Make key material and certificate values fixed after creation

[aidangarske]

F-11500 - 34a2a43 - SetAttributeValue now returns CKR_ATTRIBUTE_READ_ONLY for key component and certificate CKA_VALUE changes on existing objects, covering C_SetAttributeValue and C_CopyObject.

F-10387 - c0a668d - WP11_Object_SetSecretKey now validates the new key into a local length before zeroizing and replacing the existing key.

F-10399 - de79c8c - WP11_Object_SetDhKey now clears the whole fixed key buffer before storing a private value.

F-11515 - f9ce527 - RSA and EC private components cannot be replaced on an existing object, which the read-only key component policy already enforces; this commit changes no library code.

F-13815 - b7dc62d - WP11_Object_SetEcKey now rejects an EC private value or point when no curve is set.

F-5158 - 4195e7a - WP11_Object_SetRsaKey now rejects a CKA_MODULUS_BITS value above RSA_MAX_SIZE instead of narrowing it.

F-12458 - 89ecb2c - WP11_Object_SetCert no longer resets the certificate length on entry, and CKA_CERTIFICATE_TYPE is read-only once the object exists, though restating the same value is allowed.

F-4528 - 96f5ab4 - WP11_Object_SetCert now allocates and copies the new certificate value before freeing the old one, and sets the length only on success.

F-11501 - ec82128 - SetCert now clears keyData when it aliases the certificate data, and WP11_Object_Copy rejects certificate and trust objects.

F-4318 - 7b777a2 - WP11_Object_SetDhKey now rejects CKA_PRIME or CKA_BASE longer than WP11_MAX_DH_KEY_SZ before calling wc_DhSetKey.

[Copilot]

🟡 Changes recommended

The stored-object security test can miss secrets released by realloc, and its unavailable-feature path is incorrectly reported as passing.

2 open findings

• Ensure realloc movement scans and scrubs the old allocation · New
• Return exit status 77 when file-backed storage is unavailable · New

What changed in this PR

Hardens key/certificate immutability, token persistence, session lifecycle, validation, and PKCS#11 metadata behavior.

Changes:

• Makes key material and certificate values read-only after creation.
• Improves persistence failure handling and stored-object validation.
• Expands tests across attributes, login state, mechanisms, and storage.

File	Description
wolfpkcs11/​pkcs11.h	Adds operation-cancellation status.
wolfpkcs11/​internal.h	Adds limits and internal helpers.
tests/​token_store_test.c	Tests persistence failure recovery.
tests/​pkcs11v3test.c	Updates immutable-key expectations.
tests/​pkcs11test.c	Updates copying and cancellation tests.
tests/​pkcs11mtt.c	Updates multithreaded cancellation tests.
tests/​object_store_decode_test.c	Tests corrupted storage handling.
tests/​login_pin_state_test.c	Tests login and PIN invariants.
tests/​key_material_update_test.c	Tests immutable key material.
tests/​info_mech_table_test.c	Validates metadata and mechanisms.
tests/​include.am	Registers new tests.
tests/​attribute_validation_test.c	Expands attribute validation coverage.
src/​wolfpkcs11.c	Improves finalization and metadata output.
src/​slot.c	Corrects token information and mechanisms.
.github/​workflows/​unit-test.yml	Adds TPM and no-environment jobs.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Frauschi]

Two comments, inline.

[Frauschi]

Thanks, the error mapping and the test changes look good. The msys-static failure is a package mirror 429 and just needs a rerun.