Adds wc_AesKeyWrap_Pad/wc_AesKeyUnWrap_Pad and their _ex variants plus crypto
callback dispatch, routing blocks through wc_AesEcb* so an ECB only callback works.
RFC 8446 Section 6.2 lists failure to validate a PSK binder under
decrypt_error, but TranslateErrorToAlert() mapped BAD_BINDER to
illegal_parameter. That told the peer its ClientHello was malformed, when
in fact the message was well formed and only the binder MAC did not match.
BAD_BINDER is also returned when no offered PSK matched and the server has
no certificate to fall back to. That reuse is deliberate, because it keeps
an unknown PSK identity indistinguishable from a failed binder, so both
conditions still map to a single alert after this change. A comment at the
return site in CheckPreSharedKeys() now records the invariant at both ends.
Splitting BAD_BINDER off illegal_parameter exposed a second path that had to
move with it. FindPsk() raised PSK_KEY_ERROR, which stays mapped to
illegal_parameter, when the server callback recognised an identity carrying
a non-zero obfuscated_ticket_age. That check ran before any binder was
derived, so on a certificate-less server the two alerts would have let an
unauthenticated peer enumerate valid PSK identities without holding a key.
The check is removed rather than made to fail differently: RFC 8446 Section
4.2.11 says that for an externally established identity an
obfuscated_ticket_age of 0 SHOULD be used and servers MUST ignore the value.
Ignoring it satisfies that requirement, closes the oracle, and lets a
conformant client that sends a non-zero age complete a handshake that was
previously rejected. test_tls13_psk_age_no_identity_oracle() asserts a known
and an unknown identity produce the same alert, with a positive control that
the known run really took the matched path.
Also removes an unreachable branch in CheckPreSharedKeys(). Since commit
089f1f7c9 added the earlier !*usingPSK certificate check, the later
certificate check and its BAD_BINDER return can no longer be reached. A
build with certificates returns BAD_BINDER earlier when none is loaded, and
a NO_CERTS build returns it unconditionally. The remaining branch now falls
through to the shared exit so WOLFSSL_LEAVE() is emitted on the certificate
fallback path as well.
Adds an os-check-linux configuration, tls13-psk-no-certs. psk.yml already
covers NO_CERTS with TLS 1.3 PSK through static-psk-lowresource-tls13, but
that config disables DH, so it only reaches the psk_ke branch. This one
leaves DH enabled and covers psk_dhe_ke under NO_CERTS.
Applications that inspect wolfSSL_get_alert_history() will observe alert 51
instead of 47 for these conditions. The affected tests are updated.
wolfSSL_X509_STORE_CTX_set_verify_cb stored the application callback in
ctx->verify_cb, but every verification site read ctx->store->verify_cb
instead, so the field was never consulted. An application installing a
restrictive callback on the store context, which is the OpenSSL
documented way to enforce extra policy during verification, had it
silently ignored, and wolfSSL_X509_verify_cert could report success on a
chain the callback would have rejected.
Add X509StoreGetVerifyCb, which prefers the context callback and falls
back to the store one, and use it at all four call sites in
X509StoreVerifyCert, X509StoreCheckPathLen and wolfSSL_X509_verify_cert.
The store fallback keeps its OPENSSL_ALL or WOLFSSL_QT guard because the
store field only exists there, while the call sites now follow the
OPENSSL_EXTRA guard of the setter. Clear ctx->verify_cb in
wolfSSL_X509_STORE_CTX_init along with the other per-verification state
so a reused context does not carry a stale callback.
A rejection also has to be reportable. When the certificate manager
accepts a chain, ctx->error is X509_V_OK, so a callback that rejects it
without recording an error of its own left wolfSSL_X509_verify_cert
returning failure while X509_STORE_CTX_get_error still said the chain
was fine. Record WOLFSSL_X509_V_ERR_UNSPECIFIED in that case, matching
what OpenSSL reports, and only when the callback set no error itself.
Add that value to the X509 error enum, where the openssl compatibility
header already had the define.
Feeding the rejection marker to SetupStoreCtxError is not an option
there, since GetX509Error has no X509_V_ error for it and would pass the
negative value through as the reported error. The OPENSSL_ALL date
recheck did exactly that after a rejection, so skip that block once the
callback has rejected, which also stops it from consulting the callback
a second time.
Add a regression test that verifies a good chain twice, once bare and
once with a rejecting context callback, requires the second attempt to
fail, and checks the reported error both when the callback records one
and when it does not.
