33 #ifdef HAVE_CONFIG_VERSION_H
34 #include "config-version.h"
69 #ifdef CONFIGURE_GIT_REVISION
70 " [git:" CONFIGURE_GIT_REVISION CONFIGURE_GIT_FLAGS
"]"
73 #if defined(ENABLE_CRYPTO_MBEDTLS)
75 #elif defined(ENABLE_CRYPTO_OPENSSL)
87 #ifdef ENABLE_COMP_STUB
94 #ifdef PRODUCT_TAP_DEBUG
100 #if ENABLE_IP_PKTINFO
101 #if defined(HAVE_IN_PKTINFO) && defined(HAVE_IPI_SPEC_DST)
103 #elif defined(IP_RECVDSTADDR)
111 #ifdef CONFIGURE_GIT_REVISION
112 " built on " __DATE__
122 "--config file : Read configuration options from file.\n"
123 "--help : Show options.\n"
124 "--version : Show copyright and version information.\n"
127 "--local host : Local host name or ip address. Implies --bind.\n"
128 "--remote host [port] : Remote host name or ip address.\n"
129 "--remote-random : If multiple --remote options specified, choose one randomly.\n"
130 "--remote-random-hostname : Add a random string to remote DNS name.\n"
131 "--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
132 "--proto p : Use protocol p for communicating with peer.\n"
133 " p = udp (default), tcp-server, tcp-client\n"
134 " udp4, tcp4-server, tcp4-client\n"
135 " udp6, tcp6-server, tcp6-client\n"
136 "--proto-force p : only consider protocol p in list of connection profiles.\n"
138 "--connect-retry n [m] : For client, number of seconds to wait between\n"
139 " connection retries (default=%d). On repeated retries\n"
140 " the wait time is exponentially increased to a maximum of m\n"
142 "--connect-retry-max n : Maximum connection attempt retries, default infinite.\n"
143 "--http-proxy s p [up] [auth] : Connect to remote host\n"
144 " through an HTTP proxy at address s and port p.\n"
145 " If proxy authentication is required,\n"
146 " up is a file containing username/password on 2 lines, or\n"
147 " 'stdin' to prompt from console. Add auth='ntlm2' if\n"
148 " the proxy requires NTLM authentication.\n"
149 "--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically\n"
150 " determine auth method and query for username/password\n"
151 " if needed. auto-nct disables weak proxy auth methods.\n"
152 "--http-proxy-option type [parm] : Set extended HTTP proxy options.\n"
153 " Repeat to set multiple options.\n"
154 " VERSION version (default=1.0)\n"
155 " AGENT user-agent\n"
156 "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
157 " address s and port p (default port = 1080).\n"
158 " If proxy authentication is required,\n"
159 " up is a file containing username/password on 2 lines, or\n"
160 " 'stdin' to prompt for console.\n"
161 "--socks-proxy-retry : Retry indefinitely on Socks proxy errors.\n"
162 "--resolv-retry n: If hostname resolve fails for --remote, retry\n"
163 " resolve for n seconds before failing (disabled by default).\n"
164 " Set n=\"infinite\" to retry indefinitely.\n"
165 "--float : Allow remote to change its IP address/port, such as through\n"
166 " DHCP (this is the default if --remote is not used).\n"
167 "--ipchange cmd : Run command cmd on remote ip address initial\n"
168 " setting or change -- execute as: cmd ip-address port#\n"
169 "--port port : TCP/UDP port # for both local and remote.\n"
170 "--lport port : TCP/UDP port # for local (default=%s). Implies --bind.\n"
171 "--rport port : TCP/UDP port # for remote (default=%s).\n"
172 "--bind : Bind to local address and port. (This is the default unless\n"
173 " --proto tcp-client"
177 "--nobind : Do not bind to local address and port.\n"
178 "--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.\n"
179 "--dev-type dt : Which device type are we using? (dt = tun or tap) Use\n"
180 " this option only if the tun/tap device used with --dev\n"
181 " does not begin with \"tun\" or \"tap\".\n"
182 "--dev-node node : Explicitly set the device node rather than using\n"
183 " /dev/net/tun, /dev/tun, /dev/tap, etc.\n"
184 #if defined(ENABLE_DCO)
185 "--disable-dco : Do not attempt using Data Channel Offload.\n"
187 "--lladdr hw : Set the link layer address of the tap device.\n"
188 "--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
189 #ifdef ENABLE_IPROUTE
190 "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
192 "--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
193 " endpoint and rn as a remote endpoint. l & rn should be\n"
194 " swapped on the other peer. l & rn must be private\n"
195 " addresses outside of the subnets used by either peer.\n"
196 " TAP: configure device to use IP address l as a local\n"
197 " endpoint and rn as a subnet mask.\n"
198 "--ifconfig-ipv6 l r : configure device to use IPv6 address l as local\n"
199 " endpoint (as a /64) and r as remote endpoint\n"
200 "--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead\n"
201 " pass --ifconfig parms by environment to scripts.\n"
202 "--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the\n"
203 " connection doesn't match the remote side.\n"
204 "--route network [netmask] [gateway] [metric] :\n"
205 " Add route to routing table after connection\n"
206 " is established. Multiple routes can be specified.\n"
207 " netmask default: 255.255.255.255\n"
208 " gateway default: taken from --route-gateway or --ifconfig\n"
209 " Specify default by leaving blank or setting to \"default\".\n"
210 "--route-ipv6 network/bits [gateway] [metric] :\n"
211 " Add IPv6 route to routing table after connection\n"
212 " is established. Multiple routes can be specified.\n"
213 " gateway default: taken from --route-ipv6-gateway or 'remote'\n"
214 " in --ifconfig-ipv6\n"
215 "--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.\n"
216 "--route-ipv6-gateway gw : Specify a default gateway for use with --route-ipv6.\n"
217 "--route-metric m : Specify a default metric for use with --route.\n"
218 "--route-delay n [w] : Delay n seconds after connection initiation before\n"
219 " adding routes (may be 0). If not specified, routes will\n"
220 " be added immediately after tun/tap open. On Windows, wait\n"
221 " up to w seconds for TUN/TAP adapter to come up.\n"
222 "--route-up cmd : Run command cmd after routes are added.\n"
223 "--route-pre-down cmd : Run command cmd before routes are removed.\n"
224 "--route-noexec : Don't add routes automatically. Instead pass routes to\n"
225 " --route-up script using environmental variables.\n"
226 "--route-nopull : When used with --client or --pull, accept options pushed\n"
227 " by server EXCEPT for routes, dns, and dhcp options.\n"
228 "--allow-pull-fqdn : Allow client to pull DNS names from server for\n"
229 " --ifconfig, --route, and --route-gateway.\n"
230 "--redirect-gateway [flags]: Automatically execute routing\n"
231 " commands to redirect all outgoing IP traffic through the\n"
232 " VPN. Add 'local' flag if both " PACKAGE_NAME " servers are directly\n"
233 " connected via a common subnet, such as with WiFi.\n"
234 " Add 'def1' flag to set default route using using 0.0.0.0/1\n"
235 " and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'\n"
236 " flag to add a direct route to DHCP server, bypassing tunnel.\n"
237 " Add 'bypass-dns' flag to similarly bypass tunnel for DNS.\n"
238 "--redirect-private [flags]: Like --redirect-gateway, but omit actually changing\n"
239 " the default gateway. Useful when pushing private subnets.\n"
240 "--block-ipv6 : (Client) Instead sending IPv6 to the server generate\n"
241 " ICMPv6 host unreachable messages on the client.\n"
242 " (Server) Instead of forwarding IPv6 packets send\n"
243 " ICMPv6 host unreachable packets to the client.\n"
244 "--client-nat snat|dnat network netmask alias : on client add 1-to-1 NAT rule.\n"
245 "--push-peer-info : (client only) push client info to server.\n"
246 "--setenv name value : Set a custom environmental variable to pass to script.\n"
247 "--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow\n"
248 " directives for future OpenVPN versions to be ignored.\n"
249 "--ignore-unknown-option opt1 opt2 ...: Relax config file syntax. Allow\n"
250 " these options to be ignored when unknown\n"
251 "--script-security level: Where level can be:\n"
252 " 0 -- strictly no calling of external programs\n"
253 " 1 -- (default) only call built-ins such as ifconfig\n"
254 " 2 -- allow calling of built-ins and scripts\n"
255 " 3 -- allow password to be passed to scripts via env\n"
256 "--shaper n : Restrict output to peer to n bytes per second.\n"
257 "--keepalive n m : Helper option for setting timeouts in server mode. Send\n"
258 " ping once every n seconds, restart if ping not received\n"
260 "--inactive n [bytes] : Exit after n seconds of activity on tun/tap device\n"
261 " produces a combined in/out byte count < bytes.\n"
262 "--session-timeout n: Limit connection time to n seconds.\n"
263 "--ping-exit n : Exit if n seconds pass without reception of remote ping.\n"
264 "--ping-restart n: Restart if n seconds pass without reception of remote ping.\n"
265 "--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
267 "--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
268 #if ENABLE_IP_PKTINFO
269 "--multihome : Configure a multi-homed UDP server.\n"
271 "--fast-io : Optimize TUN/TAP/UDP writes.\n"
272 "--remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').\n"
273 "--persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.\n"
