This patch resolves two sources of memory leaks when using TLS in Asterisk:
1) It removes improper initialization (and multiple re-initializations) of
portions of the SSL library. Asterisk calls SSL_library_init and
SSL_load_error_strings during SSL initialization; collectively this
obviates the need for calling any of the following during initialization
or client connection handling:
* ERR_load_crypto_strings (handled by SSL_load_error_strings)
* OpenSSL_add_all_algorithms (synonym for SSL_library_init)
* SSLeay_add_ssl_algorithms (synonym for SSL_library_init)
2) Failure to completely clean up all memory allocated by Asterisk and by
the SSL library for TLS clients. This included not freeing the SSL_CTX
object in the SIP channel driver, as well as not clearing the error
stack when the TLS client exited.
Note that these memory leaks were found by Thomas Arimont, and this patch
was essentially written by him with some minor tweaks.
(closes issue AST-889)
Reported by: Thomas Arimont
Tested by: Thomas Arimont
patches:
(bugAST-889.patch) by Thomas Arimont (license 5525)
Review: https://reviewboard.asterisk.org/r/2105
........
Merged revisions 373061 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 373062 from http://svn.asterisk.org/svn/asterisk/branches/10
........
Merged revisions 373079 from http://svn.asterisk.org/svn/asterisk/branches/11
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@373080 65c4cc65-6c06-0410-ace0-fbb531ad65f3
When the OpenSSL duplicate initialization issues were resolved in r351447,
res_curl could fail to load if it checked SSL_library_init after SSL
initialization completed. This is due to the SSL_library_init stub returning
a value of 0 for success, as opposed to a value of 1. OpenSSL uses a value of
1 to indicate success - in fact, SSL_library_init is documented to always return
1. Interestingly, the CURL libraries actually checked the return value - the fact
that nothing else that depends on OpenSSL was having problems loading probably means
they don't check the return value.
(closes issue AST-924)
Reported by: Guenther Kelleter
patches:
(AST-924.patch license #6372 uploaded by Guenther Kelleter)
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@369870 65c4cc65-6c06-0410-ace0-fbb531ad65f3
........
r369001 | kpfleming | 2012-06-15 10:56:08 -0500 (Fri, 15 Jun 2012) | 11 lines
Add support-level indications to many more source files.
Since we now have tools that scan through the source tree looking for files
with specific support levels, we need to ensure that every file that is
a component of a 'core' or 'extended' module (or the main Asterisk binary)
is explicitly marked with its support level. This patch adds support-level
indications to many more source files in tree, but avoids adding them to
third-party libraries that are included in the tree and to source files
that don't end up involved in Asterisk itself.
........
r369002 | kpfleming | 2012-06-15 10:57:14 -0500 (Fri, 15 Jun 2012) | 3 lines
Add a script to enable finding source files without support-levels defined.
........
Merged revisions 369001-369002 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 369005 from http://svn.asterisk.org/svn/asterisk/branches/10
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@369013 65c4cc65-6c06-0410-ace0-fbb531ad65f3
When Asterisk is used with various third-party libraries (CURL, PostgresSQL,
many others) that have the ability themselves to use OpenSSL, it is possible
for conflicts to arise in how the OpenSSL libraries are initialized and
shutdown. This patch addresses these conflicts by 'wrapping' the important
functions from the OpenSSL libraries in a new shared library that is part
of Asterisk itself, and is loaded in such a way as to ensure that *all*
calls to these functions will be dispatched through the Asterisk wrapper
functions, not the native functions.
This new library is optional, but enabled by default. See the CHANGES file
for documentation on how to disable it.
Along the way, this patch also makes a few other minor changes:
* Changes MODULES_DIR to ASTMODDIR throughout the build system, in order to
more closely match what is used during run-time configuration.
* Corrects some errors in the configure script where AC_CHECK_TOOLS was used
instead of AC_PATH_PROG.
* Adds a new variable for linker flags in the build system (DYLINK), used for
producing true shared libraries (as opposed to the dynamically loadable
modules that the build system produces for 'regular' Asterisk modules).
* Moves the Makefile bits that handle installation and uninstallation of the
main Asterisk binary into main/Makefile from the top-level Makefile.
* Moves a couple of useful preprocessor macros from optional_api.h to
asterisk.h.
Review: https://reviewboard.asterisk.org/r/1006/
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@353317 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Matthew Jordan
Kevin P. Fleming