From: Maxim Dounin <mdounin@mdounin.ru>
Date: Wed, 12 Oct 2022 17:14:43 +0000 (+0300)
Subject: SSL: explicit clearing of expired sessions.
X-Git-Tag: release-1.23.2~11
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/postgres_fdw.c?a=commitdiff_plain;h=3057e6e9ad3ccb0be5cd1546697871cfec4d1fa3;p=nginx.git

SSL: explicit clearing of expired sessions.

This reduces lifetime of session keying material in server's memory, and
therefore can be beneficial from forward secrecy point of view.
---

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 24b17f985..ec4aa8f59 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -4031,6 +4031,8 @@ ngx_ssl_get_cached_session(ngx_ssl_conn_t *ssl_conn,
 
             ngx_rbtree_delete(&cache->session_rbtree, node);
 
+            ngx_explicit_memzero(sess_id->session, sess_id->len);
+
 #if (NGX_PTR_SIZE == 8)
             ngx_slab_free_locked(shpool, sess_id->session);
 #endif
@@ -4120,6 +4122,8 @@ ngx_ssl_remove_session(SSL_CTX *ssl, ngx_ssl_session_t *sess)
 
             ngx_rbtree_delete(&cache->session_rbtree, node);
 
+            ngx_explicit_memzero(sess_id->session, sess_id->len);
+
 #if (NGX_PTR_SIZE == 8)
             ngx_slab_free_locked(shpool, sess_id->session);
 #endif
@@ -4168,6 +4172,8 @@ ngx_ssl_expire_sessions(ngx_ssl_session_cache_t *cache,
 
         ngx_rbtree_delete(&cache->session_rbtree, &sess_id->node);
 
+        ngx_explicit_memzero(sess_id->session, sess_id->len);
+
 #if (NGX_PTR_SIZE == 8)
         ngx_slab_free_locked(shpool, sess_id->session);
 #endif