274 "--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.\n"
275 "--persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.\n"
276 #if PASSTOS_CAPABILITY
277 "--passtos : TOS passthrough (applies to IPv4 only).\n"
279 "--tun-mtu n : Take the tun/tap device MTU to be n and derive the\n"
280 " TCP/UDP MTU from it (default=%d).\n"
281 "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"
282 " as n bytes more than the tun-mtu size on read\n"
283 " (default TUN=0 TAP=%d).\n"
284 "--link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"
286 "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"
287 " 'no' -- Never send DF (Don't Fragment) frames\n"
288 " 'maybe' -- Use per-route hints\n"
289 " 'yes' -- Always DF (Don't Fragment)\n"
290 "--mtu-test : Empirically measure and report MTU.\n"
291 #ifdef ENABLE_FRAGMENT
292 "--fragment max : Enable internal datagram fragmentation so that no UDP\n"
293 " datagrams are sent which are larger than max bytes.\n"
294 " Adds 4 bytes of overhead per datagram.\n"
296 "--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
297 " or --fragment max value, whichever is lower.\n"
298 "--sndbuf size : Set the TCP/UDP send buffer size.\n"
299 "--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
300 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
301 "--mark value : Mark encrypted packets being sent with value. The mark value\n"
302 " can be matched in policy routing and packetfilter rules.\n"
303 "--bind-dev dev : Bind to the given device when making connection to a peer or\n"
304 " listening for connections. This allows sending encrypted packets\n"
305 " via a VRF present on the system.\n"
307 "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
308 #ifdef ENABLE_MEMSTATS
309 "--memstats file : Write live usage stats to memory mapped binary file.\n"
311 "--mlock : Disable Paging -- ensures key material and tunnel\n"
312 " data will never be written to disk.\n"
313 "--up cmd : Run command cmd after successful tun device open.\n"
314 " Execute as: cmd tun/tap-dev tun-mtu link-mtu \\\n"
315 " ifconfig-local-ip ifconfig-remote-ip\n"
316 " (pre --user or --group UID/GID change)\n"
317 "--up-delay : Delay tun/tap open and possible --up script execution\n"
318 " until after TCP/UDP connection establishment with peer.\n"
319 "--down cmd : Run command cmd after tun device close.\n"
320 " (post --user/--group UID/GID change and/or --chroot)\n"
321 " (command parameters are same as --up option)\n"
322 "--down-pre : Run --down command before TUN/TAP close.\n"
323 "--up-restart : Run up/down commands for all restarts including those\n"
324 " caused by --ping-restart or SIGUSR1\n"
325 "--user user : Set UID to user after initialization.\n"
326 "--group group : Set GID to group after initialization.\n"
327 "--chroot dir : Chroot to this directory after initialization.\n"
328 #ifdef ENABLE_SELINUX
329 "--setcon context: Apply this SELinux context after initialization.\n"
331 "--cd dir : Change to this directory before initialization.\n"
332 "--daemon [name] : Become a daemon after initialization.\n"
333 " The optional 'name' parameter will be passed\n"
334 " as the program name to the system logger.\n"
335 "--syslog [name] : Output to syslog, but do not become a daemon.\n"
336 " See --daemon above for a description of the 'name' parm.\n"
337 "--log file : Output log to file which is created/truncated on open.\n"
338 "--log-append file : Append log to file, or create file if nonexistent.\n"
339 "--suppress-timestamps : Don't log timestamps to stdout/stderr.\n"
340 "--machine-readable-output : Always log timestamp, message flags to stdout/stderr.\n"
341 "--writepid file : Write main process ID to file.\n"
342 "--nice n : Change process priority (>0 = lower, <0 = higher).\n"
343 "--echo [parms ...] : Echo parameters to log output.\n"
344 "--verb n : Set output verbosity to n (default=%d):\n"
345 " (Level 3 is recommended if you want a good summary\n"
346 " of what's happening without being swamped by output).\n"
347 " : 0 -- no output except fatal errors\n"
348 " : 1 -- startup info + connection initiated messages +\n"
349 " non-fatal encryption & net errors\n"
350 " : 2,3 -- show TLS negotiations & route info\n"
351 " : 4 -- show parameters\n"
352 " : 5 -- show 'RrWw' chars on console for each packet sent\n"
353 " and received from TCP/UDP (caps) or tun/tap (lc)\n"
354 " : 6 to 11 -- debug messages of increasing verbosity\n"
355 "--mute n : Log at most n consecutive messages in the same category.\n"
356 "--status file [n] : Write operational status to file every n seconds.\n"
357 "--status-version [n] : Choose the status file format version number.\n"
358 " Currently, n can be 1, 2, or 3 (default=1).\n"
359 "--disable-occ : (DEPRECATED) Disable options consistency check between peers.\n"
361 "--gremlin mask : Special stress testing mode (for debugging only).\n"
363 #if defined(USE_COMP)
364 "--compress alg : Use compression algorithm alg\n"
365 "--allow-compression: Specify whether compression should be allowed\n"
366 #if defined(ENABLE_LZO)
367 "--comp-lzo : Use LZO compression -- may add up to 1 byte per\n"
368 " packet for incompressible data.\n"
369 "--comp-noadapt : Don't use adaptive compression when --comp-lzo\n"
373 #ifdef ENABLE_MANAGEMENT
374 "--management ip port [pass] : Enable a TCP server on ip:port to handle\n"
375 " management functions. pass is a password file\n"
376 " or 'stdin' to prompt from console.\n"
377 #if UNIX_SOCK_SUPPORT
378 " To listen on a unix domain socket, specific the pathname\n"
379 " in place of ip and use 'unix' as the port number.\n"
381 "--management-client : Management interface will connect as a TCP client to\n"
382 " ip/port rather than listen as a TCP server.\n"
383 "--management-query-passwords : Query management channel for private key\n"
384 " and auth-user-pass passwords.\n"
385 "--management-query-proxy : Query management channel for proxy information.\n"
386 "--management-query-remote : Query management channel for --remote directive.\n"
387 "--management-hold : Start " PACKAGE_NAME " in a hibernating state, until a client\n"
388 " of the management interface explicitly starts it.\n"
389 "--management-signal : Issue SIGUSR1 when management disconnect event occurs.\n"
390 "--management-forget-disconnect : Forget passwords when management disconnect\n"
392 "--management-up-down : Report tunnel up/down events to management interface.\n"
393 "--management-log-cache n : Cache n lines of log file history for usage\n"
394 " by the management channel.\n"
395 #if UNIX_SOCK_SUPPORT
396 "--management-client-user u : When management interface is a unix socket, only\n"
397 " allow connections from user u.\n"
398 "--management-client-group g : When management interface is a unix socket, only\n"
399 " allow connections from group g.\n"
401 "--management-client-auth : gives management interface client the responsibility\n"
402 " to authenticate clients after their client certificate\n"
403 " has been verified.\n"
406 "--plugin m [str]: Load plug-in module m passing str as an argument\n"
407 " to its initialization function.\n"
409 "--vlan-tagging : Enable 802.1Q-based VLAN tagging.\n"
410 "--vlan-accept tagged|untagged|all : Set VLAN tagging mode. Default is 'all'.\n"
411 "--vlan-pvid v : Sets the Port VLAN Identifier. Defaults to 1.\n"
413 "Multi-Client Server options (when --mode server is used):\n"
414 "--server network netmask : Helper option to easily configure server mode.\n"
415 "--server-ipv6 network/bits : Configure IPv6 server mode.\n"
416 "--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to\n"
417 " easily configure ethernet bridging server mode.\n"
418 "--push \"option\" : Push a config file option back to the peer for remote\n"
419 " execution. Peer must specify --pull in its config file.\n"
420 "--push-reset : Don't inherit global push list for specific\n"
421 " client instance.\n"
422 "--push-remove opt : Remove options matching 'opt' from the push list for\n"
423 " a specific client instance.\n"
424 "--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets\n"
425 " to be dynamically allocated to connecting clients.\n"
426 "--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool\n"
427 " data to file, at seconds intervals (default=600).\n"
428 " If seconds=0, file will be treated as read-only.\n"
429 "--ifconfig-ipv6-pool base-IP/bits : set aside an IPv6 network block\n"
430 " to be dynamically allocated to connecting clients.\n"
431 "--ifconfig-push local remote-netmask : Push an ifconfig option to remote,\n"
432 " overrides --ifconfig-pool dynamic allocation.\n"
433 " Only valid in a client-specific config file.\n"
434 "--ifconfig-ipv6-push local/bits remote : Push an ifconfig-ipv6 option to\n"
435 " remote, overrides --ifconfig-ipv6-pool allocation.\n"
436 " Only valid in a client-specific config file.\n"
437 "--iroute network [netmask] : Route subnet to client.\n"
438 "--iroute-ipv6 network/bits : Route IPv6 subnet to client.\n"
439 " Sets up internal routes only.\n"
440 " Only valid in a client-specific config file.\n"
441 "--disable : Client is disabled.\n"
442 " Only valid in a client-specific config file.\n"
443 "--verify-client-cert [none|optional|require] : perform no, optional or\n"
