Commit Graph

27397 Commits

Author SHA1 Message Date
Lealem Amedie
873f10b0cf Simplifying rsa_test() by extracting sections as separate functions 2021-06-24 20:47:14 -06:00
Sean Parkinson
1994811d24 Merge pull request #4144 from haydenroche5/pkcs8
Make a bunch of PKCS#8 improvements.
2021-06-25 12:22:11 +10:00
Sean Parkinson
dae6683803 Merge pull request #4030 from julek-wolfssl/ZD12235
Expand SHA-3 support
2021-06-25 12:18:03 +10:00
Sean Parkinson
8592053856 Regression test fixes
./configure --enable-all --disable-rsa
./configure --disable-chacha --disable-asm
./configure --disable-rsa --disable-ecc --disable-dh --enable-curve25519
--enable-cryptonly (and ed25519, curve448, ed448)
./configure --disable-tls13 --enable-psk --disable-rsa --disable-ecc
--disable-dh C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK
./configure --disable-oldtls --enable-psk -disable-rsa --disable-dh
-disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK
--enable-lowresource --enable-singlethreaded --disable-asm
--disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224
--disable-sha384 --disable-sha512 --disable-sha --disable-md5
-disable-aescbc --disable-chacha --disable-poly1305 --disable-coding
Various build combinations with WOLFSSL_SP_MATH and WOLFSSL_SP_MATH_ALL
2021-06-25 09:18:06 +10:00
David Garske
45ef68d5c7 Fix for async with fragmented packets where inline crypto could be overwritten on reprocessing fragment. FIxes unit tests with --enable-all --enable-asynccrypt. Minor cleanup for line length and free verify RSA buffer sooner.
Reproducible with:

```
./examples/server/server -v 3 -l ECDHE-ECDSA-AES256-GCM-SHA384 -c ./certs/server-ecc.pem -k ./certs/ecc-key.pem -2
./examples/client/client -v 3 -l ECDHE-ECDSA-AES256-GCM-SHA384 -A ./certs/ca-ecc-cert.pem -F 6 -2
```
2021-06-24 16:03:12 -07:00
John Safranek
66c29ef1ca ABI Update
Add wolfSSL_CTX_set_verify to the ABI list.
2021-06-24 14:08:28 -07:00
David Garske
4ef3c5d75c Added inline documentation for wolfSSL_CTX_load_verify_buffer_ex. 2021-06-24 10:38:34 -07:00
Juliusz Sosinowicz
656e49cc3b Expand SHA-3 support
Add more support in the EVP layer as well as add signing support. The SHA-3 OID's were also added for DER algorithm identifier encoding.
2021-06-24 19:31:43 +02:00
David Garske
c59d1f2e8d Merge pull request #4155 from SparkiDev/ssl_reorg_3
Reorg of ssl.c: standard C wrappers, EX_DATA, BUF_MEM, TXT_DB
2021-06-24 09:53:53 -07:00
David Garske
1ec212be81 Merge pull request #4159 from SparkiDev/sakke_eccsi_fix_1
SAKKE: fix configurations
2021-06-24 09:48:14 -07:00
David Garske
97ab1bb013 Merge pull request #4154 from SparkiDev/hmac_update_ct
TLS hmac: handle truncated mac in Hmac_UpdateFinal_CT()
2021-06-24 09:28:22 -07:00
Jacob Barthelmeh
b826083fbf better checking on length of streaming buffer 2021-06-24 23:06:37 +07:00
Sean Parkinson
2fb6a9eacf SAKKE: fix configurations
Fix position of sp_1024_norm_18 now that div requires it:
./configure --disable-shared --enable-sakke --disable-eccsi
--enable-sp
Fix missing '{' in sp_mulmod_table_1024:
./configure --disable-shared --enable-sakke --enable-eccsi
--enable-smallstack  --enable-sp
2021-06-24 14:01:27 +10:00
Sean Parkinson
92a4e30b69 Merge pull request #4158 from dgarske/nxp_ltc_rsa2
Fixes for NXP LTC with RSA and Blinding
2021-06-24 12:14:04 +10:00
David Garske
73c90369c6 Fix for int neg being defined mid code. Fix limit check for mp_mulmod using hardware vs software. Resolves issue when using WC_RSA_BLINDING. 2021-06-23 14:45:52 -07:00
David Garske
2d1b113f51 Fix for missing wolfcrypt_mp_prime_is_prime_ex def. 2021-06-23 14:45:52 -07:00
John Safranek
ae2f2b246e Merge pull request #4148 from BrianAker/master
Fix for make distcheck, maintainer-clean, to allow distribution builds.
2021-06-23 10:33:06 -07:00
David Garske
81daf9172b Merge pull request #3872 from ejohnstown/pcExt
Policy Constraints Extension
2021-06-23 09:40:15 -07:00
Hayden Roche
b3401bd102 Make a bunch of PKCS#8 improvements.
- Add doxygen documentation for wc_GetPkcs8TraditionalOffset, wc_CreatePKCS8Key,
wc_EncryptPKCS8Key, and wc_DecryptPKCS8Key.
- Add a new API function, wc_CreateEncryptedPKCS8Key, which handles both
creation of an unencrypted PKCS#8 key and the subsequent encrypting of said key.
This is a wrapper around TraditionalEnc, which does the same thing. This may
become a first-class function at some point (i.e. not a wrapper). TraditionalEnc
