test_pkcs7.c: test_wc_PKCS7_BER also accepts ret >= 0 (Bleichenbacher mitigation hides the RSA key error, making the result non-deterministic).
suites.c: skip --send-ticket cases as NOT_BUILT_IN when HAVE_SESSION_TICKET
is off (avoids port-11111 race).
wc_RsaFunction is declared WOLFSSL_API but the FIPS module does not export
it, so test_wc_RsaDecisionCoverage's 7-condition wc_RsaFunction arg-check
block fails to link (undefined reference) across the FIPS legs. Exclude the
block under HAVE_FIPS; cipher/plain/key/rng stay used by the other checks,
so no unused-variable. Not frozen under self-test, so it stays there.
check-source-text flags error-code operands compared without
WC_NO_ERR_TRACE(). Wrap them in the ed25519 and cmac white-box binaries
(same fix already applied to the curve25519 white-box).
The frozen FIPS/self-test hmac's wc_HmacSizeByType returns HMAC_KAT_FIPS_E
(-206) for any type it doesn't accept - not just the invalid 9999 case but
also MD5 (not a FIPS HMAC type), which returned -206 instead of the digest
size. Rather than chase each type, exclude the whole function under
HAVE_SELFTEST/HAVE_FIPS (the campaign measures MC/DC on open builds only).
- test_cmac.c: wc_AesCmacGenerate_ex / wc_AesCmacVerify_ex are absent from
the frozen FIPS cmac.h (fips-check freezes cmac.h at WCv4-stable /
WCv5.0-RC12 / v5.2.1-stable, none of which declare the _ex variants), so
the DecisionCoverage + cryptocb tests calling them fail to compile on the
FIPS legs. Add !defined(HAVE_FIPS) to their guards. cmac is NOT frozen
under CAVP self-test, so no HAVE_SELFTEST clause is needed.
- test_random.c: the WC_RNG_SEED_CB callbacks (test_random_seedCb_ok/_fail)
were guarded #ifdef WC_RNG_SEED_CB, but their only caller test_wc_RNG_SeedCb
is additionally !HAVE_SELFTEST && !HAVE_FIPS; a fips-ready build with
WC_RNG_SEED_CB on compiled the statics but not the caller ->
-Werror=unused-function. Match the statics' guard to the caller's.
- test_dh.c: zero-initialize priv/pub in test_wc_DhCheckKeyPair. clang-tidy
flags pub[pubSz-1] ^= 0x01 as a read of an uninitialized variable (it
cannot see that wc_DhGenerateKeyPair fills pub at runtime), failing
all-c89-clang-tidy / clang-tidy-all-intelasm / clang-tidy-all-async-quic.
- test_curve25519_whitebox.c: wrap the BAD_FUNC_ARG operands in
WC_NO_ERR_TRACE() (check-source-text unescaped-error-code check).
- test_sha3_whitebox.c: drop the bogus WOLFSSL_NO_SHA3 guard (no such
macro; the real gate is WOLFSSL_SHA3), which check-source-text reported
as an unknown macro.
test_wc_SpIntExptGcdDecisionCoverage sized r with sp_init_size(&r, 2)
expecting sp_gcd(2^140, 2^70, &r) == 0, on the assumption that 2^70
occupies 2 digits. That only holds for 64-bit SP_WORD_SIZE; on a 32-bit
build (e.g. --enable-sp-math-all with ALT_ECC_SIZE under -m32) 2^70 spans
3 digits, so r->size(2) < b->used(3) trips sp_gcd's dest-size check and it
returns MP_VAL. Size r to b.used so the "r->size < b->used" operand stays
false (the intended MC/DC pair) for any word size.
test_wc_CmacFinal declares tooSmallMacSz but only uses it inside the
"#if (!HAVE_FIPS || FIPS>=5.3) && !HAVE_SELFTEST" block (wc_CmacFinalNoFree
bad-arg checks). Under the CAVP-selftest config that block is compiled out,
leaving the variable unused -> -Werror=unused-variable. Declare it under the
same condition as its use.
The CAVP-selftest-v2 CI leg configures with --enable-dsa --enable-keygen
(richer than the minimal selftest profile), so it compiles two more
functions that call wolfCrypt APIs absent from the frozen v4.1.0 module:
- test_wc_DsaSign_bad_digestSz -> wc_DsaSign_ex / wc_DsaVerify_ex
- test_wc_DhGenerateParams_and_ExportRaw -> wc_DhGenerateParams /
wc_DhExportParamsRaw
Exclude both from HAVE_SELFTEST / HAVE_FIPS builds. Only a frozen build
run under the CAVP config (DSA + keygen on) exposes these.
test_wc_EccDecisionCoverage3 calls wc_ecc_import_unsigned and
wc_ecc_rs_raw_to_sig, which are not available in the frozen
CAVP-selftest wolfCrypt module (their declarations are gated off by the
minimal selftest feature config), so the CAVP-selftest CI leg fails to
compile them under -Werror. Exclude the function from HAVE_SELFTEST /
HAVE_FIPS builds, matching the sibling EccDecisionCoverage functions.
