Print this page
9642 PKCS#11 softtoken should use explicit_bzero
Reviewed by: Dan McDonald <danmcd@joyent.com>
Reviewed by: Alex Wilson <alex.wilson@joyent.com>


   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.

  24  */
  25 
  26 #include <pthread.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29 #include <strings.h>
  30 #include <sys/types.h>
  31 #include <security/cryptoki.h>
  32 #include <modes/modes.h>
  33 #include <des_impl.h>
  34 #include "softSession.h"
  35 #include "softObject.h"
  36 #include "softCrypt.h"
  37 #include "softOps.h"
  38 
  39 /*
  40  * Allocate context for the active encryption or decryption operation, and
  41  * generate DES or DES3 key schedule to speed up the operation.
  42  */
  43 CK_RV


 431                 }
 432 encrypt_failed:
 433                 *pulEncryptedLen = 0;
 434                 rv = CKR_FUNCTION_FAILED;
 435                 goto cleanup;
 436 
 437         }
 438         } /* end switch */
 439 
 440         if (update)
 441                 return (CKR_OK);
 442 
 443         /*
 444          * The following code will be executed if the caller is
 445          * soft_encrypt() or an error occurred. The encryption
 446          * operation will be terminated so we need to do some cleanup.
 447          */
 448 cleanup:
 449         (void) pthread_mutex_lock(&session_p->session_mutex);
 450         des_ctx = (des_ctx_t *)soft_des_ctx->des_cbc;
 451         if (des_ctx != NULL) {
 452                 bzero(des_ctx->dc_keysched, des_ctx->dc_keysched_len);
 453                 free(soft_des_ctx->des_cbc);
 454         }
 455 
 456         bzero(soft_des_ctx->key_sched, soft_des_ctx->keysched_len);
 457         free(soft_des_ctx->key_sched);
 458         free(session_p->encrypt.context);
 459         session_p->encrypt.context = NULL;
 460         (void) pthread_mutex_unlock(&session_p->session_mutex);
 461 
 462         return (rv);
 463 }
 464 
 465 
 466 /*
 467  * soft_des_decrypt_common()
 468  *
 469  * Arguments:
 470  *      session_p:      pointer to soft_session_t struct
 471  *      pEncrypted:     pointer to the input data to be decrypted
 472  *      ulEncryptedLen: length of the input data
 473  *      pData:          pointer to the output data
 474  *      pulDataLen:     pointer to the length of the output data
 475  *      Update:         boolean flag indicates caller is soft_decrypt
 476  *                      or soft_decrypt_update
 477  *
 478  * Description:


 760                 if (rc == 0)
 761                         break;
 762 decrypt_failed:
 763                 *pulDataLen = 0;
 764                 rv = CKR_FUNCTION_FAILED;
 765                 goto cleanup;
 766         }
 767         } /* end switch */
 768 
 769         if (update)
 770                 return (CKR_OK);
 771 
 772         /*
 773          * The following code will be executed if the caller is
 774          * soft_decrypt() or an error occurred. The decryption
 775          * operation will be terminated so we need to do some cleanup.
 776          */
 777 cleanup:
 778         (void) pthread_mutex_lock(&session_p->session_mutex);
 779         des_ctx = (des_ctx_t *)soft_des_ctx->des_cbc;
 780         if (des_ctx != NULL) {
 781                 bzero(des_ctx->dc_keysched, des_ctx->dc_keysched_len);
 782                 free(soft_des_ctx->des_cbc);
 783         }
 784 
 785         bzero(soft_des_ctx->key_sched, soft_des_ctx->keysched_len);
 786         free(soft_des_ctx->key_sched);
 787         free(session_p->decrypt.context);
 788         session_p->decrypt.context = NULL;
 789         (void) pthread_mutex_unlock(&session_p->session_mutex);
 790 
 791         return (rv);
 792 }
 793 
 794 
 795 /*
 796  * Allocate and initialize a context for DES CBC mode of operation.
 797  */
 798 void *
 799 des_cbc_ctx_init(void *key_sched, size_t size, uint8_t *ivec, CK_KEY_TYPE type)
 800 {
 801 
 802         cbc_ctx_t *cbc_ctx;
 803 
 804         if ((cbc_ctx = calloc(1, sizeof (cbc_ctx_t))) == NULL)
 805                 return (NULL);
 806 
 807         cbc_ctx->cbc_keysched = key_sched;
 808 




