Skip to content

Commit 4fbd4fd

Browse files
dgarskedgarske
authored
Merge pull request #5917 from JacobBarthelmeh/release
prepare for release 5.5.4
2 parents 509ad07 + cca63a4 commit 4fbd4fd

8 files changed

Lines changed: 362 additions & 128 deletions

File tree

‎CMakeLists.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,16 @@ if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
2828
You must delete them, or cmake will refuse to work.")
2929
endif()
3030

31-
project(wolfssl VERSION 5.5.3 LANGUAGES C ASM)
31+
project(wolfssl VERSION 5.5.4 LANGUAGES C ASM)
3232

3333
# shared library versioning
3434
# increment if interfaces have been added, removed or changed
35-
set(LIBTOOL_CURRENT 37)
35+
set(LIBTOOL_CURRENT 38)
3636
# increment if source code has changed set to zero if current is incremented
37-
set(LIBTOOL_REVISION 1)
37+
set(LIBTOOL_REVISION 0)
3838
# increment if interfaces have been added set to zero if interfaces have been
3939
# removed or changed
40-
set(LIBTOOL_AGE 2)
40+
set(LIBTOOL_AGE 3)
4141

4242
math(EXPR LIBTOOL_SO_VERSION "${LIBTOOL_CURRENT} - ${LIBTOOL_AGE}")
4343
set(LIBTOOL_FULL_VERSION ${LIBTOOL_SO_VERSION}.${LIBTOOL_AGE}.${LIBTOOL_REVISION})