This class is only visible via an actual --enable-selftest compile, not
a header symbol diff.
The FIPS and CAVP-selftest CI legs overlay an ancient frozen wolfCrypt
per module (selftest ~= wc 4.1.0; FIPS v2 = WCv4-stable, older still).
New MC/DC tests call post-freeze wc_* APIs absent from those modules,
which fails to compile under -Werror on those legs. The campaign only
measures MC/DC on open per-module builds, never on FIPS/selftest, so
these functions gain no coverage there and only risk breaking CI.
Guard every affected test function with
!defined(HAVE_SELFTEST) && !defined(HAVE_FIPS) so it compiles out in
frozen builds, determined by diffing each header against both
v4.1.0-stable (selftest) and WCv4-stable (oldest FIPS v2):
- test_dh.c: SetNamedKey/CheckPubKey/CheckPrivKey/CheckKeyPair/
GenerateKeyPair* /Agree/ImportExport/SetKey (named-key, FFDHE,
DhAgree_ct, DhGeneratePublic, DhSetCheckKey - the last v2-only)
- test_ecc.c: mulmod + EccDecisionCoverage/2/4 (key_get_priv,
import_point_der_ex, gen_k, init_label, ctx_set_kdf_salt, ...)
- test_dsa.c: DsaKeyToPublicDer (add FIPS clause to existing selftest guard)
- test_hmac.c: HmacInit_Label, HmacInit_Id (wc_HmacInit_Id v2-only)
- test_random.c: RNG_SeedCb (wc_SetSeed_Cb)
- test_rsa.c: RsaFeatureCoverage (wc_InitRsaKey_Label)
- test_sha512.c: sha512 cryptocb fallback / default-devid variants
test_aes.c already handles this via per-feature guards (PR #10845).
Open build stays warning-clean and all guarded tests still run there.
Two MC/DC tests asserted pre-fix behavior; the corresponding library
fixes changed the observable result:
- test_wc_DsaImportParamsRaw_individual_args: the untrusted-import
primality rejection now surfaces DH_CHECK_PUB_E, since CheckDsaLN is
gated on err==MP_OKAY (commit 30ceba03c) and no longer overwrites it
with BAD_FUNC_ARG.
- test_wc_curve25519_check_public_be: the big-endian "order or higher"
loop now compares pub[i] != 0xff (symmetric with the little-endian
branch, commit 600880a0a), so the rejection input needs pub[1..30]
== 0xff, not 0x00.
Updated the assertions and the now-stale explanatory comments. Both
groups pass under --enable-all --enable-intelasm; full make check green.
The mem-zero false-positive these calls tripped is fixed at the library
level in wc_MakeRsaKey() on the sibling branch (fixes-2026-07-10 / PR
10875), which zero-initializes its stack temporaries so the early-out
mp_memzero_check() is safe. Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the
RsaSizeCheck decision is exercised in the instrumented build too. Depends
on PR 10875 for the all-check-mem-zero config.
The mem-zero registration leak this guard worked around is fixed at the
library level in wc_FreeDhKey() on the sibling branch (fixes-2026-07-10 /
PR 10875). Drop the !WOLFSSL_CHECK_MEM_ZERO guard so the import/export test
runs and validates that fix. This test therefore depends on PR 10875 to
pass the all-check-mem-zero CI config.
test_wc_DhGenerateParams_and_ExportRaw asserted wc_DhGenerateParams()==0,
but the bare WOLFSSL_SP_MATH backend cannot generate DH domain parameters
(returns PRIME_GEN_E), so the all-pq-sp-math CI config (--enable-sp-math)
failed the assertion. Guard the test on !defined(WOLFSSL_SP_MATH); the
generate/export decisions are covered with WOLFSSL_SP_MATH_ALL, fastmath
and heapmath. Verified: --enable-sp-math unit.test passes (test skipped);
the test still runs under --enable-all.
The all-check-mem-zero CI config (--enable-all -DWOLFSSL_CHECK_MEM_ZERO)
aborted unit.test (exit 134) in two of the new decision-coverage tests.
