commit 744b507866bc8b31177d7dde81ddfdb378f60d1f
author Pengyu Lv <pengyu.lv@arm.com> Wed Mar 15 12:17:14 2023 +0800
committer Pengyu Lv <pengyu.lv@arm.com> Wed Mar 15 12:17:14 2023 +0800
tree 120a30a819dbf3f0974e1926f11648ae42c367f8
parent f30488f5cde80eec4b50384935b42f9379d7825f

ssl_cache: use auxiliary function to zeroize cache entry

This commit introduce a auxiliary function to zeroize
the cache entry, especially the session structure. The
function is called wherever we need to free the entry.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>

library/ssl_cache.c

diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index ff36b05..d93508c 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -121,6 +121,23 @@
     return ret;
 }
 
+/* zeroize a cache entry */
+static void ssl_cache_entry_zeroize(mbedtls_ssl_cache_entry *entry)
+{
+    if (entry == NULL) {
+        return;
+    }
+
+    /* zeroize and free session structure */
+    if (entry->session != NULL) {
+        mbedtls_platform_zeroize(entry->session, entry->session_len);
+        mbedtls_free(entry->session);
+    }
+
+    /* zeroize the whole entry structure */
+    mbedtls_platform_zeroize(entry, sizeof(mbedtls_ssl_cache_entry));
+}
+
 MBEDTLS_CHECK_RETURN_CRITICAL
 static int ssl_cache_pick_writing_slot(mbedtls_ssl_cache_context *cache,
                                        unsigned char const *session_id,
@@ -220,19 +237,19 @@
 
 found:
 
+    /* If we're reusing an entry, free it first. */
+    if (cur->session != NULL) {
+        /* `ssl_cache_entry_zeroize` would break the chain,
+         * so we reuse `old` to record `next` temporarily. */
+        old = cur->next;
+        ssl_cache_entry_zeroize(cur);
+        cur->next = old;
+    }
+
 #if defined(MBEDTLS_HAVE_TIME)
     cur->timestamp = t;
 #endif
 
-    /* If we're reusing an entry, free it first. */
-    if (cur->session != NULL) {
-        mbedtls_free(cur->session);
-        cur->session = NULL;
-        cur->session_len = 0;
-        memset(cur->session_id, 0, sizeof(cur->session_id));
-        cur->session_id_len = 0;
-    }
-
     *dst = cur;
     return 0;
 }
@@ -349,11 +366,7 @@
     }
 
 free:
-    if (entry->session != NULL) {
-        mbedtls_platform_zeroize(entry->session, entry->session_len);
-        mbedtls_free(entry->session);
-    }
-    mbedtls_platform_zeroize(entry, sizeof(mbedtls_ssl_cache_entry));
+    ssl_cache_entry_zeroize(entry);
     mbedtls_free(entry);
     ret = 0;
 
@@ -397,7 +410,7 @@
         prv = cur;
         cur = cur->next;
 
-        mbedtls_free(prv->session);
+        ssl_cache_entry_zeroize(prv);
         mbedtls_free(prv);
     }