wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-03 20:54:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7446 from julek-wolfssl/hostap

Browse Source 
hostap update
This commit is contained in:
David Garske
2024-05-13 10:35:01 -07:00
committed by GitHub
parent 4b81a99f91 df425b306f
commit 29f7578a61
17 changed files with 2879 additions and 423 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
.github/workflows/hostap.yml → .github/workflows/disabled/hostap.yml vendored
View File

122
.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/hostapd.config vendored Normal file
View File

@@ -0,0 +1,122 @@
#CC=ccache gcc
CONFIG_DRIVER_NONE=y
CONFIG_DRIVER_NL80211=y
CONFIG_RSN_PREAUTH=y
#CONFIG_TLS=internal
#CONFIG_INTERNAL_LIBTOMMATH=y
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
#CONFIG_TLS=openssl
CONFIG_TLS=wolfssl
CONFIG_EAP=y
CONFIG_ERP=y
CONFIG_EAP_MD5=y
CONFIG_EAP_TLS=y
CONFIG_EAP_MSCHAPV2=y
CONFIG_EAP_PEAP=y
CONFIG_EAP_GTC=y
CONFIG_EAP_TTLS=y
CONFIG_EAP_SIM=y
CONFIG_EAP_AKA=y
CONFIG_EAP_AKA_PRIME=y
CONFIG_EAP_GPSK=y
CONFIG_EAP_GPSK_SHA256=y
CONFIG_EAP_SAKE=y
CONFIG_EAP_PAX=y
CONFIG_EAP_PSK=y
CONFIG_EAP_VENDOR_TEST=y
CONFIG_EAP_FAST=y
CONFIG_EAP_TEAP=y
CONFIG_EAP_IKEV2=y
CONFIG_EAP_TNC=y
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
LIBS += -rdynamic
CONFIG_EAP_UNAUTH_TLS=y
ifeq ($(CONFIG_TLS), openssl)
CONFIG_EAP_PWD=y
endif
ifeq ($(CONFIG_TLS), wolfssl)
CONFIG_EAP_PWD=y
endif
CONFIG_EAP_EKE=y
CONFIG_PKCS12=y
CONFIG_RADIUS_SERVER=y
CONFIG_IPV6=y
CONFIG_TLSV11=y
CONFIG_TLSV12=y
CONFIG_FULL_DYNAMIC_VLAN=y
CONFIG_VLAN_NETLINK=y
CONFIG_LIBNL32=y
CONFIG_LIBNL3_ROUTE=y
CONFIG_IEEE80211R=y
CONFIG_IEEE80211AC=y
CONFIG_IEEE80211AX=y
CONFIG_OCV=y
CONFIG_WPS=y
CONFIG_WPS_UPNP=y
CONFIG_WPS_NFC=y
#CONFIG_WPS_STRICT=y
CONFIG_WPA_TRACE=y
CONFIG_WPA_TRACE_BFD=y
CONFIG_P2P_MANAGER=y
CONFIG_DEBUG_FILE=y
CONFIG_DEBUG_LINUX_TRACING=y
CONFIG_WPA_CLI_EDIT=y
CONFIG_ACS=y
CONFIG_NO_RANDOM_POOL=y
CONFIG_WNM=y
CONFIG_INTERWORKING=y
CONFIG_HS20=y
CONFIG_SQLITE=y
CONFIG_SAE=y
CONFIG_SAE_PK=y
CFLAGS += -DALL_DH_GROUPS
CONFIG_FST=y
CONFIG_FST_TEST=y
CONFIG_TESTING_OPTIONS=y
CFLAGS += -DCONFIG_RADIUS_TEST
CONFIG_MODULE_TESTS=y
CONFIG_SUITEB=y
CONFIG_SUITEB192=y
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
# This can be used as a more efficient memory error detector than valgrind
# (though, with still some CPU and memory cost, so VM cases will need more
# memory allocated for the guest).
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
#LIBS_h += -fsanitize=address -fno-omit-frame-pointer -g
#LIBS_n += -fsanitize=address -fno-omit-frame-pointer -g
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
# following lines.
#CFLAGS += -Wno-format-nonliteral
#CFLAGS += -fsanitize=undefined
##CFLAGS += -fno-sanitize-recover
#LIBS += -fsanitize=undefined
##LIBS += -fno-sanitize-recover
#LIBS_h += -fsanitize=undefined
#LIBS_n += -fsanitize=undefined
#LIBS_c += -fsanitize=undefined
CONFIG_MBO=y
CONFIG_TAXONOMY=y
CONFIG_FILS=y
CONFIG_FILS_SK_PFS=y
CONFIG_OWE=y
CONFIG_DPP=y
CONFIG_DPP2=y
CONFIG_WEP=y
CONFIG_PASN=y
CONFIG_AIRTIME_POLICY=y
CONFIG_IEEE80211BE=y

1677
.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/tests vendored Normal file
View File

File diff suppressed because it is too large Load Diff

164
.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/wpa_supplicant.config vendored Normal file
View File

@@ -0,0 +1,164 @@
#CC=ccache gcc
#CONFIG_TLS=openssl
CONFIG_TLS=wolfssl
#CONFIG_TLS=internal
#CONFIG_INTERNAL_LIBTOMMATH=y
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
CONFIG_IEEE8021X_EAPOL=y
CONFIG_ERP=y
CONFIG_EAP_MD5=y
CONFIG_MSCHAPV2=y
CONFIG_EAP_TLS=y
CONFIG_EAP_PEAP=y
CONFIG_EAP_TTLS=y
CONFIG_EAP_GTC=y
CONFIG_EAP_OTP=y
CONFIG_EAP_PSK=y
CONFIG_EAP_PAX=y
CONFIG_EAP_LEAP=y
CONFIG_EAP_SIM=y
CONFIG_EAP_AKA=y
CONFIG_EAP_AKA_PRIME=y
CONFIG_EAP_VENDOR_TEST=y
CONFIG_EAP_TLV=y
CONFIG_EAP_SAKE=y
CONFIG_EAP_GPSK=y
CONFIG_EAP_GPSK_SHA256=y
CONFIG_EAP_EKE=y
CONFIG_EAP_TNC=y
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
LIBS += -rdynamic
CONFIG_EAP_FAST=y
CONFIG_EAP_TEAP=y
CONFIG_EAP_IKEV2=y
ifeq ($(CONFIG_TLS), openssl)
CONFIG_EAP_PWD=y
endif
ifeq ($(CONFIG_TLS), wolfssl)
CONFIG_EAP_PWD=y
endif
CONFIG_USIM_SIMULATOR=y
CONFIG_SIM_SIMULATOR=y
#CONFIG_PCSC=y
CONFIG_IPV6=y
CONFIG_DRIVER_NONE=y
CONFIG_PKCS12=y
CONFIG_CTRL_IFACE=unix
CONFIG_WPA_CLI_EDIT=y
CONFIG_OCSP=y
#CONFIG_ELOOP_POLL=y
CONFIG_CTRL_IFACE_DBUS_NEW=y
CONFIG_CTRL_IFACE_DBUS_INTRO=y
CONFIG_IEEE80211R=y
CONFIG_IEEE80211AC=y
CONFIG_IEEE80211AX=y
CONFIG_OCV=y
CONFIG_DEBUG_FILE=y
CONFIG_WPS=y
#CONFIG_WPS_STRICT=y
CONFIG_WPS_UPNP=y
CONFIG_WPS_NFC=y
CONFIG_WPS_ER=y
#CONFIG_WPS_REG_DISABLE_OPEN=y
CONFIG_DRIVER_WEXT=y
CONFIG_DRIVER_NL80211=y
CFLAGS += -I/usr/include/libnl3
CONFIG_LIBNL32=y
CONFIG_IBSS_RSN=y
CONFIG_AP=y
CONFIG_MESH=y
CONFIG_P2P=y
CONFIG_WIFI_DISPLAY=y
CONFIG_ACS=y
CONFIG_BGSCAN_SIMPLE=y
CONFIG_BGSCAN_LEARN=y
CONFIG_WPA_TRACE=y
CONFIG_WPA_TRACE_BFD=y
CONFIG_TDLS=y
CONFIG_TDLS_TESTING=y
CONFIG_NO_RANDOM_POOL=y
CONFIG_TLSV11=y
CONFIG_TLSV12=y
CONFIG_HT_OVERRIDES=y
CONFIG_VHT_OVERRIDES=y
CONFIG_HE_OVERRIDES=y
CONFIG_DEBUG_LINUX_TRACING=y
CONFIG_INTERWORKING=y
CONFIG_HS20=y
CONFIG_AUTOSCAN_EXPONENTIAL=y
CONFIG_AUTOSCAN_PERIODIC=y
CONFIG_EXT_PASSWORD_TEST=y
CONFIG_EXT_PASSWORD_FILE=y
CONFIG_EAP_UNAUTH_TLS=y
CONFIG_SAE=y
CONFIG_SAE_PK=y
CFLAGS += -DALL_DH_GROUPS
CONFIG_WNM=y
CONFIG_FST=y
CONFIG_FST_TEST=y
CONFIG_TESTING_OPTIONS=y
CONFIG_MODULE_TESTS=y
CONFIG_SUITEB=y
CONFIG_SUITEB192=y
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
# This can be used as a more efficient memory error detector than valgrind
# (though, with still some CPU and memory cost, so VM cases will need more
# memory allocated for the guest).
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
#LIBS_p += -fsanitize=address -fno-omit-frame-pointer -g
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
# following lines.
#CFLAGS += -Wno-format-nonliteral
#CFLAGS += -fsanitize=undefined
##CFLAGS += -fno-sanitize-recover
#LIBS += -fsanitize=undefined
##LIBS += -fno-sanitize-recover
#LIBS_c += -fsanitize=undefined
#LIBS_p += -fsanitize=undefined
CONFIG_MBO=y
CONFIG_FILS=y
CONFIG_FILS_SK_PFS=y
CONFIG_PMKSA_CACHE_EXTERNAL=y
CONFIG_OWE=y
CONFIG_DPP=y
CONFIG_DPP2=y
CONFIG_WEP=y
CONFIG_PASN=y

51
.github/workflows/hostap-files/configs/b607d2723e927a3446d89aed813f1aa6068186bb/tests vendored
View File

@@ -191,13 +191,7 @@ ap_wpa2_psk_supp_proto_no_gtk_in_group_msg
ap_wpa2_psk_supp_proto_too_long_gtk_in_group_msg
ap_wpa2_psk_supp_proto_too_long_gtk_kde
ap_wpa2_psk_supp_proto_gtk_not_encrypted
ap_wpa2_psk_supp_proto_no_igtk
ap_wpa2_psk_supp_proto_igtk_ok
ap_wpa2_psk_supp_proto_igtk_keyid_swap
ap_wpa2_psk_supp_proto_igtk_keyid_too_large
ap_wpa2_psk_supp_proto_igtk_keyid_unexpected
ap_wpa2_psk_wep
ap_wpa2_psk_ifdown
ap_wpa2_psk_drop_first_msg_4
ap_wpa2_psk_disable_enable
ap_wpa2_psk_incorrect_passphrase
@@ -210,10 +204,7 @@ ap_wpa2_disable_eapol_retry
ap_wpa2_disable_eapol_retry_group
ap_wpa2_psk_mic_0
ap_wpa2_psk_local_error
ap_wpa2_psk_inject_assoc
ap_wpa2_psk_no_control_port
ap_wpa2_psk_ap_control_port
ap_wpa2_psk_ap_control_port_disabled
ap_wpa2_psk_rsne_mismatch_ap
ap_wpa2_psk_rsne_mismatch_ap2
ap_wpa2_psk_rsne_mismatch_ap3
@@ -253,10 +244,8 @@ ap_wpa2_eap_aka_sql
ap_wpa2_eap_aka_config
ap_wpa2_eap_aka_ext
ap_wpa2_eap_aka_ext_auth_fail
ap_wpa2_eap_aka_prime
ap_wpa2_eap_aka_prime_imsi_identity
ap_wpa2_eap_aka_prime_imsi_privacy_key
ap_wpa2_eap_aka_prime_sql
ap_wpa2_eap_aka_prime_ext_auth_fail
ap_wpa2_eap_aka_prime_ext
ap_wpa2_eap_ttls_pap
@@ -416,19 +405,6 @@ ap_wpa2_radius_server_get_id
ap_wpa2_eap_tls_tod
ap_wpa2_eap_tls_tod_tofu
ap_wpa2_eap_sake_no_control_port
ap_wpa2_tdls
ap_wpa2_tdls_concurrent_init
ap_wpa2_tdls_concurrent_init2
ap_wpa2_tdls_decline_resp
ap_wpa2_tdls_long_lifetime
ap_wpa2_tdls_long_frame
ap_wpa2_tdls_reneg
ap_wpa2_tdls_wrong_lifetime_resp
ap_wpa2_tdls_diff_rsnie
ap_wpa2_tdls_wrong_tpk_m2_mic
ap_wpa2_tdls_wrong_tpk_m3_mic
ap_wpa2_tdls_double_tpk_m2
ap_wpa2_tdls_responder_teardown
dpp_network_intro_version
dpp_network_intro_version_change
dpp_network_intro_version_missing_req
@@ -459,12 +435,9 @@ dpp_qr_code_curves
dpp_qr_code_curves_brainpool
dpp_qr_code_unsupported_curve
dpp_qr_code_keygen_fail
dpp_qr_code_curve_select
dpp_qr_code_auth_broadcast
dpp_configurator_enrollee
dpp_configurator_enrollee_prime256v1
dpp_configurator_enrollee_secp384r1
dpp_configurator_enrollee_secp521r1
dpp_configurator_enrollee_brainpoolP256r1
dpp_configurator_enrollee_brainpoolP384r1
dpp_configurator_enrollee_brainpoolP512r1
@@ -477,7 +450,6 @@ dpp_qr_code_curve_brainpoolP384r1
dpp_qr_code_curve_brainpoolP512r1
dpp_qr_code_set_key
dpp_qr_code_auth_mutual
dpp_qr_code_auth_mutual2
dpp_qr_code_auth_mutual_p_256
dpp_qr_code_auth_mutual_p_384
dpp_qr_code_auth_mutual_p_521
@@ -514,13 +486,11 @@ dpp_config_no_signed_connector
dpp_config_unexpected_signed_connector_char
dpp_config_root_not_an_object
dpp_config_no_wi_fi_tech
dpp_config_unsupported_wi_fi_tech
dpp_config_no_discovery
dpp_config_no_discovery_ssid
dpp_config_too_long_discovery_ssid
dpp_config_no_cred
dpp_config_no_cred_akm
dpp_config_unsupported_cred_akm
dpp_config_error_legacy_no_pass
dpp_config_error_legacy_too_long_pass
dpp_config_error_legacy_psk_with_sae
@@ -531,13 +501,10 @@ dpp_config_connector_error_ext_sign
dpp_config_connector_error_too_short_timestamp
dpp_config_connector_error_invalid_timestamp
dpp_config_connector_error_invalid_timestamp_date
dpp_config_connector_error_invalid_time_zone
dpp_config_connector_error_invalid_time_zone_2
dpp_config_connector_error_expired_1
dpp_config_connector_error_expired_2
dpp_config_connector_error_expired_3
dpp_config_connector_error_expired_4
dpp_config_connector_error_expired_5
dpp_config_connector_error_expired_6
dpp_config_connector_error_no_groups
dpp_config_connector_error_empty_groups
@@ -565,13 +532,6 @@ dpp_ap_config_p256_bp256
dpp_ap_config_bp256_p256
dpp_ap_config_p521_bp512
dpp_ap_config_reconfig_configurator
dpp_auto_connect_1
dpp_auto_connect_2
dpp_auto_connect_2_connect_cmd
dpp_auto_connect_2_sta_ver1
dpp_auto_connect_2_ap_ver1
dpp_auto_connect_2_ver1
dpp_auto_connect_2_conf_ver1
dpp_auto_connect_legacy
dpp_auto_connect_legacy_ssid_charset
dpp_auto_connect_legacy_sae_1
@@ -580,13 +540,6 @@ dpp_auto_connect_legacy_psk_sae_1
dpp_auto_connect_legacy_psk_sae_2
dpp_auto_connect_legacy_psk_sae_3
dpp_auto_connect_legacy_pmf_required
dpp_qr_code_auth_responder_configurator
dpp_qr_code_auth_responder_configurator_group_id
dpp_qr_code_auth_enrollee_init_netrole
dpp_qr_code_hostapd_init
dpp_qr_code_hostapd_init_offchannel
dpp_qr_code_hostapd_init_offchannel_neg_freq
dpp_qr_code_hostapd_ignore_mismatch
dpp_test_vector_p_256
dpp_test_vector_p_256_b
dpp_test_vector_p_521
@@ -603,7 +556,6 @@ dpp_pkex_no_identifier
dpp_pkex_identifier_mismatch
dpp_pkex_identifier_mismatch2
dpp_pkex_identifier_mismatch3
dpp_pkex_5ghz
dpp_pkex_test_vector
dpp_pkex_code_mismatch
dpp_pkex_code_mismatch_limit
@@ -625,7 +577,6 @@ dpp_pkex_hostapd_errors
dpp_pkex_nak_curve_change
dpp_pkex_nak_curve_change2
dpp_hostapd_configurator
dpp_hostapd_configurator_enrollee_v1
dpp_hostapd_configurator_responder
dpp_hostapd_configurator_fragmentation
dpp_hostapd_enrollee_fragmentation
@@ -650,7 +601,6 @@ dpp_proto_stop_at_pkex_cr_req
dpp_proto_stop_at_pkex_cr_resp
dpp_proto_network_introduction
dpp_hostapd_auth_conf_timeout
dpp_hostapd_auth_resp_retries
dpp_tcp
dpp_tcp_port
dpp_tcp_mutual
@@ -702,6 +652,5 @@ dpp_qr_code_config_event_initiator_failure
dpp_qr_code_config_event_initiator_no_response
dpp_qr_code_config_event_initiator_both
dpp_tcp_qr_code_config_event_initiator
dpp_qr_code_config_event_responder
dpp_discard_public_action

47
.github/workflows/hostap-files/configs/hostap_2_10/extra.patch vendored Normal file
View File

@@ -0,0 +1,47 @@
From a53a6a67dc121b45d611318e2a37815cc209839c Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Fri, 19 Apr 2024 16:41:38 +0200
Subject: [PATCH] Fixes for running tests under UML
- Apply commit ID fix from more recent commit
- priv_sz and pub_sz are checked and fail on UML. Probably because stack is zeroed out.
---
src/crypto/crypto_wolfssl.c | 2 +-
tests/hwsim/run-all.sh | 8 +++++++-
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/crypto/crypto_wolfssl.c b/src/crypto/crypto_wolfssl.c
index 00ecf61352..a57fa50697 100644
--- a/src/crypto/crypto_wolfssl.c
+++ b/src/crypto/crypto_wolfssl.c
@@ -785,7 +785,7 @@ int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len, u8 *privkey,
int ret = -1;
WC_RNG rng;
DhKey *dh = NULL;
- word32 priv_sz, pub_sz;
+ word32 priv_sz = prime_len, pub_sz = prime_len;
if (TEST_FAIL())
return -1;
diff --git a/tests/hwsim/run-all.sh b/tests/hwsim/run-all.sh
index ee48cd0581..75c3a58b52 100755
--- a/tests/hwsim/run-all.sh
+++ b/tests/hwsim/run-all.sh
@@ -15,7 +15,13 @@ export LOGDIR
if [ -z "$DBFILE" ]; then
DB=""
else
- DB="-S $DBFILE --commit $(git rev-parse HEAD)"
+ DB="-S $DBFILE"
+ if [ -z "$COMMITID" ]; then
+ COMMITID="$(git rev-parse HEAD)"
+ fi
+ if [ -n "$COMMITID" ]; then
+ DB="$DB --commit $COMMITID"
+ fi
if [ -n "$BUILD" ]; then
DB="$DB -b $BUILD"
fi
--
2.34.1

14
.github/workflows/hostap-files/configs/hostap_2_10/tests vendored
View File

@@ -163,7 +163,6 @@ ap_wpa2_disable_eapol_retry_group
ap_wpa2_psk_mic_0
ap_wpa2_psk_local_error
ap_wpa2_psk_inject_assoc
ap_wpa2_psk_no_control_port
ap_wpa2_psk_ap_control_port
ap_wpa2_psk_ap_control_port_disabled
ap_wpa2_psk_rsne_mismatch_ap
@@ -269,16 +268,3 @@ ap_wpa2_eap_psk_mac_addr_change
ap_wpa2_eap_server_get_id
ap_wpa2_radius_server_get_id
ap_wpa2_eap_sake_no_control_port
ap_wpa2_tdls
ap_wpa2_tdls_concurrent_init
ap_wpa2_tdls_concurrent_init2
ap_wpa2_tdls_decline_resp
ap_wpa2_tdls_long_lifetime
ap_wpa2_tdls_long_frame
ap_wpa2_tdls_reneg
ap_wpa2_tdls_wrong_lifetime_resp
ap_wpa2_tdls_diff_rsnie
ap_wpa2_tdls_wrong_tpk_m2_mic
ap_wpa2_tdls_wrong_tpk_m3_mic
ap_wpa2_tdls_double_tpk_m2
ap_wpa2_tdls_responder_teardown

