Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement OpenSSL secure memory for Windows #13172

Closed
wants to merge 5 commits into from
Closed

Implement OpenSSL secure memory for Windows #13172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6de0ea5
Implement OpenSSL secure memory for Windows
jgowdy Oct 18, 2020
2302e52
Remove useless memset
jgowdy Oct 19, 2020
539cbff
Fix indentation
jgowdy Oct 19, 2020
fb4240f
Fix indentation / style
jgowdy Oct 19, 2020
9644d1d
Missing backslash
jgowdy Oct 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
50 changes: 45 additions & 5 deletions crypto/mem_sec.c
View file
Open in desktop
Expand Up @@ -21,11 +21,18 @@
#include <string.h>

#ifndef OPENSSL_NO_SECURE_MEMORY
# if defined(_WIN32)
# include <windows.h>
# endif
# include <stdlib.h>
# include <assert.h>
# include <unistd.h>
# if defined(OPENSSL_SYS_UNIX)
# include <unistd.h>
# endif
# include <sys/types.h>
# include <sys/mman.h>
# if defined(OPENSSL_SYS_UNIX)
# include <sys/mman.h>
# endif
# if defined(OPENSSL_SYS_LINUX)
# include <sys/syscall.h>
# if defined(SYS_mlock2)
Expand Down Expand Up @@ -375,6 +382,10 @@ static int sh_init(size_t size, size_t minsize)
size_t i;
size_t pgsize;
size_t aligned;
#if defined(_WIN32)
DWORD flOldProtect;
SYSTEM_INFO systemInfo;
#endif

memset(&sh, 0, sizeof(sh));

Expand Down Expand Up @@ -446,15 +457,19 @@ static int sh_init(size_t size, size_t minsize)
else
pgsize = (size_t)tmppgsize;
}
#elif defined(_WIN32)
GetSystemInfo(&systemInfo);
pgsize = (size_t)systemInfo.dwPageSize;
#else
pgsize = PAGE_SIZE;
#endif
sh.map_size = pgsize + sh.arena_size + pgsize;

#ifdef MAP_ANON
#if !defined(_WIN32)
paulidale marked this conversation as resolved.
Show resolved Hide resolved
# ifdef MAP_ANON
sh.map_result = mmap(NULL, sh.map_size,
PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, -1, 0);
#else
# else
{
int fd;

Expand All @@ -465,24 +480,41 @@ static int sh_init(size_t size, size_t minsize)
close(fd);
}
}
#endif
# endif
if (sh.map_result == MAP_FAILED)
goto err;
#else
sh.map_result = VirtualAlloc(NULL, sh.map_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

if (sh.map_result == NULL)
goto err;
#endif

sh.arena = (char *)(sh.map_result + pgsize);
sh_setbit(sh.arena, 0, sh.bittable);
sh_add_to_list(&sh.freelist[0], sh.arena);

/* Now try to add guard pages and lock into memory. */
ret = 1;

#if !defined(_WIN32)
/* Starting guard is already aligned from mmap. */
if (mprotect(sh.map_result, pgsize, PROT_NONE) < 0)
ret = 2;
#else
if (VirtualProtect(sh.map_result, pgsize, PAGE_NOACCESS, &flOldProtect) == FALSE)
ret = 2;
#endif

/* Ending guard page - need to round up to page boundary */
aligned = (pgsize + sh.arena_size + (pgsize - 1)) & ~(pgsize - 1);
#if !defined(_WIN32)
if (mprotect(sh.map_result + aligned, pgsize, PROT_NONE) < 0)
ret = 2;
#else
if (VirtualProtect(sh.map_result + aligned, pgsize, PAGE_NOACCESS, &flOldProtect) == FALSE)
ret = 2;
#endif

#if defined(OPENSSL_SYS_LINUX) && defined(MLOCK_ONFAULT) && defined(SYS_mlock2)
if (syscall(SYS_mlock2, sh.arena, sh.arena_size, MLOCK_ONFAULT) < 0) {
Expand All @@ -493,6 +525,9 @@ static int sh_init(size_t size, size_t minsize)
ret = 2;
}
}
#elif defined(_WIN32)
if (VirtualLock(sh.arena, sh.arena_size) == FALSE)
mattcaswell marked this conversation as resolved.
Show resolved Hide resolved
ret = 2;
#else
if (mlock(sh.arena, sh.arena_size) < 0)
ret = 2;
Expand All @@ -514,8 +549,13 @@ static void sh_done(void)
OPENSSL_free(sh.freelist);
OPENSSL_free(sh.bittable);
OPENSSL_free(sh.bitmalloc);
#if !defined(_WIN32)
if (sh.map_result != MAP_FAILED && sh.map_size)
munmap(sh.map_result, sh.map_size);
#else
if (sh.map_result != NULL && sh.map_size)
VirtualFree(sh.map_result, 0, MEM_RELEASE);
#endif
memset(&sh, 0, sizeof(sh));
}

Expand Down
9 changes: 5 additions & 4 deletions e_os.h
View file
Open in desktop
Expand Up @@ -359,10 +359,11 @@ inline int nssgetpid();

# ifndef OPENSSL_NO_SECURE_MEMORY
/* unistd.h defines _POSIX_VERSION */
# if defined(OPENSSL_SYS_UNIX) \
&& ( (defined(_POSIX_VERSION) && _POSIX_VERSION >= 200112L) \
|| defined(__sun) || defined(__hpux) || defined(__sgi) \
|| defined(__osf__) )
# if (defined(OPENSSL_SYS_UNIX) \
&& ( (defined(_POSIX_VERSION) && _POSIX_VERSION >= 200112L) \
|| defined(__sun) || defined(__hpux) || defined(__sgi) \
|| defined(__osf__) )) \
|| defined(_WIN32)
/* secure memory is implemented */
# else
# define OPENSSL_NO_SECURE_MEMORY
Expand Down