Erase private key data after use

3 files changed, 17 insertions, 3 deletions

diff --git a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp
index d4fa2ede559..089b56d177a 100644
--- a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp
+++ b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.cpp
@@ -36,11 +36,18 @@ TransportSecurityOptions::TransportSecurityOptions(vespalib::string ca_certs_pem
 {
 }
 
+void secure_memzero(void* buf, size_t size) noexcept {
+    OPENSSL_cleanse(buf, size);
+}
+
 TransportSecurityOptions::Builder::Builder() = default;
-TransportSecurityOptions::Builder::~Builder() = default;
+
+TransportSecurityOptions::Builder::~Builder() {
+    secure_memzero(&_private_key_pem[0], _private_key_pem.size());
+}
 
 TransportSecurityOptions::~TransportSecurityOptions() {
-    OPENSSL_cleanse(&_private_key_pem[0], _private_key_pem.size());
+    secure_memzero(&_private_key_pem[0], _private_key_pem.size());
 }
 
 } // vespalib::net::tls
diff --git a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h
index 647e290d985..fe0c7ead840 100644
--- a/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h
+++ b/vespalib/src/vespa/vespalib/net/tls/transport_security_options.h
@@ -61,4 +61,9 @@ public:
     const std::vector<vespalib::string>& accepted_ciphers() const noexcept { return _accepted_ciphers; }
 };
 
+// Zeroes out `size` bytes in `buf` in a way that shall never be optimized
+// away by an eager compiler.
+// TODO move to own crypto utility library
+void secure_memzero(void* buf, size_t size) noexcept;
+
 } // vespalib::net::tls
diff --git a/vespalib/src/vespa/vespalib/net/tls/transport_security_options_reading.cpp b/vespalib/src/vespa/vespalib/net/tls/transport_security_options_reading.cpp
index 0c29932699e..288d80010f7 100644
--- a/vespalib/src/vespa/vespalib/net/tls/transport_security_options_reading.cpp
+++ b/vespalib/src/vespa/vespalib/net/tls/transport_security_options_reading.cpp
@@ -124,13 +124,15 @@ std::unique_ptr<TransportSecurityOptions> load_from_input(Input& input) {
     auto authorized_peers = parse_authorized_peers(root["authorized-peers"]);
     auto accepted_ciphers = parse_accepted_ciphers(root["accepted-ciphers"]);
 
-    return std::make_unique<TransportSecurityOptions>(
+    auto options = std::make_unique<TransportSecurityOptions>(
             TransportSecurityOptions::Builder()
                 .ca_certs_pem(ca_certs)
                 .cert_chain_pem(certs)
                 .private_key_pem(priv_key)
                 .authorized_peers(std::move(authorized_peers))
                 .accepted_ciphers(std::move(accepted_ciphers)));
+    secure_memzero(&priv_key[0], priv_key.size());
+    return options;
 }
 
 } // anon ns