7529 Commits

Author SHA1 Message Date
David Garske
65c9277213 More fixes from Jenkins testing. 2018-04-24 14:01:33 -07:00
toddouska
ff1559275d
Merge pull request #1512 from dgarske/c99
Fixes to resolve issues with c99 compliance
2018-04-24 13:36:41 -07:00
toddouska
1ddccf63dc
Merge pull request #1496 from JacobBarthelmeh/Compatibility-Layer
Compatibility layer
2018-04-24 13:33:33 -07:00
David Garske
e63afa08bd Fix a couple of minor Jenkins issues. 2018-04-24 13:25:28 -07:00
David Garske
56025f38b9 Enhancements and cleanup to ASN date/time:
* Refactor the ASN get date logic to combine shared code.
* Added new API `wc_GetDateInfo` to get raw date, format and length.
* Added new API `wc_GetCertDates` to extract certificate before/after dates as `struct tm` type.
* Added new API `wc_GetDateAsCalendarTime` which parses the raw date string and convers to `struct tm`.
* Added tests for new API's.
* Added missing tests for `wc_SetAltNames`, `wc_SetAltNamesBuffer` and `wc_SetDatesBuffer`.
* Fixed build for older `NO_TIME_H` macro.
2018-04-24 13:04:36 -07:00
David Garske
b48a9ded15 Fix to allow user to force build using WOLF_C99 option. 2018-04-23 13:52:58 -07:00
David Garske
289a282183 Fixes to resolve issues with c99 compliance (building with ./configure CFLAGS="-std=c99").
* Fix for ReadDir checking for file flag to use `S_ISREG(ctx->s.st_mode)` syntax.
* Added macro for strsep `XSTRSEP`. Added wolf implementation as `wc_strsep` enabled as C99 or `USE_WOLF_STRSEP`.
* Fix to use `gethostbyname` for c99 instead of `getaddrinfo`.
* For c99 use wolf strtok `wc_strtok`.
* Exposed API's for `wc_strtok` and `wc_strsep` when available.
* Include `sys/time.h` when available from autocon `HAVE_SYS_TIME_H` or c99.
* include `<strings.h>` when `HAVE_STRINGS_H` or c99.
2018-04-23 13:47:22 -07:00
Eric Blankenhorn
568d24c63c Coverity fixes (#1509)
* Coverity fixes 3
2018-04-23 09:20:28 -07:00
John Safranek
9831a8ac94 Added a dist-hook target to the Makefile to copy the default options.h.in over options.h. 2018-04-20 11:07:57 -07:00
thivyaashok
7d425a5ce6 Added support for an anonymous cipher suite (#1267)
* Added support for cipher suite TLS_DH_anon_WITH_AES256_GCM_SHA384
* Added test cases for verification of anonymous cipher suite
2018-04-20 10:35:37 -07:00
thivyaashok
853756a73c Added a TLS alert message 115 (#1391)
Added a new TLS alert message `unknown_psk_identity` (115) from RFC 4279,  section 2.
2018-04-20 10:23:57 -07:00
Sean Parkinson
94157634e1 TLS 1.3 fixes/improvements
Support Draft 28: able to compile code to return BAD_BINDER if no PSKs
match and certificates not to be used.
Change key share implementation to use server preference - server now
checks each client key share's group is in supported_groups extension.
Client and server examples modified to support server preference.
Application can set client's and server's supported groups by rank.
Server's supported groups is sent back in encrypted_extensions if
preferred group is not in client's list - able to be turned off at
compile time.
Application can query server's preferred group from client.
Able to compile using 0x0304 as version instead of draft version.
Fix state machine in TLS 1.3 to support unexpected hello_retry_request.
Also fixes non-blocking.
Fix resumption to use the named group from session.
Fix named group in session structure to be a 2-byte field.
Better detection of errors in message flow.
Fix DoTls13ClientHello when downgrading - don't do TLS 1.3 things.
Not downgrading on client fixed.
Downgrade protocol version from TLS 1.3 when not TLS 1.3 ciphersuite.
Get downgrading from TLS 1.3 and resumption working.
Change earlyData value to an enum.
Support no extensions data (as opposed to zero length extension data) in
TLS 1.3 ClientHello.
