Attention is currently required from: Arne Schwabe.
Hello Arne Schwabe,
I'd like you to reexamine a change. Please visit
https://gerrit.openvpn.net/c/openvpn/+/2173?usp=email
to look at the new patch set (#2).
Change subject: tun_afunix: reap the child process on close
......................................................................
tun_afunix: reap the child process on close
close_tun_afunix() sent SIGINT to the child but never waited for it,
leaving a zombie on every restart.
Poll for up to a second for it to exit, then SIGKILL it and poll for
another second. Don't wait when SIGINT can't be delivered: a child
started before --user dropped privileges would block close forever.
Change-Id: I0705cff831cbd18686721dffbe5960976e3489da
Signed-off-by: Razvan Cojocaru <[email protected]>
---
M src/openvpn/tun_afunix.c
1 file changed, 37 insertions(+), 1 deletion(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/73/2173/2
diff --git a/src/openvpn/tun_afunix.c b/src/openvpn/tun_afunix.c
index 79d706a..cea1db1 100644
--- a/src/openvpn/tun_afunix.c
+++ b/src/openvpn/tun_afunix.c
@@ -125,6 +125,42 @@
gc_free(&gc);
}
+/* Waits a second for the child to exit on SIGINT, then SIGKILLs it and gives
+ * up after another second. A child started before --user dropped privileges
+ * can't be signalled and is left running. */
+static void
+tun_afunix_stop_child(pid_t pid)
+{
+ const char *msgprefix = "AF_UNIX tun: ";
+
+ if (kill(pid, SIGINT) != 0)
+ {
+ msg(M_WARN | M_ERRNO, "%scannot stop child process %d", msgprefix,
(int)pid);
+ return;
+ }
+
+ for (int i = 0;; i++)
+ {
+ /* exited and reaped, or not our child any more */
+ if (waitpid(pid, NULL, WNOHANG) != 0)
+ {
+ return;
+ }
+ if (i == 200)
+ {
+ msg(M_WARN, "%scannot reap child process %d", msgprefix, (int)pid);
+ return;
+ }
+ if (i == 100)
+ {
+ msg(M_WARN, "%schild process %d did not exit on SIGINT, killing
it", msgprefix,
+ (int)pid);
+ kill(pid, SIGKILL);
+ }
+ platform_sleep_milliseconds(10);
+ }
+}
+
void
close_tun_afunix(struct tuntap *tt)
{
@@ -138,7 +174,7 @@
* ourselves by accident */
if (tt->afunix.childprocess)
{
- kill(tt->afunix.childprocess, SIGINT);
+ tun_afunix_stop_child(tt->afunix.childprocess);
}
free(tt->actual_name);
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2173?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I0705cff831cbd18686721dffbe5960976e3489da
Gerrit-Change-Number: 2173
Gerrit-PatchSet: 2
Gerrit-Owner: Răzvan Cojocaru <[email protected]>
Gerrit-Reviewer: Arne Schwabe <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
