Merge branch 'master' into 2.6.52

Applying commits for 2.6.51.3 release.

CHANGES

@@ -4,6 +4,15 @@ of version numbers, so you will find 2.5.x and 2.6.x releases intersperced.
 
 See also docs/KNOWN_BUGS.txt and https://github.com/xelerance/Openswan/issues
 
+v2.6.51.3 (March 12, 2019)
+
+Fix memory leak bug.
+
+* wo#8179 . defer freeing states until all references are clearly gone,
+  clear them out in the main loop [MCR]
+* attempt to free the state [MCR]
+* added leak detective reporter [MCR]
+
 v2.6.51.2 (December 17, 2018)
 
 Additional commits for libnss.

Makefile.inc

@@ -442,6 +442,7 @@ USE_TAPROOM?=false
 # Whether to use LEAK_DETECTIVE to find memory leaks.
 # disabled for now as it causes some pfree()s due to bad code
 USE_LEAK_DETECTIVE?=false
+USE_ONGOING_LEAK_DETECTIVE?=false
 
 # Use dmalloc. Requires USE_LEAK_DETECTIVE
 USE_DMALLOC?=false

Makefile.ver

@@ -1 +1 @@
-IPSECBASEVERSION=2.6.51.2
+IPSECBASEVERSION=2.6.51.3

debian/changelog

@@ -1,5 +1,5 @@
-openswan (1:2.6.51.2-1) UNRELEASED; urgency=low
+openswan (1:2.6.51.3-1) UNRELEASED; urgency=low
 
   * Re-upload to unstable.
 
- -- Samir Hussain <shussain@xelerance.com>  Monday, 17 Dec 2018 11:34:16 -0400
+ -- Samir Hussain <shussain@xelerance.com>  Tuesday, 12 Mar 2019 11:34:16 -0400

packaging/centos5/openswan.spec

@@ -1,6 +1,6 @@
 Summary: Openswan IPsec implementation
 Name: openswan
-Version: 2.6.51.2
+Version: 2.6.51.3
 %{!?buildklips: %{expand: %%define buildklips 0}}
 %{!?buildxen: %{expand: %%define buildxen 0}}
 

packaging/fedora/openswan.spec

@@ -1,6 +1,6 @@
 Summary: Openswan IPsec implementation
 Name: openswan
-Version: 2.6.51.2
+Version: 2.6.51.3
 # Build KLIPS kernel module?
 %{!?buildklips: %{expand: %%define buildklips 0}}
 %{!?buildxen: %{expand: %%define buildxen 0}}

packaging/rhel7/openswan.spec

@@ -1,6 +1,6 @@
 Summary: Openswan IPsec implementation
 Name: openswanX
-Version: 2.6.51.2
+Version: 2.6.51.3
 
 # Openswan -pre/-rc nomenclature has to co-exist with hyphen paranoia
 %define srcpkgver %(echo %{version} | tr -s '_' '-')

packaging/suse/openswan.spec

@@ -5,7 +5,7 @@
 
 Summary: Openswan IPSEC implementation
 Name: openswan
-Version: 2.6.51.2
+Version: 2.6.51.3
 # Build KLIPS kernel module?
 %{!?buildklips: %{expand: %%define buildklips 0}}
 

programs/pluto/Makefile

@@ -248,6 +248,9 @@ mostlyclean: clean
 
 realclean: clean
 
+options:
+	echo ${USERCOMPILE} ${PORTINCLUDE} ${COPTS} ${ALLFLAGS}
+
 check:
 	echo no checks in lib right now.
 

programs/pluto/Makefile.options

@@ -253,6 +253,10 @@ endif
 
 ifeq ($(USE_LEAK_DETECTIVE),true)
 LEAK_CONF=-DLEAK_DETECTIVE
+
+ifeq ($(USE_ONGOING_LEAK_DETECTIVE),true)
+LEAK_CONF+=-DONGOING_LEAK_DETECTIVE
+endif
 endif
 
 ifeq ($(USE_TAPROOM),true)

programs/pluto/log.c

@@ -855,6 +855,11 @@ show_status(void)
     whack_log(RC_COMMENT, BLANK_FORMAT);	/* spacer */
     show_shunt_status();
 #endif
+
+#if defined(ONGOING_LEAK_DETECTIVE) && defined(LEAK_DETECTIVE)
+    report_leaks();
+#endif
+
 }
 
 /*

programs/pluto/server.c

@@ -590,6 +590,9 @@ call_server(void)
 	    long next_time = next_event();   /* time to any pending timer event */
 	    int maxfd = ctl_fd;
 
