diff --git a/IDE/MDK5-ARM/Projects/CryptBenchmark/benchmark.c b/IDE/MDK5-ARM/Projects/CryptBenchmark/benchmark.c index 417ae3177..fa13b8b80 100644 --- a/IDE/MDK5-ARM/Projects/CryptBenchmark/benchmark.c +++ b/IDE/MDK5-ARM/Projects/CryptBenchmark/benchmark.c @@ -52,7 +52,7 @@ #include "cavium_ioctl.h" #endif #ifdef HAVE_NTRU - #include "ntru_crypto.h" + #include "libntruencrypt/ntru_crypto.h" #endif #if defined(CYASSL_MDK_ARM) diff --git a/IDE/MDK5-ARM/Projects/CryptTest/test.c b/IDE/MDK5-ARM/Projects/CryptTest/test.c index ac5c775b2..167832eae 100644 --- a/IDE/MDK5-ARM/Projects/CryptTest/test.c +++ b/IDE/MDK5-ARM/Projects/CryptTest/test.c @@ -101,7 +101,7 @@ #endif #ifdef HAVE_NTRU - #include "ntru_crypto.h" + #include "libntruencrypt/ntru_crypto.h" #endif #ifdef HAVE_CAVIUM #include "cavium_sysdep.h" diff --git a/IDE/WIN/README.txt b/IDE/WIN/README.txt index d2ed0faaa..81695ded9 100644 --- a/IDE/WIN/README.txt +++ b/IDE/WIN/README.txt @@ -3,7 +3,7 @@ First, if you did not get the FIPS files with your archive, you must contact wolfSSL to obtain them. -# On Building the wolfssl-fips project +# Building the wolfssl-fips project The wolfCrypt FIPS library for Windows is a part of the wolfSSL library. It must be built as a static library. @@ -14,10 +14,25 @@ There are two functions added to the library that are used as markers in memory for the in-core memory check of the code. WPO consolidates them into a single function. WPO also optimizes away the automatic FIPS entry function. -A project using the library must disable - Each of the source files inside the FIPS boundary defines their own code and constant section. The code section names start with ".fipsA$" and the constant section names start with ".fipsB$". Each subsection has a letter to organize them in a secific order. This specific ordering puts marker functions and constants on either end of the boundary so it can be hashed. + +# In Core Memory Test + +The In Core Memory test calculates a checksum (HMAC-SHA256) of the wolfCrypt +FIPS library code and constant data and compares it with a known value in +the code. + +The Randomized Base Address setting doesn't cause any problems because +(I believe) that the addrsses in the executable are all offsets from the base +rather than absolute addresses. + +The "verifyCore" check value in the source fips_test.c needs to be updated when +building the code. The POS performs this check and the default failure callback +will print out the calculated checksum. When developing your code, copy this +value and paste it back into your code in the verifyCore initializer then +rebuild the code. When statically linking, you may have to recalculate your +check value when changing your application. diff --git a/IDE/WIN/test.vcxproj b/IDE/WIN/test.vcxproj index 47681399b..38e264b20 100644 --- a/IDE/WIN/test.vcxproj +++ b/IDE/WIN/test.vcxproj @@ -111,7 +111,7 @@ Disabled ..\..\;%(AdditionalIncludeDirectories) - WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) + WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) EnableFastChecks MultiThreadedDebugDLL @@ -130,7 +130,7 @@ Disabled ..\..\;%(AdditionalIncludeDirectories) - WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) + WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) EnableFastChecks MultiThreadedDebugDLL @@ -147,7 +147,7 @@ ..\..\;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) + WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) MultiThreadedDLL Level3 @@ -167,7 +167,7 @@ ..\..\;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) + WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;%(PreprocessorDefinitions) MultiThreadedDLL Level3 @@ -181,14 +181,13 @@ true true UseLinkTimeCodeGeneration - false Disabled ..\..\;%(AdditionalIncludeDirectories) - WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) + WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) EnableFastChecks MultiThreadedDebugDLL @@ -207,7 +206,7 @@ Disabled ..\..\;%(AdditionalIncludeDirectories) - WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) + WIN32;_DEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) EnableFastChecks MultiThreadedDebugDLL @@ -224,7 +223,7 @@ ..\..\;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) + WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) MultiThreadedDLL Level3 @@ -244,7 +243,7 @@ ..\..\;%(AdditionalIncludeDirectories) - WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) + WIN32;NDEBUG;_CONSOLE;OPENSSL_EXTRA;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;USE_CERT_BUFFERS_2048;WOLFSSL_DLL;%(PreprocessorDefinitions) MultiThreadedDLL Level3 diff --git a/IDE/WIN/wolfssl-fips.vcxproj b/IDE/WIN/wolfssl-fips.vcxproj index b1a68ebac..c63c79bd1 100644 --- a/IDE/WIN/wolfssl-fips.vcxproj +++ b/IDE/WIN/wolfssl-fips.vcxproj @@ -120,7 +120,7 @@ Disabled ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) EnableFastChecks MultiThreadedDebugDLL Level4 @@ -132,7 +132,7 @@ Disabled ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) true EnableFastChecks MultiThreadedDebugDLL @@ -145,7 +145,7 @@ Disabled ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) EnableFastChecks MultiThreadedDebugDLL Level4 @@ -157,7 +157,7 @@ Disabled ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) EnableFastChecks MultiThreadedDebugDLL Level4 @@ -175,7 +175,7 @@ MaxSpeed true ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) MultiThreadedDLL true Level3 @@ -187,7 +187,7 @@ MaxSpeed true ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) MultiThreadedDLL true Level3 @@ -199,7 +199,7 @@ MaxSpeed true ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) MultiThreadedDLL true Level3 @@ -212,7 +212,7 @@ MaxSpeed true ./;../../;%(AdditionalIncludeDirectories) - OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) + OPENSSL_EXTRA;HAVE_THREAD_LS;WOLFSSL_KEY_GEN;BUILDING_WOLFSSL;WOLFSSL_DLL;HAVE_FIPS;HAVE_AESGCM;HAVE_HASHDRBG;WOLFSSL_SHA384;WOLFSSL_SHA512;NO_PSK;NO_HC128;NO_RC4;NO_RABBIT;NO_DSA;NO_MD4;%(PreprocessorDefinitions) MultiThreadedDLL true Level3 @@ -261,34 +261,26 @@ $(IntDir)ctaocrypt\ - - - - - - - - diff --git a/LICENSING b/LICENSING index e43bb9f39..9f50165fd 100644 --- a/LICENSING +++ b/LICENSING @@ -1,7 +1,7 @@ -CyaSSL and wolfCrypt are either licensed for use under the GPLv2 or a -standard commercial license. For our users who cannot use CyaSSL under -GPLv2, a commercial license to CyaSSL and wolfCrypt is available. +wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use +under the GPLv2 or a standard commercial license. For our users who cannot use +wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. Please contact wolfSSL Inc. directly at: Email: licensing@wolfssl.com diff --git a/README b/README index c7245ecbc..74abbb0e8 100644 --- a/README +++ b/README @@ -34,7 +34,18 @@ before calling wolfSSL_new(); Though it's not recommended. *** end Notes *** -wolfSSL (Formerly CyaSSL) Release 3.6.0 (06/19/2015) +wolfSSL (Formerly CyaSSL) Release 3.6.2 (07/20/2015) + +Release 3.6.2 of wolfSSL is an intermediate custom release including: + +- OpenSSH compatibility with --enable-openssh +- stunnel compatibility with --enable-stunnel +- lighttpd compatibility with --enable-lighty + +See INSTALL file for build instructions. +More info can be found on-line at //http://wolfssl.com/yaSSL/Docs.html + + **************** wolfSSL (Formerly CyaSSL) Release 3.6.0 (06/19/2015) Release 3.6.0 of wolfSSL has bug fixes and new features including: diff --git a/README.md b/README.md index 7b7d57ce8..edbfb9d35 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,18 @@ before calling wolfSSL_new(); Though it's not recommended. - GNU Binutils 2.24 ld has problems with some debug builds, to fix an ld error add -fdebug-types-section to C_EXTRA_FLAGS +#wolfSSL (Formerly CyaSSL) Release 3.6.2 (07/20/2015) + +##Release 3.6.2 of wolfSSL is an intermediate custom release including: + +- OpenSSH compatibility with --enable-openssh +- stunnel compatibility with --enable-stunnel +- lighttpd compatibility with --enable-lighty + +See INSTALL file for build instructions. +More info can be found on-line at //http://wolfssl.com/yaSSL/Docs.html + + #wolfSSL (Formerly CyaSSL) Release 3.6.0 (06/19/2015) ##Release 3.6.0 of wolfSSL has bug fixes and new features including: diff --git a/configure.ac b/configure.ac index 96a7aa7a9..e66b68718 100644 --- a/configure.ac +++ b/configure.ac @@ -6,7 +6,7 @@ # # -AC_INIT([wolfssl],[3.6.1],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[http://www.wolfssl.com]) +AC_INIT([wolfssl],[3.6.2],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[http://www.wolfssl.com]) AC_CONFIG_AUX_DIR([build-aux]) @@ -148,12 +148,24 @@ then fi +# OpenSSH compatibility Build +AC_ARG_ENABLE([openssh], + [AS_HELP_STRING([--enable-openssh],[Enable OpenSSH compatibility build (default: disabled)])], + [ENABLED_OPENSSH=$enableval], + [ENABLED_OPENSSH=no]) + + # OPENSSL Extra Compatibility AC_ARG_ENABLE([opensslextra], [ --enable-opensslextra Enable extra OpenSSL API, size+ (default: disabled)], [ ENABLED_OPENSSLEXTRA=$enableval ], [ ENABLED_OPENSSLEXTRA=no ] ) +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_OPENSSLEXTRA="yes" +fi + if test "$ENABLED_OPENSSLEXTRA" = "yes" then AM_CFLAGS="-DOPENSSL_EXTRA $AM_CFLAGS" @@ -194,6 +206,11 @@ AC_ARG_ENABLE([fortress], [ ENABLED_FORTRESS=no ] ) +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_FORTRESS="yes" +fi + if test "$ENABLED_FORTRESS" = "yes" then AM_CFLAGS="$AM_CFLAGS -DFORTRESS -DWOLFSSL_ALWAYS_VERIFY_CB -DOPENSSL_EXTRA -DWOLFSSL_DES_ECB -DWOLFSSL_AES_COUNTER -DWOLFSSL_AES_DIRECT -DWOLFSSL_DER_LOAD -DWOLFSSL_SHA512 -DWOLFSSL_SHA384 -DWOLFSSL_KEY_GEN" @@ -481,6 +498,11 @@ AC_ARG_ENABLE([nullcipher], [ ENABLED_NULL_CIPHER=no ] ) +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_NULL_CIPHER="yes" +fi + if test "$ENABLED_NULL_CIPHER" = "yes" then AM_CFLAGS="$AM_CFLAGS -DHAVE_NULL_CIPHER" @@ -493,6 +515,11 @@ AC_ARG_ENABLE([ripemd], [ ENABLED_RIPEMD=no ] ) +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_RIPEMD="yes" +fi + if test "$ENABLED_RIPEMD" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_RIPEMD" @@ -536,6 +563,11 @@ then ENABLED_SHA512=no fi +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_SHA512="yes" +fi + if test "$ENABLED_SHA512" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384" @@ -637,6 +669,11 @@ AC_ARG_ENABLE([dsa], [ ENABLED_DSA=no ] ) +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_DSA="yes" +fi + if test "$ENABLED_DSA" = "no" then AM_CFLAGS="$AM_CFLAGS -DNO_DSA" @@ -666,6 +703,11 @@ then ENABLED_ECC=no fi +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_ECC="yes" +fi + if test "$ENABLED_ECC" = "yes" then AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256 -DECC_SHAMIR" @@ -901,6 +943,11 @@ AC_ARG_ENABLE([dh], [ ENABLED_DH=yes ] ) +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_DH="yes" +fi + if test "$ENABLED_DH" = "no" then AM_CFLAGS="$AM_CFLAGS -DNO_DH" @@ -1000,6 +1047,14 @@ AC_ARG_ENABLE([aes], if test "$ENABLED_AES" = "no" then AM_CFLAGS="$AM_CFLAGS -DNO_AES" + if test "$ENABLED_FORTRESS" = "yes" + then + AC_MSG_ERROR([fortress requires aes]) + fi + if test "$ENABLED_ECC_ENCRYPT" = "yes" + then + AC_MSG_ERROR([cannot enable eccencrypt and hkdf without aes.]) + fi if test "$ENABLED_AESGCM" = "yes" then AC_MSG_ERROR([AESGCM requires AES.]) @@ -1071,6 +1126,11 @@ AC_ARG_ENABLE([arc4], [ ENABLED_ARC4=no ] ) +if test "$ENABLED_OPENSSH" = "yes" +then + ENABLED_ARC4="yes" +fi + if test "$ENABLED_ARC4" = "no" then AM_CFLAGS="$AM_CFLAGS -DNO_RC4" @@ -1130,21 +1190,6 @@ fi AM_CONDITIONAL([BUILD_SHA], [test "x$ENABLED_SHA" = "xyes"]) -# MD4 -AC_ARG_ENABLE([md4], - [ --enable-md4 Enable MD4 (default: disabled)], - [ ENABLED_MD4=$enableval ], - [ ENABLED_MD4=no ] - ) - -if test "$ENABLED_MD4" = "no" -then - AM_CFLAGS="$AM_CFLAGS -DNO_MD4" -fi - -AM_CONDITIONAL([BUILD_MD4], [test "x$ENABLED_MD4" = "xyes"]) - - # Web Server Build AC_ARG_ENABLE([webserver], [ --enable-webserver Enable Web Server (default: disabled)], @@ -1412,9 +1457,9 @@ AC_ARG_WITH([ntru], [ AC_MSG_CHECKING([for NTRU]) CPPFLAGS="$CPPFLAGS -DHAVE_NTRU -DHAVE_QSH -DHAVE_TLS_EXTENSIONS" - LIBS="$LIBS -lNTRUEncrypt" + LIBS="$LIBS -lntruencrypt" - AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ ntru_crypto_drbg_instantiate(0, 0, 0, 0, 0); ]])], [ ntru_linked=yes ],[ ntru_linked=no ]) + AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ ntru_crypto_drbg_instantiate(0, 0, 0, 0, 0); ]])], [ ntru_linked=yes ],[ ntru_linked=no ]) if test "x$ntru_linked" == "xno" ; then if test "x$withval" != "xno" ; then @@ -1427,7 +1472,7 @@ AC_ARG_WITH([ntru], LDFLAGS="$AM_LDFLAGS -L$tryntrudir/lib" CPPFLAGS="$CPPFLAGS -I$tryntrudir/include" - AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ ntru_crypto_drbg_instantiate(0, 0, 0, 0, 0); ]])], [ ntru_linked=yes ],[ ntru_linked=no ]) + AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[ ntru_crypto_drbg_instantiate(0, 0, 0, 0, 0); ]])], [ ntru_linked=yes ],[ ntru_linked=no ]) if test "x$ntru_linked" == "xno" ; then AC_MSG_ERROR([NTRU isn't found. @@ -1717,6 +1762,66 @@ then AM_CFLAGS="$AM_CFLAGS -DHAVE_LIGHTY -DHAVE_WOLFSSL_SSL_H=1" fi +# stunnel Support +AC_ARG_ENABLE([stunnel], + [ --enable-stunnel Enable stunnel (default: disabled)], + [ ENABLED_STUNNEL=$enableval ], + [ ENABLED_STUNNEL=no ] + ) +if test "$ENABLED_STUNNEL" = "yes" +then + # Requires opensslextra make sure on + if test "x$ENABLED_OPENSSLEXTRA" = "xno" + then + ENABLED_OPENSSLEXTRA="yes" + AM_CFLAGS="-DOPENSSL_EXTRA $AM_CFLAGS" + fi + + # Requires coding make sure on + if test "x$ENABLED_CODING" = "xno" + then + ENABLED_CODING="yes" + fi + + # Requires sessioncerts make sure on + if test "x$ENABLED_SESSIONCERTS" = "xno" + then + ENABLED_SESSIONCERTS="yes" + AM_CFLAGS="$AM_CFLAGS -DSESSION_CERTS" + fi + + # Requires crls, make sure on + if test "x$ENABLED_CRL" = "xno" + then + ENABLED_CRL="yes" + AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL" + AM_CONDITIONAL([BUILD_CRL], [test "x$ENABLED_CRL" = "xyes"]) + fi + AM_CFLAGS="$AM_CFLAGS -DHAVE_STUNNEL" +fi + + +# MD4 +AC_ARG_ENABLE([md4], + [ --enable-md4 Enable MD4 (default: disabled)], + [ ENABLED_MD4=$enableval ], + [ ENABLED_MD4=no ] + ) + + +if test "$ENABLED_MD4" = "no" +then + #turn on MD4 if using stunnel + if test "x$ENABLED_STUNNEL" = "xyes" + then + ENABLED_MD4="yes" + else + AM_CFLAGS="$AM_CFLAGS -DNO_MD4" + fi +fi + +AM_CONDITIONAL([BUILD_MD4], [test "x$ENABLED_MD4" = "xyes"]) + # PWDBASED has to come after certservice since we want it on w/o explicit on # PWDBASED @@ -1745,7 +1850,7 @@ FASTMATH_DEFAULT=no if test "$host_cpu" = "x86_64" then -FASTMATH_DEFAULT=yes + FASTMATH_DEFAULT=yes fi # fastmath @@ -2173,6 +2278,7 @@ echo echo " Features " echo " * Single threaded: $ENABLED_SINGLETHREADED" echo " * Filesystem: $ENABLED_FILESYSTEM" +echo " * OpenSSH Build: $ENABLED_OPENSSH" echo " * OpenSSL Extra API: $ENABLED_OPENSSLEXTRA" echo " * Max Strength Build: $ENABLED_MAXSTRENGTH" echo " * fastmath: $ENABLED_FASTMATH" @@ -2218,6 +2324,7 @@ echo " * CODING: $ENABLED_CODING" echo " * MEMORY: $ENABLED_MEMORY" echo " * I/O POOL: $ENABLED_IOPOOL" echo " * LIGHTY: $ENABLED_LIGHTY" +echo " * STUNNEL: $ENABLED_STUNNEL" echo " * ERROR_STRINGS: $ENABLED_ERROR_STRINGS" echo " * DTLS: $ENABLED_DTLS" echo " * Old TLS Versions: $ENABLED_OLD_TLS" diff --git a/cyassl/ctaocrypt/blake2-impl.h b/cyassl/ctaocrypt/blake2-impl.h index fc5ec3a49..de6ed273b 100644 --- a/cyassl/ctaocrypt/blake2-impl.h +++ b/cyassl/ctaocrypt/blake2-impl.h @@ -36,7 +36,7 @@ #define CTAOCRYPT_BLAKE2_IMPL_H #include -#include +#include #endif /* CTAOCRYPT_BLAKE2_IMPL_H */ diff --git a/cyassl/ctaocrypt/blake2-int.h b/cyassl/ctaocrypt/blake2-int.h index 07ea8e745..9dadaadcb 100644 --- a/cyassl/ctaocrypt/blake2-int.h +++ b/cyassl/ctaocrypt/blake2-int.h @@ -37,7 +37,7 @@ #define CTAOCRYPT_BLAKE2_INT_H #include -#include +#include #endif /* CTAOCRYPT_BLAKE2_INT_H */ diff --git a/mcapi/crypto.h b/mcapi/crypto.h index 7a960d855..82b4d0249 100644 --- a/mcapi/crypto.h +++ b/mcapi/crypto.h @@ -163,7 +163,7 @@ enum { /* AES */ typedef struct CRYPT_AES_CTX { - int holder[70]; /* big enough to hold internal, but check on init */ + int holder[74]; /* big enough to hold internal, but check on init */ } CRYPT_AES_CTX; /* key */ diff --git a/scripts/resume.test b/scripts/resume.test index e4b0a6eb3..17bfd8c9f 100755 --- a/scripts/resume.test +++ b/scripts/resume.test @@ -7,6 +7,15 @@ resume_port=11112 no_pid=-1 server_pid=$no_pid + +remove_ready_file() { + if test -e /tmp/wolfssl_server_ready; then + echo -e "removing exisitng server_ready file" + rm /tmp/wolfssl_server_ready + fi +} + + do_cleanup() { echo "in cleanup" @@ -15,6 +24,7 @@ do_cleanup() { echo "killing server" kill -9 $server_pid fi + remove_ready_file } do_trap() { @@ -27,10 +37,7 @@ trap do_trap INT TERM echo -e "\nStarting example server for resume test...\n" -if test -e /tmp/wolfssl_server_ready; then - echo -e "removing exisitng server_ready file" - rm /tmp/wolfssl_server_ready -fi +remove_ready_file ./examples/server/server -r -R -p $resume_port & server_pid=$! @@ -51,6 +58,7 @@ fi wait $server_pid server_result=$? +remove_ready_file if [ $server_result != 0 ] then diff --git a/src/internal.c b/src/internal.c index b63b1fe2a..fa4208c44 100644 --- a/src/internal.c +++ b/src/internal.c @@ -41,7 +41,7 @@ #endif #ifdef HAVE_NTRU - #include "ntru_crypto.h" + #include "libntruencrypt/ntru_crypto.h" #endif #if defined(DEBUG_WOLFSSL) || defined(SHOW_SECRETS) || defined(CHACHA_AEAD_TEST) @@ -247,7 +247,7 @@ static int QSH_FreeAll(WOLFSSL* ssl) static RNG* rng; static wolfSSL_Mutex* rngMutex; -static word32 GetEntropy(unsigned char* out, unsigned long long num_bytes) +static word32 GetEntropy(unsigned char* out, word32 num_bytes) { int ret = 0; @@ -265,7 +265,7 @@ static word32 GetEntropy(unsigned char* out, unsigned long long num_bytes) } ret |= LockMutex(rngMutex); - ret |= wc_RNG_GenerateBlock(rng, out, (word32)num_bytes); + ret |= wc_RNG_GenerateBlock(rng, out, num_bytes); ret |= UnLockMutex(rngMutex); if (ret != 0) @@ -4464,7 +4464,7 @@ static int DoCertificate(WOLFSSL* ssl, byte* input, word32* inOutIdx, #else store->current_cert = NULL; #endif -#ifdef FORTRESS +#if defined(HAVE_FORTRESS) || defined(HAVE_STUNNEL) store->ex_data = ssl; #endif ok = ssl->verifyCallback(0, store); @@ -10623,7 +10623,7 @@ static int NtruSecretEncrypt(QSHKey* key, byte* bufIn, word32 inSz, } /* set up ntru drbg */ - ret = ntru_crypto_external_drbg_instantiate(GetEntropy, &drbg); + ret = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg); if (ret != DRBG_OK) return NTRU_DRBG_ERROR; @@ -10670,7 +10670,7 @@ static int NtruSecretDecrypt(QSHKey* key, byte* bufIn, word32 inSz, /* set up drbg */ - ret = ntru_crypto_external_drbg_instantiate(GetEntropy, &drbg); + ret = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg); if (ret != DRBG_OK) return NTRU_DRBG_ERROR; @@ -10805,7 +10805,7 @@ static word32 QSH_MaxSecret(QSHKey* key) } if (isNtru) { - ret = ntru_crypto_external_drbg_instantiate(GetEntropy, &drbg); + ret = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg); if (ret != DRBG_OK) return NTRU_DRBG_ERROR; ret = ntru_crypto_ntru_encrypt(drbg, key->pub.length, @@ -11251,7 +11251,7 @@ static word32 QSH_KeyExchangeWrite(WOLFSSL* ssl, byte isServer) return NO_PEER_KEY; } - rc = ntru_crypto_external_drbg_instantiate(GetEntropy, &drbg); + rc = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg); if (rc != DRBG_OK) { #ifdef WOLFSSL_SMALL_STACK XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER); diff --git a/src/ssl.c b/src/ssl.c index 211112164..feb86736c 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -521,6 +521,35 @@ int wolfSSL_CTX_SetTmpDH(WOLFSSL_CTX* ctx, const unsigned char* p, int pSz, return SSL_SUCCESS; } + +int wolfSSL_CTX_SetMinDhKey_Sz(WOLFSSL_CTX* ctx, word16 keySz) +{ + if (ctx == NULL || keySz > 16000 || keySz % 8 != 0) + return BAD_FUNC_ARG; + + ctx->minDhKeySz = keySz / 8; + return SSL_SUCCESS; +} + + +int wolfSSL_SetMinDhKey_Sz(WOLFSSL* ssl, word16 keySz) +{ + if (ssl == NULL || keySz > 16000 || keySz % 8 != 0) + return BAD_FUNC_ARG; + + ssl->options.minDhKeySz = keySz / 8; + return SSL_SUCCESS; +} + + +int wolfSSL_GetDhKey_Sz(WOLFSSL* ssl) +{ + if (ssl == NULL) + return BAD_FUNC_ARG; + + return (ssl->options.dhKeySz * 8); +} + #endif /* !NO_DH */ @@ -1648,7 +1677,6 @@ int wolfSSL_KeyPemToDer(const unsigned char* pem, int pemSz, } XFREE(der.buffer, NULL, DYNAMIC_TYPE_KEY); - return ret; } @@ -3493,8 +3521,10 @@ int