From 9c2ab5def674d8c5dfd45fe8020ed7932a404e18 Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Thu, 27 Aug 2026 04:28:38 +0200 Subject: [PATCH 1/5] F-10044: zero result_tmp buffer before use --- wolfcrypt/src/port/maxim/max3266x.c | 1 + 1 file changed, 1 insertion(+) diff --git a/wolfcrypt/src/port/maxim/max3266x.c b/wolfcrypt/src/port/maxim/max3266x.c index 7d0dcaca845..3b3bbe405bb 100644 --- a/wolfcrypt/src/port/maxim/max3266x.c +++ b/wolfcrypt/src/port/maxim/max3266x.c @@ -2332,6 +2332,7 @@ int wc_MXC_MAA_math(mp_int* multiplier, mp_int* multiplicand, mp_int* exp, if ((multiplier == result) || (multiplicand == result) || (exp == result) || (mod == result)) { MAX3266X_MSG("Creating Temp Result Buffer for Hardware"); + XMEMSET(&result_tmp, 0, sizeof(mp_int)); result_tmp_ptr = &result_tmp; /* Assign point to temp struct */ } else { From 5bc52a4fcc5de693f9cd44722b2ac201378b49e0 Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Thu, 27 Aug 2026 04:58:39 +0200 Subject: [PATCH 2/5] F-10725, F-10726: forbid CertificateRequest over QUIC after handshake MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both server side (don't send) and client side (alert). This is disallowed by RFC 9001 ยง4.4. --- src/tls13.c | 15 +++++++++++++++ tests/quic.c | 9 +++++++++ 2 files changed, 24 insertions(+) diff --git a/src/tls13.c b/src/tls13.c index 1322d76df55..493e8f3dbd4 100644 --- a/src/tls13.c +++ b/src/tls13.c @@ -6257,6 +6257,13 @@ static int DoTls13CertificateRequest(WOLFSSL* ssl, const byte* input, } } #ifdef WOLFSSL_POST_HANDSHAKE_AUTH +#ifdef WOLFSSL_QUIC + else if (WOLFSSL_IS_QUIC(ssl)) { + SendAlert(ssl, alert_fatal, unexpected_message); + WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E); + return OUT_OF_ORDER_E; + } +#endif else if (len == 0) { /* RFC 8446 Section 4.3.2: a post-handshake CertificateRequest context * MUST be non-empty and unique for the connection. */ @@ -16587,6 +16594,10 @@ int wolfSSL_allow_post_handshake_auth(WOLFSSL* ssl) { if (ssl == NULL || !IsAtLeastTLSv1_3(ssl->version)) return BAD_FUNC_ARG; +#ifdef WOLFSSL_QUIC + if (WOLFSSL_IS_QUIC(ssl)) + return BAD_FUNC_ARG; +#endif if (ssl->options.side == WOLFSSL_SERVER_END) return SIDE_ERROR; if (ssl->options.handShakeState != NULL_STATE) @@ -16612,6 +16623,10 @@ int wolfSSL_request_certificate(WOLFSSL* ssl) if (ssl == NULL || !IsAtLeastTLSv1_3(ssl->version)) return BAD_FUNC_ARG; +#ifdef WOLFSSL_QUIC + if (WOLFSSL_IS_QUIC(ssl)) + return BAD_FUNC_ARG; +#endif #ifndef NO_WOLFSSL_SERVER if (ssl->options.side == WOLFSSL_CLIENT_END) return SIDE_ERROR; diff --git a/tests/quic.c b/tests/quic.c index 2ff4f20cbd2..f3cd3bbc61e 100644 --- a/tests/quic.c +++ b/tests/quic.c @@ -178,6 +178,15 @@ static int test_set_quic_method(void) { ExpectTrue(wolfSSL_set_quic_method(ssl, &dummy_method) == WOLFSSL_SUCCESS); ExpectTrue(wolfSSL_is_quic(ssl)); /* Check some default, initial behaviour */ +#ifdef WOLFSSL_POST_HANDSHAKE_AUTH + /* RFC 9001 Section 4.4: no post-handshake authentication over QUIC */ + if (valids[i].is_server) { + ExpectIntEQ(wolfSSL_request_certificate(ssl), BAD_FUNC_ARG); + } + else { + ExpectIntEQ(wolfSSL_allow_post_handshake_auth(ssl), BAD_FUNC_ARG); + } +#endif ExpectTrue(wolfSSL_set_quic_transport_params(ssl, NULL, 0) == WOLFSSL_SUCCESS); wolfSSL_get_peer_quic_transport_params(ssl, &data, &data_len); ExpectNull(data); From 498bd019d7c9aa4bf9fc63b0b835cedc34c74638 Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Thu, 27 Aug 2026 05:20:23 +0200 Subject: [PATCH 3/5] Update documentation comment --- src/tls13.