From 52b16f0fe44feb96b7f1cf30c4cf8bf78417b13e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Thu, 4 Feb 2021 14:37:31 +0100 Subject: [PATCH] added some filthy stuff --- configure.ac | 2 +- lib/dns/dst_api.c | 2 +- lib/dns/dst_internal.h | 2 +- lib/dns/openssl_link.c | 80 ++--------------------------- lib/isc/include/isc/mem.h | 7 ++- lib/isc/include/isc/netmgr.h | 6 +++ lib/isc/include/isc/tls.h | 2 +- lib/isc/lib.c | 76 ++++++---------------------- lib/isc/mem.c | 31 ++++++++---- lib/isc/netmgr/netmgr.c | 34 ++++++------- lib/isc/tls.c | 97 +++++++++++++++++++++++++++++++++--- lib/isc/win32/DLLMain.c | 21 ++++---- 12 files changed, 167 insertions(+), 193 deletions(-) diff --git a/configure.ac b/configure.ac index 2598b76c73..d71986968a 100644 --- a/configure.ac +++ b/configure.ac @@ -1600,7 +1600,7 @@ AS_CASE([$with_allocator], [jemalloc], [PKG_CHECK_MODULES([ALLOCATOR], [jemalloc], [AC_DEFINE([USE_ALLOCATOR_JEMALLOC], [1], [Define if you want to use jemalloc allocator])])], [tcmalloc*], [PKG_CHECK_MODULES([ALLOCATOR], [lib$with_allocator], - [AC_DEFINE([USE_ALLOCATOR_TCMALLOC], [1], [Define if you want to use tcmalloc allocator])])] + [AC_DEFINE([USE_ALLOCATOR_TCMALLOC], [1], [Define if you want to use tcmalloc allocator])])], [AC_DEFINE([USE_ALLOCATOR_CUSTOM], [1], [Define if you want to use custom BIND 9 allocator])]) AC_MSG_NOTICE([Using $with_allocator memory allocator]) diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c index a501d0be11..75674e5f5b 100644 --- a/lib/dns/dst_api.c +++ b/lib/dns/dst_api.c @@ -201,7 +201,7 @@ dst_lib_init(isc_mem_t *mctx, const char *engine) { RETERR(dst__hmacsha256_init(&dst_t_func[DST_ALG_HMACSHA256])); RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384])); RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512])); - RETERR(dst__openssl_init(mctx, engine)); + RETERR(dst__openssl_init(engine)); RETERR(dst__openssldh_init(&dst_t_func[DST_ALG_DH])); #if USE_OPENSSL RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSASHA1], diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h index 43ab84ab15..8e06e99c27 100644 --- a/lib/dns/dst_internal.h +++ b/lib/dns/dst_internal.h @@ -201,7 +201,7 @@ struct dst_func { * Initializers */ isc_result_t -dst__openssl_init(isc_mem_t *, const char *engine); +dst__openssl_init(const char *engine); #define dst__pkcs11_init pk11_initialize isc_result_t diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c index ff4760b917..caa7ebcc23 100644 --- a/lib/dns/openssl_link.c +++ b/lib/dns/openssl_link.c @@ -39,8 +39,6 @@ #include "dst_internal.h" #include "dst_openssl.h" -static isc_mem_t *dst__mctx = NULL; - #if !defined(OPENSSL_NO_ENGINE) #include #endif /* if !defined(OPENSSL_NO_ENGINE) */ @@ -49,54 +47,13 @@ static isc_mem_t *dst__mctx = NULL; static ENGINE *e = NULL; #endif /* if !defined(OPENSSL_NO_ENGINE) */ -static void -enable_fips_mode(void) { -#ifdef HAVE_FIPS_MODE - if (FIPS_mode() != 0) { - /* - * FIPS mode is already enabled. - */ - return; - } - - if (FIPS_mode_set(1) == 0) { - dst__openssl_toresult2("FIPS_mode_set", DST_R_OPENSSLFAILURE); - exit(1); - } -#endif /* HAVE_FIPS_MODE */ -} - isc_result_t -dst__openssl_init(isc_mem_t *mctx, const char *engine) { +dst__openssl_init(const char *engine) { isc_result_t result; - REQUIRE(dst__mctx == NULL); - isc_mem_attach(mctx, &dst__mctx); - #if