From 5664ad9d02d704c4ae7fb0e01dbe648f73521136 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 21 Oct 2026 23:29:56 +0200 Subject: [PATCH 1/9] CI: keep configure's warning set in os-check builds os-check handed its flags to parallel-make-check.py with --cflags, which becomes a make-time CFLAGS= and replaces the CFLAGS configure chose. That dropped wolfSSL's own warning set, so every os-check build compiled with neither -Wall nor -Wextra. Switching to --extra-cflags keeps that set, -Werror included now that configure adds it to out-of-tree builds. The entries that carried their own cflags or ldflags only repeated the job flags to survive the replacement: the two -m32 entries already pass CFLAGS=-m32 to configure, which the link line picks up as well, and cryptocb-curve25519-no-key-export only added -Werror. The user_settings entries and apple-native-cert-validation set an empty "cflags" to stay off the job flags. That key no longer opts out of anything, so it is dropped, and those entries now build with the job's -pedantic set and -Werror too. --- .github/configs/os-check-linux.json | 40 +++++------------------------ .github/configs/os-check-macos.json | 4 +-- .github/workflows/os-check.yml | 10 +++----- 3 files changed, 10 insertions(+), 44 deletions(-) diff --git a/.github/configs/os-check-linux.json b/.github/configs/os-check-linux.json index 90bc8cffd45..06c69fe9e9f 100644 --- a/.github/configs/os-check-linux.json +++ b/.github/configs/os-check-linux.json @@ -2,7 +2,6 @@ {"name": "user-settings-all-compat", "minutes": 9.5, "comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.", "user_settings": "examples/configs/user_settings_all.h", - "cflags": "", "configure": ["--enable-usersettings"], "prepare": [["sed", "-i", "s/if 0/if 1/", "user_settings.h"]]}, {"name": "session-cache-ref", "minutes": 3.2, "comment": "NO_SESSION_CACHE_REF is now the configure default, so --enable-session-cache-ref is the only way back onto the client cache reference path and the generation check on it is covered nowhere else. savesession adds the persistence paths that restore those generations.", @@ -157,10 +156,8 @@ {"name": "lms-xmss-verify-only", "minutes": 2.5, "configure": ["--enable-lms=small,verify-only", "--enable-xmss=small,verify-only"]}, {"name": "sp-4096-m32", "minutes": 1.2, - "comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.", - "configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"], - "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE", - "ldflags": "-m32"}, + "comment": "--enable-sp=4096 asks for 4096 bit RSA and DH through SP (WOLFSSL_SP_4096) while only FFDHE 2048 is compiled in, so the generic SP math has to size itself from that rather than the FFDHE list; runs rsa_4096_bits_test. Has to be 32 bit: settings.h pins SP_INT_BITS to 4096 by hand on x86_64 and aarch64, so a native build cannot catch the mis-sizing.", + "configure": ["--enable-sp=4096", "--enable-32bit", "CFLAGS=-m32"]}, {"name": "opensslall-rng-seed-cb", "minutes": 2.2, "configure": ["--enable-opensslall", "--enable-opensslextra", "CPPFLAGS=-DWC_RNG_SEED_CB"]}, {"name": "opensslall-ecc-zero-hash", "minutes": 2.2, @@ -268,7 +265,6 @@ {"name": "user-settings-all", "minutes": 2.0, "comment": "The user_settings.h header-driven build path is distinct from the autotools-driven --enable-all path; full make check.", "user_settings": "examples/configs/user_settings_all.h", - "cflags": "", "configure": ["--enable-usersettings"]}, {"name": "she-ext-cryptocb-sw-default", "minutes": 1.9, "configure": ["--enable-she=extended", "--enable-cryptocb", "--enable-cryptocbutils", @@ -304,12 +300,10 @@ "comment": "Key wrap with HAVE_AES_ECB so the RFC 3394 loops route each block through wc_AesEcb*; runs test_wc_CryptoCb_AesKeyWrapEcbCompose (key wrap composed from an ECB-only crypto