really fix race condition

PR: 262

diff --git a/CHANGES b/CHANGES
index dfa7be1bd22d4fa4644fae6927902c7928355f25..cf9d6cdab9fc7960c07af00515d424d921956117 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -8,8 +8,12 @@
      (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
      [Bodo Moeller]
 
-  *) Fix race condition in SSLv3_client_method().
-     [Bodo Moeller]
+  *) Fix initialization code race conditions in
+        SSLv23_client_method(),   SSLv23_server_method(),
+        SSLv2_client_method(),    SSLv2_server_method(),
+        SSLv3_client_method(),    SSLv3_server_method(),
+        TLSv1_client_method(),    TLSv1_server_method().
+     [Patrick McCormick <patrick@tellme.com>, Bodo Moeller]
 
   *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
      the cached sessions are flushed, as the remove_cb() might use ex_data

diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
index 8fd2d4d26b82a73eab02843913f659585bdceb61..4580d04c2cc9aa1d6c61bd03fdff7ea316a1645f 100644 (file)
--- a/crypto/cryptlib.c
+++ b/crypto/cryptlib.c
@@ -89,6 +89,7 @@ static const char* lock_names[CRYPTO_NUM_LOCKS] =
        "ssl_session",
        "ssl_sess_cert",
        "ssl",
+       /* "ssl_method", */
        "rand",
        "rand2",
        "debug_malloc",

diff --git a/crypto/crypto.h b/crypto/crypto.h
index 8fba87131cb50aed65dbfdfb7bab8191d4295cf8..5fb7f7a766a8b26d46204cd5569f8b44009adb4a 100644 (file)
--- a/crypto/crypto.h
+++ b/crypto/crypto.h
@@ -95,35 +95,38 @@ extern "C" {
  * names in cryptlib.c
  */
 
-#define        CRYPTO_LOCK_ERR                 1
-#define        CRYPTO_LOCK_ERR_HASH            2
-#define        CRYPTO_LOCK_X509                3
-#define        CRYPTO_LOCK_X509_INFO           4
-#define        CRYPTO_LOCK_X509_PKEY           5
+#define CRYPTO_LOCK_ERR                        1
+#define CRYPTO_LOCK_ERR_HASH           2
+#define CRYPTO_LOCK_X509               3
+#define CRYPTO_LOCK_X509_INFO          4
+#define CRYPTO_LOCK_X509_PKEY          5
 #define CRYPTO_LOCK_X509_CRL           6
 #define CRYPTO_LOCK_X509_REQ           7
 #define CRYPTO_LOCK_DSA                        8
 #define CRYPTO_LOCK_RSA                        9
 #define CRYPTO_LOCK_EVP_PKEY           10
-#define        CRYPTO_LOCK_X509_STORE          11
-#define        CRYPTO_LOCK_SSL_CTX             12
-#define        CRYPTO_LOCK_SSL_CERT            13
-#define        CRYPTO_LOCK_SSL_SESSION         14
-#define        CRYPTO_LOCK_SSL_SESS_CERT       15
-#define        CRYPTO_LOCK_SSL                 16
-#define        CRYPTO_LOCK_RAND                17
-#define        CRYPTO_LOCK_RAND2               18
-#define        CRYPTO_LOCK_MALLOC              19
-#define        CRYPTO_LOCK_BIO                 20
-#define        CRYPTO_LOCK_GETHOSTBYNAME       21
-#define        CRYPTO_LOCK_GETSERVBYNAME       22
-#define        CRYPTO_LOCK_READDIR             23
-#define        CRYPTO_LOCK_RSA_BLINDING        24
-#define        CRYPTO_LOCK_DH                  25
-#define        CRYPTO_LOCK_MALLOC2             26
-#define        CRYPTO_LOCK_DSO                 27
-#define        CRYPTO_LOCK_DYNLOCK             28
-#define        CRYPTO_NUM_LOCKS                29
+#define CRYPTO_LOCK_X509_STORE         11
+#define CRYPTO_LOCK_SSL_CTX            12
+#define CRYPTO_LOCK_SSL_CERT           13
+#define CRYPTO_LOCK_SSL_SESSION                14
+#define CRYPTO_LOCK_SSL_SESS_CERT      15
+#define CRYPTO_LOCK_SSL                        16
+/* for binary compatibility between 0.9.6 minor versions,
+ * reuse an existing lock (later version use a new one): */
+# define CRYPTO_LOCK_SSL_SESSION       CRYPTO_LOCK_SSL_CERT
+#define CRYPTO_LOCK_RAND               17
+#define CRYPTO_LOCK_RAND2              18
+#define CRYPTO_LOCK_MALLOC             19
+#define CRYPTO_LOCK_BIO                        20
+#define CRYPTO_LOCK_GETHOSTBYNAME      21
+#define CRYPTO_LOCK_GETSERVBYNAME      22
+#define CRYPTO_LOCK_READDIR            23
+#define CRYPTO_LOCK_RSA_BLINDING       24
+#define CRYPTO_LOCK_DH                 25
+#define CRYPTO_LOCK_MALLOC2            26
+#define CRYPTO_LOCK_DSO                        27
+#define CRYPTO_LOCK_DYNLOCK            28
+#define CRYPTO_NUM_LOCKS               29
 
