From d7fc90afe91569c64e491bb33a4b564da7a5bc43 Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Mon, 6 Jan 2025 11:06:55 +0100 Subject: [PATCH] BUG/MAJOR: ssl/ocsp: fix NULL conn object dereferencing to access QUIC TLS counters This bug arrived with this commit in the current dev branch: 056ec51c26 MEDIUM: ssl/ocsp: counters for OCSP stapling and could occur for QUIC connections during handshake when the underlying connection object is not already initialized. So in this case the TLS counters attached to TLS listeners cannot be accessed through this object but from the QUIC connection object. Modify the code to initialize the listener (
  • variable) for both QUIC and TCP connections, then initialize the variables for the TLS counters if the listener is also initialized. Thank you to @Tristan971 for having reported this issue in GH #2833. Must be backported with the commit mentioned above if it is planned to be backported. --- src/ssl_ocsp.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c index 44c86f398..2165c97f9 100644 --- a/src/ssl_ocsp.c +++ b/src/ssl_ocsp.c @@ -53,6 +53,7 @@ #include #include #include +#include #include #include #include @@ -100,7 +101,7 @@ int ssl_sock_get_ocsp_arg_kt_index(int evp_keytype) int ssl_sock_ocsp_stapling_cbk(SSL *ssl, void *arg) { struct connection *conn = SSL_get_ex_data(ssl, ssl_app_data_index); - struct listener *li; + struct listener *li = NULL; struct ssl_counters *counters = NULL; struct ssl_counters *counters_px = NULL; struct certificate_ocsp *ocsp; @@ -115,8 +116,18 @@ int ssl_sock_ocsp_stapling_cbk(SSL *ssl, void *arg) if (!ctx) goto error; - if (obj_type(conn->target) == OBJ_TYPE_LISTENER) { + if (conn && obj_type(conn->target) == OBJ_TYPE_LISTENER) li = __objt_listener(conn->target); +#ifdef USE_QUIC + else if (!conn) { + struct quic_conn *qc = SSL_get_ex_data(ssl, ssl_qc_app_data_index); + + /* null if not a listener */ + li = qc->li; + } +#endif + + if (li) { counters = EXTRA_COUNTERS_GET(li->extra_counters, &ssl_stats_module); counters_px = EXTRA_COUNTERS_GET(li->bind_conf->frontend->extra_counters_fe, &ssl_stats_module); }