callback).", "configure": ["--enable-cryptocb", "--enable-aeskeywrap=padding", "--enable-aesecb"]}, {"name": "aeskeywrap-padding-no-64bit", "minutes": 1.6, - "comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words. cflags must repeat this job's --cflags because a per-entry value replaces them, and it must carry -m32 or make compiles 64-bit and sp_int.h errors out.", + "comment": "Only build that compiles the NO_64BIT half of the IV check in wc_AesKeyUnWrap_Pad_ex; needs -m32 and no SHA-512/384, which want 64-bit words.", "configure": ["--enable-cryptonly", "--enable-aeskeywrap=padding", "--disable-sha512", "--disable-sha384", - "--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"], - "cflags": "-m32 -pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE", - "ldflags": "-m32"}, + "--enable-32bit", "CFLAGS=-m32", "CPPFLAGS=-DNO_64BIT"]}, {"name": "no-client-no-client-auth", "minutes": 1.6, "configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]}, {"name": "ascon-experimental", "minutes": 1.6, @@ -397,97 +391,76 @@ {"name": "testwolfcrypt-ca", "minutes": 1.0, "comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.", "user_settings": "examples/configs/user_settings_ca.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-dtls13", "minutes": 1.0, "user_settings": "examples/configs/user_settings_dtls13.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-ebsnet", "minutes": 1.0, "user_settings": "examples/configs/user_settings_EBSnet.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-eccnonblock", "minutes": 1.0, "user_settings": "examples/configs/user_settings_eccnonblock.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-curve25519nonblock", "minutes": 1.0, "user_settings": "examples/configs/user_settings_curve25519nonblock.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded", "minutes": 1.0, "comment": "Default profile of the embedded template: portable C, SP math all, TLS 1.3 client, ECC P-256 + AES-GCM.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-noheap", "minutes": 1.0, "comment": "Same template with the no-heap profile (WOLFSSL_NO_MALLOC/WOLFSSL_SP_NO_MALLOC via WC_CFG_HEAP 0), which is the configuration its stack-only constraints apply to.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_HEAP=0", "WC_CFG_SMALL_STACK=0"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-cryptonly", "minutes": 1.0, "comment": "wolfCrypt-only profile (both TLS versions off), which exercises the WOLFCRYPT_ONLY/NO_TLS path and the derived WC_CFG_TLS.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_TLS13=0"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-spmath", "minutes": 1.0, "comment": "Restricted SP math (WOLFSSL_SP_MATH) with the assembly off, covering the other math back end and the WC_CFG_ASM_SP 0 path.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_MATH_ALL_SIZES=0", "WC_CFG_ASM_SP=0"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-embedded-maxed", "minutes": 1.0, "comment": "Wide profile: RSA, DH, the extra curves, X25519/Ed25519, ML-KEM and ML-DSA, every digest, ChaCha-Poly and the size knobs off.", "user_settings": "examples/configs/user_settings_embedded.h", - "cflags": "", "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_SMALL=0", "WC_CFG_RSA=1", "WC_CFG_DH=1", "WC_CFG_ECC_P384=1", "WC_CFG_CURVE25519=1", "WC_CFG_ED25519=1", "WC_CFG_MLKEM=1", "WC_CFG_MLDSA=1", "WC_CFG_SHA224=1", "WC_CFG_SHA3=1", "WC_CFG_CHACHA_POLY=1"]], "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-min-ecc", "minutes": 1.0, "user_settings": "examples/configs/user_settings_min_ecc.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-openssl-compat", "minutes": 1.0, "user_settings": "examples/configs/user_settings_openssl_compat.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-pkcs7", "minutes": 1.0, "user_settings": "examples/configs/user_settings_pkcs7.