Both stem from wolfSSL mem-zero-tracking gaps that these tests are the
first to exercise; the underlying decisions are covered in every normal
build, so guard the specific triggers out of the instrumented build:
- test_rsa.c (test_wc_RsaDecisionCoverage): calling wc_MakeRsaKey() with an
out-of-range size makes it 'goto out' and run mp_memzero_check() over its
not-yet-initialized local temporaries, which over-scans the stack and
false-positives on the still-registered, legitimately non-zero key->d of
the key made earlier in the test. Skip the two bad-size calls under the
instrumented build.
- test_dh.c (test_wc_DhImportExportKeyPair): wc_DhImportKeyPair() registers
key->priv via mp_memzero_add(), but wc_FreeDhKey() clears it with
mp_forcezero() (which does not deregister) and has no wc_MemZero_Check()
like wc_FreeRsaKey() does, so the registration leaks into later tests.
Skip this import/export test under the instrumented build.
Verified: --enable-all -DWOLFSSL_CHECK_MEM_ZERO builds and unit.test passes
(exit 0, zero mem-zero violations).
The sp_int helper functions these tests call have varied, narrow definition
guards in sp_int.c (e.g. sp_div_2d/sp_mod_2d/sp_mul_2d/sp_tohex need
WOLFSSL_SP_MATH_ALL && !WOLFSSL_RSA_VERIFY_ONLY; the ct helpers need HAVE_ECC;
sp_gcd needs !NO_RSA && WOLFSSL_KEY_GEN). The previous
(WOLFSSL_SP_MATH_ALL || WOLFSSL_SP_MATH) && WOLFSSL_PUBLIC_MP guard let the
tests compile in configs where some of those helpers are not built, producing
undefined-reference link errors (sp_gcd, sp_div_2d, ...) in builds like
--enable-curl and the pq-small matrix configs. Replace it with the union of
the helpers' requirements, which the campaign sp-math config satisfies so
coverage is unchanged, and drop the now-redundant per-call sp_gcd guard.
Three more config-specific failures surfaced once the ecc link error was
resolved:
- test_wolfmath.c: test_wc_SpIntExptGcdDecisionCoverage called sp_gcd, whose
definition (sp_int.c) is guarded by !NO_RSA && WOLFSSL_KEY_GEN - narrower
than its sp_int.h prototype (|| ). Guard the sp_gcd block with the same
condition so builds like --enable-curl (RSA on, key-gen off) link.
- test_cmac.c: the crypto-cb badlen callback dereferences wc_CryptoInfo's
cmac member (WOLFSSL_CMAC only) and uses the Cmac type, but was guarded by
WOLF_CRYPTO_CB alone; configs with the callback framework but no CMAC
(e.g. --enable-wolftpm) failed to compile. Match the callback's guard to
its only caller (WOLFSSL_CMAC && !NO_AES && WOLFSSL_AES_128 &&
WOLF_CRYPTO_CB).
- test_dsa.c: test_wc_DsaExportKeyRaw_individual_args re-initialized WC_RNG
three times but freed it once, leaking two DRBGs (caught by LeakSanitizer
in the --enable-all sanitizer build). Free the RNG before each re-init,
mirroring the existing DsaKey free-before-reinit.
Verified: --enable-curl and --enable-wolftpm build/link; --enable-all with
-fsanitize=leak runs unit.test leak-free (test_wc_DsaExportKeyRaw_individual_args
passes).
test_wc_EccDecisionCoverage2 broke the unit.test link in several CI
configs (net-snmp, C#/Rust wrappers, make check/analyze, etc.):
- The wc_ecc_check_r_s_range block calls mp_init/mp_read_radix/mp_copy/
mp_clear, which resolve to sp_* under WOLFSSL_SP_MATH_ALL and are only
exported with WOLFSSL_PUBLIC_MP. Add defined(WOLFSSL_PUBLIC_MP) to its
guard (matching the other mp_*-using blocks in this file).
- wc_ecc_export_point_der_compressed is WOLFSSL_LOCAL (hidden in a shared
library) so it is not linkable from the shared-library unit test. Drop
the four direct calls; its decision coverage is driven by the ecc
white-box (which includes ecc.c). The public compressed path
wc_ecc_export_x963_ex(...,1) is retained.
Verified: --enable-net-snmp and --enable-all (+WOLFSSL_PUBLIC_MP) both
build and link; unit.test passes.
BEFORE 15/65 (23.08%) -> AFTER 55/65 (84.62%) MC/DC on wolfcrypt/src/random.c,
measured across 5 native user_settings.h variants (default, WOLFSSL_SMALL_STACK,
WOLFSSL_SMALL_STACK_CACHE, WC_RNG_SEED_CB, CUSTOM_RAND_GENERATE_BLOCK) plus a
new tests/unit-mcdc/test_random_whitebox.c white-box supplement, in the
ISO 26262 per-module MC/DC campaign.
tests/api/test_random.c / test_random.h:
- Add test_wc_RNG_HealthTest_SHA256_Ext / test_wc_RNG_HealthTest_SHA512_Ext,
exercising the previously-untested ACVP-oriented extended health-test entry
points (wc_RNG_HealthTest_SHA256_ex, wc_RNG_HealthTest_SHA512_ex/_ex2):
nonce/personalization-string/additional-input/reseed-entropy presence and
absence, in both standard and prediction-resistance modes, including
"valid pointer + zero size" calls needed to isolate each leaf's size
operand independently of its pointer operand for MC/DC.