313
.github/workflows/hostap-vm.yml vendored Normal file
View File

@@ -0,0 +1,313 @@
name: hostap and wpa-supplicant Tests
# START OF COMMON SECTION
on:
push:
branches: [ 'master', 'main', 'release/**' ]
pull_request:
branches: [ '*' ]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# END OF COMMON SECTION
env:
LINUX_REF: v6.6
jobs:
build_wolfssl:
strategy:
matrix:
include:
- build_id: hostap-vm-build1
wolf_extra_config: --disable-tls13
- build_id: hostap-vm-build2
wolf_extra_config: >-
--enable-wpas-dpp --enable-brainpool --with-eccminsz=192
--enable-tlsv10 --enable-oldtls
name: Build wolfSSL
runs-on: ubuntu-latest
# This should be a safe limit for the tests to run.
timeout-minutes: 10
steps:
# No way to view the full strategy in the browser (really weird)
- name: Print strategy
run: |
cat <<EOF
${{ toJSON(matrix) }}
EOF
- if: ${{ runner.debug }}
name: Enable wolfSSL debug logging
run: |
echo "wolf_debug_flags=--enable-debug" >> $GITHUB_ENV
- name: Build wolfSSL
uses: wolfSSL/actions-build-autotools-project@v1
with:
path: wolfssl
configure: >-
--enable-wpas CPPFLAGS=-DWOLFSSL_STATIC_RSA
${{ env.wolf_debug_flags }} ${{ matrix.wolf_extra_config }}
install: true
- name: Upload built lib
uses: actions/upload-artifact@v4
with:
name: ${{ matrix.build_id }}
path: build-dir
retention-days: 5
build_uml_linux:
name: Build UML (UserMode Linux)
runs-on: ubuntu-latest
# This should be a safe limit for the tests to run.
timeout-minutes: 10
steps:
- name: Checking if we have kernel in cache
uses: actions/cache@v4
id: cache
with:
path: linux/linux
key: ${{ env.LINUX_REF }}
lookup-only: true
- name: Checkout hostap
if: steps.cache.outputs.cache-hit != 'true'
uses: actions/checkout@v4
with:
repository: julek-wolfssl/hostap-mirror
path: hostap
- name: Checkout linux
if: steps.cache.outputs.cache-hit != 'true'
uses: actions/checkout@v4
with:
repository: torvalds/linux
path: linux
- name: Compile linux
if: steps.cache.outputs.cache-hit != 'true'
run: |
cp hostap/tests/hwsim/vm/kernel-config.uml linux/.config
cd linux
yes "" | ARCH=um make -j $(nproc)
hostap_test:
strategy:
fail-fast: false
matrix:
# should hostapd be compiled with wolfssl
hostapd: [true, false]
# should wpa_supplicant be compiled with wolfssl
wpa_supplicant: [true, false]
# Fix the versions of hostap and osp to not break testing when a new
# patch is added in to osp. Tests are read from the corresponding
# configs/hostap_ref/tests file.
config: [
{
hostap_ref: hostap_2_10,
remove_teap: true,
# TLS 1.3 does not work for this version
build_id: hostap-vm-build1,
},
# Test the dpp patch
{
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
build_id: hostap-vm-build2
},
{
hostap_ref: 07c9f183ea744ac04585fb6dd10220c75a5e2e74,
osp_ref: e1876fbbf298ee442bc7ab8561331ebc7de17528,
build_id: hostap-vm-build2
},
]
exclude:
# don't test openssl on both sides
- hostapd: false
wpa_supplicant: false
# no hostapd support for dpp yet
- hostapd: true
config: {
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
build_id: hostap-vm-build2
}
name: hwsim test
# For openssl 1.1
runs-on: ubuntu-latest
# This should be a safe limit for the tests to run.
timeout-minutes: 45
needs: [build_wolfssl, build_uml_linux]
steps:
- name: Checking if we have kernel in cache
uses: actions/cache/restore@v4
id: cache
with:
path: linux/linux
key: ${{ env.LINUX_REF }}
fail-on-cache-miss: true
- name: show file structure
run: tree
# No way to view the full strategy in the browser (really weird)
- name: Print strategy
run: |
cat <<EOF
${{ toJSON(matrix) }}
EOF
- name: Print computed job run ID
run: |
SHA_SUM=$(sha256sum << 'END_OF_HEREDOC' | cut -d " " -f 1
${{ toJSON(github) }}
END_OF_HEREDOC
)
echo "our_job_run_id=$SHA_SUM" >> $GITHUB_ENV
echo Our job run ID is $SHA_SUM
- name: Checkout wolfSSL
uses: actions/checkout@v4
with:
path: wolfssl
- name: Download lib
uses: actions/download-artifact@v4
with:
name: ${{ matrix.config.build_id }}
path: build-dir
- name: Install dependencies
run: |
# Don't prompt for anything
export DEBIAN_FRONTEND=noninteractive
sudo apt-get update
# hostap dependencies
sudo apt-get install -y libpcap0.8 libpcap-dev curl libcurl4-openssl-dev \
libnl-3-dev binutils-dev libssl-dev libiberty-dev libnl-genl-3-dev \
libnl-route-3-dev libdbus-1-dev bridge-utils tshark
sudo pip3 install pycryptodome
- name: Checkout hostap
uses: actions/checkout@v4
with:
repository: julek-wolfssl/hostap-mirror
path: hostap
ref: ${{ matrix.config.hostap_ref }}
- name: Update certs
working-directory: hostap/tests/hwsim/auth_serv
run: ./update.sh
- if: ${{ matrix.config.osp_ref }}
name: Checkout OSP
uses: actions/checkout@v4
with:
repository: wolfssl/osp
path: osp
ref: ${{ matrix.config.osp_ref }}
- if: ${{ matrix.config.osp_ref }}
name: Apply patch files
working-directory: hostap
run: |
for f in $GITHUB_WORKSPACE/osp/hostap-patches/pending/*
do
patch -p1 < $f
done
- name: Apply extra patches
working-directory: hostap
run: |
FILE=$GITHUB_WORKSPACE/wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/extra.patch
if [ -f "$FILE" ]; then
patch -p1 < $FILE
fi
- if: ${{ matrix.hostapd }}
name: Setup hostapd config file
run: |
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/hostapd.config \
hostap/hostapd/.config
cat <<EOF >> hostap/hostapd/.config
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
EOF
- if: ${{ matrix.wpa_supplicant }}
name: Setup wpa_supplicant config file
run: |
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/wpa_supplicant.config \
hostap/wpa_supplicant/.config
cat <<EOF >> hostap/wpa_supplicant/.config
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
EOF
- name: Build hostap and wpa_supplicant
working-directory: hostap/tests/hwsim/
run: ./build.sh
- if: ${{ matrix.hostapd }}
name: Confirm hostapd linking with wolfSSL
run: ldd hostap/hostapd/hostapd | grep wolfssl
- if: ${{ matrix.wpa_supplicant }}
name: Confirm wpa_supplicant linking with wolfSSL
run: ldd hostap/wpa_supplicant/wpa_supplicant | grep wolfssl
- if: ${{ matrix.config.remove_teap }}
name: Remove EAP-TEAP from test configuration
working-directory: hostap/tests/hwsim/auth_serv
run: |
sed -e 's/"erp-teap@example.com"\tTEAP//' -i eap_user.conf
sed -e 's/"erp-teap@example.com"\tMSCHAPV2\t"password"\t\[2\]//' -i eap_user.conf
sed -e 's/"TEAP"\t\tTEAP//' -i eap_user.conf
sed -e 's/TEAP,//' -i eap_user.conf
- if: ${{ runner.debug }}
name: Enable hostap debug logging
run: |
echo "hostap_debug_flags=--debug" >> $GITHUB_ENV
- name: Run tests
id: testing
working-directory: hostap/tests/hwsim/
run: |
cat <<EOF >> vm/vm-config
KERNELDIR=$GITHUB_WORKSPACE/linux
KVMARGS="-cpu host"
EOF
# Run tests in increments of 200 to not stall out the parallel-vm script
while mapfile -t -n 200 ary && ((${#ary[@]})); do
TESTS=$(printf '%s\n' "${ary[@]}" | tr '\n' ' ')
HWSIM_RES=0 # Not set when command succeeds
./vm/parallel-vm.py ${{ env.hostap_debug_flags }} --nocurses $(nproc) $TESTS || HWSIM_RES=$?
if [ "$HWSIM_RES" -ne "0" ]; then
# Let's re-run the failing tests. We gather the failed tests from the log file.
FAILED_TESTS=$(grep 'failed tests' /tmp/hwsim-test-logs/*-parallel.log | sed 's/failed tests: //' | tr ' ' '\n' | sort | uniq | tr '\n' ' ')
printf 'failed tests: %s\n' "$FAILED_TESTS"
./vm/parallel-vm.py ${{ env.hostap_debug_flags }} --nocurses $(nproc) $FAILED_TESTS
fi
rm -r /tmp/hwsim-test-logs
done < $GITHUB_WORKSPACE/wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/tests
# The logs are quite big. It hasn't been useful so far so let's not waste
# precious gh space.
#- name: zip logs
# if: ${{ failure() && steps.testing.outcome == 'failure' }}
# working-directory: hostap/tests/hwsim/
# run: |
# rm /tmp/hwsim-test-logs/latest
# zip -9 -r logs.zip /tmp/hwsim-test-logs
#
#- name: Upload failure logs
# if: ${{ failure() && steps.testing.outcome == 'failure' }}
# uses: actions/upload-artifact@v4
# with:
# name: hostap-logs-${{ env.our_job_run_id }}
# path: hostap/tests/hwsim/logs.zip
# retention-days: 5

