wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-08-12 18:01:29 +02:00
Code Issues Packages Projects Releases Wiki Activity
30,739 Commits 13 Branches 184 Tags
d0b2d76d901b2e03986184d9c1955ae43201f1ae
Commit Graph
10030 Commits
Author SHA1 Message Date
David GarskeandGitHub feb357db09 Merge pull request #10675 from kareem-wolfssl/f5393 
Fenrir Fixes
 2026-07-09 12:07:11 -07:00
David GarskeandGitHub 2b62c84832 Merge pull request #10486 from embhorn/zd21825 
Add error when RPK is used with DANE stub
 2026-07-09 12:05:17 -07:00
David GarskeandGitHub f2fc9b6603 Merge pull request #10822 from mattia-moffa/20260629-ticket-hint-window-check 
Fix session ticket key rotation when hint exceeds key lifetime
 2026-07-09 10:27:57 -07:00
Daniel PouzznerandGitHub 40f1582dc4 Merge pull request #10824 from yosuke-wolfssl/fix/f_6555 
Lock globalRNGMutex around all shared globalRNG access
 2026-07-09 12:14:49 -05:00
Yosuke Shimizu 51aa3fb5f5 Preserve DTLS association on invalid record headers during handshake 2026-07-09 10:02:56 +09:00
Yosuke Shimizu 768a98088d Lock globalRNGMutex around all shared globalRNG access in OpenSSL-compat RNG 2026-07-09 08:43:22 +09:00
David GarskeandGitHub a4aab71ffe Merge pull request #10861 from padelsbach/asn-integer-overflow-copy 
Fix possible memcpy length overflow in wolfSSL_d2i_ASN1_INTEGER
 2026-07-08 15:20:05 -07:00
David GarskeandGitHub fdfba83c38 Merge pull request #10788 from aidangarske/fenrir-tls-batch-2026-06 
Various hardening fixes across sniffer, QUIC, PKCS#11, TLS and tooling
 2026-07-08 13:58:14 -07:00
Mattia Moffa 207b8c137c Continue without ticket rather than failing handshake 2026-07-08 22:44:33 +02:00
HAJA MOHIDEEN MandGitHub c2b9cc55fb Merge pull request #10408 from hmohide/master 
Add UDP support to NetX sockets for DTLS sessions
 2026-07-08 12:24:31 -07:00
David GarskeandGitHub 4d3d2318f6 Merge pull request #10628 from yosuke-wolfssl/fix/f_4226 
Reject CR/LF in OCSP/CRL URLs to block HTTP injection
 2026-07-08 11:54:00 -07:00
David GarskeandGitHub 922e126423 Merge pull request #10693 from padelsbach/crl-use-after-free 
Fix use-after-free possibility in GetCRLInfo
 2026-07-08 11:37:41 -07:00
David GarskeandGitHub 9395547299 Merge pull request #10716 from padelsbach/crl-reentrancy-uaf 
Address possible UAF in BufferLoadCRL
 2026-07-08 11:35:29 -07:00
David GarskeandGitHub b29e3a1a11 Merge pull request #10863 from holtrop-wolfssl/zd22109 
Fix use-after-free in some TLS shutdown/ReceiveData sequences
 2026-07-08 10:54:52 -07:00
David GarskeandGitHub 76491e6b60 Merge pull request #10661 from yosuke-wolfssl/fix/f_5808 
Enable SCSV check unconditionally
 2026-07-08 10:52:59 -07:00
Eric Blankenhorn 552ad42111 Fixes from review 2026-07-08 12:36:35 -05:00
Eric Blankenhorn addf0d4b74 Add error when RPK is used with DANE stub 2026-07-08 12:36:35 -05:00
David GarskeandGitHub 6b1bf6b81b Merge pull request #10551 from julek-wolfssl/dtls-perf-benchmark 
Add DTLS throughput benchmark tool and optimize send path
 2026-07-08 10:31:11 -07:00
