Repository navigation
Correct doc comments that describe the wrong behavior - #294
Merged
Merged
Conversation
- C_Finalize: pReserved is an input that must be NULL, not an ignored output; list CKR_CRYPTOKI_NOT_INITIALIZED and CKR_ARGUMENTS_BAD. - C_SetOperationState replaces the session's operation with the saved digest state; it was described as a getter. - The digest functions no longer claim that no digest mechanism is supported, and pDigest is an output. - C_UnwrapKey lists the mechanisms and key types it supports, names ulWrappedKeyLen correctly and documents the argument and wrapped-key errors. - WP11_Slot_TokenFailedExpire returns the last failed login time plus the lockout timeout, not a count of failed logins. - WP11_Session_IsRW reports a read/write session, not one in use, and WP11_Session_IsOpInitialized and WP11_Session_IsHashOpInitialized had the same copied text. - WP11_Object_SetSecretKey sets secret key data, not DH key data. - The WP11_TOKEN_STATE_* macros carried the session access-mode comment. Fixes F-15388. Fixes F-15389. Fixes F-15390. Fixes F-15391. Fixes F-15392. Fixes F-15393. Fixes F-15394. Fixes F-15395.
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are reported for the documentation-only corrections.
No open issues 🎉
What changed in this PR
This PR corrects API documentation to match existing PKCS#11 behavior and internal helper functions. All changes are comments only; runtime behavior is unchanged.
Changes:
- Clarifies finalization and operation-state restoration requirements and return values.
- Corrects digest output parameters and documents supported key-unwrapping behavior.
- Fixes internal descriptions of token state, session predicates, lockout expiry, and secret-key data.
| File | Description |
|---|---|
wolfpkcs11/internal.h |
Labels token initialization state constants correctly. |
src/wolfpkcs11.c |
Clarifies C_Finalize input requirements and errors. |
src/slot.c |
Documents digest-state restoration and required invalid key handles. |
src/internal.c |
Corrects helper descriptions and return-value documentation. |
src/crypto.c |
Updates digest and key-unwrapping documentation. |
Review effort: Balanced
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #294
Scan targets checked: wolfpkcs11-src, wolfpkcs11-bugs
Coverage: 5 of 5 in-scope changed file(s) opened by the reviewer
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Max
LinuxJedi
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Corrects API doc comments that describe behavior the code does not have, from eight Fenrir findings. Comments only; no code changes.
Changes
C_Finalize:pReservedis an input that must be NULL; listsCKR_CRYPTOKI_NOT_INITIALIZEDandCKR_ARGUMENTS_BADC_SetOperationState: replaces the session's operation with the saved digest state (was described as a getter); key handles must beCK_INVALID_HANDLEpDigestis an outputC_UnwrapKey: lists the supported mechanisms and key types, namesulWrappedKeyLenand documents the argument and wrapped-key errorsWP11_Slot_TokenFailedExpire: returns a time, not a failed-login countWP11_Session_IsRW,WP11_Session_IsOpInitialized,WP11_Session_IsHashOpInitialized: return descriptions match the predicatesWP11_Object_SetSecretKey: sets secret key data, not DH key dataWP11_TOKEN_STATE_*: labeled as token initialization stateFixes F-15388, F-15389, F-15390, F-15391, F-15392, F-15393, F-15394, F-15395.