- Add test_wc_RNG_SeedCb (WC_RNG_SEED_CB custom seed callback: success,
failing callback, and no-callback-installed paths).
- Add test_wc_RNG_CustomRandBlock (CUSTOM_RAND_GENERATE_BLOCK bypass path).
- Add test_wc_RNG_DrbgDisable (wc_Sha256Drbg_Disable/Enable/IsDisabled and
the wc_Sha512Drbg_* equivalents: drbgType selection and the "can't disable
both" BAD_STATE_E guard).
- Extend existing HealthTest bad-parameter coverage (reseed-without-seedB on
wc_RNG_HealthTest_ex / wc_RNG_HealthTest_SHA512 / wc_RNG_HealthTest_SHA512_ex,
and the untested wc_RNG_HealthTest_SHA512_ex2 3-operand bad-parameter guard).
- Guard test_wc_GenerateSeed against CUSTOM_RAND_GENERATE_BLOCK, whose
wc_GenerateSeed() ladder intentionally has no implementation in that
configuration (would otherwise be a link error, not a test failure).
tests/unit-mcdc/test_random_whitebox.c (new):
- White-box #include of random.c closing two structurally-unreachable-via-API
leaves: Hash_gen()/Hash512_gen()'s "out != NULL && outSz != 0" false side,
and array_add()'s "dLen > 0 && sLen > 0 && dLen >= sLen" false sides.
Residuals (10 of 65, documented in db/modules.json / baselines.json in the
paired testing-repo change): 4 WOLFSSL_SMALL_STACK allocation-failure
branches (no fault injection); 4 Hash_DRBG_Init/Hash512_DRBG_Init chained
Hash_df(...)==DRBG_SUCCESS conditions (transform-failure, SHA-256/512 never
fail on valid input); 2 Hash_gen()/Hash512_gen() "outSz != 0" leaves that are
structurally unsatisfiable given the caller's own outSz normalization and
loop-bound arithmetic (not merely hard to reach).
Bugs/interactions found while bringing up the CUSTOM_RAND_GENERATE_BLOCK
build variant (reported, not source-fixed): (1) random.c's PollAndReSeed()
is guarded only by "#ifdef HAVE_HASHDRBG" (not also
"!defined(CUSTOM_RAND_GENERATE_BLOCK)" like _InitRng()) and its non-callback
path unconditionally calls wc_GenerateSeed(), whose implementation ladder has
an intentionally empty CUSTOM_RAND_GENERATE_BLOCK arm -- an undefined-symbol
link error if a user_settings.h ever forces HAVE_HASHDRBG on together with
CUSTOM_RAND_GENERATE_BLOCK (this campaign's config now avoids the
combination instead of forcing it). (2) on this host, glibc's vDSO-
accelerated getrandom() does not validate the output buffer before writing
to it: wc_GenerateSeed(non-NULL os, NULL output, sz) segfaults inside
getrandom_vdso() instead of returning an error, so
TEST_WC_GENERATE_SEED_PARAMS is deliberately left undefined in the campaign
config for this test-only bad-parameter block (documented in
configs/random/user_settings.base.h).
Adds tests/api DecisionCoverage functions closing MC/DC gaps identified
by the per-module campaign (iso26262/mcdc-per-module):
dh.c: BEFORE 51/173 (29.48%) -> AFTER 107/173 (61.85%), union across
6 native variants (sp_default, sp_dh, sp_dh_nonblock,
small_stack, no_dh186, validate_keygen). New coverage: wc_DhSetKey
family bad-args and the FFDHE-table primality fast-path, named-key
helpers (SetNamedKey/GetNamedKeyParamSize/CopyNamedKey/CmpNamedKey),
wc_DhGenerateKeyPair/GeneratePublic bad-args plus a multi-group
(2048/3072/4096) generate+agree(+ct) round trip, WC_DH_NONBLOCK's
incremental state machine, wc_DhImportKeyPair/ExportKeyPair,
wc_DhCheckPubKey(_ex)/wc_DhCheckPrivKey(_ex)/wc_DhCheckKeyPair
(+ WOLFSSL_VALIDATE_DH_KEYGEN), wc_DhGenerateParams/
wc_DhExportParamsRaw, and CheckDhLN's divLen==224/256 MC/DC pair.
dsa.c: BEFORE 34/110 (30.91%) -> AFTER 51/110 (46.36%), union across
4 native variants (default, invmod_ct, fastmath, small_stack).