Fixes F-7341.
The function freed the extension's dynamically allocated ASN.1 string
buffer but left value.data and value.isDynamic pointing at it. The
subsequent wolfSSL_ASN1_STRING_copy() call snapshots those fields before
copying and frees the old buffer once the copy is complete, so the stale
pointer was freed a second time. Any second call to
wolfSSL_X509_EXTENSION_set_data() on an extension holding a value of at
least CTC_NAME_SIZE bytes hit this, and passing the extension its own
value made the copy read freed memory as well.
wolfSSL_ASN1_STRING_set() already performs an alias safe replacement and
disposes of the previous buffer itself, so drop the manual free. Add a
regression test that replaces a dynamically allocated extension value and
then sets the value from itself.
Fixes F-7340.
DoClientHello has four exits that fail with VERSION_ERROR when runtime
version restrictions leave nothing acceptable at or below the version the
client offered. Three of them sent no alert at all, and the fourth sent
one only when WOLFSSL_EXTRA_ALERTS was defined, so a default build simply
dropped the connection. The client could not tell a version mismatch from
a network failure.
The generic fallback did not help. SendFatalAlertOnly is a no-op unless
WOLFSSL_EXTRA_ALERTS is defined, and where it is defined it grouped
VERSION_ERROR with MATCH_SUITE_ERROR and sent handshake_failure. That also
disagreed with the TLS 1.3 mapping, which already resolves VERSION_ERROR
to protocol_version.
Send a fatal protocol_version alert from all four branches regardless of
WOLFSSL_EXTRA_ALERTS, and give VERSION_ERROR its own case in
SendFatalAlertOnly so the generic path agrees.
Note that this is only observable on the TLS 1.2 message path. A TLS 1.3
capable server routes the ClientHello through DoTls13HandShakeMsgType,
which already translates the error into the right alert.
Fixes F-7568.
check-source-text flags a comparison against a bare error code, since an
unwrapped operand defeats the error-trace build. 85 of them across five
white-boxes, all introduced by this branch; wrap each in WC_NO_ERR_TRACE().
test_compress.c was the only file of the 105 in tests/api/ that included a
libc header before <tests/unit.h>. That header establishes wolfSSL's
feature-test macros, and pulling limits.h in ahead of it fixes glibc's
exposure before they are seen, which under -std=c89 left POSIX types the
rest of the suite needs undeclared -- the unknown 'stack_t' and 'intptr_t'
the c89 clang-tidy scenario reported. Include it after, where it still
provides INT_MAX.
"statics" is not a word and codespell reads it as "statistics"; say
helpers or internals instead.
The ASNSetData array named `nd` reads as a typo for "and"/"2nd"; rename it
to `nested`, which is what it holds.
The strlcat truncation case asserted against "he worl", a deliberately cut
string that codespell flags. Use data whose truncation is not
dictionary-adjacent; the expected values come from the same OpenBSD
reference as the rest of these assertions.
These three tests fail against master today and pass once the wc_port and
pkcs7 fixes land; they are the executable statement of what those fixes
must do.
wc_strlcpy must return the length of src, not the bytes it copied, which
is what makes the documented truncation check (ret >= dstSize) work and
what its own doxygen comment already specifies.
wc_strlcat must return the total length attempted and must not measure dst
past dstSize: an unbounded scan of a dst holding no NUL is the
out-of-bounds read strlcat(3) bounds this at to prevent. The dst in that
case keeps a NUL at the very end of the array so an unbounded
implementation reads a wrong length and fails the assertion rather than
running off the buffer under a sanitizer.
Tearing down a PKCS7 whose AuthEnvelopedData decode stopped part-way must
not leak the encryptedContent buffer that stream->bufferPt holds across
WANT_READ re-entries. Counting allocators wrap the whole cycle; an
untouched blob runs first as a control so an imbalance is attributable to
the aborted decode rather than to ambient allocation.
Expected values verified against the OpenBSD strlcpy/strlcat sources and
against a build carrying the fixes.
Include <limits.h> in test_compress.c rather than relying on another
header pulling it in for INT_MAX.
Free wc_PKCS12_parse's outputs with the types it allocates them with:
DYNAMIC_TYPE_PUBLIC_KEY for the key and DYNAMIC_TYPE_PKCS for the cert
buffer, which comes from a WC_DerCertList node. The white-box was using
PRIVATE_KEY/CERT, which misaccounts under memory tracking.
