diff options
Diffstat (limited to 'openvpn/options.c')
| -rw-r--r-- | openvpn/options.c | 4552 |
1 files changed, 0 insertions, 4552 deletions
diff --git a/openvpn/options.c b/openvpn/options.c deleted file mode 100644 index 3d1eb54..0000000 --- a/openvpn/options.c +++ /dev/null @@ -1,4552 +0,0 @@ -/* - * OpenVPN -- An application to securely tunnel IP networks - * over a single UDP port, with support for SSL/TLS-based - * session authentication and key exchange, - * packet encryption, packet authentication, and - * packet compression. - * - * Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net> - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 - * as published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program (see the file COPYING included with this - * distribution); if not, write to the Free Software Foundation, Inc., - * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -/* - * 2004-01-28: Added Socks5 proxy support - * (Christof Meerwald, http://cmeerw.org) - */ - -#ifdef WIN32 -#include "config-win32.h" -#else -#include "config.h" -#endif - -#include "syshead.h" - -#include "buffer.h" -#include "error.h" -#include "common.h" -#include "shaper.h" -#include "crypto.h" -#include "ssl.h" -#include "options.h" -#include "misc.h" -#include "socket.h" -#include "packet_id.h" -#include "win32.h" -#include "push.h" -#include "pool.h" -#include "helper.h" -#include "manage.h" - -#include "memdbg.h" - -const char title_string[] = - PACKAGE_STRING - " " TARGET_ALIAS -#ifdef USE_CRYPTO -#ifdef USE_SSL - " [SSL]" -#else - " [CRYPTO]" -#endif -#endif -#ifdef USE_LZO - " [LZO]" -#endif -#if EPOLL - " [EPOLL]" -#endif -#ifdef USE_PTHREAD - " [PTHREAD]" -#endif - " built on " __DATE__ -; - -#ifndef ENABLE_SMALL - -static const char usage_message[] = - "%s\n" - "\n" - "General Options:\n" - "--config file : Read configuration options from file.\n" - "--help : Show options.\n" - "--version : Show copyright and version information.\n" - "\n" - "Tunnel Options:\n" - "--local host : Local host name or ip address.\n" - "--remote host [port] : Remote host name or ip address.\n" - "--remote-random : If multiple --remote options specified, choose one randomly.\n" - "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n" - "--proto p : Use protocol p for communicating with peer.\n" - " p = udp (default), tcp-server, or tcp-client\n" - "--connect-retry n : For --proto tcp-client, number of seconds to wait\n" - " between connection retries (default=%d).\n" -#ifdef ENABLE_HTTP_PROXY - "--http-proxy s p [up] [auth] : Connect to remote host through an HTTP proxy at\n" - " address s and port p. If proxy authentication is required,\n" - " up is a file containing username/password on 2 lines, or\n" - " 'stdin' to prompt from console. Add auth='ntlm' if\n" - " the proxy requires NTLM authentication.\n" - "--http-proxy-retry : Retry indefinitely on HTTP proxy errors.\n" - "--http-proxy-timeout n : Proxy timeout in seconds, default=5.\n" - "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n" - " Repeat to set multiple options.\n" - " VERSION version (default=1.0)\n" - " AGENT user-agent\n" -#endif -#ifdef ENABLE_SOCKS - "--socks-proxy s [p]: Connect to remote host through a Socks5 proxy at address\n" - " s and port p (default port = 1080).\n" - "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n" -#endif - "--resolv-retry n: If hostname resolve fails for --remote, retry\n" - " resolve for n seconds before failing (disabled by default).\n" - " Set n=\"infinite\" to retry indefinitely.\n" - "--float : Allow remote to change its IP address/port, such as through\n" - " DHCP (this is the default if --remote is not used).\n" - "--ipchange cmd : Execute shell command cmd on remote ip address initial\n" - " setting or change -- execute as: cmd ip-address port#\n" - "--port port : TCP/UDP port # for both local and remote.\n" - "--lport port : TCP/UDP port # for local (default=%d).\n" - "--rport port : TCP/UDP port # for remote (default=%d).\n" - "--nobind : Do not bind to local address and port.\n" - "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n" - "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n" - " this option only if the tun/tap device used with --dev\n" - " does not begin with \"tun\" or \"tap\".\n" - "--dev-node node : Explicitly set the device node rather than using\n" - " /dev/net/tun, /dev/tun, /dev/tap, etc.\n" - "--tun-ipv6 : Build tun link capable of forwarding IPv6 traffic.\n" - "--ifconfig l rn : TUN: configure device to use IP address l as a local\n" - " endpoint and rn as a remote endpoint. l & rn should be\n" - " swapped on the other peer. l & rn must be private\n" - " addresses outside of the subnets used by either peer.\n" - " TAP: configure device to use IP address l as a local\n" - " endpoint and rn as a subnet mask.\n" - "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n" - " pass --ifconfig parms by environment to scripts.\n" - "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n" - " connection doesn't match the remote side.\n" - "--route network [netmask] [gateway] [metric] :\n" - " Add route to routing table after connection\n" - " is established. Multiple routes can be specified.\n" - " netmask default: 255.255.255.255\n" - " gateway default: taken from --route-gateway or --ifconfig\n" - " Specify default by leaving blank or setting to \"nil\".\n" - "--route-gateway gw : Specify a default gateway for use with --route.\n" - "--route-delay n [w] : Delay n seconds after connection initiation before\n" - " adding routes (may be 0). If not specified, routes will\n" - " be added immediately after tun/tap open. On Windows, wait\n" - " up to w seconds for TUN/TAP adapter to come up.\n" - "--route-up cmd : Execute shell cmd after routes are added.\n" - "--route-noexec : Don't add routes automatically. Instead pass routes to\n" - " --route-up script using environmental variables.\n" - "--redirect-gateway [flags]: (Experimental) Automatically execute routing\n" - " commands to redirect all outgoing IP traffic through the\n" - " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n" - " connected via a common subnet, such as with WiFi.\n" - " Add 'def1' flag to set default route using using 0.0.0.0/1\n" - " and 128.0.0.0/1 rather than 0.0.0.0/0.\n" - "--setenv name value : Set a custom environmental variable to pass to script.\n" - "--shaper n : Restrict output to peer to n bytes per second.\n" - "--keepalive n m : Helper option for setting timeouts in server mode. Send\n" - " ping once every n seconds, restart if ping not received\n" - " for m seconds.\n" - "--inactive n : Exit after n seconds of inactivity on tun/tap device.\n" - "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n" - "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n" - "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n" - " remote address.\n" - "--ping n : Ping remote once every n seconds over TCP/UDP port.\n" - "--fast-io : (experimental) Optimize TUN/TAP/UDP writes.\n" - "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n" - "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n" - "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n" - "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n" - "--persist-key : Don't re-read key files across SIGUSR1 or --ping-restart.\n" -#if PASSTOS_CAPABILITY - "--passtos : TOS passthrough (applies to IPv4 only).\n" -#endif - "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n" - " TCP/UDP MTU from it (default=%d).\n" - "--tun-mtu-extra n : Assume that tun/tap device might return as many\n" - " as n bytes more than the tun-mtu size on read\n" - " (default TUN=0 TAP=%d).\n" - "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n" - " from it.\n" - "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n" - " 'no' -- Never send DF (Don't Fragment) frames\n" - " 'maybe' -- Use per-route hints\n" - " 'yes' -- Always DF (Don't Fragment)\n" -#ifdef ENABLE_OCC - "--mtu-test : Empirically measure and report MTU.\n" -#endif -#ifdef ENABLE_FRAGMENT - "--fragment max : Enable internal datagram fragmentation so that no UDP\n" - " datagrams are sent which are larger than max bytes.\n" - " Adds 4 bytes of overhead per datagram.\n" -#endif - "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n" - " or --fragment max value, whichever is lower.\n" - "--sndbuf size : Set the TCP/UDP send buffer size.\n" - "--rcvbuf size : Set the TCP/UDP receive buffer size.\n" - "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n" - "--mlock : Disable Paging -- ensures key material and tunnel\n" - " data will never be written to disk.\n" - "--up cmd : Shell cmd to execute after successful tun device open.\n" - " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n" - " ifconfig-local-ip ifconfig-remote-ip\n" - " (pre --user or --group UID/GID change)\n" - "--up-delay : Delay tun/tap open and possible --up script execution\n" - " until after TCP/UDP connection establishment with peer.\n" - "--down cmd : Shell cmd to run after tun device close.\n" - " (post --user/--group UID/GID change and/or --chroot)\n" - " (script parameters are same as --up option)\n" - "--down-pre : Call --down cmd/script before TUN/TAP close.\n" - "--up-restart : Run up/down scripts for all restarts including those\n" - " caused by --ping-restart or SIGUSR1\n" - "--user user : Set UID to user after initialization.\n" - "--group group : Set GID to group after initialization.\n" - "--chroot dir : Chroot to this directory after initialization.\n" - "--cd dir : Change to this directory before initialization.\n" - "--daemon [name] : Become a daemon after initialization.\n" - " The optional 'name' parameter will be passed\n" - " as the program name to the system logger.\n" - "--syslog [name] : Output to syslog, but do not become a daemon.\n" - " See --daemon above for a description of the 'name' parm.\n" - "--inetd [name] ['wait'|'nowait'] : Run as an inetd or xinetd server.\n" - " See --daemon above for a description of the 'name' parm.\n" - "--log file : Output log to file which is created/truncated on open.\n" - "--log-append file : Append log to file, or create file if nonexistent.\n" - "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n" - "--writepid file : Write main process ID to file.\n" - "--nice n : Change process priority (>0 = lower, <0 = higher).\n" -#if 0 -#ifdef USE_PTHREAD - "--nice-work n : Change thread priority of work thread. The work\n" - " thread is used for background processing such as\n" - " RSA key number crunching.\n" -#endif -#endif - "--echo [parms ...] : Echo parameters to log output.\n" - "--verb n : Set output verbosity to n (default=%d):\n" - " (Level 3 is recommended if you want a good summary\n" - " of what's happening without being swamped by output).\n" - " : 0 -- no output except fatal errors\n" - " : 1 -- startup info + connection initiated messages +\n" - " non-fatal encryption & net errors\n" - " : 2,3 -- show TLS negotiations & route info\n" - " : 4 -- show parameters\n" - " : 5 -- show 'RrWw' chars on console for each packet sent\n" - " and received from TCP/UDP (caps) or tun/tap (lc)\n" - " : 6 to 11 -- debug messages of increasing verbosity\n" - "--mute n : Log at most n consecutive messages in the same category.\n" - "--status file n : Write operational status to file every n seconds.\n" - "--status-version [n] : Choose the status file format version number.\n" - " Currently, n can be 1 or 2 (default=1).\n" -#ifdef ENABLE_OCC - "--disable-occ : Disable options consistency check between peers.\n" -#endif -#ifdef ENABLE_DEBUG - "--gremlin mask : Special stress testing mode (for debugging only).\n" -#endif -#ifdef USE_LZO - "--comp-lzo : Use fast LZO compression -- may add up to 1 byte per\n" - " packet for uncompressible data.\n" - "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n" - " is specified.\n" -#endif -#ifdef ENABLE_MANAGEMENT - "--management ip port [pass] : Enable a TCP server on ip:port to handle\n" - " management functions. pass is a password file\n" - " or 'stdin' to prompt from console.\n" - "--management-query-passwords : Query management channel for private key\n" - " and auth-user-pass passwords.\n" - "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n" - " of the management interface explicitly starts it.\n" - "--management-log-cache n : Cache n lines of log file history for usage\n" - " by the management channel.\n" -#endif -#ifdef ENABLE_PLUGIN - "--plugin m [str]: Load plug-in module m passing str as an argument\n" - " to its initialization function.\n" -#endif -#if P2MP -#if P2MP_SERVER - "\n" - "Multi-Client Server options (when --mode server is used):\n" - "--server network netmask : Helper option to easily configure server mode.\n" - "--server-bridge IP netmask pool-start-IP pool-end-IP : Helper option to\n" - " easily configure ethernet bridging server mode.\n" - "--push \"option\" : Push a config file option back to the peer for remote\n" - " execution. Peer must specify --pull in its config file.\n" - "--push-reset : Don't inherit global push list for specific\n" - " client instance.\n" - "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n" - " to be dynamically allocated to connecting clients.\n" - "--ifconfig-pool-linear : Use individual addresses rather than /30 subnets\n" - " in tun mode. Not compatible with Windows clients.\n" - "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n" - " data to file, at seconds intervals (default=600).\n" - " If seconds=0, file will be treated as read-only.\n" - "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n" - " overrides --ifconfig-pool dynamic allocation.\n" - " Only valid in a client-specific config file.\n" - "--iroute network [netmask] : Route subnet to client.\n" - " Sets up internal routes only.\n" - " Only valid in a client-specific config file.\n" - "--disable : Client is disabled.\n" - " Only valid in a client-specific config file.\n" - "--client-cert-not-required : Don't require client certificate, client\n" - " will authenticate using username/password.\n" - "--username-as-common-name : For auth-user-pass authentication, use\n" - " the authenticated username as the common name,\n" - " rather than the common name from the client cert.\n" - "--auth-user-pass-verify cmd method: Query client for username/password and\n" - " run script cmd to verify. If method='via-env', pass\n" - " user/pass via environment, if method='via-file', pass\n" - " user/pass via temporary file.\n" - "--client-to-client : Internally route client-to-client traffic.\n" - "--duplicate-cn : Allow multiple clients with the same common name to\n" - " concurrently connect.\n" - "--client-connect cmd : Run script cmd on client connection.\n" - "--client-disconnect cmd : Run script cmd on client disconnection.\n" - "--client-config-dir dir : Directory for custom client config files.