The HUK HMAC accumulation buffer now lives on the inner SHA-256 devCtx and relies
on the cryptocb copy/free ops so wc_HmacCopy/wc_HmacFree manage it correctly.
In-memory TLS 1.2 ECDHE-ECDSA handshake with the server certificate ECDSA P-256
signature produced on the HUK HW engine via a PK sign callback. The rest of TLS
(PRF/HMAC, record AES-GCM, ECDHE) stays in software: a whole-CTX WC_HUK_DEVID
would route TLS's own 32-byte HMAC keys (e.g. the P-256 ECDHE pre-master in the
PRF) to the HUK, whose key==seed semantics break key derivation. Validated on
RTL8735B silicon.
- http_client_signed: check build_http_request() return before
send() and cast to size_t; free key on import_private_only
failure.
- http_server_verify: consolidate main() error paths around a
single "cleanup:" label so pubKey and listenFd are released
uniformly (import_public, socket, bind, listen).
- test_vectors: guard ed25519_free with per-key init flags so
the shared cleanup path never frees an uninitialized struct.
- wc_http_sig.h: document that WC_SF_MAX_STRING / WC_SF_MAX_ITEMS
drive ~12KB stack usage and must be tuned for embedded targets.
- wc_sf: reject *outSz > INT_MAX in wc_SfGenSigParams and
wc_SfGenSigInput to guard word32 -> int casts (matches
build_signature_base).
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
- LoadFile now validates fread read the full file size and returns NULL
on short read.
- ocsp-responder-http checks wolfSSL_Init return value.
- Remove bare scope block around sigaction setup.
- Add SO_RCVTIMEO (5s) on accepted client sockets to prevent indefinite
blocking from incomplete requests
- Move 64KB httpBuf/respBuf from stack to static globals
- Fix SendAll infinite loop when send() returns 0 (check n <= 0)
- Ignore SIGPIPE to prevent crash on client disconnect during writes
- Use case-insensitive Content-Length header matching per RFC 7230
- Track error state and return nonzero from main on fatal errors
- Reset ret after wolfSSL_CertManagerLoadCABuffer to avoid leaking
WOLFSSL_SUCCESS (1) into error paths in ocsp-request-response.c
- Add -Wextra to Makefile CFLAGS
- Add missing <time.h> include for time(NULL) usage
- Replace atoi() with strtol() and validate Content-Length in RecvHttp
and ParsePost to reject negative/overflowing values
- Add SendAll() helper to handle partial send() writes
- Check return values of socket(), setsockopt(), and listen()
Three examples demonstrating the new OCSP Responder API:
1. ocsp-request-response.c - Pure API usage: encode DER OCSP requests
from certificates, generate signed responses, and verify them
in memory without networking.
2. ocsp-responder-http.c - Minimal HTTP server that accepts POST
requests with DER OCSP payloads and returns signed responses.
3. nginx-scgi/ - Production-style deployment using nginx as HTTP
frontend with wolfclu running as an SCGI backend for OCSP
processing.
David Garske
Juliusz Sosinowicz
Hosam Elkoulak
Kaleb Himes
Lealem Amedie
Paul Adelsbach
Sameeh Jubran
night1rider
Juliusz Sosinowicz
tmael
JacobBarthelmeh
Eric Blankenhorn
sebastian-carpenter