Commit Graph

8761 Commits

Author SHA1 Message Date
Sean Parkinson
0224ef3d2e Merge pull request #9146 from rlm2002/gh9128_MEM_ZERO
ForceZero change for WOLFSSL_CHECK_MEM_ZERO
2025-08-28 22:37:55 +10:00
Ruby Martin
1ad8b2897a Force zero with bufferSize instead of length. add void prototype to definitions 2025-08-27 14:56:51 -06:00
effbiae
934364b8e1 wolfSSL_read_ex returns {0,1} 2025-08-27 15:35:17 +10:00
David Garske
71581e321e Merge pull request #9098 from julek-wolfssl/fix-test_wolfSSL_tls_export
Fix test_wolfSSL_tls_export
2025-08-26 12:11:49 -07:00
David Garske
c7d1673948 Merge pull request #9132 from anhu/dup_CKS
Properly detect duplicate CKS extensions.
2025-08-26 09:07:04 -07:00
Juliusz Sosinowicz
5934c1eece Fix test_wolfSSL_tls_export
- Add TLS_EXPORT_OPT_SZ_4 to specify previous option size
- Actually pick up failures in the tests and propagate them to the top level
- Tests v4 and v5 sessions
Fixes https://github.com/wolfSSL/wolfssl/issues/9081 and https://github.com/wolfSSL/wolfssl/pull/9082
2025-08-26 11:04:54 +02:00
lealem47
1c2fb10007 Merge pull request #9124 from dgarske/sniffer_partial_overlap
Fix for sniffer partial segment overlap that can occur when a TCP win…
2025-08-25 15:15:48 -06:00
Anthony Hu
2885df68b4 Properly detect duplicate CKS extensions. 2025-08-25 12:01:50 -04:00
Daniel Pouzzner
e0383b496a linuxkm/module_hooks.c: implement wc_linuxkm_GenerateSeed_IntelRD, gated on WC_LINUXKM_RDSEED_IN_GLUE_LAYER;
add WC_GENERATE_SEED_DEFAULT, which defaults to wc_GenerateSeed if not overridden, and replace wc_GenerateSeed with WC_GENERATE_SEED_DEFAULT in various calls to wc_SetSeed_Cb();

linuxkm/linuxkm_wc_port.h: if FIPS <v6 and RDSEED, define WC_LINUXKM_RDSEED_IN_GLUE_LAYER and define WC_GENERATE_SEED_DEFAULT wc_linuxkm_GenerateSeed_IntelRD;

wolfcrypt/test/test.c: update rng_seed_test() with gating and vectors for FIPS v5 with HAVE_AMD_RDSEED or HAVE_INTEL_RDSEED;

