From: Gert Doering <gert@greenie.muc.de>
Date: Sun, 24 May 2015 13:02:34 +0000 (+0200)
Subject: Disallow usage of --server-poll-timeout in --secret key mode.
X-Git-Tag: v2.4_alpha1~295
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6478c1f359e6b0ea2046d9e2801830753e53c06a;p=thirdparty%2Fopenvpn.git

Disallow usage of --server-poll-timeout in --secret key mode.

The internal machinery wants TLS for this to work, so just add this
to the (long) list of options not allowed unless either --tls-client
or --tls-server is active.  For added sanity, add an ASSERT() call
to the place where this combination caused a NULL ptr reference, and
document the restriction.

Fix trac #373

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Message-Id: <1432472554-24666-1-git-send-email-gert@greenie.muc.de>
URL: http://article.gmane.org/gmane.network.openvpn.devel/9736
---

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index b1c2fab55..3fff3f2c4 100644
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -3783,6 +3783,10 @@ when polling possible remote servers to connect to
 in a round-robin fashion, spend no more than
 .B n
 seconds waiting for a response before trying the next server.
+As this only makes sense in client-to-server setups, it cannot
+be used in point-to-point setups using
+.B \-\-secret
+symmetrical key mode.
 .\"*********************************************************
 .TP
 .B \-\-explicit\-exit\-notify [n]
diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index a3323e92d..6d459d2db 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -328,6 +328,7 @@ void
 check_server_poll_timeout_dowork (struct context *c)
 {
   event_timeout_reset (&c->c2.server_poll_interval);
+  ASSERT(c->c2.tls_multi);
   if (!tls_initial_packet_received (c->c2.tls_multi))
     {
       msg (M_INFO, "Server poll timeout, restarting");
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index bc7f3c675..8487ce140 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -2310,6 +2310,9 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
       MUST_BE_UNDEF (pkcs11_id);
       MUST_BE_UNDEF (pkcs11_id_management);
 #endif
+#if P2MP
+      MUST_BE_UNDEF (server_poll_timeout);
+#endif
 
       if (pull)
 	msg (M_USAGE, err, "--pull");