How to safely close openssl (release resources) in C program?

[rakeshcpp]

Recently I got the following interrupt from my C program which is also given below:

"Thread 1 "app" received signal SIGSEGV, Segmentation fault.
0x00007947b480f830 in OPENSSL_sk_pop_free () from /lib/x86_64-linux-gnu/libcrypto.so.3"

I don't have detailed understanding about SSL over the time I found this code for safely release resources of SSL and it works
if everything goes right but when there is no connection with host then this gives error very often:

// this is the structure just for understanding:
typedef struct inetsock
{
    struct sockaddr *addr;
    int sockfd;
    SSL_CTX *ssl_ctx;
    SSL *ssl;

} inetsock;

// this is the code which free ssl

SSL_shutdown(inet_sock->ssl)

if(inet_sock->ssl != NULL)
    SSL_clear(inet_sock->ssl);

if(inet_sock->ssl_ctx != NULL)
    SSL_CTX_free(inet_sock->ssl_ctx);

if(inet_sock->ssl != NULL)
    SSL_free(inet_sock->ssl);     // this line is giving SIGSEGV execption

Is this correct sequence to free resources or I am doing something wrong because I don't know internals?
If it is right, then what can we do to avoid such faults?

[kulkarniamit]

The SSL_CTX object acts as a factory to create SSL objects.

SSL_new(SSL_CTX *ctx):
"SSL_new() creates a new SSL structure which is needed to hold the data for a TLS/SSL connection."

SSL_CTX_free()
"SSL_CTX_free() decrements the reference count of ctx, and removes the SSL_CTX object pointed to by ctx and frees up the allocated memory if the reference count has reached 0"

So, you may want to call SSL_free() for each SSL object created from the SSL_CTX object first. After all SSL objects are freed, call SSL_CTX_free() to free the SSL_CTX memory.

Here's a demo file for reference.

[rakeshcpp]

As per example and your kind explanation, I changed sequence to SSL_free() and then SSL_CTX_free. But still I got same error at the same line of code. I am using SSL as client, I connect only once and then use that connection to send multiple requests, I keep open the same connection until I release the SSL for exiting the program. Please suggest.

[rakeshcpp]

In your example in the client code (branch at line no. 347 in main.c), if SSL_connect fails then we go to SSL_shutdown() while the man pages says that is SSL_connect returns value != 1, then either shutdown was controlled (value = 0) or shutdow was not clean(value<0). This means there was already a shutdow, then why we call the ssl_shutdown() again?

RETURN VALUES

The following return values can occur:

0

The TLS/SSL handshake was not successful but was shut down controlled and by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the return value ret to find out the reason.

1

The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been established.

<0

The TLS/SSL handshake was not successful, because a fatal error occurred either at the protocol level or a connection failure occurred. The shutdown was not clean. It can also occur of action is need to continue the operation for non-blocking BIOs. Call SSL_get_error() with the return value ret to find out the reason.

[rakeshcpp]

After digging deep I found that SSL_shutdown() returns this error:
0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:303:

if I get an error in SSL_shutdown, should I try to SSL_free() and SSL_context_free(), because it gives SIGSEGV in my case.
What are the possible accurate solutions. Please help.

[t8m]

Do not call SSL_clear(), this is unneeded and might be causing this.