wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-05 15:10:48 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
79b30aa2683954a61548d29cb5b37e65ee2e215f
wolfssl/tests/api
T
History
Tobias Frauenschläger 79b30aa268 Enable support for mandatory PSKs 
Add a new option to require that an external Pre-Shared Key is negotiated
for a handshake to succeed, configured via the new APIs
wolfSSL_CTX_require_psk()/wolfSSL_require_psk(). When set, a handshake
that completes without negotiating an external PSK is aborted with
PSK_MISSING_ERROR instead of falling back to a certificate handshake, so
the PSK acts as an additional security factor.

This is a TLS 1.3 / DTLS 1.3 feature. In (D)TLS 1.2 the use of a PSK is
determined by the negotiated cipher suite, so a mandatory PSK is instead
configured there by restricting the cipher suite list to PSK suites; the
new APIs therefore reject non-TLS-1.3 contexts with BAD_FUNC_ARG.

To keep the requirement fail-closed, the APIs also disable version
downgrade on the object so a downgrade-capable context (e.g. one created
from a v23 method) cannot silently fall back to (D)TLS 1.2 and complete
without a PSK; a peer that does not support (D)TLS 1.3 fails to connect.

The requirement applies to external PSKs only (not session tickets):
session-ticket resumption is exempt. To preserve forward secrecy a
mandatory external PSK must also use an (EC)DHE key exchange; a pure
psk_ke handshake is rejected with PSK_KEY_ERROR. When used with
WOLFSSL_CERT_WITH_EXTERN_PSK, it also ensures that peers are properly
authenticated with both the PSK and via certificates.

The new APIs live alongside the existing wolfSSL_[CTX_]no_dhe_psk()/
only_dhe_psk() PSK options and do not depend on certificate support, so
the feature is usable in NO_CERTS (PSK-only) builds.

Added unit tests for the new APIs and enforcement.
2026-07-02 16:02:20 +02:00
..
api_decl.h
update Copyright year
2026-02-18 09:52:21 -07:00
api.h
remove unnecessary check, idx will be 1 and derSz is at least 5
2026-05-13 16:32:54 -06:00
create_ocsp_test_blobs.py
Remove non-RFC-compliant OCSP responder chain walk. The chain walk
2026-06-02 16:20:37 -06:00
include.am
ssl.c: Move functions out to own files and add testing
2026-06-10 09:11:59 +10:00
test_aes.c
fixes for F-3325:
2026-06-11 15:38:28 -05:00
test_aes.h
add AEAD bad tag tests
2026-05-12 20:59:29 +00:00
test_arc4.c
Ensure a key is set for ARC4 operations
2026-06-10 11:36:29 +02:00
test_arc4.h
Ensure a key is set for ARC4 operations
2026-06-10 11:36:29 +02:00
test_ascon_kats.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ascon.c
Merge pull request #10155 from aidangarske/fenrir-fixes-2
2026-05-11 21:07:53 -07:00
test_ascon.h
API tests: more cipher tests
2026-04-15 17:05:32 +10:00
test_asn.c
Merge pull request #10793 from embhorn/gh10790
2026-07-01 17:49:37 -05:00
test_asn.h
Reject duplicate certificatePolicies extension in WOLFSSL_CERT_EXT builds
2026-06-17 19:14:21 +02:00
test_blake2.c
globally fix all "BLAKE2" references (implicit BLAKE2B) to explicit "BLAKE2B":
2026-04-07 13:18:53 -05:00
test_blake2.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_camellia.c
initiallize camellia variable
2026-05-13 09:01:20 -06:00
test_camellia.h
tests: cover input validation fixes
2026-05-07 02:31:25 +00:00
test_certman.c
Merge pull request #10787 from stenslae/update-wolfssl-email
2026-07-01 17:52:20 -05:00
test_certman.h
add regression tests for name-constraint ancestor walk
2026-06-18 14:52:08 -06:00
test_chacha20_poly1305.c
add AEAD bad tag tests
2026-05-12 20:59:29 +00:00
test_chacha20_poly1305.h
add AEAD bad tag tests
2026-05-12 20:59:29 +00:00
test_chacha.c
API tests: more cipher tests
2026-04-15 17:05:32 +10:00
test_chacha.h
API tests: more cipher tests
2026-04-15 17:05:32 +10:00
test_cmac.c
Gate out all of the newly added AES-CMAC tests for FIPS as none of them will apply to the old FIPS AES-CMAC code.
