WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity
2,350 Commits
1 Branch
34 Tags
29 MiB
Commit Graph

2350 Commits (master)

Author SHA1 Message Date
David Garske 4947973367
Merge pull request #594 from aidangarske/spdm-policy-transport 
Add TPM2_PolicyTransportSPDM support for client and firmware TPM
 2026-09-17 07:11:09 -07:00
David Garske 4603f83ac3
Merge pull request #610 from aidangarske/fwtpm-no-nv-context-slots 
Reduce the fwTPM RAM use when NV is disabled
 2026-09-16 11:46:50 -07:00
Aidan Garske 64a6437e0e Reduce FWTPM_NO_NV context memory 2026-09-16 10:41:13 -07:00
Aidan Garske 3c3dfa9282 Gate SPDM channel return codes by spec or feature 2026-09-15 12:34:28 -07:00
Aidan Garske 485b3c93b2 Remove duplicate v1.85 channel response code enum definitions 2026-09-15 12:24:05 -07:00
Aidan Garske 64f2db9fcb Add SPDM-bound NV policy examples 
Add an NV binding example and extend the SPDM control flow to exercise PSK- and certificate-authenticated policy sessions. Document and automate the end-to-end policy checks.
 2026-09-15 12:24:05 -07:00
Aidan Garske ecf89639a8 Enforce SPDM transport policies in the firmware TPM 
Implement PolicyTransportSPDM and the SPDM session-info capability in the fwTPM. Track authenticated responder key names, fail closed on malformed state, and add regression coverage for policy enforcement.
 2026-09-15 12:24:05 -07:00
Aidan Garske b064b409ae Add TPM PolicyTransportSPDM client support 
Define the command, capability structures, and wrapper APIs needed to bind TPM policies to authenticated SPDM sessions. Reject malformed or truncated session-info responses and cover the client paths in unit tests.
 2026-09-15 12:24:05 -07:00
David Garske c3c0621333
Merge pull request #609 from aidangarske/dist-include-missing-files 
Include missing dist files
 2026-09-14 15:19:20 -07:00
Aidan Garske 7ce6923f98 Add a release check that rebuilds the source tarball with every feature 2026-09-14 14:16:32 -07:00
Aidan Garske a89169ef05 Include SPDM, PQC, test and CMake files in the source distribution 2026-09-14 13:28:18 -07:00
David Garske f32bf3d3aa
Merge pull request #590 from aidangarske/release-v4.2.0 
Bump version to v4.2.0 and add the 4.2.0 ChangeLog
 2026-09-14 11:48:13 -07:00
Aidan Garske 2b489b66da Bump version to v4.2.0 and add the 4.2.0 ChangeLog 2026-09-14 11:03:51 -07:00
David Garske 2a726188ea
Merge pull request #608 from aidangarske/fenrir-fixes-14014-14015-14068-14072-14073-14074-14087 
Fix fwTPM SPDM and TPM transport security findings
 2026-09-14 10:19:12 -07:00
Aidan Garske 9d4b182887 F-14074 - Bind the full keyed-hash secret into the public unique value 2026-09-14 10:00:49 -07:00
Aidan Garske 2a8c1e2e2b F-14073 - Reject policy session auth for empty authPolicy entities 2026-09-14 10:00:48 -07:00
Aidan Garske e61b751dd0 F-14072 - Reject Rewrap on a truncated duplicate parameter 2026-09-14 10:00:47 -07:00
Aidan Garske b543f546a2 F-14087 - Clear sensitive request bytes from the shared command buffer 2026-09-14 10:00:46 -07:00
Aidan Garske 0fb80e09ac F-14015 - Fail TPM2_ParsePublic on packet overflow 2026-09-14 10:00:30 -07:00
Aidan Garske a84cb5f31f F-14014 - Normalize a granted TIS locality to TPM_RC_SUCCESS 2026-09-14 10:00:29 -07:00
Aidan Garske 498a8e103a
Merge pull request #606 from dgarske/pqc_no_wolfcrypt_build 
Fix --enable-pqc build with --disable-wolfcrypt
 2026-09-11 12:35:54 -07:00
David Garske 6908d34f57
Merge pull request #605 from aidangarske/coverity-913526-fwtpm-name-deadcode 
