feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

update changelog for release 5.5.1

Browse Source
This commit is contained in:
Jacob Barthelmeh
2022-09-27 13:40:00 -06:00
parent ffe052e845
commit eb5076bb89
9 changed files with 175 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
CMakeLists.txt
View File

@ -28,16 +28,16 @@ if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
You must delete them, or cmake will refuse to work.") You must delete them, or cmake will refuse to work.")
endif() endif()
project(wolfssl VERSION 5.5.0 LANGUAGES C ASM) project(wolfssl VERSION 5.5.1 LANGUAGES C ASM)
# shared library versioning # shared library versioning
# increment if interfaces have been added, removed or changed # increment if interfaces have been added, removed or changed
set(LIBTOOL_CURRENT 35) set(LIBTOOL_CURRENT 36)
# increment if source code has changed set to zero if current is incremented # increment if source code has changed set to zero if current is incremented
set(LIBTOOL_REVISION 0) set(LIBTOOL_REVISION 0)
# increment if interfaces have been added set to zero if interfaces have been # increment if interfaces have been added set to zero if interfaces have been
# removed or changed # removed or changed
set(LIBTOOL_AGE 0) set(LIBTOOL_AGE 1)
math(EXPR LIBTOOL_SO_VERSION "${LIBTOOL_CURRENT} - ${LIBTOOL_AGE}") math(EXPR LIBTOOL_SO_VERSION "${LIBTOOL_CURRENT} - ${LIBTOOL_AGE}")
set(LIBTOOL_FULL_VERSION ${LIBTOOL_SO_VERSION}.${LIBTOOL_AGE}.${LIBTOOL_REVISION}) set(LIBTOOL_FULL_VERSION ${LIBTOOL_SO_VERSION}.${LIBTOOL_AGE}.${LIBTOOL_REVISION})

59
ChangeLog.md
View File

@ -1,3 +1,62 @@
# wolfSSL Release 5.5.1 (Sep 28, 2022)
Release 5.5.1 of wolfSSL embedded TLS has bug fixes and new features including:
## Vulnerabilities
* [Med] Denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin.
## New Feature Additions
* Add support for non-blocking ECC key gen and shared secret gen for P-256/384/521
* Add support for non-blocking ECDHE/ECDSA in TLS/DTLS layer.
* Port to NXP RT685 with FreeRTOS
* Add option to build post quantum Kyber API (--enable-kyber)
* Add post quantum algorithm sphincs to wolfCrypt
* Config. option to force no asm with SP build (--enable-sp=noasm)
* Allow post quantum keyshare for DTLS 1.3
## Enhancements
* DTLSv1.3: Do HRR Cookie exchange by default
* Add wolfSSL_EVP_PKEY_new_CMAC_key to OpenSSL compatible API
* Update ide win10 build files to add missing sp source files
* Improve Workbench docs
* Improve EVP support for CHACHA20_POLY1305
* Improve `wc_SetCustomExtension` documentation
* RSA-PSS with OCSP and add simple OCSP response DER verify test case
* Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h
* Don't over-allocate memory for DTLS fragments
* Add WOLFSSL_ATECC_TFLXTLS for Atmel port
* SHA-3 performance improvements with x86_64 assembly
* Add code to fallback to S/W if TSIP cannot handle
* Improves entropy with VxWorks
* Make time in milliseconds 64-bits for longer session ticket lives
* Support for setting cipher list with bytes
* wolfSSL_set1_curves_list(), wolfSSL_CTX_set1_curves_list() improvements
* Add to RSAES-OAEP key parsing for pkcs7
* Add missing DN nid to work with PrintName()
* SP int: default to 16 bit word size when NO_64BIT defined
* Limit the amount of fragments we store per a DTLS connection and error out when max limit is reached
* Detect when certificate's RSA public key size is too big and fail on loading of certificate
## Fixes
* Fix for async with OCSP non-blocking in `ProcessPeerCerts`
* Fixes for building with 32-bit and socket size sign/unsigned mismatch
* Fix Windows CMakeList compiler options
* TLS 1.3 Middle-Box compat: fix missing brace
* Configuration consistency fixes for RSA keys and way to force disable of private keys
* Fix for Aarch64 Mac M1 SP use
* Fix build errors and warnings for MSVC with DTLS 1.3
* Fix HMAC compat layer function for SHA-1
* Fix DTLS 1.3 do not negotiate ConnectionID in HelloRetryRequest
* Check return from call to wc_Time
* SP math: fix build configuration with opensslall
* Fix for async session tickets
* SP int mp_init_size fixes when SP_WORD_SIZE == 8
* Ed. function to make public key now checks for if the private key flag is set
* Fix HashRaw WC_SHA256_DIGEST_SIZE for wc_Sha256GetHash
* Fix for building with PSK only
* Set correct types in wolfSSL_sk_*_new functions
* Sanity check that size passed to mp_init_size() is no more than SP_INT_DIGITS
# wolfSSL Release 5.5.0 (Aug 30, 2022) # wolfSSL Release 5.5.0 (Aug 30, 2022)
Note: Note:

