From 924b6006d7db02d8dbb8e2ad35b8ea765456b19b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bodo=20M=C3=B6ller?= Date: Mon, 23 Sep 2002 14:30:59 +0000 Subject: [PATCH] really fix race condition PR: 262 --- CHANGES | 8 +++++-- crypto/cryptlib.c | 1 + crypto/crypto.h | 53 +++++++++++++++++++++++++---------------------- ssl/s23_clnt.c | 4 ++++ ssl/s23_srvr.c | 4 ++++ ssl/s2_clnt.c | 4 ++++ ssl/s2_srvr.c | 4 ++++ ssl/s3_clnt.c | 4 ++++ ssl/s3_srvr.c | 4 ++++ ssl/t1_clnt.c | 4 ++++ ssl/t1_srvr.c | 4 ++++ 11 files changed, 67 insertions(+), 27 deletions(-) diff --git a/CHANGES b/CHANGES index dfa7be1bd2..cf9d6cdab9 100644 --- a/CHANGES +++ b/CHANGES @@ -8,8 +8,12 @@ (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes). [Bodo Moeller] - *) Fix race condition in SSLv3_client_method(). - [Bodo Moeller] + *) Fix initialization code race conditions in + SSLv23_client_method(), SSLv23_server_method(), + SSLv2_client_method(), SSLv2_server_method(), + SSLv3_client_method(), SSLv3_server_method(), + TLSv1_client_method(), TLSv1_server_method(). + [Patrick McCormick , Bodo Moeller] *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after the cached sessions are flushed, as the remove_cb() might use ex_data diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c index 8fd2d4d26b..4580d04c2c 100644 --- a/crypto/cryptlib.c +++ b/crypto/cryptlib.c @@ -89,6 +89,7 @@ static const char* lock_names[CRYPTO_NUM_LOCKS] = "ssl_session", "ssl_sess_cert", "ssl", + /* "ssl_method", */ "rand", "rand2", "debug_malloc", diff --git a/crypto/crypto.h b/crypto/crypto.h index 8fba87131c..5fb7f7a766 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -95,35 +95,38 @@ extern "C" { * names in cryptlib.c */ -#define CRYPTO_LOCK_ERR 1 -#define CRYPTO_LOCK_ERR_HASH 2 -#define CRYPTO_LOCK_X509 3 -#define CRYPTO_LOCK_X509_INFO 4 -#define CRYPTO_LOCK_X509_PKEY 5 +#define CRYPTO_LOCK_ERR 1 +#define CRYPTO_LOCK_ERR_HASH 2 +#define CRYPTO_LOCK_X509 3 +#define CRYPTO_LOCK_X509_INFO 4 +#define CRYPTO_LOCK_X509_PKEY 5 #define CRYPTO_LOCK_X509_CRL 6 #define CRYPTO_LOCK_X509_REQ 7 #define CRYPTO_LOCK_DSA 8 #define CRYPTO_LOCK_RSA 9 #define CRYPTO_LOCK_EVP_PKEY 10 -#define CRYPTO_LOCK_X509_STORE 11 -#define CRYPTO_LOCK_SSL_CTX 12 -#define CRYPTO_LOCK_SSL_CERT 13 -#define CRYPTO_LOCK_SSL_SESSION 14 -#define CRYPTO_LOCK_SSL_SESS_CERT 15 -#define CRYPTO_LOCK_SSL 16 -#define CRYPTO_LOCK_RAND 17 -#define CRYPTO_LOCK_RAND2 18 -#define CRYPTO_LOCK_MALLOC 19 -#define CRYPTO_LOCK_BIO 20 -#define CRYPTO_LOCK_GETHOSTBYNAME 21 -#define CRYPTO_LOCK_GETSERVBYNAME 22 -#define CRYPTO_LOCK_READDIR 23 -#define CRYPTO_LOCK_RSA_BLINDING 24 -#define CRYPTO_LOCK_DH 25 -#define CRYPTO_LOCK_MALLOC2 26 -#define CRYPTO_LOCK_DSO 27 -#define CRYPTO_LOCK_DYNLOCK 28 -#define CRYPTO_NUM_LOCKS 29 +#define CRYPTO_LOCK_X509_STORE 11 +#define CRYPTO_LOCK_SSL_CTX 12 +#define CRYPTO_LOCK_SSL_CERT 13 +#define CRYPTO_LOCK_SSL_SESSION 14 +#define CRYPTO_LOCK_SSL_SESS_CERT 15 +#define CRYPTO_LOCK_SSL 16 +/* for binary compatibility between 0.9.6 minor versions, + * reuse an existing lock (later version use a new one): */ +# define CRYPTO_LOCK_SSL_SESSION CRYPTO_LOCK_SSL_CERT +#define CRYPTO_LOCK_RAND 17 +#define CRYPTO_LOCK_RAND2 18 +#define CRYPTO_LOCK_MALLOC 19 +#define CRYPTO_LOCK_BIO 20 +#define CRYPTO_LOCK_GETHOSTBYNAME 21 +#define CRYPTO_LOCK_GETSERVBYNAME 22 +#define CRYPTO_LOCK_READDIR 23 +#define CRYPTO_LOCK_RSA_BLINDING 24 +#define CRYPTO_LOCK_DH 25 +#define CRYPTO_LOCK_MALLOC2 26 +#define CRYPTO_LOCK_DSO 27 +#define CRYPTO_LOCK_DYNLOCK 28 +#define CRYPTO_NUM_LOCKS 29 #define CRYPTO_LOCK 1 #define CRYPTO_UNLOCK 2 @@ -145,7 +148,7 @@ extern "C" { #endif #else #define CRYPTO_w_lock(a) -#define CRYPTO_w_unlock(a) +#define CRYPTO_w_unlock(a) #define CRYPTO_r_lock(a) #define CRYPTO_r_unlock(a) #define