zephyr: build with Zephyr 4.5 and update the CI release matrix

.github/scripts/zephyr-4.x/builds.txt

@@ -4,13 +4,19 @@ native_sim          samples/wolfssl_tls_sock
 native_sim          samples/wolfssl_tls_sock    external_libc.conf
 native_sim          samples/wolfssl_tls_sock    tls_cert.conf
 native_sim          samples/wolfssl_tls_sock    ocsp.conf
+native_sim          samples/wolfssl_tls_sock    dtls13.conf
 native_sim          samples/wolfssl_test
 native_sim          samples/wolfssl_test        external_libc.conf
 native_sim          samples/wolfssl_benchmark
 native_sim          samples/wolfssl_benchmark   external_libc.conf
 native_sim          samples/wolfssl_test        prj-cert.conf
 native_sim          samples/wolfssl_test        prj-x25519-ed448.conf
 native_sim          samples/wolfssl_test        prj-ed25519-x448.conf
+native_sim          samples/wolfssl_test        sp_stack.conf
+native_sim          samples/wolfssl_test        rsa_2048.conf
+native_sim          samples/wolfssl_test        rsa_3072.conf
+native_sim          samples/wolfssl_test        rsa_3072_ecc_custom.conf
+native_sim          samples/wolfssl_test        no_ecc_x25519_psk.conf
 # external_libc overlay is native_sim-only in the original Jenkins matrix
 frdm_rw612/rw612    samples/wolfssl_tls_sock
 frdm_rw612/rw612    samples/wolfssl_test

.github/scripts/zephyr-4.x/dtls13.conf

@@ -0,0 +1,3 @@
+# DTLS 1.3, with ML-KEM from the sample's prj.conf
+CONFIG_WOLFSSL_DTLS=y
+CONFIG_WOLFSSL_DTLS_VERSION_1_3=y

.github/scripts/zephyr-4.x/no_ecc_x25519_psk.conf

@@ -0,0 +1,4 @@
+# TLS without ECC: X25519 is the only key exchange group, with PSK suites
+CONFIG_WOLFSSL_ECC=n
+CONFIG_WOLFSSL_CURVE25519=y
+CONFIG_WOLFSSL_PSK=y

.github/scripts/zephyr-4.x/rsa_2048.conf

@@ -0,0 +1,2 @@
+# Largest RSA key 2048 bits
+CONFIG_WOLFSSL_RSA_MAX_BITS_2048=y

.github/scripts/zephyr-4.x/rsa_3072.conf

@@ -0,0 +1,2 @@
+# Largest RSA key 3072 bits
+CONFIG_WOLFSSL_RSA_MAX_BITS_3072=y

.github/scripts/zephyr-4.x/rsa_3072_ecc_custom.conf

@@ -0,0 +1,9 @@
+# Custom curves (prj-ecc-custom.conf) with the largest RSA key 3072 bits
+CONFIG_WOLFSSL_ECC=y
+CONFIG_WOLFSSL_ECC_256=y
+CONFIG_WOLFSSL_ECC_384=y
+CONFIG_WOLFSSL_ECC_512=y
+CONFIG_WOLFSSL_ECC_BRAINPOOL=y
+CONFIG_MAIN_STACK_SIZE=65536
+CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536
+CONFIG_WOLFSSL_RSA_MAX_BITS_3072=y

.github/scripts/zephyr-4.x/sp_stack.conf

@@ -0,0 +1,2 @@
+# SP math temporaries on the thread stack
+CONFIG_WOLFCRYPT_SP_SMALL_STACK=n

.github/scripts/zephyr-4.x/zephyr-test.sh

@@ -25,7 +25,7 @@
 #   -h, --help             Show this help
 #
 # Examples:
-#   # Test master against Zephyr 4.1.0 for native_sim
+#   # Test master against Zephyr 4.3.0 for native_sim
 #   ./zephyr-test.sh
 #
 #   # Test a specific branch for frdm_rw612 on Zephyr 4.3.0
@@ -54,7 +54,7 @@ set -euo pipefail
 # Defaults
 WOLFSSL_REPO="https://github.com/wolfSSL/wolfssl"
 WOLFSSL_BRANCH="master"
-ZEPHYR_VERSION="v4.1.0"
+ZEPHYR_VERSION="v4.3.0"
 BOARD_TARGET="native_sim"
 SAMPLE_NAME="wolfssl_tls_sock"
 SUBDIR="samples"

.github/workflows/zephyr-4.x.yml

@@ -30,7 +30,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        zephyr-ref: [ v4.1.0, v4.3.0, v4.4.0 ]
+        zephyr-ref: [ v4.3.0, v4.4.0, v4.5.0 ]
     steps:
       - name: Checkout test driver
         uses: actions/checkout@v5

.github/workflows/zephyr.yml

@@ -23,10 +23,8 @@ jobs:
       fail-fast: false
       matrix:
         config:
-          - zephyr-ref: v3.4.0
-            zephyr-sdk: 0.16.1
-          - zephyr-ref: v3.5.0
-            zephyr-sdk: 0.16.3
+          - zephyr-ref: v3.7.2
+            zephyr-sdk: 0.16.8
           - zephyr-ref: v2.7.4
             zephyr-sdk: 0.16.3
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
@@ -92,17 +90,8 @@ jobs:
       - name: Run wolfssl test
         id: wolfssl-test
         working-directory: zephyr
-        # Scope -T to the sample directory (not the whole module) so twister does
-        # not load zephyr/tests/*/testcase.yaml. The condvar test's modern
-        # list-form platform_allow is rejected by the 2.7.4 twister schema, and
-        # this is the only sample step that runs on 2.7.4.
-        #
-        # Name the two scenarios rather than running the whole sample: the rest
-        # need a Zephyr these versions predate - hierarchical board names,
-        # COMMON_LIBC_MALLOC_ARENA_SIZE, and toolchains beyond the x86_64 one
-        # installed above. --test drops the others before their platform_allow
-        # is resolved, so an unrecognized board does not abort the run - but
-        # the yaml is still parsed, so a modern-only key would.
+        # 2.7.4's twister rejects the zephyr/tests yaml, so -T stays on the
+        # sample; the other scenarios need boards or toolchains not set up here.
         run: |
           ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/wolfssl_test \
             --test sample.crypto.wolfssl_test \