8
IDE/WIN10/wolfssl-fips.rc
View File

@ -51,8 +51,8 @@ END
// //
VS_VERSION_INFO VERSIONINFO VS_VERSION_INFO VERSIONINFO
FILEVERSION 5,5,0,0 FILEVERSION 5,5,1,0
PRODUCTVERSION 5,5,0,0 PRODUCTVERSION 5,5,1,0
FILEFLAGSMASK 0x3fL FILEFLAGSMASK 0x3fL
#ifdef _DEBUG #ifdef _DEBUG
FILEFLAGS 0x1L FILEFLAGS 0x1L
@ -69,12 +69,12 @@ BEGIN
BEGIN BEGIN
VALUE "CompanyName", "wolfSSL Inc." VALUE "CompanyName", "wolfSSL Inc."
VALUE "FileDescription", "The wolfSSL FIPS embedded SSL library is a lightweight, portable, C-language-based SSL/TLS library targeted at IoT, embedded, and RTOS environments primarily because of its size, speed, and feature set." VALUE "FileDescription", "The wolfSSL FIPS embedded SSL library is a lightweight, portable, C-language-based SSL/TLS library targeted at IoT, embedded, and RTOS environments primarily because of its size, speed, and feature set."
VALUE "FileVersion", "5.5.0.0" VALUE "FileVersion", "5.5.1.0"
VALUE "InternalName", "wolfssl-fips" VALUE "InternalName", "wolfssl-fips"
VALUE "LegalCopyright", "Copyright (C) 2022" VALUE "LegalCopyright", "Copyright (C) 2022"
VALUE "OriginalFilename", "wolfssl-fips.dll" VALUE "OriginalFilename", "wolfssl-fips.dll"
VALUE "ProductName", "wolfSSL FIPS" VALUE "ProductName", "wolfSSL FIPS"
VALUE "ProductVersion", "5.5.0.0" VALUE "ProductVersion", "5.5.1.0"
END END
END END
BLOCK "VarFileInfo" BLOCK "VarFileInfo"