‎ChangeLog.md‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,123 @@
1+
# wolfSSL Release 5.5.4 (Dec 21, 2022)
2+
3+
Release 5.5.4 of wolfSSL embedded TLS has bug fixes and new features including:
4+
5+
## New Feature Additions
6+
7+
* QUIC related changes for HAProxy integration and config option
8+
* Support for Analog Devices MAXQ1080 and MAXQ1065
9+
* Testing and build of wolfSSL with NuttX
10+
* New software based entropy gatherer with configure option --enable-entropy-memuse
11+
* NXP SE050 feature expansion and fixes, adding in RSA support and conditional compile of AES and CMAC
12+
* Support for multi-threaded sniffer
13+
14+
## Improvements / Optimizations
15+
16+
### Benchmark and Tests
17+
* Add alternate test case for unsupported static memory API when testing mutex allocations
18+
* Additional unit test cases added for AES CCM 256-bit
19+
* Initialize and free AES object with benchmarking AES-OFB
20+
* Kyber with DTLS 1.3 tests added
21+
* Tidy up Espressif ESP32 test and benchmark examples
22+
* Rework to be able to run API tests individually and add display of time taken per test
23+
24+
### Build and Port Improvements
25+
* Add check for 64-bit ABI on MIPS64 before declaring a 64-bit CPU
26+
* Add support to detect SIZEOF_LONG in armclang and diab
27+
* Added in a simple example working on Rx72n
28+
* Update azsphere support to prevent compilation of file included inline
29+
* --enable-brainpool configure option added and default to on when custom curves are also on
30+
* Add RSA PSS salt defines to engine builds if not FIPS v2
31+
32+
### Post Quantum
33+
* Remove kyber-90s and route all Kyber through wolfcrypt
34+
* Purge older version of NTRU and SABER from wolfSSL
35+
36+
### SP Math
37+
* Support static memory build with sp-math
38+
* SP C, SP int: improve performance
39+
* SP int: support mingw64 again
40+
* SP int: enhancements to guess 64-bit type and check on NO_64BIT macro set before using long long
41+
* SP int: check size required when using sp_int on stack
42+
* SP: --enable-sp-asm now enables SP by default if not set
43+
* SP: support aarch64 big endian
44+
45+
### DTLS
46+
* Allow DTLS 1.3 to compile when FIPS is enabled
47+
* Allow for stateless DTLS client hello parsing
48+
49+
### Misc.
50+
* Easier detection of DRBG health when using Intel’s RDRAND by updating the structures status value
51+
* Detection of duplicate known extensions with TLS
52+
* PKCS#11 handle a user PIN that is a NULL_PTR, compile time check in finding keys, add initialization API
53+
* Update max Cert Policy size based on RFC 5280
54+
* Add Android CA certs path for wolfSSL_CTX_load_system_CA_certs()
55+
* Improve logic for enabling system CA certs on Apple devices
56+
* Stub functions to allow for cpuid public functions with non-intel builds
57+
* Increase RNG_SECURITY_STRENGTH for FIPS
58+
* Improvements in OpenSSL Compat ERR Queue handling
59+
* Support ASN1/DER CRLs in LoadCertByIssuer
60+
* Expose more ECC math functions and improve async shared secret
61+
* Improvement for sniffer error messages
62+
* Warning added that renegotiation in TLS 1.3 requires session ticket
63+
* Adjustment for TLS 1.3 post auth support
64+
* Rework DH API and improve PEM read/write
65+
66+
## Fixes
67+
68+
### Build Fixes
69+
* Fix --enable-devcrypto build error for sys without u_int8_t type
70+
* Fix casts in evp.c and build issue in ParseCRL
71+
* Fixes for compatibility layer building with heap hint and OSSL callbacks
72+
* fix compile error due to Werro=undef on gcc-4.8
73+
* Fix mingw-w64 build issues on windows
74+
* Xcode project fixes for different build settings
75+
* Initialize variable causing failures with gcc-11 and gcc-12 with a unique wolfSSL build configuration
76+
* Prevent WOLFSSL_NO_MALLOC from breaking RSA certificate verification
77+
* Fixes for various tests that do not properly handle `WC_PENDING_E` with async. builds
78+
* Fix for misc `HashObject` to be excluded for `WOLFCRYPT_ONLY`
79+
80+
### OCSP Fixes
81+
* Correctly save next status with OCSP response verify
82+
* When the OCSP responder returns an unknown exception, continue through to checking the CRL
83+
84+
### Math Fixes
85+
* Fix for implicit conversion with 32-bit in SP math
86+
* Fix for error checks when modulus is even with SP int build
87+
* Fix for checking of err in _sp_exptmod_nct with SP int build
88+
* ECC cofactor fix when checking scalar bits
89+
* ARM32 ASM: don't use ldrd on user data
90+
* SP int, fix when ECC specific size code included
91+
92+
### Port Fixes
93+
* Fixes for STM32 PKA ECC (not 256-bit) and improvements for AES-GCM
94+
* Fix for cryptocell signature verification with ECC
95+
* Benchmark devid changes, CCM with SECO fix, set IV on AES import into SECO
96+
97+
### Compat. Layer Fixes
98+
* Fix for handling DEFAULT:... cipher suite list
99+
* Fix memory leak in wolfSSL_X509_NAME_ENTRY_get_object
100+
* Set alt name type to V_ASN1_IA5STRING
101+
* Update name hash functions wolfSSL_X509_subject_name_hash and wolfSSL_X509_issuer_name_hash to hash the canonical form of subject
102+
* Fix wolfSSL_set_SSL_CTX() to be usable during handshake
103+
* Fix X509_get1_ocsp to set num of elements in stack
104+
* X509v3 EXT d2i: fix freeing of aia
105+
* Fix to remove recreation of certificate with wolfSSL_PEM_write_bio_X509()
106+
* Link newly created x509 store's certificate manager to self by default to assist with CRL verification
107+
* Fix for compatibility `EC_KEY_new_by_curve_name` to not create a key if the curve is not found
108+
109+
### Misc.
110+
* Free potential signer malloc in a fail case
111+
* fix other name san parsing and add RID cert to test parsing
112+
* WOLFSSL_OP_NO_TICKET fix for TLSv1.2
113+
* fix ASN template parsing of X509 subject directory attribute
114+
* Fix the wrong IV size with the cipher suite TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256
115+
* Fix incorrect self signed error return when compiled with certreq and certgen.
116+
* Fix wrong function name in debug comment with wolfSSL_X509_get_name_oneline()
117+
* Fix for decryption after second handshake with async sniffer
118+
* Allow session tickets to properly resume when using PQ KEMs
119+
* Add sanity overflow check to DecodeAltNames input buffer access
120+
1121
# wolfSSL Release 5.5.3 (Nov 2, 2022)
2122

3123
Release 5.5.3 of wolfSSL embedded TLS has the following bug fix:

‎IDE/WIN10/wolfssl-fips.rc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ END
5151
//
5252

