Changeset 5990

Timestamp:

May 15, 2019 2:43:01 AM (5 years ago)

Author:

nanang

Message:

Close #2179: Wipe out memory used for storing SSL keys before released.

Location:

pjproject/trunk/pjlib

Files:

• include/pj/pool.h (modified) (1 diff)
• include/pj/pool_i.h (modified) (1 diff)
• src/pj/ssl_sock_imp_common.c (modified) (2 diffs)
• src/pj/ssl_sock_ossl.c (modified) (1 diff)

pjproject/trunk/pjlib/include/pj/pool.h

@@ -398 +398 @@
 
 /**
+ * Release the pool back to pool factory and set the pool pointer to zero.
+ * The memory pool content will be wiped out first before released.
+ *
+ * @param ppool     Pointer to memory pool.
+ */
+PJ_IDECL(void) pj_pool_secure_release( pj_pool_t **ppool );
+
+
+/**
  * Get pool object name.
  *

pjproject/trunk/pjlib/include/pj/pool_i.h

@@ -101 +101 @@
         pj_pool_release(pool);
 }
+
+PJ_IDEF(void) pj_pool_secure_release( pj_pool_t **ppool )
+{
+    pj_pool_block *b;
+    pj_pool_t *pool = *ppool;
+    *ppool = NULL;
+
+    if (!pool)
+        return;
+
+    b = pool->block_list.next;
+    while (b != &pool->block_list) {
+        volatile unsigned char *p = b->buf;
+        while (p < b->end) *p++ = 0;
+        b = b->next;
+    }
+
+    pj_pool_release(pool);
+}

pjproject/trunk/pjlib/src/pj/ssl_sock_imp_common.c

@@ -597 +597 @@
 }
 
+
+static void wipe_buf(pj_str_t *buf)
+{
+    volatile char *p = buf->ptr;
+    pj_ssize_t len = buf->slen;
+    while (len--) *p++ = 0;
+    buf->slen = 0;
+}
+
+static void wipe_cert_buffer(pj_ssl_cert_t *cert)
+{
+    wipe_buf(&cert->CA_file);
+    wipe_buf(&cert->CA_path);
+    wipe_buf(&cert->cert_file);
+    wipe_buf(&cert->privkey_file);
+    wipe_buf(&cert->privkey_pass);
+    wipe_buf(&cert->CA_buf);
+    wipe_buf(&cert->cert_buf);
+    wipe_buf(&cert->privkey_buf);
+}
+
 static void ssl_on_destroy(void *arg)
 {
@@ -614 +635 @@
     }
 
-    pj_pool_safe_release(&ssock->pool);
+    /* Wipe out cert & key buffer, note that they may not be allocated
+     * using SSL socket memory pool.
+     */
+    if (ssock->cert) {
+        wipe_cert_buffer(ssock->cert);
+    }
+
+    /* Secure release pool, i.e: all memory blocks will be zeroed first */
+    pj_pool_secure_release(&ssock->pool);
 }
 

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -1052 +1052 @@
     }
 
+    /* Early sensitive data cleanup after OpenSSL context setup. However,
+     * this cannot be done for listener sockets, as the data will still
+     * be needed by accepted sockets.
+     */
+    if (cert && (!ssock->is_server || ssock->parent)) {
+        wipe_cert_buffer(cert);
+    }
+
     /* Create SSL instance */
     ossock->ossl_ctx = ctx;