101
README
View File

@ -70,66 +70,63 @@ should be used for the enum name.
*** end Notes *** *** end Notes ***
# wolfSSL Release 5.5.0 (Aug 30, 2022) # wolfSSL Release 5.5.1 (Sep 28, 2022)
Release 5.5.1 of wolfSSL embedded TLS has bug fixes and new features including:
Note:
** If not free’ing FP_ECC caches per thread by calling wc_ecc_fp_free there is a possible memory leak during TLS 1.3 handshakes which use ECC. Users are urged to confirm they are free’ing FP_ECC caches per thread if enabled to avoid this issue.
Release 5.5.0 of wolfSSL embedded TLS has bug fixes and new features including:
## Vulnerabilities ## Vulnerabilities
* [Low] Fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users doing operations with private ECC keys such as server side TLS connections and creating ECC signatures, who also have hardware that could be targeted with a sophisticated Rowhammer attack should update the version of wolfSSL and compile using the macro WOLFSSL_CHECK_SIG_FAULTS. Thanks to Yarkin Doroz, Berk Sunar, Koksal Must, Caner Tol, and Kristi Rahman all affiliated with the Vernam Applied Cryptography and Cybersecurity Lab at Worcester Polytechnic Institute for the report. * [Med] Denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin.
* [Low] In wolfSSL version 5.3.0 if compiled with --enable-session-ticket and the client has non-empty session cache, with TLS 1.2 there is the possibility of a man in the middle passing a large session ticket to the client and causing a crash due to an invalid free. There is also the potential for a malicious TLS 1.3 server to crash a client in a similar manner except in TLS 1.3 it is not susceptible to a man in the middle attack. Users on the client side with –enable-session-ticket compiled in and using wolfSSL version 5.3.0 should update their version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin.
* [Low] If using wolfSSL_clear to reset a WOLFSSL object (vs the normal wolfSSL_free/wolfSSL_new) it can result in runtime issues. This exists with builds using the wolfSSL compatibility layer (--enable-opnesslextra) and only when the application is making use of wolfSSL_clear instead of SSL_free/SSL_new. In the case of a TLS 1.3 resumption, after continuing to use the WOLFSSH object after having called wolfSSL_clear, an application could crash. It is suggested that users calling wolfSSL_clear update the version of wolfSSL used. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin.
* Potential DoS attack on DTLS 1.2. In the case of receiving a malicious plaintext handshake message at epoch 0 the connection will enter an error state reporting a duplicate message. This affects both server and client side. Users that have DTLS enabled and in use should update their version of wolfSSL to mitigate the potential for a DoS attack.
## New Feature Additions ## New Feature Additions
* QUIC support added, for using wolfSSL with QUIC implementations like ngtcp2 * Add support for non-blocking ECC key gen and shared secret gen for P-256/384/521
* SE050 port additions and fixes * Add support for non-blocking ECDHE/ECDSA in TLS/DTLS layer.
* Added support for Dilithium post quantum algorithm use with TLS * Port to NXP RT685 with FreeRTOS
* Support for RSA-PSS signed certificates * Add option to build post quantum Kyber API (--enable-kyber)
* Support for Infineon AURIX IDE * Add post quantum algorithm sphincs to wolfCrypt
* Add Zephyr support for nRF5340 with CryptoCell-312 * Config. option to force no asm with SP build (--enable-sp=noasm)
* Allow post quantum keyshare for DTLS 1.3
## Enhancements ## Enhancements
* Expanded ABI support by 50 APIs to include wolfCrypt and Certificates making a total of 113 ABIs controlled and maintained * DTLSv1.3: Do HRR Cookie exchange by default
* DTLS 1.3 partial support for ConnectionID as described by RFC9146 and RFC9147 * Add wolfSSL_EVP_PKEY_new_CMAC_key to OpenSSL compatible API
* Added support for X509_CRL_print function * Update ide win10 build files to add missing sp source files
* Remove deprecated algorithms in Renesas cs+ project * Improve Workbench docs
* Support more build options disable/enable with i.MX CAAM build * Improve EVP support for CHACHA20_POLY1305
