Arma 3: CfgRemoteExec

CfgRemoteExec defines rules for the remote execution of functions and commands. These rules only apply to clients. The server is not subject to any limitations, everything is enabled and allowed for it.

ⓘ

As usual, the more local config takes precedence: Mission Description.ext (missionConfigFile) > Campaign Description.ext (campaignConfigFile) > Game / Mod Config (configFile).

If several definitions for CfgRemoteExec exist, the mode attribute will be overridden by the last parsed config and whitelisted functions and commands will be merged.

To allow for a mission's mod compatibility, see Mission Compatibility With Mods.

See Arma 3: Remote Execution for more information about remote execution.

Format

class CfgRemoteExec
{
	class Functions
	{
		mode = 2;
		jip = 1;

		class BIS_fnc_someFunction
		{
			allowedTargets = 0;
			jip = 0;
		};
	};

	class Commands
	{
		mode = 1;

		class setDir
		{
			allowedTargets = 2;
			jip = 0;
		};
	};
};

In a class CfgRemoteExec block, two objects can be defined:

• Functions
  • children of this object are named like the function they filter (e.g class BIS_fnc_showSubtitle)
• Commands
  • children of this object are named like the command they filter (e.g class setDir)

Both main objects can be configured using the following values:

• mode - operation mode
  • 0 - remote execution is blocked
  • 1 - only whitelisted functions / commands are allowed
  • 2 - remote execution is fully allowed, ignoring the whitelist (default, because of backward compatibility)
• jip - Join In Progress settings
  • 0 - JIP flag can not be set
  • 1 - JIP flag can be set (default)

Their elements (functions, commands) can be configured with the following values:

• allowedTargets - which machine can be reached by it
  • 0 - can target all machines (default)
  • 1 - can only target clients, execution on the server is denied
  • 2 - can only target the server, execution on clients is denied
• jip - Join In Progress settings parent override
  • 0 - JIP flag can not be set
  • 1 - JIP flag can be set

Safe Config

This config only allows required default game functions (see Notes).

class CfgRemoteExec
{
	class Functions
	{
		mode = 1;	// whitelist only
		jip = 0;	// JIP flag not allowed

		class BIS_fnc_effectKilledAirDestruction	{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_effectKilledSecondaries		{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_fire							{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_objectVar						{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_setCustomSoundController		{ allowedTargets = 0; jip = 0; };

/*
		class BIS_fnc_debugConsoleExec				{ allowedTargets = 0; }; //Allow debug console (optional)
*/
	};
};

2.14

Mission Compatibility With Mods

A mod can define its own CfgRemoteExec to allow its own functions. If a mission defines it too, the mission overrides all the existing settings.

To circumvent that, use import in the mission's Description.ext:

import CfgRemoteExec as CfgRemoteExecMod;

class CfgRemoteExec : CfgRemoteExecMod
{
	// your settings
};

initPlayerServer.sqf

If execVM is not whitelisted, initPlayerServer.sqf will not be executed. To have it functional without allowing execVM, use the following workaround through CfgFunctions:

class CfgFunctions
{
	class TAG
	{
		class Category
		{
			class initPlayerServer { file = "initPlayerServer.sqf"; };
		};
	};
};

class CfgRemoteExec
{
	class Functions
	{
		mode = 1;
		class TAG_fnc_initPlayerServer { allowedTargets = 2; };
	};
};

Then execute it from init.sqf:

if (hasInterface) then { [] spawn { waitUntil {!isNull player}; [player, didJIP] remoteExec ["TAG_fnc_initPlayerServer", 2]; }; };

Default Config

ⓘ

The default CfgRemoteExec in the game's main config uses an outdated format and is left for backward compatibility only (it was used directly by BIS_fnc_MP). The Client and Server classes are obsolete now. The new Remote Execution Framework ignores it (by default, all functions and commands are allowed).

This is the default config.cpp entry (obsolete): Show text

class CfgRemoteExec
{
	class Server
	{
		class Functions
		{
			mode = 2;
		};
		class Commands
		{
			mode = 2;
		};
	};
	class Client
	{
		class Functions
		{
			mode = 2;
		};
		class Commands
		{
			mode = 2;
		};
	};
};

Notes

AgentRev - c

Posted on Jan 02, 2016 - 05:28 (UTC)

• As BIS_fnc_MP now uses remoteExec, there are some functions spontaneously called by the game core that require whitelisting in order to work if class Functions is set to mode = 1:

  class BIS_fnc_effectKilledAirDestruction {};
  class BIS_fnc_effectKilledSecondaries {};
  class BIS_fnc_fire {};
  class BIS_fnc_objectVar {};
  class BIS_fnc_setCustomSoundController {};
  

• For initPlayerServer.sqf to work, BIS_fnc_execVM would need to be whitelisted, but that should be avoided at all costs, as it allows hackers to bypass the whitelist. Use this method instead.
• For the debug console to be able to execute anything (even locally), BIS_fnc_debugConsoleExec must be whitelisted. This function only works when its remoteExecutedOwner is admin, so it is safe to whitelist for everyone.
• remoteExec and remoteExecCall are filtered by BattlEye's remoteexec.txt, the string analyzed by BE is formatted the same way as the following example's output:
  format ["%1 %2", functionName, str arguments]
  The following remoteexec.txt exclusion can be used to safely allow all whitelisted *_fnc_* functions taking an array as parameter to go through:
  !="\w+?_fnc_\w+? \[[\S\s]*\]"
  Any attempt to exploit this exclusion using other RE methods like createUnit will run into "Error Missing ;" without any malicious code being executed. Mod makers should refrain from remote-executing raw commands from clients, as they require individual exclusions, and instead use *_fnc_* functions taking an array as parameter, which are covered by the above exclusion.