444 " mandatory client certificate verification.\n"
445 " Default is to require the client to supply a certificate.\n"
446 "--username-as-common-name : For auth-user-pass authentication, use\n"
447 " the authenticated username as the common name,\n"
448 " rather than the common name from the client cert.\n"
449 "--auth-user-pass-verify cmd method: Query client for username/password and\n"
450 " run command cmd to verify. If method='via-env', pass\n"
451 " user/pass via environment, if method='via-file', pass\n"
452 " user/pass via temporary file.\n"
453 "--auth-gen-token [lifetime] Generate a random authentication token which is pushed\n"
454 " to each client, replacing the password. Useful when\n"
455 " OTP based two-factor auth mechanisms are in use and\n"
456 " --reneg-* options are enabled. Optionally a lifetime in seconds\n"
457 " for generated tokens can be set.\n"
458 "--opt-verify : (DEPRECATED) Clients that connect with options that are incompatible\n"
459 " with those of the server will be disconnected.\n"
460 "--auth-user-pass-optional : Allow connections by clients that don't\n"
461 " specify a username/password.\n"
462 "--no-name-remapping : (DEPRECATED) Allow Common Name and X509 Subject to include\n"
463 " any printable character.\n"
464 "--client-to-client : Internally route client-to-client traffic.\n"
465 "--duplicate-cn : Allow multiple clients with the same common name to\n"
466 " concurrently connect.\n"
467 "--client-connect cmd : Run command cmd on client connection.\n"
468 "--client-disconnect cmd : Run command cmd on client disconnection.\n"
469 "--client-config-dir dir : Directory for custom client config files.\n"
470 "--ccd-exclusive : Refuse connection unless custom client config is found.\n"
471 "--tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.\n"
472 "--hash-size r v : Set the size of the real address hash table to r and the\n"
473 " virtual address table to v.\n"
474 "--bcast-buffers n : Allocate n broadcast buffers.\n"
475 "--tcp-queue-limit n : Maximum number of queued TCP output packets.\n"
476 "--tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server\n"
477 " as well as pushes it to connecting clients.\n"
478 "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
479 "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
480 "--connect-freq-initial n s : Allow a maximum of n replies for initial connections attempts per s seconds.\n"
481 "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
482 "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"
483 "--stale-routes-check n [t] : Remove routes with a last activity timestamp\n"
484 " older than n seconds. Run this check every t\n"
485 " seconds (defaults to n).\n"
486 "--explicit-exit-notify [n] : In UDP server mode send [RESTART] command on exit/restart to connected\n"
487 " clients. n = 1 - reconnect to same server,\n"
488 " 2 - advance to next server, default=1.\n"
490 "--port-share host port [dir] : When run in TCP mode, proxy incoming HTTPS\n"
491 " sessions to a web server at host:port. dir specifies an\n"
492 " optional directory to write origin IP:port data.\n"
495 "Client options (when connecting to a multi-client server):\n"
496 "--client : Helper option to easily configure client mode.\n"
497 "--auth-user-pass [up] : Authenticate with server using username/password.\n"
498 " up is a file containing the username on the first line,\n"
499 " and a password on the second. If either the password or both\n"
500 " the username and the password are omitted OpenVPN will prompt\n"
501 " for them from console.\n"
502 "--pull : Accept certain config file options from the peer as if they\n"
503 " were part of the local config file. Must be specified\n"
504 " when connecting to a '--mode server' remote host.\n"
505 "--pull-filter accept|ignore|reject t : Filter each option received from the\n"
506 " server if it starts with the text t. The action flag accept,\n"
507 " ignore or reject causes the option to be allowed, removed or\n"
508 " rejected with error. May be specified multiple times, and\n"
509 " each filter is applied in the order of appearance.\n"
510 "--dns server <n> <option> <value> [value ...] : Configure option for DNS server #n\n"
511 " Valid options are :\n"
512 " address <addr[:port]> [addr[:port] ...] : server addresses 4/6\n"
513 " resolve-domains <domain> [domain ...] : split domains\n"
514 " dnssec <yes|no|optional> : option to use DNSSEC\n"
515 " type <DoH|DoT> : query server over HTTPS / TLS\n"
516 " sni <domain> : DNS server name indication\n"
517 "--dns search-domains <domain> [domain ...]:\n"
518 " Add domains to DNS domain search list\n"
519 "--auth-retry t : How to handle auth failures. Set t to\n"
520 " none (default), interact, or nointeract.\n"
521 "--static-challenge t e : Enable static challenge/response protocol using\n"
522 " challenge text t, with e indicating echo flag (0|1)\n"
523 "--connect-timeout n : when polling possible remote servers to connect to\n"
524 " in a round-robin fashion, spend no more than n seconds\n"
525 " waiting for a response before trying the next server.\n"
526 "--allow-recursive-routing : When this option is set, OpenVPN will not drop\n"
527 " incoming tun packets with same destination as host.\n"
528 "--explicit-exit-notify [n] : On exit/restart, send exit signal to\n"
529 " server/remote. n = # of retries, default=1.\n"
531 "Data Channel Encryption Options (must be compatible between peers):\n"
532 "(These options are meaningful for both Static Key & TLS-mode)\n"
533 "--auth alg : Authenticate packets with HMAC using message\n"
534 " digest algorithm alg (default=%s).\n"
535 " (usually adds 16 or 20 bytes per packet)\n"
536 " Set alg=none to disable authentication.\n"
537 "--cipher alg : Encrypt packets with cipher algorithm alg.\n"
538 " You should usually use --data-ciphers instead.\n"
539 " Set alg=none to disable encryption.\n"
540 "--data-ciphers list : List of ciphers that are allowed to be negotiated.\n"
541 #ifndef ENABLE_CRYPTO_MBEDTLS
542 "--engine [name] : Enable OpenSSL hardware crypto engine functionality.\n"
544 "--mute-replay-warnings : Silence the output of replay warnings to log file.\n"
545 "--replay-window n [t] : Use a replay protection sliding window of size n\n"
546 " and a time window of t seconds.\n"
547 " Default n=%d t=%d\n"
548 "--replay-persist file : Persist replay-protection state across sessions\n"
550 "--test-crypto : Run a self-test of crypto features enabled.\n"
551 " For debugging only.\n"
552 #ifdef ENABLE_PREDICTION_RESISTANCE
553 "--use-prediction-resistance: Enable prediction resistance on the random\n"
554 " number generator.\n"
557 "TLS Key Negotiation Options:\n"
558 "(These options are meaningful only for TLS-mode)\n"
559 "--tls-server : Enable TLS and assume server role during TLS handshake.\n"
560 "--tls-client : Enable TLS and assume client role during TLS handshake.\n"
561 "--ca file : Certificate authority file in .pem format containing\n"
562 " root certificate.\n"
563 #ifndef ENABLE_CRYPTO_MBEDTLS
564 "--capath dir : A directory of trusted certificates (CAs"
567 "--dh file : File containing Diffie Hellman parameters\n"
568 " in .pem format (for --tls-server only).\n"
569 " Use \"openssl dhparam -out dh1024.pem 1024\" to generate.\n"
570 "--cert file : Local certificate in .pem format -- must be signed\n"
571 " by a Certificate Authority in --ca file.\n"
572 "--extra-certs file : one or more PEM certs that complete the cert chain.\n"
573 "--key file : Local private key in .pem format.\n"
574 "--tls-version-min <version> ['or-highest'] : sets the minimum TLS version we\n"
575 " will accept from the peer. If version is unrecognized and 'or-highest'\n"
576 " is specified, require max TLS version supported by SSL implementation.\n"
577 "--tls-version-max <version> : sets the maximum TLS version we will use.\n"
578 #ifndef ENABLE_CRYPTO_MBEDTLS
579 "--pkcs12 file : PKCS#12 file containing local private key, local certificate\n"
580 " and optionally the root CA certificate.\n"
582 #ifdef ENABLE_X509ALTUSERNAME
583 "--x509-username-field : Field in x509 certificate containing the username.\n"
584 " Default is CN in the Subject field.\n"
586 "--verify-hash hash [algo] : Specify fingerprint for level-1 certificate.\n"
587 " Valid algo flags are SHA1 and SHA256. \n"
589 "--cryptoapicert select-string : Load the certificate and private key from the\n"
590 " Windows Certificate System Store.\n"
592 "--tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).\n"
593 "--tls-ciphersuites l: A list of allowed TLS 1.3 cipher suites separated by : (optional)\n"
594 " : Use --show-tls to see a list of supported TLS ciphers (suites).\n"
595 "--tls-cert-profile p : Set the allowed certificate crypto algorithm profile\n"
596 " (default=legacy).\n"
597 "--providers l : A list l of OpenSSL providers to load.\n"
598 "--tls-timeout n : Packet retransmit timeout on TLS control channel\n"
599 " if no ACK from remote within n seconds (default=%d).\n"
600 "--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.\n"
601 "--reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.\n"
602 "--reneg-sec max [min] : Renegotiate data chan. key after at most max (default=%d)\n"
