Print this page
9642 PKCS#11 softtoken should use explicit_bzero
Reviewed by: Dan McDonald <danmcd@joyent.com>
Reviewed by: Alex Wilson <alex.wilson@joyent.com>

*** 20,29 **** --- 20,30 ---- */ /* * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. * Copyright 2014 Nexenta Systems, Inc. All rights reserved. + * Copyright (c) 2018, Joyent, Inc. */ #include <pthread.h> #include <stdlib.h> #include <string.h>
*** 486,503 **** * operation will be terminated so we need to do some cleanup. */ cleanup: (void) pthread_mutex_lock(&session_p->session_mutex); aes_ctx = (aes_ctx_t *)soft_aes_ctx->aes_cbc; ! if (aes_ctx != NULL) { ! bzero(aes_ctx->ac_keysched, aes_ctx->ac_keysched_len); ! free(soft_aes_ctx->aes_cbc); } ! ! bzero(soft_aes_ctx->key_sched, soft_aes_ctx->keysched_len); ! free(soft_aes_ctx->key_sched); ! free(session_p->encrypt.context); session_p->encrypt.context = NULL; (void) pthread_mutex_unlock(&session_p->session_mutex); return (rv); } --- 487,511 ---- * operation will be terminated so we need to do some cleanup. */ cleanup: (void) pthread_mutex_lock(&session_p->session_mutex); aes_ctx = (aes_ctx_t *)soft_aes_ctx->aes_cbc; ! switch (mechanism) { ! case CKM_AES_ECB: ! freezero(aes_ctx, sizeof (ecb_ctx_t)); ! break; ! case CKM_AES_CMAC: ! case CKM_AES_CBC: ! case CKM_AES_CBC_PAD: ! freezero(aes_ctx, sizeof (cbc_ctx_t)); ! break; ! case CKM_AES_CTR: ! freezero(aes_ctx, sizeof (ctr_ctx_t)); ! break; } ! freezero(soft_aes_ctx->key_sched, soft_aes_ctx->keysched_len); ! freezero(session_p->encrypt.context, sizeof (soft_aes_ctx_t)); session_p->encrypt.context = NULL; (void) pthread_mutex_unlock(&session_p->session_mutex); return (rv); }
*** 849,866 **** * operation will be terminated so we need to do some cleanup. */ cleanup: (void) pthread_mutex_lock(&session_p->session_mutex); aes_ctx = (aes_ctx_t *)soft_aes_ctx->aes_cbc; ! if (aes_ctx != NULL) { ! bzero(aes_ctx->ac_keysched, aes_ctx->ac_keysched_len); ! free(soft_aes_ctx->aes_cbc); ! } ! ! bzero(soft_aes_ctx->key_sched, soft_aes_ctx->keysched_len); ! free(soft_aes_ctx->key_sched); ! free(session_p->decrypt.context); session_p->decrypt.context = NULL; (void) pthread_mutex_unlock(&session_p->session_mutex); return (rv); } --- 857,869 ---- * operation will be terminated so we need to do some cleanup. */ cleanup: (void) pthread_mutex_lock(&session_p->session_mutex); aes_ctx = (aes_ctx_t *)soft_aes_ctx->aes_cbc; ! free(aes_ctx); ! freezero(soft_aes_ctx->key_sched, soft_aes_ctx->keysched_len); ! freezero(session_p->decrypt.context, sizeof (soft_aes_ctx_t)); session_p->decrypt.context = NULL; (void) pthread_mutex_unlock(&session_p->session_mutex); return (rv); }