From patchwork Mon Nov 2 09:06:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5540 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5151035laa; Mon, 2 Nov 2026 01:06:50 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBxagOg9T+gY4zKF3e9KOv4DdrIxGZc9KoXO0haePKJFwtI15055hemJWSS6bjZDevllIIUZh71vweQ=@openvpn.net X-Received: by 2002:a05:7022:121a:b0:1a9:cad6:5b58 with SMTP id a92af1059eb24-1ac5ffe5b8fmr13023022c88.39.1793610409454; Mon, 02 Nov 2026 01:06:49 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793610409; cv=none; d=google.com; s=arc-20260327; b=S1Vdpayyi/9IAvdov+7yRY6C4rwkgRuq+FC+JJi1MWAZ0ei97TKNlV3OWjRqSQGG9M wazwoUIRgVpN31E+t0V9LwTsVtRgHC1wcIpHlEgwW7CPJxNHvoA3LZrSolUjfLpVcdU/ AajTeGaqDbi+w0PO5r4byMw6a1ZRcmU4MJ3FUIXY77Fk+Bgml4Re/B//rKzUiLjfhWE1 /QeSJaDTmMTS8XqLQMk3p0bZz+Gt3IXMMNm7CINj9PS3+PBZDRCsQhrBC2D1A3j9myov U2Y1qzE800imaRGgxW8TFlKOoT5FtVln+sdVwYN+DlyuStOFhXsElt4aOjZduUb8wGq6 9vSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=O/8jJINZc+dKPhnVQQwj5iWZHJFsKx82p9QXHYTzx+U=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=ELSZGpgwuaj5hbtOldXUgy1kacoPQV+5hemy3ElTQbLdBVgx5Te/4c0L6tDGlp/us1 0Md3EHVZmtq45q44E3ylpPCECrJl9vYARevu5CGi38L0HUjTacCuVb1YSROTdcQbn0L1 qAotYStYfCETMla0RRbMUkRXQ2KClKBuXV+bRbb1FKfUqH2xZyz4XRkaXBXgHH2apPXg 1U3eWXpLxP8e/Gsg6CRwI/VnZuukOILgZuI04JO6bE1YHnkVptX0vd2DWieRr3AsUxj4 jEYBDsfLVDwwZdX6OTjMrCkuOpAp571HxFIjwiWYALh9LFe4tPHWe0NjQAi7DpoIB4Jy /3dQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=FaCz+7xH; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=EXdAT6v9; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=brCBmWQa; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac1b86c5e4si28754905c88.90.2026.11.02.01.06.48 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 01:06:49 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=FaCz+7xH; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=EXdAT6v9; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=brCBmWQa; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=O/8jJINZc+dKPhnVQQwj5iWZHJFsKx82p9QXHYTzx+U=; b=FaCz+7xHKokKPB 3XeO9L5DJQ9jpzAr1UGArP1mNVlXm57MnCfReE5Qc51XqgOKbpdPhIXc+l/YGO1qCkcrxSpYXoWjo xuhROMrXwtDE8rgsp7jm/ZjRrYZRL0PAr7kMwqyp8yzaxwqxN6I7pb7Ds+Kr8PRO+oWlI3pbh8Eb6 LsQ=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNo07-000000000vd-379u; Mon, 02 Nov 2026 09:06:47 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNo06-000000000vL-22oa for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 09:06:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=NjiiegHw7Qgdwj8l0L5QR+W0hHyNjrC1F3HiNvDoHSU=; b=EXdAT6v9jmMqUSGSrCrJhvwRkr AdAOpxIxbuXMQdFhESA7CnK2pLkPzVzhs4yHB7OxohpH2hOl0WsbZ/Haz0r+huAAP6oRO1mmsB4ry 09aHr1+hs9dbJT82iGQ54jyz25tbTAN1OlxYAJFWluJIuMS5q0vgmvHKnZJXSseuj/d0=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=NjiiegHw7Qgdwj8l0L5QR+W0hHyNjrC1F3HiNvDoHSU=; b=brCBmWQaw3/qbPLpIM6GGcjF7q 0/SycVFeGiqnnjXq4EbA+dodJGAW+Yb1SEwcZukknCKK7H8SYtgd7LsY1b839dlu2REPwq2TzKRoV //zxB8ViM4oWZW7JVKiRujzRXHfh3/vAeK4cm7HieOjsPw5jMGlv8B7X6rWjmAqKgJBk=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNo03-000000000ew-0wEO for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 09:06:46 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A296ZKk024930 for ; Mon, 2 Nov 2026 10:06:35 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A296Z8O024920 for openvpn-devel@lists.sourceforge.net; Mon, 2 Nov 2026 10:06:35 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 10:06:29 +0100 Message-ID: <20261102090635.24906-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Hansaem Wi auth_token_init_secret() reads the auth-token server key into a 2048 byte buffer, copies it into a struct key on the stack, converts that into a struct key_parameters on the stack and frees the buffer [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xNo03-000000000ew-0wEO Subject: [Openvpn-devel] [PATCH v2] auth_token: Wipe the server secret key after loading it X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880736828254661442 X-GMAIL-MSGID: 1880736828254661442 From: Hansaem Wi auth_token_init_secret() reads the auth-token server key into a 2048 byte buffer, copies it into a struct key on the stack, converts that into a struct key_parameters on the stack and frees the buffer with free_buf(), so all three copies of the key stay in memory. tls_crypt_v2_init_server_key() already wipes its struct key after init_key_ctx(); do the same here for the struct key and the struct key_parameters, and clear the buffer before freeing it. Found by scanning freed heap blocks for the key from test_auth_token. Assisted-by: Claude Code:claude-opus-5-5 Change-Id: Ib5eb24b156acb5a99c614050fb1bd64fe46d8b52 Signed-off-by: Hansaem Wi Acked-by: Steffan Karger Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2076 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2076 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Steffan Karger diff --git a/src/openvpn/auth_token.c b/src/openvpn/auth_token.c index 969f37f..84558af 100644 --- a/src/openvpn/auth_token.c +++ b/src/openvpn/auth_token.c @@ -172,6 +172,9 @@ key_parameters_from_key(&key_params, &key); init_key_ctx(key_ctx, &key_params, &kt, false, "auth-token secret"); + secure_memzero(&key, sizeof(key)); + secure_memzero(&key_params, sizeof(key_params)); + buf_clear(&server_secret_key); free_buf(&server_secret_key); }