Crypt::SSLeay - leaking with pkcs12 use ?

[Dirk-Willem van Gulik]

Looking at Crypt-SSLeay-0.57 - and the rather trivial script below works:

-       fine and dandy when there is no PKCS12 environment variable
        set for a client side cert:

        perl below.pl
        .......

        while true; ps aux | grep perl | grep below.pl; sleep 1; done

        shows a steady size.

HOWEVER:

-       Leaks a few 100kbs-1Mbyte/second when one is set.

        export HTTPS_PKCS12_FILE=~/client.p12
        export HTTPS_PKCS12_PASSWORD=supersecret
        perl below.pl
        .......

        while true; ps aux | grep perl | grep below.pl; sleep 1; done

        shows a very steady growth.

Simplest script I could think off is shown below. Any one any ideas -
almost looks as if the .49 patch:

+ Added patch from Pavel Hlavnicka for freeing memory leaks
  from SSL_CTX_use_pkcs12_file() whose functionality is triggered
  by the $ENV{HTTPS_PKCS12_*} settings

was somehow reverted. Suggestions appreciated ! Let me know if you need
a test server/client-cert to test against.

Thanks,

Dw

- sample script

use LWP::UserAgent;
$|++;
my $ua  = LWP::UserAgent->new(keep_alive => 10);
while(1) {
        $i++;
        my $req = HTTP::Request->new('GET', 'https://xxxx.com');
        my $res = $ua->request($req);
        print ".";
};


- command sequence to get yourself a server/client
  cert and config for apache:

  # self signed server cert
  openssl req -new -x509 -nodes \
                -set_serial 1 \
        -out server.pem -keyout server.key \
        -subj /CN=server

  # cert of the root CA issueing client certs.
  #
  openssl req -new -x509 -nodes \
        -set_serial 1 \
        -out client-ca.pem -keyout client-ca.key \
        -subj /CN=client-ca

   # client cert request
   #
   openssl req -new -nodes -set_serial 3 \
        -out client.req -keyout client.key \
        -subj /CN=theclient

   # root signs it
   #
   openssl x509 -req -in client.req \
        -signkey client-ca.key  \
        -out client.pem

   # package ss PKCS12 for Crypt::SSLeay
   openssl pkcs12 -export -out client.p12 \
        -in client.pem -inkey client.key \
        -passout pass:supersecret


   # config for apache
   httpd.conf
        SSLEngine on
        SSLProtocol all -SSLv2
        SSLCertificateFile server.pem
        SSLCertificateKeyFile server.key

        SSLCACertificateFile ca-client.pem
        SSLVerifyClient require
        SSLVerifyDepth 2


http://www.bbc.co.uk/
This e-mail (and any attachments) is confidential and may contain personal 
views which are not the views of the BBC unless specifically stated.
If you have received it in error, please delete it from your system.
Do not use, copy or disclose the information in any way nor act in reliance on 
it and notify the sender immediately.
Please note that the BBC monitors e-mails sent or received.
Further communication will signify your consent to this.