Commit Graph

24232 Commits

Author SHA1 Message Date
Daniel Pouzzner
239b85c804 Merge pull request #8323 from JacobBarthelmeh/release
prepare for release 5.7.6
v5.7.6-stable
2024-12-31 11:58:22 -06:00
JacobBarthelmeh
70e41d1ed1 prepare for release 5.7.6 2024-12-31 08:27:53 -07:00
Daniel Pouzzner
d40698a103 Merge pull request #8322 from JacobBarthelmeh/coverity
fix for dead code warning CID444417
2024-12-30 17:56:28 -06:00
JacobBarthelmeh
c9bcbd8c52 fix for dead code warning CID444417 2024-12-30 16:14:28 -07:00
David Garske
8d7c60017c Merge pull request #8263 from JacobBarthelmeh/rsa_pss
account for rsa_pss_rsae vs rsa_pss_pss type
2024-12-28 13:47:30 -08:00
JacobBarthelmeh
af4b5c2097 only run RSA-PSS interop test if cipher suites with ephemeral keys are available 2024-12-28 11:34:17 -08:00
JacobBarthelmeh
1ae0f7c66f do not do resume with new test case
add wolfssl_no_resume flag to openssl.test

check for version of openssl testing against

check if RSA is supported for test case

guard on test case for TLS versions supported
2024-12-28 02:09:49 -08:00
David Garske
2e8f0176c9 Merge pull request #8316 from JacobBarthelmeh/x509ref
Up X509 refrence count and add test case
2024-12-27 10:37:28 -08:00
JacobBarthelmeh
3ee08d81db fix for check on number of objects when free'ing and add test case 2024-12-27 08:09:03 -08:00
David Garske
5c6fdb52f1 Merge pull request #8319 from philljj/fix_coverity
coverity: correct lock message, check fd value.
2024-12-26 12:53:36 -08:00
JacobBarthelmeh
f57f044b39 Merge pull request #8318 from dgarske/CID444418
Fix for finishedSz checking with TLSv1.3 and `WOLFSSL_HAVE_TLS_UNIQUE` (CID444418)
2024-12-24 15:41:25 -07:00
jordan
c71392bb7e coverity: correct lock message, check fd value. 2024-12-24 16:31:16 -06:00
David Garske
e1baf27831 CID444418. Fix for finishSz checking with TLSv1.3 and WOLFSSL_HAVE_TLS_UNIQUE. 2024-12-24 13:38:57 -08:00
JacobBarthelmeh
17c17cde13 Merge pull request #8317 from night1rider/CID_444416
Free Val and Oid before returning error
2024-12-24 10:38:26 -07:00
JacobBarthelmeh
838fe22e61 Merge pull request #8314 from SparkiDev/aarch64_no_crypto_fallback
Aarch64 ASM: check CPU features before hw crypto instr use
2024-12-24 10:15:23 -07:00
JacobBarthelmeh
98d212d60b Merge pull request #8315 from SparkiDev/regression_fixes_16
Regression testing fixes
2024-12-24 09:56:20 -07:00
msi-debian
545257e498 CID 444416 2024-12-24 09:35:40 -07:00
JacobBarthelmeh
3aa2881cd4 account for rsa_pss_rsae vs rsa_pss_pss type 2024-12-23 23:45:33 -07:00
Sean Parkinson
cad2ebde04 Regression testing fixes
test.c: Dilithium private key not available in cert_test.h unless
signing is enabled.
./configure --disable-shared --enable-dilithium=make,44,65,87
./configure --disable-shared --enable-dilithium=make,sign,44,65,87
./configure --disable-shared --enable-dilithium=make,verify,44,65,87
test.c: Dilithium doesn't have decode/encode when
WOLFSSL_DILITHIUM_NO_ASN1 is defined.
./configure --disable-shared --enable-dilithium=yes
CFLAGS=-DWOLFSSL_DILITHIUM_NO_ASN1
2024-12-24 13:55:21 +10:00
Sean Parkinson
e1851cd482 Aarch64 ASM: check CPU features before hw crypto instr use
For SHA-256, SHA-512 and SHA3, get the CPU features to see if hardware
crypto is available. If not then fallback to an alternate
implementation.
2024-12-24 12:08:12 +10:00
Sean Parkinson
93812e4286 Merge pull request #8289 from JacobBarthelmeh/harden
add option for additional sanity checks
2024-12-24 09:17:08 +10:00
JacobBarthelmeh
ee9b88541f change default to no for --enable-faultharden 2024-12-23 13:51:30 -07:00
Daniel Pouzzner
a13d0fdd86 Merge pull request #8311 from SparkiDev/aarch64_cpuid_fix
Aarch64 CPU id: fix for privilege instruction detection
2024-12-23 11:52:14 -06:00
JacobBarthelmeh
2409971b14 Merge pull request #8224 from julek-wolfssl/dtls-server-demux
DTLS: Add server side stateless and CID QoL API
2024-12-23 10:01:01 -07:00
JacobBarthelmeh
36d5342f6b Merge pull request #8310 from douzzer/20241221-wolfCrypt-more-AES_BLOCK_SIZE
20241221-wolfCrypt-more-AES_BLOCK_SIZE
2024-12-23 09:26:05 -07:00
Sean Parkinson
e7d7e47e07 Aarch64 CPU id: fix for privilege instruction detection
AES/PMULL is in four bits 4-7.
When value is 0b0010, this indicates both AES and PMULL. Fix code to set
both.
2024-12-23 11:23:14 +10:00
David Garske
2bcad989da Merge pull request #8309 from douzzer/20241221-fix-CEscape-bounds-check
20241221-fix-CEscape-bounds-check
2024-12-21 14:51:46 -08:00
Daniel Pouzzner
50a0773c09 Merge pull request #8285 from LinuxJedi/gaisler
Add initial support for Gaisler-BCC with Sparc
2024-12-21 11:03:39 -06:00
Daniel Pouzzner
ed18bf3deb In wolfcrypt/src/port/ and IDE/, replace remaining uses of AES_BLOCK_SIZE with WC_AES_BLOCKSIZE for compatibility with OPENSSL_COEXIST.
Automated replacement with
```
git ls-files -z wolfcrypt/src/port/ IDE/ | xargs -0 pcre2grep -l '[^_]AES_BLOCK_SIZE' | xargs sed --regexp-extended --in-place 's/([^_])AES_BLOCK_SIZE/\1WC_AES_BLOCK_SIZE/g'
```