Run the SHE argument guards only on a context wc_SHE_Init() accepted,
since `she` is an uninitialised stack object otherwise.
Note in test_port.c that wc_strlcpy returns the number of bytes copied
rather than XSTRLEN(src) as BSD strlcpy does, so the truncating call is
expected to report 2.
wc_SHE_GenerateM1M2M3 and wc_SHE_GenerateM4M5 have a 12-operand and an
8-operand argument OR that account for 20 of wc_she.c's 23 uncovered
conditions; the group's other tests only pass valid arguments. One call
per operand.
The pkcs12 group was almost entirely wc_PKCS12_PBKDF_ex, which lives in
pwdbased.c, leaving pkcs12.c's container entry points to the KAT alone.
Drives the argument guards of wc_d2i_PKCS12, wc_i2d_PKCS12,
wc_PKCS12_parse and wc_PKCS12_free.
Argument guards of wc_Compress_ex, wc_DeCompress_ex and
wc_DeCompressDynamic, plus the inSz overflow cap. Takes compress.c to
8/8 with the existing compress_test() KAT.
Covers the argument guards of wc_FileLoad, wc_ReadDirFirst/Next,
wc_strtok, wc_strsep, wc_strlcpy's truncation arm and wolfSSL_NewThread.
wc_port.c had no test group of its own.
Builds clean under --enable-all, default and --enable-singlethreaded.
Allow a quantum-safe-only TLS 1.3 stack - ML-KEM key exchange with ML-DSA or
SLH-DSA authentication - with RSA, ECC and DH all disabled (the CNSA 2.0 /
EO 14412 posture).
- Treat a usable standalone ML-KEM group as a valid key exchange and
Falcon/ML-DSA/SLH-DSA as valid authentication, so the "no cipher suites"
#errors no longer fire (ssl.c, internal.h), and extend the CopyDecodedToX509
pkCurveOID guard to match the struct member guards (internal.c).
- asn.c: guard the RSA/ECC-only certificate signing helpers so cert generation
compiles with RSA and ECC disabled, while keeping MakeSignatureCb available
for the WOLFSSL_CERT_SIGN_CB (TPM/HSM) offload path.
- tls.c: advertise the psk_dhe_ke exchange mode when a standalone ML-KEM group
is usable on the client side, that is when the build has both key generation
and decapsulation. Without it an ML-KEM-only build fell back to psk_ke, the
resumption key schedules diverged, and the first AEAD record failed to
authenticate (AES_GCM_AUTH_E), breaking session-ticket resumption.
- tls13.c: hoist the hashAlgo void cast in EncodeSigAlg out of the Ed25519 and
Ed448 cases so a build with no classic signature algorithm still marks the
parameter used.
- Examples and tests: add ML-DSA and SLH-DSA certificate selection (gated on
NO_RSA so it only applies in true PQC-only builds) and default to TLS 1.3
when no classic auth is built in and a post-quantum signature is available
(test.h, client/server/echo*, test_tls13.c). SLH-DSA uses the SHAKE-128s leaf
certificates and their shared 128s root.
- CI: add PQC-only entries to the pq-all.json config list (ML-DSA and SLH-DSA),
each exercising the build, a full TLS 1.3 handshake, and ML-KEM-only
session-ticket resumption.
Whether a build can authenticate with a post-quantum certificate is three
separate questions - is the algorithm compiled in, are test credentials wired
up for the enabled parameter set, and can this build sign - so test.h answers
them with three tiers of macro rather than testing WOLFSSL_HAVE_MLDSA and
WOLFSSL_HAVE_SLHDSA directly:
- TEST_HAVE_MLDSA_CERT_FILES / TEST_HAVE_SLHDSA_CERT_FILES: the credential
paths name real files. ML-DSA needs an enabled parameter level; SLH-DSA needs
a 128s parameter set, since both families share a 128s root and only those
certificates are wired up, and PEM decoding, since the entity certificates
ship as PEM only. Loading a certificate needs verification support alone, so
test_tls13.c uses this tier - it only needs a certificate on the context.
- TEST_HAVE_MLDSA_CERTS / TEST_HAVE_SLHDSA_CERTS: the above, plus the ability
to sign. A verify-only build derives WOLFSSL_MLDSA_NO_SIGN and drops private
key support entirely, so it can neither load the key nor produce a
CertificateVerify. The example credential ladders use this tier.
