Skip to content

Commit 5b7a4ed

Browse files
LinuxJediLinuxJedi
committed
Fix build issues and findings
1 parent bb8028a commit 5b7a4ed

6 files changed

Lines changed: 216 additions & 97 deletions

File tree

‎src/crypto.c‎

Lines changed: 26 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -4093,6 +4093,8 @@ CK_RV C_DigestKey(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hKey)
40934093

40944094
if (ret < 0)
40954095
return CKR_FUNCTION_FAILED;
4096+
if (ret > 0)
4097+
return (CK_RV)ret;
40964098
return CKR_OK;
40974099
}
40984100

@@ -6704,9 +6706,6 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
67046706
CK_RV rv = CKR_OK;
67056707
WP11_Session* session = NULL;
67066708
WP11_Object* key = NULL;
6707-
CK_BBOOL trueVar = CK_TRUE;
6708-
CK_BBOOL getVar;
6709-
CK_ULONG getVarLen = sizeof(CK_BBOOL);
67106709
CK_KEY_TYPE keyType;
67116710

67126711
WOLFPKCS11_ENTER("C_GenerateKey");
@@ -6916,37 +6915,21 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
69166915
ret = WP11_Object_SetSecretKey(pbkdf2Key, secretKeyData, secretKeyLen);
69176916
if (ret == 0) {
69186917
WP11_Object_SetKeyGeneration(pbkdf2Key, pMechanism->mechanism);
6919-
rv = AddObject(session, pbkdf2Key, pTemplate, ulCount, phKey);
6920-
if (rv != CKR_OK) {
6921-
WP11_Object_Free(pbkdf2Key);
6922-
}
6918+
rv = SetInitialStates(pbkdf2Key);
69236919
} else {
6924-
WP11_Object_Free(pbkdf2Key);
69256920
rv = CKR_FUNCTION_FAILED;
69266921
}
6922+
if (rv == CKR_OK) {
6923+
rv = AddObject(session, pbkdf2Key, pTemplate, ulCount, phKey);
6924+
}
6925+
if (rv != CKR_OK) {
6926+
WP11_Object_Free(pbkdf2Key);
6927+
}
69276928
}
69286929

69296930
wc_ForceZero(derivedKey, derivedKeyLen);
69306931
XFREE(derivedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
69316932

6932-
if (rv == CKR_OK) {
6933-
rv = WP11_Object_GetAttr(pbkdf2Key, CKA_SENSITIVE, &getVar,
6934-
&getVarLen);
6935-
if ((rv == CKR_OK) && (getVar == CK_TRUE)) {
6936-
rv = WP11_Object_SetAttr(pbkdf2Key, CKA_ALWAYS_SENSITIVE,
6937-
&trueVar, sizeof(CK_BBOOL));
6938-
}
6939-
if (rv == CKR_OK) {
6940-
rv = WP11_Object_GetAttr(pbkdf2Key, CKA_EXTRACTABLE,
6941-
&getVar, &getVarLen);
6942-
if ((rv == CKR_OK) && (getVar == CK_FALSE)) {
6943-
rv = WP11_Object_SetAttr(pbkdf2Key,
6944-
CKA_NEVER_EXTRACTABLE,
6945-
&trueVar, sizeof(CK_BBOOL));
6946-
}
6947-
}
6948-
}
6949-
69506933
return rv;
69516934
}
69526935
#ifdef WOLFPKCS11_NSS
@@ -7033,37 +7016,21 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
70337016
ret = WP11_Object_SetSecretKey(pbeKey, secretKeyData, secretKeyLen);
70347017
if (ret == 0) {
70357018
WP11_Object_SetKeyGeneration(pbeKey, pMechanism->mechanism);
7036-
rv = AddObject(session, pbeKey, pTemplate, ulCount, phKey);
7037-
if (rv != CKR_OK) {
7038-
WP11_Object_Free(pbeKey);
7039-
}
7019+
rv = SetInitialStates(pbeKey);
70407020
} else {
7041-
WP11_Object_Free(pbeKey);
70427021
rv = CKR_FUNCTION_FAILED;
70437022
}
7023+
if (rv == CKR_OK) {
7024+
rv = AddObject(session, pbeKey, pTemplate, ulCount, phKey);
7025+
}
7026+
if (rv != CKR_OK) {
7027+
WP11_Object_Free(pbeKey);
7028+
}
70447029
}
70457030

70467031
wc_ForceZero(derivedKey, derivedKeyLen);
70477032
XFREE(derivedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
70487033

