LTE-2939- Added code improvements to prevent SSL_write crash

source/InterDeviceManager/Idm_TCP_apis.c

@@ -43,6 +43,7 @@ bool ssl_lib_init = false;
 bool TCP_server_started = false;
 bool connect_reset = false;
 pthread_mutex_t connect_reset_mutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_mutex_t ssl_io_mutex = PTHREAD_MUTEX_INITIALIZER;
 typedef int (*callback_recv)( connection_info_t* conn_info, void *payload);
 
 typedef struct tcp_server_threadargs
@@ -52,6 +53,55 @@ typedef struct tcp_server_threadargs
     char interface[INTF_SIZE];
 } TcpServerThreadArgs;
 
+int idm_ssl_write_safe(connection_info_t *conn_info, const void *payload, size_t payload_len)
+{
+    int val = -1;
+
+    if (conn_info == NULL || payload == NULL)
+    {
+        CcspTraceError(("(%s:%d) invalid input, send failed\n", __FUNCTION__, __LINE__));
+        return -1;
+    }
+
+    pthread_mutex_lock(&ssl_io_mutex);
+
+    if (conn_info->conn < 0 || conn_info->enc.ctx == NULL || conn_info->enc.ssl == NULL)
+    {
+        CcspTraceError(("(%s:%d) SSL connection is invalid, send failed\n", __FUNCTION__, __LINE__));
+        goto done;
+    }
+
+    int ssl_fd = SSL_get_fd(conn_info->enc.ssl);
+
+    if (ssl_fd < 0 || ssl_fd != conn_info->conn)
+    {
+        CcspTraceError(("(%s:%d) SSL fd mismatch (ssl fd: %d, conn fd: %d), send failed\n", __FUNCTION__, __LINE__, ssl_fd, conn_info->conn));
+        goto done;
+    }
+
+    if (!SSL_is_init_finished(conn_info->enc.ssl))
+    {
+        CcspTraceError(("(%s:%d) SSL handshake is not complete, send failed\n", __FUNCTION__, __LINE__));
+        goto done;
+    }
+
+    val = SSL_write(conn_info->enc.ssl, payload, (int)payload_len);
+    if (val <= 0)
+    {
+        int ssl_err = SSL_get_error(conn_info->enc.ssl, val);
+        CcspTraceError(("(%s:%d) SSL_write failed (Ret: %d, SSL Error: %d)\n", __FUNCTION__, __LINE__, val, ssl_err));
+        val = -1;
+    }
+    else
+    {
+        CcspTraceInfo(("(%s:%d) SSL_write successful connection id %d \n", __FUNCTION__, __LINE__,conn_info->conn));
+    }
+
+done:
+    pthread_mutex_unlock(&ssl_io_mutex);
+    return val;
+}
+
 SSL_CTX* init_ctx(void)
 {
     SSL_CTX *ctx = NULL;
@@ -613,7 +663,7 @@ char* getFile_to_remote(connection_info_t* conn_info,void *payload)
         CcspTraceError(("%s:%d file not present\n",__FUNCTION__,__LINE__));
         strncpy_s(Data->param_value,sizeof(Data->param_value),FT_INVALID_FILE_NAME,strlen(FT_INVALID_FILE_NAME));
 #ifndef IDM_DEBUG
-        if ((bytes = SSL_write(conn_info->enc.ssl, Data, sizeof(payload_t))) > 0)
+        if ((bytes = idm_ssl_write_safe(conn_info, Data, sizeof(payload_t))) > 0)
         {
             CcspTraceError(("%s:%d invalid file name information is sent to peer device\n",__FUNCTION__,__LINE__));
         }
@@ -641,7 +691,7 @@ char* getFile_to_remote(connection_info_t* conn_info,void *payload)
         fclose(fptr);
         strncpy_s(Data->param_value,sizeof(Data->param_value),FT_FILE_SIZE_EXCEED,strlen(FT_FILE_SIZE_EXCEED));
 #ifndef IDM_DEBUG
-        if ((bytes = SSL_write(conn_info->enc.ssl, Data, sizeof(payload_t))) > 0)
+        if ((bytes = idm_ssl_write_safe(conn_info, Data, sizeof(payload_t))) > 0)
         {
