F-1701 F-1292 F-3225 F-3902 F-1705: fix double-close, wrong-socket, and NULL-check bugs, and harden fd/session sentinel handling across DTLS, TLS, PSK, and CAN-bus examples

pull/485/merge
Emma Stensland 2026-07-02 09:29:57 -06:00 committed by Paul Adelsbach
parent b389087ed7
commit 12ba640b3a
15 changed files with 158 additions and 68 deletions

View File

@ -161,7 +161,7 @@ int setup_connection(const char *interface, int local_id, int remote_id)
/* Connect to CAN bus provided on command line, filter out everything
* except for the remote CAN ID */
sock = can_connect(interface, remote_id);
if (sock < 1) {
if (sock < 0) {
return -1;
}
can_con_info.sock = sock;

View File

@ -50,7 +50,7 @@ static void Usage(const char* progName)
int main(int argc, char** argv)
{
int sockfd = 0;
int sockfd = -1;
int ret;
struct sockaddr_in servAddr;
WOLFSSL* ssl = NULL;
@ -203,7 +203,7 @@ cleanup:
wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
}
if (sockfd > 0) close(sockfd);
if (sockfd >= 0) close(sockfd);
if (ctx != NULL) wolfSSL_CTX_free(ctx);
wolfSSL_Cleanup();

View File

@ -49,7 +49,7 @@ static void Usage(const char* progName)
int main(int argc, char** argv)
{
int sockfd = 0;
int sockfd = -1;
int ret;
struct sockaddr_in servAddr;
WOLFSSL* ssl = NULL;
@ -60,6 +60,7 @@ int main(int argc, char** argv)
unsigned char* sessionBuf = NULL;
unsigned int sessionSz = 0;
int n;
int err_occurred = 0;
/* Program argument checking */
if (argc < 2 || argc > 3) {
@ -149,6 +150,8 @@ int main(int argc, char** argv)
int err = wolfSSL_get_error(ssl, ret);
fprintf(stderr, "Error: wolfSSL_write failed: %d (%s)\n",
err, wolfSSL_ERR_reason_error_string(err));
ret = 1;
err_occurred = 1;
break;
}
printf("Sent: %s", sendLine);
@ -164,6 +167,8 @@ int main(int argc, char** argv)
if (err != SSL_ERROR_WANT_READ) {
fprintf(stderr, "Error: wolfSSL_read failed: %d (%s)\n",
err, wolfSSL_ERR_reason_error_string(err));
ret = 1;
err_occurred = 1;
break;
}
}
@ -171,7 +176,9 @@ int main(int argc, char** argv)
printf("\nEnter message (or 'quit' to exit):\n");
}
ret = 0;
if (!err_occurred) {
ret = 0;
}
cleanup:
if (sessionBuf != NULL) free(sessionBuf);
@ -179,7 +186,7 @@ cleanup:
wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
}
if (sockfd > 0) close(sockfd);
if (sockfd >= 0) close(sockfd);
if (ctx != NULL) wolfSSL_CTX_free(ctx);
wolfSSL_Cleanup();

