Skip to content

Commit 8194c25

Browse files
dgarskedgarske
authored
Merge pull request #162 from miyazakh/fenrir_id299
f-299:falseVal initialized to CK_TRUE instead of CK_FALSE
2 parents 42bc4e6 + ed036ae commit 8194c25

3 files changed

Lines changed: 144 additions & 2 deletions

File tree

‎src/crypto.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/* crypto.c
22
*
3-
* Copyright (C) 2006-2025 wolfSSL Inc.
3+
* Copyright (C) 2006-2026 wolfSSL Inc.
44
*
55
* This file is part of wolfPKCS11.
66
*
@@ -878,7 +878,7 @@ static CK_RV AddRSAPrivateKeyObject(WP11_Session* session,
878878
WP11_Object* pubKeyObject = NULL;
879879
CK_ATTRIBUTE* attr = NULL;
880880
CK_BBOOL trueVal = CK_TRUE;
881-
CK_BBOOL falseVal = CK_TRUE;
881+
CK_BBOOL falseVal = CK_FALSE;
882882

883883
CK_OBJECT_HANDLE hPub;
884884

‎tests/pkcs11str.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,11 @@ static CK_RV find_rsa_pub_key_label(CK_SESSION_HANDLE session,
300300
CK_ATTRIBUTE pubKeyTmpl[] = {
301301
{ CKA_CLASS, &pubKeyClass, sizeof(pubKeyClass) },
302302
{ CKA_KEY_TYPE, &rsaKeyType, sizeof(rsaKeyType) },
303+
#ifndef WOLFPKCS11_KEYPAIR_GEN_COMMON_LABEL
303304
{ CKA_LABEL, (unsigned char*)"", 0 },
305+
#else
306+
{ CKA_LABEL, (unsigned char*)"priv_label", 10 },
307+
#endif
304308
};
305309
CK_ULONG pubKeyTmplCnt = sizeof(pubKeyTmpl) / sizeof(*pubKeyTmpl);
306310
CK_ULONG count;

‎tests/pkcs11test.c‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6430,6 +6430,138 @@ static CK_RV test_rsa_wrap_unwrap_key(void* args)
64306430
}
64316431
#endif
64326432

