
2397 options_warning_safe (actual
, expected
, strlen (actual
) + 1);
2401 options_warning_extract_parm1 (const char *option_string
,
2402 struct gc_arena
*gc_ret
)
2404 struct gc_arena gc
= gc_new ();
2405 struct buffer b
= string_alloc_buf (option_string
, &gc
);
2406 char *p
= gc_malloc (OPTION_PARM_SIZE
, false, &gc
);
2409 buf_parse (&b
, ' ', p
, OPTION_PARM_SIZE
);
2410 ret
= string_alloc (p
, gc_ret
);
2416 options_warning_safe_scan2 (const int msglevel
,
2418 const bool report_inconsistent
,
2420 const struct buffer
*b2_src
,
2421 const char *b1_name
,
2422 const char *b2_name
)
2424 if (strlen (p1
) > 0)
2426 struct gc_arena gc
= gc_new ();
2427 struct buffer b2
= *b2_src
;
2428 const char *p1_prefix
= options_warning_extract_parm1 (p1
, &gc
);
2429 char *p2
= gc_malloc (OPTION_PARM_SIZE
, false, &gc
);
2431 while (buf_parse (&b2
, delim
, p2
, OPTION_PARM_SIZE
))
2435 const char *p2_prefix
= options_warning_extract_parm1 (p2
, &gc
);
2437 if (!strcmp (p1
, p2
))
2439 if (!strcmp (p1_prefix
, p2_prefix
))
2441 if (report_inconsistent
)
2442 msg (msglevel
, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
2443 safe_print (p1_prefix
, &gc
),
2445 safe_print (p1
, &gc
),
2447 safe_print (p2
, &gc
));
2453 msg (msglevel
, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
2454 safe_print (p1_prefix
, &gc
),
2458 safe_print (p1
, &gc
));
2466 options_warning_safe_scan1 (const int msglevel
,
2468 const bool report_inconsistent
,
2469 const struct buffer
*b1_src
,
2470 const struct buffer
*b2_src
,
2471 const char *b1_name
,
2472 const char *b2_name
)
2474 struct gc_arena gc
= gc_new ();
2475 struct buffer b
= *b1_src
;
2476 char *p
= gc_malloc (OPTION_PARM_SIZE
, true, &gc
);
2478 while (buf_parse (&b
, delim
, p
, OPTION_PARM_SIZE
))
2479 options_warning_safe_scan2 (msglevel
, delim
, report_inconsistent
, p
, b2_src
, b1_name
, b2_name
);
2485 options_warning_safe_ml (const int msglevel
, char *actual
, const char *expected
, size_t actual_n
)
2487 struct gc_arena gc
= gc_new ();
2491 struct buffer local
= alloc_buf_gc (OPTION_PARM_SIZE
+ 16, &gc
);
2492 struct buffer remote
= alloc_buf_gc (OPTION_PARM_SIZE
+ 16, &gc
);
2493 actual
[actual_n
- 1] = 0;
2495 buf_printf (&local
, "version %s", expected
);
2496 buf_printf (&remote
, "version %s", actual
);
2498 options_warning_safe_scan1 (msglevel
, ',', true,
2502 options_warning_safe_scan1 (msglevel
, ',', false,
2511 options_cmp_equal_safe (char *actual
, const char *expected
, size_t actual_n
)
2513 struct gc_arena gc
= gc_new ();
2518 actual
[actual_n
- 1] = 0;
2519 #ifndef STRICT_OPTIONS_CHECK
2520 if (strncmp (actual
, expected
, 2))
2522 msg (D_SHOW_OCC
, "NOTE: Options consistency check may be skewed by version differences");
2523 options_warning_safe_ml (D_SHOW_OCC
, actual
, expected
, actual_n
);
2527 ret
= !strcmp (actual
, expected
);
2534 options_warning_safe (char *actual
, const char *expected
, size_t actual_n
)
2536 options_warning_safe_ml (M_WARN
, actual
, expected
, actual_n
);
2540 options_string_version (const char* s
, struct gc_arena
*gc
)
2542 struct buffer out
= alloc_buf_gc (4, gc
);
2543 strncpynt ((char *) BPTR (&out
), s
, 3);
2547 #endif /* ENABLE_OCC */
2550 foreign_option (struct options
*o
, char *argv
[], int len
, struct env_set
*es
)
2554 struct gc_arena gc
= gc_new();
2555 struct buffer name
= alloc_buf_gc (OPTION_PARM_SIZE
, &gc
);
2556 struct buffer value
= alloc_buf_gc (OPTION_PARM_SIZE
, &gc
);
2561 good
&= buf_printf (&name
, "foreign_option_%d", o
->foreign_option_index
+ 1);
2562 ++o
->foreign_option_index
;
2563 for (i
= 0; i
< len
; ++i
)
2568 good
&= buf_printf (&value
, " ");
2569 good
&= buf_printf (&value
, "%s", argv
[i
]);
2574 setenv_str (es
, BSTR(&name
), BSTR(&value
));
2576 msg (M_WARN
, "foreign_option: name/value overflow");
2582 * parse/print topology coding
2586 parse_topology (const char *str
, const int msglevel
)
2588 if (streq (str
, "net30"))
2590 else if (streq (str
, "p2p"))
2592 else if (streq (str
, "subnet"))
2596 msg (msglevel
, "--topology must be net30, p2p, or subnet");
2602 print_topology (const int topology
)
2622 * Manage auth-retry variable
2625 static int global_auth_retry
; /* GLOBAL */
2628 auth_retry_get (void)
2630 return global_auth_retry
;
2634 auth_retry_set (const int msglevel
, const char *option
)
2636 if (streq (option
, "interact"))
2637 global_auth_retry
= AR_INTERACT
;
2638 else if (streq (option
, "nointeract"))
2639 global_auth_retry
= AR_NOINTERACT
;
2640 else if (streq (option
, "none"))
2641 global_auth_retry
= AR_NONE
;
2644 msg (msglevel
, "--auth-retry method must be 'interact', 'nointeract', or 'none'");
2651 auth_retry_print (void)
2653 switch (global_auth_retry
)
2658 return "nointeract";
2669 * Print the help message.
2674 FILE *fp
= msg_fp(0);
2678 fprintf (fp
, "Usage message not available\n");
2683 init_options (&o
, true);
2685 #if defined(USE_CRYPTO) && defined(USE_SSL)
2686 fprintf (fp
, usage_message
,
2688 o
.ce
.connect_retry_seconds
,
2689 o
.ce
.local_port
, o
.ce
.remote_port
,
2690 TUN_MTU_DEFAULT
, TAP_MTU_EXTRA_DEFAULT
,
2692 o
.authname
, o
.ciphername
,
2693 o
.replay_window
, o
.replay_time
,
2694 o
.tls_timeout
, o
.renegotiate_seconds
,
2695 o
.handshake_window
, o
.transition_window
);
2696 #elif defined(USE_CRYPTO)
2697 fprintf (fp
, usage_message
,
2699 o
.ce
.connect_retry_seconds
,
2700 o
.ce
.local_port
, o
.ce
.remote_port
,
2701 TUN_MTU_DEFAULT
, TAP_MTU_EXTRA_DEFAULT
,
2703 o
.authname
, o
.ciphername
,
2704 o
.replay_window
, o
.replay_time
);
2706 fprintf (fp
, usage_message
,
2708 o
.ce
.connect_retry_seconds
,
2709 o
.ce
.local_port
, o
.ce
.remote_port
,
2710 TUN_MTU_DEFAULT
, TAP_MTU_EXTRA_DEFAULT
,
2715 #endif /* ENABLE_SMALL */
2717 openvpn_exit (OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
2723 msg (M_WARN
|M_NOPREFIX
, "Use --help for more information.");
2724 openvpn_exit (OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
2728 usage_version (void)
2730 msg (M_INFO
|M_NOPREFIX
, "%s", title_string
);
2731 msg (M_INFO
|M_NOPREFIX
, "Developed by James Yonan");
2732 msg (M_INFO
|M_NOPREFIX
, "Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <sales@openvpn.net>");
2733 openvpn_exit (OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
2737 notnull (const char *arg
, const char *description
)
2740 msg (M_USAGE
, "You must define %s", description
);
2744 string_defined_equal (const char *s1
, const char *s2
)
2747 return !strcmp (s1
, s2
);
2754 ping_rec_err (int msglevel
)
2756 msg (msglevel
, "only one of --ping-exit or --ping-restart options may be specified");
2761 positive_atoi (const char *str
)
2763 const int i
= atoi (str
);
2764 return i
< 0 ? 0 : i
;
2768 space (unsigned char c
)
2770 return c
== '\0' || isspace (c
);
2774 parse_line (const char *line
,
2780 struct gc_arena
*gc
)
2782 const int STATE_INITIAL
= 0;
2783 const int STATE_READING_QUOTED_PARM
= 1;
2784 const int STATE_READING_UNQUOTED_PARM
= 2;
2785 const int STATE_DONE
= 3;
2786 const int STATE_READING_SQUOTED_PARM
= 4;
2788 const char *error_prefix
= "";
2791 const char *c
= line
;
2792 int state
= STATE_INITIAL
;
2793 bool backslash
= false;
2796 char parm
[OPTION_PARM_SIZE
];
2797 unsigned int parm_len
= 0;
2799 msglevel
&= ~M_OPTERR
;
2801 if (msglevel
& M_MSG_VIRT_OUT
)
2802 error_prefix
= "ERROR: ";
2809 if (!backslash
&& in
== '\\' && state
!= STATE_READING_SQUOTED_PARM
)
2815 if (state
== STATE_INITIAL
)
2819 if (in
== ';' || in
== '#') /* comment */
2821 if (!backslash
&& in
== '\"')
2822 state
= STATE_READING_QUOTED_PARM
;
2823 else if (!backslash
&& in
== '\'')
2824 state
= STATE_READING_SQUOTED_PARM
;
2828 state
= STATE_READING_UNQUOTED_PARM
;
2832 else if (state
== STATE_READING_UNQUOTED_PARM
)
2834 if (!backslash
&& space (in
))
2839 else if (state
== STATE_READING_QUOTED_PARM
)
2841 if (!backslash
&& in
== '\"')
2846 else if (state
== STATE_READING_SQUOTED_PARM
)
2853 if (state
== STATE_DONE
)
2855 /* ASSERT (parm_len > 0); */
2856 p
[ret
] = gc_malloc (parm_len
+ 1, true, gc
);
2857 memcpy (p
[ret
], parm
, parm_len
);
2858 p
[ret
][parm_len
] = '\0';
2859 state
= STATE_INITIAL
;
2864 if (backslash
&& out
)
2866 if (!(out
== '\\' || out
== '\"' || space (out
)))
2869 msg (msglevel
, "%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix
, file
, line_num
);
2871 msg (msglevel
, "%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE
"\\\\static.key\"", error_prefix
, file
, line_num
);
2879 /* store parameter character */
2882 if (parm_len
>= SIZE (parm
))
2884 parm
[SIZE (parm
) - 1] = 0;
2885 msg (msglevel
, "%sOptions error: Parameter at %s:%d is too long (%d chars max): %s",
2886 error_prefix
, file
, line_num
, (int) SIZE (parm
), parm
);
2889 parm
[parm_len
++] = out
;
2892 /* avoid overflow if too many parms in one config file line */
2896 } while (*c
++ != '\0');
2898 if (state
== STATE_READING_QUOTED_PARM
)
