Skip to content

Commit 4da2aaf

Browse files
bigbrettbigbrett
committed
Review feedback:
 - Renamed whServerCacheXXX to whKeyCacheXXX - Relocated client global+wrapped flags to wh_keyid.h from wh_client.h - Fixed copyright year - Fixed wh_settings.h include order
1 parent d026f0c commit 4da2aaf

File tree

13 files changed

+147
-184
lines changed

13 files changed

+147
-184
lines changed

‎src/wh_keyid.c‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,44 +24,44 @@
2424

2525
#include "wolfhsm/wh_keyid.h"
2626

27-
whKeyId wh_KeyId_TranslateClient(uint16_t type, uint16_t clientId,
28-
whKeyId reqId)
27+
whKeyId wh_KeyId_TranslateFromClient(uint16_t type, uint16_t clientId,
28+
whKeyId reqId)
2929
{
3030
uint16_t user = clientId;
3131
whKeyId id = reqId & WH_KEYID_MASK;
3232

3333
#ifdef WOLFHSM_CFG_GLOBAL_KEYS
34-
/* Check for global flag (bit 8: 0x0100) */
35-
if ((reqId & 0x0100) != 0) {
34+
/* Convert global flag to USER=0 */
35+
if ((reqId & WH_KEYID_CLIENT_GLOBAL_FLAG) != 0) {
3636
user = WH_KEYUSER_GLOBAL;
3737
}
3838
#endif
3939

4040
#ifdef WOLFHSM_CFG_KEYWRAP
41-
/* Check for wrapped flag (bit 9: 0x0200) */
42-
if ((reqId & 0x0200) != 0) {
41+
/* Convert wrapped flag to TYPE=WH_KETYPE_WRAPPED */
42+
if ((reqId & WH_KEYID_CLIENT_WRAPPED_FLAG) != 0) {
4343
type = WH_KEYTYPE_WRAPPED;
4444
}
4545
#endif
4646

4747
return WH_MAKE_KEYID(type, user, id);
4848
}
4949

50-
whKeyId wh_KeyId_ToClient(whKeyId serverId)
50+
whKeyId wh_KeyId_TranslateToClient(whKeyId serverId)
5151
{
5252
whKeyId clientId = WH_KEYID_ID(serverId);
5353

5454
#ifdef WOLFHSM_CFG_GLOBAL_KEYS
55-
/* Convert USER=0 to global flag (bit 8: 0x0100) */
55+
/* Convert USER=0 to global flag */
5656
if (WH_KEYID_USER(serverId) == WH_KEYUSER_GLOBAL) {
57-
clientId |= 0x0100; /* WH_CLIENT_KEYID_GLOBAL_FLAG */
57+
clientId |= WH_KEYID_CLIENT_GLOBAL_FLAG;
5858
}
5959
#endif
6060

6161
#ifdef WOLFHSM_CFG_KEYWRAP
62-
/* Convert TYPE=WRAPPED to wrapped flag (bit 9: 0x0200) */
62+
/* Convert TYPE=WRAPPED to wrapped flag */
6363
if (WH_KEYID_TYPE(serverId) == WH_KEYTYPE_WRAPPED) {
64-
clientId |= 0x0200; /* WH_CLIENT_KEYID_WRAPPED_FLAG */
64+
clientId |= WH_KEYID_CLIENT_WRAPPED_FLAG;
6565
}
6666
#endif
6767

‎src/wh_server_cert.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -489,7 +489,7 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
489489
cert_data = (const uint8_t*)req_packet + sizeof(req);
490490

491491
/* Map client keyId to server keyId space */
492-
whKeyId keyId = wh_KeyId_TranslateClient(
492+
whKeyId keyId = wh_KeyId_TranslateFromClient(
493493
WH_KEYTYPE_CRYPTO, server->comm->client_id, req.keyId);
494494

495495
/* Process the verify action */
@@ -499,7 +499,7 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
499499

500500
/* Propagate the keyId back to the client with flags preserved
501501
*/
502-
resp.keyId = wh_KeyId_ToClient(keyId);
502+
resp.keyId = wh_KeyId_TranslateToClient(keyId);
503503
}
504504

505505
/* Convert the response struct */
@@ -619,7 +619,7 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
619619
}
620620
if (resp.rc == WH_ERROR_OK) {
621621
/* Map client keyId to server keyId space */
622-
whKeyId keyId = wh_KeyId_TranslateClient(
622+
whKeyId keyId = wh_KeyId_TranslateFromClient(
623623
WH_KEYTYPE_CRYPTO, server->comm->client_id, req.keyId);
624624

625625
/* Process the verify action */
@@ -629,7 +629,7 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
629629

630630
/* Propagate the keyId back to the client with flags preserved
631631
*/
632-
resp.keyId = wh_KeyId_ToClient(keyId);
632+
resp.keyId = wh_KeyId_TranslateToClient(keyId);
633633
}
634634
if (resp.rc == WH_ERROR_OK) {
635635
/* Post-process client address */

‎src/wh_server_crypto.c‎

Lines changed: 60 additions & 60 deletions
Large diffs are not rendered by default.

‎src/wh_server_keystore.c‎

Lines changed: 21 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ static int _GetKeyCacheSlot(whKeyCacheContext* ctx, uint16_t keySz,
171171

172172
/* Zero slot and return pointers */
173173
if (foundIndex >= 0) {
174-
memset(&ctx->cache[foundIndex], 0, sizeof(whServerCacheSlot));
174+
memset(&ctx->cache[foundIndex], 0, sizeof(whCacheSlot));
175175
*outBuf = ctx->cache[foundIndex].buffer;
176176
*outMeta = ctx->cache[foundIndex].meta;
177177
}
@@ -197,7 +197,7 @@ static int _GetKeyCacheSlot(whKeyCacheContext* ctx, uint16_t keySz,
197197

198198
/* Zero slot and return pointers */
199199
if (foundIndex >= 0) {
200-
memset(&ctx->bigCache[foundIndex], 0, sizeof(whServerBigCacheSlot));
200+
memset(&ctx->bigCache[foundIndex], 0, sizeof(whBigCacheSlot));
201201
*outBuf = ctx->bigCache[foundIndex].buffer;
202202
*outMeta = ctx->bigCache[foundIndex].meta;
203203
}
@@ -485,26 +485,6 @@ static int _ExistsInCache(whServerContext* server, whKeyId keyId)
485485
}
486486
#endif /* WOLFHSM_CFG_KEYWRAP */
487487

488-
#ifdef WOLFHSM_CFG_KEYWRAP
489-
int wh_Server_KeystoreIsWrappedKey(whServerContext* server, whKeyId keyId,
490-
int* outIsWrapped)
491-
{
492-
int isWrapped;
493-
494-
if (server == NULL || WH_KEYID_ISERASED(keyId)) {
495-
return WH_ERROR_BADARGS;
496-
}
497-
498-
(void)server;
499-
isWrapped = (WH_KEYID_TYPE(keyId) == WH_KEYTYPE_WRAPPED);
500-
if (outIsWrapped != NULL) {
501-
*outIsWrapped = isWrapped;
502-
}
503-
504-
return WH_ERROR_OK;
505-
}
506-
#endif /* WOLFHSM_CFG_KEYWRAP */
507-
508488
/* try to put the specified key into cache if it isn't already, return pointers
509489
* to meta and the cached data*/
510490
int wh_Server_KeystoreFreshenKey(whServerContext* server, whKeyId keyId,
@@ -742,8 +722,8 @@ static int _AesGcmWrapKey(whServerContext* server, whKeyId serverKeyId,
742722
/* Get the server side key */
743723
ret = wh_Server_KeystoreReadKey(
744724
server,
745-
wh_KeyId_TranslateClient(WH_KEYTYPE_CRYPTO, server->comm->client_id,
746-
serverKeyId),
725+
wh_KeyId_TranslateFromClient(WH_KEYTYPE_CRYPTO, server->comm->client_id,
726+
serverKeyId),
747727
NULL, serverKey, &serverKeySz);
748728
if (ret != WH_ERROR_OK) {
749729
return ret;
@@ -815,8 +795,8 @@ static int _AesGcmUnwrapKey(whServerContext* server, uint16_t serverKeyId,
815795
/* Get the server side key */
816796
ret = wh_Server_KeystoreReadKey(
817797
server,
818-
wh_KeyId_TranslateClient(WH_KEYTYPE_CRYPTO, server->comm->client_id,
819-
serverKeyId),
798+
wh_KeyId_TranslateFromClient(WH_KEYTYPE_CRYPTO, server->comm->client_id,
799+
serverKeyId),
820800
NULL, serverKey, &serverKeySz);
821801
if (ret != WH_ERROR_OK) {
822802
return ret;
@@ -1115,7 +1095,7 @@ _HandleUnwrapAndCacheKeyRequest(whServerContext* server,
11151095
}
11161096

11171097
/* Store the assigned key ID in the response, preserving client flags */
1118-
resp->keyId = wh_KeyId_ToClient(metadata.id);
1098+
resp->keyId = wh_KeyId_TranslateToClient(metadata.id);
11191099

11201100
/* Cache the key */
11211101
return wh_Server_KeystoreCacheKey(server, &metadata, key);
@@ -1153,7 +1133,7 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
11531133
in = (uint8_t*)req_packet + sizeof(req);
11541134

11551135
/* set the metadata fields */
1156-
meta->id = wh_KeyId_TranslateClient(
1136+
meta->id = wh_KeyId_TranslateFromClient(
11571137
WH_KEYTYPE_CRYPTO, server->comm->client_id, req.id);
11581138
meta->access = WH_NVM_ACCESS_ANY;
11591139
meta->flags = req.flags;
@@ -1181,7 +1161,7 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
11811161
}
11821162
if (ret == WH_ERROR_OK) {
11831163
/* Translate server keyId back to client format with flags */
1184-
resp.id = wh_KeyId_ToClient(meta->id);
1164+
resp.id = wh_KeyId_TranslateToClient(meta->id);
11851165

11861166
(void)wh_MessageKeystore_TranslateCacheResponse(
11871167
magic, &resp,
@@ -1202,7 +1182,7 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
12021182
magic, (whMessageKeystore_CacheDmaRequest*)req_packet, &req);
12031183

12041184
/* set the metadata fields */
1205-
meta->id = wh_KeyId_TranslateClient(
1185+
meta->id = wh_KeyId_TranslateFromClient(
12061186
WH_KEYTYPE_CRYPTO, server->comm->client_id, req.id);
12071187
meta->access = WH_NVM_ACCESS_ANY;
12081188
meta->flags = req.flags;
@@ -1236,7 +1216,7 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
12361216
}
12371217

12381218
/* Translate server keyId back to client format with flags */
1239-
resp.id = wh_KeyId_ToClient(meta->id);
1219+
resp.id = wh_KeyId_TranslateToClient(meta->id);
12401220

12411221
(void)wh_MessageKeystore_TranslateCacheDmaResponse(
12421222
magic, &resp, (whMessageKeystore_CacheDmaResponse*)resp_packet);
@@ -1254,8 +1234,8 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
12541234

12551235
ret = wh_Server_KeystoreExportKeyDma(
12561236
server,
1257-
wh_KeyId_TranslateClient(WH_KEYTYPE_CRYPTO,
1258-
server->comm->client_id, req.id),
1237+
wh_KeyId_TranslateFromClient(WH_KEYTYPE_CRYPTO,
1238+
server->comm->client_id, req.id),
12591239
req.key.addr, req.key.sz, meta);
12601240
resp.rc = ret;
12611241
/* propagate bad address to client if DMA operation failed */
@@ -1288,8 +1268,8 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
12881268

12891269
ret = wh_Server_KeystoreEvictKey(
12901270
server,
1291-
wh_KeyId_TranslateClient(WH_KEYTYPE_CRYPTO,
1292-
server->comm->client_id, req.id));
1271+
wh_KeyId_TranslateFromClient(WH_KEYTYPE_CRYPTO,
1272+
server->comm->client_id, req.id));
12931273
resp.rc = ret;
12941274
/* TODO: Are there any fatal server errors? */
12951275
ret = WH_ERROR_OK;
@@ -1320,8 +1300,8 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
13201300
/* read the key */
13211301
ret = wh_Server_KeystoreReadKey(
13221302
server,
1323-
wh_KeyId_TranslateClient(WH_KEYTYPE_CRYPTO,
1324-
server->comm->client_id, req.id),
1303+
wh_KeyId_TranslateFromClient(WH_KEYTYPE_CRYPTO,
1304+
server->comm->client_id, req.id),
13251305
meta, out, &keySz);
13261306

13271307
/* Check if key is non-exportable */
@@ -1364,8 +1344,8 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
13641344

13651345
ret = wh_Server_KeystoreCommitKey(
13661346
server,
1367-
wh_KeyId_TranslateClient(WH_KEYTYPE_CRYPTO,
1368-
server->comm->client_id, req.id));
1347+
wh_KeyId_TranslateFromClient(WH_KEYTYPE_CRYPTO,
1348+
server->comm->client_id, req.id));
13691349
resp.rc = ret;
13701350
/* TODO: Are there any fatal server errors? */
13711351
ret = WH_ERROR_OK;
@@ -1391,8 +1371,8 @@ int wh_Server_HandleKeyRequest(whServerContext* server, uint16_t magic,
13911371

13921372
ret = wh_Server_KeystoreEraseKey(
13931373
server,
1394-
wh_KeyId_TranslateClient(WH_KEYTYPE_CRYPTO,
1395-
server->comm->client_id, req.id));
1374+
wh_KeyId_TranslateFromClient(WH_KEYTYPE_CRYPTO,
1375+
server->comm->client_id, req.id));
13961376
resp.rc = ret;
13971377
/* TODO: Are there any fatal server errors? */
13981378
ret = WH_ERROR_OK;

‎test/wh_test_multiclient.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1249,7 +1249,7 @@ static int _testKeyIdFlagPreservation(whClientContext* client1,
12491249
wh_Client_KeyCacheResponse(client1, &returnedKeyId));
12501250

12511251
/* Verify global flag is preserved */
1252-
WH_TEST_ASSERT_RETURN((returnedKeyId & WH_CLIENT_KEYID_GLOBAL_FLAG) !=
1252+
WH_TEST_ASSERT_RETURN((returnedKeyId & WH_KEYID_CLIENT_GLOBAL_FLAG) !=
12531253
0);
12541254
WH_TEST_ASSERT_RETURN((returnedKeyId & WH_KEYID_MASK) == DUMMY_KEYID_1);
12551255

@@ -1275,7 +1275,7 @@ static int _testKeyIdFlagPreservation(whClientContext* client1,
12751275
wh_Client_KeyCacheResponse(client1, &returnedKeyId));
12761276

12771277
/* Verify no global flag */
1278-
WH_TEST_ASSERT_RETURN((returnedKeyId & WH_CLIENT_KEYID_GLOBAL_FLAG) ==
1278+
WH_TEST_ASSERT_RETURN((returnedKeyId & WH_KEYID_CLIENT_GLOBAL_FLAG) ==
12791279
0);
12801280
WH_TEST_ASSERT_RETURN((returnedKeyId & WH_KEYID_MASK) == DUMMY_KEYID_2);
12811281

‎test/wh_test_multiclient.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2024 wolfSSL Inc.
2+
* Copyright (C) 2025 wolfSSL Inc.
33
*
44
* This file is part of wolfHSM.
55
*

‎wolfhsm/wh_client.h‎

Lines changed: 4 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
#ifdef WOLFHSM_CFG_DMA
5353
#include "wolfhsm/wh_dma.h"
5454
#endif /* WOLFHSM_CFG_DMA */
55+
#include "wolfhsm/wh_keyid.h"
5556

5657

5758
/* Forward declaration of the client structure so its elements can reference
@@ -2493,33 +2494,6 @@ int wh_Client_CertVerifyAcertDma(whClientContext* c, const void* cert,
24932494

