denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-server: Fix memory leaks when processing certificates or Finished messages

Browse Source 
Fixes: 7fbe2e27ec ("tls-server: TLS 1.3 support for TLS server implementation")
Fixes: d2fc9b0961 ("tls-server: Mutual authentication support for TLS 1.3")
Fixes: 760f3b730f ("tls-server: Add flag that makes client authentication optional")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:35 +02:00
parent b031cd27a8
commit be0ee2e806
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_server.c
+11 -8
View File
@@ -721,6 +721,7 @@ static status_t process_certificate(private_tls_server_t *this,
this->alert->add(this->alert, TLS_FATAL, this->alert->add(this->alert, TLS_FATAL,
this->tls->get_version_max(this->tls) > TLS_1_2 ? this->tls->get_version_max(this->tls) > TLS_1_2 ?
TLS_CERTIFICATE_REQUIRED : TLS_HANDSHAKE_FAILURE); TLS_CERTIFICATE_REQUIRED : TLS_HANDSHAKE_FAILURE);
certs->destroy(certs);
return NEED_MORE; return NEED_MORE;
} }
} }
@@ -769,6 +770,7 @@ static status_t process_certificate(private_tls_server_t *this,
{ {
DBG1(DBG_TLS, "failed to read extensions of CertificateEntry"); DBG1(DBG_TLS, "failed to read extensions of CertificateEntry");
this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR); this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
certs->destroy(certs);
return NEED_MORE; return NEED_MORE;
} }
} }
@@ -958,7 +960,7 @@ static status_t process_cert_verify(private_tls_server_t *this,
static status_t process_finished(private_tls_server_t *this, static status_t process_finished(private_tls_server_t *this,
bio_reader_t *reader) bio_reader_t *reader)
{ {
chunk_t received, verify_data; chunk_t received, verify_data = chunk_empty;
u_char buf[12]; u_char buf[12];
if (this->tls->get_version_max(this->tls) < TLS_1_3) if (this->tls->get_version_max(this->tls) < TLS_1_3)
@@ -985,7 +987,7 @@ static status_t process_finished(private_tls_server_t *this,
{ {
DBG1(DBG_TLS, "calculating client finished failed"); DBG1(DBG_TLS, "calculating client finished failed");
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR); this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE; goto out;
} }
this->crypto->change_cipher(this->crypto, TRUE); this->crypto->change_cipher(this->crypto, TRUE);
} }
@@ -994,16 +996,17 @@ static status_t process_finished(private_tls_server_t *this,
{ {
DBG1(DBG_TLS, "received client finished invalid"); DBG1(DBG_TLS, "received client finished invalid");
this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR); this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
return NEED_MORE; goto out;
}
if (verify_data.ptr != buf)
{
chunk_free(&verify_data);
} }
this->crypto->append_handshake(this->crypto, TLS_FINISHED, received); this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
this->state = STATE_FINISHED_RECEIVED; this->state = STATE_FINISHED_RECEIVED;
out:
if (verify_data.ptr && verify_data.ptr != buf)
{
chunk_free(&verify_data);
}
return NEED_MORE; return NEED_MORE;
} }