diff --git a/.github/configs/os-check-linux.json b/.github/configs/os-check-linux.json index 90bc8cffd45..06c69fe9e9f 100644 --- a/.github/configs/os-check-linux.json +++ b/.github/configs/os-check-linux.json @@ -2,7 +2,6 @@ {"name": "user-settings-all-compat", "minutes": 9.5, "comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.", "user_settings": "examples/configs/user_settings_all.h", - "cflags": "", "configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]}, {"name": "session-cache-ref", "minutes": 3.2, "comment": "NO_SESSION_CACHE_REF is now the configure default, so --enable-session-cache-ref is the only way back onto the client cache reference path and the generation check on it is covered nowhere else. savesession adds the persistence paths that restore those generations.", @@ -157,10 +156,8 @@ {"name": "lms-xmss-verify-only", "minutes": 2.5, "configure": ["--enable-lms=small,verify-only", "--enable-xmss=small,verify-only"]}, {"name": "sp-4096-m32", "minutes": 1.2, - "comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.", - "configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"], - "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE", - "ldflags": "-m32"}, + "comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing.", + "configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"]}, {"name": "opensslall-rng-seed-cb", "minutes": 2.2, "configure": ["--enable-opensslall", "--enable-opensslextra", "CPPFLAGS=-DWC_RNG_SEED_CB"]}, {"name": "opensslall-ecc-zero-hash", "minutes": 2.2, @@ -268,7 +265,6 @@ {"name": "user-settings-all", "minutes": 2.0, "comment": "The user_settings.h header-driven build path is distinct from the autotools-driven --enable-all path; full make check.", "user_settings": "examples/configs/user_settings_all.h", - "cflags": "", "configure": ["--enable-usersettings"]}, {"name": "she-ext-cryptocb-sw-default", "minutes": 1.9, "configure": ["--enable-she=extended", "--enable-cryptocb", "--enable-cryptocbutils", @@ -304,12 +300,10 @@ "comment": "Key wrap with HAVE_AES_ECB so the RFC 3394 loops route each block through wc_AesEcb*; runs test_wc_CryptoCb_AesKeyWrapEcbCompose (key wrap composed from an ECB-only crypto callback).", "configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding", "--enable-aesecb"]}, {"name": "aeskeywrap-padding-no-64bit", "minutes": 1.6, - "comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.", + "comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words.", "configure": ["--enable-cryptonly", "--enable-aeskeywrap=padding", "--disable-sha512", "--disable-sha384", - "--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"], - "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE", - "ldflags": "-m32"}, + "--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"]}, {"name": "no-client-no-client-auth", "minutes": 1.6, "configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]}, {"name": "ascon-experimental", "minutes": 1.6, @@ -397,97 +391,76 @@ {"name": "testwolfcrypt-ca", "minutes": 1.0, "comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.", "user_settings": "examples/configs/user_settings_ca.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-dtls13", "minutes": 1.0, "user_settings": "examples/configs/user_settings_dtls13.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-ebsnet", "minutes": 1.0, "user_settings": "examples/configs/user_settings_EBSnet.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-eccnonblock", "minutes": 1.0, "user_settings": "examples/configs/user_settings_eccnonblock.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-curve25519nonblock", "minutes": 1.0, "user_settings": "examples/configs/user_settings_curve25519nonblock.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded", "minutes": 1.0, "comment": "Default profile of the embedded template: portable C, SP math all, TLS 1.3 client, ECC P-256 + AES-GCM.