3043 Commits

Author SHA1 Message Date
Daniel Pouzzner
106e39bd76 tests/api.c: in test_wc_CmacFinal(), don't use wc_CmacFinalNoFree() if FIPS <5.3. 2023-12-06 21:58:55 -06:00
Daniel Pouzzner
b14aba48af wolfcrypt/src/cmac.c: add wc_CmacFree(), revert wc_CmacFinal(), rename wc_CmacFinal() as wc_CmacFinalNoFree() removing its deallocation clauses, and add new wc_CmacFinal() that calls wc_CmacFinalNoFree() then calls wc_CmacFree() unconditionally, for compatibility with legacy client code (some of which may have previously leaked).
tests/api.c: modify test_wc_CmacFinal() to use wc_CmacFinalNoFree() except for the final call.

wolfcrypt/src/aes.c:
* fix wc_AesEaxEncryptAuth() and wc_AesEaxDecryptAuth() to call wc_AesEaxFree() only if wc_AesEaxInit() succeeded.
* fix wc_AesEaxInit() to free all resources on failure.
* revert wc_AesEaxEncryptFinal() and wc_AesEaxDecryptFinal() changes, then change wc_CmacFinal() calls in them to wc_CmacFinalNoFree() calls.
* wc_AesEaxFree(): add wc_CmacFree() calls.
2023-12-06 16:55:57 -06:00
Sean Parkinson
c6d6100136
Merge pull request #7010 from julek-wolfssl/dtls13-0.5-rtt
dtls13: Add support for 0.5-RTT data
2023-12-07 08:41:42 +10:00
Daniel Pouzzner
689a82a622 fix AES-related code, in both crypto and TLS layers, for various uninitialized data and resource leak defects around wc_AesInit() and wc_AesFree():
* followup to https://github.com/wolfSSL/wolfssl/pull/7009 "20231128-misc-fixes" and  https://github.com/wolfSSL/wolfssl/pull/7011 "Add missing wc_AesInit calls."

* adds WC_DEBUG_CIPHER_LIFECYCLE, which embeds asserts in low-level AES implementations for proper usage of wc_AesInit() and wc_AesFree().

* fixes native CMAC, AES-EAX, and AES-XTS implementations to assure resource release.

* adds missing wc_AesXtsInit() API, and adds a new wc_AesXtsSetKey_NoInit().

* fixes misspellings in EVP that unconditionally gated out AES-OFB and AES-XTS.

* fixes misspellings in EVP that unconditionally gated out AES-CBC and AES-CFB code in wolfSSL_EVP_CIPHER_CTX_cleanup_cipher().

* openssl compat AES low level cipher API has no counterpart to wc_AesFree(), so these compat APIs will now be gated out in configurations where they would otherwise leak memory or file descriptors (WOLFSSL_AFALG, WOLFSSL_DEVCRYPTO, WOLF_CRYPTO_CB, etc.).  A new macro, WC_AESFREE_IS_MANDATORY, is defined in wolfcrypt/aes.h to streamline this dependency.

* fixes 40 missing EVP_CIPHER_CTX_cleanup()s and 11 wc_AesFree()s in src/ssl.c, src/ssl_crypto.c, tests/api.c, and wolfcrypt/test/test.c.
2023-12-05 15:58:09 -06:00
JacobBarthelmeh
1857648d7d
Merge pull request #6976 from embhorn/gh6974
Fix build errors with dtls1.3 and no tls1.2
2023-12-04 14:53:35 -07:00
jordan
8c1ab783a1 Add missing wc_AesInit calls: small cleanup. 2023-11-29 18:02:45 -06:00
Juliusz Sosinowicz
3edfcfe162 Jenkins fixes 2023-11-29 23:17:10 +01:00
Juliusz Sosinowicz
9337cfbb16 Add wolfSSL_get_sigalg_info 2023-11-29 23:04:19 +01:00
Juliusz Sosinowicz
7c2344c389 Add API to get information about ciphersuites 2023-11-29 23:04:19 +01:00
Juliusz Sosinowicz
fbd8996949 Add API to choose dynamic certs based on client ciphers/sigalgs 2023-11-29 23:04:19 +01:00
jordan
3158e04863 Add missing wc_AesInit calls. 2023-11-29 12:54:28 -06:00
Juliusz Sosinowicz
c87339e5c3 dtls13: Add support for 0.5-RTT data 2023-11-29 15:55:59 +01:00
JacobBarthelmeh
5b3f5496f8
Merge pull request #6430 from kareem-wolfssl/memcached
Add memcached support.
2023-11-22 16:20:28 -07:00
Eric Blankenhorn
7223b5a708 Fix spelling warnings 2023-11-22 12:34:56 -06:00
JacobBarthelmeh
538ce14c62
Merge pull request #6953 from SKlimaRA/SKlimaRA/enable-ca-false
Enable encoding CA:FALSE with build flag
2023-11-20 15:03:14 -07:00
Kareem
ca61034d22 Add memcached support.
memcached support: add required functions/defines.