2026-05-14 15:19:56 -07:00
test_cmac.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_curve448.c
Enable all-zero shared secret check for curve448/25519 by default. Change macro to opt-out macro WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK. Add unit test.
2026-05-13 17:02:08 -07:00
test_curve448.h
Enable all-zero shared secret check for curve448/25519 by default. Change macro to opt-out macro WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK. Add unit test.
2026-05-13 17:02:08 -07:00
test_curve25519.c
Merge pull request #10751 from aidangarske/tinytls13
2026-07-01 15:21:04 +02:00
test_curve25519.h
X25519 x64 ASM: fix full reduction
2026-06-01 09:14:57 +10:00
test_des3.c
Ensure a key is set for DES3 operations
2026-06-10 11:36:59 +02:00
test_des3.h
Ensure a key is set for DES3 operations
2026-06-10 11:36:59 +02:00
test_dh.c
FIPS: Default to 2048 bit min DH crypto
2026-07-01 08:26:23 -06:00
test_dh.h
dh: fix subgroup check in wc_DhAgree.
2026-06-10 01:28:12 -05:00
test_digest.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_dsa.c
misc_fixes: cleanup for skoll review.
2026-06-12 00:12:45 -05:00
test_dsa.h
Validate DSA parameters when verifying DSA key.
2026-05-11 10:05:45 -07:00
test_dtls13.c
Merge pull request #10773 from rlm2002/coverity
2026-07-01 17:59:19 -05:00
test_dtls13.h
dtlsv13: fix: send correct CH2 when server do not send HRR
2026-06-18 13:46:08 +02:00
test_dtls.c
Merge pull request #10773 from rlm2002/coverity
2026-07-01 17:59:19 -05:00
test_dtls.h
ssl.c: Move functions out to own files and add testing
2026-06-10 09:11:59 +10:00
test_ecc.c
add macro guard around new test case for specific builds
2026-06-18 00:48:26 -06:00
test_ecc.h
SP math: validate ECDH shared-secret output buffer against the field size
2026-06-16 20:56:45 +02:00
test_ed448.c
Fix Ed448/25519 export private-only key unit tests for FIPS pre-v7
2026-06-12 15:58:27 -04:00
test_ed448.h
Reject small-order public keys for Ed25519 and Ed448
2026-05-28 19:53:19 +02:00
test_ed25519.c
Free RNG from updated Ed448/Ed25519 unit tests
2026-06-12 15:58:27 -04:00
test_ed25519.h
Reject small-order public keys for Ed25519 and Ed448
2026-05-28 19:53:19 +02:00
test_evp_cipher.c
Merge pull request #10364 from MarkAtwood/fix/evp-cipher-iv-length-cfb-ofb
2026-06-04 17:26:48 -05:00
test_evp_cipher.h
Fix review feedback
2026-03-05 08:51:52 -06:00
test_evp_digest.c
add unit test for NULL SHAKE parameters
2026-05-06 15:25:06 -06:00
test_evp_digest.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_evp_pkey.c
Regression testing fixes
2026-06-04 18:29:24 +10:00
test_evp_pkey.h
Add NID_X25519 and NID_X448 support to the EVP layer
2026-05-28 14:40:36 +00:00
test_evp.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_evp.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_hash.c
PQ FIPS v7.0.0 Phase 2 & 3: All changes
2026-04-24 06:52:49 -06:00
test_hash.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_hmac.c
misc_fixes: cleanup for skoll review.
