Skip to content

Commit 49729a1

Browse files
LinuxJediLinuxJedi
committed
Fix build issues and findings
1 parent bb8028a commit 49729a1

6 files changed

Lines changed: 200 additions & 85 deletions

File tree

‎src/crypto.c‎

Lines changed: 28 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1909,12 +1909,12 @@ static CK_RV EncryptInit(CK_SESSION_HANDLE hSession,
19091909
ret = CheckOpSupported(obj, CKA_ENCRYPT);
19101910
if (ret != CKR_OK)
19111911
return ret;
1912-
}
19131912

1914-
if (WP11_Session_IsOpCategoryActive(session, WP11_OP_ENCRYPT)) {
1915-
rv = CKR_OPERATION_ACTIVE;
1916-
WOLFPKCS11_LEAVE("C_EncryptInit", rv);
1917-
return rv;
1913+
if (WP11_Session_IsOpCategoryActive(session, WP11_OP_ENCRYPT)) {
1914+
rv = CKR_OPERATION_ACTIVE;
1915+
WOLFPKCS11_LEAVE("C_EncryptInit", rv);
1916+
return rv;
1917+
}
19181918
}
19191919

19201920
type = WP11_Object_GetType(obj);
@@ -2924,12 +2924,12 @@ static CK_RV DecryptInit(CK_SESSION_HANDLE hSession,
29242924
ret = CheckOpSupported(obj, CKA_DECRYPT);
29252925
if (ret != CKR_OK)
29262926
return ret;
2927-
}
29282927

2929-
if (WP11_Session_IsOpCategoryActive(session, WP11_OP_DECRYPT)) {
2930-
rv = CKR_OPERATION_ACTIVE;
2931-
WOLFPKCS11_LEAVE("C_DecryptInit", rv);
2932-
return rv;
2928+
if (WP11_Session_IsOpCategoryActive(session, WP11_OP_DECRYPT)) {
2929+
rv = CKR_OPERATION_ACTIVE;
2930+
WOLFPKCS11_LEAVE("C_DecryptInit", rv);
2931+
return rv;
2932+
}
29332933
}
29342934

29352935
type = WP11_Object_GetType(obj);
@@ -6916,37 +6916,21 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
69166916
ret = WP11_Object_SetSecretKey(pbkdf2Key, secretKeyData, secretKeyLen);
69176917
if (ret == 0) {
69186918
WP11_Object_SetKeyGeneration(pbkdf2Key, pMechanism->mechanism);
6919-
rv = AddObject(session, pbkdf2Key, pTemplate, ulCount, phKey);
6920-
if (rv != CKR_OK) {
6921-
WP11_Object_Free(pbkdf2Key);
6922-
}
6919+
rv = SetInitialStates(pbkdf2Key);
69236920
} else {
6924-
WP11_Object_Free(pbkdf2Key);
69256921
rv = CKR_FUNCTION_FAILED;
69266922
}
6923+
if (rv == CKR_OK) {
6924+
rv = AddObject(session, pbkdf2Key, pTemplate, ulCount, phKey);
6925+
}
6926+
if (rv != CKR_OK) {
6927+
WP11_Object_Free(pbkdf2Key);
6928+
}
69276929
}
69286930

69296931
wc_ForceZero(derivedKey, derivedKeyLen);
69306932
XFREE(derivedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
69316933

6932-
if (rv == CKR_OK) {
6933-
rv = WP11_Object_GetAttr(pbkdf2Key, CKA_SENSITIVE, &getVar,
6934-
&getVarLen);
6935-
if ((rv == CKR_OK) && (getVar == CK_TRUE)) {
6936-
rv = WP11_Object_SetAttr(pbkdf2Key, CKA_ALWAYS_SENSITIVE,
6937-
&trueVar, sizeof(CK_BBOOL));
6938-
}
6939-
if (rv == CKR_OK) {
6940-
rv = WP11_Object_GetAttr(pbkdf2Key, CKA_EXTRACTABLE,
6941-
&getVar, &getVarLen);
6942-
if ((rv == CKR_OK) && (getVar == CK_FALSE)) {
6943-
rv = WP11_Object_SetAttr(pbkdf2Key,
6944-
CKA_NEVER_EXTRACTABLE,
6945-
&trueVar, sizeof(CK_BBOOL));
6946-
}
6947-
}
6948-
}
6949-
69506934
return rv;
69516935
}
69526936
#ifdef WOLFPKCS11_NSS
@@ -7033,37 +7017,21 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
70337017
ret = WP11_Object_SetSecretKey(pbeKey, secretKeyData, secretKeyLen);
70347018
if (ret == 0) {
70357019
WP11_Object_SetKeyGeneration(pbeKey, pMechanism->mechanism);
7036-
rv = AddObject(session, pbeKey, pTemplate, ulCount, phKey);
7037-
if (rv != CKR_OK) {
7038-
WP11_Object_Free(pbeKey);
7039-
}
7020+
rv = SetInitialStates(pbeKey);
70407021
} else {
7041-
WP11_Object_Free(pbeKey);
70427022
rv = CKR_FUNCTION_FAILED;
70437023
}
7024+
if (rv == CKR_OK) {
7025+
rv = AddObject(session, pbeKey, pTemplate, ulCount, phKey);
7026+
}
7027+
if (rv != CKR_OK) {
7028+
WP11_Object_Free(pbeKey);
7029+
}
70447030
}
70457031