Checked for mis-transformations with
```
git ls-files -z | xargs -0 pcre2grep '[^-[()+*/[:space:]]WC_AES_BLOCK_SIZE' | less
```

Checked for residual hits with
```
git ls-files -z | xargs -0 pcre2grep '[^_]AES_BLOCK_SIZE' | less
```

Deliberately excluded:
* ChangeLog.md -- do not alter history.
* doc/ -- do not confuse documentation with newly prefixed macro, because AES_BLOCK_SIZE is available unless -DOPENSSL_COEXIST.
* tests/api.c -- the unit tests deliberately use compatibility names, and are not compatible with -DOPENSSL_COEXIST.
* wrapper/CSharp/wolfSSL_CSharp/wolfCrypt.cs -- false positive hits on C# names.
* wrapper/CSharp/wolfCrypt-Test/wolfCrypt-Test.cs -- false positive hits on C# names.
* reference in wolfssl/wolfcrypt/aes.h that defines AES_BLOCK_SIZE when -UOPENSSL_COEXIST.
* reference in wolfssl/wolfcrypt/settings.h that defines WC_AES_BLOCK_SIZE for old FIPS when -UWC_AES_BLOCK_SIZE.
2024-12-21 10:28:18 -06:00
Daniel Pouzzner
4ff73b9024 wolfssl/wolfcrypt/aes.h: fix stray reference to AES_BLOCK_SIZE in def for GHASH_ONE_BLOCK(). 2024-12-21 10:08:17 -06:00
Daniel Pouzzner
33a47c1c04 Merge pull request #8265 from JacobBarthelmeh/armasm
armasm with opensslcoexist build
2024-12-21 10:06:27 -06:00
Daniel Pouzzner
b07f2cb461 wolfcrypt/src/coding.c: fix incorrect array bounds check in CEscape(), introduced in 8bbe8a7c8a (before which there was no bounds check at all). 2024-12-21 09:47:07 -06:00
Andrew Hutchings
231cea34ef Add initial support for Gaisler-BCC with Sparc
Slight modifications and documentation to get wolfSSL working with
Gaisler Sparc CPUs and their cross-compilers.
2024-12-21 09:19:58 +00:00
Daniel Pouzzner
ad20593569 Merge pull request #8279 from LinuxJedi/sk_push_comments
Fix code comments for some x509.c functions
2024-12-21 00:09:18 -06:00
Daniel Pouzzner
67800c3a22 Merge pull request #8292 from JacobBarthelmeh/xsocktlen
set dk-s7g2 socklent
2024-12-21 00:01:33 -06:00
Daniel Pouzzner
5ef4732745 Merge pull request #8299 from JacobBarthelmeh/cert_regen
end of year test certificate renewal
2024-12-20 17:41:33 -06:00
Daniel Pouzzner
9d3e477b63 src/ssl.c: gate wolfSSL_dtls_set_pending_peer() on !defined(WOLFSSL_NO_SOCK), not just defined(WOLFSSL_DTLS_CID).
tests/api.c: in test_dtls12_basic_connection_id(), omit chacha20 suites if defined(HAVE_FIPS), and fix gate on DHE-PSK-NULL-SHA256.
2024-12-20 17:24:13 -06:00
Daniel Pouzzner
afc7e0eb8c Merge pull request #8308 from cconlon/sessTickLenCheck
