diff options
author | Steffan Karger <steffan.karger@fox-it.com> | 2014-07-06 11:27:21 +0200 |
---|---|---|
committer | Gert Doering <gert@greenie.muc.de> | 2014-07-10 21:18:00 +0200 |
commit | d860ee4a4c2cac03a872f07a9e629b56f3158b8b (patch) | |
tree | c981ea77eff4dbc0596e4d5cd6c496e8092d22eb /src/openvpn/helper.c | |
parent | f4e0ad82b0eaccce965074c1ceec2b7e3853dc0d (diff) | |
download | openvpn-d860ee4a4c2cac03a872f07a9e629b56f3158b8b.tar.gz openvpn-d860ee4a4c2cac03a872f07a9e629b56f3158b8b.tar.xz openvpn-d860ee4a4c2cac03a872f07a9e629b56f3158b8b.zip |
Don't exit daemon if opening or parsing the CRL fails.
As requested in trac ticket #83, the daemon should not exit if opening the
CRL file during a connection attempt fails; OpenVPN should merely deny the
connection.
CRL files need to be periodically updated. When users update their CRL in
place and a connection attempt takes place simultaneously, the CRL file
might temporarily not be available, or not be in a consistent state.
Previously, that would result in the daemon exiting. With this patch, that
results in one (or possibly a few) failed connection attempts, but service
will restore automatically as soon as the CRL is again available in a valid
state.
Note that on startup OpenVPN still checks the existence and accessibility
of the CRL file, and will refuse to start on error.
While I was touching the code, I improved error reporting for the PolarSSL
code a bit. The polar code opens and parses the CRL in a single call, so
on error retrieve details from polarssl and report those to the user.
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <53BED57C.7070300@fox-it.com>
Signed-off-by: Gert Doering <gert@greenie.muc.de>
Diffstat (limited to 'src/openvpn/helper.c')
0 files changed, 0 insertions, 0 deletions