Fenrir fixes across AES, ECC, RSA, SLH-DSA, DH, and PKIX revocation

README_JCE.md

@@ -888,6 +888,10 @@ revoked, validation will fail. The difference only affects behavior when one
 method succeeds and the other would have failed (e.g., OCSP unreachable but
 CRL available).
 
+A `PKIXRevocationChecker` added with `addCertPathChecker()` applies
+irregardless of if `setRevocationEnabled()` is set, so `PREFER_CRLS` with CRLs
+in the `CertStore` list performs CRL checking even when revocation is disabled.
+
 #### Indirect CRL Not Supported
 
 Native wolfSSL does not support indirect CRLs. An indirect CRL is a CRL signed

jni/jni_aesgmac.c

@@ -64,17 +64,19 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_native_1init(
     JNIEnv* env, jobject this)
 {
 #ifdef HAVE_AESGCM
+    int ret = 0;
     Gmac* gmac = (Gmac*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
         /* getNativeStruct may throw exception, prevent throwing another */
         return;
     }
 
-    /* GMAC struct is already zero-initialized in mallocNativeStruct_internal */
-    /* Actual initialization happens in wc_GmacSetKey when we have the key */
+    ret = wc_AesInit(&gmac->aes, NULL, INVALID_DEVID);
+    if (ret != 0) {
+        throwWolfCryptExceptionFromError(env, ret);
+    }
 
     LogStr("native_init(gmac=%p)\n", gmac);
-    (void)gmac; /* suppress unused variable warning */
 #else
     throwNotCompiledInException(env);
 #endif
@@ -93,9 +95,9 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_native_1free(
     LogStr("free Gmac %p\n", gmac);
 
     if (gmac) {
-        /* Only clear the GMAC struct - do NOT free the memory here.
-         * The base class NativeStruct.xfree() will handle the actual
-         * memory deallocation to avoid double-free. */
+        /* Free AES backend resources, then clear the struct.
+         * NativeStruct.xfree() frees Gmac struct. */
+        wc_AesFree(&gmac->aes);
         XMEMSET(gmac, 0, sizeof(Gmac));
     }
 #else
@@ -242,8 +244,10 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1Gmac(
         authInSz = getByteArrayLength(env, authIn_object);
         authTagSz = getByteArrayLength(env, authTag_object);
 
-        /* Set the key */
-        ret = wc_GmacSetKey(&gmac, key, keySz);
+        ret = wc_AesInit(&gmac.aes, NULL, INVALID_DEVID);
+        if (ret == 0) {
+            ret = wc_GmacSetKey(&gmac, key, keySz);
+        }
 
         if (ret == 0) {
             /* Use a local buffer for the auth tag result to avoid
@@ -319,8 +323,10 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1GmacVerify(
         authInSz = getByteArrayLength(env, authIn_object);
         authTagSz = getByteArrayLength(env, authTag_object);
 
-        /* Set the key */
-        ret = wc_GmacSetKey(&gmac, key, keySz);
+        ret = wc_AesInit(&gmac.aes, NULL, INVALID_DEVID);
+        if (ret == 0) {
+            ret = wc_GmacSetKey(&gmac, key, keySz);
+        }
 
         if (ret == 0) {
             /* Generate the expected tag and compare */

jni/jni_aesofb.c

@@ -71,6 +71,7 @@ Java_com_wolfssl_wolfcrypt_AesOfb_native_1set_1key_1internal(
     byte* key = NULL;
     byte* iv  = NULL;
     word32 keySz = 0;
+    (void)opmode;
 
     aes = (Aes*) getNativeStruct(env, this);
     if ((*env)->ExceptionOccurred(env)) {
@@ -87,7 +88,7 @@ Java_com_wolfssl_wolfcrypt_AesOfb_native_1set_1key_1internal(
     }
 
     if (ret == 0) {
-        ret = wc_AesSetKey(aes, key, keySz, iv, opmode);
+        ret = wc_AesSetKey(aes, key, keySz, iv, AES_ENCRYPTION);
     }
 
     if (ret != 0) {

jni/jni_dh.c

@@ -320,7 +320,6 @@ Java_com_wolfssl_wolfcrypt_Dh_wc_1DhGenerateKeyPair(
     LogStr("wc_DhGenerateKeyPair(key, rng, priv, privSz, pub, pubSz) = %d\n",
         ret);
     LogStr("private[%u]: [%p]\n", privSz, priv);
-    LogHex(priv, 0, privSz);
     LogStr("public[%u]: [%p]\n", pubSz, pub);
     LogHex(pub, 0, pubSz);
 
