build: unconditionally use zeroize_key/zrelease_mpi_key

Since 39aaa63a1a4cb8432e090887f38241afb2b264a6, zeroize_temp_key is an
alias to zeroize_key, and zrelease_temp_mpi_key is an alias to
zrelease_mpi_key. Use the latter directly and also remove
_gnutls_free_temp_key_datum.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

diff --git a/lib/accelerated/aarch64/aes-cbc-aarch64.c b/lib/accelerated/aarch64/aes-cbc-aarch64.c
index f69cbf619b84ac7170418647b758d9955199e493..d6b01ee87bfc831af1b1b3f3489118a94f108d44 100644 (file)
--- a/lib/accelerated/aarch64/aes-cbc-aarch64.c
+++ b/lib/accelerated/aarch64/aes-cbc-aarch64.c
@@ -128,7 +128,7 @@ static void aes_deinit(void *_ctx)
 {
        struct aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/aarch64/aes-ccm-aarch64.c b/lib/accelerated/aarch64/aes-ccm-aarch64.c
index bac5fbf29d1fb856792bd3ba2cadeb599970eeba..d0a453abdb3d0cdbb0b4c0481426409c04cf2cd2 100644 (file)
--- a/lib/accelerated/aarch64/aes-ccm-aarch64.c
+++ b/lib/accelerated/aarch64/aes-ccm-aarch64.c
@@ -181,7 +181,7 @@ static void aes_ccm_deinit(void *_ctx)
 {
        struct ccm_aarch64_aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/aarch64/aes-gcm-aarch64.c b/lib/accelerated/aarch64/aes-gcm-aarch64.c
index b0c7d55898fba8be16f4da14deb71b46afe0c1da..dae200243cd2b8874533ce9ba1388cf68fc987af 100644 (file)
--- a/lib/accelerated/aarch64/aes-gcm-aarch64.c
+++ b/lib/accelerated/aarch64/aes-gcm-aarch64.c
@@ -74,7 +74,7 @@ static void aes_gcm_deinit(void *_ctx)
 {
        struct aes_gcm_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/aarch64/hmac-sha-aarch64.c b/lib/accelerated/aarch64/hmac-sha-aarch64.c
index ee34dab1f107f3e2883f67f904bbf85e5cf03972..46bf1ca3c0b0fea036bcf3dc6932fe9fc4352c5b 100644 (file)
--- a/lib/accelerated/aarch64/hmac-sha-aarch64.c
+++ b/lib/accelerated/aarch64/hmac-sha-aarch64.c
@@ -263,7 +263,7 @@ static void wrap_aarch64_hmac_deinit(void *hd)
 {
        struct aarch64_hmac_ctx *ctx = hd;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 
@@ -284,7 +284,7 @@ static int wrap_aarch64_hmac_fast(gnutls_mac_algorithm_t algo,
        ctx.update(&ctx, text_size, text);
        ctx.digest(&ctx, ctx.length, digest);
 
-       zeroize_temp_key(&ctx, sizeof(ctx));
+       zeroize_key(&ctx, sizeof(ctx));
 
