Disallow usage of --server-poll-timeout in --secret key mode.

The internal machinery wants TLS for this to work, so just add this
to the (long) list of options not allowed unless either --tls-client
or --tls-server is active.  For added sanity, add an ASSERT() call
to the place where this combination caused a NULL ptr reference, and
document the restriction.

Fix trac #373

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1432472554-24666-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9736

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index b1c2fab558e225b60b4c0da0c1429cce218de8aa..3fff3f2c41d21435aeb8cf9d3cbeed475696b77a 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -3783,6 +3783,10 @@ when polling possible remote servers to connect to
 in a round-robin fashion, spend no more than
 .B n
 seconds waiting for a response before trying the next server.
+As this only makes sense in client-to-server setups, it cannot
+be used in point-to-point setups using
+.B \-\-secret
+symmetrical key mode.
 .\"*********************************************************
 .TP
 .B \-\-explicit\-exit\-notify [n]

diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index a3323e92df2c9da4533c772c77efa2f0a1591009..6d459d2db50e586c63b2db3d27ba5ec6cbafd971 100644 (file)
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -328,6 +328,7 @@ void
 check_server_poll_timeout_dowork (struct context *c)
 {
   event_timeout_reset (&c->c2.server_poll_interval);
+  ASSERT(c->c2.tls_multi);
   if (!tls_initial_packet_received (c->c2.tls_multi))
     {
       msg (M_INFO, "Server poll timeout, restarting");

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index bc7f3c675664fe0840208cc4968f88863d3cc642..8487ce1405ea2ec4da1228309d6ddba93951b32e 100644 (file)
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -2310,6 +2310,9 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
       MUST_BE_UNDEF (pkcs11_id);
       MUST_BE_UNDEF (pkcs11_id_management);
 #endif
+#if P2MP
+      MUST_BE_UNDEF (server_poll_timeout);
+#endif
 
       if (pull)
        msg (M_USAGE, err, "--pull");