feat(dgram): add best-effort key buffer clearing

commit: c310fcfdc35e796bed1f9d77189a97e375c51f53
author: brice · 3mo ago · 2026-07-23 20:17 UTC
parent: ee07621
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +33 -0

M pkg/dgram/dgram.go +6 -0


@@ -24,6 +24,12 @@ var (
24	24		ErrFragment = errors.New("dgram: invalid fragment")
25	25		)
26	26
	27	+	// Erase overwrites b with zeroes. This is best effort: copies made by the
	28	+	// compiler, runtime, or called code may retain the original data.
	29	+	func Erase(b []byte) {
	30	+	clear(b)
	31	+	}
	32	+
27	33		type Codec struct {
28	34		gcm cipher.AEAD
29	35		}


@@ -24,6 +24,12 @@ var (
24	ErrFragment = errors.New("dgram: invalid fragment")	24		ErrFragment = errors.New("dgram: invalid fragment")
25	)	25		)
26		26
		27	+	// Erase overwrites b with zeroes. This is best effort: copies made by the
		28	+	// compiler, runtime, or called code may retain the original data.
		29	+	func Erase(b []byte) {
		30	+	clear(b)
		31	+	}
		32	+
27	type Codec struct {	33		type Codec struct {
28	gcm cipher.AEAD	34		gcm cipher.AEAD
29	}	35		}

A pkg/dgram/erase_test.go +27 -0

@@ -0,0 +1,27 @@
	1	+	package dgram
	2	+
	3	+	import (
	4	+	"bytes"
	5	+	"testing"
	6	+	)
	7	+
	8	+	func TestErase(t *testing.T) {
	9	+	tests := []struct {
	10	+	name string
	11	+	buf []byte
	12	+	}{
	13	+	{name: "nil", buf: nil},
	14	+	{name: "empty", buf: []byte{}},
	15	+	{name: "key", buf: bytes.Repeat([]byte{0xa5}, KeySize)},
	16	+	}
	17	+
	18	+	for _, tt := range tests {
	19	+	t.Run(tt.name, func(t *testing.T) {
	20	+	Erase(tt.buf)
	21	+
	22	+	if !bytes.Equal(tt.buf, make([]byte, len(tt.buf))) {
	23	+	t.Fatalf("Erase() left data in buffer: %x", tt.buf)
	24	+	}
	25	+	})
	26	+	}
	27	+	}

@@ -0,0 +1,27 @@
	1	+	package dgram
	2	+
	3	+	import (
	4	+	"bytes"
	5	+	"testing"
	6	+	)
	7	+
	8	+	func TestErase(t *testing.T) {
	9	+	tests := []struct {
	10	+	name string
	11	+	buf []byte
	12	+	}{
	13	+	{name: "nil", buf: nil},
	14	+	{name: "empty", buf: []byte{}},
	15	+	{name: "key", buf: bytes.Repeat([]byte{0xa5}, KeySize)},
	16	+	}
	17	+
	18	+	for _, tt := range tests {
	19	+	t.Run(tt.name, func(t *testing.T) {
	20	+	Erase(tt.buf)
	21	+
	22	+	if !bytes.Equal(tt.buf, make([]byte, len(tt.buf))) {
	23	+	t.Fatalf("Erase() left data in buffer: %x", tt.buf)
	24	+	}
	25	+	})
	26	+	}
	27	+	}