2900 msg (msglevel
, "%sOptions error: No closing quotation (\") in %s:%d", error_prefix
, file
, line_num
);
2903 if (state
== STATE_READING_SQUOTED_PARM
)
2905 msg (msglevel
, "%sOptions error: No closing single quotation (\') in %s:%d", error_prefix
, file
, line_num
);
2908 if (state
!= STATE_INITIAL
)
2910 msg (msglevel
, "%sOptions error: Residual parse state (%d) in %s:%d", error_prefix
, state
, file
, line_num
);
2916 for (i
= 0; i
< ret
; ++i
)
2918 msg (M_INFO
|M_NOPREFIX
, "%s:%d ARG[%d] '%s'", file
, line_num
, i
, p
[i
]);
2926 bypass_doubledash (char **p
)
2928 if (strlen (*p
) >= 3 && !strncmp (*p
, "--", 2))
2932 #if ENABLE_INLINE_FILES
2935 # define IS_TYPE_FP 1
2936 # define IS_TYPE_BUF 2
2940 struct buffer
*multiline
;
2945 in_src_get (const struct in_src
*is
, char *line
, const int size
)
2947 if (is
->type
== IS_TYPE_FP
)
2949 return BOOL_CAST (fgets (line
, size
, is
->u
.fp
));
2951 else if (is
->type
== IS_TYPE_BUF
)
2953 bool status
= buf_parse (is
->u
.multiline
, '\n', line
, size
);
2954 if ((int) strlen (line
) + 1 < size
)
2955 strcat (line
, "\n");
2966 read_inline_file (struct in_src
*is
, const char *close_tag
, struct gc_arena
*gc
)
2968 char line
[OPTION_LINE_SIZE
];
2969 struct buffer buf
= alloc_buf (10000);
2971 while (in_src_get (is
, line
, sizeof (line
)))
2973 if (!strncmp (line
, close_tag
, strlen (close_tag
)))
2975 buf_printf (&buf
, "%s", line
);
2977 ret
= string_alloc (BSTR (&buf
), gc
);
2985 check_inline_file (struct in_src
*is
, char *p
[], struct gc_arena
*gc
)
2991 if (arg
[0] == '<' && arg
[strlen(arg
)-1] == '>')
2993 struct buffer close_tag
;
2994 arg
[strlen(arg
)-1] = '\0';
2995 p
[0] = string_alloc (arg
+1, gc
);
2996 p
[1] = string_alloc (INLINE_FILE_TAG
, gc
);
2997 close_tag
= alloc_buf (strlen(p
[0]) + 4);
2998 buf_printf (&close_tag
, "</%s>", p
[0]);
2999 p
[2] = read_inline_file (is
, BSTR (&close_tag
), gc
);
3001 free_buf (&close_tag
);
3009 check_inline_file_via_fp (FILE *fp
, char *p
[], struct gc_arena
*gc
)
3012 is
.type
= IS_TYPE_FP
;
3014 return check_inline_file (&is
, p
, gc
);
3018 check_inline_file_via_buf (struct buffer
*multiline
, char *p
[], struct gc_arena
*gc
)
3021 is
.type
= IS_TYPE_BUF
;
3022 is
.u
.multiline
= multiline
;
3023 return check_inline_file (&is
, p
, gc
);
3029 add_option (struct options
*options
,
3035 const unsigned int permission_mask
,
3036 unsigned int *option_types_found
,
3037 struct env_set
*es
);
3040 read_config_file (struct options
*options
,
3043 const char *top_file
,
3046 const unsigned int permission_mask
,
3047 unsigned int *option_types_found
,
3050 const int max_recursive_levels
= 10;
3053 char line
[OPTION_LINE_SIZE
];
3057 if (level
<= max_recursive_levels
)
3059 if (streq (file
, "stdin"))
3062 fp
= fopen (file
, "r");
3066 while (fgets(line
, sizeof (line
), fp
))
3070 if (parse_line (line
, p
, SIZE (p
), file
, line_num
, msglevel
, &options
->gc
))
3072 bypass_doubledash (&p
[0]);
3073 #if ENABLE_INLINE_FILES
3074 check_inline_file_via_fp (fp
, p
, &options
->gc
);
3076 add_option (options
, p
, file
, line_num
, level
, msglevel
, permission_mask
, option_types_found
, es
);
3084 msg (msglevel
, "In %s:%d: Error opening configuration file: %s", top_file
, top_line
, file
);
3089 msg (msglevel
, "In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file
, top_line
, file
);
3096 read_config_string (const char *prefix
,
3097 struct options
*options
,
3100 const unsigned int permission_mask
,
3101 unsigned int *option_types_found
,
3104 char line
[OPTION_LINE_SIZE
];
3105 struct buffer multiline
;
3108 buf_set_read (&multiline
, (uint8_t*)config
, strlen (config
));
3110 while (buf_parse (&multiline
, '\n', line
, sizeof (line
)))
3115 if (parse_line (line
, p
, SIZE (p
), prefix
, line_num
, msglevel
, &options
->gc
))
3117 bypass_doubledash (&p
[0]);
3118 #if ENABLE_INLINE_FILES
3119 check_inline_file_via_buf (&multiline
, p
, &options
->gc
);
3121 add_option (options
, p
, NULL
, line_num
, 0, msglevel
, permission_mask
, option_types_found
, es
);
3129 parse_argv (struct options
*options
,
3133 const unsigned int permission_mask
,
3134 unsigned int *option_types_found
,
3143 /* config filename specified only? */
3144 if (argc
== 2 && strncmp (argv
[1], "--", 2))
3150 add_option (options
, p
, NULL
, 0, 0, msglevel
, permission_mask
, option_types_found
, es
);
3154 /* parse command line */
3155 for (i
= 1; i
< argc
; ++i
)
3160 if (strncmp(p
[0], "--", 2))
3162 msg (msglevel
, "I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p
[0]);
3167 for (j
= 1; j
< MAX_PARMS
; ++j
)
3171 char *arg
= argv
[i
+ j
];
3172 if (strncmp (arg
, "--", 2))
3178 add_option (options
, p
, NULL
, 0, 0, msglevel
, permission_mask
, option_types_found
, es
);
3185 apply_push_options (struct options
*options
,
3187 unsigned int permission_mask
,
3188 unsigned int *option_types_found
,
3191 char line
[OPTION_PARM_SIZE
];
3193 const char *file
= "[PUSH-OPTIONS]";
3194 const int msglevel
= D_PUSH_ERRORS
|M_OPTERR
;
3196 while (buf_parse (buf
, ',', line
, sizeof (line
)))
3201 if (parse_line (line
, p
, SIZE (p
), file
, line_num
, msglevel
, &options
->gc
))
3203 add_option (options
, p
, file
, line_num
, 0, msglevel
, permission_mask
, option_types_found
, es
);
3210 options_server_import (struct options
*o
,
3211 const char *filename
,
3213 unsigned int permission_mask
,
3214 unsigned int *option_types_found
,
3217 msg (D_PUSH
, "OPTIONS IMPORT: reading client specific options from: %s", filename
);
3218 read_config_file (o
,
3229 void options_string_import (struct options
*options
,
3232 const unsigned int permission_mask
,
3233 unsigned int *option_types_found
,
3236 read_config_string ("[CONFIG-STRING]", options
, config
, msglevel
, permission_mask
, option_types_found
, es
);
3241 #define VERIFY_PERMISSION(mask) { if (!verify_permission(p[0], (mask), permission_mask, option_types_found, msglevel)) goto err; }
3244 verify_permission (const char *name
,
3245 const unsigned int type
,
3246 const unsigned int allowed
,
3247 unsigned int *found
,
3250 if (!(type
& allowed
))
3252 msg (msglevel
, "option '%s' cannot be used in this context", name
);
3265 #define VERIFY_PERMISSION(mask)
3270 * Check that an option doesn't have too
3274 #define NM_QUOTE_HINT (1<<0)
3277 no_more_than_n_args (const int msglevel
,
3280 const unsigned int flags
)
3282 const int len
= string_array_len ((const char **)p
);
3289 msg (msglevel
, "the --%s directive should have at most %d parameter%s.%s",
3292 max
>= 3 ? "s" : "",
3293 (flags
& NM_QUOTE_HINT
) ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")." : "");
3301 msglevel_forward_compatible (struct options
*options
, const int msglevel
)
3303 return options
->forward_compatible
? M_WARN
: msglevel
;
3307 add_option (struct options
*options
,
3313 const unsigned int permission_mask
,
3314 unsigned int *option_types_found
,
3317 struct gc_arena gc
= gc_new ();
3318 const bool pull_mode
= BOOL_CAST (permission_mask
& OPT_P_PULL_MODE
);
3319 int msglevel_fc
= msglevel_forward_compatible (options
, msglevel
);
3321 ASSERT (MAX_PARMS
>= 5);
3324 file
= "[CMD-LINE]";
3327 if (streq (p
[0], "help"))
3329 VERIFY_PERMISSION (OPT_P_GENERAL
);
3332 if (streq (p
[0], "version"))
3334 VERIFY_PERMISSION (OPT_P_GENERAL
);
3337 else if (streq (p
[0], "config") && p
[1])
3339 VERIFY_PERMISSION (OPT_P_CONFIG
);
3341 /* save first config file only in options */
3342 if (!options
->config
)
3343 options
->config
= p
[1];
3345 read_config_file (options
, p
[1], level
, file
, line
, msglevel
, permission_mask
, option_types_found
, es
);
3348 else if (streq (p
[0], "foreign-option") && p
[1])
3350 VERIFY_PERMISSION (OPT_P_IPWIN32
);
3351 foreign_option (options
, p
, 3, es
);
3354 else if (streq (p
[0], "echo") || streq (p
[0], "parameter"))
3356 struct buffer string
= alloc_buf_gc (OPTION_PARM_SIZE
, &gc
);
3360 VERIFY_PERMISSION (OPT_P_ECHO
);
3362 for (j
= 1; j
< MAX_PARMS
; ++j
)
3367 good
&= buf_printf (&string
, " ");
3368 good
&= buf_printf (&string
, "%s", p
[j
]);
3372 msg (M_INFO
, "%s:%s",
3373 pull_mode
? "ECHO-PULL" : "ECHO",
3375 #ifdef ENABLE_MANAGEMENT
3377 management_echo (management
, BSTR (&string
), pull_mode
);
3381 msg (M_WARN
, "echo/parameter option overflow");
3383 #ifdef ENABLE_MANAGEMENT
3384 else if (streq (p
[0], "management") && p
[1] && p
[2])
3388 VERIFY_PERMISSION (OPT_P_GENERAL
);
3389 if (streq (p
[2], "unix"))
3391 #if UNIX_SOCK_SUPPORT
3392 options
->management_flags
|= MF_UNIX_SOCK
;
3394 msg (msglevel
, "MANAGEMENT: this platform does not support unix domain sockets");
3401 if (!legal_ipv4_port (port
))
3403 msg (msglevel
, "port number associated with --management directive is out of range");
3408 options
->management_addr
= p
[1];
3409 options
->management_port
= port
;
3412 options
->management_user_pass
= p
[3];
3415 else if (streq (p
[0], "management-client-user") && p
