Skip to content

Commit 7e48411

Browse files
ColtonWilleyColtonWilley
authored
Merge pull request #172 from ColtonWilley/wp_sig_lock
Implement locking around signature operations
2 parents 0df51fb + 03cbe6b commit 7e48411

8 files changed

Lines changed: 208 additions & 52 deletions

File tree

‎include/wolfprovider/alg_funcs.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,13 +175,17 @@ typedef void (*DFUNC)(void);
175175
int wolfssl_prov_is_running(void);
176176
WC_RNG* wolfssl_prov_get_rng(WOLFPROV_CTX* provctx);
177177

178+
int wp_lock(wolfSSL_Mutex* mutex);
179+
int wp_unlock(wolfSSL_Mutex* mutex);
180+
178181
/* Internal RSA types and functions. */
179182
typedef struct wp_Rsa wp_Rsa;
180183

181184
int wp_rsa_up_ref(wp_Rsa* rsa);
182185
void wp_rsa_free(wp_Rsa* rsa);
183186
int wp_rsa_get_type(wp_Rsa* rsa);
184187
int wp_rsa_get_bits(wp_Rsa* rsa);
188+
wolfSSL_Mutex* wp_rsa_get_mutex(wp_Rsa* rsa);
185189
RsaKey* wp_rsa_get_key(wp_Rsa* rsa);
186190
void wp_rsa_get_pss_mds(wp_Rsa* rsa, char** mdName, char** mgfMdName);
187191
int wp_rsa_get_pss_salt_len(wp_Rsa* rsa);
@@ -199,13 +203,15 @@ ecc_key* wp_ecc_get_key(wp_Ecc* ecc);
199203
WC_RNG* wp_ecc_get_rng(wp_Ecc* ecc);
200204
int wp_ecc_get_size(wp_Ecc* ecc);
201205
int wp_ecc_check_usage(wp_Ecc* ecc);
206+
wolfSSL_Mutex* wp_ecc_get_mutex(wp_Ecc* ecc);
202207

203208
/* Internal ECX types and functions. */
204209
typedef struct wp_Ecx wp_Ecx;
205210

206211
int wp_ecx_up_ref(wp_Ecx* ecx);
207212
void wp_ecx_free(wp_Ecx* ecx);
208213
void* wp_ecx_get_key(wp_Ecx* ecx);
214+
wolfSSL_Mutex* wp_ecx_get_mutex(wp_Ecx* ecx);
209215

210216
/* Internal DH types and functions. */
211217
typedef struct wp_Dh wp_Dh;

‎src/wp_ecc_kmgmt.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -299,6 +299,17 @@ int wp_ecc_get_size(wp_Ecc* ecc)
299299
return (ecc->bits + 7) / 8;
300300
}
301301

302+
/**
303+
* Get the mutex object from the ECC key object.
304+
*
305+
* @param [in] ecc ECC key object.
306+
* @return Pointer to wolfSSL mutex object.
307+
*/
308+
wolfSSL_Mutex* wp_ecc_get_mutex(wp_Ecc* ecc)
309+
{
310+
return &ecc->mutex;
311+
}
312+
302313
/**
303314
* Create a new ECC key object.
304315
*

‎src/wp_ecdsa_sig.c‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -280,15 +280,21 @@ static int wp_ecdsa_sign(wp_EcdsaSigCtx *ctx, unsigned char *sig,
280280
sigSize = *sigLen;
281281
}
282282
len = (word32)sigSize;
283-
PRIVATE_KEY_UNLOCK();
284-
rc = wc_ecc_sign_hash(tbs, (word32)tbsLen, sig, &len,
285-
wp_ecc_get_rng(ctx->ecc), wp_ecc_get_key(ctx->ecc));
286-
PRIVATE_KEY_LOCK();
287-
if (rc != 0) {
283+
if (wp_lock(wp_ecc_get_mutex(ctx->ecc)) != 1) {
288284
ok = 0;
289285
}
290-
else {
291-
*sigLen = len;
286+
if (ok) {
287+
PRIVATE_KEY_UNLOCK();
288+
rc = wc_ecc_sign_hash(tbs, (word32)tbsLen, sig, &len,
289+
wp_ecc_get_rng(ctx->ecc), wp_ecc_get_key(ctx->ecc));
290+
PRIVATE_KEY_LOCK();
291+
wp_unlock(wp_ecc_get_mutex(ctx->ecc));
292+
if (rc != 0) {
293+
ok = 0;
294+
}
295+
else {
296+
*sigLen = len;
297+
}
292298
}
293299
}
294300
}

