aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOfer Heifetz <oferh@marvell.com>2021-07-26 14:17:33 +0300
committerFlorin Coras <florin.coras@gmail.com>2021-08-12 14:26:22 +0000
commit8c7f5c809fecec80cdfdcae6cab1592defddc931 (patch)
tree7f2dfba98d4e6683914c63395b86850f9c8ad7c8
parentb8e7a45d56be9f3e11b07b82fd899160e2af1bf1 (diff)
tls: add start_listen openssl API return value check
Type: improvement Check SSL_CTX_use_* API return value and exit on error. Check BIO_new return code. Release allocated BIO on error cases. Change-Id: I9c48e91727e0eeba5d7d74d06fc37634e3c20978 Signed-off-by: Ofer Heifetz <oferh@marvell.com>
-rw-r--r--src/plugins/tlsopenssl/tls_openssl.c34
1 files changed, 30 insertions, 4 deletions
diff --git a/src/plugins/tlsopenssl/tls_openssl.c b/src/plugins/tlsopenssl/tls_openssl.c
index 05cd13c9970..fa223433c22 100644
--- a/src/plugins/tlsopenssl/tls_openssl.c
+++ b/src/plugins/tlsopenssl/tls_openssl.c
@@ -753,25 +753,47 @@ openssl_start_listen (tls_ctx_t * lctx)
* Set the key and cert
*/
cert_bio = BIO_new (BIO_s_mem ());
+ if (!cert_bio)
+ {
+ clib_warning ("unable to allocate memory");
+ return -1;
+ }
BIO_write (cert_bio, ckpair->cert, vec_len (ckpair->cert));
srvcert = PEM_read_bio_X509 (cert_bio, NULL, NULL, NULL);
if (!srvcert)
{
clib_warning ("unable to parse certificate");
- return -1;
+ goto err;
}
- SSL_CTX_use_certificate (ssl_ctx, srvcert);
+ rv = SSL_CTX_use_certificate (ssl_ctx, srvcert);
+ if (rv != 1)
+ {
+ clib_warning ("unable to use SSL certificate");
+ goto err;
+ }
+
BIO_free (cert_bio);
cert_bio = BIO_new (BIO_s_mem ());
+ if (!cert_bio)
+ {
+ clib_warning ("unable to allocate memory");
+ return -1;
+ }
BIO_write (cert_bio, ckpair->key, vec_len (ckpair->key));
pkey = PEM_read_bio_PrivateKey (cert_bio, NULL, NULL, NULL);
if (!pkey)
{
clib_warning ("unable to parse pkey");
- return -1;
+ goto err;
}
- SSL_CTX_use_PrivateKey (ssl_ctx, pkey);
+ rv = SSL_CTX_use_PrivateKey (ssl_ctx, pkey);
+ if (rv != 1)
+ {
+ clib_warning ("unable to use SSL PrivateKey");
+ goto err;
+ }
+
BIO_free (cert_bio);
olc_index = openssl_listen_ctx_alloc ();
@@ -785,6 +807,10 @@ openssl_start_listen (tls_ctx_t * lctx)
return 0;
+err:
+ if (cert_bio)
+ BIO_free (cert_bio);
+ return -1;
}
static int