From 21a7d1af96bacdfd3f06673181fabe567493d7ef Mon Sep 17 00:00:00 2001 From: Michael Rogov Papernov Date: Thu, 22 Oct 2026 11:41:39 +0100 Subject: [PATCH 1/3] Shrink the wc_GetErrorString() lookup table wolfCrypt error codes sit in two spans, -97..-300 and -1000..-1999. The switch in wc_GetErrorString() covers both, so compilers that lower it to a lookup table (GCC -O2/-Os, clang) build one table from 0 to the last span 2 code, with an entry for each of the ~800 unused codes, most of them between the spans. Move span 2 to just below span 1 before the switch, so the table covers one dense range. Output is unchanged for every input. Error code values are not changed; the remapping is internal to the function. On Cortex-M4 with arm-none-eabi-gcc -Os, the table shrinks from 4172 to 1376 bytes and error.o from 12911 to 10135 bytes. The switch now runs on remapped values, so the enum cast that lets -Wswitch-enum catch a code without a string moves to a new, never called wc_ErrorStringsCheck() that lists every code. error_test() still checks that every code in both spans has a string. --- wolfcrypt/src/error.c | 377 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 329 insertions(+), 48 deletions(-) diff --git a/wolfcrypt/src/error.c b/wolfcrypt/src/error.c index 58fd73c456d..d8410633cf9 100644 --- a/wolfcrypt/src/error.c +++ b/wolfcrypt/src/error.c @@ -36,10 +36,294 @@ wc_static_assert((int)WC_LAST_E <= (int)WC_SPAN2_LAST_E); wc_static_assert((int)MIN_CODE_E <= (int)WC_LAST_E); wc_static_assert((int)MIN_CODE_E <= (int)WC_SPAN2_MIN_CODE_E); +static const char wc_unknown_error_str[] = "unknown error number"; + +/* The value wc_GetErrorString() switches on for a span 2 error code: span 2 + * moved to just below span 1. */ +#define WC_SPAN2_TO_IDX(e) \ + ((e) - (int)WC_SPAN2_FIRST_E + (int)WC_SPAN1_MIN_CODE_E - 1) + +/* Never called. Lists every error code in a switch on the enum, so that + * -Wswitch-enum reports a code added without a case here. Each code listed + * here must also have a string in wc_GetErrorString(), which switches on + * remapped values and so cannot be checked by the compiler. error_test() + * checks that every code has a string. + */ +static WC_MAYBE_UNUSED void wc_ErrorStringsCheck(int error) +{ + switch ((enum wolfCrypt_ErrorCodes)error) { + case WC_SUCCESS: + case WC_FAILURE: + case MP_MEM: + case MP_VAL: + case MP_WOULDBLOCK: + case MP_NOT_INF: + case OPEN_RAN_E: + case READ_RAN_E: + case WINCRYPT_E: + case CRYPTGEN_E: + case RAN_BLOCK_E: + case BAD_MUTEX_E: + case WC_TIMEOUT_E: + case WC_PENDING_E: + case WC_NO_PENDING_E: + case MP_INIT_E: + case MP_READ_E: + case MP_EXPTMOD_E: + case MP_TO_E: + case MP_SUB_E: + case MP_ADD_E: + case MP_MUL_E: + case MP_MULMOD_E: + case MP_MOD_E: + case MP_INVMOD_E: + case MP_CMP_E: + case MP_ZERO_E: + case MEMORY_E: + case VAR_STATE_CHANGE_E: + case RSA_WRONG_TYPE_E: + case RSA_BUFFER_E: + case BUFFER_E: + case ALGO_ID_E: + case PUBLIC_KEY_E: + case DATE_E: + case SUBJECT_E: + case ISSUER_E: + case CA_TRUE_E: + case EXTENSIONS_E: + case ASN_PARSE_E: + case ASN_VERSION_E: + case ASN_GETINT_E: + case ASN_RSA_KEY_E: + case ASN_OBJECT_ID_E: + case ASN_TAG_NULL_E: + case ASN_EXPECT_0_E: + case ASN_BITSTR_E: + case ASN_UNKNOWN_OID_E: + case ASN_DATE_SZ_E: + case ASN_BEFORE_DATE_E: + case ASN_AFTER_DATE_E: + case ASN_SIG_OID_E: + case ASN_TIME_E: + case ASN_INPUT_E: + case ASN_SIG_CONFIRM_E: + case ASN_SIG_HASH_E: + case ASN_SIG_KEY_E: + case ASN_DH_KEY_E: + case ASN_CRIT_EXT_E: + case ASN_ALT_NAME_E: + case ECC_BAD_ARG_E: + case ASN_ECC_KEY_E: + case ECC_CURVE_OID_E: + case BAD_FUNC_ARG: + case NOT_COMPILED_IN: + case UNICODE_SIZE_E: + case NO_PASSWORD: + case ALT_NAME_E: + case AES_GCM_AUTH_E: + case AES_CCM_AUTH_E: + case AES_SIV_AUTH_E: + case ASYNC_INIT_E: + case COMPRESS_INIT_E: + case COMPRESS_E: + case DECOMPRESS_INIT_E: + case DECOMPRESS_E: + case BAD_ALIGN_E: + case ASN_NO_SIGNER_E: + case ASN_CRL_CONFIRM_E: + case ASN_CRL_NO_SIGNER_E: + case CRL_CERT_DATE_ERR: + case ASN_OCSP_CONFIRM_E: + case ASN_NO_PEM_HEADER: + case BAD_STATE_E: + case BAD_PADDING_E: + case REQ_ATTRIBUTE_E: + case PKCS7_OID_E: + case PKCS7_RECIP_E: + case WC_PKCS7_WANT_READ_E: + case FIPS_NOT_ALLOWED_E: + case ASN_NAME_INVALID_E: + case RNG_FAILURE_E: + case HMAC_MIN_KEYLEN_E: + case RSA_PAD_E: + case LENGTH_ONLY_E: + case IN_CORE_FIPS_E: + case AES_KAT_FIPS_E: + case DES3_KAT_FIPS_E: + case HMAC_KAT_FIPS_E: + case RSA_KAT_FIPS_E: + case DRBG_KAT_FIPS_E: + case DRBG_CONT_FIPS_E: + case AESGCM_KAT_FIPS_E: + case THREAD_STORE_KEY_E: + case THREAD_STORE_SET_E: + case MAC_CMP_FAILED_E: + case IS_POINT_E: + case ECC_INF_E: + case ECC_OUT_OF_RANGE_E: + case ECC_PRIV_KEY_E: + case SRP_CALL_ORDER_E: + case SRP_VERIFY_E: + case SRP_BAD_KEY_E: + case ASN_NO_SKID: + case ASN_NO_AKID: + case ASN_NO_KEYUSAGE: + case SKID_E: + case AKID_E: + case KEYUSAGE_E: + case EXTKEYUSAGE_E: + case CERTPOLICIES_E: + case WC_INIT_E: + case SIG_VERIFY_E: + case BAD_COND_E: + case SIG_TYPE_E: + case HASH_TYPE_E: + case WC_KEY_SIZE_E: + case ASN_COUNTRY_SIZE_E: + case MISSING_RNG_E: + case ASN_PATHLEN_SIZE_E: + case ASN_PATHLEN_INV_E: + case BAD_KEYWRAP_ALG_E: + case BAD_KEYWRAP_IV_E: + case WC_CLEANUP_E: + case ECC_CDH_KAT_FIPS_E: + case DH_CHECK_PUB_E: + case BAD_PATH_ERROR: + case ASYNC_OP_E: + case BAD_OCSP_RESPONDER: + case ECC_PRIVATEONLY_E: + case WC_HW_E: + case WC_HW_WAIT_E: + case PSS_SALTLEN_E: + case PRIME_GEN_E: + case BER_INDEF_E: + case RSA_OUT_OF_RANGE_E: + case RSAPSS_PAT_FIPS_E: + case ECDSA_PAT_FIPS_E: + case DH_KAT_FIPS_E: + case AESCCM_KAT_FIPS_E: + case SHA3_KAT_FIPS_E: + case ECDHE_KAT_FIPS_E: + case AES_GCM_OVERFLOW_E: + case AES_CCM_OVERFLOW_E: + case RSA_KEY_PAIR_E: + case DH_CHECK_PRIV_E: + case WC_AFALG_SOCK_E: + case WC_DEVCRYPTO_E: + case ZLIB_INIT_ERROR: + case ZLIB_COMPRESS_ERROR: + case ZLIB_DECOMPRESS_ERROR: + case PKCS7_NO_SIGNER_E: + case CRYPTOCB_UNAVAILABLE: + case PKCS7_SIGNEEDS_CHECK: + case PSS_SALTLEN_RECOVER_E: + case CHACHA_POLY_OVERFLOW: + case ASN_SELF_SIGNED_E: + case SAKKE_VERIFY_FAIL_E: + case MISSING_IV: + case MISSING_KEY: + case BAD_LENGTH_E: + case ECDSA_KAT_FIPS_E: + case RSA_PAT_FIPS_E: + case KDF_TLS12_KAT_FIPS_E: + case KDF_TLS13_KAT_FIPS_E: + case KDF_SSH_KAT_FIPS_E: + case DHE_PCT_E: + case ECC_PCT_E: + case FIPS_PRIVATE_KEY_LOCKED_E: + case PROTOCOLCB_UNAVAILABLE: + case NO_VALID_DEVID: + case IO_FAILED_E: + case SYSLIB_FAILED_E: + case USE_HW_PSK: + case ENTROPY_RT_E: + case ENTROPY_APT_E: + case ASN_DEPTH_E: + case ASN_LEN_E: + case SM4_GCM_AUTH_E: + case SM4_CCM_AUTH_E: + case FIPS_DEGRADED_E: + case AES_EAX_AUTH_E: + case KEY_EXHAUSTED_E: + case ML_KEM_KAT_FIPS_E: + case FIPS_INVALID_VER_E: + case FIPS_DATA_SZ_E: + case FIPS_CODE_SZ_E: + case KDF_SRTP_KAT_FIPS_E: + case ED25519_KAT_FIPS_E: + case ED448_KAT_FIPS_E: + case PBKDF2_KAT_FIPS_E: + case WC_KEY_MISMATCH_E: + case ML_DSA_KAT_FIPS_E: + case LMS_KAT_FIPS_E: + case XMSS_KAT_FIPS_E: + case DEADLOCK_AVERTED_E: + case ASCON_AUTH_E: + case WC_ACCEL_INHIBIT_E: + case BAD_INDEX_E: + case INTERRUPTED_E: + case MLKEM_PUB_HASH_E: + case BUSY_E: + case ALREADY_E: + case SEQ_OVERFLOW_E: + case PUF_INIT_E: + case PUF_READ_E: + case PUF_ENROLL_E: + case PUF_RECONSTRUCT_E: + case PUF_DERIVE_KEY_E: + case PUF_IDENTITY_E: + case ML_KEM_PCT_E: + case ML_DSA_PCT_E: + case DRBG_SHA512_KAT_FIPS_E: + case SLH_DSA_KAT_FIPS_E: + case TSP_VERIFY_E: + case SLH_DSA_PCT_E: + case CMAC_KAT_FIPS_E: + case SHAKE_KAT_FIPS_E: + case DH_PCT_E: + case AES_KW_KAT_FIPS_E: + case FIPS_WRONG_API_E: + case KMAC_MIN_KEYLEN_E: + case FIPS_BAD_VALUE_E: + case FIPS_UNAPPROVED_E: + case NO_DEFAULT_FOUND_E: + case