Skip to content

Commit

Permalink
Manually cleanup OpenSSL from dovecot_openssl_common_global_unref()
Browse files Browse the repository at this point in the history
OpenSSL 1.1 features a cleanup function that is automatically run on shutdown
using atexit(3). This function frees all OpenSSL-allocated resources.

In dovecot, OpenSSL is loaded indirectly using dlopen(3) against the relevant
dovecot crypto module and is finally unloaded using dlclose(3). Until
OpenSSL 1.0.1c this worked fine, however OpenSSL 1.0.1c makes sure[1] that the
library stays loaded after the initial dlclose() so that the atexit(3)
handlers can run on shutdown. This, together with the fact that dovecot
uses custom allocation functions for OpenSSL and has already partially
free()'d some of OpenSSL's resources in module_free(), leads to a
segfault at process shutdown[2].

We fix this by explicitly calling OPENSSL_cleanup() during module unload. This
is safe to do, as long as we will never want to subsequently re-initialize
OpenSSL.

[1] openssl/openssl@4af9f7f
[2] https://buildd.debian.org/status/fetch.php?pkg=dovecot&arch=amd64&ver=1:2.2.26.0-2&stamp=1478873022

Signed-off-by: Apollon Oikonomopoulos <apoikos@debian.org>
  • Loading branch information
apoikos authored and sirainen committed Nov 15, 2016
1 parent b775f8b commit c164f8a
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions src/lib-ssl-iostream/dovecot-openssl-common.c
Expand Up @@ -101,6 +101,9 @@ bool dovecot_openssl_common_global_unref(void)
ERR_remove_thread_state(NULL);
#endif
ERR_free_strings();
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
OPENSSL_cleanup();
#endif
return FALSE;
}

Expand Down

0 comments on commit c164f8a

Please sign in to comment.