Differential D25442

Use zfree() to explicitly zero IPsec keys.
ClosedPublic
Actions

Authored by jhb on Jun 25 2020, 12:42 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Wed, Oct 1, 10:31 AM

	Unknown Object (File)
	Tue, Sep 30, 9:29 PM

	Unknown Object (File)
	Sun, Sep 28, 9:11 PM

	Unknown Object (File)
	Wed, Sep 24, 2:12 AM

	Unknown Object (File)
	Mon, Sep 22, 2:15 AM

	Unknown Object (File)
	Sep 15 2025, 9:50 PM

	Unknown Object (File)
	Aug 15 2025, 1:00 AM

	Unknown Object (File)
	Aug 6 2025, 1:54 PM

View All 82 Files

Subscribers

Details

Reviewers

delphij
cem

Commits

rS362632: Use zfree() to explicitly zero IPsec keys.

Test Plan

tested with IPsec tunnels over IPv4 (AES-CBC + SHA1 and AES-GCM) and IPv6 (AES-GCM) and using setkey -F to clear state after

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

jhb created this revision.Jun 25 2020, 12:42 AM

Herald added subscribers: melifaro, ae. · View Herald TranscriptJun 25 2020, 12:42 AM

jhb requested review of this revision.Jun 25 2020, 12:42 AM

Harbormaster completed remote builds in B31945: Diff 73614.Jun 25 2020, 12:42 AM

jhb added a child revision: D25443: Simplify IPsec transform-specific teardown..Jun 25 2020, 12:43 AM

No interest in ipsec.

I think setting tdb_xform to NULL is no longer needed (as they are about to be done by the caller anyway).

sys/netipsec/xform_ah.c
256 ↗	(On Diff #73614)	Looks like this is redundant too? (Already done by caller, key_cleansav).
sys/netipsec/xform_esp.c
250 ↗	(On Diff #73614)	Looks like this is redundant too? (Already done by caller, key_cleansav).
sys/netipsec/xform_tcp.c
368 ↗	(On Diff #73614)	Looks like this is redundant too? (Already done by caller, key_cleansav).

This revision is now accepted and ready to land.Jun 25 2020, 4:36 AM

In D25442#561674, @delphij wrote:

I think setting tdb_xform to NULL is no longer needed (as they are about to be done by the caller anyway).

Yes, I removed those in the followup change. Here I was trying to just focus on the key zeroing via zfree separate from the other change.

Closed by commit rS362632: Use zfree() to explicitly zero IPsec keys. (authored by jhb). · Explain WhyJun 25 2020, 8:31 PM

This revision was automatically updated to reflect the committed changes.

jhb added a commit: rS362632: Use zfree() to explicitly zero IPsec keys..

Herald added a subscriber: imp. · View Herald TranscriptJun 25 2020, 8:31 PM

Revision Contents
Changeset List

Path

Size

head/

sys/

netipsec/

14 lines

3 lines

4 lines

2 lines

Diff 73665

head/sys/netipsec/key.c

Loading...

head/sys/netipsec/xform_ah.c

Loading...

head/sys/netipsec/xform_esp.c

Loading...

head/sys/netipsec/xform_tcp.c

Loading...