2026-06-12 00:12:45 -05:00
test_hmac.h
Fix issue in TLS_hmac size calculation
2026-02-26 10:26:20 -06:00
test_lms_xmss.c
Ignore return from remove() function in tests with (void)
2026-06-25 14:44:03 -06:00
test_lms_xmss.h
Support RFC 9802 LMS and XMSS in X.509 certificate and CSR generation
2026-06-10 10:51:33 +02:00
test_md2.c
update MD2 functions to return int instead of void
2026-05-13 11:36:36 -06:00
test_md2.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_md4.c
update MD4 return from void to int
2026-05-13 11:36:36 -06:00
test_md4.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_md5.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_md5.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_mldsa_legacy.c
Regression testing fixes
2026-06-04 18:29:24 +10:00
test_mldsa.c
api.c: move out tests into other files
2026-05-28 19:34:09 +10:00
test_mldsa.h
api.c: move out tests into other files
2026-05-28 19:34:09 +10:00
test_mlkem.c
add PQ key integrity tests
2026-05-12 20:59:29 +00:00
test_mlkem.h
add PQ key integrity tests
2026-05-12 20:59:29 +00:00
test_ocsp_test_blobs.h
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_ocsp.c
Merge pull request #10532 from rlm2002/zd21800
2026-06-05 16:27:00 -05:00
test_ocsp.h
Merge pull request #10532 from rlm2002/zd21800
2026-06-05 16:27:00 -05:00
test_ossl_asn1.c
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_ossl_asn1.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_bio.c
BIO: reject negative length in memory BIO read
2026-06-16 20:56:45 +02:00
test_ossl_bio.h
BIO: reject negative length in memory BIO read
2026-06-16 20:56:45 +02:00
test_ossl_bn.c
Add tests for BN_bn2binpad with zero output length
2026-04-13 15:50:26 +02:00
test_ossl_bn.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_cipher.c
Ensure a key is set for ARC4 operations
2026-06-10 11:36:29 +02:00
test_ossl_cipher.h
tests
2026-05-07 02:33:58 +00:00
test_ossl_dgst.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_dgst.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_dh.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_dh.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_dsa.c
wolfcrypt: add additional enforcement of correct digest sizes in signature gen and verify ops:
2026-04-06 00:53:57 -05:00
test_ossl_dsa.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_ec.c
Add d2i NULL-deref guards and regression tests
2026-05-27 15:38:30 -07:00
test_ossl_ec.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_ecx.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_ecx.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_mac.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_mac.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_obj.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_obj.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_p7p12.c
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_ossl_p7p12.h
PKCS7: tighten signature presence check in PKCS7_verify
2026-06-16 20:19:22 +02:00
test_ossl_pem.c
Ignore return from remove() function in tests with (void)
2026-06-25 14:44:03 -06:00
test_ossl_pem.h
Refactor - Split test to two different functions
2026-05-22 19:24:53 +03:00
test_ossl_rand.c
honor OpenSSL fail-open contracts
2026-05-14 16:59:12 +00:00
test_ossl_rand.h
honor OpenSSL fail-open contracts
2026-05-14 16:59:12 +00:00
test_ossl_rsa.c
F-3888: add negative tests for tampered RSA signatures/hashes
2026-06-08 14:21:53 +02:00
test_ossl_rsa.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_sk.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_sk.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_acert.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_acert.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_crypto.c
