64 Commits

Author SHA1 Message Date
dumb 6979f132dc fix: harden file permissions for sensitive data and add input validation
- Introduce HITLS_APP_UioOpenPrivate to create key files with 0600
  permissions, replacing open-then-chmod pattern to avoid TOCTOU race
- Migrate key/PKCS12/rand output paths to use private file creation
- Refactor PKCS12 generation to use GenBuff + private UIO write
- Add null check for confirmP.data in SPAKE2+ RespDerive
- Add max length validation for private pass token challenge requests
- Reject AEAD ciphers in enc command explicitly
- Add 30s handshake timeout on accepted TCP connections

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1625

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-06-30 10:14:03 +08:00
Tom 7beb43f2d1 fix:fix the correctness of frodokem in BE platform, clean sensitive data
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1554

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-06-30 09:40:15 +08:00
dny fa3f69dceb fix: harden app IO and TLS shutdown
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1494

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-06-30 09:40:12 +08:00
dny 3c675844ad fix: harden sm verification and pem stdin handling
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1468

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 22:26:41 +08:00
dny e5397ef8df fix: adapt app hardening changes for 0.3
Drop the main-branch s_client HITLS_CFG_SetHost call because the 0.3 branch does not provide that API and host identity verification is not enabled for this branch yet.

Convert cherry-picked app tests from snprintf to securec snprintf_s for the 0.3 branch.

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1463

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:30:11 +08:00
dny df6b1a292c fix: harden app command security handling
Harden newly added app command paths and keep command-line behavior aligned with supported functionality.

- restrict enc output files and SM key-store files to owner-only permissions

- fail closed for explicitly configured CA files and enforce s_client host identity checks

- keep TLS app mode TLS-only and require client certificates when server verification is enabled

- validate SM key UUID inputs and preserve IPv4 split allocation bases during SAN parsing

- apply stdin size limits, cast ctype inputs safely, and honor errdecode -hex parsing

- reject unsupported GMAC/AES-WRAP/prime -safe command paths and update documentation

- apply pkcs12 algorithm options and add focused SDV coverage for the fixed paths

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1463

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:29:58 +08:00
TaylorGao3558 34642ad364 fix(crypto/bsl): fix bsl and ml-kem security check
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1447

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:29:42 +08:00
xuzhengyi 7ec1c42250 fix:Fixed some function-related issues
Signed-off-by: dsy <dongshunyu1@huawei.com>

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1440

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:29:34 +08:00
Tom 8600e94f5c fix:fix some bugs and clean sensitive information
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1431

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:29:33 +08:00
xuzhengyi f874d3b25c fix:Fixing some APP and AUTH bugs
fix app and auth module bugs from ai report,mainly involves the erasure of sensitive information and a few other issues.

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1377

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:25:14 +08:00
Ooohui 02eb9c2387 fix: clear sensitive information
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1340

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:23:22 +08:00
jchx 5cbfed93c7 Clean up code compilation warnings
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1337

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:23:16 +08:00
Ooohui d68de56c2d fix: replace unsafe memory clearing functions with secure alternatives
Replace memset/BSL_SAL_FREE with BSL_SAL_CleanseData/BSL_SAL_ClearFree
to prevent sensitive data leakage.

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1313

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-05-20 20:21:22 +08:00
liwei3013 f664eda26f refactor: make list traversal stateless and harden x509 verification
add node-based BSL list helpers and migrate shared-list readers off curr-mutating macros
precompute DN UTF-8 during parse and reuse cached values in X.509 compare/verify
clean up app UIO ownership handling and expand PKI/TLS regression coverage

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-04-21 20:20:46 +08:00
Dongjianwei001 51f41da579 Sync the code of openhitls-03
Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-04-01 18:46:46 +08:00
jchx 11f227258b Standardize the naming of external structures
Co-authored-by: jchx<chenqi180@huawei.com>

# message auto-generated for no-merge-commit merge:
!1147 merge 03 into openhitls-0.3

Standardize the naming of external structures

Created-by: jchx
Commit-by: jchx
Merged-by: liwei3013
Description: <!--  感谢您提交 Pull Request!以下是一些提示:

1) 如果您是第一次提交,请阅读我们的贡献者指南:https://gitcode.com/openHiTLS/openhitls/wiki/FAQ-社区需求贡献流程.md

-->

**此 PR 的作用 / 为什么需要它**:

**自检清单**:

- [ ] **测试**:代码是否已有UT/ST测试用例覆盖,新增测试用例是否随本PR一并上库
- [ ] **接口**:是否涉及对外接口变更,变更已通过接口评审
- [ ] **文档**:是否涉及文档修改

<!-- **给审查者的特别说明**: -->
<!-- + - [ ] 是否导致无法前向兼容 -->
<!-- + - [ ] 是否涉及依赖的三方库变更 -->

See merge request: openHiTLS/openhitls!1147

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:42 +08:00
Dongjianwei001 6bd2710b48 Modify the return value when no key usage.
Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:40 +08:00
balabala-123 9716f8a7b4 Fix sizeof enumeration error
Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:40 +08:00
dny 41c0b875a5 Remove algorithms print.
Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:39 +08:00
dny 44d9d393c2 APP tlcp supports encrypted private key ciphertext.
Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:38 +08:00
hanzhiyang 6913244ec5 fix:Code optimization and refactoring
Co-authored-by: hanzhiyang<hanzhiyang4@h-partners.com>

# message auto-generated for no-merge-commit merge:
!961 merge main into main

fix:Code optimization and refactoring

Created-by: hanzhiyang
Commit-by: hanzhiyang
Merged-by: liwei3013
Description: <!--  Thanks for sending a pull request!  Here are some tips for you:

1) If this is your first time, please read our contributor guidelines: https://gitcode.com/openHiTLS/openhitls/wiki/FAQ-社区需求贡献流程.md

-->

**What does this PR do / why do we need it**:

**Self-checklist**:(**请自检,在[ ]内打上x**)

+ - [ ] **测试**:PR中的代码是否已有UT/ST测试用例进行充分的覆盖,新增测试用例是否随本PR一并上库或已经上库
+ - [ ] **接口**:是否涉及对外接口变更,相应变更已得到接口评审组织的通过,API对应的注释信息已经刷新正确
+ - [ ] **文档**:是否涉及官网文档修改,如果涉及请及时提交资料到Doc仓

<!-- **Special notes for your reviewers**: -->
<!-- + - [ ] 是否导致无法前向兼容 -->
<!-- + - [ ] 是否涉及依赖的三方库变更 -->

See merge request: openHiTLS/openhitls!961

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:35 +08:00
hs6246 7a8721571e fix:Remove some redundant function.
Co-authored-by: hs6246<zhengzeyang@huawei.com>

# message auto-generated for no-merge-commit merge:
!932 merge fix into main

fix:Remove some redundant function.

Created-by: hs6246
Commit-by: hs6246
Merged-by: liwei3013
Description: fix:Remove some redundant function.

See merge request: openHiTLS/openhitls!932

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:34 +08:00
Ooohui fa29783cbe fix: Standardize function naming and error handling in the apps module
Co-authored-by: Ooohui<zhanghui160@huawei.com>

# message auto-generated for no-merge-commit merge:
!921 merge main into main

fix: Standardize function naming and error handling in the apps module

Created-by: Ooohui
Commit-by: Ooohui
Merged-by: liwei3013
Description: fix: Standardize function naming and error handling in the apps module

See merge request: openHiTLS/openhitls!921

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:34 +08:00
hs6246 0da75b0c45 fix:HITLS_APP_OptNext overflow.
Co-authored-by: hs6246<zhengzeyang@huawei.com>

# message auto-generated for no-merge-commit merge:
!924 merge main into main

fix:HITLS_APP_OptNext overflow.

Created-by: hs6246
Commit-by: hs6246
Merged-by: liwei3013
Description: fix:HITLS_APP_OptNext overflow.

See merge request: openHiTLS/openhitls!924

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:34 +08:00
hs6246 b49c6f70a7 fix:Refactor some functions in app module.
Co-authored-by: hs6246<zhengzeyang@huawei.com>

# message auto-generated for no-merge-commit merge:
!914 merge main into main

fix:Refactor some functions in app module.

