wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-06 16:20:53 +02:00
Code Issues Packages Projects Releases Wiki Activity
30,090 Commits 13 Branches 184 Tags
37511b484e57e27a9864296d5de2f9de653fb45d
Commit Graph

30090 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Pouzzner 37511b484e tests/api/test_ssl_cert.c, tests/api/test_ssl_ext.c, tests/api/test_ssl_pk.c: add missing gates on !NO_TLS. 2026-06-10 12:05:00 -05:00
Daniel Pouzzner 4ce3baa307 wolfssl/ssl.h: add !NO_TLS gate around prototypes for wolf*_{client,server}_method*() to induce compile-time failures for TLS/SSL usage in NO_TLS configurations. 2026-06-10 12:05:00 -05:00
Daniel Pouzzner 03825c17f8 src/ssl_api_ext.c and src/ssl_api_pk.c: restore early BAD_FUNC_ARG returns that were refactored away in 359e688dc3, fixing null pointer deref regression in wolfSSL_UseALPN() (possibly others too). 2026-06-10 12:05:00 -05:00
David Garske 73f78dd3cb Merge pull request #10646 from ColtonWilley/openwrt-ci-tls-reset 
Docker/OpenWrt: accept exit 4 or 5 in negative TLS tests
 2026-06-10 09:56:41 -07:00
Daniel Pouzzner 332c249c7a Merge pull request #10572 from Frauschi/lms_xmss_cert_gen 
Support RFC 9802 LMS and XMSS in X.509 certificate and CSR generation
 2026-06-10 11:14:43 -05:00
David Garske 953467875f Merge pull request #10560 from philljj/fix_dh_agree 
dh: fix subgroup check in wc_DhAgree.
 2026-06-10 09:13:31 -07:00
David Garske 760392f403 Merge pull request #10636 from embhorn/zd21942 
Harden PKCS#7 FlattenEncodedAttribs
 2026-06-10 08:57:39 -07:00
David Garske 791224b3c5 Merge pull request #10632 from Frauschi/fenrir 
Fenrir fixes
 2026-06-10 08:14:30 -07:00
Tobias Frauenschläger 11270fc465 Check for EC_PF_UNCOMPRESSED in TLS 1.2 ClientHello 
Fixes F-4892
 2026-06-10 11:37:40 +02:00
Tobias Frauenschläger e407dba23b Improve supported_groups handling 
Fixes F-4891
 2026-06-10 11:37:40 +02:00
Tobias Frauenschläger e1413a177f Add missing ForceZero() calls 
Fixes  F-5437 and F-5438
 2026-06-10 11:37:40 +02:00
Tobias Frauenschläger c01152d35a Minor fix in liboqs GetRandomData 
Fixes F-4443
 2026-06-10 11:37:40 +02:00
Tobias Frauenschläger 9c60d87abc Fix minor CAVIUM issues 
Fixes F-4441 and F-4442
 2026-06-10 11:37:40 +02:00
Tobias Frauenschläger c611a22b2f Ensure a key is set for DES3 operations 
Fixes F-5379
 2026-06-10 11:36:59 +02:00
Tobias Frauenschläger c76c83258c Ensure a key is set for ARC4 operations 
Fixes F-5378
 2026-06-10 11:36:29 +02:00
Tobias Frauenschläger 09b288000c Size cert signature buffers from the key and check sig type vs key 
MAX_ENCODED_SIG_SZ grows to ~50KB once SLH-DSA is enabled, yet it was
used to size PKCS#1/signature scratch and output buffers across the
library, wasting stack and heap even for classic RSA/ECC operations.

- Add MAX_ENCODED_CLASSIC_SIG_SZ for RSA/DSA/ECC DigestInfo buffers that
  can never hold a PQC signature.
- Size the certificate/CSR signing output buffer from the signing key at
  runtime instead of the worst-case macro.
- Add overridable WOLFSSL_MAX_SIG_SZ for the WOLFSSL_NO_MALLOC buffer.
- Reject a signature type that does not match the signing key.
 2026-06-10 10:51:41 +02:00
Tobias Frauenschläger e05a453944 Support RFC 9802 LMS and XMSS in X.509 certificate and CSR generation 
Extend wc_MakeCert_ex/wc_SignCert_ex/wc_MakeCertReq_ex to issue HSS/LMS and
XMSS/XMSS^MT certificates and PKCS#10 requests, building on the existing
RFC 9802 verification support. New LMS_TYPE/XMSS_TYPE/XMSSMT_TYPE selectors,
wc_{Lms,Xmss}Key_PublicKeyToDer SPKI encoders, runtime signature-buffer
sizing, and sigType/key consistency checks. Generation is ASN.1-template
only, matching where the verification path lives.

