Commit Graph

8186 Commits

Author SHA1 Message Date
David Garske
72306b9a67 Merge pull request #7973 from bandi13/fixSniffer
Fix sniffer
2024-10-29 15:21:41 -07:00
David Garske
b982314ac6 Merge pull request #8101 from miyazakh/tsip_ca_add
Check Root CA by TSIP before adding it to ca-table
2024-10-29 14:23:47 -07:00
Andras Fekete
2cdecd85a2 If we have a capture on device 'any', then we need to handle the offset
Detect reading of packet errors

--enable-all and --enable-sniffer exposed this issue

Don't need variable

Rework argument parsing

Need a way to allow arguments to be supplied more granularly. Partucilarly, I needed a "-tracefile" argument without requiring the use of a PCAP file

Fix error prints to STDERR

Fix setting of port filtering

Fix 80 char limit

Not actually a bad packet when there are no more packets

Fix strcat size

Allow the sniffer to print the trace to STDOUT

Fix indexing

Take out superfluous error which is handled later

Set default port to 11111

Single return point

Combine chain to one contiguous memory block

Fix return

Add in error handling for XMALLOC

Add in debugging output when --enable-debug

It makes no sense to allocate a ton of small buffers to process chains

Ultimately, the code is slower because of the several small memcpy instead of a single large contiguous memcpy

Pass in a device name

Fix unused variable

Fix cast

Addressing PR comments

Add new flags to --help
2024-10-29 16:55:20 -04:00
Daniel Pouzzner
57a5895d0e Merge pull request #8110 from philljj/fix_infer
infer: fix uninit values in pkcs8_encode.
2024-10-29 01:16:04 -05:00
Daniel Pouzzner
6f87f57d7a fixes for gating and ARM32 alignment defects:
wolfcrypt/src/port/arm/armv8-aes.c: in the WOLFSSL_ARMASM_NO_HW_CRYPTO version of wc_AesSetKey(), copy the supplied userKey to a properly aligned buffer if necessary before calling AES_set_encrypt_key();

src/dtls13.c: in Dtls13GetRnMask(), if defined(WOLFSSL_LINUXKM)), return retval of wc_AesEncryptDirect();

wolfcrypt/src/misc.c: add readUnalignedWord32(), writeUnalignedWord32(), readUnalignedWords32(), and writeUnalignedWords32();