Check PSK cipher suite is available to both client and server before
using.
Check first PSK identity chosen when server says it is using early data
at client.
Check PSK extension is last in client_hello on server.
Check the PSK cipher suite to use is supported on client.
Check the returned cipher suite for pre-shared keys is the same as
client expects.
Send alert decrypt_error when verification fails in certificate_verify
or finished message doesn't match calculated value.
Fail when certificate messages recieved in handshake when using PSK.
Validate on the server that EndOfEarlyData message has been recieved
before finished message when server sent EarlyData extension.
2018-04-20 09:44:02 +10:00
kaleb-himes
3476a9b55a versions for Baxter updated, new tag in fips v3.12.6 2018-04-19 15:24:22 -06:00
David Garske
9e4bb3fee1
Merge pull request #1504 from SparkiDev/nginx-pemenc
Key derivation for encrypted PEM uses salt length of 8 in OpenSSL
2018-04-19 11:23:39 -07:00
David Garske
f7cb5c5c15
Merge pull request #1507 from kaleb-himes/README-update
Bring special notes inline with commit 8edbca1b21b6fcd6d09910c66bbf35…
2018-04-19 11:17:25 -07:00
JacobBarthelmeh
b7c61a72c8
Merge pull request #1503 from kojo1/Ticket3793
HMAC with SHA2
2018-04-19 09:38:55 -06:00
kaleb-himes
23615dd15f Bring special notes inline with commit 8edbca1b21b6fcd6d09910c66bbf355440720100 2018-04-18 09:58:03 -06:00
Takashi Kojo
bf950198f2 api.c: option conditions 2018-04-18 13:02:40 +09:00
Sean Parkinson
6689ee965a Key derivation for encrypted PEM uses salt length of 8 in OpenSSL 2018-04-18 12:37:06 +10:00
Takashi Kojo
7c7913264b remove printf 2018-04-18 09:25:24 +09:00
Takashi Kojo
56af3a5b36 add HMAC SHA2 2018-04-18 08:47:39 +09:00
Jacob Barthelmeh
57d40bc6d1 remove internal data types in ssl.h 2018-04-17 15:57:23 -06:00
John Safranek
11065f9222 added the missing macro file ax_require_defined.m4. 2018-04-17 13:23:17 -07:00
brian@tangent.org
48b3aa90d3 Update autoconf m4 files, except pthreads which should be its own commit 2018-04-17 13:20:33 -07:00
John Safranek
a116b5ba83
Merge pull request #1500 from BrianAker/patch-1
Adding Copyright notice to autoconf files.
2018-04-17 11:15:36 -07:00
toddouska
09706a4ed2
Merge pull request #1488 from SparkiDev/tls13_perf
Changes for interop and performance
2018-04-16 09:16:13 -07:00
Brian Aker
3179d6ce2b
Adding Copyright notice to autoconf files. 2018-04-14 22:30:02 -10:00
toddouska
942c720dc4
Merge pull request #1499 from ejohnstown/aes-asm
AES assembly file name change
2018-04-13 11:23:03 -07:00
Jacob Barthelmeh
f9eda5d790 free test certificate after use 2018-04-13 09:16:22 -06:00
Eric Blankenhorn
a0d8327320 Coverity fixes 2 (#1493)
* Coverity fixes for wolfcrypt folder
* Fixes for remaining issues
* Fixes for test files
2018-04-13 05:35:18 -07:00
Sean Parkinson
9600266483 WOLFSSL_FUNC_TIME changes
Warning in code about using this define.
Remove usage of WOLFSSL_FUNC_TIME from server.c.
2018-04-13 12:13:31 +10:00
Sean Parkinson
0b47811c46 Changes for interop and performance
Changes made to test.h to allow interop of PSK with OpenSSL.
Changes to allow server to pre-generate key share and perform other
operations at later time.
Fix ChaCha20 code header to have bigger state to support assembly code
for AVX1.
Fix Curve25519 code to use define instead.
Change Curve25519 to memset all object data on init.
Change Poly1305 to put both sizes into one buffer to avoid a second call
to wc_Poly1305Update().
Added WOLFSSL_START and WOLFSSL_END API and calls to show time of
protocol message function enter and leave to analyse performance
differences.