New coverage: wc_DsaSign_ex/wc_DsaVerify_ex digestSz bad-argument
checks and the q==1 qMinus1-iszero guard, individual single-operand
NULL-argument combinations for ImportParamsRaw/ExportParamsRaw/
ExportKeyRaw, and CheckDsaLN's case-2048 divLen==224/256 MC/DC pair.
Both modules build and pass their tests/api group + KATs across every
native variant with zero failures (10/10 variant runs).
Per-module MC/DC campaign (iso26262-mcdc-per-module). Adds decision-
coverage test cases to tests/api/test_curve25519.c and test_ed25519.c,
plus tests/unit-mcdc white-box supplements for file-static helpers
unreachable through any public wrapper (all callers pre-validate
identically before reaching them).
curve25519.c: BEFORE 26/64 (40.62%) -> AFTER 62/64 (96.88%).
Remaining 2: curve25519_smul_blind's RNG-retry loop (needs a
mockable RNG). Found and documented (not fixed - test-only
campaign) a source asymmetry bug in wc_curve25519_check_public's
BIG_ENDIAN branch (checks pub[i]!=0 where the mirrored
LITTLE_ENDIAN branch checks pub[i]!=0xff), and a build-blocking gap
in curve25519.c's WOLFSSL_CURVE25519_NOT_USE_ED25519+CURVED25519_X64
path (curve25519_base() has no header prototype anywhere in the
tree; fails under a strict C17 compiler).
ed25519.c: BEFORE 45/89 (50.56%) -> AFTER 81/89 (91.01%).
Remaining 8: 5 need a mockable hash/malloc failure to reach a
ret==0 FALSE side after a successful ed25519_hash() call; 3 are
WOLFSSL_CHECK_VER_FAULTS's redundant post-verify ConstantCompare,
a deterministic double-call on identical inputs that cannot
diverge without memory corruption in between.
Both modules build and pass across every native variant (backend
axis, blinding/non-blinding, WC_X25519_NONBLOCK, USE_INTEL_SPEEDUP,
WOLFSSL_ED25519_PERSISTENT_SHA/STREAMING_VERIFY) with zero variant
failures.
hmac.c: BEFORE 19/37 (51.35%) -> AFTER 37/37 (100%). Closed
wc_HmacSizeByType's own hash-type compound (separate physical decision
from wc_HmacSetKey_ex's copy), wc_HmacCopy's NULL guard,
wc_HmacInit_Id/wc_HmacInit_Label's length/NULL guards, wc_HmacFree's
devId/devCtx cleanup guard, and wc_HKDF_Extract_ex/wc_HKDF_Expand_ex's
NULL-inKey guard at both physical locations. No white-box needed; every
decision is reachable through the public API once WOLF_PRIVATE_KEY_ID /
WOLF_CRYPTO_CB are exercised.
cmac.c: BEFORE 19/58 (32.76%) -> AFTER 58/58 (100%). Closed independence
pairs across wc_CmacUpdate/wc_CMAC_Grow/wc_AesCmacGenerate's NULL+len
guards, wc_CmacFinalNoFree's outSz/tag-size guards, new
wc_InitCmac_Id/wc_InitCmac_Label tests plus a new
tests/unit-mcdc/test_cmac_whitebox.c supplement for _InitCmac_common's
id/label cross-combination leaves that are structurally unreachable
through the public wrappers, new DecisionCoverage tests driving
wc_AesCmacGenerate_ex/wc_AesCmacVerify_ex directly, and a WOLF_CRYPTO_CB
test reaching wc_AesCmacVerify_ex's aSz-mismatch guard (unreachable in
native software builds without a callback that violates the length
contract).
Both modules verified across all native variants (including
WOLF_PRIVATE_KEY_ID and WOLF_CRYPTO_CB axes) with zero build/test
failures.
Per-module ISO 26262 MC/DC campaign (iso26262-mcdc-per-module). Adds
DecisionCoverage-style cases to tests/api/test_chacha.c and
test_poly1305.c, plus intel-dispatch white-box supplements mirroring
the aes/sha3 technique.
chacha.c: BEFORE 6/11 (54.55%) -> AFTER 13/13 (100%). Closed
wc_Chacha_SetIV/SetKey's NULL-argument independence pairs,
wc_Chacha_Process's input/output NULL-argument pairs (both the
portable-C and USE_INTEL_CHACHA_SPEEDUP physical copies), and the
(msglen>0 && ctx->left>0) leftover-block decision's msglen==0 side.
