Make input zeroization optional

daemon/2server.go

@@ -20,17 +20,17 @@ type RCWService struct{}
 // the global password and returns the decrypted data
 func (h *RCWService) DecryptRequest(encBytes []byte, reply *[]byte) error {
 	var err error
-	*reply, err = wrappers.DecryptAndZeroizePassword(encBytes, append([]byte{}, globalPassword...)) // pass new slice to avoid zeroizing cached password)
+	*reply, err = wrappers.Decrypt(encBytes, globalPassword, false)
 	if err != nil {
 		return err
 	}
 	return nil
 }
 
-// EncryptRequestAndZeroizeDecBytes is the RPC method that encrypts the incoming data using
+// EncryptRequest is the RPC method that encrypts the incoming data using
 // the global password and returns the encrypted data
-func (h *RCWService) EncryptRequestAndZeroizeDecBytes(decBytes []byte, reply *[]byte) error {
-	*reply = wrappers.EncryptAndZeroizeDecBytesAndPassword(decBytes, append([]byte{}, globalPassword...)) // pass new slice to avoid zeroizing cached password
+func (h *RCWService) EncryptRequest(decBytes []byte, reply *[]byte) error {
+	*reply = wrappers.Encrypt(decBytes, globalPassword, true, false)
 	return nil
 }
 

daemon/2serverUNIXGeneric.go

@@ -13,6 +13,7 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/rwinkhart/go-boilerplate/security"
 	"github.com/rwinkhart/peercred-mini"
 )
 
@@ -44,6 +45,7 @@ func Start(password []byte) {
 	go func() {
 		<-sigChan
 		listener.Close()
+		security.ZeroizeBytes(globalPassword)
 		os.Exit(0)
 	}()
 
@@ -56,6 +58,7 @@ func Start(password []byte) {
 			if err.(net.Error).Timeout() {
 				log.Println(strconv.Itoa(Timeout) + " seconds have passed without any connections. Exiting...")
 				listener.Close()
+				security.ZeroizeBytes(globalPassword)
 				os.Exit(0)
 			}
 			log.Printf("Accept error: %v", err)
@@ -84,7 +87,7 @@ func handleConn(conn net.Conn, sigChan chan os.Signal) {
 		// invalid client; close the connection w/o a response,
 		// log the client's path, and kill the daemon
 		conn.Close()
-		log.Printf("Request received from invalid client: PID(%d), UID(%s), Path(%s)", ucred.PID, ucred.UID, callingBinPath) // TODO log to file
-		sigChan <- syscall.SIGTERM
+		log.Printf("Request received from invalid client: PID(%d), UID(%s), Path(%s)", ucred.PID, ucred.UID, callingBinPath)
+		sigChan <- syscall.SIGTERM // this zeroizes globalPassword and triggers os.Exit(0)
 	}
 }

daemon/2serverWindows.go

@@ -10,10 +10,10 @@ import (
 	"os"
 	"os/signal"
 	"strconv"
-	"syscall"
 	"time"
 
 	"github.com/Microsoft/go-winio"
+	"github.com/rwinkhart/go-boilerplate/security"
 	"github.com/rwinkhart/peercred-mini"
 	"golang.org/x/sys/windows"
 )
@@ -63,11 +63,13 @@ func Start(password []byte) {
 		case <-timer.C:
 			log.Println(strconv.Itoa(Timeout) + " seconds have passed without any connections. Exiting...")
 			listener.Close()
+			security.ZeroizeBytes(globalPassword)
 			os.Exit(0)
 		case <-killTimer:
 			return
 		case <-sigChan:
 			listener.Close()
+			security.ZeroizeBytes(globalPassword)
 			os.Exit(0)
 		}
 	}()
@@ -108,8 +110,7 @@ func handleConn(conn net.Conn, sigChan chan os.Signal) {
 		// invalid client; close the connection w/o a response,
 		// log the client's path, and kill the daemon
 		conn.Close()
-		log.Printf("Request received from invalid client: PID(%d), UID(%s), Path(%s)", ucred.PID, ucred.UID, callingBinPath) // TODO log to file
-		sigChan <- syscall.SIGTERM
-		os.Exit(2)
+		log.Printf("Request received from invalid client: PID(%d), UID(%s), Path(%s)", ucred.PID, ucred.UID, callingBinPath)
+		sigChan <- os.Interrupt // this zeroizes globalPassword and triggers os.Exit(0)
 	}
 }

daemon/3client.go

@@ -23,19 +23,21 @@ func GetDec(encBytes []byte) []byte {
 	return decBytes
 }
 
-// GetEncAndZeroizeDecBytes requests the RCW daemon to encrypt the given data.
+// GetEnc requests the RCW daemon to encrypt the given data.
 // It returns the encrypted data.
-func GetEncAndZeroizeDecBytes(decBytes []byte) []byte {
+func GetEnc(decBytes []byte, zeroizeDecBytes bool) []byte {
 	conn, client := connectToDaemon()
 	defer conn.Close()
 	defer client.Close()
 
 	// request encBytes from the RPC server
 	var encBytes []byte
-	err := client.Call("RCWService.EncryptRequestAndZeroizeDecBytes", decBytes, &encBytes)
-	security.ZeroizeBytes(decBytes)
+	err := client.Call("RCWService.EncryptRequest", decBytes, &encBytes)
+	if zeroizeDecBytes {
+		security.ZeroizeBytes(decBytes)
+	}
 	if err != nil {
-		log.Fatalf("Error calling RCWService.EncryptRequestAndZeroizeDecBytes: %v", err)
+		log.Fatalf("Error calling RCWService.EncryptRequest: %v", err)
 	}
 	return encBytes
 }