From caaf26f409589fc2fd49895b8d4d876c60ed1b09 Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Wed, 12 Aug 2026 05:15:46 +0200 Subject: [PATCH 1/4] Check result of SendBuffered in wolfSSL_process_quic_post_handshake Fixes F#8863 --- src/quic.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/quic.c b/src/quic.c index d725022593..66e5e0cb17 100644 --- a/src/quic.c +++ b/src/quic.c @@ -695,7 +695,10 @@ int wolfSSL_process_quic_post_handshake(WOLFSSL* ssl) } } while (ssl->buffers.outputBuffer.length > 0) { - SendBuffered(ssl); + if ((nret = SendBuffered(ssl)) < 0) { + ret = nret; + break; + } } cleanup: From c0c6132e42ddb91bc6a3528d3d4e0c0641edd85d Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Wed, 12 Aug 2026 18:40:53 +0200 Subject: [PATCH 2/4] Default resumption ticket enc cb to AES256-GCM when available Fixes F#9091 We can't choose the cipher based on the negotiated cipher strength without restructuring how resumption ticket keys work, but we can at least default to AES256 when available. WOLFSSL_TICKET_ENC_AES128_GCM will revert to the previous behavior. --- src/internal.c | 4 ++-- wolfssl/ssl.h | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/internal.c b/src/internal.c index 004943c4e7..761df9970f 100644 --- a/src/internal.c +++ b/src/internal.c @@ -89,9 +89,9 @@ * WOLFSSL_TICKET_ENC_CHACHA20_POLY1305: * ChaCha20-Poly1305 for ticket encryption default: auto * WOLFSSL_TICKET_ENC_AES128_GCM: - * AES128-GCM for ticket encryption default: auto + * AES128-GCM for ticket encryption default: off * WOLFSSL_TICKET_ENC_AES256_GCM: - * AES256-GCM for ticket encryption default: off + * AES256-GCM for ticket encryption default: auto * WOLFSSL_TICKET_DECRYPT_NO_CREATE: * No new ticket on successful decryption default: off * WOLFSSL_TICKET_ENC_CBC_HMAC: diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h index d992e98f9b..b43ab49cc7 100644 --- a/wolfssl/ssl.h +++ b/wolfssl/ssl.h @@ -5091,7 +5091,8 @@ WOLFSSL_API int wolfSSL_CTX_set_scr_check_enabled(WOLFSSL_CTX* ctx, !defined(WOLFSSL_TICKET_ENC_AES128_GCM) && \ !defined(WOLFSSL_TICKET_ENC_AES256_GCM) #define WOLFSSL_TICKET_KEY_SZ CHACHA20_POLY1305_AEAD_KEYSIZE - #elif defined(WOLFSSL_TICKET_ENC_AES256_GCM) + #elif defined(WOLFSSL_TICKET_ENC_AES256_GCM) || \ + (!defined(WOLFSSL_TICKET_ENC_AES128_GCM) && defined(WOLFSSL_AES_256)) #define WOLFSSL_TICKET_KEY_SZ AES_256_KEY_SIZE #else #define WOLFSSL_TICKET_KEY_SZ AES_128_KEY_SIZE From d75b7894d12b2b827e7a8321147b492870ba4dd0 Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Wed, 12 Aug 2026 20:58:24 +0200 Subject: [PATCH 3/4] Keep unknown FFDHE-range codepoints to comply with RFC 7919 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes F#9093 Per RFC 7919 § 4, any supported_groups codepoint in 256–511 restricts DHE to FFDHE, even if the specific codepoint is unknown. Previously the parser dropped these codepoints, so TLSX_SupportedFFDHE_Set() never saw the offer and left DHE eligible (with a codepoint unsupported by the peer). This fixes it so that unrecognized FFDHE codepoints are recorded. --- src/tls.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/tls.c b/src/tls.c index 895bcb3b99..15b084029d 100644 --- a/src/tls.c +++ b/src/tls.c @@ -5289,6 +5289,33 @@ int TLSX_SupportedCurve_Parse(const WOLFSSL* ssl, const byte* input, if (ret != WOLFSSL_SUCCESS && ret != WC_NO_ERR_TRACE(BAD_FUNC_ARG)) break; +#if defined(HAVE_FFDHE) && !defined(WOLFSSL_NO_TLS12) && \ + !defined(NO_WOLFSSL_SERVER) + /* RFC 7919 Section 4: any codepoint in the FFDHE range (256..511) + * restricts DHE to named groups even when the exact group is + * unknown. Keep it so TLSX_SupportedFFDHE_Set() sees the offer; + * an unsupported name can never match a server group. */ + if (ret == WC_NO_ERR_TRACE(BAD_FUNC_ARG) && isRequest && + WOLFSSL_NAMED_GROUP_IS_FFDHE(name)) { + TLSX* ext = TLSX_Find(*extensions, TLSX_SUPPORTED_GROUPS); + if (ext == NULL) { + SupportedCurve* curve = NULL; + ret = TLSX_SupportedCurve_New(&curve, name, ssl->heap); + if (ret == 0) { + ret = TLSX_Push(extensions, TLSX_SUPPORTED_GROUPS, + curve, ssl->heap); + if (ret != 0) + XFREE(curve, ssl->heap, DYNAMIC_TYPE_TLSX); + } + } + else { + ret = TLSX_SupportedCurve_Append( + (SupportedCurve*)ext->data, name, ssl->heap); + } + if (ret != 0) + break; + } +#endif /* HAVE_FFDHE && !WOLFSSL_NO_TLS12 && !NO_WOLFSSL_SERVER */ ret = 0; } /* All advertised groups are unsupported, so no node was added above. From 816a9e61bf8114a4077029ffd2b89b510db9e84e Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Wed, 12 Aug 2026 22:48:09 +0200 Subject: [PATCH 4/4] Gate FFDHE enforcement on WOLFSSL_QT, not HAVE_DH_DEFAULT_PARAMS Fixes F#9094 HAVE_DH_DEFAULT_PARAMS basically boils down to "not a Qt build", but that's only enforced via autotools/cmake. user_settings.h may omit it unknowingly and silently lose RFC 7919 enforcement. --- src/internal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/internal.c b/src/internal.c index 761df9970f..a44d20b386 100644 --- a/src/internal.c +++ b/src/internal.c @@ -137,7 +137,7 @@ * WOLFSSL_MAXQ10XX_TLS: Maxim MAXQ10xx secure element default: off * WOLFSSL_IOTSAFE: IoTSAFE (GSMA) applet support default: off * WOLFSSL_QNX_CAAM: QNX CAAM crypto module support default: off - * HAVE_DH_DEFAULT_PARAMS: Include default DH parameters default: off + * HAVE_DH_DEFAULT_PARAMS: No effect; kept for build compatibility * HAVE_EXT_CACHE: External session cache callbacks default: off * * Hardening: @@ -41441,7 +41441,7 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl) } -#if defined(HAVE_TLS_EXTENSIONS) && defined(HAVE_DH_DEFAULT_PARAMS) +#if defined(HAVE_TLS_EXTENSIONS) && !defined(WOLFSSL_QT) #if defined(HAVE_FFDHE) && defined(HAVE_SUPPORTED_CURVES) if (TLSX_Find(ssl->extensions, TLSX_SUPPORTED_GROUPS) != NULL) { /* Set FFDHE parameters or clear DHE parameters if FFDH parameters