wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-08-12 15:31:22 +02:00
Code Issues Packages Projects Releases Wiki Activity
30,844 Commits 13 Branches 184 Tags
e109a3b0701f328fb78ff10020ee7044037780bc
Commit Graph
10039 Commits
Author SHA1 Message Date
David GarskeandGitHub 1c34cc9cf5 Merge pull request #10568 from sebastian-carpenter/tls-ech-ext-public 
Enhancement: Public extension manager for ECH
 2026-07-10 15:39:24 -07:00
David GarskeandGitHub da67413199 Merge pull request #10747 from gasbytes/tls-1-2-ocsp-multi-stapl-check 
Reject status_request_v2 ocsp-multi staples that bundle multiple SingleResponses
 2026-07-10 11:51:52 -07:00
Reda Chouk e8653a8270 reject status_request_v2 ocsp-multi staples that bundle multiple SingleResponses 
So a revoked certificate's non-first single can no longer be accepted
 2026-07-10 18:56:51 +02:00
sebastian-carpenter f7ccf4c1de testing improvements (from #10542): 
- *_wire_sni test is now more efficient
- openssl-ech workflow now does interop with ECH rejection

extra improvements:
- tested TLSX_EchSwapExtensions
- added ctx level SNI to padding calculation
- Improvement of SNI handling for ECH
- Changed EchSwapExtensions to append instead of prepend
- Reworked ECH testing
 2026-07-10 10:09:46 -06:00
David GarskeandGitHub a962793323 Merge pull request #10704 from aidangarske/length-width-hardening 
Length Width Hardening
 2026-07-10 08:00:39 -07:00
David GarskeandGitHub feb357db09 Merge pull request #10675 from kareem-wolfssl/f5393 
Fenrir Fixes
 2026-07-09 12:07:11 -07:00
David GarskeandGitHub 2b62c84832 Merge pull request #10486 from embhorn/zd21825 
Add error when RPK is used with DANE stub
 2026-07-09 12:05:17 -07:00
David GarskeandGitHub f2fc9b6603 Merge pull request #10822 from mattia-moffa/20260629-ticket-hint-window-check 
Fix session ticket key rotation when hint exceeds key lifetime
 2026-07-09 10:27:57 -07:00
Daniel PouzznerandGitHub 40f1582dc4 Merge pull request #10824 from yosuke-wolfssl/fix/f_6555 
Lock globalRNGMutex around all shared globalRNG access
 2026-07-09 12:14:49 -05:00
Yosuke Shimizu 51aa3fb5f5 Preserve DTLS association on invalid record headers during handshake 2026-07-09 10:02:56 +09:00
Yosuke Shimizu 768a98088d Lock globalRNGMutex around all shared globalRNG access in OpenSSL-compat RNG 2026-07-09 08:43:22 +09:00
David GarskeandGitHub a4aab71ffe Merge pull request #10861 from padelsbach/asn-integer-overflow-copy 
Fix possible memcpy length overflow in wolfSSL_d2i_ASN1_INTEGER
 2026-07-08 15:20:05 -07:00
sebastian-carpenter cf91f68996 minor fixes 2026-07-08 15:01:40 -06:00
sebastian-carpenter 598f80711d add public sni handling to public ext 2026-07-08 15:01:40 -06:00
sebastian-carpenter dbf22d92fc ech public extension management 2026-07-08 15:01:40 -06:00
David GarskeandGitHub fdfba83c38 Merge pull request #10788 from aidangarske/fenrir-tls-batch-2026-06 
Various hardening fixes across sniffer, QUIC, PKCS#11, TLS and tooling
 2026-07-08 13:58:14 -07:00
Mattia Moffa 207b8c137c Continue without ticket rather than failing handshake 2026-07-08 22:44:33 +02:00
HAJA MOHIDEEN MandGitHub c2b9cc55fb Merge pull request #10408 from hmohide/master 
Add UDP support to NetX sockets for DTLS sessions
 2026-07-08 12:24:31 -07:00
David GarskeandGitHub 4d3d2318f6 Merge pull request #10628 from yosuke-wolfssl/fix/f_4226 
Reject CR/LF in OCSP/CRL URLs to block HTTP injection
 2026-07-08 11:54:00 -07:00
David GarskeandGitHub 922e126423 Merge pull request #10693 from padelsbach/crl-use-after-free 
Fix use-after-free possibility in GetCRLInfo
 2026-07-08 11:37:41 -07:00
David GarskeandGitHub 9395547299 Merge pull request #10716 from padelsbach/crl-reentrancy-uaf 
Address possible UAF in BufferLoadCRL
 2026-07-08 11:35:29 -07:00
David GarskeandGitHub b29e3a1a11 Merge pull request #10863 from holtrop-wolfssl/zd22109 
Fix use-after-free in some TLS shutdown/ReceiveData sequences
 2026-07-08 10:54:52 -07:00
David GarskeandGitHub 76491e6b60 Merge pull request #10661 from yosuke-wolfssl/fix/f_5808 
Enable SCSV check unconditionally
 2026-07-08 10:52:59 -07:00
Eric Blankenhorn 552ad42111 Fixes from review 2026-07-08 12:36:35 -05:00
Eric Blankenhorn addf0d4b74 Add error when RPK is used with DANE stub 2026-07-08 12:36:35 -05:00