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-noheap", "minutes": 1.0, "comment": "Same template with the no-heap profile (WOLFSSL_NO_MALLOC/WOLFSSL_SP_NO_MALLOC via WC_CFG_HEAP 0), which is the configuration its stack-only constraints apply to.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_HEAP=0", "WC_CFG_SMALL_STACK=0"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-cryptonly", "minutes": 1.0, "comment": "wolfCrypt-only profile (both TLS versions off), which exercises the WOLFCRYPT_ONLY/NO_TLS path and the derived WC_CFG_TLS.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_TLS13=0"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-spmath", "minutes": 1.0, "comment": "Restricted SP math (WOLFSSL_SP_MATH) with the assembly off, covering the other math back end and the WC_CFG_ASM_SP 0 path.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_MATH_ALL_SIZES=0", "WC_CFG_ASM_SP=0"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-maxed", "minutes": 1.0, "comment": "Wide profile: RSA, DH, the extra curves, X25519/Ed25519, ML-KEM and ML-DSA, every digest, ChaCha-Poly and the size knobs off.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_SMALL=0", "WC_CFG_RSA=1", "WC_CFG_DH=1", "WC_CFG_ECC_P384=1", "WC_CFG_CURVE25519=1", "WC_CFG_ED25519=1", "WC_CFG_MLKEM=1", "WC_CFG_MLDSA=1", "WC_CFG_SHA224=1", "WC_CFG_SHA3=1", "WC_CFG_CHACHA_POLY=1"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-min-ecc", "minutes": 1.0, "user_settings": "examples/configs/user_settings_min_ecc.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-openssl-compat", "minutes": 1.0, "user_settings": "examples/configs/user_settings_openssl_compat.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-pkcs7", "minutes": 1.0, "user_settings": "examples/configs/user_settings_pkcs7.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-pq", "minutes": 1.0, "comment": "ML-KEM + ML-DSA post-quantum profile. Builds without --enable-experimental; testwolfcrypt runs the ML-DSA KATs.", "user_settings": "examples/configs/user_settings_pq.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-rsa-only", "minutes": 1.0, "user_settings": "examples/configs/user_settings_rsa_only.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-template", "minutes": 1.0, "user_settings": "examples/configs/user_settings_template.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-tls12", "minutes": 1.0, "user_settings": "examples/configs/user_settings_tls12.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-tls13", "minutes": 1.0, "user_settings": "examples/configs/user_settings_tls13.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-wolfboot-keytools", "minutes": 1.0, "user_settings": "examples/configs/user_settings_wolfboot_keytools.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-wolfssh", "minutes": 1.0, "user_settings": "examples/configs/user_settings_wolfssh.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-wolftpm", "minutes": 1.0, "user_settings": "examples/configs/user_settings_wolftpm.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs", "name": "no-asn-strict-certs", @@ -539,11 +512,10 @@ {"name": "no-examples-no-malloc", "minutes": 0.8, "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]}, {"name": "cryptocb-curve25519-no-key-export", "minutes": 0.3, - "comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. cflags repeats this job's --cflags because a per-entry value replaces them, and adds -Werror so an unreferenced static fails instead of scrolling past as a warning. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.", + "comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.", "configure": ["--enable-cryptonly", "--enable-cryptocb", "--enable-curve25519", "--enable-keygen", "--disable-examples", - "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"], - "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror"}, + "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"]}, {"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false, "comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.", "configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource", diff --git a/.github/configs/os-check-macos.json b/.github/configs/os-check-macos.json index 51f74df52fb..a8e081448b5 100644 --- a/.github/configs/os-check-macos.json +++ b/.github/configs/os-check-macos.json @@ -10,11 +10,9 @@ {"name": "user-settings-all", "minutes": 1.5, "comment": "The user_settings.h header-driven build path under Apple clang: macOS-specific guard ordering (e.g. WOLFSSL_SYS_CA_CERTS pulling in Security.framework) is distinct from the autotools --enable-all path above.", "user_settings": "examples/configs/user_settings_all.h", - "cflags": "", "configure": ["--enable-usersettings"]}, {"name": "apple-native-cert-validation", "minutes": 1.5, - "comment": "Former macos-apple-native-cert-validation.yml workflow: WOLFSSL_APPLE_NATIVE_CERT_VALIDATION delegates chain verification to Security.framework instead of wolfSSL's verifier, and the TEST define enables its client tests in make check. CFLAGS go to configure (with \"cflags\": \"\" so the make-time --cflags do not override them), exactly like the old standalone job.", - "cflags": "", + "comment": "Former macos-apple-native-cert-validation.yml workflow: WOLFSSL_APPLE_NATIVE_CERT_VALIDATION delegates chain verification to Security.framework instead of wolfSSL's verifier, and the TEST define enables its client tests in make check. CFLAGS go to configure, exactly like the old standalone job.", "configure": ["CFLAGS=-DWOLFSSL_APPLE_NATIVE_CERT_VALIDATION -DWOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION -DRSA_MIN_SIZE=2048 -DNO_WOLFSSL_CIPHER_SUITE_TEST"]}, {"name": "cryptocb-swdev-ed25519", "minutes": 1.0, "comment": "swdev built with Apple ld64: tests/swdev/Makefile localizes its symbols with ld -r -exported_symbol instead of objcopy. CB_ONLY_ED25519 strips software Ed25519, so make check fails unless the swdev callback is linked and reachable.", diff --git a/.github/scripts/parallel-make-check.py b/.github/scripts/parallel-make-check.py index 230c4caa68f..a1705dee16e 100755 --- a/.github/scripts/parallel-make-check.py +++ b/.github/scripts/parallel-make-check.py @@ -308,6 +308,10 @@ def load_configs(opts: argparse.Namespace, for key in ("cflags", "extra_cflags", "ldflags"): if not isinstance(entry.get(key, ""), str): error(f"{opts.json}: \"{key}\" must be a string in {name!r}") + if entry.get("cflags") == "" and not opts.cflags: + warn(f"{opts.json}: empty \"cflags\" in {name!r} has no effect " + f"without --cflags; \"extra_cflags\": \"\" opts out of " + f"--extra-cflags") minutes = entry.get("minutes", 1.0) if isinstance(minutes, bool) or not isinstance(minutes, (int, float)) \ or minutes < 0: diff --git a/.github/workflows/afalg.yml b/.github/workflows/afalg.yml index 2b47ac75013..101f66f1d21 100644 --- a/.github/workflows/afalg.yml +++ b/.github/workflows/afalg.yml @@ -166,14 +166,14 @@ jobs: [ {"name": "defaults-afalg", "minutes": 2, "configure": ["--enable-afalg"], - "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"}, + "extra_cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"}, {"name": "all-afalg", "minutes": 5, "configure": ["--enable-all", "--enable-testcert", "--enable-acert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", "--enable-quic", "--enable-afalg", "--disable-srtp", "--disable-sha224", "--disable-hashflags", "--disable-cryptocb", "--disable-aesgcm-stream"], - "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"} + "extra_cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"} ] EOF .github/scripts/parallel-make-check.py \ diff --git a/.github/workflows/enterprise.yml b/.github/workflows/enterprise.yml index e8a321a1556..ef1956e85e3 