24942495
#endif /* WOLFHSM_CFG_DMA */
24952496

2496-
/*
2497-
* @brief Client-side keyId manipulation API
2498-
*
2499-
* This section defines the client-facing API for working with key identifiers.
2500-
* Clients use simple numeric IDs (0-255) with optional flags to indicate
2501-
* global or wrapped keys. The server translates these to full internal
2502-
* representations with TYPE/USER/ID fields.
2503-
*
2504-
* Client keyId usage:
2505-
* - Regular keys: Simple numeric ID (e.g., 5)
2506-
* - Global keys: ID with WH_CLIENT_KEYID_GLOBAL_FLAG set
2507-
* - Wrapped keys: ID with WH_CLIENT_KEYID_WRAPPED_FLAG set
2508-
* - Wrapped metadata: Must use full WH_MAKE_KEYID() construction including type
2509-
* and metadata when populating the ID field in metadata to be wrapped
2510-
*/
2511-
2512-
/* Client-facing key flags (temporary, stripped by server during translation) */
2513-
2514-
/* Bit 8: Client-to-server signal for global key (shared across all clients) */
2515-
#define WH_CLIENT_KEYID_GLOBAL_FLAG ((whKeyId)0x0100)
2516-
2517-
/* Bit 9: Client-to-server signal for wrapped key */
2518-
#define WH_CLIENT_KEYID_WRAPPED_FLAG ((whKeyId)0x0200)
2519-
2520-
/* Combined mask of all client-facing flags */
2521-
#define WH_CLIENT_KEYID_FLAGS_MASK \
2522-
(WH_CLIENT_KEYID_GLOBAL_FLAG | WH_CLIENT_KEYID_WRAPPED_FLAG)
25232497

25242498
/**
25252499
* @brief Mark a key ID as global (shared across all clients)
@@ -2535,7 +2509,7 @@ int wh_Client_CertVerifyAcertDma(whClientContext* c, const void* cert,
25352509
* whKeyId globalKey = WH_CLIENT_KEYID_MAKE_GLOBAL(5);
25362510
* wh_Client_KeyCache(client, globalKey, ...); // Stored as global key
25372511
*/
2538-
#define WH_CLIENT_KEYID_MAKE_GLOBAL(_id) ((_id) | WH_CLIENT_KEYID_GLOBAL_FLAG)
2512+
#define WH_CLIENT_KEYID_MAKE_GLOBAL(_id) ((_id) | WH_KEYID_CLIENT_GLOBAL_FLAG)
25392513

25402514
/**
25412515
* @brief Mark a key ID as wrapped
@@ -2551,7 +2525,7 @@ int wh_Client_CertVerifyAcertDma(whClientContext* c, const void* cert,
25512525
* whKeyId wrappedKey = WH_CLIENT_KEYID_MAKE_WRAPPED(2);
25522526
* wh_Client_KeyExportRequest(client, wrappedKey, ...);
25532527
*/
2554-
#define WH_CLIENT_KEYID_MAKE_WRAPPED(_id) ((_id) | WH_CLIENT_KEYID_WRAPPED_FLAG)
2528+
#define WH_CLIENT_KEYID_MAKE_WRAPPED(_id) ((_id) | WH_KEYID_CLIENT_WRAPPED_FLAG)
25552529

25562530
/**
25572531
* @brief Mark a key ID as both global and wrapped
@@ -2567,7 +2541,7 @@ int wh_Client_CertVerifyAcertDma(whClientContext* c, const void* cert,
25672541
* wh_Client_AesSetKeyId(aes, globalWrappedKey);
25682542
*/
25692543
#define WH_CLIENT_KEYID_MAKE_WRAPPED_GLOBAL(_id) \
2570-
((_id) | WH_CLIENT_KEYID_GLOBAL_FLAG | WH_CLIENT_KEYID_WRAPPED_FLAG)
2544+
((_id) | WH_KEYID_CLIENT_GLOBAL_FLAG | WH_KEYID_CLIENT_WRAPPED_FLAG)
25712545

25722546
/**
25732547
* @brief Construct wrapped key metadata ID with explicit ownership

‎wolfhsm/wh_common.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@
2424
#ifndef WOLFHSM_WH_COMMON_H_
2525
#define WOLFHSM_WH_COMMON_H_
2626

27-
#include <stdint.h>
28-
2927
/* Pick up compile-time configuration */
3028
#include "wolfhsm/wh_settings.h"
3129

30+
#include <stdint.h>
31+
3232
/* Key management types and helpers */
3333
#include "wolfhsm/wh_keyid.h"
3434

0 commit comments

Comments
 (0)