             CcspTraceError(("%s:%d file size is more than the configured value and information is sent to peer device\n",__FUNCTION__,__LINE__));
         }
@@ -669,7 +719,7 @@ char* getFile_to_remote(connection_info_t* conn_info,void *payload)
             fclose(fptr);
             return FT_ERROR;
         }
-        if ((bytes = SSL_write(conn_info->enc.ssl, Data, sizeof(payload_t))) > 0)
+        if ((bytes = idm_ssl_write_safe(conn_info, Data, sizeof(payload_t))) > 0)
         {
             free(buffer);
             buffer =(char*)malloc (length);
@@ -681,7 +731,7 @@ char* getFile_to_remote(connection_info_t* conn_info,void *payload)
                     fclose(fptr);
                     return FT_ERROR;
                 }
-                if((bytes = SSL_write(conn_info->enc.ssl, buffer,length)) <= 0)
+                if((bytes = idm_ssl_write_safe(conn_info, buffer, length)) <= 0)
                 {
                     CcspTraceError(("file data is not transformed\n"));
                 }
@@ -817,10 +867,10 @@ char* sendFile_to_remote(connection_info_t* conn_info,void *payload,char* output
         free(buffer);
         return FT_ERROR;
     }
-    if ((bytes = SSL_write(conn_info->enc.ssl, Data, sizeof(payload_t))) > 0)
+    if ((bytes = idm_ssl_write_safe(conn_info, Data, sizeof(payload_t))) > 0)
     {
         // above ssl write transfers the information about file length and output file location whereas below one sends the file content
-        if((bytes = SSL_write(conn_info->enc.ssl, buffer,length)) <= 0)
+        if((bytes = idm_ssl_write_safe(conn_info, buffer, length)) <= 0)
         {
             CcspTraceError(("file data is not transformed\n"));
         }
@@ -858,42 +908,56 @@ char* sendFile_to_remote(connection_info_t* conn_info,void *payload,char* output
 int send_remote_message(connection_info_t* conn_info,void *payload)
 {
 #ifndef IDM_DEBUG
-    int val;
-    if (conn_info->enc.ctx != NULL && conn_info->enc.ssl != NULL) {
-        val = SSL_write(conn_info->enc.ssl, payload, sizeof(payload_t));
-        if (val > 0) {
-            CcspTraceInfo(("(%s:%d) SSL_write successful connection id %d \n", __FUNCTION__, __LINE__,conn_info->conn));
-            return 0;
-        }
-        else
-        {
-            int ssl_err = SSL_get_error(conn_info->enc.ssl, val);
-            CcspTraceError(("(%s:%d) SSL_write failed (Ret: %d, SSL Error: %d)\n", __FUNCTION__, __LINE__, val, ssl_err));
-        }
+
+    if (idm_ssl_write_safe(conn_info, payload, sizeof(payload_t)) > 0) {
+        CcspTraceInfo(("(%s:%d) SSL_write successful connection id %d \n", __FUNCTION__, __LINE__, conn_info->conn));
+        return 0;
     }
     else
     {
-        CcspTraceError(("(%s:%d) SSL CTX is NULL, Data send failed\n", __FUNCTION__, __LINE__));
+        CcspTraceInfo(("(%s:%d) SSL_write failed \n", __FUNCTION__, __LINE__));
+        return -1;
     }
 #else
     if(send(conn_info->conn, payload, sizeof(payload_t), 0)<0)
     {
         CcspTraceError(("%s %d - send failed failed : %s\n",  __FUNCTION__, __LINE__, strerror(errno)));
         return -1;
     }
+    else
+    {
+        CcspTraceInfo(("%s %d - send successful \n",  __FUNCTION__, __LINE__));
+        return 0;
+    }
 #endif
-    return -1;
 }
 
