mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2025-08-04 05:04:41 +02:00
David Garske
GitHub
122
.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/hostapd.config
vendored
Normal file
122
.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/hostapd.config
vendored
Normal file
@@ -0,0 +1,122 @@
|
|||||||
|
#CC=ccache gcc
|
||||||
|
|
||||||
|
CONFIG_DRIVER_NONE=y
|
||||||
|
CONFIG_DRIVER_NL80211=y
|
||||||
|
CONFIG_RSN_PREAUTH=y
|
||||||
|
|
||||||
|
#CONFIG_TLS=internal
|
||||||
|
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||||
|
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||||
|
#CONFIG_TLS=openssl
|
||||||
|
CONFIG_TLS=wolfssl
|
||||||
|
|
||||||
|
CONFIG_EAP=y
|
||||||
|
CONFIG_ERP=y
|
||||||
|
CONFIG_EAP_MD5=y
|
||||||
|
CONFIG_EAP_TLS=y
|
||||||
|
CONFIG_EAP_MSCHAPV2=y
|
||||||
|
CONFIG_EAP_PEAP=y
|
||||||
|
CONFIG_EAP_GTC=y
|
||||||
|
CONFIG_EAP_TTLS=y
|
||||||
|
CONFIG_EAP_SIM=y
|
||||||
|
CONFIG_EAP_AKA=y
|
||||||
|
CONFIG_EAP_AKA_PRIME=y
|
||||||
|
CONFIG_EAP_GPSK=y
|
||||||
|
CONFIG_EAP_GPSK_SHA256=y
|
||||||
|
CONFIG_EAP_SAKE=y
|
||||||
|
CONFIG_EAP_PAX=y
|
||||||
|
CONFIG_EAP_PSK=y
|
||||||
|
CONFIG_EAP_VENDOR_TEST=y
|
||||||
|
CONFIG_EAP_FAST=y
|
||||||
|
CONFIG_EAP_TEAP=y
|
||||||
|
CONFIG_EAP_IKEV2=y
|
||||||
|
CONFIG_EAP_TNC=y
|
||||||
|
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||||
|
LIBS += -rdynamic
|
||||||
|
CONFIG_EAP_UNAUTH_TLS=y
|
||||||
|
ifeq ($(CONFIG_TLS), openssl)
|
||||||
|
CONFIG_EAP_PWD=y
|
||||||
|
endif
|
||||||
|
ifeq ($(CONFIG_TLS), wolfssl)
|
||||||
|
CONFIG_EAP_PWD=y
|
||||||
|
endif
|
||||||
|
CONFIG_EAP_EKE=y
|
||||||
|
CONFIG_PKCS12=y
|
||||||
|
CONFIG_RADIUS_SERVER=y
|
||||||
|
CONFIG_IPV6=y
|
||||||
|
CONFIG_TLSV11=y
|
||||||
|
CONFIG_TLSV12=y
|
||||||
|
|
||||||
|
CONFIG_FULL_DYNAMIC_VLAN=y
|
||||||
|
CONFIG_VLAN_NETLINK=y
|
||||||
|
CONFIG_LIBNL32=y
|
||||||
|
CONFIG_LIBNL3_ROUTE=y
|
||||||
|
CONFIG_IEEE80211R=y
|
||||||
|
CONFIG_IEEE80211AC=y
|
||||||
|
CONFIG_IEEE80211AX=y
|
||||||
|
|
||||||
|
CONFIG_OCV=y
|
||||||
|
|
||||||
|
CONFIG_WPS=y
|
||||||
|
CONFIG_WPS_UPNP=y
|
||||||
|
CONFIG_WPS_NFC=y
|
||||||
|
#CONFIG_WPS_STRICT=y
|
||||||
|
CONFIG_WPA_TRACE=y
|
||||||
|
CONFIG_WPA_TRACE_BFD=y
|
||||||
|
|
||||||
|
CONFIG_P2P_MANAGER=y
|
||||||
|
CONFIG_DEBUG_FILE=y
|
||||||
|
CONFIG_DEBUG_LINUX_TRACING=y
|
||||||
|
CONFIG_WPA_CLI_EDIT=y
|
||||||
|
CONFIG_ACS=y
|
||||||
|
CONFIG_NO_RANDOM_POOL=y
|
||||||
|
CONFIG_WNM=y
|
||||||
|
CONFIG_INTERWORKING=y
|
||||||
|
CONFIG_HS20=y
|
||||||
|
CONFIG_SQLITE=y
|
||||||
|
CONFIG_SAE=y
|
||||||
|
CONFIG_SAE_PK=y
|
||||||
|
CFLAGS += -DALL_DH_GROUPS
|
||||||
|
|
||||||
|
CONFIG_FST=y
|
||||||
|
CONFIG_FST_TEST=y
|
||||||
|
|
||||||
|
CONFIG_TESTING_OPTIONS=y
|
||||||
|
CFLAGS += -DCONFIG_RADIUS_TEST
|
||||||
|
CONFIG_MODULE_TESTS=y
|
||||||
|
|
||||||
|
CONFIG_SUITEB=y
|
||||||
|
CONFIG_SUITEB192=y
|
||||||
|
|
||||||
|
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||||
|
# This can be used as a more efficient memory error detector than valgrind
|
||||||
|
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||||
|
# memory allocated for the guest).
|
||||||
|
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||||
|
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||||
|
#LIBS_h += -fsanitize=address -fno-omit-frame-pointer -g
|
||||||
|
#LIBS_n += -fsanitize=address -fno-omit-frame-pointer -g
|
||||||
|
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||||
|
|
||||||
|
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||||
|
# following lines.
|
||||||
|
#CFLAGS += -Wno-format-nonliteral
|
||||||
|
#CFLAGS += -fsanitize=undefined
|
||||||
|
##CFLAGS += -fno-sanitize-recover
|
||||||
|
#LIBS += -fsanitize=undefined
|
||||||
|
##LIBS += -fno-sanitize-recover
|
||||||
|
#LIBS_h += -fsanitize=undefined
|
||||||
|
#LIBS_n += -fsanitize=undefined
|
||||||
|
#LIBS_c += -fsanitize=undefined
|
||||||
|
CONFIG_MBO=y
|
||||||
|
|
||||||
|
CONFIG_TAXONOMY=y
|
||||||
|
CONFIG_FILS=y
|
||||||
|
CONFIG_FILS_SK_PFS=y
|
||||||
|
CONFIG_OWE=y
|
||||||
|
CONFIG_DPP=y
|
||||||
|
CONFIG_DPP2=y
|
||||||
|
CONFIG_WEP=y
|
||||||
|
CONFIG_PASN=y
|
||||||
|
CONFIG_AIRTIME_POLICY=y
|
||||||
|
CONFIG_IEEE80211BE=y
|
||||||
1677
.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/tests
vendored
Normal file
1677
.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/tests
vendored
Normal file
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,164 @@
|
|||||||
|
#CC=ccache gcc
|
||||||
|
|
||||||
|
#CONFIG_TLS=openssl
|
||||||
|
CONFIG_TLS=wolfssl
|
||||||
|
#CONFIG_TLS=internal
|
||||||
|
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||||
|
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||||
|
|
||||||
|
CONFIG_IEEE8021X_EAPOL=y
|
||||||
|
|
||||||
|
CONFIG_ERP=y
|
||||||
|
CONFIG_EAP_MD5=y
|
||||||
|
CONFIG_MSCHAPV2=y
|
||||||
|
CONFIG_EAP_TLS=y
|
||||||
|
CONFIG_EAP_PEAP=y
|
||||||
|
CONFIG_EAP_TTLS=y
|
||||||
|
CONFIG_EAP_GTC=y
|
||||||
|
CONFIG_EAP_OTP=y
|
||||||
|
CONFIG_EAP_PSK=y
|
||||||
|
CONFIG_EAP_PAX=y
|
||||||
|
CONFIG_EAP_LEAP=y
|
||||||
|
CONFIG_EAP_SIM=y
|
||||||
|
CONFIG_EAP_AKA=y
|
||||||
|
CONFIG_EAP_AKA_PRIME=y
|
||||||
|
CONFIG_EAP_VENDOR_TEST=y
|
||||||
|
CONFIG_EAP_TLV=y
|
||||||
|
CONFIG_EAP_SAKE=y
|
||||||
|
CONFIG_EAP_GPSK=y
|
||||||
|
CONFIG_EAP_GPSK_SHA256=y
|
||||||
|
CONFIG_EAP_EKE=y
|
||||||
|
CONFIG_EAP_TNC=y
|
||||||
|
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||||
|
LIBS += -rdynamic
|
||||||
|
CONFIG_EAP_FAST=y
|
||||||
|
CONFIG_EAP_TEAP=y
|
||||||
|
CONFIG_EAP_IKEV2=y
|
||||||
|
|
||||||
|
ifeq ($(CONFIG_TLS), openssl)
|
||||||
|
CONFIG_EAP_PWD=y
|
||||||
|
endif
|
||||||
|
ifeq ($(CONFIG_TLS), wolfssl)
