[OpenSIPS-Devel] [OpenSIPS/opensips] b39729: tls_mgm: run tls_mgm:reload's SSL_CTX build/free i...

[Răzvan Crainea]

  Branch: refs/heads/master
  Home:   https://github.com/OpenSIPS/opensips
  Commit: b3972974b57183fba67351622a81e432ba82493e
      https://github.com/OpenSIPS/opensips/commit/b3972974b57183fba67351622a81e432ba82493e
  Author: Giovanni Maruzzelli <gmaruzz at gmail.com>
  Date:   2026-10-07 (Wed, 07 Oct 2026)

  Changed paths:
    M modules/tls_mgm/tls_mgm.c

  Log Message:
  -----------
  tls_mgm: run tls_mgm:reload's SSL_CTX build/free in TCP main

Since 11aa15d1b9 (TCP/TLS in a single process) the SSL_CTX of every TLS
domain is created in TCP main's private (libc) heap at child_init, but
tls_mgm:reload still runs init_tls_domains() and tls_free_db_domains()
in the MI process. The new domains (shm) therefore carry SSL_CTX pointers
that are valid only in the MI process, and the old SSL_CTX (TCP main's)
is SSL_CTX_free()d from the MI process. Result: a crash in free() inside
the MI process during the reload, or - when that free happens not to
fault - a crash in SSL_new() in TCP main on the next accepted TLS/WSS
connection.

Keep the DB load in the MI process, then hand the loaded domains to TCP
main over IPC and do the SSL_CTX init, the swap and the free of the old
domains there, waiting synchronously for the result.


  Commit: 606b3493deb90e7f1875da505a2048da88d842d1
      https://github.com/OpenSIPS/opensips/commit/606b3493deb90e7f1875da505a2048da88d842d1
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-10-07 (Wed, 07 Oct 2026)

  Changed paths:
    M modules/tls_mgm/tls_domain.c
    M modules/tls_mgm/tls_mgm.c

  Log Message:
  -----------
  tls_mgm: keep TLS domain destruction in TCP main


Compare: https://github.com/OpenSIPS/opensips/compare/66b5651c87bc...606b3493deb9

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications