Update API

如果类型内部没有动态内存申请或外部Handle引用，不提供cleanup接口，仅用通用secure clear

src/kyber.c

@@ -658,13 +658,6 @@ int kyber_cpa_key_generate_ex(KYBER_CPA_KEY *key, const uint8_t random[32])
 	return 1;
 }
 
-void kyber_cpa_key_cleanup(KYBER_CPA_KEY *key)
-{
-	if (key) {
-		gmssl_secure_clear(key->s, sizeof(key->s));
-	}
-}
-
 int kyber_cpa_public_key_to_bytes(const KYBER_CPA_KEY *key, uint8_t **out, size_t *outlen)
 {
 	if (!key || !outlen) {
@@ -1014,21 +1007,13 @@ int kyber_key_generate_ex(KYBER_KEY *key, const uint8_t random[32])
 	}
 	kyber_h_hash((uint8_t *)key, sizeof(KYBER_CPA_PUBLIC_KEY), key->pk_hash);
 	if (rand_bytes(key->z, 32) != 1) {
-		kyber_cpa_key_cleanup(&key->cpa_key);
+		gmssl_secure_clear(&key->cpa_key, sizeof(KYBER_CPA_KEY));
 		error_print();
 		return -1;
 	}
 	return 1;
 }
 
-void kyber_key_cleanup(KYBER_KEY *key)
-{
-	if (key) {
-		kyber_cpa_key_cleanup(&key->cpa_key);
-		gmssl_secure_clear(key->z, sizeof(key->z));
-	}
-}
-
 int kyber_public_key_to_bytes(const KYBER_KEY *key, uint8_t **out, size_t *outlen)
 {
 	if (!key || !outlen) {

src/lms.c

@@ -923,13 +923,6 @@ int lms_signature_to_merkle_root(const uint8_t I[16], size_t h, int q,
 	return 1;
 }
 
-void lms_sign_ctx_cleanup(LMS_SIGN_CTX *ctx)
-{
-	if (ctx) {
-		gmssl_secure_clear(ctx->lms_sig.lmots_sig.y, sizeof(lms_hash256_t)*34);
-	}
-}
-
 int lms_sign_init(LMS_SIGN_CTX *ctx, LMS_KEY *key)
 {
 	LMS_SIGNATURE *lms_sig;
@@ -1469,7 +1462,7 @@ int hss_key_generate(HSS_KEY *key, const int *lms_types, size_t levels)
 	ret = 1;
 end:
 	gmssl_secure_clear(seed, sizeof(seed));
-	lms_sign_ctx_cleanup(&ctx);
+	gmssl_secure_clear(&ctx, sizeof(ctx));
 	if (ret != 1) hss_key_cleanup(key);
 	return ret;
 }
@@ -2025,10 +2018,3 @@ int hss_private_key_size(const int *lms_types, size_t levels, size_t *len)
 
 	return 1;
 }
-
-void hss_sign_ctx_cleanup(HSS_SIGN_CTX *ctx)
-{
-	if (ctx) {
-		lms_sign_ctx_cleanup(&ctx->lms_sign_ctx);
-	}
-}

src/ocsp.c

@@ -14,6 +14,7 @@
 #include <stdint.h>
 #include <gmssl/oid.h>
 #include <gmssl/asn1.h>
+#include <gmssl/mem.h>
 #include <gmssl/error.h>
 #include <gmssl/x509_crl.h>
 #include <gmssl/http.h>
@@ -2135,11 +2136,11 @@ int ocsp_sign(OCSP_SIGN_CTX *ctx,
 	if ((sign_key->algor == OID_ec_public_key
 		&& x509_sign_set_signature_size(&sign_ctx, signature_len) != 1)
 		|| x509_sign(&sign_ctx, response_data, response_data_len, signature, &signature_len) != 1) {
-		x509_sign_ctx_cleanup(&sign_ctx);
+		gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
 		error_print();
 		return -1;
 	}
-	x509_sign_ctx_cleanup(&sign_ctx);
+	gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
 
 	if (ocsp_basic_response_to_der(response_data, response_data_len,
 		sign_algor, signature, signature_len,

src/sdf/sdf.c

@@ -12,6 +12,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include <gmssl/sdf.h>
+#include <gmssl/mem.h>
 #include <gmssl/sm2.h>
 #include <gmssl/sm4.h>
 #include <gmssl/error.h>
@@ -918,8 +919,15 @@ int sdf_sign_reset(SDF_SIGN_CTX *ctx)
 	return 1;
 }
 