|
||||||
|
CONFIG_EAP_PWD=y
|
||||||
|
endif
|
||||||
|
|
||||||
|
CONFIG_USIM_SIMULATOR=y
|
||||||
|
CONFIG_SIM_SIMULATOR=y
|
||||||
|
|
||||||
|
#CONFIG_PCSC=y
|
||||||
|
CONFIG_IPV6=y
|
||||||
|
CONFIG_DRIVER_NONE=y
|
||||||
|
CONFIG_PKCS12=y
|
||||||
|
CONFIG_CTRL_IFACE=unix
|
||||||
|
|
||||||
|
CONFIG_WPA_CLI_EDIT=y
|
||||||
|
|
||||||
|
CONFIG_OCSP=y
|
||||||
|
|
||||||
|
#CONFIG_ELOOP_POLL=y
|
||||||
|
|
||||||
|
CONFIG_CTRL_IFACE_DBUS_NEW=y
|
||||||
|
CONFIG_CTRL_IFACE_DBUS_INTRO=y
|
||||||
|
|
||||||
|
CONFIG_IEEE80211R=y
|
||||||
|
CONFIG_IEEE80211AC=y
|
||||||
|
CONFIG_IEEE80211AX=y
|
||||||
|
|
||||||
|
CONFIG_OCV=y
|
||||||
|
|
||||||
|
CONFIG_DEBUG_FILE=y
|
||||||
|
|
||||||
|
CONFIG_WPS=y
|
||||||
|
#CONFIG_WPS_STRICT=y
|
||||||
|
CONFIG_WPS_UPNP=y
|
||||||
|
CONFIG_WPS_NFC=y
|
||||||
|
CONFIG_WPS_ER=y
|
||||||
|
#CONFIG_WPS_REG_DISABLE_OPEN=y
|
||||||
|
|
||||||
|
CONFIG_DRIVER_WEXT=y
|
||||||
|
|
||||||
|
CONFIG_DRIVER_NL80211=y
|
||||||
|
CFLAGS += -I/usr/include/libnl3
|
||||||
|
CONFIG_LIBNL32=y
|
||||||
|
|
||||||
|
CONFIG_IBSS_RSN=y
|
||||||
|
|
||||||
|
CONFIG_AP=y
|
||||||
|
CONFIG_MESH=y
|
||||||
|
CONFIG_P2P=y
|
||||||
|
CONFIG_WIFI_DISPLAY=y
|
||||||
|
|
||||||
|
CONFIG_ACS=y
|
||||||
|
|
||||||
|
CONFIG_BGSCAN_SIMPLE=y
|
||||||
|
CONFIG_BGSCAN_LEARN=y
|
||||||
|
|
||||||
|
CONFIG_WPA_TRACE=y
|
||||||
|
CONFIG_WPA_TRACE_BFD=y
|
||||||
|
|
||||||
|
CONFIG_TDLS=y
|
||||||
|
CONFIG_TDLS_TESTING=y
|
||||||
|
CONFIG_NO_RANDOM_POOL=y
|
||||||
|
|
||||||
|
CONFIG_TLSV11=y
|
||||||
|
CONFIG_TLSV12=y
|
||||||
|
|
||||||
|
CONFIG_HT_OVERRIDES=y
|
||||||
|
CONFIG_VHT_OVERRIDES=y
|
||||||
|
CONFIG_HE_OVERRIDES=y
|
||||||
|
|
||||||
|
CONFIG_DEBUG_LINUX_TRACING=y
|
||||||
|
|
||||||
|
CONFIG_INTERWORKING=y
|
||||||
|
CONFIG_HS20=y
|
||||||
|
|
||||||
|
CONFIG_AUTOSCAN_EXPONENTIAL=y
|
||||||
|
CONFIG_AUTOSCAN_PERIODIC=y
|
||||||
|
|
||||||
|
CONFIG_EXT_PASSWORD_TEST=y
|
||||||
|
CONFIG_EXT_PASSWORD_FILE=y
|
||||||
|
|
||||||
|
CONFIG_EAP_UNAUTH_TLS=y
|
||||||
|
|
||||||
|
CONFIG_SAE=y
|
||||||
|
CONFIG_SAE_PK=y
|
||||||
|
CFLAGS += -DALL_DH_GROUPS
|
||||||
|
|
||||||
|
CONFIG_WNM=y
|
||||||
|
|
||||||
|
CONFIG_FST=y
|
||||||
|
CONFIG_FST_TEST=y
|
||||||
|
|
||||||
|
CONFIG_TESTING_OPTIONS=y
|
||||||
|
CONFIG_MODULE_TESTS=y
|
||||||
|
|
||||||
|
CONFIG_SUITEB=y
|
||||||
|
CONFIG_SUITEB192=y
|
||||||
|
|
||||||
|
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||||
|
# This can be used as a more efficient memory error detector than valgrind
|
||||||
|
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||||
|
# memory allocated for the guest).
|
||||||
|
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||||
|
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||||
|
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||||
|
#LIBS_p += -fsanitize=address -fno-omit-frame-pointer -g
|
||||||
|
|
||||||
|
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||||
|
# following lines.
|
||||||
|
#CFLAGS += -Wno-format-nonliteral
|
||||||
|
#CFLAGS += -fsanitize=undefined
|
||||||
|
##CFLAGS += -fno-sanitize-recover
|
||||||
|
#LIBS += -fsanitize=undefined
|
||||||
|
##LIBS += -fno-sanitize-recover
|
||||||
|
#LIBS_c += -fsanitize=undefined
|
||||||
|
#LIBS_p += -fsanitize=undefined
|
||||||
|
CONFIG_MBO=y
|
||||||
|
CONFIG_FILS=y
|
||||||
|
CONFIG_FILS_SK_PFS=y
|
||||||
|
CONFIG_PMKSA_CACHE_EXTERNAL=y
|
||||||
|
CONFIG_OWE=y
|
||||||
|
CONFIG_DPP=y
|
||||||
|
CONFIG_DPP2=y
|
||||||
|
CONFIG_WEP=y
|
||||||
|
CONFIG_PASN=y
|
||||||
@@ -191,13 +191,7 @@ ap_wpa2_psk_supp_proto_no_gtk_in_group_msg
|
|||||||
ap_wpa2_psk_supp_proto_too_long_gtk_in_group_msg
|
ap_wpa2_psk_supp_proto_too_long_gtk_in_group_msg
|
||||||
ap_wpa2_psk_supp_proto_too_long_gtk_kde
|
ap_wpa2_psk_supp_proto_too_long_gtk_kde
|
||||||
ap_wpa2_psk_supp_proto_gtk_not_encrypted
|
ap_wpa2_psk_supp_proto_gtk_not_encrypted
|
||||||
ap_wpa2_psk_supp_proto_no_igtk
|
|
||||||
ap_wpa2_psk_supp_proto_igtk_ok
|
|
||||||
ap_wpa2_psk_supp_proto_igtk_keyid_swap
|
|
||||||
ap_wpa2_psk_supp_proto_igtk_keyid_too_large
|
|
||||||
ap_wpa2_psk_supp_proto_igtk_keyid_unexpected
|
|
||||||
ap_wpa2_psk_wep
|
ap_wpa2_psk_wep
|
||||||
ap_wpa2_psk_ifdown
|
|
||||||
ap_wpa2_psk_drop_first_msg_4
|
ap_wpa2_psk_drop_first_msg_4
|
||||||
ap_wpa2_psk_disable_enable
|
ap_wpa2_psk_disable_enable
|
||||||
ap_wpa2_psk_incorrect_passphrase
|
ap_wpa2_psk_incorrect_passphrase
|
||||||
@@ -210,10 +204,7 @@ ap_wpa2_disable_eapol_retry
|
|||||||
ap_wpa2_disable_eapol_retry_group
|
ap_wpa2_disable_eapol_retry_group
|
||||||
ap_wpa2_psk_mic_0
|
ap_wpa2_psk_mic_0
|
||||||
ap_wpa2_psk_local_error
|
ap_wpa2_psk_local_error
|
||||||
ap_wpa2_psk_inject_assoc
|
|
||||||
ap_wpa2_psk_no_control_port
|
|
||||||
ap_wpa2_psk_ap_control_port
|
ap_wpa2_psk_ap_control_port
|
||||||
ap_wpa2_psk_ap_control_port_disabled
|
|
||||||
ap_wpa2_psk_rsne_mismatch_ap
|
ap_wpa2_psk_rsne_mismatch_ap
|
||||||
ap_wpa2_psk_rsne_mismatch_ap2
|
ap_wpa2_psk_rsne_mismatch_ap2
|
||||||
ap_wpa2_psk_rsne_mismatch_ap3
|
ap_wpa2_psk_rsne_mismatch_ap3
|
||||||
@@ -253,10 +244,8 @@ ap_wpa2_eap_aka_sql
|
|||||||
ap_wpa2_eap_aka_config
|
ap_wpa2_eap_aka_config
|
||||||
ap_wpa2_eap_aka_ext
|
ap_wpa2_eap_aka_ext
|
||||||
ap_wpa2_eap_aka_ext_auth_fail
|
ap_wpa2_eap_aka_ext_auth_fail
|
||||||
ap_wpa2_eap_aka_prime
|
|
||||||
ap_wpa2_eap_aka_prime_imsi_identity
|
ap_wpa2_eap_aka_prime_imsi_identity
|
||||||
ap_wpa2_eap_aka_prime_imsi_privacy_key
|
ap_wpa2_eap_aka_prime_imsi_privacy_key
|
||||||
ap_wpa2_eap_aka_prime_sql
|
|
||||||
ap_wpa2_eap_aka_prime_ext_auth_fail
|
ap_wpa2_eap_aka_prime_ext_auth_fail
|
||||||
ap_wpa2_eap_aka_prime_ext
|
ap_wpa2_eap_aka_prime_ext
|
||||||
ap_wpa2_eap_ttls_pap
|
ap_wpa2_eap_ttls_pap
|
||||||
@@ -416,19 +405,6 @@ ap_wpa2_radius_server_get_id
|
|||||||
ap_wpa2_eap_tls_tod
|
ap_wpa2_eap_tls_tod
|
||||||
ap_wpa2_eap_tls_tod_tofu
|
ap_wpa2_eap_tls_tod_tofu
|
||||||
ap_wpa2_eap_sake_no_control_port
|
ap_wpa2_eap_sake_no_control_port
|
||||||
ap_wpa2_tdls
|
|
||||||
ap_wpa2_tdls_concurrent_init
|
|
||||||
ap_wpa2_tdls_concurrent_init2
|
|
||||||
ap_wpa2_tdls_decline_resp
|
|
||||||
ap_wpa2_tdls_long_lifetime
|
|
||||||
ap_wpa2_tdls_long_frame
|
|
||||||
ap_wpa2_tdls_reneg
|
|
||||||
ap_wpa2_tdls_wrong_lifetime_resp
|
|
||||||
ap_wpa2_tdls_diff_rsnie
|
|
||||||
ap_wpa2_tdls_wrong_tpk_m2_mic
|
|
||||||
ap_wpa2_tdls_wrong_tpk_m3_mic
|
|
||||||
ap_wpa2_tdls_double_tpk_m2
|
|
||||||
ap_wpa2_tdls_responder_teardown
|
|
||||||
dpp_network_intro_version
|
dpp_network_intro_version
|
||||||
dpp_network_intro_version_change
|
dpp_network_intro_version_change
|
||||||
dpp_network_intro_version_missing_req
|
dpp_network_intro_version_missing_req
|
||||||
@@ -459,12 +435,9 @@ dpp_qr_code_curves
|
|||||||
dpp_qr_code_curves_brainpool
|
dpp_qr_code_curves_brainpool
|
||||||
dpp_qr_code_unsupported_curve
|
dpp_qr_code_unsupported_curve
|
||||||
dpp_qr_code_keygen_fail
|
dpp_qr_code_keygen_fail
|
||||||
dpp_qr_code_curve_select
|
|
||||||
dpp_qr_code_auth_broadcast
|
dpp_qr_code_auth_broadcast
|
||||||
dpp_configurator_enrollee
|
|
||||||
dpp_configurator_enrollee_prime256v1
|
dpp_configurator_enrollee_prime256v1
|
||||||
dpp_configurator_enrollee_secp384r1
|
dpp_configurator_enrollee_secp384r1
|
||||||
dpp_configurator_enrollee_secp521r1
|
|
||||||
dpp_configurator_enrollee_brainpoolP256r1
|
dpp_configurator_enrollee_brainpoolP256r1
|
||||||
dpp_configurator_enrollee_brainpoolP384r1
|
dpp_configurator_enrollee_brainpoolP384r1
|
||||||
dpp_configurator_enrollee_brainpoolP512r1
|
dpp_configurator_enrollee_brainpoolP512r1
|
||||||
@@ -477,7 +450,6 @@ dpp_qr_code_curve_brainpoolP384r1
|
|||||||
dpp_qr_code_curve_brainpoolP512r1
|
dpp_qr_code_curve_brainpoolP512r1
|
||||||
dpp_qr_code_set_key
|
dpp_qr_code_set_key
|
||||||
dpp_qr_code_auth_mutual
|
dpp_qr_code_auth_mutual
|
||||||
dpp_qr_code_auth_mutual2
|
|
||||||
dpp_qr_code_auth_mutual_p_256
|
dpp_qr_code_auth_mutual_p_256
|
||||||
dpp_qr_code_auth_mutual_p_384
|
dpp_qr_code_auth_mutual_p_384
|
||||||
dpp_qr_code_auth_mutual_p_521
|
dpp_qr_code_auth_mutual_p_521
|
||||||
@@ -514,13 +486,11 @@ dpp_config_no_signed_connector
|
|||||||
dpp_config_unexpected_signed_connector_char
|
dpp_config_unexpected_signed_connector_char
|
||||||
dpp_config_root_not_an_object
|
dpp_config_root_not_an_object
|
||||||
dpp_config_no_wi_fi_tech
|
dpp_config_no_wi_fi_tech
|
||||||
dpp_config_unsupported_wi_fi_tech
|
|
||||||
dpp_config_no_discovery
|
dpp_config_no_discovery
|
||||||
dpp_config_no_discovery_ssid
|
dpp_config_no_discovery_ssid
|
||||||
dpp_config_too_long_discovery_ssid
|
dpp_config_too_long_discovery_ssid
|
||||||
dpp_config_no_cred
|
dpp_config_no_cred
|
||||||
dpp_config_no_cred_akm
|
dpp_config_no_cred_akm
|
||||||
dpp_config_unsupported_cred_akm
|
|
||||||
dpp_config_error_legacy_no_pass
|
dpp_config_error_legacy_no_pass
|
||||||
dpp_config_error_legacy_too_long_pass
|
dpp_config_error_legacy_too_long_pass
|
||||||
dpp_config_error_legacy_psk_with_sae
|
dpp_config_error_legacy_psk_with_sae
|
||||||
@@ -531,13 +501,10 @@ dpp_config_connector_error_ext_sign
|
|||||||
dpp_config_connector_error_too_short_timestamp
|
dpp_config_connector_error_too_short_timestamp
|
||||||
dpp_config_connector_error_invalid_timestamp
|
dpp_config_connector_error_invalid_timestamp
|
||||||
dpp_config_connector_error_invalid_timestamp_date
|
dpp_config_connector_error_invalid_timestamp_date
|
||||||
dpp_config_connector_error_invalid_time_zone
|
|
||||||
dpp_config_connector_error_invalid_time_zone_2
|
|
||||||
dpp_config_connector_error_expired_1
|
dpp_config_connector_error_expired_1
|
||||||
dpp_config_connector_error_expired_2
|
dpp_config_connector_error_expired_2
|
||||||
dpp_config_connector_error_expired_3
|
dpp_config_connector_error_expired_3
|
||||||
dpp_config_connector_error_expired_4
|
dpp_config_connector_error_expired_4
|
||||||
dpp_config_connector_error_expired_5
|
|
||||||
dpp_config_connector_error_expired_6
|
dpp_config_connector_error_expired_6
|
||||||
dpp_config_connector_error_no_groups
|
dpp_config_connector_error_no_groups
|
||||||
dpp_config_connector_error_empty_groups
|
dpp_config_connector_error_empty_groups
|
||||||
@@ -565,13 +532,6 @@ dpp_ap_config_p256_bp256
|
|||||||
dpp_ap_config_bp256_p256
|
dpp_ap_config_bp256_p256
|
||||||
dpp_ap_config_p521_bp512
|
dpp_ap_config_p521_bp512
|
||||||
dpp_ap_config_reconfig_configurator
|
dpp_ap_config_reconfig_configurator
|
||||||
dpp_auto_connect_1
|
|
||||||
dpp_auto_connect_2
|
|
||||||
dpp_auto_connect_2_connect_cmd
|
|
||||||
dpp_auto_connect_2_sta_ver1
|
|
||||||
dpp_auto_connect_2_ap_ver1
|
|
||||||
dpp_auto_connect_2_ver1
|
|
||||||
dpp_auto_connect_2_conf_ver1
|
|
||||||
dpp_auto_connect_legacy
|
dpp_auto_connect_legacy
|
||||||
dpp_auto_connect_legacy_ssid_charset
|
dpp_auto_connect_legacy_ssid_charset
|
||||||
dpp_auto_connect_legacy_sae_1
|
dpp_auto_connect_legacy_sae_1
|
||||||
@@ -580,13 +540,6 @@ dpp_auto_connect_legacy_psk_sae_1
|
|||||||
dpp_auto_connect_legacy_psk_sae_2
|
dpp_auto_connect_legacy_psk_sae_2
|
||||||
dpp_auto_connect_legacy_psk_sae_3
|
dpp_auto_connect_legacy_psk_sae_3
|
||||||
dpp_auto_connect_legacy_pmf_required
|
dpp_auto_connect_legacy_pmf_required
|
||||||
dpp_qr_code_auth_responder_configurator
|
|
||||||
dpp_qr_code_auth_responder_configurator_group_id
|
|
||||||
dpp_qr_code_auth_enrollee_init_netrole
|
|
||||||
dpp_qr_code_hostapd_init
|
|
||||||
dpp_qr_code_hostapd_init_offchannel
|
|
||||||
dpp_qr_code_hostapd_init_offchannel_neg_freq
|
|
||||||
dpp_qr_code_hostapd_ignore_mismatch
|
|
||||||
dpp_test_vector_p_256
|
dpp_test_vector_p_256
|
||||||
dpp_test_vector_p_256_b
|
dpp_test_vector_p_256_b
|
||||||
dpp_test_vector_p_521
|
dpp_test_vector_p_521
|
||||||
@@ -603,7 +556,6 @@ dpp_pkex_no_identifier
|
|||||||
dpp_pkex_identifier_mismatch
|
dpp_pkex_identifier_mismatch
|
||||||
dpp_pkex_identifier_mismatch2
|
dpp_pkex_identifier_mismatch2
|
||||||
dpp_pkex_identifier_mismatch3
|
dpp_pkex_identifier_mismatch3
|
||||||
dpp_pkex_5ghz
|
|
||||||
dpp_pkex_test_vector
|
dpp_pkex_test_vector
|
||||||
dpp_pkex_code_mismatch
|
dpp_pkex_code_mismatch
|
||||||
dpp_pkex_code_mismatch_limit
|
dpp_pkex_code_mismatch_limit
|
||||||
@@ -625,7 +577,6 @@ dpp_pkex_hostapd_errors
|
|||||||
dpp_pkex_nak_curve_change
|
dpp_pkex_nak_curve_change
|
||||||
dpp_pkex_nak_curve_change2
|
dpp_pkex_nak_curve_change2
|
||||||
dpp_hostapd_configurator
|
dpp_hostapd_configurator
|
||||||
dpp_hostapd_configurator_enrollee_v1
|
|
||||||
dpp_hostapd_configurator_responder
|
dpp_hostapd_configurator_responder
|
||||||
dpp_hostapd_configurator_fragmentation
|
dpp_hostapd_configurator_fragmentation
|
||||||
dpp_hostapd_enrollee_fragmentation
|
dpp_hostapd_enrollee_fragmentation
|
||||||
@@ -650,7 +601,6 @@ dpp_proto_stop_at_pkex_cr_req
|
|||||||
dpp_proto_stop_at_pkex_cr_resp
|
dpp_proto_stop_at_pkex_cr_resp
|
||||||
dpp_proto_network_introduction
|
dpp_proto_network_introduction
|
||||||
dpp_hostapd_auth_conf_timeout
|
dpp_hostapd_auth_conf_timeout
|
||||||
dpp_hostapd_auth_resp_retries
|
|
||||||
dpp_tcp
|
dpp_tcp
|
||||||
dpp_tcp_port
|
dpp_tcp_port
|
||||||
dpp_tcp_mutual
|
dpp_tcp_mutual
|
||||||
@@ -702,6 +652,5 @@ dpp_qr_code_config_event_initiator_failure
|
|||||||
dpp_qr_code_config_event_initiator_no_response
|
dpp_qr_code_config_event_initiator_no_response
|
||||||
dpp_qr_code_config_event_initiator_both
|
dpp_qr_code_config_event_initiator_both
|
||||||
dpp_tcp_qr_code_config_event_initiator
|
dpp_tcp_qr_code_config_event_initiator
|
||||||
dpp_qr_code_config_event_responder
|
|
||||||
dpp_discard_public_action
|
dpp_discard_public_action
|
||||||
|
|
||||||
|
|||||||
47
.github/workflows/hostap-files/configs/hostap_2_10/extra.patch
vendored
Normal file
47
.github/workflows/hostap-files/configs/hostap_2_10/extra.patch
vendored
Normal file
@@ -0,0 +1,47 @@
|
|||||||
|
From a53a6a67dc121b45d611318e2a37815cc209839c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
|
||||||
|
Date: Fri, 19 Apr 2024 16:41:38 +0200
|
||||||
|
Subject: [PATCH] Fixes for running tests under UML
|
||||||
|
|
||||||
|
- Apply commit ID fix from more recent commit
|
||||||
|
- priv_sz and pub_sz are checked and fail on UML. Probably because stack is zeroed out.
|
||||||
|
---
|
||||||
|
src/crypto/crypto_wolfssl.c | 2 +-
|
||||||
|
tests/hwsim/run-all.sh | 8 +++++++-
|
||||||
|
2 files changed, 8 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/crypto/crypto_wolfssl.c b/src/crypto/crypto_wolfssl.c
|
||||||
|
index 00ecf61352..a57fa50697 100644
|
||||||
|
--- a/src/crypto/crypto_wolfssl.c
|
||||||
|
+++ b/src/crypto/crypto_wolfssl.c
|
||||||
|
@@ -785,7 +785,7 @@ int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len, u8 *privkey,
|
||||||
|
int ret = -1;
|
||||||
|
WC_RNG rng;
|
||||||
|
DhKey *dh = NULL;
|
||||||
|
- word32 priv_sz, pub_sz;
|
||||||
|
+ word32 priv_sz = prime_len, pub_sz = prime_len;
|
||||||
|
|
||||||
|
if (TEST_FAIL())
|
||||||
|
return -1;
|
||||||
|
diff --git a/tests/hwsim/run-all.sh b/tests/hwsim/run-all.sh
|
||||||
|
index ee48cd0581..75c3a58b52 100755
|
||||||
|
--- a/tests/hwsim/run-all.sh
|
||||||
|
+++ b/tests/hwsim/run-all.sh
|
||||||
|
@@ -15,7 +15,13 @@ export LOGDIR
|
||||||
|
if [ -z "$DBFILE" ]; then
|
||||||
|
DB=""
|
||||||
|
else
|
||||||
|
- DB="-S $DBFILE --commit $(git rev-parse HEAD)"
|
||||||
|
+ DB="-S $DBFILE"
|
||||||
|
+ if [ -z "$COMMITID" ]; then
|
||||||
|
+ COMMITID="$(git rev-parse HEAD)"
|
||||||
|
+ fi
|
||||||
|
+ if [ -n "$COMMITID" ]; then
|
||||||
|
+ DB="$DB --commit $COMMITID"
|
||||||
|
+ fi
|
||||||
|
if [ -n "$BUILD" ]; then
|
||||||
|
DB="$DB -b $BUILD"
|
||||||
|
fi
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
@@ -163,7 +163,6 @@ ap_wpa2_disable_eapol_retry_group
|
|||||||
ap_wpa2_psk_mic_0
|
ap_wpa2_psk_mic_0
|
||||||
ap_wpa2_psk_local_error
|
ap_wpa2_psk_local_error
|
||||||
ap_wpa2_psk_inject_assoc
|
ap_wpa2_psk_inject_assoc
|
||||||
ap_wpa2_psk_no_control_port
|
|
||||||
ap_wpa2_psk_ap_control_port
|
ap_wpa2_psk_ap_control_port
|
||||||
ap_wpa2_psk_ap_control_port_disabled
|
ap_wpa2_psk_ap_control_port_disabled
|
||||||
ap_wpa2_psk_rsne_mismatch_ap
|
ap_wpa2_psk_rsne_mismatch_ap
|
||||||
@@ -269,16 +268,3 @@ ap_wpa2_eap_psk_mac_addr_change
|
|||||||
ap_wpa2_eap_server_get_id
|
ap_wpa2_eap_server_get_id
|
||||||
ap_wpa2_radius_server_get_id
|
ap_wpa2_radius_server_get_id
|
||||||
ap_wpa2_eap_sake_no_control_port
|
ap_wpa2_eap_sake_no_control_port
|
||||||
ap_wpa2_tdls
|
|
||||||
ap_wpa2_tdls_concurrent_init
|
|
||||||
ap_wpa2_tdls_concurrent_init2
|
|
||||||
ap_wpa2_tdls_decline_resp
|
|
||||||
ap_wpa2_tdls_long_lifetime
|
|
||||||
ap_wpa2_tdls_long_frame
|
|
||||||
ap_wpa2_tdls_reneg
|
|
||||||
ap_wpa2_tdls_wrong_lifetime_resp
|
|
||||||
ap_wpa2_tdls_diff_rsnie
|
|
||||||
ap_wpa2_tdls_wrong_tpk_m2_mic
|
|
||||||
ap_wpa2_tdls_wrong_tpk_m3_mic
|
|
||||||
ap_wpa2_tdls_double_tpk_m2
|
|
||||||
ap_wpa2_tdls_responder_teardown
|
|
||||||
|
|||||||
313
.github/workflows/hostap-vm.yml
vendored
Normal file
313
.github/workflows/hostap-vm.yml
vendored
Normal file
@@ -0,0 +1,313 @@
|
|||||||
|
name: hostap and wpa-supplicant Tests
|
||||||
|
|
||||||
|
# START OF COMMON SECTION
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches: [ 'master', 'main', 'release/**' ]
|
||||||
|
pull_request:
|
||||||
|
branches: [ '*' ]
|
||||||
|
|
||||||
|
concurrency:
|
||||||
|
group: ${{ github.workflow }}-${{ github.ref }}
|
||||||
|
cancel-in-progress: true
|
||||||
|
# END OF COMMON SECTION
|
||||||
|
|
||||||
|
env:
|
||||||
|
LINUX_REF: v6.6
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build_wolfssl:
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
include:
|
||||||
|
- build_id: hostap-vm-build1
|
||||||
|
wolf_extra_config: --disable-tls13
|
||||||
|
- build_id: hostap-vm-build2
|
||||||
|
wolf_extra_config: >-
|
||||||
|
--enable-wpas-dpp --enable-brainpool --with-eccminsz=192
|
||||||
|
--enable-tlsv10 --enable-oldtls
|
||||||
|
name: Build wolfSSL
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
# This should be a safe limit for the tests to run.
|
||||||
|
timeout-minutes: 10
|
||||||
|
steps:
|
||||||
|
# No way to view the full strategy in the browser (really weird)
|
||||||
|
- name: Print strategy
|
||||||
|
run: |
|
||||||
|
cat <<EOF
|
||||||
|
${{ toJSON(matrix) }}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
- if: ${{ runner.debug }}
|
||||||
|
name: Enable wolfSSL debug logging
|
||||||
|
run: |
|
||||||
|
echo "wolf_debug_flags=--enable-debug" >> $GITHUB_ENV
|
||||||
|
|
||||||
|
- name: Build wolfSSL
|
||||||
|
uses: wolfSSL/actions-build-autotools-project@v1
|
||||||
|
with:
|
||||||
|
path: wolfssl
|
||||||
|
configure: >-
|
||||||
|
--enable-wpas CPPFLAGS=-DWOLFSSL_STATIC_RSA
|
||||||
|
${{ env.wolf_debug_flags }} ${{ matrix.wolf_extra_config }}
|
||||||
|
install: true
|
||||||
|
|
||||||
|
- name: Upload built lib
|
||||||
|
uses: actions/upload-artifact@v4
|
||||||
|
with:
|
||||||
|
name: ${{ matrix.build_id }}
|
||||||
|
path: build-dir
|
||||||
|
retention-days: 5
|
||||||
|
|
||||||
|
build_uml_linux:
|
||||||
|
name: Build UML (UserMode Linux)
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
# This should be a safe limit for the tests to run.
|
||||||
|
timeout-minutes: 10
|
||||||
|
steps:
|
||||||
|
- name: Checking if we have kernel in cache
|
||||||
|
uses: actions/cache@v4
|
||||||
|
id: cache
|
||||||
|
with:
|
||||||
|
path: linux/linux
|
||||||
|
key: ${{ env.LINUX_REF }}
|
||||||
|
lookup-only: true
|
||||||
|
|
||||||
|
- name: Checkout hostap
|
||||||
|
if: steps.cache.outputs.cache-hit != 'true'
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
repository: julek-wolfssl/hostap-mirror
|
||||||
|
path: hostap
|
||||||
|
|
||||||
|
- name: Checkout linux
|
||||||
|
if: steps.cache.outputs.cache-hit != 'true'
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
repository: torvalds/linux
|
||||||
|
path: linux
|
||||||
|
|
||||||
|
- name: Compile linux
|
||||||
|
if: steps.cache.outputs.cache-hit != 'true'
|
||||||
|
run: |
|
||||||
|
cp hostap/tests/hwsim/vm/kernel-config.uml linux/.config
|
||||||
|
cd linux
|
||||||
|
yes "" | ARCH=um make -j $(nproc)
|
||||||
|
|
||||||
|
hostap_test:
|
||||||
|
strategy:
|
||||||
|
fail-fast: false
|
||||||
|
matrix:
|
||||||
|
# should hostapd be compiled with wolfssl
|
||||||
|
hostapd: [true, false]
|
||||||
|
# should wpa_supplicant be compiled with wolfssl
|
||||||
|
wpa_supplicant: [true, false]
|
||||||
|
# Fix the versions of hostap and osp to not break testing when a new
|
||||||
|
# patch is added in to osp. Tests are read from the corresponding
|
||||||
|
# configs/hostap_ref/tests file.
|
||||||
|
config: [
|
||||||
|
{
|
||||||
|
hostap_ref: hostap_2_10,
|
||||||
|
remove_teap: true,
|
||||||
|
# TLS 1.3 does not work for this version
|
||||||
|
build_id: hostap-vm-build1,
|
||||||
|
},
|
||||||
|
# Test the dpp patch
|
||||||
|
{
|
||||||
|
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
|
||||||
|
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
|
||||||
|
build_id: hostap-vm-build2
|
||||||
|
},
|
||||||
|
{
|
||||||
|
hostap_ref: 07c9f183ea744ac04585fb6dd10220c75a5e2e74,
|
||||||
|
osp_ref: e1876fbbf298ee442bc7ab8561331ebc7de17528,
|
||||||
|
build_id: hostap-vm-build2
|
||||||
|
},
|
||||||
|
]
|
||||||
|
exclude:
|
||||||
|
# don't test openssl on both sides
|
||||||
|
- hostapd: false
|
||||||
|
wpa_supplicant: false
|
||||||
|
# no hostapd support for dpp yet
|
||||||
|
- hostapd: true
|
||||||
|
config: {
|
||||||
|
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
|
||||||
|
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
|
||||||
|
build_id: hostap-vm-build2
|
||||||
|
}
|
||||||
|
name: hwsim test
|
||||||
|
# For openssl 1.1
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
# This should be a safe limit for the tests to run.
|
||||||
|
timeout-minutes: 45
|
||||||
|
needs: [build_wolfssl, build_uml_linux]
|
||||||
|
steps:
|
||||||
|
- name: Checking if we have kernel in cache
|
||||||
|
uses: actions/cache/restore@v4
|
||||||
|
id: cache
|
||||||
|
with:
|
||||||
|
path: linux/linux
|
||||||
|
key: ${{ env.LINUX_REF }}
|
||||||
|
fail-on-cache-miss: true
|
||||||
|
|
||||||
|
- name: show file structure
|
||||||
|
run: tree
|
||||||
|
|
||||||
|
# No way to view the full strategy in the browser (really weird)
|
||||||
|
- name: Print strategy
|
||||||
|
run: |
|
||||||
|
cat <<EOF
|
||||||
|
${{ toJSON(matrix) }}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
- name: Print computed job run ID
|
||||||
|
run: |
|
||||||
|
SHA_SUM=$(sha256sum << 'END_OF_HEREDOC' | cut -d " " -f 1
|
||||||
|
${{ toJSON(github) }}
|
||||||
|
END_OF_HEREDOC
|
||||||
|
)
|
||||||
|
echo "our_job_run_id=$SHA_SUM" >> $GITHUB_ENV
|
||||||
|
echo Our job run ID is $SHA_SUM
|
||||||
|
|
||||||
|
- name: Checkout wolfSSL
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
path: wolfssl
|
||||||
|
|
||||||
|
- name: Download lib
|
||||||
|
uses: actions/download-artifact@v4
|
||||||
|
with:
|
||||||
|
name: ${{ matrix.config.build_id }}
|
||||||
|
path: build-dir
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: |
|
||||||
|
# Don't prompt for anything
|
||||||
|
export DEBIAN_FRONTEND=noninteractive
|
||||||
|
sudo apt-get update
|
||||||
|
# hostap dependencies
|
||||||
|
sudo apt-get install -y libpcap0.8 libpcap-dev curl libcurl4-openssl-dev \
|
||||||
|
libnl-3-dev binutils-dev libssl-dev libiberty-dev libnl-genl-3-dev \
|
||||||
|
libnl-route-3-dev libdbus-1-dev bridge-utils tshark
|
||||||
|
sudo pip3 install pycryptodome
|
||||||
|
|
||||||
|
- name: Checkout hostap
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
repository: julek-wolfssl/hostap-mirror
|
||||||
|
path: hostap
|
||||||
|
ref: ${{ matrix.config.hostap_ref }}
|
||||||
|
|
||||||
|
- name: Update certs
|
||||||
|
working-directory: hostap/tests/hwsim/auth_serv
|
||||||
|
run: ./update.sh
|
||||||
|
|
||||||
|
- if: ${{ matrix.config.osp_ref }}
|
||||||
|
name: Checkout OSP
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
repository: wolfssl/osp
|
||||||
|
path: osp
|
||||||
|
ref: ${{ matrix.config.osp_ref }}
|
||||||
|
|
||||||
|
- if: ${{ matrix.config.osp_ref }}
|
||||||
|
name: Apply patch files
|
||||||
|
working-directory: hostap
|
||||||
|
run: |
|
||||||
|
for f in $GITHUB_WORKSPACE/osp/hostap-patches/pending/*
|
||||||
|
do
|
||||||
|
patch -p1 < $f
|
||||||
|
done
|
||||||
|
|
||||||
|
- name: Apply extra patches
|
||||||
|
working-directory: hostap
|
||||||
|
run: |
|
||||||
|
FILE=$GITHUB_WORKSPACE/wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/extra.patch
|
||||||
|
if [ -f "$FILE" ]; then
|
||||||
|
patch -p1 < $FILE
|
||||||
|
fi
|
||||||
|
|
||||||
|
- if: ${{ matrix.hostapd }}
|
||||||
|
name: Setup hostapd config file
|
||||||
|
run: |
|
||||||
|
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/hostapd.config \
|
||||||
|
hostap/hostapd/.config
|
||||||
|
cat <<EOF >> hostap/hostapd/.config
|
||||||
|
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||||
|
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||||
|
EOF
|
||||||
|
|
||||||
|
- if: ${{ matrix.wpa_supplicant }}
|
||||||
|
name: Setup wpa_supplicant config file
|
||||||
|
run: |
|
||||||
|
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/wpa_supplicant.config \
|
||||||
|
hostap/wpa_supplicant/.config
|
||||||
|
cat <<EOF >> hostap/wpa_supplicant/.config
|
||||||
|
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||||
|
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||||
|
EOF
|
||||||
|
|
||||||
|
- name: Build hostap and wpa_supplicant
|
||||||
|
working-directory: hostap/tests/hwsim/
|
||||||
|
run: ./build.sh
|
||||||
|
|
||||||
|
- if: ${{ matrix.hostapd }}
|
||||||
|
name: Confirm hostapd linking with wolfSSL
|
||||||
|
run: ldd hostap/hostapd/hostapd | grep wolfssl
|
||||||
|
|
||||||
|
- if: ${{ matrix.wpa_supplicant }}
|
||||||
|
name: Confirm wpa_supplicant linking with wolfSSL
|
||||||
|
run: ldd hostap/wpa_supplicant/wpa_supplicant | grep wolfssl
|
||||||
|
|
||||||
|
- if: ${{ matrix.config.remove_teap }}
|
||||||
|
name: Remove EAP-TEAP from test configuration
|
||||||
|
working-directory: hostap/tests/hwsim/auth_serv
|
||||||
|
run: |
|
||||||
|
sed -e 's/"erp-teap@example.com"\tTEAP//' -i eap_user.conf
|
||||||
|
sed -e 's/"erp-teap@example.com"\tMSCHAPV2\t"password"\t\[2\]//' -i eap_user.conf
|
||||||
|
sed -e 's/"TEAP"\t\tTEAP//' -i eap_user.conf
|
||||||
|
sed -e 's/TEAP,//' -i eap_user.conf
|
||||||
|
|
||||||
|
- if: ${{ runner.debug }}
|
||||||
|
name: Enable hostap debug logging
|
||||||
|
run: |
|
||||||
|
echo "hostap_debug_flags=--debug" >> $GITHUB_ENV
|
||||||
|
|
||||||
|
- name: Run tests
|
||||||
|
id: testing
|
||||||
|
working-directory: hostap/tests/hwsim/
|
||||||
|
run: |
|
||||||
|
cat <<EOF >> vm/vm-config
|
||||||
|
KERNELDIR=$GITHUB_WORKSPACE/linux
|
||||||
|
KVMARGS="-cpu host"
|
||||||
|
EOF
|
||||||
|
# Run tests in increments of 200 to not stall out the parallel-vm script
|
||||||
|
while mapfile -t -n 200 ary && ((${#ary[@]})); do
|
||||||
|
TESTS=$(printf '%s\n' "${ary[@]}" | tr '\n' ' ')
|
||||||
|
HWSIM_RES=0 # Not set when command succeeds
|
||||||
|
./vm/parallel-vm.py ${{ env.hostap_debug_flags }} --nocurses $(nproc) $TESTS || HWSIM_RES=$?
|
||||||
|
if [ "$HWSIM_RES" -ne "0" ]; then
|
||||||
|
# Let's re-run the failing tests. We gather the failed tests from the log file.
|
||||||
|
FAILED_TESTS=$(grep 'failed tests' /tmp/hwsim-test-logs/*-parallel.log | sed 's/failed tests: //' | tr ' ' '\n' | sort | uniq | tr '\n' ' ')
|
||||||
|
printf 'failed tests: %s\n' "$FAILED_TESTS"
|
||||||
|
./vm/parallel-vm.py ${{ env.hostap_debug_flags }} --nocurses $(nproc) $FAILED_TESTS
|
||||||
|
fi
|
||||||
|
rm -r /tmp/hwsim-test-logs
|
||||||
|
done < $GITHUB_WORKSPACE/wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/tests
|
||||||
|
|
||||||
|
# The logs are quite big. It hasn't been useful so far so let's not waste
|
||||||
|
# precious gh space.
|
||||||
|
#- name: zip logs
|
||||||
|
# if: ${{ failure() && steps.testing.outcome == 'failure' }}
|
||||||
|
# working-directory: hostap/tests/hwsim/
|
||||||
|
# run: |
|
||||||
|
# rm /tmp/hwsim-test-logs/latest
|
||||||
|
# zip -9 -r logs.zip /tmp/hwsim-test-logs
|
||||||
|
#
|
||||||
|
#- name: Upload failure logs
|
||||||
|
# if: ${{ failure() && steps.testing.outcome == 'failure' }}
|
||||||
|
# uses: actions/upload-artifact@v4
|
||||||
|
# with:
|
||||||
|
# name: hostap-logs-${{ env.our_job_run_id }}
|
||||||
|
# path: hostap/tests/hwsim/logs.zip
|
||||||
|
# retention-days: 5
|
||||||
180
src/internal.c
180
src/internal.c
@@ -517,6 +517,22 @@ int IsTLS(const WOLFSSL* ssl)
|
|||||||
{
|
{
|
||||||
if (ssl->version.major == SSLv3_MAJOR && ssl->version.minor >=TLSv1_MINOR)
|
if (ssl->version.major == SSLv3_MAJOR && ssl->version.minor >=TLSv1_MINOR)
|
||||||
return 1;
|
return 1;
|
||||||
|
#ifdef WOLFSSL_DTLS
|
||||||
|
if (ssl->version.major == DTLS_MAJOR)
|
||||||
|
return 1;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
int IsTLS_ex(const ProtocolVersion pv)
|
||||||
|
{
|
||||||
|
if (pv.major == SSLv3_MAJOR && pv.minor >=TLSv1_MINOR)
|
||||||
|
return 1;
|
||||||
|
#ifdef WOLFSSL_DTLS
|
||||||
|
if (pv.major == DTLS_MAJOR)
|
||||||
|
return 1;
|
||||||
|
#endif
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
@@ -3048,7 +3064,7 @@ static WC_INLINE void AddSuiteHashSigAlgo(byte* hashSigAlgo, byte macAlgo,
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void InitSuitesHashSigAlgo_ex2(byte* hashSigAlgo, int haveSig, int tls1_2,
|
void InitSuitesHashSigAlgo(byte* hashSigAlgo, int haveSig, int tls1_2,
|
||||||
int keySz, word16* len)
|
int keySz, word16* len)
|
||||||
{
|
{
|
||||||
word16 idx = 0;
|
word16 idx = 0;
|
||||||
@@ -3155,30 +3171,6 @@ void InitSuitesHashSigAlgo_ex2(byte* hashSigAlgo, int haveSig, int tls1_2,
|
|||||||
*len = idx;
|
*len = idx;
|
||||||
}
|
}
|
||||||
|
|
||||||
void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig, int haveRSAsig,
|
|
||||||
int haveFalconSig, int haveDilithiumSig, int haveAnon, int tls1_2,
|
|
||||||
int keySz)
|
|
||||||
{
|
|
||||||
InitSuitesHashSigAlgo_ex(suites->hashSigAlgo, haveECDSAsig, haveRSAsig,
|
|
||||||
haveFalconSig, haveDilithiumSig, haveAnon, tls1_2, keySz,
|
|
||||||
&suites->hashSigAlgoSz);
|
|
||||||
}
|
|
||||||
|
|
||||||
void InitSuitesHashSigAlgo_ex(byte* hashSigAlgo, int haveECDSAsig,
|
|
||||||
int haveRSAsig, int haveFalconSig, int haveDilithiumSig, int haveAnon,
|
|
||||||
int tls1_2, int keySz, word16* len)
|
|
||||||
{
|
|
||||||
int have = 0;
|
|
||||||
|
|
||||||
if (haveECDSAsig) have |= SIG_ECDSA;
|
|
||||||
if (haveRSAsig) have |= SIG_RSA;
|
|
||||||
if (haveFalconSig) have |= SIG_FALCON;
|
|
||||||
if (haveDilithiumSig) have |= SIG_DILITHIUM;
|
|
||||||
if (haveAnon) have |= SIG_ANON;
|
|
||||||
|
|
||||||
InitSuitesHashSigAlgo_ex2(hashSigAlgo, have, tls1_2, keySz, len);
|
|
||||||
}
|
|
||||||
|
|
||||||
int AllocateCtxSuites(WOLFSSL_CTX* ctx)
|
int AllocateCtxSuites(WOLFSSL_CTX* ctx)
|
||||||
{
|
{
|
||||||
if (ctx->suites == NULL) {
|
if (ctx->suites == NULL) {
|
||||||
@@ -3241,6 +3233,7 @@ void InitSuites(Suites* suites, ProtocolVersion pv, int keySz, word16 haveRSA,
|
|||||||
(void)haveStaticRSA;
|
(void)haveStaticRSA;
|
||||||
(void)haveStaticECC;
|
(void)haveStaticECC;
|
||||||
(void)haveECC;
|
(void)haveECC;
|
||||||
|
(void)haveECDSAsig;
|
||||||
(void)side;
|
(void)side;
|
||||||
(void)haveRSA; /* some builds won't read */
|
(void)haveRSA; /* some builds won't read */