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-pq", "minutes": 1.0, "comment": "ML-KEM + ML-DSA post-quantum profile. Builds without --enable-experimental; testwolfcrypt runs the ML-DSA KATs.", "user_settings": "examples/configs/user_settings_pq.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-rsa-only", "minutes": 1.0, "user_settings": "examples/configs/user_settings_rsa_only.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-template", "minutes": 1.0, "user_settings": "examples/configs/user_settings_template.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-tls12", "minutes": 1.0, "user_settings": "examples/configs/user_settings_tls12.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-tls13", "minutes": 1.0, "user_settings": "examples/configs/user_settings_tls13.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-wolfboot-keytools", "minutes": 1.0, "user_settings": "examples/configs/user_settings_wolfboot_keytools.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-wolfssh", "minutes": 1.0, "user_settings": "examples/configs/user_settings_wolfssh.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"name": "testwolfcrypt-wolftpm", "minutes": 1.0, "user_settings": "examples/configs/user_settings_wolftpm.h", - "cflags": "", "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]}, {"comment": "WOLFSSL_NO_ASN_STRICT still enforces the RFC 5280 4.2 and 4.2.1.10 MUSTs", "name": "no-asn-strict-certs", @@ -539,11 +512,10 @@ {"name": "no-examples-no-malloc", "minutes": 0.8, "configure": ["--disable-examples", "CPPFLAGS=-DWOLFSSL_NO_MALLOC"]}, {"name": "cryptocb-curve25519-no-key-export", "minutes": 0.3, - "comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. cflags repeats this job's --cflags because a per-entry value replaces them, and adds -Werror so an unreferenced static fails instead of scrolling past as a warning. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.", + "comment": "Crypto callbacks with the curve25519 public key export compiled out. This is the one build shape where curve25519_key_make_pub has to be held by its key generation call site alone, and nothing else in CI compiles that half, so a guard mismatched against the call sites goes unnoticed. wolfCrypt only with examples off: src/internal.c and src/tls.c call wc_curve25519_export_public_ex unconditionally, so NO_CURVE25519_KEY_EXPORT cannot link against TLS and tests/unit.test cannot be built.", "configure": ["--enable-cryptonly", "--enable-cryptocb", "--enable-curve25519", "--enable-keygen", "--disable-examples", - "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"], - "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror"}, + "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"]}, {"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false, "comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.", "configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource", diff --git a/.github/configs/os-check-macos.json b/.github/configs/os-check-macos.json index 51f74df52fb..a8e081448b5 100644 --- a/.github/configs/os-check-macos.json +++ b/.github/configs/os-check-macos.json @@ -10,11 +10,9 @@ {"name": "user-settings-all", "minutes": 1.5, "comment": "The user_settings.h header-driven build path under Apple clang: macOS-specific guard ordering (e.g. WOLFSSL_SYS_CA_CERTS pulling in Security.framework) is distinct from the autotools --enable-all path above.", "user_settings": "examples/configs/user_settings_all.h", - "cflags": "", "configure": ["--enable-usersettings"]}, {"name": "apple-native-cert-validation", "minutes": 1.5, - "comment": "Former macos-apple-native-cert-validation.yml workflow: WOLFSSL_APPLE_NATIVE_CERT_VALIDATION delegates chain verification to Security.framework instead of wolfSSL's verifier, and the TEST