From 46c8301fae98a7785b1eca39abb46fcb455f4530 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Mon, 16 Jun 2025 12:26:51 -0700 Subject: [PATCH 1/3] Implement locking around wolfProvider signature operations to facilitate multithreaded flows with multiple threads sharing an underlying key. --- include/wolfprovider/alg_funcs.h | 6 ++ src/wp_ecc_kmgmt.c | 70 ++++++++++++++++++++++ src/wp_ecdsa_sig.c | 20 ++++--- src/wp_ecx_kmgmt.c | 70 ++++++++++++++++++++++ src/wp_ecx_sig.c | 30 +++++++--- src/wp_rsa_kmgmt.c | 70 ++++++++++++++++++++++ src/wp_rsa_sig.c | 100 ++++++++++++++++++++----------- 7 files changed, 314 insertions(+), 52 deletions(-) diff --git a/include/wolfprovider/alg_funcs.h b/include/wolfprovider/alg_funcs.h index d1ca52f6..93765030 100644 --- a/include/wolfprovider/alg_funcs.h +++ b/include/wolfprovider/alg_funcs.h @@ -182,6 +182,8 @@ int wp_rsa_up_ref(wp_Rsa* rsa); void wp_rsa_free(wp_Rsa* rsa); int wp_rsa_get_type(wp_Rsa* rsa); int wp_rsa_get_bits(wp_Rsa* rsa); +int wp_rsa_lock(wp_Rsa* rsa); +int wp_rsa_unlock(wp_Rsa* rsa); RsaKey* wp_rsa_get_key(wp_Rsa* rsa); void wp_rsa_get_pss_mds(wp_Rsa* rsa, char** mdName, char** mgfMdName); int wp_rsa_get_pss_salt_len(wp_Rsa* rsa); @@ -199,6 +201,8 @@ ecc_key* wp_ecc_get_key(wp_Ecc* ecc); WC_RNG* wp_ecc_get_rng(wp_Ecc* ecc); int wp_ecc_get_size(wp_Ecc* ecc); int wp_ecc_check_usage(wp_Ecc* ecc); +int wp_ecc_lock(wp_Ecc* ecc); +int wp_ecc_unlock(wp_Ecc* ecc); /* Internal ECX types and functions. */ typedef struct wp_Ecx wp_Ecx; @@ -206,6 +210,8 @@ typedef struct wp_Ecx wp_Ecx; int wp_ecx_up_ref(wp_Ecx* ecx); void wp_ecx_free(wp_Ecx* ecx); void* wp_ecx_get_key(wp_Ecx* ecx); +int wp_ecx_lock(wp_Ecx* ecx); +int wp_ecx_unlock(wp_Ecx* ecx); /* Internal DH types and functions. */ typedef struct wp_Dh wp_Dh; diff --git a/src/wp_ecc_kmgmt.c b/src/wp_ecc_kmgmt.c index d05f51e3..fa744b1b 100644 --- a/src/wp_ecc_kmgmt.c +++ b/src/wp_ecc_kmgmt.c @@ -299,6 +299,76 @@ int wp_ecc_get_size(wp_Ecc* ecc) return (ecc->bits + 7) / 8; } +/** + * Lock the ECC key mutex. + * + * This function locks the mutex associated with the ECC key object. + * Use wp_ecc_unlock() to unlock after operations are complete. + * + * @param [in] ecc ECC key object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_ecc_lock(wp_Ecc* ecc) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (ecc == NULL) { + ok = 0; + } + else { + rc = wc_LockMutex(&ecc->mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)ecc; + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + +/** + * Unlock the ECC key mutex. + * + * This function unlocks the mutex associated with the ECC key object. + * Should only be called after a successful wp_ecc_lock() call. + * + * @param [in] ecc ECC key object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_ecc_unlock(wp_Ecc* ecc) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (ecc == NULL) { + ok = 0; + } + else { + rc = wc_UnLockMutex(&ecc->mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)ecc; + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + /** * Create a new ECC key object. * diff --git a/src/wp_ecdsa_sig.c b/src/wp_ecdsa_sig.c index af56de4a..fe55406b 100644 --- a/src/wp_ecdsa_sig.c +++ b/src/wp_ecdsa_sig.c @@ -280,15 +280,21 @@ static int wp_ecdsa_sign(wp_EcdsaSigCtx *ctx, unsigned char *sig, sigSize = *sigLen; } len = (word32)sigSize; - PRIVATE_KEY_UNLOCK(); - rc = wc_ecc_sign_hash(tbs, (word32)tbsLen, sig, &len, - wp_ecc_get_rng(ctx->ecc), wp_ecc_get_key(ctx->ecc)); - PRIVATE_KEY_LOCK(); - if (rc != 0) { + if (wp_ecc_lock(ctx->ecc) != 1) { ok = 0; } - else { - *sigLen = len; + if (ok) { + PRIVATE_KEY_UNLOCK(); + rc = wc_ecc_sign_hash(tbs, (word32)tbsLen, sig, &len, + wp_ecc_get_rng(ctx->ecc), wp_ecc_get_key(ctx->ecc)); + PRIVATE_KEY_LOCK(); + wp_ecc_unlock(ctx->ecc); + if (rc != 0) { + ok = 0; + } + else { + *sigLen = len; + } } } } diff --git a/src/wp_ecx_kmgmt.c b/src/wp_ecx_kmgmt.c index 0292dbc6..24ec6abd 100644 --- a/src/wp_ecx_kmgmt.c +++ b/src/wp_ecx_kmgmt.c @@ -243,6 +243,76 @@ void* wp_ecx_get_key(wp_Ecx* ecx) return (void*)&ecx->key; } +/** + * Lock the ECX key mutex. + * + * This function locks the mutex associated with the ECX key object. + * Use wp_ecx_unlock() to unlock after operations are complete. + * + * @param [in] ecx ECX key object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_ecx_lock(wp_Ecx* ecx) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (ecx == NULL) { + ok = 0; + } + else { + rc = wc_LockMutex(&ecx->mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)ecx; + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + +/** + * Unlock the ECX key mutex. + * + * This function unlocks the mutex associated with the ECX key object. + * Should only be called after a successful wp_ecx_lock() call. + * + * @param [in] ecx ECX key object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_ecx_unlock(wp_Ecx* ecx) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (ecx == NULL) { + ok = 0; + } + else { + rc = wc_UnLockMutex(&ecx->mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)ecx; + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + /** * Create a new ECX key object. Base function. * diff --git a/src/wp_ecx_sig.c b/src/wp_ecx_sig.c index 15119532..375ff82d 100644 --- a/src/wp_ecx_sig.c +++ b/src/wp_ecx_sig.c @@ -436,12 +436,18 @@ static int wp_ed25519_digest_sign(wp_EcxSigCtx *ctx, unsigned char *sig, } } if (ok) { - rc = wc_ed25519_sign_msg(tbs, (word32)tbsLen, sig, &len, ed25519); - if (rc != 0) { + if (wp_ecx_lock(ctx->ecx) != 1) { ok = 0; } - else { - *sigLen = len; + if (ok) { + rc = wc_ed25519_sign_msg(tbs, (word32)tbsLen, sig, &len, ed25519); + wp_ecx_unlock(ctx->ecx); + if (rc != 0) { + ok = 0; + } + else { + *sigLen = len; + } } } } @@ -578,13 +584,19 @@ static int wp_ed448_digest_sign(wp_EcxSigCtx *ctx, unsigned char *sig, } } if (ok) { - rc = wc_ed448_sign_msg(tbs, (word32)tbsLen, sig, &len, - (ed448_key*)wp_ecx_get_key(ctx->ecx), NULL, 0); - if (rc != 0) { + if (wp_ecx_lock(ctx->ecx) != 1) { ok = 0; } - else { - *sigLen = len; + if (ok) { + rc = wc_ed448_sign_msg(tbs, (word32)tbsLen, sig, &len, + (ed448_key*)wp_ecx_get_key(ctx->ecx), NULL, 0); + wp_ecx_unlock(ctx->ecx); + if (rc != 0) { + ok = 0; + } + else { + *sigLen = len; + } } } } diff --git a/src/wp_rsa_kmgmt.c b/src/wp_rsa_kmgmt.c index cbd560bf..ffed2438 100644 --- a/src/wp_rsa_kmgmt.c +++ b/src/wp_rsa_kmgmt.c @@ -330,6 +330,76 @@ int wp_rsa_get_bits(wp_Rsa* rsa) return rsa->bits; } +/** + * Lock the RSA key mutex. + * + * This function locks the mutex associated with the RSA key object to ensure + * thread-safe access to the key data. + * + * @param [in] rsa RSA key object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_rsa_lock(wp_Rsa* rsa) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (rsa == NULL) { + ok = 0; + } + else { + rc = wc_LockMutex(&rsa->mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)rsa; + WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + +/** + * Unlock the RSA key mutex. + * + * This function unlocks the mutex associated with the RSA key object. + * Should only be called after a successful wp_rsa_lock() call. + * + * @param [in] rsa RSA key object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_rsa_unlock(wp_Rsa* rsa) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (rsa == NULL) { + ok = 0; + } + else { + rc = wc_UnLockMutex(&rsa->mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)rsa; + WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + /** * Check the RSA key size is valid. * diff --git a/src/wp_rsa_sig.c b/src/wp_rsa_sig.c index 55d33ec0..7707505e 100644 --- a/src/wp_rsa_sig.c +++ b/src/wp_rsa_sig.c @@ -609,13 +609,19 @@ static int wp_rsa_sign_pkcs1(wp_RsaSigCtx* ctx, unsigned char* sig, } } if (ok) { - PRIVATE_KEY_UNLOCK(); - rc = wc_RsaSSL_Sign(tbs, (word32)tbsLen, sig, (word32)sigSize, - wp_rsa_get_key(ctx->rsa), &ctx->rng); - PRIVATE_KEY_LOCK(); - if (rc <= 0) { + if (wp_rsa_lock(ctx->rsa) != 1) { ok = 0; } + if (ok) { + PRIVATE_KEY_UNLOCK(); + rc = wc_RsaSSL_Sign(tbs, (word32)tbsLen, sig, (word32)sigSize, + wp_rsa_get_key(ctx->rsa), &ctx->rng); + PRIVATE_KEY_LOCK(); + wp_rsa_unlock(ctx->rsa); + if (rc <= 0) { + ok = 0; + } + } } if (ok) { *sigLen = rc; @@ -655,21 +661,29 @@ static int wp_rsa_sign_pss(wp_RsaSigCtx* ctx, unsigned char* sig, #endif wp_rsa_get_key(ctx->rsa), EVP_PKEY_OP_SIGN); - PRIVATE_KEY_UNLOCK(); - rc = wc_RsaPSS_Sign_ex(tbs, (word32)tbsLen, sig, (word32)sigSize, -#if LIBWOLFSSL_VERSION_HEX >= 0x05007004 - ctx->hash.type, -#else - ctx->hashType, -#endif - ctx->mgf, saltLen, wp_rsa_get_key(ctx->rsa), - &ctx->rng); - PRIVATE_KEY_LOCK(); - if (rc < 0) { - ok = 0; - } - else { - *sigLen = rc; + if (ok) { + if (wp_rsa_lock(ctx->rsa) != 1) { + ok = 0; + } + if (ok) { + PRIVATE_KEY_UNLOCK(); + rc = wc_RsaPSS_Sign_ex(tbs, (word32)tbsLen, sig, (word32)sigSize, + #if LIBWOLFSSL_VERSION_HEX >= 0x05007004 + ctx->hash.type, + #else + ctx->hashType, + #endif + ctx->mgf, saltLen, wp_rsa_get_key(ctx->rsa), + &ctx->rng); + PRIVATE_KEY_LOCK(); + wp_rsa_unlock(ctx->rsa); + if (rc < 0) { + ok = 0; + } + else { + *sigLen = rc; + } + } } WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); @@ -749,16 +763,21 @@ static int wp_rsa_sign_no_pad(wp_RsaSigCtx* ctx, unsigned char* sig, if (ok) { word32 len = (word32)sigSize; int rc; - - PRIVATE_KEY_UNLOCK(); - rc = wc_RsaDirect((byte*)tbs, (word32)tbsLen, sig, &len, - wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng); - PRIVATE_KEY_LOCK(); - if (rc < 0) { + if (wp_rsa_lock(ctx->rsa) != 1) { ok = 0; } - else { - *sigLen = rc; + if (ok) { + PRIVATE_KEY_UNLOCK(); + rc = wc_RsaDirect((byte*)tbs, (word32)tbsLen, sig, &len, + wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng); + PRIVATE_KEY_LOCK(); + wp_rsa_unlock(ctx->rsa); + if (rc < 0) { + ok = 0; + } + else { + *sigLen = rc; + } } } @@ -841,16 +860,21 @@ static int wp_rsa_sign_x931(wp_RsaSigCtx* ctx, unsigned char* sig, } if (ok) { word32 len = (word32)sigSize; - - PRIVATE_KEY_UNLOCK(); - rc = wc_RsaDirect(padded, paddedSz, sig, &len, - wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng); - PRIVATE_KEY_LOCK(); - if (rc < 0) { + if (wp_rsa_lock(ctx->rsa) != 1) { ok = 0; } - else { - *sigLen = rc; + if (ok) { + PRIVATE_KEY_UNLOCK(); + rc = wc_RsaDirect(padded, paddedSz, sig, &len, + wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng); + PRIVATE_KEY_LOCK(); + wp_rsa_unlock(ctx->rsa); + if (rc < 0) { + ok = 0; + } + else { + *sigLen = rc; + } } } if (padded != NULL) { @@ -914,6 +938,8 @@ static int wp_rsa_sign(wp_RsaSigCtx* ctx, unsigned char* sig, size_t* sigLen, { int ok = 1; + WOLFPROV_ENTER(WP_LOG_PK, "wp_rsa_sign"); + if (!wolfssl_prov_is_running()) { ok = 0; } @@ -1311,6 +1337,8 @@ static int wp_rsa_verify(wp_RsaSigCtx* ctx, const unsigned char* sig, { int ok = 1; + WOLFPROV_ENTER(WP_LOG_PK, "wp_rsa_verify"); + if (!wolfssl_prov_is_running()) { ok = 0; } From 70df13866b493eac155bd43b0305b6e092f91a0a Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 17 Jun 2025 12:12:29 -0700 Subject: [PATCH 2/3] Unify locking behavior using a single function --- include/wolfprovider/alg_funcs.h | 12 +++--- src/wp_ecc_kmgmt.c | 67 ++---------------------------- src/wp_ecdsa_sig.c | 4 +- src/wp_ecx_kmgmt.c | 67 ++---------------------------- src/wp_ecx_sig.c | 8 ++-- src/wp_internal.c | 71 ++++++++++++++++++++++++++++++++ src/wp_rsa_kmgmt.c | 67 ++---------------------------- src/wp_rsa_sig.c | 16 +++---- 8 files changed, 103 insertions(+), 209 deletions(-) diff --git a/include/wolfprovider/alg_funcs.h b/include/wolfprovider/alg_funcs.h index 93765030..4c8bf2a4 100644 --- a/include/wolfprovider/alg_funcs.h +++ b/include/wolfprovider/alg_funcs.h @@ -175,6 +175,9 @@ typedef void (*DFUNC)(void); int wolfssl_prov_is_running(void); WC_RNG* wolfssl_prov_get_rng(WOLFPROV_CTX* provctx); +int wp_lock(wolfSSL_Mutex* mutex); +int wp_unlock(wolfSSL_Mutex* mutex); + /* Internal RSA types and functions. */ typedef struct wp_Rsa wp_Rsa; @@ -182,8 +185,7 @@ int wp_rsa_up_ref(wp_Rsa* rsa); void wp_rsa_free(wp_Rsa* rsa); int wp_rsa_get_type(wp_Rsa* rsa); int wp_rsa_get_bits(wp_Rsa* rsa); -int wp_rsa_lock(wp_Rsa* rsa); -int