Skip to content

20260319-trace-errocde-runtime-control-and-various-fixes#10036

Open
douzzer wants to merge 8 commits intowolfSSL:masterfrom
douzzer:20260319-trace-errocde-runtime-control-and-various-fixes
Open

20260319-trace-errocde-runtime-control-and-various-fixes#10036
douzzer wants to merge 8 commits intowolfSSL:masterfrom
douzzer:20260319-trace-errocde-runtime-control-and-various-fixes

Conversation

@douzzer
Copy link
Contributor

@douzzer douzzer commented Mar 20, 2026

wolfssl/wolfcrypt/wc_port.h and wolfcrypt/src/wc_port.c: implement wolfSSL_Atomic_Int_Exchange().

wolfcrypt/src/logging.c, wolfssl/wolfcrypt/error-crypt.h, and wolfssl/wolfcrypt/logging.h: implement WOLFSSL_DEBUG_TRACE_ERROR_CODES_INIT_STATE, wc_debug_trace_error_codes_enabled(), and wc_debug_trace_error_codes_set(), to allow runtime control of error tracing.

linuxkm/lkcapi_aes_glue.c: don't log wc_AesSetKey() failures for invalid keylens, to avoid log noise on expected-failure kernel native crypto self-test.

configure.ac:

  • don't default-enable ML-KEM if SHA3/SHAKE are explicitly disabled at user request, or if FIPS <7.
  • add SHAKE_DEFAULT, following ENABLED_SHA3, with a FIPS v6 threshold.
  • move ML-KEM flag setup after FIPS setup (like SHA3 and SHAKE flag setup) to allow FIPS overrides.
  • remove the unused and misleading "v6-ready" FIPS flavor, and fix v6-dev to get the v6 version triplet.

wolfcrypt/src/wc_mlkem.c, wolfcrypt/src/wc_mlkem_poly.c, wolfssl/wolfcrypt/mlkem.h, wolfssl/wolfcrypt/wc_mlkem.h: fixes for C89 compliance and aarch64-FIPS-linuxkm compatibility.

src/ssl.c: fixes for -Wsign-compares in wolfSSL_ERR_GET_REASON().

tested with

wolfssl-multi-test.sh ...
pr-check
all-crypto-openssl-extra-coexist-fips-v6
allcryptonly-gcc-c89
fips-140-3-v6-optest-acvp-sp-asm
linuxkm-defaults-all-fips-v5-valgrind
all-crypto-only-intelasm-fips-v6-linuxkm-next-insmod-optest
lean-fips-dev-sanitizer
cross-armv7m-thumb-lean
'.*fips-v6.*cust-kernel.*'
linuxkm-all-cryptonly-pie-aarch64-fips-dev-dyn-hash-LKCAPI-build
linuxkm-all-cryptonly-pie-aarch64-fips-dev-dyn-hash-LKCAPI-no-debug-build

douzzer added 7 commits March 20, 2026 14:53
…/wolfcrypt/logging.h: implement WOLFSSL_DEBUG_TRACE_ERROR_CODES_INIT_STATE, wc_debug_trace_error_codes_enabled(), and wc_debug_trace_error_codes_set(), to allow runtime control of error tracing.
…d keylens, to avoid log noise on expected-failure kernel native crypto self-test.
* don't default-enable ML-KEM if SHA3/SHAKE are explicitly disabled at user request, or if FIPS <7.
* move ML-KEM flag setup after FIPS setup (like SHA3 and SHAKE flag setup) to allow FIPS overrides.
* remove the unused and misleading "v6-ready" FIPS flavor, and fix v6-dev to get the v6 version triplet.
…crypt/mlkem.h, wolfssl/wolfcrypt/wc_mlkem.h: fixes for C89 compliance and aarch64-FIPS-linuxkm compatibility.
@douzzer
Copy link
Contributor Author

douzzer commented Mar 20, 2026

retest this please

[all-c89-clang-tidy] [1 of 1] [wolfssl]
    autogen.sh wolfssl...   real 0m13.832s  user 0m12.521s  sys 0m0.376s
    configure...   real 0m15.737s  user 0m11.858s  sys 0m4.740s
    build...   real 13m56.194s  user 13m36.607s  sys 0m20.039s
    check...FAIL: scripts/ocsp-stapling-with-wolfssl-responder.test
   real 1m8.842s  user 0m38.899s  sys 0m4.173s

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants