Commit Graph

3056 Commits

Author SHA1 Message Date
Sean Parkinson
bb84ebfd7a Curve25519: add blinding when using private key
XOR in random value to scalar and perform special scalar multiplication.
Multiply x3 and z3 by random value to randomize co-ordinates.

Add new APIs to support passing in an RNG.
Old APIs create a new RNG.

Only needed for the C implementations that are not small.

Modified TLS and OpenSSL compat API implementations to pass in RNG.

Fixed tests and benchmark program to pass in RNG.
2025-02-13 08:52:35 +10:00
Daniel Pouzzner
91aad90c59 wolfssl/internal.h and src/internal.c:
change Buffers.prevSent and .plainSz from int to word32;

change SendData() sz arg from int sz to size_t sz;

add asserts in SendData() and ReceiveData() to prevent sz > INT_MAX (assuring no overflow internally or in the returned int).

wolfssl/ssl.h and src/ssl.c:

change WOLFSSL_BUFFER_INFO.length from unsigned int to word32 (no functional change, just for consistency);

add wolfSSL_write_internal(), refactor wolfSSL_write() to call it, and fix wolfSSL_write_ex() to take size_t sz, not int sz.
2025-01-24 17:16:08 -06:00
Daniel Pouzzner
1b338abb2d fix wolfSSL_read_ex() prototype with size_t sz, not int sz, for consistency with OpenSSL;
fix internal functions wolfSSL_read_internal() and ReceiveData() to likewise accept size_t sz;

add negative sz checks where needed to other functions that call wolfSSL_read_internal() and ReceiveData();

add min_size_t() and max_size_t() to misc.c/misc.h.
2025-01-24 16:16:43 -06:00
David Garske
20ae10fd8c Merge pull request #8360 from philljj/dual_alg_mldsa
Update ssl code for ML_DSA.
2025-01-24 11:55:04 -08:00
David Garske
ba88a6454c Merge pull request #8331 from julek-wolfssl/bind-9.18.28
Bind 9.18.28 fixes
2025-01-24 11:37:26 -08:00
David Garske
2e87dfc207 Merge pull request #8345 from JacobBarthelmeh/python_update
Python update to 3.12.6
2025-01-24 11:37:10 -08:00
JacobBarthelmeh
69be9aa211 fix to not stomp on sz with XOF function, restore comment, remove early XFREE call 2025-01-24 11:40:53 -07:00
Juliusz Sosinowicz
829c2a022f Free'ing ctx->srp has to be reference counted as well 2025-01-24 18:39:11 +01:00
JacobBarthelmeh
2526d91300 formating for line length and guard on access to EncryptedInfo struct 2025-01-23 23:56:28 -07:00
JacobBarthelmeh
8ca979f892 refactor clSuites internal use, and check return values with setting PARAMS 2025-01-23 16:30:08 -07:00
JacobBarthelmeh
661f6b04a2 fix for macro guard on free of clSuites 2025-01-23 16:30:08 -07:00
JacobBarthelmeh
2812baf5a9 fix for memory leak with new wolfSSL_get_client_ciphers function 2025-01-23 16:30:08 -07:00
JacobBarthelmeh
418e63e448 fix for smallstack build 2025-01-23 16:30:08 -07:00
JacobBarthelmeh
363ecd3756 add macro guards to account for alternate builds 2025-01-23 16:30:07 -07:00
JacobBarthelmeh
c6974a921d fix for return values of write_ex/read_ex, propogate PARAMS, handle CRL with load_verify_locations, fix for get verified/unverified chain 2025-01-23 16:30:07 -07:00
JacobBarthelmeh
689c61cc7e adding implementation of wolfSSL_get_client_ciphers 2025-01-23 16:30:07 -07:00
Lealem Amedie
eda98712d5 Fix for NO_REALLOC build crash 2025-01-23 16:14:45 -07:00
Lealem Amedie
49a74daebc Fix OPENSSL_ALL build with WOLFSSL_NO_REALLOC 2025-01-23 13:59:30 -07:00
jordan
2ef90b1f89 ML-DSA/Dilithium: update ssl code for ML_DSA final. 2025-01-23 15:33:26 -05:00
JacobBarthelmeh
2c24291ed5 update copyright date 2025-01-21 09:55:03 -07:00
JacobBarthelmeh
3aa2881cd4 account for rsa_pss_rsae vs rsa_pss_pss type 2024-12-23 23:45:33 -07:00
JacobBarthelmeh
2409971b14 Merge pull request #8224 from julek-wolfssl/dtls-server-demux
DTLS: Add server side stateless and CID QoL API
2024-12-23 10:01:01 -07:00
jordan
b5c47d27e0 fedora crypto-policies: initial support. 2024-12-18 16:56:36 -06:00
Juliusz Sosinowicz
faa7b8dfaa wolfSSLReceive: Error return on interrupted connection
Interrupted connection should return control to the user since they may want to handle the signal that caused the interrupt. Otherwise, we might never give back control to the user (the timeout would error out but that causes a big delay).