wp_rsa_unlock(wp_Rsa* rsa); +wolfSSL_Mutex* wp_rsa_get_mutex(wp_Rsa* rsa); RsaKey* wp_rsa_get_key(wp_Rsa* rsa); void wp_rsa_get_pss_mds(wp_Rsa* rsa, char** mdName, char** mgfMdName); int wp_rsa_get_pss_salt_len(wp_Rsa* rsa); @@ -201,8 +203,7 @@ ecc_key* wp_ecc_get_key(wp_Ecc* ecc); WC_RNG* wp_ecc_get_rng(wp_Ecc* ecc); int wp_ecc_get_size(wp_Ecc* ecc); int wp_ecc_check_usage(wp_Ecc* ecc); -int wp_ecc_lock(wp_Ecc* ecc); -int wp_ecc_unlock(wp_Ecc* ecc); +wolfSSL_Mutex* wp_ecc_get_mutex(wp_Ecc* ecc); /* Internal ECX types and functions. */ typedef struct wp_Ecx wp_Ecx; @@ -210,8 +211,7 @@ typedef struct wp_Ecx wp_Ecx; int wp_ecx_up_ref(wp_Ecx* ecx); void wp_ecx_free(wp_Ecx* ecx); void* wp_ecx_get_key(wp_Ecx* ecx); -int wp_ecx_lock(wp_Ecx* ecx); -int wp_ecx_unlock(wp_Ecx* ecx); +wolfSSL_Mutex* wp_ecx_get_mutex(wp_Ecx* ecx); /* Internal DH types and functions. */ typedef struct wp_Dh wp_Dh; diff --git a/src/wp_ecc_kmgmt.c b/src/wp_ecc_kmgmt.c index fa744b1b..25eaf11e 100644 --- a/src/wp_ecc_kmgmt.c +++ b/src/wp_ecc_kmgmt.c @@ -300,73 +300,14 @@ int wp_ecc_get_size(wp_Ecc* ecc) } /** - * Lock the ECC key mutex. - * - * This function locks the mutex associated with the ECC key object. - * Use wp_ecc_unlock() to unlock after operations are complete. - * - * @param [in] ecc ECC key object. - * @return 1 on success. - * @return 0 on failure or when single-threaded build. - */ -int wp_ecc_lock(wp_Ecc* ecc) -{ -#ifndef WP_SINGLE_THREADED - int ok = 1; - int rc; - - if (ecc == NULL) { - ok = 0; - } - else { - rc = wc_LockMutex(&ecc->mutex); - if (rc < 0) { - ok = 0; - } - } - - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); - return ok; -#else - (void)ecc; - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); - return 1; -#endif -} - -/** - * Unlock the ECC key mutex. - * - * This function unlocks the mutex associated with the ECC key object. - * Should only be called after a successful wp_ecc_lock() call. + * Get the mutex object from the ECC key object. * * @param [in] ecc ECC key object. - * @return 1 on success. - * @return 0 on failure or when single-threaded build. + * @return Pointer to wolfSSL mutex object. */ -int wp_ecc_unlock(wp_Ecc* ecc) +wolfSSL_Mutex* wp_ecc_get_mutex(wp_Ecc* ecc) { -#ifndef WP_SINGLE_THREADED - int ok = 1; - int rc; - - if (ecc == NULL) { - ok = 0; - } - else { - rc = wc_UnLockMutex(&ecc->mutex); - if (rc < 0) { - ok = 0; - } - } - - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); - return ok; -#else - (void)ecc; - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); - return 1; -#endif + return &ecc->mutex; } /** diff --git a/src/wp_ecdsa_sig.c b/src/wp_ecdsa_sig.c index fe55406b..0b648e2f 100644 --- a/src/wp_ecdsa_sig.c +++ b/src/wp_ecdsa_sig.c @@ -280,7 +280,7 @@ static int wp_ecdsa_sign(wp_EcdsaSigCtx *ctx, unsigned char *sig, sigSize = *sigLen; } len = (word32)sigSize; - if (wp_ecc_lock(ctx->ecc) != 1) { + if (wp_lock(wp_ecc_get_mutex(ctx->ecc)) != 1) { ok = 0; } if (ok) { @@ -288,7 +288,7 @@ static int wp_ecdsa_sign(wp_EcdsaSigCtx *ctx, unsigned char *sig, rc = wc_ecc_sign_hash(tbs, (word32)tbsLen, sig, &len, wp_ecc_get_rng(ctx->ecc), wp_ecc_get_key(ctx->ecc)); PRIVATE_KEY_LOCK(); - wp_ecc_unlock(ctx->ecc); + wp_unlock(wp_ecc_get_mutex(ctx->ecc)); if (rc != 0) { ok = 0; } diff --git a/src/wp_ecx_kmgmt.c b/src/wp_ecx_kmgmt.c index 24ec6abd..2ca82a55 100644 --- a/src/wp_ecx_kmgmt.c +++ b/src/wp_ecx_kmgmt.c @@ -244,73 +244,14 @@ void* wp_ecx_get_key(wp_Ecx* ecx) } /** - * Lock the ECX key mutex. - * - * This function locks the mutex associated with the ECX key object. - * Use wp_ecx_unlock() to unlock after operations are complete. - * - * @param [in] ecx ECX key object. - * @return 1 on success. - * @return 0 on failure or when single-threaded build. - */ -int wp_ecx_lock(wp_Ecx* ecx) -{ -#ifndef WP_SINGLE_THREADED - int ok = 1; - int rc; - - if (ecx == NULL) { - ok = 0; - } - else { - rc = wc_LockMutex(&ecx->mutex); - if (rc < 0) { - ok = 0; - } - } - - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); - return ok; -#else - (void)ecx; - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); - return 1; -#endif -} - -/** - * Unlock the ECX key mutex. - * - * This function unlocks the mutex associated with the ECX key object. - * Should only be called after a successful wp_ecx_lock() call. + * Get the mutex object from the ECX key object. * * @param [in] ecx ECX key object. - * @return 1 on success. - * @return 0 on failure or when single-threaded build. + * @return Pointer to wolfSSL mutex object. */ -int wp_ecx_unlock(wp_Ecx* ecx) +wolfSSL_Mutex* wp_ecx_get_mutex(wp_Ecx* ecx) { -#ifndef WP_SINGLE_THREADED - int ok = 1; - int rc; - - if (ecx == NULL) { - ok = 0; - } - else { - rc = wc_UnLockMutex(&ecx->mutex); - if (rc < 0) { - ok = 0; - } - } - - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); - return ok; -#else - (void)ecx; - WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); - return 1; -#endif + return &ecx->mutex; } /** diff --git a/src/wp_ecx_sig.c b/src/wp_ecx_sig.c index 375ff82d..2695c06c 100644 --- a/src/wp_ecx_sig.c +++ b/src/wp_ecx_sig.c @@ -436,12 +436,12 @@ static int wp_ed25519_digest_sign(wp_EcxSigCtx *ctx, unsigned char *sig, } } if (ok) { - if (wp_ecx_lock(ctx->ecx) != 1) { + if (wp_lock(wp_ecx_get_mutex(ctx->ecx)) != 1) { ok = 0; } if (ok) { rc = wc_ed25519_sign_msg(tbs, (word32)tbsLen, sig, &len, ed25519); - wp_ecx_unlock(ctx->ecx); + wp_unlock(wp_ecx_get_mutex(ctx->ecx)); if (rc != 0) { ok = 0; } @@ -584,13 +584,13 @@ static int wp_ed448_digest_sign(wp_EcxSigCtx *ctx, unsigned char *sig, } } if (ok) { - if (wp_ecx_lock(ctx->ecx) != 1) { + if (wp_lock(wp_ecx_get_mutex(ctx->ecx)) != 1) { ok = 0; } if (ok) { rc = wc_ed448_sign_msg(tbs, (word32)tbsLen, sig, &len, (ed448_key*)wp_ecx_get_key(ctx->ecx), NULL, 0); - wp_ecx_unlock(ctx->ecx); + wp_unlock(wp_ecx_get_mutex(ctx->ecx)); if (rc != 0) { ok = 0; } diff --git a/src/wp_internal.c b/src/wp_internal.c index 1ad85d63..9405f15f 100644 --- a/src/wp_internal.c +++ b/src/wp_internal.