Commit Graph

5872 Commits

Author SHA1 Message Date
Hayden Roche
58789991f9 Allow DES3 with FIPS v5-dev. 2022-01-24 15:18:44 -08:00
Sean Parkinson
848f5eeb0c Merge pull request #4755 from dgarske/dtls_srtp
DTLS SRTP (RFC5764) support (adds `--enable-srtp`)
2022-01-21 10:43:47 +10:00
David Garske
427b67d51b Merge pull request #4756 from kareem-wolfssl/noBio
Fix building with OPENSSL_EXTRA and NO_BIO defined.
2022-01-20 10:41:22 -08:00
Marco Oliverio
40f573df72 dtls-srtp: NIT: fix EKM size in comments 2022-01-20 16:55:44 +01:00
Marco Oliverio
d5aa76b161 dtsl-srtp: use PRF according to the DTLS version used
RFC 5764 sec 4.1.2
2022-01-20 16:55:30 +01:00
Marco Oliverio
cdb2936244 dtls-srtp: PRF: fix correct order of client/server random in seed
see RFC 5705 Section 4
2022-01-20 16:12:04 +01:00
David Garske
609d6442b1 Merge pull request #4753 from SparkiDev/siphash
Add SipHash algorithm
2022-01-19 18:51:44 -08:00
Sean Parkinson
a6485a228d Add SipHash algorithm 2022-01-20 09:41:18 +10:00
David Garske
7adbf59f22 Merge pull request #4767 from anhu/kill_hc128
Get rid of HC-128
2022-01-19 12:20:18 -08:00
David Garske
8e0ece920b Test cleanups. Fix possible leak in TLSX_UseSRTP. 2022-01-19 09:22:02 -08:00
Marco Oliverio
9b69f693e4 dtls-srtp: check that length of strings matched before memcomparing
otherwise if profile_str_len is > strlen(gSrtpProfiles[i].name) we end up
comparing memory past gSrtpProfiles[i].name. -fsanitize=address catches this:

```
==100159==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f40d8d533b2 at pc 0x7f40d8eb014f bp 0x7f40d50fe240 sp 0x7f40d50fd9e8
READ of size 21 at 0x7f40d8d533b2 thread T107
    #0 0x7f40d8eb014e in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:860
    #1 0x7f40d8eb06e6 in __interceptor_memcmp /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:892
    #2 0x7f40d8eb06e6 in __interceptor_memcmp /build/gcc/src/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:887
    #3 0x7f40d8c2e830 in DtlsSrtpFindProfile src/ssl.c:1310
    #4 0x7f40d8c2e9ed in DtlsSrtpSelProfiles src/ssl.c:1347
    #5 0x7f40d8c2eada in wolfSSL_CTX_set_tlsext_use_srtp src/ssl.c:1359
    #6 0x563bf381b4c5 in server_test examples/server/server.c:2278
    #7 0x7f40d88f0258 in start_thread (/usr/lib/libpthread.so.0+0x9258)
    #8 0x7f40d88195e2 in __GI___clone (/usr/lib/libc.so.6+0xfe5e2)
```
2022-01-19 13:14:58 +01:00
David Garske
ba589955f7 Improve the DTLS SRTP client side parsing. 2022-01-18 11:23:13 -08:00
Sean Parkinson
e745de657f Merge pull request #4761 from haydenroche5/time_cb
Add time callback functionality.
2022-01-18 16:49:19 +10:00
Hayden Roche
1b0926a3b8 Add time callback functionality.
This commit adds `wolfSSL_SetTimeCb` and `wolfSSL_time`. The former allows the
user to override the function wolfSSL uses to get the current time,
`wolfSSL_time`. If set, `wolfSSL_time` uses that function. If not set,
`wolfSSL_time` uses the `XTIME` macro by default. This functionality is needed
for the port of chrony to wolfSSL. chrony is an NTP implementation that uses
GnuTLS by default. For TLS, chrony uses the time it computes in place of the
default system time function.
2022-01-17 17:49:51 -08:00
David Garske
f3f5b0f53b Peer review fixes. Improve profile not found handling or errors. Improve inline function. 2022-01-17 15:52:40 -08:00
Anthony Hu
c2860cb311 Get rid of HC-128 2022-01-17 18:11:54 -05:00
David Garske
d38c5003d0 Merge pull request #4762 from ejohnstown/old-gcc
Old Compiler Warning Cleanup (GCC 4.0.2)
2022-01-17 09:44:44 -08:00
John Safranek
b68b14b499 Merge pull request #4724 from embhorn/zd13462
Improve param checks of enc
2022-01-16 15:35:54 -08:00
Sean Parkinson
15f501358d Merge pull request #4716 from julek-wolfssl/issue-4592
Verification: Domain check should only be performed on leaf certs
2022-01-17 08:40:14 +10:00
John Safranek
001469589b Old Compiler Warning Cleanup (GCC 4.0.2)
Fixed a lot of shadowed global values. Some were prototype and function
declaration parameter name conflicts. Some conflicted with typenames.
Some conflicted with globals in libc.
2022-01-14 17:43:21 -08:00
John Safranek
153b9abc31 Old Compiler Warning Cleanup (GCC 4.0.2)
ssl.c: Fix a couple of checks on hashType enum that were using a `< 0`
for the lower bound on an unsigned.
2022-01-14 16:32:18 -08:00
David Garske
eade8ecdf1 DTLS SRTP improvements. Added support for client to send list of profiles. Added support for more SRTP profiles. 2022-01-14 13:43:29 -08:00
Kareem
1ed152daeb Fix building with OPENSSL_EXTRA and NO_BIO defined. 2022-01-14 11:19:01 -07:00
Juliusz Sosinowicz
31e84d82b8 Domain check should only be performed on leaf certs
- Refactor `*_set_verify` functions into common logic
- NULL protect `wolfSSL_X509_VERIFY_PARAM_set1_host` and add debug info
2022-01-14 18:16:42 +01:00
David Garske
6ccbd8776f DTLS SRTP (RFC5764) support (adds --enable-srtp). Used with WebRTC to agree on profile for new real-time session keys. 2022-01-14 07:35:45 -08:00
David Garske
f81e15f342 Merge pull request #4750 from SparkiDev/etm-disable
TLS EncryptThenMac; fix when extension response sent
2022-01-13 13:33:57 -08:00
Sean Parkinson
70b169e3f2 TLS EncryptThenMac; fix when extension response sent
Only respond with the extension when negotiated a block cipher.
2022-01-13 12:46:21 +10:00
elms
336e595ebb Remove some lingering oldname return values 2022-01-11 17:09:52 -08:00
elms
efe2cea8d1 TLS: Default secure renegotiation compatability
By default this change will have servers send the renegotiation info
extension, but not allow renegotiation. This is accordance with RFC 5746

From to RFC 5746:
> In order to enable clients to probe, even servers that do not support
> renegotiation MUST implement the minimal version of the extension
> described in this document for initial handshakes, thus signaling
> that they have been upgraded.

With openSSL 3.0 the default it not allow connections to servers
without secure renegotiation extension. See
https://github.com/openssl/openssl/pull/15127
2022-01-11 15:56:35 -08:00
David Garske
5910ada93d Merge pull request #4736 from douzzer/20220107-cppcheck-hygiene
cppcheck sweep
2022-01-10 12:52:22 -08:00
David Garske
6ce248e2f9 Improve documentation for wolfSSL_get1_session. Add wolfSSL specific naming on the internal session functions to avoid possible user conflicts. ZD13363 and ZD13487. 2022-01-10 07:47:19 -08:00
Daniel Pouzzner
355b5821b2 WOLFSSL_SESSION_EXPORT: fixes for scan-build complaints (deadcode.DeadStores) building --enable-all --enable-sessionexport. 2022-01-08 11:43:56 -06:00
Daniel Pouzzner
c50964cc35 src/internal.c: fix flubbed edit in wolfSSL_session_import_internal(). 2022-01-08 11:08:57 -06:00
Daniel Pouzzner
56c28ff307 src/ssl.c: in wolfSSL_SESSION_has_ticket(), add (void)sess if !defined(HAVE_SESSION_TICKET), to fix -Wunused-parameter. 2022-01-08 02:39:50 -06:00
Daniel Pouzzner
8ba6027073 src/wolfio.c: fixes for cppcheck complaints: nullPointer uninitvar 2022-01-08 00:28:35 -06:00
Daniel Pouzzner
bb727d2ef2 src/ssl.c: fixes for cppcheck complaints: uselessAssignmentPtrArg autoVariables[not a defect; added suppression] invalidPrintfArgType_sint nullPointerRedundantCheck pointerSize 2022-01-08 00:28:09 -06:00
Daniel Pouzzner
4d3dfc451d src/sniffer.c: fixes for cppcheck complaints: negativeIndex 2022-01-08 00:27:59 -06:00
Daniel Pouzzner
b69dc00bd7 src/internal.c: fixes for cppcheck complaints: nullPointerRedundantCheck uninitvar 2022-01-08 00:27:47 -06:00
Eric Blankenhorn
f74831a7da Improve param checks of enc 2022-01-06 09:12:18 -06:00
David Garske
32223b9c3a Merge pull request #4697 from LinuxJedi/isotp
Add ISO-TP support to wolfio
2022-01-05 10:34:43 -08:00
Andrew Hutchings
e847bf7301 ISO-TP buffer fixes
* Flow control failed on wrap around when there is going to be no more
  flow control packets.
* If ISOTP_Send is provided more than 4095 bytes, limit it to 4095 bytes
  as wolfSSL will retry with the rest.
* Set the default receive size to the max ISO-TP data size.
* A few other cleanups.
2022-01-05 11:37:15 +00:00
Andrew Hutchings
247cbdeef7 Cleanups for ISO-TP in wolfio
* Add Doxygen comments
* Make ISOTP_Send, ISOTP_Receive and wolfSSL_SetIO_ISOTP safer
* Reorder isotp_wolfssl_ctx
* Other minor cleanups
2022-01-04 12:57:11 +00:00
Marco Oliverio
4907696ed4 wolfssl: keys: add missing wc_AesFree() when setting new keys 2021-12-30 20:30:36 +01:00
Jacob Barthelmeh
73b4cc9476 fix for location of xmemset 2021-12-29 10:48:06 -07:00
Jacob Barthelmeh
05a19c852b account for DTLS extra header size when reading msg from pool 2021-12-27 16:52:09 -07:00
Andrew Hutchings
7c2a2229c5 Use XMEMCPY and defined constannts for ISOTP 2021-12-24 11:56:16 +00:00
Daniel Pouzzner
54e9076c45 src/ssl.c: fix whitespace and heap reference in FreeSession() (re 569c066fab). 2021-12-24 01:16:32 -06:00
David Garske
02186dbd23 Fix for TLS v1.3 client session ticket resumption where the server opts to do a new handshake. Fix to make sure preMasterSz is valid. 2021-12-23 18:45:52 -08:00
David Garske
a92fb0eb42 Fix for session resumption to ensure use of the right cipher suite. ZD13297 2021-12-23 18:42:41 -08:00
Sean Parkinson
f1f15f411f Merge pull request #4688 from embhorn/gh4684
Fix missing include ws2tcpip.h for VS build
2021-12-24 11:58:12 +10:00