From patchwork Mon Nov 2 13:13:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5546 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5387470laa; Mon, 2 Nov 2026 05:14:16 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBz6o/OpGlwutB4iGOMb4XFgkGsrirlGJT/noHpBJJnXWKqBtEpta+2o+bBrFHesezX/vKLy/psV/Y0=@openvpn.net X-Received: by 2002:a05:7022:1113:b0:1ac:9da7:e86e with SMTP id a92af1059eb24-1ac9dc67128mr14022307c88.30.1793625255705; Mon, 02 Nov 2026 05:14:15 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793625255; cv=none; d=google.com; s=arc-20260327; b=VwyOdLj+s8rELXS51UzkK4WWIgjnOlW32WDJ0L5nGQWYbal57gVKp+Tf/F3k/IhQR7 aqxLpDHPZMeVPGG4+LoLSvGlWbTMuBp/hGAa9RWWMCa3d06qZSKz3+8C3qmjEvacwrHW 2lfp9pegfSq/Hn518tqPVrL4LOUW3do14SoUal+72pk/7QGqZ3m7o2nbKMK1k53QDjGB AdAPqBTWhZ2+cO1GPxqLxOUutquJxjYHSpiK1ahwuMZg/OE6qsdjV5KeBwG1dUqKRY9g EJv7/Oy9U+IC+ABs/sQlYX+3Q9XQ9RD+P9EpUFFuWr/iNoB4CFy9OZSUC/9nbwy/49Hk tytQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=s34t/5/j90SUPfILCD3P42dm3N4DSFKZQLjf1xIJkDc=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=WcDwd6jP9onTY/66SvA6DICc3LqB3dWqS91YBK6PyTg2Q2JYwcRzfhbEokhLajogDC eZQDDuoetAN9XV84QELbA0Wz3MI3+j+2RGV1R35z56H5Ac9pfpT9W66zo8s6Y1e0qrcI scYQ89U0KYJ9v0OGuHOxlQbFcC/nIZYQDK78Ww02yzVPiGniOZ3Z9Owxds8JbLIPRLdv EEhFo0UQXUo/3dPsMbztokKPJKxRVJcrAoZIjGBDo1bu/U8PVTKGicQlpc5yFDg3TVdR b12MfriKMcU1AlPUZJE1nj56Q/jgkcihr5ojjveq5QXmna2GsoIdGQlm+8kY6SLhx1Gx JVtQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="dwv/SBlx"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZsgrvStK; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=d+nnVeMW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1ac143c4909si28086994c88.4.2026.11.02.05.14.15 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 05:14:15 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="dwv/SBlx"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZsgrvStK; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=d+nnVeMW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=s34t/5/j90SUPfILCD3P42dm3N4DSFKZQLjf1xIJkDc=; b=dwv/SBlxMeg3hA Lxgh32s43lbKrgWUVjAR6A8hKZdh4mN78YoZt4Mb/sVQy+AWiTLCWH1s9tnmWFJu6yyyh5J3EH+V6 oioIclT/oWR3Gri6HEIcRebSPN9SsozxKizaOh8H31kXZVFgCr2V+4QxadAs5bACIkbOUUorHzadY UAE=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNrra-000000003pz-2iog; Mon, 02 Nov 2026 13:14:14 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNrrZ-000000003ps-1fdg for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 13:14:13 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Zl50FxwJsfQ1w9ibHvuh+vSmoG1JwYSRD1C5eTvZgfg=; b=ZsgrvStKbvMnAfJmfcY36yUor/ FtHnEi1nnrdQQPesBbGcF/Pd6XIZ9ZGg/FB6JKWsV+oJXKIUG3d+AxJ3HXwJfNp5foOnhdGfZat+o NC1g1XhtWd9DYM/YK9yOkErjmxmX2fWsSQgV+7gzCQ2H/h3TUdOcoA7jOPjrP1+dlUq4=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Zl50FxwJsfQ1w9ibHvuh+vSmoG1JwYSRD1C5eTvZgfg=; b=d+nnVeMWLGIKxR8xJRjXm4sAJa J9UaKB0EfHPJeX0k62/A6fpko7quOXWe+qsh4ojgD5wipwNbLH8vtYQbo90ccVcMO0F1VyZQAX+et Wldjy6SCCD/aHAqqD8CwMSwuBUc2K+fyp66LNAXRMhYfSPwQ0sYByXdt+7J+GTZ7YIhQ=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNrrX-0000000080B-24We for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 13:14:13 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A2DE4mQ021615 for ; Mon, 2 Nov 2026 14:14:04 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A2DE4ts021614 for openvpn-devel@lists.sourceforge.net; Mon, 2 Nov 2026 14:14:04 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 14:13:59 +0100 Message-ID: <20261102131404.21605-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Hansaem Wi crypto_pem_decode() decodes the tls-crypt-v2 client and server keys and the auth-token key, and frees the decoded key bytes it got from PEM_read_bio() with OPENSSL_free(). Clear them with OPENSSL_clea [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xNrrX-0000000080B-24We Subject: [Openvpn-devel] [PATCH v2] crypto_openssl: Clear PEM decoded key data before freeing it X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880694054126384604 X-GMAIL-MSGID: 1880752396022451004 From: Hansaem Wi crypto_pem_decode() decodes the tls-crypt-v2 client and server keys and the auth-token key, and frees the decoded key bytes it got from PEM_read_bio() with OPENSSL_free(). Clear them with OPENSSL_cleanse() first. OPENSSL_clear_free() would do both in one call, but LibreSSL does not provide it. Assisted-by: Claude Code:claude-opus-5-5 Change-Id: I6b42785de99ee1e6b555d8c5e61ebe2ae784510e Signed-off-by: Hansaem Wi Acked-by: Steffan Karger Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Steffan Karger diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index e6abd8f..3c708c2 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -528,6 +528,7 @@ cleanup: OPENSSL_free(name_read); OPENSSL_free(header_read); + OPENSSL_cleanse(data_read, data_read_len); OPENSSL_free(data_read); if (!BIO_free(bio)) {