NOT_READY_E: + case OBJECT_NOT_LOCKED_E: + case WRONG_TYPE_OBJECT_E: + case NEEDS_RECOVERY_E: + case UNEXPECTED_STATE_E: + case STILL_REFERENCED_E: + case OBJECT_ORPHANED_E: + case HWPUF_INIT_E: + case HWPUF_ENROLL_E: + case HWPUF_START_E: + case HWPUF_GENERATE_KEY_E: + case HWPUF_GET_KEY_E: + case HWPUF_ZEROIZE_E: + case MAX_CODE_E: + case WC_SPAN1_MIN_CODE_E: + case MIN_CODE_E: + default: + break; + } +} + WOLFSSL_ABI const char* wc_GetErrorString(int error) { - switch ((enum wolfCrypt_ErrorCodes)error) { + /* Move span 2 to just below span 1, so the switch below covers one dense + * range of values. Compilers turn this switch into a lookup table, and a + * range that also covered the unused codes between the spans would cost + * one table entry per unused code. + */ + if ((error <= WC_SPAN2_FIRST_E) && (error >= WC_SPAN2_MIN_CODE_E)) { + error = WC_SPAN2_TO_IDX(error); + } + else if (error < WC_SPAN1_MIN_CODE_E) { + return wc_unknown_error_str; + } + + switch (error) { case WC_SUCCESS: return "wolfCrypt generic success"; @@ -660,141 +944,138 @@ const char* wc_GetErrorString(int error) case XMSS_KAT_FIPS_E: return "wolfCrypt FIPS XMSS Known Answer Test Failure"; - case DEADLOCK_AVERTED_E: + case WC_SPAN2_TO_IDX(DEADLOCK_AVERTED_E): return "Deadlock averted -- retry the call"; - case ASCON_AUTH_E: + case WC_SPAN2_TO_IDX(ASCON_AUTH_E): return "ASCON Authentication check fail"; - case WC_ACCEL_INHIBIT_E: + case WC_SPAN2_TO_IDX(WC_ACCEL_INHIBIT_E): return "Crypto acceleration is currently inhibited"; - case BAD_INDEX_E: + case WC_SPAN2_TO_IDX(BAD_INDEX_E): return "Bad index"; - case INTERRUPTED_E: + case WC_SPAN2_TO_IDX(INTERRUPTED_E): return "Process interrupted"; - case MLKEM_PUB_HASH_E: + case WC_SPAN2_TO_IDX(MLKEM_PUB_HASH_E): return "ML-KEM priv key's stored hash doesn't match encoded pub key"; - case BUSY_E: + case WC_SPAN2_TO_IDX(BUSY_E): return "Object is busy"; - case ALREADY_E: + case WC_SPAN2_TO_IDX(ALREADY_E): return "Operation was redundant or preempted"; - case SEQ_OVERFLOW_E: + case WC_SPAN2_TO_IDX(SEQ_OVERFLOW_E): return "Sequence counter would overflow"; - case PUF_INIT_E: + case WC_SPAN2_TO_IDX(PUF_INIT_E): return "PUF initialization failed"; - case PUF_READ_E: + case WC_SPAN2_TO_IDX(PUF_READ_E): return "PUF SRAM read failed"; - case PUF_ENROLL_E: + case WC_SPAN2_TO_IDX(PUF_ENROLL_E): return "PUF enrollment failed"; - case PUF_RECONSTRUCT_E: + case WC_SPAN2_TO_IDX(PUF_RECONSTRUCT_E): return "PUF reconstruction failed"; - case PUF_DERIVE_KEY_E: + case WC_SPAN2_TO_IDX(PUF_DERIVE_KEY_E): return "PUF key derivation failed"; - case PUF_IDENTITY_E: + case WC_SPAN2_TO_IDX(PUF_IDENTITY_E): return "PUF identity retrieval failed"; - case ML_KEM_PCT_E: + case WC_SPAN2_TO_IDX(ML_KEM_PCT_E): return "wolfcrypt ML-KEM Pairwise Consistency Test Failure"; - case ML_DSA_PCT_E: + case WC_SPAN2_TO_IDX(ML_DSA_PCT_E): return "wolfcrypt ML-DSA Pairwise Consistency Test Failure"; - case DRBG_SHA512_KAT_FIPS_E: + case WC_SPAN2_TO_IDX(DRBG_SHA512_KAT_FIPS_E): return "SHA-512 DRBG Known Answer Test check FIPS error"; - case SLH_DSA_KAT_FIPS_E: + case WC_SPAN2_TO_IDX(SLH_DSA_KAT_FIPS_E): return "SLH-DSA Known Answer Test check FIPS error"; - case TSP_VERIFY_E: + case WC_SPAN2_TO_IDX(TSP_VERIFY_E): return "TSP token invalid or response doesn't match request error"; - case SLH_DSA_PCT_E: + case WC_SPAN2_TO_IDX(SLH_DSA_PCT_E): return "wolfcrypt SLH-DSA Pairwise Consistency Test Failure"; - case CMAC_KAT_FIPS_E: + case WC_SPAN2_TO_IDX(CMAC_KAT_FIPS_E): return "wolfCrypt FIPS AES-CMAC Known Answer Test Failure"; - case SHAKE_KAT_FIPS_E: + case WC_SPAN2_TO_IDX(SHAKE_KAT_FIPS_E): return "wolfCrypt FIPS SHAKE Known Answer Test Failure"; - case DH_PCT_E: + case WC_SPAN2_TO_IDX(DH_PCT_E): return "wolfcrypt DH Pairwise Consistency Test Failure"; - case AES_KW_KAT_FIPS_E: + case WC_SPAN2_TO_IDX(AES_KW_KAT_FIPS_E): return "wolfCrypt FIPS AES Key Wrap Known Answer Test Failure"; - case FIPS_WRONG_API_E: + case WC_SPAN2_TO_IDX(FIPS_WRONG_API_E): return "Requested API is not allowed in FIPS mode"; - case KMAC_MIN_KEYLEN_E: + case WC_SPAN2_TO_IDX(KMAC_MIN_KEYLEN_E): return "FIPS Mode KMAC Minimum Key Length error"; - case FIPS_BAD_VALUE_E: + case WC_SPAN2_TO_IDX(FIPS_BAD_VALUE_E): return "Supplied value was rejected by FIPS policy"; - case FIPS_UNAPPROVED_E: + case WC_SPAN2_TO_IDX(FIPS_UNAPPROVED_E): return "Requested operation succeeded, but supplied " "parameters are unapproved for FIPS"; - case NO_DEFAULT_FOUND_E: + case WC_SPAN2_TO_IDX(NO_DEFAULT_FOUND_E): return "No default object registered for request type"; - case NOT_READY_E: + case WC_SPAN2_TO_IDX(NOT_READY_E): return "Resource not yet ready (retry)"; - case OBJECT_NOT_LOCKED_E: + case WC_SPAN2_TO_IDX(OBJECT_NOT_LOCKED_E): return "Required lock on object is not held"; - case WRONG_TYPE_OBJECT_E: + case WC_SPAN2_TO_IDX(WRONG_TYPE_OBJECT_E): return "Object is wrong type for requested operation"; - case NEEDS_RECOVERY_E: + case WC_SPAN2_TO_IDX(NEEDS_RECOVERY_E): return "Object needs recovery before use"; - case UNEXPECTED_STATE_E: + case WC_SPAN2_TO_IDX(UNEXPECTED_STATE_E): return "Object has unexpected state"; - case STILL_REFERENCED_E: + case WC_SPAN2_TO_IDX(STILL_REFERENCED_E): return "Object is still referenced (unsafe to deallocate)"; - case OBJECT_ORPHANED_E: + case WC_SPAN2_TO_IDX(OBJECT_ORPHANED_E): return "Object orphaned (can be adopted)"; - case HWPUF_INIT_E: + case WC_SPAN2_TO_IDX(HWPUF_INIT_E): return "HWPUF initialization failed"; - case HWPUF_ENROLL_E: + case WC_SPAN2_TO_IDX(HWPUF_ENROLL_E): return "HWPUF enrollment failed"; - case HWPUF_START_E: + case WC_SPAN2_TO_IDX(HWPUF_START_E): return "HWPUF start failed"; - case HWPUF_GENERATE_KEY_E: + case WC_SPAN2_TO_IDX(HWPUF_GENERATE_KEY_E): return "HWPUF generate key failed"; - case HWPUF_GET_KEY_E: + case WC_SPAN2_TO_IDX(HWPUF_GET_KEY_E): return "HWPUF get key failed"; - case HWPUF_ZEROIZE_E: + case WC_SPAN2_TO_IDX(HWPUF_ZEROIZE_E): return "HWPUF zeroize failed"; - case MAX_CODE_E: - case WC_SPAN1_MIN_CODE_E: - case MIN_CODE_E: default: - return "unknown error number"; + return wc_unknown_error_str; } } From 947d628118afeff65cba3b52a156c2b40b107a7f Mon Sep 17 00:00:00 2001 From: Michael Rogov Papernov Date: Wed, 28 Oct 2026 06:45:13 +0000 Subject: [PATCH 2/3] Keep the wc_GetErrorString() switch in its own function GCC 12 and later stop turning the switch into a lookup table when the span 2 remap comes before it in the same function. They emit a jump table and one block per case instead, which saves less on Thumb and grows the code in ARM mode and on 32-bit PowerPC. Move the switch into wc_GetErrorStringIdx(), so it compiles to the small table again on every compiler measured. Output is unchanged. --- wolfcrypt/src/error.