From a8af7cf253c4e8ab9ba1a2cfed50f6236fea3a62 Mon Sep 17 00:00:00 2001 From: Benoît Ganne Date: Thu, 17 Sep 2020 17:08:07 +0200 Subject: ikev2: fix memory leaks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Type: fix Change-Id: I5be19a4923b37e2636621d36155178ac348ee41c Signed-off-by: Benoît Ganne --- src/plugins/ikev2/ikev2.c | 23 ++++++++++++++++++++--- src/plugins/ikev2/ikev2_crypto.c | 1 + 2 files changed, 21 insertions(+), 3 deletions(-) (limited to 'src/plugins/ikev2') diff --git a/src/plugins/ikev2/ikev2.c b/src/plugins/ikev2/ikev2.c index 34c54f3d848..c69ac913c48 100644 --- a/src/plugins/ikev2/ikev2.c +++ b/src/plugins/ikev2/ikev2.c @@ -3210,6 +3210,8 @@ ikev2_set_local_key (vlib_main_t * vm, u8 * file) { ikev2_main_t *km = &ikev2_main; + if (km->pkey) + EVP_PKEY_free (km->pkey); km->pkey = ikev2_load_key_file (file); if (km->pkey == NULL) return clib_error_return (0, "load key '%s' failed", file); @@ -3358,6 +3360,19 @@ ikev2_cleanup_profile_sessions (ikev2_main_t * km, ikev2_profile_t * p) vec_free (del_sai); } +static void +ikev2_profile_free (ikev2_profile_t * p) +{ + vec_free (p->name); + + vec_free (p->auth.data); + if (p->auth.key) + EVP_PKEY_free (p->auth.key); + + vec_free (p->loc_id.data); + vec_free (p->rem_id.data); +} + clib_error_t * ikev2_add_del_profile (vlib_main_t * vm, u8 * name, int is_add) { @@ -3387,7 +3402,7 @@ ikev2_add_del_profile (vlib_main_t * vm, u8 * name, int is_add) ikev2_unregister_udp_port (p); ikev2_cleanup_profile_sessions (km, p); - vec_free (p->name); + ikev2_profile_free (p); pool_put (km->profiles, p); mhash_unset (&km->profile_index_by_name, name, 0); } @@ -3408,7 +3423,11 @@ ikev2_set_profile_auth (vlib_main_t * vm, u8 * name, u8 auth_method, r = clib_error_return (0, "unknown profile %v", name); return r; } + + if (p->auth.key) + EVP_PKEY_free (p->auth.key); vec_free (p->auth.data); + p->auth.method = auth_method; p->auth.data = vec_dup (auth_data); p->auth.hex = data_hex_format; @@ -3416,8 +3435,6 @@ ikev2_set_profile_auth (vlib_main_t * vm, u8 * name, u8 auth_method, if (auth_method == IKEV2_AUTH_METHOD_RSA_SIG) { vec_add1 (p->auth.data, 0); - if (p->auth.key) - EVP_PKEY_free (p->auth.key); p->auth.key = ikev2_load_cert_file (p->auth.data); if (p->auth.key == NULL) return clib_error_return (0, "load cert '%s' failed", p->auth.data); diff --git a/src/plugins/ikev2/ikev2_crypto.c b/src/plugins/ikev2/ikev2_crypto.c index b1fdf890e08..013857dee9b 100644 --- a/src/plugins/ikev2/ikev2_crypto.c +++ b/src/plugins/ikev2/ikev2_crypto.c @@ -828,6 +828,7 @@ ikev2_load_cert_file (u8 * file) } pkey = X509_get_pubkey (x509); + X509_free (x509); if (pkey == NULL) ikev2_log_error ("get pubkey %s failed", file); -- cgit 1.2.3-korg