socat.yml: in test 475, the test would send a SIGTERM after 3 seconds. We would continue to ignore this signal and continue to call `recvfrom`. Instead we should error out and give control back to the user.
2024-12-18 09:31:25 +01:00
Juliusz Sosinowicz
a1ee953411 Protect peer access when WOLFSSL_RW_THREADED 2024-12-18 09:31:25 +01:00
Juliusz Sosinowicz
4795e0d920 Refactor dtls pending peer processing 2024-12-18 09:31:25 +01:00
Juliusz Sosinowicz
3ded2bc05d Code review and jenkins fixes 2024-12-18 09:31:25 +01:00
Juliusz Sosinowicz
daa57c492d DTLS: Add server side stateless and CID QoL API
- wolfDTLS_accept_stateless - statelessly listen for incoming connections
- wolfSSL_inject - insert data into WOLFSSL object
- wolfSSL_SSL(Enable|Disable)Read - enable/disable reading from IO
- wolfSSL_get_wfd - get the write side file descriptor
- wolfSSL_dtls_set_pending_peer - set the pending peer that will be upgraded to regular peer when we successfully de-protect a DTLS record
- wolfSSL_dtls_get0_peer - zero copy access to the peer address
- wolfSSL_is_stateful - boolean to check if we have entered stateful processing
- wolfSSL_dtls_cid_get0_rx - zero copy access to the rx cid
- wolfSSL_dtls_cid_get0_tx - zero copy access to the tx cid
- wolfSSL_dtls_cid_parse - extract cid from a datagram/message
2024-12-18 09:31:24 +01:00
David Garske
356889a528 Add --disable-tls option that can be used with --enable-all to disable TLS features and set NO_TLS. Useful for allowing certificate manager and crypto compatibility API's only. 2024-12-17 13:40:03 -08:00
David Garske
6151160e58 Further fixes with NO_TLS to support use with compatibility layer. 2024-12-17 09:24:38 -08:00
David Garske
a2b5da8651 Fix nested NO_TLS. 2024-12-17 08:33:33 -08:00
David Garske
14e3372826 Enable support for using certificate manager only. Fixes for building without TLS enabled (NO_TLS). ZD 19054. Tested using ./configure --disable-tlsv12 --disable-tls13 CFLAGS="-DNO_TLS" && make check 2024-12-17 08:33:32 -08:00
Sean Parkinson
e3876fcab7 Merge pull request #8287 from JacobBarthelmeh/sigfault
fix for sig fault harden build
2024-12-16 09:04:29 +10:00
JacobBarthelmeh
d7e40e7413 Merge pull request #8264 from dgarske/various_20241206
Various cleanups and fixes
2024-12-13 13:48:10 -07:00
JacobBarthelmeh
a22176af40 fix for sig fault harden build 2024-12-13 10:34:23 -07:00
Daniel Pouzzner
e248d8499a move !defined(EXTERNAL_OPTS_OPENVPN) assert from src/internal.c to wolfssl/wolfcrypt/types.h with refinements; refine logic+message of assert in wolfssl/wolfcrypt/settings.h re "wolfssl/options.h included in compiled wolfssl library object..". 2024-12-09 15:02:41 -06:00
David Garske
314f7575fa Fixes for macro names. 2024-12-09 08:30:47 -08:00
Daniel Pouzzner
0ad072a34b src/internal.c: in HashSkeData(), remove unneeded logically faulty nullness check around XFREE(ssl->buffers.digest.buffer, ...). 2024-12-06 13:01:40 -06:00
Juliusz Sosinowicz
8ff79dc26e Add size checks to sessionID 2024-12-04 11:56:16 +01:00
Daniel Pouzzner
bfeb0ad48e expand opensslcoexist to all low level crypto APIs. 2024-11-22 19:27:56 -06:00
JacobBarthelmeh
6dd00abb74 Merge pull request #7771 from aidangarske/InitSuites_Orderadj
`InitSuites` changes to order making `BUILD_TLS_AES_256_GCM_SHA384` be prioritized over `BUILD_TLS_AES_128_GCM_SHA256`
2024-11-22 10:15:32 -07:00
David Garske
6be70f9230 Fix for size increase on X509 small. Fix for CRL test with NO_RSA. 2024-11-20 15:54:02 -08:00
aidan garske
b79423fae9 Merge remote-tracking branch 'origin/master' into InitSuites_Orderadj 2024-11-18 10:07:10 -08:00
Daniel Pouzzner
ff680994ba Merge pull request #8146 from julek-wolfssl/dtls13-ooo-app-data
DTLS 1.3: Don't error out on app data before finishing handshake
2024-11-16 14:56:21 -06:00
Daniel Pouzzner
ebfde75d91 fixes for misspelled/malformed macro names, and add missing BUILD_AESCCM setup in wolfssl/internal.h 2024-11-15 15:33:51 -06:00
Daniel Pouzzner
595f55eceb add struct wolfSSL_RefWithMutex, wolfSSL_RefWithMutexLock, and wolfSSL_RefWithMutexUnlock, and change WOLFSSL_CTX.ref from wolfSSL_Ref to wolfSSL_RefWithMutex.
in in wc_port.c, rename mutexful implementations of wolfSSL_Ref*() to wolfSSL_RefWithMutex*(), and build them even if defined(WOLFSSL_ATOMIC_OPS).