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/wolfcrypt/src/error.c b/wolfcrypt/src/error.c index d8410633cf9..1a7bcd660db 100644 --- a/wolfcrypt/src/error.c +++ b/wolfcrypt/src/error.c @@ -45,7 +45,7 @@ static const char wc_unknown_error_str[] = "unknown error number"; /* Never called. Lists every error code in a switch on the enum, so that * -Wswitch-enum reports a code added without a case here. Each code listed - * here must also have a string in wc_GetErrorString(), which switches on + * here must also have a string in wc_GetErrorStringIdx(), which switches on * remapped values and so cannot be checked by the compiler. error_test() * checks that every code has a string. */ @@ -308,21 +308,9 @@ static WC_MAYBE_UNUSED void wc_ErrorStringsCheck(int error) } } -WOLFSSL_ABI -const char* wc_GetErrorString(int error) +/* Takes an error code remapped by wc_GetErrorString(). */ +static const char* wc_GetErrorStringIdx(int error) { - /* Move span 2 to just below span 1, so the switch below covers one dense - * range of values. Compilers turn this switch into a lookup table, and a - * range that also covered the unused codes between the spans would cost - * one table entry per unused code. - */ - if ((error <= WC_SPAN2_FIRST_E) && (error >= WC_SPAN2_MIN_CODE_E)) { - error = WC_SPAN2_TO_IDX(error); - } - else if (error < WC_SPAN1_MIN_CODE_E) { - return wc_unknown_error_str; - } - switch (error) { case WC_SUCCESS: @@ -1079,6 +1067,22 @@ const char* wc_GetErrorString(int error) } } +WOLFSSL_ABI +const char* wc_GetErrorString(int error) +{ + /* Move span 2 to just below span 1, so the switch covers one dense range + * and compiles to a small lookup table. + */ + if ((error <= WC_SPAN2_FIRST_E) && (error >= WC_SPAN2_MIN_CODE_E)) { + error = WC_SPAN2_TO_IDX(error); + } + else if (error < WC_SPAN1_MIN_CODE_E) { + return wc_unknown_error_str; + } + + return wc_GetErrorStringIdx(error); +} + #ifdef WOLFSSL_DEBUG_TRACE_ERROR_CODES #include #endif From 258f06e524d70d8dc5b74674697865b8ba8bed39 Mon Sep 17 00:00:00 2001 From: Michael Rogov Papernov Date: Wed, 28 Oct 2026 18:16:52 +0000 Subject: [PATCH 3/3] Fix CR: check span overlap and reorder the error string switches Add a static assert that span 2 starts below span 1, which the remap relies on. Move wc_ErrorStringsCheck() below wc_GetErrorStringIdx(), so a -Wswitch-enum warning for a new code points past the switch that also needs its string. Fix a comment that named the wrong function. --- wolfcrypt/src/error.c | 1405 +++++++++++++++++++++-------------------- 1 file changed, 703 insertions(+), 702 deletions(-) diff --git a/wolfcrypt/src/error.c b/wolfcrypt/src/error.c index 1a7bcd660db..21f0aad71e7 100644 --- a/wolfcrypt/src/error.c +++ b/wolfcrypt/src/error.c @@ -35,1035 +35,1036 @@ wc_static_assert((int)WC_LAST_E <= (int)WC_SPAN2_LAST_E); wc_static_assert((int)MIN_CODE_E <= (int)WC_LAST_E); wc_static_assert((int)MIN_CODE_E <= (int)WC_SPAN2_MIN_CODE_E); +wc_static_assert((int)WC_SPAN2_FIRST_E < (int)WC_SPAN1_MIN_CODE_E); static const char wc_unknown_error_str[] = "unknown error number"; -/* The value wc_GetErrorString() switches on for a span 2 error code: span 2 +/* The value wc_GetErrorStringIdx() switches on for a span 2 error code: span 2 * moved to just below span 1. */ #define WC_SPAN2_TO_IDX(e) \ ((e) - (int)WC_SPAN2_FIRST_E + (int)WC_SPAN1_MIN_CODE_E - 1) -/* Never called. Lists every error code in a switch on the enum, so that - * -Wswitch-enum reports a code added without a case here. Each code listed - * here must also have a string in wc_GetErrorStringIdx(), which switches on - * remapped values and so cannot be checked by the compiler. error_test() - * checks that every code has a string. - */ -static WC_MAYBE_UNUSED void wc_ErrorStringsCheck(int error) +/* Takes an error code remapped by wc_GetErrorString(). */ +static const char* wc_GetErrorStringIdx(int error) { - switch ((enum wolfCrypt_ErrorCodes)error) { + switch (error) { + case WC_SUCCESS: + return "wolfCrypt generic success"; + case WC_FAILURE: - case MP_MEM: - case MP_VAL: - case MP_WOULDBLOCK: + return "wolfCrypt generic failure"; + + case MP_MEM : + return "MP integer dynamic memory allocation failed"; + + case MP_VAL : + return "MP integer invalid argument"; + + case MP_WOULDBLOCK : + return "MP integer non-blocking operation would block"; + case MP_NOT_INF: - case OPEN_RAN_E: - case READ_RAN_E: - case WINCRYPT_E: - case CRYPTGEN_E: - case RAN_BLOCK_E: - case BAD_MUTEX_E: + return "MP point not at infinity"; + + case OPEN_RAN_E : + return "opening random device error"; + + case READ_RAN_E : + return "reading random device error"; + + case WINCRYPT_E : + return "windows crypt init error"; + + case CRYPTGEN_E : + return "windows crypt generation error"; + + case RAN_BLOCK_E : + return "random device read would block error"; + + case BAD_MUTEX_E : + return "Bad mutex, operation failed"; + case WC_TIMEOUT_E: + return "Timeout error"; + case WC_PENDING_E: + return "wolfCrypt Operation Pending (would block / eagain) error"; + case WC_NO_PENDING_E: - case MP_INIT_E: - case MP_READ_E: - case MP_EXPTMOD_E: - case MP_TO_E: - case MP_SUB_E: - case MP_ADD_E: - case MP_MUL_E: - case MP_MULMOD_E: - case MP_MOD_E: - case MP_INVMOD_E: - case MP_CMP_E: - case MP_ZERO_E: - case MEMORY_E: - case VAR_STATE_CHANGE_E: - case RSA_WRONG_TYPE_E: - case RSA_BUFFER_E: - case BUFFER_E: - case ALGO_ID_E: - case PUBLIC_KEY_E: - case DATE_E: - case SUBJECT_E: - case ISSUER_E: - case CA_TRUE_E: - case EXTENSIONS_E: - case ASN_PARSE_E: - case ASN_VERSION_E: - case ASN_GETINT_E: - case ASN_RSA_KEY_E: - case ASN_OBJECT_ID_E: - case ASN_TAG_NULL_E: - case ASN_EXPECT_0_E: - case ASN_BITSTR_E: - case ASN_UNKNOWN_OID_E: - case ASN_DATE_SZ_E: - case ASN_BEFORE_DATE_E: - case ASN_AFTER_DATE_E: - case ASN_SIG_OID_E: - case ASN_TIME_E: - case ASN_INPUT_E: - case ASN_SIG_CONFIRM_E: - case ASN_SIG_HASH_E: - case ASN_SIG_KEY_E: - case ASN_DH_KEY_E: + return "wolfCrypt operation not pending error"; + + case MP_INIT_E : + return "mp_init error state"; + + case MP_READ_E : + return "mp_read error state"; + + case MP_EXPTMOD_E : + return "mp_exptmod error state"; + + case MP_TO_E : + return "mp_to_xxx error state, can't convert"; + + case MP_SUB_E : + return "mp_sub error state, can't subtract"; + + case MP_ADD_E : + return "mp_add error state, can't add"; + + case MP_MUL_E : + return "mp_mul error state, can't multiply"; + + case MP_MULMOD_E : + return "mp_mulmod error state, can't multiply mod"; + + case MP_MOD_E : + return "mp_mod error state, can't mod"; + + case MP_INVMOD_E : + return "mp_invmod error state, can't inv mod"; + + case MP_CMP_E : + return "mp_cmp error state"; + + case MP_ZERO_E : + return "mp zero result, not expected"; + + case MEMORY_E : + return "out of memory error"; + + case VAR_STATE_CHANGE_E : + return "Variable state modified by different thread"; + + case RSA_WRONG_TYPE_E : + return "RSA wrong block type for RSA function"; + + case RSA_BUFFER_E : + return "RSA buffer error, output too small or input too big"; + + case BUFFER_E : + return "Buffer error, output too small or input too big"; + + case ALGO_ID_E : + return "Setting Cert AlgoID error"; + + case PUBLIC_KEY_E : + return "Setting Cert Public Key error"; + + case DATE_E : + return "Setting Cert Date validity error"; + + case SUBJECT_E : + return "Setting Cert Subject name error"; + + case ISSUER_E : + return "Setting Cert Issuer name error"; + + case CA_TRUE_E : + return "Setting basic constraint CA true error"; + + case EXTENSIONS_E : + return "Setting extensions error"; + + case ASN_PARSE_E : + return "ASN parsing error, invalid input"; + + case ASN_VERSION_E : + return "ASN version error, invalid number"; + + case ASN_GETINT_E : + return "ASN get big int error, invalid data"; + + case ASN_RSA_KEY_E : + return "ASN key init error, invalid input"; + + case ASN_OBJECT_ID_E : + return "ASN object id error, invalid id"; + + case ASN_TAG_NULL_E : + return "ASN tag error, not null"; + + case ASN_EXPECT_0_E : + return "ASN expect error, not zero"; + + case ASN_BITSTR_E : + return "ASN bit string error, wrong id"; + + case ASN_UNKNOWN_OID_E : + return "ASN oid error, unknown sum id"; + + case ASN_DATE_SZ_E : + return "ASN date error, bad size"; + + case ASN_BEFORE_DATE_E : + return "ASN date error, current date is before start of validity"; + + case ASN_AFTER_DATE_E : + return "ASN date error, current date is after expiration"; + + case ASN_SIG_OID_E : + return "ASN signature error, mismatched oid"; + + case ASN_TIME_E : + return "ASN time error, unknown time type"; + + case ASN_INPUT_E : + return "ASN input error, not enough data"; + + case ASN_SIG_CONFIRM_E : + return "ASN sig error, confirm failure"; + + case ASN_SIG_HASH_E : + return "ASN sig error, unsupported hash type"; + + case ASN_SIG_KEY_E : + return "ASN sig error, unsupported key type"; + + case ASN_DH_KEY_E : + return "ASN key init error, invalid input"; + case ASN_CRIT_EXT_E: + return "X.509 Critical extension ignored or invalid"; + case ASN_ALT_NAME_E: - case ECC_BAD_ARG_E: - case ASN_ECC_KEY_E: - case ECC_CURVE_OID_E: - case BAD_FUNC_ARG: - case NOT_COMPILED_IN: - case UNICODE_SIZE_E: - case NO_PASSWORD: - case ALT_NAME_E: + return "ASN alternate name error"; + + case ECC_BAD_ARG_E : + return "ECC input argument wrong type, invalid input"; + + case ASN_ECC_KEY_E : + return "ECC ASN1 bad key data, invalid input"; + + case ECC_CURVE_OID_E : + return "ECC curve sum OID unsupported, invalid input"; + + case BAD_FUNC_ARG : + return "Bad function argument"; + + case NOT_COMPILED_IN : + return "Feature not compiled in"; + + case UNICODE_SIZE_E : + return "Unicode password too big"; + + case NO_PASSWORD : + return "No password provided by user"; + + case ALT_NAME_E : + return "Alt Name problem, too big"; + case AES_GCM_AUTH_E: + return "AES-GCM Authentication check fail"; + case AES_CCM_AUTH_E: + return "AES-CCM Authentication check fail"; + case AES_SIV_AUTH_E: + return "AES-SIV authentication failure"; + case ASYNC_INIT_E: + return "Async Init error"; + case COMPRESS_INIT_E: + return "Compress Init error"; + case COMPRESS_E: + return "Compress error"; + case DECOMPRESS_INIT_E: + return "DeCompress Init error"; + case DECOMPRESS_E: + return "DeCompress error"; + case BAD_ALIGN_E: - case ASN_NO_SIGNER_E: - case ASN_CRL_CONFIRM_E: - case ASN_CRL_NO_SIGNER_E: + return "Bad alignment error, no alloc help"; + + case ASN_NO_SIGNER_E : +#ifndef OPENSSL_EXTRA + return "ASN no signer error to confirm failure"; +#else + return "certificate verify failed"; +#endif + + case ASN_CRL_CONFIRM_E : + return "ASN CRL sig error, confirm failure"; + + case ASN_CRL_NO_SIGNER_E : + return "ASN CRL no signer error to confirm failure"; + case CRL_CERT_DATE_ERR: - case ASN_OCSP_CONFIRM_E: + return "CRL date error"; + + case ASN_OCSP_CONFIRM_E : + return "ASN OCSP sig error, confirm failure"; + case ASN_NO_PEM_HEADER: + return "ASN no PEM Header Error"; + case BAD_STATE_E: + return "Bad state operation"; + case BAD_PADDING_E: + return "Bad padding, message wrong length"; + case REQ_ATTRIBUTE_E: + return "Setting cert request attributes error"; + case PKCS7_OID_E: + return "PKCS#7 error: mismatched OID value"; + case PKCS7_RECIP_E: + return "PKCS#7 error: no matching recipient found"; + case WC_PKCS7_WANT_READ_E: + return "PKCS#7 operations wants more input, call again"; + case FIPS_NOT_ALLOWED_E: + return "FIPS mode not allowed error"; + case ASN_NAME_INVALID_E: + return "Name Constraint error"; + case RNG_FAILURE_E: + return "Random Number Generator failed"; + case HMAC_MIN_KEYLEN_E: + return "FIPS Mode HMAC Minimum Key or Salt Length error"; + case RSA_PAD_E: + return "Rsa Padding error"; + case LENGTH_ONLY_E: + return "Output length only set, not for other use error"; + case IN_CORE_FIPS_E: + return "In Core Integrity check FIPS error"; + case AES_KAT_FIPS_E: + return "AES Known Answer Test check FIPS error"; + case DES3_KAT_FIPS_E: + return "DES3 Known Answer Test check FIPS error"; + case HMAC_KAT_FIPS_E: + return "HMAC Known Answer Test check FIPS error"; + case RSA_KAT_FIPS_E: + return "RSA Known Answer Test check FIPS error"; + case DRBG_KAT_FIPS_E: + return "DRBG Known Answer Test check FIPS error"; + case DRBG_CONT_FIPS_E: + return "DRBG Continuous Test FIPS error"; + case AESGCM_KAT_FIPS_E: + return "AESGCM Known Answer Test check FIPS error"; + case THREAD_STORE_KEY_E: + return "Thread Storage Key Create error"; + case THREAD_STORE_SET_E: + return "Thread Storage Set error"; + case MAC_CMP_FAILED_E: + return "MAC comparison failed"; + case IS_POINT_E: + return "ECC is point on curve failed"; + case ECC_INF_E: + return "ECC point at infinity error"; + case ECC_OUT_OF_RANGE_E: + return "ECC Qx or Qy out of range error"; + case ECC_PRIV_KEY_E: + return "ECC private key is not valid error"; + case SRP_CALL_ORDER_E: + return "SRP function called in the wrong order error"; + case SRP_VERIFY_E: + return "SRP proof verification error"; + case SRP_BAD_KEY_E: + return "SRP bad key values error"; + case ASN_NO_SKID: + return "ASN no Subject Key Identifier found error"; + case ASN_NO_AKID: + return "ASN no Authority Key Identifier found error"; + case ASN_NO_KEYUSAGE: + return "ASN no Key Usage found error"; + case SKID_E: + return "Setting Subject Key Identifier error"; + case AKID_E: + return "Setting Authority Key Identifier error"; + case KEYUSAGE_E: + return "Key Usage value error"; + case EXTKEYUSAGE_E: + return "Extended Key Usage value error"; + case CERTPOLICIES_E: + return "Setting Certificate Policies error"; + case WC_INIT_E: + return "wolfCrypt Initialize Failure error"; + case SIG_VERIFY_E: + return "Signature verify error"; + case BAD_COND_E: + return "Bad condition variable operation error"; + case SIG_TYPE_E: + return "Signature type not enabled/available"; + case HASH_TYPE_E: + return "Hash type not enabled/available"; + case WC_KEY_SIZE_E: + return "Key size error, either too small or large"; + case ASN_COUNTRY_SIZE_E: + return "Country code size error, either too small or large"; + case MISSING_RNG_E: + return "RNG required but not provided"; + case ASN_PATHLEN_SIZE_E: + return "ASN CA path length value too large error"; + case ASN_PATHLEN_INV_E: + return "ASN CA path length larger than signer error"; + case BAD_KEYWRAP_ALG_E: + return "Unsupported key wrap algorithm error"; + case BAD_KEYWRAP_IV_E: + return "Decrypted AES key wrap IV does not match expected"; + case WC_CLEANUP_E: + return "wolfcrypt cleanup failed"; + case ECC_CDH_KAT_FIPS_E: + return "wolfcrypt FIPS ECC CDH Known Answer Test Failure"; + case DH_CHECK_PUB_E: + return "DH Check Public Key failure"; + case BAD_PATH_ERROR: + return "Bad path for opendir error"; + case ASYNC_OP_E: + return "Async operation error"; + case BAD_OCSP_RESPONDER: + return "Invalid OCSP Responder, missing specific key usage extensions"; + case ECC_PRIVATEONLY_E: + return "Invalid use of private only ECC key"; + case WC_HW_E: + return "Error with hardware crypto use"; + case WC_HW_WAIT_E: + return "Hardware waiting on resource"; + case PSS_SALTLEN_E: + return "PSS - Length of salt is too big for hash algorithm"; + case PRIME_GEN_E: + return "Unable to find a prime for RSA key"; + case BER_INDEF_E: + return "Unable to decode an indefinite length encoded message"; + case RSA_OUT_OF_RANGE_E: + return "Ciphertext to decrypt is out of range"; + case RSAPSS_PAT_FIPS_E: + return "wolfcrypt FIPS RSA-PSS Pairwise Agreement Test Failure"; + case ECDSA_PAT_FIPS_E: + return "wolfcrypt FIPS ECDSA Pairwise Agreement Test Failure"; + case DH_KAT_FIPS_E: + return "wolfcrypt FIPS DH Known Answer Test Failure"; + case AESCCM_KAT_FIPS_E: + return "AESCCM Known Answer Test check FIPS error"; + case SHA3_KAT_FIPS_E: + return "SHA-3 Known Answer Test check FIPS error"; + case ECDHE_KAT_FIPS_E: + return "wolfcrypt FIPS ECDHE Known Answer Test Failure"; + case AES_GCM_OVERFLOW_E: + return "AES-GCM internal overflow averted"; + case AES_CCM_OVERFLOW_E: + return "AES-CCM internal overflow averted"; + case RSA_KEY_PAIR_E: + return "RSA Key Pair-Wise Consistency check fail"; + case DH_CHECK_PRIV_E: + return "DH Check Private Key failure"; + case