980fc51ea7
Merge pull request #10275 from twcook86/make_rpm_fix
...
Fix a few issues with "make rpm"
2026-05-06 13:06:42 -07:00
490c1062e4
Merge pull request #10274 from gasbytes/crl-idp-extension-fix-follow-up
...
Reject CRLs with unrecognized critical entry extensions per RFC 5280 section 5.3
2026-05-06 12:13:28 -07:00
545376c477
Merge pull request #10279 from julek-wolfssl/zd/21661
...
zd/21661: harden X.509 chain validation, session ticket identity binding, and peer cert restore
2026-05-06 11:59:55 -07:00
27413e0a3f
Merge pull request #10403 from Frauschi/hostap_interal_retry
...
hostap CI tests: incorporate internal retries
2026-05-06 11:59:49 -07:00
c38e6cac36
Merge pull request #10414 from night1rider/zephyr/4.x-workflow-fixes
...
Zephyr 4.x workflow: stabilize CI for renamed forks and slashed branch names
2026-05-06 11:58:19 -07:00
dc3ba1e299
stabilize CI for renamed forks and slashed branch names
2026-05-06 10:04:33 -06:00
061311d6ca
zd/21661: harden X.509 chain validation, session ticket identity binding, and peer cert restore
...
- x509_str: require CA:TRUE unconditionally in wolfSSL_X509_verify_cert;
verify leaf signature even when verify_cb overrides INVALID_CA
- x509_str: align WOLFSSL_X509_V_ERR_INVALID_CA with OpenSSL value (79)
so OPENSSL_COEXIST builds compile; bump WC_OSSL_V509_V_ERR_MAX to 80
and extend error_test() missing-value table for the new gaps
- asn: reject embedded NUL in dNSName / rfc822Name / URI SAN entries
- internal: re-verify restored ticket peer cert against trust store with
CRL/OCSP checks; clear stale state from session cache on verification
failure
- ticket: bind SNI and ALPN into session ticket via compile-time selected
hash (TICKET_BINDING_HASH_TYPE); reject resumption on mismatch in both
TLS 1.3 and TLS 1.2 paths
- ticket: defer SNI/ALPN binding check until after extensions are parsed
by consolidating into VerifyTicketBinding(), called once after
ALPN_Select in DoTls13ClientHello and DoClientHello; the early
per-call sites ran before extensions were parsed and rejected valid
resumptions in nginx, haproxy, grpc, and CPython integration tests
- ssl_sess: free previous session in wolfSSL_d2i_SSL_SESSION before
overwrite
- examples/client: increase SESSION_TICKET_LEN fallback from 256 to 2048
to support larger tickets
- tests: update SAN NUL fixtures and add parse-time rejection coverage;
add test_tls13_ticket_peer_cert_reverify for CA-removal scenario; skip
it under WOLFSSL_NO_DEF_TICKET_ENC_CB
2026-05-06 16:45:58 +02:00
50da0c0a26
Merge pull request #10390 from Frauschi/lms_Wconversion
...
LMS Wconversion fixes
2026-05-06 09:16:23 -05:00
29343708df
Merge pull request #10391 from Frauschi/xmss_Wconversion
...
XMSS Wconversion fixes
2026-05-06 09:15:59 -05:00
01f500b938
Merge pull request #10399 from Frauschi/mldsa_Wconversion
...
ML-DSA Wconversion fixes
2026-05-06 09:15:53 -05:00
2833a4b1e8
ML-DSA Wconversion fixes
2026-05-06 15:33:17 +02:00
40b583fbcb
Wconversion fixes for LMS
2026-05-06 15:31:00 +02:00
fe353af409
XMSS Wconversion fixes
2026-05-06 15:29:08 +02:00
57f4b231c4
hostap CI tests: incorporate internal retries
2026-05-06 10:36:19 +02:00
6a3eb6f0a8
Merge pull request #10360 from gasbytes/cipher-init-dtls13-fix
...
dtls13: free and null the cipher slot on init failure in Dtls13InitAesCipher and ChaCha equivalent
2026-05-05 13:08:06 -07:00
13f459127c
Merge pull request #10372 from MarkAtwood/fix/ed448-der-const
...
fix: add const to wc_Ed448 DER export function key parameters
2026-05-05 12:49:30 -07:00
44564dd5fd
Merge pull request #10368 from holtrop-wolfssl/gh10359
...
Allow SubjectInfoAccess extension without id-ad-caRepository entry
2026-05-05 12:49:19 -07:00
e3a195d394
Merge pull request #10075 from josepho0918/mqx
...
Improve compatibility for XINET_PTON
2026-05-05 12:47:45 -07:00
e3285850f9
Merge pull request #10289 from julek-wolfssl/zd/21652
...
TLS 1.3: gate 0-RTT on a cache-backed resumption ticket
2026-05-05 12:46:26 -07:00
5f1e0d0f0d
Merge pull request #10314 from night1rider/zephyr-4.x-workflows
...
workflow tests for zephyr 4.3 and 4.1
2026-05-05 12:46:00 -07:00
c73f431687
Merge pull request #10392 from JeremiahM37/fenrir-5
...
wolfCrypt input validation and side-channel hardening
2026-05-05 12:24:17 -07:00
c1b2660a08
Merge pull request #10396 from douzzer/20260501-fips-v7-fixes
...