David GarskeandGitHub 67ca317097 Merge pull request #10737 from kareem-wolfssl/zd21998 
X509 validation fixes
 2026-07-08 09:48:26 -07:00
JacobBarthelmehandGitHub 7c085837ae Merge pull request #10772 from dgarske/qat_review 
Intel QuickAssist: multi-device utilization + software-fallback / Cavium fixes
 2026-07-08 10:39:24 -06:00
Tobias FrauenschlägerandGitHub 673d8d00bb Merge pull request #10778 from SparkiDev/time_stamp_protocol 
Time-Stamp Protocol (RFC 3161)
 2026-07-08 17:43:38 +02:00
Josh Holtrop 07d41740de Fix use-after-free in some TLS shutdown/ReceiveData sequences 2026-07-08 08:14:39 -04:00
Mattia Moffa bd7db08967 Move ticket hint check to default callback 2026-07-08 06:17:36 +02:00
Paul Adelsbach f842e33145 Fix possible memcpy length overflow in wolfSSL_d2i_ASN1_INTEGER 2026-07-07 17:41:49 -07:00
Kareem d0897decf3 Code review feedback 2026-07-07 16:55:59 -07:00
Kareem dd773907d3 Code review feedback 2026-07-07 16:49:59 -07:00
Kareem 910daaf658 Code review feedback 2026-07-07 16:49:58 -07:00
Kareem df81ef1fe3 Fix wolfIO_DecodeUrl handling of IPv6 brackets. 
Fixes F-4285.
 2026-07-07 16:49:58 -07:00
Kareem b28490c1cc Fix length calculations in wolfSSL_BUF_MEM_grow_ex and wolfSSL_BUF_MEM_resize. 
Also fix a potential overread in wolfSSL_BUF_MEM_grow_ex for the non-realloc case.
Fixes F-5730
 2026-07-07 16:49:51 -07:00
Kareem 84f0639257 Limit parsed port to 65535 in wolfIO_DecodeUrl. 
Fixes F-4228.
 2026-07-07 16:47:44 -07:00
David GarskeandGitHub e0a8f3f475 Merge pull request #10706 from JacobBarthelmeh/dev 
defense in depth hardening for x509 extension create by OBJ and EVP decode update
 2026-07-07 16:41:15 -07:00
Sean Parkinson ae023a5643 Time-Stamp Protocol (RFC 3161) 
Implementation in wolfCrypt
OpenSSL compatibility layer in wolfSSL
Added tests, certificates, examples.
 2026-07-08 09:33:47 +10:00
philljjandGitHub 2f2ffbac04 Merge pull request #10856 from douzzer/20260702-linuxkm-various 
20260702-linuxkm-various
 2026-07-07 17:44:50 -05:00
David GarskeandGitHub 7dd7ae86c0 Merge pull request #10770 from embhorn/zd22032 
Fix wolfSSL_BUF_MEM_grow_ex with WOLFSSL_NO_REALLOC
 2026-07-07 14:48:29 -07:00
David GarskeandGitHub 926a50458b Merge pull request #10841 from SparkiDev/extract_funcs_ssl_1 
internal.c: extract functions to make code cleaner
 2026-07-07 14:26:16 -07:00
Aidan GarskeandGitHub e6567ac353 Merge pull request #10838 from cyberstormdotmu/loganaden-patch-wolfssl_quic_underflow 
quic: Fix buffer underflow
 2026-07-07 13:30:26 -07:00
David Garske 0041fa430e Fix TLS 1.3 hybrid PQC server key share dropped under async crypt 2026-07-07 09:54:03 -07:00
Tobias Frauenschläger 1a144b69bd x509_str.c: gate pathLen decrement on isCa 
X509StoreCheckPathLen() consumed a unit of the issuer's path length budget
for any non-self-issued intermediate. Gate the RFC 5280 sec. 6.1.4 (l)
decrement on cert->isCa so only CA certificates count, matching
ParseCertRelative() (wolfcrypt/src/asn.c) and the (m) tightening step. This
prevents a false PATH_LENGTH_EXCEEDED when a non-CA intermediate is tolerated
via verify_cb.