WC_AFALG_SOCK_E: + return "AF_ALG socket error"; + case WC_DEVCRYPTO_E: + return "Error with /dev/crypto"; + case ZLIB_INIT_ERROR: + return "zlib init error"; + case ZLIB_COMPRESS_ERROR: + return "zlib compress error"; + case ZLIB_DECOMPRESS_ERROR: + return "zlib decompress error"; + case PKCS7_NO_SIGNER_E: + return "No signer in PKCS#7 signed data"; + case CRYPTOCB_UNAVAILABLE: + return "Crypto callback unavailable"; + case PKCS7_SIGNEEDS_CHECK: + return "Signature found but no certificate to verify"; + case PSS_SALTLEN_RECOVER_E: + return "PSS - Salt length unable to be recovered"; + case CHACHA_POLY_OVERFLOW: + return "wolfcrypt - ChaCha20_Poly1305 limit overflow 4GB"; + case ASN_SELF_SIGNED_E: + return "ASN self-signed certificate error"; + case SAKKE_VERIFY_FAIL_E: + return "SAKKE derivation verification error"; + case MISSING_IV: + return "Required IV not set"; + case MISSING_KEY: + return "Required key not set"; + case BAD_LENGTH_E: + return "Value of length parameter is invalid."; + case ECDSA_KAT_FIPS_E: + return "wolfcrypt FIPS ECDSA Known Answer Test Failure"; + case RSA_PAT_FIPS_E: + return "wolfcrypt FIPS RSA Pairwise Agreement Test Failure"; + case KDF_TLS12_KAT_FIPS_E: + return "wolfcrypt FIPS TLSv1.2 KDF Known Answer Test Failure"; + case KDF_TLS13_KAT_FIPS_E: + return "wolfcrypt FIPS TLSv1.3 KDF Known Answer Test Failure"; + case KDF_SSH_KAT_FIPS_E: - case DHE_PCT_E: + return "wolfcrypt FIPS SSH KDF Known Answer Test Failure"; + + case DHE_PCT_E: + return "wolfcrypt DHE Pairwise Consistency Test Failure"; + case ECC_PCT_E: + return "wolfcrypt ECDHE Pairwise Consistency Test Failure"; + case FIPS_PRIVATE_KEY_LOCKED_E: + return "Cannot export private key, locked"; + case PROTOCOLCB_UNAVAILABLE: + return "Protocol callback unavailable"; + case NO_VALID_DEVID: + return "No valid device ID set"; + case IO_FAILED_E: + return "Input/output failure"; + case SYSLIB_FAILED_E: + return "System/library call failed"; + case USE_HW_PSK: + return "Callback indicates that HW has PSK"; + case ENTROPY_RT_E: + return "Entropy Repetition Test failed"; + case ENTROPY_APT_E: + return "Entropy Adaptive Proportion Test failed"; + case ASN_DEPTH_E: + return "Invalid ASN.1 - depth check"; + case ASN_LEN_E: + return "ASN.1 length invalid"; + case SM4_GCM_AUTH_E: - case SM4_CCM_AUTH_E: - case FIPS_DEGRADED_E: - case AES_EAX_AUTH_E: - case KEY_EXHAUSTED_E: - case ML_KEM_KAT_FIPS_E: - case FIPS_INVALID_VER_E: - case FIPS_DATA_SZ_E: - case FIPS_CODE_SZ_E: - case KDF_SRTP_KAT_FIPS_E: - case ED25519_KAT_FIPS_E: - case ED448_KAT_FIPS_E: - case PBKDF2_KAT_FIPS_E: - case WC_KEY_MISMATCH_E: - case ML_DSA_KAT_FIPS_E: - case LMS_KAT_FIPS_E: - case XMSS_KAT_FIPS_E: - case DEADLOCK_AVERTED_E: - case ASCON_AUTH_E: - case WC_ACCEL_INHIBIT_E: - case BAD_INDEX_E: - case INTERRUPTED_E: - case MLKEM_PUB_HASH_E: - case BUSY_E: - case ALREADY_E: - case SEQ_OVERFLOW_E: - case PUF_INIT_E: - case PUF_READ_E: - case PUF_ENROLL_E: - case PUF_RECONSTRUCT_E: - case PUF_DERIVE_KEY_E: - case PUF_IDENTITY_E: - case ML_KEM_PCT_E: - case ML_DSA_PCT_E: - case DRBG_SHA512_KAT_FIPS_E: - case SLH_DSA_KAT_FIPS_E: - case TSP_VERIFY_E: - case SLH_DSA_PCT_E: - case CMAC_KAT_FIPS_E: - case SHAKE_KAT_FIPS_E: - case DH_PCT_E: - case AES_KW_KAT_FIPS_E: - case FIPS_WRONG_API_E: - case KMAC_MIN_KEYLEN_E: - case FIPS_BAD_VALUE_E: - case FIPS_UNAPPROVED_E: - case NO_DEFAULT_FOUND_E: - case NOT_READY_E: - case OBJECT_NOT_LOCKED_E: - case WRONG_TYPE_OBJECT_E: - case NEEDS_RECOVERY_E: - case UNEXPECTED_STATE_E: - case STILL_REFERENCED_E: - case OBJECT_ORPHANED_E: - case HWPUF_INIT_E: - case HWPUF_ENROLL_E: - case HWPUF_START_E: - case HWPUF_GENERATE_KEY_E: - case HWPUF_GET_KEY_E: - case HWPUF_ZEROIZE_E: - case MAX_CODE_E: - case WC_SPAN1_MIN_CODE_E: - case MIN_CODE_E: - default: - break; - } -} + return "SM4-GCM Authentication check fail"; -/* Takes an error code remapped by wc_GetErrorString(). */ -static const char* wc_GetErrorStringIdx(int error) -{ - switch (error) { + case SM4_CCM_AUTH_E: + return "SM4-CCM Authentication check fail"; - case WC_SUCCESS: - return "wolfCrypt generic success"; + case FIPS_DEGRADED_E: + return "FIPS module in DEGRADED mode"; - case WC_FAILURE: - return "wolfCrypt generic failure"; + case AES_EAX_AUTH_E: + return "AES-EAX Authentication check fail"; - case MP_MEM : - return "MP integer dynamic memory allocation failed"; + case KEY_EXHAUSTED_E: + return "Key no longer usable for operation"; - case MP_VAL : - return "MP integer invalid argument"; + case ML_KEM_KAT_FIPS_E: + return "wolfCrypt FIPS ML-KEM Known Answer Test Failure"; - case MP_WOULDBLOCK : - return "MP integer non-blocking operation would block"; + case FIPS_INVALID_VER_E: + return "Invalid FIPS version defined, check length"; - case MP_NOT_INF: - return "MP point not at infinity"; + case FIPS_DATA_SZ_E: + return "FIPS Module Data too large adjust MAX_FIPS_DATA_SZ"; - case OPEN_RAN_E : - return "opening random device error"; + case FIPS_CODE_SZ_E: + return "FIPS Module Code too large adjust MAX_FIPS_CODE_SZ"; - case READ_RAN_E : - return "reading random device error"; + case KDF_SRTP_KAT_FIPS_E: + return "wolfCrypt FIPS SRTP-KDF Known Answer Test Failure"; - case WINCRYPT_E : - return "windows crypt init error"; + case ED25519_KAT_FIPS_E: + return "wolfCrypt FIPS Ed25519 Known Answer Test Failure"; - case CRYPTGEN_E : - return "windows crypt generation error"; + case ED448_KAT_FIPS_E: + return "wolfCrypt FIPS Ed448 Known Answer Test Failure"; - case RAN_BLOCK_E : - return "random device read would block error"; + case PBKDF2_KAT_FIPS_E: + return "wolfCrypt FIPS PBKDF2 Known Answer Test Failure"; - case BAD_MUTEX_E : - return "Bad mutex, operation failed"; + case WC_KEY_MISMATCH_E: + return "key values mismatch"; - case WC_TIMEOUT_E: - return "Timeout error"; + case ML_DSA_KAT_FIPS_E: + return "wolfCrypt FIPS ML-DSA Known Answer Test Failure"; - case WC_PENDING_E: - return "wolfCrypt Operation Pending (would block / eagain) error"; + case LMS_KAT_FIPS_E: + return "wolfCrypt FIPS LMS Known Answer Test Failure"; - case WC_NO_PENDING_E: - return "wolfCrypt operation not pending error"; + case XMSS_KAT_FIPS_E: + return "wolfCrypt FIPS XMSS Known Answer Test Failure"; - case MP_INIT_E : - return "mp_init error state"; + case WC_SPAN2_TO_IDX(DEADLOCK_AVERTED_E): + return "Deadlock averted -- retry the call"; - case MP_READ_E : - return "mp_read error state"; + case WC_SPAN2_TO_IDX(ASCON_AUTH_E): + return "ASCON Authentication check fail"; - case MP_EXPTMOD_E : - return "mp_exptmod error state"; + case WC_SPAN2_TO_IDX(WC_ACCEL_INHIBIT_E): + return "Crypto acceleration is currently inhibited"; - case MP_TO_E : - return "mp_to_xxx error state, can't convert"; + case WC_SPAN2_TO_IDX(BAD_INDEX_E): + return "Bad index"; - case MP_SUB_E : - return "mp_sub error state, can't subtract"; + case WC_SPAN2_TO_IDX(INTERRUPTED_E): + return "Process interrupted"; - case MP_ADD_E : - return "mp_add error state, can't add"; + case WC_SPAN2_TO_IDX(MLKEM_PUB_HASH_E): + return "ML-KEM priv key's stored hash doesn't match encoded pub key"; - case MP_MUL_E : - return "mp_mul error state, can't multiply"; + case WC_SPAN2_TO_IDX(BUSY_E): + return "Object is busy"; - case MP_MULMOD_E : - return "mp_mulmod error state, can't multiply mod"; + case WC_SPAN2_TO_IDX(ALREADY_E): + return "Operation was redundant or preempted"; - case MP_MOD_E : - return "mp_mod error state, can't mod"; + case WC_SPAN2_TO_IDX(SEQ_OVERFLOW_E): + return "Sequence counter would overflow"; - case MP_INVMOD_E : - return "mp_invmod error state, can't inv mod"; + case WC_SPAN2_TO_IDX(PUF_INIT_E): + return "PUF