Added Unit tests to increase MC/DC coverage by danielinux · Pull Request #10200 · wolfSSL/wolfssl

danielinux · 2026-04-13T05:54:31Z

No description provided.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10200

Scan targets checked: wolfcrypt-port, wolfcrypt-port-bugs

No new issues found in the changed files. ✅

Copilot

Pull request overview

This PR expands MC/DC-oriented unit test coverage across wolfCrypt and TLS/DTLS APIs, and makes a small set of previously-internal entry points visible to the test harness to enable deeper branch coverage.

Changes:

Expose select internal functions via WOLFSSL_TEST_VIS so they can be invoked from external unit tests.
Add a large set of new API/unit tests targeting guardrails and decision branches across crypto, ASN.1, PKCS#7/#12, TLS/DTLS, OCSP/CRL, and OpenSSL-compat layers.
Improve liboqs integration (configure-time detection via pkg-config and more complete runtime cleanup).

Reviewed changes

Copilot reviewed 55 out of 57 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/wc_encrypt.h	Expose `wc_CryptKey` for test visibility.
wolfssl/wolfcrypt/pkcs12.h	Expose `wc_PKCS12_verify_ex` for test visibility.
wolfssl/wolfcrypt/cryptocb.h	Expose additional CryptoCb helpers for test visibility.
wolfssl/wolfcrypt/asn.h	Expose ASN.1 helpers for test visibility.
wolfssl/internal.h	Expose `TLSX_SupportExtensions` for targeted tests.
wolfcrypt/src/port/liboqs/liboqs.c	Enhance liboqs close/teardown sequence.
tests/api/test_wolfmath.h	Register new wolfmath MC/DC tests.
tests/api/test_wolfmath.c	Add wolfmath MC/DC coverage tests.
tests/api/test_wc_encrypt.h	Register new wc_encrypt MC/DC tests.
tests/api/test_wc_encrypt.c	Add encrypted-keys / `wc_CryptKey` MC/DC tests.
tests/api/test_tls13.h	Register new TLS 1.3 MC/DC test batches.
tests/api/test_tls.h	Register new TLS/TLSX MC/DC test batches.
tests/api/test_signature.h	Register new signature wrapper MC/DC tests (+ Falcon).
tests/api/test_signature.c	Add signature wrapper MC/DC tests (+ Falcon sign/verify).
tests/api/test_sha256.h	Register SHA-256 residual-coverage test.
tests/api/test_sha256.c	Add SHA-256 residual-coverage test for update path.
tests/api/test_sha.h	Register SHA-1 residual-coverage test.
tests/api/test_sha.c	Add SHA-1 residual-coverage test for update path.
tests/api/test_rsa.h	Register additional RSA MC/DC tests.
tests/api/test_random.h	Register RNG guardrails/CryptoCb tests.
tests/api/test_random.c	Add RNG guardrails and CryptoCb behavior tests.
tests/api/test_poly1305.h	Register Poly1305 MC/DC tests.
tests/api/test_poly1305.c	Add Poly1305 guardrails/decision/feature coverage tests.
tests/api/test_pkcs7.h	Register PKCS#7 InitWithCert guardrails test.
tests/api/test_pkcs7.c	Add PKCS#7 InitWithCert guardrails test.
tests/api/test_pkcs12.h	Register PKCS#12 guardrails + MC/DC suites.
tests/api/test_pkcs12.c	Add PKCS#12 guardrails + MC/DC suites (create/parse/verify/file paths).
tests/api/test_ossl_x509.c	Extend OpenSSL-compat X509 tests for edge cases.
tests/api/test_ossl_x509_vp.c	Extend X509_VERIFY_PARAM tests (host length/flags/inherit).
tests/api/test_ossl_x509_ext.h	Register new NAME_CONSTRAINTS manual-paths test.
tests/api/test_ossl_x509_ext.c	Broaden OpenSSL-compat extension test coverage and build guards.
tests/api/test_ocsp.c	Add OCSP/CRL wrapper guardrails + wolfio HTTP helper coverage.
tests/api/test_md5.h	Register MD5 residual-coverage test.
tests/api/test_md5.c	Add MD5 residual-coverage test for update path.
tests/api/test_evp_pkey.h	Register new EVP_PKEY MC/DC/batch tests.
tests/api/test_evp_cipher.h	Register new EVP_CIPHER MC/DC/batch tests.
tests/api/test_ecc.h	Register additional ECC MC/DC tests.
tests/api/test_dtls.c	Extend DTLS wolfio/memio tests for more IO translation branches.
tests/api/test_dh.h	Register DH MC/DC tests.
tests/api/test_dh.c	Add DH MC/DC tests (named groups, agree, pubkey validation, etc.).
tests/api/test_chacha20_poly1305.h	Register ChaCha20-Poly1305 MC/DC tests.
tests/api/test_chacha.h	Register ChaCha MC/DC tests.
tests/api/test_chacha.c	Add ChaCha MC/DC tests for bad-args/decision/coverage paths.
tests/api/test_certman.c	Extend CertManager tests for verify/CRL buffer edge cases.
tests/api/test_asn.h	Register additional ASN MC/DC tests.
tests/api/test_aes.h	Register additional AES MC/DC tests.
configure.ac	Improve liboqs discovery/linking (pkg-config + flag handling).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 55 out of 57 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 55 out of 57 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 56 out of 58 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

wolfcrypt/src/port/liboqs/liboqs.c:82

If wc_LockMutex(&liboqsRNGMutex) fails after wc_InitMutex succeeds, wolfSSL_liboqsInit() returns without freeing the initialized mutex and leaves liboqs_mutex_init set. This can leak resources and make subsequent init attempts inconsistent. Consider setting liboqs_mutex_init only after a successful lock, or on lock failure call wc_FreeMutex(&liboqsRNGMutex) and clear liboqs_mutex_init before returning.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 56 out of 58 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…V3_EXT

Copilot

Pull request overview

Copilot reviewed 56 out of 58 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-04-15T07:14:44Z

MemBrowse Memory Report

No memory changes detected for:

gcc-arm-cortex-m4- gcc-arm-cortex-m4-baremetal- gcc-arm-cortex-m4-min-ecc- gcc-arm-cortex-m4-tls12

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10200

Scan targets checked: wolfcrypt-port, wolfcrypt-port-bugs

No new issues found in the changed files. ✅

Copilot

Pull request overview

Copilot reviewed 56 out of 58 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 57 out of 59 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (6)

wolfcrypt/src/port/liboqs/liboqs.c:1

The liboqs_init / liboqs_mutex_init flags are read/written without synchronization. Two threads can race such that one thread frees liboqsRNGMutex (lines 86-89 / 101-104) while another thread is about to lock or is locking it, which is undefined behavior. Consider using a dedicated one-time init primitive (e.g., wolfSSL/wolfCrypt once/atomic mechanism) or a separate static init lock that is never freed, and avoid freeing a mutex that could be observed by other threads.
wolfssl/wolfcrypt/wc_encrypt.h:1
Changing wc_CryptKey from WOLFSSL_LOCAL to WOLFSSL_TEST_VIS in a public header expands the exposed symbol surface (and potentially the ABI) beyond test builds. If the intent is test-only access, consider gating this declaration/visibility behind a dedicated test-only compile macro (or keep it WOLFSSL_LOCAL and provide a test hook wrapper) so production builds do not accidentally export or depend on this internal API.
tests/api/test_signature.c:1
The DER length written into the OCTET STRING header is FALCON_LEVEL1_PRV_KEY_SIZE (lines 199-200), but privDerLen is incremented by sizeof(priv) + sizeof(pub) (lines 201-204). If FALCON_LEVEL1_PRV_KEY_SIZE does not exactly equal sizeof(priv) + sizeof(pub), this risks (1) producing malformed DER with an incorrect length field or (2) overflowing privDer[] (sized FALCON_LEVEL1_PRV_KEY_SIZE + 4). Consider deriving the encoded length from the exact bytes appended (and sizing the buffer from those exact sizes) rather than assuming the constants match.
tests/api/test_signature.c:1
The DER length written into the OCTET STRING header is FALCON_LEVEL1_PRV_KEY_SIZE (lines 199-200), but privDerLen is incremented by sizeof(priv) + sizeof(pub) (lines 201-204). If FALCON_LEVEL1_PRV_KEY_SIZE does not exactly equal sizeof(priv) + sizeof(pub), this risks (1) producing malformed DER with an incorrect length field or (2) overflowing privDer[] (sized FALCON_LEVEL1_PRV_KEY_SIZE + 4). Consider deriving the encoded length from the exact bytes appended (and sizing the buffer from those exact sizes) rather than assuming the constants match.
tests/api/test_sha.c:1
The local int i; is never used other than being cast to void. Consider removing the variable entirely (or using it for a real loop/assertion) to keep the test code simpler and avoid carrying placeholder variables.
tests/api/test_sha.c:1
The local int i; is never used other than being cast to void. Consider removing the variable entirely (or using it for a real loop/assertion) to keep the test code simpler and avoid carrying placeholder variables.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-15T14:06:01Z

+        if command -v pkg-config >/dev/null 2>&1 && \
+           PKG_CONFIG_PATH="$PKG_CONFIG_PATH" pkg-config --exists liboqs; then
+            liboqs_pkgconfig_flags=`PKG_CONFIG_PATH="$PKG_CONFIG_PATH" pkg-config --cflags liboqs`
+            liboqs_pkgconfig_libs=`PKG_CONFIG_PATH="$PKG_CONFIG_PATH" pkg-config --static --libs liboqs`
+            liboqs_link_libs="$liboqs_pkgconfig_libs"
+            liboqs_user_cppflags="$liboqs_pkgconfig_flags"
+            CPPFLAGS="$CPPFLAGS $liboqs_pkgconfig_flags -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS -pthread"
+            LIBS="$LIBS $liboqs_pkgconfig_libs"
+        else
+            LIBS="$LIBS -loqs"
+        fi
+
        AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <oqs/common.h>]], [[ OQS_init(); ]])], [ liboqs_linked=yes ],[ liboqs_linked=no ])


The link test adds -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS -pthread to CPPFLAGS (line 1697), but the values are later restored (lines 1736-1739) and only liboqs_user_cppflags is preserved (which, in the pkg-config path, appears to be just cflags). If the build relies on these defines/flags (as the previous logic did), liboqs-enabled builds may compile without HAVE_LIBOQS/related defines. Consider persisting required compile defines/flags into AM_CPPFLAGS (or an AC_DEFINE for HAVE_LIBOQS) and ensuring -pthread is consistently applied for the final build, not only for the configure-time probe.

Copilot · 2026-04-15T14:06:02Z

+        LIB_ADD="$LIB_ADD $liboqs_link_libs"
+
+        PKG_CONFIG_PATH="$liboqs_saved_PKG_CONFIG_PATH"
+        CPPFLAGS="$liboqs_saved_CPPFLAGS $liboqs_user_cppflags"
+        LDFLAGS="$liboqs_saved_LDFLAGS $liboqs_user_ldflags"
+        LIBS="$liboqs_saved_LIBS"


The link test adds -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS -pthread to CPPFLAGS (line 1697), but the values are later restored (lines 1736-1739) and only liboqs_user_cppflags is preserved (which, in the pkg-config path, appears to be just cflags). If the build relies on these defines/flags (as the previous logic did), liboqs-enabled builds may compile without HAVE_LIBOQS/related defines. Consider persisting required compile defines/flags into AM_CPPFLAGS (or an AC_DEFINE for HAVE_LIBOQS) and ensuring -pthread is consistently applied for the final build, not only for the configure-time probe.

Copilot · 2026-04-15T14:06:02Z

+    reqLen = (int)len;
+    if (test_memio_wolfio_ctx.recv_max_chunk > 0 &&
+            reqLen > test_memio_wolfio_ctx.recv_max_chunk) {
+        reqLen = test_memio_wolfio_ctx.recv_max_chunk;
+    }
    ret = test_memio_read_cb(test_memio_wolfio_ctx.ssl_s,
-            (char*)buf, (int)len, test_memio_wolfio_ctx.test_ctx);
+            (char*)buf, reqLen, test_memio_wolfio_ctx.test_ctx);


Casting size_t len to int can truncate for large reads. Even though this is test code, it’s easy to make this robust by clamping len to INT_MAX (or the callback’s accepted max) before casting, and then applying the recv_max_chunk limit. That avoids undefined behavior if the caller ever requests a large len on platforms where size_t is wider than int.

