Skip to content

Commit

Permalink
tls_wolfssl: memory handling cleanup
Browse files Browse the repository at this point in the history 
Set memory allocators to align up to 16-bytes
  • Loading branch information
@space88man
space88man committed Jun 21, 2022
1 parent 1affa05 commit 20d0b22
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 140 deletions.
141 changes: 32 additions & 109 deletions src/modules/tls_wolfssl/tls_init.c
View file
Expand Up @@ -216,26 +216,49 @@ static void* ser_realloc(void *ptr, size_t size, const char* file, int line)

#else /*TLS_MALLOC_DBG */

// up align memory allocations to 16 bytes for
// wolfSSL --enable-aligndata=yes (the default)
static const int MAX_ALIGN = __alignof__(max_align_t);

static void* ser_malloc(size_t size, const char *fname, int fline)
static void* ser_malloc(size_t size)
{
return shm_malloc(size);
}
char* ptr = shm_malloc(size + 2*MAX_ALIGN);
int pad = MAX_ALIGN - ((long) ptr % MAX_ALIGN);

*(size_t*)ptr = size;

memset(ptr + MAX_ALIGN, pad, pad);
return ptr + MAX_ALIGN + pad;
}

static void* ser_realloc(void *ptr, size_t size, const char *fname, int fline)
static void* ser_realloc(void *ptr, size_t new_size)
{
return shm_realloc(ptr, size);
if(!ptr) return ser_malloc(new_size);

int pad = *((unsigned char*)ptr - 1);
unsigned char *real_ptr = (unsigned char*)ptr - pad - MAX_ALIGN;
int size = *(size_t*)real_ptr;

char *new_ptr = shm_realloc(real_ptr, new_size+2*MAX_ALIGN);
*(size_t*)new_ptr = new_size;
int new_pad = MAX_ALIGN - ((long) new_ptr % MAX_ALIGN);
if (new_pad != pad) {
memmove(new_ptr + MAX_ALIGN + new_pad, new_ptr + MAX_ALIGN + pad, size);
memset(new_ptr + MAX_ALIGN, new_pad, new_pad);
}

return new_ptr + MAX_ALIGN + new_pad;
}
#endif /* LIBRESSL_VERSION_NUMBER */

static void ser_free(void *ptr, const char *fname, int fline)
static void ser_free(void *ptr)
{
if (ptr) {
shm_free(ptr);
int pad = *((unsigned char *)ptr - 1);
shm_free((unsigned char*)ptr - pad - MAX_ALIGN);
}
}

#endif /* LIBRESSL_VERSION_NUMBER */

/*
* Initialize TLS socket
Expand Down Expand Up @@ -366,11 +389,7 @@ int tls_pre_init(void)
mf = NULL;
rf = NULL;
ff = NULL;
#ifdef TLS_MALLOC_DBG
if (!CRYPTO_set_mem_ex_functions(ser_malloc, ser_realloc, ser_free)) {
#else
if (!CRYPTO_set_mem_functions(ser_malloc, ser_realloc, ser_free)) {
#endif
if (wolfSSL_SetAllocators(ser_malloc, ser_free, ser_realloc)) {
LM_ERR("Unable to set the memory allocation functions\n");
// CRYPTO_get_mem_functions(&mf, &rf, &ff);
LM_ERR("libssl current mem functions - m: %p r: %p f: %p\n",
Expand Down Expand Up @@ -412,108 +431,12 @@ int tls_h_mod_pre_init_f(void)
*/
int tls_h_mod_init_f(void)
{
/*struct socket_info* si;*/
long ssl_version;
const char *ssl_version_txt;
int low_mem_threshold1;
int low_mem_threshold2;
str tls_grp;
str s;
cfg_ctx_t* cfg_ctx;

if(tls_mod_initialized == 1) {
LM_DBG("already initialized\n");
return 0;
}
LM_DBG("initializing tls system\n");

ssl_version=wolfSSL_OpenSSL_version_num();
ssl_version_txt=wolfSSL_OpenSSL_version(OPENSSL_VERSION);

/* check if version have the same major minor and fix level
* (e.g. 0.9.8a & 0.9.8c are ok, but 0.9.8 and 0.9.9x are not)
* - values is represented as 0xMMNNFFPPS: major minor fix patch status
* 0x00090705f == 0.9.7e release */
if ((ssl_version>>12)!=(OPENSSL_VERSION_NUMBER>>12)){
LM_CRIT("installed openssl library"
" version is too different from the library the " NAME " tls"
" module was compiled with: installed \"%s\" (0x%08lx),"
" compiled \"%s\" (0x%08lx).\n"
" Please make sure a compatible version is used"
" (tls_force_run in kamailio.cfg will override this check)\n",
ssl_version_txt, ssl_version,
OPENSSL_VERSION_TEXT, (long)OPENSSL_VERSION_NUMBER);
if (cfg_get(tls, tls_cfg, force_run))
LM_WARN("tls_force_run turned on, ignoring "
" openssl version mismatch\n");
else
return -1; /* safer to exit */
}

/* check kerberos support using compile flags only for version < 1.1.0 */

/* set free memory threshold for openssl bug #1491 workaround */
low_mem_threshold1 = cfg_get(tls, tls_cfg, low_mem_threshold1);
low_mem_threshold2 = cfg_get(tls, tls_cfg, low_mem_threshold2);
if (low_mem_threshold1<0){
/* default */
low_mem_threshold1=512*1024*get_max_procs();
}else
low_mem_threshold1*=1024; /* KB */
if (low_mem_threshold2<0){
/* default */
low_mem_threshold2=256*1024*get_max_procs();
}else
low_mem_threshold2*=1024; /* KB */

