[aidangarske]

Description

Fix head and tail link setup in list insert (supersedes #89, 2 findings)

F-15467 - 332be14 - List insert now clears the prev pointer of a new head entry before calling the helper, so a stale back link is never left behind.

F-15466 - 9bb2771 - List insert now sets the next pointer of a new tail entry after the helper runs, so the tail is always terminated.

Escape notification markup and reject incomplete datagrams in udp_to_dbus (supersedes #90, 2 findings)

F-4820 - b99e488 - The udp_to_dbus example now rejects notification datagrams with missing string fields instead of dereferencing them.

F-4701 - b182f10 - The udp_to_dbus example now escapes markup in the notification body and sends the summary as plain text, so network input cannot inject markup.

Fix locking and initialization in address family handling (supersedes #91, 4 findings)

F-8776 - 3f55b0d - Address family insert now initializes the entry header before the fallible allocation path, so cleanup never reads uninitialized fields.

F-8752 - c629588 - Address family error paths reached before the context lock is held now return without unlocking it.

F-8783 - 4d2462d - Address family lookup now copies the matched family number before releasing the shared lock.

F-2856 - 9e27eb4 - pton now accepts UNSPEC, matching what the ntop formatter emits.

Fix DOM nesting under USEFIRST and pass the allocator context (supersedes #92, 2 findings)

F-8762 - e03865d - The DOM builder now preserves nesting when a duplicate container value is skipped under USEFIRST.

F-4098 - d908dcc - The DOM malloc callback now receives the allocator context.

Fail closed in the Linux lwIP example (supersedes #93, 6 findings)

F-4706 - 2ff5fe8 - sentry_init in the Linux lwIP example now propagates wolfSentry init and config load errors instead of running unfiltered.

F-5706 - 81e2960 - The Linux lwIP example now denies a TCP connection when wolfSentry dispatch returns an error.

F-5705 - d1082b9 - The Linux lwIP example now denies an ICMP packet when wolfSentry dispatch returns an error.

F-5704 - 20b3da8 - The Linux lwIP example now denies an Ethernet frame when wolfSentry dispatch returns an error.

F-4822 - d2662d2 - Echo init in the Linux lwIP example now halts and releases its PCB when TCP setup fails.

F-4823 - 6b8703d - Ping init in the Linux lwIP example now halts when raw ICMP PCB allocation fails.

Fix use after free and rendering defects in user values (supersedes #94, 13 findings)

F-4760 - f4c4472 - KV lookup now takes its reference while the shared lock is still held, closing a use after free window.

F-8774 - c185a68 - The KV value getters now hold a reference across the unlocked dereference.

F-5559 - 4a85f6d - KV key validation errors now return without unlocking a lock that is not held.

F-3442 - f684e40 - KV rendering now prints 64-bit integers without truncation on targets with a 32-bit long.

F-3195 - 0976ce4 - KV rendering now prints floats with round-trip precision.

F-6511 - 21324e3 - KV rendering now writes non-finite floats as quoted tokens that parse back.

F-4281 - 781d394 - KV rendering now escapes strings when JSON DOM support is not built in.

F-3869 - de38f71 - A new test covers rejection of overwriting a read-only user value.

F-12517 - 29c5aaa - User value calls now reject empty keys for both explicit and null-terminated lengths.

F-12515 - c5e8e9f - A failed user value replacement now keeps the previous value in place.

F-10509 - 03bf394 - The user value validator is now read and written atomically, so it cannot race the setter.

F-13288 - c577ba5 - The user value validator is now stored on its own table.

F-12553 - 55ce1b0 - Sentinel string lengths are now bounded in size_t before they are narrowed to int.

Fix array path parsing and cleanup in centijson values (supersedes #95, 10 findings)

F-11599 - 25f0f7e - JSON value paths now parse the documented attached and negative array index forms.

F-8777 - 4e92507 - Array range removal now rejects an index or count that wraps.

F-8763 - 2f4dc49 - A cloned array is now finalized on failure and only initialized elements are tracked.