|
||||||
(void)haveRSAsig; /* non ecc builds won't read */
|
(void)haveRSAsig; /* non ecc builds won't read */
|
||||||
@@ -4265,18 +4258,27 @@ void InitSuites(Suites* suites, ProtocolVersion pv, int keySz, word16 haveRSA,
|
|||||||
suites->suiteSz = idx;
|
suites->suiteSz = idx;
|
||||||
|
|
||||||
if (suites->hashSigAlgoSz == 0) {
|
if (suites->hashSigAlgoSz == 0) {
|
||||||
int haveSig = 0;
|
InitSuitesHashSigAlgo(suites->hashSigAlgo, SIG_ALL, tls1_2, keySz,
|
||||||
haveSig |= (haveRSAsig | haveRSA) ? SIG_RSA : 0;
|
|
||||||
haveSig |= (haveECDSAsig | haveECC) ? SIG_ECDSA : 0;
|
|
||||||
#if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
|
|
||||||
haveSig |= (haveECDSAsig | haveECC) ? SIG_SM2 : 0;
|
|
||||||
#endif
|
|
||||||
haveSig |= haveFalconSig ? SIG_FALCON : 0;
|
|
||||||
haveSig |= haveDilithiumSig ? SIG_DILITHIUM : 0;
|
|
||||||
haveSig &= ~SIG_ANON;
|
|
||||||
InitSuitesHashSigAlgo_ex2(suites->hashSigAlgo, haveSig, tls1_2, keySz,
|
|
||||||
&suites->hashSigAlgoSz);
|
&suites->hashSigAlgoSz);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* Moved to the end as we set some of the vars but never use them */
|
||||||
|
(void)tls; /* shut up compiler */
|
||||||
|
(void)tls1_2;
|
||||||
|
(void)dtls;
|
||||||
|
(void)haveDH;
|
||||||
|
(void)havePSK;
|
||||||
|
(void)haveStaticRSA;
|
||||||
|
(void)haveStaticECC;
|
||||||
|
(void)haveECC;
|
||||||
|
(void)haveECDSAsig;
|
||||||
|
(void)side;
|
||||||
|
(void)haveRSA; /* some builds won't read */
|
||||||
|
(void)haveRSAsig; /* non ecc builds won't read */
|
||||||
|
(void)haveAnon; /* anon ciphers optional */
|
||||||
|
(void)haveNull;
|
||||||
|
(void)haveFalconSig;
|
||||||
|
(void)haveDilithiumSig;
|
||||||
}
|
}
|
||||||
|
|
||||||
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_CERTS) || \
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_CERTS) || \
|
||||||
@@ -26729,7 +26731,7 @@ static int ParseCipherList(Suites* suites,
|
|||||||
#endif
|
#endif
|
||||||
{
|
{
|
||||||
suites->suiteSz = (word16)idx;
|
suites->suiteSz = (word16)idx;
|
||||||
InitSuitesHashSigAlgo_ex2(suites->hashSigAlgo, haveSig, 1, keySz,
|
InitSuitesHashSigAlgo(suites->hashSigAlgo, haveSig, 1, keySz,
|
||||||
&suites->hashSigAlgoSz);
|
&suites->hashSigAlgoSz);
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -26913,7 +26915,7 @@ int SetCipherListFromBytes(WOLFSSL_CTX* ctx, Suites* suites, const byte* list,
|
|||||||
haveSig |= haveFalconSig ? SIG_FALCON : 0;
|
haveSig |= haveFalconSig ? SIG_FALCON : 0;
|
||||||
haveSig |= haveDilithiumSig ? SIG_DILITHIUM : 0;
|
haveSig |= haveDilithiumSig ? SIG_DILITHIUM : 0;
|
||||||
haveSig |= haveAnon ? SIG_ANON : 0;
|
haveSig |= haveAnon ? SIG_ANON : 0;
|
||||||
InitSuitesHashSigAlgo_ex2(suites->hashSigAlgo, haveSig, 1, keySz,
|
InitSuitesHashSigAlgo(suites->hashSigAlgo, haveSig, 1, keySz,
|
||||||
&suites->hashSigAlgoSz);
|
&suites->hashSigAlgoSz);
|
||||||
#ifdef HAVE_RENEGOTIATION_INDICATION
|
#ifdef HAVE_RENEGOTIATION_INDICATION
|
||||||
if (ctx->method->side == WOLFSSL_CLIENT_END) {
|
if (ctx->method->side == WOLFSSL_CLIENT_END) {
|
||||||
@@ -33507,6 +33509,24 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* search suites for specific one, idx on success, negative on error */
|
||||||
|
int FindSuite(const Suites* suites, byte first, byte second)
|
||||||
|
{
|
||||||
|
int i;
|
||||||
|
|
||||||
|
if (suites == NULL || suites->suiteSz == 0) {
|
||||||
|
WOLFSSL_MSG("Suites pointer error or suiteSz 0");
|
||||||
|
return SUITES_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (i = 0; i < suites->suiteSz-1; i += SUITE_LEN) {
|
||||||
|
if (suites->suites[i] == first &&
|
||||||
|
suites->suites[i+1] == second )
|
||||||
|
return i;
|
||||||
|
}
|
||||||
|
|
||||||
|
return MATCH_SUITE_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
#ifndef NO_WOLFSSL_SERVER
|
#ifndef NO_WOLFSSL_SERVER
|
||||||
|
|
||||||
@@ -35426,30 +35446,6 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
#if defined(HAVE_SERVER_RENEGOTIATION_INFO) || defined(HAVE_FALLBACK_SCSV) || \
|
|
||||||
defined(OPENSSL_ALL)
|
|
||||||
|
|
||||||
/* search suites for specific one, idx on success, negative on error */
|
|
||||||
static int FindSuite(Suites* suites, byte first, byte second)
|
|
||||||
{
|
|
||||||
int i;
|
|
||||||
|
|
||||||
if (suites == NULL || suites->suiteSz == 0) {
|
|
||||||
WOLFSSL_MSG("Suites pointer error or suiteSz 0");
|
|
||||||
return SUITES_ERROR;
|
|
||||||
}
|
|
||||||
|
|
||||||
for (i = 0; i < suites->suiteSz-1; i += SUITE_LEN) {
|
|
||||||
if (suites->suites[i] == first &&
|
|
||||||
suites->suites[i+1] == second )
|
|
||||||
return i;
|
|
||||||
}
|
|
||||||
|
|
||||||
return MATCH_SUITE_ERROR;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#endif /* !WOLFSSL_NO_TLS12 */
|
#endif /* !WOLFSSL_NO_TLS12 */
|
||||||
|
|
||||||
/* Make sure server cert/key are valid for this suite, true on success
|
/* Make sure server cert/key are valid for this suite, true on success
|
||||||
@@ -35942,6 +35938,47 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|||||||
{
|
{
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
WOLFSSL_SESSION* session;
|
WOLFSSL_SESSION* session;
|
||||||
|
|
||||||
|
#ifdef HAVE_SECRET_CALLBACK
|
||||||
|
if (ssl->sessionSecretCb != NULL
|
||||||
|
#ifdef HAVE_SESSION_TICKET
|
||||||
|
&& ssl->session->ticketLen > 0
|
||||||
|
#endif
|
||||||
|
) {
|
||||||
|
int secretSz = SECRET_LEN;
|
||||||
|
WOLFSSL_MSG("Calling session secret callback");
|
||||||
|
ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom,
|
||||||
|
RAN_LEN);
|
||||||
|
if (ret == 0) {
|
||||||
|
ret = ssl->sessionSecretCb(ssl, ssl->arrays->masterSecret,
|
||||||
|
&secretSz, ssl->sessionSecretCtx);
|
||||||
|
if (secretSz != SECRET_LEN)
|
||||||
|
ret = SESSION_SECRET_CB_E;
|
||||||
|
}
|
||||||
|
if (ret == 0)
|
||||||
|
ret = MatchSuite(ssl, clSuites);
|
||||||
|
if (ret == 0) {
|
||||||
|
#ifdef NO_OLD_TLS
|
||||||
|
ret = DeriveTlsKeys(ssl);
|
||||||
|
#else
|
||||||
|
#ifndef NO_TLS
|
||||||
|
if (ssl->options.tls)
|
||||||
|
ret = DeriveTlsKeys(ssl);
|
||||||
|
#endif
|
||||||
|
if (!ssl->options.tls)
|
||||||
|
ret = DeriveKeys(ssl);
|
||||||
|
#endif
|
||||||
|
/* SERVER: peer auth based on session secret. */
|
||||||
|
ssl->options.peerAuthGood = (ret == 0);
|
||||||
|
ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
|
||||||
|
}
|
||||||
|
if (ret != 0)
|
||||||
|
WOLFSSL_ERROR_VERBOSE(ret);
|
||||||
|
WOLFSSL_LEAVE("HandleTlsResumption", ret);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
#endif /* HAVE_SECRET_CALLBACK */
|
||||||
|
|
||||||
#ifdef HAVE_SESSION_TICKET
|
#ifdef HAVE_SESSION_TICKET
|
||||||
if (ssl->options.useTicket == 1) {
|
if (ssl->options.useTicket == 1) {
|
||||||
session = ssl->session;
|
session = ssl->session;
|
||||||
@@ -36601,6 +36638,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|||||||
ssl->options.haveSessionId = 1;
|
ssl->options.haveSessionId = 1;
|
||||||
|
|
||||||
/* ProcessOld uses same resume code */
|
/* ProcessOld uses same resume code */
|
||||||
|
WOLFSSL_MSG_EX("ssl->options.resuming %d", ssl->options.resuming);
|
||||||
if (ssl->options.resuming) {
|
if (ssl->options.resuming) {
|
||||||
ret = HandleTlsResumption(ssl, clSuites);
|
ret = HandleTlsResumption(ssl, clSuites);
|
||||||
if (ret != 0)
|
if (ret != 0)
|
||||||
@@ -37982,6 +38020,22 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|||||||
WOLFSSL_START(WC_FUNC_TICKET_DO);
|
WOLFSSL_START(WC_FUNC_TICKET_DO);
|
||||||
WOLFSSL_ENTER("DoClientTicket");
|
WOLFSSL_ENTER("DoClientTicket");
|
||||||
|
|
||||||
|
#ifdef HAVE_SECRET_CALLBACK
|
||||||
|
if (ssl->ticketParseCb != NULL) {
|
||||||
|
decryptRet = WOLFSSL_TICKET_RET_OK;
|
||||||
|
if (!ssl->ticketParseCb(ssl, input, len, ssl->ticketParseCtx)) {
|
||||||
|
/* Failure kills the connection */
|
||||||
|
decryptRet = WOLFSSL_TICKET_RET_FATAL;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
if (wolfSSL_set_SessionTicket(ssl, input, len) !=
|
||||||
|
WOLFSSL_SUCCESS)
|
||||||
|
decryptRet = WOLFSSL_TICKET_RET_REJECT;
|
||||||
|
}
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
#endif
|
||||||
#ifdef WOLFSSL_TLS13
|
#ifdef WOLFSSL_TLS13
|
||||||
if (len == ID_LEN && IsAtLeastTLSv1_3(ssl->version)) {
|
if (len == ID_LEN && IsAtLeastTLSv1_3(ssl->version)) {
|
||||||
/* This is a stateful ticket. We can be sure about this because
|
/* This is a stateful ticket. We can be sure about this because
|
||||||
@@ -37996,7 +38050,11 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|||||||
}
|
}
|
||||||
else
|
else
|
||||||
#endif
|
#endif
|
||||||
|
if (len >= sizeof(*it))
|
||||||
decryptRet = DoDecryptTicket(ssl, input, len, &it);
|
decryptRet = DoDecryptTicket(ssl, input, len, &it);
|
||||||
|
else
|
||||||
|
WOLFSSL_MSG("Ticket is smaller than InternalTicket. Rejecting.");
|
||||||
|
|
||||||
|
|
||||||
if (decryptRet != WOLFSSL_TICKET_RET_OK &&
|
if (decryptRet != WOLFSSL_TICKET_RET_OK &&
|
||||||
decryptRet != WOLFSSL_TICKET_RET_CREATE) {
|
decryptRet != WOLFSSL_TICKET_RET_CREATE) {
|
||||||
|
|||||||
348
src/ssl.c
348
src/ssl.c
@@ -412,50 +412,6 @@ WC_RNG* wolfssl_make_rng(WC_RNG* rng, int* local)
|
|||||||
|
|
||||||
#include <wolfssl/wolfcrypt/hpke.h>
|
#include <wolfssl/wolfcrypt/hpke.h>
|
||||||
|
|
||||||
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC)
|
|
||||||
const WOLF_EC_NIST_NAME kNistCurves[] = {
|
|
||||||
{XSTR_SIZEOF("P-192"), "P-192", NID_X9_62_prime192v1},
|
|
||||||
{XSTR_SIZEOF("P-256"), "P-256", NID_X9_62_prime256v1},
|
|
||||||
{XSTR_SIZEOF("P-112"), "P-112", NID_secp112r1},
|
|
||||||
{XSTR_SIZEOF("P-112-2"), "P-112-2", NID_secp112r2},
|
|
||||||
{XSTR_SIZEOF("P-128"), "P-128", NID_secp128r1},
|
|
||||||
{XSTR_SIZEOF("P-128-2"), "P-128-2", NID_secp128r2},
|
|
||||||
{XSTR_SIZEOF("P-160"), "P-160", NID_secp160r1},
|
|
||||||
{XSTR_SIZEOF("P-160-2"), "P-160-2", NID_secp160r2},
|
|
||||||
{XSTR_SIZEOF("P-224"), "P-224", NID_secp224r1},
|
|
||||||
{XSTR_SIZEOF("P-384"), "P-384", NID_secp384r1},
|
|
||||||
{XSTR_SIZEOF("P-521"), "P-521", NID_secp521r1},
|
|
||||||
{XSTR_SIZEOF("K-160"), "K-160", NID_secp160k1},
|
|
||||||
{XSTR_SIZEOF("K-192"), "K-192", NID_secp192k1},
|
|
||||||
{XSTR_SIZEOF("K-224"), "K-224", NID_secp224k1},
|
|
||||||
{XSTR_SIZEOF("K-256"), "K-256", NID_secp256k1},
|
|
||||||
{XSTR_SIZEOF("B-160"), "B-160", NID_brainpoolP160r1},
|
|
||||||
{XSTR_SIZEOF("B-192"), "B-192", NID_brainpoolP192r1},
|
|
||||||
{XSTR_SIZEOF("B-224"), "B-224", NID_brainpoolP224r1},
|
|
||||||
{XSTR_SIZEOF("B-256"), "B-256", NID_brainpoolP256r1},
|
|
||||||
{XSTR_SIZEOF("B-320"), "B-320", NID_brainpoolP320r1},
|
|
||||||
{XSTR_SIZEOF("B-384"), "B-384", NID_brainpoolP384r1},
|
|
||||||
{XSTR_SIZEOF("B-512"), "B-512", NID_brainpoolP512r1},
|
|
||||||
#ifdef HAVE_PQC
|
|
||||||
{XSTR_SIZEOF("KYBER_LEVEL1"), "KYBER_LEVEL1", WOLFSSL_KYBER_LEVEL1},
|
|
||||||
{XSTR_SIZEOF("KYBER_LEVEL3"), "KYBER_LEVEL3", WOLFSSL_KYBER_LEVEL3},
|
|
||||||
{XSTR_SIZEOF("KYBER_LEVEL5"), "KYBER_LEVEL5", WOLFSSL_KYBER_LEVEL5},
|
|
||||||
#ifdef HAVE_LIBOQS
|
|
||||||
{XSTR_SIZEOF("P256_KYBER_LEVEL1"), "P256_KYBER_LEVEL1",
|
|
||||||
WOLFSSL_P256_KYBER_LEVEL1},
|
|
||||||
{XSTR_SIZEOF("P384_KYBER_LEVEL3"), "P384_KYBER_LEVEL3",
|
|
||||||
WOLFSSL_P384_KYBER_LEVEL3},
|
|
||||||
{XSTR_SIZEOF("P521_KYBER_LEVEL5"), "P521_KYBER_LEVEL5",
|
|
||||||
WOLFSSL_P521_KYBER_LEVEL5},
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
#ifdef WOLFSSL_SM2
|
|
||||||
{XSTR_SIZEOF("SM2"), "SM2", NID_sm2},
|
|
||||||
#endif
|
|
||||||
{0, NULL, 0},
|
|
||||||
};
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
|
#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
|
||||||
/* create the hpke key and ech config to send to clients */
|
/* create the hpke key and ech config to send to clients */
|
||||||
int wolfSSL_CTX_GenerateEchConfig(WOLFSSL_CTX* ctx, const char* publicName,
|
int wolfSSL_CTX_GenerateEchConfig(WOLFSSL_CTX* ctx, const char* publicName,
|
||||||
@@ -2692,6 +2648,7 @@ int wolfSSL_GetOutputSize(WOLFSSL* ssl, int inSz)
|
|||||||
#ifdef HAVE_ECC
|
#ifdef HAVE_ECC
|
||||||
int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, short keySz)
|
int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, short keySz)
|
||||||
{
|
{
|
||||||
|
WOLFSSL_ENTER("wolfSSL_CTX_SetMinEccKey_Sz");
|
||||||
if (ctx == NULL || keySz < 0 || keySz % 8 != 0) {
|
if (ctx == NULL || keySz < 0 || keySz % 8 != 0) {
|
||||||
WOLFSSL_MSG("Key size must be divisible by 8 or ctx was null");
|
WOLFSSL_MSG("Key size must be divisible by 8 or ctx was null");
|
||||||
return BAD_FUNC_ARG;
|
return BAD_FUNC_ARG;
|
||||||
@@ -2707,6 +2664,7 @@ int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, short keySz)
|
|||||||
|
|
||||||
int wolfSSL_SetMinEccKey_Sz(WOLFSSL* ssl, short keySz)
|
int wolfSSL_SetMinEccKey_Sz(WOLFSSL* ssl, short keySz)
|
||||||
{
|
{
|
||||||
|
WOLFSSL_ENTER("wolfSSL_SetMinEccKey_Sz");
|
||||||
if (ssl == NULL || keySz < 0 || keySz % 8 != 0) {
|
if (ssl == NULL || keySz < 0 || keySz % 8 != 0) {
|
||||||
WOLFSSL_MSG("Key size must be divisible by 8 or ssl was null");
|
WOLFSSL_MSG("Key size must be divisible by 8 or ssl was null");
|
||||||
return BAD_FUNC_ARG;
|
return BAD_FUNC_ARG;
|
||||||
@@ -3349,7 +3307,7 @@ int wolfSSL_CTX_UseSupportedCurve(WOLFSSL_CTX* ctx, word16 name)
|
|||||||
#endif /* NO_TLS */
|
#endif /* NO_TLS */
|
||||||
}
|
}
|
||||||
|
|
||||||
#if defined(OPENSSL_EXTRA) && defined(WOLFSSL_TLS13)
|
#if defined(OPENSSL_EXTRA)
|
||||||
int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
|
int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
|
||||||
int count)
|
int count)
|
||||||
{
|
{
|
||||||
@@ -3420,7 +3378,7 @@ int wolfSSL_set1_groups(WOLFSSL* ssl, int* groups, int count)
|
|||||||
return wolfSSL_set_groups(ssl, _groups, count) == WOLFSSL_SUCCESS ?
|
return wolfSSL_set_groups(ssl, _groups, count) == WOLFSSL_SUCCESS ?