* wolfSSL_CTX_set_options and wolfSSL_CTX_get_options functions added to non compatibility layer builds * Improve `wc_SetCustomExtension` documentation
* TFM: change inline x86 asm code to compile with clang * RSA-PSS with OCSP and add simple OCSP response DER verify test case
* Improvements to error queue and fix for behavior of wolfSSL_ERR_get_error * Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h
* scripts/makedistsmall.sh script added for creating a small source/header only package * Don't over-allocate memory for DTLS fragments
* TLS 1.3: restrict extension validity by message, Extensions ServerName, SupportedGroups and ALPN must not appear in server_hello * Add WOLFSSL_ATECC_TFLXTLS for Atmel port
* Add liboqs integration to CMake build system * SHA-3 performance improvements with x86_64 assembly
* Adds wolfSSL_PEM_read_RSAPrivateKey() to the OpenSSL compatible API * Add code to fallback to S/W if TSIP cannot handle
* Added support for P384 pre-share in bundled example server * Improves entropy with VxWorks
* Replace clz assembly instruction in ARM 32 builds when not supported * Make time in milliseconds 64-bits for longer session ticket lives
* Integrate chacha20-poly1305 into the EVP interface * Support for setting cipher list with bytes
* Additional validation that extensions appear in correct messages * wolfSSL_set1_curves_list(), wolfSSL_CTX_set1_curves_list() improvements
* Allow SAN to be critical with ASN template build * Add to RSAES-OAEP key parsing for pkcs7
* Support wolfSSL_CTX_set1_curves_list being available when X25519 and/or X448 only defined * Add missing DN nid to work with PrintName()
* Adds wolfSSL_PEM_read_RSA_PUBKEY() to the OpenSSL compatible API * SP int: default to 16 bit word size when NO_64BIT defined
* Match OpenSSL self signed error return with compatibility layer build * Limit the amount of fragments we store per a DTLS connection and error out when max limit is reached
* Added wolfSSL_dtls_create_peer and wolfSSL_dtls_free_peer to help with Python and Go wrappers for DTLS * Detect when certificate's RSA public key size is too big and fail on loading of certificate
## Fixes ## Fixes
* DTLS 1.3 asynchronous use case fixes * Fix for async with OCSP non-blocking in `ProcessPeerCerts`
* Fix handling of counter to support incrementing across all bytes in ARM crypto asm * Fixes for building with 32-bit and socket size sign/unsigned mismatch
* Fixes for ED25519/ED448 private key with public key export (RFC8410) * Fix Windows CMakeList compiler options
* Fix for build with NO_TLS macro * TLS 1.3 Middle-Box compat: fix missing brace
* Fix for write dup function to copy over TLS version * Configuration consistency fixes for RSA keys and way to force disable of private keys
* Fix to handle path lengths of 0 when checking certificate CA path lengths * Fix for Aarch64 Mac M1 SP use
* Fix for CMake not installing sp_int.h for SP math all * Fix build errors and warnings for MSVC with DTLS 1.3
* When WOLFSSL_VALIDATE_ECC_IMPORT is defined ECC import validates private key value is less than order * Fix HMAC compat layer function for SHA-1
* PSA crypto fixes * Fix DTLS 1.3 do not negotiate ConnectionID in HelloRetryRequest
* Fix for not having default pkcs7 signed attributes * Check return from call to wc_Time
* DTLS socket and timeout fixes * SP math: fix build configuration with opensslall
* SP int: exptmod ensure base is less than modulus * Fix for async session tickets
* Fix for AddPacketInfo with WOLFSSL_CALLBACKS to not pass encrypted TLS 1.3 handshake messages to callbacks * SP int mp_init_size fixes when SP_WORD_SIZE == 8
* Fix for sniffer to ensure the session was polled before trying to reprocess it * Ed. function to make public key now checks for if the private key flag is set
* Fix HashRaw WC_SHA256_DIGEST_SIZE for wc_Sha256GetHash
* Fix for building with PSK only
* Set correct types in wolfSSL_sk_*_new functions
* Sanity check that size passed to mp_init_size() is no more than SP_INT_DIGITS
For additional vulnerability information visit the vulnerability page at: For additional vulnerability information visit the vulnerability page at:
https://www.wolfssl.com/docs/security-vulnerabilities/ https://www.wolfssl.com/docs/security-vulnerabilities/

