# HG changeset patch
# User Maxim Dounin <mdounin@mdounin.ru>
# Date 1661481952 -10800
# Fri Aug 26 05:45:52 2022 +0300
# Node ID d5c6eae914325fb6a9b19105fe09aecd04da21e2
# Parent e88baee178eed529c6170678e373f5e2e0883c37
SSL: explicit clearing of expired sessions.

This reduces lifetime of session keying material in server's memory, and
therefore can be beneficial from forward secrecy point of view.

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -4025,6 +4025,8 @@ ngx_ssl_get_cached_session(ngx_ssl_conn_

ngx_rbtree_delete(&cache->session_rbtree, node);

+ ngx_explicit_memzero(sess_id->session, sess_id->len);
+
#if (NGX_PTR_SIZE == 8)
ngx_slab_free_locked(shpool, sess_id->session);
#endif
@@ -4114,6 +4116,8 @@ ngx_ssl_remove_session(SSL_CTX *ssl, ngx

ngx_rbtree_delete(&cache->session_rbtree, node);

+ ngx_explicit_memzero(sess_id->session, sess_id->len);
+
#if (NGX_PTR_SIZE == 8)
ngx_slab_free_locked(shpool, sess_id->session);
#endif
@@ -4162,6 +4166,8 @@ ngx_ssl_expire_sessions(ngx_ssl_session_

ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);

+ ngx_explicit_memzero(sess_id->session, sess_id->len);
+
#if (NGX_PTR_SIZE == 8)
ngx_slab_free_locked(shpool, sess_id->session);
#endif

_______________________________________________
nginx-devel mailing list -- nginx-devel@nginx.org
To unsubscribe send an email to nginx-devel-leave@nginx.org