Also adds an unaligned-key SetKey case (XSTREAM_ALIGN), a half-length
key case, and a new test_wc_Chacha_XChachaSetKey covering
wc_XChacha_SetKey. Total rose from 11 to 13 once the intelasm variant
was fixed (see campaign notes): it carries its own physical copy of
the leftover decision that the portable-only union previously missed.
poly1305.c: BEFORE 10/14 (71.43%) -> AFTER 12/14 (85.71%). Closed
wc_Poly1305Update's (m==NULL && bytes>0) inner AND, both operands.
Also adds an addSz==0 case to wc_Poly1305_MAC and a
lenToPad==WC_POLY1305_PAD_SZ case to wc_Poly1305_Pad for API
robustness. The 2 remaining conditions are structural/dead-code
residuals: wc_Poly1305SetKey's compound key==NULL check is shadowed
by an earlier unconditional key==NULL guard a few lines above (dead
code); wc_Poly1305_Pad's paddingLen<WC_POLY1305_PAD_SZ operand is
always true whenever paddingLen>0 (paddingLen is a mod-16 value
bounded to 0..15). See campaign baselines.json for full detail.
Adds test_wc_EccDecisionCoverage{,2,3,4} to tests/api/test_ecc.c (split
into four functions after a single giant one triggered a -fcoverage-mcdc
+ -O0 stack-corruption crash under this campaign's build, reproduced and
root-caused with gdb: a plain on-stack mp_int's used/size fields were
already garbage immediately after its own mp_init()) and a new
tests/unit-mcdc/test_ecc_whitebox.c white-box supplement, closing curve
lookup, point-is-at-infinity, gen_k, init_id/init_label, sign/verify
length, point DER import/export, is_point, export_public_raw/private_raw,
rs_raw_to_sig, ctx_set_kdf_salt, set_custom_curve, X963_KDF, curve_load,
_ecc_import_private_key_ex, and ecEncCtx protocol-guard decisions.
ecc.c union MC/DC across all 6 campaign variants: 217/597 -> 287/597.
tests/api/test_wolfmath.c gains six DecisionCoverage test functions
covering sp_int.c's mp_*/sp_* API: the allocation family (sp_init_size,
sp_grow, sp_copy, sp_exch), the shift family (sp_set_bit, sp_2expt,
sp_lshd, sp_rshb), the single-digit and multi-precision arithmetic
families (sp_add_d/sp_sub_d/sp_mul_d/sp_div_d/sp_mod_d/sp_div_2/
sp_div_2_mod_ct/sp_add/sp_sub/sp_addmod_ct/sp_submod_ct/sp_div,
including their WOLFSSL_SP_INT_NEGATIVE sign-path counterparts), the
conversion family (sp_div_2d/sp_mod_2d/sp_mul_2d/sp_sqrmod/
sp_mont_red_ex/sp_to_unsigned_bin_len(_ct)/sp_tohex/sp_read_radix), and
the sp_invmod/sp_exptmod_ex/sp_gcd/sp_prime_is_prime(_ex) top-level
argument and degenerate-input checks. Each exercises an internal
size/capacity guard or argument check via a deliberately undersized
destination (sp_init_size with a small size) or an out-of-range
argument - legitimate, public ways to reach decisions valid-sized RSA/
ECC/DH usage never trips.
tests/unit-mcdc/test_sp_int_whitebox.c is a new white-box supplement
(compiles sp_int.c in directly) closing the sp_count_bits/sp_cnt_lsb
non-normalized-digit trim loops: no public caller can produce that
state since every public mutator normalizes via sp_clamp before
returning.
Part of the ISO 26262 per-module MC/DC campaign's sp-math module
(wolfcrypt/src/sp_int.c, Phase 1): 412/547 (75.32%) MC/DC across 6
build-variant axes (WOLFSSL_SP_MATH_ALL vs bare WOLFSSL_SP_MATH,
WOLFSSL_SP_SMALL, WOLFSSL_SP_INT_NEGATIVE, WOLFSSL_SP_DIV_WORD_HALF,
WOLFSSL_SMALL_STACK) + the white-box, up from a 318/547 baseline. The
remaining gaps are deep invmod/exptmod/prime/gcd internal state-machine
internals, the SP-accelerated-backend-entangled RSA/DH key-size
dispatch, and other structural residuals; campaign-side files (config,
module registry, baseline) live in the separate testing repo.
Extend test_wc_RsaDecisionCoverage / test_wc_RsaFeatureCoverage and add a
tests/unit-mcdc white-box supplement (test_rsa_whitebox.c) for the per-module
MC/DC campaign, raising rsa.c union MC/DC from 67/268 to 156/283.
DecisionCoverage/FeatureCoverage additions (API-reachable argument and feature
paths): wc_RsaFunction 7-way arg check, wc_RsaDirect, wc_InitRsaKey_Id/Label,
wc_MakeRsaKey size check, wc_CheckProbablePrime, wc_RsaPSS_CheckPadding, OAEP
label mismatch (encrypt + decrypt), and a WC_RSA_NO_PADDING raw round trip.
A PSS-SHA512-on-1024-bit-key case is staged behind if(TEST_RSA_BITS==1024).
White-box supplement (file-static helpers shielded by a public pre-guard, so
their argument checks are unreachable from the API): _NewRsaKey_common,
_RsaExportKey, _RsaFlattenPublicKey, wc_CompareDiffPQ, _RsaPrivateKeyDecodeRaw,
RsaPad, RsaUnPad, _CheckProbablePrime. Both halves of each independence pair
are exercised within the white-box binary. Modeled on test_aes_whitebox.c;
main() always returns 0 so a setup failure is a skip, not a discarded variant.
Selftest/FIPS-sensitive assertions stay inside the existing
!defined(HAVE_SELFTEST) guard and the OAEP cases stay under !defined(HAVE_FIPS),
matching the committed idiom for this frozen-boundary file.
Adds #if defined(__aarch64__) && defined(WOLFSSL_ARMASM) sections to
test_aes_whitebox.c and test_sha3_whitebox.c that close the AArch64-only
MC/DC residuals the qemu-aarch64 emulator lane compiles but a native
white-box cannot reach (qemu -cpu max always advertises AES+PMULL, so the
runtime hw-crypto flags are always true on that lane):
- aes.c: the 9-site `aes->use_aes_hw_crypto && aes->use_pmull_hw_crypto`
dispatch (wc_AesGcmSetKey's H generation, the static GHASH_INIT helper,
the one-shot Encrypt/Decrypt, and the streaming Init/EncryptUpdate/
EncryptFinal/DecryptUpdate/DecryptFinal quintet), forced via the
Check_CPU_support_HwCrypto() cpuid_flags cache, plus the 4 internal
AesGcm*Update_AARCH64 pointer guards, called directly.
- sha3.c: the aarch64 twin of the Intel InitSha3 cached-dispatch decision
(line ~759), cond1 (SHA3_BLOCK != NULL), mirroring the existing
Intel-737 wb_init_with idiom.
Both sections reduce to a no-op stub outside the qemu-aarch64 lane, so the
files still compile+run natively unchanged. Verified against real
qemu-aarch64 -cpu max: all 9 aes.c hw-crypto sites show independence pairs
on both conditions, the 4 pointer-guard conditions' targeted halves show
covered, and the sha3.c:759 cond1 pair closes.
test_wc_AesEaxArgMcdc exercised the eax/out/in operands of
wc_AesEaxEncryptUpdate / wc_AesEaxDecryptUpdate but always passed
(authIn=NULL, authInSz=0), so the guard's authInSz>0 && authIn==NULL
term was never evaluated with authInSz>0 -- leaving those two
conditions (and their decrypt twins) uncovered in the MC/DC union.
Add, for both Update functions, the (authIn==NULL, authInSz>0) row
(rejected with BAD_FUNC_ARG) and the (authIn!=NULL, authInSz>0) row
(accepted), completing both conditions' independence pairs.
These four conditions were the only uncovered code the recent
master merge (AES-GCM-SIV, AES-OFB/CFB callbacks) added to aes.c that
was reachable from tests/api; closes them so the aes.c union returns
to its residual-only gap (410/445, gap 35).
MC/DC white-box supplements for the sha module of the ISO 26262 campaign,
one per involved file that has an x86-64 USE_INTEL_SPEEDUP runtime
dispatch: test_sha256_whitebox.c, test_sha512_whitebox.c,
test_sha3_whitebox.c. Each #includes its wolfcrypt/src/shaXXX.c so the
file-static cpuid mask (intel_flags / cpuid_flags) and transform function
pointers are in scope.
On an AVX2-capable host the runtime only ever takes the AVX2 branch of the
IS_INTEL_AVX1/AVX2/SHA/BMI dispatch decisions, so their not-taken
conditions are unreachable from tests/api (the aesni-class residual). The
supplements force the mask to each of {0, AVX1, AVX2, SHA, BMI1|BMI2, ...}
to show every condition's independence pair, while pinning the transform
pointer to the portable C path so a claimed-but-absent feature (e.g.
SHA-NI) never executes its asm -- crash-safe on any host.
