Commit Graph

7952 Commits

Author SHA1 Message Date
Sean Parkinson
caab2c2dca SSL loading of keys/certs: testing and fixes
Added tests to cover ssl_load.c functions.
Fixes from testing.
pk.c: renamed wolfssl_dh_load_key to wolfssl_dh_load_params as it
doesn't handle keys - just parameters.
2024-07-26 11:43:10 +10:00
Sean Parkinson
a34ea32f52 Merge pull request #7730 from anhu/unknownExtCallbackEx
Extend the unknown extension callback.
2024-07-24 08:37:44 +10:00
David Garske
7c6eb7c4a1 Merge pull request #7751 from SparkiDev/ecc_koblitz_ssl
ECC key load: fixes
2024-07-22 16:40:59 -07:00
David Garske
575df43889 Merge pull request #7768 from JacobBarthelmeh/copyright
update copyright to 2024
2024-07-19 14:27:39 -07:00
Daniel Pouzzner
787397b28e src/bio.c and related:
* refactor WOLFSSL_BIO.num and WOLFSSL_BIO.ptr as unions, for clarity and bug resistance (no functional changes).

* in wolfSSL_BIO_free(), add WOLFSSL_BIO_DGRAM to the test for closing bio->num.fd, fixing a descriptor leak.

* use SOCKET_INVALID consistently as the invalid value for WOLFSSL_BIO.num.fd, and use SOCKET_T consistently as the internal type for file descriptors.

* move the definitions for SOCKET_T and SOCKET_INVALID from wolfio.h to the filesystem section of wc_port.h, and allow override definitions of SOCKET_T.

detected and tested with wolfssl-multi-test.sh ... pq-hybrid-all-rpk-valgrind-unittest. also tested with wolfssl-multi-test.sh ... super-quick-check.
2024-07-19 14:50:26 -05:00
JacobBarthelmeh
31a6a2bf59 update copyright to 2024 2024-07-19 13:15:05 -06:00
David Garske
0eeae4da8c Merge pull request #6460 from embhorn/mosquitto_osp
Add support for Mosquitto OSP
2024-07-19 07:49:32 -07:00
David Garske
bd5586623a Merge pull request #7703 from SparkiDev/def_ticket_cbc_hmac
Default session ticket enc/dec: allow AES-CBC with HMAC
2024-07-19 07:41:27 -07:00
David Garske
08b211c3bb Merge pull request #7761 from kareem-wolfssl/zd18300
Fix not calling the signing callback when using PK callbacks + TLS 1.3.
2024-07-19 07:37:37 -07:00
David Garske
b5e188830d Merge pull request #7755 from philljj/misc_cleanup
Misc cleanup: FreeX509 null pointer checks, and spelling cleanup.
2024-07-19 07:37:24 -07:00
Daniel Pouzzner
4bc04673d1 suppress 4 uninitvar warnings, all associated with passing partially written arrays (true but benign positives). newly detected by cppcheck 2.14.2. 2024-07-18 17:22:17 -05:00
Kareem
3492caba51 Fix not calling the signing callback when using PK callbacks + TLS 1.3. 2024-07-18 10:33:19 -07:00
Daniel Pouzzner
c36ab59f24 fixes for defects identified by nightly testing:
* ecc.c: in wc_ecc_free(), fix gating around handling for key->sign_k to resolve memory leak, and in wc_ecc_gen_deterministic_k(), fix -Wconversion.

* test.c: add missing mp_free()s to ecdsa_test_deterministic_k_rs() and ecc521_test_deterministic_k().

* wc_HashType: change several occurrences of int to enum wc_HashType, including ecc_key.hashType and API wc_ecc_set_deterministic_ex(), to resolve C++ warnings.