View File

@ -47,7 +47,7 @@ main(int argc,
char * argv[])
{
/* standard variables used in a dtls client*/
int sockfd = 0;
int sockfd = -1;
int err1;
const char * host = argv[1];
WOLFSSL * ssl = NULL; /* The ssl for original connection. */
@ -88,7 +88,7 @@ main(int argc,
sockfd = new_udp_client_socket(ssl, host);
if (sockfd <= 0) {
if (sockfd < 0) {
printf("error: new_udp_client_socket failed\n");
return EXIT_FAILURE;
}
@ -123,7 +123,7 @@ main(int argc,
close(sockfd);
ssl = NULL;
sockfd = 0;
sockfd = -1;
/* Make a new WOLFSSL. */
ssl_res = wolfSSL_new(ctx);
@ -143,7 +143,7 @@ main(int argc,
/* Open a new udp socket. */
sockfd = new_udp_client_socket(ssl_res, host);
if (sockfd <= 0) {
if (sockfd < 0) {
printf("error: new_udp_client_socket failed\n");
return EXIT_FAILURE;
}
@ -173,7 +173,7 @@ main(int argc,
ssl_res = NULL;
session = NULL;
sockfd = 0;
sockfd = -1;
return 0;
}
@ -187,12 +187,12 @@ new_udp_client_socket(WOLFSSL * ssl,
const char * host)
{
struct sockaddr_in servAddr;
int sockfd = 0;
int sockfd = -1;
int ret = 0;
sockfd = socket(AF_INET, SOCK_DGRAM, 0);
if (sockfd <= 0) {
if (sockfd < 0) {
int errsave = errno;
printf("error: socket returned %d\n", errsave);
return -1;
@ -208,7 +208,7 @@ new_udp_client_socket(WOLFSSL * ssl,
if (ret != 1) {
printf("error: inet_pton %s returned %d\n", host, ret);
close(sockfd);
sockfd = 0;
sockfd = -1;
return -1;
}
@ -217,7 +217,7 @@ new_udp_client_socket(WOLFSSL * ssl,
if (ret != SSL_SUCCESS) {
printf("error: wolfSSL_dtls_set_peer returned %d\n", ret);
close(sockfd);
sockfd = 0;
sockfd = -1;
return -1;
}

View File

@ -47,7 +47,7 @@ typedef struct {
WOLFSSL_CTX * ctx;
} thread_args_t;
static void safer_shutdown(thread_args_t * args);
static int safer_shutdown(thread_args_t * args);
static void * client_work(void * arg);
int
@ -107,6 +107,7 @@ main(int argc,
for (size_t i = 0; i < n_threads; ++i) {
args[i].ctx = ctx;
args[i].activefd = -1;
ret = pthread_create(&threads[i], NULL, client_work, &args[i]);
if (ret == 0 ) {
@ -126,6 +127,14 @@ main(int argc,
}
}
/* All threads exited. Do a final cleanup pass just in case. */
for (size_t i = 0; i < n_threads; ++i) {
ret = safer_shutdown(&args[i]);
if (ret != 0) {
printf("error: safer_shutdown failed: %d\n", ret);
}
}
wolfSSL_CTX_free(ctx);
wolfSSL_Cleanup();
@ -159,18 +168,22 @@ client_work(void * args)
ret = inet_pton(AF_INET, localhost_ip, &servAddr.sin_addr);
if (ret != 1) {
printf("error: inet_pton %s returned %d\n", localhost_ip, ret);
safer_shutdown(thread_args);
return NULL;
}
ret = wolfSSL_dtls_set_peer(thread_args->ssl, &servAddr, sizeof(servAddr));
if (ret != SSL_SUCCESS) {
printf("error: wolfSSL_dtls_set_peer returned %d\n", ret);
safer_shutdown(thread_args);
return NULL;
}
thread_args->activefd = socket(AF_INET, SOCK_DGRAM, 0);
if (thread_args->activefd <= 0) {
if (thread_args->activefd < 0) {
printf("error: socket returned %d\n", thread_args->activefd);
thread_args->activefd = -1;
safer_shutdown(thread_args);
return NULL;
}
@ -183,6 +196,7 @@ client_work(void * args)
printf("error: thread %ld: wolfSSL_connect returned = %d, %s\n",
(long)pthread_self(), err1,
wolfSSL_ERR_reason_error_string(err1));
safer_shutdown(thread_args);
return NULL;
}
@ -246,33 +260,48 @@ client_work(void * args)
sleep(1);
}
safer_shutdown(thread_args);
ret = safer_shutdown(thread_args);
if (ret != 0) {
printf("error: safer_shutdown failed: %d\n", ret);
}
return NULL;
}
/* Small shutdown wrapper to safely clean up a thread's
* connection. */
static void
static int
safer_shutdown(thread_args_t * args)
{
int ret = 0;
if (args == NULL) {
printf("error: safer_shutdown with null args\n");
return;
return -1;
}
if (args->ssl != NULL) {
printf("info: closed tls session: %p\n", (void*) args->ssl);
wolfSSL_shutdown(args->ssl);
ret = wolfSSL_shutdown(args->ssl);
if (ret != WOLFSSL_SUCCESS) {
printf("warning: wolfSSL_shutdown did not complete cleanly: %d\n",
ret);
ret = -1;
}
else {
ret = 0;
}
wolfSSL_free(args->ssl);
args->ssl = NULL;
}
if (args->activefd > 0) {
if (args->activefd >= 0) {
printf("info: closed socket: %d\n", args->activefd);
close(args->activefd);
args->activefd = 0;
args->activefd = -1;
}
return;
return ret;
}