        return 0;
 }

diff --git a/lib/accelerated/x86/aes-cbc-x86-aesni.c b/lib/accelerated/x86/aes-cbc-x86-aesni.c
index 04c10d1026335fcf011d73827b2938104b5618a3..9df5183d5bbe5954343723070be8ca8643445e4d 100644 (file)
--- a/lib/accelerated/x86/aes-cbc-x86-aesni.c
+++ b/lib/accelerated/x86/aes-cbc-x86-aesni.c
@@ -128,7 +128,7 @@ static void aes_deinit(void *_ctx)
 {
        struct aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-cbc-x86-ssse3.c b/lib/accelerated/x86/aes-cbc-x86-ssse3.c
index 5e38a4f2af379b60cfe1e1073c988bebb00038aa..4efe9fde74bf1d4ca52276d671127ab673397859 100644 (file)
--- a/lib/accelerated/x86/aes-cbc-x86-ssse3.c
+++ b/lib/accelerated/x86/aes-cbc-x86-ssse3.c
@@ -129,7 +129,7 @@ static void aes_deinit(void *_ctx)
 {
        struct aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-ccm-x86-aesni.c b/lib/accelerated/x86/aes-ccm-x86-aesni.c
index a413f2bd2e1d5e54363949a69f538595dd438f07..cc55ed6d8816a1e04c68b5ddc6c7e372d7765250 100644 (file)
--- a/lib/accelerated/x86/aes-ccm-x86-aesni.c
+++ b/lib/accelerated/x86/aes-ccm-x86-aesni.c
@@ -173,7 +173,7 @@ static void aes_ccm_deinit(void *_ctx)
 {
        struct ccm_x86_aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-gcm-padlock.c b/lib/accelerated/x86/aes-gcm-padlock.c
index 7772eb9ebedb4768775a1fb1bbd459f0d8841ece..7dbe572b928d4ebd2b5d8fbe20b7ab19f01e9e29 100644 (file)
--- a/lib/accelerated/x86/aes-gcm-padlock.c
+++ b/lib/accelerated/x86/aes-gcm-padlock.c
@@ -82,7 +82,7 @@ static void aes_gcm_deinit(void *_ctx)
 {
        struct gcm_padlock_aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-gcm-x86-aesni.c b/lib/accelerated/x86/aes-gcm-x86-aesni.c
index d7865ff9657dca9375c4aaaef5a3aa38a8eca31c..8f0d23e949f2283915dbb2377cac04ba0c2199d2 100644 (file)
--- a/lib/accelerated/x86/aes-gcm-x86-aesni.c
+++ b/lib/accelerated/x86/aes-gcm-x86-aesni.c
@@ -176,7 +176,7 @@ static void aes_gcm_deinit(void *_ctx)
 {
        struct gcm_x86_aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c b/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
index e2d972139c3125ad5fe8f1cc8a1f3b5ff596c829..1fc6a37bd060afcd9f550f228c7153ebb23c5264 100644 (file)
--- a/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
+++ b/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
@@ -73,7 +73,7 @@ static void aes_gcm_deinit(void *_ctx)
 {
        struct aes_gcm_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-gcm-x86-pclmul.c b/lib/accelerated/x86/aes-gcm-x86-pclmul.c
index faeef7988ffba7e647e36f6e153c441090c98257..bae4735a325cea968daaecfd3d4e0da0d1b1c21d 100644 (file)
--- a/lib/accelerated/x86/aes-gcm-x86-pclmul.c
+++ b/lib/accelerated/x86/aes-gcm-x86-pclmul.c
@@ -72,7 +72,7 @@ static void aes_gcm_deinit(void *_ctx)
 {
        struct aes_gcm_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-gcm-x86-ssse3.c b/lib/accelerated/x86/aes-gcm-x86-ssse3.c
index 6bad1a4977bdba282c9ec00c9990e95aee898b59..bb2fe3743da7cb47695a4945015c10c4d3f1b9c2 100644 (file)
--- a/lib/accelerated/x86/aes-gcm-x86-ssse3.c
+++ b/lib/accelerated/x86/aes-gcm-x86-ssse3.c
@@ -185,7 +185,7 @@ static void aes_gcm_deinit(void *_ctx)
 {
        struct gcm_x86_aes_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-padlock.c b/lib/accelerated/x86/aes-padlock.c
index 3018b99354400ece27c3e6c7622af990c8ea8b90..348d338b16e2dc4eb4f43db457d18fe179ed5da8 100644 (file)
--- a/lib/accelerated/x86/aes-padlock.c
+++ b/lib/accelerated/x86/aes-padlock.c
@@ -165,7 +165,7 @@ static void aes_deinit(void *_ctx)
 {
        struct padlock_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/aes-xts-x86-aesni.c b/lib/accelerated/x86/aes-xts-x86-aesni.c
index e4227f95c4ca6bebdf28c043109a0d49e318e3eb..e21e576a8f10a3a6b67ea09c1f0383a999435284 100644 (file)
--- a/lib/accelerated/x86/aes-xts-x86-aesni.c
+++ b/lib/accelerated/x86/aes-xts-x86-aesni.c
@@ -144,7 +144,7 @@ static void x86_aes_xts_deinit(void *_ctx)
 {
        struct x86_aes_xts_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/accelerated/x86/hmac-padlock.c b/lib/accelerated/x86/hmac-padlock.c
index 26847e8b4e064af1ed5044e1b1d43e0109ebe7a0..8da42b327ddded6b5d5619a4140112edec319eb7 100644 (file)
--- a/lib/accelerated/x86/hmac-padlock.c
+++ b/lib/accelerated/x86/hmac-padlock.c
@@ -268,7 +268,7 @@ static void wrap_padlock_hmac_deinit(void *hd)
 {
        struct padlock_hmac_ctx *ctx = hd;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 
@@ -305,7 +305,7 @@ static int wrap_padlock_hmac_fast(gnutls_mac_algorithm_t algo,
                                       text_size + SHA1_DATA_SIZE,
                                       &pad2[SHA1_DATA_SIZE]);
 
