20260727-fips-dev-no-post - #11031

Merged

Frauschi merged 44 commits into

wolfSSL:masterfrom

douzzer:20260727-fips-dev-no-post

Aug 6, 2026

Commits on Aug 5, 2026

m4/ax_linuxkm.m4: in the AX_SIMD_CC_COMPILER_FLAGS setup, drop the -mavx and
douzzer
committed
6e2b6f6
wolfssl/wolfcrypt/error-crypt.h, wolfcrypt/src/error.c: add FIPS_BAD_VALUE_E
douzzer
committed
afc43cd
wolfssl/wolfcrypt/libwolfssl_sources_asm.h: define BUILDING_WOLFSSL_ASM when not
douzzer
committed
9d58c99
wolfcrypt/src/*.c: define WC_FIPS_LL_CRYPTO in FIPS-controlled sources before
douzzer
committed
46fb6b8
configure.ac: add --enable-fips=dev-no-post (WOLFSSL_FIPS_DEV_NO_POST, MAJOR=8)
douzzer
committed
c7a2c6c
tests/unit.h: pull in wolfssl/wolfcrypt/fips_test.h, for the WOLFSSL_FIPS_DEV_NO_POST stubs.
douzzer
committed
be988c5
wolfcrypt/test/test.c: fix PRIVATE_KEY_UNLOCK() call placement to assure unconditional matching of PRIVATE_KEY_UNLOCK() regardless of intervening error code collection.
douzzer
committed
df972c5
wolfssl/wolfcrypt/dh.h, wolfcrypt/src/dh.c: add wc_dh_enable/disable/
douzzer
committed
eedceef
wolfcrypt/src/ecc.c: pull in wolfssl/wolfcrypt/wc_compat.h for wc_AesGcmEncrypt() remapping if needed.
douzzer
committed
71d48cf
wolfcrypt/src/aes.c: in FIPS builds, reject ivSz < GCM_NONCE_MID_SZ (12) with
douzzer
committed
290553f
wolfssl/wolfcrypt/cmac.h: add WC_CMAC_NONE = 0 to CmacType.
douzzer
committed
ec54a29
wolfcrypt/src/hmac.c: in wc_HmacSetKey_ex reject WC_MD5 under HAVE_FIPS
douzzer
committed
1b53073
src/internal.c:
douzzer
committed
625f39f
wolfssl/wolfcrypt/visibility.h: add user-overrideable WC_ASM_ATT_HIDDEN(name) ->
douzzer
committed
69beb77
wolfssl/wolfcrypt/{types.h -> settings.h}: relocate the WC_HAVE_VECTOR_SPEEDUPS
douzzer
committed
2182768
various minor cleanups / tweaks for buildability and clarity:
douzzer
committed
4b543b7
wolfcrypt/src/{sha256,sha512}.c and wolfssl/wolfcrypt/{sha256,sha512}.h:
douzzer
committed
c82cfca
wolfssl/wolfcrypt/random.h, wolfcrypt/src/random.c: add full
douzzer
committed
c95cbdb
wolfcrypt/src/rng_bank.c, wolfssl/wolfcrypt/rng_bank.h, linuxkm/lkcapi_rsa_glue.c, linuxkm/lkcapi_sha_glue.c, wolfcrypt/test/test.c:
douzzer
committed
558d90c
wolfcrypt/src/fe_x25519_asm.{S,asm}, wolfcrypt/src/sp_x86_64_asm.{S,asm}:
douzzer
committed
d4293a2
wolfcrypt/src/falcon.c, configure.ac, wolfcrypt/benchmark/benchmark.c, wolfcrypt/test/test.h, wolfcrypt/test/test.c: Falcon fixes and cleanups:
douzzer
committed
0e1a3f9
wolfssl/test.h: convert err_sys() and err_sys_with_errno() to err_sys_func() /
douzzer
committed
4803bbd
tests/api/test_cmac.c: add `&& !defined(WOLFSSL_KCAPI)` to two build guards.
douzzer
committed
2a3e147
Fix WC_C_DYNAMIC_FALLBACK in various quantum-resistant alg implementations:
douzzer
committed
70cb3f0
linuxkm/x86_vector_register_glue.c, linuxkm/linuxkm_wc_port.h: add a
douzzer
committed
47d6666
refactor linuxkm_affinity_lock() and linuxkm_affinity_unlock() to use SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT() and RESTORE_VECTOR_REGISTERS_MAYBE_INHIBITED(), and in wc_linuxkm_rng_bank_init(), disabl…
douzzer
committed
348ea89
wolfssl/wolfcrypt/memory.h: prefix the SAVE_VECTOR_REGISTERS2 GNU statement-expr
douzzer
committed
93a71f3
.github/workflows/codespell.yml: add *.bin to skip list.
douzzer
committed
4f29532
.github/workflows/fips-dev-no-post.yml: add new workflow to cover --enable-fips=dev-no-post.
douzzer
committed
2f15926
linuxkm/lkcapi_glue.c: make the #error message for defined(CONFIG_CRYPTO_FIPS) != defined(HAVE_FIPS) more informative.
douzzer
committed
c8dae62
Makefile.am: add HAVE_FIPS_VERSION_MAJOR / _MINOR / _PATCH to the variables
douzzer
committed
1404ffb
configure.ac: in enable-all-crypto setup, enable_eccencrypt only if !FIPS || FIPS >= v7.
douzzer
committed
4f163df
wolfssl/wolfcrypt/settings.h: remove WOLFSSL_FIPS_READY and WOLFSSL_FIPS_DEV from the gate for implicit defining of WC_TEST_NO_ECC_SIGN_VERIFY_ZERO_DIGEST.
douzzer
committed
d1db0a8
wolfcrypt/src/logging.c, wolfssl/wolfcrypt/logging.h: recognize WOLFSSL_DEBUG_TRACE_ERROR_CODES_SUPPORT, facilitating opt-in per-file error tracing in debug campaigns.
douzzer
committed
8618f7c
wolfcrypt/src/memory.c: replace PRNG in SAVE_VECTOR_REGISTERS2_fuzzer() with xorshift64 (Marsaglia 2003).
douzzer
committed
9cad7a5
wolfssl/wolfcrypt/memory.h: add #errors for unsupported DEBUG_VECTOR_REGISTER_ACCESS configurations.
douzzer
committed
2967468
wolfcrypt/test/test.c: fix error codes in ecc_test_curve_size(), mldsa_param_*_vfy_test(), test_mldsa_decode_level(), and mldsa_test().
douzzer
committed
ec04819
fixes and improvements from AI review:
douzzer
committed
83b175c
wolfcrypt/src/sha256.c, wolfcrypt/src/sha512.c: clean up and fix up gating around WC_C_DYNAMIC_FALLBACK: use WC_SHA{256,512}_RAW_BE_BUFFER to indicate big-endian buffer.
douzzer
committed
c249a09
wolfssl/wolfcrypt/settings.h: remove automatic HAVE___INT128_T/HAVE___UINT128_T
douzzer
committed
50748f0
fixes from AI review:
douzzer
committed
64a9195
fixes from peer review, post-rebase test results, and test coverage expansion:
douzzer
committed
67df492
configure.ac: use $CC, not "$CC", for ccache compatibility. fixes enable-all-crypto default sensing, and fixes -ffile-prefix-map and --build-id=sha1 setup for reproducible-build,
douzzer
committed
bab1f66
configure.ac, wolfssl/wolfcrypt/settings.h: finish implementing opt-in DH for FIPS v7+.
douzzer
committed
e899972