603 " and at least min (defaults to 90%% of max on servers and equal\n"
604 " to max on clients).\n"
605 "--hand-window n : Data channel key exchange must finalize within n seconds\n"
606 " of handshake initiation by any peer (default=%d).\n"
607 "--tran-window n : Transition window -- old key can live this many seconds\n"
608 " after new key renegotiation begins (default=%d).\n"
609 "--single-session: Allow only one session (reset state on restart).\n"
610 "--tls-exit : Exit on TLS negotiation failure.\n"
611 "--tls-auth f [d]: Add an additional layer of authentication on top of the TLS\n"
612 " control channel to protect against attacks on the TLS stack\n"
613 " and DoS attacks.\n"
614 " f (required) is a shared-secret key file.\n"
615 " The optional d parameter controls key directionality.\n"
616 "--tls-crypt key : Add an additional layer of authenticated encryption on top\n"
617 " of the TLS control channel to hide the TLS certificate,\n"
618 " provide basic post-quantum security and protect against\n"
619 " attacks on the TLS stack and DoS attacks.\n"
620 " key (required) provides the pre-shared key file.\n"
621 "--tls-crypt-v2 key : For clients: use key as a client-specific tls-crypt key.\n"
622 " For servers: use key to decrypt client-specific keys. For\n"
623 " key generation (--genkey tls-crypt-v2-client): use key to\n"
624 " encrypt generated client-specific key. (See --tls-crypt.)\n"
625 "--genkey tls-crypt-v2-client [keyfile] [base64 metadata]: Generate a\n"
626 " fresh tls-crypt-v2 client key, and store to\n"
627 " keyfile. If supplied, include metadata in wrapped key.\n"
628 "--genkey tls-crypt-v2-server [keyfile] [base64 metadata]: Generate a\n"
629 " fresh tls-crypt-v2 server key, and store to keyfile\n"
630 "--tls-crypt-v2-verify cmd : Run command cmd to verify the metadata of the\n"
631 " client-supplied tls-crypt-v2 client key\n"
632 "--askpass [file]: Get PEM password from controlling tty before we daemonize.\n"
633 "--auth-nocache : Don't cache --askpass or --auth-user-pass passwords.\n"
634 "--crl-verify crl ['dir']: Check peer certificate against a CRL.\n"
635 "--tls-verify cmd: Run command cmd to verify the X509 name of a\n"
636 " pending TLS connection that has otherwise passed all other\n"
637 " tests of certification. cmd should return 0 to allow\n"
638 " TLS handshake to proceed, or 1 to fail. (cmd is\n"
639 " executed as 'cmd certificate_depth subject')\n"
640 "--verify-x509-name name: Accept connections only from a host with X509 subject\n"
641 " DN name. The remote host must also pass all other tests\n"
642 " of verification.\n"
643 #ifndef ENABLE_CRYPTO_MBEDTLS
644 "--ns-cert-type t: (DEPRECATED) Require that peer certificate was signed with \n"
645 " an explicit nsCertType designation t = 'client' | 'server'.\n"
647 "--x509-track x : Save peer X509 attribute x in environment for use by\n"
648 " plugins and management interface.\n"
649 #ifdef HAVE_EXPORT_KEYING_MATERIAL
650 "--keying-material-exporter label len : Save Exported Keying Material (RFC5705)\n"
651 " of len bytes (min. 16 bytes) using label in environment for use by plugins.\n"
653 "--remote-cert-ku v ... : Require that the peer certificate was signed with\n"
654 " explicit key usage, you can specify more than one value.\n"
655 " value should be given in hex format.\n"
656 "--remote-cert-eku oid : Require that the peer certificate was signed with\n"
657 " explicit extended key usage. Extended key usage can be encoded\n"
658 " as an object identifier or OpenSSL string representation.\n"
659 "--remote-cert-tls t: Require that peer certificate was signed with explicit\n"
660 " key usage and extended key usage based on RFC3280 TLS rules.\n"
661 " t = 'client' | 'server'.\n"
665 "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"
666 "--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication\n"
667 " path. Set for each provider.\n"
668 "--pkcs11-private-mode hex ... : PKCS#11 private key mode mask.\n"
669 " 0 : Try to determine automatically (default).\n"
671 " 2 : Use SignRecover.\n"
672 " 4 : Use Decrypt.\n"
674 "--pkcs11-cert-private [0|1] ... : Set if login should be performed before\n"
675 " certificate can be accessed. Set for each provider.\n"
676 "--pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1\n"
677 " cache until token is removed.\n"
678 "--pkcs11-id-management : Acquire identity from management interface.\n"
679 "--pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids\n"
682 "SSL Library information:\n"
683 "--show-ciphers : Show cipher algorithms to use with --cipher option.\n"
684 "--show-digests : Show message digest algorithms to use with --auth option.\n"
685 "--show-engines : Show hardware crypto accelerator engines (if available).\n"
686 "--show-tls : Show all TLS ciphers (TLS used only as a control channel).\n"
689 "Windows Specific:\n"
690 "--win-sys path : Pathname of Windows system directory. Default is the pathname\n"
691 " from SystemRoot environment variable.\n"
692 "--ip-win32 method : When using --ifconfig on Windows, set TAP-Windows adapter\n"
693 " IP address using method = manual, netsh, ipapi,\n"
694 " dynamic, or adaptive (default = adaptive).\n"
695 " Dynamic method allows two optional parameters:\n"
696 " offset: DHCP server address offset (> -256 and < 256).\n"
697 " If 0, use network address, if >0, take nth\n"
698 " address forward from network address, if <0,\n"
699 " take nth address backward from broadcast\n"
702 " lease-time: Lease time in seconds.\n"
703 " Default is one year.\n"
704 "--route-method : Which method to use for adding routes on Windows?\n"
705 " adaptive (default) -- Try ipapi then fall back to exe.\n"
706 " ipapi -- Use IP helper API.\n"
707 " exe -- Call the route.exe shell command.\n"
708 "--dhcp-option type [parm] : Set extended TAP-Windows properties, must\n"
709 " be used with --ip-win32 dynamic. For options\n"
710 " which allow multiple addresses,\n"
711 " --dhcp-option must be repeated.\n"
712 " DOMAIN name : Set DNS suffix\n"
713 " DOMAIN-SEARCH entry : Add entry to DNS domain search list\n"
714 " DNS addr : Set domain name server address(es) (IPv4 and IPv6)\n"
715 " NTP : Set NTP server address(es)\n"
716 " NBDD : Set NBDD server address(es)\n"
717 " WINS addr : Set WINS server address(es)\n"
718 " NBT type : Set NetBIOS over TCP/IP Node type\n"
719 " 1: B, 2: P, 4: M, 8: H\n"
720 " NBS id : Set NetBIOS scope ID\n"
721 " DISABLE-NBT : Disable Netbios-over-TCP/IP.\n"
722 "--dhcp-renew : Ask Windows to renew the TAP adapter lease on startup.\n"
723 "--dhcp-pre-release : Ask Windows to release the previous TAP adapter lease on\n"
725 "--register-dns : Run ipconfig /flushdns and ipconfig /registerdns\n"
726 " on connection initiation.\n"
727 "--tap-sleep n : Sleep for n seconds after TAP adapter open before\n"
728 " attempting to set adapter properties.\n"
729 "--pause-exit : When run from a console window, pause before exiting.\n"
730 "--service ex [0|1] : For use when " PACKAGE_NAME " is being instantiated by a\n"
731 " service, and should not be used directly by end-users.\n"
732 " ex is the name of an event object which, when\n"
733 " signaled, will cause " PACKAGE_NAME " to exit. A second\n"
734 " optional parameter controls the initial state of ex.\n"
735 "--show-net-up : Show " PACKAGE_NAME "'s view of routing table and net adapter list\n"
736 " after TAP adapter is up and routes have been added.\n"
737 "--windows-driver : Which tun driver to use?\n"
738 " ovpn-dco (default)\n"
741 "--block-outside-dns : Block DNS on other network adapters to prevent DNS leaks\n"
742 "Windows Standalone Options:\n"
744 "--show-adapters : Show all TAP-Windows adapters.\n"
745 "--show-net : Show " PACKAGE_NAME "'s view of routing table and net adapter list.\n"
746 "--show-valid-subnets : Show valid subnets for --dev tun emulation.\n"
747 "--allow-nonadmin [TAP-adapter] : Allow " PACKAGE_NAME " running without admin privileges\n"
748 " to access TAP adapter.\n"
751 "Generate a new key :\n"
752 "--genkey tls-auth file : Generate a new random key of type and write to file\n"
753 " (for use with --tls-auth or --tls-crypt)."
754 #ifdef ENABLE_FEATURE_TUN_PERSIST
756 "Tun/tap config mode (available with linux 2.4+):\n"
757 "--mktun : Create a persistent tunnel.\n"
758 "--rmtun : Remove a persistent tunnel.\n"
759 "--dev tunX|tapX : tun/tap device\n"
760 "--dev-type dt : Device type. See tunnel options above for details.\n"
761 "--user user : User to set privilege to.\n"
762 "--group group : Group to set privilege to.\n"
766 "PKCS#11 standalone options:\n"
767 #ifdef DEFAULT_PKCS11_MODULE
768 "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
770 "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
772 " --verb option can be added *BEFORE* this.\n"
775 "General Standalone Options:\n"
777 "--show-gateway : Show info about default gateway.\n"
801 o->
ce.
af = AF_UNSPEC;
825 #ifdef ENABLE_MANAGEMENT
830 #ifdef ENABLE_FEATURE_TUN_PERSIST
862 #ifdef ENABLE_PREDICTION_RESISTANCE
863 o->use_prediction_resistance =
false;
873 #ifdef ENABLE_X509ALTUSERNAME
877 o->pkcs11_pin_cache_period = -1;
892 msg(
M_USAGE,
"Could not find a suitable temporary directory."