#if 0
if ((low_mem_threshold1==0) || (low_mem_threshold2==0))
LM_WARN("tls: openssl bug #1491 (crash/mem leaks on low memory)"
" workaround disabled\n");
else
LM_WARN("openssl bug #1491 (crash/mem leaks on low memory)"
" workaround enabled (on low memory tls operations will fail"
" preemptively) with free memory thresholds %d and %d bytes\n",
low_mem_threshold1, low_mem_threshold2);
#endif

if (shm_available()==(unsigned long)(-1)){
LM_WARN(NAME " is compiled without MALLOC_STATS support:"
" the workaround for low mem. openssl bugs will _not_ "
"work\n");
low_mem_threshold1=0;
low_mem_threshold2=0;
}
if ((low_mem_threshold1 != cfg_get(tls, tls_cfg, low_mem_threshold1))
|| (low_mem_threshold2
!= cfg_get(tls, tls_cfg, low_mem_threshold2))) {
/* ugly hack to set the initial values for the mem tresholds */
if (cfg_register_ctx(&cfg_ctx, 0)) {
LM_ERR("failed to register cfg context\n");
return -1;
}
tls_grp.s = "tls";
tls_grp.len = strlen(tls_grp.s);
s.s = "low_mem_threshold1";
s.len = strlen(s.s);
if (low_mem_threshold1 != cfg_get(tls, tls_cfg, low_mem_threshold1) &&
cfg_set_now_int(cfg_ctx, &tls_grp, NULL /* group id */, &s,
low_mem_threshold1)) {
LM_ERR("failed to set tls.low_mem_threshold1 to %d\n",
low_mem_threshold1);
return -1;
}
s.s = "low_mem_threshold2";
s.len = strlen(s.s);
if (low_mem_threshold2 != cfg_get(tls, tls_cfg, low_mem_threshold2) &&
cfg_set_now_int(cfg_ctx, &tls_grp, NULL /* group id */, &s,
low_mem_threshold2)) {
LM_ERR("failed to set tls.low_mem_threshold1 to %d\n",
low_mem_threshold2);
return -1;
}
}

init_ssl_methods();
tls_mod_initialized = 1;
return 0;
Expand Down
31 changes: 0 additions & 31 deletions src/modules/tls_wolfssl/tls_server.c
View file
Expand Up @@ -65,14 +65,6 @@

int tls_run_event_routes(struct tcp_connection *c);

/* low memory treshold for openssl bug #1491 workaround */
#define LOW_MEM_NEW_CONNECTION_TEST() \
(cfg_get(tls, tls_cfg, low_mem_threshold1) && \
(shm_available_safe() < cfg_get(tls, tls_cfg, low_mem_threshold1)))
#define LOW_MEM_CONNECTED_TEST() \
(cfg_get(tls, tls_cfg, low_mem_threshold2) && \
(shm_available_safe() < cfg_get(tls, tls_cfg, low_mem_threshold2)))

#define TLS_RD_MBUF_SZ 65536
#define TLS_WR_MBUF_SZ 65536

Expand Down Expand Up @@ -238,12 +230,6 @@ static int tls_complete_init(struct tcp_connection* c)
str *sname = NULL;
str *srvid = NULL;

if (LOW_MEM_NEW_CONNECTION_TEST()){
ERR("tls: ssl bug #1491 workaround: not enough memory for safe"
" operation: shm=%lu threshold1=%d\n", shm_available_safe(),
cfg_get(tls, tls_cfg, low_mem_threshold1));
goto error2;
}
/* Get current TLS configuration and increase reference
* count immediately.
*/
Expand Down Expand Up @@ -341,11 +327,6 @@ static int tls_fix_connection_unsafe(struct tcp_connection* c)
if (unlikely(tls_complete_init(c) < 0)) {
return -1;
}
}else if (unlikely(LOW_MEM_CONNECTED_TEST())){
ERR("tls: ssl bug #1491 workaround: not enough memory for safe"
" operation: shm=%lu threshold2=%d\n", shm_available_safe(),
cfg_get(tls, tls_cfg, low_mem_threshold2));
return -1;
}
return 0;
}
Expand All @@ -372,12 +353,6 @@ static int tls_fix_connection(struct tcp_connection* c)
}
lock_release(&c->write_lock);
}
if (unlikely(LOW_MEM_CONNECTED_TEST())){
ERR("tls: ssl bug #1491 workaround: not enough memory for safe"
" operation: shm=%lu threshold2=%d\n", shm_available_safe(),
cfg_get(tls, tls_cfg, low_mem_threshold2));
return -1;
}
return 0;
}

Expand Down Expand Up @@ -575,12 +550,6 @@ static int tls_shutdown(struct tcp_connection *c)
* if the connection is not fully initialized */
if (unlikely(tls_c->state != S_TLS_ESTABLISHED))
return 0;
if (unlikely(LOW_MEM_CONNECTED_TEST())){
ERR("tls: ssl bug #1491 workaround: not enough memory for safe"
" operation: shm=%lu threshold2=%d\n", shm_available_safe(),
cfg_get(tls, tls_cfg, low_mem_threshold2));
goto err;
}

ret = wolfSSL_shutdown(ssl);
if (ret == 1) {
Expand Down

0 comments on commit 20d0b22

Please sign in to comment.