[Openvpn-devel] Fix tls-auth/crypt in connection blocks with --persist-key

Message ID 20190119103028.12497-1-steffan@karger.me
State Superseded
Headers show
Series
  • [Openvpn-devel] Fix tls-auth/crypt in connection blocks with --persist-key
Related show

Commit Message

Steffan Karger Jan. 19, 2019, 10:30 a.m.
If --persist-key was used, we would always try to pre-load the 'global'
tls-auth/crypt file. That would result in using the wrong key (leading
to a failed connection) or en error is there was to 'global' key:

  Sat Jan 19 11:09:01 2019 Cannot pre-load tls-auth keyfile ((null))
  Sat Jan 19 11:09:01 2019 Exiting due to fatal error

Fix that by loading loading the key from the current connection entry.

Signed-off-by: Steffan Karger <steffan@karger.me>
---
 src/openvpn/options.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Arne Schwabe Jan. 22, 2019, 3:31 p.m. | #1
Am 19.01.19 um 11:30 schrieb Steffan Karger:
> If --persist-key was used, we would always try to pre-load the 'global'
> tls-auth/crypt file. That would result in using the wrong key (leading
> to a failed connection) or en error is there was to 'global' key:
> 
>   Sat Jan 19 11:09:01 2019 Cannot pre-load tls-auth keyfile ((null))
>   Sat Jan 19 11:09:01 2019 Exiting due to fatal error
> 
> Fix that by loading loading the key from the current connection entry.

Acked-By: Arne Schabe <arne@rfc2549.org>
This also changes the logic to be similar with the other logic used in
the function.

Arne

Patch

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 0cf8db767..3d4da38d9 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -2863,11 +2863,11 @@  options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)
     {
         if (ce->tls_auth_file && !ce->tls_auth_file_inline)
         {
-            struct buffer in = buffer_read_from_file(o->tls_auth_file, &o->gc);
+            struct buffer in = buffer_read_from_file(ce->tls_auth_file, &o->gc);
             if (!buf_valid(&in))
             {
                 msg(M_FATAL, "Cannot pre-load tls-auth keyfile (%s)",
-                    o->tls_auth_file);
+                    ce->tls_auth_file);
             }
 
             ce->tls_auth_file = INLINE_FILE_TAG;