Cyclic0007/wolfssl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,546 Commits 12 Branches 184 Tags
bc2bb78010fe04bbc1c7a42c72d6fece1519e8a6
Commit Graph

1395 Commits

Author SHA1 Message Date
David Garske
d21603334b Added build option USE_ECDSA_KEYSZ_HASH_ALGO to alter the hash algorithm selection for ecc_dsa_sa_algo. With this build option we try and choose a hash algorithm digest size that matches the ephemeral key size, if not found then will match on next highest. We've seen cases with some Windows based TLS client's where they do not properly support hashing a smaller ephemeral key with a larger hash digest size (such as P-256 key and SHA512 hash). 2018-10-25 09:19:35 -07:00
David Garske
c268829b68 Fix bug with SendClientKeyExchange and ifdef logic for ecdhe_psk_kea, which was preventing ECDHE-PSK from working if HAVE_CURVE25519 was defined. Disabled broken downgrade test in test-tls13-down.conf (@SpariDev will need to investigate). Various spelling fixes. 2018-10-19 13:21:56 -07:00
David Garske
a0608151cf Fix for the WOLFSSL_NONBLOCK_OCSP case to reset the error code as well. 2018-10-12 11:20:13 -07:00
David Garske
fc77ed068c Fix for verify callback to not report override when there is no error. Cleanup of the myVerify example callback return code handling. 2018-10-12 10:45:20 -07:00
David Garske
fec726f10a Fix for async issue with receiving multiple TLS records (server_key_exchange and server_hello_done) in same packet, which may miss call to DoHandShakeMsgType -> HashInput because ssl->error is still marked pending WC_PENDING_E. 2018-10-12 10:39:40 -07:00
toddouska
0b78b75530 Merge pull request #1860 from dgarske/tls_either_side 
Methods cleanup and new DTLS "either" side methods
 2018-10-12 07:35:17 -07:00
David Garske
1d7c4f96fa Fix windows build warning with side data type mismatch. 2018-10-04 16:10:50 -07:00
David Garske
bbdb17975c Adds build option WOLFSSL_EITHER_SIDE for deferring the "side" of the TLS session until first connect or accept. Added the DTLS generic v1.0 and v1.2 methods for "either" side. Added "either" methods unit tests. Added "either" -v e support to example client/server. Fix to expose wolfSSL_use_certificate_file and wolfSSL_use_PrivateKey_file without OPENSSL_EXTRA. Cleanup of the methods for (void)heap and log messages. Spelling fixes. 2018-10-04 15:47:50 -07:00
David Garske
680a863054 Added support for building with certificate parsing only. ./configure --enable-asn=nocrypt. Added new API for parsing PIV format certificates wc_ParseCertPIV with WOLFSSL_CERT_PIV build option. Added wc_DeCompress_ex with ability to decompress GZIP. Moved the ZLIB error codes into wolfCrypt. 2018-10-02 15:18:56 -07:00
David Garske
b2575b0b60 Fix to only skip early key free if async pending. 2018-09-21 15:13:15 -07:00
David Garske
a643aeac41 * Fixes for async with TLS where keys are being free'd too soon. 
* Fix for possible NULL RNG case in mp_rand.
* Fix for memory macros to handle expression for `HEAP`.
* Fix for possible unknown uint32_t type with mem track.
* Fix for double Alloc/Free print when using track and debug memory at same time.
* Fix for building with `./configure CFLAGS="-DECC_USER_CURVES -DNO_ECC256 -DHAVE_ECC160"`
* Performance improvements for cases with `WC_ASYNC_NO_HASH` and `WC_ASYNC_ENABLE_SHA256`.
 2018-09-21 09:33:40 -07:00
David Garske
0ad77628f1 Merge pull request #1827 from kaleb-himes/CPP_POLY1305 
Fix for HAVE_POLY1305 without one time auth
 2018-09-11 10:00:39 -07:00
Eric Blankenhorn
412eecd51a Add wc_SetIssuerRaw and EncodeCert with raw fields (#1798) 
* Make cert with raw issuer
* Add wc_SetIssuerRaw
* Use issuer raw in EncodeCert
 2018-09-07 16:22:23 -07:00
Sean Parkinson
a3cc2119d7 Fix CheckCertSignature return to be remembered past ParseCertRelative 2018-09-06 10:42:49 +10:00
kaleb-himes
0626338be2 Fix for HAVE_POLY1305 without one time auth 2018-09-05 14:41:57 -06:00
toddouska
d149795648 Merge pull request #1759 from dgarske/verifycbfail 
Fix to resolve issue with verify callback not causing an error
 2018-09-04 15:52:58 -07:00
toddouska
8e67ef33b2 Merge pull request #1799 from SparkiDev/cert_vfy_small 
Smaller dynamic memory usage in TLS
 2018-09-04 15:40:11 -07:00
Sean Parkinson
4b208f4fe5 Make grouping EarlyData and ClientHello a configuration option 2018-09-03 08:48:28 +10:00
Sean Parkinson
d089a4651a Group Early Data message with ClientHello for faster delivery 2018-08-31 09:28:38 +10:00
Sean Parkinson
d86fc2dbbe Smaller dynamic memory usage in TLS 
Code doesn't require a DecodedCert which saves on dynamic memory usage.
WOLFSSL_SMALL_CERT_VERIFY: Don't have a DecodedCert allocated and verify
certificate signature in ProcessPeerCerts as this is maximum dynamic
memory usage.
WOLFSSL_SMALL_CERT_VERIFY is enabled with 'lowresource' configuration
option.
Fix sp_clear to work with NULL parameter.
Define a new function HashId that maps to the hashing function
available.
Set MAX_CERT_VERIFY_SZ to be the maximum based on what algorithms are
compiled in.
Fix usage of MAX_CERT_VERIFY_SZ in functions sending certificate verify
messages.
 2018-08-31 08:29:28 +10:00
David Garske
ffc0f0fb26 Fix for building with SESSION_CERTS using pointer after free. Documented store->discardSessionCerts. 2018-08-30 13:57:21 -07:00
David Garske
944342b386 Fixes for verify callback failure override handling. Fixes the return codes in the failure cases. 2018-08-30 11:17:21 -07:00
David Garske
53c0003cad Fix to resolve issue with verify callback not causing an error (if one not already present) when returning 0. Test case to follow shortly. 2018-08-30 11:17:21 -07:00
toddouska
31e37ea5df Merge pull request #1797 from SparkiDev/stack_size 
Small stack usage fixes
 2018-08-29 16:19:46 -07:00
toddouska
fc64788092 Merge pull request #1795 from SparkiDev/tls13_no_tls12 
Fixes to work when compiled with TLS 1.3 only
 2018-08-29 16:16:46 -07:00
Sean Parkinson
4dbe86f1fd Small stack usage fixes 
Stack pointer logging added.
 2018-08-29 10:16:51 +10:00
Sean Parkinson
487c60df78 Fixes to work when compiled with TLS 1.3 only 
TLS 1.3 Early Data can be used with PSK and not session tickets.
If only TLS 1.3 and no session tickets then no resumption.
External sites don't support TLS 1.3 yet.
 2018-08-28 15:37:15 +10:00
Jacob Barthelmeh
d122b9f8b5 sanity check on buffer before clearing it 2018-08-24 16:29:43 -06:00
David Garske
205088d1bc Merge pull request #1787 from ejohnstown/patches 
Patches for various build errors
 2018-08-24 14:46:28 -07:00
John Safranek
86ce22c32e Merge pull request #1785 from embhorn/zd4225 
Fix for old certs not discarded when server does not resume session
 2018-08-24 13:22:06 -07:00
John Safranek
4eb0d32fa8 Patches 
1. Define Timeval in callbacks.h if the file sys/time.h is missing.
2. When picking the correct strtok() function, take into account MINGW64.
3. In the example server, changed the call to SSL_accept_ex() as it doesn't exist. Using wolfSSL_accept_ex(). Only a problem when setting WOLFSSL_CALLBACKS.
4. PickHashSigAlgo() is missing a ; when WOLFSSL_CALLBACKS is set.
 2018-08-24 11:46:02 -07:00
Eric Blankenhorn
498d8e6c15 Fix for old certs not discarded when server does not resume session 2018-08-24 07:53:35 -05:00
David Garske
c7dde6c682 Merge pull request #1656 from danielinux/contiki-port 
Contiki port
 2018-08-23 12:31:56 -07:00
toddouska
0d171e591b Merge pull request #1776 from SparkiDev/inline_cmpl_fix 
Fix for clang builds with configs not using inline funcs
 2018-08-23 08:22:39 -07:00
Daniele Lacamera
7bd16a2582 Fixed after second review 2018-08-22 09:15:10 +02:00
Daniele Lacamera
b74869a61a Moved contiki + uIP support in the library 2018-08-22 09:15:10 +02:00
Sean Parkinson
31bd844d6f Fix for clang builds with configs not using inline funcs 2018-08-22 11:16:57 +10:00
Sean Parkinson
fff5cff273 Fix for no certificates and calling DoVerifyCallback. 2018-08-22 10:57:19 +10:00
toddouska
776fd51720 Merge pull request #1768 from SparkiDev/tls13_final 
Use final TLS 1.3 version value by default.
 2018-08-21 12:29:51 -07:00
Sean Parkinson
1ab17ac827 More changes to minimize dynamic memory usage. 
Change define to WOLFSSL_MEMORY_LOG.
Fix for ED25519 server certificate - single cert to allow comparison
with ECC dynamic memory usage.
Free memory earlier to reduce maximum memory usage in a connection.
Make MAX_ENCODED_SIG_SZ only as big as necessary.
Change memory allocation type in sha256 from RNG to DIGEST.
If we know the key type use it in decoding private key
 2018-08-21 14:41:01 +10:00
Sean Parkinson
506c858ed6 Add memory usage tracking and logging 
Add WOLFSSL_MEMORY_TRACKING to report allocations and frees with the
type.
Fix places where memory can be freed earlier.
 2018-08-21 08:54:57 +10:00
Sean Parkinson
20950ffde8 Remove TODOs around TLS 1.3 draft version. 2018-08-21 08:41:50 +10:00
toddouska
555714afa3 Merge pull request #1764 from SparkiDev/tls13_psk_cb 
Separate PSK callback for TLS 1.3
 2018-08-20 09:17:01 -07:00
Sean Parkinson
3cdeccc36e Use final TLS 1.3 version value by default. 2018-08-20 14:17:38 +10:00
Sean Parkinson
f1222c3f9f Separate PSK callback for TLS 1.3 
It is highly recommended that the PSK be different for each protocol.
Example callback already returns a different key for TLS 1.3.
New callback includes the ciphersuite, as a string, to use with the key.
 2018-08-17 10:18:28 +10:00
Sean Parkinson
f487b0d96a Config option to disable AES-CBC 
AEAD only detection and removeal of code.
Also in single threaded builds, reference the ctx suites in ssl object
if it exists.
 2018-08-16 08:25:13 +10:00
David Garske
c073aee87c Added new ECC export API's to support export as hex string. New API's are wc_ecc_export_ex and wc_ecc_export_int. For hex string use ECC_TYPE_HEX_STR as encType arg. Refactor to reduce duplicate code. Build fixes for NO_ECC_KEY_EXPORT. 2018-08-14 12:05:22 -06:00
Eric Blankenhorn
bb574d28b2 Support for more cert subject OIDs and raw subject access (#1734) 
* Add businessCategory OID
* Raw subject support methods
* Support for jurisdiction OIDs
* Wrap in WOLFSSL_CERT_EXT
* Adding tests
 2018-08-12 12:53:29 -07:00
David Garske
56974c099e Improved the logic for WOLFSSL_ALWAYS_VERIFY_CB to be more explicit and updated comments. 2018-08-06 11:40:35 -07:00
David Garske
c4ea50b956 Fix for issue with using CopyDecodedToX509 again for existing X509 and freeing the altNames in original. Fix was to use the ssl->peerCert directly for the index 0 cert. Improvement to make sure ex_data is always populated. Added NULL arg check on wolfSSL_get_peer_certificate. 2018-08-06 11:40:35 -07:00