aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChristian E. Hopps <chopps@chopps.org>2019-09-27 15:24:37 -0400
committerChristian E. Hopps <chopps@chopps.org>2019-09-27 15:41:19 -0400
commit9a5aab34f51bc1e5458456888ba142ee1055e1f4 (patch)
tree2e89e219c8c2bc0bfe2587b35e38a51155d7bd18
parent18512b002da5da312aa2638b67a8ec4bb2c10236 (diff)
ipsec: fix memleaks in ikev2 openssl code
- Need to always free created contexts - Always pair init with cleanup for older openssl API. Type: fix Signed-off-by: Christian E. Hopps <chopps@chopps.org> Change-Id: Ie8840403bcac500c20085d57240401ad39d119f8
-rw-r--r--src/plugins/ikev2/ikev2_crypto.c18
1 files changed, 15 insertions, 3 deletions
diff --git a/src/plugins/ikev2/ikev2_crypto.c b/src/plugins/ikev2/ikev2_crypto.c
index c8fed439305..3d076ed85ea 100644
--- a/src/plugins/ikev2/ikev2_crypto.c
+++ b/src/plugins/ikev2/ikev2_crypto.c
@@ -270,6 +270,7 @@ ikev2_calc_prf (ikev2_sa_transform_t * tr, v8 * key, v8 * data)
HMAC_Init_ex (ctx, key, vec_len (key), tr->md, NULL);
HMAC_Update (ctx, data, vec_len (data));
HMAC_Final (ctx, prf, &len);
+ HMAC_CTX_free (ctx);
#else
HMAC_CTX_init (&ctx);
HMAC_Init_ex (&ctx, key, vec_len (key), tr->md, NULL);
@@ -354,6 +355,7 @@ ikev2_calc_integr (ikev2_sa_transform_t * tr, v8 * key, u8 * data, int len)
HMAC_Init_ex (hctx, key, vec_len (key), tr->md, NULL);
HMAC_Update (hctx, (const u8 *) data, len);
HMAC_Final (hctx, r, &l);
+ HMAC_CTX_free (hctx);
#else
HMAC_CTX_init (&hctx);
HMAC_Init_ex (&hctx, key, vec_len (key), tr->md, NULL);
@@ -411,7 +413,9 @@ ikev2_decrypt_data (ikev2_sa_t * sa, u8 * data, int len)
/* remove padding */
_vec_len (r) -= r[vec_len (r) - 1] + 1;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ EVP_CIPHER_CTX_free (ctx);
+#else
EVP_CIPHER_CTX_cleanup (&ctx);
#endif
return r;
@@ -441,6 +445,7 @@ ikev2_encrypt_data (ikev2_sa_t * sa, v8 * src, u8 * dst)
ctx = EVP_CIPHER_CTX_new ();
EVP_EncryptInit_ex (ctx, tr_encr->cipher, NULL, key, dst /* dst */ );
EVP_EncryptUpdate (ctx, dst + bs, &out_len, src, vec_len (src));
+ EVP_CIPHER_CTX_free (ctx);
#else
EVP_CIPHER_CTX_init (&ctx);
EVP_EncryptInit_ex (&ctx, tr_encr->cipher, NULL, key, dst /* dst */ );
@@ -697,6 +702,7 @@ ikev2_complete_dh (ikev2_sa_t * sa, ikev2_sa_transform_t * t)
int
ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data)
{
+ int verify;
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
EVP_MD_CTX *md_ctx = EVP_MD_CTX_new ();
#else
@@ -713,10 +719,13 @@ ikev2_verify_sign (EVP_PKEY * pkey, u8 * sigbuf, u8 * data)
#endif
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
- return EVP_VerifyFinal (md_ctx, sigbuf, vec_len (sigbuf), pkey);
+ verify = EVP_VerifyFinal (md_ctx, sigbuf, vec_len (sigbuf), pkey);
+ EVP_MD_CTX_free (md_ctx);
#else
- return EVP_VerifyFinal (&md_ctx, sigbuf, vec_len (sigbuf), pkey);
+ verify = EVP_VerifyFinal (&md_ctx, sigbuf, vec_len (sigbuf), pkey);
+ EVP_MD_CTX_cleanup (&md_ctx);
#endif
+ return verify;
}
u8 *
@@ -726,6 +735,7 @@ ikev2_calc_sign (EVP_PKEY * pkey, u8 * data)
EVP_MD_CTX *md_ctx = EVP_MD_CTX_new ();
#else
EVP_MD_CTX md_ctx;
+ EVP_MD_CTX_init (&md_ctx);
#endif
unsigned int sig_len = 0;
u8 *sign;
@@ -738,6 +748,7 @@ ikev2_calc_sign (EVP_PKEY * pkey, u8 * data)
sign = vec_new (u8, sig_len);
/* calc sign */
EVP_SignFinal (md_ctx, sign, &sig_len, pkey);
+ EVP_MD_CTX_free (md_ctx);
#else
EVP_SignInit (&md_ctx, EVP_sha1 ());
EVP_SignUpdate (&md_ctx, data, vec_len (data));
@@ -746,6 +757,7 @@ ikev2_calc_sign (EVP_PKEY * pkey, u8 * data)
sign = vec_new (u8, sig_len);
/* calc sign */
EVP_SignFinal (&md_ctx, sign, &sig_len, pkey);
+ EVP_MD_CTX_cleanup (&md_ctx);
#endif
return sign;
}