memory reorganization in sec-mod.

It no longer relies on main pool, it uses it's own pool.
In addition the DEBUG_LEAKS definition was added to allow debugging
leaks.

src/Makefile.am

@@ -11,6 +11,8 @@ BUILT_SOURCES = ocpasswd-args.c ocpasswd-args.h \
 	ocserv-args.c ocserv-args.h ipc.pb-c.c ipc.pb-c.h \
 	ctl.pb-c.c ctl.pb-c.h
 
+#AM_CPPFLAGS += -DDEBUG_LEAKS
+
 if LOCAL_HTTP_PARSER
 AM_CPPFLAGS += -I$(srcdir)/http-parser/
 HTTP_PARSER_SOURCES = http-parser/http_parser.c http-parser/http_parser.h

src/cookies.h

@@ -33,6 +33,8 @@ struct __attribute__ ((__packed__)) stored_cookie_st {
 	uint8_t ipv4_seed[4];
 };
 
+#define COOKIE_KEY_SIZE 16
+
 #define COOKIE_IV_SIZE 12 /* AES-GCM */
 #define COOKIE_MAC_SIZE 12 /* 96-bits of AES-GCM */
 #define COOKIE_SIZE (COOKIE_IV_SIZE + sizeof(struct stored_cookie_st) + COOKIE_MAC_SIZE)

src/main-misc.c

@@ -155,7 +155,6 @@ struct proc_st *ctmp;
 
 	memcpy(&ctmp->remote_addr, remote_addr, remote_addr_len);
 	ctmp->remote_addr_len = remote_addr_len;
-	memcpy(ctmp->sid, sid, sid_size);
 
 	list_add(&s->proc_list.head, &(ctmp->list));
 	put_into_cgroup(s, s->config->cgroup, pid);
@@ -601,7 +600,7 @@ void run_sec_mod(main_server_st * s)
 #endif
 		setproctitle(PACKAGE_NAME "-secmod");
 
-		sec_mod_server(s->main_pool, s->config, p, s->cookie_key, sizeof(s->cookie_key));
+		sec_mod_server(s->main_pool, s->config, p, s->cookie_key);
 		exit(0);
 	} else if (pid > 0) {	/* parent */
 		s->sec_mod_pid = pid;

src/main.c

@@ -840,6 +840,10 @@ int main(int argc, char** argv)
 	/* tls credentials */
 	struct tls_st creds;
 
+#ifdef DEBUG_LEAKS
+	talloc_enable_leak_report_full();
+#endif
+
 	memset(&creds, 0, sizeof(creds));
 
 	/* main pool */
@@ -1143,6 +1147,10 @@ fork_failed:
 
 		/* Check for pending control commands */
 		ctl_handler_run_pending(s, &rd_set, &wr_set);
+
+#ifdef DEBUG_LEAKS
+		talloc_report_full(s, stderr);
+#endif
 	}
 
 	return 0;

src/main.h

@@ -90,13 +90,6 @@ struct proc_st {
 	struct sockaddr_storage remote_addr; /* peer address */
 	socklen_t remote_addr_len;
 
-	/* A unique session identifier used to distinguish sessions
-	 * prior to authentication. It is sent as cookie to the client
-	 * who re-uses it when it performs authentication in multiple
-	 * sessions.
-	 */
-	uint8_t sid[SID_SIZE];//XXX
-
 	/* The DTLS session ID associated with the TLS session 
 	 * it is either generated or restored from a cookie.
 	 */
@@ -165,7 +158,7 @@ typedef struct main_server_st {
 	hash_db_st *tls_db;
 	tls_st *creds;
 	
-	uint8_t cookie_key[16];
+	uint8_t cookie_key[COOKIE_KEY_SIZE];
 
 	struct listen_list_st listen_list;
 	struct proc_list_st proc_list;

src/sec-mod-auth.c

@@ -93,7 +93,7 @@ static int generate_cookie(sec_mod_st * sec, client_entry_st * entry)
 	sc.expiration = time(0) + sec->config->cookie_validity;
 
 	ret =
-	    encrypt_cookie(&sec->cookie_key, &sc, entry->cookie,
+	    encrypt_cookie(&sec->dcookie_key, &sc, entry->cookie,
 			   sizeof(entry->cookie));
 	if (ret < 0)
 		return -1;

src/sec-mod.c

@@ -306,7 +306,7 @@ static void check_other_work(sec_mod_st *sec)
 
 		sec_mod_client_db_deinit(sec->client_db);
 		sec_mod_ban_db_deinit(sec->ban_db);
-		talloc_free(sec->main_pool);
+		talloc_free(sec);
 		exit(0);
 	}
 
@@ -345,8 +345,8 @@ static void check_other_work(sec_mod_st *sec)
  * clients fast without becoming a bottleneck due to private 
  * key operations.
  */
-void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
-		    uint8_t * cookie_key, unsigned cookie_key_size)
+void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_file,
+		    uint8_t cookie_key[COOKIE_KEY_SIZE])
 {
 	struct sockaddr_un sa;
 	socklen_t sa_len;
@@ -357,17 +357,38 @@ void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
 	struct pin_st pins;
 	int sd;
 	sec_mod_st *sec;
+	void *sec_mod_pool;
 
-	sec = talloc_zero(pool, sec_mod_st);
+#ifdef DEBUG_LEAKS
+	talloc_enable_leak_report_full();
+#endif
+
+	sec_mod_pool = talloc_init("sec-mod");
+	if (sec_mod_pool == NULL) {
+		seclog(LOG_ERR, "error in memory allocation");
+		exit(1);
+	}
+
+	sec = talloc_zero(sec_mod_pool, sec_mod_st);
 	if (sec == NULL) {
 		seclog(LOG_ERR, "error in memory allocation");
 		exit(1);
 	}
 
-	sec->cookie_key.data = cookie_key;
-	sec->cookie_key.size = cookie_key_size;
-	sec->config = config;
-	sec->main_pool = pool;
+	memcpy(sec->cookie_key, cookie_key, COOKIE_KEY_SIZE);
+	sec->dcookie_key.data = sec->cookie_key;
+	sec->dcookie_key.size = COOKIE_KEY_SIZE;
+	sec->config = talloc_steal(sec, config);
+
+	memset(&sa, 0, sizeof(sa));
+	sa.sun_family = AF_UNIX;
+	snprintf(sa.sun_path, sizeof(sa.sun_path), "%s", socket_file);
+	remove(socket_file);
+
+#define SOCKET_FILE sa.sun_path
+
+	/* we no longer need the main pool after this point. */
+	talloc_free(main_pool);
 
 	ocsignal(SIGHUP, SIG_IGN);
 	ocsignal(SIGINT, handle_sigterm);
@@ -402,15 +423,11 @@ void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
 		exit(1);
 	}
 
-	memset(&sa, 0, sizeof(sa));
-	sa.sun_family = AF_UNIX;
-	snprintf(sa.sun_path, sizeof(sa.sun_path), "%s", socket_file);
-	remove(socket_file);
 
 	sd = socket(AF_UNIX, SOCK_STREAM, 0);
 	if (sd == -1) {
 		e = errno;
-		seclog(LOG_ERR, "could not create socket '%s': %s", socket_file,
+		seclog(LOG_ERR, "could not create socket '%s': %s", SOCKET_FILE,
 		       strerror(e));
 		exit(1);
 	}
@@ -419,15 +436,15 @@ void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
 	ret = bind(sd, (struct sockaddr *)&sa, SUN_LEN(&sa));
 	if (ret == -1) {
 		e = errno;
-		seclog(LOG_ERR, "could not bind socket '%s': %s", socket_file,
+		seclog(LOG_ERR, "could not bind socket '%s': %s", SOCKET_FILE,
 		       strerror(e));
 		exit(1);
 	}
 
-	ret = chown(socket_file, config->uid, config->gid);
+	ret = chown(SOCKET_FILE, config->uid, config->gid);
 	if (ret == -1) {
 		e = errno;
-		seclog(LOG_INFO, "could not chown socket '%s': %s", socket_file,
+		seclog(LOG_INFO, "could not chown socket '%s': %s", SOCKET_FILE,
 		       strerror(e));
 	}
 
@@ -435,7 +452,7 @@ void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
 	if (ret == -1) {
 		e = errno;
 		seclog(LOG_ERR, "could not listen to socket '%s': %s",
-		       socket_file, strerror(e));
+		       SOCKET_FILE, strerror(e));
 		exit(1);
 	}
 
@@ -484,7 +501,8 @@ void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
 		}
 	}
 
-	seclog(LOG_INFO, "sec-mod initialized (socket: %s)", socket_file);
+	seclog(LOG_INFO, "sec-mod initialized (socket: %s)", SOCKET_FILE);
+
 	for (;;) {
 		check_other_work(sec);
 
@@ -544,6 +562,9 @@ void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
 		}
 		talloc_free(tpool);
 
+#ifdef DEBUG_LEAKS
+		talloc_report_full(sec, stderr);
+#endif
  cont:
 		close(cfd);
 	}

src/sec-mod.h

@@ -23,7 +23,8 @@
 #include <cookies.h>
 
 typedef struct sec_mod_st {
-	gnutls_datum_t cookie_key; /* the key to generate cookies */
+	gnutls_datum_t dcookie_key; /* the key to generate cookies */
+	uint8_t cookie_key[COOKIE_KEY_SIZE];
 
 	struct cfg_st *config;
 	gnutls_privkey_t *key;
@@ -31,9 +32,6 @@ typedef struct sec_mod_st {
 	void *client_db;
 	void *ban_db;
 
-	/* to be used on deinitialization only */
-	void *main_pool;
-
 	int fd;
 } sec_mod_st;
 
@@ -78,8 +76,8 @@ void sec_auth_user_deinit(client_entry_st *e);
 int handle_sec_auth_init(sec_mod_st *sec, const SecAuthInitMsg * req);
 int handle_sec_auth_cont(sec_mod_st *sec, const SecAuthContMsg * req);
 
-void sec_mod_server(void *pool, struct cfg_st *config, const char *socket_file,
-			uint8_t *cookie_key, unsigned cookie_key_size);
+void sec_mod_server(void *main_pool, struct cfg_st *config, const char *socket_file,
+		    uint8_t cookie_key[COOKIE_KEY_SIZE]);
 
 void cleanup_banned_entries(void *_db);
 unsigned check_if_banned(void *_db, const char *ip);