[1])
3417 VERIFY_PERMISSION (OPT_P_GENERAL
);
3418 options
->management_client_user
= p
[1];
3420 else if (streq (p
[0], "management-client-group") && p
[1])
3422 VERIFY_PERMISSION (OPT_P_GENERAL
);
3423 options
->management_client_group
= p
[1];
3425 else if (streq (p
[0], "management-query-passwords"))
3427 VERIFY_PERMISSION (OPT_P_GENERAL
);
3428 options
->management_flags
|= MF_QUERY_PASSWORDS
;
3430 else if (streq (p
[0], "management-hold"))
3432 VERIFY_PERMISSION (OPT_P_GENERAL
);
3433 options
->management_flags
|= MF_HOLD
;
3435 else if (streq (p
[0], "management-signal"))
3437 VERIFY_PERMISSION (OPT_P_GENERAL
);
3438 options
->management_flags
|= MF_SIGNAL
;
3440 else if (streq (p
[0], "management-forget-disconnect"))
3442 VERIFY_PERMISSION (OPT_P_GENERAL
);
3443 options
->management_flags
|= MF_FORGET_DISCONNECT
;
3445 else if (streq (p
[0], "management-client"))
3447 VERIFY_PERMISSION (OPT_P_GENERAL
);
3448 options
->management_flags
|= MF_CONNECT_AS_CLIENT
;
3449 options
->management_write_peer_info_file
= p
[1];
3451 #ifdef MANAGEMENT_DEF_AUTH
3452 else if (streq (p
[0], "management-client-auth"))
3454 VERIFY_PERMISSION (OPT_P_GENERAL
);
3455 options
->management_flags
|= MF_CLIENT_AUTH
;
3458 #ifdef MANAGEMENT_PF
3459 else if (streq (p
[0], "management-client-pf"))
3461 VERIFY_PERMISSION (OPT_P_GENERAL
);
3462 options
->management_flags
|= (MF_CLIENT_PF
| MF_CLIENT_AUTH
);
3465 else if (streq (p
[0], "management-log-cache") && p
[1])
3469 VERIFY_PERMISSION (OPT_P_GENERAL
);
3470 cache
= atoi (p
[1]);
3473 msg (msglevel
, "--management-log-cache parameter is out of range");
3476 options
->management_log_history_cache
= cache
;
3479 #ifdef ENABLE_PLUGIN
3480 else if (streq (p
[0], "plugin") && p
[1])
3482 VERIFY_PERMISSION (OPT_P_PLUGIN
);
3483 if (!options
->plugin_list
)
3484 options
->plugin_list
= plugin_option_list_new (&options
->gc
);
3485 if (!plugin_option_list_add (options
->plugin_list
, &p
[1], &options
->gc
))
3487 msg (msglevel
, "plugin add failed: %s", p
[1]);
3492 else if (streq (p
[0], "mode") && p
[1])
3494 VERIFY_PERMISSION (OPT_P_GENERAL
);
3495 if (streq (p
[1], "p2p"))
3496 options
->mode
= MODE_POINT_TO_POINT
;
3498 else if (streq (p
[1], "server"))
3499 options
->mode
= MODE_SERVER
;
3503 msg (msglevel
, "Bad --mode parameter: %s", p
[1]);
3507 else if (streq (p
[0], "dev") && p
[1])
3509 VERIFY_PERMISSION (OPT_P_GENERAL
);
3510 options
->dev
= p
[1];
3512 else if (streq (p
[0], "dev-type") && p
[1])
3514 VERIFY_PERMISSION (OPT_P_GENERAL
);
3515 options
->dev_type
= p
[1];
3517 else if (streq (p
[0], "dev-node") && p
[1])
3519 VERIFY_PERMISSION (OPT_P_GENERAL
);
3520 options
->dev_node
= p
[1];
3522 else if (streq (p
[0], "lladdr") && p
[1])
3524 VERIFY_PERMISSION (OPT_P_UP
);
3525 if (mac_addr_safe (p
[1])) /* MAC address only */
3526 options
->lladdr
= p
[1];
3529 msg (msglevel
, "lladdr parm '%s' must be a MAC address", p
[1]);
3533 else if (streq (p
[0], "topology") && p
[1])
3535 VERIFY_PERMISSION (OPT_P_UP
);
3536 options
->topology
= parse_topology (p
[1], msglevel
);
3538 else if (streq (p
[0], "tun-ipv6"))
3540 VERIFY_PERMISSION (OPT_P_UP
);
3541 options
->tun_ipv6
= true;
3543 #ifdef CONFIG_FEATURE_IPROUTE
3544 else if (streq (p
[0], "iproute") && p
[1])
3546 VERIFY_PERMISSION (OPT_P_GENERAL
);
3547 iproute_path
= p
[1];
3550 else if (streq (p
[0], "ifconfig") && p
[1] && p
[2])
3552 VERIFY_PERMISSION (OPT_P_UP
);
3553 if (ip_or_dns_addr_safe (p
[1], options
->allow_pull_fqdn
) && ip_or_dns_addr_safe (p
[2], options
->allow_pull_fqdn
)) /* FQDN -- may be DNS name */
3555 options
->ifconfig_local
= p
[1];
3556 options
->ifconfig_remote_netmask
= p
[2];
3560 msg (msglevel
, "ifconfig parms '%s' and '%s' must be valid addresses", p
[1], p
[2]);
3564 else if (streq (p
[0], "ifconfig-noexec"))
3566 VERIFY_PERMISSION (OPT_P_UP
);
3567 options
->ifconfig_noexec
= true;
3569 else if (streq (p
[0], "ifconfig-nowarn"))
3571 VERIFY_PERMISSION (OPT_P_UP
);
3572 options
->ifconfig_nowarn
= true;
3574 else if (streq (p
[0], "local") && p
[1])
3576 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
3577 options
->ce
.local
= p
[1];
3579 else if (streq (p
[0], "remote-random"))
3581 VERIFY_PERMISSION (OPT_P_GENERAL
);
3582 options
->remote_random
= true;
3584 #if ENABLE_CONNECTION
3585 else if (streq (p
[0], "connection") && p
[1])
3587 VERIFY_PERMISSION (OPT_P_GENERAL
);
3588 if (streq (p
[1], INLINE_FILE_TAG
) && p
[2])
3591 struct connection_entry
*e
;
3593 init_options (&sub
, true);
3594 sub
.ce
= options
->ce
;
3595 read_config_string ("[CONNECTION-OPTIONS]", &sub
, p
[2], msglevel
, OPT_P_CONNECTION
, option_types_found
, es
);
3598 msg (msglevel
, "Each 'connection' block must contain exactly one 'remote' directive");
3602 e
= alloc_connection_entry (options
, msglevel
);
3606 gc_transfer (&options
->gc
, &sub
.gc
);
3607 uninit_options (&sub
);
3611 else if (streq (p
[0], "remote") && p
[1])
3613 struct remote_entry re
;
3615 re
.remote_port
= re
.proto
= -1;
3617 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
3621 const int port
= atoi (p
[2]);
3622 if (!legal_ipv4_port (port
))
3624 msg (msglevel
, "remote: port number associated with host %s is out of range", p
[1]);
3627 re
.remote_port
= port
;
3630 const int proto
= ascii2proto (p
[3]);
3633 msg (msglevel
, "remote: bad protocol associated with host %s: '%s'", p
[1], p
[3]);
3639 #ifdef ENABLE_CONNECTION
3640 if (permission_mask
& OPT_P_GENERAL
)
3642 struct remote_entry
*e
= alloc_remote_entry (options
, msglevel
);
3647 else if (permission_mask
& OPT_P_CONNECTION
)
3650 connection_entry_load_re (&options
->ce
, &re
);
3653 else if (streq (p
[0], "resolv-retry") && p
[1])
3655 VERIFY_PERMISSION (OPT_P_GENERAL
);
3656 if (streq (p
[1], "infinite"))
3657 options
->resolve_retry_seconds
= RESOLV_RETRY_INFINITE
;
3659 options
->resolve_retry_seconds
= positive_atoi (p
[1]);
3661 else if (streq (p
[0], "connect-retry") && p
[1])
3663 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
3664 options
->ce
.connect_retry_seconds
= positive_atoi (p
[1]);
3665 options
->ce
.connect_retry_defined
= true;
3667 else if (streq (p
[0], "connect-timeout") && p
[1])
3669 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
3670 options
->ce
.connect_timeout
= positive_atoi (p
[1]);
3671 options
->ce
.connect_timeout_defined
= true;
3673 else if (streq (p
[0], "connect-retry-max") && p
[1])
3675 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
3676 options
->ce
.connect_retry_max
= positive_atoi (p
[1]);
3678 else if (streq (p
[0], "ipchange") && p
[1])
3680 VERIFY_PERMISSION (OPT_P_SCRIPT
);
3681 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
3683 options
->ipchange
= string_substitute (p
[1], ',', ' ', &options
->gc
);
3685 else if (streq (p
[0], "float"))
3687 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
3688 options
->ce
.remote_float
= true;
3691 else if (streq (p
[0], "gremlin") && p
[1])
3693 VERIFY_PERMISSION (OPT_P_GENERAL
);
3694 options
->gremlin
= positive_atoi (p
[1]);
3697 else if (streq (p
[0], "chroot") && p
[1])
3699 VERIFY_PERMISSION (OPT_P_GENERAL
);
3700 options
->chroot_dir
= p
[1];
3702 else if (streq (p
[0], "cd") && p
[1])
3704 VERIFY_PERMISSION (OPT_P_GENERAL
);
3705 if (openvpn_chdir (p
[1]))
3707 msg (M_ERR
, "cd to '%s' failed", p
[1]);
3710 options
->cd_dir
= p
[1];
3712 else if (streq (p
[0], "writepid") && p
[1])
3714 VERIFY_PERMISSION (OPT_P_GENERAL
);
3715 options
->writepid
= p
[1];
3717 else if (streq (p
[0], "up") && p
[1])
3719 VERIFY_PERMISSION (OPT_P_SCRIPT
);
3720 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
3722 options
->up_script
= p
[1];
3724 else if (streq (p
[0], "down") && p
[1])
3726 VERIFY_PERMISSION (OPT_P_SCRIPT
);
3727 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
3729 options
->down_script
= p
[1];
3731 else if (streq (p
[0], "down-pre"))
3733 VERIFY_PERMISSION (OPT_P_GENERAL
);
3734 options
->down_pre
= true;
3736 else if (streq (p
[0], "up-delay"))
3738 VERIFY_PERMISSION (OPT_P_GENERAL
);
3739 options
->up_delay
= true;
3741 else if (streq (p
[0], "up-restart"))
3743 VERIFY_PERMISSION (OPT_P_GENERAL
);
3744 options
->up_restart
= true;
3746 else if (streq (p
[0], "syslog"))
3748 VERIFY_PERMISSION (OPT_P_GENERAL
);
3749 open_syslog (p
[1], false);
3751 else if (streq (p
[0], "daemon"))
3754 VERIFY_PERMISSION (OPT_P_GENERAL
);
3755 if (!options
->daemon
)
3757 options
->daemon
= didit
= true;
3758 open_syslog (p
[1], false);
3764 msg (M_WARN
, "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)", p
[1]);
3769 else if (streq (p
[0], "inetd"))
3771 VERIFY_PERMISSION (OPT_P_GENERAL
);
3772 if (!options
->inetd
)
3775 const char *name
= NULL
;
3776 const char *opterr
= "when --inetd is used with two parameters, one of them must be 'wait' or 'nowait' and the other must be a daemon name to use for system logging";
3778 options
->inetd
