<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi Tobias,<br></div><div><br data-mce-bogus="1"></div><div>Thank you for your answer. I tested the branch and it works for me.<br data-mce-bogus="1"></div><div>For the mmap, I'm not expert and I use Strongswan under FreeBSD so I'm not sure the behavior is the same.</div><div>However since decrypted private key blobs are written in the mmap chunk, memory should be allocated somewhere. This memory can be read by some other rogue processes later if not wiped properly.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>In src/swanctl/commands/load_creds.c:load_containers(), a call to chunk_unmap_clear() should be done too maybe ?<br data-mce-bogus="1"></div><div>The static buffer returned by getpass() calls in swanctl should be wiped too after use.</div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Tobias Brunner" <tobias@strongswan.org><br><b>À: </b>"jean-francois hren" <jean-francois.hren@stormshield.eu>, "dev" <dev@lists.strongswan.org><br><b>Envoyé: </b>Jeudi 30 Septembre 2021 15:42:18<br><b>Objet: </b>Re: [strongSwan-dev] Memwipe of loaded secrets through VICI<br></div><div><br></div><div data-marker="__QUOTED_TEXT__">Hi Jean-Francois,<br><br>Thanks for the report and patch. I pushed several of these fixes (some <br>with modifications) to the wipe-secrets branch, plus also added code to <br>wipe the swanctl.conf file from memory in swanctl.<br><br>I'm not entirely sure about the chunk_map() changes, though. As far as <br>I can tell, after munmap() has been called, the process can't access <br>that memory anymore (causes a segmentation fault). And mapping the same <br>memory with MAP_ANONYMOUS and MAP_UNINITIALIZED (to prevent the <br>initialization of the non-file backed area to zero) doesn't seem <br>possible on generic kernels as it requires the <br>CONFIG_MMAP_ALLOW_UNINITIALIZED kernel option, which is usually not <br>enabled for security reasons. But since it's useful on platform that <br>don't provide mmap() (e.g. Windows), I still pushed patches.<br><br>Let me know what you think.<br><br>Regards,<br>Tobias<br></div></div></body></html>