BUG/MINOR: ssl: free the fields in srv->ssl_ctx

A lot of free are missing in ssl_sock_free_srv_ctx(), this could result
in memory leaking when removing dynamically a server via the CLI.

This must be backported in every branches, by removing the fields that
does not exist in the previous branches.

(cherry picked from commit 231610ad9ccc2470930f7a728ba710a548677a65)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 8ccdbad9967b08b1f5afe89b461335b16436ecdb)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 9d11868086ab45690e561acb50ccd0ad569354b7)
[wt: changed ha_free(&x) to free(x);x=NULL]
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index cc69a2f..6b1fbaf 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4759,20 +4759,17 @@ int ssl_sock_prepare_bind_conf(struct bind_conf *bind_conf)
        return -err;
 }
 
-/* release ssl context allocated for servers. */
+/* release ssl context allocated for servers.  Most of the field free here
+ * must also be allocated in srv_ssl_settings_cpy() */
 void ssl_sock_free_srv_ctx(struct server *srv)
 {
 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
-       if (srv->ssl_ctx.alpn_str) {
-               free(srv->ssl_ctx.alpn_str);
-               srv->ssl_ctx.alpn_str = NULL;
-       }
+       free(srv->ssl_ctx.alpn_str);
+       srv->ssl_ctx.alpn_str = NULL;
 #endif
 #ifdef OPENSSL_NPN_NEGOTIATED
-       if (srv->ssl_ctx.npn_str) {
-               free(srv->ssl_ctx.npn_str);
-               srv->ssl_ctx.npn_str = NULL;
-       }
+       free(srv->ssl_ctx.npn_str);
+       srv->ssl_ctx.npn_str = NULL;
 #endif
        if (srv->ssl_ctx.reused_sess) {
                int i;
@@ -4791,6 +4788,25 @@ void ssl_sock_free_srv_ctx(struct server *srv)
                SSL_CTX_free(srv->ssl_ctx.ctx);
                srv->ssl_ctx.ctx = NULL;
        }
+
+       free(srv->ssl_ctx.ca_file);
+       srv->ssl_ctx.ca_file = NULL;
+       free(srv->ssl_ctx.crl_file);
+       srv->ssl_ctx.crl_file = NULL;
+       free(srv->ssl_ctx.client_crt);
+       srv->ssl_ctx.client_crt = NULL;
+       free(srv->ssl_ctx.verify_host);
+       srv->ssl_ctx.verify_host = NULL;
+#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
+       free(srv->sni_expr);
+       srv->sni_expr = NULL;
+#endif
+       free(srv->ssl_ctx.ciphers);
+       srv->ssl_ctx.ciphers = NULL;
+#ifdef HAVE_SSL_CTX_SET_CIPHERSUITES
+       free(srv->ssl_ctx.ciphersuites);
+       srv->ssl_ctx.ciphersuites = NULL;
+#endif
 }
 
 /* Walks down the two trees in bind_conf and frees all the certs. The pointer may