From patchwork Sat Nov 14 15:48:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5692 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:11a:a05e:cb97 with SMTP id e25csp824318laa; Sat, 14 Nov 2026 07:48:55 -0800 (PST) X-Forwarded-Encrypted: i=2; AL+hErHQCWNFYOn5Cczsk8P1lk1Dkw7XPSBH3MUqxRXWL4uuJJvPFQkKiiSxe+uJCFMGltUvbfcRxxQkLYY=@openvpn.net X-Received: by 2002:a05:701b:2802:b0:14c:d84c:7182 with SMTP id a92af1059eb24-1b503104d0fmr5012419c88.22.1794671335376; Sat, 14 Nov 2026 07:48:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794671335; cv=none; d=google.com; s=arc-20260327; b=nao+SIDb6Pcs8n3kkWEIfexgv+7jqZVuTGX5AhcnUqZEl8QGYeE8efeE7iZiLvp7nb 4lEb0iKRRR6IWu14WtL424UR0W3e0RoHvD8GvZF9ZtPrjXHG4kpUySiyaGl4/OPVCTvM q32MfHMs0v9MowE/YDCv81US0flRqhfhNyO5Firagrpycr1wo0y32XZ0SQ0+noi4no7N lxikfqRobd+TmnHl+TqMFsdPzanfX18FQyAn7LHN6pw6IVJNknX4SxA4K4mqfJO2e8V+ LDy73qyBSQtiASaphXGHZ1h6Cp8laF7NGfWQLWt1XTOs6fjT2eQZiGd9grIApyqrbRij +2CA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=0HUdFB5mvmIFvfiaTgJVAkrfBvSqd7vfh3d9UcCMY8A=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=XdyAprzD4xtRl4GlIM5pcdUickRq/X18NwZyjkrNhNtDWeXayNRoKrJ+9Hb/F4/ZFm jfdFGWnCLBmcMhyFQNpBrXIfjAqXsKspOSyQ0Ki2Jc55NFn53bzr63H4VLGIKOtfFyrn zgc4stQ2GryxIObjpqD2KUFnUoyiUoz9kHzghmht94jUlUjPhr1AsI7hNlOn5RQqu8KH YYft+aFDIbpdu2sIHzO/ffivbrEZdTsyYKT1OLAvVgtmvsHw6g892oQtSmyk6aFd224v JyNuS8+/pihwaQcQq8Q1YDsUsJAjKwhArVPvgtDYiAiZw/ZB/m/2QAfh+/6UPs8Ql2dz ZImg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Y81U5E8j; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=NhntJ6+I; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=ct9Mis2i; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1b5031dc3f3si15484493c88.16.2026.11.14.07.48.55 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 14 Nov 2026 07:48:55 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Y81U5E8j; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=NhntJ6+I; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=ct9Mis2i; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=0HUdFB5mvmIFvfiaTgJVAkrfBvSqd7vfh3d9UcCMY8A=; b=Y81U5E8jjmlgPe URtyMe72lU5FvtULNDzRfEH8mece2P499oKISdSsKoHCWHLoamiyXZfRbuKtuSlB0H8+et+/8xuNA f2+TUQO9vANiyNmrg/YLtBZpdCU8V8NZ6haowNWEsgBgkgZJB7rasl7dabTT4NqZ/Crfu/+fZP7yL OFc=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xSFzp-000000003su-3eJk; Sat, 14 Nov 2026 15:48:53 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xSFzo-000000003so-0a5q for openvpn-devel@lists.sourceforge.net; Sat, 14 Nov 2026 15:48:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=qOanMyf0lpktdutAb6sPDo30tL5KrrUcWoz10GOUxQg=; b=NhntJ6+IcqlC02c09XncidUqvV JDRj3RqifooyrSTL2xXwwybAlUPlxAoTYyIqcE905QtgQq0JBkxFVSHqU36qo+Nap88dbwmQxC3am YuYyYw2YqsOGxqs75inYjq39+aD5Ox8LFBhFa7tn4GsH2o1SVCt//JQuuv/agqCDTWRU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=qOanMyf0lpktdutAb6sPDo30tL5KrrUcWoz10GOUxQg=; b=ct9Mis2i0LGkjtnJK9MJ79MQiG J5scWzmfnChxEK7ZOS9tCrqpcoJlXvSf01coawU/fBi5KOSP8U4R/Qf13QGR3EObqDXqHDq/7/3nh DELIDLxtlhiICYSc+j3HA36oPwHByUK64eIOvrFdoYtIlG0D2XiQi9uttWNc86oABWgs=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xSFzm-000000000Wn-45Zp for openvpn-devel@lists.sourceforge.net; Sat, 14 Nov 2026 15:48:52 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6AEFmieN001753 for ; Sat, 14 Nov 2026 16:48:44 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6AEFmiO7001752 for openvpn-devel@lists.sourceforge.net; Sat, 14 Nov 2026 16:48:44 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Sat, 14 Nov 2026 16:48:37 +0100 Message-ID: <20261114154843.1738-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru tls_ctx_load_priv_file() left the private key password on the stack. Clear passbuf with secure_memzero() once the key has been parsed. Change-Id: I5099b109d43664d5b83adfded6adfaf5ae9d608f Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/o [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xSFzm-000000000Wn-45Zp Subject: [Openvpn-devel] [PATCH v1] ssl_mbedtls: wipe private key password buffer after use X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1881849290135200161 X-GMAIL-MSGID: 1881849290135200161 From: Razvan Cojocaru tls_ctx_load_priv_file() left the private key password on the stack. Clear passbuf with secure_memzero() once the key has been parsed. Change-Id: I5099b109d43664d5b83adfded6adfaf5ae9d608f Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2099 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2099 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 8aaca96..9561abb 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -481,6 +481,7 @@ status = mbedtls_pk_parse_key( ctx->priv_key, (const unsigned char *)priv_key_file, strlen(priv_key_file) + 1, (unsigned char *)passbuf, strlen(passbuf)); + secure_memzero(passbuf, sizeof(passbuf)); } } else @@ -491,6 +492,7 @@ char passbuf[512] = { 0 }; pem_password_callback(passbuf, 512, 0, NULL); status = mbedtls_pk_parse_keyfile(ctx->priv_key, priv_key_file, passbuf); + secure_memzero(passbuf, sizeof(passbuf)); } } if (!mbed_ok(status))