100644 --- a/.github/workflows/enterprise.yml +++ b/.github/workflows/enterprise.yml @@ -89,7 +89,7 @@ jobs: .github/scripts/parallel-make-check.py \ ${{ github.event_name == 'schedule' && '--build-only' || '' }} \ --shard "${{ matrix.shard }}/${{ strategy.job-total }}" \ - --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ + --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ --private-dir=certs \ .github/configs/enterprise.json diff --git a/.github/workflows/os-check.yml b/.github/workflows/os-check.yml index 0061c3b56da..e4d1eded6d2 100644 --- a/.github/workflows/os-check.yml +++ b/.github/workflows/os-check.yml @@ -244,18 +244,14 @@ jobs: # refresh later - a stale value only packs the schedule worse. The # list is kept sorted by minutes for readability, but the schedule # sorts by the values, not list order. - # The CFLAGS that were previously passed to configure are applied at - # make time via --cflags, unchanged. --private-dir=certs gives every - # build dir its own certs/ copy: crl-gen-openssl.test writes generated - # CRLs under certs/crl/, which would race through the shared VPATH - # certs symlink. + # --private-dir=certs stops crl-gen-openssl.test racing on certs/crl/. - name: Build and make check this shard's configs (parallel, out-of-tree) if: ${{ env.SEED_DECLINED != 'true' }} run: | .github/scripts/parallel-make-check.py \ ${{ (github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/master') || (github.event_name == 'workflow_dispatch' && github.event.inputs.seed != 'false')) && '--build-only' || '' }} \ --shard "${{ matrix.shard }}/${{ strategy.job-total }}" \ - --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ + --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ --private-dir=certs .github/configs/os-check-linux.json # Seed runs (a push to master, the cron, or a manual dispatch with @@ -377,7 +373,7 @@ jobs: .github/scripts/parallel-make-check.py \ ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.seed != 'false')) && '--build-only' || '' }} \ --threads 1 --cc= \ - --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ + --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ --private-dir=certs .github/configs/os-check-macos.json - name: ccache stats diff --git a/.github/workflows/tinytls13.yml b/.github/workflows/tinytls13.yml index f8b51ce4aa9..1587ede599f 100644 --- a/.github/workflows/tinytls13.yml +++ b/.github/workflows/tinytls13.yml @@ -99,12 +99,12 @@ jobs: "configure": ["--enable-tinytls13=cert,server,asm", "--disable-mlkem"]}, {"name": "tinytls13-cert-chacha", "minutes": 1, "check": false, "configure": ["--enable-tinytls13=cert,server", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"], - "cflags": "-DHAVE_CHACHA -DHAVE_POLY1305", + "extra_cflags": "-DHAVE_CHACHA -DHAVE_POLY1305", "run": [["cc", "-I.", "-I..", "../examples/tls13/tls13_memio.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tls13_memio"], ["./tls13_memio", "TLS13-CHACHA20-POLY1305-SHA256"]]}, {"name": "tinytls13-cert-aes256", "minutes": 1, "check": false, "configure": ["--enable-tinytls13=cert,server,sha384", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"], - "cflags": "-DWOLFSSL_AES_256", + "extra_cflags": "-DWOLFSSL_AES_256", "run": [["cc", "-I.", "-I..", "../examples/tls13/tls13_memio.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tls13_memio"], ["./tls13_memio", "TLS13-AES256-GCM-SHA384"]]}, {"name": "tinytls13-psk-mlkem", "minutes": 1, @@ -118,7 +118,7 @@ jobs: ["./tls13_memio"]]}, {"name": "tinytls13-nomalloc", "minutes": 1, "check": false, "configure": ["--enable-tinytls13=psk,server,staticmem", "--enable-static", "--disable-shared", "--disable-examples", "--disable-crypttests", "--disable-mlkem"], - "cflags": "-DWOLFSSL_NO_MALLOC"}, + "extra_cflags": "-DWOLFSSL_NO_MALLOC"}, {"name": "tinytls13-combo-cert-mutualauth-sha384", "minutes": 