commit 3b3d29b156ac03b8fbd56e8c6b45cc0f607a723a
author Vernon Mauery <vernon.mauery@linux.intel.com> Thu Aug 05 15:03:35 2021 -0700
committer Vernon Mauery <vernon.mauery@linux.intel.com> Fri Sep 03 12:29:41 2021 -0700
tree eb0014439ca8897992528f4444aca571a6f999ca
parent 69245b70a618784b9846877fe372c5aaf8e666b0

Update to use SecureString and SecureBuffer

ipmiOEMSetUser2Activation gets a SecureBuffer and the extra
OPENSSL_cleanse functions can be removed for SecureString

Change-Id: Ib629ea4c3bd12c446dfad671bb47ed0b61001fd6
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>

src/oemcommands.cpp

diff --git a/src/oemcommands.cpp b/src/oemcommands.cpp
index 76d10a5..e25e40d 100644
--- a/src/oemcommands.cpp
+++ b/src/oemcommands.cpp
@@ -1052,8 +1052,12 @@
  */
 ipmi::RspType<> ipmiOEMSetUser2Activation(
     std::array<uint8_t, ipmi::ipmiMaxUserName>& userName,
-    std::array<uint8_t, ipmi::maxIpmi20PasswordSize>& userPassword)
+    const SecureBuffer& userPassword)
 {
+    if (userPassword.size() != ipmi::maxIpmi20PasswordSize)
+    {
+        return ipmi::responseReqDataLenInvalid();
+    }
     bool userState = false;
     // Check for System Interface not exist and LAN should be static
     for (uint8_t channel = 0; channel < maxIpmiChannels; channel++)
@@ -1145,7 +1149,6 @@
             {
                 phosphor::logging::log<phosphor::logging::level::INFO>(
                     "ipmiOEMSetUser2Activation: user created successfully ");
-                OPENSSL_cleanse(userPassword.data(), userPassword.size());
 
                 return ipmi::responseSuccess();
             }
@@ -1155,7 +1158,6 @@
         ipmiUserSetUserName(ipmiDefaultUserId, static_cast<std::string>(""));
         phosphor::logging::log<phosphor::logging::level::ERR>(
             "ipmiOEMSetUser2Activation: password / priv setting is failed.");
-        OPENSSL_cleanse(userPassword.data(), userPassword.size());
     }
     else
     {
@@ -1263,9 +1265,6 @@
         {
             status = ipmiSetSpecialUserPassword("root", passwd);
         }
-        // Clear sensitive data
-        OPENSSL_cleanse(passwd.data(), passwd.length());
-
         return ipmi::response(status);
     }
     else