\n" - "--ccd-exclusive : Refuse connection unless custom client config is found.\n" - "--tmp-dir dir : Temporary directory, used for --client-connect return file.\n" - "--hash-size r v : Set the size of the real address hash table to r and the\n" - " virtual address table to v.\n" - "--bcast-buffers n : Allocate n broadcast buffers.\n" - "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n" - "--learn-address cmd : Run script cmd to validate client virtual addresses.\n" - "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n" - "--max-clients n : Allow a maximum of n simultaneously connected clients.\n" - "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n" -#endif - "\n" - "Client options (when connecting to a multi-client server):\n" - "--client : Helper option to easily configure client mode.\n" - "--auth-user-pass [up] : Authenticate with server using username/password.\n" - " up is a file containing username/password on 2 lines,\n" - " or omit to prompt from console.\n" - "--pull : Accept certain config file options from the peer as if they\n" - " were part of the local config file. Must be specified\n" - " when connecting to a '--mode server' remote host.\n" - "--auth-retry t : How to handle auth failures. Set t to\n" - " none (default), interact, or nointeract.\n" -#endif -#ifdef ENABLE_OCC - "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n" - " server/remote. n = # of retries, default=1.\n" -#endif -#ifdef USE_CRYPTO - "\n" - "Data Channel Encryption Options (must be compatible between peers):\n" - "(These options are meaningful for both Static Key & TLS-mode)\n" - "--secret f [d] : Enable Static Key encryption mode (non-TLS).\n" - " Use shared secret file f, generate with --genkey.\n" - " The optional d parameter controls key directionality.\n" - " If d is specified, use separate keys for each\n" - " direction, set d=0 on one side of the connection,\n" - " and d=1 on the other side.\n" - "--auth alg : Authenticate packets with HMAC using message\n" - " digest algorithm alg (default=%s).\n" - " (usually adds 16 or 20 bytes per packet)\n" - " Set alg=none to disable authentication.\n" - "--cipher alg : Encrypt packets with cipher algorithm alg\n" - " (default=%s).\n" - " Set alg=none to disable encryption.\n" -#ifdef HAVE_EVP_CIPHER_CTX_SET_KEY_LENGTH - "--keysize n : Size of cipher key in bits (optional).\n" - " If unspecified, defaults to cipher-specific default.\n" -#endif - "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n" - "--no-replay : Disable replay protection.\n" - "--mute-replay-warnings : Silence the output of replay warnings to log file.\n" - "--replay-window n [t] : Use a replay protection sliding window of size n\n" - " and a time window of t seconds.\n" - " Default n=%d t=%d\n" - "--no-iv : Disable cipher IV -- only allowed with CBC mode ciphers.\n" - "--replay-persist file : Persist replay-protection state across sessions\n" - " using file.\n" - "--test-crypto : Run a self-test of crypto features enabled.\n" - " For debugging only.\n" -#ifdef USE_SSL - "\n" - "TLS Key Negotiation Options:\n" - "(These options are meaningful only for TLS-mode)\n" - "--tls-server : Enable TLS and assume server role during TLS handshake.\n" - "--tls-client : Enable TLS and assume client role during TLS handshake.\n" - "--key-method m : Data channel key exchange method. m should be a method\n" - " number, such as 1 (default), 2, etc.\n" - "--ca file : Certificate authority file in .pem format containing\n" - " root certificate.\n" - "--dh file : File containing Diffie Hellman parameters\n" - " in .pem format (for --tls-server only).\n" - " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n" - "--cert file : Local certificate in .pem format -- must be signed\n" - " by a Certificate Authority in --ca file.\n" - "--key file : Local private key in .pem format.\n" - "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n" - " and root CA certificate.\n" -#ifdef WIN32 - "--cryptoapicert select-string : Load the certificate and private key from the\n" - " Windows Certificate System Store.\n" -#endif - "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n" - " : Use --show-tls to see a list of supported TLS ciphers.\n" - "--tls-timeout n : Packet retransmit timeout on TLS control channel\n" - " if no ACK from remote within n seconds (default=%d).\n" - "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n" - "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n" - "--reneg-sec n : Renegotiate data chan. key after n seconds (default=%d).\n" - "--hand-window n : Data channel key exchange must finalize within n seconds\n" - " of handshake initiation by any peer (default=%d).\n" - "--tran-window n : Transition window -- old key can live this many seconds\n" - " after new key renegotiation begins (default=%d).\n" - "--single-session: Allow only one session (reset state on restart).\n" - "--tls-exit : Exit on TLS negotiation failure.\n" - "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n" - " control channel to protect against DoS attacks.\n" - " f (required) is a shared-secret passphrase file.\n" - " The optional d parameter controls key directionality,\n" - " see --secret option for more info.\n" - "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n" - "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n" - "--crl-verify crl: Check peer certificate against a CRL.\n" - "--tls-verify cmd: Execute shell command cmd to verify the X509 name of a\n" - " pending TLS connection that has otherwise passed all other\n" - " tests of certification. cmd should return 0 to allow\n" - " TLS handshake to proceed, or 1 to fail. (cmd is\n" - " executed as 'cmd certificate_depth X509_NAME_oneline')\n" - "--tls-remote x509name: Accept connections only from a host with X509 name\n" - " x509name. The remote host must also pass all other tests\n" - " of verification.\n" - "--ns-cert-type t: Require that peer certificate was signed with an explicit\n" - " nsCertType designation t = 'client' | 'server'.\n" -#endif /* USE_SSL */ - "\n" - "SSL Library information:\n" - "--show-ciphers : Show cipher algorithms to use with --cipher option.\n" - "--show-digests : Show message digest algorithms to use with --auth option.\n" - "--show-engines : Show hardware crypto accelerator engines (if available).\n" -#ifdef USE_SSL - "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n" -#endif -#ifdef WIN32 - "\n" - "Windows Specific:\n" - "--ip-win32 method : When using --ifconfig on Windows, set TAP-Win32 adapter\n" - " IP address using method = manual, netsh, ipapi, or\n" - " dynamic (default = ipapi).\n" - " Dynamic method allows two optional parameters:\n" - " offset: DHCP server address offset (> -256 and < 256).\n" - " If 0, use network address, if >0, take nth\n" - " address forward from network address, if <0,\n" - " take nth address backward from broadcast\n" - " address.\n" - " Default is 0.\n" - " lease-time: Lease time in seconds.\n" - " Default is one year.\n" - "--route-method : Which method to use for adding routes on Windows?\n" - " ipapi (default) -- Use IP helper API.\n" - " exe -- Call the route.exe shell command.\n" - "--dhcp-option type [parm] : Set extended TAP-Win32 properties, must\n" - " be used with --ip-win32 dynamic. For options\n" - " which allow multiple addresses,\n" - " --dhcp-option must be repeated.\n" - " DOMAIN name : Set DNS suffix\n" - " DNS addr : Set domain name server address(es)\n" - " NTP : Set NTP server address(es)\n" - " NBDD : Set NBDD server address(es)\n" - " WINS addr : Set WINS server address(es)\n" - " NBT type : Set NetBIOS over TCP/IP Node type\n" - " 1: B, 2: P, 4: M, 8: H\n" - " NBS id : Set NetBIOS scope ID\n" - " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n" - "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n" - "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n" -" startup.\n" - "--dhcp-release : Ask Windows to release the TAP adapter lease on shutdown.\n" - "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n" - " attempting to set adapter properties.\n" - "--pause-exit : When run from a console window, pause before exiting.\n" - "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n" - " service, and should not be used directly by end-users.\n" - " ex is the name of an event object which, when\n" - " signaled, will cause " PACKAGE_NAME " to exit. A second\n" - " optional parameter controls the initial state of ex.\n" - "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n" - " after TAP adapter is up and routes have been added.\n" - "Windows Standalone Options:\n" - "\n" - "--show-adapters : Show all TAP-Win32 adapters.\n" - "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n" - "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n" -#endif - "\n" - "Generate a random key (only for non-TLS static key encryption mode):\n" - "--genkey : Generate a random key to be used as a shared secret,\n" - " for use with the --secret option.\n" - "--secret file : Write key to file.\n" -#endif /* USE_CRYPTO */ -#ifdef TUNSETPERSIST - "\n" - "Tun/tap config mode (available with linux 2.4+):\n" - "--mktun : Create a persistent tunnel.\n" - "--rmtun : Remove a persistent tunnel.\n" - "--dev tunX|tapX : tun/tap device\n" - "--dev-type dt : Device type. See tunnel options above for details.\n" -#endif - ; - -#endif /* !ENABLE_SMALL */ - -/* - * This is where the options defaults go. - * Any option not explicitly set here - * will be set to 0. - */ -void -init_options (struct options *o) -{ - CLEAR (*o); - gc_init (&o->gc); - o->mode = MODE_POINT_TO_POINT; - o->proto = PROTO_UDPv4; - o->connect_retry_seconds = 5; - o->local_port = o->remote_port = OPENVPN_PORT; - o->verbosity = 1; - o->status_file_update_freq = 60; - o->status_file_version = 1; - o->bind_local = true; - o->tun_mtu = TUN_MTU_DEFAULT; - o->link_mtu = LINK_MTU_DEFAULT; - o->mtu_discover_type = -1; - o->mssfix = MSSFIX_DEFAULT; - o->route_delay_window = 30; - o->resolve_retry_seconds = RESOLV_RETRY_INFINITE; -#ifdef ENABLE_OCC - o->occ = true; -#endif -#ifdef ENABLE_MANAGEMENT - o->management_log_history_cache = 250; - o->management_echo_buffer_size = 100; - o->management_state_buffer_size = 100; -#endif -#ifdef TUNSETPERSIST - o->persist_mode = 1; -#endif -#ifndef WIN32 - o->rcvbuf = 65536; - o->sndbuf = 65536; -#endif -#ifdef USE_LZO - o->comp_lzo_adaptive = true; -#endif -#ifdef TARGET_LINUX - o->tuntap_options.txqueuelen = 100; -#endif -#ifdef WIN32 - o->tuntap_options.ip_win32_type = IPW32_SET_DHCP_MASQ; - o->tuntap_options.dhcp_lease_time = 31536000; /* one year */ - o->tuntap_options.dhcp_masq_offset = 0; /* use network address as internal DHCP server address */ - o->route_method = ROUTE_METHOD_IPAPI; -#endif -#ifdef USE_PTHREAD - o->n_threads = 1; -#endif -#if P2MP_SERVER - o->real_hash_size = 256; - o->virtual_hash_size = 256; - o->n_bcast_buf = 256; - o->tcp_queue_limit = 64; - o->max_clients = 1024; - o->max_routes_per_client = 256; - o->ifconfig_pool_persist_refresh_freq = 600; -#endif -#if P2MP - o->scheduled_exit_interval = 5; -#endif -#ifdef USE_CRYPTO - o->ciphername = "BF-CBC"; - o->ciphername_defined = true; - o->authname = "SHA1"; - o->authname_defined = true; - o->replay = true; - o->replay_window = DEFAULT_SEQ_BACKTRACK; - o->replay_time = DEFAULT_TIME_BACKTRACK; - o->use_iv = true; - o->key_direction = KEY_DIRECTION_BIDIRECTIONAL; -#ifdef USE_SSL - o->key_method = 2; - o->tls_timeout = 2; - o->renegotiate_seconds = 3600; - o->handshake_window = 60; - o->transition_window = 3600; -#endif -#endif -} - -void -uninit_options (struct options *o) -{ - gc_free (&o->gc); -} - -#ifdef ENABLE_DEBUG - -#define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value)) -#define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'") -#define SHOW_INT(var) SHOW_PARM(var, o->var, "%d") -#define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u") -#define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x") -#define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s"); - -#endif - -void -setenv_settings (struct env_set *es, const struct options *o) -{ - setenv_str (es, "config", o->config); - setenv_str (es, "proto", proto2ascii (o->proto, false)); - setenv_str (es, "local", o->local); - setenv_int (es, "local_port", o->local_port); - setenv_int (es, "verb", o->verbosity); - setenv_int (es, "daemon", o->daemon); - setenv_int (es, "daemon_log_redirect", o->log); - - if (o->remote_list) - { - int i; - - for (i = 0; i < o->remote_list->len; ++i) - { - char remote_string[64]; - char remote_port_string[64]; - - openvpn_snprintf (remote_string, sizeof (remote_string), "remote_%d", i+1); - openvpn_snprintf (remote_port_string, sizeof (remote_port_string), "remote_port_%d", i+1); - - setenv_str (es, remote_string, o->remote_list->array[i].hostname); - setenv_int (es, remote_port_string, o->remote_list->array[i].port); - } - } -} - -static in_addr_t -get_ip_addr (const char *ip_string, int msglevel, bool *error) -{ - unsigned int flags = GETADDR_HOST_ORDER; - bool succeeded = false; - in_addr_t ret; - - if (msglevel & M_FATAL) - flags |= GETADDR_FATAL; - - ret = getaddr (flags, ip_string, 0, &succeeded, NULL); - if (!succeeded && error) - *error = true; - return ret; -} - -static char * -string_substitute (const char *src, int from, int to, struct gc_arena *gc) -{ - char *ret = (char *) gc_malloc (strlen (src) + 1, true, gc); - char *dest = ret; - char c; - - do - { - c = *src++; - if (c == from) - c = to; - *dest++ = c; - } - while (c); - return ret; -} - -bool -is_persist_option (const struct options *o) -{ - return o->persist_tun - || o->persist_key - || o->persist_local_ip - || o->persist_remote_ip -#ifdef USE_PTHREAD - || o->n_threads >= 2 -#endif - ; -} - -bool -is_stateful_restart (const struct options *o) -{ - return is_persist_option (o) || (o->remote_list && o->remote_list->len > 1); -} - -#ifdef WIN32 - -#ifdef ENABLE_DEBUG - -static void -show_dhcp_option_addrs (const char *name, const in_addr_t *array, int len) -{ - struct gc_arena gc = gc_new (); - int i; - for (i = 0; i < len; ++i) - { - msg (D_SHOW_PARMS, " %s[%d] = %s", - name, - i, - print_in_addr_t (array[i], 0, &gc)); - } - gc_free (&gc); -} - -static void -show_tuntap_options (const struct tuntap_options *o) -{ - SHOW_BOOL (ip_win32_defined); - SHOW_INT (ip_win32_type); - SHOW_INT (dhcp_masq_offset); - SHOW_INT (dhcp_lease_time); - SHOW_INT (tap_sleep); - SHOW_BOOL (dhcp_options); - SHOW_BOOL (dhcp_renew); - SHOW_BOOL (dhcp_pre_release); - SHOW_BOOL (dhcp_release); - SHOW_STR (domain); - SHOW_STR (netbios_scope); - SHOW_INT (netbios_node_type); - SHOW_BOOL (disable_nbt); - - show_dhcp_option_addrs ("DNS", o->dns, o->dns_len); - show_dhcp_option_addrs ("WINS", o->wins, o->wins_len); - show_dhcp_option_addrs ("NTP", o->ntp, o->ntp_len); - show_dhcp_option_addrs ("NBDD", o->nbdd, o->nbdd_len); -} - -#endif - -static void -dhcp_option_address_parse (const char *name, const char *parm, in_addr_t *array, int *len, int msglevel) -{ - if (*len >= N_DHCP_ADDR) - { - msg (msglevel, "--dhcp-option %s: maximum of %d %s servers can be specified", - name, - N_DHCP_ADDR, - name); - } - else - { - bool error = false; - const in_addr_t addr = get_ip_addr (parm, msglevel, &error); - if (!error) - array[(*len)++] = addr; - } -} - -#endif - -#if P2MP - -#ifdef ENABLE_DEBUG - -static void -show_p2mp_parms (const struct options *o) -{ - struct gc_arena gc = gc_new (); - -#if P2MP_SERVER - msg (D_SHOW_PARMS, " server_network = %s", print_in_addr_t (o->server_network, 0, &gc)); - msg (D_SHOW_PARMS, " server_netmask = %s", print_in_addr_t (o->server_netmask, 0, &gc)); - msg (D_SHOW_PARMS, " server_bridge_ip = %s", print_in_addr_t (o->server_bridge_ip, 0, &gc)); - msg (D_SHOW_PARMS, " server_bridge_netmask = %s", print_in_addr_t (o->server_bridge_netmask, 0, &gc)); - msg (D_SHOW_PARMS, " server_bridge_pool_start = %s", print_in_addr_t (o->server_bridge_pool_start, 0, &gc)); - msg (D_SHOW_PARMS, " server_bridge_pool_end = %s", print_in_addr_t (o->server_bridge_pool_end, 0, &gc)); - if (o->push_list) - { - const struct push_list *l = o->push_list; - const char *printable_push_list = l->options; - msg (D_SHOW_PARMS, " push_list = '%s'", printable_push_list); - } - SHOW_BOOL (ifconfig_pool_defined); - msg (D_SHOW_PARMS, " ifconfig_pool_start = %s", print_in_addr_t (o->ifconfig_pool_start, 0, &gc)); - msg (D_SHOW_PARMS, " ifconfig_pool_end = %s", print_in_addr_t (o->ifconfig_pool_end, 0, &gc)); - msg (D_SHOW_PARMS, " ifconfig_pool_netmask = %s", print_in_addr_t (o->ifconfig_pool_netmask, 0, &gc)); - SHOW_STR (ifconfig_pool_persist_filename); - SHOW_INT (ifconfig_pool_persist_refresh_freq); - SHOW_BOOL (ifconfig_pool_linear); - SHOW_INT (n_bcast_buf); - SHOW_INT (tcp_queue_limit); - SHOW_INT (real_hash_size); - SHOW_INT (virtual_hash_size); - SHOW_STR (client_connect_script); - SHOW_STR (learn_address_script); - SHOW_STR (client_disconnect_script); - SHOW_STR (client_config_dir); - SHOW_BOOL (ccd_exclusive); - SHOW_STR (tmp_dir); - SHOW_BOOL (push_ifconfig_defined); - msg (D_SHOW_PARMS, " push_ifconfig_local = %s", print_in_addr_t (o->push_ifconfig_local, 0, &gc)); - msg (D_SHOW_PARMS, " push_ifconfig_remote_netmask = %s", print_in_addr_t (o->push_ifconfig_remote_netmask, 0, &gc)); - SHOW_BOOL (enable_c2c); - SHOW_BOOL (duplicate_cn); - SHOW_INT (cf_max); - SHOW_INT (cf_per); - SHOW_INT (max_clients); - SHOW_INT (max_routes_per_client); - SHOW_BOOL (client_cert_not_required); - SHOW_BOOL (username_as_common_name) - SHOW_STR (auth_user_pass_verify_script); - SHOW_BOOL (auth_user_pass_verify_script_via_file); -#endif /* P2MP_SERVER */ - - SHOW_BOOL (client); - SHOW_BOOL (pull); - SHOW_STR (auth_user_pass_file); - - gc_free (&gc); -} - -#endif /* ENABLE_DEBUG */ - -#if P2MP_SERVER - -static void -option_iroute (struct options *o, - const char *network_str, - const char *netmask_str, - int msglevel) -{ - struct iroute *ir; - - ALLOC_OBJ_GC (ir, struct iroute, &o->gc); - ir->network = getaddr (GETADDR_HOST_ORDER, network_str, 0, NULL, NULL); - ir->netbits = -1; - - if (netmask_str) - { - const in_addr_t netmask = getaddr (GETADDR_HOST_ORDER, netmask_str, 0, NULL, NULL); - if (!netmask_to_netbits (ir->network, netmask, &ir->netbits)) - { - msg (msglevel, "in --iroute %s %s : Bad network/subnet specification", - network_str, - netmask_str); - return; - } - } - - ir->next = o->iroutes; - o->iroutes = ir; -} - -#endif /* P2MP_SERVER */ -#endif /* P2MP */ - -#ifdef ENABLE_DEBUG -static void -show_remote_list (const struct remote_list *l) -{ - if (l) - { - int i; - for (i = 0; i < l->len; ++i) - { - msg (D_SHOW_PARMS, " remote_list[%d] = {'%s', %d}", - i, l->array[i].hostname, l->array[i].port); - } - } - else - { - msg (D_SHOW_PARMS, " remote_list = NULL"); - } -} -#endif - -#if defined(ENABLE_HTTP_PROXY) && defined(ENABLE_DEBUG) -static void -show_http_proxy_options (const struct http_proxy_options *o) -{ - msg (D_SHOW_PARMS, "BEGIN http_proxy"); - SHOW_STR (server); - SHOW_INT (port); - SHOW_STR (auth_method_string); - SHOW_STR (auth_file); - SHOW_BOOL (retry); - SHOW_INT (timeout); - SHOW_STR (http_version); - SHOW_STR (user_agent); - msg (D_SHOW_PARMS, "END http_proxy"); -} -#endif - -void -options_detach (struct options *o) -{ - gc_detach (&o->gc); - o->routes = NULL; -#if P2MP_SERVER - if (o->push_list) /* clone push_list */ - { - const struct push_list *old = o->push_list; - ALLOC_OBJ_GC (o->push_list, struct push_list, &o->gc); - strcpy (o->push_list->options, old->options); - } -#endif -} - -void -rol_check_alloc (struct options *options) -{ - if (!options->routes) - options->routes = new_route_option_list (&options->gc); -} - -void -show_settings (const struct options *o) -{ -#ifdef ENABLE_DEBUG - msg (D_SHOW_PARMS, "Current Parameter Settings:"); - - SHOW_STR (config); - - SHOW_INT (mode); - -#ifdef TUNSETPERSIST - SHOW_BOOL (persist_config); - SHOW_INT (persist_mode); -#endif - -#ifdef USE_CRYPTO - SHOW_BOOL (show_ciphers); - SHOW_BOOL (show_digests); - SHOW_BOOL (show_engines); - SHOW_BOOL (genkey); -#ifdef USE_SSL - SHOW_STR (key_pass_file); - SHOW_BOOL (show_tls_ciphers); -#endif -#endif - - SHOW_INT (proto); - SHOW_STR (local); - show_remote_list (o->remote_list); - SHOW_BOOL (remote_random); - - SHOW_INT (local_port); - SHOW_INT (remote_port); - SHOW_BOOL (remote_float); - SHOW_STR (ipchange); - SHOW_BOOL (bind_local); - SHOW_STR (dev); - SHOW_STR (dev_type); - SHOW_STR (dev_node); - SHOW_BOOL (tun_ipv6); - SHOW_STR (ifconfig_local); - SHOW_STR (ifconfig_remote_netmask); - SHOW_BOOL (ifconfig_noexec); - SHOW_BOOL (ifconfig_nowarn); - -#ifdef HAVE_GETTIMEOFDAY - SHOW_INT (shaper); -#endif - SHOW_INT (tun_mtu); - SHOW_BOOL (tun_mtu_defined); - SHOW_INT (link_mtu); - SHOW_BOOL (link_mtu_defined); - SHOW_INT (tun_mtu_extra); - SHOW_BOOL (tun_mtu_extra_defined); - -#ifdef ENABLE_FRAGMENT - SHOW_INT (fragment); -#endif - - SHOW_INT (mtu_discover_type); - -#ifdef ENABLE_OCC - SHOW_INT (mtu_test); -#endif - - SHOW_BOOL (mlock); - - SHOW_INT (keepalive_ping); - SHOW_INT (keepalive_timeout); - SHOW_INT (inactivity_timeout); - SHOW_INT (ping_send_timeout); - SHOW_INT (ping_rec_timeout); - SHOW_INT (ping_rec_timeout_action); - SHOW_BOOL (ping_timer_remote); - SHOW_INT (remap_sigusr1); -#ifdef ENABLE_OCC - SHOW_INT (explicit_exit_notification); -#endif - SHOW_BOOL (persist_tun); - SHOW_BOOL (persist_local_ip); - SHOW_BOOL (persist_remote_ip); - SHOW_BOOL (persist_key); - - SHOW_INT (mssfix); - -#if PASSTOS_CAPABILITY - SHOW_BOOL (passtos); -#endif - - SHOW_INT (resolve_retry_seconds); - SHOW_INT (connect_retry_seconds); - - SHOW_STR (username); - SHOW_STR (groupname); - SHOW_STR (chroot_dir); - SHOW_STR (cd_dir); - SHOW_STR (writepid); - SHOW_STR (up_script); - SHOW_STR (down_script); - SHOW_BOOL (down_pre); - SHOW_BOOL (up_restart); - SHOW_BOOL (up_delay); - SHOW_BOOL (daemon); - SHOW_INT (inetd); - SHOW_BOOL (log); - SHOW_BOOL (suppress_timestamps); - SHOW_INT (nice); - SHOW_INT (verbosity); - SHOW_INT (mute); -#ifdef ENABLE_DEBUG - SHOW_INT (gremlin); -#endif - SHOW_STR (status_file); - SHOW_INT (status_file_version); - SHOW_INT (status_file_update_freq); - -#ifdef ENABLE_OCC - SHOW_BOOL (occ); -#endif - SHOW_INT (rcvbuf); - SHOW_INT (sndbuf); - -#ifdef ENABLE_HTTP_PROXY - if (o->http_proxy_options) - show_http_proxy_options (o->http_proxy_options); -#endif - -#ifdef ENABLE_SOCKS - SHOW_STR (socks_proxy_server); - SHOW_INT (socks_proxy_port); - SHOW_BOOL (socks_proxy_retry); -#endif - - SHOW_BOOL (fast_io); - -#ifdef USE_LZO - SHOW_BOOL (comp_lzo); - SHOW_BOOL (comp_lzo_adaptive); -#endif - - SHOW_STR (route_script); - SHOW_STR (route_default_gateway); - SHOW_BOOL (route_noexec); - SHOW_INT (route_delay); - SHOW_INT (route_delay_window); - SHOW_BOOL (route_delay_defined); - if (o->routes) - print_route_options (o->routes, D_SHOW_PARMS); - -#ifdef ENABLE_MANAGEMENT - SHOW_STR (management_addr); - SHOW_INT (management_port); - SHOW_STR (management_user_pass); - SHOW_INT (management_log_history_cache); - SHOW_INT (management_echo_buffer_size); - SHOW_BOOL (management_query_passwords); - SHOW_BOOL (management_hold); -#endif -#ifdef ENABLE_PLUGIN - if (o->plugin_list) - plugin_option_list_print (o->plugin_list, D_SHOW_PARMS); -#endif - -#ifdef USE_CRYPTO - SHOW_STR (shared_secret_file); - SHOW_INT (key_direction); - SHOW_BOOL (ciphername_defined); - SHOW_STR (ciphername); - SHOW_BOOL (authname_defined); - SHOW_STR (authname); - SHOW_INT (keysize); - SHOW_BOOL (engine); - SHOW_BOOL (replay); - SHOW_BOOL (mute_replay_warnings); - SHOW_INT (replay_window); - SHOW_INT (replay_time); - SHOW_STR (packet_id_file); - SHOW_BOOL (use_iv); - SHOW_BOOL (test_crypto); - -#ifdef USE_SSL - SHOW_BOOL (tls_server); - SHOW_BOOL (tls_client); - SHOW_INT (key_method); - SHOW_STR (ca_file); - SHOW_STR (dh_file); - SHOW_STR (cert_file); - SHOW_STR (priv_key_file); - SHOW_STR (pkcs12_file); -#ifdef WIN32 - SHOW_STR (cryptoapi_cert); -#endif - SHOW_STR (cipher_list); - SHOW_STR (tls_verify); - SHOW_STR (tls_remote); - SHOW_STR (crl_file); - SHOW_INT (ns_cert_type); - - SHOW_INT (tls_timeout); - - SHOW_INT (renegotiate_bytes); - SHOW_INT (renegotiate_packets); - SHOW_INT (renegotiate_seconds); - - SHOW_INT (handshake_window); - SHOW_INT (transition_window); - - SHOW_BOOL (single_session); - SHOW_BOOL (tls_exit); - - SHOW_STR (tls_auth_file); -#endif -#endif - -#if P2MP - show_p2mp_parms (o); -#endif - -#ifdef WIN32 - SHOW_BOOL (show_net_up); - SHOW_INT (route_method); - show_tuntap_options (&o->tuntap_options); -#endif -#endif -} - -#undef SHOW_PARM -#undef SHOW_STR -#undef SHOW_INT -#undef SHOW_BOOL - -#ifdef ENABLE_HTTP_PROXY - -struct http_proxy_options * -init_http_options_if_undefined (struct options *o) -{ - if (!o->http_proxy_options) - { - ALLOC_OBJ_CLEAR_GC (o->http_proxy_options, struct http_proxy_options, &o->gc); - /* http proxy defaults */ - o->http_proxy_options->timeout = 5; - o->http_proxy_options->http_version = "1.0"; - } - return o->http_proxy_options; -} - -#endif - -/* - * Sanity check on options. - * Also set some options based on other - * options. - */ -void -options_postprocess (struct options *options, bool first_time) -{ - struct options defaults; - int dev = DEV_TYPE_UNDEF; - int i; - bool pull = false; - - init_options (&defaults); - -#ifdef USE_CRYPTO - if (options->test_crypto) - { - notnull (options->shared_secret_file, "key file (--secret)"); - } - else -#endif - notnull (options->dev, "TUN/TAP device (--dev)"); - - /* - * Get tun/tap/null device type - */ - dev = dev_type_enum (options->dev, options->dev_type); - - /* - * Fill in default port number for --remote list - */ - if (options->remote_list) - { - for (i = 0; i < options->remote_list->len; ++i) - { - struct remote_entry *e = &options->remote_list->array[i]; - if (e->port < 0) - e->port = options->remote_port; - } - } - - /* - * If --mssfix is supplied without a parameter, default - * it to --fragment value, if --fragment is specified. - */ - if (options->mssfix_default) - { -#ifdef ENABLE_FRAGMENT - if (options->fragment) - options->mssfix = options->fragment; -#else - msg (M_USAGE, "--mssfix must specify a parameter"); -#endif - } - - /* - * Sanity check on daemon/inetd modes - */ - - if (options->daemon && options->inetd) - msg (M_USAGE, "only one of --daemon or --inetd may be specified"); - - if (options->inetd && (options->local || options->remote_list)) - msg (M_USAGE, "--local or --remote cannot be used with --inetd"); - - if (options->inetd && options->proto == PROTO_TCPv4_CLIENT) - msg (M_USAGE, "--proto tcp-client cannot be used with --inetd"); - - if (options->inetd == INETD_NOWAIT && options->proto != PROTO_TCPv4_SERVER) - msg (M_USAGE, "--inetd nowait can only be used with --proto tcp-server"); - - if (options->inetd == INETD_NOWAIT -#if defined(USE_CRYPTO) && defined(USE_SSL) - && !(options->tls_server || options->tls_client) -#endif - ) - msg (M_USAGE, "--inetd nowait can only be used in TLS mode"); - - if (options->inetd == INETD_NOWAIT && dev != DEV_TYPE_TAP) - msg (M_USAGE, "--inetd nowait only makes sense in --dev tap mode"); - - /* - * In forking TCP server mode, you don't need to ifconfig - * the tap device (the assumption is that it will be bridged). - */ - if (options->inetd == INETD_NOWAIT) - options->ifconfig_noexec = true; - - /* - * Sanity check on TCP mode options - */ - - if (options->connect_retry_defined && options->proto != PROTO_TCPv4_CLIENT) - msg (M_USAGE, "--connect-retry doesn't make sense unless also used with --proto tcp-client"); - - /* - * Sanity check on MTU parameters - */ - if (options->tun_mtu_defined && options->link_mtu_defined) - msg (M_USAGE, "only one of --tun-mtu or --link-mtu may be defined (note that --ifconfig implies --link-mtu %d)", LINK_MTU_DEFAULT); - -#ifdef ENABLE_OCC - if (options->proto != PROTO_UDPv4 && options->mtu_test) - msg (M_USAGE, "--mtu-test only makes sense with --proto udp"); -#endif - - /* - * Set MTU defaults - */ - { - if (!options->tun_mtu_defined && !options->link_mtu_defined) - { - options->tun_mtu_defined = true; - } - if ((dev == DEV_TYPE_TAP) && !options->tun_mtu_extra_defined) - { - options->tun_mtu_extra_defined = true; - options->tun_mtu_extra = TAP_MTU_EXTRA_DEFAULT; - } - } - - /* - * Process helper-type options which map to other, more complex - * sequences of options. - */ - helper_client_server (options); - helper_keepalive (options); - - /* will we be pulling options from server? */ -#if P2MP - pull = options->pull; -#endif - - /* - * Sanity check on --local, --remote, and --ifconfig - */ - - if (options->remote_list) - { - int i; - struct remote_list *l = options->remote_list; - - for (i = 0; i < l->len; ++i) - { - const char *remote = l->array[i].hostname; - const int remote_port = l->array[i].port; - - if (string_defined_equal (options->local, remote) - && options->local_port == remote_port) - msg (M_USAGE, "--remote and --local addresses are the same"); - - if (string_defined_equal (remote, options->ifconfig_local) - || string_defined_equal (remote, options->ifconfig_remote_netmask)) - msg (M_USAGE, "--local and --remote addresses must be distinct from --ifconfig addresses"); - } - } - - if (string_defined_equal (options->local, options->ifconfig_local) - || string_defined_equal (options->local, options->ifconfig_remote_netmask)) - msg (M_USAGE, "--local addresses must be distinct from --ifconfig addresses"); - - if (string_defined_equal (options->ifconfig_local, options->ifconfig_remote_netmask)) - msg (M_USAGE, "local and remote/netmask --ifconfig addresses must be different"); - - if (options->local_port_defined && !options->bind_local) - msg (M_USAGE, "--lport and --nobind don't make sense when used together"); - - if (!options->remote_list && !options->bind_local) - msg (M_USAGE, "--nobind doesn't make sense unless used with --remote"); - - /* - * Check for consistency of management options - */ -#ifdef ENABLE_MANAGEMENT - if (!options->management_addr && - (options->management_query_passwords || options->management_hold - || options->management_log_history_cache != defaults.management_log_history_cache)) - msg (M_USAGE, "--management is not specified, however one or more options which modify the behavior of --management were specified"); -#endif - - /* - * Windows-specific options. - */ - -#ifdef WIN32 - if (dev == DEV_TYPE_TUN && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask))) - msg (M_USAGE, "On Windows, --ifconfig is required when --dev tun is used"); - - if ((options->tuntap_options.ip_win32_defined) - && !