|
||||||
WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
|
WOLFSSL_SUCCESS : WOLFSSL_FAILURE;
|
||||||
}
|
}
|
||||||
#endif /* OPENSSL_EXTRA && WOLFSSL_TLS13 */
|
#endif /* OPENSSL_EXTRA */
|
||||||
#endif /* HAVE_SUPPORTED_CURVES */
|
#endif /* HAVE_SUPPORTED_CURVES */
|
||||||
|
|
||||||
/* Application-Layer Protocol Negotiation */
|
/* Application-Layer Protocol Negotiation */
|
||||||
@@ -7877,6 +7835,8 @@ WOLFSSL_API int wolfSSL_get_negotiated_server_cert_type(WOLFSSL* ssl, int* tp)
|
|||||||
/* Set Temp CTX EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
|
/* Set Temp CTX EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
|
||||||
int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz)
|
int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz)
|
||||||
{
|
{
|
||||||
|
WOLFSSL_ENTER("wolfSSL_CTX_SetTmpEC_DHE_Sz");
|
||||||
|
|
||||||
if (ctx == NULL)
|
if (ctx == NULL)
|
||||||
return BAD_FUNC_ARG;
|
return BAD_FUNC_ARG;
|
||||||
|
|
||||||
@@ -7911,6 +7871,8 @@ int wolfSSL_CTX_SetTmpEC_DHE_Sz(WOLFSSL_CTX* ctx, word16 sz)
|
|||||||
/* Set Temp SSL EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
|
/* Set Temp SSL EC-DHE size in octets, can be 14 - 66 (112 - 521 bit) */
|
||||||
int wolfSSL_SetTmpEC_DHE_Sz(WOLFSSL* ssl, word16 sz)
|
int wolfSSL_SetTmpEC_DHE_Sz(WOLFSSL* ssl, word16 sz)
|
||||||
{
|
{
|
||||||
|
WOLFSSL_ENTER("wolfSSL_SetTmpEC_DHE_Sz");
|
||||||
|
|
||||||
if (ssl == NULL)
|
if (ssl == NULL)
|
||||||
return BAD_FUNC_ARG;
|
return BAD_FUNC_ARG;
|
||||||
|
|
||||||
@@ -8191,7 +8153,7 @@ int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb cb, void* ctx)
|
|||||||
{
|
{
|
||||||
WOLFSSL_ENTER("wolfSSL_set_session_secret_cb");
|
WOLFSSL_ENTER("wolfSSL_set_session_secret_cb");
|
||||||
if (ssl == NULL)
|
if (ssl == NULL)
|
||||||
return WOLFSSL_FATAL_ERROR;
|
return WOLFSSL_FAILURE;
|
||||||
|
|
||||||
ssl->sessionSecretCb = cb;
|
ssl->sessionSecretCb = cb;
|
||||||
ssl->sessionSecretCtx = ctx;
|
ssl->sessionSecretCtx = ctx;
|
||||||
@@ -8204,6 +8166,19 @@ int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb cb, void* ctx)
|
|||||||
return WOLFSSL_SUCCESS;
|
return WOLFSSL_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
int wolfSSL_set_session_ticket_ext_cb(WOLFSSL* ssl, TicketParseCb cb,
|
||||||
|
void *ctx)
|
||||||
|
{
|
||||||
|
WOLFSSL_ENTER("wolfSSL_set_session_ticket_ext_cb");
|
||||||
|
if (ssl == NULL)
|
||||||
|
return WOLFSSL_FAILURE;
|
||||||
|
|
||||||
|
ssl->ticketParseCb = cb;
|
||||||
|
ssl->ticketParseCtx = ctx;
|
||||||
|
|
||||||
|
return WOLFSSL_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
int wolfSSL_set_secret_cb(WOLFSSL* ssl, TlsSecretCb cb, void* ctx)
|
int wolfSSL_set_secret_cb(WOLFSSL* ssl, TlsSecretCb cb, void* ctx)
|
||||||
{
|
{
|
||||||
WOLFSSL_ENTER("wolfSSL_set_secret_cb");
|
WOLFSSL_ENTER("wolfSSL_set_secret_cb");
|
||||||
@@ -15675,6 +15650,24 @@ static long wolf_set_options(long old_op, long op)
|
|||||||
return old_op | op;
|
return old_op | op;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int FindHashSig(const Suites* suites, byte first, byte second)
|
||||||
|
{
|
||||||
|
word16 i;
|
||||||
|
|
||||||
|
if (suites == NULL || suites->hashSigAlgoSz == 0) {
|
||||||
|
WOLFSSL_MSG("Suites pointer error or suiteSz 0");
|
||||||
|
return SUITES_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
|
for (i = 0; i < suites->hashSigAlgoSz-1; i += 2) {
|
||||||
|
if (suites->hashSigAlgo[i] == first &&
|
||||||
|
suites->hashSigAlgo[i+1] == second )
|
||||||
|
return i;
|
||||||
|
}
|
||||||
|
|
||||||
|
return MATCH_SUITE_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
long wolfSSL_set_options(WOLFSSL* ssl, long op)
|
long wolfSSL_set_options(WOLFSSL* ssl, long op)
|
||||||
{
|
{
|
||||||
word16 haveRSA = 1;
|
word16 haveRSA = 1;
|
||||||
@@ -15690,21 +15683,25 @@ long wolfSSL_set_options(WOLFSSL* ssl, long op)
|
|||||||
ssl->options.mask = wolf_set_options(ssl->options.mask, op);
|
ssl->options.mask = wolf_set_options(ssl->options.mask, op);
|
||||||
|
|
||||||
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_3) == WOLFSSL_OP_NO_TLSv1_3) {
|
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_3) == WOLFSSL_OP_NO_TLSv1_3) {
|
||||||
|
WOLFSSL_MSG("Disabling TLS 1.3");
|
||||||
if (ssl->version.minor == TLSv1_3_MINOR)
|
if (ssl->version.minor == TLSv1_3_MINOR)
|
||||||
ssl->version.minor = TLSv1_2_MINOR;
|
ssl->version.minor = TLSv1_2_MINOR;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_2) == WOLFSSL_OP_NO_TLSv1_2) {
|
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_2) == WOLFSSL_OP_NO_TLSv1_2) {
|
||||||
|
WOLFSSL_MSG("Disabling TLS 1.2");
|
||||||
if (ssl->version.minor == TLSv1_2_MINOR)
|
if (ssl->version.minor == TLSv1_2_MINOR)
|
||||||
ssl->version.minor = TLSv1_1_MINOR;
|
ssl->version.minor = TLSv1_1_MINOR;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_1) == WOLFSSL_OP_NO_TLSv1_1) {
|
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1_1) == WOLFSSL_OP_NO_TLSv1_1) {
|
||||||
|
WOLFSSL_MSG("Disabling TLS 1.1");
|
||||||
if (ssl->version.minor == TLSv1_1_MINOR)
|
if (ssl->version.minor == TLSv1_1_MINOR)
|
||||||
ssl->version.minor = TLSv1_MINOR;
|
ssl->version.minor = TLSv1_MINOR;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1) == WOLFSSL_OP_NO_TLSv1) {
|
if ((ssl->options.mask & WOLFSSL_OP_NO_TLSv1) == WOLFSSL_OP_NO_TLSv1) {
|
||||||
|
WOLFSSL_MSG("Disabling TLS 1.0");
|
||||||
if (ssl->version.minor == TLSv1_MINOR)
|
if (ssl->version.minor == TLSv1_MINOR)
|
||||||
ssl->version.minor = SSLv3_MINOR;
|
ssl->version.minor = SSLv3_MINOR;
|
||||||
}
|
}
|
||||||
@@ -15738,11 +15735,52 @@ long wolfSSL_set_options(WOLFSSL* ssl, long op)
|
|||||||
if (ssl->options.side != WOLFSSL_NEITHER_END) {
|
if (ssl->options.side != WOLFSSL_NEITHER_END) {
|
||||||
if (AllocateSuites(ssl) != 0)
|
if (AllocateSuites(ssl) != 0)
|
||||||
return 0;
|
return 0;
|
||||||
InitSuites(ssl->suites, ssl->version, keySz, haveRSA, havePSK,
|
if (!ssl->suites->setSuites) {
|
||||||
ssl->options.haveDH, ssl->options.haveECDSAsig,
|
InitSuites(ssl->suites, ssl->version, keySz, haveRSA,
|
||||||
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
|
havePSK, ssl->options.haveDH, ssl->options.haveECDSAsig,
|
||||||
ssl->options.haveFalconSig, ssl->options.haveDilithiumSig,
|
ssl->options.haveECC, TRUE, ssl->options.haveStaticECC,
|
||||||
ssl->options.useAnon, TRUE, ssl->options.side);
|
ssl->options.haveFalconSig,
|
||||||
|
ssl->options.haveDilithiumSig, ssl->options.useAnon,
|
||||||
|
TRUE, ssl->options.side);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
/* Only preserve overlapping suites */
|
||||||
|
Suites tmpSuites;
|
||||||
|
word16 in, out, haveECDSAsig = 0;
|
||||||
|
word16 haveStaticECC = ssl->options.haveStaticECC;
|
||||||
|
#ifdef NO_RSA
|
||||||
|
haveECDSAsig = 1;
|
||||||
|
haveStaticECC = 1;
|
||||||
|
#endif
|
||||||
|
XMEMSET(&tmpSuites, 0, sizeof(Suites));
|
||||||
|
/* Get all possible ciphers and sigalgs for the version. Following
|
||||||
|
* options limit the allowed ciphers so let's try to get as many as
|
||||||
|
* possible.
|
||||||
|
* - haveStaticECC turns off haveRSA
|
||||||
|
* - haveECDSAsig turns off haveRSAsig */
|
||||||
|
InitSuites(&tmpSuites, ssl->version, 0, 1, 1, 1, haveECDSAsig, 1, 1,
|
||||||
|
haveStaticECC, 1, 1, 1, 1, ssl->options.side);
|
||||||
|
for (in = 0, out = 0; in < ssl->suites->suiteSz; in += SUITE_LEN) {
|
||||||
|
if (FindSuite(&tmpSuites, ssl->suites->suites[in],
|
||||||
|
ssl->suites->suites[in+1]) >= 0) {
|
||||||
|
ssl->suites->suites[out] = ssl->suites->suites[in];
|
||||||
|
ssl->suites->suites[out+1] = ssl->suites->suites[in+1];
|
||||||
|
out += SUITE_LEN;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
ssl->suites->suiteSz = out;
|
||||||
|
for (in = 0, out = 0; in < ssl->suites->hashSigAlgoSz; in += 2) {
|
||||||
|
if (FindHashSig(&tmpSuites, ssl->suites->hashSigAlgo[in],
|
||||||
|
ssl->suites->hashSigAlgo[in+1]) >= 0) {
|
||||||
|
ssl->suites->hashSigAlgo[out] =
|
||||||
|
ssl->suites->hashSigAlgo[in];
|
||||||
|
ssl->suites->hashSigAlgo[out+1] =
|
||||||
|
ssl->suites->hashSigAlgo[in+1];
|
||||||
|
out += 2;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
ssl->suites->hashSigAlgoSz = out;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return ssl->options.mask;
|
return ssl->options.mask;
|
||||||
@@ -17517,80 +17555,22 @@ int wolfSSL_get_peer_signature_type_nid(const WOLFSSL* ssl, int* nid)
|
|||||||
#ifdef HAVE_ECC
|
#ifdef HAVE_ECC
|
||||||
|
|
||||||
#if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
|
#if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
|
||||||
static int populate_groups(int* groups, int max_count, const char *list)
|
|
||||||
{
|
|
||||||
const char *end;
|
|
||||||
int count = 0;
|
|
||||||
const WOLF_EC_NIST_NAME* nist_name;
|
|
||||||
|
|
||||||
if (!groups || !list) {
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
for (end = list; ; list = ++end) {
|
|
||||||
int len;
|
|
||||||
|
|
||||||
if (count > max_count) {
|
|
||||||
WOLFSSL_MSG("Too many curves in list");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
while (*end != ':' && *end != '\0') end++;
|
|
||||||
len = (int)(end - list); /* end points to char after end
|
|
||||||
* of curve name so no need for -1 */
|
|
||||||
if ((len < kNistCurves_MIN_NAME_LEN) ||
|
|
||||||
(len > kNistCurves_MAX_NAME_LEN)) {
|
|
||||||
WOLFSSL_MSG("Unrecognized curve name in list");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
for (nist_name = kNistCurves; nist_name->name != NULL; nist_name++) {
|
|
||||||
if (len == nist_name->name_len &&
|
|
||||||
XSTRNCMP(list, nist_name->name, nist_name->name_len) == 0) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (!nist_name->name) {
|
|
||||||
WOLFSSL_MSG("Unrecognized curve name in list");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
groups[count++] = nist_name->nid;
|
|
||||||
if (*end == '\0') break;
|
|
||||||
}
|
|
||||||
|
|
||||||
return count;
|
|
||||||
}
|
|
||||||
|
|
||||||
int wolfSSL_CTX_set1_groups_list(WOLFSSL_CTX *ctx, const char *list)
|
int wolfSSL_CTX_set1_groups_list(WOLFSSL_CTX *ctx, const char *list)
|
||||||
{
|
{
|
||||||
int groups[WOLFSSL_MAX_GROUP_COUNT];
|
|
||||||
int count = 0;
|
|
||||||
|
|
||||||
if (!ctx || !list) {
|
if (!ctx || !list) {
|
||||||
return WOLFSSL_FAILURE;
|
return WOLFSSL_FAILURE;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((count = populate_groups(groups,
|
return set_curves_list(NULL, ctx, list, 0);
|
||||||
WOLFSSL_MAX_GROUP_COUNT, list)) == -1) {
|
|
||||||
return WOLFSSL_FAILURE;
|
|
||||||
}
|
|
||||||
|
|
||||||
return wolfSSL_CTX_set1_groups(ctx, groups, count);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
int wolfSSL_set1_groups_list(WOLFSSL *ssl, const char *list)
|
int wolfSSL_set1_groups_list(WOLFSSL *ssl, const char *list)
|
||||||
{
|
{
|
||||||
int groups[WOLFSSL_MAX_GROUP_COUNT];
|
|
||||||
int count = 0;
|
|
||||||
|
|
||||||
if (!ssl || !list) {
|
if (!ssl || !list) {
|
||||||
return WOLFSSL_FAILURE;
|
return WOLFSSL_FAILURE;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((count = populate_groups(groups,
|
return set_curves_list(ssl, NULL, list, 0);
|
||||||
WOLFSSL_MAX_GROUP_COUNT, list)) == -1) {
|
|
||||||
return WOLFSSL_FAILURE;
|
|
||||||
}
|
|
||||||
|
|
||||||
return wolfSSL_set1_groups(ssl, groups, count);
|
|
||||||
}
|
}
|
||||||
#endif /* WOLFSSL_TLS13 */
|
#endif /* WOLFSSL_TLS13 */
|
||||||
|
|
||||||
@@ -21279,25 +21259,82 @@ void wolfSSL_get0_next_proto_negotiated(const WOLFSSL *s,
|
|||||||
#if defined(OPENSSL_EXTRA) || defined(HAVE_CURL)
|
#if defined(OPENSSL_EXTRA) || defined(HAVE_CURL)
|
||||||
int wolfSSL_curve_is_disabled(const WOLFSSL* ssl, word16 curve_id)
|
int wolfSSL_curve_is_disabled(const WOLFSSL* ssl, word16 curve_id)
|
||||||
{
|
{
|
||||||
if (curve_id >= WOLFSSL_FFDHE_START) {
|
int ret = 0;
|
||||||
/* DH parameters are never disabled. */
|
|
||||||
return 0;
|
WOLFSSL_ENTER("wolfSSL_curve_is_disabled");
|
||||||
|
WOLFSSL_MSG_EX("wolfSSL_curve_is_disabled checking for %d", curve_id);
|
||||||
|
|
||||||
|
/* (curve_id >= WOLFSSL_FFDHE_START) - DH parameters are never disabled. */
|
||||||
|
if (curve_id < WOLFSSL_FFDHE_START) {
|
||||||
|
if (curve_id > WOLFSSL_ECC_MAX_AVAIL) {
|
||||||
|
WOLFSSL_MSG("Curve id out of supported range");
|
||||||
|
/* Disabled if not in valid range. */
|
||||||
|
ret = 1;
|
||||||
|
}
|
||||||
|
else if (curve_id >= 32) {
|
||||||
|
/* 0 is for invalid and 1-14 aren't used otherwise. */
|
||||||
|
ret = (ssl->disabledCurves & (1U << (curve_id - 32))) != 0;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
ret = (ssl->disabledCurves & (1U << curve_id)) != 0;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
if (curve_id > WOLFSSL_ECC_MAX_AVAIL) {
|
|
||||||
WOLFSSL_MSG("Curve id out of supported range");
|
WOLFSSL_LEAVE("wolfSSL_curve_is_disabled", ret);
|
||||||
/* Disabled if not in valid range. */
|
return ret;
|
||||||
return 1;
|
|
||||||
}
|
|
||||||
if (curve_id >= 32) {
|
|
||||||
/* 0 is for invalid and 1-14 aren't used otherwise. */
|
|
||||||
return (ssl->disabledCurves & (1U << (curve_id - 32))) != 0;
|
|
||||||
}
|
|
||||||
return (ssl->disabledCurves & (1U << curve_id)) != 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#if (defined(HAVE_ECC) || \
|
#if (defined(HAVE_ECC) || \
|
||||||
defined(HAVE_CURVE25519) || defined(HAVE_CURVE448))
|
defined(HAVE_CURVE25519) || defined(HAVE_CURVE448))
|
||||||
static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
|
#define CURVE_NAME(c) XSTR_SIZEOF((c)), (c)
|
||||||
|
|
||||||
|
const WOLF_EC_NIST_NAME kNistCurves[] = {
|
||||||
|
{CURVE_NAME("P-160"), NID_secp160r1, WOLFSSL_ECC_SECP160R1},
|
||||||
|
{CURVE_NAME("P-160-2"), NID_secp160r2, WOLFSSL_ECC_SECP160R2},
|
||||||
|
{CURVE_NAME("P-192"), NID_X9_62_prime192v1, WOLFSSL_ECC_SECP192R1},
|
||||||
|
{CURVE_NAME("P-224"), NID_secp224r1, WOLFSSL_ECC_SECP224R1},
|
||||||
|
{CURVE_NAME("P-256"), NID_X9_62_prime256v1, WOLFSSL_ECC_SECP256R1},
|
||||||
|
{CURVE_NAME("P-384"), NID_secp384r1, WOLFSSL_ECC_SECP384R1},
|
||||||
|
{CURVE_NAME("P-521"), NID_secp521r1, WOLFSSL_ECC_SECP521R1},
|
||||||
|
{CURVE_NAME("K-160"), NID_secp160k1, WOLFSSL_ECC_SECP160K1},
|
||||||
|
{CURVE_NAME("K-192"), NID_secp192k1, WOLFSSL_ECC_SECP192K1},
|
||||||
|
{CURVE_NAME("K-224"), NID_secp224k1, WOLFSSL_ECC_SECP224R1},
|
||||||
|
{CURVE_NAME("K-256"), NID_secp256k1, WOLFSSL_ECC_SECP256K1},
|
||||||
|
