577 Commits

Author SHA1 Message Date
Chris Conlon
7d6597fe55 wolfSSL 3.11.1 release, TLS 1.3 BETA 2017-05-11 10:01:04 -06:00
Sean Parkinson
ec6d8f48b8 Add PSS for TLS v1.3 2017-05-10 17:22:53 +10:00
Sean Parkinson
2b1e9973ec Add TLS v1.3 as an option 2017-05-04 14:51:30 -07:00
Jacob Barthelmeh
b51643c344 prepare for release version 3.11.0 2017-05-04 14:17:35 -06:00
toddouska
4387e1f08e Merge pull request #855 from insane-adding-machines/master
Added support for HAproxy load balancer
2017-04-28 13:10:58 -07:00
dgarske
7db30ef550 Merge pull request #690 from embray/build/enable_aes_counter
Add a configure flag specifically for enabling AES CTR mode
2017-04-25 15:14:13 -07:00
Daniele Lacamera
ef231a039d Updated to latest masterbranch 2017-04-13 15:28:19 +02:00
toddouska
27d009475c Merge pull request #847 from dgarske/distro_options
Fixes for --enable-distro to include more features by default
2017-04-12 13:56:24 -07:00
Daniele Lacamera
3e9a5fd433 Updated to latest masterbranch 2017-04-12 12:48:38 +02:00
Daniele Lacamera
8f300515bd Grouped HAPROXY compatibility into WOLFSSL_HAPROXY flag
now haproxy compatible wolfssl builds with:

./configure --prefix=/usr --sysconfdir=/etc --disable-fastmath \
iam * ] 2:18 PM
    --disable-fasthugemath --disable-bump \
    --enable-opensslextra \
    --enable-keygen --enable-certgen \
    --disable-ntru --disable-examples \
    --enable-tlsx --enable-haproxy \
    --enable-savecert --enable-savesession --enable-sessioncerts \
    --enable-webserver --enable-sslv3 --enable-stunnel
2017-04-11 14:18:41 +02:00
David Garske
c1640e8a3d Intel QuickAssist (QAT) support and async enhancements/fixes:
* Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/).
* Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC.
* wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify.
* wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature.
* wolfCrypt test and benchmark async support added for all HW acceleration.
* wolfCrypt benchmark multi-threading support.
* Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA.
* Refactor to make sure “heap” is available for async dev init.
* Added async support for all examples for connect, accept, read and write.
* Added new WC_BIGINT (in wolfmath.c) for async hardware support.
* Added async simulator tests for DES3 CBC, AES CBC/GCM.
* Added QAT standalone build for unit testing.
* Added int return code to SHA and MD5 functions.
* Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer.
* Combined duplicate code for async push/pop handling.
* Refactor internal.c to add AllocKey / FreeKey.
* Refactor of hash init/free in TLS to use InitHashes and FreeHashes.
* Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*.
* Suppress error message for WC_PENDING_E.
* Implemented "wolfSSL_EVP_MD_CTX_init" to do memset.
* Cleanup of the openssl compat CTX sizes when async is enabled.
* Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability.
* Cleanup of the OPAQUE_LEN.
* Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret).
* Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations)
* Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding".
* Updated RSA un-padding error message so its different than one above it for better debugging.
* Added QAT async enables for each algorithm.
* Refactor of the async init to use _ex.
* Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing.
* Reformatted the benchmark results:
PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec"
Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87
* Added min execution time for all benchmarks.
* Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local.
* Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark.
* Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async.
* Added NO_SW_BENCH option to only run HW bench.
* Added support for PRNG to use hardware SHA256 if _wc devId provided.
* Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size.
* Added the wc_*GetHash calls to the wolfCrypt tests.
* Added async hardware start/stop to wolfSSL init/cleanup.
* Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos.
* Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`.
* Added arg checks on wc_*GetHash and wc_*Copy.
* Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions.
* Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator.
* Added checks for all hashing to verify valid ->buffLen.
* Fix for SHA512 scan-build warning about un-initialized “W_X”.
* Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash.
* Refactor of the benchmarking to use common function for start, check and finish of the stats.
* Fixed issue with ECC cache loading in multi-threading.
* Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned.
* Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define.
* Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-10 14:45:05 -07:00
David Garske
dc65a9a277 Distro fix to enable SHA224 by default. Was causing Debian build error since SHA224 is enabled by default only for the x86_64 architecture. Updated --enable-distro option to include new features for aeskeywrap, x963kdf and scrypt. Changed the ECC custom curve option to enable all curve types when used with distro. 2017-04-10 11:45:26 -07:00
Chris Conlon
c9bb75c0f3 3.10.4 release 2017-04-05 16:37:35 -06:00
JacobBarthelmeh
4eefa22629 Merge pull request #810 from toddouska/write-dup
add wolfSSL_write_dup(), creates write_only WOLFSSL to allow concurre…
2017-04-05 10:06:20 -06:00
toddouska
68076dee45 Merge pull request #805 from dgarske/rng_cleanup
Fix RNG issue with Intel RD and cleanup to remove old ARC4 support
2017-04-03 14:57:09 -07:00
David Garske
1251607b04 Retain existing HAVE_HASHDRBG functionality and only disable if ./configure --disable-hashdrbg or WC_NO_HASHDRBG defined. Fix use of warning with VS. Fix to only use rng seed as source if no DRBG. 2017-03-31 13:16:21 -07:00
David Garske
5e3d8e705e Fix RNG issue with Intel RDRAND and RDSEED accelerations not being used because HAVE_HASHDRBG was always being defined if !WOLFSSL_FORCE_RC4_DRBG. Added new --enable-intelrand option to indicate use of RDRAND preference for RNG source (if RDRAND not supported by CPU then HASHDRBG will be used). The --enable-intelasm option enables the RDSEED support for seeding HASHDRBG if CPU supports it. Allow use of seed as RNG source if --disable-hashdbrg (shows build warning). Cleanup to remove old ARC4 RNG support. Fixed random_test return code with !HAVE_HASHDRBG. Cleanup of ./configure --help alignment. 2017-03-31 13:16:21 -07:00
Sean Parkinson
c74c2ce00c FIPS changes and fixups
Enable ex data explicitly.
Keep the peer cert for verification callback.
External session cache for hostapd.
Enable DES_ECB when not FIPS.
Don't send the peer cert if it is not received from peer.
Initialize the peer cert after free as will be freed on tear down of
SSL.
Allow a server to become a client.
2017-03-30 11:53:35 +10:00
Maxime Vincent
25779dfb4f Introduce HAPROXY config flag + get/set app_data 2017-03-28 13:28:36 +02:00
toddouska
15423428ed add wolfSSL_write_dup(), creates write_only WOLFSSL to allow concurrent access 2017-03-20 15:08:34 -07:00
toddouska
10bf3c4d1d Merge pull request #804 from SparkiDev/wpas_shared
Wpas shared
2017-03-17 16:15:51 -07:00
Sean Parkinson
461f051ef1 Only expose ECC APIs on config define 2017-03-17 10:52:38 +10:00
Sean Parkinson
37a52414cc Make MP and ECC APIs public
These APIs are needed by wpa_supplicant.