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_ossl_x509_crypto.h
evp: support ML-DSA in wolfSSL_EVP_PKCS82PKEY() and wolfSSL_X509_check_private_key()
2026-05-22 14:56:14 -06:00
test_ossl_x509_ext.c
Handle wildcard DNS names in compat name-constraint checks
2026-06-15 12:10:40 +02:00
test_ossl_x509_ext.h
X509 API: fix issues
2026-06-01 09:57:19 +10:00
test_ossl_x509_info.c
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_ossl_x509_info.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_io.c
Harden X509 DER length handling in wolfSSL_X509_get_der and wolfSSL_i2d_X509
2026-06-04 10:38:37 -07:00
test_ossl_x509_io.h
Harden X509 DER length handling in wolfSSL_X509_get_der and wolfSSL_i2d_X509
2026-06-04 10:38:37 -07:00
test_ossl_x509_lu.c
src/x509.c: refactor wolfSSL_PEM_read_bio_X509_CRL onto the per-block reader
2026-04-28 10:06:47 +00:00
test_ossl_x509_lu.h
src/x509.c: refactor wolfSSL_PEM_read_bio_X509_CRL onto the per-block reader
2026-04-28 10:06:47 +00:00
test_ossl_x509_name.c
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_ossl_x509_name.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_pk.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_pk.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_str.c
adjust test case macro guard for ALLOW_INVALID_CERTSIGN builds
2026-06-18 08:20:33 -06:00
test_ossl_x509_str.h
certman: enforce keyCertSign usage on chain-supplied intermediate CAs
2026-06-16 20:31:36 +02:00
test_ossl_x509_vp.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509_vp.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_ossl_x509.c
Merge pull request #10787 from stenslae/update-wolfssl-email
2026-07-01 17:52:20 -05:00
test_ossl_x509.h
Restore error code from DecodeGeneralName
2026-06-26 11:11:22 -05:00
test_pkcs7.c
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_pkcs7.h
Harden PKCS#7 FlattenEncodedAttribs
2026-06-08 09:26:29 -05:00
test_pkcs12.c
tests/api/test_pkcs12.c, tests/api/test_pwdbased.c: add missing FIPS version gates to test_wc_PKCS12_PBKDF(), test_wc_PKCS12_PBKDF_ex(), and test_wc_PBKDF1_ex_iterations();
2026-06-01 14:23:38 -05:00
test_pkcs12.h
PKCS12: check mismatch between hash algo and hash size
2026-04-15 03:08:50 +02:00
test_poly1305.c
API testing additions: cipher tests
2026-04-10 15:43:21 +10:00
test_poly1305.h
API testing additions: cipher tests
2026-04-10 15:43:21 +10:00
test_pwdbased.c
tests/api/test_pkcs12.c, tests/api/test_pwdbased.c: add missing FIPS version gates to test_wc_PKCS12_PBKDF(), test_wc_PKCS12_PBKDF_ex(), and test_wc_PBKDF1_ex_iterations();
2026-06-01 14:23:38 -05:00
test_pwdbased.h
fix clamp iterations <= 0 to 1 instead of returning an error
2026-05-20 07:25:35 -07:00
test_random.c
Addressed Copilot comments
2026-06-04 15:30:39 +09:00
test_random.h
Add MAX ENTROPY BITS check
2026-06-04 09:08:24 +09:00
test_rc2.c
Add wc_Rc2Free for key zeroization
2026-05-12 20:57:31 +00:00
test_rc2.h
Add wc_Rc2Free for key zeroization
2026-05-12 20:57:31 +00:00
test_ripemd.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_ripemd.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_rsa.c
Testing: Guard RSA OversizedModulus test result by FIPS version
2026-06-25 08:16:06 -06:00
test_rsa.h
Fix potential mismatch in size between DECL_MP_INT_SIZE_DYN and NEW_MP_INT_SIZE. In some configurations DECL_MP_INT_SIZE_DYN will set the size to max while NEW_MP_INT_SIZE will memset bits.
2026-05-27 15:57:00 -07:00
test_session.c
api.c: move out tests into other files
2026-05-28 19:34:09 +10:00
test_session.h
api.c: move out tests into other files
2026-05-28 19:34:09 +10:00
test_sha3.c
SHAKE 128/256 callback wiring and tests, along with fix to devCTX initialization.
2026-06-22 13:35:37 -06:00
test_sha3.h
SHAKE 128/256 callback wiring and tests, along with fix to devCTX initialization.