wolfssl/wolfcrypt/types.h: add WC_HAVE_VECTOR_SPEEDUPS helper macro, and enlarge fallthrough definition coverage for DISABLE_VECTOR_REGISTERS.
2025-08-22 21:58:00 -05:00
David Garske
8dd43077fd Fix for sniffer partial segment overlap that can occur when a TCP window is full and a TCP retransmission occurs. 2025-08-22 14:29:18 -07:00
JacobBarthelmeh
bc5b297d33 Merge pull request #9046 from kareem-wolfssl/zd20038
Allow setting the CA type when loading into cert manager and unloading specific CA types from the cert manager.
2025-08-22 14:43:46 -06:00
David Garske
1f579afc66 Merge pull request #9117 from SparkiDev/tls13_ks_fix
TLS 1.3 KeyShare: error on duplicate group
2025-08-22 12:54:54 -07:00
Sean Parkinson
b1cdf0b214 TLS 1.3 KeyShare: error on duplicate group
Don't allow a KeyShare extension from the client to have more
than one entry for any group.
2025-08-21 08:23:31 +10:00
David Garske
79fe6e467b Merge pull request #9112 from SparkiDev/tls13_onlyDhePskKe_fix
TLS 1.3: Fix for onlyDhePskKe
2025-08-20 06:44:08 -07:00
Sean Parkinson
2810656242 TLS 1.3: CertificateVerify - check sig alg was sent
Check that the signature algorithm used in the CertificateVerify message
was one that was sent in the SignatureAlgorithm extension.
2025-08-19 16:27:19 +10:00
Sean Parkinson
cd55fe6135 TLS 1.3: Fix for onlyDhePskKe
Make client enforce onlyDhPskKe flag.
2025-08-19 14:29:30 +10:00
David Garske
f114f2cde2 Merge pull request #9093 from kareem-wolfssl/zd20372
Multiple fixes to wolfSSL_CIPHER_description to match documentation.
2025-08-18 13:43:53 -07:00
David Garske
32b0bd963b Fix issue introduced in PR #9051 causing TLS records with multiple handshake messages to be skipped (ZD 20399) 2025-08-15 10:08:28 -07:00
Sean Parkinson
5b1302e4df Merge pull request #9094 from dgarske/zd20369
Fix to better detect sniffer invalid spurious re-transmissions
2025-08-15 09:01:02 +10:00
Sean Parkinson
228ede7495 Merge pull request #9102 from rlm2002/zd20212
Remove dead code and check return values.
2025-08-15 08:21:38 +10:00
David Garske
e00fd2fd70 Fix to better detect invalid spurious retransmission. 2025-08-14 12:19:39 -07:00
Kareem
cb3f7de3f7 Fix issues found by CI/CD tests. 2025-08-14 11:34:15 -07:00
Kareem
3bcbbd2924 Fix issue with loading PEM certs. Address code review feedback.
Add tests.
2025-08-14 11:34:15 -07:00
Kareem
a652b733e4 Fix conversion warning. 2025-08-14 11:34:15 -07:00
Kareem
ab342978d7 Fix implicit conversion warning. 2025-08-14 11:34:14 -07:00
Kareem
61ccea55ac Allow setting the CA type when loading into cert manager
and unloading specific CA types from the cert manager.
2025-08-14 11:34:14 -07:00
Kareem
cb623dc9ea Multiple fixes to wolfSSL_CIPHER_description to match documentation.
Add "any" value for TLS 1.3 cipher suites.
Fix key size comparison for enc bits.
Output AEAD as MAC if cipher suite is using it, otherwise output hash MAC.
2025-08-14 11:27:10 -07:00
Ruby Martin
71c2878780 verify previously unchecked return values 2025-08-13 16:28:36 -06:00
Ruby Martin
31bf1b90b4 update wolfSSL_get_SessionTicket to be able to return ticket length 2025-08-13 08:29:30 -06:00
David Garske
3289b6b3da Merge pull request #9089 from douzzer/20250811-linuxkm-and-other-fixes
20250811-linuxkm-and-other-fixes
2025-08-12 11:40:36 -07:00
Daniel Pouzzner
e24f76bb1e Merge pull request #9057 from SparkiDev/mldsa_x64_asm
ML-DSA/Dilithium: Intel x64 ASM
2025-08-11 23:12:44 -05:00
Daniel Pouzzner
2d1c797b64 fixes from cppcheck-force-source: in src/bio.c:wolfSSL_BIO_vprintf() and
wolfcrypt/src/logging.c:WOLFSSL_MSG_CERT_EX(), add missing gating on
  defined(XVSNPRINTF);

in src/crl.c:CRL_Entry_new(), fix true-positive nullPointerRedundantCheck;

in src/pk.c:_DH_compute_key(), add bounds checking to ForceZero(priv).
2025-08-11 18:12:44 -05:00
Daniel Pouzzner
7b077737a9 src/crl.c: fix nullPointerRedundantCheck in CRL_Entry_free(). 2025-08-11 16:14:32 -05:00
Daniel Pouzzner
29dd6cce98 wolfssl/wolfcrypt/logging.h: add WOLFSSL_MSG_CERT_LOG_EX, give
WOLFSSL_DEBUG_CERTS definitions priority when defining WOLFSSL_MSG_CERT_LOG()
  and WOLFSSL_MSG_CERT_LOG_EX, update documentation in preamble, and fix the
  WOLFSSL_ANDROID_DEBUG definition of WOLFSSL_DEBUG_PRINTF_FIRST_ARGS and the
  WOLFSSL_ESPIDF definition of WOLFSSL_DEBUG_PRINTF();

src/ssl_load.c: use WOLFSSL_MSG_CERT_LOG_EX(), not WOLFSSL_DEBUG_PRINTF(), in
  ProcessFile().
2025-08-11 16:14:32 -05:00
Albert Ribes
e36daf41a4 Store in extensions the full octet string (#8967)
* Store in extensions the full octet string

Store in WOLFSSL_X509_EXTENSION.value always the full contents of the
OCTET STRING of the extension, instead of different type of data
depending on the type of extension. Previously this was only done for
unknown extensions.