-               zeroize_temp_key(pad, text_size + SHA1_DATA_SIZE);
+               zeroize_key(pad, text_size + SHA1_DATA_SIZE);
                gnutls_free(pad);
 
                memset(pad2, OPAD, SHA1_DATA_SIZE);
@@ -314,8 +314,8 @@ static int wrap_padlock_hmac_fast(gnutls_mac_algorithm_t algo,
                wrap_padlock_hash_fast((gnutls_digest_algorithm_t)algo, pad2,
                                       digest_size + SHA1_DATA_SIZE, digest);
 
-               zeroize_temp_key(pad2, sizeof(pad2));
-               zeroize_temp_key(hkey, sizeof(hkey));
+               zeroize_key(pad2, sizeof(pad2));
+               zeroize_key(hkey, sizeof(hkey));
        } else {
                struct padlock_hmac_ctx ctx;
                int ret;
@@ -331,7 +331,7 @@ static int wrap_padlock_hmac_fast(gnutls_mac_algorithm_t algo,
 
                wrap_padlock_hmac_output(&ctx, digest, ctx.length);
 
-               zeroize_temp_key(&ctx, sizeof(ctx));
+               zeroize_key(&ctx, sizeof(ctx));
        }
 
        return 0;

diff --git a/lib/accelerated/x86/hmac-x86-ssse3.c b/lib/accelerated/x86/hmac-x86-ssse3.c
index f64260864f9cdad22420a25c9c61ed8d50d9361b..9b19552497134e8b0cef6a966369212fb8025931 100644 (file)
--- a/lib/accelerated/x86/hmac-x86-ssse3.c
+++ b/lib/accelerated/x86/hmac-x86-ssse3.c
@@ -260,7 +260,7 @@ static void wrap_x86_hmac_deinit(void *hd)
 {
        struct x86_hmac_ctx *ctx = hd;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 
@@ -280,7 +280,7 @@ static int wrap_x86_hmac_fast(gnutls_mac_algorithm_t algo, const void *nonce,
        ctx.update(&ctx, text_size, text);
        ctx.digest(&ctx, ctx.length, digest);
 
-       zeroize_temp_key(&ctx, sizeof(ctx));
+       zeroize_key(&ctx, sizeof(ctx));
 
        return 0;
 }

diff --git a/lib/auth/dh_common.c b/lib/auth/dh_common.c
index 6362b72b819ff8cba33f46dfbed20f0a18c50a36..dc25f037ad423876d7e2af9db3e526f9856d1778 100644 (file)
--- a/lib/auth/dh_common.c
+++ b/lib/auth/dh_common.c
@@ -97,7 +97,7 @@ int _gnutls_proc_dh_common_client_kx(gnutls_session_t session, uint8_t *data,
        } else { /* In DHE_PSK the key is set differently */
                ret = _gnutls_set_psk_session_key(session, psk_key,
                                                  &tmp_dh_key);
-               _gnutls_free_temp_key_datum(&tmp_dh_key);
+               _gnutls_free_key_datum(&tmp_dh_key);
        }
 
        if (ret < 0) {
@@ -163,7 +163,7 @@ int _gnutls_gen_dh_common_client_kx_int(gnutls_session_t session,
                session->key.key.size = tmp_dh_key.size;
        } else { /* In DHE_PSK the key is set differently */
                ret = _gnutls_set_psk_session_key(session, pskkey, &tmp_dh_key);
-               _gnutls_free_temp_key_datum(&tmp_dh_key);
+               _gnutls_free_key_datum(&tmp_dh_key);
        }
 
        if (ret < 0) {

diff --git a/lib/auth/dhe_psk.c b/lib/auth/dhe_psk.c
index 9cd2122d524a29ba2d719e6b959641e1faf104cf..7d076966d00036ae66cdeeb0f37b101cb0b03b55 100644 (file)
--- a/lib/auth/dhe_psk.c
+++ b/lib/auth/dhe_psk.c
@@ -126,7 +126,7 @@ static int gen_ecdhe_psk_client_kx(gnutls_session_t session,
 cleanup:
        if (free) {
                _gnutls_free_datum(&username);
-               _gnutls_free_temp_key_datum(&key);
+               _gnutls_free_key_datum(&key);
        }
 
        return ret;
@@ -169,7 +169,7 @@ static int gen_dhe_psk_client_kx(gnutls_session_t session,
 cleanup:
        if (free) {
                _gnutls_free_datum(&username);
-               _gnutls_free_temp_key_datum(&key);
+               _gnutls_free_key_datum(&key);
        }
 