F-13882 - 825a906 - Cloning an empty array no longer makes a zero-size allocation.

F-10491 - 64f958f - The value compatibility predicate now rejects lossy numeric conversions.

F-13888 - 4ca9589 - The value compatibility predicate now range checks floating values before casting them.

F-11604 - 8e18e8e - Dictionary removal now frees the removed node and keeps the size consistent when finalize fails.

F-11603 - 0ed9c68 - Dictionary cleanup no longer frees a node that is still linked, so a failed cleanup can be retried.

F-10499 - 69b49ab - Cleaning or cloning an empty dictionary no longer makes a zero-size stack allocation.

F-8754 - 2a9a5bc - Shrinking an array to zero capacity now frees its buffer directly.

Prevent action list use after free during dispatch (supersedes #96, 8 findings)

F-13286 - 6b03f64 - Action dispatch now checks inhibition before marking insert and delete actions as called.

F-11617 - 6f78675 - Mutating an action list while it is being dispatched is now refused, which prevents a use after free.

F-13289 - 00cb84b - Caller action results are now cleared before an action reference is dropped.

F-2458 - 042b2c0 - A new test covers the action inhibit flag suppressing dispatch.

F-3662 - 2ce10c3 - A new test covers the action chain stopping early during dispatch.

F-3439 - b14986e - A new test covers disabled actions being skipped during dispatch.

F-2467 - 5ba30b8 - A new test covers DONT_COUNT_HITS suppressing action hit counting.

F-3872 - 0266395 - New tests cover the insert and delete action lifecycle guards.

Fail closed and validate ownership in the wolfIP filter glue (supersedes #97, 9 findings)

F-10486 - 593652c - The combined wolfIP filter installer now normalizes the TCP lifecycle mask.

F-8767 - 70ffa5e - The wolfIP glue now validates filter ownership before committing any mask change.

F-8784 - 93b9bfe - Disabling the wolfIP filters now resets the cleanup registration.

F-5006 - 3e54f9a - wolfIP filter state is now cleared only when the owning context is destroyed.

F-10501 - 3bb0a2f - wolfIP TCP close-wait events now set the CLOSE_WAIT action result.

F-10504 - 135a267 - wolfIP TCP dissociate now maps to a neutral teardown result.

F-13885 - 56ead9c - The wolfIP glue now handles UDP and ICMP socket lifecycle reasons.

F-2837 - 66008d0 - The wolfIP glue now denies packets with an unmapped protocol or event reason.

F-2438 - 374ddf2 - The wolfIP glue now denies a packet when wolfSentry dispatch fails instead of letting it through.

F-10486 - 415c3c8 - The wolfIP TCP mask is now normalized only when accept events are requested.

Harden the notification log server example (supersedes #98, 9 findings)

F-5002 - f8f83d3 - The log server example now rejects the handshake when issuer name rendering returns NULL.

F-5779 - 59a18f7 - The log server verify callback now frees its X509 name strings on every return path.

F-5712 - 55b4188 - The log server now strips control bytes from peer certificate strings before logging them.

F-5778 - a969856 - The circular log now evicts the entry at offset zero when it wraps.

F-4704 - 2b89339 - Shutdown in the log server now skips route dispatch when no rule route was checked out.

F-4821 - 5ae6bd3 - The log server now rejects circlog-size values that overflow size_t before allocating.

F-5073 - 9709d05 - The log server no longer truncates the config file size returned by ftell.

F-5008 - e017545 - The log server now checks buffer space before writing the decision list separator.

F-4763 - 06902a5 - Event and address family labels written into the circular log JSON are now escaped.

Fix route lookup loop, penalty box bypass and insert cleanup (supersedes #99, 11 findings)

F-15465 - 768c310 - Route lookup now stops after one jump into the wildcard address family span instead of looping forever.

F-11598 - 801fe1e - The exact-match lookup fast path now honors the penalty box exclusion, closing a bypass.

F-2460 - 8682a06 - A new test covers route lookup filtering on action_res_filter_bits_unset.