102
README.md
View File

@ -78,66 +78,63 @@ macro `NO_OLD_SHA_NAMES`. These names get mapped to the OpenSSL API for a
single call hash function. Instead the name `WC_SHA`, `WC_SHA256`, `WC_SHA384` and single call hash function. Instead the name `WC_SHA`, `WC_SHA256`, `WC_SHA384` and
`WC_SHA512` should be used for the enum name. `WC_SHA512` should be used for the enum name.
# wolfSSL Release 5.5.0 (Aug 30, 2022) # wolfSSL Release 5.5.1 (Sep 28, 2022)
Release 5.5.1 of wolfSSL embedded TLS has bug fixes and new features including:
Note:
** If not free’ing FP_ECC caches per thread by calling wc_ecc_fp_free there is a possible memory leak during TLS 1.3 handshakes which use ECC. Users are urged to confirm they are free’ing FP_ECC caches per thread if enabled to avoid this issue.
Release 5.5.0 of wolfSSL embedded TLS has bug fixes and new features including:
## Vulnerabilities ## Vulnerabilities
* [Low] Fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users doing operations with private ECC keys such as server side TLS connections and creating ECC signatures, who also have hardware that could be targeted with a sophisticated Rowhammer attack should update the version of wolfSSL and compile using the macro WOLFSSL_CHECK_SIG_FAULTS. Thanks to Yarkin Doroz, Berk Sunar, Koksal Must, Caner Tol, and Kristi Rahman all affiliated with the Vernam Applied Cryptography and Cybersecurity Lab at Worcester Polytechnic Institute for the report. * [Med] Denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin.
* [Low] In wolfSSL version 5.3.0 if compiled with --enable-session-ticket and the client has non-empty session cache, with TLS 1.2 there is the possibility of a man in the middle passing a large session ticket to the client and causing a crash due to an invalid free. There is also the potential for a malicious TLS 1.3 server to crash a client in a similar manner except in TLS 1.3 it is not susceptible to a man in the middle attack. Users on the client side with –enable-session-ticket compiled in and using wolfSSL version 5.3.0 should update their version of wolfSSL. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin.
* [Low] If using wolfSSL_clear to reset a WOLFSSL object (vs the normal wolfSSL_free/wolfSSL_new) it can result in runtime issues. This exists with builds using the wolfSSL compatibility layer (--enable-opnesslextra) and only when the application is making use of wolfSSL_clear instead of SSL_free/SSL_new. In the case of a TLS 1.3 resumption, after continuing to use the WOLFSSH object after having called wolfSSL_clear, an application could crash. It is suggested that users calling wolfSSL_clear update the version of wolfSSL used. Thanks to Max at Trail of Bits for the report and "LORIA, INRIA, France" for research on tlspuffin.
* Potential DoS attack on DTLS 1.2. In the case of receiving a malicious plaintext handshake message at epoch 0 the connection will enter an error state reporting a duplicate message. This affects both server and client side. Users that have DTLS enabled and in use should update their version of wolfSSL to mitigate the potential for a DoS attack.
## New Feature Additions ## New Feature Additions
* QUIC support added, for using wolfSSL with QUIC implementations like ngtcp2 * Add support for non-blocking ECC key gen and shared secret gen for P-256/384/521
* SE050 port additions and fixes * Add support for non-blocking ECDHE/ECDSA in TLS/DTLS layer.
* Added support for Dilithium post quantum algorithm use with TLS * Port to NXP RT685 with FreeRTOS
* Support for RSA-PSS signed certificates * Add option to build post quantum Kyber API (--enable-kyber)
* Support for Infineon AURIX IDE * Add post quantum algorithm sphincs to wolfCrypt
* Add Zephyr support for nRF5340 with CryptoCell-312 * Config. option to force no asm with SP build (--enable-sp=noasm)
* Allow post quantum keyshare for DTLS 1.3
## Enhancements ## Enhancements
* Expanded ABI support by 50 APIs to include wolfCrypt and Certificates making a total of 113 ABIs controlled and maintained * DTLSv1.3: Do HRR Cookie exchange by default
* DTLS 1.3 partial support for ConnectionID as described by RFC9146 and RFC9147 * Add wolfSSL_EVP_PKEY_new_CMAC_key to OpenSSL compatible API
* Added support for X509_CRL_print function * Update ide win10 build files to add missing sp source files
* Remove deprecated algorithms in Renesas cs+ project * Improve Workbench docs
* Support more build options disable/enable with i.MX CAAM build * Improve EVP support for CHACHA20_POLY1305
