Arma 3: CfgRemoteExec

CfgRemoteExec defines rules for the remote execution of functions and commands. These rules only apply to clients. The server is not subject to any limitations, everything is enabled and allowed for it.

ⓘ

As usual, the more local config takes precedence: Mission Description.ext (missionConfigFile) > Campaign Description.ext (campaignConfigFile) > Game / Mod Config (configFile). If several definitions for CfgRemoteExec exist, the mode attribute will be overridden by the last parsed config and whitelisted functions and commands will be merged.

See Arma 3: Remote Execution for more information about remote execution.

Format

class CfgRemoteExec
{
	class Functions
	{
		/*
		Operation modes:
			0 - remote execution is blocked
			1 - only whitelisted functions / commands are allowed
			2 - remote execution is fully allowed, ignoring the whitelist (default, because of backward compatibility)
		*/
		mode = 2;

		/*
		JIP:
			0 - JIP flag can not be set
			1 - JIP flag can be set (default)
		*/
		jip = 1;

		class BIS_fnc_someFunction
		{
			/*
			Allowed targets:
				0 - can target all machines (default)
				1 - can only target clients, execution on the server is denied
				2 - can only target the server, execution on clients is denied
				Any other value will be treated as 0.
			*/
			allowedTargets = 0;

			//Override the global setting (defined in class Functions) for this function:
			jip = 0;
		};
	};

	class Commands
	{
		mode = 1;

		class setDir
		{
			allowedTargets = 2;
			jip = 0;
		};
	};
};

As demonstrated with the jip attribute in class BIS_fnc_someFunction, global settings can be overridden for individual functions / commands.

Safe Config

This config only allows required default game functions (see Notes).

class CfgRemoteExec
{
	class Functions
	{
		mode = 1;	//Whitelist only
		jip = 0;	//JIP flag not allowed

		class BIS_fnc_effectKilledAirDestruction	{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_effectKilledSecondaries		{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_fire							{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_objectVar					{ allowedTargets = 0; jip = 0; };
		class BIS_fnc_setCustomSoundController		{ allowedTargets = 0; jip = 0; };

/*
		class BIS_fnc_debugConsoleExec				{ allowedTargets = 0; }; //Allow debug console (optional)
*/
	};
};

initPlayerServer.sqf

If execVM is not whitelisted, initPlayerServer.sqf will not be executed. To have it functional without allowing execVM, use the following workaround through CfgFunctions:

class CfgFunctions
{
	class TAG
	{
		class Category
		{
			class initPlayerServer { file = "initPlayerServer.sqf"; };
		};
	};
};

class CfgRemoteExec
{
	class Functions
	{
		mode = 1;
		class TAG_fnc_initPlayerServer { allowedTargets = 2; };
	};
};

Then execute it from init.sqf:

if (hasInterface) then { [] spawn { waitUntil {!isNull player}; [player, didJIP] remoteExec ["TAG_fnc_initPlayerServer", 2]; }; };

Default Config

ⓘ

The default CfgRemoteExec in the game's main config uses an outdated format and is left for backward compatibility only (it was used directly by BIS_fnc_MP). The Client and Server classes are obsolete now. The new Remote Execution Framework ignores it (by default, all functions and commands are allowed).

This is the default config.cpp entry (obsolete): Show text

class CfgRemoteExec
{
	class Server
	{
		class Functions
		{
			mode = 2;
		};
		class Commands
		{
			mode = 2;
		};
	};
	class Client
	{
		class Functions
		{
			mode = 2;
		};
		class Commands
		{
			mode = 2;
		};
	};
};

Notes

AgentRev - c

Posted on Jan 02, 2016 - 05:28 (UTC)

• As BIS_fnc_MP now uses remoteExec, there are some functions spontaneously called by the game core that require whitelisting in order to work if class Functions is set to mode = 1:

  class BIS_fnc_effectKilledAirDestruction {};
  class BIS_fnc_effectKilledSecondaries {};
  class BIS_fnc_fire {};
  class BIS_fnc_objectVar {};
  class BIS_fnc_setCustomSoundController {};
  

• For initPlayerServer.sqf to work, BIS_fnc_execVM would need to be whitelisted, but that should be avoided at all costs, as it allows hackers to bypass the whitelist. Use this method instead.
• For the debug console to be able to execute anything (even locally), BIS_fnc_debugConsoleExec must be whitelisted. This function only works when its remoteExecutedOwner is admin, so it is safe to whitelist for everyone.
• remoteExec and remoteExecCall are filtered by BattlEye's remoteexec.txt, the string analyzed by BE is formatted the same way as the following example's output:
  format ["%1 %2", functionName, str arguments]
  The following remoteexec.txt exclusion can be used to safely allow all whitelisted *_fnc_* functions taking an array as parameter to go through:
  !="\w+?_fnc_\w+? \[[\S\s]*\]"
  Any attempt to exploit this exclusion using other RE methods like createUnit will run into "Error Missing ;" without any malicious code being executed. Mod makers should refrain from remote-executing raw commands from clients, as they require individual exclusions, and instead use *_fnc_* functions taking an array as parameter, which are covered by the above exclusion.