   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2018, Joyent, Inc.
  25  */
  26 
  27 #include <pthread.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <strings.h>
  31 #include <sys/types.h>
  32 #include <security/cryptoki.h>
  33 #include <modes/modes.h>
  34 #include <des_impl.h>
  35 #include "softSession.h"
  36 #include "softObject.h"
  37 #include "softCrypt.h"
  38 #include "softOps.h"
  39 
  40 /*
  41  * Allocate context for the active encryption or decryption operation, and
  42  * generate DES or DES3 key schedule to speed up the operation.
  43  */
  44 CK_RV


 432                 }
 433 encrypt_failed:
 434                 *pulEncryptedLen = 0;
 435                 rv = CKR_FUNCTION_FAILED;
 436                 goto cleanup;
 437 
 438         }
 439         } /* end switch */
 440 
 441         if (update)
 442                 return (CKR_OK);
 443 
 444         /*
 445          * The following code will be executed if the caller is
 446          * soft_encrypt() or an error occurred. The encryption
 447          * operation will be terminated so we need to do some cleanup.
 448          */
 449 cleanup:
 450         (void) pthread_mutex_lock(&session_p->session_mutex);
 451         des_ctx = (des_ctx_t *)soft_des_ctx->des_cbc;
 452         free(des_ctx);
 453         freezero(soft_des_ctx->key_sched, soft_des_ctx->keysched_len);
 454         freezero(session_p->encrypt.context, sizeof (soft_des_ctx_t));





 455         session_p->encrypt.context = NULL;
 456         (void) pthread_mutex_unlock(&session_p->session_mutex);
 457 
 458         return (rv);
 459 }
 460 
 461 
 462 /*
 463  * soft_des_decrypt_common()
 464  *
 465  * Arguments:
 466  *      session_p:      pointer to soft_session_t struct
 467  *      pEncrypted:     pointer to the input data to be decrypted
 468  *      ulEncryptedLen: length of the input data
 469  *      pData:          pointer to the output data
 470  *      pulDataLen:     pointer to the length of the output data
 471  *      Update:         boolean flag indicates caller is soft_decrypt
 472  *                      or soft_decrypt_update
 473  *
 474  * Description:


 756                 if (rc == 0)
 757                         break;
 758 decrypt_failed:
 759                 *pulDataLen = 0;
 760                 rv = CKR_FUNCTION_FAILED;
 761                 goto cleanup;
 762         }
 763         } /* end switch */
 764 
 765         if (update)
 766                 return (CKR_OK);
 767 
 768         /*
 769          * The following code will be executed if the caller is
 770          * soft_decrypt() or an error occurred. The decryption
 771          * operation will be terminated so we need to do some cleanup.
 772          */
 773 cleanup:
 774         (void) pthread_mutex_lock(&session_p->session_mutex);
 775         des_ctx = (des_ctx_t *)soft_des_ctx->des_cbc;
 776         free(des_ctx);
 777         freezero(soft_des_ctx->key_sched, soft_des_ctx->keysched_len);
 778         freezero(session_p->decrypt.context, sizeof (soft_des_ctx_t));






 779         (void) pthread_mutex_unlock(&session_p->session_mutex);
 780 
 781         return (rv);
 782 }
 783 
 784 
 785 /*
 786  * Allocate and initialize a context for DES CBC mode of operation.
 787  */
 788 void *
 789 des_cbc_ctx_init(void *key_sched, size_t size, uint8_t *ivec, CK_KEY_TYPE type)
 790 {
 791 
 792         cbc_ctx_t *cbc_ctx;
 793 
 794         if ((cbc_ctx = calloc(1, sizeof (cbc_ctx_t))) == NULL)
 795                 return (NULL);
 796 
 797         cbc_ctx->cbc_keysched = key_sched;
 798