        return ret;

diff --git a/lib/auth/ecdhe.c b/lib/auth/ecdhe.c
index cc7c8569e26c5c5192833b5838fb633784e708e2..5779753f92e04627f0c0148a571f8262d1545d89 100644 (file)
--- a/lib/auth/ecdhe.c
+++ b/lib/auth/ecdhe.c
@@ -111,7 +111,7 @@ static int calc_ecdh_key(gnutls_session_t session, gnutls_datum_t *psk_key,
        } else {
                ret = _gnutls_set_psk_session_key(session, psk_key,
                                                  &tmp_dh_key);
-               _gnutls_free_temp_key_datum(&tmp_dh_key);
+               _gnutls_free_key_datum(&tmp_dh_key);
 
                if (ret < 0) {
                        ret = gnutls_assert_val(ret);

diff --git a/lib/auth/psk.c b/lib/auth/psk.c
index 40cc9abe3cb7dec37d6ce3fd56ed42892b686c37..8f68564864cac4b2b7c412054a45fcaf64f4f179 100644 (file)
--- a/lib/auth/psk.c
+++ b/lib/auth/psk.c
@@ -100,7 +100,7 @@ int _gnutls_set_psk_session_key(gnutls_session_t session,
        ret = 0;
 
 error:
-       _gnutls_free_temp_key_datum(&pwd_psk);
+       _gnutls_free_key_datum(&pwd_psk);
        return ret;
 }
 
@@ -168,7 +168,7 @@ int _gnutls_gen_psk_client_kx(gnutls_session_t session, gnutls_buffer_st *data)
 cleanup:
        if (free) {
                gnutls_free(username.data);
-               _gnutls_free_temp_key_datum(&key);
+               _gnutls_free_key_datum(&key);
        }
 
        return ret;

diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c
index 9f97569c5ba197b582c1861f3a8af81f48a2f630..cc92b4aa963ea3959763bc37dfb522627ba3df10 100644 (file)
--- a/lib/auth/rsa_psk.c
+++ b/lib/auth/rsa_psk.c
@@ -234,9 +234,9 @@ static int _gnutls_gen_rsa_psk_client_kx(gnutls_session_t session,
 
 cleanup:
        _gnutls_free_datum(&sdata);
-       _gnutls_free_temp_key_datum(&premaster_secret);
+       _gnutls_free_key_datum(&premaster_secret);
        if (free) {
-               _gnutls_free_temp_key_datum(&key);
+               _gnutls_free_key_datum(&key);
                gnutls_free(username.data);
        }
 

diff --git a/lib/auth/srp_kx.c b/lib/auth/srp_kx.c
index 8e407b6cab93db14150126f043e6cff0dba074e7..36bea6b26ed43f84a26232c3405d25bd5ca4ff61 100644 (file)
--- a/lib/auth/srp_kx.c
+++ b/lib/auth/srp_kx.c
@@ -303,14 +303,14 @@ int _gnutls_gen_srp_client_kx(gnutls_session_t session, gnutls_buffer_st *data)
 
        _gnutls_mpi_log("SRP B: ", B);
 
-       zrelease_temp_mpi_key(&_b);
-       zrelease_temp_mpi_key(&V);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.u);
-       zrelease_temp_mpi_key(&B);
+       zrelease_mpi_key(&_b);
+       zrelease_mpi_key(&V);
+       zrelease_mpi_key(&session->key.proto.tls12.srp.u);
+       zrelease_mpi_key(&B);
 
        ret = _gnutls_mpi_dprint(session->key.proto.tls12.srp.srp_key,
                                 &session->key.key);
-       zrelease_temp_mpi_key(&S);
+       zrelease_mpi_key(&S);
 
        if (ret < 0) {
                gnutls_assert();
@@ -377,14 +377,14 @@ int _gnutls_proc_srp_client_kx(gnutls_session_t session, uint8_t *data,
        _gnutls_mpi_log("SRP S: ", S);
 
