Nginx/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-11-21 16:28:40 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

QUIC: explicitly zero out unused keying material.

Browse Source
This commit is contained in:
Sergey Kandaurov 2023-10-20 18:05:07 +04:00
parent b94f1fbee3
commit 31620d1a89
2 changed files with 22 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/event/quic/ngx_event_quic_openssl_compat.c
View File

@ -218,6 +218,8 @@ ngx_quic_compat_keylog_callback(const SSL *ssl, const char *line)
(void) ngx_quic_compat_set_encryption_secret(c, &com->keys, level,
cipher, secret, n);
}
ngx_explicit_memzero(secret, n);
}
@ -246,15 +248,6 @@ ngx_quic_compat_set_encryption_secret(ngx_connection_t *c,
return NGX_ERROR;
}
if (sizeof(peer_secret->secret.data) < secret_len) {
ngx_log_error(NGX_LOG_ALERT, c->log, 0,
"unexpected secret len: %uz", secret_len);
return NGX_ERROR;
}
peer_secret->secret.len = secret_len;
ngx_memcpy(peer_secret->secret.data, secret, secret_len);
key.len = key_len;
peer_secret->iv.len = NGX_QUIC_IV_LEN;
@ -292,6 +285,8 @@ ngx_quic_compat_set_encryption_secret(ngx_connection_t *c,
return NGX_ERROR;
}
ngx_explicit_memzero(key.data, key.len);
return NGX_OK;
}

18
src/event/quic/ngx_event_quic_protection.c
View File

@ -710,6 +710,8 @@ ngx_quic_keys_set_encryption_secret(ngx_log_t *log, ngx_uint_t is_write,
return NGX_ERROR;
}
ngx_explicit_memzero(key.data, key.len);
return NGX_OK;
}
@ -740,6 +742,9 @@ ngx_quic_keys_discard(ngx_quic_keys_t *keys,
ngx_quic_crypto_hp_cleanup(client);
ngx_quic_crypto_hp_cleanup(server);
ngx_explicit_memzero(client->secret.data, client->secret.len);
ngx_explicit_memzero(server->secret.data, server->secret.len);
}
@ -834,6 +839,14 @@ ngx_quic_keys_update(ngx_event_t *ev)
goto failed;
}
ngx_explicit_memzero(current->client.secret.data,
current->client.secret.len);
ngx_explicit_memzero(current->server.secret.data,
current->server.secret.len);
ngx_explicit_memzero(client_key.data, client_key.len);
ngx_explicit_memzero(server_key.data, server_key.len);
return;
failed:
@ -856,6 +869,11 @@ ngx_quic_keys_cleanup(ngx_quic_keys_t *keys)
ngx_quic_crypto_cleanup(&next->client);
ngx_quic_crypto_cleanup(&next->server);
ngx_explicit_memzero(next->client.secret.data,
next->client.secret.len);
ngx_explicit_memzero(next->server.secret.data,
next->server.secret.len);
}