{CURVE_NAME("B-256"), NID_brainpoolP256r1, WOLFSSL_ECC_BRAINPOOLP256R1},
|
||||||
|
{CURVE_NAME("B-384"), NID_brainpoolP384r1, WOLFSSL_ECC_BRAINPOOLP384R1},
|
||||||
|
{CURVE_NAME("B-512"), NID_brainpoolP512r1, WOLFSSL_ECC_BRAINPOOLP512R1},
|
||||||
|
#ifdef HAVE_CURVE25519
|
||||||
|
{CURVE_NAME("X25519"), NID_X25519, WOLFSSL_ECC_X25519},
|
||||||
|
#endif
|
||||||
|
#ifdef HAVE_CURVE448
|
||||||
|
{CURVE_NAME("X448"), NID_X448, WOLFSSL_ECC_X448},
|
||||||
|
#endif
|
||||||
|
#ifdef HAVE_PQC
|
||||||
|
{CURVE_NAME("KYBER_LEVEL1"), WOLFSSL_KYBER_LEVEL1, WOLFSSL_KYBER_LEVEL1},
|
||||||
|
{CURVE_NAME("KYBER_LEVEL3"), WOLFSSL_KYBER_LEVEL3, WOLFSSL_KYBER_LEVEL1},
|
||||||
|
{CURVE_NAME("KYBER_LEVEL5"), WOLFSSL_KYBER_LEVEL5, WOLFSSL_KYBER_LEVEL1},
|
||||||
|
#ifdef HAVE_LIBOQS
|
||||||
|
{CURVE_NAME("P256_KYBER_LEVEL1"), WOLFSSL_P256_KYBER_LEVEL1, WOLFSSL_P256_KYBER_LEVEL1},
|
||||||
|
{CURVE_NAME("P384_KYBER_LEVEL3"), WOLFSSL_P384_KYBER_LEVEL3, WOLFSSL_P256_KYBER_LEVEL1},
|
||||||
|
{CURVE_NAME("P521_KYBER_LEVEL5"), WOLFSSL_P521_KYBER_LEVEL5, WOLFSSL_P256_KYBER_LEVEL1},
|
||||||
|
#endif
|
||||||
|
#endif
|
||||||
|
#ifdef WOLFSSL_SM2
|
||||||
|
{CURVE_NAME("SM2"), NID_sm2, WOLFSSL_ECC_SM2P256V1},
|
||||||
|
#endif
|
||||||
|
/* Alternative curve names */
|
||||||
|
{CURVE_NAME("prime256v1"), NID_X9_62_prime256v1, WOLFSSL_ECC_SECP256R1},
|
||||||
|
{CURVE_NAME("secp256r1"), NID_X9_62_prime256v1, WOLFSSL_ECC_SECP256R1},
|
||||||
|
{CURVE_NAME("secp384r1"), NID_secp384r1, WOLFSSL_ECC_SECP384R1},
|
||||||
|
{CURVE_NAME("secp521r1"), NID_secp521r1, WOLFSSL_ECC_SECP521R1},
|
||||||
|
#ifdef WOLFSSL_SM2
|
||||||
|
{CURVE_NAME("sm2p256v1"), NID_sm2, WOLFSSL_ECC_SM2P256V1},
|
||||||
|
#endif
|
||||||
|
{0, NULL, 0, 0},
|
||||||
|
};
|
||||||
|
|
||||||
|
int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names,
|
||||||
|
byte curves_only)
|
||||||
{
|
{
|
||||||
int idx, start = 0, len, i, ret = WOLFSSL_FAILURE;
|
int idx, start = 0, len, i, ret = WOLFSSL_FAILURE;
|
||||||
word16 curve;
|
word16 curve;
|
||||||
@@ -21310,6 +21347,7 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
|
|||||||
#else
|
#else
|
||||||
int groups[WOLFSSL_MAX_GROUP_COUNT];
|
int groups[WOLFSSL_MAX_GROUP_COUNT];
|
||||||
#endif
|
#endif
|
||||||
|
const WOLF_EC_NIST_NAME* nist_name;
|
||||||
|
|
||||||
#ifdef WOLFSSL_SMALL_STACK
|
#ifdef WOLFSSL_SMALL_STACK
|
||||||
groups = (int*)XMALLOC(sizeof(int)*WOLFSSL_MAX_GROUP_COUNT,
|
groups = (int*)XMALLOC(sizeof(int)*WOLFSSL_MAX_GROUP_COUNT,
|
||||||
@@ -21329,45 +21367,18 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
|
|||||||
goto leave;
|
goto leave;
|
||||||
|
|
||||||
XMEMCPY(name, names + start, len);
|
XMEMCPY(name, names + start, len);
|
||||||
name[len++] = 0;
|
name[len] = 0;
|
||||||
|
curve = WOLFSSL_NAMED_GROUP_INVALID;
|
||||||
|
|
||||||
/* Use XSTRNCMP to avoid valgrind error. */
|
for (nist_name = kNistCurves; nist_name->name != NULL; nist_name++) {
|
||||||
if ((XSTRNCMP(name, "prime256v1", len) == 0) ||
|
if (len == nist_name->name_len &&
|
||||||
(XSTRNCMP(name, "secp256r1", len) == 0) ||
|
XSTRNCMP(name, nist_name->name, len) == 0) {
|
||||||
(XSTRNCMP(name, "P-256", len) == 0))
|
curve = nist_name->curve;
|
||||||
{
|
break;
|
||||||
curve = WOLFSSL_ECC_SECP256R1;
|
}
|
||||||
}
|
}
|
||||||
else if ((XSTRNCMP(name, "secp384r1", len) == 0) ||
|
|
||||||
(XSTRNCMP(name, "P-384", len) == 0))
|
if (curve == WOLFSSL_NAMED_GROUP_INVALID) {
|
||||||
{
|
|
||||||
curve = WOLFSSL_ECC_SECP384R1;
|
|
||||||
}
|
|
||||||
else if ((XSTRNCMP(name, "secp521r1", len) == 0) ||
|
|
||||||
(XSTRNCMP(name, "P-521", len) == 0))
|
|
||||||
{
|
|
||||||
curve = WOLFSSL_ECC_SECP521R1;
|
|
||||||
}
|
|
||||||
#ifdef WOLFSSL_SM2
|
|
||||||
else if ((XSTRNCMP(name, "sm2p256v1", len) == 0) ||
|
|
||||||
(XSTRNCMP(name, "SM2", len) == 0))
|
|
||||||
{
|
|
||||||
curve = WOLFSSL_ECC_SM2P256V1;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#ifdef HAVE_CURVE25519
|
|
||||||
else if (XSTRNCMP(name, "X25519", len) == 0)
|
|
||||||
{
|
|
||||||
curve = WOLFSSL_ECC_X25519;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
#ifdef HAVE_CURVE448
|
|
||||||
else if (XSTRNCMP(name, "X448", len) == 0)
|
|
||||||
{
|
|
||||||
curve = WOLFSSL_ECC_X448;
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
else {
|
|
||||||
#if !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && defined(HAVE_ECC)
|
#if !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && defined(HAVE_ECC)
|
||||||
int nret;
|
int nret;
|
||||||
const ecc_set_type *eccSet;
|
const ecc_set_type *eccSet;
|
||||||
@@ -21391,7 +21402,8 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
|
|||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
if (curve >= WOLFSSL_ECC_MAX_AVAIL) {
|
if ((curves_only && curve >= WOLFSSL_ECC_MAX_AVAIL) ||
|
||||||
|
curve == WOLFSSL_NAMED_GROUP_INVALID) {
|
||||||
WOLFSSL_MSG("curve value is not supported");
|
WOLFSSL_MSG("curve value is not supported");
|
||||||
goto leave;
|
goto leave;
|
||||||
}
|
}
|
||||||
@@ -21427,7 +21439,7 @@ static int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names)
|
|||||||
disabled &= ~(1U << curve);
|
disabled &= ~(1U << curve);
|
||||||
}
|
}
|
||||||
#ifdef HAVE_SUPPORTED_CURVES
|
#ifdef HAVE_SUPPORTED_CURVES
|
||||||
#if defined(WOLFSSL_TLS13) && !defined(WOLFSSL_OLD_SET_CURVES_LIST)
|
#if !defined(WOLFSSL_OLD_SET_CURVES_LIST)
|
||||||
/* using the wolfSSL API to set the groups, this will populate
|
/* using the wolfSSL API to set the groups, this will populate
|
||||||
* (ssl|ctx)->groups and reset any TLSX_SUPPORTED_GROUPS.
|
* (ssl|ctx)->groups and reset any TLSX_SUPPORTED_GROUPS.
|
||||||
* The order in (ssl|ctx)->groups will then be respected
|
* The order in (ssl|ctx)->groups will then be respected
|
||||||
@@ -21468,20 +21480,22 @@ leave:
|
|||||||
|
|
||||||
int wolfSSL_CTX_set1_curves_list(WOLFSSL_CTX* ctx, const char* names)
|
int wolfSSL_CTX_set1_curves_list(WOLFSSL_CTX* ctx, const char* names)
|
||||||
{
|
{
|
||||||
|
WOLFSSL_ENTER("wolfSSL_CTX_set1_curves_list");
|
||||||
if (ctx == NULL || names == NULL) {
|
if (ctx == NULL || names == NULL) {
|
||||||
WOLFSSL_MSG("ctx or names was NULL");
|
WOLFSSL_MSG("ctx or names was NULL");
|
||||||
return WOLFSSL_FAILURE;
|
return WOLFSSL_FAILURE;
|
||||||
}
|
}
|
||||||
return set_curves_list(NULL, ctx, names);
|
return set_curves_list(NULL, ctx, names, 1);
|
||||||
}
|
}
|
||||||
|
|
||||||
int wolfSSL_set1_curves_list(WOLFSSL* ssl, const char* names)
|
int wolfSSL_set1_curves_list(WOLFSSL* ssl, const char* names)
|
||||||
{
|
{
|
||||||
|
WOLFSSL_ENTER("wolfSSL_set1_curves_list");
|
||||||
if (ssl == NULL || names == NULL) {
|
if (ssl == NULL || names == NULL) {
|
||||||
WOLFSSL_MSG("ssl or names was NULL");
|
WOLFSSL_MSG("ssl or names was NULL");
|
||||||
return WOLFSSL_FAILURE;
|
return WOLFSSL_FAILURE;
|
||||||
}
|
}
|
||||||
return set_curves_list(ssl, NULL, names);
|
return set_curves_list(ssl, NULL, names, 1);
|
||||||
}
|
}
|
||||||
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) */
|
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) */
|
||||||
#endif /* OPENSSL_EXTRA || HAVE_CURL */
|
#endif /* OPENSSL_EXTRA || HAVE_CURL */
|
||||||
|
|||||||
99
src/tls.c
99
src/tls.c
@@ -300,6 +300,98 @@ ProtocolVersion MakeTLSv1_3(void)
|
|||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
#if defined(HAVE_SUPPORTED_CURVES)
|
||||||
|
/* Sets the key exchange groups in rank order on a context.
|
||||||
|
*
|
||||||
|
* ctx SSL/TLS context object.
|
||||||
|
* groups Array of groups.
|
||||||
|
* count Number of groups in array.
|
||||||
|
* returns BAD_FUNC_ARG when ctx or groups is NULL, not using TLS v1.3 or
|
||||||
|
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
|
||||||
|
*/
|
||||||
|
int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups, int count)
|
||||||
|
{
|
||||||
|
int ret, i;
|
||||||
|
|
||||||
|
WOLFSSL_ENTER("wolfSSL_CTX_set_groups");
|
||||||
|
if (ctx == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
|
||||||
|
return BAD_FUNC_ARG;
|
||||||
|
if (!IsTLS_ex(ctx->method->version))
|
||||||
|
return BAD_FUNC_ARG;
|
||||||
|
|
||||||
|
#ifdef WOLFSSL_TLS13
|
||||||
|
ctx->numGroups = 0;
|
||||||
|
#endif
|
||||||
|
#if !defined(NO_TLS)
|
||||||
|
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
|
||||||
|
#endif /* !NO_TLS */
|
||||||
|
for (i = 0; i < count; i++) {
|
||||||
|
/* Call to wolfSSL_CTX_UseSupportedCurve also checks if input groups
|
||||||
|
* are valid */
|
||||||
|
if ((ret = wolfSSL_CTX_UseSupportedCurve(ctx, (word16)groups[i]))
|
||||||
|
!= WOLFSSL_SUCCESS) {
|
||||||
|
#if !defined(NO_TLS)
|
||||||
|
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
|
||||||
|
#endif /* !NO_TLS */
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
#ifdef WOLFSSL_TLS13
|
||||||
|
ctx->group[i] = (word16)groups[i];
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
#ifdef WOLFSSL_TLS13
|
||||||
|
ctx->numGroups = (byte)count;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
return WOLFSSL_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Sets the key exchange groups in rank order.
|
||||||
|
*
|
||||||
|
* ssl SSL/TLS object.
|
||||||
|
* groups Array of groups.
|
||||||
|
* count Number of groups in array.
|
||||||
|
* returns BAD_FUNC_ARG when ssl or groups is NULL, not using TLS v1.3 or
|
||||||
|
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
|
||||||
|
*/
|
||||||
|
int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count)
|
||||||
|
{
|
||||||
|
int ret, i;
|
||||||
|
|
||||||
|
WOLFSSL_ENTER("wolfSSL_set_groups");
|
||||||
|
if (ssl == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
|
||||||
|
return BAD_FUNC_ARG;
|
||||||
|
if (!IsTLS_ex(ssl->version))
|
||||||
|
return BAD_FUNC_ARG;
|
||||||
|
|
||||||
|
#ifdef WOLFSSL_TLS13
|
||||||
|
ssl->numGroups = 0;
|
||||||
|
#endif
|
||||||
|
#if !defined(NO_TLS)
|
||||||
|
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
|
||||||
|
#endif /* !NO_TLS */
|
||||||
|
for (i = 0; i < count; i++) {
|
||||||
|
/* Call to wolfSSL_UseSupportedCurve also checks if input groups
|
||||||
|
* are valid */
|
||||||
|
if ((ret = wolfSSL_UseSupportedCurve(ssl, (word16)groups[i]))
|
||||||
|
!= WOLFSSL_SUCCESS) {
|
||||||
|
#if !defined(NO_TLS)
|
||||||
|
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
|
||||||
|
#endif /* !NO_TLS */
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
#ifdef WOLFSSL_TLS13
|
||||||
|
ssl->group[i] = (word16)groups[i];
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
#ifdef WOLFSSL_TLS13
|
||||||
|
ssl->numGroups = (byte)count;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
return WOLFSSL_SUCCESS;
|
||||||
|
}
|
||||||
|
#endif /* HAVE_SUPPORTED_CURVES */
|
||||||
|
|
||||||
#ifndef WOLFSSL_NO_TLS12
|
#ifndef WOLFSSL_NO_TLS12
|
||||||
|
|
||||||
#ifdef HAVE_EXTENDED_MASTER
|
#ifdef HAVE_EXTENDED_MASTER
|
||||||
@@ -4675,6 +4767,7 @@ int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, byte second,
|
|||||||
int ephmSuite = 0;
|
int ephmSuite = 0;
|
||||||
word16 octets = 0; /* according to 'ecc_set_type ecc_sets[];' */
|
word16 octets = 0; /* according to 'ecc_set_type ecc_sets[];' */
|
||||||
int key = 0; /* validate key */
|
int key = 0; /* validate key */
|
||||||
|
int foundCurve = 0; /* Found at least one supported curve */
|
||||||
|
|
||||||
(void)oid;
|
(void)oid;
|
||||||
|
|
||||||
@@ -4836,6 +4929,8 @@ int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, byte second,
|
|||||||
default: continue; /* unsupported curve */
|
default: continue; /* unsupported curve */
|
||||||
}
|
}
|
||||||
|
|
||||||
|
foundCurve = 1;
|
||||||
|
|
||||||
#ifdef HAVE_ECC
|
#ifdef HAVE_ECC
|
||||||
/* Set default Oid */
|
/* Set default Oid */
|
||||||
if (defOid == 0 && ssl->eccTempKeySz <= octets && defSz > octets) {
|
if (defOid == 0 && ssl->eccTempKeySz <= octets && defSz > octets) {
|
||||||
@@ -4980,6 +5075,10 @@ int TLSX_ValidateSupportedCurves(const WOLFSSL* ssl, byte first, byte second,
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* Check we found at least one supported curve */
|
||||||
|
if (!foundCurve)
|
||||||
|
return 0;
|
||||||
|
|
||||||
*ecdhCurveOID = ssl->ecdhCurveOID;
|
*ecdhCurveOID = ssl->ecdhCurveOID;
|
||||||
/* Choose the default if it is at the required strength. */
|
/* Choose the default if it is at the required strength. */
|
||||||
#ifdef HAVE_ECC
|
#ifdef HAVE_ECC
|
||||||
|
|||||||
88
src/tls13.c
88
src/tls13.c
@@ -7633,10 +7633,6 @@ static int SendTls13CertificateRequest(WOLFSSL* ssl, byte* reqCtx,
|
|||||||
word32 reqSz;
|
word32 reqSz;
|
||||||
word16 hashSigAlgoSz = 0;
|
word16 hashSigAlgoSz = 0;
|
||||||
SignatureAlgorithms* sa;
|
SignatureAlgorithms* sa;
|
||||||
int haveSig = SIG_RSA | SIG_ECDSA | SIG_FALCON | SIG_DILITHIUM;
|
|
||||||
#if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
|
|
||||||
haveSig |= SIG_SM2;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
WOLFSSL_START(WC_FUNC_CERTIFICATE_REQUEST_SEND);
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_REQUEST_SEND);
|
||||||
WOLFSSL_ENTER("SendTls13CertificateRequest");
|
WOLFSSL_ENTER("SendTls13CertificateRequest");
|
||||||
@@ -7647,12 +7643,12 @@ static int SendTls13CertificateRequest(WOLFSSL* ssl, byte* reqCtx,
|
|||||||
return SIDE_ERROR;
|
return SIDE_ERROR;
|
||||||
|
|
||||||
/* Get the length of the hashSigAlgo buffer */
|
/* Get the length of the hashSigAlgo buffer */
|
||||||
InitSuitesHashSigAlgo_ex2(NULL, haveSig, 1, ssl->buffers.keySz,
|
InitSuitesHashSigAlgo(NULL, SIG_ALL, 1, ssl->buffers.keySz,
|
||||||
&hashSigAlgoSz);
|
&hashSigAlgoSz);
|
||||||
sa = TLSX_SignatureAlgorithms_New(ssl, hashSigAlgoSz, ssl->heap);
|
sa = TLSX_SignatureAlgorithms_New(ssl, hashSigAlgoSz, ssl->heap);
|
||||||
if (sa == NULL)
|
if (sa == NULL)
|
||||||
return MEMORY_ERROR;
|
return MEMORY_ERROR;
|
||||||
InitSuitesHashSigAlgo_ex2(sa->hashSigAlgo, haveSig, 1, ssl->buffers.keySz,
|
InitSuitesHashSigAlgo(sa->hashSigAlgo, SIG_ALL, 1, ssl->buffers.keySz,
|
||||||
&hashSigAlgoSz);
|
&hashSigAlgoSz);
|
||||||
ret = TLSX_Push(&ssl->extensions, TLSX_SIGNATURE_ALGORITHMS, sa, ssl->heap);
|
ret = TLSX_Push(&ssl->extensions, TLSX_SIGNATURE_ALGORITHMS, sa, ssl->heap);
|
||||||
if (ret != 0) {
|
if (ret != 0) {
|
||||||
@@ -13691,86 +13687,6 @@ int wolfSSL_preferred_group(WOLFSSL* ssl)
|
|||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#if defined(HAVE_SUPPORTED_CURVES)
|
|
||||||
/* Sets the key exchange groups in rank order on a context.