wolfcrypt/src/siphash.c: use readUnalignedWord64(), readUnalignedWord32(), and writeUnalignedWord64(), to avoid unaligned access faults, and fix cast in byte-reversing version of GET_U32().
2024-10-25 23:52:32 -05:00
jordan
ce31b15608 infer: fix uninit values in pkcs8_encode. 2024-10-23 20:11:51 -05:00
Hideki Miyazaki
a14d7db58c move trailing space 2024-10-24 09:31:00 +09:00
JacobBarthelmeh
52ba700eb3 CID 426426 code maintainability warning, stored NULL value overwritten before used 2024-10-23 18:05:12 -06:00
JacobBarthelmeh
077b070132 CID 426427 remove duplicate null checks 2024-10-23 17:57:14 -06:00
JacobBarthelmeh
9af8716e85 Merge pull request #8087 from ColtonWilley/x509_store_rewrite
Initial rewrite of X509 STORE to replicate openssl behavior
2024-10-23 17:14:40 -06:00
Daniel Pouzzner
e7e20532eb Merge pull request #8097 from julek-wolfssl/zd/18822
Fix TLS v1.2 session resumption edge cases
2024-10-23 18:01:35 -05:00
David Garske
25e32c2539 Fix for TLS v1.2 session resumption with tickets where the server decides to do a full handshake. The wrong sessionIDSz was being checked and should be the arrays one since it get set from the server_hello. 2024-10-23 15:14:05 -07:00
Daniel Pouzzner
cab20fbdd2 add and use WOLFSSL_PARTIAL_CHAIN as native bitmask macro for compat layer X509_V_FLAG_PARTIAL_CHAIN;
in src/x509_str.c, fix several C++ "invalid conversion" errors in X509StoreFreeObjList() and wolfSSL_X509_STORE_get0_objects().
2024-10-23 16:57:58 -05:00
Colton Willey
6f0bcac737 Address review comments, rename WOLFSSL_INTER_CA, use up_ref for get issuer 2024-10-23 16:55:34 -05:00
Colton Willey
ee4e1b6262 Properly omit self signed CA from untrusted intermediates, handle memory leak for SSL case with proper flow 2024-10-23 16:55:34 -05:00
Colton Willey
95f8d74202 Fix loop to decrement 2024-10-23 16:55:34 -05:00
Colton Willey
96138e70f8 Restore proper error code handling for self signed CA in non-trusted intermediates 2024-10-23 16:55:34 -05:00
Colton Willey
4c63668295 Small changes per review comments 2024-10-23 16:55:34 -05:00
Colton Willey
3fc3a84a6b Move X509_STORE_CTX_set_flags under OPENSSL_EXTRA 2024-10-23 16:55:34 -05:00
Colton Willey
1ddb2ce435 Properly implement set flags for X509_V_FLAG_PARTIAL_CHAIN 2024-10-23 16:55:34 -05:00
Colton Willey
87ce96527a Changes for various failing build configs 2024-10-23 16:55:34 -05:00
Colton Willey
1afbf55a80 Fix new build error after refactor 2024-10-23 16:55:34 -05:00
Colton Willey
6607314dc6 Address code comments, rewrite get issuer internals, use better internal names, get rid of all lines over 80 chars 2024-10-23 16:55:34 -05:00
Colton Willey
f0fae6506f Fix windows warnings 2024-10-23 16:55:34 -05:00
Colton Willey
98eb6b398c Fix for windows builds 2024-10-23 16:55:34 -05:00
Colton Willey
f7bfa71d9f Implement support for verify flag X509_V_FLAG_PARTIAL_CHAIN 2024-10-23 16:55:34 -05:00
Colton Willey
12f4f69fb4 Allow intermediate CA certs without keycertsign when added through X509 STORE 2024-10-23 16:55:34 -05:00
Colton Willey
38c7de1707 Fixes for CI build errors 2024-10-23 16:55:34 -05:00
Colton Willey
17c9e92b7f Initial rewrite of X509 STORE to replicate openssl behavior 2024-10-23 16:55:34 -05:00
Daniel Pouzzner
6e14889758 Merge pull request #8094 from JacobBarthelmeh/coverity
minor fixes for Coverity reports
2024-10-23 11:26:33 -05:00
Juliusz Sosinowicz
031656ee7a Send a new ticket when rejecting a ticket and tickets enabled 2024-10-23 13:12:46 +02:00
Hideki Miyazaki
ba1cd85934 check Root CA by TSIP before adding it to ca-table 2024-10-23 18:02:56 +09:00
Daniel Pouzzner
6429315216 fix references to misnamed HAVE_SHA224, HAVE_SHA384, HAVE_SHA512 (correct names have WOLFSSL_ prefixes). 2024-10-23 00:02:28 -05:00
Juliusz Sosinowicz
2847cbfbad Simplify TLS 1.2 session ID logic
Optimize entropy use. Only generate the exact amount of random data that we will actually keep.

Refactor done as part of work on ZD18822
2024-10-22 14:31:46 +02:00
JacobBarthelmeh
27267d7d2e CID 426066 fix check if null before free 2024-10-22 00:21:26 -06:00
Daniel Pouzzner
846ef1570d Merge pull request #8096 from philljj/fix_coverity_more
Fix more coverity errors.
2024-10-21 23:57:56 -05:00
Daniel Pouzzner
805eaa90cc Merge pull request #7797 from julek-wolfssl/softhsm
Init SoftHSMv2 support
2024-10-21 23:56:12 -05:00
jordan
5fd9e99bbd coverity: don't overwrite obj in wolfSSL_X509_get_ext_d2i. 2024-10-21 20:49:34 -05:00
jordan
35def11781 coverity: fix error, and cleanup. 2024-10-21 14:59:32 -05:00
Juliusz Sosinowicz
901384e704 Init SoftHSMv2 support
- wolfSSL_EVP_PKEY_set1_DH: If both private and public present, output private key
- ToTraditionalInline_ex2: Add DH checking
- wc_ecc_get_curve_id: check index is not negative
- Fix i2d_PKCS8_PRIV_KEY_INFO to actually output pkcs8 instead of just der
- wolfSSL_EVP_PKEY2PKCS8: Create duplicate to avoid double free
- wolfSSL_DH_generate_key: Fix case where not enough buffer was allocated for 128 bit case
- pkcs8_encode: Add DSA and DH support
- wolfSSL_d2i_PKCS8_PKEY: Correctly advance buffer
- RSA_LOW_MEM: export all integers in compat layer
- Add softhsm action
- Define
  - OPENSSL_DH_MAX_MODULUS_BITS
  - OPENSSL_DSA_MAX_MODULUS_BITS
  - OPENSSL_RSA_MAX_MODULUS_BITS
- Implement
  - BN_mul_word
  - i2d_ECPKParameters
  - PEM_write_bio_PKCS8_PRIV_KEY_INFO
  - PEM_read_bio_PKCS8_PRIV_KEY_INFO
  - i2d_PKCS8_PRIV_KEY_INFO
  - RSA_padding_add_PKCS1_PSS_mgf1
  - RSA_verify_PKCS1_PSS_mgf1
2024-10-21 17:26:42 +02:00
JacobBarthelmeh
8fda4ce147 use heap hint with wolfSSL_CTX_check_private_key 2024-10-21 08:53:15 -06:00
Daniel Pouzzner
f44d12026a wolfssl/wolfcrypt/{aes.h,curve25519.h,ed25519.h,hash.h,rsa.h}: remove unneeded .isAllocated member from struct definitions, and add int *result_code argument to constructor prototypes;
wolfssl/wolfcrypt/aes.h: add Aes.streamData_sz;