7049-
if (rv == CKR_OK) {
7050-
rv = WP11_Object_GetAttr(pbeKey, CKA_SENSITIVE, &getVar,
7051-
&getVarLen);
7052-
if ((rv == CKR_OK) && (getVar == CK_TRUE)) {
7053-
rv = WP11_Object_SetAttr(pbeKey, CKA_ALWAYS_SENSITIVE,
7054-
&trueVar, sizeof(CK_BBOOL));
7055-
}
7056-
if (rv == CKR_OK) {
7057-
rv = WP11_Object_GetAttr(pbeKey, CKA_EXTRACTABLE,
7058-
&getVar, &getVarLen);
7059-
if ((rv == CKR_OK) && (getVar == CK_FALSE)) {
7060-
rv = WP11_Object_SetAttr(pbeKey,
7061-
CKA_NEVER_EXTRACTABLE,
7062-
&trueVar, sizeof(CK_BBOOL));
7063-
}
7064-
}
7065-
}
7066-
70677034
return rv;
70687035
}
70697036
#endif
@@ -7094,29 +7061,16 @@ CK_RV C_GenerateKey(CK_SESSION_HANDLE hSession,
70947061
WP11_Session_GetSlot(session),
70957062
pMechanism->mechanism);
70967063
if (ret != 0) {
7097-
WP11_Object_Free(key);
70987064
rv = CKR_FUNCTION_FAILED;
70997065
}
7100-
else {
7101-
rv = AddObject(session, key, pTemplate, ulCount, phKey);
7102-
if (rv != CKR_OK) {
7103-
WP11_Object_Free(key);
7104-
}
7105-
}
7106-
}
7107-
}
7108-
if (rv == CKR_OK) {
7109-
rv = WP11_Object_GetAttr(key, CKA_SENSITIVE, &getVar, &getVarLen);
7110-
if ((rv == CKR_OK) && (getVar == CK_TRUE)) {
7111-
rv = WP11_Object_SetAttr(key, CKA_ALWAYS_SENSITIVE, &trueVar,
7112-
sizeof(CK_BBOOL));
71137066
}
7067+
if (rv == CKR_OK)
7068+
rv = SetInitialStates(key);
71147069
if (rv == CKR_OK) {
7115-
rv = WP11_Object_GetAttr(key, CKA_EXTRACTABLE, &getVar, &getVarLen);
7116-
if ((rv == CKR_OK) && (getVar == CK_FALSE)) {
7117-
rv = WP11_Object_SetAttr(key, CKA_NEVER_EXTRACTABLE, &trueVar,
7118-
sizeof(CK_BBOOL));
7119-
}
7070+
rv = AddObject(session, key, pTemplate, ulCount, phKey);
7071+
}
7072+
if (rv != CKR_OK && key != NULL) {
7073+
WP11_Object_Free(key);
71207074
}
71217075
}
71227076

@@ -9052,11 +9006,11 @@ CK_RV C_EncapsulateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
90529006
secretKeyLen);
90539007
if (ret != 0)
90549008
rv = CKR_FUNCTION_FAILED;
9009+
if (rv == CKR_OK)
9010+
rv = SetInitialStates(secretObj);
90559011
if (rv == CKR_OK)
90569012
rv = AddObject(session, secretObj, pTemplate, ulAttributeCount,
90579013
phKey);
9058-
if (rv == CKR_OK)
9059-
rv = SetInitialStates(secretObj);
90609014
}
90619015
if (rv != CKR_OK && secretObj != NULL) {
90629016
WP11_Object_Free(secretObj);
@@ -9158,11 +9112,11 @@ CK_RV C_DecapsulateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
91589112
secretKeyLen);
91599113
if (ret != 0)
91609114
rv = CKR_FUNCTION_FAILED;
9115+
if (rv == CKR_OK)
9116+
rv = SetInitialStates(secretObj);
91619117
if (rv == CKR_OK)
91629118
rv = AddObject(session, secretObj, pTemplate, ulAttributeCount,
91639119
phKey);
9164-
if (rv == CKR_OK)
9165-
rv = SetInitialStates(secretObj);
91669120
}
91679121
if (rv != CKR_OK && secretObj != NULL) {
91689122
WP11_Object_Free(secretObj);

‎src/internal.c‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2699,6 +2699,15 @@ int WP11_Object_Copy(WP11_Object *src, WP11_Object *dest)
26992699
else
27002700
#endif
27012701
{
2702+
#ifndef WOLFPKCS11_NO_STORE
2703+
/* When the source key is encoded (encrypted at rest), the crypto
2704+
* key struct has been freed. The keyData blob is already copied
2705+
* above via OBJ_COPY_DATA, so skip the deep key copy. */
2706+
if (src->encoded) {
2707+
dest->type = src->type;
2708+
}
2709+
else
2710+
#endif
27022711
switch (src->type) {
27032712
#ifndef NO_RSA
27042713
case CKK_RSA: {
@@ -4896,10 +4905,9 @@ static int MlKemKeyTryDecode(MlKemKey* key, int level, byte* data, word32 len,
48964905
else {
48974906
ret = wc_MlKemKey_DecodePublicKey(key, data, len);
48984907
}
4899-
}
4900-
4901-
if (ret != 0) {
4902-
wc_MlKemKey_Free(key);
4908+
if (ret != 0) {
4909+
wc_MlKemKey_Free(key);
4910+
}
49034911
}
49044912