define enables its client tests in make check. CFLAGS go to configure (with \"cflags\": \"\" so the make-time --cflags do not override them), exactly like the old standalone job.", - "cflags": "", + "comment": "Former macos-apple-native-cert-validation.yml workflow: WOLFSSL_APPLE_NATIVE_CERT_VALIDATION delegates chain verification to Security.framework instead of wolfSSL's verifier, and the TEST define enables its client tests in make check. CFLAGS go to configure, exactly like the old standalone job.", "configure": ["CFLAGS=-DWOLFSSL_APPLE_NATIVE_CERT_VALIDATION -DWOLFSSL_TEST_APPLE_NATIVE_CERT_VALIDATION -DRSA_MIN_SIZE=2048 -DNO_WOLFSSL_CIPHER_SUITE_TEST"]}, {"name": "cryptocb-swdev-ed25519", "minutes": 1.0, "comment": "swdev built with Apple ld64: tests/swdev/Makefile localizes its symbols with ld -r -exported_symbol instead of objcopy. CB_ONLY_ED25519 strips software Ed25519, so make check fails unless the swdev callback is linked and reachable.", diff --git a/.github/workflows/os-check.yml b/.github/workflows/os-check.yml index 0061c3b56da..e4d1eded6d2 100644 --- a/.github/workflows/os-check.yml +++ b/.github/workflows/os-check.yml @@ -244,18 +244,14 @@ jobs: # refresh later - a stale value only packs the schedule worse. The # list is kept sorted by minutes for readability, but the schedule # sorts by the values, not list order. - # The CFLAGS that were previously passed to configure are applied at - # make time via --cflags, unchanged. --private-dir=certs gives every - # build dir its own certs/ copy: crl-gen-openssl.test writes generated - # CRLs under certs/crl/, which would race through the shared VPATH - # certs symlink. + # --private-dir=certs stops crl-gen-openssl.test racing on certs/crl/. - name: Build and make check this shard's configs (parallel, out-of-tree) if: ${{ env.SEED_DECLINED != 'true' }} run: | .github/scripts/parallel-make-check.py \ ${{ (github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/master') || (github.event_name == 'workflow_dispatch' && github.event.inputs.seed != 'false')) && '--build-only' || '' }} \ --shard "${{ matrix.shard }}/${{ strategy.job-total }}" \ - --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ + --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ --private-dir=certs .github/configs/os-check-linux.json # Seed runs (a push to master, the cron, or a manual dispatch with @@ -377,7 +373,7 @@ jobs: .github/scripts/parallel-make-check.py \ ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.seed != 'false')) && '--build-only' || '' }} \ --threads 1 --cc= \ - --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ + --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ --private-dir=certs .github/configs/os-check-macos.json - name: ccache stats From c9d36fe7754dfb83102e951594283aaec3ef1a9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 22 Oct 2026 09:17:22 +0200 Subject: [PATCH 2/9] CI: keep configure's warning set in enterprise builds enterprise.yml handed its flags to parallel-make-check.py with --cflags, the same way os-check did, so the enterprise configs compiled without wolfSSL's warning set and without -Werror. Pass them with --extra-cflags as os-check now does. --- .github/workflows/enterprise.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/enterprise.yml b/.github/workflows/enterprise.yml index e8a321a1556..ef1956e85e3 100644 --- a/.github/workflows/enterprise.yml +++ b/.github/workflows/enterprise.yml @@ -89,7 +89,7 @@ jobs: .github/scripts/parallel-make-check.py \ ${{ github.event_name == 'schedule' && '--build-only' || '' }} \ --shard "${{ matrix.shard }}/${{ strategy.job-total }}" \ - --cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ + --extra-cflags='-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE' \ --private-dir=certs \ .github/configs/enterprise.json From 