diff --git a/RPi-Pico/src/time.c b/RPi-Pico/src/time.c
index 72927c87..56c946db 100644
--- a/RPi-Pico/src/time.c
+++ b/RPi-Pico/src/time.c
@@ -36,12 +36,12 @@ int time_init()
}
printf("%d, %d, %d, %d, %d, %d\n",
t.tm_year, t.tm_mon, t.tm_mday,
- t.tm_hour, t.tm_min, &t.tm_sec);
+ t.tm_hour, t.tm_min, t.tm_sec);
if (t.tm_year < 70)
t.tm_year += 100; /* base year of 1900 */
t.tm_mon--;
epoch_base = mktime(&t);
- printf("epoch base = %d\n", epoch_base);
+ printf("epoch base = %ld\n", epoch_base);
return 0;
}
diff --git a/TOPPERS/README-en.md b/TOPPERS/README-en.md
index d778e92e..0c9b612c 100644
--- a/TOPPERS/README-en.md
+++ b/TOPPERS/README-en.md
@@ -123,6 +123,12 @@ If you have used the smart configurator to generate code for [r_bsp],[r_cmt_rx],
Note:
`T4_Library_ether_ccrx_rxv1_little` may be an error in the linker immediately after configuration/build Clear There is, but `T4_Library_ether_ccrx_rxv1_little`` from [Linker]/[Archives]/[User defined archive (library) files (-I)]/[×] in [Settings] of the [Properties] dialog [C/C++ Build] of the project. Please delete it.
+3-10. Local Verification of ECC Configuration (USE_ECC_CERT)
+
+To locally compile and verify the build with ECC certificate support:
+1. Define the macro `USE_ECC_CERT` in `TOPPERS/WolfSSLDemo/src/wolfDemo/user_settings.h` (e.g., `#define USE_ECC_CERT`) or add it to the compiler preprocessor macros list in the e² studio project configuration.
+2. Build the project as described in step 3-8 to ensure that the code under `#if defined(USE_ECC_CERT)` compiles without errors.
+
### 3-1 Run Server Program
3-1-1. Enable `#define WOLFSSL_SERVER_TEST` in `wolf_demo.h`. IP addres will be assigned by DHCP.
diff --git a/TOPPERS/WolfSSLDemo/src/wolfDemo/wolf_client.c b/TOPPERS/WolfSSLDemo/src/wolfDemo/wolf_client.c
index 59e74c4b..2848218d 100644
--- a/TOPPERS/WolfSSLDemo/src/wolfDemo/wolf_client.c
+++ b/TOPPERS/WolfSSLDemo/src/wolfDemo/wolf_client.c
@@ -160,7 +160,7 @@ int wolfSSL_TLS_client(void *v_ctx, func_args *args)
cliecc_cert_der_256,
sizeof_cliecc_cert_der_256,
WOLFSSL_FILETYPE_ASN1);
- if(err != SSL_SUCCESS) {
+ if(ret != SSL_SUCCESS) {
printf("ERROR: can't load client-certificate\n");
ret = -1;
goto exit_;
diff --git a/fullstack/freertos-wolfip-wolfssl-https/src/wolfip_freertos.c b/fullstack/freertos-wolfip-wolfssl-https/src/wolfip_freertos.c
index 6984db7e..e2e1731f 100644
--- a/fullstack/freertos-wolfip-wolfssl-https/src/wolfip_freertos.c
+++ b/fullstack/freertos-wolfip-wolfssl-https/src/wolfip_freertos.c
@@ -21,6 +21,7 @@
#include "wolfip_freertos.h"
#include
+#include
#include
#include
#include
@@ -36,8 +37,20 @@
/* Implementation of wolfIP's required random number generator */
uint32_t wolfIP_getrandom(void) {
- uint32_t ret;
- getrandom(&ret, sizeof(ret), 0);
+ uint32_t ret = 0;
+ size_t got = 0;
+
+ while (got < sizeof(ret)) {
+ ssize_t r = getrandom(((uint8_t*)&ret) + got, sizeof(ret) - got, 0);
+ if (r <= 0) {
+ if (r < 0 && errno == EINTR) {
+ continue;
+ }
+ fprintf(stderr, "getrandom() failed, aborting\n");
+ abort();
+ }
+ got += (size_t)r;
+ }
return ret;
}
diff --git a/lwip/example-lwip-native-echoclient.c b/lwip/example-lwip-native-echoclient.c
index dfe9bdae..28c9799e 100644
--- a/lwip/example-lwip-native-echoclient.c
+++ b/lwip/example-lwip-native-echoclient.c
@@ -65,7 +65,7 @@
#endif
#ifndef MAX_MSG_SIZE
-#define MAX_MSG_SIZE
+#define MAX_MSG_SIZE 1024
#endif
#define TEST_MSG "TLS **TEST 1** "