‎src/wp_ecx_kmgmt.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,17 @@ void* wp_ecx_get_key(wp_Ecx* ecx)
243243
return (void*)&ecx->key;
244244
}
245245

246+
/**
247+
* Get the mutex object from the ECX key object.
248+
*
249+
* @param [in] ecx ECX key object.
250+
* @return Pointer to wolfSSL mutex object.
251+
*/
252+
wolfSSL_Mutex* wp_ecx_get_mutex(wp_Ecx* ecx)
253+
{
254+
return &ecx->mutex;
255+
}
256+
246257
/**
247258
* Create a new ECX key object. Base function.
248259
*

‎src/wp_ecx_sig.c‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -388,12 +388,18 @@ static int wp_ed25519_digest_sign(wp_EcxSigCtx *ctx, unsigned char *sig,
388388
}
389389
}
390390
if (ok) {
391-
rc = wc_ed25519_sign_msg(tbs, (word32)tbsLen, sig, &len, ed25519);
392-
if (rc != 0) {
391+
if (wp_lock(wp_ecx_get_mutex(ctx->ecx)) != 1) {
393392
ok = 0;
394393
}
395-
else {
396-
*sigLen = len;
394+
if (ok) {
395+
rc = wc_ed25519_sign_msg(tbs, (word32)tbsLen, sig, &len, ed25519);
396+
wp_unlock(wp_ecx_get_mutex(ctx->ecx));
397+
if (rc != 0) {
398+
ok = 0;
399+
}
400+
else {
401+
*sigLen = len;
402+
}
397403
}
398404
}
399405
}
@@ -578,13 +584,19 @@ static int wp_ed448_digest_sign(wp_EcxSigCtx *ctx, unsigned char *sig,
578584
}
579585
}
580586
if (ok) {
581-
rc = wc_ed448_sign_msg(tbs, (word32)tbsLen, sig, &len,
582-
(ed448_key*)wp_ecx_get_key(ctx->ecx), NULL, 0);
583-
if (rc != 0) {
587+
if (wp_lock(wp_ecx_get_mutex(ctx->ecx)) != 1) {
584588
ok = 0;
585589
}
586-
else {
587-
*sigLen = len;
590+
if (ok) {
591+
rc = wc_ed448_sign_msg(tbs, (word32)tbsLen, sig, &len,
592+
(ed448_key*)wp_ecx_get_key(ctx->ecx), NULL, 0);
593+
wp_unlock(wp_ecx_get_mutex(ctx->ecx));
594+
if (rc != 0) {
595+
ok = 0;
596+
}
597+
else {
598+
*sigLen = len;
599+
}
588600
}
589601
}
590602
}

‎src/wp_internal.c‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
#include <wolfprovider/internal.h>
2626
#include <wolfprovider/wp_wolfprov.h>
2727
#include <wolfprovider/wp_logging.h>
28+
#include <wolfprovider/alg_funcs.h>
2829

2930
#include <wolfssl/wolfcrypt/rsa.h>
3031
#include <wolfssl/wolfcrypt/pwdbased.h>
@@ -73,6 +74,76 @@ void wp_provctx_unlock_rng(WOLFPROV_CTX* provCtx)
7374
}
7475
#endif
7576