View File

@ -62,7 +62,7 @@ int main (int argc, char** argv)
/* Initialize wolfSSL before assigning ctx */
wolfSSL_Init();
/* wolfSSL_Debugging_ON(); */
if ( (ctx = wolfSSL_CTX_new(wolfDTLSv1_2_client_method())) == NULL) {
@ -72,7 +72,7 @@ int main (int argc, char** argv)
/* Load certificates into ctx variable */
if (wolfSSL_CTX_load_verify_locations(ctx, certs, 0)
!= SSL_SUCCESS) {
!= SSL_SUCCESS) {
fprintf(stderr, "Error loading %s, please check the file.\n", certs);
return 1;
}
@ -103,9 +103,9 @@ int main (int argc, char** argv)
/* Set the file descriptor for ssl and connect with ssl variable */
wolfSSL_set_fd(ssl, sockfd);
if (wolfSSL_connect(ssl) != SSL_SUCCESS) {
err1 = wolfSSL_get_error(ssl, 0);
printf("err = %d, %s\n", err1, wolfSSL_ERR_reason_error_string(err1));
printf("SSL_connect failed");
err1 = wolfSSL_get_error(ssl, 0);
printf("err = %d, %s\n", err1, wolfSSL_ERR_reason_error_string(err1));
printf("SSL_connect failed");
return 1;
}

View File

@ -63,7 +63,7 @@ int main(int argc, char** argv)
char servKeyLoc[] = "../certs/server-key.pem";
int ret = 0;
int on = 1;
int listenfd = 0;
int listenfd = -1;
int recvLen;
WOLFSSL_CTX* ctx = NULL;
WOLFSSL* ssl = NULL;
@ -274,7 +274,7 @@ cleanup:
wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
}
if (listenfd > 0) close(listenfd);
if (listenfd >= 0) close(listenfd);
if (ctx != NULL) wolfSSL_CTX_free(ctx);
wolfSSL_Cleanup();

View File

@ -59,7 +59,7 @@ int main(int argc, char** argv)
{
int ret = 0;
int on = 1;
int listenfd = 0;
int listenfd = -1;
int recvLen;
WOLFSSL_CTX* ctx = NULL;
WOLFSSL* ssl = NULL;
@ -72,6 +72,7 @@ int main(int argc, char** argv)
const char* sessionFile = DEFAULT_SERVER_SESSION_FILE;
unsigned char* sessionBuf = NULL;
unsigned int sessionSz = 0;
int err_occurred = 0;
/* Program argument checking */
if (argc > 2) {
@ -202,6 +203,8 @@ int main(int argc, char** argv)
int err = wolfSSL_get_error(ssl, ret);
fprintf(stderr, "Error: wolfSSL_write failed: %d (%s)\n",
err, wolfSSL_ERR_reason_error_string(err));
ret = 1;
err_occurred = 1;
break;
}
}
@ -210,12 +213,16 @@ int main(int argc, char** argv)
if (err != SSL_ERROR_WANT_READ) {
fprintf(stderr, "Error: wolfSSL_read failed: %d (%s)\n",
err, wolfSSL_ERR_reason_error_string(err));
ret = 1;
err_occurred = 1;
break;
}
}
}
ret = 0;
if (!err_occurred) {
ret = 0;
}
cleanup:
if (sessionBuf != NULL) free(sessionBuf);
@ -223,7 +230,7 @@ cleanup:
wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
}
if (listenfd > 0) close(listenfd);
if (listenfd >= 0) close(listenfd);
if (ctx != NULL) wolfSSL_CTX_free(ctx);
wolfSSL_Cleanup();