* fixes for various C++ warnings/errors in crypto and TLS layers and test and benchmark code -- implicit casts, negative initializers for unsigned type, jumped initializers, and missing enums in switch()es.
2024-07-17 18:07:08 -05:00
jordan
6a745518bc Misc cleanup: FreeX509 null pointer checks, and spelling cleanup. 2024-07-17 10:04:52 -05:00
Daniel Pouzzner
ee7748f2e3 PR7648 20240418-exosip-apis peer review:
* tweak typography;
* move wolfSSL_i2d_X509_PUBKEY() from ssl.c to x509.c;
* in asn.h, add !NO_ASN_OLD_TYPE_NAMES macros to remap old names (ISSUER, SUBJECT, BEFORE, AFTER) by default unless the macros are already defined.
2024-07-16 19:12:19 -05:00
Daniel Pouzzner
9023aeef75 BIO/wolfio: refactor TranslateReturnCode(), wolfSSL_LastError(), and TranslateIoError() into complete+consistent wolfSSL_LastError() and TranslateIoReturnCode(), handling all special cases correctly, and correctly returning WOLFSSL_CBIO_ERR_WANT_WRITE and WOLFSSL_CBIO_ERR_TIMEOUT. use TranslateIoReturnCode() directly in wolfIO_Recv(), wolfIO_Send(), wolfIO_RecvFrom(), wolfIO_SendTo(), and remove now-superfluous TranslateIoError() calls from EmbedReceive(), EmbedSend(), EmbedReceiveFrom(), EmbedSendTo(), EmbedReceiveFromMcast(). 2024-07-16 19:12:19 -05:00
Daniel Pouzzner
5298039d09 fixes from peer review: move OS-specific code from wolfSSL_BIO_read() and wolfSSL_BIO_write() to wolfIO_Recv(), wolfIO_Send(), wolfIO_RecvFrom(), and wolfIO_SendTo(); add SOCKET_ETIMEDOUT definitions to wolfio.h; misc cleanups. 2024-07-16 19:12:19 -05:00
Daniel Pouzzner
0c1163f01f src/bio.c: restore inadvertently removed update of bio->connected in wolfSSL_BIO_ctrl() case BIO_CTRL_DGRAM_SET_CONNECTED. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
1159fc333f src/bio.c: in wolfSSL_BIO_ADDR_size(), add missing gate on HAVE_SYS_UN_H for AF_UNIX. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
51c49b678e src/bio.c: fix gating for WOLFSSL_BIO_DGRAM handling. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
0a928ead3f address peer review around WOLFSSL_HAVE_BIO_ADDR:
refactor housekeeping for bio->bytes_read and bio->bytes_write, and add WOLFSSL_BIO_HAVE_FLOW_STATS gate;

add WOLFSSL_BIO_FLAG_RETRY housekeeping for WOLFSSL_BIO_SOCKET and WOLFSSL_BIO_DGRAM;

refactor WOLFSSL_BIO.peer_addr to be inline rather than a pointer;

add wolfSSL_set_mtu_compat() and wolfSSL_CTX_load_verify_locations_compat() implementations;

enable WOLFSSL_HAVE_BIO_ADDR and WOLFSSL_DTLS_MTU when OPENSSL_ALL.
2024-07-16 19:12:18 -05:00
Daniel Pouzzner
61eb6987d0 src/ssl.c: remove old version of wolfSSL_set_bio(). 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
62db3533ae wolfSSL_CTX_load_verify_locations(): set up with OpenSSL-compatible behavior (WOLFSSL_LOAD_FLAG_IGNORE_ERR). 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
2d370f3e4e wolfSSL_BIO_read(): return MEMORY_E if wolfSSL_BIO_ADDR_new() fails. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
7216a543dd checkpoint: complete test_wolfSSL_BIO_datagram(); fix some WOLFSSL_HAVE_BIO_ADDR gates to also gate on WOLFSSL_DTLS and OPENSSL_EXTRA; use DTLS_RECVFROM_FUNCTION, DTLS_SENDTO_FUNCTION, SOCKET_T, SOCKADDR, SOCKADDR_IN, and SOCKADDR_IN6 macros and types, and add SOCKADDR_UN type. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
bd7f7c8bdf checkpoint: add wolfSSL_BIO_ADDR_free to wolfSSL_BIO_free(); tweak EXPECT_SUCCESS() to tolerate TEST_SKIPPED; add WIP test_wolfSSL_BIO_datagram. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
29ec038aa6 checkpoint: add WOLFSSL_BIO_ADDR, wolfSSL_BIO_ADDR_new(), wolfSSL_BIO_ADDR_free(), wolfSSL_BIO_ADDR_clear(), wolfIO_SendTo(), wolfIO_RecvFrom(); fix name of wolfSSL_BIO_s_datagram(). 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
08940866c3 checkpoint progress: add macro definitions for BIO_CTRL_DGRAM_SET_CONNECTED, BIO_CTRL_DGRAM_SET_PEER, WOLFSSL_MULTI_LABEL_WILDCARDS, WOLFSSL_MULTI_LABEL_WILDCARDS, NID_id_GostR3410_2001, NID_id_GostR3410_2012_256, NID_id_GostR3410_2012_512; fix flag arithmetic in wolfSSL_X509_check_host(); add compat macros for i2d_X509_PUBKEY, BIO_new_dgram. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
3f921e0a32 checkpoint progress: add wolfSSL_BIO_s_dgram, wolfSSL_BIO_new_dgram, WOLFSSL_BIO_DGRAM, and remove now-duplicate prototype and definition of wolfSSL_X509_STORE_get0_param. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
8468a70b72 add wolfSSL_i2d_X509_PUBKEY, wolfSSL_X509_VERIFY_PARAM_lookup, and wolfSSL_X509_STORE_get0_param, and make wolfSSL_X509_VERIFY_PARAM_inherit a public API; add macros to openssl compat layer: DTLS_client_method, DTLS_server_method, X509_VERIFY_PARAM_lookup, X509_VERIFY_PARAM_inherit, X509_STORE_get0_param; add "const char *name" slot to struct WOLFSSL_X509_VERIFY_PARAM to support wolfSSL_X509_VERIFY_PARAM_lookup. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
1e7810153f add wolfSSL_set_rbio, wolfSSL_set_wbio, wolfSSL_BIO_number_read, wolfSSL_BIO_number_written, and compat layer shim macros SSL_set0_rbio, SSL_set0_wbio, BIO_number_read, BIO_number_written, BIO_reset. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
41efa0492c add ASN_ prefixes to ISSUER, SUBJECT, BEFORE, and AFTER enum constants defined in wolfssl/wolfcrypt/asn.h. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
198f4030e8 add stub implementations of wolfSSL_COMP_get_name(), wolfSSL_get_current_compression(), and wolfSSL_get_current_expansion(), and add compat layer shim macros for them. 2024-07-16 19:12:18 -05:00
Daniel Pouzzner
685bfd1f9d add wolfSSL_get0_peername() and SSL_set_mtu(). 2024-07-16 19:12:18 -05:00
Eric Blankenhorn
7aad09fc87 Rebase for mosquitto 2024-07-16 07:37:33 -05:00
Sean Parkinson
f2f3a8273d Merge pull request #7732 from kaleb-himes/NUCLEUS-FIPS-SRTP-KDF
Check-in Nucleus Plus 2.3 port work
2024-07-16 09:37:15 +10:00
Sean Parkinson
dc86dad26b ECC key load: fixes
asn.c:
  Return the curve OID sum with alg_id for ECC keys.
ssl_load.c:
Don't permanently strip the PKCS#8 information as it contains the
curve OID.
2024-07-15 15:46:05 +10:00
JacobBarthelmeh
baec0ced59 Merge pull request #7731 from ColtonWilley/zephyr_tls_support
Changes needed for default TLS support in zephyr kernel
2024-07-11 16:46:43 -06:00
Colton Willey
978456e39d Remove get cipher bytes from header 2024-07-11 14:51:38 -07:00
Colton Willey
7b089f548e Remove get cipher list bytes 2024-07-11 14:39:44 -07:00
Sean Parkinson
3cc7bbea67 Merge pull request #7737 from JacobBarthelmeh/staticmemory-singlethreaded
fix for staticmemory and singlethreaded build
2024-07-11 09:57:08 +10:00
Anthony Hu
e581930cb7 Extend the unknown extension callback.
This will allow the user to pass in a context pointer. Allows them to avoid
global variables.