* wolfSSL_CTX_set_options and wolfSSL_CTX_get_options functions added to non compatibility layer builds * Improve `wc_SetCustomExtension` documentation
* TFM: change inline x86 asm code to compile with clang * RSA-PSS with OCSP and add simple OCSP response DER verify test case
* Improvements to error queue and fix for behavior of wolfSSL_ERR_get_error * Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h
* scripts/makedistsmall.sh script added for creating a small source/header only package * Don't over-allocate memory for DTLS fragments
* TLS 1.3: restrict extension validity by message, Extensions ServerName, SupportedGroups and ALPN must not appear in server_hello * Add WOLFSSL_ATECC_TFLXTLS for Atmel port
* Add liboqs integration to CMake build system * SHA-3 performance improvements with x86_64 assembly
* Adds wolfSSL_PEM_read_RSAPrivateKey() to the OpenSSL compatible API * Add code to fallback to S/W if TSIP cannot handle
* Added support for P384 pre-share in bundled example server * Improves entropy with VxWorks
* Replace clz assembly instruction in ARM 32 builds when not supported * Make time in milliseconds 64-bits for longer session ticket lives
* Integrate chacha20-poly1305 into the EVP interface * Support for setting cipher list with bytes
* Additional validation that extensions appear in correct messages * wolfSSL_set1_curves_list(), wolfSSL_CTX_set1_curves_list() improvements
* Allow SAN to be critical with ASN template build * Add to RSAES-OAEP key parsing for pkcs7
* Support wolfSSL_CTX_set1_curves_list being available when X25519 and/or X448 only defined * Add missing DN nid to work with PrintName()
* Adds wolfSSL_PEM_read_RSA_PUBKEY() to the OpenSSL compatible API * SP int: default to 16 bit word size when NO_64BIT defined
* Match OpenSSL self signed error return with compatibility layer build * Limit the amount of fragments we store per a DTLS connection and error out when max limit is reached
* Added wolfSSL_dtls_create_peer and wolfSSL_dtls_free_peer to help with Python and Go wrappers for DTLS * Detect when certificate's RSA public key size is too big and fail on loading of certificate
## Fixes ## Fixes
* DTLS 1.3 asynchronous use case fixes * Fix for async with OCSP non-blocking in `ProcessPeerCerts`
* Fix handling of counter to support incrementing across all bytes in ARM crypto asm * Fixes for building with 32-bit and socket size sign/unsigned mismatch
* Fixes for ED25519/ED448 private key with public key export (RFC8410) * Fix Windows CMakeList compiler options
* Fix for build with NO_TLS macro * TLS 1.3 Middle-Box compat: fix missing brace
* Fix for write dup function to copy over TLS version * Configuration consistency fixes for RSA keys and way to force disable of private keys
* Fix to handle path lengths of 0 when checking certificate CA path lengths * Fix for Aarch64 Mac M1 SP use
* Fix for CMake not installing sp_int.h for SP math all * Fix build errors and warnings for MSVC with DTLS 1.3
* When WOLFSSL_VALIDATE_ECC_IMPORT is defined ECC import validates private key value is less than order * Fix HMAC compat layer function for SHA-1
* PSA crypto fixes * Fix DTLS 1.3 do not negotiate ConnectionID in HelloRetryRequest
* Fix for not having default pkcs7 signed attributes * Check return from call to wc_Time
* DTLS socket and timeout fixes * SP math: fix build configuration with opensslall
* SP int: exptmod ensure base is less than modulus * Fix for async session tickets
* Fix for AddPacketInfo with WOLFSSL_CALLBACKS to not pass encrypted TLS 1.3 handshake messages to callbacks * SP int mp_init_size fixes when SP_WORD_SIZE == 8
* Fix for sniffer to ensure the session was polled before trying to reprocess it * Ed. function to make public key now checks for if the private key flag is set
* Fix HashRaw WC_SHA256_DIGEST_SIZE for wc_Sha256GetHash
* Fix for building with PSK only
* Set correct types in wolfSSL_sk_*_new functions
* Sanity check that size passed to mp_init_size() is no more than SP_INT_DIGITS
For additional vulnerability information visit the vulnerability page at: For additional vulnerability information visit the vulnerability page at:
https://www.wolfssl.com/docs/security-vulnerabilities/ https://www.wolfssl.com/docs/security-vulnerabilities/
@ -146,7 +143,6 @@ See INSTALL file for build instructions.
More info can be found on-line at: https://wolfssl.com/wolfSSL/Docs.html More info can be found on-line at: https://wolfssl.com/wolfSSL/Docs.html
# Resources # Resources
[wolfSSL Website](https://www.wolfssl.com/) [wolfSSL Website](https://www.wolfssl.com/)

