[src/trunk]: src/sys/netipsec Use explicit_memset to surely zero-clear key_au...

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/72633f71af4a
branches:  trunk
changeset: 355036:72633f71af4a
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Mon Jul 10 07:17:12 2017 +0000

description:
Use explicit_memset to surely zero-clear key_auth and key_enc

diffstat:

 sys/netipsec/xform_ah.c  |  10 ++++++----
 sys/netipsec/xform_esp.c |  10 ++++++----
 sys/netipsec/xform_tcp.c |  10 ++++++----
 3 files changed, 18 insertions(+), 12 deletions(-)

diffs (93 lines):

diff -r f20422fef232 -r 72633f71af4a sys/netipsec/xform_ah.c
--- a/sys/netipsec/xform_ah.c   Mon Jul 10 00:27:32 2017 +0000
+++ b/sys/netipsec/xform_ah.c   Mon Jul 10 07:17:12 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: xform_ah.c,v 1.57 2017/07/07 01:37:34 ozaki-r Exp $    */
+/*     $NetBSD: xform_ah.c,v 1.58 2017/07/10 07:17:12 ozaki-r Exp $    */
 /*     $FreeBSD: src/sys/netipsec/xform_ah.c,v 1.1.4.1 2003/01/24 05:11:36 sam Exp $   */
 /*     $OpenBSD: ip_ah.c,v 1.63 2001/06/26 06:18:58 angelos Exp $ */
 /*
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_ah.c,v 1.57 2017/07/07 01:37:34 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_ah.c,v 1.58 2017/07/10 07:17:12 ozaki-r Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
@@ -249,8 +249,10 @@
 {
        int err;
 
-       if (sav->key_auth)
-               memset(_KEYBUF(sav->key_auth), 0, _KEYLEN(sav->key_auth));
+       if (sav->key_auth) {
+               explicit_memset(_KEYBUF(sav->key_auth), 0,
+                   _KEYLEN(sav->key_auth));
+       }
 
        err = crypto_freesession(sav->tdb_cryptoid);
        sav->tdb_cryptoid = 0;
diff -r f20422fef232 -r 72633f71af4a sys/netipsec/xform_esp.c
--- a/sys/netipsec/xform_esp.c  Mon Jul 10 00:27:32 2017 +0000
+++ b/sys/netipsec/xform_esp.c  Mon Jul 10 07:17:12 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: xform_esp.c,v 1.58 2017/07/07 01:37:34 ozaki-r Exp $   */
+/*     $NetBSD: xform_esp.c,v 1.59 2017/07/10 07:17:12 ozaki-r Exp $   */
 /*     $FreeBSD: src/sys/netipsec/xform_esp.c,v 1.2.2.1 2003/01/24 05:11:36 sam Exp $  */
 /*     $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
 
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.58 2017/07/07 01:37:34 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.59 2017/07/10 07:17:12 ozaki-r Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
@@ -283,8 +283,10 @@
        /* NB: ah_zerorize free's the crypto session state */
        int error = ah_zeroize(sav);
 
-       if (sav->key_enc)
-               memset(_KEYBUF(sav->key_enc), 0, _KEYLEN(sav->key_enc));
+       if (sav->key_enc) {
+               explicit_memset(_KEYBUF(sav->key_enc), 0,
+                   _KEYLEN(sav->key_enc));
+       }
        sav->tdb_encalgxform = NULL;
        sav->tdb_xform = NULL;
        return error;
diff -r f20422fef232 -r 72633f71af4a sys/netipsec/xform_tcp.c
--- a/sys/netipsec/xform_tcp.c  Mon Jul 10 00:27:32 2017 +0000
+++ b/sys/netipsec/xform_tcp.c  Mon Jul 10 07:17:12 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: xform_tcp.c,v 1.12 2017/06/29 07:13:41 ozaki-r Exp $ */
+/*     $NetBSD: xform_tcp.c,v 1.13 2017/07/10 07:17:12 ozaki-r Exp $ */
 /*     $FreeBSD: sys/netipsec/xform_tcp.c,v 1.1.2.1 2004/02/14 22:24:09 bms Exp $ */
 
 /*
@@ -31,7 +31,7 @@
 /* TCP MD5 Signature Option (RFC2385) */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_tcp.c,v 1.12 2017/06/29 07:13:41 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_tcp.c,v 1.13 2017/07/10 07:17:12 ozaki-r Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
@@ -123,8 +123,10 @@
 tcpsignature_zeroize(struct secasvar *sav)
 {
 
-       if (sav->key_auth)
-               memset(_KEYBUF(sav->key_auth), 0, _KEYLEN(sav->key_auth));
+       if (sav->key_auth) {
+               explicit_memset(_KEYBUF(sav->key_auth), 0,
+                   _KEYLEN(sav->key_auth));
+       }
 
        sav->tdb_cryptoid = 0;
        sav->tdb_authalgxform = NULL;