-int sdf_release_key(SDF_PRIVATE_KEY *key)
+int sdf_release_private_key(SDF_PRIVATE_KEY *key)
 {
+	if (!key) {
+		return 1;
+	}
+	if (!key->session) {
+		gmssl_secure_clear(key, sizeof(*key));
+		return 1;
+	}
 	if (SDF_ReleasePrivateKeyAccessRight(key->session, key->index) != SDR_OK) {
 		error_print();
 	}
@@ -927,9 +935,15 @@ int sdf_release_key(SDF_PRIVATE_KEY *key)
 		error_print();
 		return -1;
 	}
+	gmssl_secure_clear(key, sizeof(*key));
 	return 1;
 }
 
+int sdf_release_key(SDF_PRIVATE_KEY *key)
+{
+	return sdf_release_private_key(key);
+}
+
 int sdf_close_device(SDF_DEVICE *dev)
 {
 	if (dev) {

src/secp256r1_key.c

@@ -66,15 +66,6 @@ int secp256r1_public_key_equ(const SECP256R1_KEY *key, const SECP256R1_KEY *pub)
 }
 
 
-void secp256r1_key_cleanup(SECP256R1_KEY *key)
-{
-	if (key) {
-		gmssl_secure_clear(key->private_key, sizeof(secp256r1_t));
-		memset(key, 0, sizeof(SECP256R1_KEY));
-	}
-}
-
-
 // SM2将这个命名为_to_octets，应该更准确一些
 int secp256r1_public_key_to_bytes(const SECP256R1_KEY *key, uint8_t **out, size_t *outlen)
 {
@@ -316,7 +307,7 @@ int secp256r1_private_key_from_der(SECP256R1_KEY *key, const uint8_t **in, size_
 
 	// check
 	if (secp256r1_public_key_equ(key, &tmp_key) != 1) {
-		secp256r1_key_cleanup(key);
+		gmssl_secure_clear(key, sizeof(SECP256R1_KEY));
 		error_print();
 		return -1;
 	}

src/skf/skf.c

@@ -182,6 +182,9 @@ int skf_sign(SKF_KEY *key, const uint8_t dgst[32], uint8_t *sig, size_t *siglen)
 
 int skf_release_key(SKF_KEY *key)
 {
+	if (!key) {
+		return 1;
+	}
 	if (key->app_handle) {
 		if (SKF_ClearSecureState(key->app_handle) != SAR_OK
 			|| SKF_CloseApplication(key->app_handle) != SAR_OK) {
@@ -202,6 +205,9 @@ int skf_release_key(SKF_KEY *key)
 
 int skf_close_device(SKF_DEVICE *dev)
 {
+	if (!dev || !dev->handle) {
+		return 1;
+	}
 	if (SKF_UnlockDev(dev->handle) != SAR_OK
 		|| SKF_DisConnectDev(dev->handle) != SAR_OK) {
 		error_print();
@@ -211,12 +217,6 @@ int skf_close_device(SKF_DEVICE *dev)
 	return 1;
 }
 
-
-
-
-
-
-
 int skf_list_devices(FILE *fp, int fmt, int ind, const char *label)
 {
 	int ret = -1;

src/sm4_cl.c

@@ -14,6 +14,7 @@
 #include <stdint.h>
 #include <gmssl/sm4_cl.h>
 #include <gmssl/endian.h>
+#include <gmssl/mem.h>
 #include <gmssl/error.h>
 
 
@@ -79,10 +80,15 @@ static const char *sm4_cl_src;
 
 void sm4_cl_cleanup(SM4_CL_CTX *ctx)
 {
-	clReleaseContext(ctx->context);
-	clReleaseCommandQueue(ctx->queue);
-	clReleaseProgram(ctx->program);
-	clReleaseKernel(ctx->kernel);
+	if (ctx) {
+		if (ctx->mem_rk) clReleaseMemObject(ctx->mem_rk);
+		if (ctx->mem_io) clReleaseMemObject(ctx->mem_io);
+		if (ctx->kernel) clReleaseKernel(ctx->kernel);
+		if (ctx->program) clReleaseProgram(ctx->program);
+		if (ctx->queue) clReleaseCommandQueue(ctx->queue);
+		if (ctx->context) clReleaseContext(ctx->context);
+		gmssl_secure_clear(ctx, sizeof(*ctx));
+	}
 }
 