Remove dead code in TLSX_PopulateExtensions() around MAX_PSK_ID_LEN check
2024-12-20 16:41:09 -06:00
JacobBarthelmeh
961453b5ee fix for free'ing up memory after use 2024-12-20 14:58:57 -07:00
JacobBarthelmeh
b273bff4e9 regenerate certs_test.h with raw dilithium keys 2024-12-20 11:50:11 -07:00
JacobBarthelmeh
67f3343a5d Merge pull request #8306 from SparkiDev/kyber_no_avx2_fix
ML-KEM/Kyber: fix kyber_prf() for when no AVX2
2024-12-20 11:40:46 -07:00
JacobBarthelmeh
7cebe95138 Merge pull request #8304 from SparkiDev/regression_fixes_15
Regression testing: fixes
2024-12-20 11:29:15 -07:00
JacobBarthelmeh
3dd9f4631d Merge pull request #8305 from kareem-wolfssl/zd19044
Fix a couple of missing bounds checks found via code analyzer.
2024-12-20 11:20:19 -07:00
JacobBarthelmeh
19e68ea71a add a faketime test and update cert buffers 2024-12-20 10:35:58 -07:00
Chris Conlon
f68f99b000 Remove dead code in TLSX_PopulateExtensions() around MAX_PSK_ID_LEN check 2024-12-20 09:48:01 -07:00
Sean Parkinson
e507c466d5 ML-KEM/Kyber: fix kyber_prf() for when no AVX2
When no AVX2 available, kyber_prf() is called to produce more than one
SHAKE-256 blocks worth of ouput. Otherwise only one block is needed.
Changed function to support an outlen of greater than one block.
2024-12-20 11:03:58 +10:00
Kareem
8bbe8a7c8a Fix a couple of missing bounds checks found via code analyzer. 2024-12-19 17:01:25 -07:00
Sean Parkinson
b7c1e1cf35 Regression testing: fixes
src/x509.c: wolfssl_x509_name_entry_set() ne->object is freed if call to
wolfSSL_OBJ_nid2obj_ex() fails. Always assign directly back to
ne->object.

wolfcrypt/test/test.c: aes_ctr_test() doesn't need AES decrypt
./configure '--disable-shared' '--enable-cryptonly'
'CFLAGS=-DNO_AES_DECRYPT' '--disable-aescbc' '--disable-aesofb'
'--disable-aescfb' '--disable-aesgcm' '--disable-aesccm'
'--enable-aesctr' '--disable-aesxts' '--disable-aeseax'

tests/api.c: test_X509_STORE_InvalidCa() only defined when !NO_RSA
./configure '--disable-shared' '--enable-opensslall' '--disable-rsa'

tests/api.c: test_wolfSSL_GENERAL_NAME_print() free ridObj if not
assigned into gn.
2024-12-20 09:25:03 +10:00
Sean Parkinson
00f83facb2 Merge pull request #8302 from cconlon/sessTickLenCheck
Loosen MAX_PSK_ID_LEN check in TLSX_PopulateExtensions() to only server side
2024-12-20 08:44:10 +10:00
JacobBarthelmeh
8ca790218c certs_test.h is using raw dilithium keys 2024-12-19 15:23:37 -07:00