        _gnutls_mpi_release(&A);
-       zrelease_temp_mpi_key(&_b);
-       zrelease_temp_mpi_key(&V);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.u);
-       zrelease_temp_mpi_key(&B);
+       zrelease_mpi_key(&_b);
+       zrelease_mpi_key(&V);
+       zrelease_mpi_key(&session->key.proto.tls12.srp.u);
+       zrelease_mpi_key(&B);
 
        ret = _gnutls_mpi_dprint(session->key.proto.tls12.srp.srp_key,
                                 &session->key.key);
-       zrelease_temp_mpi_key(&S);
+       zrelease_mpi_key(&S);
 
        if (ret < 0) {
                gnutls_assert();

diff --git a/lib/constate.c b/lib/constate.c
index b091d891fffbfa399ba2dfd0539fcc03d68c89df..373d9f8eee699eb8e67a9063fa74cb79963aab9e 100644 (file)
--- a/lib/constate.c
+++ b/lib/constate.c
@@ -1103,9 +1103,9 @@ void _gnutls_epoch_gc(gnutls_session_t session)
 
 static inline void free_record_state(record_state_st *state)
 {
-       zeroize_temp_key(state->mac_key, state->mac_key_size);
-       zeroize_temp_key(state->iv, state->iv_size);
-       zeroize_temp_key(state->key, state->key_size);
+       zeroize_key(state->mac_key, state->mac_key_size);
+       zeroize_key(state->iv, state->iv_size);
+       zeroize_key(state->key, state->key_size);
 
        if (state->is_aead)
                _gnutls_aead_cipher_deinit(&state->ctx.aead);

diff --git a/lib/datum.h b/lib/datum.h
index 082aebb0f14990e92186f5fa91e21000c8678142..e92f4016f22a209bcf7d6781525c18c6bf587a5d 100644 (file)
--- a/lib/datum.h
+++ b/lib/datum.h
@@ -46,17 +46,6 @@ inline static void _gnutls_free_datum(gnutls_datum_t *dat)
        }
 }
 
-inline static ATTRIBUTE_NONNULL() void _gnutls_free_temp_key_datum(
-       gnutls_datum_t *dat)
-{
-       if (dat->data != NULL) {
-               zeroize_temp_key(dat->data, dat->size);
-               gnutls_free(dat->data);
-       }
-
-       dat->size = 0;
-}
-
 inline static ATTRIBUTE_NONNULL() void _gnutls_free_key_datum(
        gnutls_datum_t *dat)
 {

diff --git a/lib/kx.c b/lib/kx.c
index cac0d81704cb54c299c617c30f5d146af5a5adaf..36f95e852cb6a97b214c145f50d1db7b832ae441 100644 (file)
--- a/lib/kx.c
+++ b/lib/kx.c
@@ -253,7 +253,7 @@ static int generate_normal_master(gnutls_session_t session,
        }
 
        if (!keep_premaster)
-               _gnutls_free_temp_key_datum(premaster);
+               _gnutls_free_key_datum(premaster);
 
        if (ret < 0)
                return ret;

diff --git a/lib/mem.h b/lib/mem.h
index dba676ae79290894bbebd1796cf520c318fcc3e4..8751cac582f0be00e205dbaef6d2ffa18637ebe0 100644 (file)
--- a/lib/mem.h
+++ b/lib/mem.h
@@ -55,9 +55,6 @@ unsigned _gnutls_mem_is_zero(const uint8_t *ptr, unsigned size);
 
 #define zeroize_key(x, size) gnutls_memset(x, 0, size)
 
-#define zeroize_temp_key zeroize_key
-#define zrelease_temp_mpi_key zrelease_mpi_key
-
 static inline void _gnutls_memory_mark_undefined(void *addr, size_t size)
 {
 #ifdef HAVE_SANITIZER_ASAN_INTERFACE_H

diff --git a/lib/nettle/cipher.c b/lib/nettle/cipher.c
index def127b3236da0651c2fa1676f7f4640a729f0e1..1900794a26fcfda6fe32b466ac2376fa849e6875 100644 (file)
--- a/lib/nettle/cipher.c
+++ b/lib/nettle/cipher.c
@@ -1633,7 +1633,7 @@ static void wrap_nettle_cipher_close(void *_ctx)
 {
        struct nettle_cipher_ctx *ctx = _ctx;
 
-       zeroize_temp_key(ctx->ctx_ptr, ctx->cipher->ctx_size);
+       zeroize_key(ctx->ctx_ptr, ctx->cipher->ctx_size);
        gnutls_free(ctx);
 }
 

diff --git a/lib/nettle/gost_keywrap.c b/lib/nettle/gost_keywrap.c
index 5b4875d6d35b309a5d4f3f3a4928cb6c7bc697bc..8c714a7048437eb2e00c724a6f3254fb2a909d1e 100644 (file)
--- a/lib/nettle/gost_keywrap.c
+++ b/lib/nettle/gost_keywrap.c
@@ -109,7 +109,7 @@ int _gnutls_gost_key_unwrap(gnutls_gost_paramset_t gost_params,
                                             cek->data);
        if (ret == 0) {
                gnutls_assert();
-               _gnutls_free_temp_key_datum(cek);
+               _gnutls_free_key_datum(cek);
                return GNUTLS_E_DECRYPTION_FAILED;
        }
 