042f9f77d8fd5097ccfa750bd5605fa150061fdc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 22 Oct 2026 10:20:02 +0200 Subject: [PATCH 3/9] CI: keep configure's warning set in afalg and tinytls13 builds Both afalg configs and three tinytls13 configs set a per-entry "cflags", which replaces configure's CFLAGS at make time and takes -Wall, -Wextra and -Werror with it. Use "extra_cflags" so the flags are added instead. --- .github/workflows/afalg.yml | 4 ++-- .github/workflows/tinytls13.yml | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/afalg.yml b/.github/workflows/afalg.yml index 2b47ac75013..101f66f1d21 100644 --- a/.github/workflows/afalg.yml +++ b/.github/workflows/afalg.yml @@ -166,14 +166,14 @@ jobs: [ {"name": "defaults-afalg", "minutes": 2, "configure": ["--enable-afalg"], - "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"}, + "extra_cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"}, {"name": "all-afalg", "minutes": 5, "configure": ["--enable-all", "--enable-testcert", "--enable-acert", "--enable-dtls13", "--enable-dtls-mtu", "--enable-dtls-frag-ch", "--enable-dtlscid", "--enable-quic", "--enable-afalg", "--disable-srtp", "--disable-sha224", "--disable-hashflags", "--disable-cryptocb", "--disable-aesgcm-stream"], - "cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"} + "extra_cflags": "-pedantic -Wdeclaration-after-statement -Wnull-dereference -Wno-overlength-strings"} ] EOF .github/scripts/parallel-make-check.py \ diff --git a/.github/workflows/tinytls13.yml b/.github/workflows/tinytls13.yml index f8b51ce4aa9..1587ede599f 100644 --- a/.github/workflows/tinytls13.yml +++ b/.github/workflows/tinytls13.yml @@ -99,12 +99,12 @@ jobs: "configure": ["--enable-tinytls13=cert,server,asm", "--disable-mlkem"]}, {"name": "tinytls13-cert-chacha", "minutes": 1, "check": false, "configure": ["--enable-tinytls13=cert,server", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"], - "cflags": "-DHAVE_CHACHA -DHAVE_POLY1305", + "extra_cflags": "-DHAVE_CHACHA -DHAVE_POLY1305", "run": [["cc", "-I.", "-I..", "../examples/tls13/tls13_memio.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tls13_memio"], ["./tls13_memio", "TLS13-CHACHA20-POLY1305-SHA256"]]}, {"name": "tinytls13-cert-aes256", "minutes": 1, "check": false, "configure": ["--enable-tinytls13=cert,server,sha384", "--enable-static", "--disable-shared", "--disable-examples", "--disable-mlkem"], - "cflags": "-DWOLFSSL_AES_256", + "extra_cflags": "-DWOLFSSL_AES_256", "run": [["cc", "-I.", "-I..", "../examples/tls13/tls13_memio.c", "src/.libs/libwolfssl.a", "-lm", "-o", "tls13_memio"], ["./tls13_memio", "TLS13-AES256-GCM-SHA384"]]}, {"name": "tinytls13-psk-mlkem", "minutes": 1, @@ -118,7 +118,7 @@ jobs: ["./tls13_memio"]]}, {"name": "tinytls13-nomalloc", "minutes": 1, "check": false, "configure": ["--enable-tinytls13=psk,server,staticmem", "--enable-static", "--disable-shared", "--disable-examples", "--disable-crypttests", "--disable-mlkem"], - "cflags": "-DWOLFSSL_NO_MALLOC"}, + "extra_cflags": "-DWOLFSSL_NO_MALLOC"}, {"name": "tinytls13-combo-cert-mutualauth-sha384", "minutes": 1, "configure": ["--enable-tinytls13=cert,mutualauth,server,sha384", "--disable-mlkem"]}, {"name": "tinytls13-combo-cert-mldsa-sha384", "minutes": 1, From a6b645d50835a1ac6d8a2617ed46c5c747062edc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Thu, 22 Oct 2026 10:20:02 +0200 Subject: [PATCH 4/9] CI: warn about an empty cflags in parallel-make-check configs An empty "cflags" only overrides a global --cflags. Without one it does nothing, yet it reads like an opt-out from the job flags, which is how the 25 dead entries removed from the os-check configs came about. Warn about it and name "extra_cflags": "" as the opt-out from --extra-cflags. --- .github/scripts/parallel-make-check.