Documentation and embedded user_settings.h.

.github/configs/os-check-linux.json

@@ -241,7 +241,7 @@
 {"name": "no-wolfssl-client", "minutes": 1.0,
  "configure": ["CPPFLAGS=-DNO_WOLFSSL_CLIENT"]},
 {"name": "testwolfcrypt-ca", "minutes": 1.0,
- "comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_pq.h (requires --enable-experimental) and user_settings_baremetal.h (static memory, custom platform).",
+ "comment": "user_settings.h builds running only testwolfcrypt: pure crypto, no platform-specific features, so Linux-only coverage is sufficient. Not converted: user_settings_baremetal.h.",
  "user_settings": "examples/configs/user_settings_ca.h",
  "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
@@ -261,6 +261,35 @@
  "user_settings": "examples/configs/user_settings_curve25519nonblock.h",
  "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
+{"name": "testwolfcrypt-embedded", "minutes": 1.0,
+ "comment": "Default profile of the embedded template: portable C, SP math all, TLS 1.3 client, ECC P-256 + AES-GCM.",
+ "user_settings": "examples/configs/user_settings_embedded.h",
+ "cflags": "",
+ "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
+{"name": "testwolfcrypt-embedded-noheap", "minutes": 1.0,
+ "comment": "Same template with the no-heap profile (WOLFSSL_NO_MALLOC/WOLFSSL_SP_NO_MALLOC via WC_CFG_HEAP 0), which is the configuration its stack-only constraints apply to.",
+ "user_settings": "examples/configs/user_settings_embedded.h",
+ "cflags": "",
+ "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_HEAP=0", "WC_CFG_SMALL_STACK=0"]],
+ "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
+{"name": "testwolfcrypt-embedded-cryptonly", "minutes": 1.0,
+ "comment": "wolfCrypt-only profile (both TLS versions off), which exercises the WOLFCRYPT_ONLY/NO_TLS path and the derived WC_CFG_TLS.",
+ "user_settings": "examples/configs/user_settings_embedded.h",
+ "cflags": "",
+ "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_TLS13=0"]],
+ "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
+{"name": "testwolfcrypt-embedded-spmath", "minutes": 1.0,
+ "comment": "Restricted SP math (WOLFSSL_SP_MATH) with the assembly off, covering the other math back end and the WC_CFG_ASM_SP 0 path.",
+ "user_settings": "examples/configs/user_settings_embedded.h",
+ "cflags": "",
+ "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_MATH_ALL_SIZES=0", "WC_CFG_ASM_SP=0"]],
+ "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
+{"name": "testwolfcrypt-embedded-maxed", "minutes": 1.0,
+ "comment": "Wide profile: RSA, DH, the extra curves, X25519/Ed25519, ML-KEM and ML-DSA, every digest, ChaCha-Poly and the size knobs off.",
+ "user_settings": "examples/configs/user_settings_embedded.h",
+ "cflags": "",
+ "prepare": [["../.github/scripts/set-user-setting.sh", "user_settings.h", "WC_CFG_SMALL=0", "WC_CFG_RSA=1", "WC_CFG_DH=1", "WC_CFG_ECC_P384=1", "WC_CFG_CURVE25519=1", "WC_CFG_ED25519=1", "WC_CFG_MLKEM=1", "WC_CFG_MLDSA=1", "WC_CFG_SHA224=1", "WC_CFG_SHA3=1", "WC_CFG_CHACHA_POLY=1"]],
+ "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-min-ecc", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_min_ecc.h",
  "cflags": "",
@@ -273,6 +302,11 @@
  "user_settings": "examples/configs/user_settings_pkcs7.h",
  "cflags": "",
  "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
+{"name": "testwolfcrypt-pq", "minutes": 1.0,
+ "comment": "ML-KEM + ML-DSA post-quantum profile. Builds without --enable-experimental; testwolfcrypt runs the ML-DSA KATs.",
+ "user_settings": "examples/configs/user_settings_pq.h",
+ "cflags": "",
+ "configure": ["--enable-usersettings", "--disable-examples"], "check": false, "run": [["wolfcrypt/test/testwolfcrypt"]]},
 {"name": "testwolfcrypt-rsa-only", "minutes": 1.0,
  "user_settings": "examples/configs/user_settings_rsa_only.h",
  "cflags": "",

.github/scripts/set-user-setting.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+#
+# set-user-setting.sh
+#
+# Set WC_CFG_* switches in a copy of a user_settings.h template, for CI configs
+# that build the same template in more than one profile.
+#
+# Usage:
+#   set-user-setting.sh <user_settings.h> NAME=VALUE [NAME=VALUE ...]
+#
+# Why this exists rather than a sed in the JSON: a `sed -i` matching the whole
+# line, interior alignment included, silently does nothing if the template is
+# ever re-aligned, and the config then quietly tests the default profile
+# instead of the one it names. This matches on the switch name alone and fails
+# if a switch is missing, so a rename or a typo is a build failure rather than
+# a test that stopped testing anything.
+
+set -eu
+
+if [ "$#" -lt 2 ]; then
+    echo "usage: $0 <user_settings.h> NAME=VALUE [NAME=VALUE ...]" >&2
+    exit 2
+fi
+
+file=$1
+shift
+
+[ -f "$file" ] || { echo "$0: no such file: $file" >&2; exit 1; }
+
+for pair in "$@"; do
+    case $pair in
+        *=*) ;;
+        *) echo "$0: expected NAME=VALUE, got '$pair'" >&2; exit 2 ;;
+    esac
+    name=${pair%%=*}
+    value=${pair#*=}
+
+    # The switch must exist, and exactly once, or the caller's intent is
+    # already wrong.
+    count=$(grep -c "^#define ${name}[[:space:]]" "$file" || true)
+    if [ "$count" != "1" ]; then
+        echo "$0: '${name}' appears ${count} time(s) in ${file}, expected 1" >&2
+        exit 1
+    fi
+
+    # Rewrite just the value field, keeping the column the template aligns to
+    # and any trailing comment on the line.
+    awk -v n="$name" -v v="$value" '
+        $0 ~ "^#define " n "[[:space:]]" {
+            # prefix = "#define NAME" plus the alignment whitespace
+            match($0, "^#define[ \t]+" n "[ \t]+")
+            prefix = substr($0, 1, RLENGTH)
+            rest = substr($0, RLENGTH + 1)
+            # drop the old value token, keep whatever follows it
+            sub("^[^ \t]+", "", rest)
+            print prefix v rest
+            next
+        }
+        { print }
+    ' "$file" > "$file.tmp"
+    mv "$file.tmp" "$file"
+
+    # Confirm it took.
+    if ! grep -q "^#define ${name}[[:space:]]\+${value}\([[:space:]]\|$\)" \
+            "$file"; then
+        echo "$0: failed to set ${name} to ${value} in ${file}" >&2
+        exit 1
+    fi
+done

.wolfssl_known_macro_extras

@@ -862,6 +862,7 @@ WOLFSSL_HARDEN_TLS_ALLOW_OLD_TLS
 WOLFSSL_HARDEN_TLS_ALLOW_TRUNCATED_HMAC
 WOLFSSL_HARDEN_TLS_NO_PKEY_CHECK
 WOLFSSL_HARDEN_TLS_NO_SCR_CHECK
+WOLFSSL_HAVE_KYBER
 WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY
 WOLFSSL_I2D_ECDSA_SIG_ALLOC
 WOLFSSL_IAR_ARM_TIME