70467032
wc_ForceZero(derivedKey, derivedKeyLen);
70477033
XFREE(derivedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
70487034

7049-
if (rv == CKR_OK) {
7050-
rv = WP11_Object_GetAttr(pbeKey, CKA_SENSITIVE, &getVar,
7051-
&getVarLen);
7052-
if ((rv == CKR_OK) && (getVar == CK_TRUE)) {
7053-
rv = WP11_Object_SetAttr(pbeKey, CKA_ALWAYS_SENSITIVE,
7054-
&trueVar, sizeof(CK_BBOOL));
7055-
}
7056-
if (rv == CKR_OK) {
7057-
rv = WP11_Object_GetAttr(pbeKey, CKA_EXTRACTABLE,
7058-
&getVar, &getVarLen);
7059-
if ((rv == CKR_OK) && (getVar == CK_FALSE)) {
7060-
rv = WP11_Object_SetAttr(pbeKey,
7061-
CKA_NEVER_EXTRACTABLE,
7062-
&trueVar, sizeof(CK_BBOOL));
7063-
}
7064-
}
7065-
}
7066-
70677035
return rv;
70687036
}
70697037
#endif
@@ -9052,11 +9020,11 @@ CK_RV C_EncapsulateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
90529020
secretKeyLen);
90539021
if (ret != 0)
90549022
rv = CKR_FUNCTION_FAILED;
9023+
if (rv == CKR_OK)
9024+
rv = SetInitialStates(secretObj);
90559025
if (rv == CKR_OK)
90569026
rv = AddObject(session, secretObj, pTemplate, ulAttributeCount,
90579027
phKey);
9058-
if (rv == CKR_OK)
9059-
rv = SetInitialStates(secretObj);
90609028
}
90619029
if (rv != CKR_OK && secretObj != NULL) {
90629030
WP11_Object_Free(secretObj);
@@ -9158,11 +9126,11 @@ CK_RV C_DecapsulateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
91589126
secretKeyLen);
91599127
if (ret != 0)
91609128
rv = CKR_FUNCTION_FAILED;
9129+
if (rv == CKR_OK)
9130+
rv = SetInitialStates(secretObj);
91619131
if (rv == CKR_OK)
91629132
rv = AddObject(session, secretObj, pTemplate, ulAttributeCount,
91639133
phKey);
9164-
if (rv == CKR_OK)
9165-
rv = SetInitialStates(secretObj);
91669134
}
91679135
if (rv != CKR_OK && secretObj != NULL) {
91689136
WP11_Object_Free(secretObj);

‎src/internal.c‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2699,6 +2699,15 @@ int WP11_Object_Copy(WP11_Object *src, WP11_Object *dest)
26992699
else
27002700
#endif
27012701
{
2702+
#ifndef WOLFPKCS11_NO_STORE
2703+
/* When the source key is encoded (encrypted at rest), the crypto
2704+
* key struct has been freed. The keyData blob is already copied
2705+
* above via OBJ_COPY_DATA, so skip the deep key copy. */
2706+
if (src->encoded) {
2707+
dest->type = src->type;
2708+
}
2709+
else
2710+
#endif
27022711
switch (src->type) {
27032712
#ifndef NO_RSA
27042713
case CKK_RSA: {
@@ -4896,10 +4905,9 @@ static int MlKemKeyTryDecode(MlKemKey* key, int level, byte* data, word32 len,
48964905
else {
48974906
ret = wc_MlKemKey_DecodePublicKey(key, data, len);
48984907
}
4899-
}
4900-
4901-
if (ret != 0) {
4902-
wc_MlKemKey_Free(key);
4908+
if (ret != 0) {
4909+
wc_MlKemKey_Free(key);
4910+
}
49034911
}
49044912

49054913
return ret;
@@ -4922,7 +4930,7 @@ static int wp11_Object_Decode_MlKemKey(WP11_Object* object)
49224930
unsigned char* der;
49234931
int len;
49244932