View File

@ -63,7 +63,7 @@ static WOLFSSL_CTX * ctx = NULL;
static volatile int stop_server = 0;
static int new_udp_listen_socket(void);
static void safer_shutdown(thread_args_t * args);
static int safer_shutdown(thread_args_t * args);
static void * server_work(void * thread_args);
static void sig_handler(const int sig);
static void cleanup_threadpool(pthread_t * threads, thread_args_t * args,
@ -78,7 +78,7 @@ main(int argc,
char servKeyLoc[] = "../certs/server-key.pem";
int ret = 0;
/* Variables for awaiting datagram */
int listenfd = 0; /* Initialize our socket */
int listenfd = -1; /* Initialize our socket */
struct sockaddr_in cliaddr; /* the client's address */
socklen_t cliLen = sizeof(cliaddr);
/* variables needed for threading */
@ -89,6 +89,9 @@ main(int argc,
memset(threads, 0, sizeof(threads));
memset(args, 0, sizeof(args));
for (size_t i = 0; i < DTLS_NUMTHREADS; ++i) {
args[i].activefd = -1;
}
while ((opt = getopt(argc, argv, "t:?")) != -1) {
switch (opt) {
@ -159,7 +162,7 @@ main(int argc,
/* Create a UDP/IP socket */
listenfd = new_udp_listen_socket();
if (listenfd <= 0 ) {
if (listenfd < 0) {
printf("error: cannot create socket: %d\n", listenfd);
return EXIT_FAILURE;
}
@ -243,7 +246,10 @@ main(int argc,
/* All threads exited. Do a final cleanup pass just in case. */
for (size_t i = 0; i < n_threads; ++i) {
safer_shutdown(&args[i]);
ret = safer_shutdown(&args[i]);
if (ret != 0) {
printf("error: safer_shutdown failed: %d\n", ret);
}
}
wolfSSL_CTX_free(ctx);
@ -256,13 +262,13 @@ static int
new_udp_listen_socket(void)
{
struct sockaddr_in listen_addr; /* our server's address */
int sockfd = 0;
int sockfd = -1;
int ret = 0;
int on = 1;
sockfd = socket(AF_INET, SOCK_DGRAM, 0);
if (sockfd <= 0) {
if (sockfd < 0) {
int errsave = errno;
printf("error: socket returned %d\n", errsave);
return -1;
@ -277,14 +283,14 @@ new_udp_listen_socket(void)
if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, (char*)&on, sizeof(on)) != 0) {
printf("error: setsockopt() with SO_REUSEADDR");
close(sockfd);
sockfd = 0;
sockfd = -1;
return -1;
}
#ifdef SO_REUSEPORT
if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEPORT, (char*)&on, sizeof(on)) != 0) {
printf("error: setsockopt() with SO_REUSEPORT");
close(sockfd);
sockfd = 0;
sockfd = -1;
return -1;
}
#endif
@ -296,7 +302,7 @@ new_udp_listen_socket(void)
int errsave = errno;
printf("error: bind returned %d\n", errsave);
close(sockfd);
sockfd = 0;
sockfd = -1;
return -1;
}
@ -370,21 +376,24 @@ server_work(void * args)
}
}
safer_shutdown(thread_args);
ret = safer_shutdown(thread_args);
if (ret != 0) {
printf("error: safer_shutdown failed: %d\n", ret);
}
printf("info: exiting thread %ld\n", (long)pthread_self());
pthread_exit(NULL);
}
/* Small shutdown wrapper to safely clean up a thread's
* connection. */
static void
static int
safer_shutdown(thread_args_t * args)
{
int ret;
int ret = 0;
if (args == NULL) {
printf("error: safer_shutdown with null args\n");
return;
return -1;
}
if (args->ssl != NULL) {
@ -395,19 +404,28 @@ safer_shutdown(thread_args_t * args)
if (ret != WOLFSSL_SUCCESS)
ret = wolfSSL_shutdown(args->ssl);
if (ret != WOLFSSL_SUCCESS) {
printf("warning: wolfSSL_shutdown did not complete cleanly: %d\n",
ret);
ret = -1;
}
else {
ret = 0;
}
wolfSSL_free(args->ssl);
args->ssl = NULL;
}
if (args->activefd > 0) {
if (args->activefd >= 0) {
printf("info: closed socket: %d\n", args->activefd);
close(args->activefd);
args->activefd = 0;
args->activefd = -1;
}
args->done = 1;
return;
return ret;
}
static void