 2026-07-07 16:02:27 +02:00
Tobias Frauenschläger 54e20016cd x509_str.c: fix partial-chain double-push and rework pathLen tests 
- Break out of the chain-build loop after the partial-chain fallback accepts
  a caller-trusted terminus, so it is pushed to ctx->chain once instead of
  twice; X509StoreCheckPathLen's anchor-skip is now defensive, not load-bearing.
- Drop the now-dead cert == anchor guard and refresh the comment.
- Rework the pathLen regression tests: reuse the existing certs/test-pathlen
  chains (chainF rejects, chainB verifies) instead of inlined report certs.
 2026-07-07 16:02:27 +02:00
KareemandTobias Frauenschläger 3143ae0d75 Refactor to allow maxPathLen set to WOLFSSL_MAX_PATH_LEN. 2026-07-07 16:02:27 +02:00
Tobias Frauenschläger cc78d130c4 X509 validation fixes 2026-07-07 16:02:27 +02:00
Daniel Pouzzner 12272e1c06 wolfssl/wolfcrypt/hash.h, src/internal.c, src/pk_ec.c, tests/api/api.h, wolfcrypt/src/dsa.c, wolfcrypt/src/ecc.c, wolfcrypt/src/pkcs7.c, wolfcrypt/test/test.c: 
* remove FIPS 186-5 sign-mode restrictions from WC_HASH_CUSTOM_MIN_DIGEST_SIZE.
* set up WC_MIN_DIGEST_SIZE_FOR_SIGN and WC_MIN_DIGEST_SIZE_FOR_VERIFY, derived from WC_HASH_CUSTOM_MIN_DIGEST_SIZE, but enforcing FIPS 186-5 sign-mode restrictions only for WC_MIN_DIGEST_SIZE_FOR_SIGN.
* replace all uses of WC_MIN_DIGEST_SIZE with WC_MIN_DIGEST_SIZE_FOR_SIGN or WC_MIN_DIGEST_SIZE_FOR_VERIFY as appropriate.

wolfcrypt/test/test.c: in cryptocb_test(), don't expect callback execution in FIPS builds.

wolfssl/wolfcrypt/settings.h: in WOLFSSL_LINUXKM section, if defined(NO_SHA) while registering ECDSA handlers, force WC_MIN_DIGEST_SIZE_FOR_VERIFY to 20 for SHA-1 verify support.
 2026-07-07 00:19:48 -05:00
Loganaden VelvindronandGitHub 0cdc7ab583 Fix whitespaces 2026-07-07 08:51:12 +04:00
Loganaden VelvindronandGitHub 98c48a43b7 move check earlier 2026-07-07 08:47:50 +04:00
David GarskeandGitHub 675d5df2cd Merge pull request #10833 from kareem-wolfssl/zd22079 
Add some missing PKCS7 length checks and bound DTLS 1.3 ACK list.
 2026-07-06 17:28:22 -07:00
Sean Parkinson 9918a1177a internal.c: extract functions to make code cleaner 2026-07-07 08:11:10 +10:00
JacobBarthelmehandGitHub f1b700180c Merge pull request #10738 from dgarske/zd_ecc_nonblock_certchain 
Add WOLFSSL_ASYNC_CERT_YIELD: per-certificate non-blocking yield
 2026-07-06 14:21:08 -06:00
Daniel PouzznerandGitHub 326f40d032 Merge pull request #10626 from mattia-moffa/20260605-dtls-cid-check-newest 
DTLS bugfixes
 2026-07-03 01:18:38 -05:00
Daniel PouzznerandGitHub 8c7ab8eb4f Merge pull request #10686 from Frauschi/openssl_group_align 
Align wolfSSL_set1_groups_list() arg handling with OpenSSL
 2026-07-03 01:17:33 -05:00
Daniel PouzznerandGitHub a543bc4d78 Merge pull request #10745 from Frauschi/mandatory_psk 
Enable support for mandatory PSKs
 2026-07-03 01:16:45 -05:00