summaryrefslogtreecommitdiff
path: root/src/openvpn/pf.c
diff options
context:
space:
mode:
authorBernhard Schmidt <berni@debian.org>2021-02-24 19:54:19 +0100
committerBernhard Schmidt <berni@debian.org>2021-02-24 19:54:19 +0100
commitd717dbfa8d0807202f5ad05f7db53925cf63a446 (patch)
treeff434c729e3d55979ee85983296c424e637a1124 /src/openvpn/pf.c
parent76fee93e6fe89e5575bae2840b585d2f025b9050 (diff)
parent4ee98f284a93c3b855092d35ac21371d9dcad65b (diff)
Update upstream source from tag 'upstream/2.5.1'
Update to upstream version '2.5.1' with Debian dir 7ffab8b9a1f4bee8b10a736ef58cdbac4bfd4b14
Diffstat (limited to 'src/openvpn/pf.c')
-rw-r--r--src/openvpn/pf.c13
1 files changed, 11 insertions, 2 deletions
diff --git a/src/openvpn/pf.c b/src/openvpn/pf.c
index f9bbfb5..3f472ef 100644
--- a/src/openvpn/pf.c
+++ b/src/openvpn/pf.c
@@ -639,8 +639,17 @@ pf_init_context(struct context *c)
}
if (!c->c2.pf.enabled)
{
- msg(M_WARN, "WARNING: failed to init PF plugin, rejecting client.");
- register_signal(c, SIGUSR1, "plugin-pf-init-failed");
+ /* At some point in openvpn history, this code just printed a
+ * warning and signalled itself (SIGUSR1, "plugin-pf-init-failed")
+ * to terminate the client instance. This got broken at one of
+ * the client auth state refactorings (leading to SIGSEGV crashes)
+ * and due to "pf will be removed anyway" reasons the easiest way
+ * to prevent crashes is to REQUIRE that plugins succeed - so if
+ * the plugin fails, we cleanly abort OpenVPN
+ *
+ * see also: https://community.openvpn.net/openvpn/ticket/1377
+ */
+ msg(M_FATAL, "FATAL: failed to init PF plugin, must succeed.");
return;
}
}