From:
Satya Prakash Prasad <satyaprakash.developer.unix@gmail.com>
Date: Monday, 26 February 2024 at 09:48
To: Dave Rodgman <dave.rodgman@arm.com>
Cc: mbed-tls@lists.trustedfirmware.org <mbed-tls@lists.trustedfirmware.org>
Subject: Re: [mbed-tls] MBed TLS - Generic Question
Hi,
Please note that we are using the MBedTLS 2.19.1 release version since much development effort has been made using this version.
The issue we are facing currently is memory leaks. Let me explain in detail:
Since we need to connect multiple session we have modified the main function code from :
do {
printf("---[ server ]--------------------------------\n");
res_s = eap_example_server_step();
printf("---[ peer ]----------------------------------\n");
res_p = eap_example_peer_step();
} while (res_s || res_p);
do {
res_p = eap_example_peer_step();
if(eap_ctx.eapNoResp || eap_ctx.eapFail)
//On failure re-init is needed
eap_client_peer_deinit(); //On failure re-init is needed
The rest are integrated as per the code referred in link above. The way MBedTLS is integrated in EAP stack is mentioned below:
EAP stack provides interfaces to different TLS / crypto stack like:
eap_example_peer_init() -> eap_peer_sm_init(()->tls_init(&tls_config)
We have replaced the openssl with MBedTLS code as like below:
void * tls_init(const struct tls_config *eap_conf)
int rc;
mbedtls_ssl_context *mb_ctx;
mb_ctx = hosteap_calloc(sizeof(*mb_ctx));
if (mb_ctx == NULL) {
return NULL;
}
mbedtls_ssl_init(mb_ctx);
mb_ctx->conf = &mbed_conf; // mbed_conf is a Global variable
mbedtls_ssl_config_init(&mbed_conf);
mbedtls_ssl_config_defaults(&mbed_conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
mbedtls_ctr_drbg_init(&random); //random is global variable
rc = tls_platform_setup_drbg(&random);
if (rc) {
return null;
}
mbedtls_ssl_conf_rng(&mbed_conf, mbedtls_ctr_drbg_random, &random);
mbedtls_ssl_conf_export_keys_ext_cb(&mbed_conf, eap_tls_key_derivation, &eap_tls_keying );
if(mbedtls_ssl_setup(mb_ctx, &mbed_conf) != 0) {
return 0;
}
return mb_ctx;
Can anyone please confirm if the tls_init() method is correctly implemented?
I feel that somewhere in below code is causing memory leaks:
eap_client_peer_deinit(); //On failure re-init is needed
The allocation and deallocation is not happening properly - somewhere in MbedTLs 2.19.1 stack allocated memory is not deallocated?
Any references or information would be an added advantage - we need your help to integrate MBedTLs in the EAP HostAP stack.