Update wolfSSL

source/libs/libwolfssl/callbacks.h

@@ -1,6 +1,6 @@
 /* callbacks.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/crl.h

@@ -1,6 +1,6 @@
 /* crl.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/error-ssl.h

@@ -1,6 +1,6 @@
 /* error-ssl.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -170,6 +170,9 @@ enum wolfSSL_ErrorCodes {
     DTLS_SIZE_ERROR              = -439,   /* Trying to send too much data */
     NO_CERT_ERROR                = -440,   /* TLS1.3 - no cert set error */
     APP_DATA_READY               = -441,   /* DTLS1.2 application data ready for read */
+    TOO_MUCH_EARLY_DATA          = -442,   /* Too much Early data */
+
+    SOCKET_FILTERED_E            = -443,   /* Session stopped by network filter */
 
     /* add strings to wolfSSL_ERR_reason_error_string in internal.c !!!!! */
 

source/libs/libwolfssl/internal.h

@@ -1,6 +1,6 @@
 /* internal.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -59,6 +59,9 @@
 #ifdef HAVE_POLY1305
     #include <libs/libwolfssl/wolfcrypt/poly1305.h>
 #endif
+#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && defined(OPENSSL_EXTRA)
+    #include <libs/libwolfssl/wolfcrypt/chacha20_poly1305.h>
+#endif
 #ifdef HAVE_CAMELLIA
     #include <libs/libwolfssl/wolfcrypt/camellia.h>
 #endif
@@ -114,6 +117,15 @@
 #ifdef HAVE_CURVE448
     #include <libs/libwolfssl/wolfcrypt/curve448.h>
 #endif
+#ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB
+    #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && \
+        !defined(WOLFSSL_TICKET_ENC_AES128_GCM) && \
+        !defined(WOLFSSL_TICKET_ENC_AES256_GCM)
+        #include <libs/libwolfssl/wolfcrypt/chacha20_poly1305.h>
+    #else
+        #include <libs/libwolfssl/wolfcrypt/aes.h>
+    #endif
+#endif
 
 #include <libs/libwolfssl/wolfcrypt/wc_encrypt.h>
 #include <libs/libwolfssl/wolfcrypt/hash.h>
@@ -199,7 +211,11 @@
         #endif
     #endif
     #if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM)
-        #include <unistd.h>      /* for close of BIO */
+        #ifdef FUSION_RTOS
+           #include <fclunistd.h>
+        #else
+            #include <unistd.h>      /* for close of BIO */
+        #endif
     #endif
 #endif
 
@@ -845,6 +861,13 @@
     #endif
 #endif
 
+#if !defined(WOLFCRYPT_ONLY) && defined(NO_PSK) && \
+    (defined(NO_DH) || !defined(HAVE_ANON)) && \
+    defined(NO_RSA) && !defined(HAVE_ECC) && \
+    !defined(HAVE_ED25519) && !defined(HAVE_ED448)
+   #error "No cipher suites avaialble with this build"
+#endif
+
 #ifdef WOLFSSL_MULTICAST
     #if defined(HAVE_NULL_CIPHER) && !defined(NO_SHA256)
         #define BUILD_WDM_WITH_NULL_SHA256
@@ -1141,7 +1164,8 @@ enum {
 #endif /* WOLFSSL_MULTICAST */
 
 #ifndef WOLFSSL_MAX_MTU
-    #define WOLFSSL_MAX_MTU 1500
+    /* 1500 - 100 bytes to account for UDP and IP headers */
+    #define WOLFSSL_MAX_MTU 1400
 #endif /* WOLFSSL_MAX_MTU */
 
 
@@ -1171,8 +1195,8 @@ enum {
 #if (WOLFSSL_MAX_DHKEY_BITS % 8)
     #error DH maximum bit size must be multiple of 8
 #endif
-#if (WOLFSSL_MAX_DHKEY_BITS > 16000)
+#if (WOLFSSL_MAX_DHKEY_BITS > 16384)
-    #error DH maximum bit size must not be greater than 16000
+    #error DH maximum bit size must not be greater than 16384
 #endif
 #define MAX_DHKEY_SZ (WOLFSSL_MAX_DHKEY_BITS / 8)
 
@@ -1232,7 +1256,7 @@ enum Misc {
                                 /* pre RSA and all master */
 #if defined(WOLFSSL_MYSQL_COMPATIBLE) || \
     (defined(USE_FAST_MATH) && defined(FP_MAX_BITS) && FP_MAX_BITS >= 16384)
-#ifndef NO_PSK
+#if !defined(NO_PSK) && defined(USE_FAST_MATH)
     ENCRYPT_LEN     = (FP_MAX_BITS / 2 / 8) + MAX_PSK_ID_LEN + 2,
 #else
     ENCRYPT_LEN     = 1024,     /* allow 8192 bit static buffer */
@@ -1326,9 +1350,9 @@ enum Misc {
     DTLS_EXPORT_PRO          = 165,/* wolfSSL protocol for serialized session */
     DTLS_EXPORT_STATE_PRO    = 166,/* wolfSSL protocol for serialized state */
     DTLS_EXPORT_VERSION      = 4,  /* wolfSSL version for serialized session */
-    DTLS_EXPORT_OPT_SZ       = 60, /* amount of bytes used from Options */
+    DTLS_EXPORT_OPT_SZ       = 61, /* amount of bytes used from Options */
     DTLS_EXPORT_VERSION_3    = 3,  /* wolfSSL version before TLS 1.3 addition */
-    DTLS_EXPORT_OPT_SZ_3     = 59, /* amount of bytes used from Options */
+    DTLS_EXPORT_OPT_SZ_3     = 60, /* amount of bytes used from Options */
     DTLS_EXPORT_KEY_SZ       = 325 + (DTLS_SEQ_SZ * 2),
                                    /* max amount of bytes used from Keys */
     DTLS_EXPORT_MIN_KEY_SZ   = 85 + (DTLS_SEQ_SZ * 2),
@@ -1336,6 +1360,9 @@ enum Misc {
     DTLS_EXPORT_SPC_SZ       = 16, /* amount of bytes used from CipherSpecs */
     DTLS_EXPORT_LEN          = 2,  /* 2 bytes for length and protocol */
     DTLS_EXPORT_IP           = 46, /* max ip size IPv4 mapped IPv6 */
+    DTLS_MTU_ADDITIONAL_READ_BUFFER = 100, /* Additional bytes to read so that
+                                            * we can work with a peer that has
+                                            * a slightly different MTU than us. */
     MAX_EXPORT_BUFFER        = 514, /* max size of buffer for exporting */
     MAX_EXPORT_STATE_BUFFER  = (DTLS_EXPORT_MIN_KEY_SZ) + (3 * DTLS_EXPORT_LEN),
                                     /* max size of buffer for exporting state */
@@ -1469,7 +1496,11 @@ enum Misc {
     MAX_WOLFSSL_FILE_SIZE = 1024ul * 1024ul * 4,  /* 4 mb file size alloc limit */
 #endif
 
+#ifdef WOLFSSL_HAPROXY
+    MAX_X509_SIZE      = 3072, /* max static x509 buffer size */
+#else
     MAX_X509_SIZE      = 2048, /* max static x509 buffer size */
+#endif
     CERT_MIN_SIZE      =  256, /* min PEM cert size with header/footer */
 
     MAX_NTRU_PUB_KEY_SZ = 1027, /* NTRU max for now */
@@ -1585,6 +1616,26 @@ enum Misc {
     #define SESSION_TICKET_HINT_DEFAULT 300
 #endif
 
+#if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(WOLFSSL_NO_SERVER)
+    /* Check chosen encryption is available. */
+    #if !(defined(HAVE_CHACHA) && defined(HAVE_POLY1305)) && \
+        defined(WOLFSSL_TICKET_ENC_CHACHA20_POLY1305)
+        #error "ChaCha20-Poly1305 not available for default ticket encryption"
+    #endif
+    #if !defined(HAVE_AESGCM) && (defined(WOLFSSL_TICKET_ENC_AES128_GCM) || \
+        defined(WOLFSSL_TICKET_ENC_AES256_GCM))
+        #error "AES-GCM not available for default ticket encryption"
+    #endif
+
+    #ifndef WOLFSSL_TICKET_KEY_LIFETIME
+        /* Default lifetime is 1 hour from issue of first ticket with key. */
+        #define WOLFSSL_TICKET_KEY_LIFETIME       (60 * 60)
+    #endif
+    #if WOLFSSL_TICKET_KEY_LIFETIME <= SESSION_TICKET_HINT_DEFAULT
+        #error "Ticket Key lifetime must be longer than ticket life hint."
+    #endif
+#endif
+
 
 /* don't use extra 3/4k stack space unless need to */
 #ifdef HAVE_NTRU
@@ -1648,6 +1699,21 @@ WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_3(void);
     #endif
 #endif
 
+struct WOLFSSL_BY_DIR_HASH {
+    unsigned long hash_value;
+    int last_suffix;
+};
+
+struct WOLFSSL_BY_DIR_entry {
+    char*   dir_name;
+    int     dir_type;
+    WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *hashes;
+};
+
+struct WOLFSSL_BY_DIR {
+    WOLF_STACK_OF(WOLFSSL_BY_DIR_entry) *dir_entry;
+    wolfSSL_Mutex    lock; /* dir list lock */
+};
 
 /* wolfSSL method type */
 struct WOLFSSL_METHOD {
@@ -1680,7 +1746,7 @@ WOLFSSL_LOCAL int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx)
 WOLFSSL_LOCAL int  HandleTlsResumption(WOLFSSL* ssl, int bogusID,
                                        Suites* clSuites);
 #ifdef WOLFSSL_TLS13
-WOLFSSL_LOCAL int FindSuite(Suites* suites, byte first, byte second);
+WOLFSSL_LOCAL byte SuiteMac(byte* suite);
 #endif
 WOLFSSL_LOCAL int  DoClientHello(WOLFSSL* ssl, const byte* input, word32*,
                                  word32);
@@ -1837,9 +1903,10 @@ WOLFSSL_LOCAL void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig,
                                          int haveRSAsig, int haveAnon,
                                          int tls1_2, int keySz);
 WOLFSSL_LOCAL void InitSuites(Suites*, ProtocolVersion, int, word16, word16,
-                              word16, word16, word16, word16, word16, int);
+                              word16, word16, word16, word16, word16, word16, int);
 WOLFSSL_LOCAL int  MatchSuite(WOLFSSL* ssl, Suites* peerSuites);
 WOLFSSL_LOCAL int  SetCipherList(WOLFSSL_CTX*, Suites*, const char* list);
+WOLFSSL_LOCAL int  SetSuitesHashSigAlgo(Suites*, const char* list);
 
 #ifndef PSK_TYPES_DEFINED
     typedef unsigned int (*wc_psk_client_callback)(WOLFSSL*, const char*, char*,
@@ -1847,11 +1914,15 @@ WOLFSSL_LOCAL int  SetCipherList(WOLFSSL_CTX*, Suites*, const char* list);
     typedef unsigned int (*wc_psk_server_callback)(WOLFSSL*, const char*,
                           unsigned char*, unsigned int);
 #ifdef WOLFSSL_TLS13
+    typedef unsigned int (*wc_psk_client_cs_callback)(WOLFSSL*, const char*,
+                          char*, unsigned int, unsigned char*, unsigned int,
+                          const char* cipherName);
     typedef unsigned int (*wc_psk_client_tls13_callback)(WOLFSSL*, const char*,
                           char*, unsigned int, unsigned char*, unsigned int,
-                          const char**);
+                          const char** cipherName);
     typedef unsigned int (*wc_psk_server_tls13_callback)(WOLFSSL*, const char*,
-                          unsigned char*, unsigned int, const char**);
+                          unsigned char*, unsigned int,
+                          const char** cipherName);
 #endif
 #endif /* PSK_TYPES_DEFINED */
 #if defined(WOLFSSL_DTLS) && defined(WOLFSSL_SESSION_EXPORT) && \
@@ -2030,6 +2101,11 @@ struct WOLFSSL_CERT_MANAGER {
 #endif
 #if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
     short           minEccKeySz;         /* minimum allowed ECC key size */
+#endif
+#if defined(OPENSSL_EXTRA)
+    WOLFSSL_X509_STORE  *x509_store_p;  /* a pointer back to CTX x509 store  */
+                                        /* CTX has ownership and free this   */
+                                        /* with CTX free.                    */
 #endif
     wolfSSL_Mutex   refMutex;   /* reference count mutex */
     int             refCount;         /* reference count */
@@ -2248,9 +2324,9 @@ WOLFSSL_LOCAL int   TLSX_WriteResponse(WOLFSSL *ssl, byte* output, byte msgType,
                                         word16* pOffset);
 #endif
 
-WOLFSSL_LOCAL int   TLSX_ParseVersion(WOLFSSL* ssl, byte* input, word16 length,
+WOLFSSL_LOCAL int   TLSX_ParseVersion(WOLFSSL* ssl, const byte* input,
-                                      byte msgType, int* found);
+                                      word16 length, byte msgType, int* found);
-WOLFSSL_LOCAL int   TLSX_Parse(WOLFSSL* ssl, byte* input, word16 length,
+WOLFSSL_LOCAL int   TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length,
                                byte msgType, Suites *suites);
 
 #elif defined(HAVE_SNI)                           \
@@ -2473,6 +2549,28 @@ typedef struct SessionTicket {
     word16 size;
 } SessionTicket;
 
+#if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(WOLFSSL_NO_SERVER)
+
+/* Data passed to default SessionTicket enc/dec callback. */
+typedef struct TicketEncCbCtx {
+    /* Name for this context. */
+    byte name[WOLFSSL_TICKET_NAME_SZ];
+    /* Current keys - current and next. */
+    byte key[2][WOLFSSL_TICKET_KEY_SZ];
+    /* Expirary date of keys. */
+    word32 expirary[2];
+    /* Random number generator to use for generating name, keys and IV. */
+    WC_RNG rng;
+#ifndef SINGLE_THREADED
+    /* Mutex for access to changing keys. */
+    wolfSSL_Mutex mutex;
+#endif
+    /* Pointer back to SSL_CTX. */
+    WOLFSSL_CTX* ctx;
+} TicketEncCbCtx;
+
+#endif /* !WOLFSSL_NO_DEF_TICKET_ENC_CB && !WOLFSSL_NO_SERVER */
+
 WOLFSSL_LOCAL int  TLSX_UseSessionTicket(TLSX** extensions,
                                              SessionTicket* ticket, void* heap);
 WOLFSSL_LOCAL SessionTicket* TLSX_SessionTicket_Create(word32 lifetime,
@@ -2530,7 +2628,7 @@ typedef struct Cookie {
     byte   data;
 } Cookie;
 
-WOLFSSL_LOCAL int TLSX_Cookie_Use(WOLFSSL* ssl, byte* data, word16 len,
+WOLFSSL_LOCAL int TLSX_Cookie_Use(WOLFSSL* ssl, const byte* data, word16 len,
                                   byte* mac, byte macSz, int resp);
 
 
@@ -2541,17 +2639,23 @@ typedef struct KeyShareEntry {
     word16                group;     /* NamedGroup               */
     byte*                 ke;        /* Key exchange data        */
     word32                keLen;     /* Key exchange data length */
-    void*                 key;       /* Private key              */
+    void*                 key;       /* Key struct               */
-    word32                keyLen;    /* Private key length       */
+    word32                keyLen;    /* Key size (bytes)         */
     byte*                 pubKey;    /* Public key               */
     word32                pubKeyLen; /* Public key length        */
+#ifndef NO_DH
+    byte*                 privKey;   /* Private key - DH only    */
+#endif
+#ifdef WOLFSSL_ASYNC_CRYPT
+    int                   lastRet;
+#endif
     struct KeyShareEntry* next;      /* List pointer             */
 } KeyShareEntry;
 
 WOLFSSL_LOCAL int TLSX_KeyShare_Use(WOLFSSL* ssl, word16 group, word16 len,
                                     byte* data, KeyShareEntry **kse);
 WOLFSSL_LOCAL int TLSX_KeyShare_Empty(WOLFSSL* ssl);
-WOLFSSL_LOCAL int TLSX_KeyShare_Establish(WOLFSSL* ssl);
+WOLFSSL_LOCAL int TLSX_KeyShare_Establish(WOLFSSL* ssl, int* doHelloRetry);
 WOLFSSL_LOCAL int TLSX_KeyShare_DeriveSecret(WOLFSSL* ssl);
 
 
@@ -2584,7 +2688,7 @@ WOLFSSL_LOCAL int TLSX_PreSharedKey_WriteBinders(PreSharedKey* list,
                                                  word16* pSz);
 WOLFSSL_LOCAL int TLSX_PreSharedKey_GetSizeBinders(PreSharedKey* list,
                                                    byte msgType, word16* pSz);
-WOLFSSL_LOCAL int TLSX_PreSharedKey_Use(WOLFSSL* ssl, byte* identity,
+WOLFSSL_LOCAL int TLSX_PreSharedKey_Use(WOLFSSL* ssl, const byte* identity,
                                         word16 len, word32 age, byte hmac,
                                         byte cipherSuite0, byte cipherSuite,
                                         byte resumption,
@@ -2625,6 +2729,10 @@ WOLFSSL_LOCAL int DeriveMasterSecret(WOLFSSL* ssl);
 WOLFSSL_LOCAL int DeriveResumptionPSK(WOLFSSL* ssl, byte* nonce, byte nonceLen, byte* secret);
 WOLFSSL_LOCAL int DeriveResumptionSecret(WOLFSSL* ssl, byte* key);
 
+WOLFSSL_LOCAL int Tls13_Exporter(WOLFSSL* ssl, unsigned char *out, size_t outLen,
+        const char *label, size_t labelLen,
+        const unsigned char *context, size_t contextLen);
+
 /* The key update request values for KeyUpdate message. */
 enum KeyUpdateRequest {
     update_not_requested,
@@ -2649,6 +2757,13 @@ typedef struct {
 #endif
 #ifdef HAVE_ECC
     DerBuffer* ecKey;
+#endif
+    /* bits */
+#ifndef NO_DH
+    byte weOwnDH:1;
+#endif
+#ifdef HAVE_ECC
+    byte weOwnEC:1;
 #endif
 } StaticKeyExchangeInfo_t;
 #endif
@@ -2688,6 +2803,9 @@ struct WOLFSSL_CTX {
     byte        privateKeyLabel:1;
     int         privateKeySz;
     int         privateKeyDevId;
+#ifdef OPENSSL_ALL
+    WOLFSSL_EVP_PKEY* privateKeyPKey;
+#endif
     WOLFSSL_CERT_MANAGER* cm;      /* our cert manager, ctx owns SSL will use */
 #endif
 #ifdef KEEP_OUR_CERT
@@ -2719,8 +2837,11 @@ struct WOLFSSL_CTX {
     byte        minDowngrade;     /* minimum downgrade version */
     byte        haveEMS:1;        /* have extended master secret extension */
     byte        useClientOrder:1; /* Use client's cipher preference order */
+#if defined(HAVE_SESSION_TICKET)
+    byte        noTicketTls12:1;  /* TLS 1.2 server won't send ticket */
+#endif
 #ifdef WOLFSSL_TLS13
-    byte        noTicketTls13:1;  /* Server won't create new Ticket */
+    byte        noTicketTls13:1;  /* TLS 1.3 Server won't create new Ticket */
     byte        noPskDheKe:1;     /* Don't use (EC)DHE with PSK */
 #endif
     byte        mutualAuth:1;     /* Mutual authentication required */
@@ -2772,7 +2893,14 @@ struct WOLFSSL_CTX {
     byte              sessionCtxSz;
     byte              cbioFlag;  /* WOLFSSL_CBIO_RECV/SEND: CBIORecv/Send is set */
     CallbackInfoState* CBIS;      /* used to get info about SSL state */
+    WOLFSSL_X509_VERIFY_PARAM* param;    /* verification parameters*/
 #endif
+#ifdef WOLFSSL_WOLFSENTRY_HOOKS
+    NetworkFilterCallback_t AcceptFilter;
+    void *AcceptFilter_arg;
+    NetworkFilterCallback_t ConnectFilter;
+    void *ConnectFilter_arg;
+#endif /* WOLFSSL_WOLFSENTRY_HOOKS */
     CallbackIORecv CBIORecv;
     CallbackIOSend CBIOSend;
 #ifdef WOLFSSL_DTLS
@@ -2803,6 +2931,7 @@ struct WOLFSSL_CTX {
     wc_psk_client_callback client_psk_cb;  /* client callback */
     wc_psk_server_callback server_psk_cb;  /* server callback */
 #ifdef WOLFSSL_TLS13
+    wc_psk_client_cs_callback    client_psk_cs_cb;     /* client callback */
     wc_psk_client_tls13_callback client_psk_tls13_cb;  /* client callback */
     wc_psk_server_tls13_callback server_psk_tls13_cb;  /* server callback */
 #endif
@@ -2864,12 +2993,19 @@ struct WOLFSSL_CTX {
     #if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER)
         SessionTicketEncCb ticketEncCb;   /* enc/dec session ticket Cb */
         void*              ticketEncCtx;  /* session encrypt context */
+        #if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) \
+          || defined(OPENSSL_EXTRA) || defined(HAVE_LIGHTY)
+        ticketCompatCb     ticketEncWrapCb; /* callback for OpenSSL ticket key callback */
+        #endif
         int                ticketHint;    /* ticket hint in seconds */
+        #ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB
+            TicketEncCbCtx ticketKeyCtx;
+        #endif
+    #endif
     #endif
     #ifdef HAVE_SUPPORTED_CURVES
         byte userCurves;                  /* indicates user called wolfSSL_CTX_UseSupportedCurve */
     #endif
-#endif
 #ifdef ATOMIC_USER
     CallbackMacEncrypt    MacEncryptCb;    /* Atomic User Mac/Encrypt Cb */
     CallbackDecryptVerify DecryptVerifyCb; /* Atomic User Decrypt/Verify Cb */
@@ -2884,31 +3020,31 @@ struct WOLFSSL_CTX {
         CallbackEccSign   EccSignCb;    /* User EccSign   Callback handler */
         CallbackEccVerify EccVerifyCb;  /* User EccVerify Callback handler */
         CallbackEccSharedSecret EccSharedSecretCb; /* User EccVerify Callback handler */
-        #ifdef HAVE_ED25519
-            /* User Ed25519Sign   Callback handler */
-            CallbackEd25519Sign   Ed25519SignCb;
-            /* User Ed25519Verify Callback handler */
-            CallbackEd25519Verify Ed25519VerifyCb;
-        #endif
-        #ifdef HAVE_CURVE25519
-            /* User X25519 KeyGen Callback Handler */
-            CallbackX25519KeyGen X25519KeyGenCb;
-            /* User X25519 SharedSecret Callback handler */
-            CallbackX25519SharedSecret X25519SharedSecretCb;
-        #endif
-        #ifdef HAVE_ED448
-            /* User Ed448Sign   Callback handler */
-            CallbackEd448Sign   Ed448SignCb;
-            /* User Ed448Verify Callback handler */
-            CallbackEd448Verify Ed448VerifyCb;
-        #endif
-        #ifdef HAVE_CURVE448
-            /* User X448 KeyGen Callback Handler */
-            CallbackX448KeyGen X448KeyGenCb;
-            /* User X448 SharedSecret Callback handler */
-            CallbackX448SharedSecret X448SharedSecretCb;
-        #endif
     #endif /* HAVE_ECC */
+    #ifdef HAVE_ED25519
+        /* User Ed25519Sign   Callback handler */
+        CallbackEd25519Sign   Ed25519SignCb;
+        /* User Ed25519Verify Callback handler */
+        CallbackEd25519Verify Ed25519VerifyCb;
+    #endif
+    #ifdef HAVE_CURVE25519
+        /* User X25519 KeyGen Callback Handler */
+        CallbackX25519KeyGen X25519KeyGenCb;
+        /* User X25519 SharedSecret Callback handler */
+        CallbackX25519SharedSecret X25519SharedSecretCb;
+    #endif
+    #ifdef HAVE_ED448
+        /* User Ed448Sign   Callback handler */
+        CallbackEd448Sign   Ed448SignCb;
+        /* User Ed448Verify Callback handler */
+        CallbackEd448Verify Ed448VerifyCb;
+    #endif
+    #ifdef HAVE_CURVE448
+        /* User X448 KeyGen Callback Handler */
+        CallbackX448KeyGen X448KeyGenCb;
+        /* User X448 SharedSecret Callback handler */
+        CallbackX448SharedSecret X448SharedSecretCb;
+    #endif
     #ifndef NO_DH
         CallbackDhAgree DhAgreeCb;      /* User DH Agree Callback handler */
     #endif
@@ -2929,7 +3065,7 @@ struct WOLFSSL_CTX {
     WOLF_EVENT_QUEUE event_queue;
 #endif /* HAVE_WOLF_EVENT */
 #ifdef HAVE_EXT_CACHE
-    WOLFSSL_SESSION*(*get_sess_cb)(WOLFSSL*, unsigned char*, int, int*);
+    WOLFSSL_SESSION*(*get_sess_cb)(WOLFSSL*, const unsigned char*, int, int*);
     int (*new_sess_cb)(WOLFSSL*, WOLFSSL_SESSION*);
     void (*rem_sess_cb)(WOLFSSL_CTX*, WOLFSSL_SESSION*);
 #endif
@@ -2937,6 +3073,9 @@ struct WOLFSSL_CTX {
     Srp*  srp;  /* TLS Secure Remote Password Protocol*/
     byte* srp_password;
 #endif
+#if defined(OPENSSL_EXTRA) && defined(HAVE_SECRET_CALLBACK)
+    wolfSSL_CTX_keylog_cb_func keyLogCb;
+#endif /* OPENSSL_EXTRA && HAVE_SECRET_CALLBACK */
 #ifdef WOLFSSL_STATIC_EPHEMERAL
     StaticKeyExchangeInfo_t staticKE;
 #endif
@@ -2949,6 +3088,10 @@ void FreeSSL_Ctx(WOLFSSL_CTX*);
 WOLFSSL_LOCAL
 void SSL_CtxResourceFree(WOLFSSL_CTX*);
 
