Use zfree() to explicitly zero IPsec keys.

[jhb]

Test Plan

• tested with IPsec tunnels over IPv4 (AES-CBC + SHA1 and AES-GCM) and IPv6 (AES-GCM) and using setkey -F to clear state after

[cem]

No interest in ipsec.

[delphij]

I think setting tdb_xform to NULL is no longer needed (as they are about to be done by the caller anyway).

sys/netipsec/xform_ah.c

256 ↗

(On Diff #73614)

Looks like this is redundant too? (Already done by caller, key_cleansav).

sys/netipsec/xform_esp.c

250 ↗

(On Diff #73614)

Looks like this is redundant too? (Already done by caller, key_cleansav).

sys/netipsec/xform_tcp.c

368 ↗

(On Diff #73614)

Looks like this is redundant too? (Already done by caller, key_cleansav).

[jhb]

In D25442#561674, @delphij wrote:

I think setting tdb_xform to NULL is no longer needed (as they are about to be done by the caller anyway).

Yes, I removed those in the followup change. Here I was trying to just focus on the key zeroing via zfree separate from the other change.