feat: Replace append with bytes.Clone for better memory handling in multiple files
Kim committed
May 7, 2026 at 11:52 UTC
16100dc156434898765c658d7c9db207cd170e99
10 files changed
+20
-14
cmd/demo-app/main.go
+2
-1
@@ -1,6 +1,7 @@
1
package main
2
3
import (
4
+ "bytes"
5
"context"
6
"errors"
7
"flag"
@@ -229,7 +230,7 @@ func runUDPEchoLoop(ctx context.Context, exposure *sdk.Exposure) {
230
return
231
}
232
232
- payload := append([]byte(nil), frame.Payload...)
233
+ payload := bytes.Clone(frame.Payload)
234
if len(payload) == 0 {
235
payload = []byte("pong")
236
}
portal/acme/acme.go
+2
-1
@@ -1,6 +1,7 @@
1
package acme
2
3
import (
4
+ "bytes"
5
"context"
6
"crypto"
7
"crypto/ecdsa"
@@ -107,7 +108,7 @@ func (r HTTPSRecord) Normalized() (HTTPSRecord, error) {
108
Priority: priority,
109
Target: target,
110
Port: r.Port,
110
- ECHConfigList: append([]byte(nil), r.ECHConfigList...),
111
+ ECHConfigList: bytes.Clone(r.ECHConfigList),
112
}, nil
113
}
114
portal/keyless/client.go
+2
-1
@@ -1,6 +1,7 @@
1
package keyless
2
3
import (
4
+ "bytes"
5
"context"
6
"crypto/tls"
7
"errors"
@@ -76,7 +77,7 @@ func ResolveMaterials(ctx context.Context, endpoint, serverName string) ([]byte,
77
if len(chainPEM) == 0 {
78
return nil, nil, errors.New("keyless certificate chain is required")
79
}
79
- return append([]byte(nil), chainPEM...), append([]byte(nil), chainPEM...), nil
80
+ return bytes.Clone(chainPEM), bytes.Clone(chainPEM), nil
81
}
82
83
func VerifyCertificateHostname(certPEM []byte, hostname string) error {
portal/keyless/ech.go
+1
-1
@@ -120,5 +120,5 @@ func NormalizeEncryptedClientHelloConfigList(raw []byte) ([]byte, error) {
120
if listLength != len(raw)-2 {
121
return nil, errors.New("ech config list length prefix is invalid")
122
}
123
- return append([]byte(nil), raw...), nil
123
+ return bytes.Clone(raw), nil
124
}
portal/lease.go
+3
-2
@@ -1,6 +1,7 @@
1
package portal
2
3
import (
4
+ "bytes"
5
"context"
6
"errors"
7
"fmt"
@@ -163,7 +164,7 @@ func (r *leaseRegistry) Register(req types.RegisterChallengeRequest, clientIP, r
164
hopToken := strings.TrimSpace(req.HopToken)
165
routeHostname := utils.NormalizeHostname(req.RouteHostname)
166
hostnameHash := strings.TrimSpace(req.HostnameHash)
166
- echConfigList := append([]byte(nil), req.ECHConfigList...)
167
+ echConfigList := bytes.Clone(req.ECHConfigList)
168
if hopToken != "" && (req.UDPEnabled || req.TCPEnabled) {
169
return nil, types.RegisterResponse{}, errTransportMismatch
170
}
@@ -484,7 +485,7 @@ func (r *leaseRegistry) RegisterHopRoute(route *types.HopRoute, now time.Time) (
485
}
486
routeHostname := route.RouteHostname
487
hostnameHash := route.HostnameHash
487
- echConfigList := append([]byte(nil), route.ECHConfigList...)
488
+ echConfigList := bytes.Clone(route.ECHConfigList)
489
publicHostname := utils.NormalizeHostname(route.PublicHostname)
490
matchToken := route.MatchToken
491
overlayIPv4, overlayErr := utils.DeriveWireGuardOverlayIPv4(route.ForwardRelay.WireGuardPublicKey)
sdk/api_client.go
+3
-2
@@ -1,6 +1,7 @@
1
package sdk
2
3
import (
4
+ "bytes"
5
"context"
6
"crypto/sha256"
7
"encoding/base32"
@@ -171,7 +172,7 @@ func (l *listener) registerLease(ctx context.Context, ttl time.Duration, udpEnab
172
route.PublicHostname = publicHostname
173
route.RouteHostname = routeHostname
174
route.HostnameHash = utils.HostnameHash(publicHostname)
174
- route.ECHConfigList = append([]byte(nil), echConfigList...)
