diff mbox series

[Openvpn-devel,v1] ssl: Wipe the key source material in key_state_free()

Message ID 20261105093720.11781-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] ssl: Wipe the key source material in key_state_free() |

Commit Message

Gert Doering Nov. 5, 2026, 9:37 a.m. UTC 
  From: Hansaem Wi <hansaemw@gmail.com>

ks->key_src holds the pre_master and random values that the peers
exchange in key method 2. It is wiped after the data channel keys have
been generated and on the error paths of key_method_2_read() and
key_method_2_write(). When a key state is freed before the keys are
generated, for example because an --auth-user-pass-verify script or a
client-connect script rejects the client, key_state_free() frees it
with plain free() and the key material stays in freed memory, on the
server and on the client.

Wipe it with secure_memzero() before freeing it.

Assisted-by: Claude Code:claude-opus-5-5
Change-Id: I4d35f54402460c5866aeba26216ac1b2d2f8ebdc
Signed-off-by: Hansaem Wi <hansaemw@gmail.com>
Acked-by: Steffan Karger <steffan@karger.me>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2075
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2075
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Steffan Karger <steffan@karger.me>

Comments

Gert Doering Nov. 5, 2026, 4:50 p.m. UTC | #1 
Thanks again :-) - lightly stared-at, and gave the 2.7 a test run.

Your patch has been applied to the master and release/2.7 branch.

commit da6659452a34b5c94b20f55cbeb96b9ba70885ad (master)
commit 62c3c1b2fcd6aa485843255bd96dc3e2a755b4da (release/2.7)
Author: Hansaem Wi
Date:   Thu Nov 5 10:37:12 2026 +0100

     ssl: Wipe the key source material in key_state_free()

     Signed-off-by: Hansaem Wi <hansaemw@gmail.com>
     Acked-by: Steffan Karger <steffan@karger.me>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2075
     Message-Id: <20261105093720.11781-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg40746.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 086a6fc..eef8e7d 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -934,6 +934,10 @@ 
 
     free(ks->rec_ack);
     free(ks->lru_acks);
+    if (ks->key_src)
+    {
+        secure_memzero(ks->key_src, sizeof(*ks->key_src));
+    }
     free(ks->key_src);
 
     packet_id_free(&ks->crypto_options.packet_id);