Skip to content

Commit 5d2e667

Browse files
committed
zero sensitive material before free
1 parent d315002 commit 5d2e667

5 files changed

Lines changed: 27 additions & 4 deletions

File tree

src/dtls13.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2388,7 +2388,10 @@ static Dtls13Epoch* Dtls13NewEpochSlot(WOLFSSL* ssl)
23882388
WOLFSSL_MSG_EX("Delete epoch: %d", e->epochNumber);
23892389
#endif /* WOLFSSL_DEBUG_TLS */
23902390

2391-
XMEMSET(e, 0, sizeof(*e));
2391+
/* The slot we are reusing holds the previous epoch's symmetric keys, IVs,
2392+
* and sn-keys; use ForceZero so the wipe cannot be elided by the
2393+
* optimizer when the slot is later overwritten. */
2394+
ForceZero(e, sizeof(*e));
23922395

23932396
return e;
23942397
}

src/internal.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9122,6 +9122,11 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
91229122
#ifdef WOLFSSL_DTLS13
91239123
Dtls13FreeFsmResources(ssl);
91249124

9125+
/* Zero per-epoch symmetric keys / IVs / sn-keys so they are not left
9126+
* resident in the heap after FreeSSL releases the SSL struct. Mirrors
9127+
* the existing ForceZero on ssl->keys and ssl->clientSecret/serverSecret. */
9128+
ForceZero(ssl->dtls13Epochs, sizeof(ssl->dtls13Epochs));
9129+
91259130
#ifdef WOLFSSL_RW_THREADED
91269131
wc_FreeMutex(&ssl->dtls13Rtx.mutex);
91279132
#endif

src/keys.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4138,6 +4138,8 @@ static int MakeSslMasterSecret(WOLFSSL* ssl)
41384138
ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
41394139
wc_MemZero_Add("MakeSslMasterSecret shaInput", shaInput,
41404140
PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4141+
wc_MemZero_Add("MakeSslMasterSecret shaOutput", shaOutput,
4142+
WC_SHA_DIGEST_SIZE);
41414143
#endif
41424144

41434145
XMEMSET(shaOutput, 0, WC_SHA_DIGEST_SIZE);
@@ -4200,9 +4202,11 @@ static int MakeSslMasterSecret(WOLFSSL* ssl)
42004202

42014203
ForceZero(md5Input, ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
42024204
ForceZero(shaInput, PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4205+
ForceZero(shaOutput, WC_SHA_DIGEST_SIZE);
42034206
#ifdef WOLFSSL_CHECK_MEM_ZERO
42044207
wc_MemZero_Check(md5Input, ENCRYPT_LEN + WC_SHA_DIGEST_SIZE);
42054208
wc_MemZero_Check(shaInput, PREFIX + ENCRYPT_LEN + 2 * RAN_LEN);
4209+
wc_MemZero_Check(shaOutput, WC_SHA_DIGEST_SIZE);
42064210
#endif
42074211

42084212
WC_FREE_VAR_EX(shaOutput, NULL, DYNAMIC_TYPE_TMP_BUFFER);

src/sniffer.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7587,11 +7587,15 @@ static int parseKeyLogFile(const char* fileName, char* error)
75877587

75887588
if (ret != 0) {
75897589
fclose(file);
7590+
ForceZero(secret, SECRET_LENGTH);
7591+
ForceZero(secretHex, sizeof(secretHex));
75907592
return ret;
75917593
}
75927594
}
75937595
fclose(file);
75947596

7597+
ForceZero(secret, SECRET_LENGTH);
7598+
ForceZero(secretHex, sizeof(secretHex));
75957599
return 0;
75967600
}
75977601

@@ -7609,6 +7613,7 @@ static void freeSecretList(void)
76097613

76107614
while (current != NULL) {
76117615
next = current->next;
7616+
ForceZero(current, sizeof(SecretNode));
76127617
XFREE(current, NULL, DYNAMIC_TYPE_SNIFFER_KEYLOG_NODE);
76137618
current = next;
76147619
}

src/tls13.c

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1038,22 +1038,28 @@ int Tls13_Exporter(WOLFSSL* ssl, unsigned char *out, size_t outLen,
10381038
protocol, protocolLen, (byte*)label, (word32)labelLen,
10391039
emptyHash, hashLen, (int)hashType);
10401040
if (ret != 0)
1041-
return ret;
1041+
goto cleanup;
10421042

10431043
/* Sanity check contextLen to prevent truncation when cast to word32. */
10441044
if (contextLen > WOLFSSL_MAX_32BIT) {
1045-
return BAD_FUNC_ARG;
1045+
ret = BAD_FUNC_ARG;
1046+
goto cleanup;
10461047
}
10471048

10481049
/* Hash(context_value) */
10491050
ret = wc_Hash(hashType, context, (word32)contextLen, hashOut, WC_MAX_DIGEST_SIZE);
10501051
if (ret != 0)
1051-
return ret;
1052+
goto cleanup;
10521053

10531054
ret = Tls13HKDFExpandLabel(ssl, out, (word32)outLen, firstExpand, hashLen,
10541055
protocol, protocolLen, exporterLabel, EXPORTER_LABEL_SZ,
10551056
hashOut, hashLen, (int)hashType);
10561057

1058+
cleanup:
1059+
/* firstExpand is the per-label Derive-Secret PRK and hashOut holds
1060+
* Hash(context_value); wipe both before the stack frame is reclaimed. */
1061+
ForceZero(firstExpand, sizeof(firstExpand));
1062+
ForceZero(hashOut, sizeof(hashOut));
10571063
return ret;
10581064
}
10591065
#endif

0 commit comments

Comments
 (0)