+#ifdef HAVE_EX_DATA_CLEANUP_HOOKS
+void wolfSSL_CRYPTO_cleanup_ex_data(WOLFSSL_CRYPTO_EX_DATA* ex_data);
+#endif
+
 WOLFSSL_LOCAL
 int DeriveTlsKeys(WOLFSSL* ssl);
 WOLFSSL_LOCAL
@@ -3215,6 +3358,9 @@ struct WOLFSSL_SESSION {
     wolfSSL_Mutex      refMutex;                  /* ref count mutex */
     int                refCount;                  /* reference count */
 #endif
+#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
+    byte               peerVerifyRet;             /* cert verify error */
+#endif
 #ifdef WOLFSSL_TLS13
     word16             namedGroup;
 #endif
@@ -3408,7 +3554,11 @@ typedef struct Options {
 #ifndef NO_PSK
     wc_psk_client_callback client_psk_cb;
     wc_psk_server_callback server_psk_cb;
+#ifdef OPENSSL_EXTRA
+    wc_psk_use_session_cb_func session_psk_cb;
+#endif
 #ifdef WOLFSSL_TLS13
+    wc_psk_client_cs_callback    client_psk_cs_cb;     /* client callback */
     wc_psk_client_tls13_callback client_psk_tls13_cb;  /* client callback */
     wc_psk_server_tls13_callback server_psk_tls13_cb;  /* server callback */
 #endif
@@ -3469,13 +3619,12 @@ typedef struct Options {
 #ifdef HAVE_POLY1305
     word16            oldPoly:1;        /* set when to use old rfc way of poly*/
 #endif
-#ifdef HAVE_ANON
     word16            haveAnon:1;       /* User wants to allow Anon suites */
-#endif
 #ifdef HAVE_SESSION_TICKET
     word16            createTicket:1;     /* Server to create new Ticket */
     word16            useTicket:1;        /* Use Ticket not session cache */
     word16            rejectTicket:1;     /* Callback rejected ticket */
+    word16            noTicketTls12:1;    /* TLS 1.2 server won't send ticket */
 #ifdef WOLFSSL_TLS13
     word16            noTicketTls13:1;    /* Server won't create new Ticket */
 #endif
@@ -3587,6 +3736,9 @@ typedef struct Arrays {
     byte            sessionIDSz;
 #ifdef WOLFSSL_TLS13
     byte            secret[SECRET_LEN];
+#endif
+#ifdef HAVE_KEYING_MATERIAL
+    byte            exporterSecret[WC_MAX_DIGEST_SIZE];
 #endif
     byte            masterSecret[SECRET_LEN];
 #if defined(WOLFSSL_RENESAS_TSIP_TLS) && \
@@ -3620,6 +3772,9 @@ typedef struct Arrays {
 #define STACK_TYPE_X509_NAME          9
 #define STACK_TYPE_CONF_VALUE         10
 #define STACK_TYPE_X509_INFO          11
+#define STACK_TYPE_BY_DIR_entry       12
+#define STACK_TYPE_BY_DIR_hash        13
+#define STACK_TYPE_X509_OBJ           14
 
 struct WOLFSSL_STACK {
     unsigned long num; /* number of nodes in stack
@@ -3645,6 +3800,9 @@ struct WOLFSSL_STACK {
         void*                  generic;
         char*                  string;
         WOLFSSL_GENERAL_NAME*  gn;
+        WOLFSSL_BY_DIR_entry*  dir_entry;
+        WOLFSSL_BY_DIR_HASH*   dir_hash;
+        WOLFSSL_X509_OBJECT*   x509_obj;
     } data;
     void* heap; /* memory heap hint */
     WOLFSSL_STACK* next;
@@ -3722,7 +3880,7 @@ struct WOLFSSL_X509 {
     char             certPolicies[MAX_CERTPOL_NB][MAX_CERTPOL_SZ];
     int              certPoliciesNb;
 #endif /* WOLFSSL_CERT_EXT */
-#if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)
+#if defined(OPENSSL_EXTRA_X509_SMALL) || defined(OPENSSL_EXTRA)
     wolfSSL_Mutex    refMutex;                       /* ref count mutex */
     int              refCount;                       /* reference count */
 #endif
@@ -3979,6 +4137,12 @@ struct WOLFSSL {
 #ifdef OPENSSL_EXTRA
     byte              cbioFlag;  /* WOLFSSL_CBIO_RECV/SEND: CBIORecv/Send is set */
 #endif
+#ifdef WOLFSSL_WOLFSENTRY_HOOKS
+    NetworkFilterCallback_t AcceptFilter;
+    void *AcceptFilter_arg;
+    NetworkFilterCallback_t ConnectFilter;
+    void *ConnectFilter_arg;
+#endif /* WOLFSSL_WOLFSENTRY_HOOKS */
     CallbackIORecv  CBIORecv;
     CallbackIOSend  CBIOSend;
 #ifdef WOLFSSL_STATIC_MEMORY
@@ -4247,27 +4411,27 @@ struct WOLFSSL {
 #endif
 #ifdef HAVE_PK_CALLBACKS
     #ifdef HAVE_ECC
-        void* EccKeyGenCtx;              /* EccKeyGen  Callback Context */
+        void* EccKeyGenCtx;          /* EccKeyGen  Callback Context */
-        void* EccSignCtx;                /* Ecc Sign   Callback Context */
+        void* EccSignCtx;            /* Ecc Sign   Callback Context */
-        void* EccVerifyCtx;              /* Ecc Verify Callback Context */
+        void* EccVerifyCtx;          /* Ecc Verify Callback Context */
-        void* EccSharedSecretCtx;        /* Ecc Pms    Callback Context */
+        void* EccSharedSecretCtx;    /* Ecc Pms    Callback Context */
-        #ifdef HAVE_ED25519
-            void* Ed25519SignCtx;        /* ED25519 Sign   Callback Context */
-            void* Ed25519VerifyCtx;      /* ED25519 Verify Callback Context */
-        #endif
-        #ifdef HAVE_CURVE25519
-            void* X25519KeyGenCtx;       /* X25519 KeyGen Callback Context */
-            void* X25519SharedSecretCtx; /* X25519 Pms    Callback Context */
-        #endif
-        #ifdef HAVE_ED448
-            void* Ed448SignCtx;          /* ED448 Sign   Callback Context */
-            void* Ed448VerifyCtx;        /* ED448 Verify Callback Context */
-        #endif
-        #ifdef HAVE_CURVE448
-            void* X448KeyGenCtx;         /* X448 KeyGen Callback Context */
-            void* X448SharedSecretCtx;   /* X448 Pms    Callback Context */
-        #endif
     #endif /* HAVE_ECC */
+    #ifdef HAVE_ED25519
+        void* Ed25519SignCtx;        /* ED25519 Sign   Callback Context */
+        void* Ed25519VerifyCtx;      /* ED25519 Verify Callback Context */
+    #endif
+    #ifdef HAVE_CURVE25519
+        void* X25519KeyGenCtx;       /* X25519 KeyGen Callback Context */
+        void* X25519SharedSecretCtx; /* X25519 Pms    Callback Context */
+    #endif
+    #ifdef HAVE_ED448
+        void* Ed448SignCtx;          /* ED448 Sign   Callback Context */
+        void* Ed448VerifyCtx;        /* ED448 Verify Callback Context */
+    #endif
+    #ifdef HAVE_CURVE448
+        void* X448KeyGenCtx;         /* X448 KeyGen Callback Context */
+        void* X448SharedSecretCtx;   /* X448 Pms    Callback Context */
+    #endif
     #ifndef NO_DH
         void* DhAgreeCtx; /* DH Pms Callback Context */
     #endif /* !NO_DH */
@@ -4289,6 +4453,12 @@ struct WOLFSSL {
         Tls13SecretCb   tls13SecretCb;
         void*           tls13SecretCtx;
     #endif
+    #ifdef OPENSSL_EXTRA
+        SessionSecretCb keyLogCb;
+    #ifdef WOLFSSL_TLS13
+        Tls13SecretCb   tls13KeyLogCb;
+    #endif
+    #endif
 #endif /* HAVE_SECRET_CALLBACK */
 #ifdef WOLFSSL_JNI
         void* jObjectRef;     /* reference to WolfSSLSession in JNI wrapper */
@@ -4296,11 +4466,12 @@ struct WOLFSSL {
 #ifdef WOLFSSL_EARLY_DATA
     EarlyDataState earlyData;
     word32 earlyDataSz;
+    byte earlyDataStatus;
 #endif
 #ifdef OPENSSL_ALL
     long verifyCallbackResult;
 #endif
-#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
+#if defined(OPENSSL_EXTRA)
     WOLFSSL_STACK* supportedCiphers; /* Used in wolfSSL_get_ciphers_compat */
     WOLFSSL_STACK* peerCertChain;    /* Used in wolfSSL_get_peer_cert_chain */
 #endif
@@ -4623,6 +4794,8 @@ WOLFSSL_LOCAL  int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength);
 
 #if defined(WOLFSSL_TLS13) && (defined(HAVE_SESSION_TICKET) || !defined(NO_PSK))
     WOLFSSL_LOCAL word32 TimeNowInMilliseconds(void);
+
+    WOLFSSL_LOCAL int FindSuiteMac(WOLFSSL* ssl, byte* suite);
 #endif
 WOLFSSL_LOCAL word32  LowResTimer(void);
 
@@ -4651,7 +4824,8 @@ typedef struct CipherSuiteInfo {
 #endif
     byte cipherSuite0;
     byte cipherSuite;
-#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
+#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) || \
+    defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_NGINX)
     byte minor;
     byte major;
 #endif
@@ -4695,17 +4869,27 @@ WOLFSSL_LOCAL int SetDsaExternal(WOLFSSL_DSA* dsa);
 WOLFSSL_LOCAL int SetRsaExternal(WOLFSSL_RSA* rsa);
 WOLFSSL_LOCAL int SetRsaInternal(WOLFSSL_RSA* rsa);
 #endif
+
+typedef enum elem_set {
+    ELEMENT_P   = 0x01,
+    ELEMENT_Q   = 0x02,
+    ELEMENT_G   = 0x04,
+    ELEMENT_PUB = 0x08,
+    ELEMENT_PRV = 0x10,
+} Element_Set;
+WOLFSSL_LOCAL int SetDhExternal_ex(WOLFSSL_DH *dh, int elm );
 WOLFSSL_LOCAL int SetDhInternal(WOLFSSL_DH* dh);
 WOLFSSL_LOCAL int SetDhExternal(WOLFSSL_DH *dh);
 
-#ifndef NO_DH
+#if !defined(NO_DH) && (!defined(NO_CERTS) || !defined(NO_PSK))
     WOLFSSL_LOCAL int DhGenKeyPair(WOLFSSL* ssl, DhKey* dhKey,
         byte* priv, word32* privSz,
         byte* pub, word32* pubSz);
     WOLFSSL_LOCAL int DhAgree(WOLFSSL* ssl, DhKey* dhKey,
         const byte* priv, word32 privSz,
         const byte* otherPub, word32 otherPubSz,
-        byte* agree, word32* agreeSz);
+        byte* agree, word32* agreeSz,
+        const byte* prime, word32 primeSz);
 #endif /* !NO_DH */
 
 #ifdef HAVE_ECC
@@ -4738,6 +4922,43 @@ WOLFSSL_LOCAL void FreeKey(WOLFSSL* ssl, int type, void** pKey);
     WOLFSSL_LOCAL int wolfSSL_AsyncPush(WOLFSSL* ssl, WC_ASYNC_DEV* asyncDev);
 #endif
 
+#if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
+    (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
+    !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
+WOLFSSL_LOCAL int LoadCertByIssuer(WOLFSSL_X509_STORE* store, 
+                                           X509_NAME* issuer, int Type);
+#endif
+#if defined(OPENSSL_ALL) && !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
+WOLFSSL_LOCAL WOLFSSL_BY_DIR_HASH* wolfSSL_BY_DIR_HASH_new(void);
+WOLFSSL_LOCAL void wolfSSL_BY_DIR_HASH_free(WOLFSSL_BY_DIR_HASH* dir_hash);
+WOLFSSL_LOCAL WOLFSSL_STACK* wolfSSL_sk_BY_DIR_HASH_new_null(void);
+WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_HASH_find(
+   WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk, const WOLFSSL_BY_DIR_HASH* toFind);
+WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_HASH_num(const WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *sk);
+WOLFSSL_LOCAL WOLFSSL_BY_DIR_HASH* wolfSSL_sk_BY_DIR_HASH_value(
+                        const WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *sk, int i);
+WOLFSSL_LOCAL WOLFSSL_BY_DIR_HASH* wolfSSL_sk_BY_DIR_HASH_pop(
+                                WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk);
+WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_HASH_pop_free(WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk,
+    void (*f) (WOLFSSL_BY_DIR_HASH*));
+WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_HASH_free(WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH) *sk);
+WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_HASH_push(WOLF_STACK_OF(WOLFSSL_BY_DIR_HASH)* sk,
+                                               WOLFSSL_BY_DIR_HASH* in);
+/* WOLFSSL_BY_DIR_entry stuff */
+WOLFSSL_LOCAL WOLFSSL_BY_DIR_entry* wolfSSL_BY_DIR_entry_new(void);
+WOLFSSL_LOCAL void wolfSSL_BY_DIR_entry_free(WOLFSSL_BY_DIR_entry* entry);
+WOLFSSL_LOCAL WOLFSSL_STACK* wolfSSL_sk_BY_DIR_entry_new_null(void);
+WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_entry_num(const WOLF_STACK_OF(WOLFSSL_BY_DIR_entry) *sk);
+WOLFSSL_LOCAL WOLFSSL_BY_DIR_entry* wolfSSL_sk_BY_DIR_entry_value(
+                        const WOLF_STACK_OF(WOLFSSL_BY_DIR_entry) *sk, int i);
+WOLFSSL_LOCAL WOLFSSL_BY_DIR_entry* wolfSSL_sk_BY_DIR_entry_pop(
+                                WOLF_STACK_OF(WOLFSSL_BY_DIR_entry)* sk);
+WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_entry_pop_free(WOLF_STACK_OF(wolfSSL_BY_DIR_entry)* sk,
+    void (*f) (WOLFSSL_BY_DIR_entry*));
+WOLFSSL_LOCAL void wolfSSL_sk_BY_DIR_entry_free(WOLF_STACK_OF(wolfSSL_BY_DIR_entry) *sk);
+WOLFSSL_LOCAL int wolfSSL_sk_BY_DIR_entry_push(WOLF_STACK_OF(wolfSSL_BY_DIR_entry)* sk,
+                                               WOLFSSL_BY_DIR_entry* in);
+#endif /* OPENSSL_ALL && !NO_FILESYSTEM && !NO_WOLFSSL_DIR */
 
 #ifdef __cplusplus
     }  /* extern "C" */

source/libs/libwolfssl/ocsp.h

@@ -1,6 +1,6 @@
 /* ocsp.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -111,6 +111,7 @@ WOLFSSL_API int wolfSSL_i2d_OCSP_REQUEST_bio(WOLFSSL_BIO* out,
 
 WOLFSSL_API int wolfSSL_i2d_OCSP_CERTID(WOLFSSL_OCSP_CERTID *, unsigned char **);
 WOLFSSL_API const WOLFSSL_OCSP_CERTID* wolfSSL_OCSP_SINGLERESP_get0_id(const WOLFSSL_OCSP_SINGLERESP *single);
+WOLFSSL_API int wolfSSL_OCSP_id_cmp(WOLFSSL_OCSP_CERTID *a, WOLFSSL_OCSP_CERTID *b);
 WOLFSSL_API int wolfSSL_OCSP_single_get0_status(WOLFSSL_OCSP_SINGLERESP *single,
                                                 int *reason,
                                                 WOLFSSL_ASN1_TIME **revtime,

source/libs/libwolfssl/openssl/aes.h

@@ -1,6 +1,6 @@
 /* aes.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -59,12 +59,20 @@ WOLFSSL_API void wolfSSL_AES_ecb_encrypt
 WOLFSSL_API void wolfSSL_AES_cfb128_encrypt
     (const unsigned char *in, unsigned char* out, size_t len,
      AES_KEY *key, unsigned char* iv, int* num, const int enc);
+WOLFSSL_API int wolfSSL_AES_wrap_key(AES_KEY *key, const unsigned char *iv,
+                 unsigned char *out,
+                 const unsigned char *in, unsigned int inlen);
+WOLFSSL_API int wolfSSL_AES_unwrap_key(AES_KEY *key, const unsigned char *iv,
+                   unsigned char *out,
+                   const unsigned char *in, unsigned int inlen);
 
 #define AES_cbc_encrypt     wolfSSL_AES_cbc_encrypt
 #define AES_ecb_encrypt     wolfSSL_AES_ecb_encrypt
 #define AES_cfb128_encrypt  wolfSSL_AES_cfb128_encrypt
 #define AES_set_encrypt_key wolfSSL_AES_set_encrypt_key
 #define AES_set_decrypt_key wolfSSL_AES_set_decrypt_key
+#define AES_wrap_key        wolfSSL_AES_wrap_key
+#define AES_unwrap_key      wolfSSL_AES_unwrap_key
 
 #ifdef WOLFSSL_AES_DIRECT
 WOLFSSL_API void wolfSSL_AES_encrypt

source/libs/libwolfssl/openssl/asn1.h

@@ -1,6 +1,6 @@
 /* asn1.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/asn1t.h

@@ -1,6 +1,6 @@
 /* asn1t.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/bio.h

@@ -1,6 +1,6 @@
 /* bio.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -68,6 +68,7 @@
 #define BIO_set_fp                      wolfSSL_BIO_set_fp
 #define BIO_get_fp                      wolfSSL_BIO_get_fp
 #define BIO_seek                        wolfSSL_BIO_seek
+#define BIO_tell                        wolfSSL_BIO_tell
 #define BIO_write_filename              wolfSSL_BIO_write_filename
 #define BIO_set_mem_eof_return          wolfSSL_BIO_set_mem_eof_return
 

source/libs/libwolfssl/openssl/bn.h

@@ -1,6 +1,6 @@
 /* bn.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/buffer.h

@@ -1,6 +1,6 @@
 /* buffer.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/conf.h

@@ -1,6 +1,6 @@
 /* conf.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -75,6 +75,11 @@ WOLFSSL_API WOLFSSL_CONF_VALUE *wolfSSL_CONF_new_section(WOLFSSL_CONF *conf,
 WOLFSSL_API WOLFSSL_CONF_VALUE *wolfSSL_CONF_get_section(WOLFSSL_CONF *conf,
         const char *section);
 
+WOLFSSL_API WOLFSSL_X509_EXTENSION* wolfSSL_X509V3_EXT_nconf_nid(WOLFSSL_CONF* conf,
+        WOLFSSL_X509V3_CTX *ctx, int nid, const char *value);
+WOLFSSL_API WOLFSSL_X509_EXTENSION* wolfSSL_X509V3_EXT_nconf(WOLFSSL_CONF *conf,
+        WOLFSSL_X509V3_CTX *ctx, const char *sName, const char *value);
+
 #define sk_CONF_VALUE_new               wolfSSL_sk_CONF_VALUE_new
 #define sk_CONF_VALUE_free              wolfSSL_sk_CONF_VALUE_free
 #define sk_CONF_VALUE_pop_free(a,b)     wolfSSL_sk_CONF_VALUE_free(a)
@@ -95,6 +100,8 @@ WOLFSSL_API WOLFSSL_CONF_VALUE *wolfSSL_CONF_get_section(WOLFSSL_CONF *conf,
 #define _CONF_new_section               wolfSSL_CONF_new_section
 #define _CONF_get_section               wolfSSL_CONF_get_section
 
+#define X509V3_EXT_nconf_nid            wolfSSL_X509V3_EXT_nconf_nid
+#define X509V3_EXT_nconf                wolfSSL_X509V3_EXT_nconf
 #define X509V3_conf_free                wolfSSL_X509V3_conf_free
 
 #endif /* OPENSSL_EXTRA */

source/libs/libwolfssl/openssl/crypto.h

@@ -1,6 +1,6 @@
 /* crypto.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -26,6 +26,20 @@
 
 #include <libs/libwolfssl/wolfcrypt/settings.h>
 
+typedef struct WOLFSSL_INIT_SETTINGS {
+    char* appname;
+} WOLFSSL_INIT_SETTINGS;
+typedef WOLFSSL_INIT_SETTINGS OPENSSL_INIT_SETTINGS;
+
+typedef struct WOLFSSL_CRYPTO_THREADID {
+    int dummy;
+} WOLFSSL_CRYPTO_THREADID;
+typedef struct crypto_threadid_st   CRYPTO_THREADID;
+
+typedef struct CRYPTO_EX_DATA            CRYPTO_EX_DATA;
+typedef void (CRYPTO_free_func)(void* parent, void* ptr, CRYPTO_EX_DATA* ad, int idx,
+        long argl, void* argp);
+
 #include <libs/libwolfssl/openssl/opensslv.h>
 #include <libs/libwolfssl/openssl/conf.h>
 
@@ -33,26 +47,21 @@
 #include "prefix_crypto.h"
 #endif
 
-typedef struct WOLFSSL_INIT_SETTINGS {
-    char* appname;
-} WOLFSSL_INIT_SETTINGS;
-
-typedef WOLFSSL_INIT_SETTINGS OPENSSL_INIT_SETTINGS;
-
 WOLFSSL_API const char*   wolfSSLeay_version(int type);
 WOLFSSL_API unsigned long wolfSSLeay(void);
 WOLFSSL_API unsigned long wolfSSL_OpenSSL_version_num(void);
 
 #ifdef OPENSSL_EXTRA
-#include <stdint.h>
-
 WOLFSSL_API void wolfSSL_OPENSSL_free(void*);
 WOLFSSL_API void *wolfSSL_OPENSSL_malloc(size_t a);
+WOLFSSL_API int wolfSSL_OPENSSL_hexchar2int(unsigned char c);
+WOLFSSL_API unsigned char *wolfSSL_OPENSSL_hexstr2buf(const char *str, long *len);
 
-WOLFSSL_API int wolfSSL_OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings);
+WOLFSSL_API int wolfSSL_OPENSSL_init_crypto(word64 opts, const OPENSSL_INIT_SETTINGS *settings);
 #endif
 
-#define CRYPTO_THREADID void
+#define crypto_threadid_st          WOLFSSL_CRYPTO_THREADID
+#define CRYPTO_THREADID             WOLFSSL_CRYPTO_THREADID
 
 #define SSLeay_version wolfSSLeay_version
 #define SSLeay wolfSSLeay
@@ -71,6 +80,8 @@ WOLFSSL_API int wolfSSL_OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SE
 
 #define OPENSSL_free wolfSSL_OPENSSL_free
 #define OPENSSL_malloc wolfSSL_OPENSSL_malloc
+#define OPENSSL_hexchar2int wolfSSL_OPENSSL_hexchar2int
+#define OPENSSL_hexstr2buf wolfSSL_OPENSSL_hexstr2buf
 
 #define OPENSSL_INIT_ENGINE_ALL_BUILTIN 0x00000001L
 #define OPENSSL_INIT_ADD_ALL_CIPHERS    0x00000004L
@@ -79,17 +90,25 @@ WOLFSSL_API int wolfSSL_OPENSSL_init_crypto(uint64_t opts, const OPENSSL_INIT_SE
 
 #define OPENSSL_init_crypto wolfSSL_OPENSSL_init_crypto
 
+#ifdef WOLFSSL_OPENVPN
+# define OPENSSL_assert(e) \
+    if (!(e)) { \
+        fprintf(stderr, "%s:%d wolfSSL internal error: assertion failed: " #e, \
+                __FILE__, __LINE__); \
+        raise(SIGABRT); \
+        _exit(3); \
+    }
+#endif
 
 #if defined(OPENSSL_ALL) || defined(HAVE_STUNNEL) || defined(WOLFSSL_NGINX) || \
     defined(WOLFSSL_HAPROXY) || defined(OPENSSL_EXTRA) || defined(HAVE_EX_DATA)
 #define CRYPTO_set_mem_ex_functions      wolfSSL_CRYPTO_set_mem_ex_functions
 #define FIPS_mode                        wolfSSL_FIPS_mode
 #define FIPS_mode_set                    wolfSSL_FIPS_mode_set
-typedef struct CRYPTO_EX_DATA            CRYPTO_EX_DATA;
-typedef void (CRYPTO_free_func)(void*parent, void*ptr, CRYPTO_EX_DATA *ad, int idx,
-        long argl, void* argp);
 #define CRYPTO_THREADID_set_callback wolfSSL_THREADID_set_callback
 #define CRYPTO_THREADID_set_numeric wolfSSL_THREADID_set_numeric
+#define CRYPTO_THREADID_current      wolfSSL_THREADID_current
+#define CRYPTO_THREADID_hash         wolfSSL_THREADID_hash
 
 #define CRYPTO_r_lock wc_LockMutex_ex
 #define CRYPTO_unlock wc_LockMutex_ex
@@ -98,6 +117,13 @@ typedef void (CRYPTO_free_func)(void*parent, void*ptr, CRYPTO_EX_DATA *ad, int i
 #define CRYPTO_THREAD_r_lock wc_LockMutex
 #define CRYPTO_THREAD_unlock wc_UnLockMutex
 
+#define CRYPTO_THREAD_lock_new wc_InitAndAllocMutex
+#define CRYPTO_THREAD_read_lock wc_LockMutex
+#define CRYPTO_THREAD_write_lock wc_LockMutex
+#define CRYPTO_THREAD_lock_free wc_FreeMutex
+
+#define CRYPTO_set_ex_data wolfSSL_CRYPTO_set_ex_data
+
 #endif /* OPENSSL_ALL || HAVE_STUNNEL || WOLFSSL_NGINX || WOLFSSL_HAPROXY || HAVE_EX_DATA */
 
 #endif /* header */

source/libs/libwolfssl/openssl/des.h

@@ -1,6 +1,6 @@
 /* des.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/dh.h

@@ -1,6 +1,6 @@
 /* dh.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -64,12 +64,12 @@ WOLFSSL_API WOLFSSL_DH* wolfSSL_DH_dup(WOLFSSL_DH* dh);
 WOLFSSL_API int wolfSSL_DH_check(const WOLFSSL_DH *dh, int *codes);
 WOLFSSL_API int wolfSSL_DH_size(WOLFSSL_DH*);
 WOLFSSL_API int wolfSSL_DH_generate_key(WOLFSSL_DH*);
-WOLFSSL_API int wolfSSL_DH_compute_key(unsigned char* key, WOLFSSL_BIGNUM* pub,
+WOLFSSL_API int wolfSSL_DH_compute_key(unsigned char* key, const WOLFSSL_BIGNUM* pub,
                                      WOLFSSL_DH*);
 WOLFSSL_API int wolfSSL_DH_LoadDer(WOLFSSL_DH*, const unsigned char*, int sz);
 WOLFSSL_API int wolfSSL_DH_set0_pqg(WOLFSSL_DH*, WOLFSSL_BIGNUM*,
     WOLFSSL_BIGNUM*, WOLFSSL_BIGNUM*);
-
+                  
 #define DH_new  wolfSSL_DH_new
 #define DH_free wolfSSL_DH_free
 
@@ -80,9 +80,10 @@ WOLFSSL_API int wolfSSL_DH_set0_pqg(WOLFSSL_DH*, WOLFSSL_BIGNUM*,
 #define DH_size         wolfSSL_DH_size
 #define DH_generate_key wolfSSL_DH_generate_key
 #define DH_compute_key  wolfSSL_DH_compute_key
-#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
 #define DH_set0_pqg     wolfSSL_DH_set0_pqg
-#endif
+#define DH_get0_pqg     wolfSSL_DH_get0_pqg
+#define DH_get0_key     wolfSSL_DH_get0_key
+#define DH_set0_key     wolfSSL_DH_set0_key
 #define DH_bits(x)      (BN_num_bits(x->p))
 
 #define DH_GENERATOR_2                  2

source/libs/libwolfssl/openssl/dsa.h

@@ -1,6 +1,6 @@
 /* dsa.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -68,6 +68,17 @@ WOLFSSL_API int wolfSSL_DSA_generate_parameters_ex(WOLFSSL_DSA*, int bits,
                    unsigned char* seed, int seedLen, int* counterRet,
                    unsigned long* hRet, void* cb);
 
+WOLFSSL_API void wolfSSL_DSA_get0_pqg(const WOLFSSL_DSA *d, const WOLFSSL_BIGNUM **p,
+        const WOLFSSL_BIGNUM **q, const WOLFSSL_BIGNUM **g);
+WOLFSSL_API int wolfSSL_DSA_set0_pqg(WOLFSSL_DSA *d, WOLFSSL_BIGNUM *p,
+        WOLFSSL_BIGNUM *q, WOLFSSL_BIGNUM *g);
+
+WOLFSSL_API void wolfSSL_DSA_get0_key(const WOLFSSL_DSA *d,
+        const WOLFSSL_BIGNUM **pub_key, const WOLFSSL_BIGNUM **priv_key);
+WOLFSSL_API int wolfSSL_DSA_set0_key(WOLFSSL_DSA *d, WOLFSSL_BIGNUM *pub_key,
+        WOLFSSL_BIGNUM *priv_key);
+
+
 WOLFSSL_API int wolfSSL_DSA_LoadDer(WOLFSSL_DSA*, const unsigned char*, int sz);
 
 WOLFSSL_API int wolfSSL_DSA_LoadDer_ex(WOLFSSL_DSA*, const unsigned char*,
@@ -84,8 +95,17 @@ WOLFSSL_API int wolfSSL_DSA_bits(const WOLFSSL_DSA *d);
 
 WOLFSSL_API WOLFSSL_DSA_SIG* wolfSSL_DSA_SIG_new(void);
 WOLFSSL_API void wolfSSL_DSA_SIG_free(WOLFSSL_DSA_SIG *sig);
+
+WOLFSSL_API void wolfSSL_DSA_SIG_get0(const WOLFSSL_DSA_SIG *sig,
+        const WOLFSSL_BIGNUM **r, const WOLFSSL_BIGNUM **s);
+WOLFSSL_API int wolfSSL_DSA_SIG_set0(WOLFSSL_DSA_SIG *sig, WOLFSSL_BIGNUM *r,
+        WOLFSSL_BIGNUM *s);
+
+WOLFSSL_API int wolfSSL_i2d_DSA_SIG(const WOLFSSL_DSA_SIG *sig, byte **out);
+WOLFSSL_API WOLFSSL_DSA_SIG* wolfSSL_d2i_DSA_SIG(WOLFSSL_DSA_SIG **sig,
+        const unsigned char **pp, long length);
 WOLFSSL_API WOLFSSL_DSA_SIG* wolfSSL_DSA_do_sign_ex(const unsigned char* digest,
-                                                    int outLen, WOLFSSL_DSA* dsa);
+                                                    int inLen, WOLFSSL_DSA* dsa);
 WOLFSSL_API int wolfSSL_DSA_do_verify_ex(const unsigned char* digest, int digest_len,
                                          WOLFSSL_DSA_SIG* sig, WOLFSSL_DSA* dsa);
 
@@ -99,9 +119,17 @@ WOLFSSL_API int wolfSSL_DSA_do_verify_ex(const unsigned char* digest, int digest
 #define DSA_generate_key           wolfSSL_DSA_generate_key
 #define DSA_generate_parameters    wolfSSL_DSA_generate_parameters
 #define DSA_generate_parameters_ex wolfSSL_DSA_generate_parameters_ex
+#define DSA_get0_pqg               wolfSSL_DSA_get0_pqg
+#define DSA_set0_pqg               wolfSSL_DSA_set0_pqg
+#define DSA_get0_key               wolfSSL_DSA_get0_key
+#define DSA_set0_key               wolfSSL_DSA_set0_key
 
 #define DSA_SIG_new                wolfSSL_DSA_SIG_new
 #define DSA_SIG_free               wolfSSL_DSA_SIG_free
+#define DSA_SIG_get0               wolfSSL_DSA_SIG_get0
+#define DSA_SIG_set0               wolfSSL_DSA_SIG_set0
+#define i2d_DSA_SIG                wolfSSL_i2d_DSA_SIG
+#define d2i_DSA_SIG                wolfSSL_d2i_DSA_SIG
 #define DSA_do_sign                wolfSSL_DSA_do_sign_ex
 #define DSA_do_verify              wolfSSL_DSA_do_verify_ex
 

source/libs/libwolfssl/openssl/ec.h

@@ -1,6 +1,6 @@
 /* ec.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -25,6 +25,7 @@
 #define WOLFSSL_EC_H_
 
 #include <libs/libwolfssl/openssl/bn.h>
+#include <libs/libwolfssl/wolfcrypt/asn.h>
 #include <libs/libwolfssl/wolfcrypt/ecc.h>
 
 #ifdef __cplusplus
@@ -68,6 +69,13 @@ enum {
     NID_brainpoolP512r1 = 933,
 #endif
 
+#ifdef HAVE_ED448
+    NID_ED448 = ED448k,
+#endif
+#ifdef HAVE_ED25519
+    NID_ED25519 = ED25519k,
+#endif
+
     OPENSSL_EC_NAMED_CURVE  = 0x001
 };
 
@@ -109,10 +117,13 @@ struct WOLFSSL_EC_KEY {
     WOLFSSL_BIGNUM *priv_key;
 
     void*          internal;     /* our ECC Key */
-    char           inSet;        /* internal set from external ? */
-    char           exSet;        /* external set from internal ? */
     char           form;         /* Either POINT_CONVERSION_UNCOMPRESSED or
                                   * POINT_CONVERSION_COMPRESSED */
+    word16 pkcs8HeaderSz;
+
+    /* option bits */
+    byte inSet:1;        /* internal set from external ? */
+    byte exSet:1;        /* external set from internal ? */
 };
 
 struct WOLFSSL_EC_BUILTIN_CURVE {
@@ -146,6 +157,9 @@ int wolfSSL_EC_POINT_oct2point(const WOLFSSL_EC_GROUP *group,
                                WOLFSSL_EC_POINT *p, const unsigned char *buf,
                                size_t len, WOLFSSL_BN_CTX *ctx);
 WOLFSSL_API
+WOLFSSL_EC_KEY *wolfSSL_o2i_ECPublicKey(WOLFSSL_EC_KEY **a, const unsigned char **in,
+                                        long len);
+WOLFSSL_API
 int wolfSSL_i2o_ECPublicKey(const WOLFSSL_EC_KEY *in, unsigned char **out);
 WOLFSSL_API
 WOLFSSL_EC_KEY *wolfSSL_d2i_ECPrivateKey(WOLFSSL_EC_KEY **key, const unsigned char **in,
@@ -184,6 +198,7 @@ WOLFSSL_BIGNUM *wolfSSL_EC_KEY_get0_private_key(const WOLFSSL_EC_KEY *key);
 WOLFSSL_API
 WOLFSSL_EC_KEY *wolfSSL_EC_KEY_new_by_curve_name(int nid);
 WOLFSSL_API const char* wolfSSL_EC_curve_nid2nist(int nid);
+WOLFSSL_API int wolfSSL_EC_curve_nist2nid(const char* name);
 WOLFSSL_API
 WOLFSSL_EC_KEY *wolfSSL_EC_KEY_new(void);
 WOLFSSL_API
@@ -195,6 +210,7 @@ void wolfSSL_EC_KEY_set_asn1_flag(WOLFSSL_EC_KEY *key, int asn1_flag);
 WOLFSSL_API
 int wolfSSL_EC_KEY_set_public_key(WOLFSSL_EC_KEY *key,
                                   const WOLFSSL_EC_POINT *pub);
+WOLFSSL_API int wolfSSL_EC_KEY_check_key(const WOLFSSL_EC_KEY *key);
 WOLFSSL_API int wolfSSL_ECDSA_size(const WOLFSSL_EC_KEY *key);
 WOLFSSL_API int wolfSSL_ECDSA_sign(int type, const unsigned char *digest,
                                    int digestSz, unsigned char *sig,
@@ -287,6 +303,7 @@ char* wolfSSL_EC_POINT_point2hex(const WOLFSSL_EC_GROUP* group,
 #define EC_KEY_generate_key             wolfSSL_EC_KEY_generate_key
 #define EC_KEY_set_asn1_flag            wolfSSL_EC_KEY_set_asn1_flag
 #define EC_KEY_set_public_key           wolfSSL_EC_KEY_set_public_key
+#define EC_KEY_check_key                wolfSSL_EC_KEY_check_key
 
 #define ECDSA_size                      wolfSSL_ECDSA_size
 #define ECDSA_sign                      wolfSSL_ECDSA_sign
@@ -329,6 +346,7 @@ char* wolfSSL_EC_POINT_point2hex(const WOLFSSL_EC_GROUP* group,
 #define EC_POINT_oct2point              wolfSSL_EC_POINT_oct2point
 #define EC_POINT_point2bn               wolfSSL_EC_POINT_point2bn
 #define EC_POINT_is_on_curve            wolfSSL_EC_POINT_is_on_curve
+#define o2i_ECPublicKey                 wolfSSL_o2i_ECPublicKey
 #define i2o_ECPublicKey                 wolfSSL_i2o_ECPublicKey
 #define i2d_EC_PUBKEY                   wolfSSL_i2o_ECPublicKey
 #define d2i_ECPrivateKey                wolfSSL_d2i_ECPrivateKey
@@ -343,6 +361,7 @@ char* wolfSSL_EC_POINT_point2hex(const WOLFSSL_EC_GROUP* group,
 #define EC_get_builtin_curves           wolfSSL_EC_get_builtin_curves
 
 #define EC_curve_nid2nist               wolfSSL_EC_curve_nid2nist
+#define EC_curve_nist2nid               wolfSSL_EC_curve_nist2nid
 
 #ifdef __cplusplus
 }  /* extern "C" */

source/libs/libwolfssl/openssl/ec25519.h

@@ -1,6 +1,6 @@
 /* ec25519.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ec448.h

@@ -1,6 +1,6 @@
 /* ec448.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ecdh.h

@@ -1,6 +1,6 @@
 /* ecdh.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ecdsa.h

@@ -1,6 +1,6 @@
 /* ecdsa.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ed25519.h

@@ -1,6 +1,6 @@
 /* ed25519.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ed448.h

@@ -1,6 +1,6 @@
 /* ed448.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/engine.h

@@ -4,5 +4,7 @@
 
 #undef HAVE_OPENSSL_ENGINE_H
 
-#define ENGINE_load_builtin_engines() /*ENGINE_load_builtin_engines not needed*/
+/* ENGINE_load_builtin_engines not needed, as all builtin engines are already
+   loaded into memory and used on startup. */
+#define ENGINE_load_builtin_engines()
 

source/libs/libwolfssl/openssl/err.h

@@ -1,6 +1,6 @@
 /* err.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/evp.h

@@ -1,6 +1,6 @@
 /* evp.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -59,6 +59,10 @@
 #endif
 #include <libs/libwolfssl/wolfcrypt/pwdbased.h>
 
+#if defined(WOLFSSL_BASE64_ENCODE) || defined(WOLFSSL_BASE64_DECODE)
+#include <libs/libwolfssl/wolfcrypt/coding.h>
+#endif
+
 #ifdef __cplusplus
     extern "C" {
 #endif
@@ -81,6 +85,7 @@ typedef WOLFSSL_EVP_PKEY       PKCS8_PRIV_KEY_INFO;
 #ifndef NO_MD5
     WOLFSSL_API const WOLFSSL_EVP_MD* wolfSSL_EVP_md5(void);
 #endif
+WOLFSSL_API void wolfSSL_EVP_set_pw_prompt(const char *);
 WOLFSSL_API const WOLFSSL_EVP_MD* wolfSSL_EVP_mdc2(void);
 WOLFSSL_API const WOLFSSL_EVP_MD* wolfSSL_EVP_sha1(void);
 WOLFSSL_API const WOLFSSL_EVP_MD* wolfSSL_EVP_sha224(void);
@@ -286,6 +291,8 @@ enum {
     NID_sha3_256        = 1097,
     NID_sha3_384        = 1098,
     NID_sha3_512        = 1099,
+    NID_blake2b512      = 1056,
+    NID_blake2s256      = 1057,
 };
 
 enum {
@@ -372,6 +379,46 @@ struct WOLFSSL_EVP_PKEY_CTX {
     int nbits;
 };
 
+typedef
+struct WOLFSSL_ASN1_PCTX {
+    int dummy;
+} WOLFSSL_ASN1_PCTX;
+#if defined(WOLFSSL_BASE64_ENCODE) || defined(WOLFSSL_BASE64_DECODE)
+
+#define   BASE64_ENCODE_BLOCK_SIZE  48
+#define   BASE64_ENCODE_RESULT_BLOCK_SIZE 64
+#define   BASE64_DECODE_BLOCK_SIZE  4
+
+struct WOLFSSL_EVP_ENCODE_CTX {
+    void* heap;
+    int   remaining;     /* num of bytes in data[] */
+    byte  data[BASE64_ENCODE_BLOCK_SIZE];/* storage for unprocessed raw data */
+};
+typedef struct WOLFSSL_EVP_ENCODE_CTX WOLFSSL_EVP_ENCODE_CTX;
+
+WOLFSSL_API struct WOLFSSL_EVP_ENCODE_CTX* wolfSSL_EVP_ENCODE_CTX_new(void);
+WOLFSSL_API void wolfSSL_EVP_ENCODE_CTX_free(WOLFSSL_EVP_ENCODE_CTX* ctx);
+#endif /* WOLFSSL_BASE64_ENCODE || WOLFSSL_BASE64_DECODE */
+
+#if defined(WOLFSSL_BASE64_ENCODE)
+WOLFSSL_API void wolfSSL_EVP_EncodeInit(WOLFSSL_EVP_ENCODE_CTX* ctx);
+WOLFSSL_API int  wolfSSL_EVP_EncodeUpdate(WOLFSSL_EVP_ENCODE_CTX* ctx,
+                 unsigned char*out, int *outl, const unsigned char*in, int inl);
+WOLFSSL_API void wolfSSL_EVP_EncodeFinal(WOLFSSL_EVP_ENCODE_CTX* ctx,
+                 unsigned char*out, int *outl);
+#endif /* WOLFSSL_BASE64_ENCODE */
+
+#if defined(WOLFSSL_BASE64_DECODE)
+WOLFSSL_API void wolfSSL_EVP_DecodeInit(WOLFSSL_EVP_ENCODE_CTX* ctx);
+WOLFSSL_API int  wolfSSL_EVP_DecodeUpdate(WOLFSSL_EVP_ENCODE_CTX* ctx,
+                unsigned char*out, int *outl, const unsigned char*in, int inl);
+WOLFSSL_API int wolfSSL_EVP_DecodeFinal(WOLFSSL_EVP_ENCODE_CTX* ctx,
+                unsigned char*out, int *outl);
+#endif /* WOLFSSL_BASE64_DECODE */
+
+WOLFSSL_API const WOLFSSL_EVP_MD* wolfSSL_EVP_blake2b512(void);
+WOLFSSL_API const WOLFSSL_EVP_MD* wolfSSL_EVP_blake2s256(void);
+
 typedef int WOLFSSL_ENGINE  ;
 typedef WOLFSSL_ENGINE ENGINE;
 typedef WOLFSSL_EVP_PKEY_CTX EVP_PKEY_CTX;
@@ -381,6 +428,8 @@ typedef WOLFSSL_EVP_PKEY_CTX EVP_PKEY_CTX;
 #define EVP_PKEY_OP_DECRYPT (1 << 7)
 #define EVP_PKEY_OP_DERIVE  (1 << 8)
 
+#define EVP_PKEY_PRINT_INDENT_MAX    128
+
 WOLFSSL_API void wolfSSL_EVP_init(void);
 WOLFSSL_API int  wolfSSL_EVP_MD_size(const WOLFSSL_EVP_MD* md);
 WOLFSSL_API int  wolfSSL_EVP_MD_type(const WOLFSSL_EVP_MD *md);
@@ -547,7 +596,11 @@ WOLFSSL_API int wolfSSL_EVP_PKEY_keygen_init(WOLFSSL_EVP_PKEY_CTX *ctx);
 WOLFSSL_API int wolfSSL_EVP_PKEY_keygen(WOLFSSL_EVP_PKEY_CTX *ctx,
   WOLFSSL_EVP_PKEY **ppkey);
 WOLFSSL_API int wolfSSL_EVP_PKEY_bits(const WOLFSSL_EVP_PKEY *pkey);
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+WOLFSSL_API void wolfSSL_EVP_PKEY_CTX_free(WOLFSSL_EVP_PKEY_CTX *ctx);
+#else
 WOLFSSL_API int wolfSSL_EVP_PKEY_CTX_free(WOLFSSL_EVP_PKEY_CTX *ctx);
+#endif
 WOLFSSL_API WOLFSSL_EVP_PKEY_CTX *wolfSSL_EVP_PKEY_CTX_new(WOLFSSL_EVP_PKEY *pkey, WOLFSSL_ENGINE *e);
 WOLFSSL_API int wolfSSL_EVP_PKEY_CTX_set_rsa_padding(WOLFSSL_EVP_PKEY_CTX *ctx, int padding);
 WOLFSSL_API WOLFSSL_EVP_PKEY_CTX *wolfSSL_EVP_PKEY_CTX_new_id(int id, WOLFSSL_ENGINE *e);
@@ -587,7 +640,7 @@ WOLFSSL_API int wolfSSL_EVP_SignInit_ex(WOLFSSL_EVP_MD_CTX* ctx,
                                      WOLFSSL_ENGINE *impl);
 WOLFSSL_API int wolfSSL_EVP_SignUpdate(WOLFSSL_EVP_MD_CTX *ctx, const void *data, size_t len);
 WOLFSSL_API int wolfSSL_EVP_VerifyFinal(WOLFSSL_EVP_MD_CTX *ctx,
-        unsigned char* sig, unsigned int sig_len, WOLFSSL_EVP_PKEY *pkey);
+        const unsigned char* sig, unsigned int sig_len, WOLFSSL_EVP_PKEY *pkey);
 WOLFSSL_API int wolfSSL_EVP_VerifyInit(WOLFSSL_EVP_MD_CTX *ctx, const WOLFSSL_EVP_MD *type);
 WOLFSSL_API int wolfSSL_EVP_VerifyUpdate(WOLFSSL_EVP_MD_CTX *ctx, const void *data, size_t len);
 
@@ -645,6 +698,8 @@ WOLFSSL_LOCAL int wolfSSL_EVP_get_hashinfo(const WOLFSSL_EVP_MD* evp,
 #define EVP_CIPH_CCM_MODE WOLFSSL_EVP_CIPH_CCM_MODE
 #define EVP_CIPH_XTS_MODE WOLFSSL_EVP_CIPH_XTS_MODE
 
+#define EVP_CIPH_FLAG_AEAD_CIPHER WOLFSSL_EVP_CIPH_FLAG_AEAD_CIPHER
+
 #define WOLFSSL_EVP_CIPH_MODE           0x0007
 #define WOLFSSL_EVP_CIPH_STREAM_CIPHER      0x0
 #define WOLFSSL_EVP_CIPH_ECB_MODE           0x1
@@ -655,6 +710,7 @@ WOLFSSL_LOCAL int wolfSSL_EVP_get_hashinfo(const WOLFSSL_EVP_MD* evp,
 #define WOLFSSL_EVP_CIPH_GCM_MODE           0x6
 #define WOLFSSL_EVP_CIPH_CCM_MODE           0x7
 #define WOLFSSL_EVP_CIPH_XTS_MODE          0x10
+#define WOLFSSL_EVP_CIPH_FLAG_AEAD_CIPHER  0x20
 #define WOLFSSL_EVP_CIPH_NO_PADDING       0x100
 #define EVP_CIPH_VARIABLE_LENGTH          0x200
 #define WOLFSSL_EVP_CIPH_TYPE_INIT         0xff
@@ -665,6 +721,7 @@ typedef WOLFSSL_EVP_MD         EVP_MD;
 typedef WOLFSSL_EVP_CIPHER     EVP_CIPHER;
 typedef WOLFSSL_EVP_MD_CTX     EVP_MD_CTX;
 typedef WOLFSSL_EVP_CIPHER_CTX EVP_CIPHER_CTX;
+typedef WOLFSSL_ASN1_PCTX      ASN1_PCTX;
 
 #ifndef NO_MD4
     #define EVP_md4       wolfSSL_EVP_md4
@@ -672,14 +729,15 @@ typedef WOLFSSL_EVP_CIPHER_CTX EVP_CIPHER_CTX;
 #ifndef NO_MD5
     #define EVP_md5       wolfSSL_EVP_md5
 #endif
-#define EVP_sha1      wolfSSL_EVP_sha1
+#define EVP_sha1          wolfSSL_EVP_sha1
-#define EVP_mdc2      wolfSSL_EVP_mdc2
+#define EVP_mdc2          wolfSSL_EVP_mdc2
-#define EVP_dds1      wolfSSL_EVP_sha1
+#define EVP_dds1          wolfSSL_EVP_sha1
-#define EVP_sha224    wolfSSL_EVP_sha224
+#define EVP_sha224        wolfSSL_EVP_sha224
-#define EVP_sha256    wolfSSL_EVP_sha256
+#define EVP_sha256        wolfSSL_EVP_sha256
-#define EVP_sha384    wolfSSL_EVP_sha384
+#define EVP_sha384        wolfSSL_EVP_sha384
-#define EVP_sha512    wolfSSL_EVP_sha512
+#define EVP_sha512        wolfSSL_EVP_sha512
-#define EVP_ripemd160 wolfSSL_EVP_ripemd160
+#define EVP_ripemd160     wolfSSL_EVP_ripemd160
+#define EVP_set_pw_prompt wolfSSL_EVP_set_pw_prompt
 
 #define EVP_sha3_224    wolfSSL_EVP_sha3_224
 #define EVP_sha3_256    wolfSSL_EVP_sha3_256
@@ -732,7 +790,11 @@ typedef WOLFSSL_EVP_CIPHER_CTX EVP_CIPHER_CTX;
 #define EVP_MD_CTX_type         wolfSSL_EVP_MD_CTX_type
 #define EVP_MD_CTX_size         wolfSSL_EVP_MD_CTX_size
 #define EVP_MD_CTX_block_size   wolfSSL_EVP_MD_CTX_block_size
+#define EVP_MD_block_size       wolfSSL_EVP_MD_block_size
 #define EVP_MD_type             wolfSSL_EVP_MD_type
+#ifndef NO_WOLFSSL_STUB
+#define EVP_MD_CTX_set_flags(...)
+#endif
 
 #define EVP_Digest             wolfSSL_EVP_Digest
 #define EVP_DigestInit         wolfSSL_EVP_DigestInit
@@ -895,6 +957,7 @@ typedef WOLFSSL_EVP_CIPHER_CTX EVP_CIPHER_CTX;
 #define EVP_CTRL_GCM_SET_TAG           EVP_CTRL_AEAD_SET_TAG
 #define EVP_CTRL_GCM_SET_IV_FIXED      EVP_CTRL_AEAD_SET_IV_FIXED
 
+#define EVP_PKEY_print_public           wolfSSL_EVP_PKEY_print_public
 #define EVP_PKEY_print_private(arg1, arg2, arg3, arg4)
 
 #ifndef EVP_MAX_MD_SIZE
@@ -925,9 +988,8 @@ typedef WOLFSSL_EVP_CIPHER_CTX EVP_CIPHER_CTX;
 #define EVP_R_PRIVATE_KEY_DECODE_ERROR  (-MIN_CODE_E + 100 + 4)
 
 #define EVP_PKEY_NONE                   NID_undef
-#define EVP_PKEY_RSA2                   19
 #define EVP_PKEY_DH                     28
-#define EVP_CIPHER_mode                 WOLFSSL_CIPHER_mode
+#define EVP_CIPHER_mode                 WOLFSSL_EVP_CIPHER_mode
 /* WOLFSSL_EVP_CIPHER is just the string name of the cipher */
 #define EVP_CIPHER_name(x)              x
 #define EVP_MD_CTX_reset                wolfSSL_EVP_MD_CTX_cleanup
@@ -935,6 +997,25 @@ typedef WOLFSSL_EVP_CIPHER_CTX EVP_CIPHER_CTX;
 #define EVP_MD_name(x)                  x
 #define EVP_CIPHER_nid                  wolfSSL_EVP_CIPHER_nid
 
+/* Base64 encoding/decoding APIs */
+#if defined(WOLFSSL_BASE64_ENCODE) || defined(WOLFSSL_BASE64_DECODE)
+#define EVP_ENCODE_CTX       WOLFSSL_EVP_ENCODE_CTX
+#define EVP_ENCODE_CTX_new   wolfSSL_EVP_ENCODE_CTX_new
+#define EVP_ENCODE_CTX_free  wolfSSL_EVP_ENCODE_CTX_free
+#endif /* WOLFSSL_BASE64_ENCODE || WOLFSSL_BASE64_DECODE*/
+#if defined(WOLFSSL_BASE64_ENCODE)
+#define EVP_EncodeInit       wolfSSL_EVP_EncodeInit
+#define EVP_EncodeUpdate     wolfSSL_EVP_EncodeUpdate
+#define EVP_EncodeFinal      wolfSSL_EVP_EncodeFinal
+#endif /* WOLFSSL_BASE64_ENCODE */
+#if defined(WOLFSSL_BASE64_DECODE)
+#define EVP_DecodeInit       wolfSSL_EVP_DecodeInit
+#define EVP_DecodeUpdate     wolfSSL_EVP_DecodeUpdate
+#define EVP_DecodeFinal      wolfSSL_EVP_DecodeFinal
+#endif /* WOLFSSL_BASE64_DECODE */
+
+#define EVP_blake2b512       wolfSSL_EVP_blake2b512
+#define EVP_blake2s256       wolfSSL_EVP_blake2s256
 
 WOLFSSL_API void printPKEY(WOLFSSL_EVP_PKEY *k);
 

source/libs/libwolfssl/openssl/hmac.h

@@ -1,6 +1,6 @@
 /* hmac.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -35,9 +35,17 @@
 #include "prefix_hmac.h"
 #endif
 
+#include <libs/libwolfssl/wolfcrypt/hmac.h>
+
+typedef struct WOLFSSL_HMAC_CTX {
+    Hmac hmac;
+    int  type;
+    word32  save_ipad[WC_HMAC_BLOCK_SIZE  / sizeof(word32)];  /* same block size all*/
+    word32  save_opad[WC_HMAC_BLOCK_SIZE  / sizeof(word32)];
+} WOLFSSL_HMAC_CTX;
+
 #include <libs/libwolfssl/openssl/evp.h>
 #include <libs/libwolfssl/openssl/opensslv.h>
-#include <libs/libwolfssl/wolfcrypt/hmac.h>
 
 #ifdef __cplusplus
     extern "C" {
@@ -49,22 +57,13 @@ WOLFSSL_API unsigned char* wolfSSL_HMAC(const WOLFSSL_EVP_MD* evp_md,
                                const unsigned char* d, int n, unsigned char* md,
                                unsigned int* md_len);
 
-
-typedef struct WOLFSSL_HMAC_CTX {
-    Hmac hmac;
-    int  type;
-    word32  save_ipad[WC_HMAC_BLOCK_SIZE  / sizeof(word32)];  /* same block size all*/
-    word32  save_opad[WC_HMAC_BLOCK_SIZE  / sizeof(word32)];
-} WOLFSSL_HMAC_CTX;
-
-
 WOLFSSL_API WOLFSSL_HMAC_CTX* wolfSSL_HMAC_CTX_new(void);
 WOLFSSL_API int wolfSSL_HMAC_CTX_Init(WOLFSSL_HMAC_CTX* ctx);
 WOLFSSL_API int wolfSSL_HMAC_CTX_copy(WOLFSSL_HMAC_CTX* des,
                                        WOLFSSL_HMAC_CTX* src);
 WOLFSSL_LOCAL int wolfSSL_HmacCopy(Hmac* des, Hmac* src);
 WOLFSSL_API int wolfSSL_HMAC_Init(WOLFSSL_HMAC_CTX* ctx, const void* key,
-                                 int keylen, const EVP_MD* type);
+                                 int keylen, const WOLFSSL_EVP_MD* type);
 WOLFSSL_API int wolfSSL_HMAC_Init_ex(WOLFSSL_HMAC_CTX* ctx, const void* key,
                              int keylen, const EVP_MD* type, WOLFSSL_ENGINE* e);
 WOLFSSL_API int wolfSSL_HMAC_Update(WOLFSSL_HMAC_CTX* ctx,
@@ -75,6 +74,7 @@ WOLFSSL_API int wolfSSL_HMAC_cleanup(WOLFSSL_HMAC_CTX* ctx);
 WOLFSSL_API void wolfSSL_HMAC_CTX_cleanup(WOLFSSL_HMAC_CTX* ctx);
 WOLFSSL_API void wolfSSL_HMAC_CTX_free(WOLFSSL_HMAC_CTX* ctx);
 WOLFSSL_API size_t wolfSSL_HMAC_size(const WOLFSSL_HMAC_CTX *ctx);
+WOLFSSL_API const WOLFSSL_EVP_MD *wolfSSL_HMAC_CTX_get_md(const WOLFSSL_HMAC_CTX *ctx);
 
 typedef struct WOLFSSL_HMAC_CTX HMAC_CTX;
 