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/scripts/parallel-make-check.py b/.github/scripts/parallel-make-check.py index 230c4caa68f..a1705dee16e 100755 --- a/.github/scripts/parallel-make-check.py +++ b/.github/scripts/parallel-make-check.py @@ -308,6 +308,10 @@ def load_configs(opts: argparse.Namespace, for key in ("cflags", "extra_cflags", "ldflags"): if not isinstance(entry.get(key, ""), str): error(f"{opts.json}: \"{key}\" must be a string in {name!r}") + if entry.get("cflags") == "" and not opts.cflags: + warn(f"{opts.json}: empty \"cflags\" in {name!r} has no effect " + f"without --cflags; \"extra_cflags\": \"\" opts out of " + f"--extra-cflags") minutes = entry.get("minutes", 1.0) if isinstance(minutes, bool) or not isinstance(minutes, (int, float)) \ or minutes < 0: From e8a7a4825b89118ab0725b10d4c3bdefde05a349 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 21 Oct 2026 23:29:56 +0200 Subject: [PATCH 5/9] Run the DTLS cookie flip test on DTLS 1.3 too test_dtls_cookie_flip_in_cb required TLS 1.2 while its callback, test_dtls_ch_flip_cb, is compiled whenever TLS 1.2 or DTLS 1.3 is available. A --disable-tlsv12 --enable-dtls13 build defined the callback without using it and failed with -Wunused-function. Give the test the same guard as its neighbours. It passes on DTLS 1.3 unchanged, so it gains coverage instead of hiding the callback. --- tests/api/test_dtls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/api/test_dtls.c b/tests/api/test_dtls.c index df6929b7676..0cf0d589b4a 100644 --- a/tests/api/test_dtls.c +++ b/tests/api/test_dtls.c @@ -8868,7 +8868,7 @@ int test_dtls_cookie_flip_in_cb(void) EXPECT_DECLS; #if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS) && \ !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \ - !defined(WOLFSSL_NO_TLS12) + (!defined(WOLFSSL_NO_TLS12) || defined(WOLFSSL_DTLS13)) WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL; WOLFSSL *ssl_c = NULL, *ssl_s = NULL; struct test_memio_ctx io; From 7243f673522718ccc9ace21a65dc3dd6e38363bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 21 Oct 2026 23:29:56 +0200 Subject: [PATCH 6/9] Compile the local RNG health test only when it is used wc_RNG_HealthTestLocal() and the SHA-512 vectors only it reads were built under HAVE_HASHDRBG, while every caller also requires !CUSTOM_RAND_GENERATE_BLOCK. Defining both, as the rng-custom-block-hashdrbg configuration does, left the function unused and failed the build with -Wunused-function. --- wolfcrypt/src/random.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c index 80ea87ec8b7..a30111f04a2 100644 --- a/wolfcrypt/src/random.c +++ b/wolfcrypt/src/random.c @@ -810,8 +810,10 @@ static void RngAutoLockExit(WC_RNG* rng) #define RngAutoLockExit(rng) WC_DO_NOTHING #endif /* WC_RNG_HAVE_AUTO_LOCK */ +#ifndef CUSTOM_RAND_GENERATE_BLOCK static WARN_UNUSED_RESULT int wc_RNG_HealthTestLocal(WC_RNG* rng, int reseed, void* heap, int devId); +#endif #ifdef WOLFSSL_DRBG_SHA512 static WARN_UNUSED_RESULT int wc_RNG_HealthTest_SHA512_ex_internal( @@ -8279,6 +8281,7 @@ const FLASH_QUALIFIER byte outputB_data[] = { }; +#ifndef CUSTOM_RAND_GENERATE_BLOCK /* SHA-512 DRBG KAT vectors for local health test. * Source: NIST CAVP Hash_DRBG.rsp, [SHA-512], PredictionResistance=False, * EntropyInputLen=256, NonceLen=128, PersonalizationStringLen=0, @@ -8596,6 +8599,7 @@ static int wc_RNG_HealthTestLocal(WC_RNG* rng, int reseed, void* heap, return ret; } +#endif /* !CUSTOM_RAND_GENERATE_BLOCK */ /* ====================================================================== */ /* SHA-512 Health Test API */ From e167493740cfd3b89ef61977d74c15c82f24ab71 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 21 Oct 2026 23:29:56 +0200 Subject: [PATCH 7/9] Load PKCS#11 entry points without an object-to-function cast wc_Pkcs11_Initialize_v3() cast the void* from dlsym() straight to CK_C_GetInterface and CK_C_GetFunctionList. ISO C does not allow that conversion, so -pedantic -Werror builds of the dynamic loader failed. Go through a union of the data pointer and both function pointer types. --- wolfcrypt/src/wc_pkcs11.