(pull || (options->ifconfig_local && options->ifconfig_remote_netmask))) - msg (M_USAGE, "On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used"); - - if (options->tuntap_options.dhcp_options && - options->tuntap_options.ip_win32_type != IPW32_SET_DHCP_MASQ) - msg (M_USAGE, "--dhcp-options requires --ip-win32 dynamic"); - - if ((dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP) && !options->route_delay_defined) - { - options->route_delay_defined = true; - options->route_delay = 0; - } - - if (options->ifconfig_noexec) - { - options->tuntap_options.ip_win32_type = IPW32_SET_MANUAL; - options->ifconfig_noexec = false; - } -#endif - - /* - * Check that protocol options make sense. - */ - -#ifdef ENABLE_FRAGMENT - if (options->proto != PROTO_UDPv4 && options->fragment) - msg (M_USAGE, "--fragment can only be used with --proto udp"); -#endif - -#ifdef ENABLE_OCC - if (options->proto != PROTO_UDPv4 && options->explicit_exit_notification) - msg (M_USAGE, "--explicit-exit-notify can only be used with --proto udp"); -#endif - - if (!options->remote_list && options->proto == PROTO_TCPv4_CLIENT) - msg (M_USAGE, "--remote MUST be used in TCP Client mode"); - -#ifdef ENABLE_HTTP_PROXY - if (options->http_proxy_options && options->proto != PROTO_TCPv4_CLIENT) - msg (M_USAGE, "--http-proxy MUST be used in TCP Client mode (i.e. --proto tcp-client)"); -#endif - -#if defined(ENABLE_HTTP_PROXY) && defined(ENABLE_SOCKS) - if (options->http_proxy_options && options->socks_proxy_server) - msg (M_USAGE, "--http-proxy can not be used together with --socks-proxy"); -#endif - -#ifdef ENABLE_SOCKS - if (options->socks_proxy_server && options->proto == PROTO_TCPv4_SERVER) - msg (M_USAGE, "--socks-proxy can not be used in TCP Server mode"); -#endif - - if (options->proto == PROTO_TCPv4_SERVER && remote_list_len (options->remote_list) > 1) - msg (M_USAGE, "TCP server mode allows at most one --remote address"); - -#if P2MP_SERVER - - /* - * Check consistency of --mode server options. - */ - if (options->mode == MODE_SERVER) - { -#ifdef WIN32 - /* - * We need to explicitly set --tap-sleep because - * we do not schedule event timers in the top-level context. - */ - options->tuntap_options.tap_sleep = 10; - if (options->route_delay_defined && options->route_delay) - options->tuntap_options.tap_sleep = options->route_delay; - options->route_delay_defined = false; -#endif - - if (!(dev == DEV_TYPE_TUN || dev == DEV_TYPE_TAP)) - msg (M_USAGE, "--mode server only works with --dev tun or --dev tap"); - if (options->pull) - msg (M_USAGE, "--pull cannot be used with --mode server"); - if (!(options->proto == PROTO_UDPv4 || options->proto == PROTO_TCPv4_SERVER)) - msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server"); - if (!options->tls_server) - msg (M_USAGE, "--mode server requires --tls-server"); - if (options->remote_list) - msg (M_USAGE, "--remote cannot be used with --mode server"); - if (!options->bind_local) - msg (M_USAGE, "--nobind cannot be used with --mode server"); -#ifdef ENABLE_HTTP_PROXY - if (options->http_proxy_options) - msg (M_USAGE, "--http-proxy cannot be used with --mode server"); -#endif -#ifdef ENABLE_SOCKS - if (options->socks_proxy_server) - msg (M_USAGE, "--socks-proxy cannot be used with --mode server"); -#endif - if (options->tun_ipv6) - msg (M_USAGE, "--tun-ipv6 cannot be used with --mode server"); - if (options->shaper) - msg (M_USAGE, "--shaper cannot be used with --mode server"); - if (options->inetd) - msg (M_USAGE, "--inetd cannot be used with --mode server"); - if (options->ipchange) - msg (M_USAGE, "--ipchange cannot be used with --mode server (use --client-connect instead)"); - if (!(options->proto == PROTO_UDPv4 || options->proto == PROTO_TCPv4_SERVER)) - msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server"); - if (options->proto != PROTO_UDPv4 && (options->cf_max || options->cf_per)) - msg (M_USAGE, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead."); - if (dev != DEV_TYPE_TAP && options->ifconfig_pool_netmask) - msg (M_USAGE, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode"); -#ifdef ENABLE_OCC - if (options->explicit_exit_notification) - msg (M_USAGE, "--explicit-exit-notify cannot be used with --mode server"); -#endif - if (options->routes && options->routes->redirect_default_gateway) - msg (M_USAGE, "--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)"); - if (options->route_delay_defined) - msg (M_USAGE, "--route-delay cannot be used with --mode server"); - if (options->up_delay) - msg (M_USAGE, "--up-delay cannot be used with --mode server"); - if (!options->ifconfig_pool_defined && options->ifconfig_pool_persist_filename) - msg (M_USAGE, "--ifconfig-pool-persist must be used with --ifconfig-pool"); - if (options->auth_user_pass_file) - msg (M_USAGE, "--auth-user-pass cannot be used with --mode server (it should be used on the client side only)"); - if (options->ccd_exclusive && !options->client_config_dir) - msg (M_USAGE, "--ccd-exclusive must be used with --client-config-dir"); - if (options->key_method != 2) - msg (M_USAGE, "--mode server requires --key-method 2"); - - if (PLUGIN_OPTION_LIST (options) == NULL) - { - if (options->client_cert_not_required && !options->auth_user_pass_verify_script) - msg (M_USAGE, "--client-cert-not-required must be used with an --auth-user-pass-verify script"); - if (options->username_as_common_name && !options->auth_user_pass_verify_script) - msg (M_USAGE, "--username-as-common-name must be used with an --auth-user-pass-verify script"); - } - } - else - { - /* - * When not in server mode, err if parameters are - * specified which require --mode server. - */ - if (options->ifconfig_pool_defined || options->ifconfig_pool_persist_filename) - msg (M_USAGE, "--ifconfig-pool/--ifconfig-pool-persist requires --mode server"); - if (options->real_hash_size != defaults.real_hash_size - || options->virtual_hash_size != defaults.virtual_hash_size) - msg (M_USAGE, "--hash-size requires --mode server"); - if (options->learn_address_script) - msg (M_USAGE, "--learn-address requires --mode server"); - if (options->client_connect_script) - msg (M_USAGE, "--client-connect requires --mode server"); - if (options->client_disconnect_script) - msg (M_USAGE, "--client-disconnect requires --mode server"); - if (options->tmp_dir) - msg (M_USAGE, "--tmp-dir requires --mode server"); - if (options->client_config_dir || options->ccd_exclusive) - msg (M_USAGE, "--client-config-dir/--ccd-exclusive requires --mode server"); - if (options->enable_c2c) - msg (M_USAGE, "--client-to-client requires --mode server"); - if (options->duplicate_cn) - msg (M_USAGE, "--duplicate-cn requires --mode server"); - if (options->cf_max || options->cf_per) - msg (M_USAGE, "--connect-freq requires --mode server"); - if (options->client_cert_not_required) - msg (M_USAGE, "--client-cert-not-required requires --mode server"); - if (options->username_as_common_name) - msg (M_USAGE, "--username-as-common-name requires --mode server"); - if (options->auth_user_pass_verify_script) - msg (M_USAGE, "--auth-user-pass-verify requires --mode server"); - if (options->ifconfig_pool_linear) - msg (M_USAGE, "--ifconfig-pool-linear requires --mode server"); - } -#endif /* P2MP_SERVER */ - -#ifdef USE_CRYPTO - - /* - * Check consistency of replay options - */ - if ((options->proto != PROTO_UDPv4) - && (options->replay_window != defaults.replay_window - || options->replay_time != defaults.replay_time)) - msg (M_USAGE, "--replay-window only makes sense with --proto udp"); - - if (!options->replay - && (options->replay_window != defaults.replay_window - || options->replay_time != defaults.replay_time)) - msg (M_USAGE, "--replay-window doesn't make sense when replay protection is disabled with --no-replay"); - - /* - * Don't use replay window for TCP mode (i.e. require that packets - * be strictly in sequence). - */ - if (link_socket_proto_connection_oriented (options->proto)) - options->replay_window = options->replay_time = 0; - - /* - * SSL/TLS mode sanity checks. - */ - -#ifdef USE_SSL - if (options->tls_server + options->tls_client + - (options->shared_secret_file != NULL) > 1) - msg (M_USAGE, "specify only one of --tls-server, --tls-client, or --secret"); - - if (options->tls_server) - { - notnull (options->dh_file, "DH file (--dh)"); - } - if (options->tls_server || options->tls_client) - { -#ifdef WIN32 - if (options->cryptoapi_cert) - { - notnull (options->ca_file, "CA file (--ca)"); - if (options->cert_file) - msg(M_USAGE, "Parameter --cert cannot be used when --cryptoapicert is also specified."); - if (options->priv_key_file) - msg(M_USAGE, "Parameter --key cannot be used when --cryptoapicert is also specified."); - if (options->pkcs12_file) - msg(M_USAGE, "Parameter --pkcs12 cannot be used when --cryptoapicert is also specified."); - } - else -#endif - if (options->pkcs12_file) - { - if (options->ca_file) - msg(M_USAGE, "Parameter --ca cannot be used when --pkcs12 is also specified."); - if (options->cert_file) - msg(M_USAGE, "Parameter --cert cannot be used when --pkcs12 is also specified."); - if (options->priv_key_file) - msg(M_USAGE, "Parameter --key cannot be used when --pkcs12 is also specified."); - } - else - { - notnull (options->ca_file, "CA file (--ca) or PKCS#12 file (--pkcs12)"); - if (pull) - { - const int sum = (options->cert_file != NULL) + (options->priv_key_file != NULL); - if (sum == 0) - { -#if P2MP - if (!options->auth_user_pass_file) -#endif - msg (M_USAGE, "No client-side authentication method is specified. You must use either --cert/--key, --pkcs12, or --auth-user-pass"); - } - else if (sum == 2) - ; - else - { - msg (M_USAGE, "If you use one of --cert or --key, you must use them both"); - } - } - else - { - notnull (options->cert_file, "certificate file (--cert) or PKCS#12 file (--pkcs12)"); - notnull (options->priv_key_file, "private key file (--key) or PKCS#12 file (--pkcs12)"); - } - } - } - else - { - /* - * Make sure user doesn't specify any TLS options - * when in non-TLS mode. - */ - -#define MUST_BE_UNDEF(parm) if (options->parm != defaults.parm) msg (M_USAGE, err, #parm); - - const char err[] = "Parameter %s can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified."; - - MUST_BE_UNDEF (ca_file); - MUST_BE_UNDEF (dh_file); - MUST_BE_UNDEF (cert_file); - MUST_BE_UNDEF (priv_key_file); - MUST_BE_UNDEF (pkcs12_file); - MUST_BE_UNDEF (cipher_list); - MUST_BE_UNDEF (tls_verify); - MUST_BE_UNDEF (tls_remote); - MUST_BE_UNDEF (tls_timeout); - MUST_BE_UNDEF (renegotiate_bytes); - MUST_BE_UNDEF (renegotiate_packets); - MUST_BE_UNDEF (renegotiate_seconds); - MUST_BE_UNDEF (handshake_window); - MUST_BE_UNDEF (transition_window); - MUST_BE_UNDEF (tls_auth_file); - MUST_BE_UNDEF (single_session); - MUST_BE_UNDEF (tls_exit); - MUST_BE_UNDEF (crl_file); - MUST_BE_UNDEF (key_method); - MUST_BE_UNDEF (ns_cert_type); - - if (pull) - msg (M_USAGE, err, "--pull"); - } -#undef MUST_BE_UNDEF -#endif /* USE_CRYPTO */ -#endif /* USE_SSL */ - -#if P2MP - /* - * In pull mode, we usually import --ping/--ping-restart parameters from - * the server. However we should also set an initial default --ping-restart - * for the period of time before we pull the --ping-restart parameter - * from the server. - */ - if (options->pull - && options->ping_rec_timeout_action == PING_UNDEF - && options->proto == PROTO_UDPv4) - { - options->ping_rec_timeout = PRE_PULL_INITIAL_PING_RESTART; - options->ping_rec_timeout_action = PING_RESTART; - } - - if (options->auth_user_pass_file && !options->pull) - msg (M_USAGE, "--auth-user-pass requires --pull"); - - /* - * Save certain parms before modifying options via --pull - */ - pre_pull_save (options); -#endif -} - -#if P2MP - -/* - * Save/Restore certain option defaults before --pull is applied. - */ - -void -pre_pull_save (struct options *o) -{ - if (o->pull) - { - ALLOC_OBJ_CLEAR_GC (o->pre_pull, struct options_pre_pull, &o->gc); - o->pre_pull->tuntap_options = o->tuntap_options; - o->pre_pull->tuntap_options_defined = true; - o->pre_pull->foreign_option_index = o->foreign_option_index; - if (o->routes) - { - o->pre_pull->routes = *o->routes; - o->pre_pull->routes_defined = true; - } - } -} - -void -pre_pull_restore (struct options *o) -{ - const struct options_pre_pull *pp = o->pre_pull; - if (pp) - { - CLEAR (o->tuntap_options); - if (pp->tuntap_options_defined) - o->tuntap_options = pp->tuntap_options; - - if (pp->routes_defined) - { - rol_check_alloc (o); - *o->routes = pp->routes; - } - else - o->routes = NULL; - - o->foreign_option_index = pp->foreign_option_index; - } -} - -#endif - -#ifdef ENABLE_OCC - -/* - * Build an options string to represent data channel encryption options. - * This string must match exactly between peers. The keysize is checked - * separately by read_key(). - * - * The following options must match on both peers: - * - * Tunnel options: - * - * --dev tun|tap [unit number need not match] - * --dev-type tun|tap - * --link-mtu - * --udp-mtu - * --tun-mtu - * --proto udp - * --proto tcp-client [matched with --proto tcp-server - * on the other end of the connection] - * --proto tcp-server [matched with --proto tcp-client on - * the other end of the connection] - * --tun-ipv6 - * --ifconfig x y [matched with --ifconfig y x on - * the other end of the connection] - * - * --comp-lzo - * --fragment - * - * Crypto Options: - * - * --cipher - * --auth - * --keysize - * --secret - * --no-replay - * --no-iv - * - * SSL Options: - * - * --tls-auth - * --tls-client [matched with --tls-server on - * the other end of the connection] - * --tls-server [matched with --tls-client on - * the other end of the connection] - */ - -char * -options_string (const struct options *o, - const struct frame *frame, - struct tuntap *tt, - bool remote, - struct gc_arena *gc) -{ - struct buffer out = alloc_buf (OPTION_LINE_SIZE); - bool tt_local = false; - - buf_printf (&out, "V4"); - - /* - * Tunnel Options - */ - - buf_printf (&out, ",dev-type %s", dev_type_string (o->dev, o->dev_type)); - buf_printf (&out, ",link-mtu %d", EXPANDED_SIZE (frame)); - buf_printf (&out, ",tun-mtu %d", PAYLOAD_SIZE (frame)); - buf_printf (&out, ",proto %s", proto2ascii (proto_remote (o->proto, remote), true)); - if (o->tun_ipv6) - buf_printf (&out, ",tun-ipv6"); - - /* - * Try to get ifconfig parameters into the options string. - * If tt is undefined, make a temporary instantiation. - */ - if (!tt) - { - tt = init_tun (o->dev, - o->dev_type, - o->ifconfig_local, - o->ifconfig_remote_netmask, - (in_addr_t)0, - (in_addr_t)0, - false, - NULL); - if (tt) - tt_local = true; - } - - if (tt && o->mode == MODE_POINT_TO_POINT && !PULL_DEFINED(o)) - { - const char *ios = ifconfig_options_string (tt, remote, o->ifconfig_nowarn, gc); - if (ios && strlen (ios)) - buf_printf (&out, ",ifconfig %s", ios); - } - if (tt_local) - { - free (tt); - tt = NULL; - } - -#ifdef USE_LZO - if (o->comp_lzo) - buf_printf (&out, ",comp-lzo"); -#endif - -#ifdef ENABLE_FRAGMENT - if (o->fragment) - buf_printf (&out, ",mtu-dynamic"); -#endif - -#ifdef USE_CRYPTO - -#ifdef USE_SSL -#define TLS_CLIENT (o->tls_client) -#define TLS_SERVER (o->tls_server) -#else -#define TLS_CLIENT (false) -#define TLS_SERVER (false) -#endif - - /* - * Key direction - */ - { - const char *kd = keydirection2ascii (o->key_direction, remote); - if (kd) - buf_printf (&out, ",keydir %s", kd); - } - - /* - * Crypto Options - */ - if (o->shared_secret_file || TLS_CLIENT || TLS_SERVER) - { - struct key_type kt; - - ASSERT ((o->shared_secret_file != NULL) - + (TLS_CLIENT == true) - + (TLS_SERVER == true) - <= 1); - - init_key_type (&kt, o->ciphername, o->ciphername_defined, - o->authname, o->authname_defined, - o->keysize, true, false); - - buf_printf (&out, ",cipher %s", kt_cipher_name (&kt)); - buf_printf (&out, ",auth %s", kt_digest_name (&kt)); - buf_printf (&out, ",keysize %d", kt_key_size (&kt)); - if (o->shared_secret_file) - buf_printf (&out, ",secret"); - if (!o->replay) - buf_printf (&out, ",no-replay"); - if (!o->use_iv) - buf_printf (&out, ",no-iv"); - } - -#ifdef USE_SSL - /* - * SSL Options - */ - { - if (TLS_CLIENT || TLS_SERVER) - { - if (o->tls_auth_file) - buf_printf (&out, ",tls-auth"); - - if (o->key_method > 1) - buf_printf (&out, ",key-method %d", o->key_method); - } - - if (remote) - { - if (TLS_CLIENT) - buf_printf (&out, ",tls-server"); - else if (TLS_SERVER) - buf_printf (&out, ",tls-client"); - } - else - { - if (TLS_CLIENT) - buf_printf (&out, ",tls-client"); - else if (TLS_SERVER) - buf_printf (&out, ",tls-server"); - } - } -#endif /* USE_SSL */ - -#undef TLS_CLIENT -#undef TLS_SERVER - -#endif /* USE_CRYPTO */ - - return BSTR (&out); -} - -/* - * Compare option strings for equality. - * If the first two chars of the strings differ, it means that - * we are looking at different versions of the options string, - * therefore don't compare them and return true. - */ - -bool -options_cmp_equal (char *actual, const char *expected) -{ - return options_cmp_equal_safe (actual, expected, strlen (actual) + 1); -} - -void -options_warning (char *actual, const char *expected) -{ - options_warning_safe (actual, expected, strlen (actual) + 1); -} - -static const char * -options_warning_extract_parm1 (const char *option_string, - struct gc_arena *gc_ret) -{ - struct gc_arena gc = gc_new (); - struct buffer b = string_alloc_buf (option_string, &gc); - char *p = gc_malloc (OPTION_PARM_SIZE, false, &gc); - const char *ret; - - buf_parse (&b, ' ', p, OPTION_PARM_SIZE); - ret = string_alloc (p, gc_ret); - gc_free (&gc); - return ret; -} - -static void -options_warning_safe_scan2 (const int msglevel, - const int delim, - const bool report_inconsistent, - const char *p1, - const struct buffer *b2_src, - const char *b1_name, - const char *b2_name) -{ - if (strlen (p1) > 0) - { - struct gc_arena gc = gc_new (); - struct buffer b2 = *b2_src; - const char *p1_prefix = options_warning_extract_parm1 (p1, &gc); - char *p2 = gc_malloc (OPTION_PARM_SIZE, false, &gc); - - while (buf_parse (&b2, delim, p2, OPTION_PARM_SIZE)) - { - if (strlen (p2)) - { - const char *p2_prefix = options_warning_extract_parm1 (p2, &gc); - - if (!strcmp (p1, p2)) - goto done; - if (!strcmp (p1_prefix, p2_prefix)) - { - if (report_inconsistent) - msg (msglevel, "WARNING: '%s' is used inconsistently, %s='%s', %s='%s'", - safe_print (p1_prefix, &gc), - b1_name, - safe_print (p1, &gc), - b2_name, - safe_print (p2, &gc)); - goto done; - } - } - } - - msg (msglevel, "WARNING: '%s' is present in %s config but missing in %s config, %s='%s'", - safe_print (p1_prefix, &gc), - b1_name, - b2_name, - b1_name, - safe_print (p1, &gc)); - - done: - gc_free (&gc); - } -} - -static void -options_warning_safe_scan1 (const int msglevel, - const int delim, - const bool report_inconsistent, - const struct buffer *b1_src, - const struct buffer *b2_src, - const char *b1_name, - const char *b2_name) -{ - struct gc_arena gc = gc_new (); - struct buffer b = *b1_src; - char *p = gc_malloc (OPTION_PARM_SIZE, true, &gc); - - while (buf_parse (&b, delim, p, OPTION_PARM_SIZE)) - options_warning_safe_scan2 (msglevel, delim, report_inconsistent, p, b2_src, b1_name, b2_name); - - gc_free (&gc); -} - -static void -options_warning_safe_ml (const int msglevel, char *actual, const char *expected, size_t actual_n) -{ - struct gc_arena gc = gc_new (); - - if (actual_n > 0) - { - struct buffer local = alloc_buf_gc (OPTION_PARM_SIZE + 16, &gc); - struct buffer remote = alloc_buf_gc (OPTION_PARM_SIZE + 16, &gc); - actual[actual_n - 1] = 0; - - buf_printf (&local, "version %s", expected); - buf_printf (&remote, "version %s", actual); - - options_warning_safe_scan1 (msglevel, ',', true, - &local, &remote, - "local", "remote"); - - options_warning_safe_scan1 (msglevel, ',', false, - &remote, &local, - "remote", "local"); - } - - gc_free (&gc); -} - -bool -options_cmp_equal_safe (char *actual, const char *expected, size_t actual_n) -{ - struct gc_arena gc = gc_new (); - bool ret = true; - - if (actual_n > 0) - { - actual[actual_n - 1] = 0; -#ifndef STRICT_OPTIONS_CHECK - if (strncmp (actual, expected, 2)) - { - msg (D_SHOW_OCC, "NOTE: Options consistency check may be skewed by version differences"); - options_warning_safe_ml (D_SHOW_OCC, actual, expected, actual_n); - } - else -#endif - ret = !strcmp (actual, expected); - } - gc_free (&gc); - return ret; -} - -void -options_warning_safe (char *actual, const char *expected, size_t actual_n) -{ - options_warning_safe_ml (M_WARN, actual, expected, actual_n); -} - -const char * -options_string_version (const char* s, struct gc_arena *gc) -{ - struct buffer out = alloc_buf_gc (4, gc); - strncpynt ((char *) BPTR (&out), s, 3); - return BSTR (&out); -} - -#endif /* ENABLE_OCC */ - -static void -foreign_option (struct options *o, char *argv[], int len, struct env_set *es) -{ - if (len > 0) - { - struct gc_arena gc = gc_new(); - struct buffer name = alloc_buf_gc (OPTION_PARM_SIZE, &gc); - struct buffer value = alloc_buf_gc (OPTION_PARM_SIZE, &gc); - int i; - bool first = true; - - buf_printf (&name, "foreign_option_%d", o->foreign_option_index + 1); - ++o->foreign_option_index; - for (i = 0; i < len; ++i) - { - if (argv[i]) - { - if (!first) - buf_printf (&value, " "); - buf_printf (&value, "%s", argv[i]); - first = false; - } - } - setenv_str (es, BSTR(&name), BSTR(&value)); - gc_free (&gc); - } -} - -#if P2MP - -/* - * Manage auth-retry variable - */ - -static int global_auth_retry; /* GLOBAL */ - -int -auth_retry_get (void) -{ - return global_auth_retry; -} - -bool -auth_retry_set (const int msglevel, const char *option) -{ - if (streq (option, "interact")) - global_auth_retry = AR_INTERACT; - else if (streq (option, "nointeract")) - global_auth_retry = AR_NOINTERACT; - else if (streq (option, "none")) - global_auth_retry = AR_NONE; - else - { - msg (msglevel, "--auth-retry method must be 'interact', 'nointeract', or 'none'"); - return false; - } - return true; -} - -const char * -auth_retry_print (void) -{ - switch (global_auth_retry) - { - case AR_NONE: - return "none"; - case AR_NOINTERACT: - return "nointeract"; - case AR_INTERACT: - return "interact"; - default: - return "???"; - } -} - -#endif - -/* - * Print the help message. - */ -static void -usage (void) -{ - FILE *fp = msg_fp(); - -#ifdef ENABLE_SMALL - - fprintf (fp, "Usage message not available\n"); - -#else - - struct options o; - init_options (&o); - -#if defined(USE_CRYPTO) && defined(USE_SSL) - fprintf (fp, usage_message, - title_string, - o.connect_retry_seconds, - o.local_port, o.remote_port, - TUN_MTU_DEFAULT, TAP_MTU_EXTRA_DEFAULT, - o.verbosity, - o.authname, o.ciphername, - o.replay_window, o.replay_time, - o.tls_timeout, o.renegotiate_seconds, - o.handshake_window, o.transition_window); -#elif defined(USE_CRYPTO) - fprintf (fp, usage_message, - title_string, - o.connect_retry_seconds, - o.local_port, o.remote_port, - TUN_MTU_DEFAULT, TAP_MTU_EXTRA_DEFAULT, - o.verbosity, - o.authname, o.ciphername, - o.replay_window, o.replay_time); -#else - fprintf (fp, usage_message, - title_string, - o.connect_retry_seconds, - o.local_port, o.remote_port, - TUN_MTU_DEFAULT, TAP_MTU_EXTRA_DEFAULT, - o.verbosity); -#endif - fflush(fp); - -#endif /* ENABLE_SMALL */ - - openvpn_exit (OPENVPN_EXIT_STATUS_USAGE); /* exit point */ -} - -void -usage_small (void) -{ - msg (M_WARN|M_NOPREFIX, "Use --help for more information."); - openvpn_exit (OPENVPN_EXIT_STATUS_USAGE); /* exit point */ -} - -static void -usage_version (void) -{ - msg (M_INFO|M_NOPREFIX, "%s", title_string); - msg (M_INFO|M_NOPREFIX, "Developed by James Yonan"); - msg (M_INFO|M_NOPREFIX, "Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net>"); - openvpn_exit (OPENVPN_EXIT_STATUS_USAGE); /* exit point */ -} - -void -notnull (const char *arg, const char *description) -{ - if (!arg) - msg (M_USAGE, "You must define %s", description); -} - -bool -string_defined_equal (const char *s1, const char *s2) -{ - if (s1 && s2) - return !strcmp (s1, s2); - else - return false; -} - -#if 0 -static void -ping_rec_err (int msglevel) -{ - msg (msglevel, "only one of --ping-exit or --ping-restart options may be specified"); -} -#endif - -static int -positive_atoi (const char *str) -{ - const int i = atoi (str); - return i < 0 ? 0 : i; -} - -static inline bool -space (char c) -{ - return c == '\0' || isspace (c); -} - -int -parse_line (const char *line, - char *p[], - const int n, - const char *file, - const int line_num, - int msglevel, - struct gc_arena *gc) -{ - const int STATE_INITIAL = 0; - const int STATE_READING_QUOTED_PARM = 1; - const int STATE_READING_UNQUOTED_PARM = 2; - const int STATE_DONE = 3; - - const char *error_prefix = ""; - - int ret = 0; - const char *c = line; - int state = STATE_INITIAL; - bool backslash = false; - char in, out; - - char parm[OPTION_PARM_SIZE]; - unsigned int parm_len = 0; - - msglevel &= ~M_OPTERR; - - if (msglevel & M_MSG_VIRT_OUT) - error_prefix = "ERROR: "; - - do - { - in = *c; - out = 0; - - if (!backslash && in == '\\') - { - backslash = true; - } - else - { - if (state == STATE_INITIAL) - { - if (!space (in)) - { - if (in == ';' || in == '#') /* comment */ - break; - if (!backslash && in == '\"') - state = STATE_READING_QUOTED_PARM; - else - { - out = in; - state = STATE_READING_UNQUOTED_PARM; - } - } - } - else if (state == STATE_READING_UNQUOTED_PARM) - { - if (!backslash && space (in)) - state = STATE_DONE; - else - out = in; - } - else if (state == STATE_READING_QUOTED_PARM) - { - if (!backslash && in == '\"') - state = STATE_DONE; - else - out = in; - } - if (state == STATE_DONE) - { - /* ASSERT (parm_len > 0); */ - p[ret] = gc_malloc (parm_len + 1, true, gc); - memcpy (p[ret], parm, parm_len); - p[ret][parm_len] = '\0'; - state = STATE_INITIAL; - parm_len = 0; - ++ret; - } - - if (backslash && out) - { - if (!(out == '\\' || out == '\"' || space (out))) -#ifdef ENABLE_SMALL - msg (msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix, file, line_num); -#else - msg (msglevel, "%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE "\\\\static.key\"", error_prefix, file, line_num); -#endif - } - backslash = false; - } - - /* store parameter character */ - if (out) - { - if (parm_len >= SIZE (parm)) - { - parm[SIZE (parm) - 1] = 0; - msg (msglevel, "%sOptions error: Parameter at %s:%d is too long (%d chars max): %s", - error_prefix, file, line_num, (int) SIZE (parm), parm); - return 0; - } - parm[parm_len++] = out; - } - - /* avoid overflow if too many parms in one config file line */ - if (ret >= n) - break; - - } while (*c++ != '\0'); - - if (state == STATE_READING_QUOTED_PARM) - { - msg (msglevel, "%sOptions error: No closing quotation (\") in %s:%d", error_prefix, file, line_num); - return 0; - } - if (state != STATE_INITIAL) - { - msg (msglevel, "%sOptions error: Residual parse state (%d) in %s:%d", error_prefix, state, file, line_num); - return 0; - } -#if 0 - { - int i; - for (i = 0; i < ret; ++i) - { - msg (M_INFO|M_NOPREFIX, "%s:%d ARG[%d] '%s'", file, line_num, i, p[i]); - } - } -#endif - return ret; -} - -static int -add_option (struct options *options, - int i, - char *p[], - const char *file, - int line, - const int level, - const int msglevel, - const unsigned int permission_mask, - unsigned int *option_types_found, - struct env_set *es); - -static void -read_config_file (struct options *options, - const char *file, - int level, - const char *top_file, - const int top_line, - const int msglevel, - const unsigned int permission_mask, - unsigned int *option_types_found, - struct env_set *es) -{ - const int max_recursive_levels = 10; - FILE *fp; - int line_num; - char line[OPTION_LINE_SIZE]; - - ++level; - if (level <= max_recursive_levels) - { - fp = fopen (file, "r"); - if (fp) - { - line_num = 0; - while (fgets(line, sizeof (line), fp)) - { - char *p[MAX_PARMS]; - CLEAR (p); - ++line_num; - if (parse_line (line, p, SIZE (p), file, line_num, msglevel, &options->gc)) - { - if (strlen (p[0]) >= 3 && !strncmp (p[0], "--", 2)) - p[0] += 2; - add_option (options, 0, p, file, line_num, level, msglevel, permission_mask, option_types_found, es); - } - } - fclose (fp); - } - else - { - msg (msglevel, "In %s:%d: Error opening configuration file: %s", top_file, top_line, file); - } - } - else - { - msg (msglevel, "In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file, top_line, file); - } -} - -void -parse_argv (struct options *options, - const int argc, - char *argv[], - const int msglevel, - const unsigned int permission_mask, - unsigned int *option_types_found, - struct env_set *es) -{ - int i, j; - - /* usage message */ - if (argc <= 1) - usage (); - - /* config filename specified only? */ - if (argc == 2 && strncmp (argv[1], "--", 2)) - { - char *p[MAX_PARMS]; - CLEAR (p); - p[0] = "config"; - p[1] = argv[1]; - add_option (options, 0, p, NULL, 0, 0, msglevel, permission_mask, option_types_found, es); - } - else - { - /* parse command line */ - for (i = 1; i < argc; ++i) - { - char *p[MAX_PARMS]; - CLEAR (p); - p[0] = argv[i]; - if (strncmp(p[0], "--", 2)) - { - msg (msglevel, "I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p[0]); - } - else - p[0] += 2; - - for (j = 1; j < MAX_PARMS; ++j) - { - if (i + j < argc) - { - char *arg = argv[i + j]; - if (strncmp (arg, "--", 2)) - p[j] = arg; - else - break; - } - } - i = add_option (options, i, p, NULL, 0, 0, msglevel, permission_mask, option_types_found, es); - } - } -} - -bool -apply_push_options (struct options *options, - struct buffer *buf, - unsigned int permission_mask, - unsigned int *option_types_found, - struct env_set *es) -{ - char line[OPTION_PARM_SIZE]; - int line_num = 0; - const char *file = "[PUSH-OPTIONS]"; - const int msglevel = D_PUSH_ERRORS|M_OPTERR; - - while (buf_parse (buf, ',', line, sizeof (line))) - { - char *p[MAX_PARMS]; - CLEAR (p); - ++line_num; - if (parse_line (line, p, SIZE (p), file, line_num, msglevel, &options->gc)) - { - add_option (options, 0, p, file, line_num, 0, msglevel, permission_mask, option_types_found, es); - } - } - return true; -} - -void -options_server_import (struct options *o, - const char *filename, - int msglevel, - unsigned int permission_mask, - unsigned int *option_types_found, - struct env_set *es) -{ - msg (D_PUSH, "OPTIONS IMPORT: reading client specific options from: %s", filename); - read_config_file (o, - filename, - 0, - filename, - 0, - msglevel, - permission_mask, - option_types_found, - es); -} - -#if P2MP - -#define VERIFY_PERMISSION(mask) { if (!verify_permission(p[0], (mask), permission_mask, option_types_found, msglevel)) goto err; } - -static bool -verify_permission (const char *name, - const unsigned int type, - const unsigned int allowed, - unsigned int *found, - const int msglevel) -{ - if (!