From patchwork Thu Nov 5 09:37:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5604 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:30a9:b0:118:2077:975e with SMTP id f41csp1561817laa; Thu, 5 Nov 2026 01:38:07 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBxl5GiiU5Z4o39VWaHzZkEZmUdlryHwOhb4S2DjLcnCjvCBPoazxVoN4s2wiH6FtkQfZln7IP/ltsM=@openvpn.net X-Received: by 2002:a05:701b:451b:10b0:1ae:4ead:8cef with SMTP id a92af1059eb24-1ae4ead97a8mr22238566c88.30.1793871486632; Thu, 05 Nov 2026 01:38:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793871486; cv=none; d=google.com; s=arc-20260327; b=B7cbhvYc+niU3AvsH6cOXi3w+mwRztzNRHRRGAncynz/+5PeMnTaTsHpW+8Grx2pvd A/Q4ItIqcwUMBEHHllti0MGAJ7HazQD+FAUkaZrHXHITAVTwCFBeGdlsYN/XDph2grR1 BSUrqBivi2uzkQg6xM/ubNPvcRAuKtNZI2ETyXbPHBtA3BMdroLhu0WON2Cqqetp8bWz p/gNFQA+cGt7AT+djwA0fJrDfWt/zZbudqeNMhhHe1K3WMKrbuWXZyR6K43EtmV8Tkbn eWfg47WUQX8dJRwhlEVtrgtex2j/6S8OPp9RAi9vRmmKCG207OhKIcRo+5J75ut1cikM 9yPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=dt11oQOIkmZ5ogLiI+CKtsee3j5KbzLum5n1f5yQHs8=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=Tyi1ay6xn06KOAjCjCPZbHEqDf4Fk/PgvNt7EGH65sgU+wWxEQEYBGwKB6m5Dlgh8+ gBo8OgQ0EgbQshemlGSU23v0DOrKlYbg2FzQGwmBgFWfaqHz36pbxW4FKdQu/FrdEpX5 zNP6nSSyAo2AJsi6r31+S6J52SXH8tJVaHmlYSqAxYuxya2cThFX7GTHM30583hzd/sf 1tv9rvYmMEiR+YRTrQuWCc+0h7SdctGcJvZ3p62xigrwh/gvk4HrEach3+LqeSi1SU6F 2lwTJY6RxZM8v9ilFK7qMDLDVfG8l780Nk88cOAzcFQCMnnMGYRovNN1YR5AIBetNaYP D6pA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=YEA+eLaO; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=GRJcN9I3; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="Kb/QqlH/"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1b245c5c021si15261905c88.64.2026.11.05.01.38.06 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 Nov 2026 01:38:06 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=YEA+eLaO; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=GRJcN9I3; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b="Kb/QqlH/"; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=dt11oQOIkmZ5ogLiI+CKtsee3j5KbzLum5n1f5yQHs8=; b=YEA+eLaOsdsM2H CyDqfDBCv2sRrrOnmjJZtuhUkTg+oYTm2mJ5hFbd4jPV+N9rpG0C1LZoFmk/apyB7Tk4x9x++uEyp b77Mw0dkOXlzWsXLty/cxOXwHXDtkr/CPbOM0lGxKnnyKTkb+cW2hc+yZjIrTYHINn+oVeQkYTOeN 9AA=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xOtv3-000000004eM-24Y1; Thu, 05 Nov 2026 09:38:05 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xOtv2-000000004ds-3e1R for openvpn-devel@lists.sourceforge.net; Thu, 05 Nov 2026 09:38:04 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Mv/XGzd843ndctLjk47Rh1LkW7qtfWXpgRzh1F2552o=; b=GRJcN9I3Dq+SyUj/zi/Q/ZRiMH Z4ld3WTfNWRNSYKUUWeTOYRfw6e8Ci4APBITtQ//rqCE6d8SUmn+cy78jCOx1WZIkidemd86tS086 9+JqL1tDZDphVVQ4ndoZbdwcLJ/FhfDiXys7Tbbn9+AM+nHOWprR884OmCbmxdMS5bac=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Mv/XGzd843ndctLjk47Rh1LkW7qtfWXpgRzh1F2552o=; b=Kb/QqlH/IQ7vQxkBh04t03RshZ 8S0r9m836MSR5YmtAIndoptk4xQkeQcszf/UfdOi0HiUcOHkDePexw811Od23hn+eoNdeCIHSR4Ky tMxmtjIhE/1MVbWSHQcHgoozUMQvP6rNOcvM0vfoA0u6e1wdTrqCxc70UnTkUIfUiWMc=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xOtuh-000000006ZU-2Dwz for openvpn-devel@lists.sourceforge.net; Thu, 05 Nov 2026 09:37:44 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A59ba8V011856 for ; Thu, 5 Nov 2026 10:37:36 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A59baRO011855 for openvpn-devel@lists.sourceforge.net; Thu, 5 Nov 2026 10:37:36 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Thu, 5 Nov 2026 10:37:30 +0100 Message-ID: <20261105093736.11814-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Hansaem Wi init_key_ctx_bi() and tls_crypt_v2_init_server_key() convert the key into a struct key_parameters on the stack and return without clearing it. init_key_ctx_bi() sets up the data channel keys (when epo [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xOtuh-000000006ZU-2Dwz Subject: [Openvpn-devel] [PATCH v1] crypto: Wipe the struct key_parameters copies after use X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1881010587940624372 X-GMAIL-MSGID: 1881010587940624372 From: Hansaem Wi init_key_ctx_bi() and tls_crypt_v2_init_server_key() convert the key into a struct key_parameters on the stack and return without clearing it. init_key_ctx_bi() sets up the data channel keys (when epoch keys are not used), tls-auth, tls-crypt and static keys, so the cipher and HMAC keys stay on the stack after every key setup. epoch_init_send_key() and epoch_init_recv_key() already clear their struct key_parameters after use; do the same in these two places. Assisted-by: Claude Code:claude-opus-5-5 Change-Id: Ic4243377c96a3b460d69050386cddcb30535de27 Signed-off-by: Hansaem Wi Acked-by: Steffan Karger Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2078 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2078 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Steffan Karger diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c index 3d3ab0c..a5d4a38 100644 --- a/src/openvpn/crypto.c +++ b/src/openvpn/crypto.c @@ -1075,6 +1075,9 @@ init_key_bi_ctx_send(&ctx->encrypt, &send_key, kt, name); init_key_bi_ctx_recv(&ctx->decrypt, &recv_key, kt, name); ctx->initialized = true; + + secure_memzero(&send_key, sizeof(send_key)); + secure_memzero(&recv_key, sizeof(recv_key)); } void diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c index 23c7975..1ac25ce 100644 --- a/src/openvpn/tls_crypt.c +++ b/src/openvpn/tls_crypt.c @@ -359,6 +359,7 @@ init_key_ctx(key_ctx, &srv_key_params, &kt, encrypt, "tls-crypt-v2 server key"); secure_memzero(&srv_key, sizeof(srv_key)); + secure_memzero(&srv_key_params, sizeof(srv_key_params)); } static bool