mirror of
https://github.com/asterisk/asterisk.git
synced 2025-11-09 11:28:25 +00:00
5688c2f104
This patch resolves two sources of memory leaks when using TLS in Asterisk: 1) It removes improper initialization (and multiple re-initializations) of portions of the SSL library. Asterisk calls SSL_library_init and SSL_load_error_strings during SSL initialization; collectively this obviates the need for calling any of the following during initialization or client connection handling: * ERR_load_crypto_strings (handled by SSL_load_error_strings) * OpenSSL_add_all_algorithms (synonym for SSL_library_init) * SSLeay_add_ssl_algorithms (synonym for SSL_library_init) 2) Failure to completely clean up all memory allocated by Asterisk and by the SSL library for TLS clients. This included not freeing the SSL_CTX object in the SIP channel driver, as well as not clearing the error stack when the TLS client exited. Note that these memory leaks were found by Thomas Arimont, and this patch was essentially written by him with some minor tweaks. (closes issue AST-889) Reported by: Thomas Arimont Tested by: Thomas Arimont patches: (bugAST-889.patch) by Thomas Arimont (license 5525) Review: https://reviewboard.asterisk.org/r/2105 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@373061 65c4cc65-6c06-0410-ace0-fbb531ad65f3
103 lines
2.0 KiB
C
103 lines
2.0 KiB
C
/*
|
|
* Asterisk -- An open source telephony toolkit.
|
|
*
|
|
* Copyright (C) 2009, Digium, Inc.
|
|
*
|
|
* Russell Bryant <russell@digium.com>
|
|
*
|
|
* See http://www.asterisk.org for more information about
|
|
* the Asterisk project. Please do not directly contact
|
|
* any of the maintainers of this project for assistance;
|
|
* the project provides a web site, mailing lists and IRC
|
|
* channels for your use.
|
|
*
|
|
* This program is free software, distributed under the terms of
|
|
* the GNU General Public License Version 2. See the LICENSE file
|
|
* at the top of the source tree.
|
|
*/
|
|
|
|
/*!
|
|
* \file
|
|
* \brief Common OpenSSL support code
|
|
*
|
|
* \author Russell Bryant <russell@digium.com>
|
|
*/
|
|
|
|
/*** MODULEINFO
|
|
<support_level>core</support_level>
|
|
***/
|
|
|
|
#include "asterisk.h"
|
|
|
|
ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
|
|
|
|
#ifdef HAVE_OPENSSL
|
|
#include <openssl/ssl.h>
|
|
#include <openssl/err.h>
|
|
#endif
|
|
|
|
#include "asterisk/_private.h" /* ast_ssl_init() */
|
|
|
|
#include "asterisk/utils.h"
|
|
#include "asterisk/lock.h"
|
|
|
|
#ifdef HAVE_OPENSSL
|
|
|
|
static ast_mutex_t *ssl_locks;
|
|
|
|
static int ssl_num_locks;
|
|
|
|
static unsigned long ssl_threadid(void)
|
|
{
|
|
return (unsigned long)pthread_self();
|
|
}
|
|
|
|
static void ssl_lock(int mode, int n, const char *file, int line)
|
|
{
|
|
if (n < 0 || n >= ssl_num_locks) {
|
|
ast_log(LOG_ERROR, "OpenSSL is full of LIES!!! - "
|
|
"ssl_num_locks '%d' - n '%d'\n",
|
|
ssl_num_locks, n);
|
|
return;
|
|
}
|
|
|
|
if (mode & CRYPTO_LOCK) {
|
|
ast_mutex_lock(&ssl_locks[n]);
|
|
} else {
|
|
ast_mutex_unlock(&ssl_locks[n]);
|
|
}
|
|
}
|
|
|
|
#endif /* HAVE_OPENSSL */
|
|
|
|
/*!
|
|
* \internal
|
|
* \brief Common OpenSSL initialization for all of Asterisk.
|
|
*/
|
|
int ast_ssl_init(void)
|
|
{
|
|
#ifdef HAVE_OPENSSL
|
|
unsigned int i;
|
|
|
|
SSL_library_init();
|
|
SSL_load_error_strings();
|
|
ERR_load_BIO_strings();
|
|
|
|
/* Make OpenSSL thread-safe. */
|
|
|
|
CRYPTO_set_id_callback(ssl_threadid);
|
|
|
|
ssl_num_locks = CRYPTO_num_locks();
|
|
if (!(ssl_locks = ast_calloc(ssl_num_locks, sizeof(ssl_locks[0])))) {
|
|
return -1;
|
|
}
|
|
for (i = 0; i < ssl_num_locks; i++) {
|
|
ast_mutex_init(&ssl_locks[i]);
|
|
}
|
|
CRYPTO_set_locking_callback(ssl_lock);
|
|
|
|
#endif /* HAVE_OPENSSL */
|
|
return 0;
|
|
}
|
|
|