 static void clPrintDeviceInfo(cl_device_id device)
@@ -231,6 +237,7 @@ static int sm4_cl_set_key(SM4_CL_CTX *ctx, const uint8_t key[16], int enc)
 
 
 end:
+	sm4_cl_cleanup(ctx);
 	return -1;
 }
 
@@ -393,4 +400,3 @@ __kernel void sm4_ctr32_encrypt_blocks(__global const unsigned int *rkey, __glob
 }
 
 );
-

src/sphincs.c

@@ -1328,15 +1328,6 @@ int sphincs_private_key_print(FILE *fp, int fmt, int ind, const char *label, con
 	return 1;
 }
 
-void sphincs_key_cleanup(SPHINCS_KEY *key)
-{
-	if (key) {
-		gmssl_secure_clear(key->secret, sizeof(sphincs_hash128_t));
-		gmssl_secure_clear(key->sk_prf, sizeof(sphincs_hash128_t));
-	}
-}
-
-
 int sphincs_key_generate(SPHINCS_KEY *key)
 {
 	if (!key) {
@@ -1746,10 +1737,3 @@ int sphincs_verify_finish(SPHINCS_SIGN_CTX *ctx)
 
 	return 1;
 }
-
-void sphincs_sign_ctx_cleanup(SPHINCS_SIGN_CTX *ctx)
-{
-	if (ctx) {
-		sphincs_key_cleanup(&ctx->key);
-	}
-}

src/tls.c

@@ -3396,7 +3396,16 @@ int tls_init(TLS_CONNECT *conn, TLS_CTX *ctx)
 
 void tls_cleanup(TLS_CONNECT *conn)
 {
-	gmssl_secure_clear(conn, sizeof(TLS_CONNECT));
+	if (conn) {
+		size_t i;
+
+		x509_key_cleanup(&conn->server_enc_key);
+		for (i = 0; i < conn->key_exchanges_cnt; i++) {
+			x509_key_cleanup(&conn->key_exchanges[i]);
+		}
+		tls_client_verify_cleanup(&conn->client_verify_ctx);
+		gmssl_secure_clear(conn, sizeof(TLS_CONNECT));
+	}
 }
 
 int tls_set_verbose(TLS_CONNECT *conn, int verbose)

src/tls12.c

@@ -2557,11 +2557,11 @@ int tls_send_server_key_exchange(TLS_CONNECT *conn)
 			|| x509_sign_update(&sign_ctx, conn->server_random, 32) != 1
 			|| x509_sign_update(&sign_ctx, server_ecdh_params, server_ecdh_params_len) != 1
 			|| x509_sign_finish(&sign_ctx, sig, &siglen) != 1) {
-			x509_sign_ctx_cleanup(&sign_ctx);
+			gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
 			error_print();
 			return -1;
 		}
-		x509_sign_ctx_cleanup(&sign_ctx);
+		gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
 
 		if (tls12_record_set_handshake_server_key_exchange(conn->record, &conn->recordlen,
 			TLS_server_key_exchange_ecdhe, server_ecdh_params, server_ecdh_params_len,

src/x509_key.c

@@ -334,7 +334,7 @@ void x509_key_cleanup(X509_KEY *key)
 				break;
 #ifdef ENABLE_SECP256R1
 			case OID_secp256r1:
-				secp256r1_key_cleanup(&key->u.secp256r1_key);
+				gmssl_secure_clear(&key->u.secp256r1_key, sizeof(SECP256R1_KEY));
 				break;
 #endif
 			default:
@@ -360,12 +360,12 @@ void x509_key_cleanup(X509_KEY *key)
 #endif
 #ifdef ENABLE_SPHINCS
 		case OID_sphincs_hashsig:
-			sphincs_key_cleanup(&key->u.sphincs_key);
+			gmssl_secure_clear(&key->u.sphincs_key, sizeof(SPHINCS_KEY));
 			break;
 #endif
 #ifdef ENABLE_KYBER
 		case OID_kyber_kem:
-			kyber_key_cleanup(&key->u.kyber_key);
+			gmssl_secure_clear(&key->u.kyber_key, sizeof(KYBER_KEY));
 			break;
 #endif
 #ifdef ENABLE_SM9
@@ -1174,7 +1174,7 @@ int ec_private_key_from_der(X509_KEY *key, int opt_curve, const uint8_t **in, si
 				return -1;
 			}
 			if (secp256r1_public_key_equ(&key->u.secp256r1_key, &p256_pub) != 1) {
-				secp256r1_key_cleanup(&key->u.secp256r1_key);
+				gmssl_secure_clear(&key->u.secp256r1_key, sizeof(SECP256R1_KEY));
 				error_print();
 				return -1;
 			}
@@ -2498,50 +2498,6 @@ int x509_verify(X509_SIGN_CTX *ctx, const uint8_t *data, size_t datalen)
 	return ret;
 }
 
