Skip to content

Commit 00cd1a7

Browse files
dgarskedgarske
authored
Merge pull request #9962 from night1rider/ecc-dilithium-callback-free-fix
Fix expected callback behavior for ECC/Dilithium for Free Callbacks
2 parents cdacf3a + cdbd195 commit 00cd1a7

5 files changed

Lines changed: 70 additions & 7 deletions

File tree

‎.github/workflows/os-check.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ jobs:
7676
'--enable-sessionexport',
7777
'--enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"',
7878
'--disable-tls --enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY -DWOLF_CRYPTO_CB_FREE"',
79+
'--enable-all --enable-dilithium --enable-cryptocb --enable-cryptocbutils --enable-pkcallbacks',
7980
'--enable-cryptocb --enable-aesgcm CPPFLAGS="-DWOLF_CRYPTO_CB_AES_SETKEY"',
8081
'--disable-examples CPPFLAGS=-DWOLFSSL_NO_MALLOC',
8182
'CPPFLAGS=-DNO_WOLFSSL_CLIENT',

‎wolfcrypt/src/dilithium.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10889,14 +10889,22 @@ int wc_dilithium_get_level(dilithium_key* key, byte* level)
1088910889
*/
1089010890
void wc_dilithium_free(dilithium_key* key)
1089110891
{
10892+
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
10893+
int ret = 0;
10894+
#endif
10895+
1089210896
if (key != NULL) {
1089310897
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
1089410898
if (key->devId != INVALID_DEVID) {
10895-
wc_CryptoCb_Free(key->devId, WC_ALGO_TYPE_PK,
10899+
ret = wc_CryptoCb_Free(key->devId, WC_ALGO_TYPE_PK,
1089610900
WC_PK_TYPE_PQC_SIG_KEYGEN,
1089710901
WC_PQC_SIG_TYPE_DILITHIUM,
1089810902
(void*)key);
10903+
if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
10904+
return;
10905+
/* fall-through to software cleanup */
1089910906
}
10907+
(void)ret;
1090010908
#endif
1090110909
#ifdef WOLFSSL_WC_DILITHIUM
1090210910
#ifndef WC_DILITHIUM_FIXED_ARRAY

‎wolfcrypt/src/ecc.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7886,15 +7886,23 @@ void wc_ecc_free_curve(const ecc_set_type* curve, void* heap)
78867886
WOLFSSL_ABI
78877887
int wc_ecc_free(ecc_key* key)
78887888
{
7889+
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
7890+
int ret = 0;
7891+
#endif
7892+
78897893
if (key == NULL) {
78907894
return 0;
78917895
}
78927896

78937897
#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
78947898
if (key->devId != INVALID_DEVID) {
7895-
wc_CryptoCb_Free(key->devId, WC_ALGO_TYPE_PK,
7899+
ret = wc_CryptoCb_Free(key->devId, WC_ALGO_TYPE_PK,
78967900
WC_PK_TYPE_EC_KEYGEN, 0, key);
7901+
if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
7902+
return ret;
7903+
/* fall-through to software cleanup */
78977904
}
7905+
(void)ret;
78987906
#endif
78997907

79007908
#if defined(WOLFSSL_ECDSA_SET_K) || defined(WOLFSSL_ECDSA_SET_K_ONE_LOOP) || \

‎wolfcrypt/src/wc_pkcs11.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5794,6 +5794,12 @@ int wc_Pkcs11_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx)
57945794
(ecc_key*)info->free.obj);
57955795
Pkcs11CloseSession(token, &session);
57965796
}
5797+
/* Return CRYPTOCB_UNAVAILABLE so wc_ecc_free() still
5798+
* performs software cleanup. This callback only releases
5799+
* the HSM object. Conditional because wc_ecc_free returns
5800+
* int and can propagate an HSM error to the caller. */
5801+
if (ret == 0)
5802+
ret = CRYPTOCB_UNAVAILABLE;
57975803
}
57985804
else
57995805
#endif
@@ -5807,6 +5813,11 @@ int wc_Pkcs11_CryptoDevCb(int devId, wc_CryptoInfo* info, void* ctx)
58075813
(MlDsaKey*)info->free.obj);
58085814
Pkcs11CloseSession(token, &session);
58095815
}
5816+
/* Always return CRYPTOCB_UNAVAILABLE so wc_dilithium_free()
5817+
* performs software cleanup. This callback only releases
5818+
* the HSM object. Unconditional because wc_dilithium_free
5819+
* returns void and cannot propagate an error. */
5820+
ret = CRYPTOCB_UNAVAILABLE;
58105821
}
58115822
else
58125823
#endif