175
+ route.ECHConfigList = bytes.Clone(echConfigList)
176
route.Metadata = l.metadata.Copy()
177
route.Metadata.Hide = true
178
hopRoutes = append(hopRoutes, route)
@@ -195,7 +196,7 @@ func (l *listener) registerLease(ctx context.Context, ttl time.Duration, udpEnab
196
if streamLease && len(l.multiHop) == 0 {
197
registerReq.RouteHostname = routeHostname
198
registerReq.HostnameHash = utils.HostnameHash(publicHostname)
198
- registerReq.ECHConfigList = append([]byte(nil), echConfigList...)
199
+ registerReq.ECHConfigList = bytes.Clone(echConfigList)
200
}
201
202
var challenge types.RegisterChallengeResponse
sdk/listener.go
+1
-1
@@ -315,7 +315,7 @@ func (l *listener) acceptDatagram() (types.DatagramFrame, error) {
315
return types.DatagramFrame{}, err
316
}
317
318
- frame.Payload = append([]byte(nil), frame.Payload...)
318
+ frame.Payload = bytes.Clone(frame.Payload)
319
if lease, ok := l.leaseSnapshot(); ok {
320
frame.UDPAddr = lease.udpAddr
321
}
sdk/mitm.go
+2
-2
@@ -116,7 +116,7 @@ func (m *mitmManager) probeTLSPassthrough(ctx context.Context) (MITMProbeReport,
116
ServerName: lease.hostname,
117
InsecureSkipVerify: true,
118
MinVersion: keyless.MinTLSVersion(len(lease.echConfigList) > 0),
119
- EncryptedClientHelloConfigList: append([]byte(nil), lease.echConfigList...),
119
+ EncryptedClientHelloConfigList: bytes.Clone(lease.echConfigList),
120
}
121
122
dialer := &tls.Dialer{
@@ -332,7 +332,7 @@ func (m *mitmManager) maybeHandleConn(conn net.Conn) (net.Conn, bool, error) {
332
func (m *mitmManager) startProbe(nonce string, expected []byte) (<-chan string, func()) {
333
m.mu.Lock()
334
state := &mitmProbePending{
335
- expected: append([]byte(nil), expected...),
335
+ expected: bytes.Clone(expected),
336
resultCh: make(chan string, 1),
337
}
338
m.pending[nonce] = state
sdk/mitm_test.go
+2
-2
@@ -58,7 +58,7 @@ func TestMITMProbeConnMatchesExporter(t *testing.T) {
58
}
59
}()
60
61
- frame := append([]byte(nil), nonce...)
61
+ frame := bytes.Clone(nonce)
62
frame = append(frame, bytes.Repeat([]byte{0xAB}, 128)...)
63
if _, err := clientConn.Write(frame); err != nil {
64
t.Fatalf("clientConn.Write() error = %v", err)
@@ -113,7 +113,7 @@ func TestMITMProbeConnDetectsExporterMismatch(t *testing.T) {
113
}
114
}()
115
116
- frame := append([]byte(nil), nonce...)
116
+ frame := bytes.Clone(nonce)
117
frame = append(frame, bytes.Repeat([]byte{0xCD}, 128)...)
118
if _, err := clientConn.Write(frame); err != nil {
119
t.Fatalf("clientConn.Write() error = %v", err)
sdk/proxy.go
+2
-1
@@ -1,6 +1,7 @@
1
package sdk
2
3
import (
4
+ "bytes"
5
"context"
6
"errors"
7
"fmt"
@@ -424,7 +425,7 @@ func (m *udpFlowManager) readLoop(ctx context.Context, key udpFlowKey, conn *net
425
}
426
entry.lastSeen = time.Now()
427
replyFrame := entry.frame
427
- replyFrame.Payload = append([]byte(nil), buf[:n]...)
428
+ replyFrame.Payload = bytes.Clone(buf[:n])
429
m.mu.Unlock()
430
431
if sendErr := m.exposure.SendDatagram(replyFrame); sendErr != nil {