@@ -92,6 +92,7 @@ typedef struct WOLFSSL_HMAC_CTX HMAC_CTX;
 #define HMAC_Final    wolfSSL_HMAC_Final
 #define HMAC_cleanup  wolfSSL_HMAC_cleanup
 #define HMAC_size     wolfSSL_HMAC_size
+#define HMAC_CTX_get_md wolfSSL_HMAC_CTX_get_md
 
 
 #ifdef __cplusplus

source/libs/libwolfssl/openssl/lhash.h

@@ -1,6 +1,6 @@
 /* lhash.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/md4.h

@@ -1,6 +1,6 @@
 /* md4.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/md5.h

@@ -1,6 +1,6 @@
 /* md5.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -52,13 +52,14 @@ typedef struct WOLFSSL_MD5_CTX {
 WOLFSSL_API int wolfSSL_MD5_Init(WOLFSSL_MD5_CTX*);
 WOLFSSL_API int wolfSSL_MD5_Update(WOLFSSL_MD5_CTX*, const void*, unsigned long);
 WOLFSSL_API int wolfSSL_MD5_Final(unsigned char*, WOLFSSL_MD5_CTX*);
-
+WOLFSSL_API int wolfSSL_MD5_Transform(WOLFSSL_MD5_CTX*, const unsigned char*);
 
 typedef WOLFSSL_MD5_CTX MD5_CTX;
 
 #define MD5_Init wolfSSL_MD5_Init
 #define MD5_Update wolfSSL_MD5_Update
 #define MD5_Final wolfSSL_MD5_Final
+#define MD5_Transform wolfSSL_MD5_Transform
 
 #ifdef OPENSSL_EXTRA_BSD
     #define MD5Init wolfSSL_MD5_Init

source/libs/libwolfssl/openssl/obj_mac.h

@@ -1,6 +1,6 @@
 /* obj_mac.h
  *
- * Copyright (C) 2006-2017 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -42,6 +42,8 @@
 #define NID_sect571k1 733
 #define NID_sect571r1 734
 
+/* the definition is for Qt Unit test */
+#define SN_jurisdictionCountryName "jurisdictionC"
 #ifdef __cplusplus
     } /* extern "C" */
 #endif

source/libs/libwolfssl/openssl/objects.h

@@ -1,6 +1,6 @@
 /* objects.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ocsp.h

@@ -1,6 +1,6 @@
 /* ocsp.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -79,6 +79,7 @@
 
 #define i2d_OCSP_CERTID           wolfSSL_i2d_OCSP_CERTID
 #define OCSP_SINGLERESP_get0_id   wolfSSL_OCSP_SINGLERESP_get0_id
+#define OCSP_id_cmp               wolfSSL_OCSP_id_cmp
 #define OCSP_single_get0_status   wolfSSL_OCSP_single_get0_status
 #define OCSP_resp_count           wolfSSL_OCSP_resp_count
 #define OCSP_resp_get0            wolfSSL_OCSP_resp_get0

source/libs/libwolfssl/openssl/opensslv.h

@@ -1,6 +1,6 @@
 /* opensslv.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -30,12 +30,15 @@
     defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER == 0x10100000L) ||\
     defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER == 0x10001040L)  
      /* valid version */
-#elif defined(WOLFSSL_APACHE_HTTPD) || defined(HAVE_LIBEST)
+#elif defined(WOLFSSL_APACHE_HTTPD) || defined(HAVE_LIBEST) || defined(WOLFSSL_BIND)
     /* For Apache httpd, Use 1.1.0 compatibility */
      #define OPENSSL_VERSION_NUMBER 0x10100000L
+#elif  defined(WOLFSSL_QT)
+     #define OPENSSL_VERSION_NUMBER 0x10101000L
+#elif defined(WOLFSSL_HAPROXY)
+     #define OPENSSL_VERSION_NUMBER 0x1010000fL
 #elif defined(OPENSSL_ALL) || defined(HAVE_STUNNEL) || defined(HAVE_LIGHTY) || \
-    defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \
+    defined(WOLFSSL_NGINX) || defined(WOLFSSL_OPENSSH) || defined(WOLFSSL_OPENVPN)
-    defined(WOLFSSL_OPENSSH) || defined(WOLFSSL_QT) || defined(WOLFSSL_OPENVPN)
      /* version number can be increased for Lighty after compatibility for ECDH
         is added */
      #define OPENSSL_VERSION_NUMBER 0x10001040L

source/libs/libwolfssl/openssl/ossl_typ.h

@@ -1,6 +1,6 @@
 /* ossl_typ.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/pem.h

@@ -1,6 +1,6 @@
 /* pem.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/pkcs12.h

@@ -1,6 +1,6 @@
 /* pkcs12.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/pkcs7.h

@@ -1,6 +1,6 @@
 /* pkcs7.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -37,7 +37,6 @@
 #define PKCS7_NOINTERN         0x0010
 #define PKCS7_NOVERIFY         0x0020
 
-
 typedef struct WOLFSSL_PKCS7
 {
     PKCS7 pkcs7;
@@ -53,6 +52,8 @@ WOLFSSL_API void wolfSSL_PKCS7_free(PKCS7* p7);
 WOLFSSL_API void wolfSSL_PKCS7_SIGNED_free(PKCS7_SIGNED* p7);
 WOLFSSL_API PKCS7* wolfSSL_d2i_PKCS7(PKCS7** p7, const unsigned char** in,
     int len);
+WOLFSSL_LOCAL PKCS7* wolfSSL_d2i_PKCS7_ex(PKCS7** p7, const unsigned char** in,
+    int len, byte* content, word32 contentSz);
 WOLFSSL_API PKCS7* wolfSSL_d2i_PKCS7_bio(WOLFSSL_BIO* bio, PKCS7** p7);
 WOLFSSL_API int wolfSSL_i2d_PKCS7_bio(WOLFSSL_BIO *bio, PKCS7 *p7);
 WOLFSSL_API int wolfSSL_PKCS7_verify(PKCS7* p7, WOLFSSL_STACK* certs,
@@ -63,6 +64,10 @@ WOLFSSL_API WOLFSSL_STACK* wolfSSL_PKCS7_to_stack(PKCS7* pkcs7);
 WOLFSSL_API WOLFSSL_STACK* wolfSSL_PKCS7_get0_signers(PKCS7* p7,
     WOLFSSL_STACK* certs, int flags);
 WOLFSSL_API int wolfSSL_PEM_write_bio_PKCS7(WOLFSSL_BIO* bio, PKCS7* p7);
+#if defined(HAVE_SMIME)
+WOLFSSL_API PKCS7* wolfSSL_SMIME_read_PKCS7(WOLFSSL_BIO* in, WOLFSSL_BIO** bcont);
+#endif /* HAVE_SMIME */
+
 
 #define PKCS7_new                      wolfSSL_PKCS7_new
 #define PKCS7_SIGNED_new               wolfSSL_PKCS7_SIGNED_new
@@ -74,6 +79,9 @@ WOLFSSL_API int wolfSSL_PEM_write_bio_PKCS7(WOLFSSL_BIO* bio, PKCS7* p7);
 #define PKCS7_verify                   wolfSSL_PKCS7_verify
 #define PKCS7_get0_signers             wolfSSL_PKCS7_get0_signers
 #define PEM_write_bio_PKCS7            wolfSSL_PEM_write_bio_PKCS7
+#if defined(HAVE_SMIME)
+#define SMIME_read_PKCS7               wolfSSL_SMIME_read_PKCS7
+#endif /* HAVE_SMIME */
 
 #endif /* OPENSSL_ALL && HAVE_PKCS7 */
 

source/libs/libwolfssl/openssl/rand.h

@@ -1,6 +1,6 @@
 /* rand.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -24,4 +24,6 @@
 #include <libs/libwolfssl/openssl/ssl.h>
 #include <libs/libwolfssl/wolfcrypt/random.h>
 
+typedef WOLFSSL_RAND_METHOD RAND_METHOD;
+
 #define RAND_set_rand_method     wolfSSL_RAND_set_rand_method

source/libs/libwolfssl/openssl/rc4.h

@@ -1,6 +1,6 @@
 /* rc4.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ripemd.h

@@ -1,6 +1,6 @@
 /* ripemd.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/rsa.h

@@ -1,6 +1,6 @@
 /* rsa.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -77,19 +77,22 @@ typedef struct WOLFSSL_RSA {
     WOLFSSL_BIGNUM* iqmp;      /* u */
     void*          heap;
     void*          internal;  /* our RSA */
-    char           inSet;     /* internal set from external ? */
-    char           exSet;     /* external set from internal ? */
-    char           ownRng;    /* flag for if the rng should be free'd */
 #if defined(OPENSSL_EXTRA)
     WOLFSSL_RSA_METHOD* meth;
 #endif
 #if defined(HAVE_EX_DATA)
     WOLFSSL_CRYPTO_EX_DATA ex_data;  /* external data */
 #endif
-#if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)
+#if defined(OPENSSL_EXTRA_X509_SMALL) || defined(OPENSSL_EXTRA)
     wolfSSL_Mutex    refMutex;                       /* ref count mutex */
     int              refCount;                       /* reference count */
 #endif
+    word16 pkcs8HeaderSz;
+
+    /* bits */
+    byte inSet:1;     /* internal set from external ? */
+    byte exSet:1;     /* external set from internal ? */
+    byte ownRng:1;    /* flag for if the rng should be free'd */
 } WOLFSSL_RSA;
 #endif
 
@@ -107,10 +110,11 @@ WOLFSSL_API int wolfSSL_RSA_public_encrypt(int len, const unsigned char* fr,
 	                               unsigned char* to, WOLFSSL_RSA*, int padding);
 WOLFSSL_API int wolfSSL_RSA_private_decrypt(int len, const unsigned char* fr,
 	                               unsigned char* to, WOLFSSL_RSA*, int padding);
-WOLFSSL_API int wolfSSL_RSA_private_encrypt(int len, unsigned char* in,
+WOLFSSL_API int wolfSSL_RSA_private_encrypt(int len, const unsigned char* in,
                             unsigned char* out, WOLFSSL_RSA* rsa, int padding);
 
 WOLFSSL_API int wolfSSL_RSA_size(const WOLFSSL_RSA*);
+WOLFSSL_API int wolfSSL_RSA_bits(const WOLFSSL_RSA*);
 WOLFSSL_API int wolfSSL_RSA_sign(int type, const unsigned char* m,
                                unsigned int mLen, unsigned char* sigRet,
                                unsigned int* sigLen, WOLFSSL_RSA*);
@@ -140,18 +144,35 @@ WOLFSSL_API int wolfSSL_RSA_set_method(WOLFSSL_RSA *rsa, WOLFSSL_RSA_METHOD *met
 WOLFSSL_API const WOLFSSL_RSA_METHOD* wolfSSL_RSA_get_method(const WOLFSSL_RSA *rsa);
 WOLFSSL_API const WOLFSSL_RSA_METHOD* wolfSSL_RSA_get_default_method(void);
 
+WOLFSSL_API void wolfSSL_RSA_get0_crt_params(const WOLFSSL_RSA *r,
+                                             const WOLFSSL_BIGNUM **dmp1,
+                                             const WOLFSSL_BIGNUM **dmq1,
+                                             const WOLFSSL_BIGNUM **iqmp);
+WOLFSSL_API int wolfSSL_RSA_set0_crt_params(WOLFSSL_RSA *r, WOLFSSL_BIGNUM *dmp1,
+                                            WOLFSSL_BIGNUM *dmq1, WOLFSSL_BIGNUM *iqmp);
+WOLFSSL_API void wolfSSL_RSA_get0_factors(const WOLFSSL_RSA *r, const WOLFSSL_BIGNUM **p,
+                                          const WOLFSSL_BIGNUM **q);
+WOLFSSL_API int wolfSSL_RSA_set0_factors(WOLFSSL_RSA *r, WOLFSSL_BIGNUM *p, WOLFSSL_BIGNUM *q);
 WOLFSSL_API void wolfSSL_RSA_get0_key(const WOLFSSL_RSA *r, const WOLFSSL_BIGNUM **n,
                                       const WOLFSSL_BIGNUM **e, const WOLFSSL_BIGNUM **d);
 WOLFSSL_API int wolfSSL_RSA_set0_key(WOLFSSL_RSA *r, WOLFSSL_BIGNUM *n, WOLFSSL_BIGNUM *e,
                                      WOLFSSL_BIGNUM *d);
 WOLFSSL_API int wolfSSL_RSA_flags(const WOLFSSL_RSA *r);
 WOLFSSL_API void wolfSSL_RSA_set_flags(WOLFSSL_RSA *r, int flags);
+WOLFSSL_API void wolfSSL_RSA_clear_flags(WOLFSSL_RSA *r, int flags);
+WOLFSSL_API int wolfSSL_RSA_test_flags(const WOLFSSL_RSA *r, int flags);
 
 WOLFSSL_API WOLFSSL_RSA* wolfSSL_RSAPublicKey_dup(WOLFSSL_RSA *rsa);
 
 WOLFSSL_API void* wolfSSL_RSA_get_ex_data(const WOLFSSL_RSA *rsa, int idx);
 WOLFSSL_API int wolfSSL_RSA_set_ex_data(WOLFSSL_RSA *rsa, int idx, void *data);
-
+#ifdef HAVE_EX_DATA_CLEANUP_HOOKS
+WOLFSSL_API int wolfSSL_RSA_set_ex_data_with_cleanup(
+    WOLFSSL_RSA *rsa,
+    int idx,
+    void *data,
+    wolfSSL_ex_data_cleanup_routine_t cleanup_routine);
+#endif
 
 #define WOLFSSL_RSA_LOAD_PRIVATE 1
 #define WOLFSSL_RSA_LOAD_PUBLIC  2
@@ -184,10 +205,16 @@ WOLFSSL_API int wolfSSL_RSA_set_ex_data(WOLFSSL_RSA *rsa, int idx, void *data);
 #define RSA_get_default_method  wolfSSL_RSA_get_default_method
 #define RSA_get_method          wolfSSL_RSA_get_method
 #define RSA_set_method          wolfSSL_RSA_set_method
+#define RSA_get0_crt_params     wolfSSL_RSA_get0_crt_params
+#define RSA_set0_crt_params     wolfSSL_RSA_set0_crt_params
+#define RSA_get0_factors        wolfSSL_RSA_get0_factors
+#define RSA_set0_factors        wolfSSL_RSA_set0_factors
 #define RSA_get0_key            wolfSSL_RSA_get0_key
 #define RSA_set0_key            wolfSSL_RSA_set0_key
 #define RSA_flags               wolfSSL_RSA_flags
 #define RSA_set_flags           wolfSSL_RSA_set_flags
+#define RSA_clear_flags         wolfSSL_RSA_clear_flags
+#define RSA_test_flags          wolfSSL_RSA_test_flags
 
 #define RSAPublicKey_dup        wolfSSL_RSAPublicKey_dup
 #define RSA_get_ex_data        wolfSSL_RSA_get_ex_data

source/libs/libwolfssl/openssl/sha.h

@@ -1,6 +1,6 @@
 /* sha.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -52,12 +52,14 @@ typedef struct WOLFSSL_SHA_CTX {
 WOLFSSL_API int wolfSSL_SHA_Init(WOLFSSL_SHA_CTX*);
 WOLFSSL_API int wolfSSL_SHA_Update(WOLFSSL_SHA_CTX*, const void*, unsigned long);
 WOLFSSL_API int wolfSSL_SHA_Final(unsigned char*, WOLFSSL_SHA_CTX*);
-
+WOLFSSL_API int wolfSSL_SHA_Transform(WOLFSSL_SHA_CTX*, 
+                                          const unsigned char *data);
 /* SHA1 points to above, shouldn't use SHA0 ever */
 WOLFSSL_API int wolfSSL_SHA1_Init(WOLFSSL_SHA_CTX*);
 WOLFSSL_API int wolfSSL_SHA1_Update(WOLFSSL_SHA_CTX*, const void*, unsigned long);
 WOLFSSL_API int wolfSSL_SHA1_Final(unsigned char*, WOLFSSL_SHA_CTX*);
-
+WOLFSSL_API int wolfSSL_SHA1_Transform(WOLFSSL_SHA_CTX*, 
+                                          const unsigned char *data);
 enum {
     SHA_DIGEST_LENGTH = 20
 };
@@ -68,11 +70,20 @@ typedef WOLFSSL_SHA_CTX SHA_CTX;
 #define SHA_Init wolfSSL_SHA_Init
 #define SHA_Update wolfSSL_SHA_Update
 #define SHA_Final wolfSSL_SHA_Final
+#define SHA_Transform wolfSSL_SHA_Transform
+
+#if defined(NO_OLD_SHA_NAMES) && !defined(HAVE_SELFTEST) && \
+    (!defined(HAVE_FIPS) || \
+    (defined(HAVE_FIPS_VERSION) && HAVE_FIPS_VERSION > 2))
+    /* SHA is only available in non-fips mode or fips version > 2 mode 
+     * because of SHA enum in FIPS build. */
+    #define SHA wolfSSL_SHA1
+#endif
 
 #define SHA1_Init wolfSSL_SHA1_Init
 #define SHA1_Update wolfSSL_SHA1_Update
 #define SHA1_Final wolfSSL_SHA1_Final
-
+#define SHA1_Transform wolfSSL_SHA1_Transform
 
 #ifdef WOLFSSL_SHA224
 
@@ -99,6 +110,13 @@ typedef WOLFSSL_SHA224_CTX SHA224_CTX;
 #define SHA224_Init   wolfSSL_SHA224_Init
 #define SHA224_Update wolfSSL_SHA224_Update
 #define SHA224_Final  wolfSSL_SHA224_Final
+#if defined(NO_OLD_SHA_NAMES) && !defined(HAVE_SELFTEST) && \
+    (!defined(HAVE_FIPS) || \
+    (defined(HAVE_FIPS_VERSION) && HAVE_FIPS_VERSION > 2))
+    /* SHA224 is only available in non-fips mode or fips version > 2 mode 
+     * because of SHA224 enum in FIPS build. */
+    #define SHA224 wolfSSL_SHA224
+#endif
 
 #endif /* WOLFSSL_SHA224 */
 
@@ -113,9 +131,10 @@ typedef struct WOLFSSL_SHA256_CTX {
 
 WOLFSSL_API int wolfSSL_SHA256_Init(WOLFSSL_SHA256_CTX*);
 WOLFSSL_API int wolfSSL_SHA256_Update(WOLFSSL_SHA256_CTX*, const void*,
-	                                 unsigned long);
+                                 unsigned long);
 WOLFSSL_API int wolfSSL_SHA256_Final(unsigned char*, WOLFSSL_SHA256_CTX*);
-
+WOLFSSL_API int wolfSSL_SHA256_Transform(WOLFSSL_SHA256_CTX*, 
+                                                const unsigned char *data);
 enum {
     SHA256_DIGEST_LENGTH = 32
 };
@@ -126,6 +145,8 @@ typedef WOLFSSL_SHA256_CTX SHA256_CTX;
 #define SHA256_Init   wolfSSL_SHA256_Init
 #define SHA256_Update wolfSSL_SHA256_Update
 #define SHA256_Final  wolfSSL_SHA256_Final
+#define SHA256_Transform wolfSSL_SHA256_Transform
+
 #if defined(NO_OLD_SHA_NAMES) && !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
     /* SHA256 is only available in non-fips mode because of SHA256 enum in FIPS
      * build. */
@@ -137,7 +158,7 @@ typedef WOLFSSL_SHA256_CTX SHA256_CTX;
 
 typedef struct WOLFSSL_SHA384_CTX {
     /* big enough to hold wolfCrypt Sha384, but check on init */
-    void* holder[(256 + WC_ASYNC_DEV_SIZE) / sizeof(void*)];
+    void* holder[(268 + WC_ASYNC_DEV_SIZE) / sizeof(void*)];
 } WOLFSSL_SHA384_CTX;
 
 WOLFSSL_API int wolfSSL_SHA384_Init(WOLFSSL_SHA384_CTX*);
@@ -171,9 +192,10 @@ typedef struct WOLFSSL_SHA512_CTX {
 
 WOLFSSL_API int wolfSSL_SHA512_Init(WOLFSSL_SHA512_CTX*);
 WOLFSSL_API int wolfSSL_SHA512_Update(WOLFSSL_SHA512_CTX*, const void*,
-	                                 unsigned long);
+                                     unsigned long);
 WOLFSSL_API int wolfSSL_SHA512_Final(unsigned char*, WOLFSSL_SHA512_CTX*);
-
+WOLFSSL_API int wolfSSL_SHA512_Transform(WOLFSSL_SHA512_CTX*, 
+                                        const unsigned char*);
 enum {
     SHA512_DIGEST_LENGTH = 64
 };
@@ -184,6 +206,7 @@ typedef WOLFSSL_SHA512_CTX SHA512_CTX;
 #define SHA512_Init   wolfSSL_SHA512_Init
 #define SHA512_Update wolfSSL_SHA512_Update
 #define SHA512_Final  wolfSSL_SHA512_Final
+#define SHA512_Transform wolfSSL_SHA512_Transform
 #if defined(NO_OLD_SHA_NAMES) && !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
     /* SHA512 is only available in non-fips mode because of SHA512 enum in FIPS
      * build. */

source/libs/libwolfssl/openssl/sha3.h

@@ -1,6 +1,6 @@
 /* sha3.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/srp.h

@@ -1,6 +1,6 @@
 /* srp.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/ssl.h

@@ -1,6 +1,6 @@
 /* ssl.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -70,8 +70,7 @@
 #endif
 
 #ifdef OPENSSL_EXTRA
-#include <stdint.h>
+WOLFSSL_API int wolfSSL_OPENSSL_init_ssl(word64 opts, const OPENSSL_INIT_SETTINGS *settings);
-WOLFSSL_API int wolfSSL_OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings);
 #endif
 
 typedef WOLFSSL          SSL;
@@ -113,17 +112,26 @@ typedef WOLFSSL_BUF_MEM        BUF_MEM;
 typedef WOLFSSL_GENERAL_NAMES  GENERAL_NAMES;
 typedef WOLFSSL_GENERAL_NAME GENERAL_NAME;
 
+#define X509_L_FILE_LOAD  WOLFSSL_X509_L_FILE_LOAD
+#define X509_L_ADD_DIR    WOLFSSL_X509_L_ADD_DIR
+#define X509_L_ADD_STORE  WOLFSSL_X509_L_ADD_STORE
+#define X509_L_LOAD_STORE WOLFSSL_X509_L_LOAD_STORE
+
 #define ASN1_UTCTIME         WOLFSSL_ASN1_TIME
 #define ASN1_GENERALIZEDTIME WOLFSSL_ASN1_TIME
 
 typedef WOLFSSL_COMP_METHOD    COMP_METHOD;
 typedef WOLFSSL_COMP           SSL_COMP;
 typedef WOLFSSL_X509_REVOKED   X509_REVOKED;
+typedef WOLFSSL_X509_LOOKUP_TYPE X509_LOOKUP_TYPE;
 typedef WOLFSSL_X509_OBJECT    X509_OBJECT;
 typedef WOLFSSL_X509_STORE     X509_STORE;
 typedef WOLFSSL_X509_STORE_CTX X509_STORE_CTX;
 typedef WOLFSSL_X509_VERIFY_PARAM X509_VERIFY_PARAM;
 
+typedef int                    OSSL_HANDSHAKE_STATE;
+#define TLS_ST_BEFORE          0 /* NULL_STATE from enum states */
+
 #define EVP_CIPHER_INFO        EncryptedInfo
 
 #define STACK_OF(x) WOLFSSL_STACK
@@ -133,13 +141,15 @@ typedef WOLFSSL_X509_VERIFY_PARAM X509_VERIFY_PARAM;
 #define CONF_get1_default_config_file   wolfSSL_CONF_get1_default_config_file
 typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 
-#define CRYPTO_free(xp)                 XFREE(xp, NULL, DYNAMIC_TYPE_TMP_BUFFER)
+#define CRYPTO_free                     wolfSSL_CRYPTO_free
-#define CRYPTO_malloc(sz)               XMALLOC(sz, NULL, DYNAMIC_TYPE_TMP_BUFFER)
+#define CRYPTO_malloc                   wolfSSL_CRYPTO_malloc
 #define CRYPTO_EX_new                   WOLFSSL_CRYPTO_EX_new
 #define CRYPTO_EX_dup                   WOLFSSL_CRYPTO_EX_dup
 #define CRYPTO_EX_free                  WOLFSSL_CRYPTO_EX_free
 #define CRYPTO_EX_DATA                  WOLFSSL_CRYPTO_EX_DATA
 
+#define CRYPTO_set_mem_functions        wolfSSL_CRYPTO_set_mem_functions
+
 /* depreciated */
 #define CRYPTO_thread_id                wolfSSL_thread_id
 #define CRYPTO_set_id_callback          wolfSSL_set_id_callback
@@ -160,6 +170,9 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define set_ex_data                     wolfSSL_CRYPTO_set_ex_data
 #define get_ex_data                     wolfSSL_CRYPTO_get_ex_data
 #define CRYPTO_memcmp                   wolfSSL_CRYPTO_memcmp
+#define CRYPTO_get_ex_new_index         wolfSSL_CRYPTO_get_ex_new_index
+
+#define CRYPTO_get_ex_new_index         wolfSSL_CRYPTO_get_ex_new_index
 
 /* this function was used to set the default malloc, free, and realloc */
 #define CRYPTO_malloc_init() 0 /* CRYPTO_malloc_init is not needed */
@@ -174,11 +187,12 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 
 /* at the moment only returns ok */
 #define SSL_get_verify_result           wolfSSL_get_verify_result
-#define SSL_get_verify_mode             wolfSSL_SSL_get_mode
+#define SSL_get_verify_mode             wolfSSL_get_verify_mode
 #define SSL_get_verify_depth            wolfSSL_get_verify_depth
 #define SSL_CTX_get_verify_mode         wolfSSL_CTX_get_verify_mode
 #define SSL_CTX_get_verify_depth        wolfSSL_CTX_get_verify_depth
 #define SSL_get_certificate             wolfSSL_get_certificate
+#define SSL_CTX_get0_certificate        wolfSSL_CTX_get0_certificate
 #define SSL_use_certificate             wolfSSL_use_certificate
 #define SSL_use_certificate_ASN1        wolfSSL_use_certificate_ASN1
 #define d2i_PKCS8_PRIV_KEY_INFO_bio     wolfSSL_d2i_PKCS8_PKEY_bio
@@ -186,6 +200,7 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define i2d_PKCS8PrivateKey_bio         wolfSSL_PEM_write_bio_PKCS8PrivateKey
 #define PKCS8_PRIV_KEY_INFO_free        wolfSSL_EVP_PKEY_free
 #define d2i_PKCS12_fp                   wolfSSL_d2i_PKCS12_fp
+#define SSL_CTX_set_ecdh_auto           wolfSSL_CTX_set_ecdh_auto
 
 #define i2d_PUBKEY                      wolfSSL_i2d_PUBKEY
 #define d2i_PUBKEY                      wolfSSL_d2i_PUBKEY
@@ -292,6 +307,7 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define SSL_pending                     wolfSSL_pending
 #define SSL_load_error_strings          wolfSSL_load_error_strings
 #define SSL_library_init                wolfSSL_library_init
+#define OPENSSL_cleanup                 (void)wolfSSL_Cleanup
 #define OPENSSL_init_ssl                wolfSSL_OPENSSL_init_ssl
 #define OpenSSL_add_ssl_algorithms      wolfSSL_library_init
 #define SSL_CTX_set_session_cache_mode  wolfSSL_CTX_set_session_cache_mode
@@ -299,9 +315,17 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define SSL_CTX_set_ciphersuites        wolfSSL_CTX_set_cipher_list
 #define SSL_set_cipher_list             wolfSSL_set_cipher_list
 /* wolfSSL does not support security levels */
-#define SSL_CTX_set_security_level(...)
+#define SSL_CTX_set_security_level      wolfSSL_CTX_set_security_level
+#define SSL_CTX_get_security_level      wolfSSL_CTX_get_security_level
 /* wolfSSL does not support exporting keying material */
-#define SSL_export_keying_material(...) 0
+#define SSL_export_keying_material      wolfSSL_export_keying_material
+
+#define SSL_CTX_set1_sigalgs_list       wolfSSL_CTX_set1_sigalgs_list
+#define SSL_set1_sigalgs_list           wolfSSL_set1_sigalgs_list
+#define SSL_get_signature_nid           wolfSSL_get_signature_nid
+
+#define SSL_CTX_set1_groups             wolfSSL_CTX_set1_groups
+#define SSL_set1_groups                 wolfSSL_set1_groups
 
