File cyrus-imapd-3.0.14-make-sure-saved-tls-session-... of Package cyrus-imapd

Overview Repositories Revisions Requests Users Attributes Meta

File cyrus-imapd-3.0.14-make-sure-saved-tls-session-is-refcounted.patch of Package cyrus-imapd (Revision facb5273b075b7f86187d7bfa1656a89)

Currently displaying revision facb5273b075b7f86187d7bfa1656a89 , Show latest

From 3b2f53141947c5a6f4e335ce6a168f1a40b072b5 Mon Sep 17 00:00:00 2001
From: ellie timoney <ellie@fastmail.com>
Date: Wed, 30 Sep 2020 13:16:25 +1000
Subject: [PATCH] tls: make sure saved session is refcounted

otherwise OpenSSL will eventually garbage collect it out from under us,
causing a crash when we try to reuse it.  Also free it properly when
we're done with it.

Same also for imtest.

Fixes #3191, and maybe #2979
---
 imap/tls.c      | 14 ++++++++++++--
 imtest/imtest.c | 17 ++++++++++++-----
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/imap/tls.c b/imap/tls.c
index 8834f44a9e..221b03841c 100644
--- a/imap/tls.c
+++ b/imap/tls.c
@@ -1587,11 +1587,21 @@ HIDDEN int tls_start_clienttls(int readfd, int writefd,
         if (session) {
             SSL_CTX_remove_session(c_ctx, session);
         }
-        if (sess) *sess = NULL;
+        if (sess) {
+            if (*sess)
+                SSL_SESSION_free(*sess);
+            *sess = NULL;
+        }
         r = -1;
         goto done;
     }
-    if (sess) *sess = SSL_get_session(tls_conn);
+
+    /* Session may have been renegotiated; make sure we cache the right one */
+    if (sess) {
+        if (*sess)
+            SSL_SESSION_free(*sess);
+        *sess = SSL_get1_session(tls_conn);
+    }
 
     /* Only loglevel==4 dumps everything */
     if (var_proxy_tls_loglevel < 4)
diff --git a/imtest/imtest.c b/imtest/imtest.c
index a3c795da22..a9e07962e4 100644
--- a/imtest/imtest.c
+++ b/imtest/imtest.c
@@ -690,12 +690,17 @@ static int tls_start_clienttls(unsigned *layer, char **authid)
         SSL_set_session(tls_conn, tls_sess);
 
     if ((sts = SSL_connect(tls_conn)) <= 0) {
+        SSL_SESSION *currsess;
+
         printf("SSL_connect error %d\n", sts);
-        tls_sess = SSL_get_session(tls_conn);
+        currsess = SSL_get_session(tls_conn);
+        if (currsess) {
+            SSL_CTX_remove_session(tls_ctx, currsess);
+            printf("SSL session removed\n");
+        }
         if (tls_sess) {
-            SSL_CTX_remove_session(tls_ctx, tls_sess);
+            SSL_SESSION_free(tls_sess);
             tls_sess = NULL;
-            printf("SSL session removed\n");
         }
         if (tls_conn!=NULL)
             SSL_free(tls_conn);
@@ -758,8 +763,10 @@ static void do_starttls(int ssl, char *keyfile, unsigned *ssf)
                 imtest_fatal("TLS negotiation failed!\n");
         }
 
-    /* TLS negotiation suceeded */
-    tls_sess = SSL_get_session(tls_conn); /* Save the session for reuse */
+    /* TLS negotiation succeeded */
+    if (tls_sess)
+        SSL_SESSION_free(tls_sess);
+    tls_sess = SSL_get1_session(tls_conn); /* Save the session for reuse */
 
     /* tell SASL about the negotiated layer */
     result=sasl_setprop(conn,

Places

File cyrus-imapd-3.0.14-make-sure-saved-tls-session-is-refcounted.patch of Package cyrus-imapd (Revision facb5273b075b7f86187d7bfa1656a89)

Places