= -1;
3780 for (z
= 1; z
<= 2; ++z
)
3784 if (streq (p
[z
], "wait"))
3786 if (options
->inetd
!= -1)
3788 msg (msglevel
, opterr
);
3792 options
->inetd
= INETD_WAIT
;
3794 else if (streq (p
[z
], "nowait"))
3796 if (options
->inetd
!= -1)
3798 msg (msglevel
, opterr
);
3802 options
->inetd
= INETD_NOWAIT
;
3808 msg (msglevel
, opterr
);
3817 if (options
->inetd
== -1)
3818 options
->inetd
= INETD_WAIT
;
3820 save_inetd_socket_descriptor ();
3821 open_syslog (name
, true);
3824 else if (streq (p
[0], "log") && p
[1])
3826 VERIFY_PERMISSION (OPT_P_GENERAL
);
3827 options
->log
= true;
3828 redirect_stdout_stderr (p
[1], false);
3830 else if (streq (p
[0], "suppress-timestamps"))
3832 VERIFY_PERMISSION (OPT_P_GENERAL
);
3833 options
->suppress_timestamps
= true;
3834 set_suppress_timestamps(true);
3836 else if (streq (p
[0], "log-append") && p
[1])
3838 VERIFY_PERMISSION (OPT_P_GENERAL
);
3839 options
->log
= true;
3840 redirect_stdout_stderr (p
[1], true);
3842 else if (streq (p
[0], "mlock"))
3844 VERIFY_PERMISSION (OPT_P_GENERAL
);
3845 options
->mlock
= true;
3847 #if ENABLE_IP_PKTINFO
3848 else if (streq (p
[0], "multihome"))
3850 VERIFY_PERMISSION (OPT_P_GENERAL
);
3851 options
->sockflags
|= SF_USE_IP_PKTINFO
;
3854 else if (streq (p
[0], "verb") && p
[1])
3856 VERIFY_PERMISSION (OPT_P_MESSAGES
);
3857 options
->verbosity
= positive_atoi (p
[1]);
3859 else if (streq (p
[0], "mute") && p
[1])
3861 VERIFY_PERMISSION (OPT_P_MESSAGES
);
3862 options
->mute
= positive_atoi (p
[1]);
3864 else if (streq (p
[0], "errors-to-stderr"))
3866 VERIFY_PERMISSION (OPT_P_MESSAGES
);
3869 else if (streq (p
[0], "status") && p
[1])
3871 VERIFY_PERMISSION (OPT_P_GENERAL
);
3872 options
->status_file
= p
[1];
3875 options
->status_file_update_freq
= positive_atoi (p
[2]);
3878 else if (streq (p
[0], "status-version") && p
[1])
3882 VERIFY_PERMISSION (OPT_P_GENERAL
);
3883 version
= atoi (p
[1]);
3884 if (version
< 1 || version
> 3)
3886 msg (msglevel
, "--status-version must be 1 to 3");
3889 options
->status_file_version
= version
;
3891 else if (streq (p
[0], "remap-usr1") && p
[1])
3893 VERIFY_PERMISSION (OPT_P_GENERAL
);
3894 if (streq (p
[1], "SIGHUP"))
3895 options
->remap_sigusr1
= SIGHUP
;
3896 else if (streq (p
[1], "SIGTERM"))
3897 options
->remap_sigusr1
= SIGTERM
;
3900 msg (msglevel
, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'");
3904 else if ((streq (p
[0], "link-mtu") || streq (p
[0], "udp-mtu")) && p
[1])
3906 VERIFY_PERMISSION (OPT_P_MTU
);
3907 options
->link_mtu
= positive_atoi (p
[1]);
3908 options
->link_mtu_defined
= true;
3910 else if (streq (p
[0], "tun-mtu") && p
[1])
3912 VERIFY_PERMISSION (OPT_P_MTU
);
3913 options
->tun_mtu
= positive_atoi (p
[1]);
3914 options
->tun_mtu_defined
= true;
3916 else if (streq (p
[0], "tun-mtu-extra") && p
[1])
3918 VERIFY_PERMISSION (OPT_P_MTU
);
3919 options
->tun_mtu_extra
= positive_atoi (p
[1]);
3920 options
->tun_mtu_extra_defined
= true;
3922 #ifdef ENABLE_FRAGMENT
3923 else if (streq (p
[0], "mtu-dynamic"))
3925 VERIFY_PERMISSION (OPT_P_GENERAL
);
3926 msg (msglevel
, "--mtu-dynamic has been replaced by --fragment");
3929 else if (streq (p
[0], "fragment") && p
[1])
3931 VERIFY_PERMISSION (OPT_P_MTU
);
3932 options
->fragment
= positive_atoi (p
[1]);
3935 else if (streq (p
[0], "mtu-disc") && p
[1])
3937 VERIFY_PERMISSION (OPT_P_MTU
);
3938 options
->mtu_discover_type
= translate_mtu_discover_type_name (p
[1]);
3941 else if (streq (p
[0], "mtu-test"))
3943 VERIFY_PERMISSION (OPT_P_GENERAL
);
3944 options
->mtu_test
= true;
3947 else if (streq (p
[0], "nice") && p
[1])
3949 VERIFY_PERMISSION (OPT_P_NICE
);
3950 options
->nice
= atoi (p
[1]);
3952 else if (streq (p
[0], "rcvbuf") && p
[1])
3954 VERIFY_PERMISSION (OPT_P_SOCKBUF
);
3955 options
->rcvbuf
= positive_atoi (p
[1]);
3957 else if (streq (p
[0], "sndbuf") && p
[1])
3959 VERIFY_PERMISSION (OPT_P_SOCKBUF
);
3960 options
->sndbuf
= positive_atoi (p
[1]);
3962 else if (streq (p
[0], "socket-flags"))
3965 VERIFY_PERMISSION (OPT_P_SOCKFLAGS
);
3966 for (j
= 1; j
< MAX_PARMS
&& p
[j
]; ++j
)
3968 if (streq (p
[j
], "TCP_NODELAY"))
3969 options
->sockflags
|= SF_TCP_NODELAY
;
3971 msg (msglevel
, "unknown socket flag: %s", p
[j
]);
3974 else if (streq (p
[0], "txqueuelen") && p
[1])
3976 VERIFY_PERMISSION (OPT_P_GENERAL
);
3978 options
->tuntap_options
.txqueuelen
= positive_atoi (p
[1]);
3980 msg (msglevel
, "--txqueuelen not supported on this OS");
3985 else if (streq (p
[0], "nice-work") && p
[1])
3987 VERIFY_PERMISSION (OPT_P_NICE
);
3988 options
->nice_work
= atoi (p
[1]);
3990 else if (streq (p
[0], "threads") && p
[1])
3994 VERIFY_PERMISSION (OPT_P_GENERAL
);
3995 n_threads
= positive_atoi (p
[1]);
3998 msg (msglevel
, "--threads parameter must be at least 1");
4001 options
->n_threads
= n_threads
;
4004 else if (streq (p
[0], "shaper") && p
[1])
4006 #ifdef HAVE_GETTIMEOFDAY
4009 VERIFY_PERMISSION (OPT_P_SHAPER
);
4010 shaper
= atoi (p
[1]);
4011 if (shaper
< SHAPER_MIN
|| shaper
> SHAPER_MAX
)
4013 msg (msglevel
, "Bad shaper value, must be between %d and %d",
4014 SHAPER_MIN
, SHAPER_MAX
);
4017 options
->shaper
= shaper
;
4018 #else /* HAVE_GETTIMEOFDAY */
4019 VERIFY_PERMISSION (OPT_P_GENERAL
);
4020 msg (msglevel
, "--shaper requires the gettimeofday() function which is missing");
4022 #endif /* HAVE_GETTIMEOFDAY */
4024 else if (streq (p
[0], "port") && p
[1])
4028 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4030 if (!legal_ipv4_port (port
))
4032 msg (msglevel
, "Bad port number: %s", p
[1]);
4035 options
->ce
.port_option_used
= true;
4036 options
->ce
.local_port
= options
->ce
.remote_port
= port
;
4038 else if (streq (p
[0], "lport") && p
[1])
4042 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4044 if (!legal_ipv4_port (port
))
4046 msg (msglevel
, "Bad local port number: %s", p
[1]);
4049 options
->ce
.local_port_defined
= true;
4050 options
->ce
.port_option_used
= true;
4051 options
->ce
.local_port
= port
;
4053 else if (streq (p
[0], "rport") && p
[1])
4057 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4059 if (!legal_ipv4_port (port
))
4061 msg (msglevel
, "Bad remote port number: %s", p
[1]);
4064 options
->ce
.port_option_used
= true;
4065 options
->ce
.remote_port
= port
;
4067 else if (streq (p
[0], "bind"))
4069 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4070 options
->ce
.bind_defined
= true;
4072 else if (streq (p
[0], "nobind"))
4074 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4075 options
->ce
.bind_local
= false;
4077 else if (streq (p
[0], "fast-io"))
4079 VERIFY_PERMISSION (OPT_P_GENERAL
);
4080 options
->fast_io
= true;
4082 else if (streq (p
[0], "inactive") && p
[1])
4084 VERIFY_PERMISSION (OPT_P_TIMER
);
4085 options
->inactivity_timeout
= positive_atoi (p
[1]);
4087 options
->inactivity_minimum_bytes
= positive_atoi (p
[2]);
4089 else if (streq (p
[0], "proto") && p
[1])
4092 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4093 proto
= ascii2proto (p
[1]);
4096 msg (msglevel
, "Bad protocol: '%s'. Allowed protocols with --proto option: %s",
4098 proto2ascii_all (&gc
));
4101 options
->ce
.proto
= proto
;
4103 #ifdef GENERAL_PROXY_SUPPORT
4104 else if (streq (p
[0], "auto-proxy"))
4108 VERIFY_PERMISSION (OPT_P_GENERAL
);
4109 options
->auto_proxy_info
= get_proxy_settings (&error
, &options
->gc
);
4111 msg (M_WARN
, "PROXY: %s", error
);
4113 else if (streq (p
[0], "show-proxy-settings"))
4115 struct auto_proxy_info
*pi
;
4118 VERIFY_PERMISSION (OPT_P_GENERAL
);
4119 pi
= get_proxy_settings (&error
, &options
->gc
);
4122 msg (M_INFO
|M_NOPREFIX
, "HTTP Server: %s", np(pi
->http
.server
));
4123 msg (M_INFO
|M_NOPREFIX
, "HTTP Port: %d", pi
->http
.port
);
4124 msg (M_INFO
|M_NOPREFIX
, "SOCKS Server: %s", np(pi
->socks
.server
));
4125 msg (M_INFO
|M_NOPREFIX
, "SOCKS Port: %d", pi
->socks
.port
);
4128 msg (msglevel
, "Proxy error: %s", error
);
4130 show_win_proxy_settings (M_INFO
|M_NOPREFIX
);
4132 openvpn_exit (OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
4134 #endif /* GENERAL_PROXY_SUPPORT */
4135 #ifdef ENABLE_HTTP_PROXY
4136 else if (streq (p
[0], "http-proxy") && p
[1])
4138 struct http_proxy_options
*ho
;
4140 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4146 msg (msglevel
, "http-proxy port number not defined");
4150 if (!legal_ipv4_port (port
))
4152 msg (msglevel
, "Bad http-proxy port number: %s", p
[2]);
4156 ho
= init_http_options_if_undefined (options
);
4164 if (streq (p
[3], "auto"))
4165 ho
->auth_retry
= true;
4168 ho
->auth_method_string
= "basic";
4169 ho
->auth_file
= p
[3];
4173 ho
->auth_method_string
= p
[4];
4179 ho
->auth_method_string
= "none";
4182 else if (streq (p
[0], "http-proxy-retry"))
4184 struct http_proxy_options
*ho
;
4185 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4186 ho
= init_http_options_if_undefined (options
);
4189 else if (streq (p
[0], "http-proxy-timeout") && p