* Avoid local variables in 'DecodeExtKeyUsageInternal'

There is a great performance loss on configs using 'WOLFSSL_NO_MALLOC',
'WOLFSSL_STATIC_MEMORY' and 'USE_FAST_MATH' if function
'DecodeExtKeyUsageInternal' uses intermediate variables. This can be
observed running the Zephyr test 'wolfssl_test/prj-no-malloc.conf'.

Avoid using intermediate variables, and use raw pointers to the final
destination instead.

* Add missing calls to 'FreeDecodedCert'

* Return error code from 'wolfSSL_ASN1_STRING_into_old_ext_fmt'

* Fix lines larger than 80

* Allow NULL parameters for 'DecodeAuthKeyId'

* Add comment explaining build option '--enable-old-extdata-fmt'

* Test full OCTET STRING in tests/api.c

* wolfSSL_X509V3_EXT_d2i: Honor 'WOLFSSL_SMALL_STACK'

* zephyr/wolfssl_test_no_malloc: Increase test timeout

* wolfSSL_X509V3_EXT_d2i: Extract repeated code into common part

* wolfcrypt: Remove 'WOLFSSL_LOCAL' from .c files

* wolfcrypt: Change location of functions to make diff easier
2025-08-11 10:33:15 -07:00
Daniel Pouzzner
260fca600a Merge pull request #8902 from gojimmypi/pr-cert-logging
Introduce WOLFSSL_DEBUG_CERTS Certificate Debug Messages
2025-08-08 23:44:03 -05:00
Daniel Pouzzner
9236b81ade Merge pull request #9078 from rlm2002/cppCheck
Changes for cppcheck=force-source errors and warnings
2025-08-08 23:29:30 -05:00
Ruby Martin
6070ca8499 remove nested check for ssl->options.dtls
move cidSz declaration
2025-08-08 10:46:35 -06:00
Ruby Martin
e631f2e56e add ret check before assigning row value 2025-08-08 10:40:09 -06:00
Ruby Martin
9e3f726b0e add null checks for function arguments that return BAD_FUNC_ARG
update function comment
2025-08-08 10:40:09 -06:00
Ruby Martin
f5a4b13391 initialize lpMsgBuf 2025-08-08 10:40:09 -06:00
Ruby Martin
35ea769c9f add null check to CRL_Entry_free() 2025-08-08 10:40:09 -06:00
Josh Holtrop
e6eac9b920 Fix inconsistent function prototype parameter names for wolfssl 2025-08-07 09:28:50 -04:00
Sean Parkinson
648a057147 ML-DSA/Dilithium: Intel x64 ASM
Optimize code knowing it is for Intel x64.
Change signing to calculate one polynomial at a time so that if it isn't
valid then we fail early.
Other minor improvements.
Move the SHA-3 4 blocks at a time assembly into SHA-3 asm file.
Make constants in assembly the same length (front pad with zeros).
2025-08-07 14:01:50 +10:00
gojimmypi
d64ef34ef8 Introduce WOLFSSL_DEBUG_CERTS Certificate Debug Messages 2025-08-06 13:57:53 -07:00
Kareem
36e0e3aa53 Fix wolfSSL_i2d_PublicKey not returning SPKI format for ECC keys. 2025-08-05 17:20:47 -07:00
Ruby Martin
598a3e6232 check return value of wc_DhGetNamedKeyParamSize 2025-08-01 14:56:35 -06:00
JacobBarthelmeh
0392ee009f Merge pull request #9033 from anhu/mlkem-hybrid-draft-names-wolfssl
Rename ML-KEM hybrids to match IETF Draft.
2025-08-01 10:21:54 -06:00
JacobBarthelmeh
65e7f2c40f Merge pull request #9051 from lealem47/zd20288
Sniffer: Fix infinite recursion caused by an OOO appData packet
2025-07-31 14:50:36 -06:00
Lealem Amedie
0e8aab241d Sniffer: Fix infinte recursion caused by an OOO appData packet 2025-07-31 09:31:59 -06:00