 int close_remote_connection(connection_info_t* conn_info)
 {
+    if (conn_info == NULL) {
+        return -1;
+    }
+
+    pthread_mutex_lock(&ssl_io_mutex);
+
     if (conn_info->enc.ssl != NULL) {
+        SSL_shutdown(conn_info->enc.ssl);
         SSL_free(conn_info->enc.ssl);
+        conn_info->enc.ssl = NULL;
     }
-    close(conn_info->conn);
+
+    if (conn_info->conn >= 0) {
+        close(conn_info->conn);
+        conn_info->conn = -1;
+    }
+
     if (conn_info->enc.ctx != NULL) {
         SSL_CTX_free(conn_info->enc.ctx);
+        conn_info->enc.ctx = NULL;
     }
+
+    pthread_mutex_unlock(&ssl_io_mutex);
+
     CcspTraceInfo(("%s %d - socket closed\n", __FUNCTION__, __LINE__));
     return 1;
 }

source/InterDeviceManager/Idm_TCP_apis.h

@@ -20,6 +20,8 @@
 #ifndef _IDM_TCP_H_
 #define _IDM_TCP_H_
 
+#include <stddef.h>
+
 #include "Idm_rbus.h"
 #include "Idm_msg_process.h"
 
@@ -30,5 +32,7 @@ int open_remote_connection(connection_config_t* connectionConf, int (*connection
 
 int send_remote_message(connection_info_t* conn_info, void *payload);
 
+int idm_ssl_write_safe(connection_info_t* conn_info, const void *payload, size_t payload_len);
+
 int close_remote_connection(connection_info_t* conn_info);
 #endif

source/InterDeviceManager/Idm_msg_process.c

@@ -742,7 +742,7 @@ char* IDM_SFT_receive(connection_info_t* conn_info,void* payload)
     char* buf = NULL;
     int bytes=0,length=0,total_bytes=0;
 #ifndef IDM_DEBUG
-    SSL* ssl= NULL;
+    connection_info_t *tx_conn = NULL;
 #else
     int conn=0;
 #endif
@@ -767,7 +767,7 @@ char* IDM_SFT_receive(connection_info_t* conn_info,void* payload)
 #ifndef IDM_DEBUG
                 if(remoteDevice->stRemoteDeviceInfo.conn_info.enc.ssl != NULL)
                 {
-                    ssl = remoteDevice->stRemoteDeviceInfo.conn_info.enc.ssl;
+                    tx_conn = &remoteDevice->stRemoteDeviceInfo.conn_info;
                 }
 #else
                 if(remoteDevice->stRemoteDeviceInfo.conn_info.conn != 0)
@@ -784,9 +784,9 @@ char* IDM_SFT_receive(connection_info_t* conn_info,void* payload)
             strncpy_s(Data->param_value,sizeof(Data->param_value),FT_INVALID_FILE_SIZE,strlen(FT_INVALID_FILE_SIZE));
             CcspTraceDebug(("%s:%d Data->operation=%d Data->param_value=%s \n",__FUNCTION__,__LINE__,Data->operation,Data->param_value));
 #ifndef IDM_DEBUG
-            if(ssl != NULL)
+            if(tx_conn != NULL)
             {
-                if(bytes = (SSL_write(ssl,Data,sizeof(payload_t))) <= 0 )
+                if((bytes = idm_ssl_write_safe(tx_conn, Data, sizeof(payload_t))) <= 0)
 #else
                     if(bytes = (send(conn,Data,sizeof(payload_t),0)) <= 0 )
 #endif
@@ -800,7 +800,7 @@ char* IDM_SFT_receive(connection_info_t* conn_info,void* payload)
             }
             else
             {
-                CcspTraceError(("%s:%d ssl value is null\n",__FUNCTION__,__LINE__));
+                CcspTraceError(("%s:%d ssl connection is null\n",__FUNCTION__,__LINE__));
                 IdmMgrDml_GetConfigData_release(pidmDmlInfo);
                 return FT_ERROR;
             }
@@ -833,9 +833,9 @@ char* IDM_SFT_receive(connection_info_t* conn_info,void* payload)
                 strncpy_s(Data->param_value,sizeof(Data->param_value),FT_INVALID_DST_PATH,strlen(FT_INVALID_DST_PATH));
                 CcspTraceDebug(("%s:%d Data->operation=%d Data->param_value%s\n",__FUNCTION__,__LINE__,Data->operation,Data->param_value));
 #ifndef IDM_DEBUG
-                if(ssl != NULL)
+                if(tx_conn != NULL)
                 {
-                    SSL_write(ssl,Data,sizeof(payload_t));
+                    idm_ssl_write_safe(tx_conn, Data, sizeof(payload_t));
                 }
 #else
                 send(conn,Data,sizeof(payload_t),0);
@@ -845,9 +845,9 @@ char* IDM_SFT_receive(connection_info_t* conn_info,void* payload)
 #ifndef IDM_DEBUG
             strncpy_s(Data->param_value,sizeof(Data->param_value),FT_NOT_WRITABLE_PATH,strlen(FT_NOT_WRITABLE_PATH));            
             CcspTraceDebug(("%s:%d Data->operation=%d Data->param_value%s\n",__FUNCTION__,__LINE__,Data->operation,Data->param_value));
-            if(ssl != NULL)
+            if(tx_conn != NULL)
             {
-                SSL_write(ssl,Data,sizeof(payload_t));
+                idm_ssl_write_safe(tx_conn, Data, sizeof(payload_t));
             }
 #else
             send(conn,Data,sizeof(payload_t),0);