 #define CRYPTO_LOCK            1
 #define CRYPTO_UNLOCK          2
@@ -145,7 +148,7 @@ extern "C" {
 #endif
 #else
 #define CRYPTO_w_lock(a)
-#define        CRYPTO_w_unlock(a)
+#define CRYPTO_w_unlock(a)
 #define CRYPTO_r_lock(a)
 #define CRYPTO_r_unlock(a)
 #define CRYPTO_add(a,b,c)      ((*(a))+=(b))

diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c
index 2d0eb4a8fff32290e328e532f3a0dccc5363d67c..df9ed02ddd0a6dcc5997ec0302767741e3a99797 100644 (file)
--- a/ssl/s23_clnt.c
+++ b/ssl/s23_clnt.c
@@ -87,11 +87,15 @@ SSL_METHOD *SSLv23_client_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&SSLv23_client_data,
                        (char *)sslv23_base_method(),sizeof(SSL_METHOD));
                SSLv23_client_data.ssl_connect=ssl23_connect;
                SSLv23_client_data.get_ssl_method=ssl23_get_client_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&SSLv23_client_data);
        }

diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c
index b40bb01ab72a80723b1d13d4163497fe01c5c53d..94198750f9edbad9cb1d2010f6006e8fdb2a2f96 100644 (file)
--- a/ssl/s23_srvr.c
+++ b/ssl/s23_srvr.c
@@ -139,11 +139,15 @@ SSL_METHOD *SSLv23_server_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&SSLv23_server_data,
                        (char *)sslv23_base_method(),sizeof(SSL_METHOD));
                SSLv23_server_data.ssl_accept=ssl23_accept;
                SSLv23_server_data.get_ssl_method=ssl23_get_server_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&SSLv23_server_data);
        }

diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index 236b394db7eeb4ad3d6948bf5b2c89f4a68d5196..c59fa6e4292419e8d653763217f7205831356a5e 100644 (file)
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -145,11 +145,15 @@ SSL_METHOD *SSLv2_client_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&SSLv2_client_data,(char *)sslv2_base_method(),
                        sizeof(SSL_METHOD));
                SSLv2_client_data.ssl_connect=ssl2_connect;
                SSLv2_client_data.get_ssl_method=ssl2_get_client_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&SSLv2_client_data);
        }

diff --git a/ssl/s2_srvr.c b/ssl/s2_srvr.c
index 3ef41cc0fdc6979eb0ae408dd24d279c8d3b0454..48fff175d4e80c8bccdcd01f46fb32ee2a0d718f 100644 (file)
--- a/ssl/s2_srvr.c
+++ b/ssl/s2_srvr.c
@@ -145,11 +145,15 @@ SSL_METHOD *SSLv2_server_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&SSLv2_server_data,(char *)sslv2_base_method(),
                        sizeof(SSL_METHOD));
                SSLv2_server_data.ssl_accept=ssl2_accept;
                SSLv2_server_data.get_ssl_method=ssl2_get_server_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&SSLv2_server_data);
        }

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index b58321628b5060379eff9788809626b71a501420..a55acd19752bb6dff6ebc9bee13dcb09e118a2d2 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -146,11 +146,15 @@ SSL_METHOD *SSLv3_client_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(),
                        sizeof(SSL_METHOD));
                SSLv3_client_data.ssl_connect=ssl3_connect;
                SSLv3_client_data.get_ssl_method=ssl3_get_client_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&SSLv3_client_data);
        }

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index fe1e6890142b918909f20694fd0109723c28cc46..50913ae8e4aabef53a0dfe626914f778068bb23f 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -151,11 +151,15 @@ SSL_METHOD *SSLv3_server_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&SSLv3_server_data,(char *)sslv3_base_method(),
                        sizeof(SSL_METHOD));
                SSLv3_server_data.ssl_accept=ssl3_accept;
                SSLv3_server_data.get_ssl_method=ssl3_get_server_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&SSLv3_server_data);
        }

diff --git a/ssl/t1_clnt.c b/ssl/t1_clnt.c
index 9745630a008cf8e1a17e077846afd3650cac109e..df00a1215af79d53a21952d72ea4d5af208e116b 100644 (file)
--- a/ssl/t1_clnt.c
+++ b/ssl/t1_clnt.c
@@ -79,11 +79,15 @@ SSL_METHOD *TLSv1_client_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&TLSv1_client_data,(char *)tlsv1_base_method(),
                        sizeof(SSL_METHOD));
                TLSv1_client_data.ssl_connect=ssl3_connect;
                TLSv1_client_data.get_ssl_method=tls1_get_client_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&TLSv1_client_data);
        }

diff --git a/ssl/t1_srvr.c b/ssl/t1_srvr.c
index 996b7ca8e2ef54a6bc65288d94e9f9aa8e9810e0..e62275c6f8145ead72e3f713a604ca7d21916beb 100644 (file)
--- a/ssl/t1_srvr.c
+++ b/ssl/t1_srvr.c
@@ -80,11 +80,15 @@ SSL_METHOD *TLSv1_server_method(void)
 
        if (init)
                {
+               CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
+
                memcpy((char *)&TLSv1_server_data,(char *)tlsv1_base_method(),
                        sizeof(SSL_METHOD));
                TLSv1_server_data.ssl_accept=ssl3_accept;
                TLSv1_server_data.get_ssl_method=tls1_get_server_method;
                init=0;
+
+               CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
                }
        return(&TLSv1_server_data);
        }