180
src/internal.c
View File

@@ -517,6 +517,22 @@ int IsTLS(const WOLFSSL* ssl)
{
if (ssl->version.major == SSLv3_MAJOR && ssl->version.minor >=TLSv1_MINOR)
return 1;
#ifdef WOLFSSL_DTLS
if (ssl->version.major == DTLS_MAJOR)
return 1;
#endif
return 0;
}
int IsTLS_ex(const ProtocolVersion pv)
{
if (pv.major == SSLv3_MAJOR && pv.minor >=TLSv1_MINOR)
return 1;
#ifdef WOLFSSL_DTLS
if (pv.major == DTLS_MAJOR)
return 1;
#endif
return 0;
}
@@ -3048,7 +3064,7 @@ static WC_INLINE void AddSuiteHashSigAlgo(byte* hashSigAlgo, byte macAlgo,
}
}
void InitSuitesHashSigAlgo_ex2(byte* hashSigAlgo, int haveSig, int tls1_2,
void InitSuitesHashSigAlgo(byte* hashSigAlgo, int haveSig, int tls1_2,
int keySz, word16* len)
{
word16 idx = 0;
@@ -3155,30 +3171,6 @@ void InitSuitesHashSigAlgo_ex2(byte* hashSigAlgo, int haveSig, int tls1_2,
*len = idx;
}
void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig, int haveRSAsig,
int haveFalconSig, int haveDilithiumSig, int haveAnon, int tls1_2,
int keySz)
{
InitSuitesHashSigAlgo_ex(suites->hashSigAlgo, haveECDSAsig, haveRSAsig,
haveFalconSig, haveDilithiumSig, haveAnon, tls1_2, keySz,
&suites->hashSigAlgoSz);
}
void InitSuitesHashSigAlgo_ex(byte* hashSigAlgo, int haveECDSAsig,
int haveRSAsig, int haveFalconSig, int haveDilithiumSig, int haveAnon,
int tls1_2, int keySz, word16* len)
{
int have = 0;
if (haveECDSAsig) have |= SIG_ECDSA;
if (haveRSAsig) have |= SIG_RSA;
if (haveFalconSig) have |= SIG_FALCON;
if (haveDilithiumSig) have |= SIG_DILITHIUM;
if (haveAnon) have |= SIG_ANON;
InitSuitesHashSigAlgo_ex2(hashSigAlgo, have, tls1_2, keySz, len);
}
int AllocateCtxSuites(WOLFSSL_CTX* ctx)
{
if (ctx->suites == NULL) {
@@ -3241,6 +3233,7 @@ void InitSuites(Suites* suites, ProtocolVersion pv, int keySz, word16 haveRSA,
(void)haveStaticRSA;
(void)haveStaticECC;
(void)haveECC;
(void)haveECDSAsig;
(void)side;
(void)haveRSA; /* some builds won't read */
(void)haveRSAsig; /* non ecc builds won't read */
@@ -4265,18 +4258,27 @@ void InitSuites(Suites* suites, ProtocolVersion pv, int keySz, word16 haveRSA,
suites->suiteSz = idx;
if (suites->hashSigAlgoSz == 0) {
int haveSig = 0;
haveSig |= (haveRSAsig | haveRSA) ? SIG_RSA : 0;
haveSig |= (haveECDSAsig | haveECC) ? SIG_ECDSA : 0;
#if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
haveSig |= (haveECDSAsig | haveECC) ? SIG_SM2 : 0;
#endif
haveSig |= haveFalconSig ? SIG_FALCON : 0;
haveSig |= haveDilithiumSig ? SIG_DILITHIUM : 0;
haveSig &= ~SIG_ANON;
InitSuitesHashSigAlgo_ex2(suites->hashSigAlgo, haveSig, tls1_2, keySz,
InitSuitesHashSigAlgo(suites->hashSigAlgo, SIG_ALL, tls1_2, keySz,
&suites->hashSigAlgoSz);
}
/* Moved to the end as we set some of the vars but never use them */
(void)tls; /* shut up compiler */
(void)tls1_2;
(void)dtls;
(void)haveDH;
(void)havePSK;
(void)haveStaticRSA;
(void)haveStaticECC;
(void)haveECC;
(void)haveECDSAsig;
(void)side;
(void)haveRSA; /* some builds won't read */
(void)haveRSAsig; /* non ecc builds won't read */
(void)haveAnon; /* anon ciphers optional */
(void)haveNull;
(void)haveFalconSig;
(void)haveDilithiumSig;
}
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_CERTS) || \
@@ -26729,7 +26731,7 @@ static int ParseCipherList(Suites* suites,
#endif
{
suites->suiteSz = (word16)idx;
InitSuitesHashSigAlgo_ex2(suites->hashSigAlgo, haveSig, 1, keySz,
InitSuitesHashSigAlgo(suites->hashSigAlgo, haveSig, 1, keySz,
&suites->hashSigAlgoSz);
}
@@ -26913,7 +26915,7 @@ int SetCipherListFromBytes(WOLFSSL_CTX* ctx, Suites* suites, const byte* list,
haveSig |= haveFalconSig ? SIG_FALCON : 0;
haveSig |= haveDilithiumSig ? SIG_DILITHIUM : 0;
haveSig |= haveAnon ? SIG_ANON : 0;
InitSuitesHashSigAlgo_ex2(suites->hashSigAlgo, haveSig, 1, keySz,
InitSuitesHashSigAlgo(suites->hashSigAlgo, haveSig, 1, keySz,
&suites->hashSigAlgoSz);
#ifdef HAVE_RENEGOTIATION_INDICATION
if (ctx->method->side == WOLFSSL_CLIENT_END) {
@@ -33507,6 +33509,24 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
}
}
/* search suites for specific one, idx on success, negative on error */
int FindSuite(const Suites* suites, byte first, byte second)
{
int i;
if (suites == NULL || suites->suiteSz == 0) {
WOLFSSL_MSG("Suites pointer error or suiteSz 0");
return SUITES_ERROR;
}
for (i = 0; i < suites->suiteSz-1; i += SUITE_LEN) {
if (suites->suites[i] == first &&
suites->suites[i+1] == second )
return i;
}
return MATCH_SUITE_ERROR;
}
#ifndef NO_WOLFSSL_SERVER
@@ -35426,30 +35446,6 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
return ret;
}
#if defined(HAVE_SERVER_RENEGOTIATION_INFO) || defined(HAVE_FALLBACK_SCSV) || \
defined(OPENSSL_ALL)
/* search suites for specific one, idx on success, negative on error */
static int FindSuite(Suites* suites, byte first, byte second)
{
int i;
if (suites == NULL || suites->suiteSz == 0) {
WOLFSSL_MSG("Suites pointer error or suiteSz 0");
return SUITES_ERROR;
}
for (i = 0; i < suites->suiteSz-1; i += SUITE_LEN) {
if (suites->suites[i] == first &&
suites->suites[i+1] == second )
return i;
}
return MATCH_SUITE_ERROR;
}
#endif
#endif /* !WOLFSSL_NO_TLS12 */
/* Make sure server cert/key are valid for this suite, true on success
@@ -35942,6 +35938,47 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
{
int ret = 0;
WOLFSSL_SESSION* session;
#ifdef HAVE_SECRET_CALLBACK
if (ssl->sessionSecretCb != NULL
#ifdef HAVE_SESSION_TICKET
&& ssl->session->ticketLen > 0
#endif
) {
int secretSz = SECRET_LEN;
WOLFSSL_MSG("Calling session secret callback");
ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom,
RAN_LEN);
if (ret == 0) {
ret = ssl->sessionSecretCb(ssl, ssl->arrays->masterSecret,
&secretSz, ssl->sessionSecretCtx);
if (secretSz != SECRET_LEN)
ret = SESSION_SECRET_CB_E;
}
if (ret == 0)
ret = MatchSuite(ssl, clSuites);
if (ret == 0) {
#ifdef NO_OLD_TLS
ret = DeriveTlsKeys(ssl);
#else
#ifndef NO_TLS
if (ssl->options.tls)
ret = DeriveTlsKeys(ssl);
#endif
if (!ssl->options.tls)
ret = DeriveKeys(ssl);
#endif
/* SERVER: peer auth based on session secret. */
ssl->options.peerAuthGood = (ret == 0);
ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
}
if (ret != 0)
WOLFSSL_ERROR_VERBOSE(ret);
WOLFSSL_LEAVE("HandleTlsResumption", ret);
return ret;
}
#endif /* HAVE_SECRET_CALLBACK */
#ifdef HAVE_SESSION_TICKET
if (ssl->options.useTicket == 1) {
session = ssl->session;
@@ -36601,6 +36638,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
ssl->options.haveSessionId = 1;
/* ProcessOld uses same resume code */
WOLFSSL_MSG_EX("ssl->options.resuming %d", ssl->options.resuming);
if (ssl->options.resuming) {
ret = HandleTlsResumption(ssl, clSuites);
if (ret != 0)
@@ -37982,6 +38020,22 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
WOLFSSL_START(WC_FUNC_TICKET_DO);
WOLFSSL_ENTER("DoClientTicket");
#ifdef HAVE_SECRET_CALLBACK
if (ssl->ticketParseCb != NULL) {
decryptRet = WOLFSSL_TICKET_RET_OK;
if (!ssl->ticketParseCb(ssl, input, len, ssl->ticketParseCtx)) {
/* Failure kills the connection */
decryptRet = WOLFSSL_TICKET_RET_FATAL;
}
else {
if (wolfSSL_set_SessionTicket(ssl, input, len) !=
WOLFSSL_SUCCESS)
decryptRet = WOLFSSL_TICKET_RET_REJECT;
}
goto cleanup;
}
else
#endif
#ifdef WOLFSSL_TLS13
if (len == ID_LEN && IsAtLeastTLSv1_3(ssl->version)) {
/* This is a stateful ticket. We can be sure about this because
@@ -37996,7 +38050,11 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
}
else
#endif
if (len >= sizeof(*it))
decryptRet = DoDecryptTicket(ssl, input, len, &it);
else
WOLFSSL_MSG("Ticket is smaller than InternalTicket. Rejecting.");
if (decryptRet != WOLFSSL_TICKET_RET_OK &&
decryptRet != WOLFSSL_TICKET_RET_CREATE) {