diff --git a/lib/nettle/mac.c b/lib/nettle/mac.c
index 899dc0e6e6dae59cea266784b4498abbbad82332..b6be1c913dcedb0efb202e19871ebe6302db325f 100644 (file)
--- a/lib/nettle/mac.c
+++ b/lib/nettle/mac.c
@@ -470,7 +470,7 @@ static int wrap_nettle_mac_fast(gnutls_mac_algorithm_t algo, const void *nonce,
        ctx.update(&ctx, text_size, text);
        ctx.digest(&ctx, ctx.length, digest);
 
-       zeroize_temp_key(&ctx, sizeof(ctx));
+       zeroize_key(&ctx, sizeof(ctx));
 
        return 0;
 }
@@ -598,7 +598,7 @@ static void wrap_nettle_mac_deinit(void *hd)
 {
        struct nettle_mac_ctx *ctx = hd;
 
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 
@@ -849,7 +849,7 @@ static int wrap_nettle_hash_fast(gnutls_digest_algorithm_t algo,
                ctx.update(&ctx, text_size, text);
        }
        ctx.digest(&ctx, ctx.length, digest);
-       zeroize_temp_key(&ctx, sizeof(ctx));
+       zeroize_key(&ctx, sizeof(ctx));
 
        return 0;
 }
@@ -932,7 +932,7 @@ static int wrap_nettle_hkdf_extract(gnutls_mac_algorithm_t mac, const void *key,
        hkdf_extract(&ctx.ctx, ctx.update, ctx.digest, ctx.length, keysize, key,
                     output);
 
-       zeroize_temp_key(&ctx, sizeof(ctx));
+       zeroize_key(&ctx, sizeof(ctx));
        return 0;
 }
 
@@ -955,7 +955,7 @@ static int wrap_nettle_hkdf_expand(gnutls_mac_algorithm_t mac, const void *key,
        ctx.set_key(&ctx, keysize, key);
        hkdf_expand(&ctx.ctx, ctx.update, ctx.digest, ctx.length, infosize,
                    info, length, output);
-       zeroize_temp_key(&ctx, sizeof(ctx));
+       zeroize_key(&ctx, sizeof(ctx));
 
        return 0;
 }
@@ -974,7 +974,7 @@ static int wrap_nettle_pbkdf2(gnutls_mac_algorithm_t mac, const void *key,
        ctx.set_key(&ctx, keysize, key);
        pbkdf2(&ctx.ctx, ctx.update, ctx.digest, ctx.length, iter_count,
               saltsize, salt, length, output);
-       zeroize_temp_key(&ctx, sizeof(ctx));
+       zeroize_key(&ctx, sizeof(ctx));
 
        return 0;
 }

diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 3880baf0881f77f801949fe3c3bf8be78781923a..d288625e36c92bf952c04bfbc504cd77d270e481 100644 (file)
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -402,7 +402,7 @@ static int _wrap_nettle_pk_derive(gnutls_pk_algorithm_t algo,
        dh_cleanup:
                _gnutls_mpi_release(&r);
                _gnutls_mpi_release(&primesub1);
-               zrelease_temp_mpi_key(&k);
+               zrelease_mpi_key(&k);
                if (ret < 0)
                        goto cleanup;
 

diff --git a/lib/pkcs11/p11_mac.c b/lib/pkcs11/p11_mac.c
index 0a86fec9618b995a89c32b0d350d4bd4c3e4ef3b..5b06395a8d979c53c5c72fdb80506fe785fba785 100644 (file)
--- a/lib/pkcs11/p11_mac.c
+++ b/lib/pkcs11/p11_mac.c
@@ -152,7 +152,7 @@ static int set_gmac_aad(struct p11_mac_ctx *ctx, const void *aad,
 
 static int init_gmac_params(struct p11_mac_ctx *ctx)
 {
-       zeroize_temp_key(&ctx->params, sizeof(ctx->params));
+       zeroize_key(&ctx->params, sizeof(ctx->params));
        ctx->params_size = sizeof(CK_GCM_PARAMS);
        ctx->params.gcm.ulTagBits = ctx->mac->length * 8;
        return 0;
@@ -162,7 +162,7 @@ static void free_gmac_params(struct p11_mac_ctx *ctx)
 {
        gnutls_free(ctx->params.gcm.pIv);
        gnutls_free(ctx->params.gcm.pAAD);
-       zeroize_temp_key(&ctx->params, sizeof(ctx->params));
+       zeroize_key(&ctx->params, sizeof(ctx->params));
        ctx->params_size = 0;
 }
 
@@ -475,7 +475,7 @@ static void wrap_p11_mac_deinit(void *_ctx)
        _p11_provider_close_session(ctx->session);
        if (ctx->mac->free_params != NULL)
                ctx->mac->free_params(ctx);
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 
@@ -636,7 +636,7 @@ static void wrap_p11_hash_deinit(void *_ctx)
        struct p11_digest_ctx *ctx = _ctx;
 
        _p11_provider_close_session(ctx->session);
-       zeroize_temp_key(ctx, sizeof(*ctx));
+       zeroize_key(ctx, sizeof(*ctx));
        gnutls_free(ctx);
 }
 

diff --git a/lib/state.c b/lib/state.c
index 8090686bfc4ce9cdcdc20761a1acd7c598095dce..1105f13c9f322dd0a235a0eef9843ffa6fdf3aa3 100644 (file)
--- a/lib/state.c
+++ b/lib/state.c
@@ -347,8 +347,8 @@ const char *gnutls_ciphersuite_get(gnutls_session_t session)
 
 void reset_binders(gnutls_session_t session)
 {
-       _gnutls_free_temp_key_datum(&session->key.binders[0].psk);
-       _gnutls_free_temp_key_datum(&session->key.binders[1].psk);
+       _gnutls_free_key_datum(&session->key.binders[0].psk);
+       _gnutls_free_key_datum(&session->key.binders[1].psk);
        memset(session->key.binders, 0, sizeof(session->key.binders));
        session->internals.hsk_flags &= ~HSK_PSK_SELECTED;
 }
@@ -466,30 +466,30 @@ static void deinit_keys(gnutls_session_t session)
        if (!vers->tls13_sem && session->key.binders[0].prf == NULL) {
                gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
                gnutls_pk_params_release(&session->key.proto.tls12.dh.params);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.x);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.y);
-               _gnutls_free_temp_key_datum(&session->key.proto.tls12.ecdh.raw);
+               zrelease_mpi_key(&session->key.proto.tls12.ecdh.x);
+               zrelease_mpi_key(&session->key.proto.tls12.ecdh.y);
+               _gnutls_free_key_datum(&session->key.proto.tls12.ecdh.raw);
 
-               zrelease_temp_mpi_key(&session->key.proto.tls12.dh.client_Y);
+               zrelease_mpi_key(&session->key.proto.tls12.dh.client_Y);
 
                /* SRP */
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_p);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_g);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_key);
-
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.u);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.a);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.x);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.A);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.B);
-               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.b);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.srp_p);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.srp_g);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.srp_key);
+
+               zrelease_mpi_key(&session->key.proto.tls12.srp.u);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.a);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.x);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.A);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.B);
+               zrelease_mpi_key(&session->key.proto.tls12.srp.b);
        } else {
                gnutls_memset(session->key.proto.tls13.temp_secret, 0,
                              sizeof(session->key.proto.tls13.temp_secret));
        }
 
        reset_binders(session);
-       _gnutls_free_temp_key_datum(&session->key.key);
+       _gnutls_free_key_datum(&session->key.key);
 }
 
 /* An internal version of _gnutls_handshake_internal_state_clear(),

diff --git a/lib/tls13/session_ticket.h b/lib/tls13/session_ticket.h
index 1b14518b4e8362a8563782e83ceb1cdac2da8f6e..e007877f23483507c0ba28a866b028094ac7f9df 100644 (file)
--- a/lib/tls13/session_ticket.h
+++ b/lib/tls13/session_ticket.h
@@ -40,8 +40,8 @@ int _gnutls13_unpack_session_ticket(gnutls_session_t session,
 
 inline static void tls13_ticket_deinit(tls13_ticket_st *ticket)
 {
-       zeroize_temp_key(&ticket->resumption_master_secret,
-                        sizeof(ticket->resumption_master_secret));
+       zeroize_key(&ticket->resumption_master_secret,
+                   sizeof(ticket->resumption_master_secret));
 