 #define SSL_CTX_set1_groups_list        wolfSSL_CTX_set1_groups_list
 #define SSL_set1_groups_list            wolfSSL_set1_groups_list
@@ -320,6 +344,7 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define SSL_SESSION_up_ref              wolfSSL_SESSION_up_ref
 #define SSL_SESSION_dup                 wolfSSL_SESSION_dup
 #define SSL_SESSION_free                wolfSSL_SESSION_free
+#define SSL_SESSION_set_cipher          wolfSSL_SESSION_set_cipher
 #define SSL_is_init_finished            wolfSSL_is_init_finished
 
 #define SSL_get_version                 wolfSSL_get_version
@@ -359,6 +384,8 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define DSA_dup_DH                      wolfSSL_DSA_dup_DH
 /* wolfSSL does not support DSA as the cert public key */
 #define EVP_PKEY_get0_DSA               wolfSSL_EVP_PKEY_get0_DSA
+#define EVP_PKEY_param_check            wolfSSL_EVP_PKEY_param_check
+#define EVP_PKEY_CTX_free               wolfSSL_EVP_PKEY_CTX_free
 #define DSA_bits                        wolfSSL_DSA_bits
 
 #define i2d_X509_bio                    wolfSSL_i2d_X509_bio
@@ -401,6 +428,7 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define X509_free                       wolfSSL_X509_free
 #define X509_load_certificate_file      wolfSSL_X509_load_certificate_file
 #define X509_digest                     wolfSSL_X509_digest
+#define X509_pubkey_digest              wolfSSL_X509_pubkey_digest
 #define X509_get_ext_count              wolfSSL_X509_get_ext_count
 #define X509_get_ext_d2i                wolfSSL_X509_get_ext_d2i
 #define X509V3_EXT_i2d                  wolfSSL_X509V3_EXT_i2d
@@ -419,17 +447,17 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define X509_REQ_get_pubkey             wolfSSL_X509_get_pubkey
 #define X509_get_notBefore              wolfSSL_X509_get_notBefore
 #define X509_get0_notBefore             wolfSSL_X509_get_notBefore
+#define X509_getm_notBefore             wolfSSL_X509_get_notBefore
 #define X509_get_notAfter               wolfSSL_X509_get_notAfter
 #define X509_get0_notAfter              wolfSSL_X509_get_notAfter
+#define X509_getm_notAfter              wolfSSL_X509_get_notAfter
 #define X509_get_serialNumber           wolfSSL_X509_get_serialNumber
 #define X509_get0_pubkey_bitstr         wolfSSL_X509_get0_pubkey_bitstr
 #define X509_get_ex_new_index           wolfSSL_X509_get_ex_new_index
 #define X509_get_ex_data                wolfSSL_X509_get_ex_data
 #define X509_set_ex_data                wolfSSL_X509_set_ex_data
 #define X509_get1_ocsp                  wolfSSL_X509_get1_ocsp
-#ifndef WOLFSSL_HAPROXY
 #define X509_get_version                wolfSSL_X509_get_version
-#endif
 #define X509_get_signature_nid          wolfSSL_X509_get_signature_nid
 #define X509_set_subject_name           wolfSSL_X509_set_subject_name
 #define X509_set_issuer_name            wolfSSL_X509_set_issuer_name
@@ -456,6 +484,7 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define X509_REQ_check_private_key      wolfSSL_X509_check_private_key
 #define X509_check_ca                   wolfSSL_X509_check_ca
 #define X509_check_host                 wolfSSL_X509_check_host
+#define X509_check_email                wolfSSL_X509_check_email
 #define X509_check_ip_asc               wolfSSL_X509_check_ip_asc
 #define X509_email_free                 wolfSSL_X509_email_free
 #define X509_check_issued               wolfSSL_X509_check_issued
@@ -476,6 +505,10 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define sk_X509_pop_free                wolfSSL_sk_X509_pop_free
 #define sk_X509_dup                     wolfSSL_sk_dup
 #define sk_X509_free                    wolfSSL_sk_X509_free
+#define X509_chain_up_ref               wolfSSL_X509_chain_up_ref
+
+#define sk_X509_OBJECT_new              wolfSSL_sk_X509_OBJECT_new
+#define sk_X509_OBJECT_free             wolfSSL_sk_X509_OBJECT_free
 
 #define sk_X509_EXTENSION_num           wolfSSL_sk_X509_EXTENSION_num
 #define sk_X509_EXTENSION_value         wolfSSL_sk_X509_EXTENSION_value
@@ -511,6 +544,7 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define X509_NAME_add_entry_by_txt      wolfSSL_X509_NAME_add_entry_by_txt
 #define X509_NAME_add_entry_by_NID      wolfSSL_X509_NAME_add_entry_by_NID
 #define X509_NAME_delete_entry          wolfSSL_X509_NAME_delete_entry
+#define X509_NAME_hash                  wolfSSL_X509_NAME_hash
 #define X509_NAME_oneline               wolfSSL_X509_NAME_oneline
 #define X509_NAME_get_index_by_NID      wolfSSL_X509_NAME_get_index_by_NID
 #define X509_NAME_print_ex              wolfSSL_X509_NAME_print_ex
@@ -525,6 +559,7 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 #define sk_ACCESS_DESCRIPTION_value     wolfSSL_sk_ACCESS_DESCRIPTION_value
 
 #define sk_X509_NAME_new                wolfSSL_sk_X509_NAME_new
+#define sk_X509_NAME_new_null()         wolfSSL_sk_X509_NAME_new(NULL)
 #define sk_X509_NAME_push               wolfSSL_sk_X509_NAME_push
 #define sk_X509_NAME_find               wolfSSL_sk_X509_NAME_find
 #define sk_X509_NAME_set_cmp_func       wolfSSL_sk_X509_NAME_set_cmp_func
@@ -549,11 +584,18 @@ typedef WOLFSSL_X509_NAME_ENTRY X509_NAME_ENTRY;
 #define X509_V_FLAG_NO_CHECK_TIME  WOLFSSL_NO_CHECK_TIME
 #define X509_CHECK_FLAG_NO_WILDCARDS WOLFSSL_NO_WILDCARDS
 
+#define X509_VP_FLAG_DEFAULT        WOLFSSL_VPARAM_DEFAULT
+#define X509_VP_FLAG_OVERWRITE      WOLFSSL_VPARAM_OVERWRITE
+#define X509_VP_FLAG_RESET_FLAGS    WOLFSSL_VPARAM_RESET_FLAGS
+#define X509_VP_FLAG_LOCKED         WOLFSSL_VPARAM_LOCKED
+#define X509_VP_FLAG_ONCE           WOLFSSL_VPARAM_ONCE
+
 #define X509_STORE_CTX_get_current_cert wolfSSL_X509_STORE_CTX_get_current_cert
 #define X509_STORE_CTX_set_verify_cb    wolfSSL_X509_STORE_CTX_set_verify_cb
 #define X509_STORE_CTX_new              wolfSSL_X509_STORE_CTX_new
 #define X509_STORE_CTX_free             wolfSSL_X509_STORE_CTX_free
 #define X509_STORE_CTX_get_chain        wolfSSL_X509_STORE_CTX_get_chain
+#define X509_STORE_CTX_get0_chain       wolfSSL_X509_STORE_CTX_get_chain
 #define X509_STORE_CTX_get1_chain       wolfSSL_X509_STORE_CTX_get1_chain
 #define X509_STORE_CTX_get0_parent_ctx  wolfSSL_X509_STORE_CTX_get0_parent_ctx
 #define X509_STORE_CTX_get_error        wolfSSL_X509_STORE_CTX_get_error
@@ -570,6 +612,7 @@ typedef WOLFSSL_X509_NAME_ENTRY X509_NAME_ENTRY;
                                       wolfSSL_X509_STORE_CTX_get0_current_issuer
 #define X509_STORE_CTX_get0_store       wolfSSL_X509_STORE_CTX_get0_store
 #define X509_STORE_CTX_get0_cert        wolfSSL_X509_STORE_CTX_get0_cert
+#define X509_STORE_CTX_trusted_stack    wolfSSL_X509_STORE_CTX_trusted_stack
 
 #define X509_STORE_set_verify_cb(s, c) \
 wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_CTX_verify_cb)(c))
@@ -585,17 +628,26 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define X509_STORE_set_flags            wolfSSL_X509_STORE_set_flags
 #define X509_STORE_get1_certs           wolfSSL_X509_STORE_get1_certs
 #define X509_STORE_get_by_subject       wolfSSL_X509_STORE_get_by_subject
+#define X509_STORE_set_ex_data          wolfSSL_X509_STORE_set_ex_data
+#define X509_STORE_get_ex_data          wolfSSL_X509_STORE_get_ex_data
 #define X509_STORE_CTX_get1_issuer      wolfSSL_X509_STORE_CTX_get1_issuer
 #define X509_STORE_CTX_set_time         wolfSSL_X509_STORE_CTX_set_time
+#define X509_VERIFY_PARAM_new           wolfSSL_X509_VERIFY_PARAM_new
+#define X509_VERIFY_PARAM_free          wolfSSL_X509_VERIFY_PARAM_free
+#define X509_VERIFY_PARAM_set_flags     wolfSSL_X509_VERIFY_PARAM_set_flags
+#define X509_VERIFY_PARAM_get_flags     wolfSSL_X509_VERIFY_PARAM_get_flags
+#define X509_VERIFY_PARAM_clear_flags   wolfSSL_X509_VERIFY_PARAM_clear_flags
 #define X509_VERIFY_PARAM_set_hostflags wolfSSL_X509_VERIFY_PARAM_set_hostflags
 #define X509_VERIFY_PARAM_set1_host     wolfSSL_X509_VERIFY_PARAM_set1_host
 #define X509_VERIFY_PARAM_set1_ip_asc   wolfSSL_X509_VERIFY_PARAM_set1_ip_asc
+#define X509_VERIFY_PARAM_set1          wolfSSL_X509_VERIFY_PARAM_set1
 #define X509_STORE_load_locations       wolfSSL_X509_STORE_load_locations
 
 #define X509_LOOKUP_add_dir             wolfSSL_X509_LOOKUP_add_dir
 #define X509_LOOKUP_load_file           wolfSSL_X509_LOOKUP_load_file
 #define X509_LOOKUP_hash_dir            wolfSSL_X509_LOOKUP_hash_dir
 #define X509_LOOKUP_file                wolfSSL_X509_LOOKUP_file
+#define X509_LOOKUP_ctrl                wolfSSL_X509_LOOKUP_ctrl
 
 #define d2i_X509_CRL                    wolfSSL_d2i_X509_CRL
 #define d2i_X509_CRL_fp                 wolfSSL_d2i_X509_CRL_fp
@@ -606,6 +658,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define X509_CRL_get_nextUpdate         wolfSSL_X509_CRL_get_nextUpdate
 #define X509_CRL_verify                 wolfSSL_X509_CRL_verify
 #define X509_CRL_get_REVOKED            wolfSSL_X509_CRL_get_REVOKED
+#define X509_load_crl_file              wolfSSL_X509_load_crl_file
 
 #define X509_get_X509_PUBKEY            wolfSSL_X509_get_X509_PUBKEY
 #define X509_REQ_get_X509_PUBKEY        wolfSSL_X509_get_X509_PUBKEY
@@ -626,6 +679,9 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 
 #define X509_OBJECT_free_contents       wolfSSL_X509_OBJECT_free_contents
 
+#define X509_OBJECT_get0_X509           wolfSSL_X509_OBJECT_get0_X509
+#define X509_OBJECT_get0_X509_CRL       wolfSSL_X509_OBJECT_get0_X509_CRL
+
 #define X509_check_purpose(...)         0
 
 #define OCSP_parse_url                  wolfSSL_OCSP_parse_url
@@ -656,11 +712,10 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define BIO_set_write_buffer_size       wolfSSL_BIO_set_write_buffer_size
 #define BIO_f_ssl                       wolfSSL_BIO_f_ssl
 #define BIO_new_socket                  wolfSSL_BIO_new_socket
-#ifndef NO_WOLFSSL_STUB
 #define BIO_new_connect                 wolfSSL_BIO_new_connect
 #define BIO_set_conn_port               wolfSSL_BIO_set_conn_port
 #define BIO_do_connect                  wolfSSL_BIO_do_connect
-#endif
+#define BIO_do_handshake                wolfSSL_BIO_do_handshake
 #define SSL_set_bio                     wolfSSL_set_bio
 #define BIO_set_ssl                     wolfSSL_BIO_set_ssl
 #define BIO_eof                         wolfSSL_BIO_eof
@@ -735,7 +790,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define ASN1_STRING_free                wolfSSL_ASN1_STRING_free
 #define ASN1_STRING_cmp                 wolfSSL_ASN1_STRING_cmp
 #define ASN1_STRING_data                wolfSSL_ASN1_STRING_data
-#define ASN1_STRING_get0_data           wolfSSL_ASN1_STRING_data
+#define ASN1_STRING_get0_data           wolfSSL_ASN1_STRING_get0_data
 #define ASN1_STRING_length              wolfSSL_ASN1_STRING_length
 #define ASN1_STRING_to_UTF8             wolfSSL_ASN1_STRING_to_UTF8
 #define ASN1_UNIVERSALSTRING_to_string  wolfSSL_ASN1_UNIVERSALSTRING_to_string
@@ -746,6 +801,8 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define ASN1_STRING_set_default_mask_asc(...) 1
 #endif
 
+#define ASN1_OCTET_STRING_free          wolfSSL_ASN1_STRING_free
+
 #define ASN1_PRINTABLE_type(...)        V_ASN1_PRINTABLESTRING
 
 #define ASN1_UTCTIME_pr                 wolfSSL_ASN1_UTCTIME_pr
@@ -774,6 +831,10 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define SSL_CTX_set_info_callback       wolfSSL_CTX_set_info_callback
 #define SSL_CTX_set_alpn_protos         wolfSSL_CTX_set_alpn_protos
 
+#define SSL_CTX_keylog_cb_func          wolfSSL_CTX_keylog_cb_func
+#define SSL_CTX_set_keylog_callback     wolfSSL_CTX_set_keylog_callback
+#define SSL_CTX_get_keylog_callback     wolfSSL_CTX_get_keylog_callback
+
 #define SSL_alert_type_string           wolfSSL_alert_type_string
 #define SSL_alert_desc_string           wolfSSL_alert_desc_string
 #define SSL_state_string                wolfSSL_state_string
@@ -782,7 +843,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define RSA_generate_key                wolfSSL_RSA_generate_key
 #define SSL_CTX_set_tmp_rsa_callback    wolfSSL_CTX_set_tmp_rsa_callback
 #define RSA_print                       wolfSSL_RSA_print
-#define RSA_bits                        wolfSSL_RSA_size
+#define RSA_bits                        wolfSSL_RSA_bits
 #define RSA_up_ref                      wolfSSL_RSA_up_ref
 #define RSA_padding_add_PKCS1_PSS       wolfSSL_RSA_padding_add_PKCS1_PSS
 #define RSA_verify_PKCS1_PSS            wolfSSL_RSA_verify_PKCS1_PSS
@@ -858,6 +919,8 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define ERR_error_string                wolfSSL_ERR_error_string
 #define ERR_error_string_n              wolfSSL_ERR_error_string_n
 #define ERR_reason_error_string         wolfSSL_ERR_reason_error_string
+#define ERR_func_error_string           wolfSSL_ERR_func_error_string
+#define ERR_lib_error_string            wolfSSL_ERR_lib_error_string
 #define ERR_load_BIO_strings            wolfSSL_ERR_load_BIO_strings
 
 #ifndef WOLFCRYPT_ONLY
@@ -881,6 +944,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define SSL_CTX_clear_options           wolfSSL_CTX_clear_options
 
 #define SSL_CTX_check_private_key       wolfSSL_CTX_check_private_key
+#define SSL_CTX_get0_privatekey         wolfSSL_CTX_get0_privatekey
 #define SSL_check_private_key           wolfSSL_check_private_key
 
 #define SSL_CTX_set_mode                wolfSSL_CTX_set_mode
@@ -902,8 +966,10 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 
 #define sk_num                          wolfSSL_sk_num
 #define sk_ASN1_OBJECT_num              wolfSSL_sk_num
+#define OPENSSL_sk_num                  wolfSSL_sk_num
 #define sk_value                        wolfSSL_sk_value
 #define sk_ASN1_OBJECT_value            wolfSSL_sk_value
+#define OPENSSL_sk_value                wolfSSL_sk_value
 
 #define d2i_PKCS12_bio                  wolfSSL_d2i_PKCS12_bio
 #define d2i_PKCS12_fp                   wolfSSL_d2i_PKCS12_fp
@@ -1055,13 +1121,22 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 
 #define SSL_CTX_set_min_proto_version   wolfSSL_CTX_set_min_proto_version
 #define SSL_CTX_set_max_proto_version   wolfSSL_CTX_set_max_proto_version
+#define SSL_set_min_proto_version       wolfSSL_set_min_proto_version
+#define SSL_set_max_proto_version       wolfSSL_set_max_proto_version
+#define SSL_CTX_get_min_proto_version   wolfSSL_CTX_get_min_proto_version
 
 #define SSL_get_tlsext_status_exts      wolfSSL_get_tlsext_status_exts
 
+#define SSL_CTX_get_tlsext_ticket_keys  wolfSSL_CTX_get_tlsext_ticket_keys
+#define SSL_CTX_set_tlsext_ticket_keys  wolfSSL_CTX_set_tlsext_ticket_keys
+#define SSL_CTX_get_tlsext_status_cb    wolfSSL_CTX_get_tlsext_status_cb
+#define SSL_CTX_set_tlsext_status_cb    wolfSSL_CTX_set_tlsext_status_cb
+
 #define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS         11
 #define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS         12
 #define SSL_CTRL_SET_TMP_DH                       3
 #define SSL_CTRL_SET_TMP_ECDH                     4
+#define SSL_CTRL_SET_SESS_CACHE_MODE              44
 #define SSL_CTRL_SET_TLSEXT_DEBUG_ARG             57
 #define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE       65
 #define SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS       66
@@ -1070,6 +1145,12 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS        69
 #define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP  70
 #define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP  71
+#define SSL_CTRL_SET_GROUPS                       91
+#define SSL_CTRL_GET_PEER_TMP_KEY                 109
+#define SSL_CTRL_GET_SERVER_TMP_KEY               SSL_CTRL_GET_PEER_TMP_KEY
+#define SSL_CTRL_SET_MIN_PROTO_VERSION            123
+#define SSL_CTRL_SET_MAX_PROTO_VERSION            124
+#define SSL_CTRL_SET_CURVES                       SSL_CTRL_SET_GROUPS
 
 #define SSL_CTRL_EXTRA_CHAIN_CERT               14
 #define SSL_CTRL_OPTIONS                        32
@@ -1099,6 +1180,23 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define DTLS1_VERSION                    0xFEFF
 #define DTLS1_2_VERSION                  0xFEFD
 
+#define OPENSSL_INIT_LOAD_SSL_STRINGS    0x00200000L
+#define OPENSSL_INIT_LOAD_CRYPTO_STRINGS 0x00000002L
+
+#define CRYPTO_EX_INDEX_SSL              0
+#define TLS_ANY_VERSION                  0x10000
+#define DTLS1_2_VERSION                  0xFEFD
+#define DTLS_MAX_VERSION                 DTLS1_2_VERSION
+
+/* apache and lighty use SSL_CONF_FLAG_FILE to enable conf support */
+#if !defined(WOLFSSL_APACHE_HTTPD) && !defined(HAVE_LIGHTY)
+#define SSL_CONF_FLAG_CMDLINE            WOLFSSL_CONF_FLAG_CMDLINE
+#define SSL_CONF_FLAG_FILE               WOLFSSL_CONF_FLAG_FILE
+#define SSL_CONF_FLAG_CERTIFICATE        WOLFSSL_CONF_FLAG_CERTIFICATE
+#define SSL_CONF_TYPE_STRING             WOLFSSL_CONF_TYPE_STRING
+#define SSL_CONF_TYPE_FILE               WOLFSSL_CONF_TYPE_FILE
+#endif
+
 #if defined(HAVE_STUNNEL) || defined(WOLFSSL_NGINX) || defined(OPENSSL_EXTRA) \
                                                          || defined(OPENSSL_ALL)
 #include <libs/libwolfssl/openssl/asn1.h>
@@ -1108,6 +1206,9 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 
 #define SSL3_AD_BAD_CERTIFICATE          bad_certificate
 #define SSL_AD_BAD_CERTIFICATE           SSL3_AD_BAD_CERTIFICATE
+#define SSL_AD_UNRECOGNIZED_NAME         unrecognized_name
+#define SSL_AD_NO_RENEGOTIATION          no_renegotiation
+#define SSL_AD_INTERNAL_ERROR            80
 
 #define ASN1_STRFLGS_ESC_MSB             4
 
@@ -1147,8 +1248,9 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 
 #define SSL3_AL_FATAL                   2
 #define SSL_TLSEXT_ERR_OK               0
-#define SSL_TLSEXT_ERR_ALERT_FATAL      alert_fatal
+#define SSL_TLSEXT_ERR_ALERT_WARNING    warning_return
-#define SSL_TLSEXT_ERR_NOACK            alert_warning
+#define SSL_TLSEXT_ERR_ALERT_FATAL      fatal_return
+#define SSL_TLSEXT_ERR_NOACK            noack_return
 #define TLSEXT_NAMETYPE_host_name       WOLFSSL_SNI_HOST_NAME
 
 #define SSL_set_tlsext_host_name        wolfSSL_set_tlsext_host_name
@@ -1162,6 +1264,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define PSK_MAX_IDENTITY_LEN            128
 #define SSL_CTX_clear_options           wolfSSL_CTX_clear_options
 
+#define SSL_CTX_add_server_custom_ext(...) 0
 
 #endif /* HAVE_STUNNEL || WOLFSSL_NGINX */
 
@@ -1202,7 +1305,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 
 #if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \
     defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(OPENSSL_ALL) || \
-    defined(HAVE_LIGHTY)
+    defined(HAVE_LIGHTY) || defined(HAVE_STUNNEL)
 
 #include <libs/libwolfssl/error-ssl.h>
 
@@ -1235,6 +1338,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define SSL_R_HTTPS_PROXY_REQUEST                  PARSE_ERROR
 #define SSL_R_HTTP_REQUEST                         PARSE_ERROR
 #define SSL_R_UNSUPPORTED_PROTOCOL                 VERSION_ERROR
+#define SSL_R_CERTIFICATE_VERIFY_FAILED            VERIFY_CERT_ERROR
 
 
 #ifdef HAVE_SESSION_TICKET
@@ -1286,6 +1390,8 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define SSL_CTX_set_srp_strength        wolfSSL_CTX_set_srp_strength
 #define SSL_get_SSL_CTX                 wolfSSL_get_SSL_CTX
 #define SSL_get0_param                  wolfSSL_get0_param
+#define SSL_CTX_get0_param              wolfSSL_CTX_get0_param
+#define SSL_CTX_set1_param              wolfSSL_CTX_set1_param
 #define SSL_get_srp_username            wolfSSL_get_srp_username
 
 #define ERR_NUM_ERRORS                  16
@@ -1297,6 +1403,11 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define SSL_get_rbio                    wolfSSL_SSL_get_rbio
 #define SSL_get_wbio                    wolfSSL_SSL_get_wbio
 #define SSL_do_handshake                wolfSSL_SSL_do_handshake
+
+#if defined(WOLFSSL_EARLY_DATA)
+#define SSL_get_early_data_status       wolfSSL_get_early_data_status
+#endif
+
 #endif  /* OPENSSL_EXTRA */
 
 /* cipher suites for compatibility */
@@ -1313,15 +1424,30 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define sk_X509_OBJECT_num              wolfSSL_sk_X509_OBJECT_num
 #define sk_X509_OBJECT_value            wolfSSL_sk_X509_OBJECT_value
 #define sk_X509_OBJECT_delete           wolfSSL_sk_X509_OBJECT_delete
+#define X509_OBJECT_new                 wolfSSL_X509_OBJECT_new
 #define X509_OBJECT_free                wolfSSL_X509_OBJECT_free
-#define X509_OBJECT_get_type(x)         0
+#define X509_OBJECT_get_type            wolfSSL_X509_OBJECT_get_type
-
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
+#define OpenSSL_version(x)              wolfSSL_OpenSSL_version(x)
+#else
 #define OpenSSL_version(x)              wolfSSL_OpenSSL_version()
+#endif
 
 #ifndef NO_WOLFSSL_STUB
 #define OBJ_create_objects(...)
 #endif
 
+#define SSL_set_psk_use_session_callback    wolfSSL_set_psk_use_session_callback
+#define SSL_SESSION_is_resumable    wolfSSL_SESSION_is_resumable
+typedef WOLFSSL_CONF_CTX SSL_CONF_CTX;
+
+#define SSL_CONF_CTX_new                wolfSSL_CONF_CTX_new
+#define SSL_CONF_CTX_free               wolfSSL_CONF_CTX_free
+#define SSL_CONF_CTX_set_ssl_ctx        wolfSSL_CONF_CTX_set_ssl_ctx
+#define SSL_CONF_CTX_set_flags          wolfSSL_CONF_CTX_set_flags
+#define SSL_CONF_CTX_finish             wolfSSL_CONF_CTX_finish
+#define SSL_CONF_cmd                    wolfSSL_CONF_cmd
+
 #ifdef __cplusplus
     } /* extern "C" */
 #endif

source/libs/libwolfssl/openssl/stack.h

@@ -1,6 +1,6 @@
 /* stack.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/tls1.h

@@ -1,6 +1,6 @@
 /* tls1.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/x509_vfy.h

@@ -1,6 +1,6 @@
 /* x509_vfy.h
  *
- * Copyright (C) 2006-2017 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/openssl/x509v3.h

@@ -1,6 +1,6 @@
 /* x509v3.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/sniffer.h

@@ -1,6 +1,6 @@
 /* sniffer.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -25,6 +25,7 @@
 #define WOLFSSL_SNIFFER_H
 
 #include <libs/libwolfssl/wolfcrypt/settings.h>
+#include <libs/libwolfssl/wolfcrypt/asn_public.h>
 
 #ifdef _WIN32
     #ifdef SSL_SNIFFER_EXPORTS
@@ -182,8 +183,6 @@ typedef struct SSLStats
     unsigned long int sslDecryptedPackets;
     unsigned long int sslKeyMatches;
     unsigned long int sslEncryptedConns;
-
-    unsigned long int sslResumptionValid;
     unsigned long int sslResumptionInserts;
 } SSLStats;
 
@@ -199,7 +198,21 @@ SSL_SNIFFER_API int ssl_ReadStatistics(SSLStats* stats);
 WOLFSSL_API
 SSL_SNIFFER_API int ssl_ReadResetStatistics(SSLStats* stats);
 
+typedef int (*SSLKeyCb)(void* vSniffer, int namedGroup,
+    const unsigned char* srvPub, unsigned int srvPubSz,
+    const unsigned char* cliPub, unsigned int cliPubSz,
+    DerBuffer* privKey, void* cbCtx, char* error);
 
