Add OPENSSL_cleanup to tls_shutdown function

This prevents a direct leak in OPENSSL_init_crypto (called from
OPENSSL_init_ssl).

Add shim version of OPENSSL_cleanup because it is missing in LibreSSL on
OpenBSD.

(cherry picked from commit 89f4f8f0c89a5243ba9fa343d492b15fd97e4df0)

diff --git a/config.h.in b/config.h.in
index 39c140a3685c78899ff2ebe4044c85705496c148..212bc0b179976e6d6fdb67367998bd60ac9a9971 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -288,6 +288,9 @@
 /* Define to 1 if you have the <net/route.h> header file. */
 #undef HAVE_NET_ROUTE_H
 
+/* Define to 1 if you have the `OPENSSL_cleanup' function. */
+#undef HAVE_OPENSSL_CLEANUP
+
 /* define if OpenSSL supports Ed25519 */
 #undef HAVE_OPENSSL_ED25519
 

diff --git a/configure.ac b/configure.ac
index d11e0ca7264bdb5f2c4f7579e5ded7c639a96a3c..b3c2eaa085e9008d453983bfb5e3daad98cc0b03 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -832,7 +832,7 @@ AC_COMPILE_IFELSE(
 # Check for functions added in OpenSSL or LibreSSL
 #
 
-AC_CHECK_FUNCS([OPENSSL_init_ssl OPENSSL_init_crypto])
+AC_CHECK_FUNCS([OPENSSL_init_ssl OPENSSL_init_crypto OPENSSL_cleanup])
 AC_CHECK_FUNCS([CRYPTO_zalloc])
 AC_CHECK_FUNCS([EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free])
 AC_CHECK_FUNCS([EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset])

diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
index bc1baa92bbb3d0efd02e360f44efdc00e5b13891..683526d05425cda570946de3c44e2f43c5d3f0b2 100644 (file)
--- a/lib/isc/openssl_shim.c
+++ b/lib/isc/openssl_shim.c
@@ -220,3 +220,10 @@ OPENSSL_init_ssl(uint64_t opts, const void *settings) {
        return (1);
 }
 #endif
+
+#if !HAVE_OPENSSL_CLEANUP
+void
+OPENSSL_cleanup(void) {
+       return;
+}
+#endif

diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
index bd5a137e34b2061546912be15e090b584c486a21..2923e278b2dbc4c76490335a01954d769f63e79b 100644 (file)
--- a/lib/isc/openssl_shim.h
+++ b/lib/isc/openssl_shim.h
@@ -119,6 +119,11 @@ OPENSSL_init_ssl(uint64_t opts, const void *settings);
 
 #endif
 
+#if !HAVE_OPENSSL_CLEANUP
+void
+OPENSSL_cleanup(void);
+#endif
+
 #if !HAVE_TLS_SERVER_METHOD
 #define TLS_server_method SSLv23_server_method
 #endif

diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index c5da21449890bf360a067bee430fadb739376066..a73af17e9691dd16213971619abe74bae63abe5f 100644 (file)
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -13,6 +13,7 @@
 
 #include <openssl/bn.h>
 #include <openssl/conf.h>
+#include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/opensslv.h>
 #include <openssl/rand.h>
@@ -123,8 +124,9 @@ tls_shutdown(void) {
        REQUIRE(atomic_load(&init_done));
        REQUIRE(!atomic_load(&shut_done));
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+       OPENSSL_cleanup();
+#else
        CONF_modules_unload(1);
        OBJ_cleanup();
        EVP_cleanup();