348
src/ssl.c
View File

@@ -412,50 +412,6 @@ WC_RNG* wolfssl_make_rng(WC_RNG* rng, int* local)
#include <wolfssl/wolfcrypt/hpke.h>
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC)
const WOLF_EC_NIST_NAME kNistCurves[] = {
{XSTR_SIZEOF("P-192"), "P-192", NID_X9_62_prime192v1},
{XSTR_SIZEOF("P-256"), "P-256", NID_X9_62_prime256v1},
{XSTR_SIZEOF("P-112"), "P-112", NID_secp112r1},
{XSTR_SIZEOF("P-112-2"), "P-112-2", NID_secp112r2},
{XSTR_SIZEOF("P-128"), "P-128", NID_secp128r1},
{XSTR_SIZEOF("P-128-2"), "P-128-2", NID_secp128r2},
{XSTR_SIZEOF("P-160"), "P-160", NID_secp160r1},
{XSTR_SIZEOF("P-160-2"), "P-160-2", NID_secp160r2},
{XSTR_SIZEOF("P-224"), "P-224", NID_secp224r1},
{XSTR_SIZEOF("P-384"), "P-384", NID_secp384r1},
{XSTR_SIZEOF("P-521"), "P-521", NID_secp521r1},
{XSTR_SIZEOF("K-160"), "K-160", NID_secp160k1},
{XSTR_SIZEOF("K-192"), "K-192", NID_secp192k1},
{XSTR_SIZEOF("K-224"), "K-224", NID_secp224k1},
{XSTR_SIZEOF("K-256"), "K-256", NID_secp256k1},
{XSTR_SIZEOF("B-160"), "B-160", NID_brainpoolP160r1},
{XSTR_SIZEOF("B-192"), "B-192", NID_brainpoolP192r1},
{XSTR_SIZEOF("B-224"), "B-224", NID_brainpoolP224r1},
{XSTR_SIZEOF("B-256"), "B-256", NID_brainpoolP256r1},
{XSTR_SIZEOF("B-320"), "B-320", NID_brainpoolP320r1},
{XSTR_SIZEOF("B-384"), "B-384", NID_brainpoolP384r1},
{XSTR_SIZEOF("B-512"), "B-512", NID_brainpoolP512r1},
#ifdef HAVE_PQC
{XSTR_SIZEOF("KYBER_LEVEL1"), "KYBER_LEVEL1", WOLFSSL_KYBER_LEVEL1},
{XSTR_SIZEOF("KYBER_LEVEL3"), "KYBER_LEVEL3", WOLFSSL_KYBER_LEVEL3},
{XSTR_SIZEOF("KYBER_LEVEL5"), "KYBER_LEVEL5", WOLFSSL_KYBER_LEVEL5},
#ifdef HAVE_LIBOQS
{XSTR_SIZEOF("P256_KYBER_LEVEL1"), "P256_KYBER_LEVEL1",
WOLFSSL_P256_KYBER_LEVEL1},
{XSTR_SIZEOF("P384_KYBER_LEVEL3"), "P384_KYBER_LEVEL3",
WOLFSSL_P384_KYBER_LEVEL3},
{XSTR_SIZEOF("P521_KYBER_LEVEL5"), "P521_KYBER_LEVEL5",
WOLFSSL_P521_KYBER_LEVEL5},
#endif
#endif
#ifdef WOLFSSL_SM2
{XSTR_SIZEOF("SM2"), "SM2", NID_sm2},
#endif
{0, NULL, 0},
};
#endif
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
/* create the hpke key and ech config to send to clients */
int wolfSSL_CTX_GenerateEchConfig(WOLFSSL_CTX* ctx, const char* publicName,
@@ -2692,6 +2648,7 @@ int wolfSSL_GetOutputSize(WOLFSSL* ssl, int inSz)
#ifdef HAVE_ECC
int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, short keySz)
{
WOLFSSL_ENTER("wolfSSL_CTX_SetMinEccKey_Sz");
if (ctx == NULL || keySz < 0 || keySz % 8 != 0) {
WOLFSSL_MSG("Key size must be divisible by 8 or ctx was null");
return BAD_FUNC_ARG;
@@ -2707,6 +2664,7 @@ int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, short keySz)
int wolfSSL_SetMinEccKey_Sz(WOLFSSL* ssl, short keySz)
{
WOLFSSL_ENTER("wolfSSL_SetMinEccKey_Sz");
if (ssl == NULL || keySz < 0 || keySz % 8 != 0) {
WOLFSSL_MSG("Key size must be divisible by 8 or ssl was null");
return BAD_FUNC_ARG;
@@ -3349,7 +3307,7 @@ int wolfSSL_CTX_UseSupportedCurve(WOLFSSL_CTX* ctx, word16 name)
#endif /* NO_TLS */
}
#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_TLS13)
#if defined(OPENSSL_EXTRA)
int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
int count)
{
@@ -3420,7 +3378,7 @@ int wolfSSL_set1_groups(WOLFSSL* ssl, int* groups, int count)
return wolfSSL_set_groups(ssl, _groups, count) == WOLFSSL_SUCCESS ?
WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
}
#endif /* OPENSSL_EXTRA && WOLFSSL_TLS13 */
#endif /* OPENSSL_EXTRA */
#endif /* HAVE_SUPPORTED_CURVES */
/* Application-Layer Protocol Negotiation */
@@ -7877,6 +7835,8 @@ WOLFSSL_API int wolfSSL_get_negotiated_server_cert_type(WOLFSSL* ssl, int* tp)
/* Set Temp CTX EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz)
{
WOLFSSL_ENTER("wolfSSL_CTX_SetTmpEC_DHE_Sz");
if (ctx == NULL)
return BAD_FUNC_ARG;
@@ -7911,6 +7871,8 @@ int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz)
/* Set Temp SSL EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
int wolfSSL_SetTmpEC_DHE_Sz(WOLFSSL* ssl, word16 sz)
{
WOLFSSL_ENTER("wolfSSL_SetTmpEC_DHE_Sz");
if (ssl == NULL)
return BAD_FUNC_ARG;
@@ -8191,7 +8153,7 @@ int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb cb, void* ctx)
{
WOLFSSL_ENTER("wolfSSL_set_session_secret_cb");
if (ssl == NULL)
return WOLFSSL_FATAL_ERROR;
return WOLFSSL_FAILURE;
ssl->sessionSecretCb = cb;
ssl->sessionSecretCtx = ctx;
@@ -8204,6 +8166,19 @@ int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb cb, void* ctx)
return WOLFSSL_SUCCESS;
}
int wolfSSL_set_session_ticket_ext_cb(WOLFSSL* ssl, TicketParseCb cb,
void *ctx)
{
WOLFSSL_ENTER("wolfSSL_set_session_ticket_ext_cb");
if (ssl == NULL)
return WOLFSSL_FAILURE;
ssl->ticketParseCb = cb;
ssl->ticketParseCtx = ctx;
return WOLFSSL_SUCCESS;
}
int wolfSSL_set_secret_cb(WOLFSSL* ssl, TlsSecretCb cb, void* ctx)
{
WOLFSSL_ENTER("wolfSSL_set_secret_cb");
@@ -15675,6 +15650,24 @@ static long wolf_set_options(long old_op, long op)
return old_op | op;
}
static int FindHashSig(const Suites* suites, byte first, byte second)
{
word16 i;
if (suites == NULL || suites->hashSigAlgoSz == 0) {
WOLFSSL_MSG("Suites pointer error or suiteSz 0");
return SUITES_ERROR;
}
for (i = 0; i < suites->hashSigAlgoSz-1; i += 2) {
if (suites->hashSigAlgo[i] == first &&
suites->hashSigAlgo[i+1] == second )
return i;
}
return MATCH_SUITE_ERROR;
}
long wolfSSL_set_options(WOLFSSL* ssl, long op)
{
word16 haveRSA = 1;
@@ -15690,21 +15683,25 @@ long wolfSSL_set_options(WOLFSSL* ssl, long op)
ssl->options.mask = wolf_set_options(ssl->options.mask, op);
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_3) == WOLFSSL_OP_NO_TLSv1_3) {
WOLFSSL_MSG("Disabling TLS 1.3");
if (ssl->version.minor == TLSv1_3_MINOR)
ssl->version.minor = TLSv1_2_MINOR;
}
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_2) == WOLFSSL_OP_NO_TLSv1_2) {
WOLFSSL_MSG("Disabling TLS 1.2");
if (ssl->version.minor == TLSv1_2_MINOR)
ssl->version.minor = TLSv1_1_MINOR;
}
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_1) == WOLFSSL_OP_NO_TLSv1_1) {
WOLFSSL_MSG("Disabling TLS 1.1");
if (ssl->version.minor == TLSv1_1_MINOR)
ssl->version.minor = TLSv1_MINOR;
}
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1) == WOLFSSL_OP_NO_TLSv1) {
WOLFSSL_MSG("Disabling TLS 1.0");
if (ssl->version.minor == TLSv1_MINOR)
ssl->version.minor = SSLv3_MINOR;
}
@@ -15738,11 +15735,52 @@ long wolfSSL_set_options(WOLFSSL* ssl, long op)
if (ssl->options.side != WOLFSSL_NEITHER_END) {
if (AllocateSuites(ssl) != 0)
return 0;
InitSuites(ssl->suites, ssl->version, keySz, haveRSA, havePSK,
ssl->options.haveDH, ssl->options.haveECDSAsig,
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
ssl->options.useAnon, TRUE, ssl->options.side);
if (!ssl->suites->setSuites) {
InitSuites(ssl->suites, ssl->version, keySz, haveRSA,
havePSK, ssl->options.haveDH, ssl->options.haveECDSAsig,
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
ssl->options.haveFalconSig,
ssl->options.haveDilithiumSig, ssl->options.useAnon,
TRUE, ssl->options.side);
}
else {
/* Only preserve overlapping suites */
Suites tmpSuites;
word16 in, out, haveECDSAsig = 0;
word16 haveStaticECC = ssl->options.haveStaticECC;
#ifdef NO_RSA
haveECDSAsig = 1;
haveStaticECC = 1;
#endif
XMEMSET(&tmpSuites, 0, sizeof(Suites));
/* Get all possible ciphers and sigalgs for the version. Following
* options limit the allowed ciphers so let's try to get as many as
* possible.
* - haveStaticECC turns off haveRSA
* - haveECDSAsig turns off haveRSAsig */
InitSuites(&tmpSuites, ssl->version, 0, 1, 1, 1, haveECDSAsig, 1, 1,
haveStaticECC, 1, 1, 1, 1, ssl->options.side);
for (in = 0, out = 0; in < ssl->suites->suiteSz; in += SUITE_LEN) {
if (FindSuite(&tmpSuites, ssl->suites->suites[in],
ssl->suites->suites[in+1]) >= 0) {
ssl->suites->suites[out] = ssl->suites->suites[in];
ssl->suites->suites[out+1] = ssl->suites->suites[in+1];
out += SUITE_LEN;
}
}
ssl->suites->suiteSz = out;
for (in = 0, out = 0; in < ssl->suites->hashSigAlgoSz; in += 2) {
if (FindHashSig(&tmpSuites, ssl->suites->hashSigAlgo[in],
ssl->suites->hashSigAlgo[in+1]) >= 0) {
ssl->suites->hashSigAlgo[out] =
ssl->suites->hashSigAlgo[in];
ssl->suites->hashSigAlgo[out+1] =
ssl->suites->hashSigAlgo[in+1];
out += 2;
}
}
ssl->suites->hashSigAlgoSz = out;
}
}
return ssl->options.mask;
@@ -17517,80 +17555,22 @@ int wolfSSL_get_peer_signature_type_nid(const WOLFSSL* ssl, int* nid)
#ifdef HAVE_ECC
#if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
static int populate_groups(int* groups, int max_count, const char *list)
{
const char *end;
int count = 0;
const WOLF_EC_NIST_NAME* nist_name;
if (!groups || !list) {
return -1;
}
for (end = list; ; list = ++end) {
int len;
if (count > max_count) {
WOLFSSL_MSG("Too many curves in list");
return -1;
}
while (*end != ':' && *end != '\0') end++;
len = (int)(end - list); /* end points to char after end
* of curve name so no need for -1 */
if ((len < kNistCurves_MIN_NAME_LEN) ||
(len > kNistCurves_MAX_NAME_LEN)) {
WOLFSSL_MSG("Unrecognized curve name in list");
return -1;
}
for (nist_name = kNistCurves; nist_name->name != NULL; nist_name++) {
if (len == nist_name->name_len &&
XSTRNCMP(list, nist_name->name, nist_name->name_len) == 0) {
break;
}
}
if (!nist_name->name) {
WOLFSSL_MSG("Unrecognized curve name in list");
return -1;
}
groups[count++] = nist_name->nid;
if (*end == '\0') break;
}
return count;
}
int wolfSSL_CTX_set1_groups_list(WOLFSSL_CTX *ctx, const char *list)
{
int groups[WOLFSSL_MAX_GROUP_COUNT];
int count = 0;
if (!ctx || !list) {
return WOLFSSL_FAILURE;
}
if ((count = populate_groups(groups,
WOLFSSL_MAX_GROUP_COUNT, list)) == -1) {
return WOLFSSL_FAILURE;
}
return wolfSSL_CTX_set1_groups(ctx, groups, count);
return set_curves_list(NULL, ctx, list, 0);
}
int wolfSSL_set1_groups_list(WOLFSSL *ssl, const char *list)
{
int groups[WOLFSSL_MAX_GROUP_COUNT];
int count = 0;
if (!ssl || !list) {
return WOLFSSL_FAILURE;
}
if ((count = populate_groups(groups,
WOLFSSL_MAX_GROUP_COUNT, list)) == -1) {
return WOLFSSL_FAILURE;
}
return wolfSSL_set1_groups(ssl, groups, count);
return set_curves_list(ssl, NULL, list, 0);
}
#endif /* WOLFSSL_TLS13 */
@@ -21279,25 +21259,82 @@ void wolfSSL_get0_next_proto_negotiated(const WOLFSSL *s,
#if defined(OPENSSL_EXTRA) || defined(HAVE_CURL)
int wolfSSL_curve_is_disabled(const WOLFSSL* ssl, word16 curve_id)
{
if (curve_id >= WOLFSSL_FFDHE_START) {
/* DH parameters are never disabled. */
return 0;
int ret = 0;
WOLFSSL_ENTER("wolfSSL_curve_is_disabled");
WOLFSSL_MSG_EX("wolfSSL_curve_is_disabled checking for %d", curve_id);
/* (curve_id >= WOLFSSL_FFDHE_START) - DH parameters are never disabled. */
if (curve_id < WOLFSSL_FFDHE_START) {
if (curve_id > WOLFSSL_ECC_MAX_AVAIL) {
WOLFSSL_MSG("Curve id out of supported range");
/* Disabled if not in valid range. */
ret = 1;
}
else if (curve_id >= 32) {
/* 0 is for invalid and 1-14 aren't used otherwise. */
ret = (ssl->disabledCurves & (1U << (curve_id - 32))) != 0;
}
else {
ret = (ssl->disabledCurves & (1U << curve_id)) != 0;
}
}
if (curve_id > WOLFSSL_ECC_MAX_AVAIL) {
WOLFSSL_MSG("Curve id out of supported range");
/* Disabled if not in valid range. */
return 1;
}
if (curve_id >= 32) {
/* 0 is for invalid and 1-14 aren't used otherwise. */
return (ssl->disabledCurves & (1U << (curve_id - 32))) != 0;
}
return (ssl->disabledCurves & (1U << curve_id)) != 0;
WOLFSSL_LEAVE("wolfSSL_curve_is_disabled", ret);
return ret;
}
#if (defined(HAVE_ECC) || \
defined(HAVE_CURVE25519) || defined(HAVE_CURVE448))
static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
#define CURVE_NAME(c) XSTR_SIZEOF((c)), (c)
const WOLF_EC_NIST_NAME kNistCurves[] = {
{CURVE_NAME("P-160"), NID_secp160r1, WOLFSSL_ECC_SECP160R1},
{CURVE_NAME("P-160-2"), NID_secp160r2, WOLFSSL_ECC_SECP160R2},
{CURVE_NAME("P-192"), NID_X9_62_prime192v1, WOLFSSL_ECC_SECP192R1},
{CURVE_NAME("P-224"), NID_secp224r1, WOLFSSL_ECC_SECP224R1},
{CURVE_NAME("P-256"), NID_X9_62_prime256v1, WOLFSSL_ECC_SECP256R1},
{CURVE_NAME("P-384"), NID_secp384r1, WOLFSSL_ECC_SECP384R1},
{CURVE_NAME("P-521"), NID_secp521r1, WOLFSSL_ECC_SECP521R1},
{CURVE_NAME("K-160"), NID_secp160k1, WOLFSSL_ECC_SECP160K1},
{CURVE_NAME("K-192"), NID_secp192k1, WOLFSSL_ECC_SECP192K1},
{CURVE_NAME("K-224"), NID_secp224k1, WOLFSSL_ECC_SECP224R1},
{CURVE_NAME("K-256"), NID_secp256k1, WOLFSSL_ECC_SECP256K1},
{CURVE_NAME("B-256"), NID_brainpoolP256r1, WOLFSSL_ECC_BRAINPOOLP256R1},
{CURVE_NAME("B-384"), NID_brainpoolP384r1, WOLFSSL_ECC_BRAINPOOLP384R1},
{CURVE_NAME("B-512"), NID_brainpoolP512r1, WOLFSSL_ECC_BRAINPOOLP512R1},
#ifdef HAVE_CURVE25519
{CURVE_NAME("X25519"), NID_X25519, WOLFSSL_ECC_X25519},
#endif
#ifdef HAVE_CURVE448
{CURVE_NAME("X448"), NID_X448, WOLFSSL_ECC_X448},
#endif
#ifdef HAVE_PQC
{CURVE_NAME("KYBER_LEVEL1"), WOLFSSL_KYBER_LEVEL1, WOLFSSL_KYBER_LEVEL1},
{CURVE_NAME("KYBER_LEVEL3"), WOLFSSL_KYBER_LEVEL3, WOLFSSL_KYBER_LEVEL1},
{CURVE_NAME("KYBER_LEVEL5"), WOLFSSL_KYBER_LEVEL5, WOLFSSL_KYBER_LEVEL1},
#ifdef HAVE_LIBOQS
{CURVE_NAME("P256_KYBER_LEVEL1"), WOLFSSL_P256_KYBER_LEVEL1, WOLFSSL_P256_KYBER_LEVEL1},
{CURVE_NAME("P384_KYBER_LEVEL3"), WOLFSSL_P384_KYBER_LEVEL3, WOLFSSL_P256_KYBER_LEVEL1},
{CURVE_NAME("P521_KYBER_LEVEL5"), WOLFSSL_P521_KYBER_LEVEL5, WOLFSSL_P256_KYBER_LEVEL1},
#endif
#endif
#ifdef WOLFSSL_SM2
{CURVE_NAME("SM2"), NID_sm2, WOLFSSL_ECC_SM2P256V1},
#endif
/* Alternative curve names */
{CURVE_NAME("prime256v1"), NID_X9_62_prime256v1, WOLFSSL_ECC_SECP256R1},
{CURVE_NAME("secp256r1"), NID_X9_62_prime256v1, WOLFSSL_ECC_SECP256R1},
{CURVE_NAME("secp384r1"), NID_secp384r1, WOLFSSL_ECC_SECP384R1},
{CURVE_NAME("secp521r1"), NID_secp521r1, WOLFSSL_ECC_SECP521R1},
#ifdef WOLFSSL_SM2
{CURVE_NAME("sm2p256v1"), NID_sm2, WOLFSSL_ECC_SM2P256V1},
#endif
{0, NULL, 0, 0},
};
int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names,
byte curves_only)
{
int idx, start = 0, len, i, ret = WOLFSSL_FAILURE;
word16 curve;
@@ -21310,6 +21347,7 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
#else
int groups[WOLFSSL_MAX_GROUP_COUNT];
#endif
const WOLF_EC_NIST_NAME* nist_name;
#ifdef WOLFSSL_SMALL_STACK
groups = (int*)XMALLOC(sizeof(int)*WOLFSSL_MAX_GROUP_COUNT,
@@ -21329,45 +21367,18 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
goto leave;
XMEMCPY(name, names + start, len);
name[len++] = 0;
name[len] = 0;
curve = WOLFSSL_NAMED_GROUP_INVALID;
/* Use XSTRNCMP to avoid valgrind error. */
if ((XSTRNCMP(name, "prime256v1", len) == 0) ||
(XSTRNCMP(name, "secp256r1", len) == 0) ||
(XSTRNCMP(name, "P-256", len) == 0))
{
curve = WOLFSSL_ECC_SECP256R1;
for (nist_name = kNistCurves; nist_name->name != NULL; nist_name++) {
if (len == nist_name->name_len &&
XSTRNCMP(name, nist_name->name, len) == 0) {
curve = nist_name->curve;
break;
}
}
else if ((XSTRNCMP(name, "secp384r1", len) == 0) ||
(XSTRNCMP(name, "P-384", len) == 0))
{
curve = WOLFSSL_ECC_SECP384R1;
}
else if ((XSTRNCMP(name, "secp521r1", len) == 0) ||
(XSTRNCMP(name, "P-521", len) == 0))
{
curve = WOLFSSL_ECC_SECP521R1;
}
#ifdef WOLFSSL_SM2
else if ((XSTRNCMP(name, "sm2p256v1", len) == 0) ||
(XSTRNCMP(name, "SM2", len) == 0))
{
curve = WOLFSSL_ECC_SM2P256V1;
}
#endif
#ifdef HAVE_CURVE25519
else if (XSTRNCMP(name, "X25519", len) == 0)
{
curve = WOLFSSL_ECC_X25519;
}
#endif
#ifdef HAVE_CURVE448
else if (XSTRNCMP(name, "X448", len) == 0)
{
curve = WOLFSSL_ECC_X448;
}
#endif
else {
if (curve == WOLFSSL_NAMED_GROUP_INVALID) {
#if !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && defined(HAVE_ECC)
int nret;
const ecc_set_type *eccSet;
@@ -21391,7 +21402,8 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
#endif
}
if (curve >= WOLFSSL_ECC_MAX_AVAIL) {
if ((curves_only && curve >= WOLFSSL_ECC_MAX_AVAIL) ||
curve == WOLFSSL_NAMED_GROUP_INVALID) {
WOLFSSL_MSG("curve value is not supported");
goto leave;
}
@@ -21427,7 +21439,7 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
disabled &= ~(1U << curve);
}
#ifdef HAVE_SUPPORTED_CURVES
#if defined(WOLFSSL_TLS13) && !defined(WOLFSSL_OLD_SET_CURVES_LIST)
#if !defined(WOLFSSL_OLD_SET_CURVES_LIST)
/* using the wolfSSL API to set the groups, this will populate
* (ssl|ctx)->groups and reset any TLSX_SUPPORTED_GROUPS.
* The order in (ssl|ctx)->groups will then be respected
@@ -21468,20 +21480,22 @@ leave:
int wolfSSL_CTX_set1_curves_list(WOLFSSL_CTX* ctx, const char* names)
{
WOLFSSL_ENTER("wolfSSL_CTX_set1_curves_list");
if (ctx == NULL || names == NULL) {
WOLFSSL_MSG("ctx or names was NULL");
return WOLFSSL_FAILURE;
}
return set_curves_list(NULL, ctx, names);
return set_curves_list(NULL, ctx, names, 1);
}
int wolfSSL_set1_curves_list(WOLFSSL* ssl, const char* names)
{
WOLFSSL_ENTER("wolfSSL_set1_curves_list");
if (ssl == NULL || names == NULL) {
WOLFSSL_MSG("ssl or names was NULL");
return WOLFSSL_FAILURE;
}
return set_curves_list(ssl, NULL, names);
return set_curves_list(ssl, NULL, names, 1);
}
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) */
#endif /* OPENSSL_EXTRA || HAVE_CURL */