F-2462 - 3083976 - A new test covers the penalty box exclusion on the full route lookup scan.

F-6261 - 58815e7 - Route insert now returns before auxiliary bookkeeping when insert actions fail, which prevents a use after free.

F-6256 - 5d9ad1b - Route insert now releases the bitmask address family reference when insert actions fail.

F-8768 - 9818a46 - The parent event is now marked on every successful route insert.

F-3191 - affc180 - A new test covers rejection of route inserts with an expired purge deadline.

F-8773 - d37e071 - The route address formatter is now sized from the space left after its JSON key, which prevents an out-of-bounds write.

F-2855 - c32e53d - Event labels and names are now escaped when routes are rendered to JSON.

F-8753 - 8b325c9 - The getprotobynumber_r result pointer is now checked before a protocol name is rendered.

Fix lock wakeups and context lifecycle cleanup (supersedes #100, 10 findings)

F-10487 - 47541cd - The AUTO_DOWNGRADE unlock path is now reachable and consistent.

F-11600 - 23d5219 - Unlock now posts one reader wakeup per queued reader, so no waiting reader is stranded.

F-8775 - 41e2942 - wolfsentry_object_release now rejects table-less objects instead of dereferencing NULL.

F-8765 - bd5d6c7 - The ThreadX semaphore shims now implement timed and try semantics.

F-8750 - 2265aad - A partially allocated context is now freed without needing an owned mutex.

F-10492 - 026dc64 - wolfsentry_context_clone now frees the clone when its mutex cannot be taken.

F-15470 - c262237 - An as-at-creation clone now gets its own fallthrough route.

F-11601 - efd5f0b - wolfsentry_init_ex now frees a partially initialized context when it fails.

F-10497 - 7d2dc2d - wolfsentry_init_ex now fails when a duration conversion is rejected.

F-6507 - 81c094f - wolfsentry_context_exchange now refreshes the lock-free copy of the default policy.

Correct wrong API documentation in public headers (supersedes #101, 20 findings)

F-10470 - 69d4855 - The version comparison macro docs now state that the header version is the left operand.

F-10471 - 1a7968d - The sem_init_cb_t docs now describe the pshared argument correctly.

F-10472 - e50d760 - The WOLFSENTRY_PROMOTABLE_EX docs now describe a shared lock with a promotion reservation.

F-10473 - e131228 - The wolfsentry_context_clone docs now use the correct clone flag name.

F-10474 - 8af2f75 - The wolfsentry_route_event_dispatch_by_route docs now say route pointer instead of ID.

F-10475 - b341daa - The wolfsentry_route_event_dispatch_by_route_with_inited_result docs now say route pointer instead of ID.

F-10476 - b9da241 - The WOLFSENTRY_KV_V_SINT docs now name WOLFSENTRY_KV_SINT.

F-10477 - 6cde2a8 - The wolfsentry_user_value_get_sint docs now name WOLFSENTRY_KV_SINT.

F-10478 - 3a8b3c2 - The wolfsentry_user_value_get_float docs now name WOLFSENTRY_KV_FLOAT.

F-10479 - 8bbd5e6 - The wolfsentry_route_get_metadata docs now describe the metadata parameter indirection correctly.

F-10480 - 31ca06f - The WOLFSENTRY_NO_PROTOCOL_NAMES docs now describe protocol name support correctly.

F-11596 - a9bf4be - The dictionary walk callback docs now say only negative returns abort.

F-11597 - bc0246e - The event label argument annotations in the wolfsentry_setup calls are now correct.

F-12519 - 347e79d - The wolfsentry_lock_get_flags docs now say flags must be non-NULL.

F-12520 - 977b3ee - The route deletion docs now refer to the delete action.

F-12521 - c2463b4 - The wolfsentry_route_event_dispatch docs example now dereferences action_results.

F-12522 - edd0c63 - The SAX process callback docs now say only negative returns abort.

F-12523 - 7f97940 - The JSON dump writer callback docs now say only negative returns abort.