[1])
4191 struct http_proxy_options
*ho
;
4193 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4194 ho
= init_http_options_if_undefined (options
);
4195 ho
->timeout
= positive_atoi (p
[1]);
4197 else if (streq (p
[0], "http-proxy-option") && p
[1])
4199 struct http_proxy_options
*ho
;
4201 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4202 ho
= init_http_options_if_undefined (options
);
4204 if (streq (p
[1], "VERSION") && p
[2])
4206 ho
->http_version
= p
[2];
4208 else if (streq (p
[1], "AGENT") && p
[2])
4210 ho
->user_agent
= p
[2];
4214 msg (msglevel
, "Bad http-proxy-option or missing parameter: '%s'", p
[1]);
4219 else if (streq (p
[0], "socks-proxy") && p
[1])
4221 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4227 if (!legal_ipv4_port (port
))
4229 msg (msglevel
, "Bad socks-proxy port number: %s", p
[2]);
4232 options
->ce
.socks_proxy_port
= port
;
4236 options
->ce
.socks_proxy_port
= 1080;
4238 options
->ce
.socks_proxy_server
= p
[1];
4240 else if (streq (p
[0], "socks-proxy-retry"))
4242 VERIFY_PERMISSION (OPT_P_GENERAL
|OPT_P_CONNECTION
);
4243 options
->ce
.socks_proxy_retry
= true;
4246 else if (streq (p
[0], "keepalive") && p
[1] && p
[2])
4248 VERIFY_PERMISSION (OPT_P_GENERAL
);
4249 options
->keepalive_ping
= atoi (p
[1]);
4250 options
->keepalive_timeout
= atoi (p
[2]);
4252 else if (streq (p
[0], "ping") && p
[1])
4254 VERIFY_PERMISSION (OPT_P_TIMER
);
4255 options
->ping_send_timeout
= positive_atoi (p
[1]);
4257 else if (streq (p
[0], "ping-exit") && p
[1])
4259 VERIFY_PERMISSION (OPT_P_TIMER
);
4260 options
->ping_rec_timeout
= positive_atoi (p
[1]);
4261 options
->ping_rec_timeout_action
= PING_EXIT
;
4263 else if (streq (p
[0], "ping-restart") && p
[1])
4265 VERIFY_PERMISSION (OPT_P_TIMER
);
4266 options
->ping_rec_timeout
= positive_atoi (p
[1]);
4267 options
->ping_rec_timeout_action
= PING_RESTART
;
4269 else if (streq (p
[0], "ping-timer-rem"))
4271 VERIFY_PERMISSION (OPT_P_TIMER
);
4272 options
->ping_timer_remote
= true;
4275 else if (streq (p
[0], "explicit-exit-notify"))
4277 VERIFY_PERMISSION (OPT_P_EXPLICIT_NOTIFY
);
4280 options
->explicit_exit_notification
= positive_atoi (p
[1]);
4284 options
->explicit_exit_notification
= 1;
4288 else if (streq (p
[0], "persist-tun"))
4290 VERIFY_PERMISSION (OPT_P_PERSIST
);
4291 options
->persist_tun
= true;
4293 else if (streq (p
[0], "persist-key"))
4295 VERIFY_PERMISSION (OPT_P_PERSIST
);
4296 options
->persist_key
= true;
4298 else if (streq (p
[0], "persist-local-ip"))
4300 VERIFY_PERMISSION (OPT_P_PERSIST_IP
);
4301 options
->persist_local_ip
= true;
4303 else if (streq (p
[0], "persist-remote-ip"))
4305 VERIFY_PERMISSION (OPT_P_PERSIST_IP
);
4306 options
->persist_remote_ip
= true;
4308 else if (streq (p
[0], "route") && p
[1])
4310 VERIFY_PERMISSION (OPT_P_ROUTE
);
4311 rol_check_alloc (options
);
4314 if (!ip_or_dns_addr_safe (p
[1], options
->allow_pull_fqdn
) && !is_special_addr (p
[1])) /* FQDN -- may be DNS name */
4316 msg (msglevel
, "route parameter network/IP '%s' must be a valid address", p
[1]);
4319 if (p
[2] && !ip_addr_dotted_quad_safe (p
[2])) /* FQDN -- must be IP address */
4321 msg (msglevel
, "route parameter netmask '%s' must be an IP address", p
[2]);
4324 if (p
[3] && !ip_or_dns_addr_safe (p
[3], options
->allow_pull_fqdn
) && !is_special_addr (p
[3])) /* FQDN -- may be DNS name */
4326 msg (msglevel
, "route parameter gateway '%s' must be a valid address", p
[3]);
4330 add_route_to_option_list (options
->routes
, p
[1], p
[2], p
[3], p
[4]);
4332 else if (streq (p
[0], "route-gateway") && p
[1])
4334 VERIFY_PERMISSION (OPT_P_ROUTE_EXTRAS
);
4335 if (streq (p
[1], "dhcp"))
4337 options
->route_gateway_via_dhcp
= true;
4341 if (ip_or_dns_addr_safe (p
[1], options
->allow_pull_fqdn
) || is_special_addr (p
[1])) /* FQDN -- may be DNS name */
4343 options
->route_default_gateway
= p
[1];
4347 msg (msglevel
, "route-gateway parm '%s' must be a valid address", p
[1]);
4352 else if (streq (p
[0], "route-metric") && p
[1])
4354 VERIFY_PERMISSION (OPT_P_ROUTE
);
4355 options
->route_default_metric
= positive_atoi (p
[1]);
4357 else if (streq (p
[0], "route-delay"))
4359 VERIFY_PERMISSION (OPT_P_ROUTE_EXTRAS
);
4360 options
->route_delay_defined
= true;
4363 options
->route_delay
= positive_atoi (p
[1]);
4366 options
->route_delay_window
= positive_atoi (p
[2]);
4371 options
->route_delay
= 0;
4374 else if (streq (p
[0], "route-up") && p
[1])
4376 VERIFY_PERMISSION (OPT_P_SCRIPT
);
4377 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
4379 options
->route_script
= p
[1];
4381 else if (streq (p
[0], "route-noexec"))
4383 VERIFY_PERMISSION (OPT_P_SCRIPT
);
4384 options
->route_noexec
= true;
4386 else if (streq (p
[0], "route-nopull"))
4388 VERIFY_PERMISSION (OPT_P_GENERAL
);
4389 options
->route_nopull
= true;
4391 else if (streq (p
[0], "allow-pull-fqdn"))
4393 VERIFY_PERMISSION (OPT_P_GENERAL
);
4394 options
->allow_pull_fqdn
= true;
4396 else if (streq (p
[0], "redirect-gateway") || streq (p
[0], "redirect-private"))
4399 VERIFY_PERMISSION (OPT_P_ROUTE
);
4400 rol_check_alloc (options
);
4401 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
4403 if (streq (p
[0], "redirect-gateway"))
4404 options
->routes
->flags
|= RG_REROUTE_GW
;
4405 if (streq (p
[j
], "local"))
4406 options
->routes
->flags
|= RG_LOCAL
;
4407 else if (streq (p
[j
], "autolocal"))
4408 options
->routes
->flags
|= RG_AUTO_LOCAL
;
4409 else if (streq (p
[j
], "def1"))
4410 options
->routes
->flags
|= RG_DEF1
;
4411 else if (streq (p
[j
], "bypass-dhcp"))
4412 options
->routes
->flags
|= RG_BYPASS_DHCP
;
4413 else if (streq (p
[j
], "bypass-dns"))
4414 options
->routes
->flags
|= RG_BYPASS_DNS
;
4417 msg (msglevel
, "unknown --%s flag: %s", p
[0], p
[j
]);
4421 options
->routes
->flags
|= RG_ENABLE
;
4423 else if (streq (p
[0], "setenv") && p
[1])
4425 VERIFY_PERMISSION (OPT_P_GENERAL
);
4426 if (streq (p
[1], "FORWARD_COMPATIBLE") && p
[2] && streq (p
[2], "1"))
4428 options
->forward_compatible
= true;
4429 msglevel_fc
= msglevel_forward_compatible (options
, msglevel
);
4431 setenv_str (es
, p
[1], p
[2] ? p
[2] : "");
4433 else if (streq (p
[0], "setenv-safe") && p
[1])
4435 VERIFY_PERMISSION (OPT_P_SETENV
);
4436 setenv_str_safe (es
, p
[1], p
[2] ? p
[2] : "");
4438 else if (streq (p
[0], "script-security") && p
[1])
4440 VERIFY_PERMISSION (OPT_P_GENERAL
);
4441 script_security
= atoi (p
[1]);
4444 if (streq (p
[2], "execve"))
4445 script_method
= SM_EXECVE
;
4446 else if (streq (p
[2], "system"))
4447 script_method
= SM_SYSTEM
;
4450 msg (msglevel
, "unknown --script-security method: %s", p
[2]);
4455 script_method
= SM_EXECVE
;
4457 else if (streq (p
[0], "mssfix"))
4459 VERIFY_PERMISSION (OPT_P_GENERAL
);
4462 options
->mssfix
= positive_atoi (p
[1]);
4465 options
->mssfix_default
= true;
4469 else if (streq (p
[0], "disable-occ"))
4471 VERIFY_PERMISSION (OPT_P_GENERAL
);
4472 options
->occ
= false;
4477 else if (streq (p
[0], "server") && p
[1] && p
[2])
4479 const int lev
= M_WARN
;
4481 in_addr_t network
, netmask
;
4483 VERIFY_PERMISSION (OPT_P_GENERAL
);
4484 network
= get_ip_addr (p
[1], lev
, &error
);
4485 netmask
= get_ip_addr (p
[2], lev
, &error
);
4486 if (error
|| !network
|| !netmask
)
4488 msg (msglevel
, "error parsing --server parameters");
4491 options
->server_defined
= true;
4492 options
->server_network
= network
;
4493 options
->server_netmask
= netmask
;
4497 if (streq (p
[3], "nopool"))
4498 options
->server_flags
|= SF_NOPOOL
;
4501 msg (msglevel
, "error parsing --server: %s is not a recognized flag", p
[3]);
4506 else if (streq (p
[0], "server-bridge") && p
[1] && p
[2] && p
[3] && p
[4])
4508 const int lev
= M_WARN
;
4510 in_addr_t ip
, netmask
, pool_start
, pool_end
;
4512 VERIFY_PERMISSION (OPT_P_GENERAL
);
4513 ip
= get_ip_addr (p
[1], lev
, &error
);
4514 netmask
= get_ip_addr (p
[2], lev
, &error
);
4515 pool_start
= get_ip_addr (p
[3], lev
, &error
);
4516 pool_end
= get_ip_addr (p
[4], lev
, &error
);
4517 if (error
|| !ip
|| !netmask
|| !pool_start
|| !pool_end
)
4519 msg (msglevel
, "error parsing --server-bridge parameters");
4522 options
->server_bridge_defined
= true;
4523 options
->server_bridge_ip
= ip
;
4524 options
->server_bridge_netmask
= netmask
;
4525 options
->server_bridge_pool_start
= pool_start
;
4526 options
->server_bridge_pool_end
= pool_end
;
4528 else if (streq (p
[0], "server-bridge") && p
[1] && streq (p
[1], "nogw"))
4530 VERIFY_PERMISSION (OPT_P_GENERAL
);
4531 options
->server_bridge_proxy_dhcp
= true;
4532 options
->server_flags
|= SF_NO_PUSH_ROUTE_GATEWAY
;
4534 else if (streq (p
[0], "server-bridge") && !p
[1])
4536 VERIFY_PERMISSION (OPT_P_GENERAL
);
4537 options
->server_bridge_proxy_dhcp
= true;
4539 else if (streq (p
[0], "push") && p
[1])
4541 VERIFY_PERMISSION (OPT_P_PUSH
);
4542 push_options (options
, &p
[1], msglevel
, &options
->gc
);
