dnsdist: Use safe_memset if we have neither sodium nor gnutls_memset

diff --git a/pdns/dnsdistdist/m4/dnsdist_check_gnutls.m4 b/pdns/dnsdistdist/m4/dnsdist_check_gnutls.m4
index 4d8eaf784243de02fac4b680ba008f7d8db6eba4..77bb03f14ffddd898e931a36fdd8d1f50cd0821a 100644 (file)
--- a/pdns/dnsdistdist/m4/dnsdist_check_gnutls.m4
+++ b/pdns/dnsdistdist/m4/dnsdist_check_gnutls.m4
@@ -14,6 +14,14 @@ AC_DEFUN([DNSDIST_CHECK_GNUTLS], [
       PKG_CHECK_MODULES([GNUTLS], [gnutls >= 3.1.11], [
         [HAVE_GNUTLS=1]
         AC_DEFINE([HAVE_GNUTLS], [1], [Define to 1 if you have GnuTLS])
+        save_CFLAGS=$CFLAGS
+        save_LIBS=$LIBS
+        CFLAGS="$GNUTLS_CFLAGS $CFLAGS"
+        LIBS="$GNUTLS_LIBS $LIBS"
+        AC_CHECK_FUNCS([gnutls_memset])
+        CFLAGS=$save_CFLAGS
+        LIBS=$save_LIBS
+
       ], [ : ])
     ])
   ])

diff --git a/pdns/dnsdistdist/tcpiohandler.cc b/pdns/dnsdistdist/tcpiohandler.cc
index 4f8d11e12d3205b422156a0679c2fd2e3e3547a0..0408fcd92d0a9ea9108618a26989bc02da53d86a 100644 (file)
--- a/pdns/dnsdistdist/tcpiohandler.cc
+++ b/pdns/dnsdistdist/tcpiohandler.cc
@@ -543,6 +543,26 @@ std::atomic<uint64_t> OpenSSLTLSIOCtx::s_users(0);
 #include <gnutls/gnutls.h>
 #include <gnutls/x509.h>
 
+#ifndef HAVE_LIBSODIUM
+void safe_memset(void* data, int c, size_t size)
+{
+#ifdef HAVE_GNUTLS_MEMSET
+      gnutls_memset(data, c, size);
+#else
+      /* shamelessly taken from Dovecot's src/lib/safe-memset.c */
+      volatile unsigned int volatile_zero_idx = 0;
+      volatile unsigned char *p = reinterpret_cast<volatile unsigned char *>(data);
+
+      if (size == 0)
+        return;
+
+      do {
+        memset(data, c, size);
+      } while (p[volatile_zero_idx] != c);
+#endif /* HAVE_GNUTLS_MEMSET */
+}
+#endif /* HAVE_LIBSODIUM */
+
 class GnuTLSTicketsKey
 {
 public:
@@ -583,6 +603,8 @@ public:
     catch (const std::exception& e) {
 #ifdef HAVE_LIBSODIUM
       sodium_munlock(d_key.data, d_key.size);
+#else
+      safe_memset(d_key.data, 0, d_key.size);
 #endif /* HAVE_LIBSODIUM */
       gnutls_free(d_key.data);
       throw;
@@ -595,7 +617,7 @@ public:
 #ifdef HAVE_LIBSODIUM
       sodium_munlock(d_key.data, d_key.size);
 #else
-      gnutls_memset(d_key.data, 0, d_key.size);
+      safe_memset(d_key.data, 0, d_key.size);
 #endif /* HAVE_LIBSODIUM */
     }
     gnutls_free(d_key.data);