Fixed memory leak in the firewall implementation and added mlock() usage

The memory leak was caused by not freeing the shadow context the firewall
child process uses for logging.  In addition this child process had a
connection to the database open as well, which was not needed.  This
connection is now disconnected immediately after the child process has
started.

Added also usage of mlock() to protect sensitive information from being
swapped out to disk.

1 files changed, 8 insertions, 1 deletions

diff --git a/plugin/firewall/eurephiafw.c b/plugin/firewall/eurephiafw.c
index deec3db..471e6e8 100644
--- a/plugin/firewall/eurephiafw.c
+++ b/plugin/firewall/eurephiafw.c
@@ -145,6 +145,10 @@ void eFW_StartFirewall(eurephiaCTX *ctx) {
         // Create a fake eurephia context, just for logging
         shadowctx = (eurephiaCTX *) malloc_nullsafe(ctx, sizeof(eurephiaCTX)+2);
         assert( shadowctx != NULL );
+        if( mlock(shadowctx, sizeof(eurephiaCTX)+2) < 0 ) {
+                eurephia_log(ctx, LOG_CRITICAL, 0, "Could not mlock() firewall context: %s",
+                             strerror(errno));
+        };
         shadowctx->context_type = ECTX_NO_PRIVILEGES;
         shadowctx->log = ctx->log;
         (*ctx->fwcfg).thrdata.ctx = shadowctx;
@@ -214,6 +218,7 @@ void eFW_StartFirewall(eurephiaCTX *ctx) {
         }
         switch( ctx->fwcfg->fwproc_pid ) {
         case 0: // Child process
+                eDBdisconnect(ctx);
                 eFW_RunFirewall(&(*ctx->fwcfg).thrdata);
                 exit(-1); // If our child process exits abnormally.
 
@@ -252,7 +257,7 @@ void eFW_StartFirewall(eurephiaCTX *ctx) {
         sem_wait(ctx->fwcfg->thrdata.semp_worker);
         eurephia_log(ctx, LOG_INFO, 2, "eFW interface initialised.");
 
-	// Initialise the chain
+        // Initialise the chain
         memset(&buf, 0, 1026);
         snprintf(buf, 1024, "I %s", fwdest);
         if( mq_send((*ctx->fwcfg).thrdata.msgq, buf, strlen(buf)+1, 1) == -1 ) {
@@ -348,6 +353,8 @@ void eFW_StopFirewall(eurephiaCTX *ctx) {
         sem_post(ctx->fwcfg->thrdata.semp_master);
 
         // Clean up and exit
+        munlock(ctx->fwcfg->thrdata.ctx, sizeof(eurephiaCTX)+2);
+        free_nullsafe(ctx, ctx->fwcfg->thrdata.ctx);
         free_nullsafe(ctx, ctx->fwcfg->fwblacklist_sendto);
         eFree_values(ctx, ctx->fwcfg->blacklisted);
         free_nullsafe(ctx, (*ctx->fwcfg).thrdata.fw_command);