Skip to content

Commit cc9e93b

Browse files
LinuxJediLinuxJedi
committed
More NSS fixes
* `C_Decrypt` should return `CKR_ENCRYPTED_DATA_INVALID` when decryption fails * Fix Clang compiler error * Fix RSA test for storage disabled * Fix NSS + storage disabled compiling * Declare `CKM_HKDF_KEY_GEN` in mechanism list
1 parent eeef748 commit cc9e93b

4 files changed

Lines changed: 30 additions & 25 deletions

File tree

‎src/crypto.c‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2946,7 +2946,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
29462946
&decDataLen, obj,
29472947
WP11_Session_GetSlot(session));
29482948
if (ret < 0)
2949-
return CKR_FUNCTION_FAILED;
2949+
return CKR_ENCRYPTED_DATA_INVALID;
29502950
*pulDataLen = decDataLen;
29512951
break;
29522952
case CKM_RSA_PKCS:
@@ -2966,7 +2966,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
29662966
&decDataLen, obj,
29672967
WP11_Session_GetSlot(session));
29682968
if (ret < 0)
2969-
return CKR_FUNCTION_FAILED;
2969+
return CKR_ENCRYPTED_DATA_INVALID;
29702970
*pulDataLen = decDataLen;
29712971
break;
29722972
#ifndef WC_NO_RSA_OAEP
@@ -2988,7 +2988,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
29882988
(int)ulEncryptedDataLen, pData,
29892989
&decDataLen, obj, session);
29902990
if (ret < 0)
2991-
return CKR_FUNCTION_FAILED;
2991+
return CKR_ENCRYPTED_DATA_INVALID;
29922992
*pulDataLen = decDataLen;
29932993
break;
29942994
#endif
@@ -3010,7 +3010,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
30103010
ret = WP11_AesCbc_Decrypt(pEncryptedData, (int)ulEncryptedDataLen,
30113011
pData, &decDataLen, session);
30123012
if (ret < 0)
3013-
return CKR_FUNCTION_FAILED;
3013+
return CKR_ENCRYPTED_DATA_INVALID;
30143014
*pulDataLen = decDataLen;
30153015
break;
30163016
case CKM_AES_CBC_PAD:
@@ -3029,7 +3029,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
30293029
(int)ulEncryptedDataLen, pData,
30303030
&decDataLen, session);
30313031
if (ret < 0)
3032-
return CKR_FUNCTION_FAILED;
3032+
return CKR_ENCRYPTED_DATA_INVALID;
30333033
*pulDataLen = decDataLen;
30343034
break;
30353035
#endif
@@ -3049,7 +3049,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
30493049
ret = WP11_AesCtr_Do(pEncryptedData,
30503050
(word32)ulEncryptedDataLen, pData, &decDataLen, session);
30513051
if (ret != 0)
3052-
return CKR_FUNCTION_FAILED;
3052+
return CKR_ENCRYPTED_DATA_INVALID;
30533053
*pulDataLen = decDataLen;
30543054
break;
30553055
#endif
@@ -3070,7 +3070,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
30703070
ret = WP11_AesGcm_Decrypt(pEncryptedData, (int)ulEncryptedDataLen,
30713071
pData, &decDataLen, obj, session);
30723072
if (ret < 0)
3073-
return CKR_FUNCTION_FAILED;
3073+
return CKR_ENCRYPTED_DATA_INVALID;
30743074
*pulDataLen = decDataLen;
30753075
break;
30763076
#endif
@@ -3091,7 +3091,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
30913091
ret = WP11_AesCcm_Decrypt(pEncryptedData, (int)ulEncryptedDataLen,
30923092
pData, &decDataLen, obj, session);
30933093
if (ret < 0)
3094-
return CKR_FUNCTION_FAILED;
3094+
return CKR_ENCRYPTED_DATA_INVALID;
30953095
*pulDataLen = decDataLen;
30963096
break;
30973097
#endif
@@ -3111,7 +3111,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
31113111
ret = WP11_AesEcb_Decrypt(pEncryptedData, (int)ulEncryptedDataLen,
31123112
pData, &decDataLen, obj, session);
31133113
if (ret < 0)
3114-
return CKR_FUNCTION_FAILED;
3114+
return CKR_ENCRYPTED_DATA_INVALID;
31153115
*pulDataLen = decDataLen;
31163116
break;
31173117
#endif
@@ -3133,7 +3133,7 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
31333133
if (ret == BUFFER_E)
31343134
return CKR_BUFFER_TOO_SMALL;
31353135
if (ret < 0)
3136-
return CKR_FUNCTION_FAILED;
3136+
return CKR_ENCRYPTED_DATA_INVALID;
31373137
*pulDataLen = decDataLen;
31383138
break;
31393139
#endif
@@ -3157,15 +3157,15 @@ CK_RV C_Decrypt(CK_SESSION_HANDLE hSession, CK_BYTE_PTR pEncryptedData,
31573157
ret = WP11_AesKeyWrap_Decrypt(pEncryptedData,
31583158
(word32)ulEncryptedDataLen, pData, &decDataLen, session);
31593159
if (ret != 0)
3160-
return CKR_FUNCTION_FAILED;
3160+
return CKR_ENCRYPTED_DATA_INVALID;
31613161
if (mechanism == CKM_AES_KEY_WRAP_PAD) {
31623162
int i;
31633163
byte padValue = pData[decDataLen - 1];
31643164
if (padValue > KEYWRAP_BLOCK_SIZE || padValue > decDataLen)
3165-
return CKR_FUNCTION_FAILED;
3165+
return CKR_ENCRYPTED_DATA_LEN_RANGE;
31663166
for (i = 0; i < padValue; i++) {
31673167
if (pData[decDataLen - 1 - i] != padValue)
3168-
return CKR_FUNCTION_FAILED;
3168+
return CKR_ENCRYPTED_DATA_INVALID;
31693169
}
31703170
decDataLen -= padValue;
31713171
}
@@ -6747,7 +6747,7 @@ CK_RV C_UnwrapKey(CK_SESSION_HANDLE hSession,
67476747
return CKR_HOST_MEMORY;
67486748

