From d4ea9dd08b642161e2959771716c061decab90cf Mon Sep 17 00:00:00 2001 From: Kareem Date: Tue, 28 Jul 2026 18:15:52 -0700 Subject: [PATCH] Fix multiple issues with WOLFSSL_CHECK_SIG_FAULTS + HAVE_PK_CALLBACKS. --- .github/workflows/os-check.yml | 2 ++ .github/workflows/wolfsm.yml | 6 ++++- src/internal.c | 41 +++++++++++++++++++++------------- src/tls13.c | 7 ++++-- 4 files changed, 38 insertions(+), 18 deletions(-) diff --git a/.github/workflows/os-check.yml b/.github/workflows/os-check.yml index 2d39f5f284..8ebbec088e 100644 --- a/.github/workflows/os-check.yml +++ b/.github/workflows/os-check.yml @@ -165,6 +165,8 @@ jobs: "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_DEBUG_CERTS"]}, {"name": "all-hash-keep", "minutes": 7.8, "configure": ["--enable-all", "CPPFLAGS=-DWOLFSSL_HASH_KEEP"]}, + {"name": "all-faultharden", "minutes": 7.8, + "configure": ["--enable-all", "--enable-faultharden"]}, {"name": "all-no-pkcs7-stream", "minutes": 7.0, "comment": "Non-streaming PKCS#7 exercises the multi-certificate decode bound in pkcs7_signed_multi_cert_test(); the streaming default cannot reach that off-by-idx path.", "configure": ["--enable-all", "CPPFLAGS=-DNO_PKCS7_STREAM"]}, diff --git a/.github/workflows/wolfsm.yml b/.github/workflows/wolfsm.yml index 927a709f46..ed5ae40cec 100644 --- a/.github/workflows/wolfsm.yml +++ b/.github/workflows/wolfsm.yml @@ -94,7 +94,11 @@ jobs: {"name": "sm4-all-modes", "minutes": 1.5, "configure": ["--enable-sm2", "--enable-sm3", "--enable-sm4-ecb", "--enable-sm4-cbc", "--enable-sm4-ctr", "--enable-sm4-gcm", - "--enable-sm4-ccm", "--enable-sha3"]} + "--enable-sm4-ccm", "--enable-sha3"]}, + {"name": "sm-faultharden", "minutes": 1.5, + "configure": ["--enable-sm2", "--enable-sm3", "--enable-sm4-ecb", + "--enable-sm4-cbc", "--enable-sm4-ctr", "--enable-sm4-gcm", + "--enable-sm4-ccm", "--enable-sha3", "--enable-faultharden"]} ] EOF .github/scripts/parallel-make-check.py \ diff --git a/src/internal.c b/src/internal.c index 3ec871608c..03450f100f 100644 --- a/src/internal.c +++ b/src/internal.c @@ -36519,15 +36519,20 @@ int SendCertificateVerify(WOLFSSL* ssl) #ifdef HAVE_PK_CALLBACKS buffer tmp; - tmp.length = ssl->buffers.key->length; - tmp.buffer = ssl->buffers.key->buffer; + /* Private key may be held by the PK callback. */ + tmp.length = ssl->buffers.key ? + ssl->buffers.key->length : 0; + tmp.buffer = ssl->buffers.key ? + ssl->buffers.key->buffer : NULL; #endif - ret = Sm3wSm2Verify(ssl, + /* Sm2wSm3Sign() was given the handshake messages and + * not the digest - verify over the same data. */ + ret = Sm2wSm3Verify(ssl, TLS12_SM2_SIG_ID, TLS12_SM2_SIG_ID_SZ, ssl->buffers.sig.buffer, ssl->buffers.sig.length, - ssl->buffers.digest.buffer, - ssl->buffers.digest.length, key, + ssl->hsHashes->messages, + ssl->hsHashes->length, key, #ifdef HAVE_PK_CALLBACKS &tmp #else @@ -36541,8 +36546,11 @@ int SendCertificateVerify(WOLFSSL* ssl) #ifdef HAVE_PK_CALLBACKS buffer tmp; - tmp.length = ssl->buffers.key->length; - tmp.buffer = ssl->buffers.key->buffer; + /* Private key may be held by the PK callback. */ + tmp.length = ssl->buffers.key ? + ssl->buffers.key->length : 0; + tmp.buffer = ssl->buffers.key ? + ssl->buffers.key->buffer : NULL; #endif ret = EccVerify(ssl, @@ -38584,6 +38592,16 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl) #ifdef WOLFSSL_CHECK_SIG_FAULTS { ecc_key* key = (ecc_key*)ssl->hsKey; + #ifdef HAVE_PK_CALLBACKS + buffer tmp; + + /* Private key may be held by the PK + * callback. */ + tmp.length = ssl->buffers.key ? + ssl->buffers.key->length : 0; + tmp.buffer = ssl->buffers.key ? + ssl->buffers.key->buffer : NULL; + #endif #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3) if (ssl->options.sigAlgo == sm2_sa_algo) { @@ -38595,7 +38613,7 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl) ssl->buffers.sig.length, key, #ifdef HAVE_PK_CALLBACKS - ssl->buffers.key + &tmp #else NULL #endif @@ -38604,13 +38622,6 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl) else #endif /* WOLFSSL_SM2 */ { - #ifdef HAVE_PK_CALLBACKS - buffer tmp; - - tmp.length = ssl->buffers.key->length; - tmp.buffer = ssl->buffers.key->buffer; - #endif - ret = EccVerify(ssl, args->output + LENGTH_SZ + args->idx, args->sigSz, diff --git a/src/tls13.c b/src/tls13.c index 5b785e7eb4..de407fc465 100644 --- a/src/tls13.c +++ b/src/tls13.c @@ -10720,8 +10720,11 @@ static int SendTls13CertificateVerify(WOLFSSL* ssl) #ifdef HAVE_PK_CALLBACKS buffer tmp; - tmp.length = ssl->buffers.key->length; - tmp.buffer = ssl->buffers.key->buffer; + /* Private key may be held by the PK callback. */ + tmp.length = ssl->buffers.key ? + ssl->buffers.key->length : 0; + tmp.buffer = ssl->buffers.key ? + ssl->buffers.key->buffer : NULL; #endif ret = EccVerify(ssl, sigOut, args->sigLen, args->sigData, args->sigDataSz,