        _gnutls_free_datum(&ticket->ticket);
        memset(ticket, 0, sizeof(tls13_ticket_st));

diff --git a/lib/tpm2/callbacks/rsa/rsa_callbacks.c b/lib/tpm2/callbacks/rsa/rsa_callbacks.c
index 06e7d120464f6523343283448e13b9ac3edcb0da..5ff1b8d73627e42380a4de1bdd45c327ca1c35d1 100644 (file)
--- a/lib/tpm2/callbacks/rsa/rsa_callbacks.c
+++ b/lib/tpm2/callbacks/rsa/rsa_callbacks.c
@@ -93,14 +93,14 @@ static TSS2_RC _gnutls_rsa_pk_encrypt(TPM2B_PUBLIC *pub_tpm_key, size_t in_size,
                return TSS2_ESYS_RC_GENERAL_FAILURE;
 
        if (output.size > max_out_size) {
-               zeroize_temp_key(output.data, output.size);
+               zeroize_key(output.data, output.size);
                return TSS2_ESYS_RC_INSUFFICIENT_BUFFER;
        }
 
        memcpy(out_buffer, output.data, output.size);
        *out_size = output.size;
 
-       zeroize_temp_key(output.data, output.size);
+       zeroize_key(output.data, output.size);
        return TSS2_RC_SUCCESS;
 }
 

diff --git a/lib/vko.c b/lib/vko.c
index c01664724a1d74197c736d542835d0ff61c5e8ff..f9ba6e47a9c7c495cd89b10d885c4c92a3a4c969 100644 (file)
--- a/lib/vko.c
+++ b/lib/vko.c
@@ -59,7 +59,7 @@ static int _gnutls_gost_vko_key(gnutls_pk_params_st *pub,
        ret = 0;
 
 cleanup:
-       _gnutls_free_temp_key_datum(&tmp_vko_key);
+       _gnutls_free_key_datum(&tmp_vko_key);
 
        return ret;
 }

diff --git a/lib/x509/pkcs7-crypt.c b/lib/x509/pkcs7-crypt.c
index db160b9a78a7696e868a8e11aadb5f3f94f2729c..10370b2c25fb062acd994fe5d31d3e26a21833d8 100644 (file)
--- a/lib/x509/pkcs7-crypt.c
+++ b/lib/x509/pkcs7-crypt.c
@@ -1209,7 +1209,7 @@ int _gnutls_pkcs_raw_decrypt_data(schema_id schema, asn1_node pkcs8_asn,
 
        ret = gnutls_cipher_init(&ch, ce->id, &dkey, &d_iv);
 
-       zeroize_temp_key(key, key_size);
+       zeroize_key(key, key_size);
        gnutls_free(key);
 
        if (ret < 0) {
@@ -1255,7 +1255,7 @@ int _gnutls_pkcs_raw_decrypt_data(schema_id schema, asn1_node pkcs8_asn,
 
 cleanup:
        if (password) {
-               zeroize_temp_key(password, pass_len);
+               zeroize_key(password, pass_len);
                gnutls_free(password);
        }
 
@@ -1263,15 +1263,15 @@ cleanup:
 
 error:
        if (password) {
-               zeroize_temp_key(password, pass_len);
+               zeroize_key(password, pass_len);
                gnutls_free(password);
        }
        if (enc.data) {
-               zeroize_temp_key(enc.data, enc.size);
+               zeroize_key(enc.data, enc.size);
                gnutls_free(enc.data);
        }
        if (key) {
-               zeroize_temp_key(key, key_size);
+               zeroize_key(key, key_size);
                gnutls_free(key);
        }
        if (ch) {

diff --git a/lib/x509/privkey.c b/lib/x509/privkey.c
index 6c7bf139dec081da44e2faa595a0630f32e2c3dd..76c4a08926a1ee958d60cece403bf16bfc878a89 100644 (file)
--- a/lib/x509/privkey.c
+++ b/lib/x509/privkey.c
@@ -756,7 +756,7 @@ finish:
 
 cleanup:
        if (need_free) {
-               zeroize_temp_key(_data.data, _data.size);
+               zeroize_key(_data.data, _data.size);
                _gnutls_free_datum(&_data);
        }
 

diff --git a/lib/x509/privkey_pkcs8.c b/lib/x509/privkey_pkcs8.c
index 987f8c79622568679d0cf8073defc745086d4f35..4746a0ab890384236847c8ed37d9ad25e8d9446d 100644 (file)
--- a/lib/x509/privkey_pkcs8.c
+++ b/lib/x509/privkey_pkcs8.c
@@ -2042,7 +2042,7 @@ cleanup:
        asn1_delete_structure2(&key->key, ASN1_DELETE_FLAG_ZEROIZE);
        key->params.algo = GNUTLS_PK_UNKNOWN;
        if (need_free) {
-               zeroize_temp_key(_data.data, _data.size);
+               zeroize_key(_data.data, _data.size);
                _gnutls_free_datum(&_data);
        }
        return result;