Tests generate self-signed roots, CSRs and a CA->ECC-leaf chain in-process
and verify them, replacing the patched Bouncy Castle fixtures (only the stock
RFC 9802-aligned LMS interop anchor is kept).
 2026-06-10 10:51:33 +02:00
jordan 0640b2ef99 dh tests: fix define gate. 2026-06-10 01:39:18 -05:00
jordan c78fb5f41b dh: fix subgroup check in wc_DhAgree. 2026-06-10 01:28:12 -05:00
Daniel Pouzzner fdbfb66c4b Merge pull request #10569 from SparkiDev/ssl_c_split_1 
ssl.c: Move functions out to own files and add testing
 2026-06-09 22:52:34 -05:00
Sean Parkinson 359e688dc3 ssl.c: Move functions out to own files and add testing 
ssl_api_pk.c: added Public-key APIs (min/max key sizes, DH key test,
signature NIDs, tmp ecdh. Reworked code of new functions.
ssl_api_cert.c: added more SSL Certificate APIs. Reworked code of new
functions.
ssl_api_ext.c: TLS extension APIs (session tickets, max fragment,
groups, etc.). Reworked code.
ssl_api_dtls.c: DTLS APIs (cookie secret, etc.)

Improved test coverage for functions moved.
 2026-06-10 09:11:59 +10:00
David Garske 4f09916e7e Merge pull request #10443 from anhu/protonamelist 
Enforce only 1 protocolname in serverhello
 2026-06-09 15:42:02 -07:00
David Garske 358ae9a559 Merge pull request #10249 from ColtonWilley/pr15-tls-config-bounds 
Add negative-count and NULL checks to group-setting and shared-cipher APIs
 2026-06-09 14:40:16 -07:00
Eric Blankenhorn 4ef8d52abb Fix from review 2026-06-09 16:37:44 -05:00
David Garske 52681591fe Merge pull request #10640 from douzzer/20260608-atomic-fixes 
20260608-atomic-fixes
 2026-06-09 10:41:01 -07:00
David Garske 850cc84ee8 Merge pull request #10635 from holtrop-wolfssl/wolfssl-wolfcrypt-2.0.0 
Update wolfssl-wolfcrypt Rust crate to v2.0.0
 2026-06-09 10:08:19 -07:00
Colton Willey 7ea94c9a99 Docker/OpenWrt: accept exit 4 or 5 in negative TLS tests 
uclient-fetch intermittently returns 4 ("connection reset prematurely") instead of 5: with ML-KEM enabled by default the larger ClientHello is sometimes reset by the server before the cert is evaluated. Accept either on all four negative tests as a band-aid.
 2026-06-09 09:49:43 -07:00
David Garske 65d54df5ea Merge pull request #10644 from Frauschi/arduino 
Fix Arduino CI test
 2026-06-09 09:36:01 -07:00
Tobias Frauenschläger 0278d3a72e Reduce flash size for Arduino examples 2026-06-09 15:41:27 +02:00
David Garske bbace5a1cc Merge pull request #10494 from LinuxJedi/STM32MP13-SHAKE 
Fix SHAKE with STM32MP13 and add simulator
 2026-06-08 15:45:30 -07:00
David Garske e2d3b63139 Merge pull request #10207 from ColtonWilley/d2i_pem_negative_length 
Add signed-length validation to d2i, PEM, and buffer-load APIs
 2026-06-08 15:42:00 -07:00
David Garske dbf72c4f00 Merge pull request #10601 from kareem-wolfssl/f3772 
Fenrir fixes
 2026-06-08 15:23:05 -07:00
Colton Willey 41c09a734c Address review cleanups 2026-06-08 15:10:51 -07:00
David Garske c9cb0ef033 Merge pull request #10212 from ColtonWilley/fix-skid-overflow-and-null-checks 
Harden X509 DER length handling in wolfSSL_X509_get_der and wolfSSL_i2d_X509
 2026-06-08 15:01:14 -07:00
Daniel Pouzzner 68144a81da fixes from AI review: 
wolfcrypt/src/wc_port.c: fix several missed refactors to WC_ATOMIC_[U]INT_ARG.

