Commit Graph

7683 Commits

Author SHA1 Message Date
Daniel Pouzzner
038be95a4a wolfssl/wolfcrypt/types.h: add WC_SAFE_SUM_WORD32().
src/internal.c: mitigations for potential integer overflows in figuring allocation sizes.
2024-03-29 11:45:11 -05:00
Daniel Pouzzner
7e8c0156fe Merge pull request #7325 from dgarske/zephyr
Improve Zephyr support
2024-03-29 00:57:55 -04:00
Daniel Pouzzner
58462840c1 src/ssl.c: add missing cast in wolfSSL_GetSessionFromCache(). 2024-03-28 15:14:19 -05:00
gojimmypi
01ae240fe8 Initialize some Kyber variables 2024-03-25 14:08:47 -07:00
JacobBarthelmeh
85601311a2 rework library versioning 2024-03-21 04:02:28 +07:00
David Garske
50b1044c2f Merge pull request #7347 from JacobBarthelmeh/coverity2
Coverity Fixes QUIC
2024-03-18 09:04:09 -07:00
David Garske
85c22abe4e Fix for Zephyr TimeNowInMilliseconds. Resolves issue with TLS v1.3 server and session tickets time (uptime in sim < 1000 ms was being made 0). 2024-03-18 08:14:40 -07:00
JacobBarthelmeh
d6b4b27cd1 CID 299893 out of bounds read with XMEMCMP 2024-03-18 16:42:15 +07:00
JacobBarthelmeh
44f3e4a3b7 CID 337219 allocation using untrusted size 2024-03-18 16:04:37 +07:00
JacobBarthelmeh
635d326812 CID 337232 sanity check on tainted scalar 2024-03-18 15:03:04 +07:00
David Garske
8d1714a307 Fix for PSK callback with OPENSSL_EXTRA to correctly handle the 0 length case. Thank you @miyazakh. Broken in #7302 2024-03-15 08:09:59 -07:00
David Garske
5dff8aa417 Merge pull request #7334 from SparkiDev/macosx_clang_15_asm_fix
MacOS X Intel ASM clang 15: fix asm to compile without warning
2024-03-14 10:10:42 -07:00
Daniel Pouzzner
3fd6af0cd2 Merge pull request #7283 from SparkiDev/lms
LMS: initial implementation
2024-03-14 01:48:57 -04:00
Sean Parkinson
3ba5dd3e6d MacOS X Intel ASM clang 15: fix asm to compile without warning
Don't use align when __APPLE__ is defined.
Make minimum alignment on variables in ASM 8 bytes (.p2align 3).

Fix x86 builds with ASM.
2024-03-14 11:42:12 +10:00
JacobBarthelmeh
9f240bb34c fix for warning of no stdint.h include with uintptr_t 2024-03-14 00:38:02 +07:00
JacobBarthelmeh
1e054b9613 Merge pull request #7302 from dgarske/pk_psk
Support for Public Key (PK) callbacks with PSK
2024-03-14 00:02:23 +07:00
jordan
0e15a2e83a Handle failed alloc in TLSX_Write. 2024-03-08 22:56:27 -06:00
David Garske
9fadcb2edc Merge pull request #7307 from bandi13/fixNightlyCrossworks
Fix nightly crossworks
2024-03-08 13:12:53 -08:00
David Garske
11303ab796 Support for Public Key (PK) callbacks with PSK in TLS v1.2 and TLS v1.3 (client and server). ZD 17383 2024-03-08 12:21:06 -08:00
gojimmypi
56f3c93272 Revert per https://github.com/wolfSSL/wolfssl/pull/7304#pullrequestreview-1925571495 2024-03-08 12:05:54 -08:00
Andras Fekete
98f8329bf2 Add indentation for legibility 2024-03-08 11:49:38 -05:00
Andras Fekete
8fcb007301 Missing gating for netdb.h includes 2024-03-08 11:46:49 -05:00
Sean Parkinson
28e8228744 Merge pull request #7304 from gojimmypi/PR-Arduino-Logging
Update Arduino examples: 32KB TLS Client/Server; Add wolfcrypt breadcrumbs.
2024-03-08 07:12:01 +10:00
Sean Parkinson
6c8df33191 LMS: initial implementation
Initial wolfSSL implementation of LMS.
Changed LMS benchmarking to time making a key and reloading.
SHA-256:
  Added wc_Sha256HashBlock to make hashing a block fast.
Fixed assembly code to be able to hash a block from an external
buffer.
  Simplified code were possible.
Moved byte reversal decision logic to one place instead of replicating
length checks.
2024-03-07 11:43:16 +10:00
Sean Parkinson
f011012d8e Merge pull request #7300 from bandi13/codeSonarFixes
Code sonar fixes
2024-03-07 10:17:06 +10:00
gojimmypi
e40eb3c774 Update Arduino examples; add wolfcrypt breadcrumbs. 2024-03-06 15:13:37 -08:00
Eric Blankenhorn
a0a9680325 Fix leak in wolfSSL_X509_STORE_CTX_get_chain 2024-03-06 15:13:38 -06:00
Daniel Pouzzner
321a72c906 misc fixes:
wolfcrypt/test/test.c: fix gating for verify4 in scrypt_test(), and fix WOLFSSL_SMALL_STACK -Wframe-larger-than=2048 warnings in sha256_test() and sha512_test().