wolfSSL_CTX_load_verify_locations(WOLFSSL_CTX* ctx, const char* file, #ifdef WOLFSSL_SMALL_STACK name = (char*)XMALLOC(MAX_FILENAME_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER); - if (name == NULL) + if (name == NULL) { + closedir(dir); return MEMORY_E; + } #endif while ( ret == SSL_SUCCESS && (entry = readdir(dir)) != NULL) { @@ -4130,36 +4160,6 @@ int wolfSSL_CTX_SetTmpDH_file(WOLFSSL_CTX* ctx, const char* fname, int format) return wolfSSL_SetTmpDH_file_wrapper(ctx, NULL, fname, format); } - -int wolfSSL_CTX_SetMinDhKey_Sz(WOLFSSL_CTX* ctx, word16 keySz) -{ - if (ctx == NULL || keySz > 16000 || keySz % 8 != 0) - return BAD_FUNC_ARG; - - ctx->minDhKeySz = keySz / 8; - return SSL_SUCCESS; -} - - -int wolfSSL_SetMinDhKey_Sz(WOLFSSL* ssl, word16 keySz) -{ - if (ssl == NULL || keySz > 16000 || keySz % 8 != 0) - return BAD_FUNC_ARG; - - ssl->options.minDhKeySz = keySz / 8; - return SSL_SUCCESS; -} - - -int wolfSSL_GetDhKey_Sz(WOLFSSL* ssl) -{ - if (ssl == NULL) - return BAD_FUNC_ARG; - - return (ssl->options.dhKeySz * 8); -} - - #endif /* NO_DH */ @@ -7184,8 +7184,14 @@ int wolfSSL_set_compression(WOLFSSL* ssl) void wolfSSL_set_shutdown(WOLFSSL* ssl, int opt) { - (void)ssl; - (void)opt; + WOLFSSL_ENTER("wolfSSL_set_shutdown"); + if(ssl==NULL) { + WOLFSSL_MSG("Shutdown not set. ssl is null"); + return; + } + + ssl->options.sentNotify = (opt&SSL_SENT_SHUTDOWN) > 0; + ssl->options.closeNotify = (opt&SSL_RECEIVED_SHUTDOWN) > 0; } @@ -7238,7 +7244,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl) WOLFSSL_X509_STORE_CTX* ctx) { (void)ctx; - return 0; + return NULL; } @@ -8855,14 +8861,18 @@ int wolfSSL_set_compression(WOLFSSL* ssl) WOLFSSL_X509_NAME* wolfSSL_X509_get_issuer_name(WOLFSSL_X509* cert) { WOLFSSL_ENTER("X509_get_issuer_name"); - return &cert->issuer; + if(cert) + return &cert->issuer; + return NULL; } WOLFSSL_X509_NAME* wolfSSL_X509_get_subject_name(WOLFSSL_X509* cert) { WOLFSSL_ENTER("X509_get_subject_name"); - return &cert->subject; + if(cert) + return &cert->subject; + return NULL; } @@ -9535,23 +9545,6 @@ WOLFSSL_X509* wolfSSL_X509_load_certificate_file(const char* fname, int format) #ifdef OPENSSL_EXTRA -int wolfSSL_set_ex_data(WOLFSSL* ssl, int idx, void* data) -{ -#ifdef FORTRESS - if (ssl != NULL && idx < MAX_EX_DATA) - { - ssl->ex_data[idx] = data; - return SSL_SUCCESS; - } -#else - (void)ssl; - (void)idx; - (void)data; -#endif - return SSL_FAILURE; -} - - int wolfSSL_set_session_id_context(WOLFSSL* ssl, const unsigned char* id, unsigned int len) { @@ -9571,9 +9564,14 @@ void wolfSSL_set_connect_state(WOLFSSL* ssl) int wolfSSL_get_shutdown(const WOLFSSL* ssl) { + WOLFSSL_ENTER("wolfSSL_get_shutdown"); +#ifdef HAVE_STUNNEL + return (ssl->options.sentNotify << 1) | (ssl->options.closeNotify); +#else return (ssl->options.isClosed || ssl->options.connReset || ssl->options.sentNotify); +#endif } @@ -10198,19 +10196,6 @@ int wolfSSL_COMP_add_compression_method(int method, void* data) } - -int wolfSSL_get_ex_new_index(long idx, void* data, void* cb1, void* cb2, - void* cb3) -{ - (void)idx; - (void)data; - (void)cb1; - (void)cb2; - (void)cb3; - return 0; -} - - void wolfSSL_set_dynlock_create_callback(WOLFSSL_dynlock_value* (*f)( const char*, int)) { @@ -10368,6 +10353,7 @@ int wolfSSL_X509_STORE_CTX_init(WOLFSSL_X509_STORE_CTX* ctx, WOLFSSL_X509_STORE* store, WOLFSSL_X509* x509, STACK_OF(WOLFSSL_X509)* sk) { (void)sk; + WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_init"); if (ctx != NULL) { ctx->store = store; ctx->current_cert = x509; @@ -10554,7 +10540,8 @@ long wolfSSL_ASN1_INTEGER_get(const WOLFSSL_ASN1_INTEGER* i) void* wolfSSL_X509_STORE_CTX_get_ex_data(WOLFSSL_X509_STORE_CTX* ctx, int idx) { -#ifdef FORTRESS + WOLFSSL_ENTER("wolfSSL_X509_STORE_CTX_get_ex_data"); +#if defined(FORTRESS) || defined(HAVE_STUNNEL) if (ctx != NULL && idx == 0) return ctx->ex_data; #else @@ -10567,24 +10554,13 @@ void* wolfSSL_X509_STORE_CTX_get_ex_data(WOLFSSL_X509_STORE_CTX* ctx, int idx) int wolfSSL_get_ex_data_X509_STORE_CTX_idx(void) { + WOLFSSL_ENTER("wolfSSL_get_ex_data_X509_STORE_CTX_idx"); return 0; } -void* wolfSSL_get_ex_data(const WOLFSSL* ssl, int idx) -{ -#ifdef FORTRESS - if (ssl != NULL && idx < MAX_EX_DATA) - return ssl->ex_data[idx]; -#else - (void)ssl; - (void)idx; -#endif - return 0; -} - - -void wolfSSL_CTX_set_info_callback(WOLFSSL_CTX* ctx, void (*f)(void)) +void wolfSSL_CTX_set_info_callback(WOLFSSL_CTX* ctx, + void (*f)(const WOLFSSL* ssl, int type, int val)) { (void)ctx; (void)f; @@ -10597,7 +10573,7 @@ unsigned long wolfSSL_ERR_peek_error(void) } -int wolfSSL_ERR_GET_REASON(int err) +int wolfSSL_ERR_GET_REASON(unsigned long err) { (void)err; return 0; @@ -10618,7 +10594,7 @@ char* wolfSSL_alert_desc_string_long(int alertID) } -char* wolfSSL_state_string_long(WOLFSSL* ssl) +char* wolfSSL_state_string_long(const WOLFSSL* ssl) { (void)ssl; return 0; @@ -10777,23 +10753,6 @@ void* wolfSSL_sk_value(WOLFSSL_X509_REVOKED* rev, int i) /* stunnel 4.28 needs */ -void* wolfSSL_CTX_get_ex_data(const WOLFSSL_CTX* ctx, int d) -{ - (void)ctx; - (void)d; - return 0; -} - - -int wolfSSL_CTX_set_ex_data(WOLFSSL_CTX* ctx, int d, void* p) -{ - (void)ctx; - (void)d; - (void)p; - return SSL_SUCCESS; -} - - void wolfSSL_CTX_sess_set_get_cb(WOLFSSL_CTX* ctx, WOLFSSL_SESSION*(*f)(WOLFSSL*, unsigned char*, int, int*)) { @@ -10851,17 +10810,6 @@ long wolfSSL_SESSION_get_time(const WOLFSSL_SESSION* sess) } -int wolfSSL_CTX_get_ex_new_index(long idx, void* arg, void* a, void* b, - void* c) -{ - (void)idx; - (void)arg; - (void)a; - (void)b; - (void)c; - return 0; -} - #endif /* OPENSSL_EXTRA */ @@ -10901,6 +10849,7 @@ int wolfSSL_cmp_peer_cert_to_file(WOLFSSL* ssl, const char *fname) WOLFSSL_X509* peer_cert = &ssl->peerCert; buffer fileDer; + fileDer.buffer = 0; file = XFOPEN(fname, "rb"); if (file == XBADFILE) return SSL_BAD_FILE; @@ -10926,7 +10875,6 @@ int wolfSSL_cmp_peer_cert_to_file(WOLFSSL* ssl, const char *fname) info->set = 0; info->ctx = ctx; info->consumed = 0; - fileDer.buffer = 0; if ((myBuffer != NULL) && (sz > 0) && @@ -11280,17 +11228,27 @@ int wolfSSL_BN_bn2bin(const WOLFSSL_BIGNUM* bn, unsigned char* r) WOLFSSL_BIGNUM* wolfSSL_BN_bin2bn(const unsigned char* str, int len, WOLFSSL_BIGNUM* ret) { + int weOwn = 0; + WOLFSSL_MSG("wolfSSL_BN_bin2bn"); + /* if ret is null create a BN */ + if (ret == NULL) { + ret = wolfSSL_BN_new(); + weOwn = 1; + if (ret == NULL) + return NULL; + } + + /* check ret and ret->internal then read in value */ if (ret && ret->internal) { if (mp_read_unsigned_bin((mp_int*)ret->internal, str, len) != 0) { WOLFSSL_MSG("mp_read_unsigned_bin failure"); + if (weOwn) + wolfSSL_BN_free(ret); return NULL; } } - else { - WOLFSSL_MSG("wolfSSL_BN_bin2bn wants return bignum"); - } return ret; } @@ -11522,6 +11480,38 @@ int wolfSSL_BN_dec2bn(WOLFSSL_BIGNUM** bn, const char* str) } +#if defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) +char *wolfSSL_BN_bn2dec(const WOLFSSL_BIGNUM *bn) +{ + int len = 0; + char *buf; + + WOLFSSL_MSG("wolfSSL_BN_bn2dec"); + + if (bn == NULL || bn->internal == NULL) { + WOLFSSL_MSG("bn NULL error"); + return NULL; + } + + if (mp_radix_size((mp_int*)bn->internal, 10, &len) != MP_OKAY) { + WOLFSSL_MSG("mp_radix_size failure"); + return NULL; + } + + buf = (char*) XMALLOC(len, NULL, DYNAMIC_TYPE_ECC); + if (buf == NULL) { + WOLFSSL_MSG("wolfSSL_BN_bn2hex malloc buffer failure"); + return NULL; + } + + if (mp_toradix((mp_int*)bn->internal, buf, 10) != MP_OKAY) { + XFREE(buf, NULL, DYNAMIC_TYPE_ECC); + return NULL; + } + + return buf; +} +#else char* wolfSSL_BN_bn2dec(const WOLFSSL_BIGNUM* bn) { (void)bn; @@ -11530,6 +11520,7 @@ char* wolfSSL_BN_bn2dec(const WOLFSSL_BIGNUM* bn) return NULL; } +#endif /* defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) */ /* return code compliant with OpenSSL : * 1 if success, 0 else @@ -11538,23 +11529,13 @@ int wolfSSL_BN_lshift(WOLFSSL_BIGNUM *r, const WOLFSSL_BIGNUM *bn, int n) { WOLFSSL_MSG("wolfSSL_BN_lshift"); - if (bn == NULL || bn->internal == NULL) { + if (r == NULL || r->internal == NULL || bn == NULL || bn->internal == NULL){ WOLFSSL_MSG("bn NULL error"); return SSL_FAILURE; } - /* create new bn for res, if not done before */ - if (r == NULL) - r = wolfSSL_BN_new(); - - if (r == NULL) { - WOLFSSL_MSG("bn new error"); - return SSL_FAILURE; - } - if (mp_mul_2d((mp_int*)bn->internal, n, (mp_int*)r->internal) != MP_OKAY) { WOLFSSL_MSG("mp_mul_2d error"); - wolfSSL_BN_free(r); return SSL_FAILURE; } @@ -11568,24 +11549,14 @@ int wolfSSL_BN_rshift(WOLFSSL_BIGNUM *r, const WOLFSSL_BIGNUM *bn, int n) { WOLFSSL_MSG("wolfSSL_BN_rshift"); - if (bn == NULL || bn->internal == NULL) { + if (r == NULL || r->internal == NULL || bn == NULL || bn->internal == NULL){ WOLFSSL_MSG("bn NULL error"); return SSL_FAILURE; } - /* create new bn for res, if not done before */ - if (r == NULL) - r = wolfSSL_BN_new(); - - if (r == NULL) { - WOLFSSL_MSG("bn new error"); - return SSL_FAILURE; - } - if (mp_div_2d((mp_int*)bn->internal, n, (mp_int*)r->internal, NULL) != MP_OKAY) { WOLFSSL_MSG("mp_mul_2d error"); - wolfSSL_BN_free(r); return SSL_FAILURE; } @@ -11642,11 +11613,11 @@ int wolfSSL_BN_add(WOLFSSL_BIGNUM *r, WOLFSSL_BIGNUM *a, WOLFSSL_BIGNUM *b) int wolfSSL_BN_is_prime_ex(const WOLFSSL_BIGNUM *bn, int nbchecks, WOLFSSL_BN_CTX *ctx, WOLFSSL_BN_GENCB *cb) { + int res; + (void)ctx; (void)cb; - int res; - WOLFSSL_MSG("wolfSSL_BN_is_prime_ex"); if (bn == NULL || bn->internal == NULL) { @@ -11679,12 +11650,12 @@ WOLFSSL_BN_ULONG wolfSSL_BN_mod_word(const WOLFSSL_BIGNUM *bn, if (bn == NULL || bn->internal == NULL) { WOLFSSL_MSG("bn NULL error"); - return SSL_FATAL_ERROR; + return (WOLFSSL_BN_ULONG)SSL_FATAL_ERROR; } if (mp_mod_d((mp_int*)bn->internal, w, &ret) != MP_OKAY) { WOLFSSL_MSG("mp_add_d error"); - return SSL_FATAL_ERROR; + return (WOLFSSL_BN_ULONG)SSL_FATAL_ERROR; } return ret; @@ -11723,6 +11694,7 @@ char *wolfSSL_BN_bn2hex(const WOLFSSL_BIGNUM *bn) return buf; } +#ifndef NO_FILESYSTEM /* return code compliant with OpenSSL : * 1 if success, 0 if error */ @@ -11748,6 +11720,7 @@ int wolfSSL_BN_print_fp(FILE *fp, const WOLFSSL_BIGNUM *bn) return SSL_SUCCESS; } +#endif /* !defined(NO_FILESYSTEM) */ #else /* defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) */ @@ -11760,6 +11733,7 @@ char *wolfSSL_BN_bn2hex(const WOLFSSL_BIGNUM *bn) return (char*)""; } +#ifndef NO_FILESYSTEM /* return code compliant with OpenSSL : * 1 if success, 0 if error */ @@ -11772,6 +11746,8 @@ int wolfSSL_BN_print_fp(FILE *fp, const WOLFSSL_BIGNUM *bn) return SSL_SUCCESS; } +#endif /* !defined(NO_FILESYSTEM) */ + #endif /* defined(WOLFSSL_KEY_GEN) || defined(HAVE_COMP_KEY) */ @@ -12649,6 +12625,16 @@ int wolfSSL_DSA_generate_key(WOLFSSL_DSA* dsa) return SSL_FAILURE; } + if (dsa->inSet == 0) + { + WOLFSSL_MSG("No DSA internal set, do it"); + + if (SetDsaInternal(dsa) != SSL_SUCCESS) { + WOLFSSL_MSG("SetDsaInternal failed"); + return ret; + } + } + #ifdef WOLFSSL_KEY_GEN { int initTmpRng = 0; @@ -12754,10 +12740,8 @@ int wolfSSL_DSA_generate_parameters_ex(WOLFSSL_DSA* dsa, int bits, WOLFSSL_MSG("wc_MakeDsaParameters failed"); else if (SetDsaExternal(dsa) != SSL_SUCCESS) WOLFSSL_MSG("SetDsaExternal failed"); - else { - dsa->inSet = 1; + else ret = SSL_SUCCESS; - } } if (initTmpRng) @@ -12863,6 +12847,8 @@ int wolfSSL_DSA_do_verify(const unsigned char* d, unsigned char* sig, ret = DsaVerify(d, sig, (DsaKey*)dsa->internal, dsacheck); if (ret != 0 || *dsacheck != 1) { WOLFSSL_MSG("DsaVerify failed"); + printf("ret = %d\n", ret); + printf("*dsacheck = %d\n", *dsacheck); return ret; } @@ -14789,8 +14775,8 @@ int wolfSSL_ECDH_compute_key(void *out, size_t outlen, void *(*KDF) (const void *in, size_t inlen, void *out, size_t *outlen)) { - (void)KDF; word32 len; + (void)KDF; WOLFSSL_ENTER("wolfSSL_ECDH_compute_key"); @@ -15696,142 +15682,558 @@ void* wolfSSL_GetRsaDecCtx(WOLFSSL* ssl) unsigned char *wolfSSL_SHA1(const unsigned char *d, size_t n, unsigned char *md) { (void) *d; (void) n; (void) *md; + WOLFSSL_ENTER("wolfSSL_SHA1"); + WOLFSSL_STUB("wolfssl_SHA1"); + return NULL; } - char WOLFSSL_CTX_use_certificate(WOLFSSL_CTX *ctx, WOLFSSL_X509 *x) { + char wolfSSL_CTX_use_certificate(WOLFSSL_CTX *ctx, WOLFSSL_X509 *x) { (void)ctx; (void)x; + WOLFSSL_ENTER("wolfSSL_CTX_use_certificate"); + WOLFSSL_STUB("wolfSSL_CTX_use_certificate"); return 0; } - int WOLFSSL_CTX_use_PrivateKey(WOLFSSL_CTX *ctx, WOLFSSL_EVP_PKEY *pkey) { + int wolfSSL_CTX_use_PrivateKey(WOLFSSL_CTX *ctx, WOLFSSL_EVP_PKEY *pkey) { (void)ctx; (void)pkey; + WOLFSSL_ENTER("wolfSSL_CTX_use_PrivateKey"); + WOLFSSL_STUB("wolfSSL_CTX_use_PrivateKey"); return 0; } - WOLFSSL_BIO *wolfSSL_BIO_new_file(const char *filename, const char *mode) { - (void)filename; - (void)mode; - - return NULL; - } int wolfSSL_BIO_read_filename(WOLFSSL_BIO *b, const char *name) { (void)b; (void)name; + WOLFSSL_ENTER("wolfSSL_BIO_read_filename"); + WOLFSSL_STUB("wolfSSL_BIO_read_filename"); return 0; } - WOLFSSL_BIO_METHOD* WOLFSSL_BIO_s_file(void) { + WOLFSSL_BIO_METHOD* wolfSSL_BIO_s_file(void) { + WOLFSSL_ENTER("wolfSSL_BIO_s_file"); + WOLFSSL_STUB("wolfSSL_BIO_s_file"); + return NULL; } const char * wolf_OBJ_nid2sn(int n) { (void)n; + WOLFSSL_ENTER("wolf_OBJ_nid2sn"); + WOLFSSL_STUB("wolf_OBJ_nid2sn"); return 0; } int wolf_OBJ_obj2nid(const WOLFSSL_ASN1_OBJECT *o) { (void)o; + WOLFSSL_ENTER("wolf_OBJ_obj2nid"); + WOLFSSL_STUB("wolf_OBJ_obj2nid"); return 0; } int wolf_OBJ_sn2nid(const char *sn) { (void)sn; + WOLFSSL_ENTER("wolf_OBJ_osn2nid"); + WOLFSSL_STUB("wolf_OBJ_osn2nid"); return 0; } - WOLFSSL_DH *PEM_read_bio_DHparams(WOLFSSL_BIO *bp, WOLFSSL_DH **x, pem_password_cb *cb, void *u) { - (void)bp; - (void)x; - (void)cb; - (void)u; - - return NULL; - } WOLFSSL_X509 *PEM_read_bio_WOLFSSL_X509(WOLFSSL_BIO *bp, WOLFSSL_X509 **x, pem_password_cb *cb, void *u) { (void)bp; (void)x; (void)cb; (void)u; + WOLFSSL_ENTER("PEM_read_bio_WOLFSSL_X509"); + WOLFSSL_STUB("PEM_read_bio_WOLFSSL_X509"); return NULL; } - int PEM_write_bio_WOLFSSL_X509(WOLFSSL_BIO *bp, WOLFSSL_X509 *x) { - (void)bp; - (void)x; - - return 0; - } - - long WOLFSSL_CTX_set_tmp_dh(WOLFSSL_CTX *ctx, WOLFSSL_DH *dh) { - (void)ctx; - (void)dh; - - return 0; - } - - void wolfSSL_CTX_set_verify_depth(WOLFSSL_CTX *ctx,int depth) { + void wolfSSL_CTX_set_verify_depth(WOLFSSL_CTX *ctx, int depth) { (void)ctx; (void)depth; + WOLFSSL_ENTER("wolfSSL_CTX_set_verify_depth"); + WOLFSSL_STUB("wolfSSL_CTX_set_verify_depth"); + } - void* WOLFSSL_get_app_data( const WOLFSSL *ssl) + void* wolfSSL_get_app_data( const WOLFSSL *ssl) { /* checkout exdata stuff... */ (void)ssl; + WOLFSSL_ENTER("wolfSSL_get_app_data"); + WOLFSSL_STUB("wolfSSL_get_app_data"); return 0; } - void WOLFSSL_set_app_data(WOLFSSL *ssl, void *arg) { + void wolfSSL_set_app_data(WOLFSSL *ssl, void *arg) { (void)ssl; (void)arg; + WOLFSSL_ENTER("wolfSSL_set_app_data"); + WOLFSSL_STUB("wolfSSL_set_app_data"); } - WOLFSSL_ASN1_OBJECT * WOLFSSL_X509_NAME_ENTRY_get_object(WOLFSSL_X509_NAME_ENTRY *ne) { + WOLFSSL_ASN1_OBJECT * wolfSSL_X509_NAME_ENTRY_get_object(WOLFSSL_X509_NAME_ENTRY *ne) { (void)ne; + WOLFSSL_ENTER("wolfSSL_X509_NAME_ENTRY_get_object"); + WOLFSSL_STUB("wolfSSL_X509_NAME_ENTRY_get_object"); return NULL; } - WOLFSSL_X509_NAME_ENTRY *WOLFSSL_X509_NAME_get_entry(WOLFSSL_X509_NAME *name, int loc) { + WOLFSSL_X509_NAME_ENTRY *wolfSSL_X509_NAME_get_entry(WOLFSSL_X509_NAME *name, int loc) { (void)name; (void)loc; + WOLFSSL_ENTER("wolfSSL_X509_NAME_get_entry"); + WOLFSSL_STUB("wolfSSL_X509_NAME_get_entry"); return NULL; } - void WOLFSSL_X509_NAME_free(WOLFSSL_X509_NAME *name){ + void wolfSSL_X509_NAME_free(WOLFSSL_X509_NAME *name){ FreeX509Name(name); + WOLFSSL_ENTER("wolfSSL_X509_NAME_free"); + WOLFSSL_STUB("wolfSSL_X509_NAME_free"); } void wolfSSL_sk_X509_NAME_pop_free(STACK_OF(WOLFSSL_X509_NAME)* sk, void f (WOLFSSL_X509_NAME*)){ (void) sk; (void) f; + WOLFSSL_ENTER("wolfSSL_sk_X509_NAME_pop_free"); + WOLFSSL_STUB("wolfSSL_sk_X509_NAME_pop_free"); } int wolfSSL_X509_check_private_key(WOLFSSL_X509 *x509, WOLFSSL_EVP_PKEY *key){ (void) x509; (void) key; - return 0; + WOLFSSL_ENTER("wolfSSL_X509_check_private_key"); + WOLFSSL_STUB("wolfSSL_X509_check_private_key"); + + return SSL_SUCCESS; } STACK_OF(WOLFSSL_X509_NAME) *wolfSSL_dup_CA_list( STACK_OF(WOLFSSL_X509_NAME) *sk ){ (void) sk; + WOLFSSL_ENTER("wolfSSL_dup_CA_list"); + WOLFSSL_STUB("wolfSSL_dup_CA_list"); + return NULL; } #endif #endif + +#ifdef OPENSSL_EXTRA +void* wolfSSL_CTX_get_ex_data(const WOLFSSL_CTX* ctx, int idx) +{ + WOLFSSL_ENTER("wolfSSL_CTX_get_ex_data"); + #ifdef HAVE_STUNNEL + if(ctx != NULL && idx < MAX_EX_DATA) { + return ctx->ex_data[idx]; + } + #else + (void)ctx; + (void)idx; + #endif + return NULL; +} + + +int wolfSSL_CTX_get_ex_new_index(long idx, void* arg, void* a, void* b, + void* c) +{ + WOLFSSL_ENTER("wolfSSL_CTX_get_ex_new_index"); + (void)idx; + (void)arg; + (void)a; + (void)b; + (void)c; + return 0; +} + + +int wolfSSL_CTX_set_ex_data(WOLFSSL_CTX* ctx, int idx, void* data) +{ + WOLFSSL_ENTER("wolfSSL_CTX_set_ex_data"); + #ifdef HAVE_STUNNEL + if (ctx != NULL && idx < MAX_EX_DATA) + { + ctx->ex_data[idx] = data; + return SSL_SUCCESS; + } + #else + (void)ctx; + (void)idx; + (void)data; + #endif + return SSL_FAILURE; +} + + +int wolfSSL_set_ex_data(WOLFSSL* ssl, int idx, void* data) +{ + WOLFSSL_ENTER("wolfSSL_set_ex_data"); +#if defined(FORTRESS) || defined(HAVE_STUNNEL) + if (ssl != NULL && idx < MAX_EX_DATA) + { + ssl->ex_data[idx] = data; + return SSL_SUCCESS; + } +#else + (void)ssl; + (void)idx; + (void)data; +#endif + return SSL_FAILURE; +} + + +int wolfSSL_get_ex_new_index(long idx, void* data, void* cb1, void* cb2, + void* cb3) +{ + WOLFSSL_ENTER("wolfSSL_get_ex_new_index"); + (void)idx; + (void)data; + (void)cb1; + (void)cb2; + (void)cb3; + return 0; +} + + +void* wolfSSL_get_ex_data(const WOLFSSL* ssl, int idx) +{ + WOLFSSL_ENTER("wolfSSL_get_ex_data"); +#if defined(FORTRESS) || defined(HAVE_STUNNEL) + if (ssl != NULL && idx < MAX_EX_DATA) + return ssl->ex_data[idx]; +#else + (void)ssl; + (void)idx; +#endif + return 0; +} +#endif /* OPENSSL_EXTRA */ + + +#if defined(HAVE_LIGHTY) || defined(HAVE_STUNNEL) +WOLFSSL_BIO *wolfSSL_BIO_new_file(const char *filename, const char *mode) { + (void)filename; + (void)mode; + WOLFSSL_ENTER("wolfSSL_BIO_new_file"); + WOLFSSL_STUB("wolfSSL_BIO_new_file"); + + return NULL; +} + + +WOLFSSL_DH *wolfSSL_PEM_read_bio_DHparams(WOLFSSL_BIO *bp, WOLFSSL_DH **x, pem_password_cb *cb, void *u) +{ + (void) bp; + (void) x; + (void) cb; + (void) u; + + WOLFSSL_ENTER("wolfSSL_PEM_read_bio_DHparams"); + WOLFSSL_STUB("wolfSSL_PEM_read_bio_DHparams"); + + return NULL; +} + +int PEM_write_bio_WOLFSSL_X509(WOLFSSL_BIO *bp, WOLFSSL_X509 *x) { + (void)bp; + (void)x; + WOLFSSL_ENTER("PEM_write_bio_WOLFSSL_X509"); + WOLFSSL_STUB("PEM_write_bio_WOLFSSL_X509"); + + return 0; +} + + +#ifndef NO_DH +/* Intialize ctx->dh with dh's params. Return SSL_SUCCESS on ok */ +long wolfSSL_CTX_set_tmp_dh(WOLFSSL_CTX* ctx, WOLFSSL_DH* dh) +{ + int pSz, gSz; + byte *p, *g; + int ret=0; + + WOLFSSL_ENTER("wolfSSL_CTX_set_tmp_dh"); + + if(!ctx || !dh) + return BAD_FUNC_ARG; + + /* Get needed size for p and g */ + pSz = wolfSSL_BN_bn2bin(dh->p, NULL); + gSz = wolfSSL_BN_bn2bin(dh->g, NULL); + + if(pSz <= 0 || gSz <= 0) + return SSL_FATAL_ERROR; + + p = XMALLOC(pSz, ctx->heap, DYNAMIC_TYPE_DH); + if(!p) + return MEMORY_E; + + g = XMALLOC(gSz, ctx->heap, DYNAMIC_TYPE_DH); + if(!g) { + XFREE(p, ctx->heap, DYNAMIC_TYPE_DH); + return MEMORY_E; + } + + pSz = wolfSSL_BN_bn2bin(dh->p, p); + gSz = wolfSSL_BN_bn2bin(dh->g, g); + + if(pSz >= 0 && gSz >= 0) /* Conversion successful */ + ret = wolfSSL_CTX_SetTmpDH(ctx, p, pSz, g, gSz); + + XFREE(p, ctx->heap, DYNAMIC_TYPE_DH); + XFREE(g, ctx->heap, DYNAMIC_TYPE_DH); + + return pSz > 0 && gSz > 0 ? ret : SSL_FATAL_ERROR; +} +#endif /* NO_DH */ +#endif /* HAVE_LIGHTY || HAVE_STUNNEL */ + + +/* stunnel compatability functions*/ +#if defined(OPENSSL_EXTRA) && defined(HAVE_STUNNEL) +int wolfSSL_SESSION_set_ex_data(WOLFSSL_SESSION* session, int idx, void* data) +{ + WOLFSSL_ENTER("wolfSSL_SESSION_set_ex_data"); + if(session != NULL && idx < MAX_EX_DATA) { + session->ex_data[idx] = data; + return SSL_SUCCESS; + } + return SSL_FAILURE; +} + + +int wolfSSL_SESSION_get_ex_new_index(long idx, void* data, void* cb1, + void* cb2, CRYPTO_free_func* cb3) +{ + WOLFSSL_ENTER("wolfSSL_SESSION_get_ex_new_index"); + (void)idx; + (void)cb1; + (void)cb2; + (void)cb3; + if(XSTRNCMP(data, "redirect index", 14) == 0) { + return 0; + } + else if(XSTRNCMP(data, "addr index", 10) == 