Two mechanics were needed for full coverage: the host's multi-block 'Len'
transform bypasses the per-block byte-reverse decision, so the pointer is
set NULL to route through the per-block path; and the byte-reverse
decisions live in several update sub-paths (buffered-block completion,
bulk loop, final on/over the padding boundary) that are each driven with
the matching update granularity. The sha3 multi-block fast-path decision
needs both the NULL and non-NULL block-pointer rows in the same binary, so
both are exercised.
Closes the Intel dispatch false-sides in the union: sha256.c 19->25/26,
sha512.c 25->35/36, sha3.c 41->45/49. Remaining gaps are structural/lane
residuals (guard ordering, transform-failure, an AArch64-only twin);
documented in the campaign's reports/sha/RESIDUALS.md.
fixes longstanding bug in afalg_aes.c that made no-AAD handles non-interchangeable with AAD handles. also adds missing arg validation and KEYUSAGE_E checks throughout AF_ALG.
- *_wire_sni test is now more efficient
- openssl-ech workflow now does interop with ECH rejection
extra improvements:
- tested TLSX_EchSwapExtensions
- added ctx level SNI to padding calculation
- Improvement of SNI handling for ECH
- Changed EchSwapExtensions to append instead of prepend
- Reworked ECH testing
test_wc_falcon_sign_verify aborted (SIGABRT) when run as part of the
full unit suite in liboqs configs. The direct OQS_SIG_keypair() call
draws from liboqs' randombytes callback, which wolfSSL points at its
default liboqs RNG; wolfSSL_liboqsClose() (run by wolfCrypt_Cleanup)
frees that RNG without resetting liboqs_init, so after any earlier
Init/Cleanup cycle in the suite the re-Init never re-creates it and
the callback abort()s on the freed RNG. Running the test alone passed,
which is why this only surfaced in make check.
Drop the direct liboqs usage entirely: decode the embedded
bench_falcon_level1_key (certs_test.h) with wc_Falcon_PrivateKeyDecode
and exercise sign/verify through the wolfSSL API only, which hands the
test's own RNG to liboqs and does not depend on the default-RNG
lifecycle. Also removes the oqs/oqs.h include and the OQS_STATUS
handling; with no liboqs symbols left in the body, only the guard
still references HAVE_LIBOQS, easing the planned liboqs removal.
Validated in --with-liboqs --enable-experimental --enable-falcon (the
failing PRB-liboqs config): the full unit suite now completes with the
test passing at the position that aborted; also passes under
opensslall+falcon and compiles clean with -Werror=bad-function-cast.
ExpectIntEQ casts both arguments to int (tests/unit.h ExpectInt), and
casting a function call that returns the liboqs OQS_STATUS enum trips
-Werror=bad-function-cast, which is part of the test warning set. Store
the status in a local first; casting a variable does not trigger the
warning. Broke falcon-enabled configs once the HAVE_PQC guard fix made
this test compile.
Verified: the TU reproduces the exact CI error before this change and
compiles clean after, and test_wc_falcon_sign_verify still passes in a
--disable-md5 --enable-opensslextra --enable-falcon --with-liboqs
build.
Address the PR 10845 review findings:
* test_signature.c: the Falcon sign/verify test was guarded on
HAVE_PQC, which no build system ever defines (--enable-falcon sets
HAVE_FALCON only), so the test always compiled out to skipped. Gate
it on HAVE_FALCON && HAVE_LIBOQS like the library does, and drop the
now-unreferenced HAVE_PQC entry from .wolfssl_known_macro_extras.
Verified with --enable-opensslall --enable-experimental
--enable-falcon --with-liboqs: the test now executes and passes.
* api.c: revert the (OPENSSL_EXTRA || OPENSSL_ALL) widening of the
inner guards of test_wolfSSL_TXT_DB and the new
test_wolfSSL_NCONF_negative_paths. Both functions live inside the
enclosing OPENSSL_ALL block and their TEST_DECLs are OPENSSL_ALL-
gated (and TXT_DB/NCONF themselves are OPENSSL_ALL-only APIs), so
the widening could never take effect. Inner guards now match their
siblings (filesystem/BIO deps only).
* test_pkcs12.c: wrap the expected BAD_FUNC_ARG values of the new
parse guardrail asserts in WC_NO_ERR_TRACE() for consistency with
the rest of the PR's negative-path assertions.
All six affected tests pass in an opensslall+falcon+liboqs build:
falcon_sign_verify, TXT_DB, NCONF, NCONF_negative_paths,
PKCS12_parse_guardrails, PKCS12_create_guardrails.
Sean Parkinson
JacobBarthelmehandGitHub
philljjandGitHub
Daniele Lacamera
Tobias FrauenschlägerandGitHub
Yosuke Shimizu
David GarskeandGitHub
Daniel Pouzzner
Reda Chouk
sebastian-carpenter