+            /* free up any states not yet freed */
+            do_state_frees();
+
 	    if (sigtermflag)
 		exit_pluto(0);
 

programs/pluto/state.c

@@ -308,6 +308,27 @@ rehash_state(struct state *st)
     insert_state(st);
 }
 
+struct state *st_state_to_be_freed = NULL;
+/*
+ * place a state onto a chain of states to delete in the main loop.
+ */
+static void
+mark_state_freed(struct state *st)
+{
+    st->st_hashchain_next = st_state_to_be_freed;
+    st_state_to_be_freed = st;
+}
+
+void
+do_state_frees(void)
+{
+    while(st_state_to_be_freed != NULL) {
+        struct state *tbf = st_state_to_be_freed;
+        st_state_to_be_freed = st_state_to_be_freed->st_hashchain_next;
+        free_state(tbf);
+    }
+}
+
 /* unlink a state object from the hash table, but don't free it
  */
 void
@@ -565,10 +586,11 @@ delete_state(struct state *st)
     connection_discard(c);
 
     change_state(st, STATE_UNDEFINED);
-
     release_whack(st);
 
-    change_state(st, STATE_CHILDSA_DEL);
+    /* object is not deleted here, because it still exists in many stack
+     * frames, but instead is added to a to-be-freed list */
+    mark_state_freed(st);
 }
 
 /*

programs/pluto/state.h

@@ -448,6 +448,7 @@ extern void state_eroute_usage(ip_subnet *ours, ip_subnet *his
     , unsigned long count, time_t nw);
 extern void free_state(struct state *st);
 extern void delete_state(struct state *st);
+extern void do_state_frees(void);
 struct connection;	/* forward declaration of tag */
 extern void delete_states_by_connection(struct connection *c, bool relations);
 extern void delete_p2states_by_connection(struct connection *c);

tests/unit/libpluto/lp02-parentI1/output.txt

@@ -477,10 +477,46 @@ sending 892 bytes for ikev2_parent_outI1_common through eth0:500 [192.168.1.1:50
 | ICOOKIE:  80 01 02 03  04 05 06 07
 | RCOOKIE:  00 00 00 00  00 00 00 00
 | state hash entry 4
-| freeing state object #1
 ./parentI1 deleting connection
 | pass 0: considering CHILD SAs to delete
 | pass 1: considering PARENT SAs to delete
+./parentI1 leak: saved first packet, item size: X
+./parentI1 leak: reply packet for ikev2_parent_outI1_tail, item size: X
+./parentI1 leak: sa in main_outI1, item size: X
+./parentI1 leak: db_attrs, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_v2_prop, item size: X
+./parentI1 leak: db_attrs, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_attrs, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_attrs, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_attrs, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: db_attrs, item size: X
+./parentI1 leak: db_v2_trans, item size: X
+./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: initiator nonce, item size: X
+./parentI1 leak: long term secret, item size: X
+./parentI1 leak: saved gi value, item size: X
 ./parentI1 leak: msg_digest, item size: X
 ./parentI1 leak: ikev2_outI1 KE, item size: X
 ./parentI1 leak: db_attrs, item size: X
@@ -514,6 +550,12 @@ sending 892 bytes for ikev2_parent_outI1_common through eth0:500 [192.168.1.1:50
 ./parentI1 leak: db_attrs, item size: X
 ./parentI1 leak: db_v2_trans, item size: X
 ./parentI1 leak: db_v2_prop_conj, item size: X
+./parentI1 leak: 12 * sa copy attrs array, item size: X
+./parentI1 leak: sa copy trans array, item size: X
+./parentI1 leak: sa copy prop array, item size: X
+./parentI1 leak: sa copy prop conj array, item size: X
+./parentI1 leak: sa copy prop_conj, item size: X
+./parentI1 leak: struct state in new_state(), item size: X
 ./parentI1 leak: policies path, item size: X
 ./parentI1 leak: ocspcerts path, item size: X
 ./parentI1 leak: aacerts path, item size: X

tests/unit/libpluto/lp02-parentI1/parentI1_main.c

@@ -65,7 +65,6 @@ int main(int argc, char *argv[])
     st = state_with_serialno(1);
     if(st!=NULL) {
         delete_state(st);
-        free_state(st);
     }
 #endif
 