initialization failed"; - case MP_CMP_E : - return "mp_cmp error state"; + case WC_SPAN2_TO_IDX(PUF_READ_E): + return "PUF SRAM read failed"; - case MP_ZERO_E : - return "mp zero result, not expected"; + case WC_SPAN2_TO_IDX(PUF_ENROLL_E): + return "PUF enrollment failed"; - case MEMORY_E : - return "out of memory error"; + case WC_SPAN2_TO_IDX(PUF_RECONSTRUCT_E): + return "PUF reconstruction failed"; - case VAR_STATE_CHANGE_E : - return "Variable state modified by different thread"; + case WC_SPAN2_TO_IDX(PUF_DERIVE_KEY_E): + return "PUF key derivation failed"; - case RSA_WRONG_TYPE_E : - return "RSA wrong block type for RSA function"; + case WC_SPAN2_TO_IDX(PUF_IDENTITY_E): + return "PUF identity retrieval failed"; - case RSA_BUFFER_E : - return "RSA buffer error, output too small or input too big"; + case WC_SPAN2_TO_IDX(ML_KEM_PCT_E): + return "wolfcrypt ML-KEM Pairwise Consistency Test Failure"; - case BUFFER_E : - return "Buffer error, output too small or input too big"; + case WC_SPAN2_TO_IDX(ML_DSA_PCT_E): + return "wolfcrypt ML-DSA Pairwise Consistency Test Failure"; - case ALGO_ID_E : - return "Setting Cert AlgoID error"; + case WC_SPAN2_TO_IDX(DRBG_SHA512_KAT_FIPS_E): + return "SHA-512 DRBG Known Answer Test check FIPS error"; - case PUBLIC_KEY_E : - return "Setting Cert Public Key error"; + case WC_SPAN2_TO_IDX(SLH_DSA_KAT_FIPS_E): + return "SLH-DSA Known Answer Test check FIPS error"; - case DATE_E : - return "Setting Cert Date validity error"; + case WC_SPAN2_TO_IDX(TSP_VERIFY_E): + return "TSP token invalid or response doesn't match request error"; - case SUBJECT_E : - return "Setting Cert Subject name error"; + case WC_SPAN2_TO_IDX(SLH_DSA_PCT_E): + return "wolfcrypt SLH-DSA Pairwise Consistency Test Failure"; - case ISSUER_E : - return "Setting Cert Issuer name error"; + case WC_SPAN2_TO_IDX(CMAC_KAT_FIPS_E): + return "wolfCrypt FIPS AES-CMAC Known Answer Test Failure"; - case CA_TRUE_E : - return "Setting basic constraint CA true error"; + case WC_SPAN2_TO_IDX(SHAKE_KAT_FIPS_E): + return "wolfCrypt FIPS SHAKE Known Answer Test Failure"; - case EXTENSIONS_E : - return "Setting extensions error"; + case WC_SPAN2_TO_IDX(DH_PCT_E): + return "wolfcrypt DH Pairwise Consistency Test Failure"; - case ASN_PARSE_E : - return "ASN parsing error, invalid input"; + case WC_SPAN2_TO_IDX(AES_KW_KAT_FIPS_E): + return "wolfCrypt FIPS AES Key Wrap Known Answer Test Failure"; - case ASN_VERSION_E : - return "ASN version error, invalid number"; + case WC_SPAN2_TO_IDX(FIPS_WRONG_API_E): + return "Requested API is not allowed in FIPS mode"; - case ASN_GETINT_E : - return "ASN get big int error, invalid data"; + case WC_SPAN2_TO_IDX(KMAC_MIN_KEYLEN_E): + return "FIPS Mode KMAC Minimum Key Length error"; - case ASN_RSA_KEY_E : - return "ASN key init error, invalid input"; + case WC_SPAN2_TO_IDX(FIPS_BAD_VALUE_E): + return "Supplied value was rejected by FIPS policy"; - case ASN_OBJECT_ID_E : - return "ASN object id error, invalid id"; + case WC_SPAN2_TO_IDX(FIPS_UNAPPROVED_E): + return "Requested operation succeeded, but supplied " + "parameters are unapproved for FIPS"; - case ASN_TAG_NULL_E : - return "ASN tag error, not null"; + case WC_SPAN2_TO_IDX(NO_DEFAULT_FOUND_E): + return "No default object registered for request type"; - case ASN_EXPECT_0_E : - return "ASN expect error, not zero"; + case WC_SPAN2_TO_IDX(NOT_READY_E): + return "Resource not yet ready (retry)"; - case ASN_BITSTR_E : - return "ASN bit string error, wrong id"; + case WC_SPAN2_TO_IDX(OBJECT_NOT_LOCKED_E): + return "Required lock on object is not held"; - case ASN_UNKNOWN_OID_E : - return "ASN oid error, unknown sum id"; + case WC_SPAN2_TO_IDX(WRONG_TYPE_OBJECT_E): + return "Object is wrong type for requested operation"; - case ASN_DATE_SZ_E : - return "ASN date error, bad size"; + case WC_SPAN2_TO_IDX(NEEDS_RECOVERY_E): + return "Object needs recovery before use"; - case ASN_BEFORE_DATE_E : - return "ASN date error, current date is before start of validity"; + case WC_SPAN2_TO_IDX(UNEXPECTED_STATE_E): + return "Object has unexpected state"; - case ASN_AFTER_DATE_E : - return "ASN date error, current date is after expiration"; + case WC_SPAN2_TO_IDX(STILL_REFERENCED_E): + return "Object is still referenced (unsafe to deallocate)"; - case ASN_SIG_OID_E : - return "ASN signature error, mismatched oid"; + case WC_SPAN2_TO_IDX(OBJECT_ORPHANED_E): + return "Object orphaned (can be adopted)"; - case ASN_TIME_E : - return "ASN time error, unknown time type"; + case WC_SPAN2_TO_IDX(HWPUF_INIT_E): + return "HWPUF initialization failed"; - case ASN_INPUT_E : - return "ASN input error, not enough data"; + case WC_SPAN2_TO_IDX(HWPUF_ENROLL_E): + return "HWPUF enrollment failed"; - case ASN_SIG_CONFIRM_E : - return "ASN sig error, confirm failure"; + case WC_SPAN2_TO_IDX(HWPUF_START_E): + return "HWPUF start failed"; - case ASN_SIG_HASH_E : - return "ASN sig error, unsupported hash type"; + case WC_SPAN2_TO_IDX(HWPUF_GENERATE_KEY_E): + return "HWPUF generate key failed"; - case ASN_SIG_KEY_E : - return "ASN sig error, unsupported key type"; + case WC_SPAN2_TO_IDX(HWPUF_GET_KEY_E): + return "HWPUF get key failed"; - case ASN_DH_KEY_E : - return "ASN key init error, invalid input"; + case WC_SPAN2_TO_IDX(HWPUF_ZEROIZE_E): + return "HWPUF zeroize failed"; + + default: + return wc_unknown_error_str; + } +} +/* Never called. Lists every error code in a switch on the enum, so that + * -Wswitch-enum reports a code added without a case here. Each code listed + * here must also have a string in wc_GetErrorStringIdx() above, which + * switches on remapped values and so cannot be checked by the compiler. + * error_test() checks that every code has a string. + */ +static WC_MAYBE_UNUSED void wc_ErrorStringsCheck(int error) +{ + switch ((enum wolfCrypt_ErrorCodes)error) { + case WC_SUCCESS: + case WC_FAILURE: + case MP_MEM: + case MP_VAL: + case MP_WOULDBLOCK: + case MP_NOT_INF: + case OPEN_RAN_E: + case READ_RAN_E: + case WINCRYPT_E: + case CRYPTGEN_E: + case RAN_BLOCK_E: + case BAD_MUTEX_E: + case WC_TIMEOUT_E: + case WC_PENDING_E: + case WC_NO_PENDING_E: + case MP_INIT_E: + case MP_READ_E: + case MP_EXPTMOD_E: + case MP_TO_E: + case MP_SUB_E: + case MP_ADD_E: + case MP_MUL_E: + case MP_MULMOD_E: + case MP_MOD_E: + case MP_INVMOD_E: + case MP_CMP_E: + case MP_ZERO_E: + case MEMORY_E: + case VAR_STATE_CHANGE_E: + case RSA_WRONG_TYPE_E: + case RSA_BUFFER_E: + case BUFFER_E: + case ALGO_ID_E: + case PUBLIC_KEY_E: + case DATE_E: + case SUBJECT_E: + case ISSUER_E: + case CA_TRUE_E: + case EXTENSIONS_E: + case ASN_PARSE_E: + case ASN_VERSION_E: + case ASN_GETINT_E: + case ASN_RSA_KEY_E: + case ASN_OBJECT_ID_E: + case ASN_TAG_NULL_E: + case ASN_EXPECT_0_E: + case ASN_BITSTR_E: + case ASN_UNKNOWN_OID_E: + case ASN_DATE_SZ_E: + case ASN_BEFORE_DATE_E: + case ASN_AFTER_DATE_E: + case ASN_SIG_OID_E: + case ASN_TIME_E: + case ASN_INPUT_E: + case ASN_SIG_CONFIRM_E: + case ASN_SIG_HASH_E: + case ASN_SIG_KEY_E: + case ASN_DH_KEY_E: case ASN_CRIT_EXT_E: - return "X.509 Critical extension ignored or invalid"; - case ASN_ALT_NAME_E: - return "ASN alternate name error"; - - case ECC_BAD_ARG_E : - return "ECC input argument wrong type, invalid input"; - - case ASN_ECC_KEY_E : - return "ECC ASN1 bad key data, invalid input"; - - case ECC_CURVE_OID_E : - return "ECC curve sum OID unsupported, invalid input"; - - case BAD_FUNC_ARG : - return "Bad function argument"; - - case NOT_COMPILED_IN : - return "Feature not compiled in"; - - case UNICODE_SIZE_E : - return "Unicode password too big"; - - case NO_PASSWORD : - return "No password provided by user"; - - case ALT_NAME_E : - return "Alt Name problem, too big"; - + case ECC_BAD_ARG_E: + case ASN_ECC_KEY_E: + case ECC_CURVE_OID_E: + case BAD_FUNC_ARG: + case NOT_COMPILED_IN: + case UNICODE_SIZE_E: + case NO_PASSWORD: + case ALT_NAME_E: case AES_GCM_AUTH_E: - return "AES-GCM Authentication check fail"; - case AES_CCM_AUTH_E: - return "AES-CCM Authentication check fail"; - case AES_SIV_AUTH_E: - return "AES-SIV authentication failure"; - case ASYNC_INIT_E: - return "Async Init error"; - case COMPRESS_INIT_E: - return "Compress Init error"; - case COMPRESS_E: - return "Compress error"; - case DECOMPRESS_INIT_E: - return "DeCompress Init error"; - case DECOMPRESS_E: - return "DeCompress error"; - case BAD_ALIGN_E: - return "Bad alignment error, no alloc help"; - - case ASN_NO_SIGNER_E : -#ifndef OPENSSL_EXTRA - return "ASN no signer error to confirm failure"; -#else - return "certificate verify failed"; -#endif - - case ASN_CRL_CONFIRM_E : - return "ASN CRL sig error, confirm failure"; - - case ASN_CRL_NO_SIGNER_E : - return "ASN CRL no signer error to confirm failure"; - + case ASN_NO_SIGNER_E: + case ASN_CRL_CONFIRM_E: + case ASN_CRL_NO_SIGNER_E: case CRL_CERT_DATE_ERR: - return "CRL date error"; - - case ASN_OCSP_CONFIRM_E : - return "ASN OCSP sig error, confirm failure"; - + case ASN_OCSP_CONFIRM_E: case ASN_NO_PEM_HEADER: - return "ASN no PEM Header Error"; - case BAD_STATE_E: - return "Bad state operation"; - case BAD_PADDING_E: - return "Bad padding, message wrong length"; - case REQ_ATTRIBUTE_E: - return "Setting cert request attributes error"; - case PKCS7_OID_E: - return "PKCS#7 error: mismatched OID value"; - case PKCS7_RECIP_E: - return "PKCS#7 error: no matching recipient found"; - case WC_PKCS7_WANT_READ_E: - return "PKCS#7 operations wants more input, call again"; - case FIPS_NOT_ALLOWED_E: - return "FIPS mode not allowed error"; - case ASN_NAME_INVALID_E: - return "Name Constraint error"; - case RNG_FAILURE_E: - return "Random Number Generator failed"; - case HMAC_MIN_KEYLEN_E: - return "FIPS Mode HMAC Minimum Key or Salt Length error"; - case RSA_PAD_E: - return "Rsa Padding error"; - case LENGTH_ONLY_E: - return "Output length only set, not for other use error"; - case IN_CORE_FIPS_E: - return "In Core Integrity check FIPS error"; - case AES_KAT_FIPS_E: - return "AES Known Answer Test check FIPS error"; - case DES3_KAT_FIPS_E: - return "DES3 Known Answer Test check FIPS error"; - case HMAC_KAT_FIPS_E: - return "HMAC Known Answer Test check FIPS error"; - case RSA_KAT_FIPS_E: - return "RSA Known Answer Test check FIPS error"; - case DRBG_KAT_FIPS_E: - return "DRBG Known Answer Test check FIPS error"; - case DRBG_CONT_FIPS_E: - return "DRBG Continuous Test FIPS error"; - case AESGCM_KAT_FIPS_E: - return "AESGCM Known Answer Test check FIPS error"; - case THREAD_STORE_KEY_E: - return "Thread Storage Key Create error"; - case THREAD_STORE_SET_E: - return "Thread Storage Set error"; - case MAC_CMP_FAILED_E: - return "MAC comparison failed"; - case IS_POINT_E: - return "ECC is point on curve failed"; - case ECC_INF_E: - return "ECC point at infinity error"; - case ECC_OUT_OF_RANGE_E: - return "ECC Qx or Qy out of range error"; - case ECC_PRIV_KEY_E: - return "ECC private key is not valid error"; - case SRP_CALL_ORDER_E: - return "SRP function called in the wrong order error"; - case SRP_VERIFY_E: - return "SRP proof verification error"; - case SRP_BAD_KEY_E: - return "SRP bad key values error"; - case ASN_NO_SKID: - return "ASN no Subject Key Identifier found error"; - case ASN_NO_AKID: - return "ASN no Authority Key Identifier found error"; - case ASN_NO_KEYUSAGE: - return "ASN no Key Usage found error"; - case SKID_E: - return "Setting Subject Key Identifier error"; - case AKID_E: - return "Setting Authority Key Identifier error"; - case KEYUSAGE_E: - return "Key Usage value error"; - case EXTKEYUSAGE_E: - return "Extended Key Usage value error"; - case CERTPOLICIES_E: - return "Setting Certificate Policies error"; - case WC_INIT_E: - return "wolfCrypt Initialize Failure error"; - case SIG_VERIFY_E: - return "Signature verify error"; - case BAD_COND_E: - return "Bad condition variable operation error"; - case SIG_TYPE_E: - return "Signature type not enabled/available"; - case HASH_TYPE_E: - return "Hash type not enabled/available"; - case WC_KEY_SIZE_E: - return "Key size error, either too small or large"; - case ASN_COUNTRY_SIZE_E: - return "Country code size error, either too small or large"; - case MISSING_RNG_E: - return "RNG required but not provided"; - case ASN_PATHLEN_SIZE_E: - return "ASN CA path length value too large error"; - case ASN_PATHLEN_INV_E: - return "ASN CA path length larger than signer error"; - case BAD_KEYWRAP_ALG_E: - return "Unsupported key wrap algorithm error"; - case BAD_KEYWRAP_IV_E: - return "Decrypted AES key wrap IV does not match expected"; - case WC_CLEANUP_E: - return "wolfcrypt cleanup failed"; - case ECC_CDH_KAT_FIPS_E: - return "wolfcrypt FIPS ECC CDH Known Answer Test Failure"; - case DH_CHECK_PUB_E: - return "DH Check Public Key failure"; - case BAD_PATH_ERROR: - return "Bad path for opendir error"; - case ASYNC_OP_E: - return "Async operation error"; - case BAD_OCSP_RESPONDER: - return "Invalid OCSP Responder, missing specific key usage extensions"; - case ECC_PRIVATEONLY_E: - return "Invalid use of private only ECC key"; - case WC_HW_E: - return "Error with hardware crypto use"; - case WC_HW_WAIT_E: - return "Hardware waiting on resource"; - case PSS_SALTLEN_E: - return "PSS - Length of salt is too big for hash algorithm"; - case PRIME_GEN_E: - return "Unable to find a prime for RSA key"; - case BER_INDEF_E: - return "Unable to decode an indefinite length encoded message"; - case RSA_OUT_OF_RANGE_E: - return "Ciphertext to decrypt is out of range"; - case RSAPSS_PAT_FIPS_E: - return "wolfcrypt FIPS RSA-PSS Pairwise Agreement Test Failure"; - case ECDSA_PAT_FIPS_E: - return "wolfcrypt FIPS ECDSA Pairwise Agreement Test Failure"; - case DH_KAT_FIPS_E: - return "wolfcrypt FIPS DH Known Answer Test Failure"; - case AESCCM_KAT_FIPS_E: - return "AESCCM Known Answer Test check FIPS error"; - case SHA3_KAT_FIPS_E: - return "SHA-3 Known Answer Test check FIPS error"; - case ECDHE_KAT_FIPS_E: - return "wolfcrypt FIPS ECDHE Known Answer Test Failure"; - case AES_GCM_OVERFLOW_E: - return "AES-GCM internal overflow averted"; - case AES_CCM_OVERFLOW_E: - return "AES-CCM internal overflow averted"; - case RSA_KEY_PAIR_E: - return "RSA Key Pair-Wise Consistency check fail"; - case DH_CHECK_PRIV_E: - return "DH Check Private Key failure"; - case WC_AFALG_SOCK_E: - return "AF_ALG socket error"; - case WC_DEVCRYPTO_E: - return "Error with /dev/crypto"; - case ZLIB_INIT_ERROR: - return "zlib init error"; - case ZLIB_COMPRESS_ERROR: - return "zlib compress error"; - case ZLIB_DECOMPRESS_ERROR: - return "zlib decompress error"; - case PKCS7_NO_SIGNER_E: - return "No signer in PKCS#7 signed data"; - case CRYPTOCB_UNAVAILABLE: - return "Crypto callback unavailable"; - case PKCS7_SIGNEEDS_CHECK: - return "Signature found but no certificate to verify"; - case PSS_SALTLEN_RECOVER_E: - return "PSS - Salt length unable to be recovered"; - case CHACHA_POLY_OVERFLOW: - return "wolfcrypt - ChaCha20_Poly1305 limit overflow 4GB"; - case ASN_SELF_SIGNED_E: - return "ASN self-signed certificate error"; - case SAKKE_VERIFY_FAIL_E: - return "SAKKE derivation verification error"; - case MISSING_IV: - return "Required IV not set"; - case MISSING_KEY: - return "Required key not set"; - case BAD_LENGTH_E: - return "Value of length parameter is invalid."; - case ECDSA_KAT_FIPS_E: - return "wolfcrypt