src/ssl.c: fix for true-but-benign nullPointerRedundantCheck in ProcessBufferTryDecodeEd25519().

tests/api.c: fix for -Wmaybe-uninitialized in test_wc_PKCS7_VerifySignedData_RSA() identified via cross-m68k-all-asm.
2024-03-05 17:44:33 -06:00
Sean Parkinson
ee39a8f17f Merge pull request #7262 from gojimmypi/PR-SHA-Interleave
Introduce SHA256/SHA512 interleave testing, HAVE_DSA; revised ERROR_OUT
2024-03-05 10:13:10 +10:00
Andras Fekete
d81a08a03b Catch error return code and remove redundant condition 2024-03-04 09:48:31 -05:00
Daniel Pouzzner
7fbb209684 ssl.c: in wolfSSL_Init(), fix cppcheck identicalInnerCondition warning on non-FIPS configurations. 2024-03-01 17:54:55 -06:00
Daniel Pouzzner
a59080a858 Merge pull request #7288 from bandi13/fixNETDB_H
Move netdb.h and ioctl.h into wolfio.c
2024-03-01 18:36:18 -05:00
Eric Blankenhorn
cf733c306c Merge pull request #7284 from douzzer/20240229-mutex-initializer-global-refactor
20240229-mutex-initializer-global-refactor
2024-03-01 16:43:10 -06:00
Andras Fekete
897a8419c1 Move netdb.h and ioctl.h into wolfio.c 2024-03-01 11:59:02 -05:00
Daniel Pouzzner
67d4019058 Merge pull request #7270 from philljj/zd17560
Fix dataASN null pointer dereference in asn.c.
2024-03-01 01:53:55 -05:00
Daniel Pouzzner
dfbde4514b global refactor of static mutex initialization to use WOLFSSL_MUTEX_INITIALIZER, and adjustment of WOLFSSL_MUTEX_INITIALIZER macro to take an argument, for Linux kernel compatibility. 2024-02-29 02:11:32 -06:00
jordan
c24add5da9 Fix dataASN null pointer dereference in asn.c. 2024-02-28 15:37:55 -06:00
Sean Parkinson
9addb3e45d SSL: Change other ProcessBufferTryDecode*()
Ed448, Falcon and Dilithium changed to return 0 when key format is 0.
2024-02-29 07:37:41 +10:00
Sean Parkinson
b53cc0e98c SSL: Loading bad private key
Fix ProcessBufferTryDecodeRsa and ProcessBufferTryDecodeEcc to only
clear error when key format isn't known.
2024-02-28 21:47:45 +10:00
Daniel Pouzzner
daf43cd04f Merge pull request #7260 from kosmas-valianos/missingConst
Add const in the list of wolfSSL_CTX_set1_groups_list() and wolfSSL_set1_groups_list()
2024-02-28 00:28:37 -05:00
gojimmypi
0775baa2e1 Introduce SHA256/SHA512 interleave, HAVE_DSA; revised ERROR_OUT, cleanup 2024-02-23 17:52:20 -08:00
Juliusz Sosinowicz
4caef93346 Implement transient certs
Add wolfSSL_CertManagerUnloadIntermediateCerts API to clear intermediate certs added to store.
2024-02-20 14:33:36 +01:00
Kosmas Valianos
73a6935386 Add const in the list of wolfSSL_CTX_set1_groups_list() and wolfSSL_set1_groups_list()
aligning with the wolfSSL_CTX_set1_sigalgs_list()/wolfSSL_set1_sigalgs_list() API
2024-02-20 09:14:39 +01:00
JacobBarthelmeh
757fcbcc25 Merge pull request #7236 from julek-wolfssl/get-sig-nid
Implement SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid
2024-02-20 02:46:37 +07:00
Daniel Pouzzner
44e0ee1ecd wolfssl/wolfcrypt/types.h:
* fix overallocation in WC_DECLARE_ARRAY() macro in the !WOLFSSL_SMALL_STACK path.
* rename WC_INIT_ARRAY() to WC_ALLOC_ARRAY() for clarity (it doesn't initialize any memory).
* rename WC_DECLARE_ARRAY_DYNAMIC_DEC(), WC_DECLARE_ARRAY_DYNAMIC_EXE(), and WC_FREE_ARRAY_DYNAMIC() to WC_DECLARE_HEAP_ARRAY(), WC_ALLOC_HEAP_ARRAY(), and WC_FREE_HEAP_ARRAY(), respectively, also for clarity, and refactor out the duplicate definitions.
* add WC_ALLOC_VAR(), and move the XMALLOC() in smallstack WC_DECLARE_VAR() into it.  smallstack WC_DECLARE_VAR() now initializes the pointer to NULL, like smallstack WC_DECLARE_ARRAY(), assuring all pointers are valid upon shortcircuit to cleanup for a failed allocation (see WC_ALLOC_DO_ON_FAILURE below).
* add a new hook "WC_ALLOC_DO_ON_FAILURE" in WC_ALLOC_VAR(), WC_ALLOC_ARRAY(), and WC_DECLARE_ARRAY_DYNAMIC_EXE(), which is invoked when an allocation fails.  by default the hook is defined to WC_DO_NOTHING.
* add basic safety to WC_*_HEAP_ARRAY() by recording/detecting allocation state via idx##VAR_NAME.
* add macros WC_ARRAY_OK() and WC_HEAP_ARRAY_OK() to test if allocation succeeded.
* add macros WC_CALLOC_ARRAY() and WC_CALLOC_HEAP_ARRAY() which zero the objects.
* add macro WC_CALLOC_VAR() which zeros the object.

