|
 |
1b46c7 |
From b8b463159d9bcb05505ec128b5c2926ace0b3e92 Mon Sep 17 00:00:00 2001
|
|
|
1b46c7 |
From: Quentin Armitage <quentin@armitage.org.uk>
|
|
|
1b46c7 |
Date: Thu, 13 Oct 2022 08:32:17 +0100
|
|
|
1b46c7 |
Subject: [PATCH] ipvs: Work around OpenSSL memory leak in versions 3.0.0 to
|
|
|
1b46c7 |
3.0.4
|
|
|
1b46c7 |
|
|
|
1b46c7 |
The memory leak was observed with OpenSSL 3.0.1, and it is resolved
|
|
|
1b46c7 |
by version 3.0.5. Also the leak is not observed in v1.1.1n.
|
|
|
1b46c7 |
|
|
|
1b46c7 |
Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
|
|
|
1b46c7 |
---
|
|
|
1b46c7 |
keepalived/check/check_ssl.c | 20 +++++++++++++++++++-
|
|
|
1b46c7 |
1 file changed, 19 insertions(+), 1 deletion(-)
|
|
|
1b46c7 |
|
|
|
1b46c7 |
diff --git a/keepalived/check/check_ssl.c b/keepalived/check/check_ssl.c
|
|
|
1b46c7 |
index 917ac0d7..50efa824 100644
|
|
|
1b46c7 |
--- a/keepalived/check/check_ssl.c
|
|
|
1b46c7 |
+++ b/keepalived/check/check_ssl.c
|
|
|
1b46c7 |
@@ -229,7 +229,25 @@ ssl_connect(thread_ref_t thread, int new_req)
|
|
|
1b46c7 |
BIO_get_fd(req->bio, &bio_fd);
|
|
|
1b46c7 |
if (fcntl(bio_fd, F_SETFD, fcntl(bio_fd, F_GETFD) | FD_CLOEXEC) == -1)
|
|
|
1b46c7 |
log_message(LOG_INFO, "Setting CLOEXEC failed on ssl socket - errno %d", errno);
|
|
|
1b46c7 |
-#ifdef HAVE_SSL_SET0_RBIO
|
|
|
1b46c7 |
+
|
|
|
1b46c7 |
+ /* There is a memory leak in openSSL at least in version 3.0.1, which is fixed
|
|
|
1b46c7 |
+ * by version 3.0.5. It was not present in version 1.1.1n. Since I haven't been
|
|
|
1b46c7 |
+ * able to identify the OpenSSL patch that resolved the leak, we play safe and
|
|
|
1b46c7 |
+ * assume it is in versions 3.0.0 up to 3.0.4.
|
|
|
1b46c7 |
+ * The leak is memory allocated by
|
|
|
1b46c7 |
+ * p = OPENSSL_malloc(len);
|
|
|
1b46c7 |
+ * in ssl3_setup_write_buffer() in ssl/record/ssl_buffer.c
|
|
|
1b46c7 |
+ *
|
|
|
1b46c7 |
+ * It appears that setting SSL_MODE_RELEASE_BUFFERS causes the memory leak not
|
|
|
1b46c7 |
+ * to occur.
|
|
|
1b46c7 |
+ */
|
|
|
1b46c7 |
+#ifdef OPENSSL_VERSION_MAJOR
|
|
|
1b46c7 |
+#if OPENSSL_VERSION_MAJOR == 3 && OPENSSL_VERSION_MINOR == 0 && OPENSSL_VERSION_PATCH <= 4
|
|
|
1b46c7 |
+ SSL_set_mode(req->ssl, SSL_MODE_RELEASE_BUFFERS);
|
|
|
1b46c7 |
+#endif
|
|
|
1b46c7 |
+#endif
|
|
|
1b46c7 |
+
|
|
|
1b46c7 |
+#if defined HAVE_SSL_SET0_RBIO && defined HAVE_SSL_SET0_WBIO
|
|
|
1b46c7 |
BIO_up_ref(req->bio);
|
|
|
1b46c7 |
SSL_set0_rbio(req->ssl, req->bio);
|
|
|
1b46c7 |
SSL_set0_wbio(req->ssl, req->bio);
|
|
|
1b46c7 |
--
|
|
|
1b46c7 |
2.38.1
|
|
|
1b46c7 |
|