4544 else if (streq (p
[0], "push-reset"))
4546 VERIFY_PERMISSION (OPT_P_INSTANCE
);
4547 push_reset (options
);
4549 else if (streq (p
[0], "ifconfig-pool") && p
[1] && p
[2])
4551 const int lev
= M_WARN
;
4553 in_addr_t start
, end
, netmask
=0;
4555 VERIFY_PERMISSION (OPT_P_GENERAL
);
4556 start
= get_ip_addr (p
[1], lev
, &error
);
4557 end
= get_ip_addr (p
[2], lev
, &error
);
4560 netmask
= get_ip_addr (p
[3], lev
, &error
);
4564 msg (msglevel
, "error parsing --ifconfig-pool parameters");
4567 if (!ifconfig_pool_verify_range (msglevel
, start
, end
))
4570 options
->ifconfig_pool_defined
= true;
4571 options
->ifconfig_pool_start
= start
;
4572 options
->ifconfig_pool_end
= end
;
4574 options
->ifconfig_pool_netmask
= netmask
;
4576 else if (streq (p
[0], "ifconfig-pool-persist") && p
[1])
4578 VERIFY_PERMISSION (OPT_P_GENERAL
);
4579 options
->ifconfig_pool_persist_filename
= p
[1];
4582 options
->ifconfig_pool_persist_refresh_freq
= positive_atoi (p
[2]);
4585 else if (streq (p
[0], "ifconfig-pool-linear"))
4587 VERIFY_PERMISSION (OPT_P_GENERAL
);
4588 options
->topology
= TOP_P2P
;
4590 else if (streq (p
[0], "hash-size") && p
[1] && p
[2])
4594 VERIFY_PERMISSION (OPT_P_GENERAL
);
4596 virtual = atoi (p
[2]);
4597 if (real
< 1 || virtual < 1)
4599 msg (msglevel
, "--hash-size sizes must be >= 1 (preferably a power of 2)");
4602 options
->real_hash_size
= real
;
4603 options
->virtual_hash_size
= real
;
4605 else if (streq (p
[0], "connect-freq") && p
[1] && p
[2])
4609 VERIFY_PERMISSION (OPT_P_GENERAL
);
4610 cf_max
= atoi (p
[1]);
4611 cf_per
= atoi (p
[2]);
4612 if (cf_max
< 0 || cf_per
< 0)
4614 msg (msglevel
, "--connect-freq parms must be > 0");
4617 options
->cf_max
= cf_max
;
4618 options
->cf_per
= cf_per
;
4620 else if (streq (p
[0], "max-clients") && p
[1])
4624 VERIFY_PERMISSION (OPT_P_GENERAL
);
4625 max_clients
= atoi (p
[1]);
4626 if (max_clients
< 0)
4628 msg (msglevel
, "--max-clients must be at least 1");
4631 options
->max_clients
= max_clients
;
4633 else if (streq (p
[0], "max-routes-per-client") && p
[1])
4635 VERIFY_PERMISSION (OPT_P_INHERIT
);
4636 options
->max_routes_per_client
= max_int (atoi (p
[1]), 1);
4638 else if (streq (p
[0], "client-cert-not-required"))
4640 VERIFY_PERMISSION (OPT_P_GENERAL
);
4641 options
->ssl_flags
|= SSLF_CLIENT_CERT_NOT_REQUIRED
;
4643 else if (streq (p
[0], "username-as-common-name"))
4645 VERIFY_PERMISSION (OPT_P_GENERAL
);
4646 options
->ssl_flags
|= SSLF_USERNAME_AS_COMMON_NAME
;
4648 else if (streq (p
[0], "auth-user-pass-optional"))
4650 VERIFY_PERMISSION (OPT_P_GENERAL
);
4651 options
->ssl_flags
|= SSLF_AUTH_USER_PASS_OPTIONAL
;
4653 else if (streq (p
[0], "no-name-remapping"))
4655 VERIFY_PERMISSION (OPT_P_GENERAL
);
4656 options
->ssl_flags
|= SSLF_NO_NAME_REMAPPING
;
4658 else if (streq (p
[0], "opt-verify"))
4660 VERIFY_PERMISSION (OPT_P_GENERAL
);
4661 options
->ssl_flags
|= SSLF_OPT_VERIFY
;
4663 else if (streq (p
[0], "auth-user-pass-verify") && p
[1])
4665 VERIFY_PERMISSION (OPT_P_SCRIPT
);
4666 if (!no_more_than_n_args (msglevel
, p
, 3, NM_QUOTE_HINT
))
4670 if (streq (p
[2], "via-env"))
4671 options
->auth_user_pass_verify_script_via_file
= false;
4672 else if (streq (p
[2], "via-file"))
4673 options
->auth_user_pass_verify_script_via_file
= true;
4676 msg (msglevel
, "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'");
4682 msg (msglevel
, "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')");
4685 options
->auth_user_pass_verify_script
= p
[1];
4687 else if (streq (p
[0], "client-connect") && p
[1])
4689 VERIFY_PERMISSION (OPT_P_SCRIPT
);
4690 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
4692 options
->client_connect_script
= p
[1];
4694 else if (streq (p
[0], "client-disconnect") && p
[1])
4696 VERIFY_PERMISSION (OPT_P_SCRIPT
);
4697 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
4699 options
->client_disconnect_script
= p
[1];
4701 else if (streq (p
[0], "learn-address") && p
[1])
4703 VERIFY_PERMISSION (OPT_P_SCRIPT
);
4704 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
4706 options
->learn_address_script
= p
[1];
4708 else if (streq (p
[0], "tmp-dir") && p
[1])
4710 VERIFY_PERMISSION (OPT_P_GENERAL
);
4711 options
->tmp_dir
= p
[1];
4713 else if (streq (p
[0], "client-config-dir") && p
[1])
4715 VERIFY_PERMISSION (OPT_P_GENERAL
);
4716 options
->client_config_dir
= p
[1];
4718 else if (streq (p
[0], "ccd-exclusive"))
4720 VERIFY_PERMISSION (OPT_P_GENERAL
);
4721 options
->ccd_exclusive
= true;
4723 else if (streq (p
[0], "bcast-buffers") && p
[1])
4727 VERIFY_PERMISSION (OPT_P_GENERAL
);
4728 n_bcast_buf
= atoi (p
[1]);
4729 if (n_bcast_buf
< 1)
4730 msg (msglevel
, "--bcast-buffers parameter must be > 0");
4731 options
->n_bcast_buf
= n_bcast_buf
;
4733 else if (streq (p
[0], "tcp-queue-limit") && p
[1])
4735 int tcp_queue_limit
;
4737 VERIFY_PERMISSION (OPT_P_GENERAL
);
4738 tcp_queue_limit
= atoi (p
[1]);
4739 if (tcp_queue_limit
< 1)
4740 msg (msglevel
, "--tcp-queue-limit parameter must be > 0");
4741 options
->tcp_queue_limit
= tcp_queue_limit
;
4744 else if (streq (p
[0], "port-share") && p
[1] && p
[2])
4748 VERIFY_PERMISSION (OPT_P_GENERAL
);
4750 if (!legal_ipv4_port (port
))
4752 msg (msglevel
, "port number associated with --port-share directive is out of range");
4756 options
->port_share_host
= p
[1];
4757 options
->port_share_port
= port
;
4760 else if (streq (p
[0], "client-to-client"))
4762 VERIFY_PERMISSION (OPT_P_GENERAL
);
4763 options
->enable_c2c
= true;
4765 else if (streq (p
[0], "duplicate-cn"))
4767 VERIFY_PERMISSION (OPT_P_GENERAL
);
4768 options
->duplicate_cn
= true;
4770 else if (streq (p
[0], "iroute") && p
[1])
4772 const char *netmask
= NULL
;
4774 VERIFY_PERMISSION (OPT_P_INSTANCE
);
4779 option_iroute (options
, p
[1], netmask
, msglevel
);
4781 else if (streq (p
[0], "ifconfig-push") && p
[1] && p
[2])
4783 in_addr_t local
, remote_netmask
;
4785 VERIFY_PERMISSION (OPT_P_INSTANCE
);
4786 local
= getaddr (GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[1], 0, NULL
, NULL
);
4787 remote_netmask
= getaddr (GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[2], 0, NULL
, NULL
);
4788 if (local
&& remote_netmask
)
4790 options
->push_ifconfig_defined
= true;
4791 options
->push_ifconfig_local
= local
;
4792 options
->push_ifconfig_remote_netmask
= remote_netmask
;
4796 msg (msglevel
, "cannot parse --ifconfig-push addresses");
4800 else if (streq (p
[0], "ifconfig-push-constraint") && p
[1] && p
[2])
4802 in_addr_t network
, netmask
;
4804 VERIFY_PERMISSION (OPT_P_GENERAL
);
4805 network
= getaddr (GETADDR_HOST_ORDER
|GETADDR_RESOLVE
, p
[1], 0, NULL
, NULL
);
4806 netmask
= getaddr (GETADDR_HOST_ORDER
, p
[2], 0, NULL
, NULL
);
4807 if (network
&& netmask
)
4809 options
->push_ifconfig_constraint_defined
= true;
4810 options
->push_ifconfig_constraint_network
= network
;
4811 options
->push_ifconfig_constraint_netmask
= netmask
;
4815 msg (msglevel
, "cannot parse --ifconfig-push-constraint addresses");
4819 else if (streq (p
[0], "disable"))
4821 VERIFY_PERMISSION (OPT_P_INSTANCE
);
4822 options
->disable
= true;
4824 else if (streq (p
[0], "tcp-nodelay"))
4826 VERIFY_PERMISSION (OPT_P_GENERAL
);
4827 options
->server_flags
|= SF_TCP_NODELAY_HELPER
;
4829 #endif /* P2MP_SERVER */
4831 else if (streq (p
[0], "client"))
4833 VERIFY_PERMISSION (OPT_P_GENERAL
);
4834 options
->client
= true;
4836 else if (streq (p
[0], "pull"))
4838 VERIFY_PERMISSION (OPT_P_GENERAL
);
4839 options
->pull
= true;
4841 else if (streq (p
[0], "auth-user-pass"))
4843 VERIFY_PERMISSION (OPT_P_GENERAL
);
4846 options
->auth_user_pass_file
= p
[1];
4849 options
->auth_user_pass_file
= "stdin";
4851 else if (streq (p
[0], "auth-retry") && p
[1])
4853 VERIFY_PERMISSION (OPT_P_GENERAL
);
4854 auth_retry_set (msglevel
, p
[1]);
4858 else if (streq (p
[0], "win-sys") && p
[1])
4860 VERIFY_PERMISSION (OPT_P_GENERAL
);
4861 if (streq (p
[1], "env"))
4862 set_win_sys_path_via_env (es
);
4864 set_win_sys_path (p
[1], es
);
4866 else if (streq (p
[0], "route-method") && p
[1])
4868 VERIFY_PERMISSION (OPT_P_ROUTE_EXTRAS
);
4869 if (streq (p
[1], "adaptive"))
4870 options
->route_method
= ROUTE_METHOD_ADAPTIVE
;
4871 else if (streq (p
[1], "ipapi"))
4872 options
->route_method
= ROUTE_METHOD_IPAPI
;
4873 else if (streq (p
[1], "exe"))
4874 options
->route_method
= ROUTE_METHOD_EXE
;
4877 msg (msglevel
, "--route method must be 'adaptive', 'ipapi', or 'exe'");
4881 else if (streq (p
[0], "ip-win32") && p
[1])
4883 const int index
= ascii2ipset (p
[1]);
4884 struct tuntap_options
*to
= &options
->tuntap_options
;
4886 VERIFY_PERMISSION (OPT_P_IPWIN32
);
4891 "Bad --ip-win32 method: '%s'. Allowed methods: %s",
4893 ipset2ascii_all (&gc
));
4897 if (index
== IPW32_SET_ADAPTIVE
)
4898 options
->route_delay_window
= IPW32_SET_ADAPTIVE_DELAY_WINDOW
;
4900 if (index
== IPW32_SET_DHCP_MASQ
)
4904 if (!streq (p