@@ -127,7 +127,7 @@ void tls_echoclient_connect(void)
/* read a reply from the server */
if (tlsWaitingForReply == 1) {
memset(reply, 0, sizeof(reply));
- ret = wolfSSL_read(ssl, reply, sizeof(reply));
+ ret = wolfSSL_read(ssl, reply, sizeof(reply) - 1);
if (ret <= 0) {
err = wolfSSL_get_error(ssl, 0);
if (err != SSL_ERROR_WANT_READ &&
@@ -137,6 +137,7 @@ void tls_echoclient_connect(void)
}
}
if (ret > 0) {
+ reply[ret] = '\0';
loggingCb(0, reply);
TLS_shutdown(); /* received reply, done with connection */
}
@@ -181,10 +182,7 @@ static int TLS_setup(void)
return ERR_MEM;
}
-#if 1
- /* Disable peer certificate validation for testing */
- wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
-#endif
+ wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL);
ssl = wolfSSL_new(ctx);
if (ssl == NULL) {
diff --git a/mynewt/client-tls-mn.c b/mynewt/client-tls-mn.c
index 505e7c90..f365dba8 100644
--- a/mynewt/client-tls-mn.c
+++ b/mynewt/client-tls-mn.c
@@ -35,7 +35,6 @@
#include
#include
-// #include
#include
#include
@@ -57,7 +56,7 @@ extern time_t time(time_t*);
#define USE_CERT_BUFFERS_2048
#include
-#define DEFAULT_IPADDR "93.184.216.34" // www.example.com
+#define DEFAULT_IPADDR "93.184.216.34" /* www.example.com */
#define DEFAULT_PORT 443
struct os_sem test_sem;
@@ -173,11 +172,11 @@ net_cli(int argc, char **argv)
int port = DEFAULT_PORT;
if(argc > 3) {
- // get ip address from argument
+ /* get ip address from argument */
addrStr = argv[2];
}
if(argc > 4) {
- // get port number from argument
+ /* get port number from argument */
char *eptr = NULL;
port = strtoul(argv[3], &eptr, 0);
if (*eptr != '\0') {
@@ -381,7 +380,7 @@ static WOLFSSL* ssl = NULL;
static int wolfssl_ctx_init() {
if(wolfsslCtx && ssl) {
console_printf("ERROR: already initialize WOLFSSL_CTX and ssl\n");
- return -1; // already init
+ return -1; /* already init */
}
/* Create and initialize WOLFSSL_CTX */
diff --git a/psk/server-psk-tls13-multi-id.c b/psk/server-psk-tls13-multi-id.c
index 33701823..83abeb56 100644
--- a/psk/server-psk-tls13-multi-id.c
+++ b/psk/server-psk-tls13-multi-id.c
@@ -194,8 +194,8 @@ int main()
if (n > 0) {
printf("%s\n", buf);
/* server response */
- if (wolfSSL_write(ssl, response, strlen(response)) >
- strlen(response)) {
+ if (wolfSSL_write(ssl, response, strlen(response)) !=
+ (int)strlen(response)) {
printf("Fatal error : respond: write error\n");
return 1;
}
diff --git a/stsafe/platform/stse_platform_linux.c b/stsafe/platform/stse_platform_linux.c
index 28748afb..63d907b9 100644
--- a/stsafe/platform/stse_platform_linux.c
+++ b/stsafe/platform/stse_platform_linux.c
@@ -121,6 +121,9 @@ stse_ReturnCode_t stse_platform_i2c_send_continue(
(void)speed;
if (data_size != 0) {
+ if ((PLAT_UI32)i2c_tx_frame_offset + data_size > I2C_BUFFER_SIZE) {
+ return STSE_PLATFORM_BUFFER_ERR;
+ }
if (pData == NULL) {
memset((I2c_tx_buffer + i2c_tx_frame_offset), 0x00, data_size);
} else {
@@ -150,6 +153,9 @@ stse_ReturnCode_t stse_platform_i2c_send_stop(
/* Add final element if provided */
if (pElement != NULL && element_size > 0) {
+ if ((PLAT_UI32)i2c_tx_frame_offset + element_size > I2C_BUFFER_SIZE) {
+ return STSE_PLATFORM_BUFFER_ERR;
+ }
memcpy((I2c_tx_buffer + i2c_tx_frame_offset), pElement, element_size);
i2c_tx_frame_offset += element_size;
}
@@ -203,6 +209,7 @@ stse_ReturnCode_t stse_platform_i2c_send(
return STSE_OK;
}
+/* \note pFrame_payload must be at least I2C_BUFFER_SIZE bytes. */
