Release session operation state on replace, error and cancel

[aidangarske]

F-5763 - 1703e9e - Replacing an active operation now aborts it through the new WP11_Session_AbortOp at the point the new operation first writes session state.

F-8664 - a205cfd - 59 terminating error paths in crypto.c now call WP11_Session_AbortOp so the operation state is released.

F-11514 - 9a40d68 - Resetting the AES-GCM parameters now zeroizes and frees buffered data and frees a live streaming context.

F-11506 - 41c4441 - The AES CBC, CTR, key wrap and CTS setters and WP11_Hmac_Init now free their wolfCrypt contexts when key setup fails.

F-12480 - be0b7c7 - Destroying an AES key used by an active GCM, CCM or ECB operation now clears the session's reference to it, and that session's next call returns CKR_OPERATION_NOT_INITIALIZED.

F-4071 - d467553 - Accumulated MAC input is now zeroized before it is freed or grown, and growth is done as allocate, copy, zeroize, free.

F-8660 - 8f8f265 - Session close and operation abort now zeroize and free the accumulated MAC input.

F-8641 - a03fb4a - C_GetOperationState now returns CKR_OPERATION_NOT_INITIALIZED when no operation is active and CKR_STATE_UNSAVEABLE for a non-digest operation, and writes the length only once it is known.

F-5871 - 301ed2b - Restoring saved operation state now aborts the operation it replaces before initializing the hash.

F-11510 - c4a8e94 - C_SetOperationState now validates the mechanism and length into locals before changing the session, so a rejected state leaves the active operation unchanged.

F-5870 - 598df96 - C_SetOperationState now returns CKR_KEY_NOT_NEEDED when key handles are passed with a keyless digest state.

F-10394 - f88c1dc - With PKCS#11 v3.0 enabled, the Init functions for encrypt, decrypt, digest, sign, verify and verify-recover cancel the active operation and return CKR_OK when the mechanism pointer is NULL. v2.40 builds still return CKR_ARGUMENTS_BAD, and CKR_OPERATION_CANCEL_FAILED is added to pkcs11.h.

[Copilot]

🟡 Changes recommended

Several security regression checks can pass without observing the cleanup or policy-tampering behavior they claim to test.

3 open findings

• Reset result before store mutation to validate tampering failure · New
• Start watcher before encryption call to catch operation cleanup · New
• Start watcher before C_DigestKey to catch error-path frees · New

What changed in this PR

Hardens operation-state cleanup, cancellation, PIN lockout handling, and related security regression coverage.

Changes:

• Adds centralized operation abort and PKCS#11 v3.0 cancellation behavior.
• Improves operation-state and PIN lockout handling.
• Adds lifecycle, storage, policy, and concurrency tests.

File	Description
wolfpkcs11/​pkcs11.h	Adds cancellation failure status.
wolfpkcs11/​internal.h	Declares new lifecycle and lockout helpers.
src/​crypto.c	Releases operation resources on errors and cancellation.
src/​slot.c	Strengthens lockout and saved-state handling.
tests/​session_op_lifecycle_test.c	Tests operation cleanup paths.
tests/​object_store_decode_test.c	Tests malformed stored objects.
tests/​object_policy_integrity_test.c	Tests stored-key policy integrity.
tests/​login_pin_state_test.c	Tests PIN, login, and concurrency state.
tests/​pkcs11test.c	Updates v3.0 cancellation expectations.
tests/​pkcs11mtt.c	Updates threaded cancellation expectations.
tests/​include.am	Registers the new tests.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.