Disallow usage of --server-poll-timeout in --secret key mode.

The internal machinery wants TLS for this to work, so just add this
to the (long) list of options not allowed unless either --tls-client
or --tls-server is active.  For added sanity, add an ASSERT() call
to the place where this combination caused a NULL ptr reference, and
document the restriction.

Fix trac #373

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1432472554-24666-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9736
(cherry picked from commit 6478c1f359e6b0ea2046d9e2801830753e53c06a)

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index 00f03830575aa68e8026a334c4ddb27afd52750e..1e654bdb925ded38be3267a5798d59f6119ec362 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -3735,6 +3735,10 @@ when polling possible remote servers to connect to
 in a round-robin fashion, spend no more than
 .B n
 seconds waiting for a response before trying the next server.
+As this only makes sense in client-to-server setups, it cannot
+be used in point-to-point setups using
+.B \-\-secret
+symmetrical key mode.
 .\"*********************************************************
 .TP
 .B \-\-explicit\-exit\-notify [n]

diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index 7f0d083dbd817de75feda7854bc82658603cddec..217fbb38a2375ea49144293d6932aff81a7e3336 100644 (file)
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -331,6 +331,7 @@ void
 check_server_poll_timeout_dowork (struct context *c)
 {
   event_timeout_reset (&c->c2.server_poll_interval);
+  ASSERT(c->c2.tls_multi);
   if (!tls_initial_packet_received (c->c2.tls_multi))
     {
       msg (M_INFO, "Server poll timeout, restarting");

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index fdf8fba47e644252f1dcd3566c78596fd2dc4f9e..ff4b07b3907d2d84ab372d166f23c99806a1a300 100644 (file)
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -2337,6 +2337,9 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
       MUST_BE_UNDEF (pkcs11_id);
       MUST_BE_UNDEF (pkcs11_id_management);
 #endif
+#if P2MP
+      MUST_BE_UNDEF (server_poll_timeout);
+#endif
 
       if (pull)
        msg (M_USAGE, err, "--pull");