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/tls13.c b/src/tls13.c index 493e8f3dbd4..2df7bdff7ba 100644 --- a/src/tls13.c +++ b/src/tls13.c @@ -16583,9 +16583,9 @@ int wolfSSL_CTX_allow_post_handshake_auth(WOLFSSL_CTX* ctx) /* Allow post-handshake authentication in TLS v1.3 connection. * * ssl The SSL/TLS object. - * returns BAD_FUNC_ARG when ssl is NULL, or not using TLS v1.3, - * SIDE_ERROR when not a client, BAD_STATE_E when called after the handshake - * has started, and 0 on success. + * returns BAD_FUNC_ARG when ssl is NULL, not using TLS v1.3, or running over + * QUIC, SIDE_ERROR when not a client, BAD_STATE_E when called after the + * handshake has started, and 0 on success. * * Must be called before wolfSSL_connect() so the post_handshake_auth * extension can be included in the ClientHello. From d1932ec049e17e193a0059cab6f4d01e5c593efb Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Wed, 2 Sep 2026 18:11:21 +0200 Subject: [PATCH 4/5] Avoid duplicate SendAlert in QUIC CertificateRequest --- src/tls13.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/tls13.c b/src/tls13.c index 2df7bdff7ba..5b5d521e702 100644 --- a/src/tls13.c +++ b/src/tls13.c @@ -6259,7 +6259,6 @@ static int DoTls13CertificateRequest(WOLFSSL* ssl, const byte* input, #ifdef WOLFSSL_POST_HANDSHAKE_AUTH #ifdef WOLFSSL_QUIC else if (WOLFSSL_IS_QUIC(ssl)) { - SendAlert(ssl, alert_fatal, unexpected_message); WOLFSSL_ERROR_VERBOSE(OUT_OF_ORDER_E); return OUT_OF_ORDER_E; } From 8881f4333c0eef60da437f70f1d81abed62edbc6 Mon Sep 17 00:00:00 2001 From: Mattia Moffa Date: Wed, 2 Sep 2026 18:23:08 +0200 Subject: [PATCH 5/5] Test that a QUIC client rejects a post-handshake CertificateRequest --- tests/quic.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/tests/quic.c b/tests/quic.c index f3cd3bbc61e..ceefe1a0197 100644 --- a/tests/quic.c +++ b/tests/quic.c @@ -1831,6 +1831,52 @@ static int test_quic_key_update_rejected(int verbose) { return EXPECT_RESULT(); } +#ifdef WOLFSSL_POST_HANDSHAKE_AUTH +static int test_quic_cert_req_rejected(int verbose) { + EXPECT_DECLS; + WOLFSSL_CTX * ctx_c = NULL; + WOLFSSL_CTX * ctx_s = NULL; + QuicTestContext tclient, tserver; + QuicConversation conv; + uint8_t lbuffer[16]; + size_t len; + int ret; + + ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method())); + ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method())); + ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile, + WOLFSSL_FILETYPE_PEM)); + ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile, + WOLFSSL_FILETYPE_PEM)); + ExpectIntEQ(wolfSSL_CTX_allow_post_handshake_auth(ctx_c), 0); + + /* complete a normal QUIC handshake */ + QuicTestContext_init(&tclient, ctx_c, "client", verbose); + QuicTestContext_init(&tserver, ctx_s, "server", verbose); + QuicConversation_init(&conv, &tclient, &tserver); + QuicConversation_do(&conv); + + /* RFC 9001 section 4.4: servers must not send post-handshake + * CertificateRequest messages and clients must treat their receipt as a + * connection error. */ + len = fake_record(certificate_request, OPAQUE8_LEN, lbuffer); + lbuffer[HANDSHAKE_HEADER_SZ] = 0; + ExpectIntEQ(wolfSSL_provide_quic_data(tclient.ssl, + wolfssl_encryption_application, lbuffer, len), WOLFSSL_SUCCESS); + ret = wolfSSL_process_quic_post_handshake(tclient.ssl); + ExpectIntEQ(ret, WC_NO_ERR_TRACE(OUT_OF_ORDER_E)); + + QuicTestContext_free(&tclient); + QuicTestContext_free(&tserver); + + wolfSSL_CTX_free(ctx_c); + wolfSSL_CTX_free(ctx_s); + printf(" test_quic_cert_req_rejected: %s\n", + EXPECT_RESULT() ? pass : fail); + return EXPECT_RESULT(); +} +#endif /* WOLFSSL_POST_HANDSHAKE_AUTH */ + /* This has gotten a bit out of hand. */ #if (defined(OPENSSL_ALL) || (defined(OPENSSL_EXTRA) && \ (defined(HAVE_STUNNEL) || defined(WOLFSSL_NGINX) || \ @@ -2462,6 +2508,9 @@ int QuicTest(void) if ((ret = test_quic_big_client_hello(verbose)) != TEST_SUCCESS) goto leave; if ((ret = test_quic_server_hello_fail(verbose)) != TEST_SUCCESS) goto leave; if ((ret = test_quic_key_update_rejected(verbose)) != TEST_SUCCESS) goto leave; +#ifdef WOLFSSL_POST_HANDSHAKE_AUTH + if ((ret = test_quic_cert_req_rejected(verbose)) != TEST_SUCCESS) goto leave; +#endif #ifdef REALLY_HAVE_ALPN_AND_SNI if ((ret = test_quic_alpn(verbose)) != TEST_SUCCESS) goto leave; #endif /* REALLY_HAVE_ALPN_AND_SNI */