6433+
#if defined(WOLFPKCS11_KEYPAIR_GEN_COMMON_LABEL) && \
6434+
defined(HAVE_AES_KEYWRAP) && !defined(WOLFPKCS11_NO_STORE) && \
6435+
!defined(NO_RSA) && !defined(NO_AES) && \
6436+
(defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA))
6437+
/* Test that the companion public key auto-generated during RSA private key
6438+
* unwrap has CKA_WRAP set to CK_FALSE (not CK_TRUE). */
6439+
static CK_RV test_rsa_unwrap_companion_pub_cka_wrap(void* args)
6440+
{
6441+
CK_SESSION_HANDLE session = *(CK_SESSION_HANDLE*)args;
6442+
CK_RV ret;
6443+
CK_MECHANISM mech = { CKM_AES_KEY_WRAP_PAD, NULL, 0 };
6444+
CK_OBJECT_HANDLE wrappingKey = CK_INVALID_HANDLE;
6445+
CK_OBJECT_HANDLE privKey = CK_INVALID_HANDLE;
6446+
CK_OBJECT_HANDLE unwrappedPrivKey = CK_INVALID_HANDLE;
6447+
CK_OBJECT_HANDLE pubKey = CK_INVALID_HANDLE;
6448+
byte wrappedKey[2048];
6449+
CK_ULONG wrappedKeyLen = sizeof(wrappedKey);
6450+
CK_BBOOL wrapAttr = CK_TRUE;
6451+
CK_BBOOL sessionObj = CK_FALSE;
6452+
CK_BBOOL wrapTrue = CK_TRUE;
6453+
CK_BBOOL unwrapTrue = CK_TRUE;
6454+
CK_ULONG count;
6455+
CK_ATTRIBUTE aesKeyTmpl[] = {
6456+
{ CKA_CLASS, &secretKeyClass, sizeof(secretKeyClass) },
6457+
{ CKA_KEY_TYPE, &aesKeyType, sizeof(aesKeyType) },
6458+
{ CKA_ENCRYPT, &ckTrue, sizeof(ckTrue) },
6459+
{ CKA_DECRYPT, &ckTrue, sizeof(ckTrue) },
6460+
{ CKA_WRAP, &wrapTrue, sizeof(wrapTrue) },
6461+
{ CKA_UNWRAP, &unwrapTrue, sizeof(unwrapTrue) },
6462+
{ CKA_TOKEN, &sessionObj, sizeof(sessionObj) },
6463+
{ CKA_VALUE, aes_128_key, sizeof(aes_128_key) },
6464+
};
6465+
CK_ULONG aesKeyTmplCnt = sizeof(aesKeyTmpl) / sizeof(*aesKeyTmpl);
6466+
CK_ATTRIBUTE rsaPrivTmpl[] = {
6467+
{ CKA_CLASS, &privKeyClass, sizeof(privKeyClass) },
6468+
{ CKA_KEY_TYPE, &rsaKeyType, sizeof(rsaKeyType) },
6469+
{ CKA_DECRYPT, &ckTrue, sizeof(ckTrue) },
6470+
{ CKA_MODULUS, rsa_2048_modulus, sizeof(rsa_2048_modulus) },
6471+
{ CKA_PRIVATE_EXPONENT, rsa_2048_priv_exp, sizeof(rsa_2048_priv_exp) },
6472+
{ CKA_PRIME_1, rsa_2048_p, sizeof(rsa_2048_p) },
6473+
{ CKA_PRIME_2, rsa_2048_q, sizeof(rsa_2048_q) },
6474+
{ CKA_EXPONENT_1, rsa_2048_dP, sizeof(rsa_2048_dP) },
6475+
{ CKA_EXPONENT_2, rsa_2048_dQ, sizeof(rsa_2048_dQ) },
6476+
{ CKA_COEFFICIENT, rsa_2048_u, sizeof(rsa_2048_u) },
6477+
{ CKA_PUBLIC_EXPONENT, rsa_2048_pub_exp, sizeof(rsa_2048_pub_exp) },
6478+
{ CKA_EXTRACTABLE, &ckTrue, sizeof(ckTrue) },
6479+
{ CKA_TOKEN, &sessionObj, sizeof(sessionObj) },
6480+
};
6481+
CK_ULONG rsaPrivTmplCnt = sizeof(rsaPrivTmpl) / sizeof(*rsaPrivTmpl);
6482+
CK_ATTRIBUTE unwrapTmpl[] = {
6483+
{ CKA_CLASS, &privKeyClass, sizeof(privKeyClass) },
6484+
{ CKA_KEY_TYPE, &rsaKeyType, sizeof(rsaKeyType) },
6485+
{ CKA_TOKEN, &sessionObj, sizeof(sessionObj) },
6486+
};
6487+
CK_ULONG unwrapTmplCnt = sizeof(unwrapTmpl) / sizeof(*unwrapTmpl);
6488+
CK_ATTRIBUTE pubKeySearchTmpl[] = {
6489+
{ CKA_CLASS, &pubKeyClass, sizeof(pubKeyClass) },
6490+
{ CKA_KEY_TYPE, &rsaKeyType, sizeof(rsaKeyType) },
6491+
{ CKA_TOKEN, &sessionObj, sizeof(sessionObj) },
6492+
};
6493+
CK_ULONG pubKeySearchTmplCnt =
6494+
sizeof(pubKeySearchTmpl) / sizeof(*pubKeySearchTmpl);
6495+
CK_ATTRIBUTE getWrapTmpl[] = {
6496+
{ CKA_WRAP, &wrapAttr, sizeof(wrapAttr) },
6497+
};
6498+
/* Create the AES wrapping key */
6499+
ret = funcList->C_CreateObject(session, aesKeyTmpl, aesKeyTmplCnt,