F-12524 - aaa172f - The DOM dump writer callback docs now say only negative returns abort.

F-12526 - 9761211 - The WOLFSENTRY_SUCCESS_UNLOCK_AND_RETURN docs example now uses a success code name.

Harden base64, time conversion and allocator helpers (supersedes #102, 12 findings)

F-8757 - 10b95ec - Base64 decode now honors lenient junk handling in the pad lookahead.

F-8771 - 156a889 - Base64 decode now rejects padded quantums with too few data sextets.

F-2843 - 91c7637 - A new test covers eventconfig rejection of conflicting add and clear bits.

F-2849 - dbe9f4d - A new test covers eventconfig validation of route private data alignment.

F-3190 - dcaeafa - A new test covers the eventconfig derogatory threshold range check.

F-1214 - 0a85a2c - The user-defined success string table is now sized with the correct arithmetic.

F-10495 - 3f380d9 - Relative deadline conversion failures are now propagated instead of being replaced with zero.

F-13886 - d044c63 - The deadline getter now propagates interval conversion failures.

F-13887 - 9a786f7 - Seconds are now checked against divided limits before the microsecond multiply, so it cannot overflow.

F-10496 - f19d649 - The timespec wrappers now propagate epoch conversion failures.

F-10503 - 40c86d7 - The malloc debug count no longer changes on a failed nonzero realloc.

F-10510 - 23f2b00 - The fallback aligned allocators now validate alignment and guard against size overflow.

Fix range checks and fail closed in the JSON config loader (supersedes #103, 18 findings)

F-4277 - 16d6cdd - The JSON loader now rejects out-of-range uint64 values without relying on errno.

F-10488 - 8b15ad9 - The JSON loader now rejects a leading minus sign in unsigned integer values.

F-4282 - 7bd579e - The JSON loader now rejects out-of-range signed integer values without relying on errno.

F-4283 - 8796b01 - The JSON loader now uses a wider accumulator so the uint32 range check works on 32-bit targets.

F-4278 - 185a990 - CAN addresses are now range checked without relying on errno on 32-bit targets.

F-6687 - 12d4fc3 - A new test covers uint16 config value range rejection and its boundary.

F-3435 - dd6857d - The uint8 parse buffer is now large enough to accept hex and octal interface values.

F-4322 - 5f1a512 - The JSON loader now rejects negative durations.

F-4565 - edb477f - The JSON loader now rejects an explicit LINK64 family when the address is not EUI-64 sized.

F-8780 - 58d619e - A null service lookup result is now treated as item not found.

F-8781 - 2085b8f - A null protocol lookup result is now treated as item not found.

F-3666 - 85c7175 - A bitmask address is now right-justified by byte count, which prevents an out-of-bounds write.

F-3873 - 70e32a3 - The JSON loader now bounds prefix-bits to the address family width.

F-13290 - d9fa5a0 - The actions-update rejection now reports through the parser error-position path.

F-2441 - 26af1c1 - A default-mode JSON config load that fails after flushing now fails closed, leaving the config flushed with a REJECT default policy.

F-15478 - c73e294 - Actions are now re-enabled when a LOAD_THEN_COMMIT load fails after the exchange.

F-2453 - efe5c33 - The JSON loader now parses AF_LOCAL path addresses, so a dump reloads symmetrically.

F-2854 - 4a3b93a - An explicit tcplike-port-numbers setting now wins over the protocol default.

F-3873 - 891d0b6 - A generic LINK prefix-bits is now judged the same whether it appears before or after its address.

F-2453 - ad8a630 - AF_LOCAL addresses now defer to a registered handler, and the built-in path limit stays byte-aligned.

Fix route dispatch, purge and match scoring defects (supersedes #104, 35 findings)

F-4562 - 21e7158 - Bitmask address match scoring now uses bytes and bits consistently.

F-4705 - 0f35126 - The bitmask compare padding offset is now computed in bytes instead of bits.

F-8764 - 3158353 - Stale purge now keeps connected routes that are within the max purgeable idle time.

F-13881 - b11e6bc - Dispatch now reports resource failures instead of masking them as fallthrough.

F-12514 - 754c2d2 - Copying route metadata now keeps the purge list consistent.

F-8751 - 28dc18f - Dispatch now refreshes the config and route flags after switching to the fallthrough route.

F-13287 - c2b726c - A disconnect now decrements the connection count regardless of the configured limit.

F-15468 - 785ff31 - A refreshed route is now always repositioned in the purge list.

F-2442 - 9f37e6e - Dispatch now sets the error result bit when an action chain fails.

F-2437 - aa4510d - Dispatch now warns once when unmatched traffic falls through with an unset default policy.

F-3441 - 8ce0cae - Caller-initialized dispatch input with internal-only result bits is now rejected.

F-6510 - d155b2e - A default policy that sets both accept and reject is now rejected.

F-1216 - f849f0b - The default event getter now reports the written label length.

F-10502 - b3d10ce - A zero count delta is now a no-op, and negative deltas are negated safely.

F-11618 - cd81ba7 - Setting a purge time on a route with no parent table is now rejected.

F-2860 - e63ec50 - Link and CAN address rendering now includes the final partial byte.

F-5564 - 4c5e1c7 - The route APIs now null check their result and count outputs before writing them.

F-10494 - 41cce96 - Route flag names are now matched by exact length, so parsing never reads past the name.

F-11605 - d3eebec - A new route is now freed and nulled when taking its parent event reference fails.

F-10493 - d549530 - Route clone now reads the address from the source route's address offset.

F-15469 - 61b26a6 - Wildcarding the remote address now compacts the address buffer so the local address stays valid.

F-8766 - 571d41e - Cloning a route table header now copies the max purgeable idle time.

F-12516 - fec2696 - The fallthrough route is now referenced before it is published into a cloned table.

F-10489 - 9b8d132 - Copying route metadata now carries the hit count across.

F-3667 - ab4c102 - A reset default policy is now accepted, and the port reset carries into fallthrough verdicts.

F-2841 - 8869ef3 - A new test covers dispatch rejecting caller-initialized verdict and status bits.

F-2465 - 8c469b8 - A new test covers the exact stale purge time and idle limit boundaries.

F-2459 - 85f1349 - A new test covers routes exempt from connection counting never being limited.

F-6258 - ce08512 - A new test covers connection limit enforcement and slot reuse at a positive limit.

F-5565 - 0648b2d - A new test covers the most specific of equal-priority overlapping routes winning.

F-2456 - a71802e - A new test covers the exact penalty box duration boundary.

F-2461 - efc7c7a - A new test covers a zero derogatory threshold disabling penalty boxing.

F-2464 - 7ae6d45 - A new test covers permanent penalty boxing and boxes with no recorded time.

F-3663 - fe4dd79 - A new test covers the penalty box trigger when commendable events are ignored.

F-13287 - 38ecde6 - Every connection is now counted so disconnects stay balanced when the limit changes, and the limit only decides REJECT.

F-15468 - 545f994 - A route's purge links are now cleared before it is reinserted into the purge list, which fixes an infinite purge scan.

F-8764 - e71f8be - The per-dispatch stale purge scan on the packet path is now bounded to eight entries.

F-8764 - 776333c - The bounded per-dispatch purge now requeues still-connected routes, so it reaches the expired routes behind them.

F-4562 - e1f1889 - Equal-priority bitmask routes are now ranked by the number of bits their mask constrains instead of by address similarity.

F-8764 - e34098f - The purge requeue deadline is now computed through the configured time callbacks.

F-4100 - 842f12a - max_connection_count above the 16-bit per-route counter maximum is now rejected instead of being silently capped.

F-8764 - 286d0f8 - Purge idle time for a never-hit route is now measured from its insertion, and a negative idle limit is treated as unlimited.

Fix table cloning, ID allocation and teardown in internal tables (supersedes #105, 4 findings)

F-6255 - de10018 - Cloning coupled address family tables now sets the prev links.

F-4280 - 7bb193d - The entry ID counter now skips the reserved null ID when it wraps.

F-8755 - f383969 - Delete now reclaims the newest entry ID instead of the second newest.

F-10490 - c2e538e - Entry destructor failures during table teardown are now reported, and teardown continues so the shutdown mutex is released.

Fix track peer insert results and unpurgeable routes (supersedes #106, 3 findings)

F-4564 - b440cf7 - Track-peer now initializes its insert results and merges them only on success.

F-2443 - 6c50456 - Track-peer now refuses to create routes that would never be purged.

F-2466 - 9b3c11c - The connection that spawns a track-peer route is now counted on that route.

Fix double round trip and literal parsing in centijson (supersedes #107, 4 findings)

F-6259 - 865f987 - Doubles are now printed with 17 significant digits so they round-trip exactly, including on FREERTOS and pre-C99 builds.

F-8756 - 8a15438 - Non-finite doubles are now dumped as null instead of an invalid token.

F-10508 - 03e4bf1 - Incomplete true, false and null literals at end of input are now rejected.

F-8772 - 6f5f7b1 - Double text that exactly fills the local conversion buffer is now accepted.

Fail closed in the lwIP packet filter glue (supersedes #108, 7 findings)

F-2438 - e0fe2fc - The lwIP glue now denies a packet when wolfSentry dispatch fails.

F-3866 - b024dee - The lwIP glue now denies a packet when the filter callback has no wolfSentry context.

F-10500 - 5a23110 - lwIP TCP close-wait events now set the close-wait action result.

F-3864 - a8e1a1d - Disabling the lwIP ICMPv4 filter now clears its mask and context.

F-3868 - e37b446 - The lwIP filter context and mask are now installed before the callback pointer.

F-4762 - 8a82314 - lwIP filter slots are now cleared only by the owning context, and a non-owner gets INCOMPATIBLE_STATE.

F-5004 - 5459984 - The STM32 example now publishes its wolfSentry context only after its policy is loaded.

Fix event label sizing and event config update validation (supersedes #109, 10 findings)

F-5558 - aa1fdbc - The event lookup buffer is now sized for a maximum-length label and its terminator.

F-13883 - 88ca8cc - New tests cover maximum-length event labels across the event lookup APIs.

F-8758 - 1c8daa6 - The event id output is now set only after the event is inserted.

F-11606 - 00ff7b2 - Event config updates now reject a NULL configuration.

F-11619 - 890d40f - Event config updates now reject route layout changes once routes use the event.

F-11602 - a7f0a58 - An event can no longer be set as its own auxiliary event.

F-5566 - 83936b7 - The subevent mark is now cleared when an event stops being any event's auxiliary event.

F-3870 - 74f2c64 - A new test covers an auxiliary event being barred from having its own auxiliary event.

F-3871 - 742b9aa - A new test covers a route parent event being barred from becoming an auxiliary event.

F-10506 - 27e469b - The default event priority is now documented, and a test covers an omitted priority behaving as zero.

F-13883 - 972f5ce - The JSON loader now accepts a maximum-length event label.

F-8758 - fc25c39 - The action id output is now set only after the action is inserted.

F-11619 - 3fe03d5 - The event layout guard now treats auxiliary event use and held references as route ownership.

Add route flag validation and purge limit tests (supersedes #110, 7 findings)

F-2846 - f942fef - A new test covers route insert rejecting a route with no direction flag.

F-2848 - 0f3ee63 - A new test covers route insert by exports rejecting a route with no direction flag.

F-3440 - 039b902 - A new test covers route flag validation rejecting inconsistent wildcard combinations.

F-2842 - 50cc0c8 - A new test covers route flag update rejecting penaltybox and greenlist together.

F-2844 - 1dacf1c - A new test covers route flag update rejecting changes to immutable flags on an inserted route.

F-2847 - 10f695e - A new test covers route flag update rejecting changes to internal table flags.

F-4563 - 6bb0e6a - A new test covers lowering the purgeable route limit purging the excess stale routes.

Follow-ups found by make check-all on the combined tree (11 commits)

F-8775 - 41e2942 - The table-less release test now initializes its route pointer, which the fortify-source build rejected under -Werror.

F-3442 - f148db4 - KV integers are now rendered without a 64-bit printf conversion, so the -m32 C89 build compiles and keeps every digit.

F-10491 - dbef6d7 - The intentional float round-trip check now carries a same-line cppcheck suppression, so the line-pinned analyzer filters stay valid.

F-8772 - e62e4ae - The 62 and 63 digit boundary test now compares against double-cast constants, so x87 excess precision under -m32 -std=c23 cannot fail it.

F-6511 - 37a1cd1 - The non-finite KV test now builds its values with strtod instead of NAN and INFINITY, which cppcheck could not parse.

305f8a9 - The new unit tests declare read-only pointers const and drop an unused return value, per cppcheck.

F-11617 - 7214539 - The action delete docs name the BUSY error in plain text, so doxygen reports no unresolved link.

7f454cb - The library dependency tests accept the glibc C23 __isoc23_strto* aliases that gcc 15 emits by default.

F-4277 - 32a8610 - The config magnitude check widens a hex digit before adding its offset, which clang-tidy flagged as a misplaced widening cast.

428c39c - The FreeRTOS arm32 first-stage image limit rises from 230000 to 240000 bytes, since the fixes add about 5 KB (225824 to 231104 bytes with arm-none-eabi-gcc 13.2).

a8ab5f9 - A make check-all workflow runs analyze-all, check and check-extra on Ubuntu 26.04 (gcc 15, clang 21, cppcheck 2.19), and the nightly run includes it. It skips sanitize-armeb-test, the two FreeRTOS arm32 image size tests and clang-tidy, which need a toolchain or private repo the runners do not have.

Adds make check-all targets in CI

[Copilot]

🟡 Changes recommended

Unresolved findings identify critical connection-accounting and failed-replacement data-loss bugs, along with memory leaks caused by lost ownership during JSON cleanup failures.

4 open issues

• Zero connection limit skips active connection accounting · New
• Failed replacement can delete the existing dictionary value · New
• Failed nested finalization leaks the unlinked subtree · New
• Failed clone cleanup can leak an initialized dictionary · New

What changed in this PR

This PR consolidates Fenrir fixes across wolfSentry’s core library, network integrations, and examples, addressing memory safety, lifecycle handling, parsing, and fail-closed behavior.

Changes:

• Hardens reference handling, cleanup, event validation, and JSON processing.
• Makes network filters and examples reject traffic when initialization or dispatch fails.
• Corrects API documentation and adds containerized checks to nightly automation.

File	Description
wolfsentry/​wolfssl_test.h	Corrects event argument annotations and uses NULL.
wolfsentry/​wolfsentry.h	Corrects API documentation and permits port-reset default policies.
wolfsentry/​wolfsentry_settings.h	Clarifies address-family naming configuration.
wolfsentry/​wolfsentry_lwip.h	Documents filter ownership and failure behavior.
wolfsentry/​wolfsentry_errcodes.h	Corrects locking macro documentation.
wolfsentry/​centijson_value.h	Clarifies dictionary callback return semantics.
wolfsentry/​centijson_sax.h	Corrects parser and writer callback documentation.
wolfsentry/​centijson_dom.h	Corrects dump callback error documentation.
tests/​filter-clang-analyzer.py	Updates line-specific analyzer suppressions.
src/​wolfsentry_ll.h	Clears boundary links during list insertion.
src/​wolfsentry_internal.h	Adds auxiliary-owner and dispatch-depth tracking.
src/​wolfsentry_internal.c	Fixes clone links, ID handling, and teardown diagnostics.
src/​wolfip/​packet_filter_glue.c	Hardens ownership, lifecycle mapping, and dispatch failures.
src/​lwip/​packet_filter_glue.c	Adds filter ownership and fail-closed handling.
src/​kv.c	Hardens value references, replacement, validation, and rendering.
src/​json/​centijson_value.c	Updates numeric checks, paths, and container cleanup.
src/​json/​centijson_sax.c	Fixes literal parsing and double serialization.
src/​json/​centijson_dom.c	Fixes allocator context and skipped-container nesting.
src/​events.c	Tracks auxiliary ownership and guards layout changes.
src/​addr_families.c	Fixes allocation cleanup, locking, and UNSPEC parsing.
src/​actions.c	Protects active dispatch and delays publishing inserted IDs.
src/​action_builtins.c	Updates track-peer insertion and connection accounting.
Makefile.analyzers	Updates dependency allowances and embedded image limits.
examples/​STM32-LWIP/​Src/​sentry.c	Publishes configured contexts and rejects dispatch failures.
examples/​STM32-LWIP/​README.md	Shows initialization failure handling.
examples/​notification-demo/​udp_to_dbus/​udp_to_dbus.c	Validates notification fields and escapes markup.
examples/​notification-demo/​log_server/​sentry.c	Escapes JSON labels and checks separator space.
examples/​notification-demo/​log_server/​log_server.c	Hardens certificate handling, circular logs, and shutdown.
examples/​Linux-LWIP/​sentry.c	Propagates initialization failures and denies dispatch errors.
examples/​Linux-LWIP/​ping.c	Handles ICMP allocation failure.
examples/​Linux-LWIP/​echo.c	Handles TCP setup failures and releases resources.
doc/​json_configuration.md	Documents the default event priority.
.github/​workflows/​nightly.yml	Adds check-all to nightly coordination.
.github/​workflows/​examples.yml	Retries the lwIP contrib checkout.
.github/​workflows/​check-all.yml	Adds containerized analysis and test jobs.
.github/​docker/​wolfsentry-check-all/​run-check-all.sh	Runs check groups with platform-specific exclusions.
.github/​docker/​wolfsentry-check-all/​Dockerfile	Defines the check-all toolchain image.

_{Review effort: Balanced}

[aidangarske]

@claude review

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #113

Scan targets checked: wolfsentry-src, wolfsentry-bugs
Not reviewed (no scan target covers them): .github/docker/wolfsentry-check-all/Dockerfile, .github/docker/wolfsentry-check-all/run-check-all.sh, .github/workflows/check-all.yml, .github/workflows/examples.yml, .github/workflows/nightly.yml, Makefile.analyzers, doc/json_configuration.md, examples/Linux-LWIP/echo.c, examples/Linux-LWIP/ping.c, examples/Linux-LWIP/sentry.c, examples/STM32-LWIP/README.md, examples/STM32-LWIP/Src/sentry.c, examples/notification-demo/log_server/log_server.c, examples/notification-demo/log_server/sentry.c, examples/notification-demo/udp_to_dbus/udp_to_dbus.c, src/wolfsentry_internal.h, src/wolfsentry_ll.h, tests/filter-clang-analyzer.py
Coverage: 20 of 23 in-scope changed file(s) opened by the reviewer; not opened: wolfsentry/centijson_dom.h, wolfsentry/centijson_sax.h, wolfsentry/wolfsentry_lwip.h

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #113

Scan targets checked: wolfsentry-src, wolfsentry-bugs
Not reviewed (no scan target covers them): .github/docker/wolfsentry-check-all/Dockerfile, .github/docker/wolfsentry-check-all/run-check-all.sh, .github/workflows/check-all.yml, .github/workflows/examples.yml, .github/workflows/nightly.yml, Makefile.analyzers, doc/json_configuration.md, examples/Linux-LWIP/echo.c, examples/Linux-LWIP/ping.c, examples/Linux-LWIP/sentry.c, examples/STM32-LWIP/README.md, examples/STM32-LWIP/Src/sentry.c, examples/notification-demo/log_server/log_server.c, examples/notification-demo/log_server/sentry.c, examples/notification-demo/udp_to_dbus/udp_to_dbus.c, src/wolfsentry_internal.h, src/wolfsentry_ll.h, tests/filter-clang-analyzer.py
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.