67496749
decryptedLen = (word32)ulUnwrappedLen;
6750-
ret = WP11_RsaPkcs15_PrivateDecrypt(pWrappedKey, ulWrappedKeyLen,
6750+
ret = WP11_RsaPkcs15_PrivateDecrypt(pWrappedKey, decryptedLen,
67516751
workBuffer, &decryptedLen,
67526752
unwrappingKey,
67536753
WP11_Session_GetSlot(session));

‎src/slot.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,7 @@ static CK_MECHANISM_TYPE mechanismList[] = {
357357
#ifdef WOLFPKCS11_HKDF
358358
CKM_HKDF_DERIVE,
359359
CKM_HKDF_DATA,
360+
CKM_HKDF_KEY_GEN,
360361
#endif
361362
#ifndef NO_DH
362363
CKM_DH_PKCS_KEY_PAIR_GEN,

‎src/wolfpkcs11.c‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ CK_RV C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
111111
{
112112
CK_RV ret;
113113
WOLFPKCS11_ENTER("C_GetFunctionList");
114-
114+
115115
if (ppFunctionList == NULL) {
116116
ret = CKR_ARGUMENTS_BAD;
117117
WOLFPKCS11_LEAVE("C_GetFunctionList", ret);
@@ -124,7 +124,7 @@ CK_RV C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
124124
return ret;
125125
}
126126

127-
#ifdef WOLFPKCS11_NSS
127+
#if (defined(WOLFPKCS11_NSS) && !defined(WOLFPKCS11_NO_STORE))
128128
/*
129129
* Parse a string of NSS configuration parameters. For now only the
130130
* configdir parameter is supported.
@@ -197,7 +197,7 @@ CK_RV C_Initialize(CK_VOID_PTR pInitArgs)
197197
if (args != NULL) {
198198
WOLFPKCS11_MSG("Warning: C_Initialize called with arguments, but most "
199199
"are ignored.");
200-
#ifdef WOLFPKCS11_NSS
200+
#if (defined(WOLFPKCS11_NSS) && !defined(WOLFPKCS11_NO_STORE))
201201
if (args->LibraryParameters != NULL) {
202202
char* configdir = NULL;
203203
size_t configdirLen = 0;
@@ -241,7 +241,7 @@ CK_RV C_Finalize(CK_VOID_PTR pReserved)
241241
{
242242
CK_RV ret;
243243
WOLFPKCS11_ENTER("C_Finalize");
244-
244+
245245
WP11_Library_Final();
246246