Fix running unit test when defining DEBUG_WOLFSSL_VERBOSE without OPENSSL_EXTRA.

Break out session_id_context APIs into separate option WOLFSSL_SESSION_ID_CTX, so they can be used without OPENSSL_EXTRA.

Make wolfSSL_ERR_get_error and wolfSSL_CTX_set_mode available for memcached.

Add --enable-memcached.

Include required defines for memcached.

Revert unit test fix, no longer needed.

Add Github actions test for memcached.  Stop defining DEBUG_WOLFSSL_VERBOSE for memcached.

Add auto retry to writes.

Memcached CI: correct libevent package name.

Memcached CI: Add pkgconfig path for Github CI wolfSSL prefix.

memcached: Fix WOLFSSL_OP_NO_RENEGOTIATION going outside of int bounds, add LD_LIBRARY_PATH for memcached CI test.

memcached CI: Use correct path for wolfSSL

memcached: Add required perl dependency for SSL tests

memcached: Update to 1.6.22

memcached: actually test tls

memcached: Update wolfSSL_SSL_in_before to be side agnostic.
2023-11-20 10:10:34 -07:00
JacobBarthelmeh
6945093221
Merge pull request #6935 from SparkiDev/ssl_crypto_extract
ssl.c: Move out crypto compat APIs
2023-11-16 11:58:14 -07:00
JacobBarthelmeh
bb73c233fc
Merge pull request #6973 from douzzer/20231115-misc-fixits
20231115-misc-fixits
2023-11-15 15:27:25 -07:00
Eric Blankenhorn
7bbeadcf97 Fix build errors with dtls1.3 and no tls1.2 2023-11-15 10:37:09 -06:00
JacobBarthelmeh
7daac20d24
Merge pull request #6952 from julek-wolfssl/dtls13-pqc-tests
Add dtls 1.3 PQC suites tests
2023-11-15 09:34:36 -07:00
Daniel Pouzzner
7569cfdff8 src/internal.c,src/wolfio.c: fallback to SHA256 when NO_SHA, in LoadCertByIssuer(), MicriumGenerateCookie(), uIPGenerateCookie(), and GNRC_GenerateCookie();
tests/api.c: when NO_SHA, omit test_wolfSSL_CertManagerCheckOCSPResponse() and test_wolfSSL_CheckOCSPResponse() (both use static artifacts with SHA1 name and key hashes).
2023-11-15 00:09:22 -06:00
jordan
be24d68e5d Add EXTENDED_KEY_USAGE_free to OpenSSL compat layer. 2023-11-08 15:26:24 -06:00
Stanislav Klima
76d89a0c15 unused variable 2023-11-08 11:09:05 +01:00
Stanislav Klima
f518a8f7d5 new build flag WOLFSSL_ALLOW_ENCODING_CA_FALSE 2023-11-08 10:51:25 +01:00
Sean Parkinson
54f2d56300 ssl.c: Move out crypto compat APIs
ssl_crypto.c contains OpenSSL compatibility APIS for:
 - MD4, MD5, SHA/SHA-1, SHA2, SHA3
 - HMAC, CMAC
 - DES, DES3, AES, RC4
API implementations reworked.
Tests added for coverage.
TODOs for future enhancements.
2023-11-08 19:43:18 +10:00
Juliusz Sosinowicz
8bc79a0b43 Add dtls 1.3 PQC suites tests 2023-11-08 10:29:35 +01:00
Stanislav Klima
4bbb0e3876 drafted ca false 2023-11-08 10:23:46 +01:00
Daniel Pouzzner
ca694938fd tests/api.c: update response vector in test_wolfSSL_CertManagerCheckOCSPResponse(), reflecting regenerated keys in certs/ocsp/. 2023-11-07 19:25:52 -06:00
JacobBarthelmeh
c5e2f414ea
Merge pull request #6929 from julek-wolfssl/dtls13-early-data-server-side