893 " (GetTempPath() failed). Consider using --tmp-dir");
930 #define PUF_TYPE_UNDEF 0
931 #define PUF_TYPE_ACCEPT 1
932 #define PUF_TYPE_IGNORE 2
933 #define PUF_TYPE_REJECT 3
969 #define SHOW_PARM(name, value, format) msg(D_SHOW_PARMS, " " #name " = " format, (value))
970 #define SHOW_STR(var) SHOW_PARM(var, (o->var ? o->var : "[UNDEF]"), "'%s'")
971 #define SHOW_STR_INLINE(var) SHOW_PARM(var, \
972 o->var ## _inline ? "[INLINE]" : \
973 (o->var ? o->var : "[UNDEF]"), \
975 #define SHOW_INT(var) SHOW_PARM(var, o->var, "%d")
976 #define SHOW_UINT(var) SHOW_PARM(var, o->var, "%u")
977 #define SHOW_INT64(var) SHOW_PARM(var, o->var, "%" PRIi64)
978 #define SHOW_UNSIGNED(var) SHOW_PARM(var, o->var, "0x%08x")
979 #define SHOW_BOOL(var) SHOW_PARM(var, (o->var ? "ENABLED" : "DISABLED"), "%s");
1050 for (i = 0; i <
len; ++i)
1068 msg(
M_WARN,
"foreign_option: name/value overflow");
1079 bool succeeded =
false;
1087 ret =
getaddr(flags, ip_string, 0, &succeeded, NULL);
1088 if (!succeeded && error)
1103 const char *end = strchr(addr,
'/');
1111 size_t len = end - addr;
1113 memcpy(ret, addr,
len);
1121 struct in6_addr t_addr;
1122 unsigned int t_bits;
1130 char *ret = (
char *)
gc_malloc(strlen(src) + 1,
true, gc);
1160 const char *cp = str;
1168 while (*cp && i < nbytes)
1171 if (!isxdigit(cp[0])
1173 || (cp[2] !=
':' && cp[2] !=
'\0')
1174 || sscanf(cp,
"%x", &
byte) != 1)
1176 msg(msglevel,
"format error in hash fingerprint: %s", str);
1180 ret->
hash[i++] = (uint8_t)
byte;
1191 msg(msglevel,
"hash fingerprint is wrong length - expected %d bytes, got %d: %s", nbytes, i, str);
1193 else if (term !=
'\0')
1195 msg(msglevel,
"hash fingerprint too long - expected only %d bytes: %s", nbytes, str);
1220 while ((line =
strsep(&lines,
"\n")))
1223 while (isspace(*line))
1228 if (strlen(line) == 0 || *line ==
'#' || *line ==
';')
1251 #ifndef ENABLE_SMALL
1257 for (i = 0; i < len; ++i)
1268 for (i = 0; i < len; ++i)
1304 #if defined(_WIN32) || defined(TARGET_ANDROID)
1308 struct in6_addr addr;
1311 msg(msglevel,
"--dhcp-option DNS: maximum of %d IPv6 dns servers can be specified",
1316 dns6_list[(*len)++] = addr;
1324 msg(msglevel,
"--dhcp-option %s: maximum of %d %s servers can be specified",
1334 const in_addr_t addr =
get_ip_addr(parm, msglevel, &error);
1337 array[(*len)++] = addr;
1342 msg(msglevel,
"dhcp-option parameter %s '%s' must be an IP address", name, parm);
1365 domain = domain->
next;
1369 msg(
M_WARN,
"WARNING: couldn't copy all --dns search-domains to --dhcp-option");
1378 bool overflow =
false;
1403 server = server->
next;
1407 msg(
M_WARN,
"WARNING: couldn't copy all --dns server addresses to --dhcp-option");
1418 if (!domain && !server)
1427 for (
int i = 1; i <= opt_max; ++i)
1430 snprintf(name,
sizeof(name),
"foreign_option_%d", i);
1433 const char *value = strchr(env_str,
'=') + 1;
1434 if ((domain && strstr(value,
"dhcp-option DOMAIN-SEARCH") == value)
1435 || (server && strstr(value,
"dhcp-option DNS") == value))
1441 setenv_foreign_option(o, &value, 1,
es);
1453 const char *
argv[] = {
1458 setenv_foreign_option(o,
argv, 3,
es);
1462 const char *
argv[] = {
1467 setenv_foreign_option(o,
argv, 3,
es);
1470 server = server->
next;
1474 const char *
argv[] = {
"dhcp-option",
"DOMAIN-SEARCH", domain->
name };
1475 setenv_foreign_option(o,
argv, 3,
es);
1476 domain = domain->
next;
1485 snprintf(name,
sizeof(name),
"foreign_option_%d", opt_max--);
1491 #ifndef ENABLE_SMALL
1538 SHOW_STR(ifconfig_pool_persist_filename);
1539 SHOW_INT(ifconfig_pool_persist_refresh_freq);
1542 SHOW_INT(ifconfig_ipv6_pool_netbits);
1549 SHOW_STR(client_disconnect_script);
1550 SHOW_STR(client_crresponse_script);
1568 SHOW_STR(auth_user_pass_verify_script);
1569 SHOW_BOOL(auth_user_pass_verify_script_via_file);
1593 const char *network_str,
1594 const char *netmask_str,
1610 msg(msglevel,
"in --iroute %s %s : Bad network/subnet specification",
1623 const char *prefix_str,
1632 msg(msglevel,
"in --iroute-ipv6 %s: Bad IPv6 prefix specification",
1641 #ifndef ENABLE_SMALL
1709 #ifndef ENABLE_SMALL
1741 #ifdef ENABLE_FRAGMENT
1748 SHOW_INT(explicit_exit_notification);
1765 for (i = 0; i < l->
len; ++i)
1800 #ifndef ENABLE_SMALL
1807 #ifdef ENABLE_FEATURE_TUN_PERSIST
1829 #if defined(ENABLE_DCO)
1861 #if PASSTOS_CAPABILITY
1872 #ifdef ENABLE_SELINUX
1898 #if defined(TARGET_LINUX) && HAVE_DECL_SO_MARK
1932 #ifdef ENABLE_MANAGEMENT
1936 SHOW_INT(management_log_history_cache);
1937 SHOW_INT(management_echo_buffer_size);
1942 #ifdef ENABLE_PLUGIN
1954 #ifndef ENABLE_CRYPTO_MBEDTLS
1962 #ifdef ENABLE_PREDICTION_RESISTANCE
1973 SHOW_PARM(
"cert_file",
"EXTERNAL_CERT",
"%s");
1983 SHOW_PARM(
"priv_key_file",
"EXTERNAL_PRIVATE_KEY",
"%s");
1989 #ifndef ENABLE_CRYPTO_MBEDTLS
1992 #ifdef ENABLE_CRYPTOAPI
1999 SHOW_STR(tls_export_peer_cert_dir);
2046 #ifdef ENABLE_PKCS11
2049 for (i = 0; i<
MAX_PARMS && o->pkcs11_providers[i] != NULL; i++)
2051 SHOW_PARM(pkcs11_providers, o->pkcs11_providers[i],
"%s");
2058 SHOW_PARM(pkcs11_protected_authentication, o->pkcs11_protected_authentication[i] ?
"ENABLED" :
"DISABLED",
"%s");
2065 SHOW_PARM(pkcs11_private_mode, o->pkcs11_private_mode[i],
"%08x");
2072 SHOW_PARM(pkcs11_cert_private, o->pkcs11_cert_private[i] ?
"ENABLED" :
"DISABLED",
"%s");
2096 #ifdef ENABLE_MANAGEMENT
2111 if (flags && !strcmp(flags,
"nct"))
2134 bool succeed =
false;
2135 for (i = 0; i < l->
len; ++i)
2146 for (i = 0; i < l->
len; ++i)
2157 msg(
M_WARN,
"Note: option http-proxy-override ignored because no TCP-based connection profiles are defined");
2185 msg(msglevel,
"Unable to process more connection options: out of memory. Number of entries = %d", l->
len);
2218 msg(msglevel,
"Unable to process more remote options: out of memory. Number of entries = %d", l->
len);
2285 if (key_file && *key_file && !(*key_inline))
2290 msg(
M_FATAL,
"Cannot pre-load keyfile (%s)", *key_file);
2293 *key_file = (
const char *) in.