99
src/tls.c
View File

@@ -300,6 +300,98 @@ ProtocolVersion MakeTLSv1_3(void)
}
#endif
#if defined(HAVE_SUPPORTED_CURVES)
/* Sets the key exchange groups in rank order on a context.
*
* ctx SSL/TLS context object.
* groups Array of groups.
* count Number of groups in array.
* returns BAD_FUNC_ARG when ctx or groups is NULL, not using TLS v1.3 or
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
*/
int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups, int count)
{
int ret, i;
WOLFSSL_ENTER("wolfSSL_CTX_set_groups");
if (ctx == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
return BAD_FUNC_ARG;
if (!IsTLS_ex(ctx->method->version))
return BAD_FUNC_ARG;
#ifdef WOLFSSL_TLS13
ctx->numGroups = 0;
#endif
#if !defined(NO_TLS)
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
#endif /* !NO_TLS */
for (i = 0; i < count; i++) {
/* Call to wolfSSL_CTX_UseSupportedCurve also checks if input groups
* are valid */
if ((ret = wolfSSL_CTX_UseSupportedCurve(ctx, (word16)groups[i]))
!= WOLFSSL_SUCCESS) {
#if !defined(NO_TLS)
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
#endif /* !NO_TLS */
return ret;
}
#ifdef WOLFSSL_TLS13
ctx->group[i] = (word16)groups[i];
#endif
}
#ifdef WOLFSSL_TLS13
ctx->numGroups = (byte)count;
#endif
return WOLFSSL_SUCCESS;
}
/* Sets the key exchange groups in rank order.
*
* ssl SSL/TLS object.
* groups Array of groups.
* count Number of groups in array.
* returns BAD_FUNC_ARG when ssl or groups is NULL, not using TLS v1.3 or
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
*/
int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count)
{
int ret, i;
WOLFSSL_ENTER("wolfSSL_set_groups");
if (ssl == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
return BAD_FUNC_ARG;
if (!IsTLS_ex(ssl->version))
return BAD_FUNC_ARG;
#ifdef WOLFSSL_TLS13
ssl->numGroups = 0;
#endif
#if !defined(NO_TLS)
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
#endif /* !NO_TLS */
for (i = 0; i < count; i++) {
/* Call to wolfSSL_UseSupportedCurve also checks if input groups
* are valid */
if ((ret = wolfSSL_UseSupportedCurve(ssl, (word16)groups[i]))
!= WOLFSSL_SUCCESS) {
#if !defined(NO_TLS)
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
#endif /* !NO_TLS */
return ret;
}
#ifdef WOLFSSL_TLS13
ssl->group[i] = (word16)groups[i];
#endif
}
#ifdef WOLFSSL_TLS13
ssl->numGroups = (byte)count;
#endif
return WOLFSSL_SUCCESS;
}
#endif /* HAVE_SUPPORTED_CURVES */
#ifndef WOLFSSL_NO_TLS12
#ifdef HAVE_EXTENDED_MASTER
@@ -4675,6 +4767,7 @@ int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, byte second,
int ephmSuite = 0;
word16 octets = 0; /* according to 'ecc_set_type ecc_sets[];' */
int key = 0; /* validate key */
int foundCurve = 0; /* Found at least one supported curve */
(void)oid;
@@ -4836,6 +4929,8 @@ int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, byte second,
default: continue; /* unsupported curve */
}
foundCurve = 1;
#ifdef HAVE_ECC
/* Set default Oid */
if (defOid == 0 && ssl->eccTempKeySz <= octets && defSz > octets) {
@@ -4980,6 +5075,10 @@ int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, byte second,
}
}
/* Check we found at least one supported curve */
if (!foundCurve)
return 0;
*ecdhCurveOID = ssl->ecdhCurveOID;
/* Choose the default if it is at the required strength. */
#ifdef HAVE_ECC

88
src/tls13.c
View File

@@ -7633,10 +7633,6 @@ static int SendTls13CertificateRequest(WOLFSSL* ssl, byte* reqCtx,
word32 reqSz;
word16 hashSigAlgoSz = 0;
SignatureAlgorithms* sa;
int haveSig = SIG_RSA | SIG_ECDSA | SIG_FALCON | SIG_DILITHIUM;
#if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
haveSig |= SIG_SM2;
#endif
WOLFSSL_START(WC_FUNC_CERTIFICATE_REQUEST_SEND);
WOLFSSL_ENTER("SendTls13CertificateRequest");
@@ -7647,12 +7643,12 @@ static int SendTls13CertificateRequest(WOLFSSL* ssl, byte* reqCtx,
return SIDE_ERROR;
/* Get the length of the hashSigAlgo buffer */
InitSuitesHashSigAlgo_ex2(NULL, haveSig, 1, ssl->buffers.keySz,
InitSuitesHashSigAlgo(NULL, SIG_ALL, 1, ssl->buffers.keySz,
&hashSigAlgoSz);
sa = TLSX_SignatureAlgorithms_New(ssl, hashSigAlgoSz, ssl->heap);
if (sa == NULL)
return MEMORY_ERROR;
InitSuitesHashSigAlgo_ex2(sa->hashSigAlgo, haveSig, 1, ssl->buffers.keySz,
InitSuitesHashSigAlgo(sa->hashSigAlgo, SIG_ALL, 1, ssl->buffers.keySz,
&hashSigAlgoSz);
ret = TLSX_Push(&ssl->extensions, TLSX_SIGNATURE_ALGORITHMS, sa, ssl->heap);
if (ret != 0) {
@@ -13691,86 +13687,6 @@ int wolfSSL_preferred_group(WOLFSSL* ssl)
}
#endif
#if defined(HAVE_SUPPORTED_CURVES)
/* Sets the key exchange groups in rank order on a context.
*
* ctx SSL/TLS context object.
* groups Array of groups.
* count Number of groups in array.
* returns BAD_FUNC_ARG when ctx or groups is NULL, not using TLS v1.3 or
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
*/
int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups, int count)
{
int ret, i;
WOLFSSL_ENTER("wolfSSL_CTX_set_groups");
if (ctx == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
return BAD_FUNC_ARG;
if (!IsAtLeastTLSv1_3(ctx->method->version))
return BAD_FUNC_ARG;
ctx->numGroups = 0;
#if !defined(NO_TLS)
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
#endif /* !NO_TLS */
for (i = 0; i < count; i++) {
/* Call to wolfSSL_CTX_UseSupportedCurve also checks if input groups
* are valid */
if ((ret = wolfSSL_CTX_UseSupportedCurve(ctx, (word16)groups[i]))
!= WOLFSSL_SUCCESS) {
#if !defined(NO_TLS)
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
#endif /* !NO_TLS */
return ret;
}
ctx->group[i] = (word16)groups[i];
}
ctx->numGroups = (byte)count;
return WOLFSSL_SUCCESS;
}
/* Sets the key exchange groups in rank order.
*
* ssl SSL/TLS object.
* groups Array of groups.
* count Number of groups in array.
* returns BAD_FUNC_ARG when ssl or groups is NULL, not using TLS v1.3 or
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
*/
int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count)
{
int ret, i;
WOLFSSL_ENTER("wolfSSL_set_groups");
if (ssl == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
return BAD_FUNC_ARG;
if (!IsAtLeastTLSv1_3(ssl->version))
return BAD_FUNC_ARG;
ssl->numGroups = 0;
#if !defined(NO_TLS)
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
#endif /* !NO_TLS */
for (i = 0; i < count; i++) {
/* Call to wolfSSL_UseSupportedCurve also checks if input groups
* are valid */
if ((ret = wolfSSL_UseSupportedCurve(ssl, (word16)groups[i]))
!= WOLFSSL_SUCCESS) {
#if !defined(NO_TLS)
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
#endif /* !NO_TLS */
return ret;
}
ssl->group[i] = (word16)groups[i];
}
ssl->numGroups = (byte)count;
return WOLFSSL_SUCCESS;
}
#endif /* HAVE_SUPPORTED_CURVES */
#ifndef NO_PSK
/* Set the PSK callback, that is passed the cipher suite, for a client to use
* against context object.

108
tests/api.c
View File

@@ -40527,6 +40527,89 @@ static int test_wolfSSL_set1_curves_list(void)
return EXPECT_RESULT();
}
#if defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && \
(defined(OPENSSL_EXTRA) || defined(HAVE_CURL)) && defined(HAVE_ECC)
static int test_wolfSSL_curves_mismatch_ctx_ready(WOLFSSL_CTX* ctx)
{
static int counter = 0;
EXPECT_DECLS;
if (counter % 2) {
ExpectIntEQ(wolfSSL_CTX_set1_curves_list(ctx, "P-256"),
WOLFSSL_SUCCESS);
}
else {
ExpectIntEQ(wolfSSL_CTX_set1_curves_list(ctx, "P-384"),
WOLFSSL_SUCCESS);
}
/* Ciphersuites that require curves */
wolfSSL_CTX_set_cipher_list(ctx, "TLS13-AES256-GCM-SHA384:"
"TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES128-GCM-SHA256:"
"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:"
"ECDHE-ECDSA-AES128-GCM-SHA256:"
"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:"
"ECDHE-ECDSA-CHACHA20-POLY1305");
counter++;
return EXPECT_RESULT();
}
#endif
static int test_wolfSSL_curves_mismatch(void)
{
EXPECT_DECLS;
#if defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && \
(defined(OPENSSL_EXTRA) || defined(HAVE_CURL)) && defined(HAVE_ECC)
test_ssl_cbf func_cb_client;
test_ssl_cbf func_cb_server;
size_t i;
struct {
method_provider client_meth;
method_provider server_meth;
const char* desc;
int client_last_err;
int server_last_err;
} test_params[] = {
#ifdef WOLFSSL_TLS13
{wolfTLSv1_3_client_method, wolfTLSv1_3_server_method, "TLS 1.3",
FATAL_ERROR, BAD_KEY_SHARE_DATA},
#endif
#ifndef WOLFSSL_NO_TLS12
{wolfTLSv1_2_client_method, wolfTLSv1_2_server_method, "TLS 1.2",
FATAL_ERROR, MATCH_SUITE_ERROR},
#endif
#ifndef NO_OLD_TLS
{wolfTLSv1_1_client_method, wolfTLSv1_1_server_method, "TLS 1.1",
FATAL_ERROR, MATCH_SUITE_ERROR},
#endif
};
for (i = 0; i < XELEM_CNT(test_params) && !EXPECT_FAIL(); i++) {
XMEMSET(&func_cb_client, 0, sizeof(func_cb_client));
XMEMSET(&func_cb_server, 0, sizeof(func_cb_server));
printf("\tTesting with %s...\n", test_params[i].desc);
func_cb_client.ctx_ready = &test_wolfSSL_curves_mismatch_ctx_ready;
func_cb_server.ctx_ready = &test_wolfSSL_curves_mismatch_ctx_ready;
func_cb_client.method = test_params[i].client_meth;
func_cb_server.method = test_params[i].server_meth;
ExpectIntEQ(test_wolfSSL_client_server_nofail_memio(&func_cb_client,
&func_cb_server, NULL), TEST_FAIL);
ExpectIntEQ(func_cb_client.last_err, test_params[i].client_last_err);
ExpectIntEQ(func_cb_server.last_err, test_params[i].server_last_err);
if (!EXPECT_SUCCESS())
break;
printf("\t%s passed\n", test_params[i].desc);
}
#endif
return EXPECT_RESULT();
}
static int test_wolfSSL_set1_sigalgs_list(void)
{
EXPECT_DECLS;
@@ -47164,7 +47247,7 @@ static int test_wolfSSL_sigalg_info(void)
word16 idx = 0;
int allSigAlgs = SIG_ECDSA | SIG_RSA | SIG_SM2 | SIG_FALCON | SIG_DILITHIUM;
InitSuitesHashSigAlgo_ex2(hashSigAlgo, allSigAlgs, 1, 0xFFFFFFFF, &len);
InitSuitesHashSigAlgo(hashSigAlgo, allSigAlgs, 1, 0xFFFFFFFF, &len);
for (idx = 0; idx < len; idx += 2) {
int hashAlgo = 0;
int sigAlgo = 0;
@@ -47176,7 +47259,7 @@ static int test_wolfSSL_sigalg_info(void)
ExpectIntNE(sigAlgo, 0);
}
InitSuitesHashSigAlgo_ex2(hashSigAlgo, allSigAlgs | SIG_ANON, 1,
InitSuitesHashSigAlgo(hashSigAlgo, allSigAlgs | SIG_ANON, 1,
0xFFFFFFFF, &len);
for (idx = 0; idx < len; idx += 2) {
int hashAlgo = 0;
@@ -55201,15 +55284,21 @@ static int test_tls13_apis(void)
#endif
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC)
char groupList[] =
#ifdef HAVE_CURVE25519
"X25519:"
#endif
#ifdef HAVE_CURVE448
"X448:"
#endif
#ifndef NO_ECC_SECP
#if (defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 521
"P-521:"
"P-521:secp521r1:"
#endif
#if (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 384
"P-384:"
"P-384:secp384r1:"
#endif
#if (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
"P-256"
"P-256:secp256r1"
#if defined(HAVE_PQC) && defined(HAVE_LIBOQS)
":P256_KYBER_LEVEL1"
#endif
@@ -55505,7 +55594,7 @@ static int test_tls13_apis(void)
#ifndef NO_WOLFSSL_CLIENT
#ifndef WOLFSSL_NO_TLS12
ExpectIntEQ(wolfSSL_CTX_set_groups(clientTls12Ctx, groups, numGroups),
BAD_FUNC_ARG);
WOLFSSL_SUCCESS);
#endif
ExpectIntEQ(wolfSSL_CTX_set_groups(clientCtx, groups,
WOLFSSL_MAX_GROUP_COUNT + 1), BAD_FUNC_ARG);
@@ -55529,7 +55618,7 @@ static int test_tls13_apis(void)
#ifndef NO_WOLFSSL_CLIENT
#ifndef WOLFSSL_NO_TLS12
ExpectIntEQ(wolfSSL_set_groups(clientTls12Ssl, groups, numGroups),
BAD_FUNC_ARG);
WOLFSSL_SUCCESS);
#endif
ExpectIntEQ(wolfSSL_set_groups(clientSsl, groups,
WOLFSSL_MAX_GROUP_COUNT + 1), BAD_FUNC_ARG);
@@ -55556,7 +55645,7 @@ static int test_tls13_apis(void)
#ifndef NO_WOLFSSL_CLIENT
#ifndef WOLFSSL_NO_TLS12
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(clientTls12Ctx, groupList),
WOLFSSL_FAILURE);
WOLFSSL_SUCCESS);
#endif
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(clientCtx, groupList),
WOLFSSL_SUCCESS);
@@ -55574,7 +55663,7 @@ static int test_tls13_apis(void)
#ifndef NO_WOLFSSL_CLIENT
#ifndef WOLFSSL_NO_TLS12
ExpectIntEQ(wolfSSL_set1_groups_list(clientTls12Ssl, groupList),
WOLFSSL_FAILURE);
WOLFSSL_SUCCESS);
#endif
ExpectIntEQ(wolfSSL_set1_groups_list(clientSsl, groupList),
WOLFSSL_SUCCESS);
@@ -72416,6 +72505,7 @@ TEST_CASE testCases[] = {
TEST_DECL(test_wolfSSL_configure_args),
TEST_DECL(test_wolfSSL_sk_SSL_CIPHER),
TEST_DECL(test_wolfSSL_set1_curves_list),
TEST_DECL(test_wolfSSL_curves_mismatch),
TEST_DECL(test_wolfSSL_set1_sigalgs_list),
TEST_DECL(test_wolfSSL_OtherName),

