[#5218] Zero out private key copied to ByteBuf before release.
Motivation: We should zero-out the private key as soon as possible when we not need it anymore. Modifications: zero out the private key before release the buffer. Result: Limit the time the private key resist in memory.
This commit is contained in:
parent
2472d8c3cf
commit
b39c53ce17
@ -517,18 +517,24 @@ public abstract class OpenSslContext extends SslContext {
|
||||
try {
|
||||
buffer.writeBytes(encodedBuf);
|
||||
} finally {
|
||||
encodedBuf.release();
|
||||
zerooutAndRelease(encodedBuf);
|
||||
}
|
||||
} finally {
|
||||
wrappedBuf.release();
|
||||
zerooutAndRelease(wrappedBuf);
|
||||
}
|
||||
buffer.writeBytes(END_PRIVATE_KEY);
|
||||
return newBIO(buffer);
|
||||
} finally {
|
||||
buffer.release();
|
||||
// Zero out the buffer and so the private key it held.
|
||||
zerooutAndRelease(buffer);
|
||||
}
|
||||
}
|
||||
|
||||
private static void zerooutAndRelease(ByteBuf buffer) {
|
||||
buffer.setZero(0, buffer.capacity());
|
||||
buffer.release();
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the pointer to a <a href="https://www.openssl.org/docs/crypto/BIO_get_mem_ptr.html">in-memory BIO</a>
|
||||
* or {@code 0} if the {@code certChain} is {@code null}. The BIO contains the content of the {@code certChain}.
|
||||
|
Loading…
Reference in New Issue
Block a user