- TEST_HAVE_PQC_CERT_AUTH: either of those, plus WOLFSSL_TLS13. Both algorithms
are TLS 1.3 only, so folding the version into the macro keeps the version
defaults and the PSK fallbacks in the client, server and echo examples from
disagreeing. Falcon is deliberately absent, having no credentials in the
ladders, so a Falcon-only build keeps the historic TLS 1.2 PSK behavior.
A build that fails a gate now falls back to PSK instead of naming credentials
it cannot use, which removes two hard #errors that were reachable from
configure: --enable-slhdsa with only non-128s parameter sets broke every build
that includes test.h, even ones with RSA and ECC enabled that would never touch
an SLH-DSA credential.
Also in the credential material and the configurations this opens up:
- test.h: pair the DER ML-DSA certificate with mldsa<N>-key.der. The
mldsa<N>_priv-only.der files are standalone PKCS#8 encoding vectors from an
unrelated key pair, so a build without PEM decoding presented a certificate
and signed with a key that did not match it, and the peer rejected the
CertificateVerify.
- echoserver.c: load the SLH-DSA key with CERT_FILETYPE like every neighboring
branch, rather than hardcoding WOLFSSL_FILETYPE_PEM against a certificate
loaded in the build-dependent format.
- internal.c, tls13.c, ssl_load.c: mark ssl, sigOut, keyType and keySz used.
Every reader of these sits in a per-algorithm block, so a build with no
signing algorithm at all left them unused and -Werror rejected the library.
- tests/api.c: skip test_wolfSSL_PKCS8 unless RSA, ECC or PEM decoding is
available. With none of them every key-loading body compiles out, leaving the
file locals unused and nothing for the test to do.
The quad decoding loop broke out on a NUL byte without clearing the
remaining input length, unlike the equivalent loops in Base64_Decode and
Base64_Decode_nonCT. Control then fell into the block that buffers the
leftover input in the context, which copied the full remaining byte count
into the 48 byte ctx->data with an unbounded index, and read one byte past
the end of the caller's buffer. An application decoding attacker supplied
base64 with an explicit, binary safe length could write attacker
controlled data past the end of a heap allocated encode context.
Clear the length before breaking, and bound the leftover copy loop at one
decode block, which is the most that loop can legitimately buffer. That
also keeps ctx->remaining below the block size, so a reused context cannot
underflow the copy size in the next update call or over-read ctx->data in
EVP_DecodeFinal.
Add a negative test feeding a NUL byte followed by more non-whitespace
data than the context buffer can hold.
Fixes F-7445.
wc_LmsKey_Sign computes the signature with the one-time key at the
current leaf and only afterwards advances the leaf index and writes it
to non-volatile storage. When that write failed the signature was erased
but the key state was left as OK, so the same in-memory key could sign
again while storage still recorded the already consumed leaf. A restart
followed by wc_LmsKey_Reload would then resume from that leaf and sign a
second message with the same LM-OTS private key.
Set the key state to bad before signing and only restore it to OK once
the advanced private key has been committed to storage, matching what
wc_xmsskey_signupdate already does for XMSS. Exhausted keys keep their
existing NOSIGS state.
Fixes F-7411.
Clean up includes single return point from every function, consistent formatting function block comment and tests added.
ssl_api_rw.c: Cleanup; 6 helpers extracted from write_dup/shutdown; fixed a SendBuffered corner case that returned 0 instead of an error.
ssl_api_ext.c: Cleanup; extracted wolfssl_ticket_key_cb_process, wolfssl_rehandshake_prepare.
ssl_api_hs.c: Cleanup + de-indent; 9 helpers extracted, incl. shared wolfssl_handshake_flush/_done between connect and accept (~100 duplicated lines removed). wolfSSL_connect/accept left multi-exit.
ssl_api_cert.c: Cleanup of newer functions at end of file; extracted PushPeerCertToChain; fixed a double free in CreatePeerCertChain; fixed 5 wrong @param names.
ssl_api_crl_ocsp.c: Full cleanup of all 49 functions; wolfSSL_OCSP_parse_url rewritten; fixed a URL with no host returning success with the rest of the URL as the host; added IPv6 literal support; fixed 4 wrong WOLFSSL_ENTER names.
ssl.c: Moved the x509GetIssuerFromCM forward declaration here for clarity.
night1rider
David GarskeandGitHub
Takashi Kojo
Tobias Frauenschläger
Daniele Lacamera
Sean Parkinson