Marco Oliverio 44a22af323 Handle wildcard DNS names in compat name-constraint checks ...

MatchNameConstraint() compared wildcard DNS SANs literally, so
*.example.com was not rejected by an excluded subtree covering
foo.example.com. Route WOLFSSL_GEN_DNS through
wolfssl_local_MatchDnsNameConstraint(), passing the subtree direction:
permitted subtrees require every wildcard expansion to stay inside the
subtree, excluded subtrees reject when any expansion can fall inside.
This matches what ConfirmNameConstraints() already does.

2026-06-15 12:10:40 +02:00

..

bio.c

Merge pull request #10208 from ColtonWilley/bio-io-negative-length-checks

2026-05-05 11:32:21 -07:00

conf.c

Make sure large buffers are on the heap with SMALL_STACK

2026-04-19 20:38:41 +02:00

crl.c

Regression testing fixes - memory allocation failure testing

2026-06-11 12:14:06 +10:00

dtls13.c

Merge pull request #10652 from SparkiDev/regression_fixes_25

2026-06-12 16:30:57 -06:00

dtls.c

Cache AEAD record overhead on WOLFSSL

2026-05-28 16:19:44 +02:00

include.am

ssl.c: Move functions out to own files and add testing

2026-06-10 09:11:59 +10:00

internal.c

Merge pull request #10582 from julek-wolfssl/fenrir-20260602

2026-06-11 15:29:51 -07:00

keys.c

Cache AEAD record overhead on WOLFSSL

2026-05-28 16:19:44 +02:00

ocsp.c

Regression testing fixes - memory allocation failure testing

2026-06-11 12:14:06 +10:00

pk_ec.c

Add d2i NULL-deref guards and regression tests

2026-05-27 15:38:30 -07:00

pk_rsa.c

Size cert signature buffers from the key and check sig type vs key

2026-06-10 10:51:41 +02:00

pk.c

F-4591: fix right-justification of short DH shared secret

2026-06-03 13:01:19 +02:00

quic.c

add missing WOLFSSL_QUIC_MAX_RECORD_CAPACITY check on the early-data path in quic_record_make() and added a unit test for it

2026-04-14 12:43:19 +02:00

sniffer.c

zero sensitive material before free

2026-05-14 16:59:48 +00:00

ssl_api_cert.c

ssl.c: Move functions out to own files and add testing

2026-06-10 09:11:59 +10:00

ssl_api_crl_ocsp.c

Add bounds check on wolfSSL_X509_notBefore and wolfSSL_X509_notAfter

2026-03-31 09:29:46 -07:00

ssl_api_dtls.c

ssl.c: Move functions out to own files and add testing

2026-06-10 09:11:59 +10:00

ssl_api_ext.c

src/ssl_api_ext.c and src/ssl_api_pk.c: restore early BAD_FUNC_ARG returns that were refactored away in 359e688dc3, fixing null pointer deref regression in wolfSSL_UseALPN() (possibly others too).

2026-06-10 12:05:00 -05:00

ssl_api_pk.c

src/ssl_api_ext.c and src/ssl_api_pk.c: restore early BAD_FUNC_ARG returns that were refactored away in 359e688dc3, fixing null pointer deref regression in wolfSSL_UseALPN() (possibly others too).

2026-06-10 12:05:00 -05:00

ssl_asn1.c

Merge pull request #10207 from ColtonWilley/d2i_pem_negative_length

2026-06-08 15:42:00 -07:00

ssl_bn.c

Add BN_bn2binpad API and enable OpenVPN master CI testing

2026-04-13 15:35:40 +02:00

ssl_certman.c

Finalize ML-DSA renaming

2026-05-26 14:54:30 +02:00

ssl_crypto.c

cryptocb: support WOLF_CRYPTO_CB_ONLY_SHA512

2026-06-04 20:21:50 +02:00

ssl_ech.c

Merge pull request #10469 from sebastian-carpenter/tls-ech-server-improvements

2026-05-23 00:07:40 +10:00

ssl_load.c

Add negative length validation to d2i wrappers, PEM helpers, and buffer loaders

2026-05-27 11:36:38 -07:00

ssl_misc.c

nginx 1.28.1

2026-02-25 15:19:13 +01:00

ssl_p7p12.c

honor OpenSSL fail-open contracts

2026-05-14 16:59:12 +00:00

ssl_sess.c

Check SNI/ALPN in TLS 1.2 stateful session ID resumption

2026-05-27 09:16:34 -04:00

ssl_sk.c

Add Python CI workflow and Blake2 EVP support

2026-03-06 08:27:41 +01:00

ssl.c

Merge pull request #10639 from julek-wolfssl/fix-current-cipher-kx-nid

2026-06-10 14:50:02 -07:00

tls13.c

Merge pull request #10652 from SparkiDev/regression_fixes_25

2026-06-12 16:30:57 -06:00

tls.c

Merge pull request #10652 from SparkiDev/regression_fixes_25

2026-06-12 16:30:57 -06:00

wolfio.c

Merge pull request #10290 from LinuxJedi/emnet

2026-05-05 11:46:15 -07:00

x509_str.c

x509: harden wolfSSL_X509_verify_cert() against alloc failure and stack pollution

2026-06-12 17:29:31 +02:00

x509.c

Handle wildcard DNS names in compat name-constraint checks

2026-06-15 12:10:40 +02:00