+#if defined(WOLFSSL_STATIC_EPHEMERAL) && defined(WOLFSSL_TLS13)
+/* macro indicating support for key callback */
+#undef  WOLFSSL_SNIFFER_KEY_CALLBACK
+#define WOLFSSL_SNIFFER_KEY_CALLBACK
+WOLFSSL_API 
+SSL_SNIFFER_API int ssl_SetKeyCallback(SSLKeyCb cb, void* cbCtx);
+#endif
+
+
+#ifdef WOLFSSL_SNIFFER_WATCH
 typedef int (*SSLWatchCb)(void* vSniffer,
                         const unsigned char* certHash,
                         unsigned int certHashSz,
@@ -226,29 +239,37 @@ WOLFSSL_API
 SSL_SNIFFER_API int ssl_SetWatchKey_file(void* vSniffer,
                         const char* keyFile, int keyType,
                         const char* password, char* error);
+#endif
 
-
+#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
 typedef int (*SSLStoreDataCb)(const unsigned char* decryptBuf,
         unsigned int decryptBufSz, unsigned int decryptBufOffset, void* ctx);
 
 WOLFSSL_API
 SSL_SNIFFER_API int ssl_SetStoreDataCallback(SSLStoreDataCb cb);
+#endif
 
+#ifdef WOLFSSL_SNIFFER_STORE_DATA_CB
 WOLFSSL_API
 SSL_SNIFFER_API int ssl_DecodePacketWithSessionInfoStoreData(
         const unsigned char* packet, int length, void* ctx,
         SSLInfo* sslInfo, char* error);
+#endif
 
-
+#ifdef WOLFSSL_SNIFFER_CHAIN_INPUT
 WOLFSSL_API
 SSL_SNIFFER_API int ssl_DecodePacketWithChain(void* vChain,
         unsigned int chainSz, unsigned char** data, char* error);
+#endif
 
-
+#if defined(WOLFSSL_SNIFFER_CHAIN_INPUT) && \
+    defined(WOLFSSL_SNIFFER_STORE_DATA_CB)
 WOLFSSL_API
 SSL_SNIFFER_API int ssl_DecodePacketWithChainSessionInfoStoreData(
         void* vChain, unsigned int chainSz, void* ctx, SSLInfo* sslInfo,
         char* error);
+#endif
+
 
 #ifdef __cplusplus
     }  /* extern "C" */

source/libs/libwolfssl/sniffer_error.h

@@ -1,6 +1,6 @@
 /* sniffer_error.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -24,6 +24,13 @@
 #ifndef WOLFSSL_SNIFFER_ERROR_H
 #define WOLFSSL_SNIFFER_ERROR_H
 
+
+/* General Sniffer Error */
+#define WOLFSSL_SNIFFER_ERROR -1
+
+/* Sniffer failed and is in Fatal state */
+#define WOLFSSL_SNIFFER_FATAL_ERROR -2
+
 /* need to have errors as #defines since .rc files can't handle enums */
 /* need to start at 1 and go in order for same reason */
 

source/libs/libwolfssl/version.h

@@ -1,6 +1,6 @@
 /* wolfssl_version.h.in
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -28,8 +28,8 @@
 extern "C" {
 #endif
 
-#define LIBWOLFSSL_VERSION_STRING "4.6.0"
+#define LIBWOLFSSL_VERSION_STRING "4.8.1"
-#define LIBWOLFSSL_VERSION_HEX 0x04006000
+#define LIBWOLFSSL_VERSION_HEX 0x04008001
 
 #ifdef __cplusplus
 }

source/libs/libwolfssl/wolfcrypt/aes.h

@@ -1,6 +1,6 @@
 /* aes.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -250,6 +250,21 @@ struct Aes {
     silabs_aes_t ctx;
 #endif
     void*  heap; /* memory hint to use */
+#ifdef WOLFSSL_AESGCM_STREAM
+#if !defined(WOLFSSL_SMALL_STACK) || defined(WOLFSSL_AESNI)
+    ALIGN16 byte streamData[5 * AES_BLOCK_SIZE];
+#else
+    byte*        streamData;
+#endif
+    word32       aSz;
+    word32       cSz;
+    byte         over;
+    byte         aOver;
+    byte         cOver;
+    byte         gcmKeySet:1;
+    byte         nonceSet:1;
+    byte         ctrSet:1;
+#endif
 };
 
 #ifndef WC_AES_TYPE_DEFINED
@@ -361,6 +376,26 @@ WOLFSSL_API int wc_AesEcbDecrypt(Aes* aes, byte* out,
                                    const byte* iv, word32 ivSz,
                                    const byte* authTag, word32 authTagSz,
                                    const byte* authIn, word32 authInSz);
+#ifdef WOLFSSL_AESGCM_STREAM
+WOLFSSL_API int wc_AesGcmInit(Aes* aes, const byte* key, word32 len,
+        const byte* iv, word32 ivSz);
+
+WOLFSSL_API int wc_AesGcmEncryptInit(Aes* aes, const byte* key, word32 len,
+        const byte* iv, word32 ivSz);
+WOLFSSL_API int wc_AesGcmEncryptInit_ex(Aes* aes, const byte* key, word32 len,
+        byte* ivOut, word32 ivOutSz);
+WOLFSSL_API int wc_AesGcmEncryptUpdate(Aes* aes, byte* out, const byte* in,
+        word32 sz, const byte* authIn, word32 authInSz);
+WOLFSSL_API int wc_AesGcmEncryptFinal(Aes* aes, byte* authTag,
+        word32 authTagSz);
+
+WOLFSSL_API int wc_AesGcmDecryptInit(Aes* aes, const byte* key, word32 len,
+        const byte* iv, word32 ivSz);
+WOLFSSL_API int wc_AesGcmDecryptUpdate(Aes* aes, byte* out, const byte* in,
+        word32 sz, const byte* authIn, word32 authInSz);
+WOLFSSL_API int wc_AesGcmDecryptFinal(Aes* aes, const byte* authTag,
+        word32 authTagSz);
+#endif
 
 #ifndef WC_NO_RNG
  WOLFSSL_API int  wc_AesGcmSetExtIV(Aes* aes, const byte* iv, word32 ivSz);
@@ -416,10 +451,18 @@ WOLFSSL_API int wc_AesEcbDecrypt(Aes* aes, byte* out,
                                 const byte* in, word32 inSz,
                                 byte* out, word32 outSz,
                                 const byte* iv);
+ WOLFSSL_API int  wc_AesKeyWrap_ex(Aes *aes,
+                                const byte* in, word32 inSz,
+                                byte* out, word32 outSz,
+                                const byte* iv);
  WOLFSSL_API int  wc_AesKeyUnWrap(const byte* key, word32 keySz,
                                 const byte* in, word32 inSz,
                                 byte* out, word32 outSz,
                                 const byte* iv);
+ WOLFSSL_API int  wc_AesKeyUnWrap_ex(Aes *aes,
+                                const byte* in, word32 inSz,
+                                byte* out, word32 outSz,
+                                const byte* iv);
 #endif /* HAVE_AES_KEYWRAP */
 
 #ifdef WOLFSSL_AES_XTS

source/libs/libwolfssl/wolfcrypt/arc4.h

@@ -1,6 +1,6 @@
 /* arc4.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/asn.h

@@ -1,6 +1,6 @@
 /* asn.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -140,6 +140,7 @@ enum DN_Tags {
     /* pilot attribute types
      * OID values of 0.9.2342.19200300.100.1.* */
     ASN_USER_ID          = 0x01, /* UID */
+    ASN_FAVOURITE_DRINK  = 0x05, /* favouriteDrink */
     ASN_DOMAIN_COMPONENT = 0x19  /* DC */
 };
 
@@ -182,6 +183,7 @@ extern const WOLFSSL_ObjectInfo wolfssl_object_info[];
 
 #define WOLFSSL_USER_ID          "/UID="
 #define WOLFSSL_DOMAIN_COMPONENT "/DC="
+#define WOLFSSL_FAVOURITE_DRINK  "/favouriteDrink="
 
 #if defined(WOLFSSL_APACHE_HTTPD)
     /* otherName strings */
@@ -196,6 +198,7 @@ extern const WOLFSSL_ObjectInfo wolfssl_object_info[];
     #define WOLFSSL_TLS_FEATURE_SUM 92
 #endif
 
+#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
 /* NIDs */
 enum
 {
@@ -247,6 +250,7 @@ enum
     NID_jurisdictionStateOrProvinceName = 0xd,
     NID_businessCategory = ASN_BUS_CAT,
     NID_domainComponent = ASN_DOMAIN_COMPONENT,
+    NID_favouriteDrink = 462,
     NID_userId = 458,
     NID_emailAddress = 0x30,           /* emailAddress */
     NID_id_on_dnsSRV = 82,             /* 1.3.6.1.5.5.7.8.7 */
@@ -254,6 +258,7 @@ enum
 
     NID_X9_62_prime_field = 406        /* 1.2.840.10045.1.1 */
 };
+#endif /* OPENSSL_EXTRA */
 
 enum ECC_TYPES
 {
@@ -305,12 +310,17 @@ enum Misc_ASN {
     KEYID_SIZE          = WC_SHA_DIGEST_SIZE,
 #endif
     RSA_INTS            =   8,     /* RSA ints in private key */
+    DSA_PARAM_INTS      =   3,     /* DSA paramater ints */
     DSA_INTS            =   5,     /* DSA ints in private key */
     MIN_DATE_SIZE       =  12,
     MAX_DATE_SIZE       =  32,
     ASN_GEN_TIME_SZ     =  15,     /* 7 numbers * 2 + Zulu tag */
 #ifndef NO_RSA
-    MAX_ENCODED_SIG_SZ  = 512,
+#ifdef WOLFSSL_HAPROXY
+    MAX_ENCODED_SIG_SZ  = 1024,    /* Supports 8192 bit keys */
+#else
+    MAX_ENCODED_SIG_SZ  = 512,     /* Supports 4096 bit keys */
+#endif
 #elif defined(HAVE_ECC)
     MAX_ENCODED_SIG_SZ  = 140,
 #elif defined(HAVE_CURVE448)
@@ -330,7 +340,7 @@ enum Misc_ASN {
     MAX_ENCODED_DIG_ASN_SZ= 9,     /* enum(bit or octet) + length(4) */
     MAX_ENCODED_DIG_SZ  =  64 + MAX_ENCODED_DIG_ASN_SZ, /* asn header + sha512 */
     MAX_RSA_INT_SZ      = 517,     /* RSA raw sz 4096 for bits + tag + len(4) */
-    MAX_DSA_INT_SZ      = 261,     /* DSA raw sz 2048 for bits + tag + len(4) */
+    MAX_DSA_INT_SZ      = 389,     /* DSA raw sz 3072 for bits + tag + len(4) */
     MAX_NTRU_KEY_SZ     = 610,     /* NTRU 112 bit public key */
     MAX_NTRU_ENC_SZ     = 628,     /* NTRU 112 bit DER public encoding */
     MAX_LENGTH_SZ       =   4,     /* Max length size for DER encoding */
@@ -531,23 +541,23 @@ enum HMAC_Sum {
 
 
 enum Extensions_Sum {
-    BASIC_CA_OID    = 133,
+    BASIC_CA_OID    = 133,           /* 2.5.29.19 */
-    ALT_NAMES_OID   = 131,
+    ALT_NAMES_OID   = 131,           /* 2.5.29.17 */
-    CRL_DIST_OID    = 145,
+    CRL_DIST_OID    = 145,           /* 2.5.29.31 */
-    AUTH_INFO_OID   = 69, /* id-pe 1 */
+    AUTH_INFO_OID   = 69,            /* 1.3.6.1.5.5.7.1.1 */
-    AUTH_KEY_OID    = 149,
+    AUTH_KEY_OID    = 149,           /* 2.5.29.35 */
-    SUBJ_KEY_OID    = 128,
+    SUBJ_KEY_OID    = 128,           /* 2.5.29.14 */
-    CERT_POLICY_OID = 146,
+    CERT_POLICY_OID = 146,           /* 2.5.29.32 */
-    KEY_USAGE_OID   = 129,  /* 2.5.29.15 */
+    KEY_USAGE_OID   = 129,           /* 2.5.29.15 */
-    INHIBIT_ANY_OID = 168,  /* 2.5.29.54 */
+    INHIBIT_ANY_OID = 168,           /* 2.5.29.54 */
     EXT_KEY_USAGE_OID         = 151, /* 2.5.29.37 */
     NAME_CONS_OID             = 144, /* 2.5.29.30 */
     PRIV_KEY_USAGE_PERIOD_OID = 130, /* 2.5.29.16 */
-    SUBJECT_INFO_ACCESS       = 79,  /* id-pe 11 */
+    SUBJECT_INFO_ACCESS       = 79,  /* 1.3.6.1.5.5.7.1.11 */
-    POLICY_MAP_OID            = 147,
+    POLICY_MAP_OID            = 147, /* 2.5.29.33 */
-    POLICY_CONST_OID          = 150,
+    POLICY_CONST_OID          = 150, /* 2.5.29.36 */
-    ISSUE_ALT_NAMES_OID       = 132,
+    ISSUE_ALT_NAMES_OID       = 132, /* 2.5.29.18 */
-    TLS_FEATURE_OID           = 92,  /* id-pe 24 */
+    TLS_FEATURE_OID           = 92,  /* 1.3.6.1.5.5.7.1.24 */
     NETSCAPE_CT_OID           = 753, /* 2.16.840.1.113730.1.1 */
     OCSP_NOCHECK_OID          = 121  /* 1.3.6.1.5.5.7.48.1.5
                                          id-pkix-ocsp-nocheck */
@@ -589,6 +599,7 @@ enum VerifyType {
     VERIFY_OCSP = 3,
     VERIFY_NAME = 4,
     VERIFY_SKIP_DATE = 5,
+    VERIFY_OCSP_CERT = 6,
 };
 
 #ifdef WOLFSSL_CERT_EXT
@@ -682,7 +693,8 @@ struct SignatureCtx {
 #if !(defined(NO_RSA) && defined(NO_DSA))
     byte* sigCpy;
 #endif
-#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
+#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \
+    !defined(NO_DSA)
     int verify;
 #endif
     union {
@@ -829,6 +841,7 @@ struct DecodedCert {
     byte    maxPathLen;              /* max_path_len see RFC 5280 section
                                       * 6.1.2 "Initialization" - (k) for
                                       * description of max_path_len */
+    byte    policyConstSkip;         /* Policy Constraints skip certs value */
     word16  extKeyUsage;             /* Key usage bitfield               */
     byte    extExtKeyUsage;          /* Extended Key usage bitfield      */
 
@@ -949,6 +962,9 @@ struct DecodedCert {
     byte extCRLdistSet : 1;
     byte extAuthInfoSet : 1;
     byte extBasicConstSet : 1;
+    byte extPolicyConstSet : 1;
+    byte extPolicyConstRxpSet : 1; /* requireExplicitPolicy set */
+    byte extPolicyConstIpmSet : 1; /* inhibitPolicyMapping set */
     byte extSubjAltNameSet : 1;
     byte inhibitAnyOidSet : 1;
     byte selfSigned : 1;           /* Indicates subject and issuer are same */
@@ -959,6 +975,7 @@ struct DecodedCert {
     byte extCRLdistCrit : 1;
     byte extAuthInfoCrit : 1;
     byte extBasicConstCrit : 1;
+    byte extPolicyConstCrit : 1;
     byte extSubjAltNameCrit : 1;
     byte extAuthKeyIdCrit : 1;
     #ifndef IGNORE_NAME_CONSTRAINTS
@@ -976,6 +993,14 @@ struct DecodedCert {
 #endif
 };
 
+/* ASN Encoded Name field */
+typedef struct EncodedName {
+    int  nameLen;                /* actual string value length */
+    int  totalLen;               /* total encoded length */
+    int  type;                   /* type of name */
+    int  used;                   /* are we actually using this one */
+    byte encoded[CTC_NAME_SIZE * 2]; /* encoding */
+} EncodedName;
 
 #ifdef NO_SHA
     #define SIGNER_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
@@ -1049,6 +1074,42 @@ struct TrustedPeerCert {
     #define WOLFSSL_ASN_API WOLFSSL_LOCAL
 #endif
 
+#ifdef HAVE_SMIME
+#define MIME_HEADER_ASCII_MIN   33
+#define MIME_HEADER_ASCII_MAX   126
+
+typedef struct MimeParam MimeParam;
+typedef struct MimeHdr MimeHdr;
+
+struct MimeParam
+{
+    MimeParam*  next;
+    char*       attribute;
+    char*       value;
+};
+
+struct MimeHdr
+{
+    MimeHdr*    next;
+    MimeParam*  params;
+    char*       name;
+    char*       body;
+};
+
+typedef enum MimeTypes
+{
+    MIME_HDR,
+    MIME_PARAM
+} MimeTypes;
+
+typedef enum MimeStatus
+{
+    MIME_NAMEATTR,
+    MIME_BODYVAL
+} MimeStatus;
+#endif /* HAVE_SMIME */
+
+
 WOLFSSL_LOCAL int CalcHashId(const byte* data, word32 len, byte* hash);
 WOLFSSL_LOCAL int GetName(DecodedCert* cert, int nameType, int maxIdx);
 
@@ -1126,6 +1187,10 @@ WOLFSSL_LOCAL int DateGreaterThan(const struct tm* a, const struct tm* b);
 WOLFSSL_LOCAL int wc_ValidateDate(const byte* date, byte format, int dateType);
 WOLFSSL_LOCAL int wc_OBJ_sn2nid(const char *sn);
 
+WOLFSSL_LOCAL int wc_EncodeName(EncodedName* name, const char* nameStr,
+                                char nameType, byte type);
+WOLFSSL_LOCAL int wc_EncodeNameCanonical(EncodedName* name, const char* nameStr,
+                                char nameType, byte type);
 /* ASN.1 helper functions */
 #ifdef WOLFSSL_CERT_GEN
 WOLFSSL_ASN_API int SetName(byte* output, word32 outputSz, CertName* name);
@@ -1178,12 +1243,6 @@ WOLFSSL_LOCAL int GetASNTag(const byte* input, word32* idx, byte* tag,
 WOLFSSL_LOCAL word32 SetLength(word32 length, byte* output);
 WOLFSSL_LOCAL word32 SetSequence(word32 len, byte* output);
 WOLFSSL_LOCAL word32 SetOctetString(word32 len, byte* output);
-#if (defined(WOLFSSL_QT) || defined(OPENSSL_ALL)) && !defined(NO_DH) \
-    || defined(WOLFSSL_OPENSSH)
-WOLFSSL_LOCAL int wc_DhParamsToDer(DhKey* key, byte* out, word32* outSz);
-WOLFSSL_LOCAL int wc_DhPubKeyToDer(DhKey* key, byte* out, word32* outSz);
-WOLFSSL_LOCAL int wc_DhPrivKeyToDer(DhKey* key, byte* out, word32* outSz);
-#endif
 WOLFSSL_LOCAL int SetASNInt(int len, byte firstByte, byte* output);
 WOLFSSL_LOCAL word32 SetBitString(word32 len, byte unusedBits, byte* output);
 WOLFSSL_LOCAL word32 SetImplicit(byte tag,byte number,word32 len,byte* output);
@@ -1203,16 +1262,16 @@ WOLFSSL_LOCAL int wc_CheckPrivateKey(const byte* privKey, word32 privKeySz,
 WOLFSSL_LOCAL int StoreDHparams(byte* out, word32* outLen, mp_int* p, mp_int* g);
 WOLFSSL_LOCAL int FlattenAltNames( byte*, word32, const DNS_entry*);
 
-#ifdef HAVE_ECC
+#if defined(HAVE_ECC) || !defined(NO_DSA)
     /* ASN sig helpers */
     WOLFSSL_LOCAL int StoreECC_DSA_Sig(byte* out, word32* outLen, mp_int* r,
                                       mp_int* s);
     WOLFSSL_LOCAL int StoreECC_DSA_Sig_Bin(byte* out, word32* outLen, 
         const byte* r, word32 rLen, const byte* s, word32 sLen);
-    WOLFSSL_LOCAL int DecodeECC_DSA_Sig(const byte* sig, word32 sigLen,
-                                       mp_int* r, mp_int* s);
     WOLFSSL_LOCAL int DecodeECC_DSA_Sig_Bin(const byte* sig, word32 sigLen, 
         byte* r, word32* rLen, byte* s, word32* sLen);
+    WOLFSSL_LOCAL int DecodeECC_DSA_Sig(const byte* sig, word32 sigLen,
+                                       mp_int* r, mp_int* s);
 #endif
 #if defined HAVE_ECC && (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL))
 WOLFSSL_API int EccEnumToNID(int n);
@@ -1223,8 +1282,8 @@ WOLFSSL_LOCAL void FreeSignatureCtx(SignatureCtx* sigCtx);
 
 #ifndef NO_CERTS
 
-WOLFSSL_LOCAL int wc_EncryptedInfoParse(EncryptedInfo* info, char** pBuffer,
+WOLFSSL_LOCAL int wc_EncryptedInfoParse(EncryptedInfo* info,
-                                        size_t bufSz);
+                                        const char** pBuffer, size_t bufSz);
 
 WOLFSSL_LOCAL int PemToDer(const unsigned char* buff, long sz, int type,
                           DerBuffer** pDer, void* heap, EncryptedInfo* info,
@@ -1234,6 +1293,17 @@ WOLFSSL_LOCAL void FreeDer(DerBuffer** der);
 
 #endif /* !NO_CERTS */
 
+#ifdef HAVE_SMIME
+WOLFSSL_LOCAL int wc_MIME_parse_headers(char* in, int inLen, MimeHdr** hdrs);
+WOLFSSL_LOCAL int wc_MIME_header_strip(char* in, char** out, size_t start, size_t end);
+WOLFSSL_LOCAL int wc_MIME_create_header(char* name, char* body, MimeHdr** hdr);
+WOLFSSL_LOCAL int wc_MIME_create_parameter(char* attribute, char* value, MimeParam** param);
+WOLFSSL_LOCAL MimeHdr* wc_MIME_find_header_name(const char* name, MimeHdr* hdr);
+WOLFSSL_LOCAL MimeParam* wc_MIME_find_param_attr(const char* attribute, MimeParam* param);
+WOLFSSL_LOCAL char* wc_MIME_canonicalize(const char* line);
+WOLFSSL_LOCAL int wc_MIME_free_hdrs(MimeHdr* head);
+#endif /* HAVE_SMIME */
+
 #ifdef WOLFSSL_CERT_GEN
 
 enum cert_enums {
@@ -1341,6 +1411,8 @@ struct OcspEntry
     byte* rawCertId;                      /* raw bytes of the CertID   */
     int rawCertIdSize;                    /* num bytes in raw CertID   */
     /* option bits - using 32-bit for alignment */
+    word32 ownStatus:1;                   /* do we need to free the status
+                                           * response list */
     word32 isDynamic:1;                   /* was dynamically allocated */
 
 };

source/libs/libwolfssl/wolfcrypt/asn_public.h

@@ -1,6 +1,6 @@
 /* asn_public.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -32,6 +32,7 @@ This library defines the interface APIs for X509 certificates.
 #define WOLF_CRYPT_ASN_PUBLIC_H
 
 #include <libs/libwolfssl/wolfcrypt/types.h>
+#include <libs/libwolfssl/wolfcrypt/dsa.h>
 
 #ifdef __cplusplus
     extern "C" {
@@ -58,6 +59,10 @@ This library defines the interface APIs for X509 certificates.
     typedef struct WC_RNG WC_RNG;
     #define WC_RNG_TYPE_DEFINED
 #endif
+#ifndef WC_DH_TYPE_DEFINED
+    typedef struct DhKey DhKey;
+    #define WC_DH_TYPE_DEFINED
+#endif
 
 enum Ecc_Sum {
     ECC_SECP112R1_OID = 182,
@@ -139,6 +144,17 @@ enum Ctc_SigType {
     CTC_SHA384wECDSA = 525,
     CTC_SHA512wRSA   = 657,
     CTC_SHA512wECDSA = 526,
+
+    /* https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration */
+    CTC_SHA3_224wECDSA = 423,
+    CTC_SHA3_256wECDSA = 424,
+    CTC_SHA3_384wECDSA = 425,
+    CTC_SHA3_512wECDSA = 426,
+    CTC_SHA3_224wRSA = 427,
+    CTC_SHA3_256wRSA = 428,
+    CTC_SHA3_384wRSA = 429,
+    CTC_SHA3_512wRSA = 430,
+
     CTC_ED25519      = 256,
     CTC_ED448        = 257
 };
@@ -332,7 +348,8 @@ typedef struct Cert {
     char    certPolicies[CTC_MAX_CERTPOL_NB][CTC_MAX_CERTPOL_SZ];
     word16  certPoliciesNb;              /* Number of Cert Policy */
 #endif
-#if defined(WOLFSSL_CERT_EXT) || defined(OPENSSL_EXTRA)
+#if defined(WOLFSSL_CERT_EXT) || defined(OPENSSL_EXTRA) || \
+    defined(WOLFSSL_CERT_REQ)
     byte     issRaw[sizeof(CertName)];   /* raw issuer info */
     byte     sbjRaw[sizeof(CertName)];   /* raw subject info */
 #endif
@@ -468,7 +485,7 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer);
 
 #ifdef WOLFSSL_PEM_TO_DER
     WOLFSSL_API int wc_PemToDer(const unsigned char* buff, long longSz, int type,
-              DerBuffer** pDer, void* heap, EncryptedInfo* info, int* eccKey);
+              DerBuffer** pDer, void* heap, EncryptedInfo* info, int* keyFormat);
 
     WOLFSSL_API int wc_KeyPemToDer(const unsigned char*, int,
                                    unsigned char*, int, const char*);
@@ -508,6 +525,20 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer);
     WOLFSSL_API int wc_RsaPublicKeyDerSize(RsaKey* key, int with_header);
 #endif
 
+#ifndef NO_DSA
+    /* DSA parameter DER helper functions */
+    WOLFSSL_API int wc_DsaParamsDecode(const byte* input, word32* inOutIdx,
+                                       DsaKey*, word32);
+    WOLFSSL_API int wc_DsaKeyToParamsDer(DsaKey* key, byte* output, word32 inLen);
+#endif
+
+#if !defined(NO_DH) && defined(WOLFSSL_DH_EXTRA)
+WOLFSSL_LOCAL int wc_DhKeyToDer(DhKey* key, byte* output, word32* outSz, int exportPriv);
+WOLFSSL_API int wc_DhParamsToDer(DhKey* key, byte* out, word32* outSz);
+WOLFSSL_API int wc_DhPubKeyToDer(DhKey* key, byte* out, word32* outSz);
+WOLFSSL_API int wc_DhPrivKeyToDer(DhKey* key, byte* out, word32* outSz);
+#endif
+
 #ifdef HAVE_ECC
     /* private key helpers */
     WOLFSSL_API int wc_EccPrivateKeyDecode(const byte*, word32*,
@@ -515,8 +546,11 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer);
     WOLFSSL_API int wc_EccKeyToDer(ecc_key*, byte* output, word32 inLen);
     WOLFSSL_API int wc_EccPrivateKeyToDer(ecc_key* key, byte* output,
                                           word32 inLen);
+    WOLFSSL_API int wc_EccKeyDerSize(ecc_key*, int pub);
     WOLFSSL_API int wc_EccPrivateKeyToPKCS8(ecc_key* key, byte* output,
                                             word32* outLen);
+    WOLFSSL_API int wc_EccKeyToPKCS8(ecc_key* key, byte* output,
+                                     word32* outLen);
 
     /* public key helper */
     WOLFSSL_API int wc_EccPublicKeyDecode(const byte*, word32*,
@@ -528,17 +562,24 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer);
 
 #ifdef HAVE_ED25519
     /* private key helpers */
+#ifdef HAVE_ED25519_KEY_IMPORT
     WOLFSSL_API int wc_Ed25519PrivateKeyDecode(const byte*, word32*,
                                                ed25519_key*, word32);
+#endif
+
+#ifdef HAVE_ED25519_KEY_EXPORT
     WOLFSSL_API int wc_Ed25519KeyToDer(ed25519_key* key, byte* output,
                                        word32 inLen);
     WOLFSSL_API int wc_Ed25519PrivateKeyToDer(ed25519_key* key, byte* output,
                                               word32 inLen);
+#endif
 
