Skip to content

Fix ca bundle leaks #856

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ekoby merged 2 commits into from
Apr 23, 2025
Merged

Fix ca bundle leaks #856

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8b78eb8
fix TSL context leak on CA bundle update
ekoby Apr 22, 2025
c9e3514
refactor OIDC error handling
ekoby Apr 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion inc_internal/zt_internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,6 @@ struct ziti_ctx {

bool closing;
bool enabled;
bool logout;
int ctrl_status;

ziti_auth_method_t *auth_method;
Expand Down
3 changes: 1 addition & 2 deletions library/oidc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,8 +184,7 @@ static void parse_cb(tlsuv_http_resp_t *resp, void *ctx) {

// connection failure
if (resp->code < 0) {
req->cb(req, resp->code, NULL);
free(req);
complete_oidc_req(req, resp->code, NULL);
return;
}

Expand Down
33 changes: 7 additions & 26 deletions library/ziti.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -448,23 +448,6 @@
ziti_posture_init(ztx, 20);
}

static void logout_cb(void *resp, const ziti_error *err, void *ctx) {
ziti_context ztx = ctx;

ziti_set_unauthenticated(ztx, NULL);

ziti_close_channels(ztx, ZITI_DISABLED);
ziti_ctrl_close(&ztx->ctrl);

model_map_clear(&ztx->sessions, (_free_f) free_ziti_session_ptr);
model_map_clear(&ztx->services, (_free_f) free_ziti_service_ptr);

if (ztx->closing) {
ztx->logout = true;
shutdown_and_free(ztx);
}
}

void ziti_force_api_session_refresh(ziti_context ztx) {
ZTX_LOG(DEBUG, "forcing session refresh");
ztx->auth_method->force_refresh(ztx->auth_method);
Expand Down Expand Up @@ -539,7 +522,6 @@
if (!ztx->enabled) {
ZTX_LOG(INFO, "enabling Ziti Context");
ztx->enabled = true;
ztx->logout = false;

int rc = load_tls(&ztx->config, &ztx->tlsCtx, &ztx->id_creds);
if (rc != 0) {
Expand Down Expand Up @@ -806,15 +788,12 @@
return;
}

if (!ztx->logout) {
ZTX_LOG(INFO, "waiting for logout");
return;
}

grim_reaper(ztx);

ztx->tlsCtx->free_ctx(ztx->tlsCtx);
ztx->tlsCtx = NULL;
if (ztx->tlsCtx) {
ztx->tlsCtx->free_ctx(ztx->tlsCtx);
ztx->tlsCtx = NULL;
}

// N.B.: libuv processes close callbacks in reverse order
// so we put the free on the first uv_close()
Expand Down Expand Up @@ -1609,12 +1588,14 @@
ztx->config.id.ca = new_pem;

tls_context *new_tls = NULL;
tls_context *old_tls = ztx->tlsCtx;
if (load_tls(&ztx->config, &new_tls, &ztx->id_creds) == 0) {
ztx_config_update(ztx);
free(old_ca);
ztx->tlsCtx = new_tls;
tlsuv_http_set_ssl(ztx_get_controller(ztx)->client, ztx->tlsCtx);
new_pem = NULL; // owned by ztx->config
old_tls->free_ctx(old_tls);
} else {
ztx->config.id.ca = old_ca;
ZITI_LOG(ERROR, "failed to create TLS context with updated CA bundle");
Expand Down Expand Up @@ -1760,7 +1741,7 @@
ziti_channel_prepare(ch);
}

if (!ztx->enabled) {
if (!ztx->enabled || ztx->closing) {
uv_timer_stop(&ztx->deadline_timer);
uv_prepare_stop(&ztx->prepper);
}
Expand Down Expand Up @@ -1807,7 +1788,7 @@
id_it = model_list_it_remove(id_it);
}

MODEL_MAP_FOREACH(conn_id, conn, &ztx->connections) {

Check warning on line 1791 in library/ziti.c

View workflow job for this annotation

GitHub Actions / MacOS arm64 

comparison between pointer and integer ('uint32_t' (aka 'unsigned int') and 'void *') [-Wpointer-integer-compare]

Check warning on line 1791 in library/ziti.c

View workflow job for this annotation

GitHub Actions / MacOS x86_64 

comparison between pointer and integer ('uint32_t' (aka 'unsigned int') and 'void *') [-Wpointer-integer-compare]
if (conn->type == Server) {
update_bindings(conn);
}
Expand Down
Loading