data;
2304 #ifndef ENABLE_CRYPTO_MBEDTLS
2312 const char *
const str =
"You must define CA file (--ca)"
2313 #ifndef ENABLE_CRYPTO_MBEDTLS
2314 " or CA path (--capath)"
2316 " and/or peer fingerprint verification (--peer-fingerprint)";
2351 "--proto tcp is ambiguous in this context. Please specify "
2352 "--proto tcp-server or --proto tcp-client");
2357 msg(
M_USAGE,
"--lladdr can only be used in --dev tap mode");
2365 msg(
M_USAGE,
"only one of --tun-mtu or --link-mtu may be defined");
2370 msg(
M_USAGE,
"--mtu-test only makes sense with --proto udp");
2384 msg(
M_USAGE,
"--remote and --local addresses are the same");
2391 "--local and --remote addresses must be distinct from --ifconfig "
2399 "--local addresses must be distinct from --ifconfig addresses");
2406 "local and remote/netmask --ifconfig addresses must be different");
2411 msg(
M_USAGE,
"--bind and --nobind can't be used together");
2417 "--local and --nobind don't make sense when used together");
2423 "--lport and --nobind don't make sense when used together");
2428 msg(
M_USAGE,
"--nobind doesn't make sense unless used with --remote");
2434 #ifdef ENABLE_MANAGEMENT
2439 msg(
M_USAGE,
"--management is not specified, however one or more options which modify the behavior of --management were specified");
2445 msg(
M_USAGE,
"--management-client-(user|group) can only be used on unix domain sockets");
2452 msg(
M_WARN,
"WARNING: Using --management on a TCP port WITHOUT "
2453 "passwords is STRONGLY discouraged and considered insecure");
2458 #if !defined(HAVE_XKEY_PROVIDER)
2464 msg(
M_FATAL,
"management-external-key with TLS 1.3 or later requires "
2465 "nopadding argument/support");
2475 msg(
M_USAGE,
"On Windows, --ifconfig is required when --dev tun is used");
2481 msg(
M_USAGE,
"On Windows, --ip-win32 doesn't make sense unless --ifconfig is also used");
2486 const char *prefix =
"Some --dhcp-option or --dns options require DHCP server";
2489 msg(
M_USAGE,
"%s, which is not supported by the selected %s driver",
2495 msg(
M_USAGE,
"%s, which requires --ip-win32 dynamic or adaptive",
2502 msg(
M_USAGE,
"--windows-driver wintun requires --dev tun");
2510 #ifdef ENABLE_FRAGMENT
2513 msg(
M_USAGE,
"--fragment can only be used with --proto udp");
2519 msg(
M_USAGE,
"--remote MUST be used in TCP Client mode");
2525 "--http-proxy MUST be used in TCP Client mode (i.e. --proto "
2532 "--http-proxy not specified but other http proxy options present");
2538 "--http-proxy can not be used together with --socks-proxy");
2543 msg(
M_USAGE,
"--socks-proxy can not be used in TCP Server mode");
2548 msg(
M_USAGE,
"TCP server mode allows at most one --remote address");
2556 #define USAGE_VALID_SERVER_PROTOS "--mode server currently only supports " \
2557 "--proto values of udp, tcp-server, tcp4-server, or tcp6-server"
2558 #ifdef TARGET_ANDROID
2559 msg(
M_FATAL,
"--mode server not supported on Android");
2563 msg(
M_USAGE,
"--mode server only works with --dev tun or --dev tap");
2567 msg(
M_USAGE,
"--pull cannot be used with --mode server");
2571 msg(
M_WARN,
"--pull-filter ignored for --mode server");
2581 msg(
M_USAGE,
"--port-share only works in TCP server mode "
2582 "(--proto values of tcp-server, tcp4-server, or tcp6-server)");
2587 msg(
M_USAGE,
"--mode server requires --tls-server");
2591 msg(
M_USAGE,
"--remote cannot be used with --mode server");
2595 msg(
M_USAGE,
"--nobind cannot be used with --mode server");
2599 msg(
M_USAGE,
"--http-proxy cannot be used with --mode server");
2603 msg(
M_USAGE,
"--socks-proxy cannot be used with --mode server");
2611 msg(
M_USAGE,
"<connection> cannot be used with --mode server");
2616 msg(
M_USAGE,
"--shaper cannot be used with --mode server");
2621 "--ipchange cannot be used with --mode server (use "
2622 "--client-connect instead)");
2630 msg(
M_USAGE,
"--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
2634 msg(
M_USAGE,
"The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
2638 msg(
M_USAGE,
"--redirect-gateway cannot be used with --mode server (however --push \"redirect-gateway\" is fine)");
2642 msg(
M_USAGE,
"--route-delay cannot be used with --mode server");
2646 msg(
M_USAGE,
"--up-delay cannot be used with --mode server");
2653 "--ifconfig-pool-persist must be used with --ifconfig-pool or --ifconfig-ipv6-pool");
2657 msg(
M_USAGE,
"--ifconfig-ipv6-pool needs --ifconfig-ipv6");
2661 msg(
M_USAGE,
"--allow-recursive-routing cannot be used with --mode server");
2665 msg(
M_USAGE,
"--auth-user-pass cannot be used with --mode server (it should be used on the client side only)");
2669 msg(
M_USAGE,
"--ccd-exclusive must be used with --client-config-dir");
2673 msg(
M_USAGE,
"--auth-gen-token needs a non-infinite "
2674 "--renegotiate_seconds setting");
2679 msg(
M_USAGE,
"--auth-gen-token renewal time needs to be at least "
2680 " two times --hand-window (%d).",
2688 const char *postfix =
"must be used with --management-client-auth, an --auth-user-pass-verify script, or plugin";
2691 msg(
M_USAGE,
"--verify-client-cert none|optional %s", postfix);
2695 msg(
M_USAGE,
"--username-as-common-name %s", postfix);
2699 msg(
M_USAGE,
"--auth-user-pass-optional %s", postfix);
2705 msg(
M_USAGE,
"--vlan-tagging must be used with --dev tap");
2711 msg(
M_USAGE,
"--vlan-accept requires --vlan-tagging");
2715 msg(
M_USAGE,
"--vlan-pvid requires --vlan-tagging");
2727 msg(
M_USAGE,
"--ifconfig-pool/--ifconfig-pool-persist requires --mode server");
2731 msg(
M_USAGE,
"--ifconfig-ipv6-pool requires --mode server");
2736 msg(
M_USAGE,
"--hash-size requires --mode server");
2740 msg(
M_USAGE,
"--learn-address requires --mode server");
2744 msg(
M_USAGE,
"--client-connect requires --mode server");
2748 msg(
M_USAGE,
"--client-crresponse requires --mode server");
2752 msg(
M_USAGE,
"--client-disconnect requires --mode server");
2756 msg(
M_USAGE,
"--client-config-dir/--ccd-exclusive requires --mode server");
2760 msg(
M_USAGE,
"--client-to-client requires --mode server");
2764 msg(
M_USAGE,
"--duplicate-cn requires --mode server");
2768 msg(
M_USAGE,
"--connect-freq requires --mode server");
2772 msg(
M_USAGE,
"--verify-client-cert requires --mode server");
2776 msg(
M_USAGE,
"--username-as-common-name requires --mode server");
2780 msg(
M_USAGE,
"--auth-user-pass-optional requires --mode server");
2784 msg(
M_USAGE,
"--opt-verify requires --mode server");
2788 msg(
M_WARN,
"WARNING: setting tcp-nodelay on the client side will not "
2789 "affect the server. To have TCP_NODELAY in both direction use "
2790 "tcp-nodelay in the server configuration instead.");
2794 msg(
M_USAGE,
"--auth-user-pass-verify requires --mode server");
2798 msg(
M_USAGE,
"--auth-gen-token requires --mode server");
2803 msg(
M_USAGE,
"--port-share requires TCP server mode (--mode server --proto tcp-server)");
2809 msg(
M_USAGE,
"--stale-routes-check requires --mode server");
2814 msg(
M_USAGE,
"--vlan-tagging requires --mode server");
2819 msg(
M_USAGE,
"--force-tls-key-material-export requires --mode server");
2829 msg(
M_USAGE,
"specify only one of --tls-server, --tls-client, or --secret");
2840 msg(msglevel,
"DEPRECATION: No tls-client or tls-server option in "
2841 "configuration detected. OpenVPN 2.8 will remove the "
2842 "functionality to run a VPN without TLS. "
2843 "See the examples section in the manual page for "
2844 "examples of a similar quick setup with peer-fingerprint."
2845 "OpenVPN 2.7 allows using this configuration when using "
2846 "--allow-deprecated-insecure-static-crypto but you should move"
2847 "to a proper configuration using TLS as soon as possible."