Moved Curve25519 code in KeyShare extension out of general ECC code.
2018-04-13 12:01:20 +10:00
John Safranek
425cee64a7 AES assembly file name change
Some versions of GCC on the Mac will not run the file aes_asm.s through the preprocessor. There are some ifdefs in the file that are included when they shouldn't be. This is not a problem on Linux. Renaming the file to have a capital S extension forces the assembler to run with the preprocessor.
2018-04-12 16:47:58 -07:00
toddouska
84f7bd8cde
Merge pull request #1494 from dgarske/wpas
Fix for building wpa_supplicant
2018-04-12 13:49:31 -07:00
toddouska
eacd98fe4e
Merge pull request #1491 from dgarske/config
Configure improvements and new options
2018-04-12 13:48:20 -07:00
toddouska
8f1e8be2d0
Merge pull request #1490 from dgarske/hashoid_cleanup
Hash OID cleanup
2018-04-12 13:46:47 -07:00
Jacob Barthelmeh
cfaed48f90 adjust GetInt call with ASN1 integer to big number 2018-04-12 14:40:20 -06:00
Jacob Barthelmeh
df06707496 Handle larger values with ASN1 INTEGER structure 2018-04-12 14:07:29 -06:00
David Garske
cf1230d232 Fix for building wpa_supplicant (./configure --enable-wpas) after PemToDer refactor in PR #1467. 2018-04-12 06:53:44 -07:00
David Garske
1f7b954d47 Fix for wc_GetCTC_HashOID in FIPS mode. Uses the new wc_HashTypeConvert to handle conversion from unique WC_ALGO (int) to WC_HASH_TYPE_ALGO (enum wc_HashType). 2018-04-12 06:51:23 -07:00
David Garske
ce6728951f Added a new --enable-opensslall option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build. 2018-04-11 13:54:07 -07:00
David Garske
689203d310 Added some more features to the --enable-all. Added new --enable-webclient option. 2018-04-11 13:54:07 -07:00
David Garske
ee5d78f84f Added new wc_OidGetHash API for getting the hash type from a hash OID. Refactor PKCS7 and PKCS12 to use new API and reduce duplicate ocde. Updated wc_GetCTC_HashOID to use wc_HashGetOID and maintain back compat. 2018-04-11 13:53:30 -07:00
toddouska
d85580691b
Merge pull request #1492 from dgarske/fix_noasn_pwdbased
Fixes for ASN disabled and PWDBASED enabled / Win FIPS
2018-04-11 12:09:30 -07:00
David Garske
83bfdb1594 Fix for issue with unique hash types on ctoacrypt FIPS using different values than WC_HASH_TYPE_*. Add new API wc_HashTypeConvert to handle the conversion between enum wc_HashType and int. For FIPS it uses a switch() to convert and for non-FIPS it uses a simple cast. Changed the pwdbased_test to return actual ret instead of adding values (made it difficult to track down error location). 2018-04-11 09:30:30 -07:00
David Garske
3f3e332a3a Fix for evp.c statement will never be executed in wolfSSL_EVP_CIPHER_CTX_block_size. 2018-04-11 08:18:39 -07:00
David Garske
38aa56cc40 Fix for Windows FIPS build in current master. Resolves issue with missing DES/AES key size enums. 2018-04-10 20:07:14 -07:00
David Garske
565f394972 Fix for building without ASN and PWDBASED enabled (./configure --disable-asn --enable-pwdbased). 2018-04-10 16:36:11 -07:00
toddouska
e25da80766
Merge pull request #1467 from dgarske/asnpemtoder
PEM Encrypted Keys cleanup and PemToDer move to wolfCrypt asn.c
2018-04-09 16:33:30 -07:00
David Garske
a38576146e * Added support for disabling PEM to DER functionality using WOLFSSL_PEM_TO_DER. This allows way to use with DER (ASN.1) certificates only in an embedded environment. This option builds, but internal make check requires PEM support for tests.
* More cleanup to move PEM functions from ssl.c to asn.c (`wolfSSL_CertPemToDer`, `wolfSSL_KeyPemToDer`, `wolfSSL_PubKeyPemToDer`). Renamed these API's to `wc_` and added backwards compatability macro for old function names.
2018-04-09 13:28:15 -07:00