defined(OPENSSL_NO_ENGINE) UNUSED(engine); -#endif /* if defined(OPENSSL_NO_ENGINE) */ - - enable_fips_mode(); - - isc_tls_initialize(); - -#if !defined(OPENSSL_NO_ENGINE) -#if !defined(CONF_MFLAGS_DEFAULT_SECTION) - OPENSSL_config(NULL); -#else /* if !defined(CONF_MFLAGS_DEFAULT_SECTION) */ - /* - * OPENSSL_config() can only be called a single time as of - * 1.0.2e so do the steps individually. - */ - OPENSSL_load_builtin_modules(); - ENGINE_load_builtin_engines(); - ERR_clear_error(); - CONF_modules_load_file(NULL, NULL, - CONF_MFLAGS_DEFAULT_SECTION | - CONF_MFLAGS_IGNORE_MISSING_FILE); -#endif /* if !defined(CONF_MFLAGS_DEFAULT_SECTION) */ - +#else /* if defined(OPENSSL_NO_ENGINE) */ if (engine != NULL && *engine == '\0') { engine = NULL; } @@ -116,14 +73,6 @@ dst__openssl_init(isc_mem_t *mctx, const char *engine) { #endif /* !defined(OPENSSL_NO_ENGINE) */ - /* Protect ourselves against unseeded PRNG */ - if (RAND_status() != 1) { - FATAL_ERROR(__FILE__, __LINE__, - "OpenSSL pseudorandom number generator " - "cannot be initialized (see the `PRNG not " - "seeded' message in the OpenSSL FAQ)"); - } - return (ISC_R_SUCCESS); #if !defined(OPENSSL_NO_ENGINE) @@ -138,30 +87,7 @@ cleanup_rm: void dst__openssl_destroy(void) { -#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER) - /* - * Sequence taken from apps_shutdown() in . - */ - CONF_modules_free(); - OBJ_cleanup(); - EVP_cleanup(); -#if !defined(OPENSSL_NO_ENGINE) - if (e != NULL) { - ENGINE_free(e); - } - e = NULL; - ENGINE_cleanup(); -#endif /* if !defined(OPENSSL_NO_ENGINE) */ - CRYPTO_cleanup_all_ex_data(); - ERR_clear_error(); - -#ifdef DNS_CRYPTO_LEAKS - CRYPTO_mem_leaks_fp(stderr); -#endif /* ifdef DNS_CRYPTO_LEAKS */ - -#endif - isc_tls_destroy(); - isc_mem_detach(&dst__mctx); + /* Empty */ } static isc_result_t diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h index d1319bae45..ce95ec56e7 100644 --- a/lib/isc/include/isc/mem.h +++ b/lib/isc/include/isc/mem.h @@ -589,11 +589,16 @@ isc__free(void *ptr _ISC_MEM_FLARG); char * isc__strdup(const char *str _ISC_MEM_FLARG); char * -isc__strndup(const char *str _ISC_MEM_FLARG); +isc__strndup(const char *str, size_t size _ISC_MEM_FLARG); isc_mem_t * isc_get_default_mctx(void); +void +isc_mem_initialize(void); +void +isc_mem_shutdown(void); + ISC_LANG_ENDDECLS #endif /* ISC_MEM_H */ diff --git a/lib/isc/include/isc/netmgr.h b/lib/isc/include/isc/netmgr.h index cb505f9237..1250b37a2b 100644 --- a/lib/isc/include/isc/netmgr.h +++ b/lib/isc/include/isc/netmgr.h @@ -548,3 +548,9 @@ isc_result_t isc_nm_http_add_doh_endpoint(isc_nmsocket_t *sock, const char *uri, isc_nm_recv_cb_t cb, void *cbarg, size_t extrahandlesize); + +void +isc_nm_initialize(void); + +void +isc_nm_shutdown(void); diff --git a/lib/isc/include/isc/tls.h b/lib/isc/include/isc/tls.h index d0318262e5..b99590be4b 100644 --- a/lib/isc/include/isc/tls.h +++ b/lib/isc/include/isc/tls.h @@ -23,7 +23,7 @@ void isc_tls_initialize(void); void -isc_tls_destroy(void); +isc_tls_shutdown(void); void isc_tlsctx_free(isc_tlsctx_t **ctpx); diff --git a/lib/isc/lib.c b/lib/isc/lib.c index 6bb93d488e..ce07d631cb 100644 --- a/lib/isc/lib.c +++ b/lib/isc/lib.c @@ -16,6 +16,8 @@ #include #include #include +#include +#include #include /*** @@ -27,71 +29,21 @@ isc_lib_register(void) { isc_bind9 = false; } -LIBISC_EXTERNAL_DATA extern isc_mem_t *isc__mem_mctx; +void +isc__initialize(void) ISC_CONSTRUCTOR(101); +void +isc__shutdown(void) ISC_DESTRUCTOR(101); void -isc__mem_initialize(void) ISC_CONSTRUCTOR(101); -void -isc__mem_shutdown(void) ISC_DESTRUCTOR(101); - -void -isc__mem_initialize(void) { - REQUIRE(isc__mem_mctx == NULL); - isc_mem_create(&isc__mem_mctx); - isc_mem_setname(isc__mem_mctx, "default"); +isc__initialize(void) { + isc_mem_initialize(); /* Priority 102 */ + isc_tls_initialize(); /* Priority 103 */ + isc_nm_initialize(); /* Priority 104 */ } void -isc__mem_shutdown(void) { - REQUIRE(isc__mem_mctx != NULL); - isc_mem_destroy(&isc__mem_mctx); - /* FIXME: All code using raw 'exit(1);' has to be fixed first */ - /* isc_mem_checkdestroyed(stderr); */ +isc__shutdown(void) { + isc_nm_shutdown(); /* Priority 104 */ + isc_tls_shutdown(); /* Priority 103 */ + isc_mem_shutdown(); /* Priority 102 */ } - -void -isc__nm_initialize(void) ISC_CONSTRUCTOR(102); -void -isc__nm_shutdown(void) ISC_DESTRUCTOR(102); - -#if UV_VERSION_MAJOR > 1 || (UV_VERSION_MAJOR == 1 && UV_VERSION_MINOR >= 38) - -static void * -_malloc(size_t size) { - return (isc_malloc(size)); -} - -static void * -_calloc(size_t num, size_t size) { - return (isc_calloc(num, size)); -} - -static void * -_realloc(void *ptr, size_t size) { - return (isc_realloc(ptr, size)); -} - -static void -_free(void *ptr) { - return (isc_free(ptr)); -} - -void -isc__nm_initialize(void) { - uv_replace_allocator(_malloc, _realloc, _calloc, _free); -} - -void -isc__nm_shutdown(void) { - uv_library_shutdown(); -} - -#else - -void -isc__nm_initialize(void) {} - -void -isc__nm_shutdown(void) {} - -#endif diff --git a/lib/isc/mem.c b/lib/isc/mem.c index 308fc8d623..eda01fa733 100644 --- a/lib/isc/mem.c +++ b/lib/isc/mem.c @@ -947,9 +947,6 @@ isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size FLARG) { *ctxp = NULL; #if USE_ALLOCATOR_CUSTOM - isc_mem_t *ctx = *ctxp; - *ctxp = NULL; - if (ISC_UNLIKELY((isc_mem_debugging & (ISC_MEM_DEBUGSIZE | ISC_MEM_DEBUGCTX)) != 0)) { @@ -1029,7 +1026,6 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) { void *ptr = NULL; #if USE_ALLOCATOR_CUSTOM - isc__mem_t *ctx = (isc__mem_t *)ctx0; bool call_water = false; if (ISC_UNLIKELY((isc_mem_debugging & @@ -1098,6 +1094,8 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) { UNUSED(file); UNUSED(line); ptr = default_memalloc(size); +#else + #error Unknown allocator #endif return (ptr); } @@ -1620,11 +1618,10 @@ isc__mem_strdup(isc_mem_t *mctx, const char *s FLARG) { } char * -isc__mem_strndup(isc_mem_t *mctx0, const char *s, size_t size FLARG) { - REQUIRE(VALID_CONTEXT(mctx0)); +isc__mem_strndup(isc_mem_t *mctx, const char *s, size_t size FLARG) { + REQUIRE(VALID_CONTEXT(mctx)); REQUIRE(s != NULL); - isc__mem_t *mctx = (isc__mem_t *)mctx0; size_t len; char *ns; @@ -1958,7 +1955,6 @@ isc__mempool_get(isc_mempool_t *mpctx FLARG) { } #if USE_ALLOCATOR_CUSTOM - isc__mem_t *mctx = mpctx->mctx; if (ISC_UNLIKELY(mpctx->items == NULL)) { /* * We need to dip into the well. Lock the memory context @@ -2704,8 +2700,8 @@ isc__strdup(const char *s1 FLARG) { } char * -isc__strndup(const char *s1 FLARG) { - return (isc__mem_strndup(isc__mem_mctx, s1 FLARG_PASS)); +isc__strndup(const char *s1, size_t size FLARG) { + return (isc__mem_strndup(isc__mem_mctx, s1, size