|
|
||||||
*
|
|
||||||
* ctx SSL/TLS context object.
|
|
||||||
* groups Array of groups.
|
|
||||||
* count Number of groups in array.
|
|
||||||
* returns BAD_FUNC_ARG when ctx or groups is NULL, not using TLS v1.3 or
|
|
||||||
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
|
|
||||||
*/
|
|
||||||
int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups, int count)
|
|
||||||
{
|
|
||||||
int ret, i;
|
|
||||||
|
|
||||||
WOLFSSL_ENTER("wolfSSL_CTX_set_groups");
|
|
||||||
if (ctx == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
|
|
||||||
return BAD_FUNC_ARG;
|
|
||||||
if (!IsAtLeastTLSv1_3(ctx->method->version))
|
|
||||||
return BAD_FUNC_ARG;
|
|
||||||
|
|
||||||
ctx->numGroups = 0;
|
|
||||||
#if !defined(NO_TLS)
|
|
||||||
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
|
|
||||||
#endif /* !NO_TLS */
|
|
||||||
for (i = 0; i < count; i++) {
|
|
||||||
/* Call to wolfSSL_CTX_UseSupportedCurve also checks if input groups
|
|
||||||
* are valid */
|
|
||||||
if ((ret = wolfSSL_CTX_UseSupportedCurve(ctx, (word16)groups[i]))
|
|
||||||
!= WOLFSSL_SUCCESS) {
|
|
||||||
#if !defined(NO_TLS)
|
|
||||||
TLSX_Remove(&ctx->extensions, TLSX_SUPPORTED_GROUPS, ctx->heap);
|
|
||||||
#endif /* !NO_TLS */
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
ctx->group[i] = (word16)groups[i];
|
|
||||||
}
|
|
||||||
ctx->numGroups = (byte)count;
|
|
||||||
|
|
||||||
return WOLFSSL_SUCCESS;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Sets the key exchange groups in rank order.
|
|
||||||
*
|
|
||||||
* ssl SSL/TLS object.
|
|
||||||
* groups Array of groups.
|
|
||||||
* count Number of groups in array.
|
|
||||||
* returns BAD_FUNC_ARG when ssl or groups is NULL, not using TLS v1.3 or
|
|
||||||
* count is greater than WOLFSSL_MAX_GROUP_COUNT and WOLFSSL_SUCCESS on success.
|
|
||||||
*/
|
|
||||||
int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count)
|
|
||||||
{
|
|
||||||
int ret, i;
|
|
||||||
|
|
||||||
WOLFSSL_ENTER("wolfSSL_set_groups");
|
|
||||||
if (ssl == NULL || groups == NULL || count > WOLFSSL_MAX_GROUP_COUNT)
|
|
||||||
return BAD_FUNC_ARG;
|
|
||||||
if (!IsAtLeastTLSv1_3(ssl->version))
|
|
||||||
return BAD_FUNC_ARG;
|
|
||||||
|
|
||||||
ssl->numGroups = 0;
|
|
||||||
#if !defined(NO_TLS)
|
|
||||||
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
|
|
||||||
#endif /* !NO_TLS */
|
|
||||||
for (i = 0; i < count; i++) {
|
|
||||||
/* Call to wolfSSL_UseSupportedCurve also checks if input groups
|
|
||||||
* are valid */
|
|
||||||
if ((ret = wolfSSL_UseSupportedCurve(ssl, (word16)groups[i]))
|
|
||||||
!= WOLFSSL_SUCCESS) {
|
|
||||||
#if !defined(NO_TLS)
|
|
||||||
TLSX_Remove(&ssl->extensions, TLSX_SUPPORTED_GROUPS, ssl->heap);
|
|
||||||
#endif /* !NO_TLS */
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
ssl->group[i] = (word16)groups[i];
|
|
||||||
}
|
|
||||||
ssl->numGroups = (byte)count;
|
|
||||||
|
|
||||||
return WOLFSSL_SUCCESS;
|
|
||||||
}
|
|
||||||
#endif /* HAVE_SUPPORTED_CURVES */
|
|
||||||
|
|
||||||
#ifndef NO_PSK
|
#ifndef NO_PSK
|
||||||
/* Set the PSK callback, that is passed the cipher suite, for a client to use
|
/* Set the PSK callback, that is passed the cipher suite, for a client to use
|
||||||
* against context object.
|
* against context object.
|
||||||
|
|||||||
108
tests/api.c
108
tests/api.c
@@ -40527,6 +40527,89 @@ static int test_wolfSSL_set1_curves_list(void)
|
|||||||
return EXPECT_RESULT();
|
return EXPECT_RESULT();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#if defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && \
|
||||||
|
(defined(OPENSSL_EXTRA) || defined(HAVE_CURL)) && defined(HAVE_ECC)
|
||||||
|
static int test_wolfSSL_curves_mismatch_ctx_ready(WOLFSSL_CTX* ctx)
|
||||||
|
{
|
||||||
|
static int counter = 0;
|
||||||
|
EXPECT_DECLS;
|
||||||
|
|
||||||
|
if (counter % 2) {
|
||||||
|
ExpectIntEQ(wolfSSL_CTX_set1_curves_list(ctx, "P-256"),
|
||||||
|
WOLFSSL_SUCCESS);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
ExpectIntEQ(wolfSSL_CTX_set1_curves_list(ctx, "P-384"),
|
||||||
|
WOLFSSL_SUCCESS);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Ciphersuites that require curves */
|
||||||
|
wolfSSL_CTX_set_cipher_list(ctx, "TLS13-AES256-GCM-SHA384:"
|
||||||
|
"TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES128-GCM-SHA256:"
|
||||||
|
"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:"
|
||||||
|
"ECDHE-ECDSA-AES128-GCM-SHA256:"
|
||||||
|
"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:"
|
||||||
|
"ECDHE-ECDSA-CHACHA20-POLY1305");
|
||||||
|
|
||||||
|
counter++;
|
||||||
|
return EXPECT_RESULT();
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
|
static int test_wolfSSL_curves_mismatch(void)
|
||||||
|
{
|
||||||
|
EXPECT_DECLS;
|
||||||
|
#if defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && \
|
||||||
|
(defined(OPENSSL_EXTRA) || defined(HAVE_CURL)) && defined(HAVE_ECC)
|
||||||
|
test_ssl_cbf func_cb_client;
|
||||||
|
test_ssl_cbf func_cb_server;
|
||||||
|
size_t i;
|
||||||
|
struct {
|
||||||
|
method_provider client_meth;
|
||||||
|
method_provider server_meth;
|
||||||
|
const char* desc;
|
||||||
|
int client_last_err;
|
||||||
|
int server_last_err;
|
||||||
|
} test_params[] = {
|
||||||
|
#ifdef WOLFSSL_TLS13
|
||||||
|
{wolfTLSv1_3_client_method, wolfTLSv1_3_server_method, "TLS 1.3",
|
||||||
|
FATAL_ERROR, BAD_KEY_SHARE_DATA},
|
||||||
|
#endif
|
||||||
|
#ifndef WOLFSSL_NO_TLS12
|
||||||
|
{wolfTLSv1_2_client_method, wolfTLSv1_2_server_method, "TLS 1.2",
|
||||||
|
FATAL_ERROR, MATCH_SUITE_ERROR},
|
||||||
|
#endif
|
||||||
|
#ifndef NO_OLD_TLS
|
||||||
|
{wolfTLSv1_1_client_method, wolfTLSv1_1_server_method, "TLS 1.1",
|
||||||
|
FATAL_ERROR, MATCH_SUITE_ERROR},
|
||||||
|
#endif
|
||||||
|
};
|
||||||
|
|
||||||
|
for (i = 0; i < XELEM_CNT(test_params) && !EXPECT_FAIL(); i++) {
|
||||||
|
XMEMSET(&func_cb_client, 0, sizeof(func_cb_client));
|
||||||
|
XMEMSET(&func_cb_server, 0, sizeof(func_cb_server));
|
||||||
|
|
||||||
|
printf("\tTesting with %s...\n", test_params[i].desc);
|
||||||
|
|
||||||
|
func_cb_client.ctx_ready = &test_wolfSSL_curves_mismatch_ctx_ready;
|
||||||
|
func_cb_server.ctx_ready = &test_wolfSSL_curves_mismatch_ctx_ready;
|
||||||
|
|
||||||
|
func_cb_client.method = test_params[i].client_meth;
|
||||||
|
func_cb_server.method = test_params[i].server_meth;
|
||||||
|
|
||||||
|
ExpectIntEQ(test_wolfSSL_client_server_nofail_memio(&func_cb_client,
|
||||||
|
&func_cb_server, NULL), TEST_FAIL);
|
||||||
|
ExpectIntEQ(func_cb_client.last_err, test_params[i].client_last_err);
|
||||||
|
ExpectIntEQ(func_cb_server.last_err, test_params[i].server_last_err);
|
||||||
|
|
||||||
|
if (!EXPECT_SUCCESS())
|
||||||
|
break;
|
||||||
|
printf("\t%s passed\n", test_params[i].desc);
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
return EXPECT_RESULT();
|
||||||
|
}
|
||||||
|
|
||||||
static int test_wolfSSL_set1_sigalgs_list(void)
|
static int test_wolfSSL_set1_sigalgs_list(void)
|
||||||
{
|
{
|
||||||
EXPECT_DECLS;
|
EXPECT_DECLS;
|
||||||
@@ -47164,7 +47247,7 @@ static int test_wolfSSL_sigalg_info(void)
|
|||||||
word16 idx = 0;
|
word16 idx = 0;
|
||||||
int allSigAlgs = SIG_ECDSA | SIG_RSA | SIG_SM2 | SIG_FALCON | SIG_DILITHIUM;
|
int allSigAlgs = SIG_ECDSA | SIG_RSA | SIG_SM2 | SIG_FALCON | SIG_DILITHIUM;
|
||||||
|
|
||||||
InitSuitesHashSigAlgo_ex2(hashSigAlgo, allSigAlgs, 1, 0xFFFFFFFF, &len);
|
InitSuitesHashSigAlgo(hashSigAlgo, allSigAlgs, 1, 0xFFFFFFFF, &len);
|
||||||
for (idx = 0; idx < len; idx += 2) {
|
for (idx = 0; idx < len; idx += 2) {
|
||||||
int hashAlgo = 0;
|
int hashAlgo = 0;
|
||||||
int sigAlgo = 0;
|
int sigAlgo = 0;
|
||||||
@@ -47176,7 +47259,7 @@ static int test_wolfSSL_sigalg_info(void)
|
|||||||
ExpectIntNE(sigAlgo, 0);
|
ExpectIntNE(sigAlgo, 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
InitSuitesHashSigAlgo_ex2(hashSigAlgo, allSigAlgs | SIG_ANON, 1,
|
InitSuitesHashSigAlgo(hashSigAlgo, allSigAlgs | SIG_ANON, 1,
|
||||||
0xFFFFFFFF, &len);
|
0xFFFFFFFF, &len);
|
||||||
for (idx = 0; idx < len; idx += 2) {
|
for (idx = 0; idx < len; idx += 2) {
|
||||||
int hashAlgo = 0;
|
int hashAlgo = 0;
|
||||||
@@ -55201,15 +55284,21 @@ static int test_tls13_apis(void)
|
|||||||
#endif
|
#endif
|
||||||
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC)
|
#if defined(OPENSSL_EXTRA) && defined(HAVE_ECC)
|
||||||
char groupList[] =
|
char groupList[] =
|
||||||
|
#ifdef HAVE_CURVE25519
|
||||||
|
"X25519:"
|
||||||
|
#endif
|
||||||
|
#ifdef HAVE_CURVE448
|
||||||
|
"X448:"
|
||||||
|
#endif
|
||||||
#ifndef NO_ECC_SECP
|
#ifndef NO_ECC_SECP
|
||||||
#if (defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 521
|
#if (defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 521
|
||||||
"P-521:"
|
"P-521:secp521r1:"
|
||||||
#endif
|
#endif
|
||||||
#if (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 384
|
#if (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 384
|
||||||
"P-384:"
|
"P-384:secp384r1:"
|
||||||
#endif
|
#endif
|
||||||
#if (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
|
#if (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
|
||||||
"P-256"
|
"P-256:secp256r1"
|
||||||
#if defined(HAVE_PQC) && defined(HAVE_LIBOQS)
|
#if defined(HAVE_PQC) && defined(HAVE_LIBOQS)
|
||||||
":P256_KYBER_LEVEL1"
|
":P256_KYBER_LEVEL1"
|
||||||
#endif
|
#endif
|
||||||
@@ -55505,7 +55594,7 @@ static int test_tls13_apis(void)
|
|||||||
#ifndef NO_WOLFSSL_CLIENT
|
#ifndef NO_WOLFSSL_CLIENT
|
||||||
#ifndef WOLFSSL_NO_TLS12
|
#ifndef WOLFSSL_NO_TLS12
|
||||||
ExpectIntEQ(wolfSSL_CTX_set_groups(clientTls12Ctx, groups, numGroups),
|
ExpectIntEQ(wolfSSL_CTX_set_groups(clientTls12Ctx, groups, numGroups),
|
||||||
BAD_FUNC_ARG);
|
WOLFSSL_SUCCESS);
|
||||||
#endif
|
#endif
|
||||||
ExpectIntEQ(wolfSSL_CTX_set_groups(clientCtx, groups,
|
ExpectIntEQ(wolfSSL_CTX_set_groups(clientCtx, groups,
|
||||||
WOLFSSL_MAX_GROUP_COUNT + 1), BAD_FUNC_ARG);
|
WOLFSSL_MAX_GROUP_COUNT + 1), BAD_FUNC_ARG);
|
||||||
@@ -55529,7 +55618,7 @@ static int test_tls13_apis(void)
|
|||||||
#ifndef NO_WOLFSSL_CLIENT
|
#ifndef NO_WOLFSSL_CLIENT
|
||||||
#ifndef WOLFSSL_NO_TLS12
|
#ifndef WOLFSSL_NO_TLS12
|
||||||
ExpectIntEQ(wolfSSL_set_groups(clientTls12Ssl, groups, numGroups),
|
ExpectIntEQ(wolfSSL_set_groups(clientTls12Ssl, groups, numGroups),
|
||||||
BAD_FUNC_ARG);
|
WOLFSSL_SUCCESS);
|
||||||
#endif
|
#endif
|
||||||
ExpectIntEQ(wolfSSL_set_groups(clientSsl, groups,
|
ExpectIntEQ(wolfSSL_set_groups(clientSsl, groups,
|
||||||
WOLFSSL_MAX_GROUP_COUNT + 1), BAD_FUNC_ARG);
|
WOLFSSL_MAX_GROUP_COUNT + 1), BAD_FUNC_ARG);
|
||||||
@@ -55556,7 +55645,7 @@ static int test_tls13_apis(void)
|
|||||||
#ifndef NO_WOLFSSL_CLIENT
|
#ifndef NO_WOLFSSL_CLIENT
|
||||||
#ifndef WOLFSSL_NO_TLS12
|
#ifndef WOLFSSL_NO_TLS12
|
||||||
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(clientTls12Ctx, groupList),
|
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(clientTls12Ctx, groupList),
|
||||||
WOLFSSL_FAILURE);
|
WOLFSSL_SUCCESS);
|
||||||
#endif
|
#endif
|
||||||
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(clientCtx, groupList),
|
ExpectIntEQ(wolfSSL_CTX_set1_groups_list(clientCtx, groupList),
|
||||||
WOLFSSL_SUCCESS);
|
WOLFSSL_SUCCESS);
|
||||||
@@ -55574,7 +55663,7 @@ static int test_tls13_apis(void)
|
|||||||
#ifndef NO_WOLFSSL_CLIENT
|
#ifndef NO_WOLFSSL_CLIENT
|
||||||
#ifndef WOLFSSL_NO_TLS12
|
#ifndef WOLFSSL_NO_TLS12
|
||||||
ExpectIntEQ(wolfSSL_set1_groups_list(clientTls12Ssl, groupList),
|
ExpectIntEQ(wolfSSL_set1_groups_list(clientTls12Ssl, groupList),
|
||||||
WOLFSSL_FAILURE);
|
WOLFSSL_SUCCESS);
|
||||||
#endif
|
#endif
|
||||||
ExpectIntEQ(wolfSSL_set1_groups_list(clientSsl, groupList),
|
ExpectIntEQ(wolfSSL_set1_groups_list(clientSsl, groupList),
|
||||||
WOLFSSL_SUCCESS);
|
WOLFSSL_SUCCESS);
|
||||||
@@ -72416,6 +72505,7 @@ TEST_CASE testCases[] = {
|
|||||||
TEST_DECL(test_wolfSSL_configure_args),
|
TEST_DECL(test_wolfSSL_configure_args),
|
||||||