2017-03-17 10:23:37 +10:00
David Garske
4eb76e1d71 Fixes for building with IPV6. Added new WOLFSSL_IPV6 define to indicate IPV6 support. Fix to not include connect() and socket() calls unless HAVE_HTTP_CLIENT, HAVE_OCSP or HAVE_CRL_IO defined. Typo fixes. 2017-03-15 12:27:02 -07:00
Sean Parkinson
7897d04145 Need GetHMACSize and GetIVSize for wpas 2.0 2017-03-15 09:09:02 +10:00
Sean Parkinson
e2930b0a43 Changes for WPA Supplicant 2017-03-15 09:09:02 +10:00
Sean Parkinson
d4abeb56db Fixes required after logging changes to master. 2017-03-01 08:38:54 +10:00
Sean Parkinson
e6434f380b Get Nginx working with wolfSSL 2017-03-01 08:38:54 +10:00
toddouska
e3503b8f9b 3.10.3 rel 2017-02-17 14:49:18 -08:00
Jacob Barthelmeh
337c52b4cf prepare for release 3.10.2 2017-02-10 10:19:34 -07:00
Erik M. Bray
e3ec769107 Adds an --enable-aesctr flag to the configure script to explicitly compile with -DWOLFSSL_AES_COUNTER and -DWOLFSSL_AES_DIRECT
If --enable-fortress or --enable-mcapi are used they effectively force --enable-aesctr
2016-12-29 21:26:34 +01:00
Jacob Barthelmeh
7752f9ad05 prepare for release 3.10.0 2016-12-22 14:23:41 -07:00
toddouska
168203ff9d Merge pull request #649 from dgarske/distro
Linux Distro Patches
2016-12-16 16:03:16 -08:00
toddouska
50cf1df8da Merge pull request #669 from SparkiDev/scrypt
Implementation of scrypt
2016-12-16 15:53:48 -08:00
Sean Parkinson
20887a8c35 Implementation of scrypt
Tests and benchmarking added.
Configure with --enable-scrypt and requires --enable-pwdbased
2016-12-14 16:57:41 +10:00
Chris Conlon
dad0cfda92 add EnvelopedData ECC support, refactor pkcs7 2016-12-13 09:40:54 -07:00
toddouska
b0b80bed78 Merge pull request #657 from cconlon/x963kdf
add ANSI-X9.63-KDF support [SEC1]
2016-12-09 13:29:41 -08:00
toddouska
ad2b0810c6 Merge pull request #648 from cconlon/keywrap
add AES key wrap support, RFC 3394
2016-12-09 13:23:39 -08:00
Chris Conlon
33e840b01b add AES key wrap support, RFC 3394 2016-12-09 09:30:56 -07:00
Chris Conlon
a5b267087f add ANSI-X9.63-KDF support [SEC1] 2016-12-07 20:26:09 -07:00
toddouska
2a3f3433e7 Merge pull request #652 from ejohnstown/autoconf-size-check
Move autoconf size checks
2016-12-07 15:23:25 -08:00
David Garske
9399cc05cb Fixes for building with CRL monitor when not linux, OS X or FreeBSD and --enable-distro set. Cleanup of the crl.c HAVE_CRL_MONITOR checks for OS and make sure if StopMonitor preprocessor is defined the function will also be defined. 2016-12-07 07:07:27 -08:00
John Safranek
fdc297f6bd Moved the check for the size of long, long long, and __m128 to before
the checks for libraries. In some combination of autotools, making a
32-bit build, the autoconf test code can't link libnetwork and crashes,
leaving those sizes all set to 0.
2016-12-06 16:15:45 -08:00
toddouska
80cc737ffa add pkcallbacks script test 2016-12-06 11:27:05 -08:00
David Garske
13bdcc518d Pulled in patches from Debian package. 2016-11-22 11:25:40 -08:00
Sean Parkinson
478f279b3c Fix logic 2016-11-11 16:38:28 +10:00
Sean Parkinson
abcd6af512 Disable SHA-224 in FIPS 2016-11-11 16:29:34 +10:00
Sean Parkinson
fdfc177254 SHA224 implementation added
Added SHA24 implementation and tetss.
Added HMAC-SHA224 implementation and tests.
Added RSA-SHA224 and ECDSA-SHA224.
Added MGF1-SHA224
Added OpenSSL APIs for SHA224
Configuration option to enable SHA224 and it is on by default for x86_64
2016-11-10 15:52:26 +10:00
Jacob Barthelmeh
70e7e34c87 RNG : change to --disable-rng, non-autoconf scenario, help msg 2016-11-01 10:21:29 -06:00
Jacob Barthelmeh
09c32de412 RNG : option to not use RNG 2016-10-31 16:51:02 -06:00