2853 msg(
M_WARN,
"WARNING: POTENTIALLY DANGEROUS OPTION "
2854 "--verify-client-cert none|optional "
2855 "may accept clients which do not present a certificate");
2861 const int tls_version_min =
2867 msg(
M_USAGE,
"--tls-version-min bigger than --tls-version-max");
2873 #ifdef ENABLE_PKCS11
2876 msg(
M_WARN,
"Option pkcs11-id is ignored as no pkcs11-providers are specified");
2878 else if (!
options->pkcs11_providers[0] &&
options->pkcs11_id_management)
2880 msg(
M_WARN,
"Option pkcs11-id-management is ignored as no pkcs11-providers are specified");
2883 if (
options->pkcs11_providers[0])
2887 msg(
M_USAGE,
"Parameter --pkcs11-id cannot be used when --pkcs11-id-management is also specified.");
2889 if (!
options->pkcs11_id_management &&
options->pkcs11_id == NULL)
2891 msg(
M_USAGE,
"Parameter --pkcs11-id or --pkcs11-id-management should be specified.");
2895 msg(
M_USAGE,
"Parameter --cert cannot be used when --pkcs11-provider is also specified.");
2899 msg(
M_USAGE,
"Parameter --key cannot be used when --pkcs11-provider is also specified.");
2903 msg(
M_USAGE,
"Parameter --management-external-key cannot be used when --pkcs11-provider is also specified.");
2907 msg(
M_USAGE,
"Parameter --management-external-cert cannot be used when --pkcs11-provider is also specified.");
2911 msg(
M_USAGE,
"Parameter --pkcs12 cannot be used when --pkcs11-provider is also specified.");
2913 #ifdef ENABLE_CRYPTOAPI
2916 msg(
M_USAGE,
"Parameter --cryptoapicert cannot be used when --pkcs11-provider is also specified.");
2924 msg(
M_USAGE,
"--key and --management-external-key are mutually exclusive");
2930 msg(
M_USAGE,
"--cert and --management-external-cert are mutually exclusive");
2934 msg(
M_USAGE,
"--management-external-cert must be used with --management-external-key");
2938 #ifdef ENABLE_CRYPTOAPI
2943 msg(
M_USAGE,
"Parameter --cert cannot be used when --cryptoapicert is also specified.");
2947 msg(
M_USAGE,
"Parameter --key cannot be used when --cryptoapicert is also specified.");
2951 msg(
M_USAGE,
"Parameter --pkcs12 cannot be used when --cryptoapicert is also specified.");
2955 msg(
M_USAGE,
"Parameter --management-external-key cannot be used when --cryptoapicert is also specified.");
2959 msg(
M_USAGE,
"Parameter --management-external-cert cannot be used when --cryptoapicert is also specified.");
2966 #ifdef ENABLE_CRYPTO_MBEDTLS
2967 msg(
M_USAGE,
"Parameter --pkcs12 cannot be used with the mbed TLS version version of OpenVPN.");
2971 msg(
M_USAGE,
"Parameter --capath cannot be used when --pkcs12 is also specified.");
2975 msg(
M_USAGE,
"Parameter --cert cannot be used when --pkcs12 is also specified.");
2979 msg(
M_USAGE,
"Parameter --key cannot be used when --pkcs12 is also specified.");
2983 msg(
M_USAGE,
"Parameter --management-external-key cannot be used when --pkcs12 is also specified.");
2987 msg(
M_USAGE,
"Parameter --management-external-cert cannot be used when --pkcs12 is also specified.");
2993 #ifdef ENABLE_CRYPTO_MBEDTLS
2996 msg(
M_USAGE,
"Parameter --capath cannot be used with the mbed TLS version version of OpenVPN.");
3010 msg(
M_USAGE,
"No client-side authentication method is "
3011 "specified. You must use either "
3012 "--cert/--key, --pkcs12, or "
3013 "--auth-user-pass");
3018 msg(
M_USAGE,
"If you use one of --cert or --key, you must use them both");
3035 msg(
M_USAGE,
"--tls-auth and --tls-crypt are mutually exclusive");
3040 msg(
M_USAGE,
"--tls-crypt-v2, --tls-auth and --tls-crypt are mutually exclusive in client mode");
3050 #define MUST_BE_UNDEF(parm) if (options->parm != defaults.parm) {msg(M_USAGE, err, #parm); \
3053 const char err[] =
"Parameter %s can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.";
3060 #ifndef ENABLE_CRYPTO_MBEDTLS
3085 #ifdef ENABLE_PKCS11
3097 #undef MUST_BE_UNDEF
3101 msg(
M_USAGE,
"--auth-user-pass requires --pull");
3165 if (
ce->
af == AF_INET6)
3167 msg(
M_INFO,
"WARNING: '--proto udp6' is not compatible with "
3168 "'--socks-proxy' today. Forcing IPv4 mode." );
3172 msg(
M_INFO,
"NOTICE: dual-stack mode for '--proto udp' does not "
3173 "work correctly with '--socks-proxy' today. Forcing IPv4." );
3200 #ifdef ENABLE_FRAGMENT
3260 msg(
M_WARN,
"NOTICE: --explicit-exit-notify ignored for --proto tcp");
3275 msg(
M_INFO,
"Flag 'def1' added to --redirect-gateway (iservice is in use)");
3449 #ifdef DEFAULT_PKCS11_MODULE
3453 if (!
options->pkcs11_providers[0]
3456 options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
3481 msg(
M_WARN,
"Note: --client-to-client has no effect when using data "
3482 "channel offload: packets are always sent to the VPN "
3483 "interface and then routed based on the system routing table");
3503 bool can_do_chacha =
cipher_valid(
"CHACHA20-POLY1305");
3513 o->
ncp_ciphers =
"AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305";
3547 msg(
M_INFO,
"Note: --cipher is not set. OpenVPN versions before 2.5 "
3548 "defaulted to BF-CBC as fallback when cipher negotiation "
3549 "failed in this case. If you need this fallback please add "
3550 "'--data-ciphers-fallback BF-CBC' to your configuration "
3551 "and/or add BF-CBC to --data-ciphers.");
3556 msg(
M_WARN,
"DEPRECATED OPTION: --cipher set to '%s' but missing in "
3557 "--data-ciphers (%s). OpenVPN ignores --cipher for cipher "
3593 if (tls_ver_min == 0)
3602 else if (tls_ver_max == 0 || tls_ver_max >=
TLS_VER_1_2)
3663 "supported by the TLS library. Your system does not support this "
3664 "calculation anymore or your security policy (e.g. FIPS 140-2) "
3665 "forbids it. Connections will only work with peers running "
3666 "OpenVPN 2.6.0 or higher)");
3667 #ifndef HAVE_EXPORT_KEYING_MATERIAL
3668 msg(
M_FATAL,
"Keying Material Exporters (RFC 5705) not available either. "
3669 "No way to generate data channel keys left.");
3673 msg(
M_WARN,
"Automatically enabling option "
3674 "--force-tls-key-material-export");
3703 msg(
M_USAGE,
"--data-ciphers list contains unsupported ciphers or is too long.");
3712 for (i = 0; i < rl->
len; ++i)
3751 msg(
M_WARN,
"WARNING: Ignoring option 'dh' in tls-client mode, please only "
3752 "include this in your server configuration");
3755 #if ENABLE_MANAGEMENT
3764 msg(
M_INFO,
"Using certificate fingerprint to verify peer (no CA "
3771 msg(
M_USAGE,
"Options 'config stdin' and 'remap-usr1 SIGHUP' are "
3772 "incompatible with each other.");
3797 msg(
M_WARN,
"Option --windows-driver ovpn-dco is ignored because Data Channel Offload is disabled");
3808 msg(
M_WARN,
"Note: ignoring --dev-node as it has no effect when using "
3809 "data channel offload");
3830 #if defined(_WIN32) || defined(TARGET_ANDROID)
3833 foreign_options_copy_dns(o,
es);
3847 #ifndef ENABLE_SMALL
3849 #define CHKACC_FILE (1<<0)
3850 #define CHKACC_DIRPATH (1<<1)
3851 #define CHKACC_FILEXSTWR (1<<2)
3852 #define CHKACC_ACPTSTDIN (1<<3)
3853 #define CHKACC_PRIVATE (1<<4)
3878 char *dirpath =
dirname(fullpath);
3913 if (st.st_mode & (S_IRWXG|S_IRWXO))
3915 msg(
M_WARN,
"WARNING: file '%s' is group or others accessible", file);
3928 return (errcode != 0 ?