Guard fwTPM public name computation on buffer allocation success
 2026-09-11 11:28:48 -07:00
David Garske 01aef89af0 Fix --enable-pqc build with --disable-wolfcrypt 2026-09-11 11:14:06 -07:00
David Garske a2c3103e6e
Merge pull request #604 from aidangarske/fenrir-fixes-9172-13499 
Harden wolfTPM examples fwTPM and SPDM error handling and secret zeroization
 2026-09-11 09:31:34 -07:00
Aidan Garske b571dfba5f Guard fwTPM public name computation on buffer allocation success 2026-09-11 09:17:49 -07:00
David Garske 4ff1972737
Merge pull request #603 from aidangarske/codeql-46-unseal-permissions 
Restrict unsealed output file permissions
 2026-09-10 16:13:34 -07:00
Aidan Garske 1d8ea0cfd2 Advance SPDM receive sequence after auth and harden size checks 2026-09-10 14:05:48 -07:00
Aidan Garske 58d0fa65fb F-9194 - Zeroize the command auth cache on every process command exit 2026-09-10 13:10:33 -07:00
Aidan Garske c33c5036e2 F-11933 - Skip the authorization area in no-auth-handle session commands 2026-09-10 13:10:33 -07:00
Aidan Garske c06f2c2cb8 F-13499 - Run the PolicyTemplate compare without short-circuiting on size 2026-09-10 13:10:33 -07:00
Aidan Garske 6ecdd4ba8b F-13498 - Run policy assertion compares without short-circuiting on size 2026-09-10 13:10:33 -07:00
Aidan Garske 7ce7a67919 F-12713 - Reject malformed PCR_Read selection counts and sizes 2026-09-10 13:10:33 -07:00
Aidan Garske e15f515b66 F-13529 - Guard the EncryptDecrypt input buffer against a NULL allocation 2026-09-10 13:10:32 -07:00
Aidan Garske d679f5bec5 F-13530 - Guard the encrypted salt zeroization against a NULL buffer 2026-09-10 13:10:32 -07:00
Aidan Garske 022fe8409d F-13531 - Guard the object name marshalling on a successful allocation 2026-09-10 13:10:32 -07:00
Aidan Garske ed95d45f64 F-11916 - Use a constant-time compare for the primary key cache lookup 2026-09-10 13:10:32 -07:00
Aidan Garske 651a35f2a5 F-12755 - Zeroize the session start nonce structures on all exits 2026-09-10 13:09:24 -07:00
Aidan Garske facc55c239 F-9193 - Assert the TIS FIFO can hold the maximum command response 2026-09-10 13:09:24 -07:00
Aidan Garske 7f02facf89 F-12707 - Clean up wolfCrypt only when its init succeeded 2026-09-10 13:09:24 -07:00
Aidan Garske efa68e4acf F-11932 - Zeroize the hierarchy authorization stack buffer 2026-09-10 13:09:24 -07:00
Aidan Garske 36a549d773 F-11931 - Zeroize the PCR authorization buffer before freeing 2026-09-10 13:09:24 -07:00
Aidan Garske b8615b3504 F-11930 - Zeroize the NV save marshal buffer before grow frees 2026-09-10 13:09:24 -07:00
Aidan Garske f53b7ecf65 F-10824 - Zeroize the NV journal load buffer before freeing 2026-09-10 13:09:24 -07:00
Aidan Garske b12c95e64a F-11929 - Zeroize the append-only NV replay buffer before freeing 2026-09-10 13:09:24 -07:00
Aidan Garske ae3581982e F-13453 - Preserve an allocation failure before generating the context IV 2026-09-10 13:09:24 -07:00
Aidan Garske 55135d1cd2 F-13452 - Free the wrap HMAC only after it is initialized 2026-09-10 13:09:24 -07:00
Aidan Garske ef6e19e25b F-11934 - Advance the SPDM receive sequence only after authentication 2026-09-10 13:09:24 -07:00
Aidan Garske 60fd8ae1d2 F-9185 - Fail MCTP encryption once the sequence number exceeds 16 bits 2026-09-10 13:09:24 -07:00
Aidan Garske 3ac5feb984 F-13467 - Validate declared PSK exchange field lengths against the request 2026-09-10 13:09:24 -07:00
Aidan Garske 550277ef13 F-9177 - Reset the responder only after the end session ack is encrypted 2026-09-10 13:09:24 -07:00