     /* public key helper */
     WOLFSSL_API int wc_Ed25519PublicKeyDecode(const byte*, word32*,
                                               ed25519_key*, word32);
-    #if (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN))
+    #if (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN)) && \
+        defined(HAVE_ED25519_KEY_EXPORT)
+
         WOLFSSL_API int wc_Ed25519PublicKeyToDer(ed25519_key*, byte* output,
                                                word32 inLen, int with_AlgCurve);
     #endif
@@ -546,17 +587,23 @@ WOLFSSL_API void wc_FreeDer(DerBuffer** pDer);
 
 #ifdef HAVE_ED448
     /* private key helpers */
+#ifdef HAVE_ED448_KEY_IMPORT
     WOLFSSL_API int wc_Ed448PrivateKeyDecode(const byte*, word32*,
                                              ed448_key*, word32);
+#endif
+
+#ifdef HAVE_ED448_KEY_EXPORT
     WOLFSSL_API int wc_Ed448KeyToDer(ed448_key* key, byte* output,
                                      word32 inLen);
     WOLFSSL_API int wc_Ed448PrivateKeyToDer(ed448_key* key, byte* output,
                                             word32 inLen);
+#endif
 
     /* public key helper */
     WOLFSSL_API int wc_Ed448PublicKeyDecode(const byte*, word32*,
                                             ed448_key*, word32);
-    #if (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN))
+    #if (defined(WOLFSSL_CERT_GEN) || defined(WOLFSSL_KEY_GEN)) && \
+        defined(HAVE_ED448_KEY_EXPORT)
         WOLFSSL_API int wc_Ed448PublicKeyToDer(ed448_key*, byte* output,
                                                word32 inLen, int with_AlgCurve);
     #endif
@@ -570,7 +617,13 @@ WOLFSSL_API int wc_GetCTC_HashOID(int type);
 WOLFSSL_API int wc_GetPkcs8TraditionalOffset(byte* input,
                                              word32* inOutIdx, word32 sz);
 WOLFSSL_API int wc_CreatePKCS8Key(byte* out, word32* outSz,
-       byte* key, word32 keySz, int algoID, const byte* curveOID, word32 oidSz);
+        byte* key, word32 keySz, int algoID, const byte* curveOID,
+        word32 oidSz);
+WOLFSSL_API int wc_EncryptPKCS8Key(byte*, word32, byte*, word32*, const char*,
+        int, int, int, int, byte*, word32, int, WC_RNG*, void*);
+WOLFSSL_API int wc_DecryptPKCS8Key(byte*, word32, const char*, int);
+WOLFSSL_API int wc_CreateEncryptedPKCS8Key(byte*, word32, byte*, word32*,
+        const char*, int, int, int, int, byte*, word32, int, WC_RNG*, void*);
 
 #ifndef NO_ASN_TIME
 /* Time */

source/libs/libwolfssl/wolfcrypt/blake2-impl.h

@@ -12,7 +12,7 @@
 */
 /* blake2-impl.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -85,7 +85,7 @@ static WC_INLINE void store32( void *dst, word32 w )
 
 static WC_INLINE void store64( void *dst, word64 w )
 {
-#if defined(LITTLE_ENDIAN_ORDER)
+#if defined(LITTLE_ENDIAN_ORDER) && !defined(WOLFSSL_GENERAL_ALIGNMENT)
   *( word64 * )( dst ) = w;
 #else
   byte *p = ( byte * )dst;

source/libs/libwolfssl/wolfcrypt/blake2-int.h

@@ -12,7 +12,7 @@
 */
 /* blake2-int.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -77,7 +77,7 @@
     byte  personal[BLAKE2S_PERSONALBYTES];  /* 32 */
   } blake2s_param;
 
-  ALIGN32 typedef struct __blake2s_state
+  typedef struct ALIGN32 __blake2s_state
   {
     word32 h[8];
     word32 t[2];
@@ -102,7 +102,7 @@
     byte  personal[BLAKE2B_PERSONALBYTES];  /* 64 */
   } blake2b_param;
 
-  ALIGN64 typedef struct __blake2b_state
+  typedef struct ALIGN64 __blake2b_state
   {
     word64 h[8];
     word64 t[2];

source/libs/libwolfssl/wolfcrypt/blake2.h

@@ -1,6 +1,6 @@
 /* blake2.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/camellia.h

@@ -27,7 +27,7 @@
 
 /* camellia.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/chacha.h

@@ -1,6 +1,6 @@
 /* chacha.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/chacha20_poly1305.h

@@ -1,6 +1,6 @@
 /* chacha20_poly1305.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/cmac.h

@@ -1,6 +1,6 @@
 /* cmac.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -53,6 +53,16 @@ struct Cmac {
     byte k2[AES_BLOCK_SIZE];
     word32 bufferSz;
     word32 totalSz;
+#ifdef WOLF_CRYPTO_CB
+    int devId;
+    void* devCtx;
+    #ifdef WOLFSSL_QNX_CAAM
+    byte ctx[32]; /* hold state for save and return */
+    word32 blackKey;
+    word32 keylen;
+    byte   initialized;
+    #endif
+#endif
 };
 
 
@@ -70,6 +80,12 @@ WOLFSSL_API
 int wc_InitCmac(Cmac* cmac,
                 const byte* key, word32 keySz,
                 int type, void* unused);
+
+WOLFSSL_API
+int wc_InitCmac_ex(Cmac* cmac,
+                const byte* key, word32 keySz,
+                int type, void* unused, void* heap, int devId);
+
 WOLFSSL_API
 int wc_CmacUpdate(Cmac* cmac,
                   const byte* in, word32 inSz);

source/libs/libwolfssl/wolfcrypt/coding.h

@@ -1,6 +1,6 @@
 /* coding.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -79,6 +79,8 @@ WOLFSSL_API int Base64_Decode(const byte* in, word32 inLen, byte* out,
     int Base16_Encode(const byte* in, word32 inLen, byte* out, word32* outLen);
 #endif
 
+ WOLFSSL_LOCAL int Base64_SkipNewline(const byte* in, word32* inLen,
+            word32* outJ);
 
 #ifdef __cplusplus
     } /* extern "C" */

source/libs/libwolfssl/wolfcrypt/compress.h

@@ -1,6 +1,6 @@
 /* compress.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/cpuid.h

@@ -1,6 +1,6 @@
 /* cpuid.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -32,8 +32,9 @@
     extern "C" {
 #endif
 
-#if defined(WOLFSSL_X86_64_BUILD) || defined(USE_INTEL_SPEEDUP) || \
+#if (defined(WOLFSSL_X86_64_BUILD) || defined(USE_INTEL_SPEEDUP) || \
-    defined(WOLFSSL_AESNI)
+    defined(WOLFSSL_AESNI) || defined(WOLFSSL_SP_X86_64_ASM)) && \
+    !defined(WOLFSSL_NO_ASM)
 
     #define CPUID_AVX1   0x0001
     #define CPUID_AVX2   0x0002

source/libs/libwolfssl/wolfcrypt/cryptocb.h

@@ -1,6 +1,6 @@
 /* cryptocb.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -15,7 +15,8 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  */
 
 #ifndef _WOLF_CRYPTO_CB_H_
@@ -58,7 +59,18 @@
 #ifndef NO_DES3
     #include <libs/libwolfssl/wolfcrypt/des3.h>
 #endif
-
+#ifdef WOLFSSL_CMAC
+    #include <libs/libwolfssl/wolfcrypt/cmac.h>
+#endif
+#ifdef HAVE_ED25519
+    #include <libs/libwolfssl/wolfcrypt/ed25519.h>
+#endif
+#ifdef HAVE_CURVE25519
+    #include <libs/libwolfssl/wolfcrypt/curve25519.h>
+#endif
+#if defined(WOLFSSL_SHA512) || defined(WOLFSSL_SHA384)
+    #include <libs/libwolfssl/wolfcrypt/sha512.h>
+#endif
 
 /* Crypto Information Structure for callbacks */
 typedef struct wc_CryptoInfo {
@@ -126,6 +138,50 @@ typedef struct wc_CryptoInfo {
                 word32      pubKeySz;
             } ecc_check;
         #endif
+        #ifdef HAVE_CURVE25519
+            struct {
+                WC_RNG*  rng;
+                int      size;
+                curve25519_key* key;
+                int      curveId;
+            } curve25519kg;
+            struct {
+                curve25519_key* private_key;
+                curve25519_key* public_key;
+                byte*    out;
+                word32*  outlen;
+                int      endian;
+            } curve25519;
+        #endif
+        #ifdef HAVE_ED25519
+            struct {
+                WC_RNG*  rng;
+                int      size;
+                ed25519_key* key;
+                int      curveId;
+            } ed25519kg;
+            struct {
+                const byte*  in;
+                word32       inLen;
+                byte*        out;
+                word32*      outLen;
+                ed25519_key* key;
+                byte         type;
+                const byte*  context;
+                byte         contextLen;
+            } ed25519sign;
+            struct {
+                const byte*  sig;
+                word32       sigLen;
+                const byte*  msg;
+                word32       msgLen;
+                int*         res;
+                ed25519_key* key;
+                byte         type;
+                const byte*  context;
+                byte         contextLen;
+            } ed25519verify;
+        #endif
         };
     } pk;
 #endif /* !NO_RSA || HAVE_ECC */
@@ -179,7 +235,8 @@ typedef struct wc_CryptoInfo {
         };
     } cipher;
 #endif /* !NO_AES || !NO_DES3 */
-#if !defined(NO_SHA) || !defined(NO_SHA256)
+#if !defined(NO_SHA) || !defined(NO_SHA256) || \
+    defined(WOLFSSL_SHA512) || defined(WOLFSSL_SHA384)
     struct {
         int type; /* enum wc_HashType */
         const byte* in;
@@ -192,6 +249,12 @@ typedef struct wc_CryptoInfo {
         #ifndef NO_SHA256
             wc_Sha256* sha256;
         #endif
+        #ifdef WOLFSSL_SHA384
+            wc_Sha384* sha384;
+        #endif
+        #ifdef WOLFSSL_SHA512
+            wc_Sha512* sha512;
+        #endif
         };
     } hash;
 #endif /* !NO_SHA || !NO_SHA256 */
@@ -216,6 +279,19 @@ typedef struct wc_CryptoInfo {
         word32 sz;
     } seed;
 #endif
+#ifdef WOLFSSL_CMAC
+    struct {
+        Cmac* cmac;
+        void* ctx;
+        const byte* key;
+        const byte* in;
+        byte*       out;
+        word32* outSz;
+        word32  keySz;
+        word32  inSz;
+        int type;
+    } cmac;
+#endif
 } wc_CryptoInfo;
 
 
@@ -261,6 +337,25 @@ WOLFSSL_LOCAL int wc_CryptoCb_EccCheckPrivKey(ecc_key* key, const byte* pubKey,
     word32 pubKeySz);
 #endif /* HAVE_ECC */
 
+#ifdef HAVE_CURVE25519
+WOLFSSL_LOCAL int wc_CryptoCb_Curve25519Gen(WC_RNG* rng, int keySize,
+    curve25519_key* key);
+
+WOLFSSL_LOCAL int wc_CryptoCb_Curve25519(curve25519_key* private_key,
+    curve25519_key* public_key, byte* out, word32* outlen, int endian);
+#endif /* HAVE_CURVE25519 */
+
+#ifdef HAVE_ED25519
+WOLFSSL_LOCAL int wc_CryptoCb_Ed25519Gen(WC_RNG* rng, int keySize,
+    ed25519_key* key);
+WOLFSSL_LOCAL int wc_CryptoCb_Ed25519Sign(const byte* in, word32 inLen,
+    byte* out, word32 *outLen, ed25519_key* key, byte type, const byte* context,
+    byte contextLen);
+WOLFSSL_LOCAL int wc_CryptoCb_Ed25519Verify(const byte* sig, word32 sigLen,
+    const byte* msg, word32 msgLen, int* res, ed25519_key* key, byte type,
+    const byte* context, byte contextLen);
+#endif /* HAVE_ED25519 */
+
 #ifndef NO_AES
 #ifdef HAVE_AESGCM
 WOLFSSL_LOCAL int wc_CryptoCb_AesGcmEncrypt(Aes* aes, byte* out,
@@ -296,6 +391,15 @@ WOLFSSL_LOCAL int wc_CryptoCb_ShaHash(wc_Sha* sha, const byte* in,
 WOLFSSL_LOCAL int wc_CryptoCb_Sha256Hash(wc_Sha256* sha256, const byte* in,
     word32 inSz, byte* digest);
 #endif /* !NO_SHA256 */
+#ifdef WOLFSSL_SHA384
+WOLFSSL_LOCAL int wc_CryptoCb_Sha384Hash(wc_Sha384* sha384, const byte* in,
+    word32 inSz, byte* digest);
+#endif
+#ifdef WOLFSSL_SHA512
+WOLFSSL_LOCAL int wc_CryptoCb_Sha512Hash(wc_Sha512* sha512, const byte* in,
+    word32 inSz, byte* digest);
+#endif
+
 #ifndef NO_HMAC
 WOLFSSL_LOCAL int wc_CryptoCb_Hmac(Hmac* hmac, int macType, const byte* in,
     word32 inSz, byte* digest);
@@ -306,6 +410,12 @@ WOLFSSL_LOCAL int wc_CryptoCb_RandomBlock(WC_RNG* rng, byte* out, word32 sz);
 WOLFSSL_LOCAL int wc_CryptoCb_RandomSeed(OS_Seed* os, byte* seed, word32 sz);
 #endif
 
+#ifdef WOLFSSL_CMAC
+WOLFSSL_LOCAL int wc_CryptoCb_Cmac(Cmac* cmac, const byte* key, word32 keySz,
+        const byte* in, word32 inSz, byte* out, word32* outSz, int type,
+        void* ctx);
+#endif
+
 #endif /* WOLF_CRYPTO_CB */
 
 #ifdef __cplusplus

source/libs/libwolfssl/wolfcrypt/curve25519.h

@@ -1,6 +1,6 @@
 /* curve25519.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -79,6 +79,9 @@ typedef struct curve25519_key {
 #ifdef WOLFSSL_ASYNC_CRYPT
     WC_ASYNC_DEV asyncDev;
 #endif
+#if defined(WOLF_CRYPTO_CB)
+    int devId;
+#endif
 } curve25519_key;
 
 enum {
@@ -113,6 +116,8 @@ int wc_curve25519_shared_secret_ex(curve25519_key* private_key,
 
 WOLFSSL_API
 int wc_curve25519_init(curve25519_key* key);
+WOLFSSL_API
+int wc_curve25519_init_ex(curve25519_key* key, void* heap, int devId);
 
 WOLFSSL_API
 void wc_curve25519_free(curve25519_key* key);

source/libs/libwolfssl/wolfcrypt/curve448.h

@@ -1,6 +1,6 @@
 /* curve448.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/des3.h

@@ -1,6 +1,6 @@
 /* des3.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/dh.h

@@ -1,6 +1,6 @@
 /* dh.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -46,13 +46,6 @@
     #include <libs/libwolfssl/wolfcrypt/async.h>
 #endif
 
-/* Optional support extended DH public / private keys */
-#if !defined(WOLFSSL_DH_EXTRA) && (defined(WOLFSSL_QT) || \
-        defined(OPENSSL_ALL) || defined(WOLFSSL_OPENSSH) || \
-        defined(WOLFSSL_STATIC_EPHEMERAL))
-    #define WOLFSSL_DH_EXTRA
-#endif
-
 typedef struct DhParams {
 #ifdef HAVE_FFDHE_Q
     const byte* q;
@@ -117,6 +110,8 @@ WOLFSSL_API int wc_DhSetKey_ex(DhKey* key, const byte* p, word32 pSz,
                         const byte* g, word32 gSz, const byte* q, word32 qSz);
 
 #ifdef WOLFSSL_DH_EXTRA
+WOLFSSL_API int wc_DhPublicKeyDecode(const byte* input, word32* inOutIdx,
+                        DhKey* key, word32 inSz);
 WOLFSSL_API int wc_DhImportKeyPair(DhKey* key, const byte* priv, word32 privSz,
                                    const byte* pub, word32 pubSz);
 WOLFSSL_API int wc_DhExportKeyPair(DhKey* key, byte* priv, word32* pPrivSz, 

source/libs/libwolfssl/wolfcrypt/dsa.h

@@ -1,6 +1,6 @@
 /* dsa.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -53,8 +53,20 @@ enum {
 };
 
 enum {
-    DSA_HALF_SIZE = 20,   /* r and s size  */
+    /* 160 bit q length */
-    DSA_SIG_SIZE  = 40    /* signature size */
+    DSA_160_HALF_SIZE = 20,            /* r and s size  */
+    DSA_160_SIG_SIZE  = 40,            /* signature size */
+    DSA_HALF_SIZE = DSA_160_HALF_SIZE, /* kept for compatiblity  */
+    DSA_SIG_SIZE = DSA_160_SIG_SIZE,   /* kept for compatiblity */
+    /* 256 bit q length */
+    DSA_256_HALF_SIZE = 32,            /* r and s size  */
+    DSA_256_SIG_SIZE  = 64,            /* signature size */
+
+    DSA_MIN_HALF_SIZE = DSA_160_HALF_SIZE,
+    DSA_MIN_SIG_SIZE = DSA_160_SIG_SIZE,
+
+    DSA_MAX_HALF_SIZE = DSA_256_HALF_SIZE,
+    DSA_MAX_SIG_SIZE = DSA_256_SIG_SIZE,
 };
 
 /* DSA */

source/libs/libwolfssl/wolfcrypt/ecc.h

@@ -1,6 +1,6 @@
 /* ecc.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -85,30 +85,41 @@
 
 
 /* Determine max ECC bits based on enabled curves */
-#if defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)
+#if defined(WOLFCRYPT_HAVE_SAKKE)
-    #define MAX_ECC_BITS    521
+    #define MAX_ECC_BITS_NEEDED    1024
+#elif defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)
+    #define MAX_ECC_BITS_NEEDED    521
 #elif defined(HAVE_ECC512)
-    #define MAX_ECC_BITS    512
+    #define MAX_ECC_BITS_NEEDED    512
 #elif defined(HAVE_ECC384)
-    #define MAX_ECC_BITS    384
+    #define MAX_ECC_BITS_NEEDED    384
 #elif defined(HAVE_ECC320)
-    #define MAX_ECC_BITS    320
+    #define MAX_ECC_BITS_NEEDED    320
 #elif !defined(NO_ECC256)
-    #define MAX_ECC_BITS    256
+    #define MAX_ECC_BITS_NEEDED    256
 #elif defined(HAVE_ECC239)
-    #define MAX_ECC_BITS    239
+    #define MAX_ECC_BITS_NEEDED    239
 #elif defined(HAVE_ECC224)
-    #define MAX_ECC_BITS    224
+    #define MAX_ECC_BITS_NEEDED    224
 #elif defined(HAVE_ECC192)
-    #define MAX_ECC_BITS    192
+    #define MAX_ECC_BITS_NEEDED    192
 #elif defined(HAVE_ECC160)
-    #define MAX_ECC_BITS    160
+    #define MAX_ECC_BITS_NEEDED    160
 #elif defined(HAVE_ECC128)
-    #define MAX_ECC_BITS    128
+    #define MAX_ECC_BITS_NEEDED    128
 #elif defined(HAVE_ECC112)
-    #define MAX_ECC_BITS    112
+    #define MAX_ECC_BITS_NEEDED    112
 #endif
 
+#ifndef MAX_ECC_BITS
+    #define MAX_ECC_BITS MAX_ECC_BITS_NEEDED
+#else
+    #if MAX_ECC_BITS_NEEDED > MAX_ECC_BITS
+        #error configured MAX_ECC_BITS is less than required by enabled curves.
+    #endif
+#endif
+
+
 /* calculate max ECC bytes */
 #if ((MAX_ECC_BITS * 2) % 8) == 0
     #define MAX_ECC_BYTES     (MAX_ECC_BITS / 8)
@@ -128,10 +139,15 @@ enum {
     ECC_PRIVATEKEY_ONLY = 3,
     ECC_MAXNAME     = 16,   /* MAX CURVE NAME LENGTH */
     SIG_HEADER_SZ   =  7,   /* ECC signature header size (30 81 87 02 42 [R] 02 42 [S]) */
-    ECC_BUFSIZE     = 256,  /* for exported keys temp buffer */
+    ECC_BUFSIZE     = 257,  /* for exported keys temp buffer */
     ECC_MINSIZE     = ECC_MIN_KEY_SZ/8,   /* MIN Private Key size */
+#ifdef WOLFCRYPT_HAVE_SAKKE
+    ECC_MAXSIZE     = 128,  /* MAX Private Key size */
+    ECC_MAXSIZE_GEN = 128,  /* MAX Buffer size required when generating ECC keys*/
+#else
     ECC_MAXSIZE     = 66,   /* MAX Private Key size */
     ECC_MAXSIZE_GEN = 74,   /* MAX Buffer size required when generating ECC keys*/
+#endif
     ECC_MAX_OID_LEN = 16,
     ECC_MAX_SIG_SIZE= ((MAX_ECC_BYTES * 2) + ECC_MAX_PAD_SZ + SIG_HEADER_SZ),
 
@@ -212,9 +228,14 @@ typedef enum ecc_curve_id {
     ECC_X448,
 #endif
 
+#ifdef WOLFCRYPT_HAVE_SAKKE
+    ECC_SAKKE_1,
+#endif
+
 #ifdef WOLFSSL_CUSTOM_CURVES
     ECC_CURVE_CUSTOM,
 #endif
+    ECC_CURVE_MAX
 } ecc_curve_id;
 
 #ifdef HAVE_OID_ENCODING
@@ -304,6 +325,9 @@ typedef struct ecc_set_type {
 #ifndef USE_FAST_MATH
     #error USE_FAST_MATH must be defined to use ALT_ECC_SIZE
 #endif
+#ifdef WOLFSSL_NO_MALLOC
+    #error ALT_ECC_SIZE cannot be used with no malloc (WOLFSSL_NO_MALLOC)
+#endif
 
 /* determine max bits required for ECC math */
 #ifndef FP_MAX_BITS_ECC
@@ -396,6 +420,12 @@ struct ecc_key {
     void* heap;         /* heap hint */
     ecc_point pubkey;   /* public key */
     mp_int    k;        /* private key */
+
+#ifdef WOLFSSL_QNX_CAAM
+    word32 blackKey;     /* address of key encrypted and in secure memory */
+    word32 securePubKey; /* address of public key in secure memory */
+    int    partNum; /* partition number*/
+#endif
 #if defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A)
     int  slot;        /* Key Slot Number (-1 unknown) */
     byte pubkey_raw[ECC_MAX_CRYPTO_HW_PUBKEY_SIZE];
@@ -435,9 +465,13 @@ struct ecc_key {
     ecc_context_t ctx;
 #endif
 
-#ifdef WOLFSSL_ECDSA_SET_K
+#if defined(WOLFSSL_ECDSA_SET_K) || defined(WOLFSSL_ECDSA_SET_K_ONE_LOOP) || \
+    defined(WOLFSSL_ECDSA_DETERMINISTIC_K)
     mp_int *sign_k;
 #endif
+#if defined(WOLFSSL_ECDSA_DETERMINISTIC_K)
+    byte deterministic:1;
+#endif
 
 #ifdef WOLFSSL_SMALL_STACK_CACHE
     mp_int* t1;
@@ -472,8 +506,6 @@ extern const size_t ecc_sets_count;
 WOLFSSL_API
 const char* wc_ecc_get_name(int curve_id);
 
-#if !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A)
-
 #ifdef WOLFSSL_PUBLIC_ECC_ADD_DBL
     #define ECC_API    WOLFSSL_API
 #else
@@ -498,8 +530,6 @@ WOLFSSL_LOCAL
 int ecc_projective_dbl_point_safe(ecc_point* P, ecc_point* R, mp_int* a,
                                   mp_int* modulus, mp_digit mp);
 
-#endif
-
 WOLFSSL_API
 int wc_ecc_make_key(WC_RNG* rng, int keysize, ecc_key* key);
 WOLFSSL_ABI WOLFSSL_API
@@ -545,7 +575,15 @@ int wc_ecc_sign_hash(const byte* in, word32 inlen, byte* out, word32 *outlen,
 WOLFSSL_API
 int wc_ecc_sign_hash_ex(const byte* in, word32 inlen, WC_RNG* rng,
                         ecc_key* key, mp_int *r, mp_int *s);
-#ifdef WOLFSSL_ECDSA_SET_K
+#ifdef WOLFSSL_ECDSA_DETERMINISTIC_K
+WOLFSSL_API
+int wc_ecc_set_deterministic(ecc_key* key, byte flag);
+WOLFSSL_API
+int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
+        enum wc_HashType hashType, mp_int* priv, mp_int* k, mp_int* order,
+        void* heap);
+#endif
+#if defined(WOLFSSL_ECDSA_SET_K) || defined(WOLFSSL_ECDSA_SET_K_ONE_LOOP)
 WOLFSSL_API
 int wc_ecc_sign_set_k(const byte* k, word32 klen, ecc_key* key);
 #endif
@@ -629,7 +667,9 @@ void wc_ecc_del_point(ecc_point* p);
 WOLFSSL_API
 void wc_ecc_del_point_h(ecc_point* p, void* h);
 WOLFSSL_API
-int wc_ecc_copy_point(ecc_point* p, ecc_point *r);
+void wc_ecc_forcezero_point(ecc_point* p);
+WOLFSSL_API
+int wc_ecc_copy_point(const ecc_point* p, ecc_point *r);
 WOLFSSL_API
 int wc_ecc_cmp_point(ecc_point* a, ecc_point *b);
 WOLFSSL_API
@@ -639,13 +679,13 @@ int wc_ecc_point_is_on_curve(ecc_point *p, int curve_idx);
 
 #if !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A)
 WOLFSSL_API
-int wc_ecc_mulmod(mp_int* k, ecc_point *G, ecc_point *R,
+int wc_ecc_mulmod(const mp_int* k, ecc_point *G, ecc_point *R,
                   mp_int* a, mp_int* modulus, int map);
 WOLFSSL_LOCAL
-int wc_ecc_mulmod_ex(mp_int* k, ecc_point *G, ecc_point *R,
+int wc_ecc_mulmod_ex(const mp_int* k, ecc_point *G, ecc_point *R,
                   mp_int* a, mp_int* modulus, int map, void* heap);
 WOLFSSL_LOCAL
-int wc_ecc_mulmod_ex2(mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
+int wc_ecc_mulmod_ex2(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
                       mp_int* modulus, mp_int* order, WC_RNG* rng, int map,
                       void* heap);
 #endif /* !WOLFSSL_ATECC508A */
@@ -687,8 +727,8 @@ WOLFSSL_API
 int wc_ecc_import_raw_ex(ecc_key* key, const char* qx, const char* qy,
                    const char* d, int curve_id);
 WOLFSSL_API
-int wc_ecc_import_unsigned(ecc_key* key, byte* qx, byte* qy,
+int wc_ecc_import_unsigned(ecc_key* key, const byte* qx, const byte* qy,
-                   byte* d, int curve_id);
+                   const byte* d, int curve_id);
 #endif /* HAVE_ECC_KEY_IMPORT */
 
 #ifdef HAVE_ECC_KEY_EXPORT
@@ -721,10 +761,11 @@ int wc_ecc_export_point_der_compressed(const int curve_idx, ecc_point* point,
 