[2], "default"))
4906 int offset
= atoi (p
[2]);
4908 if (!(offset
> -256 && offset
< 256))
4910 msg (msglevel
, "--ip-win32 dynamic [offset] [lease-time]: offset (%d) must be > -256 and < 256", offset
);
4914 to
->dhcp_masq_custom_offset
= true;
4915 to
->dhcp_masq_offset
= offset
;
4920 const int min_lease
= 30;
4922 lease_time
= atoi (p
[3]);
4923 if (lease_time
< min_lease
)
4925 msg (msglevel
, "--ip-win32 dynamic [offset] [lease-time]: lease time parameter (%d) must be at least %d seconds", lease_time
, min_lease
);
4928 to
->dhcp_lease_time
= lease_time
;
4932 to
->ip_win32_type
= index
;
4933 to
->ip_win32_defined
= true;
4935 else if (streq (p
[0], "dhcp-option") && p
[1])
4937 struct tuntap_options
*o
= &options
->tuntap_options
;
4938 VERIFY_PERMISSION (OPT_P_IPWIN32
);
4940 if (streq (p
[1], "DOMAIN") && p
[2])
4944 else if (streq (p
[1], "NBS") && p
[2])
4946 o
->netbios_scope
= p
[2];
4948 else if (streq (p
[1], "NBT") && p
[2])
4952 if (!(t
== 1 || t
== 2 || t
== 4 || t
== 8))
4954 msg (msglevel
, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t
);
4957 o
->netbios_node_type
= t
;
4959 else if (streq (p
[1], "DNS") && p
[2])
4961 dhcp_option_address_parse ("DNS", p
[2], o
->dns
, &o
->dns_len
, msglevel
);
4963 else if (streq (p
[1], "WINS") && p
[2])
4965 dhcp_option_address_parse ("WINS", p
[2], o
->wins
, &o
->wins_len
, msglevel
);
4967 else if (streq (p
[1], "NTP") && p
[2])
4969 dhcp_option_address_parse ("NTP", p
[2], o
->ntp
, &o
->ntp_len
, msglevel
);
4971 else if (streq (p
[1], "NBDD") && p
[2])
4973 dhcp_option_address_parse ("NBDD", p
[2], o
->nbdd
, &o
->nbdd_len
, msglevel
);
4975 else if (streq (p
[1], "DISABLE-NBT"))
4981 msg (msglevel
, "--dhcp-option: unknown option type '%s' or missing parameter", p
[1]);
4984 o
->dhcp_options
= true;
4986 else if (streq (p
[0], "show-adapters"))
4988 VERIFY_PERMISSION (OPT_P_GENERAL
);
4989 show_tap_win32_adapters (M_INFO
|M_NOPREFIX
, M_WARN
|M_NOPREFIX
);
4990 openvpn_exit (OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
4992 else if (streq (p
[0], "show-net"))
4994 VERIFY_PERMISSION (OPT_P_GENERAL
);
4995 show_routes (M_INFO
|M_NOPREFIX
);
4996 show_adapters (M_INFO
|M_NOPREFIX
);
4997 openvpn_exit (OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
4999 else if (streq (p
[0], "show-net-up"))
5001 VERIFY_PERMISSION (OPT_P_UP
);
5002 options
->show_net_up
= true;
5004 else if (streq (p
[0], "tap-sleep") && p
[1])
5007 VERIFY_PERMISSION (OPT_P_IPWIN32
);
5009 if (s
< 0 || s
>= 256)
5011 msg (msglevel
, "--tap-sleep parameter must be between 0 and 255");
5014 options
->tuntap_options
.tap_sleep
= s
;
5016 else if (streq (p
[0], "dhcp-renew"))
5018 VERIFY_PERMISSION (OPT_P_IPWIN32
);
5019 options
->tuntap_options
.dhcp_renew
= true;
5021 else if (streq (p
[0], "dhcp-pre-release"))
5023 VERIFY_PERMISSION (OPT_P_IPWIN32
);
5024 options
->tuntap_options
.dhcp_pre_release
= true;
5026 else if (streq (p
[0], "dhcp-release"))
5028 VERIFY_PERMISSION (OPT_P_IPWIN32
);
5029 options
->tuntap_options
.dhcp_release
= true;
5031 else if (streq (p
[0], "show-valid-subnets"))
5033 VERIFY_PERMISSION (OPT_P_GENERAL
);
5034 show_valid_win32_tun_subnets ();
5035 openvpn_exit (OPENVPN_EXIT_STATUS_USAGE
); /* exit point */
5037 else if (streq (p
[0], "pause-exit"))
5039 VERIFY_PERMISSION (OPT_P_GENERAL
);
5040 set_pause_exit_win32 ();
5042 else if (streq (p
[0], "service") && p
[1])
5044 VERIFY_PERMISSION (OPT_P_GENERAL
);
5045 options
->exit_event_name
= p
[1];
5048 options
->exit_event_initial_state
= (atoi(p
[2]) != 0);
5051 else if (streq (p
[0], "allow-nonadmin"))
5053 VERIFY_PERMISSION (OPT_P_GENERAL
);
5054 tap_allow_nonadmin_access (p
[1]);
5055 openvpn_exit (OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
5057 else if (streq (p
[0], "user") && p
[1])
5059 VERIFY_PERMISSION (OPT_P_GENERAL
);
5060 msg (M_WARN
, "NOTE: --user option is not implemented on Windows");
5062 else if (streq (p
[0], "group") && p
[1])
5064 VERIFY_PERMISSION (OPT_P_GENERAL
);
5065 msg (M_WARN
, "NOTE: --group option is not implemented on Windows");
5068 else if (streq (p
[0], "user") && p
[1])
5070 VERIFY_PERMISSION (OPT_P_GENERAL
);
5071 options
->username
= p
[1];
5073 else if (streq (p
[0], "group") && p
[1])
5075 VERIFY_PERMISSION (OPT_P_GENERAL
);
5076 options
->groupname
= p
[1];
5078 else if (streq (p
[0], "dhcp-option") && p
[1])
5080 VERIFY_PERMISSION (OPT_P_IPWIN32
);
5081 foreign_option (options
, p
, 3, es
);
5083 else if (streq (p
[0], "route-method") && p
[1]) /* ignore when pushed to non-Windows OS */
5085 VERIFY_PERMISSION (OPT_P_ROUTE_EXTRAS
);
5088 #if PASSTOS_CAPABILITY
5089 else if (streq (p
[0], "passtos"))
5091 VERIFY_PERMISSION (OPT_P_GENERAL
);
5092 options
->passtos
= true;
5096 else if (streq (p
[0], "comp-lzo"))
5098 VERIFY_PERMISSION (OPT_P_COMP
);
5101 if (streq (p
[1], "yes"))
5102 options
->lzo
= LZO_SELECTED
|LZO_ON
;
5103 else if (streq (p
[1], "no"))
5104 options
->lzo
= LZO_SELECTED
;
5105 else if (streq (p
[1], "adaptive"))
5106 options
->lzo
= LZO_SELECTED
|LZO_ON
|LZO_ADAPTIVE
;
5109 msg (msglevel
, "bad comp-lzo option: %s -- must be 'yes', 'no', or 'adaptive'", p
[1]);
5114 options
->lzo
= LZO_SELECTED
|LZO_ON
|LZO_ADAPTIVE
;
5116 else if (streq (p
[0], "comp-noadapt"))
5118 VERIFY_PERMISSION (OPT_P_COMP
);
5119 options
->lzo
&= ~LZO_ADAPTIVE
;
5121 #endif /* USE_LZO */
5123 else if (streq (p
[0], "show-ciphers"))
5125 VERIFY_PERMISSION (OPT_P_GENERAL
);
5126 options
->show_ciphers
= true;
5128 else if (streq (p
[0], "show-digests"))
5130 VERIFY_PERMISSION (OPT_P_GENERAL
);
5131 options
->show_digests
= true;
5133 else if (streq (p
[0], "show-engines"))
5135 VERIFY_PERMISSION (OPT_P_GENERAL
);
5136 options
->show_engines
= true;
5138 else if (streq (p
[0], "key-direction") && p
[1])
5142 key_direction
= ascii2keydirection (msglevel
, p
[1]);
5143 if (key_direction
>= 0)
5144 options
->key_direction
= key_direction
;
5148 else if (streq (p
[0], "secret") && p
[1])
5150 VERIFY_PERMISSION (OPT_P_GENERAL
);
5151 #if ENABLE_INLINE_FILES
5152 if (streq (p
[1], INLINE_FILE_TAG
) && p
[2])
5154 options
->shared_secret_file_inline
= p
[2];
5162 key_direction
= ascii2keydirection (msglevel
, p
[2]);
5163 if (key_direction
>= 0)
5164 options
->key_direction
= key_direction
;
5168 options
->shared_secret_file
= p
[1];
5170 else if (streq (p
[0], "genkey"))
5172 VERIFY_PERMISSION (OPT_P_GENERAL
);
5173 options
->genkey
= true;
5175 else if (streq (p
[0], "auth") && p
[1])
5177 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5178 options
->authname_defined
= true;
5179 options
->authname
= p
[1];
5180 if (streq (options
->authname
, "none"))
5182 options
->authname_defined
= false;
5183 options
->authname
= NULL
;
5186 else if (streq (p
[0], "auth"))
5188 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5189 options
->authname_defined
= true;
5191 else if (streq (p
[0], "cipher") && p
[1])
5193 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5194 options
->ciphername_defined
= true;
5195 options
->ciphername
= p
[1];
5196 if (streq (options
->ciphername
, "none"))
5198 options
->ciphername_defined
= false;
5199 options
->ciphername
= NULL
;
5202 else if (streq (p
[0], "cipher"))
5204 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5205 options
->ciphername_defined
= true;
5207 else if (streq (p
[0], "prng") && p
[1])
5209 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5210 if (streq (p
[1], "none"))
5211 options
->prng_hash
= NULL
;
5213 options
->prng_hash
= p
[1];
5216 const int sl
= atoi (p
[2]);
5217 if (sl
>= NONCE_SECRET_LEN_MIN
&& sl
<= NONCE_SECRET_LEN_MAX
)
5219 options
->prng_nonce_secret_len
= sl
;
5223 msg (msglevel
, "prng parameter nonce_secret_len must be between %d and %d",
5224 NONCE_SECRET_LEN_MIN
, NONCE_SECRET_LEN_MAX
);
5229 else if (streq (p
[0], "no-replay"))
5231 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5232 options
->replay
= false;
5234 else if (streq (p
[0], "replay-window"))
5236 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5241 replay_window
= atoi (p
[1]);
5242 if (!(MIN_SEQ_BACKTRACK
<= replay_window
&& replay_window
<= MAX_SEQ_BACKTRACK
))
5244 msg (msglevel
, "replay-window window size parameter (%d) must be between %d and %d",
5250 options
->replay_window
= replay_window
;
5256 replay_time
= atoi (p
[2]);
5257 if (!(MIN_TIME_BACKTRACK
<= replay_time
&& replay_time
<= MAX_TIME_BACKTRACK
))
5259 msg (msglevel
, "replay-window time window parameter (%d) must be between %d and %d",
5262 MAX_TIME_BACKTRACK
);
5265 options
->replay_time
= replay_time
;
5270 msg (msglevel
, "replay-window option is missing window size parameter");
5274 else if (streq (p
[0], "mute-replay-warnings"))
5276 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5277 options
->mute_replay_warnings
= true;
5279 else if (streq (p
[0], "no-iv"))
5281 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5282 options