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/wolfcrypt/src/wc_pkcs11.c b/wolfcrypt/src/wc_pkcs11.c index b3d2895b44c..1c713bff176 100644 --- a/wolfcrypt/src/wc_pkcs11.c +++ b/wolfcrypt/src/wc_pkcs11.c @@ -578,7 +578,11 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, int ret = 0; CK_RV rv = CKR_OK; #if !defined(HAVE_PKCS11_STATIC) && !defined(HAVE_PKCS11_V3_STATIC) - void* func; + union { + void* p; + CK_C_GetInterface getInterface; + CK_C_GetFunctionList getFunctionList; + } func; #endif CK_C_INITIALIZE_ARGS args; CK_VERSION_PTR version_ptr = NULL; @@ -694,8 +698,8 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, /* Check if the library supports PKCS#11 version 3.0 (or above) by * looking for the C_GetInterface method (only present for >= V3.0). */ - func = dlsym(dev->dlHandle, "C_GetInterface"); - if (func != NULL) { + func.p = dlsym(dev->dlHandle, "C_GetInterface"); + if (func.p != NULL) { /* Function is present, use it */ CK_INTERFACE_PTR interface = NULL; CK_VERSION pkcs11_version = {0, 0}; @@ -726,8 +730,8 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, version_ptr = NULL; } - rv = ((CK_C_GetInterface)func)((CK_UTF8CHAR_PTR) interfaceName, - version_ptr, &interface, 0); + rv = func.getInterface((CK_UTF8CHAR_PTR) interfaceName, + version_ptr, &interface, 0); if (rv == CKR_OK) { dev->func = interface->pFunctionList; version_ptr = (CK_VERSION_PTR) interface->pFunctionList; @@ -764,8 +768,8 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, else { /* Function not present, try a 2.x library by looking for * C_GetFunctionList. */ - func = dlsym(dev->dlHandle, "C_GetFunctionList"); - if (func == NULL) { + func.p = dlsym(dev->dlHandle, "C_GetFunctionList"); + if (func.p == NULL) { #if defined(_WIN32) WOLFSSL_MSG_EX("GetProcAddress(): %d", GetLastError()); #else @@ -774,7 +778,7 @@ int wc_Pkcs11_Initialize_v3(Pkcs11Dev* dev, const char* library, ret = WC_HW_E; } if (ret == 0) { - rv = ((CK_C_GetFunctionList)func)(&dev->func); + rv = func.getFunctionList(&dev->func); if (rv == CKR_OK) { version_ptr = (CK_VERSION_PTR) dev->func; if (version_ptr->major == 2 && From ea56de2553a3d3b41a7553f00c1fcd1eec442d31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 21 Oct 2026 23:29:56 +0200 Subject: [PATCH 8/9] Keep ecc_encrypt_gcm_kat declarations ahead of code The AES-128 vector was declared after the AES-256 case had already run, a declaration after a statement that -Wdeclaration-after-statement rejects whenever both key sizes are enabled. Declare all vectors first and run the cases after them, which also retires the bare block the X9.63 vector was declared in. --- wolfcrypt/test/test.c | 66 +++++++++++++++++++++++-------------------- 1 file changed, 36 insertions(+), 30 deletions(-) diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 270f8b4e0b4..2d1d8537806 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -58790,10 +58790,6 @@ static wc_test_ret_t ecc_encrypt_gcm_kat(WC_RNG* rng) 0xd9, 0x89, 0xbd, 0xf8, 0x21, 0x55, 0x43, 0x88, 0x19 }; - if (ret == 0) { - ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_256_GCM, ecHKDF_SHA256, - enc_msg_256_hkdf, (word32)sizeof(enc_msg_256_hkdf)); - } #endif /* WOLFSSL_AES_256 */ #ifdef WOLFSSL_AES_128 @@ -58817,37 +58813,47 @@ static wc_test_ret_t ecc_encrypt_gcm_kat(WC_RNG* rng) 0x20,0xab,0x13,0xac,0xe9,0xcd,0x6d,0x89, 0xb0 }; +#ifdef HAVE_X963_KDF + /* AES-128-GCM, X9.63-KDF-SHA256, SEC1 format */ + WOLFSSL_SMALL_STACK_STATIC const byte enc_msg_128_x963[] = { + 0x04,0x7b,0x1a,0x46,0x41,0x7c,0x5e,0x64, + 0xb4,0x55,0x73,0x78,0xf1,0x7f,0xe9,0xbf, + 