(type & allowed)) - { - msg (msglevel, "option '%s' cannot be used in this context", name); - return false; - } - else - { - if (found) - *found |= type; - return true; - } -} - -#else - -#define VERIFY_PERMISSION(mask) - -#endif - -/* - * Return the length of a string array - */ -static int -string_array_len (char *array[]) -{ - int i = 0; - if (array) - { - while (array[i]) - ++i; - } - return i; -} - -/* - * Check that an option doesn't have too - * many parameters. - */ - -#define NM_QUOTE_HINT (1<<0) - -static bool -no_more_than_n_args (const int msglevel, - char *p[], - const int max, - const unsigned int flags) -{ - const int len = string_array_len (p); - - if (!len) - return false; - - if (len > max) - { - msg (msglevel, "the --%s directive should have at most %d parameter%s.%s", - p[0], - max - 1, - max >= 3 ? "s" : "", - (flags & NM_QUOTE_HINT) ? " To pass a list of arguments as one of the parameters, try enclosing them in double quotes (\"\")." : ""); - return false; - } - else - return true; -} - -static int -add_option (struct options *options, - int i, - char *p[], - const char *file, - int line, - const int level, - const int msglevel, - const unsigned int permission_mask, - unsigned int *option_types_found, - struct env_set *es) -{ - struct gc_arena gc = gc_new (); - ASSERT (MAX_PARMS >= 5); - - if (!file) - { - file = "[CMD-LINE]"; - line = 1; - } - if (streq (p[0], "help")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - usage (); - } - if (streq (p[0], "version")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - usage_version (); - } - else if (streq (p[0], "config") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_CONFIG); - - /* save first config file only in options */ - if (!options->config) - options->config = p[1]; - - read_config_file (options, p[1], level, file, line, msglevel, permission_mask, option_types_found, es); - } - else if (streq (p[0], "echo")) - { - struct buffer string = alloc_buf_gc (OPTION_PARM_SIZE, &gc); - int j; - VERIFY_PERMISSION (OPT_P_ECHO); - - for (j = 1; j < MAX_PARMS; ++j) - { - if (!p[j]) - break; - ++i; - if (j > 1) - buf_printf (&string, " "); - buf_printf (&string, "%s", p[j]); - } - msg (M_INFO, "ECHO:%s", BSTR (&string)); -#ifdef ENABLE_MANAGEMENT - if (management) - management_echo (management, BSTR (&string)); -#endif - } -#ifdef ENABLE_MANAGEMENT - else if (streq (p[0], "management") && p[1] && p[2]) - { - int port; - - i += 2; - VERIFY_PERMISSION (OPT_P_GENERAL); - port = atoi (p[2]); - if (!legal_ipv4_port (port)) - { - msg (msglevel, "port number associated with --management directive is out of range"); - goto err; - } - - options->management_addr = p[1]; - options->management_port = port; - if (p[3]) - { - ++i; - options->management_user_pass = p[3]; - } - } - else if (streq (p[0], "management-query-passwords")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->management_query_passwords = true; - } - else if (streq (p[0], "management-hold")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->management_hold = true; - } - else if (streq (p[0], "management-log-cache") && p[1]) - { - int cache; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - cache = atoi (p[1]); - if (cache < 1) - { - msg (msglevel, "--management-log-cache parameter is out of range"); - goto err; - } - options->management_log_history_cache = cache; - } -#endif -#ifdef ENABLE_PLUGIN - else if (streq (p[0], "plugin") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (p[2]) - ++i; - if (!no_more_than_n_args (msglevel, p, 3, NM_QUOTE_HINT)) - goto err; - if (!options->plugin_list) - options->plugin_list = plugin_option_list_new (&options->gc); - if (!plugin_option_list_add (options->plugin_list, p[1], p[2])) - { - msg (msglevel, "plugin add failed: %s", p[1]); - goto err; - } - } -#endif - else if (streq (p[0], "mode") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (streq (p[1], "p2p")) - options->mode = MODE_POINT_TO_POINT; -#if P2MP_SERVER - else if (streq (p[1], "server")) - options->mode = MODE_SERVER; -#endif - else - { - msg (msglevel, "Bad --mode parameter: %s", p[1]); - goto err; - } - } - else if (streq (p[0], "dev") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->dev = p[1]; - } - else if (streq (p[0], "dev-type") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->dev_type = p[1]; - } - else if (streq (p[0], "dev-node") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->dev_node = p[1]; - } - else if (streq (p[0], "tun-ipv6")) - { - VERIFY_PERMISSION (OPT_P_UP); - options->tun_ipv6 = true; - } - else if (streq (p[0], "ifconfig") && p[1] && p[2]) - { - i += 2; - VERIFY_PERMISSION (OPT_P_UP); - options->ifconfig_local = p[1]; - options->ifconfig_remote_netmask = p[2]; - } - else if (streq (p[0], "ifconfig-noexec")) - { - VERIFY_PERMISSION (OPT_P_UP); - options->ifconfig_noexec = true; - } - else if (streq (p[0], "ifconfig-nowarn")) - { - VERIFY_PERMISSION (OPT_P_UP); - options->ifconfig_nowarn = true; - } - else if (streq (p[0], "local") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->local = p[1]; - } - else if (streq (p[0], "remote-random")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->remote_random = true; - } - else if (streq (p[0], "remote") && p[1]) - { - struct remote_list *l; - struct remote_entry e; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (!options->remote_list) - ALLOC_OBJ_CLEAR_GC (options->remote_list, struct remote_list, &options->gc); - l = options->remote_list; - if (l->len >= REMOTE_LIST_SIZE) - { - msg (msglevel, "Maximum number of --remote options (%d) exceeded", REMOTE_LIST_SIZE); - goto err; - } - e.hostname = p[1]; - if (p[2]) - { - ++i; - e.port = atoi (p[2]); - if (!legal_ipv4_port (e.port)) - { - msg (msglevel, "port number associated with host %s is out of range", e.hostname); - goto err; - } - } - else - e.port = -1; - l->array[l->len++] = e; - } - else if (streq (p[0], "resolv-retry") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (streq (p[1], "infinite")) - options->resolve_retry_seconds = RESOLV_RETRY_INFINITE; - else - options->resolve_retry_seconds = positive_atoi (p[1]); - } - else if (streq (p[0], "connect-retry") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->connect_retry_seconds = positive_atoi (p[1]); - options->connect_retry_defined = true; - } - else if (streq (p[0], "ipchange") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->ipchange = string_substitute (p[1], ',', ' ', &options->gc); - } - else if (streq (p[0], "float")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->remote_float = true; - } -#ifdef ENABLE_DEBUG - else if (streq (p[0], "gremlin") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->gremlin = positive_atoi (p[1]); - } -#endif - else if (streq (p[0], "chroot") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->chroot_dir = p[1]; - } - else if (streq (p[0], "cd") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (openvpn_chdir (p[1])) - { - msg (M_ERR, "cd to '%s' failed", p[1]); - goto err; - } - options->cd_dir = p[1]; - } - else if (streq (p[0], "writepid") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->writepid = p[1]; - } - else if (streq (p[0], "up") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->up_script = p[1]; - } - else if (streq (p[0], "down") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->down_script = p[1]; - } - else if (streq (p[0], "down-pre")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->down_pre = true; - } - else if (streq (p[0], "up-delay")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->up_delay = true; - } - else if (streq (p[0], "up-restart")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->up_restart = true; - } - else if (streq (p[0], "syslog")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - if (p[1]) - ++i; - open_syslog (p[1], false); - } - else if (streq (p[0], "daemon")) - { - bool didit = false; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (!options->daemon) - { - options->daemon = didit = true; - open_syslog (p[1], false); - } - if (p[1]) - { - ++i; - if (!didit) - { - msg (M_WARN, "WARNING: Multiple --daemon directives specified, ignoring --daemon %s. (Note that initscripts sometimes add their own --daemon directive.)", p[1]); - goto err; - } - } - } - else if (streq (p[0], "inetd")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - if (!options->inetd) - { - int z; - const char *name = NULL; - const char *opterr = "when --inetd is used with two parameters, one of them must be 'wait' or 'nowait' and the other must be a daemon name to use for system logging"; - - options->inetd = -1; - - for (z = 1; z <= 2; ++z) - { - if (p[z]) - { - ++i; - if (streq (p[z], "wait")) - { - if (options->inetd != -1) - { - msg (msglevel, opterr); - goto err; - } - else - options->inetd = INETD_WAIT; - } - else if (streq (p[z], "nowait")) - { - if (options->inetd != -1) - { - msg (msglevel, opterr); - goto err; - } - else - options->inetd = INETD_NOWAIT; - } - else - { - if (name != NULL) - { - msg (msglevel, opterr); - goto err; - } - name = p[z]; - } - } - } - - /* default */ - if (options->inetd == -1) - options->inetd = INETD_WAIT; - - save_inetd_socket_descriptor (); - open_syslog (name, true); - } - } - else if (streq (p[0], "log") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->log = true; - redirect_stdout_stderr (p[1], false); - } - else if (streq (p[0], "suppress-timestamps")) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->suppress_timestamps = true; - set_suppress_timestamps(true); - } - else if (streq (p[0], "log-append") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->log = true; - redirect_stdout_stderr (p[1], true); - } - else if (streq (p[0], "mlock")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->mlock = true; - } - else if (streq (p[0], "verb") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_MESSAGES); - options->verbosity = positive_atoi (p[1]); - } - else if (streq (p[0], "mute") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_MESSAGES); - options->mute = positive_atoi (p[1]); - } - else if (streq (p[0], "status") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->status_file = p[1]; - if (p[2]) - { - ++i; - options->status_file_update_freq = positive_atoi (p[2]); - } - } - else if (streq (p[0], "status-version") && p[1]) - { - int version; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - version = atoi (p[1]); - if (version < 1 || version > 2) - { - msg (msglevel, "--status-version must be 1 or 2"); - goto err; - } - options->status_file_version = version; - } - else if (streq (p[0], "remap-usr1") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (streq (p[1], "SIGHUP")) - options->remap_sigusr1 = SIGHUP; - else if (streq (p[1], "SIGTERM")) - options->remap_sigusr1 = SIGTERM; - else - { - msg (msglevel, "--remap-usr1 parm must be 'SIGHUP' or 'SIGTERM'"); - goto err; - } - } - else if ((streq (p[0], "link-mtu") || streq (p[0], "udp-mtu")) && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_MTU); - options->link_mtu = positive_atoi (p[1]); - options->link_mtu_defined = true; - } - else if (streq (p[0], "tun-mtu") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_MTU); - options->tun_mtu = positive_atoi (p[1]); - options->tun_mtu_defined = true; - } - else if (streq (p[0], "tun-mtu-extra") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_MTU); - options->tun_mtu_extra = positive_atoi (p[1]); - options->tun_mtu_extra_defined = true; - } -#ifdef ENABLE_FRAGMENT - else if (streq (p[0], "mtu-dynamic")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - msg (msglevel, "--mtu-dynamic has been replaced by --fragment"); - goto err; - } - else if (streq (p[0], "fragment") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_MTU); - options->fragment = positive_atoi (p[1]); - } -#endif - else if (streq (p[0], "mtu-disc") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_MTU); - options->mtu_discover_type = translate_mtu_discover_type_name (p[1]); - } -#ifdef ENABLE_OCC - else if (streq (p[0], "mtu-test")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->mtu_test = true; - } -#endif - else if (streq (p[0], "nice") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_NICE); - options->nice = atoi (p[1]); - } - else if (streq (p[0], "rcvbuf") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->rcvbuf = positive_atoi (p[1]); - } - else if (streq (p[0], "sndbuf") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->sndbuf = positive_atoi (p[1]); - } - else if (streq (p[0], "txqueuelen") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); -#ifdef TARGET_LINUX - options->tuntap_options.txqueuelen = positive_atoi (p[1]); -#else - msg (msglevel, "--txqueuelen not supported on this OS"); - goto err; -#endif - } -#ifdef USE_PTHREAD - else if (streq (p[0], "nice-work") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_NICE); - options->nice_work = atoi (p[1]); - } - else if (streq (p[0], "threads") && p[1]) - { - int n_threads; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - n_threads = positive_atoi (p[1]); - if (n_threads < 1) - { - msg (msglevel, "--threads parameter must be at least 1"); - goto err; - } - options->n_threads = n_threads; - } -#endif - else if (streq (p[0], "shaper") && p[1]) - { -#ifdef HAVE_GETTIMEOFDAY - int shaper; - - ++i; - VERIFY_PERMISSION (OPT_P_SHAPER); - shaper = atoi (p[1]); - if (shaper < SHAPER_MIN || shaper > SHAPER_MAX) - { - msg (msglevel, "Bad shaper value, must be between %d and %d", - SHAPER_MIN, SHAPER_MAX); - goto err; - } - options->shaper = shaper; -#else /* HAVE_GETTIMEOFDAY */ - VERIFY_PERMISSION (OPT_P_GENERAL); - msg (msglevel, "--shaper requires the gettimeofday() function which is missing"); - goto err; -#endif /* HAVE_GETTIMEOFDAY */ - } - else if (streq (p[0], "port") && p[1]) - { - int port; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - port = atoi (p[1]); - if (!legal_ipv4_port (port)) - { - msg (msglevel, "Bad port number: %s", p[1]); - goto err; - } - options->port_option_used = true; - options->local_port = options->remote_port = port; - } - else if (streq (p[0], "lport") && p[1]) - { - int port; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - port = atoi (p[1]); - if (!legal_ipv4_port (port)) - { - msg (msglevel, "Bad local port number: %s", p[1]); - goto err; - } - options->local_port_defined = true; - options->port_option_used = true; - options->local_port = port; - } - else if (streq (p[0], "rport") && p[1]) - { - int port; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - port = atoi (p[1]); - if (!legal_ipv4_port (port)) - { - msg (msglevel, "Bad remote port number: %s", p[1]); - goto err; - } - options->port_option_used = true; - options->remote_port = port; - } - else if (streq (p[0], "nobind")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->bind_local = false; - } - else if (streq (p[0], "fast-io")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->fast_io = true; - } - else if (streq (p[0], "inactive") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TIMER); - options->inactivity_timeout = positive_atoi (p[1]); - } - else if (streq (p[0], "proto") && p[1]) - { - int proto; - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - proto = ascii2proto (p[1]); - if (proto < 0) - { - msg (msglevel, "Bad protocol: '%s'. Allowed protocols with --proto option: %s", - p[1], - proto2ascii_all (&gc)); - goto err; - } - options->proto = proto; - } -#ifdef ENABLE_HTTP_PROXY - else if (streq (p[0], "http-proxy") && p[1] && p[2]) - { - int port; - struct http_proxy_options *ho; - - i += 2; - VERIFY_PERMISSION (OPT_P_GENERAL); - port = atoi (p[2]); - if (!legal_ipv4_port (port)) - { - msg (msglevel, "Bad http-proxy port number: %s", p[2]); - goto err; - } - - ho = init_http_options_if_undefined (options); - - ho->server = p[1]; - ho->port = port; - if (p[3]) - { - ++i; - ho->auth_method_string = "basic"; - ho->auth_file = p[3]; - - if (p[4]) - { - ++i; - ho->auth_method_string = p[4]; - } - } - else - { - ho->auth_method_string = "none"; - } - } - else if (streq (p[0], "http-proxy-retry")) - { - struct http_proxy_options *ho; - VERIFY_PERMISSION (OPT_P_GENERAL); - ho = init_http_options_if_undefined (options); - ho->retry = true; - } - else if (streq (p[0], "http-proxy-timeout") && p[1]) - { - struct http_proxy_options *ho; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - ho = init_http_options_if_undefined (options); - ho->timeout = positive_atoi (p[1]); - } - else if (streq (p[0], "http-proxy-option") && p[1]) - { - struct http_proxy_options *ho; - - ++i; - if (p[2]) - ++i; - - VERIFY_PERMISSION (OPT_P_GENERAL); - ho = init_http_options_if_undefined (options); - - if (streq (p[1], "VERSION") && p[2]) - { - ho->http_version = p[2]; - } - else if (streq (p[1], "AGENT") && p[2]) - { - ho->user_agent = p[2]; - } - else - { - msg (msglevel, "Bad http-proxy-option or missing parameter: '%s'", p[1]); - } - } -#endif -#ifdef ENABLE_SOCKS - else if (streq (p[0], "socks-proxy") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - - if (p[2]) - { - int port; - ++i; - port = atoi (p[2]); - if (!legal_ipv4_port (port)) - { - msg (msglevel, "Bad socks-proxy port number: %s", p[2]); - goto err; - } - options->socks_proxy_port = port; - } - else - { - options->socks_proxy_port = 1080; - } - options->socks_proxy_server = p[1]; - } - else if (streq (p[0], "socks-proxy-retry")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->socks_proxy_retry = true; - } -#endif - else if (streq (p[0], "keepalive") && p[1] && p[2]) - { - i += 2; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->keepalive_ping = atoi (p[1]); - options->keepalive_timeout = atoi (p[2]); - } - else if (streq (p[0], "ping") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TIMER); - options->ping_send_timeout = positive_atoi (p[1]); - } - else if (streq (p[0], "ping-exit") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TIMER); - options->ping_rec_timeout = positive_atoi (p[1]); - options->ping_rec_timeout_action = PING_EXIT; - } - else if (streq (p[0], "ping-restart") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TIMER); - options->ping_rec_timeout = positive_atoi (p[1]); - options->ping_rec_timeout_action = PING_RESTART; - } - else if (streq (p[0], "ping-timer-rem")) - { - VERIFY_PERMISSION (OPT_P_TIMER); - options->ping_timer_remote = true; - } -#ifdef ENABLE_OCC - else if (streq (p[0], "explicit-exit-notify")) - { - VERIFY_PERMISSION (OPT_P_EXPLICIT_NOTIFY); - if (p[1]) - { - ++i; - options->explicit_exit_notification = positive_atoi (p[1]); - } - else - { - options->explicit_exit_notification = 1; - } - } -#endif - else if (streq (p[0], "persist-tun")) - { - VERIFY_PERMISSION (OPT_P_PERSIST); - options->persist_tun = true; - } - else if (streq (p[0], "persist-key")) - { - VERIFY_PERMISSION (OPT_P_PERSIST); - options->persist_key = true; - } - else if (streq (p[0], "persist-local-ip")) - { - VERIFY_PERMISSION (OPT_P_PERSIST_IP); - options->persist_local_ip = true; - } - else if (streq (p[0], "persist-remote-ip")) - { - VERIFY_PERMISSION (OPT_P_PERSIST_IP); - options->persist_remote_ip = true; - } - else if (streq (p[0], "route") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_ROUTE); - if (p[2]) - ++i; - if (p[3]) - ++i; - if (p[4]) - ++i; - rol_check_alloc (options); - add_route_to_option_list (options->routes, p[1], p[2], p[3], p[4]); - } - else if (streq (p[0], "route-gateway") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_ROUTE); - options->route_default_gateway = p[1]; - } - else if (streq (p[0], "route-delay")) - { - VERIFY_PERMISSION (OPT_P_ROUTE); - options->route_delay_defined = true; - if (p[1]) - { - ++i; - options->route_delay = positive_atoi (p[1]); - if (p[2]) - { - ++i; - options->route_delay_window = positive_atoi (p[2]); - } - } - else - { - options->route_delay = 0; - } - } - else if (streq (p[0], "route-up") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->route_script = p[1]; - } - else if (streq (p[0], "route-noexec")) - { - VERIFY_PERMISSION (OPT_P_SCRIPT); - options->route_noexec = true; - } - else if (streq (p[0], "redirect-gateway")) - { - int j; - VERIFY_PERMISSION (OPT_P_ROUTE); - rol_check_alloc (options); - for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j) - { - ++i; - if (streq (p[j], "local")) - options->routes->redirect_local = true; - else if (streq (p[j], "def1")) - options->routes->redirect_def1 = true; - else - { - msg (msglevel, "unknown --redirect-gateway flag: %s", p[j]); - goto err; - } - } - options->routes->redirect_default_gateway = true; - } - else if (streq (p[0], "setenv") && p[1] && p[2]) - { - i += 2; - VERIFY_PERMISSION (OPT_P_SETENV); - setenv_str (es, p[1], p[2]); - } - else if (streq (p[0], "mssfix")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - if (p[1]) - { - ++i; - options->mssfix = positive_atoi (p[1]); - } - else - options->mssfix_default = true; - - } -#ifdef ENABLE_OCC - else if (streq (p[0], "disable-occ")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->occ = false; - } -#endif -#if P2MP -#if P2MP_SERVER - else if (streq (p[0], "server") && p[1] && p[2]) - { - const int lev = M_WARN; - bool error = false; - in_addr_t network, netmask; - - i += 2; - VERIFY_PERMISSION (OPT_P_GENERAL); - network = get_ip_addr (p[1], lev, &error); - netmask = get_ip_addr (p[2], lev, &error); - if (error || !network || !netmask) - { - msg (msglevel, "error parsing --server parameters"); - goto err; - } - options->server_defined = true; - options->server_network = network; - options->server_netmask = netmask; - } - else if (streq (p[0], "server-bridge") && p[1] && p[2] && p[3] && p[4]) - { - const int lev = M_WARN; - bool error = false; - in_addr_t ip, netmask, pool_start, pool_end; - - i += 4; - VERIFY_PERMISSION (OPT_P_GENERAL); - ip = get_ip_addr (p[1], lev, &error); - netmask = get_ip_addr (p[2], lev, &error); - pool_start = get_ip_addr (p[3], lev, &error); - pool_end = get_ip_addr (p[4], lev, &error); - if (error || !ip || !netmask || !pool_start || !pool_end) - { - msg (msglevel, "error parsing --server-bridge parameters"); - goto err; - } - options->server_bridge_defined = true; - options->server_bridge_ip = ip; - options->server_bridge_netmask = netmask; - options->server_bridge_pool_start = pool_start; - options->server_bridge_pool_end = pool_end; - } - else if (streq (p[0], "push") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_PUSH); - push_option (options, p[1], msglevel); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - } - else if (streq (p[0], "push-reset")) - { - VERIFY_PERMISSION (OPT_P_INSTANCE); - push_reset (options); - } - else if (streq (p[0], "ifconfig-pool") && p[1] && p[2]) - { - const int lev = M_WARN; - bool error = false; - in_addr_t start, end, netmask=0; - - i += 2; - VERIFY_PERMISSION (OPT_P_GENERAL); - start = get_ip_addr (p[1], lev, &error); - end = get_ip_addr (p[2], lev, &error); - if (p[3]) - { - ++i; - netmask = get_ip_addr (p[3], lev, &error); - } - if (error) - { - msg (msglevel, "error parsing --ifconfig-pool parameters"); - goto err; - } - if (!ifconfig_pool_verify_range (msglevel, start, end)) - goto err; - - options->ifconfig_pool_defined = true; - options->ifconfig_pool_start = start; - options->ifconfig_pool_end = end; - options->ifconfig_pool_netmask = netmask; - } - else if (streq (p[0], "ifconfig-pool-persist") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->ifconfig_pool_persist_filename = p[1]; - if (p[2]) - { - ++i; - options->ifconfig_pool_persist_refresh_freq = positive_atoi (p[2]); - } - } - else if (streq (p[0], "ifconfig-pool-linear")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->ifconfig_pool_linear = true; - } - else if (streq (p[0], "hash-size") && p[1] && p[2]) - { - int real, virtual; - - i += 2; - VERIFY_PERMISSION (OPT_P_GENERAL); - real = atoi (p[1]); - virtual = atoi (p[2]); - if (real < 1 || virtual < 1) - { - msg (msglevel, "--hash-size sizes must be >= 1 (preferably a power of 2)"); - goto err; - } - options->real_hash_size = real; - options->virtual_hash_size = real; - } - else if (streq (p[0], "connect-freq") && p[1] && p[2]) - { - int cf_max, cf_per; - - i += 2; - VERIFY_PERMISSION (OPT_P_GENERAL); - cf_max = atoi (p[1]); - cf_per = atoi (p[2]); - if (cf_max < 0 || cf_per < 0) - { - msg (msglevel, "--connect-freq parms must be > 0"); - goto err; - } - options->cf_max = cf_max; - options->cf_per = cf_per; - } - else if (streq (p[0], "max-clients") && p[1]) - { - int max_clients; - - i += 1; - VERIFY_PERMISSION (OPT_P_GENERAL); - max_clients = atoi (p[1]); - if (max_clients < 0) - { - msg (msglevel, "--max-clients must be at least 1"); - goto err; - } - options->max_clients = max_clients; - } - else if (streq (p[0], "max-routes-per-client") && p[1]) - { - i += 1; - VERIFY_PERMISSION (OPT_P_INHERIT); - options->max_routes_per_client = max_int (atoi (p[1]), 1); - } - else if (streq (p[0], "client-cert-not-required")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->client_cert_not_required = true; - } - else if (streq (p[0], "username-as-common-name")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->username_as_common_name = true; - } - else if (streq (p[0], "auth-user-pass-verify") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 3, NM_QUOTE_HINT)) - goto err; - if (p[2]) - { - ++i; - if (streq (p[2], "via-env")) - options->auth_user_pass_verify_script_via_file = false; - else if (streq (p[2], "via-file")) - options->auth_user_pass_verify_script_via_file = true; - else - { - msg (msglevel, "second parm to --auth-user-pass-verify must be 'via-env' or 'via-file'"); - goto err; - } - } - else - { - msg (msglevel, "--auth-user-pass-verify requires a second parameter ('via-env' or 'via-file')"); - goto err; - } - options->auth_user_pass_verify_script = p[1]; - } - else if (streq (p[0], "client-connect") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->client_connect_script = p[1]; - } - else if (streq (p[0], "client-disconnect") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->client_disconnect_script = p[1]; - } - else if (streq (p[0], "learn-address") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->learn_address_script = p[1]; - } - else if (streq (p[0], "tmp-dir") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->tmp_dir = p[1]; - } - else if (streq (p[0], "client-config-dir") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->client_config_dir = p[1]; - } - else if (streq (p[0], "ccd-exclusive")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->ccd_exclusive = true; - } - else if (streq (p[0], "bcast-buffers") && p[1]) - { - int n_bcast_buf; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - n_bcast_buf = atoi (p[1]); - if (n_bcast_buf < 1) - msg (msglevel, "--bcast-buffers parameter must be > 0"); - options->n_bcast_buf = n_bcast_buf; - } - else if (streq (p[0], "tcp-queue-limit") && p[1]) - { - int tcp_queue_limit; - - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - tcp_queue_limit = atoi (p[1]); - if (tcp_queue_limit < 1) - msg (msglevel, "--tcp-queue-limit parameter must be > 0"); - options->tcp_queue_limit = tcp_queue_limit; - } - else if (streq (p[0], "client-to-client")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->enable_c2c = true; - } - else if (streq (p[0], "duplicate-cn")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->duplicate_cn = true; - } - else if (streq (p[0], "iroute") && p[1]) - { - const char *netmask = NULL; - - ++i; - VERIFY_PERMISSION (OPT_P_INSTANCE); - if (p[2]) - { - ++i; - netmask = p[2]; - } - option_iroute (options, p[1], netmask, msglevel); - } - else if (streq (p[0], "ifconfig-push") && p[1] && p[2]) - { - in_addr_t local, remote_netmask; - - i += 2; - VERIFY_PERMISSION (OPT_P_INSTANCE); - local = getaddr (GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[1], 0, NULL, NULL); - remote_netmask = getaddr (GETADDR_HOST_ORDER|GETADDR_RESOLVE, p[2], 0, NULL, NULL); - if (local && remote_netmask) - { - options->push_ifconfig_defined = true; - options->push_ifconfig_local = local; - options->push_ifconfig_remote_netmask = remote_netmask; - } - else - { - msg (msglevel, "cannot parse --ifconfig-push addresses"); - goto err; - } - } - else if (streq (p[0], "disable")) - { - VERIFY_PERMISSION (OPT_P_INSTANCE); - options->disable = true; - } -#endif /* P2MP_SERVER */ - - else if (streq (p[0], "client")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->client = true; - } - else if (streq (p[0], "pull")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->pull = true; - } - else if (streq (p[0], "auth-user-pass")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - if (p[1]) - { - ++i; - options->auth_user_pass_file = p[1]; - } - else - options->auth_user_pass_file = "stdin"; - } - else if (streq (p[0], "auth-retry") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - auth_retry_set (msglevel, p[1]); - } -#endif -#ifdef WIN32 - else if (streq (p[0], "route-method") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_ROUTE); - if (streq (p[1], "ipapi")) - options->route_method = ROUTE_METHOD_IPAPI; - else if (streq (p[1], "exe")) - options->route_method = ROUTE_METHOD_EXE; - else - { - msg (msglevel, "--route method must be 'ipapi' or 'exe'"); - goto err; - } - } - else if (streq (p[0], "ip-win32") && p[1]) - { - const int index = ascii2ipset (p[1]); - struct tuntap_options *to = &options->tuntap_options; - - ++i; - VERIFY_PERMISSION (OPT_P_IPWIN32); - - if (index < 0) - { - msg (msglevel, - "Bad --ip-win32 method: '%s'. Allowed methods: %s", - p[1], - ipset2ascii_all (&gc)); - goto err; - } - - if (index == IPW32_SET_DHCP_MASQ) - { - if (p[2]) - { - ++i; - if (!streq (p[2], "default")) - { - int offset = atoi (p[2]); - - if (!