#2179 closed enhancement (fixed)
Wipe out memory used for storing SSL keys before released
Reported by: | nanang | Owned by: | nanang |
---|---|---|---|
Priority: | normal | Milestone: | release-2.9 |
Component: | pjlib | Version: | trunk |
Keywords: | Cc: | ||
Backport to 1.x milestone: | Backported: | no |
Description (last modified by nanang)
Zeroing our buffers should be sufficient as we cannot really manage the OpenSSL internal buffers. Moreover, it seems that OpenSSL already does wipe out its internal buffers, i.e: a lot of OpenSSL_cleanse() calls in OpenSSL source code, the function will fill a buffer with garbage or zero. But unfortunately cannot really find official docs about it.
Additionally, SSL socket pool content will be zeroed before released, it is done using a new API pj_pool_secure_release().
Thanks Peter Koletzki for the feedback.
Change History (4)
comment:1 Changed 6 years ago by nanang
- Description modified (diff)
comment:2 Changed 6 years ago by nanang
- Owner set to nanang
- Resolution set to fixed
- Status changed from new to closed
comment:3 Changed 6 years ago by nanang
In 5994:
comment:4 Changed 6 years ago by nanang
In 5999:
Note: See
TracTickets for help on using
tickets.
In 5990: