chaps: Prevent interspersal of incremental and one-shot operations.

PKCS#11 spec has variants of the following (from C_Encrypt):
   "C_Encrypt can not be user to terminate a multi-part operation, and
    must be called after C_EncryptInit without intervening
    C_EncryptUpdate calls."

So track whether a one-shot or multi-part operation has been started, and
reject the other style if so.

TEST=Chaps unit tests (with ASAN) plus PKCS11 tests

Change-Id: I484dca635a12246a30c461e6ea7113697e085d26
Reviewed-by: Darren Krahn <>
Commit-Queue: David Drysdale <>
Tested-by: David Drysdale <>
3 files changed