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include @@ -73,6 +74,76 @@ void wp_provctx_unlock_rng(WOLFPROV_CTX* provCtx) } #endif +/** + * Lock the mutex. + * + * This function locks the mutex and translates the return value. + * Use wp_unlock() to unlock after operations are complete. + * + * @param [in] mutex Mutex object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_lock(wolfSSL_Mutex *mutex) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (mutex == NULL) { + ok = 0; + } + else { + rc = wc_LockMutex(mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)mutex; + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + +/** + * Unlock the mutex. + * + * This function unlocks the mutex and translates the return value. + * Should only be called after a successful wp_lock() call. + * + * @param [in] mutex Mutex object. + * @return 1 on success. + * @return 0 on failure or when single-threaded build. + */ +int wp_unlock(wolfSSL_Mutex* mutex) +{ +#ifndef WP_SINGLE_THREADED + int ok = 1; + int rc; + + if (mutex == NULL) { + ok = 0; + } + else { + rc = wc_UnLockMutex(mutex); + if (rc < 0) { + ok = 0; + } + } + + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); + return ok; +#else + (void)mutex; + WOLFPROV_LEAVE(WP_LOG_KE, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); + return 1; +#endif +} + /** * Convert the string name of an object to an OpenSSL Numeric ID (NID). diff --git a/src/wp_rsa_kmgmt.c b/src/wp_rsa_kmgmt.c index ffed2438..04d99699 100644 --- a/src/wp_rsa_kmgmt.c +++ b/src/wp_rsa_kmgmt.c @@ -331,73 +331,14 @@ int wp_rsa_get_bits(wp_Rsa* rsa) } /** - * Lock the RSA key mutex. - * - * This function locks the mutex associated with the RSA key object to ensure - * thread-safe access to the key data. - * - * @param [in] rsa RSA key object. - * @return 1 on success. - * @return 0 on failure or when single-threaded build. - */ -int wp_rsa_lock(wp_Rsa* rsa) -{ -#ifndef WP_SINGLE_THREADED - int ok = 1; - int rc; - - if (rsa == NULL) { - ok = 0; - } - else { - rc = wc_LockMutex(&rsa->mutex); - if (rc < 0) { - ok = 0; - } - } - - WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); - return ok; -#else - (void)rsa; - WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); - return 1; -#endif -} - -/** - * Unlock the RSA key mutex. - * - * This function unlocks the mutex associated with the RSA key object. - * Should only be called after a successful wp_rsa_lock() call. + * Get the mutex object from the RSA key object. * * @param [in] rsa RSA key object. - * @return 1 on success. - * @return 0 on failure or when single-threaded build. + * @return Pointer to wolfSSL mutex object. */ -int wp_rsa_unlock(wp_Rsa* rsa) +wolfSSL_Mutex* wp_rsa_get_mutex(wp_Rsa* rsa) { -#ifndef WP_SINGLE_THREADED - int ok = 1; - int rc; - - if (rsa == NULL) { - ok = 0; - } - else { - rc = wc_UnLockMutex(&rsa->mutex); - if (rc < 0) { - ok = 0; - } - } - - WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), ok); - return ok; -#else - (void)rsa; - WOLFPROV_LEAVE(WP_LOG_PK, __FILE__ ":" WOLFPROV_STRINGIZE(__LINE__), 1); - return 1; -#endif + return &rsa->mutex; } /** diff --git a/src/wp_rsa_sig.c b/src/wp_rsa_sig.c index 7707505e..f3899783 100644 --- a/src/wp_rsa_sig.c +++ b/src/wp_rsa_sig.c @@ -609,7 +609,7 @@ static int wp_rsa_sign_pkcs1(wp_RsaSigCtx* ctx, unsigned char* sig, } } if (ok) { - if (wp_rsa_lock(ctx->rsa) != 1) { + if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) { ok = 0; } if (ok) { @@ -617,7 +617,7 @@ static int wp_rsa_sign_pkcs1(wp_RsaSigCtx* ctx, unsigned char* sig, rc = wc_RsaSSL_Sign(tbs, (word32)tbsLen, sig, (word32)sigSize, wp_rsa_get_key(ctx->rsa), &ctx->rng); PRIVATE_KEY_LOCK(); - wp_rsa_unlock(ctx->rsa); + wp_unlock(wp_rsa_get_mutex(ctx->rsa)); if (rc <= 0) { ok = 0; } @@ -662,7 +662,7 @@ static int wp_rsa_sign_pss(wp_RsaSigCtx* ctx, unsigned char* sig, wp_rsa_get_key(ctx->rsa), EVP_PKEY_OP_SIGN); if (ok) { - if (wp_rsa_lock(ctx->rsa) != 1) { + if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) { ok = 0; } if (ok) { @@ -676,7 +676,7 @@ static int wp_rsa_sign_pss(wp_RsaSigCtx* ctx, unsigned char* sig, ctx->mgf, saltLen, wp_rsa_get_key(ctx->rsa), &ctx->rng); PRIVATE_KEY_LOCK(); - wp_rsa_unlock(ctx->rsa); + wp_unlock(wp_rsa_get_mutex(ctx->rsa)); if (rc < 0) { ok = 0; } @@ -763,7 +763,7 @@ static int wp_rsa_sign_no_pad(wp_RsaSigCtx* ctx, unsigned char* sig, if (ok) { word32 len = (word32)sigSize; int rc; - if (wp_rsa_lock(ctx->rsa) != 1) { + if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) { ok = 0; } if (ok) { @@ -771,7 +771,7 @@ static int wp_rsa_sign_no_pad(wp_RsaSigCtx* ctx, unsigned char* sig, rc = wc_RsaDirect((byte*)tbs, (word32)tbsLen, sig, &len, wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng); PRIVATE_KEY_LOCK(); - wp_rsa_unlock(ctx->rsa); + wp_unlock(wp_rsa_get_mutex(ctx->rsa)); if (rc < 0) { ok = 0; } @@ -860,7 +860,7 @@ static int wp_rsa_sign_x931(wp_RsaSigCtx* ctx, unsigned char* sig, } if (ok) { word32 len = (word32)sigSize; - if (wp_rsa_lock(ctx->rsa) != 1) { + if (wp_lock(wp_rsa_get_mutex(ctx->rsa)) != 1) { ok = 0; } if (ok) { @@ -868,7 +868,7 @@ static int wp_rsa_sign_x931(wp_RsaSigCtx* ctx, unsigned char* sig, rc = wc_RsaDirect(padded, paddedSz, sig, &len, wp_rsa_get_key(ctx->rsa), RSA_PRIVATE_ENCRYPT, &ctx->rng); PRIVATE_KEY_LOCK(); - wp_rsa_unlock(ctx->rsa); + wp_unlock(wp_rsa_get_mutex(ctx->rsa)); if (rc < 0) { ok = 0; } From 03cbe6b55c1b3c0d1364a2c2775f4aac7ea31458 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Thu, 19 Jun 2025 11:21:15 -0700 Subject: [PATCH 3/3] Use __FUNCTION__ macro instead of hardcoded string --- src/wp_rsa_sig.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/wp_rsa_sig.c b/src/wp_rsa_sig.c index f3899783..c147bbff 100644 --- a/src/wp_rsa_sig.c +++ b/src/wp_rsa_sig.c @@ -938,7 +938,7 @@ static int wp_rsa_sign(wp_RsaSigCtx* ctx, unsigned char* sig, size_t* sigLen, { int ok = 1; - WOLFPROV_ENTER(WP_LOG_PK, "wp_rsa_sign"); + WOLFPROV_ENTER(WP_LOG_PK, __FUNCTION__); if (!wolfssl_prov_is_running()) { ok = 0; @@ -1337,7 +1337,7 @@ static int wp_rsa_verify(wp_RsaSigCtx* ctx, const unsigned char* sig, { int ok = 1; - WOLFPROV_ENTER(WP_LOG_PK, "wp_rsa_verify"); + WOLFPROV_ENTER(WP_LOG_PK, __FUNCTION__); if (!wolfssl_prov_is_running()) { ok = 0;