 #ifdef HAVE_ECC_KEY_IMPORT
 WOLFSSL_API
-int wc_ecc_import_point_der_ex(byte* in, word32 inLen, const int curve_idx,
+int wc_ecc_import_point_der_ex(const byte* in, word32 inLen,
-                               ecc_point* point, int shortKeySize);
+                               const int curve_idx, ecc_point* point,
+                               int shortKeySize);
 WOLFSSL_API
-int wc_ecc_import_point_der(byte* in, word32 inLen, const int curve_idx,
+int wc_ecc_import_point_der(const byte* in, word32 inLen, const int curve_idx,
                             ecc_point* point);
 #endif /* HAVE_ECC_KEY_IMPORT */
 
@@ -734,7 +775,7 @@ int wc_ecc_size(ecc_key* key);
 WOLFSSL_API
 int wc_ecc_sig_size_calc(int sz);
 WOLFSSL_API
-int wc_ecc_sig_size(ecc_key* key);
+int wc_ecc_sig_size(const ecc_key* key);
 
 WOLFSSL_API
 int wc_ecc_get_oid(word32 oidSum, const byte** oid, word32* oidSz);
@@ -767,6 +808,7 @@ enum {
     KEY_SIZE_256     = 32,
     IV_SIZE_64       =  8,
     IV_SIZE_128      = 16,
+    ECC_MAX_IV_SIZE  = 16,
     EXCHANGE_SALT_SZ = 16,
     EXCHANGE_INFO_SZ = 23
 };

source/libs/libwolfssl/wolfcrypt/ed25519.h

@@ -1,6 +1,6 @@
 /* ed25519.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -34,6 +34,9 @@
 #include <libs/libwolfssl/wolfcrypt/fe_operations.h>
 #include <libs/libwolfssl/wolfcrypt/ge_operations.h>
 #include <libs/libwolfssl/wolfcrypt/random.h>
+#ifndef WOLFSSL_SHA512
+#error ED25519 requires SHA512
+#endif
 #include <libs/libwolfssl/wolfcrypt/sha512.h>
 
 #ifdef WOLFSSL_ASYNC_CRYPT
@@ -87,6 +90,14 @@ struct ed25519_key {
 #ifdef WOLFSSL_ASYNC_CRYPT
     WC_ASYNC_DEV asyncDev;
 #endif
+#if defined(WOLF_CRYPTO_CB)
+    int devId;
+#endif
+    void *heap;
+#ifdef WOLFSSL_ED25519_PERSISTENT_SHA
+    wc_Sha512 sha;
+    int sha_clean_flag;
+#endif
 };
 
 
@@ -95,6 +106,7 @@ int wc_ed25519_make_public(ed25519_key* key, unsigned char* pubKey,
                            word32 pubKeySz);
 WOLFSSL_API
 int wc_ed25519_make_key(WC_RNG* rng, int keysize, ed25519_key* key);
+#ifdef HAVE_ED25519_SIGN
 WOLFSSL_API
 int wc_ed25519_sign_msg(const byte* in, word32 inLen, byte* out,
                         word32 *outLen, ed25519_key* key);
@@ -111,6 +123,12 @@ int wc_ed25519ph_sign_msg(const byte* in, word32 inLen, byte* out,
                           word32 *outLen, ed25519_key* key, const byte* context,
                           byte contextLen);
 WOLFSSL_API
+int wc_ed25519_sign_msg_ex(const byte* in, word32 inLen, byte* out,
+                            word32 *outLen, ed25519_key* key, byte type,
+                            const byte* context, byte contextLen);
+#endif /* HAVE_ED25519_SIGN */
+#ifdef HAVE_ED25519_VERIFY
+WOLFSSL_API
 int wc_ed25519_verify_msg(const byte* sig, word32 sigLen, const byte* msg,
                           word32 msgLen, int* stat, ed25519_key* key);
 WOLFSSL_API
@@ -125,10 +143,31 @@ WOLFSSL_API
 int wc_ed25519ph_verify_msg(const byte* sig, word32 sigLen, const byte* msg,
                             word32 msgLen, int* stat, ed25519_key* key,
                             const byte* context, byte contextLen);
+WOLFSSL_API
+int wc_ed25519_verify_msg_ex(const byte* sig, word32 sigLen, const byte* msg,
+                              word32 msgLen, int* res, ed25519_key* key,
+                              byte type, const byte* context, byte contextLen);
+#ifdef WOLFSSL_ED25519_STREAMING_VERIFY
+WOLFSSL_API
+int wc_ed25519_verify_msg_init(const byte* sig, word32 sigLen, ed25519_key* key,
+                               byte type, const byte* context, byte contextLen);
+WOLFSSL_API
+int wc_ed25519_verify_msg_update(const byte* msgSegment, word32 msgSegmentLen,
+                               ed25519_key* key);
+WOLFSSL_API
+int wc_ed25519_verify_msg_final(const byte* sig, word32 sigLen, int* res,
+                                ed25519_key* key);
+#endif /* WOLFSSL_ED25519_STREAMING_VERIFY */
+#endif /* HAVE_ED25519_VERIFY */
+
+
 WOLFSSL_API
 int wc_ed25519_init(ed25519_key* key);
 WOLFSSL_API
+int wc_ed25519_init_ex(ed25519_key* key, void* heap, int devId);
+WOLFSSL_API
 void wc_ed25519_free(ed25519_key* key);
+#ifdef HAVE_ED25519_KEY_IMPORT
 WOLFSSL_API
 int wc_ed25519_import_public(const byte* in, word32 inLen, ed25519_key* key);
 WOLFSSL_API
@@ -137,6 +176,9 @@ int wc_ed25519_import_private_only(const byte* priv, word32 privSz,
 WOLFSSL_API
 int wc_ed25519_import_private_key(const byte* priv, word32 privSz,
                                const byte* pub, word32 pubSz, ed25519_key* key);
+#endif /* HAVE_ED25519_KEY_IMPORT */
+
+#ifdef HAVE_ED25519_KEY_EXPORT
 WOLFSSL_API
 int wc_ed25519_export_public(ed25519_key*, byte* out, word32* outLen);
 WOLFSSL_API
@@ -147,6 +189,7 @@ WOLFSSL_API
 int wc_ed25519_export_key(ed25519_key* key,
                           byte* priv, word32 *privSz,
                           byte* pub, word32 *pubSz);
+#endif /* HAVE_ED25519_KEY_EXPORT */
 
 WOLFSSL_API
 int wc_ed25519_check_key(ed25519_key* key);

source/libs/libwolfssl/wolfcrypt/ed448.h

@@ -1,6 +1,6 @@
 /* ed448.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -34,6 +34,9 @@
 #include <libs/libwolfssl/wolfcrypt/fe_448.h>
 #include <libs/libwolfssl/wolfcrypt/ge_448.h>
 #include <libs/libwolfssl/wolfcrypt/random.h>
+#ifndef WOLFSSL_SHAKE256
+#error ED448 requires SHAKE256
+#endif
 #include <libs/libwolfssl/wolfcrypt/sha3.h>
 
 #ifdef WOLFSSL_ASYNC_CRYPT
@@ -62,6 +65,7 @@
 /* both private and public key */
 #define ED448_PRV_KEY_SIZE (ED448_PUB_KEY_SIZE+ED448_KEY_SIZE)
 
+#define ED448_PREHASH_SIZE 64
 
 enum {
     Ed448    = 0,
@@ -86,6 +90,14 @@ struct ed448_key {
 #ifdef WOLFSSL_ASYNC_CRYPT
     WC_ASYNC_DEV asyncDev;
 #endif
+#if defined(WOLF_CRYPTO_CB)
+    int devId;
+#endif
+    void *heap;
+#ifdef WOLFSSL_ED448_PERSISTENT_SHA
+    wc_Shake sha;
+    int sha_clean_flag;
+#endif
 };
 
 
@@ -94,6 +106,7 @@ int wc_ed448_make_public(ed448_key* key, unsigned char* pubKey,
                          word32 pubKeySz);
 WOLFSSL_API
 int wc_ed448_make_key(WC_RNG* rng, int keysize, ed448_key* key);
+#ifdef HAVE_ED448_SIGN
 WOLFSSL_API
 int wc_ed448_sign_msg(const byte* in, word32 inLen, byte* out, word32 *outLen,
                       ed448_key* key, const byte* context, byte contextLen);
@@ -102,9 +115,30 @@ int wc_ed448ph_sign_hash(const byte* hash, word32 hashLen, byte* out,
                          word32 *outLen, ed448_key* key,
                          const byte* context, byte contextLen);
 WOLFSSL_API
+int wc_ed448_sign_msg_ex(const byte* in, word32 inLen, byte* out,
+                         word32 *outLen, ed448_key* key, byte type,
+                         const byte* context, byte contextLen);
+WOLFSSL_API
 int wc_ed448ph_sign_msg(const byte* in, word32 inLen, byte* out,
                         word32 *outLen, ed448_key* key, const byte* context,
                         byte contextLen);
+#endif /* HAVE_ED448_SIGN */
+#ifdef HAVE_ED448_VERIFY
+WOLFSSL_API
+int wc_ed448_verify_msg_ex(const byte* sig, word32 sigLen, const byte* msg,
+                            word32 msgLen, int* res, ed448_key* key,
+                            byte type, const byte* context, byte contextLen);
+#ifdef WOLFSSL_ED448_STREAMING_VERIFY
+WOLFSSL_API
+int wc_ed448_verify_msg_init(const byte* sig, word32 sigLen, ed448_key* key,
+                        byte type, const byte* context, byte contextLen);
+WOLFSSL_API
+int wc_ed448_verify_msg_update(const byte* msgSegment, word32 msgSegmentLen,
+                             ed448_key* key);
+WOLFSSL_API
+int wc_ed448_verify_msg_final(const byte* sig, word32 sigLen,
+                              int* stat, ed448_key* key);
+#endif /* WOLFSSL_ED448_STREAMING_VERIFY */
 WOLFSSL_API
 int wc_ed448_verify_msg(const byte* sig, word32 sigLen, const byte* msg,
                         word32 msgLen, int* stat, ed448_key* key,
@@ -117,10 +151,15 @@ WOLFSSL_API
 int wc_ed448ph_verify_msg(const byte* sig, word32 sigLen, const byte* msg,
                           word32 msgLen, int* stat, ed448_key* key,
                           const byte* context, byte contextLen);
+#endif /* HAVE_ED448_VERIFY */
+WOLFSSL_API
+int wc_ed448_init_ex(ed448_key* key, void *heap, int devId);
 WOLFSSL_API
 int wc_ed448_init(ed448_key* key);
 WOLFSSL_API
 void wc_ed448_free(ed448_key* key);
+
+#ifdef HAVE_ED448_KEY_IMPORT
 WOLFSSL_API
 int wc_ed448_import_public(const byte* in, word32 inLen, ed448_key* key);
 WOLFSSL_API
@@ -129,6 +168,9 @@ int wc_ed448_import_private_only(const byte* priv, word32 privSz,
 WOLFSSL_API
 int wc_ed448_import_private_key(const byte* priv, word32 privSz,
                                 const byte* pub, word32 pubSz, ed448_key* key);
+#endif /* HAVE_ED448_KEY_IMPORT */
+
+#ifdef HAVE_ED448_KEY_EXPORT
 WOLFSSL_API
 int wc_ed448_export_public(ed448_key*, byte* out, word32* outLen);
 WOLFSSL_API
@@ -138,6 +180,7 @@ int wc_ed448_export_private(ed448_key* key, byte* out, word32* outLen);
 WOLFSSL_API
 int wc_ed448_export_key(ed448_key* key, byte* priv, word32 *privSz,
                         byte* pub, word32 *pubSz);
+#endif /* HAVE_ED448_KEY_EXPORT */
 
 WOLFSSL_API
 int wc_ed448_check_key(ed448_key* key);

source/libs/libwolfssl/wolfcrypt/error-crypt.h

@@ -1,6 +1,6 @@
 /* error-crypt.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -234,8 +234,12 @@ enum {
     PSS_SALTLEN_RECOVER_E=-273,  /* PSS slat length not recoverable */
     CHACHA_POLY_OVERFLOW =-274,  /* ChaCha20Poly1305 limit overflow */
     ASN_SELF_SIGNED_E   = -275,  /* ASN self-signed certificate error */
+    SAKKE_VERIFY_FAIL_E = -276,  /* SAKKE derivation verification error */
+    MISSING_IV          = -277,  /* IV was not set */
+    MISSING_KEY         = -278,  /* Key was not set */
+    BAD_LENGTH_E        = -279,  /* Value of length parameter is invalid. */
 
-    WC_LAST_E           = -275,  /* Update this to indicate last error */
+    WC_LAST_E           = -279,  /* Update this to indicate last error */
     MIN_CODE_E          = -300   /* errors -101 - -299 */
 
     /* add new companion error id strings for any new error codes

source/libs/libwolfssl/wolfcrypt/fe_448.h

@@ -1,6 +1,6 @@
 /* fe448_448.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -27,10 +27,6 @@
 
 #if defined(HAVE_CURVE448) || defined(HAVE_ED448)
 
-#ifndef WOLFSSL_LINUXKM
-#include <stdint.h>
-#endif
-
 #include <libs/libwolfssl/wolfcrypt/types.h>
 
 #if defined(HAVE___UINT128_T) && !defined(NO_CURVED448_128BIT)
@@ -45,19 +41,23 @@
 #if !defined(CURVE448_SMALL) && !defined(ED448_SMALL)
 
 #if defined(CURVED448_128BIT)
-    typedef int64_t fe448;
+    typedef sword64 fe448;
     #ifndef WOLFSSL_UINT128_T_DEFINED
         #ifdef __SIZEOF_INT128__
             typedef __uint128_t uint128_t;
             typedef __int128_t int128_t;
+            typedef __uint128_t word128;
+            typedef __int128_t sword128;
         #else
             typedef unsigned long uint128_t __attribute__ ((mode(TI)));
             typedef long int128_t __attribute__ ((mode(TI)));
+            typedef uint128_t word128;
+            typedef int128_t sword128;
         #endif
         #define WOLFSSL_UINT128_T_DEFINED
     #endif
 #else
-    typedef int32_t fe448;
+    typedef sword32 fe448;
 #endif
 
 WOLFSSL_LOCAL void fe448_init(void);
@@ -94,21 +94,21 @@ WOLFSSL_LOCAL void fe448_init(void);
 WOLFSSL_LOCAL int  curve448(byte* r, const byte* n, const byte* a);
 
 #define fe448_reduce(a)
-WOLFSSL_LOCAL void fe448_neg(uint8_t*,const uint8_t*);
+WOLFSSL_LOCAL void fe448_neg(word8*,const word8*);
-WOLFSSL_LOCAL void fe448_add(uint8_t*, const uint8_t*, const uint8_t*);
+WOLFSSL_LOCAL void fe448_add(word8*, const word8*, const word8*);
-WOLFSSL_LOCAL void fe448_sub(uint8_t*, const uint8_t*, const uint8_t*);
+WOLFSSL_LOCAL void fe448_sub(word8*, const word8*, const word8*);
-WOLFSSL_LOCAL void fe448_mul(uint8_t*,const uint8_t*,const uint8_t*);
+WOLFSSL_LOCAL void fe448_mul(word8*,const word8*,const word8*);
-WOLFSSL_LOCAL void fe448_sqr(uint8_t*, const uint8_t*);
+WOLFSSL_LOCAL void fe448_sqr(word8*, const word8*);
-WOLFSSL_LOCAL void fe448_mul39081(uint8_t*, const uint8_t*);
+WOLFSSL_LOCAL void fe448_mul39081(word8*, const word8*);
-WOLFSSL_LOCAL void fe448_invert(uint8_t*, const uint8_t*);
+WOLFSSL_LOCAL void fe448_invert(word8*, const word8*);
 
-WOLFSSL_LOCAL void fe448_copy(uint8_t*, const uint8_t*);
+WOLFSSL_LOCAL void fe448_copy(word8*, const word8*);
-WOLFSSL_LOCAL int  fe448_isnonzero(const uint8_t*);
+WOLFSSL_LOCAL int  fe448_isnonzero(const word8*);
 
 WOLFSSL_LOCAL void fe448_norm(byte *a);
 
-WOLFSSL_LOCAL void fe448_cmov(uint8_t*,const uint8_t*, int);
+WOLFSSL_LOCAL void fe448_cmov(word8*,const word8*, int);
-WOLFSSL_LOCAL void fe448_pow_2_446_222_1(uint8_t*,const uint8_t*);
+WOLFSSL_LOCAL void fe448_pow_2_446_222_1(word8*,const word8*);
 
 #endif /* !CURVE448_SMALL || !ED448_SMALL */
 

source/libs/libwolfssl/wolfcrypt/fe_operations.h

@@ -1,6 +1,6 @@
 /* fe_operations.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -27,12 +27,6 @@
 
 #if defined(HAVE_CURVE25519) || defined(HAVE_ED25519)
 
-#if !defined(CURVE25519_SMALL) || !defined(ED25519_SMALL)
-#ifndef WOLFSSL_LINUXKM
-    #include <stdint.h>
-#endif
-#endif
-
 #include <libs/libwolfssl/wolfcrypt/types.h>
 
 #if defined(USE_INTEL_SPEEDUP) && !defined(NO_CURVED25519_X64)
@@ -88,13 +82,13 @@ WOLFSSL_LOCAL int  curve25519(byte * q, const byte * n, const byte * p);
 #if !defined(CURVE25519_SMALL) || !defined(ED25519_SMALL)
 
 #ifdef CURVED25519_ASM_64BIT
-    typedef int64_t  fe[4];
+    typedef sword64  fe[4];
 #elif defined(CURVED25519_ASM_32BIT)
-    typedef int32_t  fe[8];
+    typedef sword32  fe[8];
 #elif defined(CURVED25519_128BIT)
-    typedef int64_t  fe[5];
+    typedef sword64  fe[5];
 #else
-    typedef int32_t  fe[10];
+    typedef sword32  fe[10];
 #endif
 
 WOLFSSL_LOCAL void fe_copy(fe, const fe);
@@ -122,8 +116,8 @@ WOLFSSL_LOCAL void fe_cmov(fe,const fe, int);
 WOLFSSL_LOCAL void fe_pow22523(fe,const fe);
 
 /* 64 type needed for SHA512 */
-WOLFSSL_LOCAL uint64_t load_3(const unsigned char *in);
+WOLFSSL_LOCAL word64 load_3(const unsigned char *in);
-WOLFSSL_LOCAL uint64_t load_4(const unsigned char *in);
+WOLFSSL_LOCAL word64 load_4(const unsigned char *in);
 
 #ifdef CURVED25519_ASM
 WOLFSSL_LOCAL void fe_ge_to_p2(fe rx, fe ry, fe rz, const fe px, const fe py,

source/libs/libwolfssl/wolfcrypt/fips_test.h

@@ -1,6 +1,6 @@
 /* fips_test.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/ge_448.h

@@ -1,6 +1,6 @@
 /* ge_448.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -45,10 +45,10 @@ Representations:
     typedef byte     ge448;
     #define GE448_WORDS    56
 #elif defined(CURVED448_128BIT)
-    typedef int64_t  ge448;
+    typedef sword64  ge448;
     #define GE448_WORDS    8
 #else
-    typedef int32_t  ge448;
+    typedef sword32  ge448;
     #define GE448_WORDS    16
 #endif
 

source/libs/libwolfssl/wolfcrypt/ge_operations.h

@@ -1,6 +1,6 @@
 /* ge_operations.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -48,13 +48,13 @@ Representations:
 #ifdef ED25519_SMALL
   typedef byte     ge[F25519_SIZE];
 #elif defined(CURVED25519_ASM_64BIT)
-  typedef int64_t  ge[4];
+  typedef sword64  ge[4];
 #elif defined(CURVED25519_ASM_32BIT)
-  typedef int32_t  ge[8];
+  typedef sword32  ge[8];
 #elif defined(CURVED25519_128BIT)
-  typedef int64_t  ge[5];
+  typedef sword64  ge[5];
 #else
-  typedef int32_t  ge[10];
+  typedef sword32  ge[10];
 #endif
 
 typedef struct {

source/libs/libwolfssl/wolfcrypt/hash.h

@@ -1,6 +1,6 @@
 /* hash.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -88,7 +88,7 @@ enum wc_HashFlags {
 #endif
 };
 
-
+#ifndef NO_HASH_WRAPPER
 typedef union {
     #ifndef NO_MD5
         wc_Md5 md5;
@@ -112,6 +112,7 @@ typedef union {
         wc_Sha3 sha3;
     #endif
 } wc_HashAlg;
+#endif /* !NO_HASH_WRAPPER */
 
 /* Find largest possible digest size
    Note if this gets up to the size of 80 or over check smallstack build */
@@ -151,6 +152,8 @@ WOLFSSL_API enum wc_HashType wc_OidGetHash(int oid);
 
 WOLFSSL_API enum wc_HashType wc_HashTypeConvert(int hashType);
 
+#ifndef NO_HASH_WRAPPER
+
 WOLFSSL_API int wc_HashGetDigestSize(enum wc_HashType hash_type);
 WOLFSSL_API int wc_HashGetBlockSize(enum wc_HashType hash_type);
 WOLFSSL_API int wc_Hash(enum wc_HashType hash_type,
@@ -215,6 +218,8 @@ WOLFSSL_API int wc_Shake256Hash(const byte*, word32, byte*, word32);
 #endif
 #endif /* WOLFSSL_SHA3 */
 
+#endif /* !NO_HASH_WRAPPER */
+
 enum max_prf {
 #ifdef HAVE_FFDHE_8192
     MAX_PRF_HALF        = 516, /* Maximum half secret len */

source/libs/libwolfssl/wolfcrypt/hc128.h

@@ -1,6 +1,6 @@
 /* hc128.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/hmac.h

@@ -1,6 +1,6 @@
 /* hmac.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/idea.h

@@ -1,6 +1,6 @@
 /* idea.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/integer.h

@@ -1,6 +1,6 @@
 /* integer.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -72,7 +72,7 @@ extern "C" {
 
 
 /* detect 64-bit mode if possible */
-#if defined(__x86_64__) && !(defined (_MSC_VER) && defined(__clang__))
+#if (defined(__x86_64__) || defined(__aarch64__)) && !(defined (_MSC_VER) && defined(__clang__))
    #if !(defined(MP_64BIT) && defined(MP_16BIT) && defined(MP_8BIT))
       #define MP_64BIT
    #endif
@@ -227,7 +227,8 @@ typedef int ltm_prime_callback(unsigned char *dst, int len, void *dat);
 /* ---> Basic Manipulations <--- */
 #define mp_iszero(a) (((a)->used == 0) ? MP_YES : MP_NO)
 #define mp_isone(a) \
-    (((((a)->used == 1)) && ((a)->dp[0] == 1u)) ? MP_YES : MP_NO)
+    (((((a)->used == 1)) && ((a)->dp[0] == 1u) && ((a)->sign == MP_ZPOS)) \
+                                                               ? MP_YES : MP_NO)
 #define mp_iseven(a) \
     (((a)->used > 0 && (((a)->dp[0] & 1u) == 0u)) ? MP_YES : MP_NO)
 #define mp_isodd(a) \
@@ -255,9 +256,6 @@ typedef int ltm_prime_callback(unsigned char *dst, int len, void *dat);
 #define mp_prime_random(a, t, size, bbs, cb, dat) \
    mp_prime_random_ex(a, t, ((size) * 8) + 1, (bbs==1)?LTM_PRIME_BBS:0, cb, dat)
 
-#define mp_read_raw(mp, str, len) mp_read_signed_bin((mp), (str), (len))
-#define mp_raw_size(mp)           mp_signed_bin_size(mp)
-#define mp_toraw(mp, str)         mp_to_signed_bin((mp), (str))
 #define mp_read_mag(mp, str, len) mp_read_unsigned_bin((mp), (str), (len))
 #define mp_mag_size(mp)           mp_unsigned_bin_size(mp)
 #define mp_tomag(mp, str)         mp_to_unsigned_bin((mp), (str))
@@ -285,7 +283,7 @@ MP_API int  mp_init (mp_int * a);
 MP_API void mp_clear (mp_int * a);
 MP_API void mp_free (mp_int * a);
 MP_API void mp_forcezero(mp_int * a);
-MP_API int  mp_unsigned_bin_size(mp_int * a);
+MP_API int  mp_unsigned_bin_size(const mp_int * a);
 MP_API int  mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c);
 MP_API int  mp_to_unsigned_bin_at_pos(int x, mp_int *t, unsigned char *b);
 MP_API int  mp_to_unsigned_bin (mp_int * a, unsigned char *b);
@@ -296,10 +294,10 @@ MP_API int  mp_exptmod_ex (mp_int * G, mp_int * X, int digits, mp_int * P,
 /* end functions needed by Rsa */
 
 /* functions added to support above needed, removed TOOM and KARATSUBA */
-MP_API int  mp_count_bits (mp_int * a);
+MP_API int  mp_count_bits (const mp_int * a);
 MP_API int  mp_leading_bit (mp_int * a);
 MP_API int  mp_init_copy (mp_int * a, mp_int * b);
-MP_API int  mp_copy (mp_int * a, mp_int * b);
+MP_API int  mp_copy (const mp_int * a, mp_int * b);
 MP_API int  mp_grow (mp_int * a, int size);
 MP_API int  mp_div_2d (mp_int * a, int b, mp_int * c, mp_int * d);
 MP_API void mp_zero (mp_int * a);

source/libs/libwolfssl/wolfcrypt/logging.h

@@ -1,6 +1,6 @@
 /* logging.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/md2.h

@@ -1,6 +1,6 @@
 /* md2.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/md4.h

@@ -1,6 +1,6 @@
 /* md4.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/md5.h

@@ -1,6 +1,6 @@
 /* md5.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *
@@ -42,9 +42,12 @@
     extern "C" {
 #endif
 
+#if !defined(NO_OLD_MD5_NAME)
+    #define MD5             WC_MD5
+#endif
+
 #ifndef NO_OLD_WC_NAMES
     #define Md5             wc_Md5
-    #define MD5             WC_MD5
     #define MD5_BLOCK_SIZE  WC_MD5_BLOCK_SIZE
     #define MD5_DIGEST_SIZE WC_MD5_DIGEST_SIZE
     #define WC_MD5_PAD_SIZE WC_MD5_PAD_SIZE
@@ -71,7 +74,7 @@ enum {
 
 #ifdef WOLFSSL_TI_HASH
     #include "wolfssl/wolfcrypt/port/ti/ti-hash.h"
-#elif defined(WOLFSSL_IMX6_CAAM)
+#elif defined(WOLFSSL_IMX6_CAAM) && !defined(WOLFSSL_QNX_CAAM)
     #include "wolfssl/wolfcrypt/port/caam/wolfcaam_sha.h"
 #else
 
@@ -109,6 +112,9 @@ WOLFSSL_API int wc_InitMd5_ex(wc_Md5*, void*, int);
 WOLFSSL_API int wc_Md5Update(wc_Md5*, const byte*, word32);
 WOLFSSL_API int wc_Md5Final(wc_Md5*, byte*);
 WOLFSSL_API void wc_Md5Free(wc_Md5*);
+#ifdef OPENSSL_EXTRA
+WOLFSSL_API int wc_Md5Transform(wc_Md5*, const byte*);
+#endif
 
 WOLFSSL_API int  wc_Md5GetHash(wc_Md5*, byte*);
 WOLFSSL_API int  wc_Md5Copy(wc_Md5*, wc_Md5*);

source/libs/libwolfssl/wolfcrypt/mem_track.h

@@ -1,6 +1,6 @@
 /* mem_track.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/memory.h

@@ -1,6 +1,6 @@
 /* memory.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/misc.h

@@ -1,6 +1,6 @@
 /* misc.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/mpi_class.h

@@ -1,6 +1,6 @@
 /* mpi_class.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/mpi_superclass.h

@@ -1,6 +1,6 @@
 /* mpi_superclass.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *

source/libs/libwolfssl/wolfcrypt/pkcs11.h

@@ -1,6 +1,6 @@
 /* pkcs11.h
  *
- * Copyright (C) 2006-2020 wolfSSL Inc.
+ * Copyright (C) 2006-2021 wolfSSL Inc.
  *
  * This file is part of wolfSSL.
  *