eb180dbee2
Add test cases for max chain depth fixes
2026-05-27 17:16:30 -07:00
94b36c9092
Harden chain depth bounds and parser input validation
...
Enforce MAX_CHAIN_DEPTH limits in OCSP chain processing
(SendCertificateStatus, ProcessChainOCSPRequest), certificate loading
(ProcessUserChain), and TLS 1.3 certificate sending
(SendTls13Certificate). Add idx bounds checks to chain accessors
in ssl.c.
Harden SNI extension parser (TLSX_SNI_GetFromBuffer) with length
checks preventing buffer overreads on malformed ClientHello.
Fix off-by-one in TLSX_CSR_Free where <= should be < since
csr->requests is a count, not a max index.
Add remaining-buffer bounds checks to PKCS7 decoders:
DecodeEnvelopedData, DecodeAuthEnvelopedData (encryptedContentSz
and authTagSz), DecodeEncryptedData, SignedData null signature tag,
and PwriKek_KeyUnWrap cekLen validation.
2026-05-27 17:16:30 -07:00
713a220fc9
Merge pull request #10426 from JeremiahM37/fenrir-8
...
protocol correctness, OpenSSL-compat hardening, and sensitive-memory zeroization
2026-05-28 09:48:10 +10:00
971d2b051a
Merge pull request #10401 from night1rider/Early-heap-delcare-cmac
...
plumb caller heap into Cmac before cryptocb fires
2026-05-28 09:46:10 +10:00
78a5740bac
Merge pull request #10504 from miyazakh/f-2180_pbkdf
...
f-2180: fix clamp iterations <= 0 to 1 instead of returning an error
2026-05-28 09:32:01 +10:00
c92208076f
Merge pull request #10374 from kareem-wolfssl/zd21699
...
Enable all-zero shared secret check for Curve448/25519 by default. Ensure post_handshake_auth extension was sent before accepting post-handshake CertificateRequest message.
2026-05-28 09:29:49 +10:00
eaadfb12ed
Merge pull request #10508 from JacobBarthelmeh/static_analysis_3
...
devcrypto fixes, forcezero on memory after use, RX64 GetHash port fix, blake2 stor64 alignment
2026-05-28 09:24:56 +10:00
7bcc613bb0
Merge pull request #10478 from embhorn/zd21821
...
Fixes in SP int and DH
2026-05-28 09:00:41 +10:00
70f8bd9831
Merge pull request #10492 from rizlik/legacy_session_id_bad_client
...
Add compatibility flag and tests for pre-5.9.0 DTLSv1.3 clients
2026-05-28 08:57:48 +10:00
b0d61c5e44
Merge pull request #10545 from douzzer/20260527-fixes
...
20260527-fixes
2026-05-27 16:14:21 -06:00
815d48c65a
Merge pull request #10533 from JacobBarthelmeh/wolfclu_flag
...
set MD5 min hash size when using --enable-wolfclu
2026-05-27 16:05:52 -06:00
b28cbc7666
Merge pull request #10521 from philljj/kernel_fcntl
...
wc_port: guard fcntl behind WOLFSSL_KERNEL_MODE.
2026-05-27 15:10:50 -06:00
12d79d8838
wc_port: guard fcntl behind WOLFSSL_KERNEL_MODE.
2026-05-27 14:52:54 -05:00
e55e8a9842
Merge pull request #10524 from JacobBarthelmeh/sgx
...
SGX build does not have fcntl.h
2026-05-27 12:06:05 -07:00
f6d6ae687a
tests/api/test_mldsa_legacy.c: fix bugprone-macro-parentheses in MLDSA_LEGACY_SIZE_ASSERT().
...
wolfssl/wolfcrypt/wc_mldsa.h: move WOLFSSL_MLDSA_NO_CTX setup to precede legacy dilithium.h header, so that the _NO_CTX remap macros are properly gated in.
2026-05-27 14:02:37 -05:00
4e491ed3db
Merge pull request #10511 from dgarske/zd21780
...
Fix minor compile error with `WOLFSSL_DEBUG_MEMORY`
2026-05-27 11:16:19 -06:00
39a3546b64
Merge pull request #10519 from sebastian-carpenter/flaky-ech-test
...
CI Fix: fix flaky ECH test
2026-05-27 11:09:18 -06:00
3fa4ebcaec
Merge pull request #10527 from mattia-moffa/20260525-writedup-no-dtls
...
Allow --enable-writedup when DTLS is disabled
2026-05-27 11:02:55 -06:00
c568755751
Merge pull request #10528 from julek-wolfssl/tls/maxsigalgos
...
Default WOLFSSL_MAX_SIGALGO to 128
2026-05-27 11:01:54 -06:00
cd82d7e08d
Merge pull request #10529 from SparkiDev/sp_fixes_8
...
sp_int: fixes and added testing
2026-05-27 10:59:24 -06:00
7cf84dd833
Merge pull request #10523 from dgarske/ci_opt2
...
CI: cache compiler output in os-check Ubuntu matrix
2026-05-26 19:35:03 -06:00
5b08bc04b2
set MD5 min hash size when using --enable-wolfclu
2026-05-26 17:58:23 -06:00
91f3e7e063
Merge pull request #10332 from jackctj117/SNI
...
tls.c: send missing_extension alert on TLS 1.3 SNI absence
2026-05-27 08:37:05 +10:00
10020f9cc9
Fix minor compile error with WOLFSSL_DEBUG_MEMORY
2026-05-26 11:39:34 -07:00
8199fda0a4
Merge pull request #10160 from Roy-Carter/feature/integrate_openssl_comp_fixes
...