4925-
if (object->keyDataLen < AES_BLOCK_SIZE)
4933+
if (object->keyDataLen <= AES_BLOCK_SIZE)
49264934
return BAD_FUNC_ARG;
49274935
len = object->keyDataLen - AES_BLOCK_SIZE;
49284936

@@ -9403,7 +9411,9 @@ int WP11_Object_SetMlKemKey(WP11_Object* object, unsigned char** data,
94039411
object->devId);
94049412
break;
94059413
default:
9406-
ret = ASN_PARSE_E;
9414+
if (object->onToken)
9415+
WP11_Lock_UnlockRW(object->lock);
9416+
return ASN_PARSE_E;
94079417
}
94089418

94099419
/* Set seed (only for private keys). */
@@ -13387,6 +13397,13 @@ int WP11_MlKem_GenerateKeyPair(WP11_Object* pub, WP11_Object* priv,
1338713397
ret = wc_MlKemKey_EncodePublicKey(priv->data.mlKemKey, pubKeyBytes,
1338813398
pubKeyLen);
1338913399
}
13400+
if (ret == 0) {
13401+
/* Re-init the public key before decoding into it since it was
13402+
* already Init'd during NewObject -> WP11_Object_SetMlKemKey. */
13403+
wc_MlKemKey_Free(pub->data.mlKemKey);
13404+
ret = wc_MlKemKey_Init(pub->data.mlKemKey, priv->data.mlKemKey->type,
13405+
NULL, pub->devId);
13406+
}
1339013407
if (ret == 0) {
1339113408
ret = wc_MlKemKey_DecodePublicKey(pub->data.mlKemKey, pubKeyBytes,
1339213409
pubKeyLen);
@@ -13423,7 +13440,7 @@ int WP11_MlKem_Encapsulate(WP11_Object* pub, unsigned char** sharedSecret,
1342313440
int ret;
1342413441
int rngInit = 0;
1342513442
WC_RNG rng;
13426-
MlKemKey* mlKemKey = pub->data.mlKemKey;
13443+
MlKemKey* mlKemKey;
1342713444
word32 ctLen = 0;
1342813445

1342913446
*sharedSecret = NULL;
@@ -13436,6 +13453,7 @@ int WP11_MlKem_Encapsulate(WP11_Object* pub, unsigned char** sharedSecret,
1343613453
if (pub->onToken)
1343713454
WP11_Lock_LockRO(pub->lock);
1343813455

13456+
mlKemKey = pub->data.mlKemKey;
1343913457
ret = wc_MlKemKey_CipherTextSize(mlKemKey, &ctLen);
1344013458
if (ret == 0) {
1344113459
if (pCiphertext == NULL) {
@@ -13501,7 +13519,7 @@ int WP11_MlKem_Decapsulate(WP11_Object* priv, unsigned char** sharedSecret,
1350113519
CK_ULONG ulCiphertextLen)
1350213520
{
1350313521
int ret;
13504-
MlKemKey* mlKemKey = priv->data.mlKemKey;
13522+
MlKemKey* mlKemKey;
1350513523

1350613524
*sharedSecret = NULL;
1350713525

@@ -13513,6 +13531,7 @@ int WP11_MlKem_Decapsulate(WP11_Object* priv, unsigned char** sharedSecret,
1351313531
if (priv->onToken)
1351413532
WP11_Lock_LockRO(priv->lock);
1351513533

13534+
mlKemKey = priv->data.mlKemKey;
1351613535
ret = wc_MlKemKey_SharedSecretSize(mlKemKey, ssLen);
1351713536
if (ret == 0) {
1351813537
*sharedSecret = (unsigned char*)XMALLOC(*ssLen, NULL,

‎tests/pbkdf2_keygen_attrs_test.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545

4646
#include "testdata.h"
4747

48-
#ifndef NO_PWDBASED
48+
#if !defined(NO_PWDBASED) && !defined(NO_HMAC)
4949

5050
#define TEST_DIR "./store/pbkdf2_keygen_attrs_test"
5151
#define WOLFPKCS11_TOKEN_FILENAME "wp11_token_0000000000000001"
@@ -428,14 +428,14 @@ int main(int argc, char* argv[])
428428
return (test_failed == 0) ? 0 : 1;
429429
}
430430

431-
#else /* NO_PWDBASED */
431+
#else /* NO_PWDBASED || NO_HMAC */
432432

433433
int main(int argc, char* argv[])
434434
{
435435
(void)argc;
436436
(void)argv;
437437

438-
printf("PWDBASED not available, skipping PBKDF2 keygen attributes test\n");
438+
printf("PWDBASED/HMAC not available, skipping PBKDF2 keygen attributes test\n");
439439
return 0;
440440
}
441441

0 commit comments

Comments
 (0)