0) { + return 1; + } + return SSL_FAILURE; +} + + +void* wolfSSL_SESSION_get_ex_data(const WOLFSSL_SESSION* session, int idx) +{ + WOLFSSL_ENTER("wolfSSL_SESSION_get_ex_data"); + if (session != NULL && idx < MAX_EX_DATA) + return session->ex_data[idx]; + return NULL; +} + + +int wolfSSL_CRYPTO_set_mem_ex_functions(void *(*m) (size_t, const char *, int), + void *(*r) (void *, size_t, const char *, + int), void (*f) (void *)) +{ + (void) m; + (void) r; + (void) f; + + return SSL_FAILURE; +} + + +WOLFSSL_DH *wolfSSL_DH_generate_parameters(int prime_len, int generator, + void (*callback) (int, int, void *), void *cb_arg) +{ + (void)prime_len; + (void)generator; + (void)callback; + (void)cb_arg; + return NULL; +} + + +void wolfSSL_ERR_load_crypto_strings(void){} +unsigned long wolfSSL_ERR_peek_last_error(void) +{ + unsigned long l = 0UL; + return l; +} + + +int wolfSSL_FIPS_mode(void) +{ + return SSL_FAILURE; +} + +int wolfSSL_FIPS_mode_set(int r) +{ + (void)r; + return SSL_FAILURE; +} + + +int wolfSSL_RAND_set_rand_method(const void *meth) +{ + (void) meth; + return SSL_FAILURE; +} + + +int wolfSSL_CIPHER_get_bits(const WOLFSSL_CIPHER *c, int *alg_bits) +{ + int ret = SSL_FAILURE; + if(c != NULL && c->ssl != NULL) { + ret = 8 * c->ssl->specs.key_size; + if(alg_bits != NULL) { + *alg_bits = ret; + } + } + return ret; +} + + +int wolfSSL_sk_X509_NAME_num(const STACK_OF(WOLFSSL_X509_NAME) *s) +{ + (void) s; + return SSL_FAILURE; +} + + +int wolfSSL_sk_X509_num(const STACK_OF(WOLFSSL_X509) *s) +{ + (void) s; + return SSL_FAILURE; +} + + +int wolfSSL_X509_NAME_print_ex(WOLFSSL_BIO* bio, WOLFSSL_X509_NAME* nm, + int indent, unsigned long flags) +{ + (void)bio; + (void)nm; + (void)indent; + (void)flags; + return SSL_FAILURE; +} + + +WOLFSSL_ASN1_BIT_STRING* wolfSSL_X509_get0_pubkey_bitstr(const WOLFSSL_X509* x) +{ + (void)x; + return NULL; +} + + +int wolfSSL_CTX_add_session(WOLFSSL_CTX* ctx, WOLFSSL_SESSION* session) +{ + (void)ctx; + (void)session; + return SSL_SUCCESS; +} + + +int wolfSSL_get_state(const WOLFSSL* ssl) +{ + (void)ssl; + return SSL_FAILURE; +} + + +void* wolfSSL_sk_X509_NAME_value(STACK_OF(WOLFSSL_X509_NAME)* sk, int i) +{ + (void)sk; + (void)i; + return NULL; +} + + +void* wolfSSL_sk_X509_value(STACK_OF(WOLFSSL_X509)* sk, int i) +{ + (void)sk; + (void)i; + return NULL; +} + + +int wolfSSL_version(WOLFSSL* ssl) +{ + if (ssl->version.major == SSLv3_MAJOR) { + switch (ssl->version.minor) { + case SSLv3_MINOR : + return SSL3_VERSION; + case TLSv1_MINOR : + case TLSv1_1_MINOR : + case TLSv1_2_MINOR : + return TLS1_VERSION; + default: + return SSL_FAILURE; + } + } + else if (ssl->version.major == DTLS_MAJOR) { + switch (ssl->version.minor) { + case DTLS_MINOR : + case DTLSv1_2_MINOR : + return DTLS1_VERSION; + default: + return SSL_FAILURE; + } + } + return SSL_FAILURE; +} + + +STACK_OF(WOLFSSL_X509)* wolfSSL_get_peer_cert_chain(const WOLFSSL* ssl) +{ + (void)ssl; + return NULL; +} + + +long wolfSSL_CTX_get_options(WOLFSSL_CTX* ctx) +{ + (void)ctx; + return 0; +} + + +WOLFSSL_CTX* wolfSSL_get_SSL_CTX(WOLFSSL* ssl) +{ + return ssl->ctx; +} + +int wolfSSL_X509_NAME_get_sz(WOLFSSL_X509_NAME* name) +{ + if(!name) + return -1; + return name->sz; +} + + +const byte* wolfSSL_SESSION_get_id(WOLFSSL_SESSION* sess, unsigned int* idLen) +{ + if(!sess || !idLen) { + WOLFSSL_MSG("Bad func args. Please provide idLen"); + return NULL; + } + *idLen = sess->sessionIDSz; + return sess->sessionID; +} +#endif /* OPENSSL_EXTRA and HAVE_STUNNEL */ diff --git a/src/tls.c b/src/tls.c index 5a070f667..39f36bb17 100644 --- a/src/tls.c +++ b/src/tls.c @@ -37,7 +37,7 @@ #endif #ifdef HAVE_NTRU - #include "ntru_crypto.h" + #include "libntruencrypt/ntru_crypto.h" #include #endif #ifdef HAVE_QSH @@ -2836,7 +2836,7 @@ static word16 TLSX_Write(TLSX* list, byte* output, byte* semaphore, #ifdef HAVE_NTRU -static word32 GetEntropy(unsigned char* out, unsigned long long num_bytes) +static word32 GetEntropy(unsigned char* out, word32 num_bytes) { int ret = 0; @@ -2854,7 +2854,7 @@ static word32 GetEntropy(unsigned char* out, unsigned long long num_bytes) } ret |= LockMutex(rngMutex); - ret |= wc_RNG_GenerateBlock(rng, out, (word32)num_bytes); + ret |= wc_RNG_GenerateBlock(rng, out, num_bytes); ret |= UnLockMutex(rngMutex); if (ret != 0) @@ -2947,7 +2947,7 @@ int TLSX_CreateNtruKey(WOLFSSL* ssl, int type) WOLFSSL_MSG("Unknown type for creating NTRU key"); return -1; } - ret = ntru_crypto_external_drbg_instantiate(GetEntropy, &drbg); + ret = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg); if (ret != DRBG_OK) { WOLFSSL_MSG("NTRU drbg instantiate failed\n"); return ret; diff --git a/support/wolfssl.pc b/support/wolfssl.pc index 024f117ab..f95d19b7a 100644 --- a/support/wolfssl.pc +++ b/support/wolfssl.pc @@ -5,6 +5,6 @@ includedir=${prefix}/include Name: wolfssl Description: wolfssl C library. -Version: 3.6.1 +Version: 3.6.2 Libs: -L${libdir} -lwolfssl Cflags: -I${includedir} diff --git a/tests/test-qsh.conf b/tests/test-qsh.conf index 8261f147d..0f59c428f 100644 --- a/tests/test-qsh.conf +++ b/tests/test-qsh.conf @@ -2018,4 +2018,7 @@ -c ./certs/ntru-cert.pem -k ./certs/ntru-key.raw +# client TLSv1.2 NTRU_AES128 +-v 3 +-l QSH:NTRU-AES128-SHA diff --git a/tests/test.conf b/tests/test.conf index 963db7b06..9e6d0674a 100644 --- a/tests/test.conf +++ b/tests/test.conf @@ -2018,4 +2018,7 @@ -c ./certs/ntru-cert.pem -k ./certs/ntru-key.raw +# client TLSv1.2 NTRU_AES128 +-v 3 +-l NTRU-AES128-SHA diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c index 891ce0bf9..e68af6177 100644 --- a/wolfcrypt/benchmark/benchmark.c +++ b/wolfcrypt/benchmark/benchmark.c @@ -71,7 +71,7 @@ #include "cavium_ioctl.h" #endif #ifdef HAVE_NTRU - #include "ntru_crypto.h" + #include "libntruencrypt/ntru_crypto.h" #endif #if defined(WOLFSSL_MDK_ARM) diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c index e9019456d..90edfc77c 100644 --- a/wolfcrypt/src/asn.c +++ b/wolfcrypt/src/asn.c @@ -49,7 +49,7 @@ #endif #ifdef HAVE_NTRU - #include "ntru_crypto.h" + #include "libntruencrypt/ntru_crypto.h" #endif #if defined(WOLFSSL_SHA512) || defined(WOLFSSL_SHA384) diff --git a/wolfcrypt/src/coding.c b/wolfcrypt/src/coding.c index bed85a5a1..0dff4c94d 100644 --- a/wolfcrypt/src/coding.c +++ b/wolfcrypt/src/coding.c @@ -166,8 +166,8 @@ static int CEscape(int escaped, byte e, byte* out, word32* i, word32 max, else basic = base64Encode[e]; - /* check whether to escape */ - if (escaped) { + /* check whether to escape. Only escape for EncodeEsc */ + if (escaped == WC_ESC_NL_ENC) { switch ((char)basic) { case '+' : plus = 1; @@ -235,15 +235,17 @@ static int DoBase64_Encode(const byte* in, word32 inLen, byte* out, word32 outSz = (inLen + 3 - 1) / 3 * 4; word32 addSz = (outSz + PEM_LINE_SZ - 1) / PEM_LINE_SZ; /* new lines */ - if (escaped) + if (escaped == WC_ESC_NL_ENC) addSz *= 3; /* instead of just \n, we're doing %0A triplet */ + else if (escaped == WC_NO_NL_ENC) + addSz = 0; /* encode without \n */ outSz += addSz; /* if escaped we can't predetermine size for one pass encoding, but * make sure we have enough if no escapes are in input */ if (outSz > *outLen) return BAD_FUNC_ARG; - + while (inLen > 2) { byte b1 = in[j++]; byte b2 = in[j++]; @@ -267,7 +269,8 @@ static int DoBase64_Encode(const byte* in, word32 inLen, byte* out, inLen -= 3; - if ((++n % (PEM_LINE_SZ / 4)) == 0 && inLen) { + /* Insert newline after PEM_LINE_SZ, unless no \n requested */ + if (escaped != WC_NO_NL_ENC && (++n % (PEM_LINE_SZ/4)) == 0 && inLen){ ret = CEscape(escaped, '\n', out, &i, *outLen, 1); if (ret != 0) break; } @@ -285,44 +288,48 @@ static int DoBase64_Encode(const byte* in, word32 inLen, byte* out, byte e3 = (byte)((b2 & 0xF) << 2); ret = CEscape(escaped, e1, out, &i, *outLen, 0); - if (ret == 0) + if (ret == 0) ret = CEscape(escaped, e2, out, &i, *outLen, 0); if (ret == 0) { /* third */ if (twoBytes) ret = CEscape(escaped, e3, out, &i, *outLen, 0); - else + else ret = CEscape(escaped, '=', out, &i, *outLen, 1); } /* fourth always pad */ if (ret == 0) ret = CEscape(escaped, '=', out, &i, *outLen, 1); - } + } - if (ret == 0) + if (ret == 0 && escaped != WC_NO_NL_ENC) ret = CEscape(escaped, '\n', out, &i, *outLen, 1); - if (i != outSz && escaped == 0 && ret == 0) - return ASN_INPUT_E; + if (i != outSz && escaped != 1 && ret == 0) + return ASN_INPUT_E; *outLen = i; - return ret; + return ret; } /* Base64 Encode, PEM style, with \n line endings */ int Base64_Encode(const byte* in, word32 inLen, byte* out, word32* outLen) { - return DoBase64_Encode(in, inLen, out, outLen, 0); + return DoBase64_Encode(in, inLen, out, outLen, WC_STD_ENC); } /* Base64 Encode, with %0A esacped line endings instead of \n */ int Base64_EncodeEsc(const byte* in, word32 inLen, byte* out, word32* outLen) { - return DoBase64_Encode(in, inLen, out, outLen, 1); + return DoBase64_Encode(in, inLen, out, outLen, WC_ESC_NL_ENC); } +int Base64_Encode_NoNl(const byte* in, word32 inLen, byte* out, word32* outLen) +{ + return DoBase64_Encode(in, inLen, out, outLen, WC_NO_NL_ENC); +} #endif /* defined(WOLFSSL_BASE64_ENCODE) */ diff --git a/wolfcrypt/src/dsa.c b/wolfcrypt/src/dsa.c index 1f9308e86..dc0e20e4b 100644 --- a/wolfcrypt/src/dsa.c +++ b/wolfcrypt/src/dsa.c @@ -18,6 +18,7 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA */ +#include #ifdef HAVE_CONFIG_H #include @@ -93,6 +94,8 @@ int wc_MakeDsaKey(RNG *rng, DsaKey *dsa) return BAD_FUNC_ARG; qsize = mp_unsigned_bin_size(&dsa->q); + if (qsize == 0) + return BAD_FUNC_ARG; /* allocate ram */ buf = (unsigned char *)XMALLOC(qsize, NULL, @@ -114,9 +117,6 @@ int wc_MakeDsaKey(RNG *rng, DsaKey *dsa) return err; } - /* force magnitude */ - buf[0] |= 0xC0; - err = mp_read_unsigned_bin(&dsa->x, buf, qsize); if (err != MP_OKAY) { mp_clear(&dsa->x); @@ -148,9 +148,11 @@ int wc_MakeDsaKey(RNG *rng, DsaKey *dsa) /* modulus_size in bits */ int wc_MakeDsaParameters(RNG *rng, int modulus_size, DsaKey *dsa) { - mp_int tmp, tmp2; - int err, res, msize, qsize, loop; - unsigned char *buf; + mp_int tmp, tmp2; + int err, msize, qsize, + loop_check_prime = 0, + check_prime = MP_NO; + unsigned char *buf; if (rng == NULL || dsa == NULL) return BAD_FUNC_ARG; @@ -174,43 +176,16 @@ int wc_MakeDsaParameters(RNG *rng, int modulus_size, DsaKey *dsa) /* modulus size in bytes */ msize = modulus_size / 8; - if (mp_init(&dsa->q) != MP_OKAY) - return MP_INIT_E; - - /* make our prime q */ - err = mp_rand_prime(&dsa->q, qsize, rng, NULL); - if (err != MP_OKAY) { - mp_clear(&dsa->q); - return err; - } - - if (mp_init(&tmp) != MP_OKAY) { - mp_clear(&dsa->q); - return MP_INIT_E; - } - - /* tmp = 2q */ - err = mp_add(&dsa->q, &dsa->q, &tmp); - if (err != MP_OKAY) { - mp_clear(&dsa->q); - mp_clear(&tmp); - return err; - } - /* allocate ram */ buf = (unsigned char *)XMALLOC(msize - qsize, NULL, DYNAMIC_TYPE_TMP_BUFFER); if (buf == NULL) { - mp_clear(&dsa->q); - mp_clear(&tmp); return MEMORY_E; } - /* now make a random string and multply it against q */ + /* make a random string that will be multplied against q */ err = wc_RNG_GenerateBlock(rng, buf, msize - qsize); if (err != MP_OKAY) { - mp_clear(&dsa->q); - mp_clear(&tmp); XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } @@ -221,9 +196,8 @@ int wc_MakeDsaParameters(RNG *rng, int modulus_size, DsaKey *dsa) /* force even */ buf[msize - qsize - 1] &= ~1; - if (mp_init_multi(&tmp2, &dsa->p, 0, 0, 0, 0) != MP_OKAY) { + if (mp_init_multi(&tmp2, &dsa->p, &dsa->q, 0, 0, 0) != MP_OKAY) { mp_clear(&dsa->q); - mp_clear(&tmp); XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); return MP_INIT_E; } @@ -232,25 +206,48 @@ int wc_MakeDsaParameters(RNG *rng, int modulus_size, DsaKey *dsa) if (err != MP_OKAY) { mp_clear(&dsa->q); mp_clear(&dsa->p); - mp_clear(&tmp); mp_clear(&tmp2); XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); return err; } XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); - /* p = tmp2 * q */ - err = mp_mul(&dsa->q, &tmp2, &dsa->p); + /* make our prime q */ + err = mp_rand_prime(&dsa->q, qsize, rng, NULL); if (err != MP_OKAY) { mp_clear(&dsa->q); mp_clear(&dsa->p); - mp_clear(&tmp); mp_clear(&tmp2); return err; } - /* p = tmp2 * q + 1, so q is a prime divisor of p-1 */ + /* p = random * q */ + err = mp_mul(&dsa->q, &tmp2, &dsa->p); + if (err != MP_OKAY) { + mp_clear(&dsa->q); + mp_clear(&dsa->p); + mp_clear(&tmp2); + return err; + } + + /* p = random * q + 1, so q is a prime divisor of p-1 */ err = mp_add_d(&dsa->p, 1, &dsa->p); + if (err != MP_OKAY) { + mp_clear(&dsa->q); + mp_clear(&dsa->p); + mp_clear(&tmp2); + return err; + } + + if (mp_init(&tmp) != MP_OKAY) { + mp_clear(&dsa->q); + mp_clear(&dsa->p); + mp_clear(&tmp2); + return MP_INIT_E; + } + + /* tmp = 2q */ + err = mp_add(&dsa->q, &dsa->q, &tmp); if (err != MP_OKAY) { mp_clear(&dsa->q); mp_clear(&dsa->p); @@ -260,8 +257,8 @@ int wc_MakeDsaParameters(RNG *rng, int modulus_size, DsaKey *dsa) } /* loop until p is prime */ - for (loop = 0; loop++;) { - err = mp_prime_is_prime(&dsa->p, 8, &res); + while (check_prime == MP_NO) { + err = mp_prime_is_prime(&dsa->p, 8, &check_prime); if (err != MP_OKAY) { mp_clear(&dsa->q); mp_clear(&dsa->p); @@ -270,25 +267,26 @@ int wc_MakeDsaParameters(RNG *rng, int modulus_size, DsaKey *dsa) return err; } - if (res == MP_YES) - break; + if (check_prime != MP_YES) { + /* p += 2q */ + err = mp_add(&tmp, &dsa->p, &dsa->p); + if (err != MP_OKAY) { + mp_clear(&dsa->q); + mp_clear(&dsa->p); + mp_clear(&tmp); + mp_clear(&tmp2); + return err; + } - /* p += 2q */ - err = mp_add(&tmp, &dsa->p, &dsa->p); - if (err != MP_OKAY) { - mp_clear(&dsa->q); - mp_clear(&dsa->p); - mp_clear(&tmp); - mp_clear(&tmp2); - return err; + loop_check_prime++; } } - /* tmp2 += (2*loop) + /* tmp2 += (2*loop_check_prime) * to have p = (q * tmp2) + 1 prime */ - if (loop) { - err = mp_add_d(&tmp2, 2*loop, &tmp2); + if (loop_check_prime) { + err = mp_add_d(&tmp2, 2*loop_check_prime, &tmp2); if (err != MP_OKAY) { mp_clear(&dsa->q); mp_clear(&dsa->p); diff --git a/wolfcrypt/src/ecc.c b/wolfcrypt/src/ecc.c index d247cb3b7..f9b82f220 100644 --- a/wolfcrypt/src/ecc.c +++ b/wolfcrypt/src/ecc.c @@ -4912,7 +4912,7 @@ static int ecc_get_key_sizes(ecEncCtx* ctx, int* encKeySz, int* ivSz, switch (ctx->encAlgo) { case ecAES_128_CBC: *encKeySz = KEY_SIZE_128; - *ivSz = IV_SIZE_64; + *ivSz = IV_SIZE_128; *blockSz = AES_BLOCK_SIZE; break; default: diff --git a/wolfcrypt/src/integer.c b/wolfcrypt/src/integer.c index aaf9954b5..5f337fd30 100644 --- a/wolfcrypt/src/integer.c +++ b/wolfcrypt/src/integer.c @@ -963,7 +963,7 @@ top: /* if not zero goto step 4 */ if (mp_iszero (&u) == 0) { - if (++loop_check > 1024) { + if (++loop_check > 4096) { res = MP_VAL; goto LBL_ERR; } @@ -2501,33 +2501,6 @@ int mp_reduce_2k_setup(mp_int *a, mp_digit *d) } -/* computes a = 2**b - * - * Simple algorithm which zeroes the int, grows it then just sets one bit - * as required. - */ -int -mp_2expt (mp_int * a, int b) -{ - int res; - - /* zero a as per default */ - mp_zero (a); - - /* grow a to accomodate the single bit */ - if ((res = mp_grow (a, b / DIGIT_BIT + 1)) != MP_OKAY) { - return res; - } - - /* set the used count of where the bit will go */ - a->used = b / DIGIT_BIT + 1; - - /* put the single bit in its place */ - a->dp[b / DIGIT_BIT] = ((mp_digit)1) << (b % DIGIT_BIT); - - return MP_OKAY; -} - /* set the b bit of a */ int mp_set_bit (mp_int * a, int b) @@ -2550,6 +2523,19 @@ mp_set_bit (mp_int * a, int b) return MP_OKAY; } +/* computes a = 2**b + * + * Simple algorithm which zeroes the int, set the required bit + */ +int +mp_2expt (mp_int * a, int b) +{ + /* zero a as per default */ + mp_zero (a); + + return mp_set_bit(a, b); +} + /* multiply by a digit */ int mp_mul_d (mp_int * a, mp_digit b, mp_int * c) diff --git a/wolfcrypt/src/tfm.c b/wolfcrypt/src/tfm.c index cbb922199..5c5f60bda 100755 --- a/wolfcrypt/src/tfm.c +++ b/wolfcrypt/src/tfm.c @@ -933,7 +933,7 @@ top: /* if not zero goto step 4 */ if (fp_iszero (&u) == FP_NO) { - if (++loop_check > 1024) /* bad input */ + if (++loop_check > 4096) /* bad input */ return FP_VAL; goto top; } @@ -1840,11 +1840,11 @@ int fp_set_bit (fp_int * a, fp_digit b) i = b/DIGIT_BIT; /* set the used count of where the bit will go if required */ - if (a->used < (int)(i + 1)) - a->used = (int)(i + 1); + if (a->used < (int)(i+1)) + a->used = (int)(i+1); /* put the single bit in its place */ - a->dp[i] |= ((mp_digit)1) << (b % DIGIT_BIT); + a->dp[i] |= ((fp_digit)1) << (b % DIGIT_BIT); return MP_OKAY; } @@ -1868,6 +1868,7 @@ int fp_count_bits (fp_int * a) ++r; q >>= ((fp_digit) 1); } + return r; } diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index f4a624432..a36a2fa36 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -115,7 +115,7 @@ #endif #ifdef HAVE_NTRU - #include "ntru_crypto.h" + #include "libntruencrypt/ntru_crypto.h" #endif #ifdef HAVE_CAVIUM #include "cavium_sysdep.h" @@ -3386,7 +3386,6 @@ int rsa_test(void) wc_RsaInitCavium(&key, CAVIUM_DEV_ID); #endif -printf("1\n"); ret = wc_InitRsaKey(&key, 0); if (ret != 0) { free(tmp); @@ -3447,7 +3446,7 @@ printf("1\n"); free(tmp); return -49; } -printf("11\n"); + bytes = fread(tmp, 1, FOURK_BUF, file2); fclose(file2); #endif @@ -3467,7 +3466,6 @@ printf("11\n"); (void)bytes; #endif -printf("111\n"); #ifdef WOLFSSL_KEY_GEN { byte* der; @@ -3478,7 +3476,7 @@ printf("111\n"); RsaKey genKey; FILE* keyFile; FILE* pemFile; -printf("2\n"); + ret = wc_InitRsaKey(&genKey, 0); if (ret != 0) return -300; @@ -3504,7 +3502,7 @@ printf("2\n"); free(pem); return -302; } -printf("22\n"); + #ifdef FREESCALE_MQX keyFile = fopen("a:\\certs\\key.der", "wb"); #else @@ -3532,7 +3530,7 @@ printf("22\n"); wc_FreeRsaKey(&genKey); return -304; } -printf("222\n"); + #ifdef FREESCALE_MQX pemFile = fopen("a:\\certs\\key.pem", "wb"); #else @@ -3569,7 +3567,7 @@ printf("222\n"); wc_FreeRsaKey(&genKey); return -306; } -printf("2222\n"); + wc_FreeRsaKey(&derIn); wc_FreeRsaKey(&genKey); free(pem); @@ -3577,7 +3575,6 @@ printf("2222\n"); } #endif /* WOLFSSL_KEY_GEN */ -printf("3\n"); #ifdef WOLFSSL_CERT_GEN /* self signed */ { @@ -3600,7 +3597,7 @@ printf("3\n"); free(derCert); return -310; } -printf("33\n"); + wc_InitCert(&myCert); strncpy(myCert.subject.country, "US", CTC_NAME_SIZE); @@ -3630,7 +3627,7 @@ printf("33\n"); } FreeDecodedCert(&decode); #endif -printf("333\n"); + #ifdef FREESCALE_MQX derFile = fopen("a:\\certs\\cert.der", "wb"); #else @@ -3648,14 +3645,14 @@ printf("333\n"); free(pem); return -414; } -printf("4\n"); + pemSz = wc_DerToPem(derCert, certSz, pem, FOURK_BUF, NULL, CERT_TYPE); if (pemSz < 0) { free(derCert); free(pem); return -404; } -printf("41\n"); + #ifdef FREESCALE_MQX pemFile = fopen("a:\\certs\\cert.pem", "wb"); #else @@ -4430,8 +4427,111 @@ int dsa_test(void) if (answer != 1) return -65; wc_FreeDsaKey(&key); - wc_FreeRng(&rng); +#ifdef WOLFSSL_KEY_GEN + { + byte* der; + byte* pem; + int derSz = 0; + int pemSz = 0; + DsaKey derIn; + DsaKey genKey; + FILE* keyFile; + FILE* pemFile; + + wc_InitDsaKey(&genKey); + ret = wc_MakeDsaParameters(&rng, 1024, &genKey); + if (ret != 0) return -362; + + ret = wc_MakeDsaKey(&rng, &genKey); + if (ret != 0) return -363; + + der = (byte*)malloc(FOURK_BUF); + if (der == NULL) { + wc_FreeDsaKey(&genKey); + return -364; + } + pem = (byte*)malloc(FOURK_BUF); + if (pem == NULL) { + free(der); + wc_FreeDsaKey(&genKey); + return -365; + } + + derSz = wc_DsaKeyToDer(&genKey, der, FOURK_BUF); + if (derSz < 0) { + free(der); + free(pem); + return -366; + } + +#ifdef FREESCALE_MQX + keyFile = fopen("a:\\certs\\key.der", "wb"); +#else + keyFile = fopen("./key.der", "wb"); +#endif + if (!keyFile) { + free(der); + free(pem); + wc_FreeDsaKey(&genKey); + return -367; + } + ret = (int)fwrite(der, 1, derSz, keyFile); + fclose(keyFile); + if (ret != derSz) { + free(der); + free(pem); + wc_FreeDsaKey(&genKey); + return -368; + } + + pemSz = wc_DerToPem(der, derSz, pem, FOURK_BUF, NULL, DSA_PRIVATEKEY_TYPE); + if (pemSz < 0) { + free(der); + free(pem); + wc_FreeDsaKey(&genKey); + return -369; + } + +#ifdef FREESCALE_MQX + pemFile = fopen("a:\\certs\\key.pem", "wb"); +#else + pemFile = fopen("./key.pem", "wb"); +#endif + if (!pemFile) { + free(der); + free(pem); + wc_FreeDsaKey(&genKey); + return -370; + } + ret = (int)fwrite(pem, 1, pemSz, pemFile); + fclose(pemFile); + if (ret != pemSz) { + free(der); + free(pem); + wc_FreeDsaKey(&genKey); + return -371; + } + + wc_InitDsaKey(&derIn); + idx = 0; + ret = wc_DsaPrivateKeyDecode(der, &idx, &derIn, derSz); + if (ret != 0) { + free(der); + free(pem); + wc_FreeDsaKey(&derIn); + wc_FreeDsaKey(&genKey); + return -373; + } + + wc_FreeDsaKey(&derIn); + wc_FreeDsaKey(&genKey); + free(pem); + free(der); + } +#endif /* WOLFSSL_KEY_GEN */ + + wc_FreeRng(&rng); return 0; } diff --git a/wolfssl/internal.h b/wolfssl/internal.h index 9664bf0e4..66c0d18cd 100644 --- a/wolfssl/internal.h +++ b/wolfssl/internal.h @@ -890,7 +890,7 @@ enum Misc { MAX_WOLFSSL_FILE_SIZE = 1024 * 1024 * 4, /* 4 mb file size alloc limit */ -#ifdef FORTRESS +#if defined(FORTRESS) || defined (HAVE_STUNNEL) MAX_EX_DATA = 3, /* allow for three items of ex_data */ #endif @@ -1612,8 +1612,11 @@ struct WOLFSSL_CTX { #endif /* HAVE_ANON */ #if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) pem_password_cb passwd_cb; - void* userdata; + void* userdata; #endif /* OPENSSL_EXTRA */ +#ifdef HAVE_STUNNEL + void* ex_data[MAX_EX_DATA]; +#endif #ifdef HAVE_OCSP WOLFSSL_OCSP ocsp; #endif @@ -1847,6 +1850,9 @@ struct WOLFSSL_SESSION { word16 ticketLen; byte ticket[SESSION_TICKET_LEN]; #endif +#ifdef HAVE_STUNNEL + void* ex_data[MAX_EX_DATA]; +#endif }; @@ -2300,7 +2306,7 @@ struct WOLFSSL { #ifdef KEEP_PEER_CERT WOLFSSL_X509 peerCert; /* X509 peer cert */ #endif -#ifdef FORTRESS +#if defined(FORTRESS) || defined(HAVE_STUNNEL) void* ex_data[MAX_EX_DATA]; /* external data, for Fortress */ #endif #ifdef HAVE_CAVIUM diff --git a/wolfssl/openssl/asn1.h b/wolfssl/openssl/asn1.h index 3f34d7d2c..11cafa840 100644 --- a/wolfssl/openssl/asn1.h +++ b/wolfssl/openssl/asn1.h @@ -1,2 +1,19 @@ /* asn1.h for openssl */ +#ifndef WOLFSSL_ASN1_H_ +#define WOLFSSL_ASN1_H_ +struct WOLFSSL_ASN1_BIT_STRING { + int length; + int type; + char* data; + long flags; +}; + +struct WOLFSSL_ASN1_STRING { + int length; + int type; + char* data; + long flags; +}; + +#endif /* WOLFSSL_ASN1_H_ */ diff --git a/wolfssl/openssl/bn.h b/wolfssl/openssl/bn.h index 225e6976d..c56a3cfca 100644 --- a/wolfssl/openssl/bn.h +++ b/wolfssl/openssl/bn.h @@ -77,7 +77,9 @@ WOLFSSL_API int wolfSSL_BN_is_prime_ex(const WOLFSSL_BIGNUM*, int, WOLFSSL_BN_CTX*, WOLFSSL_BN_GENCB*); WOLFSSL_API WOLFSSL_BN_ULONG wolfSSL_BN_mod_word(const WOLFSSL_BIGNUM*, WOLFSSL_BN_ULONG); -WOLFSSL_API int wolfSSL_BN_print_fp(FILE*, const WOLFSSL_BIGNUM*); +#ifndef NO_FILESYSTEM + WOLFSSL_API int wolfSSL_BN_print_fp(FILE*, const WOLFSSL_BIGNUM*); +#endif WOLFSSL_API int wolfSSL_BN_rshift(WOLFSSL_BIGNUM*, const WOLFSSL_BIGNUM*, int); WOLFSSL_API WOLFSSL_BIGNUM *wolfSSL_BN_CTX_get(WOLFSSL_BN_CTX *ctx); WOLFSSL_API void wolfSSL_BN_CTX_start(WOLFSSL_BN_CTX *ctx); diff --git a/wolfssl/openssl/crypto.h b/wolfssl/openssl/crypto.h index 8f7c6f40e..034b1cfe1 100644 --- a/wolfssl/openssl/crypto.h +++ b/wolfssl/openssl/crypto.h @@ -21,6 +21,14 @@ WOLFSSL_API unsigned long wolfSSLeay(void); #define SSLEAY_VERSION 0x0090600fL #define SSLEAY_VERSION_NUMBER SSLEAY_VERSION +#ifdef HAVE_STUNNEL +#define CRYPTO_set_mem_ex_functions wolfSSL_CRYPTO_set_mem_ex_functions +#define FIPS_mode wolfSSL_FIPS_mode +#define FIPS_mode_set wolfSSL_FIPS_mode_set +typedef struct CRYPTO_EX_DATA CRYPTO_EX_DATA; +typedef void (CRYPTO_free_func)(void*parent, void*ptr, CRYPTO_EX_DATA *ad, int idx, + long argl, void* argp); +#endif /* HAVE_STUNNEL */ #endif /* header */ diff --git a/wolfssl/openssl/dh.h b/wolfssl/openssl/dh.h index 2bdb67522..e38b7f7af 100644 --- a/wolfssl/openssl/dh.h +++ b/wolfssl/openssl/dh.h @@ -11,7 +11,7 @@ extern "C" { #endif -typedef struct WOLFSSL_DH { +struct WOLFSSL_DH { WOLFSSL_BIGNUM* p; WOLFSSL_BIGNUM* g; WOLFSSL_BIGNUM* pub_key; /* openssh deference g^x */ @@ -23,7 +23,7 @@ typedef struct WOLFSSL_DH { * lighttpd src code. */ int length; -} WOLFSSL_DH; +}; WOLFSSL_API WOLFSSL_DH* wolfSSL_DH_new(void); @@ -48,4 +48,7 @@ typedef WOLFSSL_DH DH; } /* extern "C" */ #endif +#ifdef HAVE_STUNNEL +#define DH_generate_parameters wolfSSL_DH_generate_parameters +#endif /* HAVE_STUNNEL */ #endif /* header */ diff --git a/wolfssl/openssl/ecdh.h b/wolfssl/openssl/ecdh.h index b5583dd93..57d9e2e37 100644 --- a/wolfssl/openssl/ecdh.h +++ b/wolfssl/openssl/ecdh.h @@ -7,7 +7,7 @@ #include #ifdef __cplusplus -extern C { +extern "C" { #endif diff --git a/wolfssl/openssl/ecdsa.h b/wolfssl/openssl/ecdsa.h index 22b2d4cda..a92841fff 100644 --- a/wolfssl/openssl/ecdsa.h +++ b/wolfssl/openssl/ecdsa.h @@ -35,4 +35,5 @@ WOLFSSL_API int wolfSSL_ECDSA_do_verify(const unsigned char *dgst, } /* extern "C" */ #endif -#endif /* header */ \ No newline at end of file +#endif /* header */ + diff --git a/wolfssl/openssl/err.h b/wolfssl/openssl/err.h index 7e7f1eb78..951386868 100644 --- a/wolfssl/openssl/err.h +++ b/wolfssl/openssl/err.h @@ -1,2 +1,3 @@ /* err.h for openssl */ - +#define ERR_load_crypto_strings wolfSSL_ERR_load_crypto_strings +#define ERR_peek_last_error wolfSSL_ERR_peek_last_error diff --git a/wolfssl/openssl/opensslv.h b/wolfssl/openssl/opensslv.h index dc8de4260..e569ec52a 100644 --- a/wolfssl/openssl/opensslv.h +++ b/wolfssl/openssl/opensslv.h @@ -5,7 +5,15 @@ /* api version compatibility */ -#define OPENSSL_VERSION_NUMBER 0x0090810fL +#if defined(HAVE_STUNNEL) || defined(HAVE_LIGHTY) + /* version number can be increased for Lighty after compatibility for ECDH + is added */ + #define OPENSSL_VERSION_NUMBER 0x0090700fL +#else + #define OPENSSL_VERSION_NUMBER 0x0090810fL +#endif + +#define OPENSSL_VERSION_TEXT LIBWOLFSSL_VERSION_STRING #endif /* header */ diff --git a/wolfssl/openssl/rand.h b/wolfssl/openssl/rand.h index c1fa62e1c..bc1f83a88 100644 --- a/wolfssl/openssl/rand.h +++ b/wolfssl/openssl/rand.h @@ -1,4 +1,6 @@ /* rand.h for openSSL */ #include +#include +#define RAND_set_rand_method wolfSSL_RAND_set_rand_method diff --git a/wolfssl/openssl/ssl.h b/wolfssl/openssl/ssl.h index 103d5f217..cae159e55 100644 --- a/wolfssl/openssl/ssl.h +++ b/wolfssl/openssl/ssl.h @@ -289,7 +289,7 @@ typedef WOLFSSL_X509_STORE_CTX X509_STORE_CTX; #define X509_get_serialNumber wolfSSL_X509_get_serialNumber -#define ASN1_TIME_pr wolfSSL_ASN1_TIME_pr +#define ASN1_TIME_print wolfSSL_ASN1_TIME_print #define ASN1_INTEGER_cmp wolfSSL_ASN1_INTEGER_cmp #define ASN1_INTEGER_get wolfSSL_ASN1_INTEGER_get @@ -304,7 +304,7 @@ typedef WOLFSSL_X509_STORE_CTX X509_STORE_CTX; #define SSL_CTX_set_default_passwd_cb_userdata wolfSSL_CTX_set_default_passwd_cb_userdata #define SSL_CTX_set_default_passwd_cb wolfSSL_CTX_set_default_passwd_cb -#define SSL_CTX_set_timeout wolfSSL_CTX_set_timeout +#define SSL_CTX_set_timeout(ctx, to) wolfSSL_CTX_set_timeout(ctx, (unsigned int) to) #define SSL_CTX_set_info_callback wolfSSL_CTX_set_info_callback #define ERR_peek_error wolfSSL_ERR_peek_error @@ -407,25 +407,21 @@ typedef WOLFSSL_X509_STORE_CTX X509_STORE_CTX; typedef WOLFSSL_X509_NAME_ENTRY X509_NAME_ENTRY; #define SSL_CB_HANDSHAKE_START 0x10 -#define X509_NAME_free WOLFSSL_X509_NAME_free -#define SSL_CTX_use_certificate WOLFSSL_CTX_use_certificate -#define SSL_CTX_use_PrivateKey WOLFSSL_CTX_use_PrivateKey -#define BIO_new_file wolfSSL_BIO_new_file +#define X509_NAME_free wolfSSL_X509_NAME_free +#define SSL_CTX_use_certificate wolfSSL_CTX_use_certificate +#define SSL_CTX_use_PrivateKey wolfSSL_CTX_use_PrivateKey #define BIO_read_filename wolfSSL_BIO_read_filename -#define BIO_s_file WOLFSSL_BIO_s_file +#define BIO_s_file wolfSSL_BIO_s_file #define OBJ_nid2sn wolf_OBJ_nid2sn #define OBJ_obj2nid wolf_OBJ_obj2nid #define OBJ_sn2nid wolf_OBJ_sn2nid -#define PEM_read_bio_DHparams PEM_read_bio_DHparams #define PEM_read_bio_X509 PEM_read_bio_WOLFSSL_X509 -#define PEM_write_bio_X509 PEM_write_bio_WOLFSSL_X509 -#define SSL_CTX_set_tmp_dh WOLFSSL_CTX_set_tmp_dh #define SSL_CTX_set_verify_depth wolfSSL_CTX_set_verify_depth -#define SSL_get_app_data WOLFSSL_get_app_data -#define SSL_set_app_data WOLFSSL_set_app_data +#define SSL_get_app_data wolfSSL_get_app_data +#define SSL_set_app_data wolfSSL_set_app_data #define X509_NAME_entry_count wolfSSL_X509_NAME_entry_count -#define X509_NAME_ENTRY_get_object WOLFSSL_X509_NAME_ENTRY_get_object -#define X509_NAME_get_entry WOLFSSL_X509_NAME_get_entry +#define X509_NAME_ENTRY_get_object wolfSSL_X509_NAME_ENTRY_get_object +#define X509_NAME_get_entry wolfSSL_X509_NAME_get_entry #define sk_X509_NAME_pop_free wolfSSL_sk_X509_NAME_pop_free #define SHA1 wolfSSL_SHA1 #define X509_check_private_key wolfSSL_X509_check_private_key @@ -433,6 +429,58 @@ typedef WOLFSSL_X509_NAME_ENTRY X509_NAME_ENTRY; #endif +#if defined(HAVE_STUNNEL) || defined(HAVE_LIGHTY) + +#define PEM_read_bio_DHparams wolfSSL_PEM_read_bio_DHparams +#define PEM_write_bio_X509 PEM_write_bio_WOLFSSL_X509 +#define SSL_CTX_set_tmp_dh wolfSSL_CTX_set_tmp_dh +#define BIO_new_file wolfSSL_BIO_new_file + + +#endif /* HAVE_STUNNEL || HAVE_LIGHTY */ + +#ifdef HAVE_STUNNEL +#include + +/* defined as: (SSL_ST_ACCEPT|SSL_CB_LOOP), which becomes 0x2001*/ +#define SSL_CB_ACCEPT_LOOP 0x2001 +#define SSL2_VERSION 0x0002 +#define SSL3_VERSION 0x0300 +#define TLS1_VERSION 0x0301 +#define DTLS1_VERSION 0xFEFF +#define SSL23_ST_SR_CLNT_HELLO_A (0x210|0x2000) +#define SSL3_ST_SR_CLNT_HELLO_A (0x110|0x2000) +#define ASN1_STRFLGS_ESC_MSB 4 +#define X509_V_ERR_CERT_REJECTED 28 + +#define SSL_alert_desc_string_long wolfSSL_alert_desc_string_long +#define SSL_alert_type_string_long wolfSSL_alert_type_string_long +#define SSL_CIPHER_get_bits wolfSSL_CIPHER_get_bits +#define sk_X509_NAME_num wolfSSL_sk_X509_NAME_num +#define sk_X509_num wolfSSL_sk_X509_num +#define X509_NAME_print_ex wolfSSL_X509_NAME_print_ex +#define X509_get0_pubkey_bitstr wolfSSL_X509_get0_pubkey_bitstr +#define SSL_CTX_get_options wolfSSL_CTX_get_options + +#define SSL_CTX_flush_sessions wolfSSL_flush_sessions +#define SSL_CTX_add_session wolfSSL_CTX_add_session +#define SSL_get_SSL_CTX wolfSSL_get_SSL_CTX +#define SSL_version wolfSSL_version +#define SSL_get_state wolfSSL_get_state +#define SSL_state_string_long wolfSSL_state_string_long +#define SSL_get_peer_cert_chain wolfSSL_get_peer_cert_chain +#define sk_X509_NAME_value wolfSSL_sk_X509_NAME_value +#define sk_X509_value wolfSSL_sk_X509_value +#define SSL_SESSION_get_ex_data wolfSSL_SESSION_get_ex_data +#define SSL_SESSION_set_ex_data wolfSSL_SESSION_set_ex_data +#define SSL_SESSION_get_ex_new_index wolfSSL_SESSION_get_ex_new_index +#define SSL_SESSION_get_id wolfSSL_SESSION_get_id +#define CRYPTO_dynlock_value WOLFSSL_dynlock_value +typedef WOLFSSL_ASN1_BIT_STRING ASN1_BIT_STRING; + + +#endif /* HAVE_STUNNEL */ + #ifdef __cplusplus } /* extern "C" */ #endif diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h index 58c21e7b9..25b86a6c5 100644 --- a/wolfssl/ssl.h +++ b/wolfssl/ssl.h @@ -91,13 +91,10 @@ typedef struct WOLFSSL_ASN1_TIME WOLFSSL_ASN1_TIME; typedef struct WOLFSSL_ASN1_INTEGER WOLFSSL_ASN1_INTEGER; typedef struct WOLFSSL_ASN1_OBJECT WOLFSSL_ASN1_OBJECT; -typedef struct WOLFSSL_ASN1_STRING{ - #ifdef HAVE_LIGHTY - char* data; - int length; - #endif -} WOLFSSL_ASN1_STRING; -typedef struct WOLFSSL_dynlock_value WOLFSSL_dynlock_value; +typedef struct WOLFSSL_ASN1_STRING WOLFSSL_ASN1_STRING; +typedef struct WOLFSSL_dynlock_value WOLFSSL_dynlock_value; +typedef struct WOLFSSL_DH WOLFSSL_DH; +typedef struct WOLFSSL_ASN1_BIT_STRING WOLFSSL_ASN1_BIT_STRING; #define WOLFSSL_ASN1_UTCTIME WOLFSSL_ASN1_TIME @@ -146,6 +143,7 @@ typedef struct WOLFSSL_X509_REVOKED { typedef struct WOLFSSL_X509_OBJECT { union { char* ptr; + WOLFSSL_X509 *x509; WOLFSSL_X509_CRL* crl; /* stunnel dereference */ } data; } WOLFSSL_X509_OBJECT; @@ -340,7 +338,7 @@ WOLFSSL_API int wolfSSL_dtls(WOLFSSL* ssl); WOLFSSL_API int wolfSSL_dtls_set_peer(WOLFSSL*, void*, unsigned int); WOLFSSL_API int wolfSSL_dtls_get_peer(WOLFSSL*, void*, unsigned int*); -WOLFSSL_API int wolfSSL_ERR_GET_REASON(int err); +WOLFSSL_API int wolfSSL_ERR_GET_REASON(unsigned long err); WOLFSSL_API char* wolfSSL_ERR_error_string(unsigned long,char*); WOLFSSL_API void wolfSSL_ERR_error_string_n(unsigned long e, char* buf, unsigned long sz); @@ -524,14 +522,15 @@ WOLFSSL_API void wolfSSL_CTX_set_default_passwd_cb_userdata(WOLFSSL_CTX*, WOLFSSL_API void wolfSSL_CTX_set_default_passwd_cb(WOLFSSL_CTX*, pem_password_cb); -WOLFSSL_API void wolfSSL_CTX_set_info_callback(WOLFSSL_CTX*, void (*)(void)); +WOLFSSL_API void wolfSSL_CTX_set_info_callback(WOLFSSL_CTX*, + void (*)(const WOLFSSL* ssl, int type, int val)); WOLFSSL_API unsigned long wolfSSL_ERR_peek_error(void); WOLFSSL_API int wolfSSL_GET_REASON(int); WOLFSSL_API char* wolfSSL_alert_type_string_long(int); WOLFSSL_API char* wolfSSL_alert_desc_string_long(int); -WOLFSSL_API char* wolfSSL_state_string_long(WOLFSSL*); +WOLFSSL_API char* wolfSSL_state_string_long(const WOLFSSL*); WOLFSSL_API WOLFSSL_RSA* wolfSSL_RSA_generate_key(int, unsigned long, void(*)(int, int, void*), void*); @@ -644,11 +643,16 @@ enum { X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD = 20, X509_V_ERR_CERT_HAS_EXPIRED = 21, X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD = 22, - + X509_V_ERR_CERT_REJECTED = 23, X509_V_OK = 0, + XN_FLAG_SPC_EQ = (1 << 23), + XN_FLAG_ONELINE = 0, + CRYPTO_LOCK = 1, - CRYPTO_NUM_LOCKS = 10 + CRYPTO_NUM_LOCKS = 10, + + ASN1_STRFLGS_ESC_MSB = 4 }; /* extras end */ @@ -1509,26 +1513,23 @@ typedef struct WOLFSSL_X509_NAME_ENTRY { #include +#include -WOLFSSL_API void WOLFSSL_X509_NAME_free(WOLFSSL_X509_NAME *name); -WOLFSSL_API char WOLFSSL_CTX_use_certificate(WOLFSSL_CTX *ctx, WOLFSSL_X509 *x); -WOLFSSL_API int WOLFSSL_CTX_use_PrivateKey(WOLFSSL_CTX *ctx, WOLFSSL_EVP_PKEY *pkey); -WOLFSSL_API WOLFSSL_BIO* wolfSSL_BIO_new_file(const char *filename, const char *mode); +WOLFSSL_API void wolfSSL_X509_NAME_free(WOLFSSL_X509_NAME *name); +WOLFSSL_API char wolfSSL_CTX_use_certificate(WOLFSSL_CTX *ctx, WOLFSSL_X509 *x); +WOLFSSL_API int wolfSSL_CTX_use_PrivateKey(WOLFSSL_CTX *ctx, WOLFSSL_EVP_PKEY *pkey); WOLFSSL_API int wolfSSL_BIO_read_filename(WOLFSSL_BIO *b, const char *name); -WOLFSSL_API WOLFSSL_BIO_METHOD* WOLFSSL_BIO_s_file(void); +WOLFSSL_API WOLFSSL_BIO_METHOD* wolfSSL_BIO_s_file(void); /* These are to be merged shortly */ WOLFSSL_API const char * wolf_OBJ_nid2sn(int n); WOLFSSL_API int wolf_OBJ_obj2nid(const WOLFSSL_ASN1_OBJECT *o); WOLFSSL_API int wolf_OBJ_sn2nid(const char *sn); -WOLFSSL_API WOLFSSL_DH *PEM_read_bio_DHparams(WOLFSSL_BIO *bp, WOLFSSL_DH **x, pem_password_cb *cb, void *u); WOLFSSL_API WOLFSSL_X509 *PEM_read_bio_WOLFSSL_X509(WOLFSSL_BIO *bp, WOLFSSL_X509 **x, pem_password_cb *cb, void *u); -WOLFSSL_API int PEM_write_bio_WOLFSSL_X509(WOLFSSL_BIO *bp, WOLFSSL_X509 *x); -WOLFSSL_API long WOLFSSL_CTX_set_tmp_dh(WOLFSSL_CTX *ctx, WOLFSSL_DH *dh); WOLFSSL_API void wolfSSL_CTX_set_verify_depth(WOLFSSL_CTX *ctx,int depth); -WOLFSSL_API void* WOLFSSL_get_app_data( const WOLFSSL *ssl); -WOLFSSL_API void WOLFSSL_set_app_data(WOLFSSL *ssl, void *arg); -WOLFSSL_API WOLFSSL_ASN1_OBJECT * WOLFSSL_X509_NAME_ENTRY_get_object(WOLFSSL_X509_NAME_ENTRY *ne); -WOLFSSL_API WOLFSSL_X509_NAME_ENTRY *WOLFSSL_X509_NAME_get_entry(WOLFSSL_X509_NAME *name, int loc); +WOLFSSL_API void* wolfSSL_get_app_data( const WOLFSSL *ssl); +WOLFSSL_API void wolfSSL_set_app_data(WOLFSSL *ssl, void *arg); +WOLFSSL_API WOLFSSL_ASN1_OBJECT * wolfSSL_X509_NAME_ENTRY_get_object(WOLFSSL_X509_NAME_ENTRY *ne); +WOLFSSL_API WOLFSSL_X509_NAME_ENTRY *wolfSSL_X509_NAME_get_entry(WOLFSSL_X509_NAME *name, int loc); WOLFSSL_API void wolfSSL_sk_X509_NAME_pop_free(STACK_OF(WOLFSSL_X509_NAME)* sk, void f (WOLFSSL_X509_NAME*)); WOLFSSL_API unsigned char *wolfSSL_SHA1(const unsigned char *d, size_t n, unsigned char *md); WOLFSSL_API int wolfSSL_X509_check_private_key(WOLFSSL_X509*, WOLFSSL_EVP_PKEY*); @@ -1538,6 +1539,77 @@ WOLFSSL_API STACK_OF(WOLFSSL_X509_NAME) *wolfSSL_dup_CA_list( STACK_OF(WOLFSSL_X #endif #endif +#if defined(HAVE_STUNNEL) || defined(HAVE_LIGHTY) + +WOLFSSL_API WOLFSSL_BIO* wolfSSL_BIO_new_file(const char *filename, const char *mode); +WOLFSSL_API long wolfSSL_CTX_set_tmp_dh(WOLFSSL_CTX*, WOLFSSL_DH*); +WOLFSSL_API WOLFSSL_DH *wolfSSL_PEM_read_bio_DHparams(WOLFSSL_BIO *bp, + WOLFSSL_DH **x, pem_password_cb *cb, void *u); +WOLFSSL_API int PEM_write_bio_WOLFSSL_X509(WOLFSSL_BIO *bp, WOLFSSL_X509 *x); + + +#endif /* HAVE_STUNNEL || HAVE_LIGHTY */ + + +#ifdef HAVE_STUNNEL + +#include + +WOLFSSL_API int wolfSSL_CRYPTO_set_mem_ex_functions(void *(*m) (size_t, const char *, int), + void *(*r) (void *, size_t, const char *, int), void (*f) (void *)); + +WOLFSSL_API WOLFSSL_DH *wolfSSL_DH_generate_parameters(int prime_len, int generator, + void (*callback) (int, int, void *), void *cb_arg); + +WOLFSSL_API void wolfSSL_ERR_load_crypto_strings(void); + +WOLFSSL_API unsigned long wolfSSL_ERR_peek_last_error(void); + +WOLFSSL_API int wolfSSL_FIPS_mode(void); + +WOLFSSL_API int wolfSSL_FIPS_mode_set(int r); + +WOLFSSL_API int wolfSSL_RAND_set_rand_method(const void *meth); + +WOLFSSL_API int wolfSSL_CIPHER_get_bits(const WOLFSSL_CIPHER *c, int *alg_bits); + +WOLFSSL_API int wolfSSL_sk_X509_NAME_num(const STACK_OF(WOLFSSL_X509_NAME) *s); + +WOLFSSL_API int wolfSSL_sk_X509_num(const STACK_OF(WOLFSSL_X509) *s); + +WOLFSSL_API int wolfSSL_X509_NAME_print_ex(WOLFSSL_BIO*,WOLFSSL_X509_NAME*,int,unsigned long); + +WOLFSSL_API WOLFSSL_ASN1_BIT_STRING* wolfSSL_X509_get0_pubkey_bitstr( + const WOLFSSL_X509*); + +WOLFSSL_API int wolfSSL_CTX_add_session(WOLFSSL_CTX*, WOLFSSL_SESSION*); + +WOLFSSL_API WOLFSSL_CTX* wolfSSL_get_SSL_CTX(WOLFSSL* ssl); + +WOLFSSL_API int wolfSSL_version(WOLFSSL*); + +WOLFSSL_API int wolfSSL_get_state(const WOLFSSL*); + +WOLFSSL_API void* wolfSSL_sk_X509_NAME_value(STACK_OF(WOLFSSL_X509_NAME)*, int); + +WOLFSSL_API void* wolfSSL_sk_X509_value(STACK_OF(WOLFSSL_X509)*, int); + +WOLFSSL_API STACK_OF(WOLFSSL_X509)* wolfSSL_get_peer_cert_chain(const WOLFSSL*); + +WOLFSSL_API long wolfSSL_CTX_get_options(WOLFSSL_CTX* ctx); + +WOLFSSL_API void* wolfSSL_SESSION_get_ex_data(const WOLFSSL_SESSION*, int); + +WOLFSSL_API int wolfSSL_SESSION_set_ex_data(WOLFSSL_SESSION*, int, void*); + +WOLFSSL_API int wolfSSL_SESSION_get_ex_new_index(long,void*,void*,void*, + CRYPTO_free_func*); + +WOLFSSL_API int wolfSSL_X509_NAME_get_sz(WOLFSSL_X509_NAME*); + + +WOLFSSL_API const unsigned char* wolfSSL_SESSION_get_id(WOLFSSL_SESSION*, unsigned int*); +#endif /* HAVE_STUNNEL */ #ifdef __cplusplus } /* extern "C" */ diff --git a/wolfssl/version.h b/wolfssl/version.h index 6ec106bab..f5a990a10 100644 --- a/wolfssl/version.h +++ b/wolfssl/version.h @@ -26,8 +26,8 @@ extern "C" { #endif -#define LIBWOLFSSL_VERSION_STRING "3.6.1" -#define LIBWOLFSSL_VERSION_HEX 0x03006001 +#define LIBWOLFSSL_VERSION_STRING "3.6.2" +#define LIBWOLFSSL_VERSION_HEX 0x03006002 #ifdef __cplusplus } diff --git a/wolfssl/wolfcrypt/coding.h b/wolfssl/wolfcrypt/coding.h index e7b482379..6c203e964 100644 --- a/wolfssl/wolfcrypt/coding.h +++ b/wolfssl/wolfcrypt/coding.h @@ -41,6 +41,12 @@ WOLFSSL_API int Base64_Decode(const byte* in, word32 inLen, byte* out, #ifdef WOLFSSL_BASE64_ENCODE + enum Escaped { + WC_STD_ENC = 0, /* normal \n line ending encoding */ + WC_ESC_NL_ENC, /* use escape sequence encoding */ + WC_NO_NL_ENC /* no encoding at all */ + }; /* Encoding types */ + /* encode isn't */ WOLFSSL_API int Base64_Encode(const byte* in, word32 inLen, byte* out, @@ -48,6 +54,9 @@ WOLFSSL_API int Base64_Decode(const byte* in, word32 inLen, byte* out, WOLFSSL_API int Base64_EncodeEsc(const byte* in, word32 inLen, byte* out, word32* outLen); + WOLFSSL_API + int Base64_Encode_NoNl(const byte* in, word32 inLen, byte* out, + word32* outLen); #endif #if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || defined(HAVE_FIPS) diff --git a/wolfssl/wolfcrypt/ecc.h b/wolfssl/wolfcrypt/ecc.h index 01ad398b8..92fcc4f4f 100644 --- a/wolfssl/wolfcrypt/ecc.h +++ b/wolfssl/wolfcrypt/ecc.h @@ -234,6 +234,7 @@ enum { KEY_SIZE_128 = 16, KEY_SIZE_256 = 32, IV_SIZE_64 = 8, + IV_SIZE_128 = 16, EXCHANGE_SALT_SZ = 16, EXCHANGE_INFO_SZ = 23 }; diff --git a/wolfssl/wolfcrypt/logging.h b/wolfssl/wolfcrypt/logging.h index 0b124835b..2e604080d 100644 --- a/wolfssl/wolfcrypt/logging.h +++ b/wolfssl/wolfcrypt/logging.h @@ -46,9 +46,13 @@ typedef void (*wolfSSL_Logging_cb)(const int logLevel, WOLFSSL_API int wolfSSL_SetLoggingCb(wolfSSL_Logging_cb log_function); #ifdef DEBUG_WOLFSSL + /* a is prepended to m and b is appended, creating a log msg a + m + b */ + #define WOLFSSL_LOG_CAT(a, m, b) #a " " m " " #b void WOLFSSL_ENTER(const char* msg); void WOLFSSL_LEAVE(const char* msg, int ret); + #define WOLFSSL_STUB(m) \ + WOLFSSL_MSG(WOLFSSL_LOG_CAT(wolfSSL Stub, m, not implemented)) void WOLFSSL_ERROR(int); void WOLFSSL_MSG(const char* msg); @@ -57,6 +61,7 @@ WOLFSSL_API int wolfSSL_SetLoggingCb(wolfSSL_Logging_cb log_function); #define WOLFSSL_ENTER(m) #define WOLFSSL_LEAVE(m, r) + #define WOLFSSL_STUB(m) #define WOLFSSL_ERROR(e) #define WOLFSSL_MSG(m)