From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sabrina Dubroca Subject: [PATCH net v2 0/3] tls: don't leave keys in kernel memory Date: Wed, 12 Sep 2018 17:44:40 +0200 Message-ID: Cc: Sabrina Dubroca , Aviad Yehezkel , Boris Pismenny , Dave Watson , Vakul Garg To: netdev@vger.kernel.org Return-path: Received: from mx3-rdu2.redhat.com ([66.187.233.73]:60280 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726640AbeILUtf (ORCPT ); Wed, 12 Sep 2018 16:49:35 -0400 Sender: netdev-owner@vger.kernel.org List-ID: There are a few places where the RX/TX key for a TLS socket is copied to kernel memory. This series clears those memory areas when they're no longer needed. v2: add union tls_crypto_context, following Vakul Garg's comment swap patch 2 and 3, using new union in patch 3 Sabrina Dubroca (3): tls: don't copy the key out of tls12_crypto_info_aes_gcm_128 tls: zero the crypto information from tls_context before freeing tls: clear key material from kernel memory when do_tls_setsockopt_conf fails include/net/tls.h | 19 +++++++++---------- net/tls/tls_device.c | 6 +++--- net/tls/tls_device_fallback.c | 2 +- net/tls/tls_main.c | 22 ++++++++++++++++------ net/tls/tls_sw.c | 13 +++++-------- 5 files changed, 34 insertions(+), 28 deletions(-) -- 2.18.0