@@ -455,7 +454,6 @@ Java_com_wolfssl_wolfcrypt_Dh_wc_1DhAgree(
     LogStr("wc_DhAgree(key, secret, secretSz, priv, privSz, pub, pubSz) = %d\n",
         ret);
     LogStr("secret[%u]: [%p]\n", secretSz, secret);
-    LogHex(secret, 0, secretSz);
 
     if (secret != NULL) {
     #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \

jni/jni_ecc.c

@@ -164,6 +164,7 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_Ecc_wc_1ecc_1make_1key_1ex
 {
 #ifdef HAVE_ECC
     int ret = 0;
+    int curveId = 0;
     ecc_key* ecc = NULL;
     RNG* rng = NULL;
     const char* name = NULL;
@@ -188,29 +189,26 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_Ecc_wc_1ecc_1make_1key_1ex
     if (ret == 0) {
         name = (*env)->GetStringUTFChars(env, curveName, 0);
         if (name == NULL) {
-            ret = BAD_FUNC_ARG;
+            /* GetStringUTFChars failed with an exception already pending */
+            return;
         }
-    }
 
-    if (ret == 0) {
-        ret = wc_ecc_get_curve_id_from_name(name);
+        curveId = wc_ecc_get_curve_id_from_name(name);
         (*env)->ReleaseStringUTFChars(env, curveName, name);
-    }
-
-    if (ret < 0) {
-        throwWolfCryptException(env, "ECC curve unsupported or not enabled");
 
-    } else {
-        /* When using a specific curve_id, pass keysize as 0 to let the
-         * curve_id determine the key size. This is required for FIPS mode
-         * compatibility where keysize must be 0 when using approved curves.
-         * The 'size' parameter from Java is ignored here since curve_id
-         * (stored in ret) defines the actual key size. */
-        ret = wc_ecc_make_key_ex(rng, 0, ecc, ret);
-
-        if (ret < 0) {
-            throwWolfCryptExceptionFromError(env, ret);
+        if (curveId < 0) {
+            throwWolfCryptException(env,
+                "ECC curve unsupported or not enabled");
+            return;
         }
+
+        /* Pass keysize 0 so the curve_id sets the key size, required for
+         * FIPS where approved curves need keysize 0 */
+        ret = wc_ecc_make_key_ex(rng, 0, ecc, curveId);
+    }
+
+    if (ret != 0) {
+        throwWolfCryptExceptionFromError(env, ret);
     }
 
     LogStr("ecc_make_key_ex(rng, size, ecc=%p) = %d\n", ecc, ret);

jni/jni_feature_detect.c

@@ -527,7 +527,11 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_wolfcrypt_FeatureDetect_RsaPssLongSa
 {
     (void)env;
     (void)jcl;
-#if !defined(NO_RSA) && defined(WC_RSA_PSS) && defined(WOLFSSL_PSS_LONG_SALT)
+/* FIPS v7 and later cap the PSS salt at the digest length, even when
+ * WOLFSSL_PSS_LONG_SALT is defined */
+#if !defined(NO_RSA) && defined(WC_RSA_PSS) && \
+    defined(WOLFSSL_PSS_LONG_SALT) && \
+    !(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 7))
     return JNI_TRUE;
 #else
     return JNI_FALSE;

jni/jni_rsa.c

@@ -561,23 +561,6 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateKeyToP
         }
     }
 
-    /* Get PKCS#8 output size, into pkcs8Sz */
-    if (ret == 0) {
-        ret = wc_CreatePKCS8Key(NULL, &pkcs8Sz, derKey, derKeySz, algoID,
-                                curveOID, oidSz);
-        if (ret == LENGTH_ONLY_E) {
-            pkcs8 = (byte*)XMALLOC(pkcs8Sz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-            if (pkcs8 == NULL) {
-                ret = MEMORY_E;
-            }
-            else {
-                XMEMSET(pkcs8, 0, pkcs8Sz);
-                pkcs8BufSz = pkcs8Sz;
-                ret = 0;
-            }
-        }
-    }
-
     if (ret == 0) {
         /* Allocate temp buffer to hold DER encoded key */
         derKey = (byte*)XMALLOC(derKeySz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -599,6 +582,23 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateKeyToP
         }
     }
 
