Always zero encryption key on Stop

enj · Nathaniel McCallum · commit 926a9721efe9 · 2018-03-20T15:37:23.000-04:00
This change moves the zero key on Stop logic into cmdKEK.run.  This
guarantees via a defer that it is the last thing executed when run
exits (and thus the key is always zeroed).

Signed-off-by: Monis Khan &lt;mkhan@redhat.com&gt;
diff --git a/pkg/kek/kek.go b/pkg/kek/kek.go
@@ -47,7 +47,6 @@ func (c *cmdKEK) Get() ([]byte, error) {
 }
 
 func (c *cmdKEK) Stop() {
-	c.setErrorState(errEmptyKey)
 	close(c.stop)
 }
 
@@ -81,6 +80,7 @@ func (c *cmdKEK) run() {
 	const factor = 5 // TODO move constant, maybe make configurable?
 	ticker := time.NewTicker(c.duration / factor)
 	defer ticker.Stop()
+	defer c.setErrorState(errEmptyKey)
 
 	current := 0
 

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,6 @@ func (c *cmdKEK) Get() ([]byte, error) {`
`47`	`47`	`}`
`48`	`48`
`49`	`49`	`func (c *cmdKEK) Stop() {`
`50`		`- c.setErrorState(errEmptyKey)`
`51`	`50`	`close(c.stop)`
`52`	`51`	`}`
`53`	`52`
`@@ -81,6 +80,7 @@ func (c *cmdKEK) run() {`
`81`	`80`	`const factor = 5 // TODO move constant, maybe make configurable?`
`82`	`81`	`ticker := time.NewTicker(c.duration / factor)`
`83`	`82`	`defer ticker.Stop()`
	`83`	`+ defer c.setErrorState(errEmptyKey)`
`84`	`84`
`85`	`85`	`current := 0`
`86`	`86`