77+
/**
78+
* Lock the mutex.
79+
*
80+
* This function locks the mutex and translates the return value.
81+
* Use wp_unlock() to unlock after operations are complete.
82+
*
83+
* @param [in] mutex Mutex object.
84+
* @return 1 on success.
85+
* @return 0 on failure or when single-threaded build.
86+
*/
87+
int wp_lock(wolfSSL_Mutex *mutex)
88+
{
89+
#ifndef WP_SINGLE_THREADED
90+
int ok = 1;
91+
int rc;
92+
93+
if (mutex == NULL) {
94+
ok = 0;
95+
}
96+
else {
97+
rc = wc_LockMutex(mutex);
98+
if (rc < 0) {
99+
ok = 0;
100+
}
101+
}
102+
103+
WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok);
104+
return ok;
105+
#else
106+
(void)mutex;
107+
WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1);
108+
return 1;
109+
#endif
110+
}
111+
112+
/**
113+
* Unlock the mutex.
114+
*
115+
* This function unlocks the mutex and translates the return value.
116+
* Should only be called after a successful wp_lock() call.
117+
*
118+
* @param [in] mutex Mutex object.
119+
* @return 1 on success.
120+
* @return 0 on failure or when single-threaded build.
121+
*/
122+
int wp_unlock(wolfSSL_Mutex* mutex)
123+
{
124+
#ifndef WP_SINGLE_THREADED
125+
int ok = 1;
126+
int rc;
127+
128+
if (mutex == NULL) {
129+
ok = 0;
130+
}
131+
else {
132+
rc = wc_UnLockMutex(mutex);
133+
if (rc < 0) {
134+
ok = 0;
135+
}
136+
}
137+
138+
WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok);
139+
return ok;
140+
#else
141+
(void)mutex;
142+
WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1);
143+
return 1;
144+
#endif
145+
}
146+
76147

77148
/**
78149
* Convert the string name of an object to an OpenSSL Numeric ID (NID).

‎src/wp_rsa_kmgmt.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,17 @@ int wp_rsa_get_bits(wp_Rsa* rsa)
330330
return rsa->bits;
331331
}
332332

333+
/**
334+
* Get the mutex object from the RSA key object.
335+
*
336+
* @param [in] rsa RSA key object.
337+
* @return Pointer to wolfSSL mutex object.
338+
*/
339+
wolfSSL_Mutex* wp_rsa_get_mutex(wp_Rsa* rsa)
340+
{
341+
return &rsa->mutex;
342+
}
343+
333344
/**
334345
* Check the RSA key size is valid.
335346
*

‎src/wp_rsa_sig.c‎

Lines changed: 64 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -609,13 +609,19 @@ static int wp_rsa_sign_pkcs1(wp_RsaSigCtx* ctx, unsigned char* sig,
609609
}
610610
}
611611
if (ok) {
612-
PRIVATE_KEY_UNLOCK();
613-
rc = wc_RsaSSL_Sign(tbs, (word32)tbsLen, sig, (word32)sigSize,
614-
wp_rsa_get_key(ctx->rsa), &ctx->rng);
615-
PRIVATE_KEY_LOCK();
616-
if (rc <= 0) {
612+
if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) {
617613
ok = 0;
618614
}
615+
if (ok) {
616+
PRIVATE_KEY_UNLOCK();
617+
rc = wc_RsaSSL_Sign(tbs, (word32)tbsLen, sig, (word32)sigSize,
618+
wp_rsa_get_key(ctx->rsa), &ctx->rng);
619+
PRIVATE_KEY_LOCK();
620+
wp_unlock(wp_rsa_get_mutex(ctx->rsa));
621+
if (rc <= 0) {
622+
ok = 0;
623+
}
624+
}
619625
}
620626
if (ok) {
621627
*sigLen = rc;
@@ -655,21 +661,29 @@ static int wp_rsa_sign_pss(wp_RsaSigCtx* ctx, unsigned char* sig,
655661
#endif
656662
wp_rsa_get_key(ctx->rsa), EVP_PKEY_OP_SIGN);
657663