wolfssl/wolfcrypt/wc_port.h:
* harmonize the return type of WOLFSSL_ATOMIC_STORE() (always void).
* fix MSVC WOLFSSL_ATOMIC_LOAD() and _STORE() with correct atomic semantics, and add gating on USE_WINDOWS_API.
 2026-06-08 16:52:06 -05:00
David Garske da1de8a9fc Merge pull request #10472 from douzzer/20260512-wc_init_state 
20260512-wc_init_state
 2026-06-08 13:44:17 -07:00
Daniel Pouzzner 672da2ad96 Merge pull request #10633 from holtrop-wolfssl/f-4141 
Add unit tests that TLS resumption fails due to ALPN mismatch
 2026-06-08 15:21:53 -05:00
Daniel Pouzzner f3ab345d1c Merge pull request #10553 from julek-wolfssl/tls-12-mutual-auth 
Allow RSA client certs on ECDHE-ECDSA mutual auth
 2026-06-08 15:21:29 -05:00
Daniel Pouzzner e51317261d Merge pull request #10630 from yosuke-wolfssl/fix/f_4890 
Fix odd-length CertificateRequest signature_algorithms acceptance
 2026-06-08 15:21:02 -05:00
Daniel Pouzzner 51bbb74b74 Merge pull request #10629 from yosuke-wolfssl/fix/f_4637 
Fix the error handling on wc_PKCS7_DecodeAuthEnvelopedData
 2026-06-08 15:20:36 -05:00
Daniel Pouzzner 1943a6f33a Merge pull request #10550 from rizlik/sha512_only 
add support for WOLF_CRYPTO_CB_ONLY_SHA512
 2026-06-08 15:20:08 -05:00
Colton Willey 6211210c86 Strengthen regression tests for group and shared-cipher API guards 2026-06-08 12:41:34 -07:00
Colton Willey 00a21b0bfa Add regression tests for group-setting and shared-cipher API guards 
Extend test_tls13_apis with negative-count assertions for
wolfSSL_CTX_set_groups and wolfSSL_set_groups, and NULL-groups
assertions for wolfSSL_CTX_set1_groups and wolfSSL_set1_groups
(tests/api/test_tls13.c).

Add test_wolfSSL_get_shared_ciphers covering NULL ssl, NULL buf, and
zero-length inputs (tests/api/test_tls.c).
 2026-06-08 12:41:34 -07:00
Colton Willey af0db53e86 Fix negative count and NULL pointer checks in group-setting and shared cipher APIs 
Add count < 0 validation to wolfSSL_CTX_set_groups and wolfSSL_set_groups
(src/tls.c) to prevent negative count from bypassing the upper-bound check
and corrupting numGroups via byte truncation.

Widen count == 0 to count <= 0 and add NULL groups check in
wolfSSL_CTX_set1_groups and wolfSSL_set1_groups (src/ssl.c).

Add NULL buf and NULL cipher checks in wolfSSL_get_shared_ciphers to
prevent NULL pointer dereference.
 2026-06-08 12:40:46 -07:00
Kareem 4a854b0a71 Add unit test for wc_AesEaxEncryptFinal authTagSz below minimum. 2026-06-08 10:29:10 -07:00
Kareem 147c808562 Change no_renegotiation alert to warning level to match RFC 5246 7.2.2. 
Fixes F-4113.
 2026-06-08 10:29:10 -07:00
Kareem 8e268dee13 Avoid suppressing error from Cy_Crypto_Core_Sha_Finish in wc_Sha512_224Final. 
Fixes F-4002.
 2026-06-08 10:29:10 -07:00
Kareem b2d5cbf6f1 Reject auth tags below WOLFSSL_MIN_AUTH_TAG_SZ in the AES-EAX encrypt path. This matches AES-EAX decrypt behavior as well as other AES modes. 
Fixes F-3759.
 2026-06-08 10:29:10 -07:00
Kareem 00c84ced25 Confirm keys-params is not NULL before dereferencing in wc_XmssKey_GetPubLen. 
Fixes F-3980.
 2026-06-08 10:29:10 -07:00
Kareem 47bebc6441 Fix wc_tsip_MakeRsaKey ignoring errors and not freeing buffers in some error cases. 
Fixes F-4005.
 2026-06-08 10:29:09 -07:00