danielinux requested review from Copilot and wolfSSL-Fenrir-bot April 13, 2026 05:54

wolfSSL-Fenrir-bot reviewed Apr 13, 2026

View reviewed changes

Copilot started reviewing on behalf of danielinux April 13, 2026 05:58 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/liboqs/liboqs.c

Comment thread tests/api/test_pkcs7.c

Copilot AI review requested due to automatic review settings April 13, 2026 11:04

danielinux self-assigned this Apr 13, 2026

Copilot started reviewing on behalf of danielinux April 13, 2026 11:06 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread tests/api/test_pkcs7.c Outdated

Comment thread wolfcrypt/src/port/liboqs/liboqs.c Outdated

Copilot AI review requested due to automatic review settings April 13, 2026 16:39

Copilot started reviewing on behalf of danielinux April 13, 2026 16:42 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/liboqs/liboqs.c

Comment thread tests/api/test_signature.c

Comment thread tests/api/test_wolfmath.c

Copilot AI review requested due to automatic review settings April 14, 2026 08:01

danielinux force-pushed the unit-tests branch from ecec4cb to e8b5cab Compare April 14, 2026 08:01

Copilot started reviewing on behalf of danielinux April 14, 2026 08:03 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread tests/api/test_dtls.c Outdated

Copilot AI review requested due to automatic review settings April 14, 2026 10:59

Copilot started reviewing on behalf of danielinux April 14, 2026 11:02 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

danielinux added 11 commits April 15, 2026 08:59

Added more unit tests to increase branch coverage

3072fec

Fixes after rebasing to master

f42a651

Fix tests regressions (kdf/macOS)

0b8ccf6

Addressed copilot's comments

3d23695

Fix test build due to kdf config mismatch

9ebb9bf

Fix more test config mismatch. Codespell fixes.

c1d5c61

Fixed more configuration mismatches in tests

afd9443

More configuration fixes

81c20e1

Disable extra wolfSSL_X509V3_EXT_i2d(...) checks in test_wolfSSL_X509…

ecdc8c4

…V3_EXT

Fix failing tests

6c7bc71

Fixed more test cases configurations

3a4a7e6

danielinux added 2 commits April 15, 2026 08:59

Fix runtime error tls_mcdc, fixed correct MAP symbols

9ad9af5

Fixed mix-decl-and-code leftover

c13dcdd

Copilot AI review requested due to automatic review settings April 15, 2026 07:00

danielinux force-pushed the unit-tests branch from 421f4ab to c13dcdd Compare April 15, 2026 07:00

Copilot started reviewing on behalf of danielinux April 15, 2026 07:01 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/liboqs/liboqs.c Outdated

Comment thread configure.ac

Fix AES test conflict resolution

e4fc749

danielinux added 5 commits April 15, 2026 09:54

Handle reduced AES key sizes in AES coverage tests

8e595ce

Make DH ASN NULL-input test parser-aware

c1699bb

Fix source-text and static-analysis regressions

2666b54

Stabilize TLS13 and ECH test flows

af50118

Fix AES-XTS test cleanup under sanitizer

cf39c73

Copilot AI review requested due to automatic review settings April 15, 2026 08:30

Free AIA entries in X509 extension tests

617ff4a

Copilot started reviewing on behalf of danielinux April 15, 2026 08:32 View session

danielinux requested a review from wolfSSL-Fenrir-bot April 15, 2026 08:34

Fix unresolved Copilot review issues

75aa849

wolfSSL-Fenrir-bot reviewed Apr 15, 2026

View reviewed changes

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/liboqs/liboqs.c

Comment thread .wolfssl_known_macro_extras

danielinux added 5 commits April 15, 2026 10:48

Stabilize TLS13 post-handshake auth coverage test

2bbbe34

Restore WOLF_CRYPTO_CB_FIND allowlist entry

eaf7378

Harden AES and ASN coverage tests for CI variants

b4e8e06

Guard ASN DH NULL-arg coverage for parser variants

a7e4cfc

Stabilize flaky CI tests and OCSP port reuse

7c94714

Copilot AI review requested due to automatic review settings April 15, 2026 13:56

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Copilot started reviewing on behalf of danielinux April 15, 2026 14:09 View session

Relax ECH sub-TLS expectation across configs

e7aa81c

Conversation

danielinux commented Apr 13, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10200

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10200

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Apr 15, 2026 •

edited

Loading