ED448: smallstack refactor of ge448_scalarmult_base().

src/tls.c tests/api.c wolfcrypt/test/test.c: update WC_DECLARE_VAR()s with now-required matching WC_ALLOC_VAR()s.

wolfcrypt/benchmark/benchmark.c:
* no functional changes in default error-free behavior.
* add definition of WC_ALLOC_DO_ON_FAILURE() that prints error message, sets ret, and does goto exit.
* add BENCH_NTIMES and BENCH_AGREETIMES overrideeable macros, to allow fast sanitizer runs and slow high-precision runs.
* smallstack refactor of all declarations of stack arrays of the form foo[BENCH_MAX_PENDING], using WC_DECLARE_ARRAY() (35 in all).
* additional smallstack refactors, using WC_DECLARE_VAR(), for bench_aesxts(), bench_ed448KeyGen(), bench_eccsi*(), and bench_sakke*().
* fixes for various unhandled error conditions around malloc failures.

wolfcrypt/test/test.c: opportunistically constify several (42) static constants, moving them to the readonly data segment.

linuxkm/Makefile: if ENABLED_LINUXKM_BENCHMARKS, add wolfcrypt/benchmark/benchmark.o to WOLFSSL_OBJ_FILES.

linuxkm/Kbuild: enable FPU for benchmark.o, and remove enablement for module_hooks.o.

linuxkm/module_hooks.c: remove inline include of benchmark.c.
2024-02-16 10:26:21 -06:00
Juliusz Sosinowicz
44de6dfdd3 Return correct values in get_signature APIs and write tests 2024-02-16 11:32:22 +01:00
Juliusz Sosinowicz
6537c7163c Implement SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid 2024-02-16 11:32:04 +01:00
Marco Oliverio
c8f3a8f14b fix: negotiate handshake until the end in wolfSSL_read/wolfSSL_write (#7237)
* tls: negotiate until hs is complete in wolfSSL_read/wolfSSL_write

Don't rely on ssl->options.handShakeSate == HANDSHAKE_DONE to check if
negotiation is needed. wolfSSL_Connect() or wolfSSL_Accept() job may not yet be
completed and/or some messages may be waiting in the buffer because of
non-blocking I/O.

* tests: test case for handshake with wolfSSL_read()/wolfSSL_write()

* doc: clarify wolfSSL_write()

* internal.c: rename: need_negotiate -> ssl_in_handshake
2024-02-15 13:48:19 -08:00
David Garske
d39cf1e499 Merge pull request #7246 from kareem-wolfssl/zd17176
Only include CRL monitor definitions when building with HAVE_CRL_MONITOR.
2024-02-14 13:45:23 -08:00
Kareem
6dc6d58c04 Remove redundant ifdefs. 2024-02-14 11:22:32 -07:00