true :
false);
3950 struct buffer chroot_file;
3970 const int type,
const char *file,
3971 const int mode,
const char *opt)
3987 const int mode,
const char *opt)
4094 "--crl-verify directory");
4101 R_OK,
"--crl-verify");
4108 W_OK,
"--tls-export-cert");
4141 #ifdef ENABLE_MANAGEMENT
4144 "--management user/password file");
4149 "--auth-user-pass");
4152 R_OK|X_OK,
"--chroot directory");
4154 R_OK|W_OK,
"--writepid");
4158 R_OK|W_OK,
"--status");
4162 R_OK|X_OK,
"--client-config-dir");
4164 R_OK|W_OK|X_OK,
"Temporary directory (--tmp-dir)");
4168 msg(
M_USAGE,
"Please correct these errors.");
4183 #ifndef ENABLE_SMALL
4200 #if defined(_WIN32) || defined(TARGET_ANDROID)
4203 foreign_options_copy_dns(o,
es);
4259 bool tt_local =
false;
4321 if (tt && p2p_nopull)
4324 if (ios && strlen(ios))
4342 #ifdef ENABLE_FRAGMENT
4349 #define TLS_CLIENT (o->tls_client)
4350 #define TLS_SERVER (o->tls_server)
4407 #ifdef ENABLE_PREDICTION_RESISTANCE
4408 if (o->use_prediction_resistance)
4410 buf_printf(&out,
",use-prediction-resistance");
4499 const bool report_inconsistent,
4501 const struct buffer *b2_src,
4502 const char *b1_name,
4503 const char *b2_name)
4512 ||
streq(p1,
"tls-auth")
4522 struct buffer b2 = *b2_src;
4532 if (!strcmp(p1, p2))
4536 if (!strcmp(p1_prefix, p2_prefix))
4538 if (report_inconsistent)
4540 msg(msglevel,
"WARNING: '%s' is used inconsistently, %s='%s', %s='%s'",
4552 msg(msglevel,
"WARNING: '%s' is present in %s config but missing in %s config, %s='%s'",
4567 const bool report_inconsistent,
4568 const struct buffer *b1_src,
4569 const struct buffer *b2_src,
4570 const char *b1_name,
4571 const char *b2_name)
4574 struct buffer b = *b1_src;
4594 actual[actual_n - 1] = 0;
4619 actual[actual_n - 1] = 0;
4620 if (strncmp(actual, expected, 2))
4622 msg(
D_SHOW_OCC,
"NOTE: Options consistency check may be skewed by version differences");
4627 ret = !strcmp(actual, expected);
4653 const size_t opt_name_len = strlen(opt_name);
4658 if (0 == strncmp(p, opt_name, opt_name_len)
4659 && strlen(p) > (opt_name_len+1) && p[opt_name_len] ==
' ')
4662 const char *start = &p[opt_name_len+1];
4663 const char *end = strchr(p,
',');
4664 size_t val_len = end ? end - start : strlen(start);
4666 memcpy(ret, start, val_len);
4689 if (
streq(str,
"tap-windows6"))
4693 else if (
streq(str,
"wintun"))
4698 else if (
streq(str,
"ovpn-dco"))
4704 msg(msglevel,
"--windows-driver must be tap-windows6, wintun "
4718 if (
streq(str,
"net30"))
4722 else if (
streq(str,
"p2p"))
4726 else if (
streq(str,
"subnet"))
4732 msg(msglevel,
"--topology must be net30, p2p, or subnet");
4774 if (
streq(option,
"interact"))
4778 else if (
streq(option,
"nointeract"))
4782 else if (
streq(option,
"none"))
4788 msg(msglevel,
"--auth-retry method must be 'interact', 'nointeract', or 'none'");
4803 return "nointeract";
4823 fprintf(fp,
"Usage message not available\n");
4879 #define LZO_LIB_VER_STR ", LZO ", lzo_version_string()
4881 #define LZO_LIB_VER_STR "", ""
4887 #undef LZO_LIB_VER_STR
4901 #ifndef ENABLE_SMALL
4902 #ifdef CONFIGURE_DEFINES
4905 #ifdef CONFIGURE_SPECIAL_BUILD
4917 msg(
M_USAGE,
"You must define %s", description);
4926 return !strcmp(s1, s2);
4936 ping_rec_err(
int msglevel)
4938 msg(msglevel,
"only one of --ping-exit or --ping-restart options may be specified");
4945 const int i = atoi(str);
4946 return i < 0 ? 0 : i;
4953 unsigned int val = 0;
4954 sscanf(str,
"%u", &val);
4962 return c ==
'\0' || isspace(c);
4974 const int STATE_INITIAL = 0;
4975 const int STATE_READING_QUOTED_PARM = 1;
4976 const int STATE_READING_UNQUOTED_PARM = 2;
4977 const int STATE_DONE = 3;
4978 const int STATE_READING_SQUOTED_PARM = 4;
4980 const char *error_prefix =
"";
4983 const char *c = line;
4984 int state = STATE_INITIAL;
4985 bool backslash =
false;
4989 unsigned int parm_len = 0;
4995 error_prefix =
"ERROR: ";
5003 if (!backslash && in ==
'\\' && state != STATE_READING_SQUOTED_PARM)
5009 if (state == STATE_INITIAL)
5013 if (in ==
';' || in ==
'#')
5017 if (!backslash && in ==
'\"')
5019 state = STATE_READING_QUOTED_PARM;
5021 else if (!backslash && in ==
'\'')
5023 state = STATE_READING_SQUOTED_PARM;
5028 state = STATE_READING_UNQUOTED_PARM;
5032 else if (state == STATE_READING_UNQUOTED_PARM)
5034 if (!backslash &&
space(in))
5043 else if (state == STATE_READING_QUOTED_PARM)
5045 if (!backslash && in ==
'\"')
5054 else if (state == STATE_READING_SQUOTED_PARM)
5065 if (state == STATE_DONE)
5068 p[ret] =
gc_malloc(parm_len + 1,
true, gc);
5069 memcpy(p[ret], parm, parm_len);
5070 p[ret][parm_len] =
'\0';
5071 state = STATE_INITIAL;
5076 if (backslash && out)
5078 if (!(out ==
'\\' || out ==
'\"' ||
space(out)))
5081 msg(msglevel,
"%sOptions warning: Bad backslash ('\\') usage in %s:%d", error_prefix, file, line_num);
5083 msg(msglevel,
"%sOptions warning: Bad backslash ('\\') usage in %s:%d: remember that backslashes are treated as shell-escapes and if you need to pass backslash characters as part of a Windows filename, you should use double backslashes such as \"c:\\\\" PACKAGE "\\\\static.key\"", error_prefix, file, line_num);
5094 if (parm_len >=
SIZE(parm))
5096 parm[
SIZE(parm) - 1] = 0;
5097 msg(msglevel,
"%sOptions error: Parameter at %s:%d is too long (%d chars max): %s",
5098 error_prefix, file, line_num, (
int)
SIZE(parm), parm);
5101 parm[parm_len++] = out;
5110 }
while (*c++ !=
'\0');
5112 if (state == STATE_READING_QUOTED_PARM)
5114 msg(msglevel,
"%sOptions error: No closing quotation (\") in %s:%d", error_prefix, file, line_num);
5117 if (state == STATE_READING_SQUOTED_PARM)
5119 msg(msglevel,
"%sOptions error: No closing single quotation (\') in %s:%d", error_prefix, file, line_num);
5122 if (state != STATE_INITIAL)
5124 msg(msglevel,
"%sOptions error: Residual parse state (%d) in %s:%d", error_prefix, state, file, line_num);
5130 for (i = 0; i < ret; ++i)
5142 if (strlen(*p) >= 3 && !strncmp(*p,
"--", 2))
5149 #define IS_TYPE_FP 1
5150 #define IS_TYPE_BUF 2
5168 if ((
int) strlen(line) + 1 < size)
5183 int *num_lines,
struct gc_arena *gc)
5188 bool endtagfound =
false;
5193 char *line_ptr = line;
5195 while (isspace(*line_ptr))
5199 if (!strncmp(line_ptr, close_tag, strlen(close_tag)))
5204 if (!
buf_safe(&buf, strlen(line)+1))
5217 msg(
M_FATAL,
"ERROR: Endtag %s missing", close_tag);
5229 int num_inline_lines = 0;
5234 if (arg[0] ==
'<' && arg[strlen(arg)-1] ==
'>')
5238 arg[strlen(arg) - 1] =
'\0';
5240 close_tag =
alloc_buf(strlen(p[0]) + 4);
5247 return num_inline_lines;
5277 const unsigned int permission_mask,
5278 unsigned int *option_types_found,
5285 const char *top_file,
5288 const unsigned int permission_mask,
5289 unsigned int *option_types_found,
5292 const int max_recursive_levels = 10;
5299 if (level <= max_recursive_levels)
5301 if (
streq(file,
"stdin"))
5312 while (fgets(line,
sizeof(line),
fp))
5319 msg(msglevel,
"In %s:%d: Maximum option line length (%d) exceeded, line starts with %s",
5324 if (line_num == 1 && strncmp(line,
"\xEF\xBB\xBF", 3) == 0)
5333 msglevel, permission_mask, option_types_found,
5335 line_num += lines_inline;
5345 msg(msglevel,
"In %s:%d: Error opening configuration file: %s", top_file, top_line, file);
5350 msg(msglevel,
"In %s:%d: Maximum recursive include levels exceeded in include attempt of file %s -- probably you have a configuration file that tries to include itself.", top_file, top_line, file);
5361 const unsigned int permission_mask,
5362 unsigned int *option_types_found,
5369 buf_set_read(&multiline, (uint8_t *)config, strlen(config));
5371 while (
buf_parse(&multiline,
'\n', line,
sizeof(line)))
5381 permission_mask, option_types_found,
es);
5382 line_num += lines_inline;
5394 const unsigned int permission_mask,
5395 unsigned int *option_types_found,
5405 if (argc == 2 && strncmp(
argv[1],
"--", 2))
5412 option_types_found,
es);
5417 for (
int i = 1; i < argc; ++i)
5422 if (strncmp(p[0],
"--", 2))
5424 msg(msglevel,
"I'm trying to parse \"%s\" as an --option parameter but I don't see a leading '--'", p[0]);
5436 char *arg =
argv[i + j];
5437 if (strncmp(arg,
"--", 2))
5448 option_types_found,
es);
5473 while (isspace(*line))
5482 msg(
D_LOW,
"Pushed option accepted by filter: '%s'", line);
5487 msg(
D_PUSH,
"Pushed option removed by filter: '%s'", line);
5493 msg(
M_WARN,
"Pushed option rejected by filter: '%s'. Restarting.", line);
5505 unsigned int permission_mask,
5506 unsigned int *option_types_found,
5511 const char *file =
"[PUSH-OPTIONS]";
5514 while (
buf_parse(buf,
',', line,
sizeof(line)))
5526 permission_mask, option_types_found,
es);