1, "configure": ["--enable-tinytls13=cert,mutualauth,server,sha384", "--disable-mlkem"]}, {"name": "tinytls13-combo-cert-mldsa-sha384", "minutes": 1, diff --git a/tests/api/test_dtls.c b/tests/api/test_dtls.c index df6929b7676..1219f4fbc9a 100644 --- a/tests/api/test_dtls.c +++ b/tests/api/test_dtls.c @@ -4114,7 +4114,7 @@ static int test_wolfSSL_dtls_export_peers_set_peer(WOLFSSL* ssl, char* ip, int ipSz, unsigned short port, int fam) { (void)ssl; - if (ip[0] != -1 || ipSz != 1 || port != 1 || fam != 2) + if (ip[0] != (char)-1 || ipSz != 1 || port != 1 || fam != 2) return 0; return 1; } @@ -8868,7 +8868,7 @@ int test_dtls_cookie_flip_in_cb(void) EXPECT_DECLS; #if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS) && \ !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \ - !defined(WOLFSSL_NO_TLS12) + (!defined(WOLFSSL_NO_TLS12) || defined(WOLFSSL_DTLS13)) WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL; WOLFSSL *ssl_c = NULL, *ssl_s = NULL; struct test_memio_ctx io; @@ -9138,7 +9138,7 @@ static int test_dtls_export_etm_set_peer(WOLFSSL* ssl, char* ip, int ipSz, unsigned short port, int fam) { (void)ssl; - if (ip[0] != -1 || ipSz != 1 || port != 1 || fam != 2) + if (ip[0] != (char)-1 || ipSz != 1 || port != 1 || fam != 2) return 0; return 1; } @@ -9241,7 +9241,7 @@ static int test_dtls_export_set_peer(WOLFSSL* ssl, char* ip, int ipSz, unsigned short port, int fam) { (void)ssl; - if (ip[0] != -1 || ipSz != 1 || port != 1 || fam != 2) + if (ip[0] != (char)-1 || ipSz != 1 || port != 1 || fam != 2) return 0; return 1; } diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c index 80ea87ec8b7..a30111f04a2 100644 --- a/wolfcrypt/src/random.c +++ b/wolfcrypt/src/random.c @@ -810,8 +810,10 @@ static void RngAutoLockExit(WC_RNG* rng) #define RngAutoLockExit(rng) WC_DO_NOTHING #endif /* WC_RNG_HAVE_AUTO_LOCK */ +#ifndef CUSTOM_RAND_GENERATE_BLOCK static WARN_UNUSED_RESULT int wc_RNG_HealthTestLocal(WC_RNG* rng, int reseed, void* heap, int devId); +#endif #ifdef WOLFSSL_DRBG_SHA512 static WARN_UNUSED_RESULT int wc_RNG_HealthTest_SHA512_ex_internal( @@ -8279,6 +8281,7 @@ const FLASH_QUALIFIER byte outputB_data[] = { }; +#ifndef CUSTOM_RAND_GENERATE_BLOCK /* SHA-512 DRBG KAT vectors for local health test. * Source: NIST CAVP Hash_DRBG.rsp, [SHA-512], PredictionResistance=False, * EntropyInputLen=256, NonceLen=128, PersonalizationStringLen=0, @@ -8596,6 +8599,7 @@ static int wc_RNG_HealthTestLocal(WC_RNG* rng, int reseed, void* heap, return ret; } +#endif /* !CUSTOM_RAND_GENERATE_BLOCK */ /* ====================================================================== */ /* SHA-512 Health Test API */ diff --git a/wolfcrypt/src/wc_pkcs11.c b/wolfcrypt/src/wc_pkcs11.c index b3d2895b44c..1c713bff176 100644 --- a/wolfcrypt/src/wc_pkcs11.c +++ b/wolfcrypt/src/wc_pkcs11.c @@ -578,7 +578,11 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, int ret = 0; CK_RV rv = CKR_OK; #if !defined(HAVE_PKCS11_STATIC) && !defined(HAVE_PKCS11_V3_STATIC) - void* func; + union { + void* p; + CK_C_GetInterface getInterface; + CK_C_GetFunctionList getFunctionList; + } func; #endif CK_C_INITIALIZE_ARGS args; CK_VERSION_PTR version_ptr = NULL; @@ -694,8 +698,8 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, /* Check if the library supports PKCS#11 version 3.0 (or above) by * looking for the C_GetInterface method (only present for >= V3.0). */ - func = dlsym(dev->dlHandle, "C_GetInterface"); - if (func != NULL) { + func.p = dlsym(dev->dlHandle, "C_GetInterface"); + if (func.p != NULL) { /* Function is present, use it */ CK_INTERFACE_PTR interface = NULL; CK_VERSION pkcs11_version = {0, 0}; @@ -726,8 +730,8 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, version_ptr = NULL; } - rv = ((CK_C_GetInterface)func)((CK_UTF8CHAR_PTR) interfaceName, - version_ptr, &interface, 0); + rv = func.getInterface((CK_UTF8CHAR_PTR) interfaceName, + version_ptr, &interface, 0); if (rv == CKR_OK) { dev->func = interface->pFunctionList; version_ptr = (CK_VERSION_PTR) interface->pFunctionList; @@ -764,8 +768,8 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, else { /* Function not present, try a 2.x library by looking for * C_GetFunctionList. */ - func = dlsym(dev->dlHandle, "C_GetFunctionList"); - if (func == NULL) { + func.p = dlsym(dev->dlHandle, "C_GetFunctionList"); + if (func.p == NULL) { #if defined(_WIN32) WOLFSSL_MSG_EX("GetProcAddress(): %d", GetLastError()); #else @@ -774,7 +778,7 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, ret = WC_HW_E; } if (ret == 0) { - rv = ((CK_C_GetFunctionList)func)(&dev->func); + rv = func.getFunctionList(&dev->func); if (rv == CKR_OK) { version_ptr = (CK_VERSION_PTR) dev->func; if (version_ptr->major == 2 && diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 270f8b4e0b4..2d1d8537806 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -58790,10 +58790,6 @@ static wc_test_ret_t ecc_encrypt_gcm_kat(WC_RNG* rng) 0xd9, 0x89, 0xbd, 0xf8, 0x21, 0x55, 0x43, 0x88, 0x19 }; - if (ret == 0) { - ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_256_GCM, ecHKDF_SHA256, - enc_msg_256_hkdf, (word32)sizeof(enc_msg_256_hkdf)); - } #endif /* WOLFSSL_AES_256 */ #ifdef WOLFSSL_AES_128 @@ -58817,37 +58813,47 @@ static wc_test_ret_t ecc_encrypt_gcm_kat(WC_RNG* rng) 0x20,0xab,0x13,0xac,0xe9,0xcd,0x6d,0x89, 0xb0 }; +#ifdef HAVE_X963_KDF + /* AES-128-GCM, X9.63-KDF-SHA256, SEC1 format */ + WOLFSSL_SMALL_STACK_STATIC const byte enc_msg_128_x963[] = { + 0x04,0x7b,0x1a,0x46,0x41,0x7c,0x5e,0x64, + 0xb4,0x55,0x73,0x78,0xf1,0x7f,0xe9,0xbf, + 0xd9,0x01,0xdb,0x1a,0x5d,0xef,0x96,0x1c, + 0x78,0x58,0x1b,0x68,0x5f,0x5d,0xe4,0x40, + 0xcd,0x8f,0xdf,0x88,0xc5,0x06,0xc1,0x64, + 0x00,0x37,0x45,0xe0,0x6c,0xf0,0x61,0x70, + 0xda,0x2d,0x65,0xff,0xd2,0x59,0x5b,0x73, + 0x9d,0x4f,0x72,0x15,0x21,0xa5,0x54,0xbc, + 0x80,0x2f,0x0d,0x83,0x64,0x0e,0x41,0x2b, + 0x1e,0x61,0xbb,0x0c,0x98,0x37,0x0e,0xbe, + 0xf4,0xb2,0xf3,0xae,0x07,0x20,0x88,0x79, + 0xb3,0x08,0xca,0x73,0x2b,0xb3,0x26,0x8f, + 0x2b,0x22,0x05,0x57,0x4f,0x50,0x04,0xc1, + 0x51,0x9c,0xbb,0xb5,0xd2,0xad,0x3b,0x19, + 0x1c,0x14,0xc0,0xd5,0x81,0x60,0x34,0x79, + 0x04,0x26,0x18,0x20,0x2d,0xd7,0xda,0xa2, + 0x31 + }; +#endif /* HAVE_X963_KDF */ +#endif /* WOLFSSL_AES_128 */ + +#ifdef WOLFSSL_AES_256 + if (ret == 0) { + ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_256_GCM, ecHKDF_SHA256, + enc_msg_256_hkdf, (word32)sizeof(enc_msg_256_hkdf)); + } +#endif /* WOLFSSL_AES_256 */ + +#ifdef WOLFSSL_AES_128 if (ret == 0) { ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_128_GCM, ecHKDF_SHA256, enc_msg_128_hkdf, (word32)sizeof(enc_msg_128_hkdf)); } #ifdef HAVE_X963_KDF - /* AES-128-GCM, X9.63-KDF-SHA256, SEC1 format */ - { - WOLFSSL_SMALL_STACK_STATIC const byte enc_msg_128_x963[] = { - 0x04,0x7b,0x1a,0x46,0x41,0x7c,0x5e,0x64, - 0xb4,0x55,0x73,0x78,0xf1,0x7f,0xe9,0xbf, - 0xd9,0x01,0xdb,0x1a,0x5d,0xef,0x96,0x1c, - 0x78,0x58,0x1b,0x68,0x5f,0x5d,0xe4,0x40, - 0xcd,0x8f,0xdf,0x88,0xc5,0x06,0xc1,0x64, - 0x00,0x37,0x45,0xe0,0x6c,0xf0,0x61,0x70, - 0xda,0x2d,0x65,0xff,0xd2,0x59,0x5b,0x73, - 0x9d,0x4f,0x72,0x15,0x21,0xa5,0x54,0xbc, - 0x80,0x2f,0x0d,0x83,0x64,0x0e,0x41,0x2b, - 0x1e,0x61,0xbb,0x0c,0x98,0x37,0x0e,0xbe, - 0xf4,0xb2,0xf3,0xae,0x07,0x20,0x88,0x79, - 0xb3,0x08,0xca,0x73,0x2b,0xb3,0x26,0x8f, - 0x2b,0x22,0x05,0x57,0x4f,0x50,0x04,0xc1, - 0x51,0x9c,0xbb,0xb5,0xd2,0xad,0x3b,0x19, - 0x1c,0x14,0xc0,0xd5,0x81,0x60,0x34,0x79, - 0x04,0x26,0x18,0x20,0x2d,0xd7,0xda,0xa2, - 0x31 - }; - if (ret == 0) { - ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_128_GCM, - ecKDF_X963_SHA256, enc_msg_128_x963, - (word32)sizeof(enc_msg_128_x963)); - } + if (ret == 0) { + ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_128_GCM, + ecKDF_X963_SHA256, enc_msg_128_x963, + (word32)sizeof(enc_msg_128_x963)); } #endif /* HAVE_X963_KDF */ #endif /* WOLFSSL_AES_128 */