+    /* Get PKCS#8 output size, into pkcs8Sz. */
+    if (ret == 0) {
+        ret = wc_CreatePKCS8Key(NULL, &pkcs8Sz, derKey, derKeySz, algoID,
+                                curveOID, oidSz);
+        if (ret == LENGTH_ONLY_E) {
+            pkcs8 = (byte*)XMALLOC(pkcs8Sz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            if (pkcs8 == NULL) {
+                ret = MEMORY_E;
+            }
+            else {
+                XMEMSET(pkcs8, 0, pkcs8Sz);
+                pkcs8BufSz = pkcs8Sz;
+                ret = 0;
+            }
+        }
+    }
+
     /* Create PKCS#8 from DER key */
     if (ret == 0) {
         ret = wc_CreatePKCS8Key(pkcs8, &pkcs8Sz, derKey, derKeySz,

jni/jni_slhdsa.c

@@ -50,6 +50,12 @@
 /* #define WOLFCRYPT_JNI_DEBUG_ON */
 #include <wolfcrypt_jni_debug.h>
 
+#if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && !defined(WOLFSSL_NO_FORCE_ZERO)
+    #define SLHDSA_FORCE_ZERO(p, len) wc_ForceZero((p), (len))
+#else
+    #define SLHDSA_FORCE_ZERO(p, len) XMEMSET((p), 0, (len))
+#endif
+
 /* A WOLFSSL_SLHDSA_VERIFY_ONLY build provides only public-key verify. DER
  * encode (KeyToDer / PublicKeyToDer) additionally needs
  * WC_ENABLE_ASYM_KEY_EXPORT. */
@@ -1258,7 +1264,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_SlhDsa_wc_1SlhDsaKey_1ex
 
     LogStr("wc_SlhDsaKey_ExportPrivate(key=%p) = %d\n", key, ret);
 
-    wc_ForceZero(output, outputBufSz);
+    SLHDSA_FORCE_ZERO(output, outputBufSz);
     XFREE(output, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #else
     (void)env;
@@ -1463,7 +1469,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_SlhDsa_wc_1SlhDsaKey_1Ke
 
     LogStr("wc_SlhDsaKey_KeyToDer(key=%p) = %d\n", key, ret);
 
-    wc_ForceZero(output, outputBufSz);
+    SLHDSA_FORCE_ZERO(output, outputBufSz);
     XFREE(output, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #else
     (void)env;
@@ -1558,7 +1564,7 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_SlhDsa_wc_1SlhDsaKey_1PrivateK
     LogStr("wc_SlhDsaKey_PrivateKeyDecode(key=%p) = %d\n", key, ret);
 
     if (derCopy != NULL) {
-        wc_ForceZero(derCopy, derLen);
+        SLHDSA_FORCE_ZERO(derCopy, derLen);
         XFREE(derCopy, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
     releaseByteArray(env, der_object, der, JNI_ABORT);

jni/jni_wolfssl_cert_manager.c

@@ -523,6 +523,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_WolfSSLCertManager_CertManager
     }
 
     buff = (byte*)(*env)->GetByteArrayElements(env, in, NULL);
+    if (buff == NULL) {
+        return MEMORY_E;
+    }
     buffSz = (word32)sz;
 
     ret = wolfSSL_CertManagerLoadCABuffer(cm, buff, buffSz, format);
@@ -547,6 +550,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_WolfSSLCertManager_CertManager
     }
 
     buff = (byte*)(*env)->GetByteArrayElements(env, in, NULL);
+    if (buff == NULL) {
+        return MEMORY_E;
+    }
     buffSz = (word32)sz;
 
     ret = wolfSSL_CertManagerLoadCABuffer_ex(cm, buff, buffSz, format, 0,
@@ -588,6 +594,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_WolfSSLCertManager_CertManager
     }
 
     buff = (byte*)(*env)->GetByteArrayElements(env, in, NULL);
+    if (buff == NULL) {
+        return MEMORY_E;
+    }
     buffSz = (word32)sz;
 
     ret = wolfSSL_CertManagerVerifyBuffer(cm, buff, buffSz, format);
@@ -656,6 +665,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_WolfSSLCertManager_CertManager
     }
 
     buff = (byte*)(*env)->GetByteArrayElements(env, in, NULL);
+    if (buff == NULL) {
+        return MEMORY_E;
+    }
     buffSz = (word32)sz;
 
     ret = wolfSSL_CertManagerLoadCRLBuffer(cm, buff, buffSz, type);