4
configure.ac
View File

@ -7,7 +7,7 @@
# #
AC_COPYRIGHT([Copyright (C) 2006-2020 wolfSSL Inc.]) AC_COPYRIGHT([Copyright (C) 2006-2020 wolfSSL Inc.])
AC_PREREQ([2.69]) AC_PREREQ([2.69])
AC_INIT([wolfssl],[5.5.0],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[https://www.wolfssl.com]) AC_INIT([wolfssl],[5.5.1],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[https://www.wolfssl.com])
AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_AUX_DIR([build-aux])
# The following sets CFLAGS to empty if unset on command line. We do not # The following sets CFLAGS to empty if unset on command line. We do not
@ -38,7 +38,7 @@ LT_INIT([disable-static win32-dll])
AC_ARG_VAR(EXTRA_CFLAGS, [Extra CFLAGS to add to autoconf-computed arg list. Can also supply directly to make.]) AC_ARG_VAR(EXTRA_CFLAGS, [Extra CFLAGS to add to autoconf-computed arg list. Can also supply directly to make.])
#shared library versioning #shared library versioning
WOLFSSL_LIBRARY_VERSION=35:0:0 WOLFSSL_LIBRARY_VERSION=36:0:1
# | | | # | | |
# +------+ | +---+ # +------+ | +---+
# | | | # | | |