is left as is since it is used in the wild.
- Added a unit test which exercises wc_CreateEncryptedPKCS8Key and
wc_DecryptPKCS8Key. Testing wc_CreateEncryptedPKCS8Key inherently also tests
TraditionalEnc, wc_CreatePKCS8Key, and wc_EncryptPKCS8Key.
- Modified wc_EncryptPKCS8Key to be able to return the required output buffer
size via LENGTH_ONLY_E idiom.
- Added parameter checking to wc_EncryptPKCS8Key and wc_DecryptPKCS8Key.
2021-06-23 08:39:20 -07:00
John Safranek
f762672a12 Merge pull request #4157 from julek-wolfssl/app-data-reason
Add a reason text for APP_DATA_READY
2021-06-23 08:30:19 -07:00
Juliusz Sosinowicz
4eff3ff3dd Add a reason text for APP_DATA_READY 2021-06-23 13:43:56 +02:00
Sean Parkinson
945acb4c2f Reorg of ssl.c: standard C wrappers, EX_DATA, BUF_MEM, TXT_DB 2021-06-23 11:28:38 +10:00
Sean Parkinson
2923d812bd Merge pull request #4058 from miyazakh/qt_oslext_cs
TLS: extend set_cipher_list() compatibility layer API
2021-06-23 10:12:11 +10:00
Sean Parkinson
5cf7e17820 TLS hmac: handle truncated mac in Hmac_UpdateFinal_CT() 2021-06-23 09:54:41 +10:00
John Safranek
a5852fe440 Merge pull request #4119 from julek-wolfssl/dtls-seq-num-refactor
Refactor `dtls_expected_peer_handshake_number` handling
2021-06-22 16:29:45 -07:00
Sean Parkinson
eccfb4f632 Merge pull request #4125 from dgarske/sniffer_etsi
TLS: Fixes for sniffer and static ephemeral keys
2021-06-23 09:17:13 +10:00
Chris Conlon
4b3bd3e384 Merge pull request #4049 from miyazakh/set_verifyDepth_3
Set verify depth limit
2021-06-22 10:23:43 -06:00
Chris Conlon
b70e028200 Merge pull request #4087 from miyazakh/get_ciphers_compat
higher priority of cipher suite is on top of stack
2021-06-22 10:22:43 -06:00
Chris Conlon
446393bcab Merge pull request #3793 from TakayukiMatsuo/os_base64
Add wolfSSL_EVP_Encode/Decode APIs
2021-06-22 10:19:30 -06:00
Chris Conlon
b050463dce Merge pull request #4059 from miyazakh/qt_unit_test
fix qt unit test
2021-06-22 10:12:48 -06:00
Jacob Barthelmeh
647bde671c macro guard on test case 2021-06-22 22:56:35 +07:00
Jacob Barthelmeh
2b1a6cfb54 add setting contentOID with decode enveloped data 2021-06-22 22:06:16 +07:00
Jacob Barthelmeh
a4b5ebb62f remove contentOID check 2021-06-22 21:59:57 +07:00
Jacob Barthelmeh
31e8784057 fix for compressedData eContent encoding with PKCS7 2021-06-22 21:59:57 +07:00
Jacob Barthelmeh
9c2de0e40a wc_PKCS7_DecodeCompressedData optionally handle a packet without content wrapping 2021-06-22 21:59:57 +07:00
Jacob Barthelmeh
3cd43cf692 fix for keyid with ktri cms 2021-06-22 21:33:12 +07:00
David Garske
67b87a8883 Merge pull request #4127 from douzzer/wolfsentry-client
outbound connection filtering and wolfSentry integration
2021-06-22 07:27:18 -07:00
David Garske
c4ea64b7fc Merge pull request #4140 from SparkiDev/set_sig_algs 2021-06-21 19:18:10 -07:00
David Garske
52582ede28 Merge pull request #4146 from SparkiDev/pkcs11_dec_final
PKCS #11: Use C_Decrypt instead of C_DecryptUpdate
2021-06-21 15:28:45 -07:00
Sean Parkinson
ab2c1e117e Merge pull request #4149 from guidovranken/wc_ecc_verify_hash_ex-alloc-check
ECC: wc_ecc_verify_hash_ex, return if ALLOC_CURVE_SPECS() fails
2021-06-22 08:24:22 +10:00
David Garske
716237c5dd Fix minor line length and spelling. 2021-06-21 15:09:39 -07:00
David Garske
4942220718 Merge pull request #4150 from elms/fix/sniffer_no_dh
Fix build with `--enable-sniffer --disable-dh`
2021-06-21 12:47:58 -07:00
Elms
a409e7c9ce Fix build with --enable-sniffer --disable-dh 2021-06-21 09:42:51 -07:00
David Garske
7491a44bb4 Fix for possible memory leak case on mp_init failure in wc_ecc_verify_hash_ex with WOLFSSL_SMALL_STACK. 2021-06-21 09:19:47 -07:00
Guido Vranken
7c600e3ebc In wc_ecc_verify_hash_ex, return if ALLOC_CURVE_SPECS() fails
This prevents a NULL pointer dereference later in the function.
2021-06-20 22:29:20 +02:00
Brian Aker
2d497d1cf5 Fix for make distcheck, maintainer-clean, to allow distribution builds.
This the second pass at this after seeing how fips is added to tree in later phases.
This allow autoreconf to be directly called which allows the Makefile to rebuild when seeing that changes have been ( having an autogen.sh is older convention which left to history in the way autotools are invoked )
This fixes "make distcheck" and "make maintainer-clean" which are required by most distributions packaging systems.

The files previously touched by autogen.sh are now properly placed into autoconf.
The include files files are generated by configure. ( There is a note placed in configure.ac as to why and reference to the automake documention for this ). Append to file was done on purpose, touch cannot be in configure safetly. Normally autoheader would be used for this but since the include files are created out of tree, care has to be taken to not overwrite those file.
For the source files, they were moved into the coresponding automake file. It is safe to use touch in automake. Since files can optionally copied from elsewhere, they have to be listed in BUILT_SOURCES. They are written srcdir in order to allow make to do VPATH builds ( which is configure by make distcheck ).
To show fips files are preserved without having the actual fips files, a C style comment can be echoed into the files.
There are a few current, but outstanding issues.
1) config.h needs to be fixed configure.ac to use autoheader in order to allow configure to know to rebuilt depencies on its changes. ( Out of scope for this patch. )
2) verion.h checked into the tree and it is a built file. A make maintainer-clean followed by "git status --ignored" will confirm this. ( Out of scope for this patch )
3) autogen.sh has not been updated to reflect fixes. I believe that for this patch, it should be left alone and checked for regression in Jenkins by itself.
4) There is an out of date .spec file for building RPM which should be updated now that distcheck is working.
5) maintainer-clean should have rule added to remove build-aux testdriver.

This has been tested on current Ubuntu testing, OSX, Fedora 34, and Debian 10.

Additionaly "make distcheck" should be added to regression testing, along with "make maintainer-check".

Other improvement possibilities:
A possible future improvement is to let autoconf handle build with optional out of dist files.
Modify fips configure.ac check to allow for an injection of comments into blank fips files in order to prove distribution of fips/non-fips builds.
Update git rules to use 'make maintainer-clean', 'autoreconf -if', 'make distcheck'.
2021-06-19 20:16:14 -07:00
Kaleb Himes
149920fc14 Merge pull request #4110 from dgarske/config_examples
Additional user_settings.h examples
2021-06-18 12:00:29 -05:00
David Garske
5a685ca37e Merge pull request #4139 from SparkiDev/etm_check_pad
TLS EtM: check all padding bytes are the same value
2021-06-18 08:14:46 -07:00
David Garske
15065175d8 Merge pull request #4145 from SparkiDev/sp_int_neg_mod
SP int negative: check size of a in mp_mod
2021-06-18 08:14:02 -07:00
Sean Parkinson
7224fcd9bc TLS: add support for user setting signature algorithms 2021-06-18 16:19:01 +10:00