0xd9,0x01,0xdb,0x1a,0x5d,0xef,0x96,0x1c, + 0x78,0x58,0x1b,0x68,0x5f,0x5d,0xe4,0x40, + 0xcd,0x8f,0xdf,0x88,0xc5,0x06,0xc1,0x64, + 0x00,0x37,0x45,0xe0,0x6c,0xf0,0x61,0x70, + 0xda,0x2d,0x65,0xff,0xd2,0x59,0x5b,0x73, + 0x9d,0x4f,0x72,0x15,0x21,0xa5,0x54,0xbc, + 0x80,0x2f,0x0d,0x83,0x64,0x0e,0x41,0x2b, + 0x1e,0x61,0xbb,0x0c,0x98,0x37,0x0e,0xbe, + 0xf4,0xb2,0xf3,0xae,0x07,0x20,0x88,0x79, + 0xb3,0x08,0xca,0x73,0x2b,0xb3,0x26,0x8f, + 0x2b,0x22,0x05,0x57,0x4f,0x50,0x04,0xc1, + 0x51,0x9c,0xbb,0xb5,0xd2,0xad,0x3b,0x19, + 0x1c,0x14,0xc0,0xd5,0x81,0x60,0x34,0x79, + 0x04,0x26,0x18,0x20,0x2d,0xd7,0xda,0xa2, + 0x31 + }; +#endif /* HAVE_X963_KDF */ +#endif /* WOLFSSL_AES_128 */ + +#ifdef WOLFSSL_AES_256 + if (ret == 0) { + ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_256_GCM, ecHKDF_SHA256, + enc_msg_256_hkdf, (word32)sizeof(enc_msg_256_hkdf)); + } +#endif /* WOLFSSL_AES_256 */ + +#ifdef WOLFSSL_AES_128 if (ret == 0) { ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_128_GCM, ecHKDF_SHA256, enc_msg_128_hkdf, (word32)sizeof(enc_msg_128_hkdf)); } #ifdef HAVE_X963_KDF - /* AES-128-GCM, X9.63-KDF-SHA256, SEC1 format */ - { - WOLFSSL_SMALL_STACK_STATIC const byte enc_msg_128_x963[] = { - 0x04,0x7b,0x1a,0x46,0x41,0x7c,0x5e,0x64, - 0xb4,0x55,0x73,0x78,0xf1,0x7f,0xe9,0xbf, - 0xd9,0x01,0xdb,0x1a,0x5d,0xef,0x96,0x1c, - 0x78,0x58,0x1b,0x68,0x5f,0x5d,0xe4,0x40, - 0xcd,0x8f,0xdf,0x88,0xc5,0x06,0xc1,0x64, - 0x00,0x37,0x45,0xe0,0x6c,0xf0,0x61,0x70, - 0xda,0x2d,0x65,0xff,0xd2,0x59,0x5b,0x73, - 0x9d,0x4f,0x72,0x15,0x21,0xa5,0x54,0xbc, - 0x80,0x2f,0x0d,0x83,0x64,0x0e,0x41,0x2b, - 0x1e,0x61,0xbb,0x0c,0x98,0x37,0x0e,0xbe, - 0xf4,0xb2,0xf3,0xae,0x07,0x20,0x88,0x79, - 0xb3,0x08,0xca,0x73,0x2b,0xb3,0x26,0x8f, - 0x2b,0x22,0x05,0x57,0x4f,0x50,0x04,0xc1, - 0x51,0x9c,0xbb,0xb5,0xd2,0xad,0x3b,0x19, - 0x1c,0x14,0xc0,0xd5,0x81,0x60,0x34,0x79, - 0x04,0x26,0x18,0x20,0x2d,0xd7,0xda,0xa2, - 0x31 - }; - if (ret == 0) { - ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_128_GCM, - ecKDF_X963_SHA256, enc_msg_128_x963, - (word32)sizeof(enc_msg_128_x963)); - } + if (ret == 0) { + ret = ecc_encrypt_gcm_kat_vec(rng, ecAES_128_GCM, + ecKDF_X963_SHA256, enc_msg_128_x963, + (word32)sizeof(enc_msg_128_x963)); } #endif /* HAVE_X963_KDF */ #endif /* WOLFSSL_AES_128 */ From 074664f432498e1ad0e0415ca05dd97ea2911102 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Frauenschl=C3=A4ger?= Date: Wed, 21 Oct 2026 23:29:56 +0200 Subject: [PATCH 9/9] Compare the DTLS export test address byte as a char The dummy get_peer callbacks store -1 in ip[0] and the set_peer callbacks compared ip[0] against -1. Where char is unsigned, as on Linux aarch64, the stored byte reads back as 255, so the comparison was always true and -Wtype-limits failed the build. Compare against (char)-1. --- tests/api/test_dtls.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/api/test_dtls.c b/tests/api/test_dtls.c index 0cf0d589b4a..1219f4fbc9a 100644 --- a/tests/api/test_dtls.c +++ b/tests/api/test_dtls.c @@ -4114,7 +4114,7 @@ static int test_wolfSSL_dtls_export_peers_set_peer(WOLFSSL* ssl, char* ip, int ipSz, unsigned short port, int fam) { (void)ssl; - if (ip[0] != -1 || ipSz != 1 || port != 1 || fam != 2) + if (ip[0] != (char)-1 || ipSz != 1 || port != 1 || fam != 2) return 0; return 1; } @@ -9138,7 +9138,7 @@ static int test_dtls_export_etm_set_peer(WOLFSSL* ssl, char* ip, int ipSz, unsigned short port, int fam) { (void)ssl; - if (ip[0] != -1 || ipSz != 1 || port != 1 || fam != 2) + if (ip[0] != (char)-1 || ipSz != 1 || port != 1 || fam != 2) return 0; return 1; } @@ -9241,7 +9241,7 @@ static int test_dtls_export_set_peer(WOLFSSL* ssl, char* ip, int ipSz, unsigned short port, int fam) { (void)ssl; - if (ip[0] != -1 || ipSz != 1 || port != 1 || fam != 2) + if (ip[0] != (char)-1 || ipSz != 1 || port != 1 || fam != 2) return 0; return 1; }