TEST_DECL(test_wolfSSL_sk_SSL_CIPHER),
|
TEST_DECL(test_wolfSSL_sk_SSL_CIPHER),
|
||||||
TEST_DECL(test_wolfSSL_set1_curves_list),
|
TEST_DECL(test_wolfSSL_set1_curves_list),
|
||||||
|
TEST_DECL(test_wolfSSL_curves_mismatch),
|
||||||
TEST_DECL(test_wolfSSL_set1_sigalgs_list),
|
TEST_DECL(test_wolfSSL_set1_sigalgs_list),
|
||||||
|
|
||||||
TEST_DECL(test_wolfSSL_OtherName),
|
TEST_DECL(test_wolfSSL_OtherName),
|
||||||
|
|||||||
@@ -306,6 +306,16 @@ int wc_PRF_TLS(byte* digest, word32 digLen, const byte* secret, word32 secLen,
|
|||||||
{
|
{
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
|
|
||||||
|
#ifdef WOLFSSL_DEBUG_TLS
|
||||||
|
WOLFSSL_MSG(" secret");
|
||||||
|
WOLFSSL_BUFFER(secret, secLen);
|
||||||
|
WOLFSSL_MSG(" label");
|
||||||
|
WOLFSSL_BUFFER(label, labLen);
|
||||||
|
WOLFSSL_MSG(" seed");
|
||||||
|
WOLFSSL_BUFFER(seed, seedLen);
|
||||||
|
#endif
|
||||||
|
|
||||||
|
|
||||||
if (useAtLeastSha256) {
|
if (useAtLeastSha256) {
|
||||||
#ifdef WOLFSSL_SMALL_STACK
|
#ifdef WOLFSSL_SMALL_STACK
|
||||||
byte* labelSeed;
|
byte* labelSeed;
|
||||||
@@ -350,6 +360,12 @@ int wc_PRF_TLS(byte* digest, word32 digLen, const byte* secret, word32 secLen,
|
|||||||
#endif
|
#endif
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#ifdef WOLFSSL_DEBUG_TLS
|
||||||
|
WOLFSSL_MSG(" digest");
|
||||||
|
WOLFSSL_BUFFER(digest, digLen);
|
||||||
|
WOLFSSL_MSG_EX("hash_type %d", hash_type);
|
||||||
|
#endif
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
#endif /* WOLFSSL_HAVE_PRF && !NO_HMAC */
|
#endif /* WOLFSSL_HAVE_PRF && !NO_HMAC */
|
||||||
|
|||||||
@@ -1773,7 +1773,7 @@ enum Misc {
|
|||||||
ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */
|
ECDHE_SIZE = 32, /* ECDHE server size defaults to 256 bit */
|
||||||
#endif
|
#endif
|
||||||
MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */
|
MAX_EXPORT_ECC_SZ = 256, /* Export ANSI X9.62 max future size */
|
||||||
MAX_CURVE_NAME_SZ = 16, /* Maximum size of curve name string */
|
MAX_CURVE_NAME_SZ = 18, /* Maximum size of curve name string */
|
||||||
|
|
||||||
NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */
|
NEW_SA_MAJOR = 8, /* Most significant byte used with new sig algos */
|
||||||
ED25519_SA_MAJOR = 8, /* Most significant byte for ED25519 */
|
ED25519_SA_MAJOR = 8, /* Most significant byte for ED25519 */
|
||||||
@@ -2360,16 +2360,8 @@ typedef struct CipherSuite {
|
|||||||
#endif
|
#endif
|
||||||
} CipherSuite;
|
} CipherSuite;
|
||||||
|
|
||||||
WOLFSSL_LOCAL void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig,
|
|
||||||
int haveRSAsig, int haveFalconSig,
|
|
||||||
int haveDilithiumSig, int haveAnon,
|
|
||||||
int tls1_2, int keySz);
|
|
||||||
WOLFSSL_LOCAL void InitSuitesHashSigAlgo_ex(byte* hashSigAlgo, int haveECDSAsig,
|
|
||||||
int haveRSAsig, int haveFalconSig,
|
|
||||||
int haveDilithiumSig, int haveAnon,
|
|
||||||
int tls1_2, int keySz, word16* len);
|
|
||||||
/* use wolfSSL_API visibility to be able to test in tests/api.c */
|
/* use wolfSSL_API visibility to be able to test in tests/api.c */
|
||||||
WOLFSSL_API void InitSuitesHashSigAlgo_ex2(byte* hashSigAlgo, int have,
|
WOLFSSL_API void InitSuitesHashSigAlgo(byte* hashSigAlgo, int have,
|
||||||
int tls1_2, int keySz,
|
int tls1_2, int keySz,
|
||||||
word16* len);
|
word16* len);
|
||||||
WOLFSSL_LOCAL int AllocateCtxSuites(WOLFSSL_CTX* ctx);
|
WOLFSSL_LOCAL int AllocateCtxSuites(WOLFSSL_CTX* ctx);
|
||||||
@@ -4045,13 +4037,16 @@ enum KeyExchangeAlgorithm {
|
|||||||
ecc_static_diffie_hellman_kea /* for verify suite only */
|
ecc_static_diffie_hellman_kea /* for verify suite only */
|
||||||
};
|
};
|
||||||
|
|
||||||
/* Used with InitSuitesHashSigAlgo_ex2 */
|
/* Used with InitSuitesHashSigAlgo */
|
||||||
#define SIG_ECDSA 0x01
|
#define SIG_ECDSA 0x01
|
||||||
#define SIG_RSA 0x02
|
#define SIG_RSA 0x02
|
||||||
#define SIG_SM2 0x04
|
#define SIG_SM2 0x04
|
||||||
#define SIG_FALCON 0x08
|
#define SIG_FALCON 0x08
|
||||||
#define SIG_DILITHIUM 0x10
|
#define SIG_DILITHIUM 0x10
|
||||||
#define SIG_ANON 0x20
|
#define SIG_ANON 0x20
|
||||||
|
/* SIG_ANON is omitted by default */
|
||||||
|
#define SIG_ALL (SIG_ECDSA | SIG_RSA | SIG_SM2 | SIG_FALCON | \
|
||||||
|
SIG_DILITHIUM)
|
||||||
|
|
||||||
/* Supported Authentication Schemes */
|
/* Supported Authentication Schemes */
|
||||||
enum SignatureAlgorithm {
|
enum SignatureAlgorithm {
|
||||||
@@ -5874,6 +5869,8 @@ struct WOLFSSL {
|
|||||||
#ifdef HAVE_SECRET_CALLBACK
|
#ifdef HAVE_SECRET_CALLBACK
|
||||||
SessionSecretCb sessionSecretCb;
|
SessionSecretCb sessionSecretCb;
|
||||||
void* sessionSecretCtx;
|
void* sessionSecretCtx;
|
||||||
|
TicketParseCb ticketParseCb;
|
||||||
|
void* ticketParseCtx;
|
||||||
TlsSecretCb tlsSecretCb;
|
TlsSecretCb tlsSecretCb;
|
||||||
void* tlsSecretCtx;
|
void* tlsSecretCtx;
|
||||||
#ifdef WOLFSSL_TLS13
|
#ifdef WOLFSSL_TLS13
|
||||||
@@ -6125,16 +6122,11 @@ typedef struct {
|
|||||||
int name_len;
|
int name_len;
|
||||||
const char *name;
|
const char *name;
|
||||||
int nid;
|
int nid;
|
||||||
|
word16 curve;
|
||||||
} WOLF_EC_NIST_NAME;
|
} WOLF_EC_NIST_NAME;
|
||||||
extern const WOLF_EC_NIST_NAME kNistCurves[];
|
extern const WOLF_EC_NIST_NAME kNistCurves[];
|
||||||
/* This is the longest and shortest curve name in the kNistCurves list. Note we
|
WOLFSSL_LOCAL int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx,
|
||||||
* also have quantum-safe group names as well. */
|
const char* names, byte curves_only);
|
||||||
#define kNistCurves_MIN_NAME_LEN 5
|
|
||||||
#ifdef HAVE_PQC
|
|
||||||
#define kNistCurves_MAX_NAME_LEN 32
|
|
||||||
#else
|
|
||||||
#define kNistCurves_MAX_NAME_LEN 7
|
|
||||||
#endif
|
|
||||||
#endif /* OPENSSL_EXTRA || WOLFSSL_WPAS_SMALL */
|
#endif /* OPENSSL_EXTRA || WOLFSSL_WPAS_SMALL */
|
||||||
|
|
||||||
/* internal functions */
|
/* internal functions */
|
||||||
@@ -6194,6 +6186,7 @@ WOLFSSL_LOCAL int DeriveKeys(WOLFSSL* ssl);
|
|||||||
WOLFSSL_LOCAL int StoreKeys(WOLFSSL* ssl, const byte* keyData, int side);
|
WOLFSSL_LOCAL int StoreKeys(WOLFSSL* ssl, const byte* keyData, int side);
|
||||||
|
|
||||||
WOLFSSL_LOCAL int IsTLS(const WOLFSSL* ssl);
|
WOLFSSL_LOCAL int IsTLS(const WOLFSSL* ssl);
|
||||||
|
WOLFSSL_LOCAL int IsTLS_ex(const ProtocolVersion pv);
|
||||||
WOLFSSL_LOCAL int IsAtLeastTLSv1_2(const WOLFSSL* ssl);
|
WOLFSSL_LOCAL int IsAtLeastTLSv1_2(const WOLFSSL* ssl);
|
||||||
WOLFSSL_LOCAL int IsAtLeastTLSv1_3(ProtocolVersion pv);
|
WOLFSSL_LOCAL int IsAtLeastTLSv1_3(ProtocolVersion pv);
|
||||||
WOLFSSL_LOCAL int IsEncryptionOn(const WOLFSSL* ssl, int isSend);
|
WOLFSSL_LOCAL int IsEncryptionOn(const WOLFSSL* ssl, int isSend);
|
||||||
@@ -6422,6 +6415,7 @@ WOLFSSL_LOCAL int cipherExtraData(WOLFSSL* ssl);
|
|||||||
WOLFSSL_LOCAL word32 LowResTimer(void);
|
WOLFSSL_LOCAL word32 LowResTimer(void);
|
||||||
|
|
||||||
WOLFSSL_LOCAL int FindSuiteSSL(const WOLFSSL* ssl, byte* suite);
|
WOLFSSL_LOCAL int FindSuiteSSL(const WOLFSSL* ssl, byte* suite);
|
||||||
|
WOLFSSL_LOCAL int FindSuite(const Suites* suites, byte first, byte second);
|
||||||
|
|
||||||
WOLFSSL_LOCAL void DecodeSigAlg(const byte* input, byte* hashAlgo,
|
WOLFSSL_LOCAL void DecodeSigAlg(const byte* input, byte* hashAlgo,
|
||||||
byte* hsType);
|
byte* hsType);
|
||||||
|
|||||||
@@ -74,9 +74,15 @@ enum {
|
|||||||
#ifdef HAVE_ED448
|
#ifdef HAVE_ED448
|
||||||
NID_ED448 = ED448k,
|
NID_ED448 = ED448k,
|
||||||
#endif
|
#endif
|
||||||
|
#ifdef HAVE_CURVE448
|
||||||
|
NID_X448 = X448k,
|
||||||
|
#endif
|
||||||
#ifdef HAVE_ED25519
|
#ifdef HAVE_ED25519
|
||||||
NID_ED25519 = ED25519k,
|
NID_ED25519 = ED25519k,
|
||||||
#endif
|
#endif
|
||||||
|
#ifdef HAVE_CURVE25519
|
||||||
|
NID_X25519 = X25519k,
|
||||||
|
#endif
|
||||||
|
|
||||||
OPENSSL_EC_EXPLICIT_CURVE = 0x000,
|
OPENSSL_EC_EXPLICIT_CURVE = 0x000,
|
||||||
OPENSSL_EC_NAMED_CURVE = 0x001,
|
OPENSSL_EC_NAMED_CURVE = 0x001,
|
||||||
|
|||||||
@@ -1182,6 +1182,21 @@ WOLFSSL_API int wolfSSL_peek(WOLFSSL* ssl, void* data, int sz);
|
|||||||
WOLFSSL_ABI WOLFSSL_API int wolfSSL_accept(WOLFSSL* ssl);
|
WOLFSSL_ABI WOLFSSL_API int wolfSSL_accept(WOLFSSL* ssl);
|
||||||
WOLFSSL_API int wolfSSL_CTX_mutual_auth(WOLFSSL_CTX* ctx, int req);
|
WOLFSSL_API int wolfSSL_CTX_mutual_auth(WOLFSSL_CTX* ctx, int req);
|
||||||
WOLFSSL_API int wolfSSL_mutual_auth(WOLFSSL* ssl, int req);
|
WOLFSSL_API int wolfSSL_mutual_auth(WOLFSSL* ssl, int req);
|
||||||
|
|
||||||
|
WOLFSSL_API int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups,
|
||||||
|
int count);
|
||||||
|
WOLFSSL_API int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count);
|
||||||
|
#if defined(OPENSSL_EXTRA) && defined(HAVE_SUPPORTED_CURVES)
|
||||||
|
WOLFSSL_API int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
|
||||||
|
int count);
|
||||||
|
WOLFSSL_API int wolfSSL_set1_groups(WOLFSSL* ssl, int* groups, int count);
|
||||||
|
|
||||||
|
#ifdef HAVE_ECC
|
||||||
|
WOLFSSL_API int wolfSSL_CTX_set1_groups_list(WOLFSSL_CTX *ctx, const char *list);
|
||||||
|
WOLFSSL_API int wolfSSL_set1_groups_list(WOLFSSL *ssl, const char *list);
|
||||||
|
#endif
|
||||||
|
#endif
|
||||||
|
|
||||||
#ifdef WOLFSSL_TLS13
|
#ifdef WOLFSSL_TLS13
|
||||||
WOLFSSL_API int wolfSSL_send_hrr_cookie(WOLFSSL* ssl,
|
WOLFSSL_API int wolfSSL_send_hrr_cookie(WOLFSSL* ssl,
|
||||||
const unsigned char* secret, unsigned int secretSz);
|
const unsigned char* secret, unsigned int secretSz);
|
||||||
@@ -1199,20 +1214,6 @@ WOLFSSL_API int wolfSSL_allow_post_handshake_auth(WOLFSSL* ssl);
|
|||||||
WOLFSSL_API int wolfSSL_request_certificate(WOLFSSL* ssl);
|
WOLFSSL_API int wolfSSL_request_certificate(WOLFSSL* ssl);
|
||||||
|
|
||||||
WOLFSSL_API int wolfSSL_preferred_group(WOLFSSL* ssl);
|
WOLFSSL_API int wolfSSL_preferred_group(WOLFSSL* ssl);
|
||||||
WOLFSSL_API int wolfSSL_CTX_set_groups(WOLFSSL_CTX* ctx, int* groups,
|
|
||||||
int count);
|
|
||||||
WOLFSSL_API int wolfSSL_set_groups(WOLFSSL* ssl, int* groups, int count);
|
|
||||||
|
|
||||||
#if defined(OPENSSL_EXTRA) && defined(HAVE_SUPPORTED_CURVES)
|
|
||||||
WOLFSSL_API int wolfSSL_CTX_set1_groups(WOLFSSL_CTX* ctx, int* groups,
|
|
||||||
int count);
|
|
||||||
WOLFSSL_API int wolfSSL_set1_groups(WOLFSSL* ssl, int* groups, int count);
|
|
||||||
|
|
||||||
#ifdef HAVE_ECC
|
|
||||||
WOLFSSL_API int wolfSSL_CTX_set1_groups_list(WOLFSSL_CTX *ctx, const char *list);
|
|
||||||
WOLFSSL_API int wolfSSL_set1_groups_list(WOLFSSL *ssl, const char *list);
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
|
|
||||||
WOLFSSL_API int wolfSSL_connect_TLSv13(WOLFSSL* ssl);
|
WOLFSSL_API int wolfSSL_connect_TLSv13(WOLFSSL* ssl);
|
||||||
WOLFSSL_API int wolfSSL_accept_TLSv13(WOLFSSL* ssl);
|
WOLFSSL_API int wolfSSL_accept_TLSv13(WOLFSSL* ssl);
|
||||||
@@ -1367,8 +1368,12 @@ WOLFSSL_ABI WOLFSSL_API long wolfSSL_CTX_set_session_cache_mode(WOLFSSL_CTX* ctx
|
|||||||
typedef int (*SessionSecretCb)(WOLFSSL* ssl, void* secret, int* secretSz,
|
typedef int (*SessionSecretCb)(WOLFSSL* ssl, void* secret, int* secretSz,
|
||||||
void* ctx);
|
void* ctx);
|
||||||
/* This callback is used to set the master secret during resumption */
|
/* This callback is used to set the master secret during resumption */
|
||||||
WOLFSSL_API int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb,
|
WOLFSSL_API int wolfSSL_set_session_secret_cb(WOLFSSL* ssl, SessionSecretCb cb,
|
||||||
void*);
|
void* ctx);
|
||||||
|
typedef int (*TicketParseCb)(WOLFSSL *ssl, const unsigned char *data,
|
||||||
|
int len, void *ctx);
|
||||||
|
WOLFSSL_API int wolfSSL_set_session_ticket_ext_cb(WOLFSSL* ssl,
|
||||||
|
TicketParseCb cb, void *ctx);
|
||||||
typedef int (*TlsSecretCb)(WOLFSSL* ssl, void* secret, int secretSz,
|
typedef int (*TlsSecretCb)(WOLFSSL* ssl, void* secret, int secretSz,
|
||||||
void* ctx);
|
void* ctx);
|
||||||
/* This callback is used to log the secret for TLS <= 1.2 */
|
/* This callback is used to log the secret for TLS <= 1.2 */
|
||||||
|
|||||||
Reference in New Issue
Block a user