Created-by: hs6246
Commit-by: hs6246
Merged-by: liwei3013
Description: fix:Refactor some functions in app module.
![image.png](https://raw.gitcode.com/user-images/assets/4195561/a4952bd7-ee26-4e1a-bbbb-e8a1d18912b5/image.png 'image.png')
![image.png](https://raw.gitcode.com/user-images/assets/4195561/0a5502e4-8bc6-4f96-adce-0dc7a4813e2b/image.png 'image.png')
![image.png](https://raw.gitcode.com/user-images/assets/4195561/bbb02e64-cb25-49c4-8ebe-28d62443a39b/image.png 'image.png')
![image.png](https://raw.gitcode.com/user-images/assets/4195561/26ccf5ba-5ff5-4b18-b2ff-bc4cfec682fb/image.png 'image.png')
![image.png](https://raw.gitcode.com/user-images/assets/4195561/184c1132-c0ae-4607-a730-b7620efaa609/image.png 'image.png')

See merge request: openHiTLS/openhitls!914

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:34 +08:00
hs6246 d23649f345 fix:Remove some redundant commands.
Co-authored-by: hs6246<zhengzeyang@huawei.com>

# message auto-generated for no-merge-commit merge:
!918 merge fix into main

fix:Remove some redundant commands.

Created-by: hs6246
Commit-by: hs6246
Merged-by: liwei3013
Description: fix:Remove some redundant commands.

See merge request: openHiTLS/openhitls!918

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:33 +08:00
hs6246 475b0ea38e fix:Refactor some functions in app module.
Co-authored-by: hs6246<zhengzeyang@huawei.com>

# message auto-generated for no-merge-commit merge:
!887 merge main into main

fix:Refactor some functions in app module.

Created-by: hs6246
Commit-by: hs6246
Merged-by: liwei3013
Description: fix:Refactor some functions in app module.

See merge request: openHiTLS/openhitls!887

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:33 +08:00
cnxf cb55114cdf feat(app): add prime command line with prime number generation and testing
- Implement prime number generation and primality testing
- Support decimal and hexadecimal input/output formats
- Add safe prime generation option
- Include 15 comprehensive test cases with cross-platform support
- Add command-line interface with options: -generate, -bits, -safe, -hex, -checks

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/856

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:33 +08:00
libiaoliang 3c2e80d8a6 Fix app digest errors
Co-authored-by: xuzhengyi<xuzhengyi1@h-partners.com>

# message auto-generated for no-merge-commit merge:
!891 merge FIX_BUG into main

Fix app digest errors

Created-by: libiaoliang
Commit-by: xuzhengyi
Merged-by: liwei3013
Description: Fix app digest errors

See merge request: openHiTLS/openhitls!891

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:33 +08:00
hs6246 63c7b46afa Fix app module bugs.
Co-authored-by: hs6246<zhengzeyang@huawei.com>

# message auto-generated for no-merge-commit merge:
!883 merge main into main

Fix app module bugs.

Created-by: hs6246
Commit-by: hs6246
Merged-by: liwei3013
Description: Fix app module bugs.

See merge request: openHiTLS/openhitls!883

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:32 +08:00
liwei3013 39ea49bec0 Support partial certificate chain verification
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/692

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:29 +08:00
baoyi84930 5f5fdacf8c feat: add default ca path to the CLI
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/691

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:28 +08:00
baoyi84930 b174cc4583 feat:Added TLS to the CLI
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/688

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:28 +08:00
tlhc 3ba30169c2 feat: Add cross-platform support for Darwin/macOS
**Core Platform Support:**
- Add Darwin/macOS platform detection and conditional compilation
- Implement platform-specific library extensions (.dylib for macOS, .so for Linux)
- Enhanced dynamic library loading with cross-platform error handling
- Platform-optimized time functions (clock_gettime_nsec_np for macOS)
- Add App module support for Darwin/macOS

**Threading & Synchronization:**
- BSL: Migrate from simple integer flags to proper pthread_once_t implementation
- Add BSL_SAL_OnceControl type with platform-specific implementations
- Implement thread-safe one-time initialization across platforms
- Fix memory initialization patterns for thread-once controls

**Build System Improvements:**
- Remove GNU ld-specific flags for test-framework use c function pointer replace or `stub_utils.h` to hook target function
- Boundcheck components will linked as static library for tests, reduce tests dynamic library deps
- Update CMake configurations for Darwin support

**Test Framework Enhancements:**
- Replace jmp_buf with sigjmp_buf for better signal handling
- Update time handling to avoid platform-specific gmtime issues
- Improve entropy test stability across platforms
- Add proper RAND initialization/deinitialization

**Entropy & Cryptographic Updates:**
- Temporarily disable CPU jitter entropy on macOS (pending validation)
- Add cross-platform entropy source management
- Update DRBG configuration for improved compatibility
- Enhance hardware entropy detection and handling