‎wolfcrypt/test/test.c‎

Lines changed: 40 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46997,7 +46997,7 @@ static wc_test_ret_t dilithium_param_vfy_test(int param, const byte* pubKey,
4699746997
msg[i] = (byte)i;
4699846998
}
4699946999

47000-
ret = wc_dilithium_init(key);
47000+
ret = wc_dilithium_init_ex(key, NULL, devId);
4700147001
if (ret != 0) {
4700247002
ret = WC_TEST_RET_ENC_EC(ret);
4700347003
return ret;
@@ -50158,7 +50158,7 @@ static wc_test_ret_t dilithium_param_test(int param, WC_RNG* rng)
5015850158
}
5015950159
#endif
5016050160

50161-
ret = wc_dilithium_init(key);
50161+
ret = wc_dilithium_init_ex(key, NULL, devId);
5016250162
if (ret != 0) {
5016350163
ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
5016450164
}
@@ -50250,7 +50250,7 @@ static wc_test_ret_t test_dilithium_decode_level(const byte* rawKey,
5025050250

5025150251
/* Initialize key */
5025250252
if (ret == 0) {
50253-
ret = wc_dilithium_init(key);
50253+
ret = wc_dilithium_init_ex(key, NULL, devId);
5025450254
}
5025550255

5025650256
/* Import raw key, setting the security level */
@@ -50293,7 +50293,7 @@ static wc_test_ret_t test_dilithium_decode_level(const byte* rawKey,
5029350293
/* Free and reinit key to test fresh decode */
5029450294
if (ret == 0) {
5029550295
wc_dilithium_free(key);
50296-
ret = wc_dilithium_init(key);
50296+
ret = wc_dilithium_init_ex(key, NULL, devId);
5029750297
}
5029850298

5029950299
/* First test decoding when security level is set externally */
@@ -50318,7 +50318,7 @@ static wc_test_ret_t test_dilithium_decode_level(const byte* rawKey,
5031850318
/* Free and reinit key to test fresh decode */
5031950319
if (ret == 0) {
5032050320
wc_dilithium_free(key);
50321-
ret = wc_dilithium_init(key);
50321+
ret = wc_dilithium_init_ex(key, NULL, devId);
5032250322
}
5032350323

5032450324
#ifndef WOLFSSL_DILITHIUM_FIPS204_DRAFT
@@ -65407,6 +65407,37 @@ static int myCryptoDevCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
6540765407
ret = 0;
6540865408
break;
6540965409
}
65410+
#endif
65411+
default:
65412+
ret = WC_NO_ERR_TRACE(NOT_COMPILED_IN);
65413+
break;
65414+
}
65415+
}
65416+
else if (info->free.algo == WC_ALGO_TYPE_PK) {
65417+
switch (info->free.type) {
65418+
#ifdef HAVE_ECC
65419+
case WC_PK_TYPE_EC_KEYGEN:
65420+
{
65421+
ecc_key* ecc = (ecc_key*)info->free.obj;
65422+
ecc->devId = INVALID_DEVID;
65423+
wc_ecc_free(ecc);
65424+
ret = 0;
65425+
break;
65426+
}
65427+
#endif
65428+
#ifdef HAVE_DILITHIUM
65429+
case WC_PK_TYPE_PQC_SIG_KEYGEN:
65430+
{
65431+
if (info->free.subType ==
65432+
WC_PQC_SIG_TYPE_DILITHIUM) {
65433+
dilithium_key* dil =
65434+
(dilithium_key*)info->free.obj;
65435+
dil->devId = INVALID_DEVID;
65436+
wc_dilithium_free(dil);
65437+
ret = 0;
65438+
}
65439+
break;
65440+
}
6541065441
#endif
6541165442
default:
6541265443
ret = WC_NO_ERR_TRACE(NOT_COMPILED_IN);
@@ -65600,6 +65631,10 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cryptocb_test(void)
6560065631
ret = ecc_onlycb_test(&myCtx);
6560165632
PRIVATE_KEY_LOCK();
6560265633
#endif
65634+
#ifdef HAVE_DILITHIUM
65635+
if (ret == 0)
65636+
ret = dilithium_test();
65637+
#endif
6560365638
#ifdef HAVE_ED25519
6560465639
PRIVATE_KEY_UNLOCK();
6560565640
if (ret == 0)

0 commit comments

Comments
 (0)