From 940619c88067d95a1c9865795624bc3822a89bd7 Mon Sep 17 00:00:00 2001 From: Max Fillinger Date: Thu, 15 Apr 2021 11:34:54 +0200 Subject: [PATCH] Abort if CRL file can't be stat-ed in ssl_init Now that the path for the CRL file is handled correctly when using chroot, there's no good reason for the file to be inaccessible during ssl_init(). This commit ensures that the CRL file is accessed successfully at least once, which fixes a bug where the mbedtls version of OpenVPN wouldn't use a reloaded CRL if it initially failed to access the file. Signed-off-by: Max Fillinger Acked-by: Antonio Quartulli Message-Id: <20210415093454.18324-1-maximilian.fillinger@foxcrypto.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22118.html Signed-off-by: Gert Doering --- src/openvpn/ssl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 84d000e0a..97a460e1b 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -559,7 +559,15 @@ tls_ctx_reload_crl(struct tls_root_ctx *ssl_ctx, const char *crl_file, } else if (platform_stat(crl_file, &crl_stat) < 0) { - msg(M_WARN, "WARNING: Failed to stat CRL file, not (re)loading CRL."); + /* If crl_last_mtime is zero, the CRL file has not been read before. */ + if (ssl_ctx->crl_last_mtime == 0) + { + msg(M_FATAL, "ERROR: Failed to stat CRL file during initialization, exiting."); + } + else + { + msg(M_WARN, "WARNING: Failed to stat CRL file, not reloading CRL."); + } return; } -- 2.47.2