CRYPTO_add(a,b,c) ((*(a))+=(b)) diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c index 2d0eb4a8ff..df9ed02ddd 100644 --- a/ssl/s23_clnt.c +++ b/ssl/s23_clnt.c @@ -87,11 +87,15 @@ SSL_METHOD *SSLv23_client_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&SSLv23_client_data, (char *)sslv23_base_method(),sizeof(SSL_METHOD)); SSLv23_client_data.ssl_connect=ssl23_connect; SSLv23_client_data.get_ssl_method=ssl23_get_client_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&SSLv23_client_data); } diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c index b40bb01ab7..94198750f9 100644 --- a/ssl/s23_srvr.c +++ b/ssl/s23_srvr.c @@ -139,11 +139,15 @@ SSL_METHOD *SSLv23_server_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&SSLv23_server_data, (char *)sslv23_base_method(),sizeof(SSL_METHOD)); SSLv23_server_data.ssl_accept=ssl23_accept; SSLv23_server_data.get_ssl_method=ssl23_get_server_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&SSLv23_server_data); } diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c index 236b394db7..c59fa6e429 100644 --- a/ssl/s2_clnt.c +++ b/ssl/s2_clnt.c @@ -145,11 +145,15 @@ SSL_METHOD *SSLv2_client_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&SSLv2_client_data,(char *)sslv2_base_method(), sizeof(SSL_METHOD)); SSLv2_client_data.ssl_connect=ssl2_connect; SSLv2_client_data.get_ssl_method=ssl2_get_client_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&SSLv2_client_data); } diff --git a/ssl/s2_srvr.c b/ssl/s2_srvr.c index 3ef41cc0fd..48fff175d4 100644 --- a/ssl/s2_srvr.c +++ b/ssl/s2_srvr.c @@ -145,11 +145,15 @@ SSL_METHOD *SSLv2_server_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&SSLv2_server_data,(char *)sslv2_base_method(), sizeof(SSL_METHOD)); SSLv2_server_data.ssl_accept=ssl2_accept; SSLv2_server_data.get_ssl_method=ssl2_get_server_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&SSLv2_server_data); } diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index b58321628b..a55acd1975 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -146,11 +146,15 @@ SSL_METHOD *SSLv3_client_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(), sizeof(SSL_METHOD)); SSLv3_client_data.ssl_connect=ssl3_connect; SSLv3_client_data.get_ssl_method=ssl3_get_client_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&SSLv3_client_data); } diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index fe1e689014..50913ae8e4 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -151,11 +151,15 @@ SSL_METHOD *SSLv3_server_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&SSLv3_server_data,(char *)sslv3_base_method(), sizeof(SSL_METHOD)); SSLv3_server_data.ssl_accept=ssl3_accept; SSLv3_server_data.get_ssl_method=ssl3_get_server_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&SSLv3_server_data); } diff --git a/ssl/t1_clnt.c b/ssl/t1_clnt.c index 9745630a00..df00a1215a 100644 --- a/ssl/t1_clnt.c +++ b/ssl/t1_clnt.c @@ -79,11 +79,15 @@ SSL_METHOD *TLSv1_client_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&TLSv1_client_data,(char *)tlsv1_base_method(), sizeof(SSL_METHOD)); TLSv1_client_data.ssl_connect=ssl3_connect; TLSv1_client_data.get_ssl_method=tls1_get_client_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&TLSv1_client_data); } diff --git a/ssl/t1_srvr.c b/ssl/t1_srvr.c index 996b7ca8e2..e62275c6f8 100644 --- a/ssl/t1_srvr.c +++ b/ssl/t1_srvr.c @@ -80,11 +80,15 @@ SSL_METHOD *TLSv1_server_method(void) if (init) { + CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD); + memcpy((char *)&TLSv1_server_data,(char *)tlsv1_base_method(), sizeof(SSL_METHOD)); TLSv1_server_data.ssl_accept=ssl3_accept; TLSv1_server_data.get_ssl_method=tls1_get_server_method; init=0; + + CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD); } return(&TLSv1_server_data); }