IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

QUIC: zero out existing keying material only.

Browse Source 
Previously, this used to have extra ngx_explicit_memzero() calls
from within ngx_quic_keys_cleanup(), which might be suboptimal.
This commit is contained in:
Sergey Kandaurov 2024-08-09 19:12:26 +04:00
parent 58b92177e7
commit 504c78fc6d
1 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/event/quic/ngx_event_quic_protection.c
View File

@ -743,8 +743,15 @@ ngx_quic_keys_discard(ngx_quic_keys_t *keys,
ngx_quic_crypto_hp_cleanup(client); ngx_quic_crypto_hp_cleanup(client);
ngx_quic_crypto_hp_cleanup(server); ngx_quic_crypto_hp_cleanup(server);
ngx_explicit_memzero(client->secret.data, client->secret.len); if (client->secret.len) {
ngx_explicit_memzero(server->secret.data, server->secret.len); ngx_explicit_memzero(client->secret.data, client->secret.len);
client->secret.len = 0;
}
if (server->secret.len) {
ngx_explicit_memzero(server->secret.data, server->secret.len);
server->secret.len = 0;
}
} }
@ -844,6 +851,9 @@ ngx_quic_keys_update(ngx_event_t *ev)
ngx_explicit_memzero(current->server.secret.data, ngx_explicit_memzero(current->server.secret.data,
current->server.secret.len); current->server.secret.len);
current->client.secret.len = 0;
current->server.secret.len = 0;
ngx_explicit_memzero(client_key.data, client_key.len); ngx_explicit_memzero(client_key.data, client_key.len);
ngx_explicit_memzero(server_key.data, server_key.len); ngx_explicit_memzero(server_key.data, server_key.len);
@ -870,10 +880,17 @@ ngx_quic_keys_cleanup(ngx_quic_keys_t *keys)
ngx_quic_crypto_cleanup(&next->client); ngx_quic_crypto_cleanup(&next->client);
ngx_quic_crypto_cleanup(&next->server); ngx_quic_crypto_cleanup(&next->server);
ngx_explicit_memzero(next->client.secret.data, if (next->client.secret.len) {
next->client.secret.len); ngx_explicit_memzero(next->client.secret.data,
ngx_explicit_memzero(next->server.secret.data, next->client.secret.len);
next->server.secret.len); next->client.secret.len = 0;
}
if (next->server.secret.len) {
ngx_explicit_memzero(next->server.secret.data,
next->server.secret.len);
next->server.secret.len = 0;
}
} }