49054913
return ret;
@@ -4922,7 +4930,7 @@ static int wp11_Object_Decode_MlKemKey(WP11_Object* object)
49224930
unsigned char* der;
49234931
int len;
49244932

4925-
if (object->keyDataLen < AES_BLOCK_SIZE)
4933+
if (object->keyDataLen <= AES_BLOCK_SIZE)
49264934
return BAD_FUNC_ARG;
49274935
len = object->keyDataLen - AES_BLOCK_SIZE;
49284936

@@ -9403,7 +9411,9 @@ int WP11_Object_SetMlKemKey(WP11_Object* object, unsigned char** data,
94039411
object->devId);
94049412
break;
94059413
default:
9406-
ret = ASN_PARSE_E;
9414+
if (object->onToken)
9415+
WP11_Lock_UnlockRW(object->lock);
9416+
return ASN_PARSE_E;
94079417
}
94089418

94099419
/* Set seed (only for private keys). */
@@ -13387,6 +13397,13 @@ int WP11_MlKem_GenerateKeyPair(WP11_Object* pub, WP11_Object* priv,
1338713397
ret = wc_MlKemKey_EncodePublicKey(priv->data.mlKemKey, pubKeyBytes,
1338813398
pubKeyLen);
1338913399
}
13400+
if (ret == 0) {
13401+
/* Re-init the public key before decoding into it since it was
13402+
* already Init'd during NewObject -> WP11_Object_SetMlKemKey. */
13403+
wc_MlKemKey_Free(pub->data.mlKemKey);
13404+
ret = wc_MlKemKey_Init(pub->data.mlKemKey, priv->data.mlKemKey->type,
13405+
NULL, pub->devId);
13406+
}
1339013407
if (ret == 0) {
1339113408
ret = wc_MlKemKey_DecodePublicKey(pub->data.mlKemKey, pubKeyBytes,
1339213409
pubKeyLen);
@@ -13423,7 +13440,7 @@ int WP11_MlKem_Encapsulate(WP11_Object* pub, unsigned char** sharedSecret,
1342313440
int ret;
1342413441
int rngInit = 0;
1342513442
WC_RNG rng;
13426-
MlKemKey* mlKemKey = pub->data.mlKemKey;
13443+
MlKemKey* mlKemKey;
1342713444
word32 ctLen = 0;
1342813445

1342913446
*sharedSecret = NULL;
@@ -13436,6 +13453,7 @@ int WP11_MlKem_Encapsulate(WP11_Object* pub, unsigned char** sharedSecret,
1343613453
if (pub->onToken)
1343713454
WP11_Lock_LockRO(pub->lock);
1343813455

13456+
mlKemKey = pub->data.mlKemKey;
1343913457
ret = wc_MlKemKey_CipherTextSize(mlKemKey, &ctLen);
1344013458
if (ret == 0) {
1344113459
if (pCiphertext == NULL) {
@@ -13501,7 +13519,7 @@ int WP11_MlKem_Decapsulate(WP11_Object* priv, unsigned char** sharedSecret,
1350113519
CK_ULONG ulCiphertextLen)
1350213520
{
1350313521
int ret;
13504-
MlKemKey* mlKemKey = priv->data.mlKemKey;
13522+
MlKemKey* mlKemKey;
1350513523

1350613524
*sharedSecret = NULL;
1350713525

@@ -13513,6 +13531,7 @@ int WP11_MlKem_Decapsulate(WP11_Object* priv, unsigned char** sharedSecret,
1351313531
if (priv->onToken)
1351413532
WP11_Lock_LockRO(priv->lock);
1351513533

13534+
mlKemKey = priv->data.mlKemKey;
1351613535
ret = wc_MlKemKey_SharedSecretSize(mlKemKey, ssLen);
1351713536
if (ret == 0) {
1351813537
*sharedSecret = (unsigned char*)XMALLOC(*ssLen, NULL,

‎tests/pbkdf2_keygen_attrs_test.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545

4646
#include "testdata.h"
4747

48-
#ifndef NO_PWDBASED
48+
#if !defined(NO_PWDBASED) && !defined(NO_HMAC)
4949

5050
#define TEST_DIR "./store/pbkdf2_keygen_attrs_test"
5151
#define WOLFPKCS11_TOKEN_FILENAME "wp11_token_0000000000000001"
@@ -428,14 +428,14 @@ int main(int argc, char* argv[])
428428
return (test_failed == 0) ? 0 : 1;
429429
}
430430

431-
#else /* NO_PWDBASED */
431+
#else /* NO_PWDBASED || NO_HMAC */
432432

433433
int main(int argc, char* argv[])
434434
{
435435
(void)argc;
436436
(void)argv;
437437

438-
printf("PWDBASED not available, skipping PBKDF2 keygen attributes test\n");
438+
printf("PWDBASED/HMAC not available, skipping PBKDF2 keygen attributes test\n");
439439
return 0;
440440
}
441441

0 commit comments

Comments
 (0)