dtls 1.3: allow to skip cookie exchange on resumption
2023-11-06 13:30:21 -07:00
JacobBarthelmeh
c92d25816a
Merge pull request #6887 from julek-wolfssl/zd/16849
Implement untrusted certs in wolfSSL_X509_STORE_CTX_init
2023-11-06 10:13:43 -07:00
Juliusz Sosinowicz
8c87920903 Address code review 2023-11-03 11:02:41 +01:00
JacobBarthelmeh
96977d1480
Merge pull request #6900 from julek-wolfssl/zd/16868
EVP_EncodeBlock should not append a newline
2023-11-02 09:20:39 -06:00
JacobBarthelmeh
21f34ef028
Merge pull request #6905 from bandi13/moreCodeSonarFixes
Don't nag about leaked resources
2023-11-01 14:46:02 -06:00
JacobBarthelmeh
c920337f2f
Merge pull request #6891 from julek-wolfssl/zd/16849-i2d_x509
Advance pointer in wolfSSL_i2d_X509
2023-11-01 11:02:44 -06:00
JacobBarthelmeh
026c4bcbc7
Merge pull request #6902 from dgarske/various_20231020
Fixes for PKCS w/out RSA and Cert/CSR signing with unknown OID
2023-11-01 10:58:10 -06:00
JacobBarthelmeh
98843798c2
Merge pull request #6934 from SparkiDev/regression_fixes_8
Regression test fixes
2023-11-01 10:55:41 -06:00
Sean Parkinson
0eab70f806 Regression test fixes
Fixes for different configurations and memory allocation failure
testing.
2023-11-01 14:10:49 +10:00
Juliusz Sosinowicz
aed715cb2c dtls 1.3: allow to skip cookie exchange on resumption
tls 1.3: do cookie exchange when asked too even when found a matching cipher
2023-10-31 14:29:04 +01:00
David Garske
0455224439 Fix build errors in API unit test without IO dependencies. 2023-10-30 17:04:36 -07:00
Andras Fekete
42c241dbbf Avoid use of uninitialized array 2023-10-27 15:38:46 -04:00
Juliusz Sosinowicz
8f60fb0053 Advance pointer in wolfSSL_i2d_X509 2023-10-24 10:25:06 +02:00
Daniel Pouzzner
501299bc31 fix null pointer derefs in examples/pem/pem.c:pemApp_ReadFile() and tests/api.c:LoadPKCS7SignedDataCerts() detected by clang-tidy. 2023-10-21 13:34:04 -05:00
David Garske
6887281361 Fix for ./configure --enable-pkcs7 --disable-rsa && make check. 2023-10-20 16:27:54 -07:00
Juliusz Sosinowicz
8cd6cd175d EVP_EncodeBlock should not append a newline 2023-10-20 13:20:11 +02:00
Juliusz Sosinowicz
d13d446c2e Add missing guard 2023-10-19 20:05:59 +02:00
Juliusz Sosinowicz
1ae248018f Implement untrusted certs in wolfSSL_X509_STORE_CTX_init 2023-10-18 22:24:19 +02:00
Daniel Pouzzner
3e9f8bc649 tests/api.c: gate test_wc_AesEaxVectors(), test_wc_AesEaxEncryptAuth(), and test_wc_AesEaxDecryptAuth(), on !FIPS || FIPS>=5.3.
wolfcrypt/src/eccsi.c: remove incorrect `(void)h` from eccsi_mulmod_base_add() in newly exposed WOLFSSL_SP_MATH code path.
2023-10-16 13:30:16 -05:00
JacobBarthelmeh
c23559a91c
Merge pull request #6866 from bigbrett/aes-eax
Add more extensive AES EAX tests to api.c
2023-10-13 16:09:30 -06:00
Brett
87cffc8229 Added more extensive AES EAX tests to api.c 2023-10-13 11:38:16 -06:00
JacobBarthelmeh
79a6e1eb04
Merge pull request #6808 from SparkiDev/sp_sm2
SP updates for SM2
2023-10-13 10:17:17 -06:00