Significant hardening (always work on bytes; zeroize everything); address JetBrains warnings

daemon/2server.go

@@ -20,17 +20,17 @@ type RCWService struct{}
 // the global passphrase and returns the decrypted data
 func (h *RCWService) DecryptRequest(encBytes []byte, reply *[]byte) error {
 	var err error
-	*reply, err = wrappers.Decrypt(encBytes, globalPassphrase)
+	*reply, err = wrappers.DecryptAndZeroizePassphrase(encBytes, append([]byte{}, globalPassphrase...)) // pass new slice to avoid zeroizing cached passphrase)
 	if err != nil {
 		return err
 	}
 	return nil
 }
 
-// EncryptRequest is the RPC method that encrypts the incoming data using
+// EncryptRequestAndZeroizeDecBytes is the RPC method that encrypts the incoming data using
 // the global passphrase and returns the encrypted data
-func (h *RCWService) EncryptRequest(decBytes []byte, reply *[]byte) error {
-	*reply = wrappers.Encrypt(decBytes, globalPassphrase)
+func (h *RCWService) EncryptRequestAndZeroizeDecBytes(decBytes []byte, reply *[]byte) error {
+	*reply = wrappers.EncryptAndZeroizeDecBytesAndPassphrase(decBytes, append([]byte{}, globalPassphrase...)) // pass new slice to avoid zeroizing cached passphrase
 	return nil
 }
 
@@ -39,5 +39,6 @@ func getFileHash(path string) []byte {
 	file, _ := os.Open(path)
 	hash := sha256.New()
 	io.Copy(hash, file)
+	file.Close()
 	return hash.Sum(nil)
 }

daemon/2serverUNIXGeneric.go

@@ -13,7 +13,7 @@ import (
 	"syscall"
 	"time"
 
-	peercred "github.com/rwinkhart/peercred-mini"
+	"github.com/rwinkhart/peercred-mini"
 )
 
 // Start is the entry point for the RPC server responsible for

daemon/3client.go

@@ -4,6 +4,8 @@ import (
 	"log"
 	"net"
 	"net/rpc"
+
+	"github.com/rwinkhart/go-boilerplate/security"
 )
 
 // GetDec requests the RCW daemon to decrypt the given data.
@@ -21,17 +23,19 @@ func GetDec(encBytes []byte) []byte {
 	return decBytes
 }
 
-// GetEnc requests the RCW daemon to encrypt the given data.
+// GetEncAndZeroizeDecBytes requests the RCW daemon to encrypt the given data.
 // It returns the encrypted data.
-func GetEnc(decBytes []byte) []byte {
+func GetEncAndZeroizeDecBytes(decBytes []byte) []byte {
 	conn, client := connectToDaemon()
 	defer conn.Close()
 	defer client.Close()
 
 	// request encBytes from the RPC server
 	var encBytes []byte
-	if err := client.Call("RCWService.EncryptRequest", decBytes, &encBytes); err != nil {
-		log.Fatalf("Error calling RCWService.EncryptRequest: %v", err)
+	err := client.Call("RCWService.EncryptRequestAndZeroizeDecBytes", decBytes, &encBytes)
+	security.ZeroizeBytes(decBytes)
+	if err != nil {
+		log.Fatalf("Error calling RCWService.EncryptRequestAndZeroizeDecBytes: %v", err)
 	}
 	return encBytes
 }