(offset > -256 && offset < 256)) - { - msg (msglevel, "--ip-win32 dynamic [offset] [lease-time]: offset (%d) must be > -256 and < 256", offset); - goto err; - } - - to->dhcp_masq_custom_offset = true; - to->dhcp_masq_offset = offset; - } - - if (p[3]) - { - const int min_lease = 30; - int lease_time; - ++i; - lease_time = atoi (p[3]); - if (lease_time < min_lease) - { - msg (msglevel, "--ip-win32 dynamic [offset] [lease-time]: lease time parameter (%d) must be at least %d seconds", lease_time, min_lease); - goto err; - } - to->dhcp_lease_time = lease_time; - } - } - } - to->ip_win32_type = index; - to->ip_win32_defined = true; - } - else if (streq (p[0], "dhcp-option") && p[1]) - { - struct tuntap_options *o = &options->tuntap_options; - ++i; - VERIFY_PERMISSION (OPT_P_IPWIN32); - - if (streq (p[1], "DOMAIN") && p[2]) - { - ++i; - o->domain = p[2]; - } - else if (streq (p[1], "NBS") && p[2]) - { - ++i; - o->netbios_scope = p[2]; - } - else if (streq (p[1], "NBT") && p[2]) - { - int t; - ++i; - t = atoi (p[2]); - if (!(t == 1 || t == 2 || t == 4 || t == 8)) - { - msg (msglevel, "--dhcp-option NBT: parameter (%d) must be 1, 2, 4, or 8", t); - goto err; - } - o->netbios_node_type = t; - } - else if (streq (p[1], "DNS") && p[2]) - { - ++i; - dhcp_option_address_parse ("DNS", p[2], o->dns, &o->dns_len, msglevel); - } - else if (streq (p[1], "WINS") && p[2]) - { - ++i; - dhcp_option_address_parse ("WINS", p[2], o->wins, &o->wins_len, msglevel); - } - else if (streq (p[1], "NTP") && p[2]) - { - ++i; - dhcp_option_address_parse ("NTP", p[2], o->ntp, &o->ntp_len, msglevel); - } - else if (streq (p[1], "NBDD") && p[2]) - { - ++i; - dhcp_option_address_parse ("NBDD", p[2], o->nbdd, &o->nbdd_len, msglevel); - } - else if (streq (p[1], "DISABLE-NBT")) - { - o->disable_nbt = 1; - } - else - { - msg (msglevel, "--dhcp-option: unknown option type '%s' or missing parameter", p[1]); - goto err; - } - o->dhcp_options = true; - } - else if (streq (p[0], "show-adapters")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - show_tap_win32_adapters (M_INFO|M_NOPREFIX, M_WARN|M_NOPREFIX); - openvpn_exit (OPENVPN_EXIT_STATUS_GOOD); /* exit point */ - } - else if (streq (p[0], "show-net")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - show_routes (M_INFO|M_NOPREFIX); - show_adapters (M_INFO|M_NOPREFIX); - openvpn_exit (OPENVPN_EXIT_STATUS_GOOD); /* exit point */ - } - else if (streq (p[0], "show-net-up")) - { - VERIFY_PERMISSION (OPT_P_UP); - options->show_net_up = true; - } - else if (streq (p[0], "tap-sleep") && p[1]) - { - int s; - ++i; - VERIFY_PERMISSION (OPT_P_IPWIN32); - s = atoi (p[1]); - if (s < 0 || s >= 256) - { - msg (msglevel, "--tap-sleep parameter must be between 0 and 255"); - goto err; - } - options->tuntap_options.tap_sleep = s; - } - else if (streq (p[0], "dhcp-renew")) - { - VERIFY_PERMISSION (OPT_P_IPWIN32); - options->tuntap_options.dhcp_renew = true; - } - else if (streq (p[0], "dhcp-pre-release")) - { - VERIFY_PERMISSION (OPT_P_IPWIN32); - options->tuntap_options.dhcp_pre_release = true; - } - else if (streq (p[0], "dhcp-release")) - { - VERIFY_PERMISSION (OPT_P_IPWIN32); - options->tuntap_options.dhcp_release = true; - } - else if (streq (p[0], "show-valid-subnets")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - show_valid_win32_tun_subnets (); - openvpn_exit (OPENVPN_EXIT_STATUS_USAGE); /* exit point */ - } - else if (streq (p[0], "pause-exit")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - set_pause_exit_win32 (); - } - else if (streq (p[0], "service") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->exit_event_name = p[1]; - if (p[2]) - { - ++i; - options->exit_event_initial_state = (atoi(p[2]) != 0); - } - } - else if (streq (p[0], "user") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - msg (M_WARN, "NOTE: --user option is not implemented on Windows"); - } - else if (streq (p[0], "group") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - msg (M_WARN, "NOTE: --group option is not implemented on Windows"); - } -#else - else if (streq (p[0], "user") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->username = p[1]; - } - else if (streq (p[0], "group") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->groupname = p[1]; - } - else if (streq (p[0], "dhcp-option") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_IPWIN32); - if (p[2]) - ++i; - foreign_option (options, p, 3, es); - } - else if (streq (p[0], "route-method") && p[1]) /* ignore when pushed to non-Windows OS */ - { - ++i; - VERIFY_PERMISSION (OPT_P_ROUTE); - } -#endif -#if PASSTOS_CAPABILITY - else if (streq (p[0], "passtos")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->passtos = true; - } -#endif -#ifdef USE_LZO - else if (streq (p[0], "comp-lzo")) - { - VERIFY_PERMISSION (OPT_P_COMP); - options->comp_lzo = true; - } - else if (streq (p[0], "comp-noadapt")) - { - VERIFY_PERMISSION (OPT_P_COMP); - options->comp_lzo_adaptive = false; - } -#endif /* USE_LZO */ -#ifdef USE_CRYPTO - else if (streq (p[0], "show-ciphers")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->show_ciphers = true; - } - else if (streq (p[0], "show-digests")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->show_digests = true; - } - else if (streq (p[0], "show-engines")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->show_engines = true; - } - else if (streq (p[0], "secret") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (p[2]) - { - int key_direction; - - ++i; - key_direction = ascii2keydirection (msglevel, p[2]); - if (key_direction >= 0) - options->key_direction = key_direction; - else - goto err; - } - options->shared_secret_file = p[1]; - } - else if (streq (p[0], "genkey")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->genkey = true; - } - else if (streq (p[0], "auth") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_CRYPTO); - options->authname_defined = true; - options->authname = p[1]; - if (streq (options->authname, "none")) - { - options->authname_defined = false; - options->authname = NULL; - } - } - else if (streq (p[0], "auth")) - { - VERIFY_PERMISSION (OPT_P_CRYPTO); - options->authname_defined = true; - } - else if (streq (p[0], "cipher") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_CRYPTO); - options->ciphername_defined = true; - options->ciphername = p[1]; - if (streq (options->ciphername, "none")) - { - options->ciphername_defined = false; - options->ciphername = NULL; - } - } - else if (streq (p[0], "cipher")) - { - VERIFY_PERMISSION (OPT_P_CRYPTO); - options->ciphername_defined = true; - } - else if (streq (p[0], "no-replay")) - { - VERIFY_PERMISSION (OPT_P_CRYPTO); - options->replay = false; - } - else if (streq (p[0], "replay-window")) - { - VERIFY_PERMISSION (OPT_P_CRYPTO); - if (p[1]) - { - int replay_window; - - ++i; - replay_window = atoi (p[1]); - if (!(MIN_SEQ_BACKTRACK <= replay_window && replay_window <= MAX_SEQ_BACKTRACK)) - { - msg (msglevel, "replay-window window size parameter (%d) must be between %d and %d", - replay_window, - MIN_SEQ_BACKTRACK, - MAX_SEQ_BACKTRACK); - goto err; - } - options->replay_window = replay_window; - - if (p[2]) - { - int replay_time; - - ++i; - replay_time = atoi (p[2]); - if (!(MIN_TIME_BACKTRACK <= replay_time && replay_time <= MAX_TIME_BACKTRACK)) - { - msg (msglevel, "replay-window time window parameter (%d) must be between %d and %d", - replay_time, - MIN_TIME_BACKTRACK, - MAX_TIME_BACKTRACK); - goto err; - } - options->replay_time = replay_time; - } - } - else - { - msg (msglevel, "replay-window option is missing window size parameter"); - goto err; - } - } - else if (streq (p[0], "mute-replay-warnings")) - { - VERIFY_PERMISSION (OPT_P_CRYPTO); - options->mute_replay_warnings = true; - } - else if (streq (p[0], "no-iv")) - { - VERIFY_PERMISSION (OPT_P_CRYPTO); - options->use_iv = false; - } - else if (streq (p[0], "replay-persist") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->packet_id_file = p[1]; - } - else if (streq (p[0], "test-crypto")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->test_crypto = true; - } - else if (streq (p[0], "engine")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - if (p[1]) - { - ++i; - options->engine = p[1]; - } - else - options->engine = "auto"; - } -#ifdef HAVE_EVP_CIPHER_CTX_SET_KEY_LENGTH - else if (streq (p[0], "keysize") && p[1]) - { - int keysize; - - ++i; - VERIFY_PERMISSION (OPT_P_CRYPTO); - keysize = atoi (p[1]) / 8; - if (keysize < 0 || keysize > MAX_CIPHER_KEY_LENGTH) - { - msg (msglevel, "Bad keysize: %s", p[1]); - goto err; - } - options->keysize = keysize; - } -#endif -#ifdef USE_SSL - else if (streq (p[0], "show-tls")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->show_tls_ciphers = true; - } - else if (streq (p[0], "tls-server")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->tls_server = true; - } - else if (streq (p[0], "tls-client")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->tls_client = true; - } - else if (streq (p[0], "ca") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->ca_file = p[1]; - } - else if (streq (p[0], "dh") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->dh_file = p[1]; - } - else if (streq (p[0], "cert") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->cert_file = p[1]; - } -#ifdef WIN32 - else if (streq (p[0], "cryptoapicert") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->cryptoapi_cert = p[1]; - } -#endif - else if (streq (p[0], "key") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->priv_key_file = p[1]; - } - else if (streq (p[0], "pkcs12") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->pkcs12_file = p[1]; - } - else if (streq (p[0], "askpass")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - if (p[1]) - { - ++i; - options->key_pass_file = p[1]; - } - else - options->key_pass_file = "stdin"; - } - else if (streq (p[0], "auth-nocache")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - ssl_set_auth_nocache (); - } - else if (streq (p[0], "single-session")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->single_session = true; - } - else if (streq (p[0], "tls-exit")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->tls_exit = true; - } - else if (streq (p[0], "tls-cipher") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->cipher_list = p[1]; - } - else if (streq (p[0], "crl-verify") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->crl_file = p[1]; - } - else if (streq (p[0], "tls-verify") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_SCRIPT); - if (!no_more_than_n_args (msglevel, p, 2, NM_QUOTE_HINT)) - goto err; - options->tls_verify = string_substitute (p[1], ',', ' ', &options->gc); - } - else if (streq (p[0], "tls-remote") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - options->tls_remote = p[1]; - } - else if (streq (p[0], "ns-cert-type") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (streq (p[1], "server")) - options->ns_cert_type = NS_SSL_SERVER; - else if (streq (p[1], "client")) - options->ns_cert_type = NS_SSL_CLIENT; - else - { - msg (msglevel, "--ns-cert-type must be 'client' or 'server'"); - goto err; - } - } - else if (streq (p[0], "tls-timeout") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TLS_PARMS); - options->tls_timeout = positive_atoi (p[1]); - } - else if (streq (p[0], "reneg-bytes") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TLS_PARMS); - options->renegotiate_bytes = positive_atoi (p[1]); - } - else if (streq (p[0], "reneg-pkts") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TLS_PARMS); - options->renegotiate_packets = positive_atoi (p[1]); - } - else if (streq (p[0], "reneg-sec") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TLS_PARMS); - options->renegotiate_seconds = positive_atoi (p[1]); - } - else if (streq (p[0], "hand-window") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TLS_PARMS); - options->handshake_window = positive_atoi (p[1]); - } - else if (streq (p[0], "tran-window") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_TLS_PARMS); - options->transition_window = positive_atoi (p[1]); - } - else if (streq (p[0], "tls-auth") && p[1]) - { - ++i; - VERIFY_PERMISSION (OPT_P_GENERAL); - if (p[2]) - { - int key_direction; - - ++i; - key_direction = ascii2keydirection (msglevel, p[2]); - if (key_direction >= 0) - options->key_direction = key_direction; - else - goto err; - } - options->tls_auth_file = p[1]; - } - else if (streq (p[0], "key-method") && p[1]) - { - int key_method; - ++i; - - VERIFY_PERMISSION (OPT_P_GENERAL); - key_method = atoi (p[1]); - if (key_method < KEY_METHOD_MIN || key_method > KEY_METHOD_MAX) - { - msg (msglevel, "key_method parameter (%d) must be >= %d and <= %d", - key_method, - KEY_METHOD_MIN, - KEY_METHOD_MAX); - goto err; - } - options->key_method = key_method; - } -#endif /* USE_SSL */ -#endif /* USE_CRYPTO */ -#ifdef TUNSETPERSIST - else if (streq (p[0], "rmtun")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->persist_config = true; - options->persist_mode = 0; - } - else if (streq (p[0], "mktun")) - { - VERIFY_PERMISSION (OPT_P_GENERAL); - options->persist_config = true; - options->persist_mode = 1; - } -#endif - else - { - if (file) - msg (msglevel, "Unrecognized option or missing parameter(s) in %s:%d: %s (%s)", file, line, p[0], PACKAGE_VERSION); - else - msg (msglevel, "Unrecognized option or missing parameter(s): --%s (%s)", p[0], PACKAGE_VERSION); - } - err: - gc_free (&gc); - return i; -} |