1
0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-27 04:49:34 +03:00

Commit Graph

  • 277bd66624 FIPS: Default to 2048 bit min DH crypto Lealem Amedie 2026-06-30 11:50:51 -06:00
  • 9e71da21ac Merge pull request #10751 from aidangarske/tinytls13 Tobias Frauenschläger 2026-07-01 15:21:04 +02:00
  • 6dae0c9dd4 Merge pull request #10818 from dgarske/dh_checkprivkey_prime Kaleb Himes 2026-07-01 05:34:47 -06:00
  • b98e43eeca Fix wrong length on test message Koji Takeda 2026-06-30 11:20:32 +09:00
  • 3fa342a76c Merge pull request #10812 from douzzer/20260629-linuxkm-fixes philljj 2026-06-30 13:36:04 -05:00
  • b5636ffaf9 Merge pull request #10696 from douzzer/20260615-linuxkm-fixes philljj 2026-06-30 12:00:25 -05:00
  • 8820b810f2 Merge pull request #10725 from SparkiDev/aes_x25519_arm32_thumb2_fixes Daniel Pouzzner 2026-06-30 10:47:03 -05:00
  • 07b677edba Merge pull request #10744 from SparkiDev/arm64_asm_opt David Garske 2026-06-30 08:42:23 -07:00
  • 5fa08e767b DH: honor explicit prime in wc_DhCheckPrivKey_ex (Fenrir F5317) David Garske 2026-06-29 17:01:54 -07:00
  • 8d63afab99 Merge pull request #10767 from SparkiDev/ppc64_ppc32_asm_1 David Garske 2026-06-30 07:13:35 -07:00
  • 95e798e897 TLSv1.3 test: CertificateVerify signature algorithm test Sean Parkinson 2026-06-30 15:51:51 +10:00
  • 2af2a2967f fix F-3085 "Base64_Decode silently returns success with outLen=0 when input is a 1-3 byte truncated base64 fragment, violating decode(encode(x)) roundtrip for inputs producing 2-3 base64 chars without padding" Daniel Pouzzner 2026-06-29 23:48:36 -05:00
  • 6560777d05 linuxkm/linuxkm_wc_port.h: fix F-6395 "WC_LINUXKM_ROUND_UP_P_OF_2(1) invokes undefined behavior via __builtin_clzl(0)". Daniel Pouzzner 2026-06-29 14:56:42 -05:00
  • 155e5822a7 wolfssl/wolfcrypt/settings.h: move ML-KEM/ML-DSA/SLH-DSA inhibition of DEBUG_VECTOR_REGISTER_ACCESS_FUZZING from the WOLFSSL_LINUXKM section to top level (the exceptions are generally applicable, and needed for user-mode SVR fuzzing). also add a DEBUG_FORCE_VECTOR_REGISTER_ACCESS_FUZZING flag. Daniel Pouzzner 2026-06-29 19:06:13 -05:00
  • 2124a1075f F-6558 - Reject name constraint subtree with non-zero minimum or maximum aidan garske 2026-06-29 16:10:15 -07:00
  • 3e99430671 PPC64/PPC32 ASM: AES, SHA-2, SHA-3 Sean Parkinson 2026-06-24 21:22:25 +10:00
  • fef29abf0e certs: regenerate ecc-leaf-mldsa44 and ecc-leaf-rsapss from renew scripts aidan garske 2026-06-29 13:46:14 -07:00
  • 5956da84c2 ARM32/Thumb2: generated asm fixes Sean Parkinson 2026-06-18 11:20:52 +10:00
  • aa32abc556 Address tls13_memio review: build-time MEM_BUF_SZ/HS_MAX_ITERS/CERT_DIR, drop snprintf, doc PSK aidan garske 2026-06-29 12:58:55 -07:00
  • 18c9684c9d Merge pull request #10740 from SparkiDev/ppc32_cond_reg David Garske 2026-06-29 10:41:46 -07:00
  • 8452f2b2e0 wolfssl/wolfcrypt/wc_port.h: keep #define INLINE WC_INLINE even for latest FIPS; Daniel Pouzzner 2026-06-27 22:31:48 -05:00
  • 568c660bf5 wolfcrypt/src/pkcs7.c: in wc_PKCS7_DecodeAuthEnvelopedData(), accommodate old FIPS using old authTagSz check. Daniel Pouzzner 2026-06-27 19:50:52 -05:00
  • d69d49cc68 wolfcrypt/src/aes.c: don't use explicit inline attribute on wc_local_AesGcmCheckTagSz() with C++ (namespace breakage). Daniel Pouzzner 2026-06-27 16:14:59 -05:00
  • 47cf8d066c wolfcrypt/src/pkcs7.c: in wc_PKCS7_DecodeAuthEnvelopedData(), accommodate AES*GCMb with !HAVE_AESGCM, and add AES-CCM authTagSz check. Daniel Pouzzner 2026-06-27 16:09:57 -05:00
  • 262b0ed3b8 tweaks for linuxkm targeting clang-built kernels: Daniel Pouzzner 2026-06-27 14:48:17 -05:00
  • 3811ec0aa7 linuxkm-related loose ends: * wolfssl/ocsp.h: gate out the CheckOcspResponder() prototype if defined(CheckOcspResponder) (for linuxkm-pie). * wolfcrypt/src/wc_mldsa.c: add support for WC_MLDSA_NO_ASM. * .wolfssl_known_macro_extras: add new macros. Daniel Pouzzner 2026-06-27 14:47:32 -05:00
  • ac5f2b98e7 wolfcrypt/src/wc_slhdsa.c: * disable asm accelerations if WC_SHA3_NO_ASM is set. * fix an uninited-data warning in slhdsakey_wots_pkgen_chain_c(). Daniel Pouzzner 2026-06-27 14:41:44 -05:00
  • cba69093cc wolfcrypt/src/port/riscv/riscv-64-aes.c: in GHASH(), remove runtime nullness check for arg 1 (matching nonnull attribute to arg 1 added to prototype in earlier commit). Daniel Pouzzner 2026-06-27 14:41:17 -05:00
  • 649197d159 replace several nonconformant uses of __FUNCTION__ with __func__ (linuxkm/linuxkm_memory.c, wolfcrypt/src/random.c, wolfcrypt/test/test.c, wolfssl/wolfcrypt/mem_track.h, wolfssl/wolfcrypt/memory.h, wolfssl/wolfcrypt/settings.h). Daniel Pouzzner 2026-06-27 14:37:35 -05:00
  • bf088dfc3c linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: on kernel >= 7.2, remove indirect symbol support for strncpy and add backward-compat implementation wc_linuxkm_strncpy(). Daniel Pouzzner 2026-06-27 14:34:06 -05:00
  • 538262a5dc linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: add linuxkm-pie support for CheckOcspResponder() (WOLFSSL_NO_OCSP_ISSUER_CHECK is no longer implied by KERNEL_MODE_DEFAULTS). Daniel Pouzzner 2026-06-27 14:30:57 -05:00
  • 948ba6ec10 * add hard compile-time assert in settings.h for FIPS v7+ asserting that WOLFSSL_MIN_AUTH_TAG_SZ meets SP 800-38D Rev 1 requirements. Daniel Pouzzner 2026-06-27 14:29:06 -05:00
  • 7545798248 clean up setup code for kernel modules: Daniel Pouzzner 2026-06-27 14:26:56 -05:00
  • 7a402566b6 wolfcrypt/src/sha3.c: refactor WC_C_DYNAMIC_FALLBACK using SAVE_VECTOR_REGISTERS2(). Daniel Pouzzner 2026-06-27 14:21:36 -05:00
  • 8b5b6af44e linuxkm/x86_vector_register_glue.c, linuxkm/linuxkm_wc_port.h, wolfssl/wolfcrypt/memory.h: add WC_SVR_FLAG_FUZZ, implement support for DEBUG_VECTOR_REGISTER_ACCESS_FUZZING directly in the save/restore implementations, and properly reflect existing save state there and in the _FUZZING variants of SAVE_VECTOR_REGISTERS2(). Daniel Pouzzner 2026-06-27 14:21:00 -05:00
  • 4d46e1eb74 wolfcrypt/test/test.c: * in slhdsa_keygen_kat() and slhdsa_id_label_test(), pass devId to wc_SlhDsaKey_Init*() * in cryptocb_test(), inhibit the callback verification check for SLHDSA if FIPS (no crypto callbacks in FIPS-wrapped calls). Daniel Pouzzner 2026-06-27 14:14:31 -05:00
  • 5ae99fb03b wolfcrypt/src/aes.c, wolfcrypt/src/port/, wolfssl/wolfcrypt/aes.h, wolfcrypt/src/pkcs7.c, wolfcrypt/test/test.c: * implement wc_local_AesGcmCheckTagSz() with pedantic checks for valid authtag size. SP 800-38D restrictions are now uniformly imposed, unless WC_AES_GCM_ALLOW_NONSTANDARD_TAG_LENGTH is defined (not allow with FIPS). * refactor tag size checks in wc_AesGcmEncrypt(), wc_AesGcmDecrypt(), wc_AesGcmEncryptFinal(), wc_AesGcmDecryptFinal(), and wc_PKCS7_DecodeAuthEnvelopedData(). * in test.c, update aesgcm_non12iv_test() to skip tag sizes expected to fail. Daniel Pouzzner 2026-06-27 14:12:34 -05:00
  • 6d21d600f6 in all FIPS-relevant C sources, add a "#define _WC_BUILDING_foo" first (where foo is a stylization of the filename), before including libwolfssl_sources.h, to allow future file-specific suppressions or other settings without altering FIPS sources. Daniel Pouzzner 2026-06-27 14:06:52 -05:00
  • 300f58db6e src/include.am: remove wolfcrypt/src/aes_x86_64_asm.S from AESNI source lists in FIPS v2/v5/v6 sections. Daniel Pouzzner 2026-06-27 14:04:12 -05:00
  • 479a685199 wolfcrypt/src/aes.c: fix performance regressions on GMAC and AES-CFB decrypt: * add WC_VAES_MIN_BLOCKS, WC_VAES_ECB_MIN_BLOCKS, and WC_VAES_GCM_MIN_BLOCKS, and check against them before using AVX512/VAES implementations. * in AesCfbDecrypt_C(), enlarge the tmp[] buffer and parameterize its size with newly added WC_AES_CFB_DEC_BUF_BLOCKS. Daniel Pouzzner 2026-06-27 14:03:42 -05:00
  • 92e76d4667 updated email to facts@wolfssl.com Emma Stensland 2026-06-11 17:12:01 -06:00
  • d4eaeb1b2e linuxkm/lkcapi_sha_glue.c: refactor error code handling in wc_linuxkm_drbg_generate() (followup to 3c9996efe0 in #10688). Daniel Pouzzner 2026-06-16 12:19:57 -05:00
  • c38f11b9a7 fixes for false positives on linuxkm CONFIG_FORTIFY_SOURCE builds on gcc-16: Daniel Pouzzner 2026-06-16 00:12:54 -05:00
  • 5d0678d38b Fix from review Eric Blankenhorn 2026-06-26 12:46:30 -05:00
  • c18833f520 Fix to send record_overflow alert Eric Blankenhorn 2026-06-26 11:49:59 -05:00
  • e1a2ba3b02 Restore error code from DecodeGeneralName Eric Blankenhorn 2026-06-26 11:11:22 -05:00
  • 0cecccdf6e Merge pull request #10756 from SparkiDev/aes_asm_ymm_zmm David Garske 2026-06-25 21:41:17 -07:00
  • 39c0336cb1 Merge pull request #10728 from SparkiDev/intel_asm_fixup David Garske 2026-06-25 21:41:08 -07:00
  • cfdbeac11b bsdkm: fenrir and misc cleanup. jordan 2026-06-25 22:43:38 -05:00
  • 23bfe9b65e Merge pull request #10775 from SparkiDev/regression_fixes_26 David Garske 2026-06-25 14:47:08 -07:00
  • 5bd8fc5b47 Move tinytls13 smoke test to examples/tls13/tls13_memio.c and restore WOLFSSL_MLKEM_DYNAMIC_KEYS macro aidan garske 2026-06-25 14:32:33 -07:00
  • 37365796bd Fix untrusted pointer issue. Bound tainted lengths in ECH test helper Ruby Martin 2026-06-24 17:12:50 -06:00
  • 720662e013 capture and free NULL peer to prevent resource leak false positive Ruby Martin 2026-06-24 14:47:48 -06:00
  • c26f22e9f9 Correct assignment to ssl->options.tls1_3 Ruby Martin 2026-06-24 14:24:59 -06:00
  • c50d4d2a52 Add bounds check to test helper ech_find_extension() Ruby Martin 2026-06-24 14:12:37 -06:00
  • 92ed948907 Ignore return from remove() function in tests with (void) Ruby Martin 2026-06-24 12:45:09 -06:00
  • 26625b7d5e Remove dead code. Dead XBADFILE check, remove() call Ruby Martin 2026-06-24 12:38:36 -06:00
  • 2c23f174ce FreePeerProtocol before freeing, clears potential resource leak (currently false positive) Ruby Martin 2026-06-24 11:34:55 -06:00
  • acfaac4959 Move cast to return, prevents overflowed return value. Adds hardening to maxSz assignment Ruby Martin 2026-06-24 10:29:29 -06:00
  • 0129f6fb72 Remove logically dead len and *data checks Ruby Martin 2026-06-23 15:06:53 -06:00
  • c3366597b3 Merge pull request #10707 from SparkiDev/mlkem_mldsa_unaligned David Garske 2026-06-25 13:00:18 -07:00
  • 039e97df89 Merge pull request #10779 from lealem47/guard_rsa_modulus_test David Garske 2026-06-25 12:06:14 -07:00
  • 6ef3df248a Merge pull request #10598 from twcook86/hkdf_cryptocb_split twcook86 2026-06-25 14:58:15 -04:00
  • cee4b2bb47 Merge pull request #10713 from SparkiDev/curve25519_hibit_mask David Garske 2026-06-25 10:34:49 -07:00
  • 70dad95573 Merge pull request #10776 from julek-wolfssl/fix-sha512-w-cache-free-type David Garske 2026-06-25 09:29:47 -07:00
  • 10444189d4 Merge pull request #10771 from julek-wolfssl/socat-parallel-shards David Garske 2026-06-25 08:00:59 -07:00
  • b6d962350d Rust wrapper: rename dilithium to mldsa Josh Holtrop 2026-06-09 13:47:49 -04:00
  • b707c00f80 Testing: Guard RSA OversizedModulus test result by FIPS version Lealem Amedie 2026-06-25 08:16:06 -06:00
  • 044a477378 parallel-make-check.py: only require bwrap for an actual netns run Juliusz Sosinowicz 2026-06-25 13:05:35 +00:00
  • f2fa741bad socat CI: run the test suite as parallel netns shards Juliusz Sosinowicz 2026-06-25 09:35:13 +00:00
  • c9d71d52f8 parallel-make-check.py: add generic pool extensions for arbitrary commands Juliusz Sosinowicz 2026-06-25 09:35:13 +00:00
  • cb11e2ff28 Regression testing fixes: ARM/PP64 asm fixes, plus more Sean Parkinson 2026-06-25 17:33:49 +10:00
  • dbd495dacb sha512: free SHA-512/384 W cache with its allocated memory type Juliusz Sosinowicz 2026-06-24 22:50:29 +00:00
  • 93d16f431c Address tinytls13 review: ML-DSA-44, canonical ML-DSA/ML-KEM macros, optimizer-measured static-mem bucket guidance, footprint hygiene aidan garske 2026-06-24 13:06:14 -07:00
  • ac01707f55 Merge pull request #10757 from philljj/release v5.9.2-stable JacobBarthelmeh 2026-06-24 13:21:53 -06:00
  • 0fe21bbcd5 prepare for release 5.9.2 jordan 2026-06-24 12:01:51 -05:00
  • ad1cd4789b Merge pull request #10763 from douzzer/20260623-WC_16BIT_CPU-WC_ATOMIC_INT_ARG philljj 2026-06-23 17:51:11 -05:00
  • 18c2329167 wolfssl/wolfcrypt/wc_port.h and wolfcrypt/src/wc_port.c: for 16 bit portability, use target native int for WC_ATOMIC_INT_ARG, add user overrideability, and adjust WC_INIT_STATE_COUNT_BITS to depend on sizeof(WC_ATOMIC_UINT_ARG). add a wc_static_assert to sanity-check WC_INIT_STATE_STATE_BITS, and use CHAR_BIT opportunistically in the other wc_static_assert to sanity check that CHAR_BIT is at least 8. Daniel Pouzzner 2026-06-23 11:24:51 -05:00
  • a342eba578 Intel x64 ASM: Add new assembly for AES Sean Parkinson 2026-06-23 10:35:31 +10:00
  • fed375fcea SHAKE 128/256 callback wiring and tests, along with fix to devCTX initialization. night1rider 2026-06-13 23:11:02 -06:00
  • 41fad5f307 Fix and expand tinytls13 footprint profile across CI configs Aidan Garske 2026-06-22 12:08:58 -07:00
  • 0481cba126 ARM64 ASM: optimizations Sean Parkinson 2026-06-20 08:56:52 +10:00
  • 8bce9f0ead Add --enable-tinytls13 TLS 1.3-only footprint profile (PSK+ECDHE floor + minimal X.509) aidan garske 2026-06-19 15:22:59 -07:00
  • 9eb8858fb7 PPC32 ASM: Use condition register Sean Parkinson 2026-06-19 09:36:25 +10:00
  • dd6da70d39 Merge pull request #10732 from douzzer/20260618-FORCE_FAILURE_RDSEED-fixes JacobBarthelmeh 2026-06-18 15:30:54 -06:00
  • 0052ec44dd add regression tests for name-constraint ancestor walk Ruby Martin 2026-06-10 17:10:43 -06:00
  • bc26ce05cd walk cert chain to apply ancestor name constraints Ruby Martin 2026-06-10 17:09:43 -06:00
  • d379e833cf Merge pull request #10735 from douzzer/20260618-disable-errorstrings-test_wolfSSL_set_cipher_list_exclusions JacobBarthelmeh 2026-06-18 14:23:17 -06:00
  • 0b20777315 tests/api.c: in test_wolfSSL_set_cipher_list_exclusions(), don't test IANA names if NO_ERROR_STRINGS. Daniel Pouzzner 2026-06-18 13:41:20 -05:00
  • 3876746500 Merge pull request #10726 from JacobBarthelmeh/test Daniel Pouzzner 2026-06-18 13:01:27 -05:00
  • 8167d16b5f Merge pull request #10727 from SparkiDev/thumb2_x25519_fix JacobBarthelmeh 2026-06-18 11:43:42 -06:00
  • 296bfc8a83 wolfcrypt/src/random.c: Daniel Pouzzner 2026-06-18 11:53:44 -05:00
  • c2a8f77f38 Merge pull request #10731 from julek-wolfssl/ci-cache-save-on-master David Garske 2026-06-18 08:51:14 -07:00
  • 6fcf188aba Merge pull request #10700 from julek-wolfssl/parallel-make-check-annotation-link David Garske 2026-06-18 08:48:52 -07:00
  • e95376c0a6 Merge pull request #10729 from julek-wolfssl/ci-deps-full-timeout David Garske 2026-06-18 08:48:34 -07:00
  • 84d27741d5 CI: run PIC32MZ simulator test on ready_for_review Juliusz Sosinowicz 2026-06-18 14:21:35 +00:00
  • 1001428637 adjust test case macro guard for ALLOW_INVALID_CERTSIGN builds JacobBarthelmeh 2026-06-18 08:20:33 -06:00
  • 708837a599 CI: skip PIC32MZ simulator test on draft PRs Juliusz Sosinowicz 2026-06-18 12:45:22 +00:00
  • 3dd04c818c CI: hand off mbedtls/nss build via artifact on cache miss Juliusz Sosinowicz 2026-06-18 12:53:57 +00:00
  • 058f506407 CI: factor threadx NetXDuo version into NETXDUO_REF env var Juliusz Sosinowicz 2026-06-18 12:30:24 +00:00