5353
VS_VERSION_INFO VERSIONINFO
54-
FILEVERSION 5,5,3,0
55-
PRODUCTVERSION 5,5,3,0
54+
FILEVERSION 5,5,4,0
55+
PRODUCTVERSION 5,5,4,0
5656
FILEFLAGSMASK 0x3fL
5757
#ifdef _DEBUG
5858
FILEFLAGS 0x1L
@@ -69,12 +69,12 @@ BEGIN
6969
BEGIN
7070
VALUE "CompanyName", "wolfSSL Inc."
7171
VALUE "FileDescription", "The wolfSSL FIPS embedded SSL library is a lightweight, portable, C-language-based SSL/TLS library targeted at IoT, embedded, and RTOS environments primarily because of its size, speed, and feature set."
72-
VALUE "FileVersion", "5.5.3.0"
72+
VALUE "FileVersion", "5.5.4.0"
7373
VALUE "InternalName", "wolfssl-fips"
7474
VALUE "LegalCopyright", "Copyright (C) 2022"
7575
VALUE "OriginalFilename", "wolfssl-fips.dll"
7676
VALUE "ProductName", "wolfSSL FIPS"
77-
VALUE "ProductVersion", "5.5.3.0"
77+
VALUE "ProductVersion", "5.5.4.0"
7878
END
7979
END
8080
BLOCK "VarFileInfo"

‎README‎

Lines changed: 114 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -70,69 +70,126 @@ should be used for the enum name.
7070

7171
*** end Notes ***
7272

73+
# wolfSSL Release 5.5.4 (Dec 21, 2022)
7374

74-
# wolfSSL Release 5.5.3 (Nov 2, 2022)
75+
Release 5.5.4 of wolfSSL embedded TLS has bug fixes and new features including:
7576

76-
Release 5.5.3 of wolfSSL embedded TLS has the following bug fix:
77-
78-
## Fixes
79-
80-
* Fix for possible buffer zeroization overrun introduced at the end of v5.5.2 release cycle in GitHub pull request 5743 (https://github.com/wolfSSL/wolfssl/pull/5743) and fixed in pull request 5757 (https://github.com/wolfSSL/wolfssl/pull/5757). In the case where a specific memory allocation failed or a hardware fault happened there was the potential for an overrun of 0’s when masking the buffer used for (D)TLS 1.2 and lower operations. (D)TLS 1.3 only and crypto only users are not affected by the issue. This is not related in any way to recent issues reported in OpenSSL.
81-
82-
83-
# wolfSSL Release 5.5.2 (Oct 28, 2022)
84-
Release 5.5.2 of wolfSSL embedded TLS has bug fixes and new features including:
77+
## New Feature Additions
8578

86-
## Vulnerabilities
87-
* [Med] In the case that the WOLFSSL_CALLBACKS macro is set when building wolfSSL, there is a potential heap over read of 5 bytes when handling TLS 1.3 client connections. This heap over read is limited to wolfSSL builds explicitly setting the macro WOLFSSL_CALLBACKS, the feature does not get turned on by any other build options. The macro WOLFSSL_CALLBACKS is intended for debug use only, but if having it enabled in production, users are recommended to disable WOLFSSL_CALLBACKS. Users enabling WOLFSSL_CALLBACKS are recommended to update their version of wolfSSL. Thanks to Lucca Hirschi and Steve Kremer from LORIA, Inria and Max Ammann from Trail of Bits for finding and reporting the bug with the tlspuffin tool developed partly at LORIA and Trail of Bits. CVE 2022-42905
79+
* QUIC related changes for HAProxy integration and config option
80+
* Support for Analog Devices MAXQ1080 and MAXQ1065
81+
* Testing and build of wolfSSL with NuttX
82+
* New software based entropy gatherer with configure option --enable-entropy-memuse
83+
* NXP SE050 feature expansion and fixes, adding in RSA support and conditional compile of AES and CMAC
84+
* Support for multi-threaded sniffer
85+
86+
## Improvements / Optimizations
87+
88+
### Benchmark and Tests
89+
* Add alternate test case for unsupported static memory API when testing mutex allocations
90+
* Additional unit test cases added for AES CCM 256-bit
91+
* Initialize and free AES object with benchmarking AES-OFB
92+
* Kyber with DTLS 1.3 tests added
93+
* Tidy up Espressif ESP32 test and benchmark examples
94+
* Rework to be able to run API tests individually and add display of time taken per test
95+
96+
### Build and Port Improvements
97+
* Add check for 64-bit ABI on MIPS64 before declaring a 64-bit CPU
98+
* Add support to detect SIZEOF_LONG in armclang and diab
99+
* Added in a simple example working on Rx72n
100+
* Update azsphere support to prevent compilation of file included inline
101+
* --enable-brainpool configure option added and default to on when custom curves are also on
102+
* Add RSA PSS salt defines to engine builds if not FIPS v2
103+
104+
### Post Quantum
105+
* Remove kyber-90s and route all Kyber through wolfcrypt
106+
* Purge older version of NTRU and SABER from wolfSSL
107+
108+
### SP Math
109+
* Support static memory build with sp-math
110+
* SP C, SP int: improve performance
111+
* SP int: support mingw64 again
112+
* SP int: enhancements to guess 64-bit type and check on NO_64BIT macro set before using long long
113+
* SP int: check size required when using sp_int on stack
114+
* SP: --enable-sp-asm now enables SP by default if not set
115+
* SP: support aarch64 big endian
116+
117+
### DTLS
118+
* Allow DTLS 1.3 to compile when FIPS is enabled
119+
* Allow for stateless DTLS client hello parsing
120+
121+
### Misc.
122+
* Easier detection of DRBG health when using Intel’s RDRAND by updating the structures status value
123+
* Detection of duplicate known extensions with TLS
124+
* PKCS#11 handle a user PIN that is a NULL_PTR, compile time check in finding keys, add initialization API
125+
* Update max Cert Policy size based on RFC 5280
126+
* Add Android CA certs path for wolfSSL_CTX_load_system_CA_certs()
127+
* Improve logic for enabling system CA certs on Apple devices
128+
* Stub functions to allow for cpuid public functions with non-intel builds
129+
* Increase RNG_SECURITY_STRENGTH for FIPS
130+
* Improvements in OpenSSL Compat ERR Queue handling
131+
* Support ASN1/DER CRLs in LoadCertByIssuer
132+
* Expose more ECC math functions and improve async shared secret
133+
* Improvement for sniffer error messages
134+
* Warning added that renegotiation in TLS 1.3 requires session ticket
135+
* Adjustment for TLS 1.3 post auth support
136+
* Rework DH API and improve PEM read/write
88137

89-
Release 5.5.2 of wolfSSL embedded TLS has bug fixes and new features including:
138+
## Fixes
90139

