From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 20 Nov 2017 16:10:44 +0000 (-0500)
Subject: initialize mutexes before modules_init().  Helps with #2129
X-Git-Tag: release_3_0_16~40
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=09759f738604d0fbb24e34f937441b6bb76a287c;p=thirdparty%2Ffreeradius-server.git

initialize mutexes before modules_init().  Helps with #2129
---

diff --git a/src/include/tls-h b/src/include/tls-h
index bf57f339a0d..ee4ea76396b 100644
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -294,8 +294,11 @@ void 		cbtls_msg(int write_p, int msg_version, int content_type, void const *buf
 			  void *arg);
 int		cbtls_verify(int ok, X509_STORE_CTX *ctx);
 
+/* threads.c */
+int		tls_mutexes_init(void);
+
 /* TLS */
-void		tls_global_init(void);
+int		tls_global_init(bool spawn_flag, bool check);
 #ifdef ENABLE_OPENSSL_VERSION_CHECK
 int		tls_global_version_check(char const *acknowledged);
 #endif
diff --git a/src/main/radiusd.c b/src/main/radiusd.c
index 8581d3c66ca..55a3bbca7cb 100644
--- a/src/main/radiusd.c
+++ b/src/main/radiusd.c
@@ -337,7 +337,7 @@ int main(int argc, char *argv[])
 	 *  Initialising OpenSSL once, here, is safer than having individual modules do it.
 	 */
 #ifdef HAVE_OPENSSL_CRYPTO_H
-	tls_global_init();
+	if (tls_global_init(spawn_flag, check_config) < 0) exit(EXIT_FAILURE);
 #endif
 
 	/*
diff --git a/src/main/threads.c b/src/main/threads.c
index 24091707916..91050329d8f 100644
--- a/src/main/threads.c
+++ b/src/main/threads.c
@@ -265,14 +265,17 @@ static void ssl_locking_function(int mode, int n, UNUSED char const *file, UNUSE
 }
 #endif
 
-static int setup_ssl_mutexes(void)
+/*
+ *	Create the TLS mutexes.
+ */
+int tls_mutexes_init(void)
 {
 	int i;
 
 	ssl_mutexes = rad_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t));
 	if (!ssl_mutexes) {
 		ERROR("Error allocating memory for SSL mutexes!");
-		return 0;
+		return -1;
 	}
 
 	for (i = 0; i < CRYPTO_num_locks(); i++) {
@@ -286,7 +289,7 @@ static int setup_ssl_mutexes(void)
 	CRYPTO_set_locking_callback(ssl_locking_function);
 #endif
 
-	return 1;
+	return 0;
 }
 #endif
 
@@ -1044,18 +1047,6 @@ int thread_pool_init(CONF_SECTION *cs, bool *spawn_flag)
 	}
 #endif
 
-#ifdef HAVE_OPENSSL_CRYPTO_H
-	/*
-	 *	If we're linking with OpenSSL too, then we need
-	 *	to set up the mutexes and enable the thread callbacks.
-	 */
-	if (!setup_ssl_mutexes()) {
-		ERROR("FATAL: Failed to set up SSL mutexes");
-		return -1;
-	}
-#endif
-
-
 #ifndef WITH_GCD
 	/*
 	 *	Create a number of waiting threads.
diff --git a/src/main/tls.c b/src/main/tls.c
index dcc96ad5c5e..2690ebca00a 100644
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -2595,7 +2595,7 @@ static void sess_free_certs(UNUSED void *parent, void *data_ptr,
  * This should be called exactly once from main, before reading the main config
  * or initialising any modules.
  */
-void tls_global_init(void)
+int tls_global_init(bool spawn_flag, bool check)
 {
 	SSL_load_error_strings();	/* readable error messages (examples show call before library_init) */
 	SSL_library_init();		/* initialize library */
@@ -2606,6 +2606,20 @@ void tls_global_init(void)
 	 *	Initialize the index for the certificates.
 	 */
 	fr_tls_ex_index_certs = SSL_SESSION_get_ex_new_index(0, NULL, NULL, NULL, sess_free_certs);
+
+	/*
+	 *	If we're linking with OpenSSL too, then we need
+	 *	to set up the mutexes and enable the thread callbacks.
+	 *
+	 *	'check' and not 'check_config' because it's a global,
+	 *	and we don't want to have tls.c depend on globals.
+	 */
+	if (spawn_flag && !check && (tls_mutexes_init() < 0)) {
+		ERROR("FATAL: Failed to set up SSL mutexes");
+		return -1;
+	}
+
+	return 0;
 }
 
 #ifdef ENABLE_OPENSSL_VERSION_CHECK
diff --git a/src/main/unittest.c b/src/main/unittest.c
index d6641ce8066..7ae605c5168 100644
--- a/src/main/unittest.c
+++ b/src/main/unittest.c
@@ -752,7 +752,7 @@ int main(int argc, char *argv[])
 	 *  Initialising OpenSSL once, here, is safer than having individual modules do it.
 	 */
 #ifdef HAVE_OPENSSL_CRYPTO_H
-	tls_global_init();
+	tls_global_init(false, false);
 #endif
 
 	if (xlat_register("poke", xlat_poke, NULL, NULL) < 0) {