From: Max Fillinger Date: Thu, 15 Apr 2021 09:34:54 +0000 (+0200) Subject: Abort if CRL file can't be stat-ed in ssl_init X-Git-Tag: v2.6_beta1~533 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=940619c88067d95a1c9865795624bc3822a89bd7;p=thirdparty%2Fopenvpn.git Abort if CRL file can't be stat-ed in ssl_init Now that the path for the CRL file is handled correctly when using chroot, there's no good reason for the file to be inaccessible during ssl_init(). This commit ensures that the CRL file is accessed successfully at least once, which fixes a bug where the mbedtls version of OpenVPN wouldn't use a reloaded CRL if it initially failed to access the file. Signed-off-by: Max Fillinger Acked-by: Antonio Quartulli Message-Id: <20210415093454.18324-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22118.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 84d000e0a..97a460e1b 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -559,7 +559,15 @@ tls_ctx_reload_crl(struct tls_root_ctx *ssl_ctx, const char *crl_file, } else if (platform_stat(crl_file, &crl_stat) < 0) { - msg(M_WARN, "WARNING: Failed to stat CRL file, not (re)loading CRL."); + /* If crl_last_mtime is zero, the CRL file has not been read before. */ + if (ssl_ctx->crl_last_mtime == 0) + { + msg(M_FATAL, "ERROR: Failed to stat CRL file during initialization, exiting."); + } + else + { + msg(M_WARN, "WARNING: Failed to stat CRL file, not reloading CRL."); + } return; }