Skip to content

Commit c142cc8

Browse files
committed
zero sensitive material before free
1 parent 748528f commit c142cc8

5 files changed

Lines changed: 27 additions & 4 deletions

File tree

src/dtls13.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2388,7 +2388,10 @@ static Dtls13Epoch* Dtls13NewEpochSlot(WOLFSSL* ssl)
23882388
WOLFSSL_MSG_EX("Delete epoch: %d", e->epochNumber);
23892389
#endif /* WOLFSSL_DEBUG_TLS */
23902390

2391-
XMEMSET(e, 0, sizeof(*e));
2391+
/* The slot we are reusing holds the previous epoch's symmetric keys, IVs,
2392+
* and sn-keys; use ForceZero so the wipe cannot be elided by the
2393+
* optimizer when the slot is later overwritten. */
2394+
ForceZero(e, sizeof(*e));
23922395

23932396
return e;
23942397
}

src/internal.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9126,6 +9126,11 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
91269126
#ifdef WOLFSSL_DTLS13
91279127
Dtls13FreeFsmResources(ssl);
91289128

9129+
/* Zero per-epoch symmetric keys / IVs / sn-keys so they are not left
9130+
* resident in the heap after FreeSSL releases the SSL struct. Mirrors
9131+
* the existing ForceZero on ssl->keys and ssl->clientSecret/serverSecret. */
9132+
ForceZero(ssl->dtls13Epochs, sizeof(ssl->dtls13Epochs));
9133+
91299134
#ifdef WOLFSSL_RW_THREADED
91309135
wc_FreeMutex(&ssl->dtls13Rtx.mutex);
91319136
#endif

src/keys.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4138,6 +4138,8 @@ static int MakeSslMasterSecret(WOLFSSL* ssl)
41384138
ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
41394139
wc_MemZero_Add("MakeSslMasterSecret shaInput", shaInput,
41404140
PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4141+
wc_MemZero_Add("MakeSslMasterSecret shaOutput", shaOutput,
4142+
WC_SHA_DIGEST_SIZE);
41414143
#endif
41424144

41434145
XMEMSET(shaOutput, 0, WC_SHA_DIGEST_SIZE);
@@ -4200,9 +4202,11 @@ static int MakeSslMasterSecret(WOLFSSL* ssl)
42004202

42014203
ForceZero(md5Input, ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
42024204
ForceZero(shaInput, PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4205+
ForceZero(shaOutput, WC_SHA_DIGEST_SIZE);
42034206
#ifdef WOLFSSL_CHECK_MEM_ZERO
42044207
wc_MemZero_Check(md5Input, ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
42054208
wc_MemZero_Check(shaInput, PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4209+
wc_MemZero_Check(shaOutput, WC_SHA_DIGEST_SIZE);
42064210
#endif
42074211

42084212
WC_FREE_VAR_EX(shaOutput, NULL, DYNAMIC_TYPE_TMP_BUFFER);

src/sniffer.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7591,11 +7591,15 @@ static int parseKeyLogFile(const char* fileName, char* error)
75917591

75927592
if (ret != 0) {
75937593
fclose(file);
7594+
ForceZero(secret, SECRET_LENGTH);
7595+
ForceZero(secretHex, sizeof(secretHex));
75947596
return ret;
75957597
}
75967598
}
75977599
fclose(file);
75987600

7601+
ForceZero(secret, SECRET_LENGTH);
7602+
ForceZero(secretHex, sizeof(secretHex));
75997603
return 0;
76007604
}
76017605

@@ -7613,6 +7617,7 @@ static void freeSecretList(void)
76137617

76147618
while (current != NULL) {
76157619
next = current->next;
7620+
ForceZero(current, sizeof(SecretNode));
76167621
XFREE(current, NULL, DYNAMIC_TYPE_SNIFFER_KEYLOG_NODE);
76177622
current = next;
76187623
}

src/tls13.c

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1038,22 +1038,28 @@ int Tls13_Exporter(WOLFSSL* ssl, unsigned char *out, size_t outLen,
10381038
protocol, protocolLen, (byte*)label, (word32)labelLen,
10391039
emptyHash, hashLen, (int)hashType);
10401040
if (ret != 0)
1041-
return ret;
1041+
goto cleanup;
10421042

10431043
/* Sanity check contextLen to prevent truncation when cast to word32. */
10441044
if (contextLen > WOLFSSL_MAX_32BIT) {
1045-
return BAD_FUNC_ARG;
1045+
ret = BAD_FUNC_ARG;
1046+
goto cleanup;
10461047
}
10471048

10481049
/* Hash(context_value) */
10491050
ret = wc_Hash(hashType, context, (word32)contextLen, hashOut, WC_MAX_DIGEST_SIZE);
10501051
if (ret != 0)
1051-
return ret;
1052+
goto cleanup;
10521053

10531054
ret = Tls13HKDFExpandLabel(ssl, out, (word32)outLen, firstExpand, hashLen,
10541055
protocol, protocolLen, exporterLabel, EXPORTER_LABEL_SZ,
10551056
hashOut, hashLen, (int)hashType);
10561057

1058+
cleanup:
1059+
/* firstExpand is the per-label Derive-Secret PRK and hashOut holds
1060+
* Hash(context_value); wipe both before the stack frame is reclaimed. */
1061+
ForceZero(firstExpand, sizeof(firstExpand));
1062+
ForceZero(hashOut, sizeof(hashOut));
10571063
return ret;
10581064
}
10591065
#endif

0 commit comments

Comments
 (0)