Skip to content

Add secure file I/O utilities, memory wiping, and tests #278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stenslae wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add secure file I/O utilities, memory wiping, and tests #278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3958fc2
Add secure file I/O helpers for key and output files
Aug 10, 2026
1cf2dee
Add C unit tests for the secure file I/O helpers
Aug 10, 2026
d35559d
Write keys and output through the secure helpers in the non-X.509 tools
Aug 10, 2026
7c10bda
Fix the --disable-filesystem build of the s_server example
Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,9 @@ wolfssl
test-suite.log
tests/*/*.log
tests/*/*.trs
# check_PROGRAMS binaries left in the tree by an in-tree "make check"
tests/tools/tools_unit_test
tests/tools/tools_unit_test.exe
ecckey
src/config.h
src/config.h.in
Expand Down
16 changes: 12 additions & 4 deletions Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ endif

include src/include.am
include wolfclu/include.am
include tests/tools/include.am
if HAVE_PYTHON
include tests/dh/include.am
include tests/dsa/include.am
Expand Down Expand Up @@ -117,10 +118,11 @@ TESTS += $(check_PROGRAMS)
check_SCRIPTS+= $(dist_noinst_SCRIPTS)
TESTS += $(check_SCRIPTS)

# Automake's test driver writes .log/.trs files next to each test script.
# When tests live in the source tree (no VPATH), those files land in tests/,
# where EXTRA_DIST+=tests would otherwise sweep them into the tarball and
# break `make distcheck` via stale VPATH lookups.
# Automake's test driver writes .log/.trs files next to each test script, and
# an in-tree build leaves the compiled check_PROGRAMS binaries and their .o
# files there too. When tests live in the source tree (no VPATH), all of that
# lands in tests/, where EXTRA_DIST+=tests would otherwise sweep it into the
# tarball and break `make distcheck` via stale VPATH lookups.
# Generate the compressed manpages into the tarball from their .1 sources,
# so the .gz copies are never hand-maintained in git. These ship in the release
# tarball for downstream packaging; they are intentionally not installed
Expand All @@ -130,6 +132,12 @@ TESTS += $(check_SCRIPTS)
dist-hook:
find $(distdir)/tests -name '*.log' -delete
find $(distdir)/tests -name '*.trs' -delete
find $(distdir)/tests -name '*.o' -delete
find $(distdir)/tests -name '.dirstamp' -delete
find $(distdir)/tests \( -name '.deps' -o -name '.libs' \) -type d -prune -exec rm -rf {} +
for p in $(check_PROGRAMS); do \
rm -f "$(distdir)/$$p"; \
done
# Always strip stale .1.gz from the tarball (local manpages-gz output or a
# prior dist may have left them in manpages/). Regenerate only when enabled.
chmod u+w $(distdir)/manpages 2>/dev/null || true
Expand Down
64 changes: 37 additions & 27 deletions src/crypto/clu_crypto_setup.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,16 @@ static const struct option crypt_options[] = {
#endif

/* returns WOLFCLU_SUCCESS on success */
/* Zero sensitive data before freeing. */
static void wolfCLU_zeroAndFreeCryptoBins(byte* pwdKey, byte* iv, byte* key,
char* mode, int keySize, int block)
{
wolfCLU_ForceZero(key, keySize);
wolfCLU_ForceZero(pwdKey, keySize + block);
wolfCLU_ForceZero(iv, block);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
}

int wolfCLU_setup(int argc, char** argv, char action)
{
#ifndef WOLFCLU_NO_FILESYSTEM
Expand Down Expand Up @@ -311,7 +321,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
switch (option) {
case ARG_FOUND_TWICE:
wolfCLU_LogError("Found duplicate argument");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;

case WOLFCLU_PASSWORD_SOURCE:
Expand All @@ -320,7 +330,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
/* On an unsupported source wolfCLU_GetPassword zeroes the buffer
* and fails. Bail out so we do not encrypt under an empty key. */
if (ret != WOLFCLU_SUCCESS) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return ret;
}
pwdKeyChk = 1;
Expand All @@ -329,7 +339,7 @@ int wolfCLU_setup(int argc, char** argv, char action)

case WOLFCLU_PASSWORD:
if (optarg == NULL) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
else {
Expand All @@ -354,14 +364,14 @@ int wolfCLU_setup(int argc, char** argv, char action)
case WOLFCLU_KEY: /* hex key string from the command line */
if (optarg == NULL) {
wolfCLU_LogError("no key passed in..");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}

ret = wolfCLU_loadHexKeyInto(key, (keySize + 7) / 8,
optarg, (word32)XSTRLEN(optarg));
if (ret != WOLFCLU_SUCCESS) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return ret;
}
keyCheck = 1;
Expand All @@ -374,13 +384,13 @@ int wolfCLU_setup(int argc, char** argv, char action)
byte* ivTmp = NULL;
word32 ivTmpSz = 0;
if (optarg == NULL) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
ivString = (char*)XMALLOC(XSTRLEN(optarg) + 1, HEAP_HINT,
DYNAMIC_TYPE_TMP_BUFFER);
if (ivString == NULL) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return MEMORY_E;
}
XSTRLCPY(ivString, optarg, XSTRLEN(optarg) + 1);
Expand All @@ -396,7 +406,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
if (ret != WOLFCLU_SUCCESS) {
WOLFCLU_LOG(WOLFCLU_E0,
"failed during conversion of IV, ret = %d", ret);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
if ((int)ivTmpSz != block) {
Expand All @@ -405,7 +415,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
block, (unsigned int)ivTmpSz);
wolfCLU_ForceZero(ivTmp, ivTmpSz);
XFREE(ivTmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
XMEMCPY(iv, ivTmp, ivTmpSz);
Expand Down Expand Up @@ -461,7 +471,7 @@ int wolfCLU_setup(int argc, char** argv, char action)

if (optarg == NULL) {
wolfCLU_LogError("no key file passed in..");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}