-void x509_sign_ctx_cleanup(X509_SIGN_CTX *ctx)
-{
-	if (ctx) {
-		switch (ctx->sign_algor) {
-		case OID_sm2sign_with_sm3:
-			gmssl_secure_clear(&ctx->u.sm2_sign_ctx, sizeof(SM2_SIGN_CTX));
-			break;
-#ifdef ENABLE_SECP256R1
-		case OID_ecdsa_with_sha256:
-		case OID_ecdsa_with_sha384:
-		case OID_ecdsa_with_sha512:
-			gmssl_secure_clear(&ctx->u.ecdsa_sign_ctx, sizeof(ECDSA_SIGN_CTX));
-			break;
-#endif
-#ifdef ENABLE_LMS
-		case OID_lms_hashsig:
-			lms_sign_ctx_cleanup(&ctx->u.lms_sign_ctx);
-			break;
-		case OID_hss_lms_hashsig:
-			hss_sign_ctx_cleanup(&ctx->u.hss_sign_ctx);
-			break;
-#endif
-#ifdef ENABLE_XMSS
-		case OID_xmss_hashsig:
-			xmss_sign_ctx_cleanup(&ctx->u.xmss_sign_ctx);
-			break;
-		case OID_xmssmt_hashsig:
-			xmssmt_sign_ctx_cleanup(&ctx->u.xmssmt_sign_ctx);
-			break;
-#endif
-#ifdef ENABLE_SPHINCS
-		case OID_sphincs_hashsig:
-			sphincs_sign_ctx_cleanup(&ctx->u.sphincs_sign_ctx);
-			break;
-#endif
-#ifdef ENABLE_SM9
-		case OID_sm9sign:
-			gmssl_secure_clear(&ctx->u.sm9_sign_ctx, sizeof(SM9_SIGN_CTX));
-#endif
-		}
-		memset(ctx, 0, sizeof(X509_SIGN_CTX));
-	}
-}
-
 // FIXME: add arg max_outlen ?
 int x509_key_do_exchange(const X509_KEY *key, const X509_KEY *pub, uint8_t *out, size_t *outlen)
 {

src/xmss.c

@@ -1153,14 +1153,6 @@ int xmss_signature_print(FILE *fp, int fmt, int ind, const char *label, const ui
 	return 1;
 }
 
-void xmss_sign_ctx_cleanup(XMSS_SIGN_CTX *ctx)
-{
-	if (ctx) {
-		gmssl_secure_clear(ctx->xmss_sig.random, sizeof(xmss_hash256_t));
-		gmssl_secure_clear(ctx->xmss_sig.wots_sig, sizeof(xmss_wots_sig_t)); // might cache wots_sk
-	}
-}
-
 int xmss_sign_init(XMSS_SIGN_CTX *ctx, XMSS_KEY *key)
 {
 	xmss_hash256_t hash256_index = {0};
@@ -2222,14 +2214,6 @@ int xmssmt_signature_print(FILE *fp, int fmt, int ind, const char *label, const
 	return 1;
 }
 
-void xmssmt_sign_ctx_cleanup(XMSSMT_SIGN_CTX *ctx)
-{
-	if (ctx) {
-		gmssl_secure_clear(ctx->xmssmt_sig.random, sizeof(xmss_hash256_t));
-		gmssl_secure_clear(ctx->xmssmt_sig.wots_sigs[0], sizeof(xmss_wots_sig_t));
-	}
-}
-
 int xmssmt_sign_init(XMSSMT_SIGN_CTX *ctx, XMSSMT_KEY *key)
 {
 	size_t height;