From: Jan Hák <jan.hak@nic.cz>
Date: Wed, 15 Nov 2023 12:57:26 +0000 (+0100)
Subject: fix: enhance deinitialization of TLS context while handling error
X-Git-Tag: v3.4.0~255^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3a2a78eb6d84dfd18af5c13257408b970ac458b6;p=thirdparty%2Fknot-dns.git

fix: enhance deinitialization of TLS context while handling error
---

diff --git a/src/utils/common/tls.c b/src/utils/common/tls.c
index 7d7419c6a2..a886ac238c 100644
--- a/src/utils/common/tls.c
+++ b/src/utils/common/tls.c
@@ -513,6 +513,7 @@ int tls_ctx_init(tls_ctx_t *ctx, const tls_params_t *params,
 	                             ctx->credentials);
 	if (ret != GNUTLS_E_SUCCESS) {
 		gnutls_deinit(ctx->session);
+		ctx->session = NULL;
 		return KNOT_ERROR;
 	}
 
@@ -529,7 +530,7 @@ int tls_ctx_setup_remote_endpoint(tls_ctx_t *ctx, const gnutls_datum_t *alpn,
 	if (alpn != NULL) {
 		ret = gnutls_alpn_set_protocols(ctx->session, alpn, alpn_size, 0);
 		if (ret != GNUTLS_E_SUCCESS) {
-			gnutls_deinit(ctx->session);
+			tls_ctx_deinit(ctx);
 			return KNOT_NET_ECONNECT;
 		}
 	}
@@ -540,7 +541,7 @@ int tls_ctx_setup_remote_endpoint(tls_ctx_t *ctx, const gnutls_datum_t *alpn,
 		ret = gnutls_set_default_priority(ctx->session);
 	}
 	if (ret != GNUTLS_E_SUCCESS) {
-		gnutls_deinit(ctx->session);
+		tls_ctx_deinit(ctx);
 		return KNOT_EINVAL;
 	}
 
@@ -548,7 +549,7 @@ int tls_ctx_setup_remote_endpoint(tls_ctx_t *ctx, const gnutls_datum_t *alpn,
 		ret = gnutls_server_name_set(ctx->session, GNUTLS_NAME_DNS, remote,
 		                             strlen(remote));
 		if (ret != GNUTLS_E_SUCCESS) {
-			gnutls_deinit(ctx->session);
+			tls_ctx_deinit(ctx);
 			return KNOT_EINVAL;
 		}
 	}
@@ -570,7 +571,7 @@ int tls_ctx_connect(tls_ctx_t *ctx, int sockfd, bool fastopen,
 		gnutls_transport_set_fastopen(ctx->session, sockfd, (struct sockaddr *)addr,
 		                              sockaddr_len(addr), 0);
 #else
-		gnutls_deinit(ctx->session);
+		tls_ctx_deinit(ctx);
 		return KNOT_ENOTSUP;
 #endif
 	} else {
@@ -592,7 +593,7 @@ int tls_ctx_connect(tls_ctx_t *ctx, int sockfd, bool fastopen,
 		if (ret != GNUTLS_E_SUCCESS && gnutls_error_is_fatal(ret) == 0) {
 			if (poll(&pfd, 1, 1000 * ctx->wait) != 1) {
 				WARN("TLS, peer took too long to respond");
-				gnutls_deinit(ctx->session);
+				tls_ctx_deinit(ctx);
 				return KNOT_NET_ETIMEOUT;
 			}
 		}