Expand All @@ -471,7 +481,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
keyBio = wolfSSL_BIO_new_file(optarg, "rb");
if (keyBio == NULL) {
wolfCLU_LogError("could not open key file '%s'", optarg);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}

Expand All @@ -480,15 +490,15 @@ int wolfCLU_setup(int argc, char** argv, char action)
wolfCLU_LogError("key file '%s' is empty or unreadable",
optarg);
wolfSSL_BIO_free(keyBio);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}

fileBuf = (byte*)XMALLOC(fileLen, HEAP_HINT,
DYNAMIC_TYPE_TMP_BUFFER);
if (fileBuf == NULL) {
wolfSSL_BIO_free(keyBio);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return MEMORY_E;
}

Expand All @@ -497,7 +507,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
wolfCLU_ForceZero(fileBuf, fileLen);
XFREE(fileBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL_BIO_free(keyBio);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
wolfSSL_BIO_free(keyBio);
Expand Down Expand Up @@ -528,7 +538,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
if (keyString == NULL) {
wolfCLU_ForceZero(fileBuf, fileLen);
XFREE(fileBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return MEMORY_E;
}
/* Copy out hex characters, skipping any embedded
Expand All @@ -549,7 +559,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
wolfCLU_ForceZero(fileBuf, fileLen);
XFREE(fileBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
if (ret != WOLFCLU_SUCCESS) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return ret;
}
}
Expand All @@ -566,7 +576,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
"Invalid Key. Must match algorithm key size.");
wolfCLU_ForceZero(fileBuf, fileLen);
XFREE(fileBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
XMEMCPY(key, fileBuf, fileLen);
Expand Down Expand Up @@ -595,7 +605,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
hashType = wolfSSL_EVP_get_digestbyname(optarg);
if (hashType == NULL) {
wolfCLU_LogError("Invalid digest name");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
break;
Expand All @@ -617,7 +627,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
WOLFCLU_LOG(WOLFCLU_L0,
"Please type \"wolfssl -decrypt -help\" for decryption"
" usage \n");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
/* if no pwdKey is provided */
Expand All @@ -640,7 +650,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
"-in flag was not set, please enter a string or"
" file name to be encrypted: ");
if (ret != WOLFCLU_SUCCESS) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
WOLFCLU_LOG(WOLFCLU_L0, "Encrypting :\"%s\"", inName);
Expand All @@ -650,13 +660,13 @@ int wolfCLU_setup(int argc, char** argv, char action)
if (encCheck == 1 && decCheck == 1) {
WOLFCLU_LOG(WOLFCLU_E0,
"Encrypt and decrypt simultaneously is invalid");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}

if (inCheck == 0 && decCheck == 1) {
wolfCLU_LogError("File/string to decrypt needed");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}

Expand All @@ -666,7 +676,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
"-iv was explicitly set, but no -key or -inkey was"
" provided. A non-password based key must be supplied"
" when setting the -iv flag.");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
}
Expand All @@ -679,7 +689,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
WOLFCLU_LOG(WOLFCLU_E0,
"-key/-inkey requires -iv to be set: an IV must be"
" supplied alongside an explicit key.");
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}

Expand All @@ -701,7 +711,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
ret = wolfCLU_readFilename(outNameEnc, sizeof(outNameEnc),
"Please enter a name for the output file: ");
if (ret != WOLFCLU_SUCCESS) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
out = outNameEnc;
Expand All @@ -723,7 +733,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
ret = wolfCLU_readFilename(outNameDec, sizeof(outNameDec),
"Please enter a name for the output file: ");
if (ret != WOLFCLU_SUCCESS) {
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);
return WOLFCLU_FATAL_ERROR;
}
out = outNameDec;
Expand All @@ -743,7 +753,7 @@ int wolfCLU_setup(int argc, char** argv, char action)
wolfCLU_ForceZero(key, keySize);
wolfCLU_ForceZero(pwdKey, keySize + block);
wolfCLU_ForceZero(iv, block);
wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL);
wolfCLU_zeroAndFreeCryptoBins(pwdKey, iv, key, mode, keySize, block);

return ret;
#else
Expand Down
13 changes: 9 additions & 4 deletions src/crypto/clu_decrypt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,10 +66,11 @@ int wolfCLU_decrypt(int alg, char* mode, byte* pwdKey, byte* key, int size,
wolfCLU_LogError("Input file does not exist.");
return DECRYPT_ERROR;
}
/* opens output file */

if ((outFile = XFOPEN(out, "wb")) == NULL) {
wolfCLU_LogError("Error creating output file.");
/* opens output file; guarded against -in and -out naming the same
* file, since opening it truncates it and would destroy the
* ciphertext mid-read. */
if ((outFile = wolfCLU_OpenPairedOutFile(in, out, inFile)) == NULL) {
XFCLOSE(inFile);
return DECRYPT_ERROR;
}
Expand Down Expand Up @@ -236,7 +237,11 @@ int wolfCLU_decrypt(int alg, char* mode, byte* pwdKey, byte* key, int size,
/* Use the wolfssl wc_FreeRng to free rng */
wc_FreeRng(&rng);
XFCLOSE(inFile);
XFCLOSE(outFile);
if (wolfCLU_CloseOutFile(outFile, out) != WOLFCLU_SUCCESS && ret == 0) {
/* Only when nothing else already failed, so a more specific earlier
* error is not overwritten. */
ret = DECRYPT_ERROR;
}

(void)mode;
(void)alg;
Expand Down
Loading
Loading