David GarskeandGitHub 6b1bf6b81b Merge pull request #10551 from julek-wolfssl/dtls-perf-benchmark 
Add DTLS throughput benchmark tool and optimize send path
 2026-07-08 10:31:11 -07:00
David GarskeandGitHub 67ca317097 Merge pull request #10737 from kareem-wolfssl/zd21998 
X509 validation fixes
 2026-07-08 09:48:26 -07:00
JacobBarthelmehandGitHub 7c085837ae Merge pull request #10772 from dgarske/qat_review 
Intel QuickAssist: multi-device utilization + software-fallback / Cavium fixes
 2026-07-08 10:39:24 -06:00
Tobias FrauenschlägerandGitHub 673d8d00bb Merge pull request #10778 from SparkiDev/time_stamp_protocol 
Time-Stamp Protocol (RFC 3161)
 2026-07-08 17:43:38 +02:00
Josh Holtrop 07d41740de Fix use-after-free in some TLS shutdown/ReceiveData sequences 2026-07-08 08:14:39 -04:00
Mattia Moffa bd7db08967 Move ticket hint check to default callback 2026-07-08 06:17:36 +02:00
Paul Adelsbach f842e33145 Fix possible memcpy length overflow in wolfSSL_d2i_ASN1_INTEGER 2026-07-07 17:41:49 -07:00
Kareem d0897decf3 Code review feedback 2026-07-07 16:55:59 -07:00
Kareem dd773907d3 Code review feedback 2026-07-07 16:49:59 -07:00
Kareem 910daaf658 Code review feedback 2026-07-07 16:49:58 -07:00
Kareem df81ef1fe3 Fix wolfIO_DecodeUrl handling of IPv6 brackets. 
Fixes F-4285.
 2026-07-07 16:49:58 -07:00
Kareem b28490c1cc Fix length calculations in wolfSSL_BUF_MEM_grow_ex and wolfSSL_BUF_MEM_resize. 
Also fix a potential overread in wolfSSL_BUF_MEM_grow_ex for the non-realloc case.
Fixes F-5730
 2026-07-07 16:49:51 -07:00
Kareem 84f0639257 Limit parsed port to 65535 in wolfIO_DecodeUrl. 
Fixes F-4228.
 2026-07-07 16:47:44 -07:00
David GarskeandGitHub e0a8f3f475 Merge pull request #10706 from JacobBarthelmeh/dev 
defense in depth hardening for x509 extension create by OBJ and EVP decode update
 2026-07-07 16:41:15 -07:00
Sean Parkinson ae023a5643 Time-Stamp Protocol (RFC 3161) 
Implementation in wolfCrypt
OpenSSL compatibility layer in wolfSSL
Added tests, certificates, examples.
 2026-07-08 09:33:47 +10:00
aidan garskeandaidan garske 8d4b28bb25 Use an overflow-safe comparison for the TLS 1.3 early data quota check 2026-07-07 15:48:20 -07:00
philljjandGitHub 2f2ffbac04 Merge pull request #10856 from douzzer/20260702-linuxkm-various 
20260702-linuxkm-various
 2026-07-07 17:44:50 -05:00
David GarskeandGitHub 7dd7ae86c0 Merge pull request #10770 from embhorn/zd22032 
Fix wolfSSL_BUF_MEM_grow_ex with WOLFSSL_NO_REALLOC
 2026-07-07 14:48:29 -07:00
David GarskeandGitHub 926a50458b Merge pull request #10841 from SparkiDev/extract_funcs_ssl_1 
internal.c: extract functions to make code cleaner
 2026-07-07 14:26:16 -07:00
Aidan GarskeandGitHub e6567ac353 Merge pull request #10838 from cyberstormdotmu/loganaden-patch-wolfssl_quic_underflow 
quic: Fix buffer underflow
 2026-07-07 13:30:26 -07:00
David Garske 0041fa430e Fix TLS 1.3 hybrid PQC server key share dropped under async crypt 2026-07-07 09:54:03 -07:00
Tobias Frauenschläger 1a144b69bd x509_str.c: gate pathLen decrement on isCa 
X509StoreCheckPathLen() consumed a unit of the issuer's path length budget
for any non-self-issued intermediate. Gate the RFC 5280 sec. 6.1.4 (l)
decrement on cert->isCa so only CA certificates count, matching
ParseCertRelative() (wolfcrypt/src/asn.c) and the (m) tightening step. This
prevents a false PATH_LENGTH_EXCEEDED when a non-CA intermediate is tolerated
via verify_cb.
 2026-07-07 16:02:27 +02:00
Tobias Frauenschläger 54e20016cd x509_str.c: fix partial-chain double-push and rework pathLen tests 
- Break out of the chain-build loop after the partial-chain fallback accepts
  a caller-trusted terminus, so it is pushed to ctx->chain once instead of
  twice; X509StoreCheckPathLen's anchor-skip is now defensive, not load-bearing.
- Drop the now-dead cert == anchor guard and refresh the comment.
- Rework the pathLen regression tests: reuse the existing certs/test-pathlen
  chains (chainF rejects, chainB verifies) instead of inlined report certs.
 2026-07-07 16:02:27 +02:00
KareemandTobias Frauenschläger 3143ae0d75 Refactor to allow maxPathLen set to WOLFSSL_MAX_PATH_LEN. 2026-07-07 16:02:27 +02:00
Tobias Frauenschläger cc78d130c4 X509 validation fixes 2026-07-07 16:02:27 +02:00