src/tls13.c: fix devId passed to wc_HmacInit() in CreateCookieExt() and TlsCheckCookie();

src/keys.c: in SetKeys(), call wc_HmacInit() on hmacs only if newly allocated;

wolfcrypt/src/aes.c:
* in wc_Gmac(), wc_GmacVerify(), and AesSivCipher(), use wc_AesNew() and wc_AesDelete();
* in wc_AesInit(), zero the object on entry, and remove superseded piecemeal initializations to zero;
* in wc_AesFree(), zero aes->streamData, and zero the entire object as final cleanup;

wolfcrypt/src/curve25519.c: in wc_curve25519_free(), zero the entire object rather than zeroing piecemeal;

wolfcrypt/test/test.c:
* add fallback implementations (for old FIPS) of wc_HashNew(), wc_HashDelete(), wc_curve25519_new(), wc_curve25519_delete(), wc_ed25519_new(), and wc_ed25519_delete();
* update constructor calls throughout for new semantics;
* refactor ed25519_test() for proper cleanup and error encoding.
2024-10-18 17:49:28 -05:00
Daniel Pouzzner
fa65da7bb0 analyzer-driven cleanups of --enable-dtls13 --enable-dtls-mtu --enable-dtls-frag-ch:
Dtls13HashClientHello(): fix wc_HashType handling;

Dtls13SendFragment(): fix identicalConditionAfterEarlyExit;

GetDtlsRecordHeader(): fix error handling around GetDtls13RecordHeader() (incorrectLogicOperator);

test_wolfSSL_dtls_stateless_maxfrag(): fix a clang-analyzer-core.NullDereference,
test_dtls_frag_ch(): fix a clang-diagnostic-embedded-directive,
test_AEAD_limit_client(): fix an united-data defect found by valgrind.
2024-10-17 00:06:32 -05:00
Daniel Pouzzner
abc6edf4c7 Merge pull request #7796 from SparkiDev/dtls_read_write_threaded
SSL asynchronous read/write and encrypt
2024-10-17 00:05:47 -05:00
Daniel Pouzzner
8803f3dd70 Merge pull request #8085 from philljj/fix_coverity
Fix coverity errors
2024-10-16 17:18:31 -05:00
Daniel Pouzzner
a833d6e9b2 Merge pull request #8084 from anhu/kyber_levels
Correct kyber levels. Was copy and paste error.
2024-10-16 15:54:18 -05:00
jordan
115507e0c0 coverity: null check. 2024-10-16 13:08:06 -05:00
Anthony Hu
db6df887a6 Correct kyber levels. Was copy and paste error. 2024-10-16 13:39:57 -04:00
philljj
2abbab2fd8 Merge pull request #8082 from SparkiDev/bn_bin2bn_fix
BN API: fix BN_bin2bn to handle NULL data properly
2024-10-16 12:00:41 -04:00
Sean Parkinson
64a9e6f7c4 BN API: fix BN_bin2bn to handle NULL data properly
BN_bin2bn was freeing the BN and returning it.
Added test for this.
2024-10-16 14:08:55 +10:00