View File

@ -40,7 +40,6 @@
#define SERV_PORT 11111 /* define our server port number */
#define MSGLEN 4096
static int cleanup = 0; /* To handle shutdown */
static struct sockaddr_in servAddr; /* our server's address */
static struct sockaddr_in cliaddr; /* the client's address */
@ -59,7 +58,7 @@ int main(int argc, char** argv)
int res = 1;
int bytesReceived = 0;
int recvLen = 0; /* length of message */
int listenfd = 0; /* Initialize our socket */
int listenfd = -1; /* Initialize our socket */
WOLFSSL* ssl = NULL;
socklen_t cliLen;
socklen_t len = sizeof(int);
@ -105,11 +104,11 @@ int main(int argc, char** argv)
/* Await Datagram */
;
while (cleanup != 1) {
while (1) {
/* Create a UDP/IP socket */
listenfd = socket(AF_INET, SOCK_DGRAM, 0);
if (listenfd <= 0 ) {
if (listenfd < 0 ) {
printf("error: cannot create socket: %d\n", listenfd);
break;
}
@ -211,16 +210,19 @@ int main(int argc, char** argv)
wolfSSL_set_fd(ssl, 0);
wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
ssl = NULL;
close(listenfd);
cleanup = 0;
listenfd = -1;
printf("Client left cont to idle state\n");
}
if (cleanup == 1) {
if (ssl != NULL) {
wolfSSL_set_fd(ssl, 0);
wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
}
if (listenfd >= 0) {
close(listenfd);
}

View File

@ -95,13 +95,15 @@ int main(int argc, char **argv){
/* converts IPv4 addresses from text to binary form */
ret = inet_pton(AF_INET, argv[1], &servaddr.sin_addr);
if (ret != 1){
ret = -1; goto exit;
ret = -1;
goto exit;
}
/* attempts to make a connection on a socket */
ret = connect(sockfd, (struct sockaddr *) &servaddr, sizeof(servaddr));
if (ret != 0 ){
ret = -1; goto exit;
ret = -1;
goto exit;
}
wolfSSL_Init(); /* initialize wolfSSL */
@ -109,7 +111,8 @@ int main(int argc, char **argv){
/* create and initialize WOLFSSL_CTX structure */
if ((ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) {
fprintf(stderr, "wolfSSL_CTX_new error.\n");
ret = -1; goto exit;
ret = -1;
goto exit;
}
#ifndef NO_PSK
@ -122,7 +125,8 @@ int main(int argc, char **argv){
/* create wolfSSL object after each tcp connect */
if ( (ssl = wolfSSL_new(ctx)) == NULL) {
fprintf(stderr, "wolfSSL_new error.\n");
ret = -1; goto exit;
ret = -1;
goto exit;
}
/* associate the file descriptor with the session */
@ -131,20 +135,22 @@ int main(int argc, char **argv){
/* takes inputting string and outputs it to the server */
if (wolfSSL_write(ssl, sendline, sizeof(sendline)) != sizeof(sendline)) {
printf("Write Error to Server\n");
ret = -1; goto exit;
ret = -1;
goto exit;
}
/* flags if the Server stopped before the client could end */
if (wolfSSL_read(ssl, recvline, MAXLINE) < 0 ) {
printf("Client: Server Terminated Prematurely!\n");
ret = -1; goto exit;
ret = -1;
goto exit;
}
/* show message from the server */
printf("Server Message: %s\n", recvline);
/* Save the session ID to reuse */
session = wolfSSL_get_session(ssl);
session = wolfSSL_get1_session(ssl);
sslResume = wolfSSL_new(ctx);
/* shut down wolfSSL */
@ -152,11 +158,22 @@ int main(int argc, char **argv){
/* close connection */
close(sockfd);
sockfd = SOCKET_INVALID;
/* cleanup without wolfSSL_Cleanup() and wolfSSL_CTX_free() for now */
wolfSSL_free(ssl);
ssl = NULL;
if (session == NULL) {
ret = -1;
goto exit;
}
if (sslResume == NULL) {
ret = -1;
goto exit;
}
/*
* resume session, start new connection and socket
*/
@ -213,6 +230,8 @@ exit:
wolfSSL_free(ssl); /* Free the wolfSSL object */
if (sslResume)
wolfSSL_free(sslResume); /* Free the wolfSSL object */
if (session != NULL)
wolfSSL_SESSION_free(session);
if (sockfd != SOCKET_INVALID)
close(sockfd); /* Close the socket */
if (sock != SOCKET_INVALID)