FIPS ECDSA Known Answer Test Failure"; - case RSA_PAT_FIPS_E: - return "wolfcrypt FIPS RSA Pairwise Agreement Test Failure"; - case KDF_TLS12_KAT_FIPS_E: - return "wolfcrypt FIPS TLSv1.2 KDF Known Answer Test Failure"; - case KDF_TLS13_KAT_FIPS_E: - return "wolfcrypt FIPS TLSv1.3 KDF Known Answer Test Failure"; - case KDF_SSH_KAT_FIPS_E: - return "wolfcrypt FIPS SSH KDF Known Answer Test Failure"; - - case DHE_PCT_E: - return "wolfcrypt DHE Pairwise Consistency Test Failure"; - + case DHE_PCT_E: case ECC_PCT_E: - return "wolfcrypt ECDHE Pairwise Consistency Test Failure"; - case FIPS_PRIVATE_KEY_LOCKED_E: - return "Cannot export private key, locked"; - case PROTOCOLCB_UNAVAILABLE: - return "Protocol callback unavailable"; - case NO_VALID_DEVID: - return "No valid device ID set"; - case IO_FAILED_E: - return "Input/output failure"; - case SYSLIB_FAILED_E: - return "System/library call failed"; - case USE_HW_PSK: - return "Callback indicates that HW has PSK"; - case ENTROPY_RT_E: - return "Entropy Repetition Test failed"; - case ENTROPY_APT_E: - return "Entropy Adaptive Proportion Test failed"; - case ASN_DEPTH_E: - return "Invalid ASN.1 - depth check"; - case ASN_LEN_E: - return "ASN.1 length invalid"; - case SM4_GCM_AUTH_E: - return "SM4-GCM Authentication check fail"; - case SM4_CCM_AUTH_E: - return "SM4-CCM Authentication check fail"; - case FIPS_DEGRADED_E: - return "FIPS module in DEGRADED mode"; - case AES_EAX_AUTH_E: - return "AES-EAX Authentication check fail"; - case KEY_EXHAUSTED_E: - return "Key no longer usable for operation"; - case ML_KEM_KAT_FIPS_E: - return "wolfCrypt FIPS ML-KEM Known Answer Test Failure"; - case FIPS_INVALID_VER_E: - return "Invalid FIPS version defined, check length"; - case FIPS_DATA_SZ_E: - return "FIPS Module Data too large adjust MAX_FIPS_DATA_SZ"; - case FIPS_CODE_SZ_E: - return "FIPS Module Code too large adjust MAX_FIPS_CODE_SZ"; - case KDF_SRTP_KAT_FIPS_E: - return "wolfCrypt FIPS SRTP-KDF Known Answer Test Failure"; - case ED25519_KAT_FIPS_E: - return "wolfCrypt FIPS Ed25519 Known Answer Test Failure"; - case ED448_KAT_FIPS_E: - return "wolfCrypt FIPS Ed448 Known Answer Test Failure"; - case PBKDF2_KAT_FIPS_E: - return "wolfCrypt FIPS PBKDF2 Known Answer Test Failure"; - case WC_KEY_MISMATCH_E: - return "key values mismatch"; - case ML_DSA_KAT_FIPS_E: - return "wolfCrypt FIPS ML-DSA Known Answer Test Failure"; - case LMS_KAT_FIPS_E: - return "wolfCrypt FIPS LMS Known Answer Test Failure"; - case XMSS_KAT_FIPS_E: - return "wolfCrypt FIPS XMSS Known Answer Test Failure"; - - case WC_SPAN2_TO_IDX(DEADLOCK_AVERTED_E): - return "Deadlock averted -- retry the call"; - - case WC_SPAN2_TO_IDX(ASCON_AUTH_E): - return "ASCON Authentication check fail"; - - case WC_SPAN2_TO_IDX(WC_ACCEL_INHIBIT_E): - return "Crypto acceleration is currently inhibited"; - - case WC_SPAN2_TO_IDX(BAD_INDEX_E): - return "Bad index"; - - case WC_SPAN2_TO_IDX(INTERRUPTED_E): - return "Process interrupted"; - - case WC_SPAN2_TO_IDX(MLKEM_PUB_HASH_E): - return "ML-KEM priv key's stored hash doesn't match encoded pub key"; - - case WC_SPAN2_TO_IDX(BUSY_E): - return "Object is busy"; - - case WC_SPAN2_TO_IDX(ALREADY_E): - return "Operation was redundant or preempted"; - - case WC_SPAN2_TO_IDX(SEQ_OVERFLOW_E): - return "Sequence counter would overflow"; - - case WC_SPAN2_TO_IDX(PUF_INIT_E): - return "PUF initialization failed"; - - case WC_SPAN2_TO_IDX(PUF_READ_E): - return "PUF SRAM read failed"; - - case WC_SPAN2_TO_IDX(PUF_ENROLL_E): - return "PUF enrollment failed"; - - case WC_SPAN2_TO_IDX(PUF_RECONSTRUCT_E): - return "PUF reconstruction failed"; - - case WC_SPAN2_TO_IDX(PUF_DERIVE_KEY_E): - return "PUF key derivation failed"; - - case WC_SPAN2_TO_IDX(PUF_IDENTITY_E): - return "PUF identity retrieval failed"; - - case WC_SPAN2_TO_IDX(ML_KEM_PCT_E): - return "wolfcrypt ML-KEM Pairwise Consistency Test Failure"; - - case WC_SPAN2_TO_IDX(ML_DSA_PCT_E): - return "wolfcrypt ML-DSA Pairwise Consistency Test Failure"; - - case WC_SPAN2_TO_IDX(DRBG_SHA512_KAT_FIPS_E): - return "SHA-512 DRBG Known Answer Test check FIPS error"; - - case WC_SPAN2_TO_IDX(SLH_DSA_KAT_FIPS_E): - return "SLH-DSA Known Answer Test check FIPS error"; - - case WC_SPAN2_TO_IDX(TSP_VERIFY_E): - return "TSP token invalid or response doesn't match request error"; - - case WC_SPAN2_TO_IDX(SLH_DSA_PCT_E): - return "wolfcrypt SLH-DSA Pairwise Consistency Test Failure"; - - case WC_SPAN2_TO_IDX(CMAC_KAT_FIPS_E): - return "wolfCrypt FIPS AES-CMAC Known Answer Test Failure"; - - case WC_SPAN2_TO_IDX(SHAKE_KAT_FIPS_E): - return "wolfCrypt FIPS SHAKE Known Answer Test Failure"; - - case WC_SPAN2_TO_IDX(DH_PCT_E): - return "wolfcrypt DH Pairwise Consistency Test Failure"; - - case WC_SPAN2_TO_IDX(AES_KW_KAT_FIPS_E): - return "wolfCrypt FIPS AES Key Wrap Known Answer Test Failure"; - - case WC_SPAN2_TO_IDX(FIPS_WRONG_API_E): - return "Requested API is not allowed in FIPS mode"; - - case WC_SPAN2_TO_IDX(KMAC_MIN_KEYLEN_E): - return "FIPS Mode KMAC Minimum Key Length error"; - - case WC_SPAN2_TO_IDX(FIPS_BAD_VALUE_E): - return "Supplied value was rejected by FIPS policy"; - - case WC_SPAN2_TO_IDX(FIPS_UNAPPROVED_E): - return "Requested operation succeeded, but supplied " - "parameters are unapproved for FIPS"; - - case WC_SPAN2_TO_IDX(NO_DEFAULT_FOUND_E): - return "No default object registered for request type"; - - case WC_SPAN2_TO_IDX(NOT_READY_E): - return "Resource not yet ready (retry)"; - - case WC_SPAN2_TO_IDX(OBJECT_NOT_LOCKED_E): - return "Required lock on object is not held"; - - case WC_SPAN2_TO_IDX(WRONG_TYPE_OBJECT_E): - return "Object is wrong type for requested operation"; - - case WC_SPAN2_TO_IDX(NEEDS_RECOVERY_E): - return "Object needs recovery before use"; - - case WC_SPAN2_TO_IDX(UNEXPECTED_STATE_E): - return "Object has unexpected state"; - - case WC_SPAN2_TO_IDX(STILL_REFERENCED_E): - return "Object is still referenced (unsafe to deallocate)"; - - case WC_SPAN2_TO_IDX(OBJECT_ORPHANED_E): - return "Object orphaned (can be adopted)"; - - case WC_SPAN2_TO_IDX(HWPUF_INIT_E): - return "HWPUF initialization failed"; - - case WC_SPAN2_TO_IDX(HWPUF_ENROLL_E): - return "HWPUF enrollment failed"; - - case WC_SPAN2_TO_IDX(HWPUF_START_E): - return "HWPUF start failed"; - - case WC_SPAN2_TO_IDX(HWPUF_GENERATE_KEY_E): - return "HWPUF generate key failed"; - - case WC_SPAN2_TO_IDX(HWPUF_GET_KEY_E): - return "HWPUF get key failed"; - - case WC_SPAN2_TO_IDX(HWPUF_ZEROIZE_E): - return "HWPUF zeroize failed"; - + case DEADLOCK_AVERTED_E: + case ASCON_AUTH_E: + case WC_ACCEL_INHIBIT_E: + case BAD_INDEX_E: + case INTERRUPTED_E: + case MLKEM_PUB_HASH_E: + case BUSY_E: + case ALREADY_E: + case SEQ_OVERFLOW_E: + case PUF_INIT_E: + case PUF_READ_E: + case PUF_ENROLL_E: + case PUF_RECONSTRUCT_E: + case PUF_DERIVE_KEY_E: + case PUF_IDENTITY_E: + case ML_KEM_PCT_E: + case ML_DSA_PCT_E: + case DRBG_SHA512_KAT_FIPS_E: + case SLH_DSA_KAT_FIPS_E: + case TSP_VERIFY_E: + case SLH_DSA_PCT_E: + case CMAC_KAT_FIPS_E: + case SHAKE_KAT_FIPS_E: + case DH_PCT_E: + case AES_KW_KAT_FIPS_E: + case FIPS_WRONG_API_E: + case KMAC_MIN_KEYLEN_E: + case FIPS_BAD_VALUE_E: + case FIPS_UNAPPROVED_E: + case NO_DEFAULT_FOUND_E: + case NOT_READY_E: + case OBJECT_NOT_LOCKED_E: + case WRONG_TYPE_OBJECT_E: + case NEEDS_RECOVERY_E: + case UNEXPECTED_STATE_E: + case STILL_REFERENCED_E: + case OBJECT_ORPHANED_E: + case HWPUF_INIT_E: + case HWPUF_ENROLL_E: + case HWPUF_START_E: + case HWPUF_GENERATE_KEY_E: + case HWPUF_GET_KEY_E: + case HWPUF_ZEROIZE_E: + case MAX_CODE_E: + case WC_SPAN1_MIN_CODE_E: + case MIN_CODE_E: default: - return wc_unknown_error_str; + break; } }