This changes the behavior for pf plugins: instead of just not initializing
the firewall rules and happily continuing, this now rejects the client in
the case of an (unlikely) failure to initialize the pf.
Signed-off-by: Steffan Karger <stef...@karger.me>
---
v3: return immediately after registering signal
src/openvpn/pf.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/src/openvpn/pf.c b/src/openvpn/pf.c
index e1b5b0e7..6e4107c5 100644
--- a/src/openvpn/pf.c
+++ b/src/openvpn/pf.c
@@ -638,10 +638,12 @@ pf_init_context(struct context *c)
}
#endif
}
- else
- {
- msg(M_WARN, "WARNING: OPENVPN_PLUGIN_ENABLE_PF disabled");
- }
+ }
+ if (!c->c2.pf.enabled)
+ {
+ msg(M_WARN, "WARNING: failed to init PF plugin, rejecting
client.");
+ register_signal(c, SIGUSR1, "plugin-pf-init-failed");
+ return;
}
}
#endif /* ifdef PLUGIN_PF */
--
2.14.1
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
