Nginx/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-11-21 16:28:40 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

QUIC: zero out existing keying material only.

Browse Source 
Previously, this used to have extra ngx_explicit_memzero() calls
from within ngx_quic_keys_cleanup(), which might be suboptimal.
This commit is contained in:
Sergey Kandaurov 2024-08-09 19:12:26 +04:00
parent 58b92177e7
commit 504c78fc6d
1 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/event/quic/ngx_event_quic_protection.c
View File

@ -743,8 +743,15 @@ ngx_quic_keys_discard(ngx_quic_keys_t *keys,
ngx_quic_crypto_hp_cleanup(client);
ngx_quic_crypto_hp_cleanup(server);
ngx_explicit_memzero(client->secret.data, client->secret.len);
ngx_explicit_memzero(server->secret.data, server->secret.len);
if (client->secret.len) {
ngx_explicit_memzero(client->secret.data, client->secret.len);
client->secret.len = 0;
}
if (server->secret.len) {
ngx_explicit_memzero(server->secret.data, server->secret.len);
server->secret.len = 0;
}
}
@ -844,6 +851,9 @@ ngx_quic_keys_update(ngx_event_t *ev)
ngx_explicit_memzero(current->server.secret.data,
current->server.secret.len);
current->client.secret.len = 0;
current->server.secret.len = 0;
ngx_explicit_memzero(client_key.data, client_key.len);
ngx_explicit_memzero(server_key.data, server_key.len);
@ -870,10 +880,17 @@ ngx_quic_keys_cleanup(ngx_quic_keys_t *keys)
ngx_quic_crypto_cleanup(&next->client);
ngx_quic_crypto_cleanup(&next->server);
ngx_explicit_memzero(next->client.secret.data,
next->client.secret.len);
ngx_explicit_memzero(next->server.secret.data,
next->server.secret.len);
if (next->client.secret.len) {
ngx_explicit_memzero(next->client.secret.data,
next->client.secret.len);
next->client.secret.len = 0;
}
if (next->server.secret.len) {
ngx_explicit_memzero(next->server.secret.data,
next->server.secret.len);
next->server.secret.len = 0;
}
}