FLARG_PASS)); } isc_mem_t * @@ -2713,3 +2709,18 @@ isc_get_default_mctx(void) { REQUIRE(isc__mem_mctx != NULL); return ((isc_mem_t *)isc__mem_mctx); } + +void +isc_mem_initialize(void) { + REQUIRE(isc__mem_mctx == NULL); + isc_mem_create(&isc__mem_mctx); + isc_mem_setname(isc__mem_mctx, "default"); +} + +void +isc_mem_shutdown(void) { + REQUIRE(isc__mem_mctx != NULL); + isc_mem_destroy(&isc__mem_mctx); + /* FIXME: All code using raw 'exit(1);' has to be fixed first */ + /* isc_mem_checkdestroyed(stderr); */ +} diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c index 30850d4cea..9af83adca6 100644 --- a/lib/isc/netmgr/netmgr.c +++ b/lib/isc/netmgr/netmgr.c @@ -216,8 +216,6 @@ isc_nm_start(isc_mem_t *mctx, uint32_t workers) { isc__nm_winsock_initialize(); #endif /* WIN32 */ - isc_tls_initialize(); - mgr = isc_mem_get(mctx, sizeof(*mgr)); *mgr = (isc_nm_t){ .nworkers = workers }; @@ -374,8 +372,6 @@ nm_destroy(isc_nm_t **mgr0) { mgr->nworkers * sizeof(isc__networker_t)); isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr)); - isc_tls_destroy(); - #ifdef WIN32 isc__nm_winsock_destroy(); #endif /* WIN32 */ @@ -2522,12 +2518,8 @@ isc__nm_dump_active(isc_nm_t *nm) { } #endif -void -isc__nm_initialize(void); -void -isc__nm_shutdown(void); - #if UV_VERSION_MAJOR > 1 || (UV_VERSION_MAJOR == 1 && UV_VERSION_MINOR >= 38) + static void * isc__nm_malloc(size_t size) { return (isc_malloc(size)); @@ -2547,21 +2539,23 @@ static void isc__nm_free(void *ptr) { return (isc_free(ptr)); } -#endif -ISC_CONSTRUCTOR(200) void -isc__nm_initialize(void) { -#if UV_VERSION_MAJOR > 1 || (UV_VERSION_MAJOR == 1 && UV_VERSION_MINOR >= 38) - uv_replace_allocator(isc__nm_malloc, isc__nm_realloc, isc__nm_calloc, - isc__nm_free); -#endif +isc_nm_initialize(void) { + uv_replace_allocator(isc__nm_malloc, isc__nm_realloc, isc__nm_calloc, isc__nm_free); } -ISC_DESTRUCTOR(200) void -isc__nm_shutdown(void) { -#if UV_VERSION_MAJOR > 1 || (UV_VERSION_MAJOR == 1 && UV_VERSION_MINOR >= 38) +isc_nm_shutdown(void) { uv_library_shutdown(); -#endif } + +#else + +void +isc_nm_initialize(void) {} + +void +isc_nm_shutdown(void) {} + +#endif diff --git a/lib/isc/tls.c b/lib/isc/tls.c index ea5de5dbf9..d968b95d8c 100644 --- a/lib/isc/tls.c +++ b/lib/isc/tls.c @@ -9,6 +9,7 @@ * information regarding copyright ownership. */ +#include #include #include @@ -46,14 +47,71 @@ static void isc__tls_set_thread_id(CRYPTO_THREADID *id) { CRYPTO_THREADID_set_numeric(id, (unsigned long)isc_thread_self()); } + +# if !defined(OPENSSL_NO_ENGINE) +# define apps_startup() { \ + CRYPTO_malloc_init(); \ + ERR_load_crypto_strings(); \ + OpenSSL_add_all_algorithms(); \ + ENGINE_load_builtin_engines(); \ + } +# define apps_shutdown() { \ + CONF_modules_unload(1); \ + OBJ_cleanup(); \ + EVP_cleanup(); \ + ENGINE_cleanup(); \ + CRYPTO_cleanup_all_ex_data(); \ + ERR_remove_thread_state(NULL); \ + RAND_cleanup(); \ + ERR_free_strings(); \ + } +# else +# define apps_startup() { \ + CRYPTO_malloc_init(); \ + ERR_load_crypto_strings(); \ + OpenSSL_add_all_algorithms(); \ + } +# define apps_shutdown() { \ + CONF_modules_unload(1); \ + OBJ_cleanup(); \ + EVP_cleanup(); \ + CRYPTO_cleanup_all_ex_data(); \ + ERR_remove_thread_state(NULL); \ + RAND_cleanup(); \ + ERR_free_strings(); \ + } +# endif + #endif +static void +enable_fips_mode(void) { +#ifdef HAVE_FIPS_MODE + if (FIPS_mode() != 0) { + /* + * FIPS mode is already enabled. + */ + return; + } + + if (FIPS_mode_set(1) == 0) { + FATAL_ERROR(__FILE__, __LINE__, + "OpenSSL FIPS mode cannot be set"); + exit(1); + } +#endif /* HAVE_FIPS_MODE */ +} + static void isc__tls_initialize(void) { REQUIRE(!atomic_load(&init_done)); - RUNTIME_CHECK(OPENSSL_init_ssl(0, NULL) == 1); -#if OPENSSL_VERSION_NUMBER < 0x10100000L + enable_fips_mode(); + +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + RUNTIME_CHECK(OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN + | OPENSSL_INIT_LOAD_CONFIG, NULL) == 1); +#else isc_mem_create(&isc__tls_mctx); nlocks = CRYPTO_num_locks(); @@ -61,8 +119,25 @@ isc__tls_initialize(void) { isc_mutexblock_init(locks, nlocks); CRYPTO_set_locking_callback(isc__tls_lock_callback); CRYPTO_THREADID_set_callback(isc__tls_set_thread_id); - ERR_load_crypto_strings(); + + apps_startup(); #endif + +#if !defined(CONF_MFLAGS_DEFAULT_SECTION) + OPENSSL_config(NULL); +#else /* if !defined(CONF_MFLAGS_DEFAULT_SECTION) */ + /* + * OPENSSL_config() can only be called a single time as of + * 1.0.2e so do the steps individually. + */ + OPENSSL_load_builtin_modules(); + ENGINE_load_builtin_engines(); + ERR_clear_error(); + CONF_modules_load_file(NULL, NULL, + CONF_MFLAGS_DEFAULT_SECTION | + CONF_MFLAGS_IGNORE_MISSING_FILE); +#endif /* if !defined(CONF_MFLAGS_DEFAULT_SECTION) */ + atomic_store(&init_done, true); } @@ -71,15 +146,23 @@ isc_tls_initialize(void) { isc_result_t result = isc_once_do(&init_once, isc__tls_initialize); REQUIRE(result == ISC_R_SUCCESS); REQUIRE(atomic_load(&init_done)); + + /* Protect ourselves against unseeded PRNG */ + if (RAND_status() != 1) { + FATAL_ERROR(__FILE__, __LINE__, + "OpenSSL pseudorandom number generator " + "cannot be initialized (see the `PRNG not " + "seeded' message in the OpenSSL FAQ)"); + } } void -isc_tls_destroy(void) { +isc_tls_shutdown(void) { REQUIRE(atomic_load(&init_done)); -#if (OPENSSL_VERSION_NUMBER < 0x10100000L) - ERR_free_strings(); - ERR_remove_thread_state(NULL); +#if (OPENSSL_VERSION_NUMBER < 0x10100000L) + apps_shutdown(); + CRYPTO_set_locking_callback(NULL); if (locks != NULL) { diff --git a/lib/isc/win32/DLLMain.c b/lib/isc/win32/DLLMain.c index 97696bd82d..27b338dee1 100644 --- a/lib/isc/win32/DLLMain.c +++ b/lib/isc/win32/DLLMain.c @@ -12,14 +12,9 @@ #include #include -void -isc__mem_initialize(void); -void -isc__mem_shutdown(void); -void -isc__nm_initialize(void); -void -isc__nm_shutdown(void); +#include +#include +#include /* * Called when we enter the DLL @@ -36,8 +31,9 @@ __declspec(dllexport) BOOL WINAPI * Disable DllMain() invocation on Thread creation/destruction */ DisableThreadLibraryCalls(hinstDLL); - isc__mem_initialize(); /* priority=101 */ - isc__nm_initialized(); /* priority=200 */ + isc_mem_initialize(); /* priority=101 */ + isc_tls_initialize(); /* priority=102 + isc_nm_initialized(); /* priority=103 */ break; /* @@ -45,8 +41,9 @@ __declspec(dllexport) BOOL WINAPI * termination or a call to FreeLibrary. */ case DLL_PROCESS_DETACH: - isc__nm_shutdown(); /* priority=200 */ - isc__mem_shutdown(); /* priority=101 */ + isc_nm_shutdown(); /* priority=103 */ + isc_tls_shutdown(); /* priority=102 */ + isc_mem_shutdown(); /* priority=101 */ break; case DLL_THREAD_ATTACH: