stir_shaken: add global lock for loading the certificate

This prevents a crash generated by openssl internals regarding resetting
the error stack.

Many thanks go to ConnexCS for the valuable reports and testing fixes!

Author: razvancrainea

modules/stir_shaken/stir_shaken.c

@@ -72,6 +72,19 @@
 #define parsed_ctx_set(_ptr) \
 	context_put_ptr(CONTEXT_GLOBAL, current_processing_ctx, parsed_ctx_idx, _ptr)
 
+#define SS_LOCK \
+	do { \
+		if (ss_openssl_lock) \
+			lock_get(ss_openssl_lock); \
+		else \
+			LM_DBG("cannot lock openssl\n"); \
+	} while (0)
+#define SS_UNLOCK \
+	do { \
+		if (ss_openssl_lock) \
+			lock_release(ss_openssl_lock); \
+	} while (0)
+
 /*
  * Module core functions
  */
@@ -133,6 +146,7 @@ static int tn_authlist_nid;
 static int parsed_ctx_idx =-1;
 
 static X509_STORE *store;
+static gen_lock_t *ss_openssl_lock;
 
 
 static const param_export_t params[] = {
@@ -270,6 +284,12 @@ static int init_cert_validation(void)
 			X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
 	}
 
+	ss_openssl_lock = lock_alloc();
+	if (!ss_openssl_lock || !lock_init(ss_openssl_lock)) {
+		LM_ERR("could not allocate openssl lock\n");
+		ss_openssl_lock = NULL;
+	}
+
 	return 0;
 }
 
@@ -1019,12 +1039,14 @@ static int load_cert(X509 **cert, STACK_OF(X509) **certchain, str *cert_buf)
 		LM_ERR("Unable to create BIO buf\n");
 		return -1;
 	}
+	SS_LOCK;
 
 	/* parse end-entity certificate */
 	*cert = PEM_read_bio_X509(cbio, NULL, 0, NULL);
 	if (*cert == NULL) {
 		LM_ERR("Failed to parse certificate\n");
 		BIO_free(cbio);
+		SS_UNLOCK;
 		return -1;
 	}
 
@@ -1036,6 +1058,7 @@ static int load_cert(X509 **cert, STACK_OF(X509) **certchain, str *cert_buf)
 			X509_free(*cert);
 			*cert = NULL;
 			BIO_free(cbio);
+			SS_UNLOCK;
 			return -1;
 		}
 
@@ -1046,6 +1069,7 @@ static int load_cert(X509 **cert, STACK_OF(X509) **certchain, str *cert_buf)
 			*cert = NULL;
 			BIO_free(cbio);
 			sk_X509_free(stack);
+			SS_UNLOCK;
 			return -1;
 		}
 
@@ -1068,6 +1092,7 @@ static int load_cert(X509 **cert, STACK_OF(X509) **certchain, str *cert_buf)
 	} else {
 		BIO_free(cbio);
 	}
+	SS_UNLOCK;
 
 	return 0;
 }
@@ -1082,14 +1107,17 @@ static int load_pkey(EVP_PKEY **pkey, str *pkey_buf)
 		return -1;
 	}
 
+	SS_LOCK;
 	*pkey = PEM_read_bio_PrivateKey(kbio, NULL, NULL, NULL);
 	if (*pkey == NULL) {
 		LM_ERR("Failed to load private key from buffer\n");
 		BIO_free(kbio);
+		SS_UNLOCK;
 		return -1;
 	}
 
 	BIO_free(kbio);
+	SS_UNLOCK;
 
 	return 0;
 }