ssl.c split: cleanup

[SparkiDev]

Description

Clean up includes single return point from every function, consistent formatting function block comment and tests added.

ssl_api_rw.c: Cleanup; 6 helpers extracted from write_dup/shutdown; fixed a SendBuffered corner case that returned 0 instead of an error.

ssl_api_ext.c: Cleanup; extracted wolfssl_ticket_key_cb_process, wolfssl_rehandshake_prepare.

ssl_api_hs.c: Cleanup + de-indent; 9 helpers extracted, incl. shared wolfssl_handshake_flush/_done between connect and accept (~100 duplicated lines removed). wolfSSL_connect/accept left multi-exit.

ssl_api_cert.c: Cleanup of newer functions at end of file; extracted PushPeerCertToChain; fixed a double free in CreatePeerCertChain; fixed 5 wrong @param names.

ssl_api_crl_ocsp.c: Full cleanup of all 49 functions; wolfSSL_OCSP_parse_url rewritten; fixed a URL with no host returning success with the rest of the URL as the host; added IPv6 literal support; fixed 4 wrong WOLFSSL_ENTER names.

ssl.c: Moved the x509GetIssuerFromCM forward declaration here for clarity.

Testing

Maximal config.
OpenSSL API regression testing.

Tests added.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +44 B (+0.0%, 122,987 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 201,303 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 181,988 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +200 B, .text +320 B (+0.1%, 773,556 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 281,280 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 327,392 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 237,449 B / 262,144 B, total: 91% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 281,856 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 237,513 B / 262,144 B, total: 91% used)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 49,192 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• linuxkm-pie
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11022

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[SparkiDev]

Jenkins: retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 21 total — 14 posted, 7 skipped

Posted findings

• [High] New rw and hs tests call wolfTLSv1_2_*_method() without a !WOLFSSL_NO_TLS12 guard - build break in TLS 1.3-only builds — tests/api/test_ssl_rw.c:82
• [High] wolfSSL_OCSP_parse_url now rejects URLs with an explicit port and a ':' in the path — src/ssl_api_crl_ocsp.c:1339-1349
• [High] New !sentNotify branch in wolfSSL_shutdown overwrites WOLFSSL_SUCCESS and changes ssl->error on a pre-existing path — src/ssl_api_rw.c:960-976
• [High] Guard mismatches after the split leave three static functions unused or undefined under -Werror — src/ssl_api_hs.c:89-92
• [Medium] wolfSSL_writev: small-stack allocation regression, ssl dereferenced before validation, and stale guard indentation — src/ssl_api_rw.c:1077-1114
• [Medium] None of the three fixes this PR claims is covered by a test that could fail without it — src/ssl_api_rw.c:965-976
• [Medium] set0_verify_cert_store still leaks the handed-over reference on the sibling early-return path — src/ssl_api_cert.c:1740-1762
• [Medium] Doxygen blocks in ssl_api_crl_ocsp.c copy-pasted from neighbouring functions describe the wrong parameter — src/ssl_api_crl_ocsp.c:1172-1177
• [Medium] wolfSSL_UseMaxFragment overloads ret with three incompatible conventions — src/ssl_api_ext.c:247-278
• [Low] wolfSSL_SendUserCanceled doc omits WOLFSSL_FATAL_ERROR — doc/dox_comments/header_files/ssl.h:2542-2575
• [Low] UnloadIntermediateCerts NULL check hidden behind an unrelated WOLFSSL_TRUST_PEER_CERT guard — tests/api/test_ssl_cert.c:1179-1182
• [Low] Leftovers from the ssl_api_hs.c de-indent: an indented preprocessor block and three dead (void) casts — src/ssl_api_hs.c:1459-1478
• [Low] Comment in _Rehandshake describes the branch that is not taken — src/ssl_api_ext.c:988-993
• [Info] wolfSSL_get_ocsp_response is now the only unguarded function in a hardened file — src/ssl_api_crl_ocsp.c:780-793

Skipped findings

• [Medium] ChangeLog.md not updated for the user-visible behaviour changes in this PR
• [Low] Five bare scope blocks introduced in test_ssl_hs.c
• [Low] Three new tests carry comments that claim more than the assertions can prove
• [Low] ALPN test allocates the peer buffer with the wrong dynamic type
• [Low] Handshake state enums moved to file scope pollute the ssl.c amalgamation namespace with very generic names
• [Low] Flush progress messages switch from WOLFSSL_MSG to WOLFSSL_MSG_EX, dropping them where XVSNPRINTF is unavailable
• [Info] Inconsistent backslash alignment in the extended DECLS macros

Review generated by Skoll via Claude/Codex

[SparkiDev]

Jenkins: retest this please

FIPS aborted

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11022

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 17 total — 10 posted, 7 skipped

Posted findings

• [High] New !sentNotify tail in wolfSSL_shutdown can overwrite a WOLFSSL_SUCCESS result — src/ssl_api_rw.c:993-1004
• [High] Static test helpers guarded looser than their only callers: -Werror unused-function in TLS-1.3-only builds — tests/api/test_ssl_rw.c:40-41,482-483; tests/api/test_ssl_hs.c:408-409; tests/api/test_ssl_ext.c:228-230
• [Medium] Over-restrictive !WOLFSSL_NO_TLS12 guards silently drop TLS 1.3 test coverage — tests/api/test_ssl_ext.c:297-318; tests/api/test_ssl_cert.c:966-1006
• [Medium] Moved x509GetIssuerFromCM forward declaration loses the !NO_CERTS guard — src/ssl.c:424-429
• [Medium] Blind-private-key behaviour change shipped undeclared, and conflates OOM with "not an EC key" — src/ssl_api_hs.c:1462-1490
• [Low] producedDate accessors skipped by the file-wide NULL-hardening pass — src/ssl_api_crl_ocsp.c:846-871
• [Low] OCSP response test leaks the allocated buffer on the failure path — tests/api/test_ssl_crl_ocsp.c:310-321
• [Info] inject test never re-tries the call its comment says is accepted — tests/api/test_ssl_rw.c:656-671
• [Info] test reads ctx->CBClientCert under a wider guard than the field has — tests/api/test_ssl_cert.c:441-469
• [Info] wolfSSL_CTX_set_cert_store doc note does not match the guard it describes — src/ssl_api_cert.c:1632-1645

Skipped findings

• [Info] @param [in] ssl on two functions that mutate the object
• [Info] connect and accept compute advanceState by different rules for the same helper
• [Info] Vestigial ret = 0 and stale WANT_WRITE comment after the write-dup split
• [Info] myBuffer[0] = 0 makes the -Wmaybe-uninitialized pragma and its comment redundant
• [Info] endTime passed to the reset-timer helper while potentially uninitialized
• [Info] set0_verify_cert_store with the CTX's own store is now destructive rather than a no-op
• [Info] Dead (void)ssl in wolfSSL_negotiate

Review generated by Skoll via Claude/Codex

[SparkiDev]

Jenkins: retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 16 total — 9 posted, 7 skipped

Posted findings

• [High] New set0 free in wolfssl_set_verify_cert_store turns a safe no-op into a dangling pointer, and the new test cannot fail without it — src/ssl_api_cert.c:1748-1756
• [Medium] Two static helpers are guarded wider than their only callers, giving -Wunused-function under -Werror — tests/api/test_ssl_cert.c:416-419
• [Medium] wolfSSL_shutdown return value changes from 0 to WOLFSSL_FATAL_ERROR with no ChangeLog entry — src/ssl_api_rw.c:797-834
• [Medium] New shutdown branch reports SOCKET_PEER_CLOSED_E for locally-initiated closures, masking the real reason — src/ssl_api_rw.c:988-1006
• [Medium] wolfSSL_want_read/wolfSSL_want_write gained a "Must not be NULL" comment but no NULL check, unlike every other API in the file — src/ssl_api_rw.c:1203-1241
• [Low] CRL bad-argument test is over-gated on NO_FILESYSTEM and skips most of the CRL API — tests/api/test_ssl_crl_ocsp.c:47-61
• [Low] New ticket-key-callback test: gated on a macro the code under test does not depend on, and its callback documents a check it never performs — tests/api/test_ssl_ext.c:1190-1195
• [Low] Rewritten OCSP URL parser: unvalidated port string and userinfo folded into the host or port — src/ssl_api_crl_ocsp.c:1419-1433
• [Low] test_wolfSSL_rw_bad_args calls wolfSSL_recv without the !WOLFSSL_LEANPSK guard used by test_wolfSSL_send — tests/api/test_ssl_rw.c:407-447

Skipped findings

• [Medium] Blind-private-key fix in wolfSSL_set_accept_state is still undeclared, and the OOM path is now fail-open
• [Medium] New handshake tests assert only that a value is non-NULL or one-of-two, so they cannot catch a wrong mapping
• [Low] New wolfSSL_writev argument validation is untested
• [Low] Three new doc comments in ssl_api_crl_ocsp.c describe the wrong thing
• [Low] New standalone scope blocks appear once the preprocessor removes the attaching statement
• [Info] Preprocessor continuation lines de-indented flush left, hurting readability
• [Info] Comment in the stapled-response test describes the wrong assertion

Review generated by Skoll via Claude/Codex

[Frauschi]

Some of these findings may come from missing CI coverage, see #11036

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 16 total — 10 posted, 6 skipped

Posted findings

• [High] Build break: test_wolfSSL_pk_callback_ctx calls VerifyMac accessors that do not exist in an AEAD-only TLS 1.2 build — tests/api/test_ssl_hs.c:487-489
• [High] Build break: the shared I/O helper block in test_ssl_hs.c is guarded neither as a superset nor a subset of its six callers — tests/api/test_ssl_hs.c:911-913,1291-1293
• [Medium] wolfSSL_read_ex() changes its NULL-object return value in non-OPENSSL_EXTRA builds, and the new Doxygen documents the old behaviour — src/ssl_api_rw.c:656-665
• [Medium] wolfSSL_ex_wrapper: timer-setup helper overwrites the WOLFSSL_FATAL_ERROR default in ret — src/ssl_api_hs.c:1316,1341-1345
• [Medium] Two new tests load PEM credential files without requiring WOLFSSL_PEM_TO_DER — tests/api/test_ssl_hs.c:1163-1165,tests/api/test_ssl_cert.c:912-914
• [Medium] The wolfSSL_shutdown change is neither covered by the new test nor described in the public Doxygen — tests/api/test_ssl_rw.c:824-826
• [Low] Rewritten Doxygen blocks still carry copy-pasted parameter text and wrong parameter directions — src/ssl_api_crl_ocsp.c:213-220,1044-1051,1099-1105
• [Low] myBuffer[0] = 0 is a dead store that the retained pragma already covers — src/ssl_api_rw.c:1152-1171
• [Low] New helper doc blocks omit return codes that reach the caller — src/ssl_api_rw.c:125-164,368-412
• [Low] *wolfSSL_OCSP_parse_url leaves ssl set on failure though the cleanup promises otherwise — src/ssl_api_crl_ocsp.c:1349-1353,1488-1498

Skipped findings

• [Medium] wolfSSL_set_accept_state gains a functional change for WOLFSSL_BLIND_PRIVATE_KEY builds, undocumented and untested
• [Medium] Step-failure tests accept both success and failure, so they cannot detect a regression
• [Low] wolfssl_handshake_flush parameter named 'connect' shadows the POSIX socket function
• [Low] Preprocessor directives left at column 0 inside the newly nested blocks
• [Low] WOLFSSL_ABI moved onto the return-type line, deviating from the tree-wide convention
• [Info] writeStates is a scalar loop bound carrying a plural array-style name

Review generated by Skoll via Claude/Codex

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 11 total — 4 posted, 7 skipped

Posted findings

• [Medium] wolfSSL_set_secret documents a MEMORY_E return it can never produce — src/ssl_api_dtls.c:755-765
• [Medium] set0 path of wolfssl_set_verify_cert_store leaks the caller's reference, and the comment's rationale is incorrect — src/ssl_api_cert.c:1761-1776
• [Medium] New test assertions that cannot fail: the state-string loops and the write_ex out-parameter check — tests/api/test_ssl_hs.c:153-208
• [Low] The doc/dox_comments sweep left six defects in the public manual — doc/dox_comments/header_files/ssl.h:2525-2536

Skipped findings

• [Medium] The new ChangeLog section: missing behavioural changes, an overstated claim, and wrong categorisation
• [Low] x509GetIssuerFromCM: the forward declaration carries !NO_CERTS but the use site does not
• [Low] Step-failure tests: two entries are not steps, and the expected result is selected by a positional magic index
• [Low] Two coverage claims that do not hold in the config or build they name
• [Low] No regression test for the CreatePeerCertChain double free the PR fixes
• [Low] Leftovers from the mechanical cleanup pass across the split files
• [Info] client_cert_cb guard narrowing is a build fix, not an API removal (verified, no action needed)

Review generated by Skoll via Claude/Codex

[SparkiDev]

Jenkins: retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 13 total — 11 posted, 2 skipped

Posted findings

• [Medium] New NULL-clear path in wolfSSL_CTX_set1_verify_cert_store can leave ctx->cm->x509_store_p dangling — src/ssl_api_cert.c:1703-1708
• [Medium] Shutdown's new "always leave a reason" contract does not cover the repeat-call case — src/ssl_api_rw.c:1017-1035
• [Medium] test_wolfSSL_ticket_key_cb_renew_ext cannot fail if the RENEW handling is reverted — tests/api/test_ssl_ext.c:1369-1372
• [Medium] State-string enum and OUTPUT_STR table split ~300 lines apart with no compile-time size check — src/ssl_api_hs.c:1684-1709
• [Medium] Path ':' rejected only when no explicit port is present, which also rejects unambiguous bracketed-IPv6 URLs — src/ssl_api_crl_ocsp.c:1424-1439
• [Low] The mechanical cleanup is not applied uniformly: an early return survives in wolfSSL_write_ex, and three converted returns lose the error trace master emitted — src/ssl_api_rw.c:453-458
• [Low] wolfssl_shutdown_flush_alert documents "0 = shutdown must continue" but returns 0 after completing the shutdown — src/ssl_api_rw.c:806-853
• [Low] Preprocessor hygiene in src/ssl_api_hs.c: four function-local macros still leak into the files included after it, and the 142-line helper block closes on a bare #endif — src/ssl_api_hs.c:1328
• [Low] Two test_ssl_rw.c assertions rely on things they should not: an unportable SIZE_MAX sentinel that truncates to int, and an over-long length that is safe only by implementation detail — tests/api/test_ssl_rw.c:481-491
• [Low] OCSP URL failure cases do not check or free the output pointers — tests/api/test_ssl_crl_ocsp.c:457-465
• [Info] QUIC helper block omits WOLFSSL_TLS13 while its caller uses a TLS 1.3 method — tests/api/test_ssl_hs.c:844-846

Skipped findings

• [Medium] The OCSP parse_url rewrite is documented as something it is not: the wolfIO_DecodeUrl parity claim does not hold, and the grammar changes are absent from the ChangeLog
• [Info] wolfssl_rehandshake_prepare dereferences ssl->secure_renegotiation with no documented precondition

Review generated by Skoll via Claude/Codex

[Frauschi]

LGTM

[Frauschi]

The failing FIPS dev-no-POST is a flaky run, already resolved by #11091 (merged).