refactor wolfSSL_CTX_UnloadIntermediateCerts() to wrap the refcount check and deallocation with wolfSSL_RefWithMutexLock()...wolfSSL_RefWithMutexUnlock().

move port-specific setup for WARN_UNUSED_RESULT, WC_MAYBE_UNUSED, and WC_INLINE, from types.h to wc_port.h, to make them usable by port-specific definitions later in wc_port.h.

when defined(SINGLE_THREADED) and !defined(WOLFSSL_NO_ATOMICS), typedef int wolfSSL_Atomic_Int, so that access to wolfSSL_Atomic_Ints in SINGLE_THREADED builds is easy.

refactor fallback definitions of wolfSSL_Atomic_Int_FetchAdd and wolfSSL_Atomic_Int_FetchSub as WC_INLINE functions to avoid -Wunused-result.
2024-11-15 12:35:41 -06:00
David Garske
c06b5fadc1 Merge pull request #8180 from JacobBarthelmeh/staticmemory
wc_UnloadStaticMemory should be used to free mutex
2024-11-14 17:54:56 -08:00
Daniel Pouzzner
0ebd86d668 add second wolfCrypt error code span, and add DEADLOCK_AVERTED_E. 2024-11-13 13:01:00 -06:00
JacobBarthelmeh
f74e73e8ce wc_UnloadStaticMemory should be used to free mutex 2024-11-13 11:51:53 -07:00
Juliusz Sosinowicz
cf80eb8788 DTLS 1.3: Don't error out on app data before finishing handshake
Check epoch for early data
2024-11-12 12:19:02 +01:00