@@ -163,6 +163,13 @@ User-visible Changes

 - :code:`link_mtu` parameter is removed from environment or replaced with 0 when scripts are

   called with parameters. This parameter is unreliable and no longer internally calculated.

+- In point-to-point OpenVPN setups (no ``--server``), using

+  ``--explict-exit-notiy`` on one end would terminate the other side at

+  session end.  This is considered a no longer useful default and has

+  been changed to "restart on reception of explicit-exit-notify message".

+  If the old behaviour is still desired, ``--remap-usr1 SIGTERM`` can be used.

+

+

 Overview of changes in 2.5

 ==========================

@@ -431,7 +431,7 @@ process_received_occ_msg(struct context *c)

         case OCC_EXIT:

             dmsg(D_PACKET_CONTENT, "RECEIVED OCC_EXIT");

-            c->sig->signal_received = SIGTERM;

+            c->sig->signal_received = SIGUSR1;

             c->sig->signal_text = "remote-exit";

             break;

     }

@@ -193,7 +193,25 @@ void

 receive_exit_message(struct context *c)

 {

     dmsg(D_STREAM_ERRORS, "Exit message received by peer");

-    c->sig->signal_received = SIGTERM;

+    /* With control channel exit notification, we want to give the session

+     * enough time to handle retransmits and acknowledgment, so that eventual

+     * retries from the client to resend the exit or ACKs will not trigger

+     * a new session (we already forgot the session but the packet's HMAC

+     * is still valid).  This could happen for the entire period that the

+     * HMAC timeslot is still valid, but waiting five seconds here does not

+     * hurt much, takes care of the retransmits, and is easier code-wise.

+     *

+     * This does not affect OCC exit since the HMAC session code will

+     * ignore DATA packets

+     * */

+    if (c->options.mode == MODE_SERVER)

+    {

+        schedule_exit(c, c->options.scheduled_exit_interval, SIGTERM);

+    }

+    else

+    {

+        c->sig->signal_received = SIGUSR1;

+    }

     c->sig->signal_text = "remote-exit";

 #ifdef ENABLE_MANAGEMENT

     if (management)