2026-06-22 13:35:37 -06:00
test_sha256.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_sha256.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_sha512.c
cryptocb: support WOLF_CRYPTO_CB_ONLY_SHA512
2026-06-04 20:21:50 +02:00
test_sha512.h
cryptocb: support WOLF_CRYPTO_CB_ONLY_SHA512
2026-06-04 20:21:50 +02:00
test_sha.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_sha.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_she.c
wc_SHE_ImportM1M2M3: fix guard from || to && so it gates on WOLF_CRYPTO_CB
2026-04-15 18:03:39 -06:00
test_she.h
Fix CMake SHE deps, const-correctness in CryptoCb uid, stale comment, XSTRLEN double call, configure.ac AES-CBC guard, and add LoadKey/LoadKey_Verify test coverage
2026-04-15 11:28:03 -06:00
test_signature.c
fix f-1370 key_len size check for void* in wc_SignatureGetSize
2026-04-08 17:07:42 +09:00
test_signature.h
fix f-1370 key_len size check for void* in wc_SignatureGetSize
2026-04-08 17:07:42 +09:00
test_slhdsa.c
add PQ key integrity tests
2026-05-12 20:59:29 +00:00
test_slhdsa.h
HashSLH-DSA APIs now take the pre-hashed digest, not the raw message
2026-05-11 10:14:13 +02:00
test_sm2.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_sm2.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_sm3.c
update Copyright year
2026-02-18 09:52:21 -07:00
test_sm3.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_sm4.c
Unit testing: Add Monte Carlo testing to ciphers
2026-04-14 13:25:15 +10:00
test_sm4.h
Unit testing: Add Monte Carlo testing to ciphers
2026-04-14 13:25:15 +10:00
test_ssl_cert.c
tests/api/test_ssl_cert.c, tests/api/test_ssl_ext.c, tests/api/test_ssl_pk.c: add missing gates on !NO_TLS.
2026-06-10 12:05:00 -05:00
test_ssl_cert.h
ssl.c: Move functions out to own files and add testing
2026-06-10 09:11:59 +10:00
test_ssl_ext.c
FreePeerProtocol before freeing, clears potential resource leak (currently false positive)
2026-06-25 14:44:03 -06:00
test_ssl_ext.h
ssl.c: Move functions out to own files and add testing
2026-06-10 09:11:59 +10:00
test_ssl_pk.c
tests/api/test_ssl_cert.c, tests/api/test_ssl_ext.c, tests/api/test_ssl_pk.c: add missing gates on !NO_TLS.
2026-06-10 12:05:00 -05:00
test_ssl_pk.h
ssl.c: Move functions out to own files and add testing
2026-06-10 09:11:59 +10:00
test_tls13.c
Enable support for mandatory PSKs
2026-07-02 16:02:20 +02:00
test_tls13.h
Enable support for mandatory PSKs
2026-07-02 16:02:20 +02:00
test_tls_ext.c
updated email to facts@wolfssl.com
2026-06-26 14:44:16 -06:00
test_tls_ext.h
Merge pull request #10582 from julek-wolfssl/fenrir-20260602
2026-06-11 15:29:51 -07:00
test_tls.c
Fix to send record_overflow alert
2026-06-26 11:49:59 -05:00
test_tls.h
Fix to send record_overflow alert
2026-06-26 11:49:59 -05:00
test_wc_encrypt.c
API testing additions: cipher tests
2026-04-10 15:43:21 +10:00
test_wc_encrypt.h
API testing additions: cipher tests
2026-04-10 15:43:21 +10:00
test_wolfmath.c
wolfmath: check mpSz cleanup.
2026-05-11 12:09:50 -05:00
test_wolfmath.h
update Copyright year
2026-02-18 09:52:21 -07:00
test_x509.c
Regression testing fixes
2026-06-04 18:29:24 +10:00
test_x509.h
Fix wolfSSL_sk_X509_OBJECT_deep_copy to check bounds
2026-04-13 17:02:51 -05:00