The old code would run all (succeeding) handlers, then discover "one of
them set the 'disable' flag for this client", and then unroll all the
handlers.
Moving the 'disable' check into the loop makes it stop after the first
handler that fails or (succeeds and sets 'disable'). This is a bit
more logical in the log files, and has less potential side effects
due to running "later" client-connect handlers when we already know
they will have to be unrolled.
Signed-off-by: Gert Doering <g...@greenie.muc.de>
---
src/openvpn/multi.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index cfb34720..0f9c586b 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -2617,18 +2617,18 @@ multi_connection_established(struct multi_context *m,
struct multi_instance *mi)
ASSERT(0);
}
- (*cur_handler_index)++;
- }
+ /*
+ * Check for "disable" directive in client-config-dir file
+ * or config file generated by --client-connect script.
+ */
+ if (mi->context.options.disable)
+ {
+ msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to "
+ "'disable' directive");
+ cc_succeeded = false;
+ }
- /*
- * Check for "disable" directive in client-config-dir file
- * or config file generated by --client-connect script.
- */
- if (mi->context.options.disable)
- {
- msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to "
- "'disable' directive");
- cc_succeeded = false;
+ (*cur_handler_index)++;
}
if (cc_succeeded)
--
2.26.2
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
