diff mbox series

[Openvpn-devel,v2] crypto_openssl: Clear PEM decoded key data before freeing it

Message ID 20261102131404.21605-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] crypto_openssl: Clear PEM decoded key data before freeing it |

Commit Message

Gert Doering Nov. 2, 2026, 1:13 p.m. UTC 
  From: Hansaem Wi <hansaemw@gmail.com>

crypto_pem_decode() decodes the tls-crypt-v2 client and server keys
and the auth-token key, and frees the decoded key bytes it got from
PEM_read_bio() with OPENSSL_free(). Clear them with OPENSSL_cleanse()
first. OPENSSL_clear_free() would do both in one call, but LibreSSL
does not provide it.

Assisted-by: Claude Code:claude-opus-5-5
Change-Id: I6b42785de99ee1e6b555d8c5e61ebe2ae784510e
Signed-off-by: Hansaem Wi <hansaemw@gmail.com>
Acked-by: Steffan Karger <steffan@karger.me>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Steffan Karger <steffan@karger.me>

Comments

Gert Doering Nov. 2, 2026, 2:29 p.m. UTC | #1 
Thanks.  The wonders of SSL library compat...

Your patch has been applied to the master and release/2.7 branch
("reasonable code hardening").

commit 21c8a682755c425c0830d25cc33643545d479514 (master)
commit b8062e7394cd7f37bc14b153da84100835894135 (release/2.7)
Author: Hansaem Wi
Date:   Mon Nov 2 14:13:59 2026 +0100

     crypto_openssl: Clear PEM decoded key data before freeing it

     Signed-off-by: Hansaem Wi <hansaemw@gmail.com>
     Acked-by: Steffan Karger <steffan@karger.me>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077
     Message-Id: <20261102131404.21605-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg40430.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
index e6abd8f..3c708c2 100644
--- a/src/openvpn/crypto_openssl.c
+++ b/src/openvpn/crypto_openssl.c
@@ -528,6 +528,7 @@ 
 cleanup:
     OPENSSL_free(name_read);
     OPENSSL_free(header_read);
+    OPENSSL_cleanse(data_read, data_read_len);
     OPENSSL_free(data_read);
     if (!BIO_free(bio))
     {