erase cookie data before forking to unprivileged process.

src/cookies-gdbm.c

@@ -39,7 +39,7 @@
 #ifdef HAVE_GDBM
 
 static
-int store_cookie_gdbm(main_server_st *s, struct stored_cookie_st* sc)
+int cookie_gdbm_store(main_server_st *s, struct stored_cookie_st* sc)
 {
 GDBM_FILE dbf;
 datum key;
@@ -72,7 +72,7 @@ finish:
 }
 
 static
-int retrieve_cookie_gdbm(main_server_st *s, const void* cookie, unsigned cookie_size, 
+int cookie_gdbm_retrieve(main_server_st *s, const void* cookie, unsigned cookie_size, 
 			struct stored_cookie_st* sc)
 {
 GDBM_FILE dbf;
@@ -107,7 +107,7 @@ finish:
 }
 
 static
-void expire_cookies_gdbm(main_server_st* s)
+void cookie_gdbm_expire(main_server_st* s)
 {
 GDBM_FILE dbf;
 datum key;
@@ -148,23 +148,30 @@ finish:
 }
 
 static
-int cookie_db_init_gdbm(main_server_st* s)
+int cookie_gdbm_init(main_server_st* s)
 {
 	return 0;
 }
 
 static
-void cookie_db_deinit_gdbm(main_server_st* s)
+void cookie_gdbm_erase(main_server_st* s)
+{
+	return;
+}
+
+static
+void cookie_gdbm_deinit(main_server_st* s)
 {
         return;
 }
 
 struct cookie_storage_st gdbm_cookie_funcs = {
-	.store = store_cookie_gdbm,
-	.retrieve = retrieve_cookie_gdbm,
-	.expire = expire_cookies_gdbm,
-	.init = cookie_db_init_gdbm,
-	.deinit = cookie_db_deinit_gdbm,
+	.store = cookie_gdbm_store,
+	.retrieve = cookie_gdbm_retrieve,
+	.expire = cookie_gdbm_expire,
+	.init = cookie_gdbm_init,
+	.deinit = cookie_gdbm_deinit,
+	.erase = cookie_gdbm_erase,
 };
 
 #endif

src/cookies-hash.c

@@ -102,6 +102,24 @@ time_t now = time(0);
         }
 }
 
+void erase_cookies_hash(main_server_st* s)
+{
+struct stored_cookie_st *sc;
+struct htable_iter iter;
+time_t now = time(0);
+
+	sc = htable_first(&s->cookie_db->ht, &iter);
+	while(sc != NULL) {
+		if (sc->expiration <= now) {
+	          	htable_delval(&s->cookie_db->ht, &iter);
+	          	memset(sc->cookie, 0, sizeof(sc->cookie));
+	          	free(sc);
+			s->cookie_db->entries--;
+		}
+          	sc = htable_next(&s->cookie_db->ht, &iter);
+        }
+}
+
 static size_t rehash(const void *_e, void *unused)
 {
 const struct stored_cookie_st *e = _e;
@@ -145,6 +163,7 @@ struct cookie_storage_st hash_cookie_funcs = {
 	.store = store_cookie_hash,
 	.retrieve = retrieve_cookie_hash,
 	.expire = expire_cookies_hash,
+	.erase = erase_cookies_hash,
 	.init = cookie_db_init_hash,
 	.deinit = cookie_db_deinit_hash,
 };

src/cookies.c

@@ -40,6 +40,7 @@ cookie_store_fn store_cookie;
 cookie_retrieve_fn retrieve_cookie;
 cookie_db_deinit_fn cookie_db_deinit;
 cookie_expire_fn expire_cookies;
+cookie_expire_fn erase_cookies;
 
 int cookie_db_init(main_server_st* s)
 {
@@ -54,6 +55,7 @@ struct cookie_storage_st* funcs;
 
 	cookie_db_deinit = funcs->deinit;
 	expire_cookies = funcs->expire;
+	erase_cookies = funcs->erase;
 	store_cookie = funcs->store;
 	retrieve_cookie = funcs->retrieve;
 

src/cookies.h

@@ -24,6 +24,7 @@ extern cookie_store_fn store_cookie;
 extern cookie_retrieve_fn retrieve_cookie;
 extern cookie_db_deinit_fn cookie_db_deinit;
 extern cookie_expire_fn expire_cookies;
+extern cookie_expire_fn erase_cookies;
 
 int cookie_db_init(main_server_st*);
 
@@ -32,6 +33,7 @@ struct cookie_storage_st {
 	cookie_store_fn store;
 	cookie_retrieve_fn retrieve;
 	cookie_expire_fn expire;
+	cookie_expire_fn erase; /* erases cookies if stored in process */
 	int (*init)(main_server_st *);
 	cookie_db_deinit_fn deinit;
 };

src/main.c

@@ -617,12 +617,14 @@ int main(int argc, char** argv)
 
 				pid = fork();
 				if (pid == 0) {	/* child */
-					/* close any open descriptors before
-					 * running the server
+					/* close any open descriptors, and erase
+					 * sensitive data before running the worker
 					 */
-					setproctitle(PACKAGE_NAME"-worker");
 					close(cmd_fd[0]);
 					clear_lists(&s);
+					erase_cookies(&s);
+
+					setproctitle(PACKAGE_NAME"-worker");
 
 					ws.config = &config;
 					ws.cmd_fd = cmd_fd[1];

src/sample.config

@@ -63,7 +63,7 @@ tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
 # which he can reconnect. This option sets the maximum lifetime
 # of that cookie.
 cookie-validity = 14400
-cookie-db = /var/tmp/vpn-cookies.db
+#cookie-db = /var/tmp/vpn-cookies.db
 
 run-as-user = nobody
 run-as-group = nogroup