Skip to content

Engine cleanup and hardening #226

Open
aidangarske wants to merge 42 commits into
wolfSSL:masterfrom
aidangarske:fenrir-findings-fixes
Open

Engine cleanup and hardening #226
aidangarske wants to merge 42 commits into
wolfSSL:masterfrom
aidangarske:fenrir-findings-fixes

Conversation

@aidangarske

@aidangarske aidangarske commented Jun 17, 2026

Copy link
Copy Markdown
Member 
F-4173, F-4174, F-4175, F-4176, F-4177, F-4200, F-4201, F-4202, F-4203, F-4204,
F-4205, F-4206, F-4207, F-4208, F-4209, F-4469, F-4470, F-4471, F-4472, F-4473,
F-4474, F-4477, F-4478, F-4479, F-4480, F-5441, F-5442, F-5443, F-5444, F-5445,
F-5446, F-5447, F-5448, F-5450, F-6009, F-6010, F-6011, F-6013, F-6014

aidangarske added 30 commits June 17, 2026 12:56
@aidangarske
Fix wrong variable in NULL check after EVP_CIPHER_meth_new for AES-CB…
4ba0fd1 
…C-HMAC
@aidangarske
Validate record length in AES-CBC-HMAC TLS decrypt to prevent underflow
7ed5e44
@aidangarske
Handle NULL output length query in RSA private decrypt
35a9a2a
@aidangarske
Use correct element size when copying RSA NID list into digest method
d9d3c6f
@aidangarske
Correct inverted NULL check on cipher data in we_aes_cbc_ctrl
411627c
@aidangarske
Correct inverted NULL check on cipher data in we_aes_ecb_ctrl
bfff84a
@aidangarske
Correct inverted NULL check on cipher data in we_des3_cbc_ctrl
46ae9c8
@aidangarske
Initialize AES-ECB key alongside wc_AesInit when key is provided
86d15cf
@aidangarske
Reject unknown digest names in TLS1-PRF and HKDF ctrl_str handlers
29007f3
@aidangarske
Initialize ECDSA signature mp_ints once in direct sign path
d25f537
@aidangarske
Free DH generator buffer on all paths in key generation
05b0870
@aidangarske
Clamp GCM IV increment loop to avoid out-of-bounds write for short IVs
dee9486
@aidangarske
Propagate EVP_CIPHER_asn1_to_param failure in PBES2 key generation
bbf0e46
@aidangarske
Return 0 not -1 from AES-CTR init on IV-set failure
821b1ed
@aidangarske
Use AES block size for AES-CTR block counter modulus
2f78625
@aidangarske
Log salt pointer not key in HKDF salt allocation failure
92dfc06
@aidangarske
Advance buffer index by two after debug separator in hex dump
e4e17ac
@aidangarske
Fix mismatched endif comment in we_random.c
308fbad
@aidangarske
Match RNG cleanup condition to RNG init condition
3732cb2
@aidangarske
Only store RSA-PSS salt length when padding mode is PSS
70f603f
@aidangarske
Free buffered GCM input before reallocating on repeated update
ddbb407
@aidangarske
Zeroize buffered GCM plaintext when freeing in final and cleanup
c5a7898
@aidangarske
Use clear_realloc to wipe relocated HMAC key padding buffer
5a3702b
@aidangarske
Free ASN1 key when EVP_PKEY_assign fails in HMAC keygen
0e1cfe6
@aidangarske
Free DH object when EVP_PKEY_assign_DH fails in paramgen
c629cb5
@aidangarske
Free DH object when EVP_PKEY_assign_DH fails in keygen
0e92222
@aidangarske
Free RSA object when EVP_PKEY_assign_RSA fails in keygen
c6abe22
@aidangarske
Zeroize HKDF salt buffer on context cleanup
cbdd2ce
@aidangarske
Cleanse derived key and IV stack buffers in PBE key generation
8342ade
@aidangarske
Zeroize private key BIGNUMs in EC_KEY_oct2priv and DH_set0_key backports
76b800f
@aidangarske aidangarske self-assigned this Jun 17, 2026
@aidangarske
Skip stitched AES-CBC-HMAC and RSA no-padding query tests under FIPS
0f87f18
@aidangarske
Guard remaining new negative tests under FIPS builds
73177c9
@aidangarske
test: skip AES-CBC-HMAC-SHA256 short-record test when stitched cipher…
0a8e791 
… absent

OpenSSL 1.1.1 only provides EVP_aes_128_cbc_hmac_sha256() on platforms
where it has a hand-written stitched implementation (notably AES-NI on
x86_64). On every other build it returns NULL, so EVP_DecryptInit_ex
fails with "no cipher set" before the engine path is ever exercised
and the test asserts an unrelated failure.

Detect the NULL cipher and return success so the suite is portable to
non-x86_64 agents and to x86_64 VMs without AES-NI passthrough.
@aidangarske aidangarske force-pushed the fenrir-findings-fixes branch from 1c1a90e to 0a8e791 Compare June 17, 2026 23:23
@aidangarske
Revert "Allow empty HMAC raw private key import while bounding length…
5fdc1ca 
…" because its test_hmac_empty_raw_key crashes the Non FIPSv2 CI job with a double free on OpenSSL 1.1.1b.
@aidangarske aidangarske force-pushed the fenrir-findings-fixes branch from f7f7274 to 5fdc1ca Compare June 18, 2026 00:48
@aidangarske aidangarske marked this pull request as ready for review June 18, 2026 15:48
@aidangarske aidangarske requested a review from ColtonWilley June 18, 2026 15:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ColtonWilley ColtonWilley Awaiting requested review from ColtonWilley

At least 1 approving review is required to merge this pull request.

Assignees

@aidangarske aidangarske

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aidangarske