tests/unit/libpluto/lp06-parentR1notchosen/output.txt

@@ -206,6 +206,43 @@ sending 36 bytes for send_v2_notification through eth0:500 [192.168.1.1:500] to
 | state transition function for no-state failed: AUTHENTICATION_FAILED
 ./parentI1R1 deleting state #1 (STATE_PARENT_I1)
 ./parentI1R1 leak: notification packet, item size: X
+./parentI1R1 leak: saved first packet, item size: X
+./parentI1R1 leak: reply packet for ikev2_parent_outI1_tail, item size: X
+./parentI1R1 leak: sa in main_outI1, item size: X
+./parentI1R1 leak: db_attrs, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_v2_prop, item size: X
+./parentI1R1 leak: db_attrs, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_attrs, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_attrs, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_attrs, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: db_attrs, item size: X
+./parentI1R1 leak: db_v2_trans, item size: X
+./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: initiator nonce, item size: X
+./parentI1R1 leak: long term secret, item size: X
+./parentI1R1 leak: saved gi value, item size: X
 ./parentI1R1 leak: msg_digest, item size: X
 ./parentI1R1 leak: ikev2_outI1 KE, item size: X
 ./parentI1R1 leak: db_attrs, item size: X
@@ -239,6 +276,12 @@ sending 36 bytes for send_v2_notification through eth0:500 [192.168.1.1:500] to
 ./parentI1R1 leak: db_attrs, item size: X
 ./parentI1R1 leak: db_v2_trans, item size: X
 ./parentI1R1 leak: db_v2_prop_conj, item size: X
+./parentI1R1 leak: 12 * sa copy attrs array, item size: X
+./parentI1R1 leak: sa copy trans array, item size: X
+./parentI1R1 leak: sa copy prop array, item size: X
+./parentI1R1 leak: sa copy prop conj array, item size: X
+./parentI1R1 leak: sa copy prop_conj, item size: X
+./parentI1R1 leak: struct state in new_state(), item size: X
 ./parentI1R1 leak: 2 * keep id name, item size: X
 ./parentI1R1 leak: ID host_pair, item size: X
 ./parentI1R1 leak: host_pair, item size: X

tests/unit/libpluto/lp06-parentR1notchosen/parentI1R1.c

@@ -128,7 +128,6 @@ int main(int argc, char *argv[])
     st = state_with_serialno(1);
     if(st!=NULL) {
         delete_state(st);
-        free_state(st);
     }
 
     report_leaks();

tests/unit/libpluto/lp08-parentR1/output1.txt

@@ -230,7 +230,7 @@ sending 40 bytes for send_v2_notification through eth0:500 [132.213.238.7:500] t
 | RCOOKIE:  de bc 58 3a  8f 40 d0 cf
 | state hash entry 28
 | #1 complete v2 state transition with STF_FAIL+25
-./parentR1 STATE_CHILDSA_DEL: INVALID_KEY_INFORMATION
+./parentR1 STATE_UNDEFINED: INVALID_KEY_INFORMATION
 ./parentR1 sending notification ISAKMP_v2_SA_INIT/v2N_INVALID_KE_PAYLOAD to 192.168.1.1:500
 | **emit ISAKMP Message:
 |    initiator cookie:
@@ -254,7 +254,7 @@ sending 36 bytes for send_v2_notification through eth0:500 [132.213.238.7:500] t
 |   00 01 02 03  04 05 06 07  de bc 58 3a  8f 40 d0 cf
 |   29 20 22 20  00 00 00 00  00 00 00 24  00 00 00 08
 |   01 00 00 11
-| state transition function for STATE_CHILDSA_DEL failed: INVALID_KEY_INFORMATION
+| state transition function for STATE_UNDEFINED failed: INVALID_KEY_INFORMATION
 ./parentR1 deleting connection
 | pass 0: considering CHILD SAs to delete
 | pass 1: considering PARENT SAs to delete

tests/unit/libpluto/lp08-parentR1/output2.txt

@@ -336,11 +336,55 @@ sending 432 bytes for STATE_IKEv2_START through eth0:500 [132.213.238.7:500] to
 | ICOOKIE:  80 01 02 03  04 05 06 07
 | RCOOKIE:  de bc 58 3a  8f 40 d0 cf
 | state hash entry 28
-| freeing state object #1
 ./parentR1 deleting connection
 | pass 0: considering CHILD SAs to delete
 | pass 1: considering PARENT SAs to delete
+./parentR1 leak: reply packet, item size: X
+./parentR1 leak: saved first packet, item size: X
+./parentR1 leak: initiator nonce, item size: X
+./parentR1 leak: long term secret, item size: X
+./parentR1 leak: saved gi value, item size: X
+./parentR1 leak: nonce, item size: X
+./parentR1 leak: Gi, item size: X
+./parentR1 leak: db_attrs, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_v2_prop, item size: X
+./parentR1 leak: db_attrs, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_attrs, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_attrs, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_attrs, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: db_attrs, item size: X
+./parentR1 leak: db_v2_trans, item size: X
+./parentR1 leak: db_v2_prop_conj, item size: X
+./parentR1 leak: 12 * sa copy attrs array, item size: X
+./parentR1 leak: sa copy trans array, item size: X
+./parentR1 leak: sa copy prop array, item size: X
+./parentR1 leak: sa copy prop conj array, item size: X
+./parentR1 leak: sa copy prop_conj, item size: X
+./parentR1 leak: saved first received packet, item size: X
 ./parentR1 leak: ikev2_inI1outR1 KE, item size: X
+./parentR1 leak: struct state in new_state(), item size: X
 ./parentR1 leak: msg_digest, item size: X
 ./parentR1 leak: policies path, item size: X
 ./parentR1 leak: ocspcerts path, item size: X