sinjuginas/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: httpclient: fixed memory allocation for the SSL ca_file

Browse Source 
The memory for the SSL ca_file was allocated only once (in the function
httpclient_create_proxy()) and that pointer was assigned to each created
proxy that the HTTP client uses.  This would not be a problem if this
memory was not freed in each individual proxy when it was deinitialized
in the function ssl_sock_free_srv_ctx().

  Memory allocation:
    src/http_client.c, function httpclient_create_proxy():
      1277:	if (!httpclient_ssl_ca_file)
      1278:		httpclient_ssl_ca_file = strdup("@system-ca");
      1280:	srv_ssl->ssl_ctx.ca_file = httpclient_ssl_ca_file;

  Memory deallocation:
    src/ssl_sock.c, function ssl_sock_free_srv_ctx():
      5613:	ha_free(&srv->ssl_ctx.ca_file);

This should be backported to version 2.6.

(cherry picked from commit a2ec192de38eba294189bf94b76dbb2c4cf9a55b)
[cf: Context adjustment]
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
This commit is contained in:
Miroslav Zagorac 2022-11-02 16:11:50 +01:00 committed by Christopher Faulet
parent b055edbeeb
commit b0c7490d4e
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/http_client.c
View File

@ -1215,11 +1215,7 @@ static int httpclient_precheck()
httpclient_srv_ssl->ssl_ctx.verify = httpclient_ssl_verify; httpclient_srv_ssl->ssl_ctx.verify = httpclient_ssl_verify;
/* if the verify is required, try to load the system CA */ /* if the verify is required, try to load the system CA */
if (httpclient_ssl_verify == SSL_SOCK_VERIFY_REQUIRED) { if (httpclient_ssl_verify == SSL_SOCK_VERIFY_REQUIRED) {
httpclient_srv_ssl->ssl_ctx.ca_file = strdup(httpclient_ssl_ca_file ? httpclient_ssl_ca_file : "@system-ca");
if (!httpclient_ssl_ca_file)
httpclient_ssl_ca_file = strdup("@system-ca");
httpclient_srv_ssl->ssl_ctx.ca_file = httpclient_ssl_ca_file;
if (!ssl_store_load_locations_file(httpclient_srv_ssl->ssl_ctx.ca_file, 1, CAFILE_CERT)) { if (!ssl_store_load_locations_file(httpclient_srv_ssl->ssl_ctx.ca_file, 1, CAFILE_CERT)) {
/* if we failed to load the ca-file, only quits in /* if we failed to load the ca-file, only quits in
* error with hard_error, otherwise just disable the * error with hard_error, otherwise just disable the