->use_iv
= false;
5284 else if (streq (p
[0], "replay-persist") && p
[1])
5286 VERIFY_PERMISSION (OPT_P_GENERAL
);
5287 options
->packet_id_file
= p
[1];
5289 else if (streq (p
[0], "test-crypto"))
5291 VERIFY_PERMISSION (OPT_P_GENERAL
);
5292 options
->test_crypto
= true;
5294 else if (streq (p
[0], "engine"))
5296 VERIFY_PERMISSION (OPT_P_GENERAL
);
5299 options
->engine
= p
[1];
5302 options
->engine
= "auto";
5304 #ifdef HAVE_EVP_CIPHER_CTX_SET_KEY_LENGTH
5305 else if (streq (p
[0], "keysize") && p
[1])
5309 VERIFY_PERMISSION (OPT_P_CRYPTO
);
5310 keysize
= atoi (p
[1]) / 8;
5311 if (keysize
< 0 || keysize
> MAX_CIPHER_KEY_LENGTH
)
5313 msg (msglevel
, "Bad keysize: %s", p
[1]);
5316 options
->keysize
= keysize
;
5320 else if (streq (p
[0], "show-tls"))
5322 VERIFY_PERMISSION (OPT_P_GENERAL
);
5323 options
->show_tls_ciphers
= true;
5325 else if (streq (p
[0], "tls-server"))
5327 VERIFY_PERMISSION (OPT_P_GENERAL
);
5328 options
->tls_server
= true;
5330 else if (streq (p
[0], "tls-client"))
5332 VERIFY_PERMISSION (OPT_P_GENERAL
);
5333 options
->tls_client
= true;
5335 else if (streq (p
[0], "ca") && p
[1])
5337 VERIFY_PERMISSION (OPT_P_GENERAL
);
5338 options
->ca_file
= p
[1];
5339 #if ENABLE_INLINE_FILES
5340 if (streq (p
[1], INLINE_FILE_TAG
) && p
[2])
5342 options
->ca_file_inline
= p
[2];
5346 else if (streq (p
[0], "capath") && p
[1])
5348 VERIFY_PERMISSION (OPT_P_GENERAL
);
5349 options
->ca_path
= p
[1];
5351 else if (streq (p
[0], "dh") && p
[1])
5353 VERIFY_PERMISSION (OPT_P_GENERAL
);
5354 options
->dh_file
= p
[1];
5355 #if ENABLE_INLINE_FILES
5356 if (streq (p
[1], INLINE_FILE_TAG
) && p
[2])
5358 options
->dh_file_inline
= p
[2];
5362 else if (streq (p
[0], "cert") && p
[1])
5364 VERIFY_PERMISSION (OPT_P_GENERAL
);
5365 options
->cert_file
= p
[1];
5366 #if ENABLE_INLINE_FILES
5367 if (streq (p
[1], INLINE_FILE_TAG
) && p
[2])
5369 options
->cert_file_inline
= p
[2];
5374 else if (streq (p
[0], "cryptoapicert") && p
[1])
5376 VERIFY_PERMISSION (OPT_P_GENERAL
);
5377 options
->cryptoapi_cert
= p
[1];
5380 else if (streq (p
[0], "key") && p
[1])
5382 VERIFY_PERMISSION (OPT_P_GENERAL
);
5383 options
->priv_key_file
= p
[1];
5384 #if ENABLE_INLINE_FILES
5385 if (streq (p
[1], INLINE_FILE_TAG
) && p
[2])
5387 options
->priv_key_file_inline
= p
[2];
5391 else if (streq (p
[0], "pkcs12") && p
[1])
5393 VERIFY_PERMISSION (OPT_P_GENERAL
);
5394 options
->pkcs12_file
= p
[1];
5396 else if (streq (p
[0], "askpass"))
5398 VERIFY_PERMISSION (OPT_P_GENERAL
);
5401 options
->key_pass_file
= p
[1];
5404 options
->key_pass_file
= "stdin";
5406 else if (streq (p
[0], "auth-nocache"))
5408 VERIFY_PERMISSION (OPT_P_GENERAL
);
5409 ssl_set_auth_nocache ();
5411 else if (streq (p
[0], "single-session"))
5413 VERIFY_PERMISSION (OPT_P_GENERAL
);
5414 options
->single_session
= true;
5416 else if (streq (p
[0], "tls-exit"))
5418 VERIFY_PERMISSION (OPT_P_GENERAL
);
5419 options
->tls_exit
= true;
5421 else if (streq (p
[0], "tls-cipher") && p
[1])
5423 VERIFY_PERMISSION (OPT_P_GENERAL
);
5424 options
->cipher_list
= p
[1];
5426 else if (streq (p
[0], "crl-verify") && p
[1])
5428 VERIFY_PERMISSION (OPT_P_GENERAL
);
5429 options
->crl_file
= p
[1];
5431 else if (streq (p
[0], "tls-verify") && p
[1])
5433 VERIFY_PERMISSION (OPT_P_SCRIPT
);
5434 if (!no_more_than_n_args (msglevel
, p
, 2, NM_QUOTE_HINT
))
5436 options
->tls_verify
= string_substitute (p
[1], ',', ' ', &options
->gc
);
5438 else if (streq (p
[0], "tls-remote") && p
[1])
5440 VERIFY_PERMISSION (OPT_P_GENERAL
);
5441 options
->tls_remote
= p
[1];
5443 else if (streq (p
[0], "ns-cert-type") && p
[1])
5445 VERIFY_PERMISSION (OPT_P_GENERAL
);
5446 if (streq (p
[1], "server"))
5447 options
->ns_cert_type
= NS_SSL_SERVER
;
5448 else if (streq (p
[1], "client"))
5449 options
->ns_cert_type
= NS_SSL_CLIENT
;
5452 msg (msglevel
, "--ns-cert-type must be 'client' or 'server'");
5456 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
5457 else if (streq (p
[0], "remote-cert-ku"))
5461 VERIFY_PERMISSION (OPT_P_GENERAL
);
5463 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
5464 sscanf (p
[j
], "%x", &(options
->remote_cert_ku
[j
-1]));
5466 else if (streq (p
[0], "remote-cert-eku") && p
[1])
5468 VERIFY_PERMISSION (OPT_P_GENERAL
);
5469 options
->remote_cert_eku
= p
[1];
5471 else if (streq (p
[0], "remote-cert-tls") && p
[1])
5473 VERIFY_PERMISSION (OPT_P_GENERAL
);
5475 if (streq (p
[1], "server"))
5477 options
->remote_cert_ku
[0] = 0xa0;
5478 options
->remote_cert_ku
[1] = 0x88;
5479 options
->remote_cert_eku
= "TLS Web Server Authentication";
5481 else if (streq (p
[1], "client"))
5483 options
->remote_cert_ku
[0] = 0x80;
5484 options
->remote_cert_ku
[1] = 0x08;
5485 options
->remote_cert_ku
[2] = 0x88;
5486 options
->remote_cert_eku
= "TLS Web Client Authentication";
5490 msg (msglevel
, "--remote-cert-tls must be 'client' or 'server'");
5494 #endif /* OPENSSL_VERSION_NUMBER */
5495 else if (streq (p
[0], "tls-timeout") && p
[1])
5497 VERIFY_PERMISSION (OPT_P_TLS_PARMS
);
5498 options
->tls_timeout
= positive_atoi (p
[1]);
5500 else if (streq (p
[0], "reneg-bytes") && p
[1])
5502 VERIFY_PERMISSION (OPT_P_TLS_PARMS
);
5503 options
->renegotiate_bytes
= positive_atoi (p
[1]);
5505 else if (streq (p
[0], "reneg-pkts") && p
[1])
5507 VERIFY_PERMISSION (OPT_P_TLS_PARMS
);
5508 options
->renegotiate_packets
= positive_atoi (p
[1]);
5510 else if (streq (p
[0], "reneg-sec") && p
[1])
5512 VERIFY_PERMISSION (OPT_P_TLS_PARMS
);
5513 options
->renegotiate_seconds
= positive_atoi (p
[1]);
5515 else if (streq (p
[0], "hand-window") && p
[1])
5517 VERIFY_PERMISSION (OPT_P_TLS_PARMS
);
5518 options
->handshake_window
= positive_atoi (p
[1]);
5520 else if (streq (p
[0], "tran-window") && p
[1])
5522 VERIFY_PERMISSION (OPT_P_TLS_PARMS
);
5523 options
->transition_window
= positive_atoi (p
[1]);
5525 else if (streq (p
[0], "tls-auth") && p
[1])
5527 VERIFY_PERMISSION (OPT_P_GENERAL
);
5528 #if ENABLE_INLINE_FILES
5529 if (streq (p
[1], INLINE_FILE_TAG
) && p
[2])
5531 options
->tls_auth_file_inline
= p
[2];
5539 key_direction
= ascii2keydirection (msglevel
, p
[2]);
5540 if (key_direction
>= 0)
5541 options
->key_direction
= key_direction
;
5545 options
->tls_auth_file
= p
[1];
5547 else if (streq (p
[0], "key-method") && p
[1])
5551 VERIFY_PERMISSION (OPT_P_GENERAL
);
5552 key_method
= atoi (p
[1]);
5553 if (key_method
< KEY_METHOD_MIN
|| key_method
> KEY_METHOD_MAX
)
5555 msg (msglevel
, "key_method parameter (%d) must be >= %d and <= %d",
5561 options
->key_method
= key_method
;
5563 #endif /* USE_SSL */
5564 #endif /* USE_CRYPTO */
5565 #ifdef ENABLE_PKCS11
5566 else if (streq (p
[0], "show-pkcs11-ids") && p
[1])
5568 char *provider
= p
[1];
5569 bool cert_private
= (p
[2] == NULL
? false : ( atoi (p
[2]) != 0 ));
5571 VERIFY_PERMISSION (OPT_P_GENERAL
);
5573 set_debug_level (options
->verbosity
, SDL_CONSTRAIN
);
5574 show_pkcs11_ids (provider
, cert_private
);
5575 openvpn_exit (OPENVPN_EXIT_STATUS_GOOD
); /* exit point */
5577 else if (streq (p
[0], "pkcs11-providers") && p
[1])
5581 VERIFY_PERMISSION (OPT_P_GENERAL
);
5583 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
5584 options
->pkcs11_providers
[j
-1] = p
[j
];
5586 else if (streq (p
[0], "pkcs11-protected-authentication"))
5590 VERIFY_PERMISSION (OPT_P_GENERAL
);
5592 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
5593 options
->pkcs11_protected_authentication
[j
-1] = atoi (p
[j
]) != 0 ? 1 : 0;
5595 else if (streq (p
[0], "pkcs11-private-mode") && p
[1])
5599 VERIFY_PERMISSION (OPT_P_GENERAL
);
5601 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
5602 sscanf (p
[j
], "%x", &(options
->pkcs11_private_mode
[j
-1]));
5604 else if (streq (p
[0], "pkcs11-cert-private"))
5608 VERIFY_PERMISSION (OPT_P_GENERAL
);
5610 for (j
= 1; j
< MAX_PARMS
&& p
[j
] != NULL
; ++j
)
5611 options
->pkcs11_cert_private
[j
-1] = atoi (p
[j
]) != 0 ? 1 : 0;
5613 else if (streq (p
[0], "pkcs11-pin-cache") && p
[1])
5615 VERIFY_PERMISSION (OPT_P_GENERAL
);
5616 options
->pkcs11_pin_cache_period
= atoi (p
[1]);
5618 else if (streq (p
[0], "pkcs11-id") && p
[1])
5620 VERIFY_PERMISSION (OPT_P_GENERAL
);
5621 options
->pkcs11_id
= p
[1];
5623 else if (streq (p
[0], "pkcs11-id-management"))
5625 VERIFY_PERMISSION (OPT_P_GENERAL
);
5626 options
->pkcs11_id_management
= true;
5629 #ifdef TUNSETPERSIST
5630 else if (streq (p
[0], "rmtun"))
5632 VERIFY_PERMISSION (OPT_P_GENERAL
);
5633 options
->persist_config
= true;
5634 options
->persist_mode
= 0;
5636 else if (streq (p
[0], "mktun"))
5638 VERIFY_PERMISSION (OPT_P_GENERAL
);
5639 options
->persist_config
= true;
5640 options
->persist_mode
= 1;
5646 msg (msglevel_fc
, "Unrecognized option or missing parameter(s) in %s:%d: %s (%s)", file
, line
, p
[0], PACKAGE_VERSION
);
5648 msg (msglevel_fc
, "Unrecognized option or missing parameter(s): --%s (%s)", p
[0], PACKAGE_VERSION
);