91-
## New Feature Additions
92-
* Add function wolfSSL_CTX_load_system_CA_certs to load system CA certs into a WOLFSSL_CTX and --sys-ca-certs option to example client
93-
* Add wolfSSL_set1_host to OpenSSL compatible API
94-
* Added the function sk_X509_shift
95-
* AES x86 ASM for AES-CBC and GCM performance enhancements
96-
* Add assembly for AES for ARM32 without using crypto hardware instructions
97-
* Xilinx Versal port and hardware acceleration tie in
98-
* SP Cortex-M support for ICCARM
99-
100-
## Enhancements
101-
* Add snifftest vcxproj file and documentation
102-
* Nucleus Thread Types supported
103-
* Handle certificates with RSA-PSS signature that have RSAk public keys
104-
* Small stack build improvements
105-
* DTLS 1.3 improvements for Alerts and unit tests
106-
* Add a binary search for CRL
107-
* Improvement of SSL/CTX_set_max_early_data() for client side
108-
* Remove unused ASN1_GENERALIZEDTIME enum value from wolfssl/ssl.h
109-
* Add user_settings.h for Intel/M1 FIPSv2 macOS C++ projects
110-
* Add dtlscid.test to ‘make check’ unit testing
111-
* Generate an assembler-safe user_settings.h in configure.ac and CMakeLists.txt
112-
* ForceZero enabled with USE_FAST_MATH
113-
* Add TLS 1.3 support of ticketNonce sizes bigger than MAX_TICKET_NONCE_SZ
114-
* FIPSv2 builds on win10 adjust for new fastmath default in settings.h
115-
* Add IRQ install for Aruix example
140+
### Build Fixes
141+
* Fix --enable-devcrypto build error for sys without u_int8_t type
142+
* Fix casts in evp.c and build issue in ParseCRL
143+
* Fixes for compatibility layer building with heap hint and OSSL callbacks
144+
* fix compile error due to Werro=undef on gcc-4.8
145+
* Fix mingw-w64 build issues on windows
146+
* Xcode project fixes for different build settings
147+
* Initialize variable causing failures with gcc-11 and gcc-12 with a unique wolfSSL build configuration
148+
* Prevent WOLFSSL_NO_MALLOC from breaking RSA certificate verification
149+
* Fixes for various tests that do not properly handle `WC_PENDING_E` with async. builds
150+
* Fix for misc `HashObject` to be excluded for `WOLFCRYPT_ONLY`
151+
152+
### OCSP Fixes
153+
* Correctly save next status with OCSP response verify
154+
* When the OCSP responder returns an unknown exception, continue through to checking the CRL
155+
156+
### Math Fixes
157+
* Fix for implicit conversion with 32-bit in SP math
158+
* Fix for error checks when modulus is even with SP int build
159+
* Fix for checking of err in _sp_exptmod_nct with SP int build
160+
* ECC cofactor fix when checking scalar bits
161+
* ARM32 ASM: don't use ldrd on user data
162+
* SP int, fix when ECC specific size code included
163+
164+
### Port Fixes
165+
* Fixes for STM32 PKA ECC (not 256-bit) and improvements for AES-GCM
166+
* Fix for cryptocell signature verification with ECC
167+
* Benchmark devid changes, CCM with SECO fix, set IV on AES import into SECO
168+
169+
### Compat. Layer Fixes
170+
* Fix for handling DEFAULT:... cipher suite list
171+
* Fix memory leak in wolfSSL_X509_NAME_ENTRY_get_object
172+
* Set alt name type to V_ASN1_IA5STRING
173+
* Update name hash functions wolfSSL_X509_subject_name_hash and wolfSSL_X509_issuer_name_hash to hash the canonical form of subject
174+
* Fix wolfSSL_set_SSL_CTX() to be usable during handshake
175+
* Fix X509_get1_ocsp to set num of elements in stack
176+
* X509v3 EXT d2i: fix freeing of aia
177+
* Fix to remove recreation of certificate with wolfSSL_PEM_write_bio_X509()
178+
* Link newly created x509 store's certificate manager to self by default to assist with CRL verification
179+
* Fix for compatibility `EC_KEY_new_by_curve_name` to not create a key if the curve is not found
180+
181+
### Misc.
182+
* Free potential signer malloc in a fail case
183+
* fix other name san parsing and add RID cert to test parsing
184+
* WOLFSSL_OP_NO_TICKET fix for TLSv1.2
185+
* fix ASN template parsing of X509 subject directory attribute
186+
* Fix the wrong IV size with the cipher suite TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256
187+
* Fix incorrect self signed error return when compiled with certreq and certgen.
188+
* Fix wrong function name in debug comment with wolfSSL_X509_get_name_oneline()
189+
* Fix for decryption after second handshake with async sniffer
190+
* Allow session tickets to properly resume when using PQ KEMs
191+
* Add sanity overflow check to DecodeAltNames input buffer access
116192

117-
## Fixes
118-
* When looking up the session by ID on the server, check that the protocol version of the SSL and session match on TLS 1.3 or not
119-
* Fix for potential EVP_PKEY_DH memory leak with OPENSSL_EXTRA
120-
* Curve448 32-bit C code: handle corner case
121-
* Fixup builds using WOLFSSL_LOG_PRINTF
122-
* Correct DIST_POINT_NAME type value
123-
* Do not perform IV Wrap test when using cert3389 inlined armasm
124-
* Fix for Linux kernel module and stdio.h
125-
* (D)TLS: send alert on version mismatch
126-
* Fix PKCS#7 SignedData verification when signer cert is not first in SET
127-
* Fix bug with wolfIO_TcpConnect not working with timeout on Windows
128-
* Fix output length bug in SP non-blocking ECC shared secret gen
129-
* Fix build with enable-fastmath and disable-rsa
130-
* Correct wolfSSL_sk_X509_new in OpenSSL compatible API
131-
* Fixes for SP and x86_64 with MSVC
132-
* Fix wrong size using DTLSv1.3 in RestartHandshakeHashWithCookie
133-
* Fix redundant file include with TI RTOS build
134-
* Fix wolfCrypt only build with wincrypt.h
135-
* DTLS 1.2: Reset state when sending HelloVerifyRequest
136193

137194
For additional vulnerability information visit the vulnerability page at:
138195
https://www.wolfssl.com/docs/security-vulnerabilities/

0 commit comments

Comments
 (0)