Hi, we recently noticed a race condition in signal handling in OpenVPN,
which we were able to reproduce pretty reliably using:

PID=$(cat /var/run/openvpn/openvpn.pid); kill -USR2 $PID & (kill $PID)

I took a look at the code, and it look like the signal_received variable
currently holds only a single signal at a time, so I am guessing that
the SIGUSR2 signal is overwrites the SIGTERM from the kill before it
gets handled.  

I'm not too familiar with the openvpn code and the portability
requirements around it, but perhaps this issue could be fixed by
converting signal_received into a signal mask instead.  I did a grep
through the code, and it looks like most uses of the variable could be
replaced with the appropriate bit operators along with sigmask() calls
to prevent one signal from overriding another.  I'm not familiar with
what other race conditions/other expected behavior this could lead to
though.

Do any more experienced developers have any thoughts on how this issue
could be handled?

Thanks a lot (OpenVPN has been really great for us),
Ricky

Attachment: pgpoIAGDcohOx.pgp
Description: PGP signature

Reply via email to