658-
PRIVATE_KEY_UNLOCK();
659-
rc = wc_RsaPSS_Sign_ex(tbs, (word32)tbsLen, sig, (word32)sigSize,
660-
#if LIBWOLFSSL_VERSION_HEX >= 0x05007004
661-
ctx->hash.type,
662-
#else
663-
ctx->hashType,
664-
#endif
665-
ctx->mgf, saltLen, wp_rsa_get_key(ctx->rsa),
666-
&ctx->rng);
667-
PRIVATE_KEY_LOCK();
668-
if (rc < 0) {
669-
ok = 0;
670-
}
671-
else {
672-
*sigLen = rc;
664+
if (ok) {
665+
if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) {
666+
ok = 0;
667+
}
668+
if (ok) {
669+
PRIVATE_KEY_UNLOCK();
670+
rc = wc_RsaPSS_Sign_ex(tbs, (word32)tbsLen, sig, (word32)sigSize,
671+
#if LIBWOLFSSL_VERSION_HEX >= 0x05007004
672+
ctx->hash.type,
673+
#else
674+
ctx->hashType,
675+
#endif
676+
ctx->mgf, saltLen, wp_rsa_get_key(ctx->rsa),
677+
&ctx->rng);
678+
PRIVATE_KEY_LOCK();
679+
wp_unlock(wp_rsa_get_mutex(ctx->rsa));
680+
if (rc < 0) {
681+
ok = 0;
682+
}
683+
else {
684+
*sigLen = rc;
685+
}
686+
}
673687
}
674688

675689
WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok);
@@ -749,16 +763,21 @@ static int wp_rsa_sign_no_pad(wp_RsaSigCtx* ctx, unsigned char* sig,
749763
if (ok) {
750764
word32 len = (word32)sigSize;
751765
int rc;
752-
753-
PRIVATE_KEY_UNLOCK();
754-
rc = wc_RsaDirect((byte*)tbs, (word32)tbsLen, sig, &len,
755-
wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng);
756-
PRIVATE_KEY_LOCK();
757-
if (rc < 0) {
766+
if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) {
758767
ok = 0;
759768
}
760-
else {
761-
*sigLen = rc;
769+
if (ok) {
770+
PRIVATE_KEY_UNLOCK();
771+
rc = wc_RsaDirect((byte*)tbs, (word32)tbsLen, sig, &len,
772+
wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng);
773+
PRIVATE_KEY_LOCK();
774+
wp_unlock(wp_rsa_get_mutex(ctx->rsa));
775+
if (rc < 0) {
776+
ok = 0;
777+
}
778+
else {
779+
*sigLen = rc;
780+
}
762781
}
763782
}
764783

@@ -841,16 +860,21 @@ static int wp_rsa_sign_x931(wp_RsaSigCtx* ctx, unsigned char* sig,
841860
}
842861
if (ok) {
843862
word32 len = (word32)sigSize;
844-
845-
PRIVATE_KEY_UNLOCK();
846-
rc = wc_RsaDirect(padded, paddedSz, sig, &len,
847-
wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng);
848-
PRIVATE_KEY_LOCK();
849-
if (rc < 0) {
863+
if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) {
850864
ok = 0;
851865
}
852-
else {
853-
*sigLen = rc;
866+
if (ok) {
867+
PRIVATE_KEY_UNLOCK();
868+
rc = wc_RsaDirect(padded, paddedSz, sig, &len,
869+
wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng);
870+
PRIVATE_KEY_LOCK();
871+
wp_unlock(wp_rsa_get_mutex(ctx->rsa));
872+
if (rc < 0) {
873+
ok = 0;
874+
}
875+
else {
876+
*sigLen = rc;
877+
}
854878
}
855879
}
856880
if (padded != NULL) {
@@ -914,6 +938,8 @@ static int wp_rsa_sign(wp_RsaSigCtx* ctx, unsigned char* sig, size_t* sigLen,
914938
{
915939
int ok = 1;
916940

941+
WOLFPROV_ENTER(WP_LOG_PK, __FUNCTION__);
942+
917943
if (!wolfssl_prov_is_running()) {
918944
ok = 0;
919945
}
@@ -1311,6 +1337,8 @@ static int wp_rsa_verify(wp_RsaSigCtx* ctx, const unsigned char* sig,
13111337
{
13121338
int ok = 1;
13131339

1340+
WOLFPROV_ENTER(WP_LOG_PK, __FUNCTION__);
1341+
13141342
if (!wolfssl_prov_is_running()) {
13151343
ok = 0;
13161344
}

0 commit comments

Comments
 (0)