We also add unknown extensions callback when processing a CA in cert manager
as CA certs can have unknown extensions as well.

Fixes ZD 18252
2024-07-10 13:22:19 -04:00
JacobBarthelmeh
6703a58c51 fix for staticmemory and singlethreaded build 2024-07-10 09:44:10 -06:00
Sean Parkinson
fea7a89b86 Coverity fixes
pk.c:
	EncryptDerKey - setting wrong ret value on allocation failure.
	wolfssl_rsa_generate_key_native - now checks e is a valid long
before passing in.
	Fix formatting.

ssl_load.c:
	ProcessBufferPrivPkcs8Dec - now checking password is not NULL
before zeroizing. Allocation may fail and ForceZero doesn't check for
NULL.
	Fix formatting.

tests/api.c:
	test_RsaSigFailure_cm - Check cert_sz is greater than zero
before use.
	send_new_session_ticket - assert that building the message
doesn't return error or 0.
	test_ticket_nonce_malloc - fix setting of medium and big to use
preprocessor. Fix big to be medium + 20.

asn.c:
	GetLength_ex - Fix type of bytes so that it can go negative.

sp_int.h:
	sp_clamp - add one to ii while it is a signed.
	Fix formatting.
2024-07-10 11:40:48 +10:00
kaleb-himes
c333fdf545 Check-in Nucleus Plus 2.3 port work 2024-07-09 15:53:00 -06:00
Colton Willey
4ec07bb5a8 Changes needed for default TLS support in zephyr kernel 2024-07-09 12:00:34 -07:00
Daniel Pouzzner
780fd98f40 src/internal.c: in ProcessPeerCerts(), smallstack refactor of a span gated on HAVE_CERTIFICATE_STATUS_REQUEST_V2, to get DecodedCert off the stack. 2024-07-06 10:04:06 -05:00
Daniel Pouzzner
88af1a2932 fixes for Coverity #394680, #394682, #394693, #394712. 2024-07-05 20:42:32 -05:00
JacobBarthelmeh
b948f6797c account for negative return value, fixes coverity issue 394678 2024-07-05 15:34:28 -06:00
JacobBarthelmeh
f8eb0c3776 fix for coverity issue 394676 possible null dereference 2024-07-05 14:06:19 -06:00