details: https://hg.nginx.org/nginx/rev/873150addfeb
branches:
changeset: 7453:873150addfeb
user: Ruslan Ermilov <ru@nginx.com>
date: Thu Jan 31 19:28:07 2019 +0300
description:
SSL: explicitly zero out session ticket keys.

diffstat:

src/event/ngx_event_openssl.c | 24 ++++++++++++++++++++++++
1 files changed, 24 insertions(+), 0 deletions(-)

diffs (69 lines):

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -68,6 +68,7 @@ static void ngx_ssl_session_rbtree_inser
static int ngx_ssl_session_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
unsigned char *name, unsigned char *iv, EVP_CIPHER_CTX *ectx,
HMAC_CTX *hctx, int enc);
+static void ngx_ssl_session_ticket_keys_cleanup(void *data);
#endif

#ifndef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
@@ -3455,6 +3456,7 @@ ngx_ssl_session_ticket_keys(ngx_conf_t *
ngx_uint_t i;
ngx_array_t *keys;
ngx_file_info_t fi;
+ ngx_pool_cleanup_t *cln;
ngx_ssl_session_ticket_key_t *key;

if (paths == NULL) {
@@ -3467,6 +3469,14 @@ ngx_ssl_session_ticket_keys(ngx_conf_t *
return NGX_ERROR;
}

+ cln = ngx_pool_cleanup_add(cf->pool, 0);
+ if (cln == NULL) {
+ return NGX_ERROR;
+ }
+
+ cln->handler = ngx_ssl_session_ticket_keys_cleanup;
+ cln->data = keys;
+
path = paths->elts;
for (i = 0; i < paths->nelts; i++) {

@@ -3538,6 +3548,8 @@ ngx_ssl_session_ticket_keys(ngx_conf_t *
ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
ngx_close_file_n " \"%V\" failed", &file.name);
}
+
+ ngx_explicit_memzero(&buf, 80);
}

if (SSL_CTX_set_ex_data(ssl->ctx, ngx_ssl_session_ticket_keys_index, keys)
@@ -3568,6 +3580,8 @@ failed:
ngx_close_file_n " \"%V\" failed", &file.name);
}

+ ngx_explicit_memzero(&buf, 80);
+
return NGX_ERROR;
}

@@ -3696,6 +3710,16 @@ ngx_ssl_session_ticket_key_callback(ngx_
}
}

+
+static void
+ngx_ssl_session_ticket_keys_cleanup(void *data)
+{
+ ngx_array_t *keys = data;
+
+ ngx_explicit_memzero(keys->elts,
+ keys->nelts * sizeof(ngx_ssl_session_ticket_key_t));
+}
+
#else

ngx_int_t
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel