Repository navigation
tests: fix test_client_nofail() ignoring callback_functions CA/cert/key - #11388
thiagodoregosousa wants to merge 3 commits into
Conversation
|
Can one of the admins verify this patch? |
|
@thiagodoregosousa thanks for opening a pull request! Can you tell us a little more about the use case with wolfSSL? I'm not seeing a contributor agreement on file, please reach out to us through support@wolfssl.com to get that process started. |
|
Hi Jacob, thanks for the quick reply. Use case: I'm a researcher at CESAR working on integrating post-quantum algorithms (ML-KEM and ML-DSA) into TLS/DTLS. Rather than wolfSSL's built-in PQC, I expose a custom PQC library through the crypto callback interface (wc_CryptoCb, via SetDevId), so it runs inside a real handshake. wolfSSL was a natural fit because of its native DTLS 1.3 support, which is the target transport for the project. This fix came up while writing DTLS 1.3 tests that drive the handshake through the callback path, mirroring the existing TLS 1.3 tests. On the contributor agreement: I'll check with CESAR on how to proceed and get back to you by email, it may take a little time on my side. |
|
OK to test - contributor agreement approved |
|
Retest this please Jenkins |
|
@thiagodoregosousa sorry for the delay in follow up response. I see the contributor agreement is taken care of. Could you rebase this pull request on top of the latest wolfssl/master branch to pull in the latest CI testing? It looks like one of our tests needs it. |
Client half of test_wolfSSL_client_server_nofail() silently ignores callback_functions.caPemFile/certPemFile/keyPemFile, unlike its server counterpart. This test fails until the next commit fixes it.
Add caFile/certFile/keyFile locals, overridden when callback_functions supplies them. Same pattern test_server_nofail() already uses for its own cert/key.
bf1ac2a to
70df961
Compare
|
Thanks! I’ve rebased on the latest wolfssl/master and force-pushed. Let me know if anything else is needed. |
There was a problem hiding this comment.
🟡 Changes recommended
An unguarded test registration breaks compilation without I/O test dependencies, while credential-loading paths ignore overrides and hardcoded PEM files cause failures in supported DER configurations.
3 open issues
What changed in this PR
This PR updates the client-side test driver to honor callback-supplied CA, certificate, and key paths, matching the server-side override pattern.
Changes:
- Selects custom credential paths when supplied, retaining existing defaults otherwise.
- Adds and registers an ECC-based regression test for the custom CA override.
| File | Description |
|---|---|
tests/api.c |
Adds client credential-path overrides and a custom-CA handshake regression test. |
Review effort: Balanced
… overrides in per-SSL loaders, use format-aware ECC cert macros
|
Client half of test_wolfSSL_client_server_nofail()'s driver pair silently ignores callback_functions.caPemFile/certPemFile/keyPemFile and always loads the hardcoded classical defaults, even though its server-side counterpart already honors the equivalent fields for certPemFile/keyPemFile.
First commit adds a regression test (fails on the parent commit, using an ECC server cert the default classical CA can't verify). Second commit adds the fix: caFile/certFile/keyFile locals, overridden when callback_functions supplies them.
Tested locally: built and ran the full tests/unit.test --api suite before and after (0 failures either way), and confirmed the new test fails on the first commit and passes on the second.