stse_ReturnCode_t stse_platform_i2c_receive(
PLAT_UI8 busID,
PLAT_UI8 devAddr,
@@ -242,6 +249,11 @@ stse_ReturnCode_t stse_platform_i2c_receive(
}
PLAT_UI16 payload_len = ((PLAT_UI16)len_bytes[0] << 8) | len_bytes[1];
+
+ if (payload_len > I2C_BUFFER_SIZE) {
+ return STSE_PLATFORM_BUFFER_ERR;
+ }
+
*pFrame_payload_Length = payload_len;
if (payload_len > 0 && pFrame_payload != NULL) {
diff --git a/utasker/wolfSSLClientTask.c b/utasker/wolfSSLClientTask.c
index 584609b3..7e81d91a 100644
--- a/utasker/wolfSSLClientTask.c
+++ b/utasker/wolfSSLClientTask.c
@@ -388,6 +388,7 @@ extern void fnTLSClientTask(TTASKTABLE *ptrTaskTable)
if (sslCtx == NULL) {
fnDebugMsg("ERROR: wolfSSL_CTX_new() failed\r\n");
clientState = clientShutdown;
+ return;
}
else {
fnDebugMsg("status: Created WOLFSSL_CTX\r\n");
@@ -404,6 +405,7 @@ extern void fnTLSClientTask(TTASKTABLE *ptrTaskTable)
if (ret != SSL_SUCCESS) {
fnDebugMsg("ERROR: wolfSSL_CTX_load_verify_buffer\r\n");
clientState = clientShutdown;
+ return;
}
else {
fnDebugMsg("status: Loaded trusted CA certificates\r\n");
@@ -428,6 +430,7 @@ extern void fnTLSClientTask(TTASKTABLE *ptrTaskTable)
if (ssl == NULL) {
fnDebugMsg("ERROR: wolfSSL_new\r\n");
clientState = clientShutdown;
+ return;
}
else {
fnDebugMsg("status: Created WOLFSSL session object\r\n");
diff --git a/utasker/wolfSSLServerTask.c b/utasker/wolfSSLServerTask.c
index d6adcdb0..5fafa954 100644
--- a/utasker/wolfSSLServerTask.c
+++ b/utasker/wolfSSLServerTask.c
@@ -104,6 +104,7 @@ int CacheRecvBuffer(UTASKER_RECVCTX* ctx, unsigned char* data,
int ResetRecvBuffer(UTASKER_RECVCTX* ctx);
int UTasker_Receive(WOLFSSL* ssl, char* buf, int sz, void* ctx);
int UTasker_Send(WOLFSSL* ssl, char* buf, int sz, void* ctx);
+static void AbortServerTLSInit(void);
/* ---------------------------- SOCKET LISTENERS --------------------------- */
@@ -171,6 +172,18 @@ static int fnServerListener(USOCKET Socket, unsigned char ucEvent,
/* ------------------------------- APP TASK -------------------------------- */
+/*
+ * release resources acquired so far during serverTLSInit and abort setup
+ */
+static void AbortServerTLSInit(void)
+{
+ if (sslCtx != NULL) {
+ wolfSSL_CTX_free(sslCtx);
+ sslCtx = NULL;
+ }
+ wolfSSL_Cleanup();
+ serverState = serverIdle;
+}
/*
* wolfSSL server app task
@@ -208,7 +221,8 @@ extern void fnTLSServerTask(TTASKTABLE *ptrTaskTable)
sslCtx = wolfSSL_CTX_new(wolfTLSv1_2_server_method());
if (sslCtx == NULL) {
fnDebugMsg("ERROR: wolfSSL_CTX_new() failed\r\n");
- serverState = serverShutdown;
+ AbortServerTLSInit();
+ return;
}
else {
fnDebugMsg("status: Created WOLFSSL_CTX\r\n");
@@ -220,7 +234,8 @@ extern void fnTLSServerTask(TTASKTABLE *ptrTaskTable)
SSL_FILETYPE_ASN1);
if (ret != SSL_SUCCESS) {
fnDebugMsg("ERROR: wolfSSL_CTX_use_certificate_chain_buffer\r\n");
- serverState = serverShutdown;
+ AbortServerTLSInit();
+ return;
}
/* load server private key */
@@ -229,7 +244,8 @@ extern void fnTLSServerTask(TTASKTABLE *ptrTaskTable)
SSL_FILETYPE_ASN1);
if (ret != SSL_SUCCESS) {
fnDebugMsg("ERROR: wolfSSL_CTX_use_PrivateKey_buffer\r\n");
- serverState = serverShutdown;
+ AbortServerTLSInit();
+ return;
}
/* register wolfSSL send/recv callbacks */
@@ -268,6 +284,7 @@ extern void fnTLSServerTask(TTASKTABLE *ptrTaskTable)
if (ssl == NULL) {
fnDebugMsg("ERROR: wolfSSL_new\r\n");
serverState = serverShutdown;
+ return;
}
else {
fnDebugMsg("status: Created WOLFSSL session object\r\n");