6500+
&wrappingKey);
6501+
CHECK_CKR(ret, "AES Wrapping Key Create Object");
6502+
/* Create the RSA private key */
6503+
if (ret == CKR_OK) {
6504+
ret = funcList->C_CreateObject(session, rsaPrivTmpl, rsaPrivTmplCnt,
6505+
&privKey);
6506+
CHECK_CKR(ret, "RSA Private Key Create Object");
6507+
}
6508+
/* Wrap the RSA private key */
6509+
if (ret == CKR_OK) {
6510+
ret = funcList->C_WrapKey(session, &mech, wrappingKey, privKey,
6511+
wrappedKey, &wrappedKeyLen);
6512+
CHECK_CKR(ret, "Wrap RSA Private Key with AES");
6513+
}
6514+
/* Clean up */
6515+
funcList->C_DestroyObject(session, privKey);
6516+
privKey = CK_INVALID_HANDLE;
6517+
/* Unwrap the RSA private key */
6518+
if (ret == CKR_OK) {
6519+
ret = funcList->C_UnwrapKey(session, &mech, wrappingKey,
6520+
wrappedKey, wrappedKeyLen,
6521+
unwrapTmpl, unwrapTmplCnt,
6522+
&unwrappedPrivKey);
6523+
CHECK_CKR(ret, "Unwrap RSA Private Key");
6524+
}
6525+
/* Find the companion public key */
6526+
if (ret == CKR_OK) {
6527+
ret = funcList->C_FindObjectsInit(session, pubKeySearchTmpl,
6528+
pubKeySearchTmplCnt);
6529+
CHECK_CKR(ret, "Find companion public key Init");
6530+
}
6531+
/* Find the companion public key */
6532+
if (ret == CKR_OK) {
6533+
ret = funcList->C_FindObjects(session, &pubKey, 1, &count);
6534+
CHECK_CKR(ret, "Find companion public key");
6535+
}
6536+
/* Finalize the object search */
6537+
if (ret == CKR_OK) {
6538+
ret = funcList->C_FindObjectsFinal(session);
6539+
CHECK_CKR(ret, "Find companion public key Final");
6540+
}
6541+
/* Check if the companion public key was found */
6542+
if (ret == CKR_OK && count == 0) {
6543+
ret = -1;
6544+
CHECK_CKR(ret, "Companion public key not found");
6545+
}
6546+
/* Check the wrap attribute of the companion public key */
6547+
if (ret == CKR_OK) {
6548+
ret = funcList->C_GetAttributeValue(session, pubKey, getWrapTmpl, 1);
6549+
CHECK_CKR(ret, "Get CKA_WRAP from companion public key");
6550+
}
6551+
/* Check that the companion public key has CKA_WRAP set to CK_FALSE */
6552+
if (ret == CKR_OK && wrapAttr != CK_FALSE) {
6553+
ret = -1;
6554+
CHECK_CKR(ret, "CKA_WRAP must be CK_FALSE on companion public key");
6555+
}
6556+
/* Clean up */
6557+
funcList->C_DestroyObject(session, wrappingKey);
6558+
funcList->C_DestroyObject(session, unwrappedPrivKey);
6559+
funcList->C_DestroyObject(session, pubKey);
6560+
6561+
return ret;
6562+
}
6563+
#endif /* WOLFPKCS11_KEYPAIR_GEN_COMMON_LABEL && HAVE_AES_KEYWRAP && ... */
6564+
64336565
static CK_RV test_attributes_rsa(void* args)
64346566
{
64356567
CK_SESSION_HANDLE session = *(CK_SESSION_HANDLE*)args;
@@ -15866,6 +15998,12 @@ static TEST_FUNC testFunc[] = {
1586615998
#if (!defined(NO_RSA) && !defined(WOLFPKCS11_NO_STORE))
1586715999
PKCS11TEST_FUNC_SESS_DECL(test_rsa_wrap_unwrap_key),
1586816000
#endif
16001+
#if defined(WOLFPKCS11_KEYPAIR_GEN_COMMON_LABEL) && \
16002+
defined(HAVE_AES_KEYWRAP) && !defined(WOLFPKCS11_NO_STORE) && \
16003+
!defined(NO_RSA) && !defined(NO_AES) && \
16004+
(defined(WOLFSSL_KEY_GEN) || defined(OPENSSL_EXTRA))
16005+
PKCS11TEST_FUNC_SESS_DECL(test_rsa_unwrap_companion_pub_cka_wrap),
16006+
#endif
1586916007
#ifndef NO_DH
1587016008
PKCS11TEST_FUNC_SESS_DECL(test_derive_key),
1587116009
#endif

0 commit comments

Comments
 (0)