View File

@ -29,6 +29,7 @@
#include <arpa/inet.h>
#include <netinet/in.h>
#include <unistd.h>
#include <netdb.h>
/* wolfSSL */
#include <wolfssl/options.h>

View File

@ -29,6 +29,7 @@
#include <arpa/inet.h>
#include <netinet/in.h>
#include <unistd.h>
#include <netdb.h>
/* wolfSSL */
#include <wolfssl/options.h>
@ -222,7 +223,11 @@ int main(int argc, char **argv)
* before writing session information
*/
if (strcmp(msg, "break") == 0) {
session = wolfSSL_get_session(ssl);
session = wolfSSL_get1_session(ssl);
if (session == NULL) {
print_SSL_error("failed wolfSSL_get1_session", ssl);
break;
}
ret = write_SESS(session, SAVED_SESS);
break;
}

View File

@ -180,6 +180,7 @@ int main(int argc, char** argv)
wolfSSL_free(ssl);
ssl = NULL;
close(sockfd);
sockfd = SOCKET_INVALID;
/* --------------------------------------- *

View File

@ -228,7 +228,7 @@ int main()
ret = wolfSSL_accept(ssl);
err = wolfSSL_get_error(ssl, ret);
if (err == WOLFSSL_ERROR_WANT_READ)
tcp_select(sockfd, SELECT_WAIT_SEC, 1);
tcp_select(connd, SELECT_WAIT_SEC, 1);
} while (err == WOLFSSL_ERROR_WANT_READ || err == WOLFSSL_ERROR_WANT_WRITE);
if (ret != WOLFSSL_SUCCESS) {
fprintf(stderr, "wolfSSL_accept error %d (%d)\n", err, ret);
@ -244,7 +244,7 @@ int main()
err = wolfSSL_get_error(ssl, ret);
if (err == WOLFSSL_ERROR_WANT_READ)
tcp_select(sockfd, SELECT_WAIT_SEC, 1);
tcp_select(connd, SELECT_WAIT_SEC, 1);
}
while (err == WOLFSSL_ERROR_WANT_READ);
if (ret < 0) {
@ -272,7 +272,8 @@ int main()
do {
ret = wolfSSL_write(ssl, reply, len);
err = wolfSSL_get_error(ssl, ret);
sleep(1);
if (err == WOLFSSL_ERROR_WANT_WRITE)
tcp_select(connd, SELECT_WAIT_SEC, 0);
}
while (err == WOLFSSL_ERROR_WANT_WRITE);
if (ret < 0) {
@ -285,7 +286,7 @@ int main()
ret = wolfSSL_shutdown(ssl);
err = wolfSSL_get_error(ssl, 0);
if (err == WOLFSSL_ERROR_WANT_READ)
tcp_select(sockfd, SELECT_WAIT_SEC, 1);
tcp_select(connd, SELECT_WAIT_SEC, 1);
} while (err == WOLFSSL_ERROR_WANT_READ || err == WOLFSSL_ERROR_WANT_WRITE);
/* Cleanup after this connection */