]> git.ipfire.org Git - thirdparty/openvpn.git/commit
tls-crypt-v2: also preload tls-crypt-v2 keys (if --persist-key)
authorSteffan Karger <steffan@karger.me>
Thu, 3 Dec 2020 15:49:51 +0000 (16:49 +0100)
committerGert Doering <gert@greenie.muc.de>
Fri, 4 Dec 2020 10:16:53 +0000 (11:16 +0100)
commit4d307ed431bf18d554f524ebaf111f5e136147fe
tree8c6e4a696e7433e1e36fcbeca881e53b9af8915e
parentfb169c3b8fdfa9792c0eee8441956f062dfd7982
tls-crypt-v2: also preload tls-crypt-v2 keys (if --persist-key)

This allows tls-crypt-v2 servers to drop privileges after reading the
keys. Without it, the server would try to read the key file for each
connecting client. (And clients for each reconnect.)

As with the previous patch, the pre-loading was developed in parallel
with tls-crypt-v2, and the tls-crypt-v2 patches were never amended to
implement the pre-loading.

Also as with the previous patch, it would be nicer if servers would not
reload the tls-crypt-v2 server key for each connecting client. But let's
first fix the issue, and see if we can improve later.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20201203154951.29382-2-steffan@karger.me>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg21307.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
src/openvpn/options.c