diff mbox series

[Openvpn-devel] Don't manually free DH params in OpenSSL 3

Message ID 20211025145314.23009-1-maximilian.fillinger@foxcrypto.com
State Accepted
Headers show
Series [Openvpn-devel] Don't manually free DH params in OpenSSL 3 | expand

Commit Message

Maximilian Fillinger Oct. 25, 2021, 3:53 a.m. UTC 
When the EVP_PKEY object with the Diffie-Hellman parameters is passed
to SSL_CTX_set0_tmp_dh_pkey, it does not create a copy but stores the
pointer in the SSL_CTX. Therefore, we should not free it.

The EVP_PKEY will be freed automatically when we free the SSL_CTX.

Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com>
---
 src/openvpn/ssl_openssl.c | 2 --
 1 file changed, 2 deletions(-)

Comments

Arne Schwabe Oct. 25, 2021, 4:07 a.m. UTC | #1 
Am 25.10.21 um 16:53 schrieb Max Fillinger:
> When the EVP_PKEY object with the Diffie-Hellman parameters is passed
> to SSL_CTX_set0_tmp_dh_pkey, it does not create a copy but stores the
> pointer in the SSL_CTX. Therefore, we should not free it.
> 
> The EVP_PKEY will be freed automatically when we free the SSL_CTX.
> 

Yes. The set0 indicates that it does a direct reference.

Acked-By: Arne Schwabe <arne@rfc2549.org>
Gert Doering Oct. 25, 2021, 4:59 a.m. UTC | #2 
Great find.  

I had this trac ticket (1436) about weird hanging/looping on signal exit, 
inside openssl cleanup, and your patch fixes this :-)

Your patch has been applied to the master branch.

commit 4daed27f28f6bb3033e659328fe80322a8f4b5e1
Author: Max Fillinger
Date:   Mon Oct 25 16:53:14 2021 +0200

     Don't manually free DH params in OpenSSL 3

     Signed-off-by: Max Fillinger <maximilian.fillinger@foxcrypto.com>
     Message-Id: <20211025145314.23009-1-maximilian.fillinger@foxcrypto.com>
     URL: https://www.mail-archive.com/search?l=mid&q=20211025145314.23009-1-maximilian.fillinger@foxcrypto.com
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
index 2414fc5e..6f2d6d57 100644
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -685,8 +685,6 @@  tls_ctx_load_dh_params(struct tls_root_ctx *ctx, const char *dh_file,
 
     msg(D_TLS_DEBUG_LOW, "Diffie-Hellman initialized with %d bit key",
         8 * EVP_PKEY_get_size(dh));
-
-    EVP_PKEY_free(dh);
 #else
     DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
     BIO_free(bio);