busybox-w32/networking/tls.c, branch join2

tls: fix double free of HMAC context

2026-04-25T10:46:25+00:00

Commit aed19625ff (Post-merge fixes) attempted to handle some upstream code shuffling which broke support for https in wget with FEATURE_USE_CNG_API enabled and CONFIG_FEATURE_TLS_SCHANNEL disabled (i.e. using the upstream internal TLS code). Unfortunately it resulted in the HMAC context being freed twice which caused failures in certain cases. Fix this by not freeing the context in hmac_blocks(), thus making that function match upstream again. Thanks to @avih for identifying the problem. (GitHub issue #582)

wget: allow HTTPS certificate check to be skipped

2026-04-24T07:43:59+00:00

The Microsoft Windows Schannel implementation of TLS validates the server certificate. Enable the --no-check-certificate option to wget to allow these checks to be skipped. This may be useful to connect to badly configured websites. Adds 202 bytes to the x86_64 build with Schannel enabled. (GitHub issue #581)

Merge branch 'busybox' into merge

2026-03-11T10:14:49+00:00

tls: code shrink

2026-02-21T00:36:01+00:00

function old new delta tls_handshake_as_server 2408 2400 -8 Signed-off-by: Denys Vlasenko

tls: server: fix incorrect key_block assignments - now works against openssl s_client

2026-02-15T14:26:31+00:00

function old new delta privRsaEncryptSignedElement - 236 +236 tls_handshake_as_server 2033 2264 +231 .rodata 108079 108301 +222 initialize_aes_keys - 77 +77 xwrite_encrypted 507 506 -1 tls_handshake 1519 1500 -19 derive_master_secret_and_keys 154 123 -31 ------------------------------------------------------------------------------ (add/remove: 2/0 grow/shrink: 2/3 up/down: 766/-51) Total: 715 bytes Totoal growth compared to code before TLS server code: function old new delta tls_handshake_as_server - 2264 +2264 .rodata 107074 108301 +1227 psRsaCrypt - 577 +577 load_rsa_priv_key - 282 +282 ssl_server_main - 279 +279 privRsaEncryptSignedElement - 236 +236 ssl_client_main 137 363 +226 psRsaDecryptPriv - 171 +171 set_cipher_parameters - 161 +161 derive_master_secret_and_keys - 123 +123 packed_usage 36034 36146 +112 sp_ecc_make_key_256 - 103 +103 send_finished - 94 +94 get_change_cipher_spec - 88 +88 initialize_aes_keys - 77 +77 static.BLOCK_NAMES - 70 +70 curve_P256_compute_premaster - 65 +65 der_binary_to_pstm - 50 +50 curve_x25519_generate_keypair - 44 +44 get_finished - 42 +42 get_outbuf_fill_handshake_record - 37 +37 client_hello_ciphers - 32 +32 curve_P256_generate_keypair - 27 +27 sp_256_from_bin_8 - 26 +26 tls_xread_record 681 704 +23 curve_x25519_compute_premaster - 15 +15 applet_names 2870 2881 +11 applet_main 1652 1656 +4 xwrite_encrypted 507 506 -1 xwrite_and_update_handshake_hash 76 59 -17 sp_256_point_from_bin2x32 70 43 -27 curve_x25519_compute_pubkey_and_premaster 71 39 -32 curve_P256_compute_pubkey_and_premaster 167 65 -102 psRsaEncryptPub 395 199 -196 tls_handshake 2069 1500 -569 ------------------------------------------------------------------------------ (add/remove: 23/0 grow/shrink: 6/7 up/down: 6466/-944) Total: 5522 bytes Signed-off-by: Denys Vlasenko

tls: make ECDHE_RSA work against our client (openssl s_client not yet)

2026-02-15T14:16:26+00:00

function old new delta tls_handshake_as_server 1601 2033 +432 sp_ecc_make_key_256 - 103 +103 curve_P256_compute_premaster - 65 +65 .rodata 108023 108079 +56 curve_x25519_generate_keypair - 44 +44 tls_get_zeroed_outbuf - 28 +28 curve_P256_generate_keypair - 27 +27 sp_256_from_bin_8 - 26 +26 curve_x25519_compute_premaster - 15 +15 tls_xread_record 708 704 -4 tls_handshake 1530 1519 -11 get_outbuf_fill_handshake_record 51 37 -14 sp_256_point_from_bin2x32 70 43 -27 curve_x25519_compute_pubkey_and_premaster 71 39 -32 curve_P256_compute_pubkey_and_premaster 167 65 -102 ------------------------------------------------------------------------------ (add/remove: 7/0 grow/shrink: 2/6 up/down: 796/-190) Total: 606 bytes Signed-off-by: Denys Vlasenko

tls: fix cipher-id selection in server mode

2026-02-15T14:16:26+00:00

ECDSA keys still don't work, and currently will be ignored function old new delta tls_handshake_as_server 824 1601 +777 .rodata 107764 108007 +243 set_cipher_parameters - 161 +161 packed_usage 36072 36146 +74 static.BLOCK_NAMES - 70 +70 client_hello_ciphers - 32 +32 ssl_server_main 288 279 -9 load_rsa_priv_key 329 282 -47 tls_handshake 1676 1530 -146 ------------------------------------------------------------------------------ (add/remove: 3/0 grow/shrink: 3/3 up/down: 1357/-202) Total: 1155 bytes Signed-off-by: Denys Vlasenko

tls: eliminate unnecessary ENCRYPT_ON_WRITE, merge tls_get_zeroed_outbuf() with fill_handshake_record_hdr()

2026-02-15T14:16:26+00:00

function old new delta get_outbuf_fill_handshake_record - 51 +51 send_finished 95 94 -1 tls_handshake 1690 1676 -14 xwrite_and_update_handshake_hash 76 59 -17 tls_handshake_as_server 852 824 -28 tls_get_zeroed_outbuf 28 - -28 ------------------------------------------------------------------------------ (add/remove: 1/1 grow/shrink: 0/4 up/down: 51/-88) Total: -37 bytes Signed-off-by: Denys Vlasenko

tls: fix up debug printouts wrt newlines

2026-02-15T14:16:26+00:00

Signed-off-by: Denys Vlasenko

tls: implement server code

2026-02-15T14:16:26+00:00

function old new delta tls_handshake_as_server 7 852 +845 .rodata 107103 107764 +661 psRsaCrypt - 577 +577 load_rsa_priv_key - 329 +329 psRsaDecryptPriv - 200 +200 derive_master_secret_and_keys - 154 +154 send_finished - 95 +95 get_change_cipher_spec - 88 +88 der_binary_to_pstm - 50 +50 get_finished - 42 +42 tls_xread_record 681 708 +27 ssl_server_main 285 288 +3 psRsaEncryptPub 395 199 -196 tls_handshake 2069 1690 -379 ------------------------------------------------------------------------------ (add/remove: 8/0 grow/shrink: 4/2 up/down: 3071/-575) Total: 2496 bytes Signed-off-by: Denys Vlasenko