20260501-fips-v7-fixes -- reviewed+approved by @Frauschi
2026-05-05 14:20:49 -05:00
b47f71678d
Merge pull request #10363 from MarkAtwood/fix/curve25519-clamp-check-rule3
...
fix: curve25519 clamp check missing rule 3 (bit 6 of byte 31) (ZD-21731)
2026-05-05 12:16:06 -07:00
3147a10f23
Merge pull request #10141 from sebastian-carpenter/tls-ech-downgrade
...
TLS ECH Compliance Fixes
2026-05-05 12:14:20 -07:00
00abce3474
Merge pull request #10310 from cconlon/d2iMLDSA
...
Add ML-DSA SPKI/PKCS#8 DER support to d2i_PUBKEY and d2i_PrivateKey
2026-05-05 12:11:49 -07:00
ba5132831f
Merge pull request #10389 from Frauschi/hostap
...
Increase hostap retry count
2026-05-05 12:08:16 -07:00
7de26312e6
Merge pull request #10378 from rlm2002/fenrir
...
Various PKCS12 Fixes
2026-05-05 12:07:17 -07:00
e38a120043
Merge pull request #10387 from Frauschi/fix-windows-tcp-bind-flaky
...
Fix flaky tcp bind on Windows test runs
2026-05-05 12:06:44 -07:00
63bda771fe
Merge pull request #10305 from holtrop-wolfssl/rust-crate-updates
...
Rust wrapper: add password-hash, kem, mac traits; fix a few Fenrir findings
2026-05-05 12:05:29 -07:00
3a1f51d2e6
Merge pull request #10388 from Frauschi/slh-dsa_Wconversion
...
SLH-DSA Wconversion fixes
2026-05-05 12:04:22 -07:00
da038c6d51
Merge pull request #10299 from Frauschi/pqc_key_share_fix
...
Fix PQC key exchange with multiple KEM key shares
2026-05-05 12:03:32 -07:00
15b10454bc
Merge pull request #10340 from JeremiahM37/fenrir-3
...
harden falcon key handling
2026-05-05 11:57:41 -07:00
c3cd71ea02
Merge pull request #9965 from kojo1/mldsa
...
Add ML-DSA to X509_get_pubkey and EVP_PKEY_base_id
2026-05-05 11:57:06 -07:00
519c08ae32
Merge pull request #10121 from JacobBarthelmeh/bench
...
use heap hints where possible in benchmark
2026-05-05 11:56:04 -07:00
309ada27a7
Merge pull request #10370 from cconlon/setAKID
...
Fix malformed AKID extension from wolfSSL_X509_set_authority_key_id()
2026-05-05 11:55:38 -07:00
d4d1f03fef
Merge pull request #10333 from JacobBarthelmeh/oss-fuzz
...
change call to GetSigAlg in ASN original to sanity check length
2026-05-05 11:55:21 -07:00
87536214bf
Merge pull request #10375 from LinuxJedi/STSAFEA120Sim
...
Add STSAFE A120 CI support
2026-05-05 11:53:29 -07:00
5074cf3726
Merge pull request #10366 from embhorn/zd21744
...
Fix CUDA with WOLFSSL_AES_SMALL_TABLES
2026-05-05 11:51:01 -07:00
a7379fa811
Merge pull request #10355 from miyazakh/rx72n_fix_usersettings
...
[Renesas RX72N] Fix SP_MATH and SP_MATH_ALL conflict in user_settings.h
2026-05-05 11:48:32 -07:00
5266329c9a
Merge pull request #10352 from embhorn/zd21724
...
Fix static / mem tracker build error
2026-05-05 11:48:16 -07:00
644f6171ab
Merge pull request #10290 from LinuxJedi/emnet
...
Fix emNET support and add tests
2026-05-05 11:46:15 -07:00
9b1167772d
Merge pull request #10350 from LinuxJedi/ATECC608Sim
...
Add ATECC608 CI tests
2026-05-05 11:45:45 -07:00
8e46221428
Merge pull request #10336 from julek-wolfssl/wolfSSL_PEM_read_bio_X509_CRL-multi-crl-fix
...
src/x509.c: refactor wolfSSL_PEM_read_bio_X509_CRL onto the per-block reader
2026-05-05 11:42:00 -07:00
3b7ac9fd25
Merge pull request #10327 from embhorn/zd21704
...
Hardening in TLSX_KeyShare_ProcessPqcHybridClient
2026-05-05 11:41:43 -07:00
678ddd6c73
Merge pull request #10339 from embhorn/zd21707
...
Fix handling of otherName in ConfirmNameConstraints
2026-05-05 11:41:28 -07:00
b0fca9df10
Merge pull request #10276 from padelsbach/asn1-time-chars-check
...
Add checks for ascii digits in time decode functions
2026-05-05 11:38:47 -07:00
bc15131f60
Merge pull request #10338 from gasbytes/cert-ext-offered-list-fix
...
reject extensions in a TLS 1.3 Certificate message that were not offered in the prior ClientHello/CertificateRequest
2026-05-05 11:38:25 -07:00
403f0fe637
Merge pull request #10230 from julek-wolfssl/fenrir/20260415
...
Fenrir fixes
2026-05-05 11:34:43 -07:00
aaca0948e8
Merge pull request #10335 from julek-wolfssl/pkcs11-hmac-session
...
wolfcrypt/src/wc_pkcs11.c: cache PKCS#11 session across multi-call HMAC
2026-05-05 11:33:10 -07:00
04984a5d5e
Merge pull request #10346 from Frauschi/ecc_leak_fix
...
Prevent ECC tmp key leak and UB
2026-05-05 11:32:48 -07:00
David Garske
night1rider
Juliusz Sosinowicz
Daniel Pouzzner
Tobias Frauenschläger