**Network & I/O:**
- Extend POSIX network functions to support both Linux and Darwin
- Add file accessibility checks before dynamic loading
- Improve error handling for symbol resolution across platforms
- Update socket and I/O operations for cross-platform compatibility

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/677

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:28 +08:00
xuzhengyi eaed969628 Fix the error that occurs when the app parses standardized input
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/673

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:27 +08:00
dny 8277605a0e SM algorithm adds kat vector.
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/674

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:27 +08:00
Ooohui e8d715a8a0 refactor code, delete redundant head files
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/675

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:27 +08:00
dny e43825da33 Add password complexity check in sm mode.
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/666

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:26 +08:00
dny 88abc011b8 App SM2 key exchange adds temporary private key encryption.
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/666

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:26 +08:00
tlhc b67050ce74 feat: build system improvements and cross-platform support (macOS)
Major Features:
- Multi-compiler/linker configuration system with toolchain support
- Auto-manage Secure C (libboundscheck) dependency
- Dynamic provider library names for CMVP modes (ISO19790, SM)
- macOS/Darwin platform support with unified POSIX abstractions
- Cross-platform build improvements and optimizations

Build System:
- Add toolchain management for cross-compilation
- Support nested 'common' format in compile config
- with _EXTRA/_REMOVE/_OVERRIDE in common flags, we can add remove by
  per compiler
- Unify toolchain naming convention (arch-vendor-os-abi-compiler)

Platform Support:
- Unify Linux and Darwin sources under POSIX
- Add Darwin support for SAL and build flags
- Add Darwin support for REC wrapper functions (WIP)
- Cross-platform ops count macros for benchmarking
- Platform-specific library extension detection (.dylib vs .so)

Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/652

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:26 +08:00
Ooohui 546420a052 Optimize the code to reduce ROM space
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/575

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:25 +08:00
fly2x 0cab2d1454 Add ml-kem keygen
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/643

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:50:24 +08:00
dny 1d6f4525e1 Modify the HITLS_APP_SM_PrintLog function name.
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/601

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:42:24 +08:00
dny 621324747a Modify sm provider errcode and entropy self-check parameters.
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/601

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 19:41:57 +08:00
dny 0dc264fe26 Modify app sm error code.
Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/599

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 17:49:30 +08:00
dny 84ea051d6a Fix testcase failed.
Co-authored-by: dny<duanningyan@huawei.com>

# message auto-generated for no-merge-commit merge:
merge gm into main

Fix testcase failed.

Created-by: dny
Commit-by: dny
Merged-by: liwei3013
Description: Fix testcase failed.

See merge request: openHiTLS/openhitls!597

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 17:49:30 +08:00
tianshenqi 630748ea0c fix:Fix abnormal -help print information.
Co-authored-by: tianshenqi<tianshenqi@h-partners.com>

# message auto-generated for no-merge-commit merge:
merge fix into main

fix:Fix abnormal -help print information.

Created-by: tianshenqi
Commit-by: tianshenqi
Merged-by: liwei3013
Description: fix:Fix abnormal -help print information.

See merge request: openHiTLS/openhitls!596

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 17:49:30 +08:00
dny ca13e2c48b Fix app dtlcp wrong log.
Co-authored-by: dny<duanningyan@huawei.com>

# message auto-generated for no-merge-commit merge:
merge gm into main

Fix app dtlcp wrong log.

Created-by: dny
Commit-by: dny
Merged-by: liwei3013
Description: Fix app dtlcp wrong log.

See merge request: openHiTLS/openhitls!592

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 17:49:30 +08:00
dny beef878248 App tlcp support use p12 sign key.
Co-authored-by: dny<duanningyan@huawei.com>

# message auto-generated for no-merge-commit merge:
merge gm into main

App tlcp support use p12 sign key.

Created-by: dny
Commit-by: dny
Merged-by: liwei3013
Description: App tlcp support use p12 sign key.

See merge request: openHiTLS/openhitls!585

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 17:49:30 +08:00
dny c7f74a0b96 App tlcp add sm mode.
Co-authored-by: dny<duanningyan@huawei.com>

# message auto-generated for no-merge-commit merge:
merge gm into main

App tlcp add sm mode.

Created-by: dny
Commit-by: dny
Merged-by: liwei3013
Description: App tlcp add sm mode.

See merge request: openHiTLS/openhitls!579

Signed-off-by: Dongjianwei001 <dongjianwei1@huawei.com>
2026-03-30 17:49:30 +08:00