OpenSSL compatibility layer extension
2026-05-26 10:39:14 -07:00
cd2713a731
Default WOLFSSL_MAX_SIGALGO to 128
2026-05-26 17:37:11 +00:00
08022ffebf
CI: cache compiler output in os-check Ubuntu matrix
...
- Add .github/actions/ccache-setup composite (ccache + PATH intercept).
- Wire into os-check.yml make_check_linux; macOS unchanged for now.
- Measured on master --enable-all: cold 11.6s -> warm 1.1s (~10x), 100% hit.
2026-05-26 10:36:49 -07:00
291ec20d4e
stash caller heap before cryptocb fires so InitCmac_* callbacks can honor it
2026-05-26 09:51:59 -06:00
a3f5260260
Merge pull request #10500 from rizlik/sha224_only
...
crpytocb: support SHA224 under WOLF_CRYPTO_CB_ONLY_SHA256
2026-05-26 08:05:47 -07:00
52620e3204
Merge pull request #10516 from Frauschi/mldsa_rename
...
Finalize ML-DSA renaming
2026-05-26 08:05:04 -07:00
0c15be5fef
Revert ".wolfssl_known_macro_extra: add ONLY_AES and ONLY_SHA256"
...
This reverts commit 87f8078367
2026-05-26 15:48:06 +02:00
637c07798a
Finalize ML-DSA renaming
2026-05-26 14:54:30 +02:00
bc574f7930
dtls13: WOLFSSL_DTLS13_5_9_0_COMPAT -> WOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID
2026-05-26 09:16:56 +02:00
87f8078367
.wolfssl_known_macro_extra: add ONLY_AES and ONLY_SHA256
2026-05-26 09:16:53 +02:00
e6fa789e68
test_dtls: remove non-ASCII chars
2026-05-26 09:15:58 +02:00
7592b481e7
test: dtls: add WOLFSSL_DTLS13_5_9_0_COMPAT related tests
2026-05-26 09:15:58 +02:00
8f477356ce
dtls: add compat flag for buggy pre 5.9.0 DTLSv1.3 clients
2026-05-26 09:15:58 +02:00
c57a873824
sp_int: fixes and added testing
...
sp_set_bit(): check i is in range before use.
_sp_div_2(): Use a constant-time clamp as called by a constant-time
function.
_sp_sqr(): static buffer needs to be one larger for when ECC with P-521
is the largest size.
Add tests:
- Testing negative numbers with mp_read_raidx/mp_to_radix 10/16
- Testing negative numbers with mp_add_d/mp_sub_d
- Testing of mp_gcd without mp_lcm
- More testing of mp_mod_d and when negative numbers are used
- Check maximum values work for square. Check of _sp_sqr() bug
- Add testing of mp_add/sub_mod_ct
- Add testing of mp_cmp_mag
- Add testing of mp_mulmod/mp_sqrmod
- Add testing of mp_exch
- Add testing of mp_to_unsigned_bin_len_ct
- Add testing of mp_exptmod that uses base-2 windowing method.
- Add testing of mp_invmod_mont_ct
2026-05-26 13:52:57 +10:00
1f619a9f50
Allow --enable-writedup when DTLS is disabled
2026-05-25 17:34:32 +02:00
887f242ee8
Merge pull request #10522 from dgarske/retrigger_prb_on_ready
...
GH Actions: retrigger Jenkins PRB when draft PR is marked ready
2026-05-25 20:55:05 +10:00
8c0d3b7ea1
SGX build does not have fcntl.h
2026-05-22 23:20:36 -06:00
b0d2b10c6b
GH Actions: retrigger Jenkins PRB when draft PR is marked ready
2026-05-22 15:14:50 -07:00
d4ed43853f
flaky ECH test: fix method for finding ECH extension
2026-05-22 10:48:56 -06:00
eb32554bdb
Fix: support adding UE to excluded strings
2026-05-22 19:01:05 +03:00
dc86dc34a8
Fix: change test string to the new format
2026-05-22 19:01:05 +03:00
8f15bf6d10
fix : bad merge conflics leftovers.
2026-05-22 19:01:05 +03:00
56e4612e4e
Fix : apply Julek pr notes
2026-05-22 19:01:05 +03:00
f15c896551
Build_fix:
...
When building with --enable-opensslextra=x509small, only OPENSSL_EXTRA_X509_SMALL is defined, not OPENSSL_EXTRA, so these functions are not compiled into the library
2026-05-22 19:01:05 +03:00
7561911cba
fix: Fix build errors for some tests on pipeline
2026-05-22 19:01:05 +03:00
c1a507e175
Feature: allow the usage of
...
wolfSSL_alert_type_string
wolfSSL_alert_desc_string
wolfSSL_EVP_DigestSign
wolfSSL_EVP_DigestVerify
in the openssl compatiility layer for wolfssl
2026-05-22 19:01:04 +03:00
Colton Willey
Sean Parkinson
JacobBarthelmeh
Chris Conlon
jordan
David Garske
Daniel Pouzzner
Zackery
Juliusz Sosinowicz
night1rider
Marco Oliverio
Tobias Frauenschläger
Mattia Moffa
sebastian-carpenter
Roy Carter