16
wolfcrypt/src/kdf.c
View File

@@ -306,6 +306,16 @@ int wc_PRF_TLS(byte* digest, word32 digLen, const byte* secret, word32 secLen,
{
int ret = 0;
#ifdef WOLFSSL_DEBUG_TLS
WOLFSSL_MSG(" secret");
WOLFSSL_BUFFER(secret, secLen);
WOLFSSL_MSG(" label");
WOLFSSL_BUFFER(label, labLen);
WOLFSSL_MSG(" seed");
WOLFSSL_BUFFER(seed, seedLen);
#endif
if (useAtLeastSha256) {
#ifdef WOLFSSL_SMALL_STACK
byte* labelSeed;
@@ -350,6 +360,12 @@ int wc_PRF_TLS(byte* digest, word32 digLen, const byte* secret, word32 secLen,
#endif
}
#ifdef WOLFSSL_DEBUG_TLS
WOLFSSL_MSG(" digest");
WOLFSSL_BUFFER(digest, digLen);
WOLFSSL_MSG_EX("hash_type %d", hash_type);
#endif
return ret;
}
#endif /* WOLFSSL_HAVE_PRF && !NO_HMAC */

32
wolfssl/internal.h
View File

@@ -1773,7 +1773,7 @@ enum Misc {
ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */
#endif
MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */
MAX_CURVE_NAME_SZ = 16, /* Maximum size of curve name string */
MAX_CURVE_NAME_SZ = 18, /* Maximum size of curve name string */
NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */
ED25519_SA_MAJOR = 8, /* Most significant byte for ED25519 */
@@ -2360,16 +2360,8 @@ typedef struct CipherSuite {
#endif
} CipherSuite;
WOLFSSL_LOCAL void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig,
int haveRSAsig, int haveFalconSig,
int haveDilithiumSig, int haveAnon,
int tls1_2, int keySz);
WOLFSSL_LOCAL void InitSuitesHashSigAlgo_ex(byte* hashSigAlgo, int haveECDSAsig,
int haveRSAsig, int haveFalconSig,
int haveDilithiumSig, int haveAnon,
int tls1_2, int keySz, word16* len);
/* use wolfSSL_API visibility to be able to test in tests/api.c */
WOLFSSL_API void InitSuitesHashSigAlgo_ex2(byte* hashSigAlgo, int have,
WOLFSSL_API void InitSuitesHashSigAlgo(byte* hashSigAlgo, int have,
int tls1_2, int keySz,
word16* len);
WOLFSSL_LOCAL int AllocateCtxSuites(WOLFSSL_CTX* ctx);
@@ -4045,13 +4037,16 @@ enum KeyExchangeAlgorithm {
ecc_static_diffie_hellman_kea /* for verify suite only */
};
/* Used with InitSuitesHashSigAlgo_ex2 */
/* Used with InitSuitesHashSigAlgo */
#define SIG_ECDSA 0x01
#define SIG_RSA 0x02
#define SIG_SM2 0x04
#define SIG_FALCON 0x08
#define SIG_DILITHIUM 0x10
#define SIG_ANON 0x20
/* SIG_ANON is omitted by default */
#define SIG_ALL (SIG_ECDSA | SIG_RSA | SIG_SM2 | SIG_FALCON | \
SIG_DILITHIUM)
/* Supported Authentication Schemes */
enum SignatureAlgorithm {
@@ -5874,6 +5869,8 @@ struct WOLFSSL {
#ifdef HAVE_SECRET_CALLBACK
SessionSecretCb sessionSecretCb;
void* sessionSecretCtx;
TicketParseCb ticketParseCb;
void* ticketParseCtx;
TlsSecretCb tlsSecretCb;
void* tlsSecretCtx;
#ifdef WOLFSSL_TLS13
@@ -6125,16 +6122,11 @@ typedef struct {
int name_len;
const char *name;
int nid;
word16 curve;
} WOLF_EC_NIST_NAME;
extern const WOLF_EC_NIST_NAME kNistCurves[];
/* This is the longest and shortest curve name in the kNistCurves list. Note we
* also have quantum-safe group names as well. */
#define kNistCurves_MIN_NAME_LEN 5
#ifdef HAVE_PQC
#define kNistCurves_MAX_NAME_LEN 32
#else
#define kNistCurves_MAX_NAME_LEN 7
#endif
WOLFSSL_LOCAL int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx,
const char* names, byte curves_only);
#endif /* OPENSSL_EXTRA || WOLFSSL_WPAS_SMALL */
/* internal functions */
@@ -6194,6 +6186,7 @@ WOLFSSL_LOCAL int DeriveKeys(WOLFSSL* ssl);
WOLFSSL_LOCAL int StoreKeys(WOLFSSL* ssl, const byte* keyData, int side);
WOLFSSL_LOCAL int IsTLS(const WOLFSSL* ssl);
WOLFSSL_LOCAL int IsTLS_ex(const ProtocolVersion pv);
WOLFSSL_LOCAL int IsAtLeastTLSv1_2(const WOLFSSL* ssl);
WOLFSSL_LOCAL int IsAtLeastTLSv1_3(ProtocolVersion pv);
WOLFSSL_LOCAL int IsEncryptionOn(const WOLFSSL* ssl, int isSend);
@@ -6422,6 +6415,7 @@ WOLFSSL_LOCAL int cipherExtraData(WOLFSSL* ssl);
WOLFSSL_LOCAL word32 LowResTimer(void);
WOLFSSL_LOCAL int FindSuiteSSL(const WOLFSSL* ssl, byte* suite);
WOLFSSL_LOCAL int FindSuite(const Suites* suites, byte first, byte second);
WOLFSSL_LOCAL void DecodeSigAlg(const byte* input, byte* hashAlgo,
byte* hsType);

6
wolfssl/openssl/ec.h
View File

@@ -74,9 +74,15 @@ enum {
#ifdef HAVE_ED448
NID_ED448 = ED448k,
#endif
#ifdef HAVE_CURVE448
NID_X448 = X448k,
#endif
#ifdef HAVE_ED25519
NID_ED25519 = ED25519k,
#endif
#ifdef HAVE_CURVE25519
NID_X25519 = X25519k,
#endif
OPENSSL_EC_EXPLICIT_CURVE = 0x000,
OPENSSL_EC_NAMED_CURVE = 0x001,

37
wolfssl/ssl.h
View File

@@ -1182,6 +1182,21 @@ WOLFSSL_API int wolfSSL_peek(WOLFSSL* ssl, void* data, int sz);
WOLFSSL_ABI WOLFSSL_API int wolfSSL_accept(WOLFSSL* ssl);
WOLFSSL_API int wolfSSL_CTX_mutual_auth(WOLFSSL_CTX* ctx, int req);
WOLFSSL_API int wolfSSL_mutual_auth(WOLFSSL* ssl, int req);
WOLFSSL_API int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups,
int count);
WOLFSSL_API int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count);
#if defined(OPENSSL_EXTRA) && defined(HAVE_SUPPORTED_CURVES)
WOLFSSL_API int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
int count);
WOLFSSL_API int wolfSSL_set1_groups(WOLFSSL* ssl, int* groups, int count);
#ifdef HAVE_ECC
WOLFSSL_API int wolfSSL_CTX_set1_groups_list(WOLFSSL_CTX *ctx, const char *list);
WOLFSSL_API int wolfSSL_set1_groups_list(WOLFSSL *ssl, const char *list);
#endif
#endif
#ifdef WOLFSSL_TLS13
WOLFSSL_API int wolfSSL_send_hrr_cookie(WOLFSSL* ssl,
const unsigned char* secret, unsigned int secretSz);
@@ -1199,20 +1214,6 @@ WOLFSSL_API int wolfSSL_allow_post_handshake_auth(WOLFSSL* ssl);
WOLFSSL_API int wolfSSL_request_certificate(WOLFSSL* ssl);
WOLFSSL_API int wolfSSL_preferred_group(WOLFSSL* ssl);
WOLFSSL_API int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups,
int count);
WOLFSSL_API int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count);
#if defined(OPENSSL_EXTRA) && defined(HAVE_SUPPORTED_CURVES)
WOLFSSL_API int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
int count);
WOLFSSL_API int wolfSSL_set1_groups(WOLFSSL* ssl, int* groups, int count);
#ifdef HAVE_ECC
WOLFSSL_API int wolfSSL_CTX_set1_groups_list(WOLFSSL_CTX *ctx, const char *list);
WOLFSSL_API int wolfSSL_set1_groups_list(WOLFSSL *ssl, const char *list);
#endif
#endif
WOLFSSL_API int wolfSSL_connect_TLSv13(WOLFSSL* ssl);
WOLFSSL_API int wolfSSL_accept_TLSv13(WOLFSSL* ssl);
@@ -1367,8 +1368,12 @@ WOLFSSL_ABI WOLFSSL_API long wolfSSL_CTX_set_session_cache_mode(WOLFSSL_CTX* ctx
typedef int (*SessionSecretCb)(WOLFSSL* ssl, void* secret, int* secretSz,
void* ctx);
/* This callback is used to set the master secret during resumption */
WOLFSSL_API int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb,
void*);
WOLFSSL_API int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb cb,
void* ctx);
typedef int (*TicketParseCb)(WOLFSSL *ssl, const unsigned char *data,
int len, void *ctx);
WOLFSSL_API int wolfSSL_set_session_ticket_ext_cb(WOLFSSL* ssl,
TicketParseCb cb, void *ctx);
typedef int (*TlsSecretCb)(WOLFSSL* ssl, void* secret, int secretSz,
void* ctx);
/* This callback is used to log the secret for TLS <= 1.2 */