initialize mutexes before modules_init(). Helps with #2129

diff --git a/src/include/tls-h b/src/include/tls-h
index bf57f339a0dac06bd433d859d583cff75c33106c..ee4ea76396bea6cbbc7410eb2a8e4a9c396b08b1 100644 (file)
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -294,8 +294,11 @@ void               cbtls_msg(int write_p, int msg_version, int content_type, void const *buf
                          void *arg);
 int            cbtls_verify(int ok, X509_STORE_CTX *ctx);
 
+/* threads.c */
+int            tls_mutexes_init(void);
+
 /* TLS */
-void           tls_global_init(void);
+int            tls_global_init(bool spawn_flag, bool check);
 #ifdef ENABLE_OPENSSL_VERSION_CHECK
 int            tls_global_version_check(char const *acknowledged);
 #endif

diff --git a/src/main/radiusd.c b/src/main/radiusd.c
index 8581d3c66ca8a6dc54b1b01ad6ff8a54e70f1fea..55a3bbca7cb5dabbf28b0026c5299633a3fd94ce 100644 (file)
--- a/src/main/radiusd.c
+++ b/src/main/radiusd.c
@@ -337,7 +337,7 @@ int main(int argc, char *argv[])
         *  Initialising OpenSSL once, here, is safer than having individual modules do it.
         */
 #ifdef HAVE_OPENSSL_CRYPTO_H
-       tls_global_init();
+       if (tls_global_init(spawn_flag, check_config) < 0) exit(EXIT_FAILURE);
 #endif
 
        /*

diff --git a/src/main/threads.c b/src/main/threads.c
index 240917079160533da9e272a3749a7eee4e04fad1..91050329d8f7ddf0e8dfb43870524671d251186f 100644 (file)
--- a/src/main/threads.c
+++ b/src/main/threads.c
@@ -265,14 +265,17 @@ static void ssl_locking_function(int mode, int n, UNUSED char const *file, UNUSE
 }
 #endif
 
-static int setup_ssl_mutexes(void)
+/*
+ *     Create the TLS mutexes.
+ */
+int tls_mutexes_init(void)
 {
        int i;
 
        ssl_mutexes = rad_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
        if (!ssl_mutexes) {
                ERROR("Error allocating memory for SSL mutexes!");
-               return 0;
+               return -1;
        }
 
        for (i = 0; i < CRYPTO_num_locks(); i++) {
@@ -286,7 +289,7 @@ static int setup_ssl_mutexes(void)
        CRYPTO_set_locking_callback(ssl_locking_function);
 #endif
 
-       return 1;
+       return 0;
 }
 #endif
 
@@ -1044,18 +1047,6 @@ int thread_pool_init(CONF_SECTION *cs, bool *spawn_flag)
        }
 #endif
 
-#ifdef HAVE_OPENSSL_CRYPTO_H
-       /*
-        *      If we're linking with OpenSSL too, then we need
-        *      to set up the mutexes and enable the thread callbacks.
-        */
-       if (!setup_ssl_mutexes()) {
-               ERROR("FATAL: Failed to set up SSL mutexes");
-               return -1;
-       }
-#endif
-
-
 #ifndef WITH_GCD
        /*
         *      Create a number of waiting threads.

diff --git a/src/main/tls.c b/src/main/tls.c
index dcc96ad5c5e33afd016a1ff4b77868dc2113fe76..2690ebca00a3205115c7103778381e174e3bc910 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2595,7 +2595,7 @@ static void sess_free_certs(UNUSED void *parent, void *data_ptr,
  * This should be called exactly once from main, before reading the main config
  * or initialising any modules.
  */
-void tls_global_init(void)
+int tls_global_init(bool spawn_flag, bool check)
 {
        SSL_load_error_strings();       /* readable error messages (examples show call before library_init) */
        SSL_library_init();             /* initialize library */
@@ -2606,6 +2606,20 @@ void tls_global_init(void)
         *      Initialize the index for the certificates.
         */
        fr_tls_ex_index_certs = SSL_SESSION_get_ex_new_index(0, NULL, NULL, NULL, sess_free_certs);
+
+       /*
+        *      If we're linking with OpenSSL too, then we need
+        *      to set up the mutexes and enable the thread callbacks.
+        *
+        *      'check' and not 'check_config' because it's a global,
+        *      and we don't want to have tls.c depend on globals.
+        */
+       if (spawn_flag && !check && (tls_mutexes_init() < 0)) {
+               ERROR("FATAL: Failed to set up SSL mutexes");
+               return -1;
+       }
+
+       return 0;
 }
 
 #ifdef ENABLE_OPENSSL_VERSION_CHECK

diff --git a/src/main/unittest.c b/src/main/unittest.c
index d6641ce8066038d4dac99c49e98c61578012ca0e..7ae605c516824911e0358f3fb537b335167958a9 100644 (file)
--- a/src/main/unittest.c
+++ b/src/main/unittest.c
@@ -752,7 +752,7 @@ int main(int argc, char *argv[])
         *  Initialising OpenSSL once, here, is safer than having individual modules do it.
         */
 #ifdef HAVE_OPENSSL_CRYPTO_H
-       tls_global_init();
+       tls_global_init(false, false);
 #endif
 
        if (xlat_register("poke", xlat_poke, NULL, NULL) < 0) {