9
rpm/spec.in
View File

@ -76,7 +76,7 @@ mkdir -p $RPM_BUILD_ROOT/
%{_libdir}/libwolfssl.la %{_libdir}/libwolfssl.la
%{_libdir}/libwolfssl.so %{_libdir}/libwolfssl.so
%{_libdir}/libwolfssl.so.35 %{_libdir}/libwolfssl.so.35
%{_libdir}/libwolfssl.so.35.0.0 %{_libdir}/libwolfssl.so.35.1.0
%files devel %files devel
%defattr(-,root,root,-) %defattr(-,root,root,-)
@ -267,6 +267,7 @@ mkdir -p $RPM_BUILD_ROOT/
%{_includedir}/wolfssl/wolfcrypt/ed25519.h %{_includedir}/wolfssl/wolfcrypt/ed25519.h
%{_includedir}/wolfssl/wolfcrypt/ed448.h %{_includedir}/wolfssl/wolfcrypt/ed448.h
%{_includedir}/wolfssl/wolfcrypt/error-crypt.h %{_includedir}/wolfssl/wolfcrypt/error-crypt.h
%{_includedir}/wolfssl/wolfcrypt/ext_kyber.h
%{_includedir}/wolfssl/wolfcrypt/falcon.h %{_includedir}/wolfssl/wolfcrypt/falcon.h
%{_includedir}/wolfssl/wolfcrypt/dilithium.h %{_includedir}/wolfssl/wolfcrypt/dilithium.h
%{_includedir}/wolfssl/wolfcrypt/sphincs.h %{_includedir}/wolfssl/wolfcrypt/sphincs.h
@ -279,6 +280,7 @@ mkdir -p $RPM_BUILD_ROOT/
%{_includedir}/wolfssl/wolfcrypt/hmac.h %{_includedir}/wolfssl/wolfcrypt/hmac.h
%{_includedir}/wolfssl/wolfcrypt/integer.h %{_includedir}/wolfssl/wolfcrypt/integer.h
%{_includedir}/wolfssl/wolfcrypt/kdf.h %{_includedir}/wolfssl/wolfcrypt/kdf.h
%{_includedir}/wolfssl/wolfcrypt/kyber.h
%{_includedir}/wolfssl/wolfcrypt/logging.h %{_includedir}/wolfssl/wolfcrypt/logging.h
%{_includedir}/wolfssl/wolfcrypt/md2.h %{_includedir}/wolfssl/wolfcrypt/md2.h
%{_includedir}/wolfssl/wolfcrypt/md4.h %{_includedir}/wolfssl/wolfcrypt/md4.h
@ -311,17 +313,20 @@ mkdir -p $RPM_BUILD_ROOT/
%{_includedir}/wolfssl/wolfcrypt/visibility.h %{_includedir}/wolfssl/wolfcrypt/visibility.h
%{_includedir}/wolfssl/wolfcrypt/wc_encrypt.h %{_includedir}/wolfssl/wolfcrypt/wc_encrypt.h
%{_includedir}/wolfssl/wolfcrypt/wc_port.h %{_includedir}/wolfssl/wolfcrypt/wc_port.h
%{_includedir}/wolfssl/wolfcrypt/wc_kyber.h
%{_includedir}/wolfssl/wolfcrypt/wolfevent.h %{_includedir}/wolfssl/wolfcrypt/wolfevent.h
%{_includedir}/wolfssl/wolfcrypt/wolfmath.h %{_includedir}/wolfssl/wolfcrypt/wolfmath.h
%{_includedir}/wolfssl/wolfio.h %{_includedir}/wolfssl/wolfio.h
%{_libdir}/pkgconfig/wolfssl.pc %{_libdir}/pkgconfig/wolfssl.pc
%changelog %changelog
* Tue Sep 27 2022 Jacob Barthelmeh <jacob@wolfssl.com>
- Add include of kyber headers
* Tue Aug 30 2022 Jacob Barthelmeh <jacob@wolfssl.com> * Tue Aug 30 2022 Jacob Barthelmeh <jacob@wolfssl.com>
- Add include of QUIC documentation - Add include of QUIC documentation
* Wed Aug 17 2022 Anthony Hu <anthony@wolfssl.com> * Wed Aug 17 2022 Anthony Hu <anthony@wolfssl.com>
- Add a new header sphincs.h. - Add a new header sphincs.h.
* Fri Jul 20 2022 Anthony Hu <anthony@wolfssl.com> * Wed Jul 20 2022 Anthony Hu <anthony@wolfssl.com>
- Add a new header dilithium.h. - Add a new header dilithium.h.
* Fri Jul 8 2022 Jacob Barthelmeh <jacob@wolfssl.com> * Fri Jul 8 2022 Jacob Barthelmeh <jacob@wolfssl.com>
- Add missing sp_int.h file - Add missing sp_int.h file

BIN
wolfssl.rc
View File

Binary file not shown.

4
wolfssl/version.h
View File

@ -28,8 +28,8 @@
extern "C" { extern "C" {
#endif #endif
#define LIBWOLFSSL_VERSION_STRING "5.5.0" #define LIBWOLFSSL_VERSION_STRING "5.5.1"
#define LIBWOLFSSL_VERSION_HEX 0x05005000 #define LIBWOLFSSL_VERSION_HEX 0x05005001
#ifdef __cplusplus #ifdef __cplusplus
} }