OpenVPN / OpenVPN/openvpn

Infinite loop after user disconnection while in resolve address state

Open
#753 0 comments 0 reactions 1 assignee View on GitHub

@schwabe is already working on this.

Since May 25, 2025.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Hi
I am using OpenVPN in a closed private network with a server that its address could only be resolved using our DNS server. In cases like the DNS server isn't working or the client is connected to a different network rather than our local network, the client tries to resolve the address infinitely with a 5 seconds timeout because of having resolv-retry infinite in the configuration. But if the user tries to disconnect and discard the connection in this state, the client will try to resolve the server address infinitely with no wait or timeout between each try that causes the client not to respond.

I tried to debug the code and found the cause which I am going to explain:

In the process of connection the code will reach to this method:
https://github.com/OpenVPN/openvpn/blob/4a48841da2d4179a96348994f841661ec9e5ce1d/src/openvpn/socket.c#L343

Then it continues here:
https://github.com/OpenVPN/openvpn/blob/4a48841da2d4179a96348994f841661ec9e5ce1d/src/openvpn/socket.c#L382
It will enters this function with flags the same as preresolve_flags with no change.

Continuing to here entering openvpn_getaddrinfo with sig_info being NULL:
https://github.com/OpenVPN/openvpn/blob/4a48841da2d4179a96348994f841661ec9e5ce1d/src/openvpn/socket.c#L309

The openvpn_getaddrinfo has an infinite loop tries to resolve the server address and checks for having any signal or not:
https://github.com/OpenVPN/openvpn/blob/4a48841da2d4179a96348994f841661ec9e5ce1d/src/openvpn/socket.c#L612

But since we entered this function with sig_info being NULL, there will be no signal at all while signal_received in management_event_loop_n_seconds is correct and stops the timer and causing openvpn_getaddrinfo to loop infinitely without timer waits between each try.
https://github.com/OpenVPN/openvpn/blob/4a48841da2d4179a96348994f841661ec9e5ce1d/src/openvpn/manage.c#L3474

Because we enter openvpn_getaddrinfo with sig_info being NULL I could not expect other behavior.
Just to make sure of this I removed the condition here and always filled sig_info and the client discards the connection fine.
https://github.com/OpenVPN/openvpn/blob/4a48841da2d4179a96348994f841661ec9e5ce1d/src/openvpn/socket.c#L504

I know the way I did is not the proper way so for now added preresolve_flags in that condition to check for them and then assign &sigrec to sig_info.

I should note that If I wait long enough, resolve_retries will reach zero and code will stop but that will take a really long time.

I hope I described problem well

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.