247247
(void)pReserved;
@@ -271,7 +271,7 @@ CK_RV C_GetInfo(CK_INFO_PTR pInfo)
271271
{
272272
CK_RV ret;
273273
WOLFPKCS11_ENTER("C_GetInfo");
274-
274+
275275
if (!WP11_Library_IsInitialized()) {
276276
ret = CKR_CRYPTOKI_NOT_INITIALIZED;
277277
WOLFPKCS11_LEAVE("C_GetInfo", ret);
@@ -288,4 +288,3 @@ CK_RV C_GetInfo(CK_INFO_PTR pInfo)
288288
WOLFPKCS11_LEAVE("C_GetInfo", ret);
289289
return ret;
290290
}
291-

‎tests/pkcs11test.c‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4349,6 +4349,7 @@ static CK_RV find_rsa_priv_key_label(CK_SESSION_HANDLE session,
43494349
}
43504350
#endif
43514351

4352+
#ifndef WOLFPKCS11_NO_STORE
43524353
static CK_RV test_rsa_wrap_unwrap_key(void* args)
43534354
{
43544355
CK_SESSION_HANDLE session = *(CK_SESSION_HANDLE*)args;
@@ -4375,10 +4376,11 @@ static CK_RV test_rsa_wrap_unwrap_key(void* args)
43754376
if (ret == CKR_OK) {
43764377
ret = get_rsa_pub_key(session, NULL, 0, &wrappingPubKey);
43774378
}
4378-
4379+
43794380
/* Create a secret key to wrap */
43804381
if (ret == CKR_OK) {
4381-
ret = get_generic_key(session, keyData, sizeof(keyData), CK_FALSE, &key);
4382+
ret = get_generic_key(session, keyData, sizeof(keyData), CK_FALSE,
4383+
&key);
43824384
}
43834385

43844386
/* Test wrapping with RSA public key */
@@ -4402,7 +4404,8 @@ static CK_RV test_rsa_wrap_unwrap_key(void* args)
44024404

44034405
/* Test getting wrapped key length */
44044406
if (ret == CKR_OK) {
4405-
ret = get_generic_key(session, keyData, sizeof(keyData), CK_FALSE, &key);
4407+
ret = get_generic_key(session, keyData, sizeof(keyData), CK_FALSE,
4408+
&key);
44064409
if (ret == CKR_OK) {
44074410
CK_ULONG testLen = 0;
44084411
ret = funcList->C_WrapKey(session, &mech, wrappingPubKey, key,
@@ -4446,7 +4449,8 @@ static CK_RV test_rsa_wrap_unwrap_key(void* args)
44464449
/* Test buffer too small error */
44474450
if (ret == CKR_OK) {
44484451
/* Create fresh key for this test since original was destroyed */
4449-
ret = get_generic_key(session, keyData, sizeof(keyData), CK_FALSE, &key);
4452+
ret = get_generic_key(session, keyData, sizeof(keyData), CK_FALSE,
4453+
&key);
44504454
if (ret == CKR_OK) {
44514455
CK_ULONG smallLen = 1;
44524456
CK_RV wrapRet = funcList->C_WrapKey(session, &mech, wrappingPubKey,
@@ -4464,6 +4468,7 @@ static CK_RV test_rsa_wrap_unwrap_key(void* args)
44644468

44654469
return ret;
44664470
}
4471+
#endif
44674472

44684473
static CK_RV test_attributes_rsa(void* args)
44694474
{
@@ -13749,7 +13754,7 @@ static TEST_FUNC testFunc[] = {
1374913754
PKCS11TEST_FUNC_SESS_DECL(test_aes_wrap_unwrap_pad_key),
1375013755
#endif
1375113756
PKCS11TEST_FUNC_SESS_DECL(test_wrap_unwrap_key),
13752-
#ifndef NO_RSA
13757+
#if (!defined(NO_RSA) && !defined(WOLFPKCS11_NO_STORE))
1375313758
PKCS11TEST_FUNC_SESS_DECL(test_rsa_wrap_unwrap_key),
1375413759
#endif
1375513760
#ifndef NO_DH

0 commit comments

Comments
 (0)