.wolfssl_known_macro_extras

@@ -191,6 +191,7 @@ CONFIG_WOLFCRYPT_FIPS_V5_2_3
 CONFIG_WOLFCRYPT_FIPS_V6
 CONFIG_WOLFCRYPT_FIPS_V7
 CONFIG_WOLFCRYPT_SP_SMALL
+CONFIG_WOLFCRYPT_SP_SMALL_STACK
 CONFIG_WOLFSSL
 CONFIG_WOLFSSL_AES_BITSLICED
 CONFIG_WOLFSSL_AES_TOUCH_LINES
@@ -212,6 +213,7 @@ CONFIG_WOLFSSL_CRYPTO_CB
 CONFIG_WOLFSSL_CURVE25519
 CONFIG_WOLFSSL_CURVE448
 CONFIG_WOLFSSL_DTLS
+CONFIG_WOLFSSL_DTLS_VERSION_1_3
 CONFIG_WOLFSSL_ECC
 CONFIG_WOLFSSL_ECC_256
 CONFIG_WOLFSSL_ECC_384
@@ -254,6 +256,9 @@ CONFIG_WOLFSSL_POST_HANDSHAKE_AUTH
 CONFIG_WOLFSSL_PSK
 CONFIG_WOLFSSL_PUBLIC_ASN
 CONFIG_WOLFSSL_RSA
+CONFIG_WOLFSSL_RSA_MAX_BITS_2048
+CONFIG_WOLFSSL_RSA_MAX_BITS_3072
+CONFIG_WOLFSSL_RSA_MAX_BITS_4096
 CONFIG_WOLFSSL_RSA_PSS
 CONFIG_WOLFSSL_SESSION_CACHE
 CONFIG_WOLFSSL_SESSION_EXPORT

src/internal.c

@@ -40048,6 +40048,7 @@ int SendClientKeyExchange(WOLFSSL* ssl)
                         break;
                     }
                 #endif
+                #ifdef HAVE_ECC
                     ret = EccSharedSecret(
                         ssl,
                         (ecc_key*)ssl->hsKey, ssl->peerEccKey,
@@ -40065,6 +40066,9 @@ int SendClientKeyExchange(WOLFSSL* ssl)
                                                       (void**)&ssl->peerEccKey);
                         ssl->peerEccKeyPresent = 0;
                     }
+                #else
+                    ret = BAD_KEA_TYPE_E;
+                #endif
                     break;
                 }
             #endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
@@ -48373,6 +48377,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
                             break;
                         }
                     #endif
+                    #ifdef HAVE_ECC
                         /* Generate shared secret */
                         ret = EccSharedSecret(ssl,
                             ssl->eccTempKey, ssl->peerEccKey,
@@ -48390,6 +48395,9 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
                                                       (void**)&ssl->peerEccKey);
                             ssl->peerEccKeyPresent = 0;
                         }
+                    #else
+                        ret = BAD_KEA_TYPE_E;
+                    #endif
                         break;
                     }
                 #endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */

src/ssl_api_rw.c

@@ -1284,6 +1284,13 @@ int wolfSSL_has_pending(const WOLFSSL* ssl)
     else if (ssl->buffers.inputBuffer.length > ssl->buffers.inputBuffer.idx) {
         ret = 1;
     }
+    #elif defined(WOLFSSL_DTLS)
+    /* A DTLS read takes a whole datagram, which can hold more records. They
+     * may carry no application data, so wolfSSL_read() can still WANT_READ. */
+    else if (ssl->options.dtls &&
+             ssl->buffers.inputBuffer.length > ssl->buffers.inputBuffer.idx) {
+        ret = 1;
+    }
     #endif
 
     return ret;

tests/api/test_ssl_rw.c

@@ -408,6 +408,88 @@ int test_wolfSSL_pending_api(void)
     return EXPECT_RESULT();
 }
 
+/* Test wolfSSL_has_pending() with two DTLS records in one datagram.
+ *
+ * A DTLS read takes the whole datagram, so the second record is still
+ * buffered, though not decrypted, after the first one is read.
+ *
+ * @return  TEST_SUCCESS on success.
+ */
+int test_wolfSSL_has_pending_dtls_datagram(void)
+{
+    EXPECT_DECLS;
+#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS) && \
+    (!defined(WOLFSSL_NO_TLS12) || defined(WOLFSSL_DTLS13))
+    WOLFSSL_CTX* ctx_c = NULL;
+    WOLFSSL_CTX* ctx_s = NULL;
+    WOLFSSL* ssl_c = NULL;
+    WOLFSSL* ssl_s = NULL;
+    struct test_memio_ctx test_ctx;
+    byte reply[1];
+    size_t i;
+    struct {
+        method_provider client_meth;
+        method_provider server_meth;
+        const char* cipher;
+    } params[] = {
+#ifndef WOLFSSL_NO_TLS12
+        { wolfDTLSv1_2_client_method, wolfDTLSv1_2_server_method, NULL },
+#if !defined(WOLFSSL_AEAD_ONLY) && !defined(NO_RSA) && !defined(NO_AES) && \
+    defined(HAVE_AES_CBC) && !defined(NO_SHA256) && defined(HAVE_ECC)
+        { wolfDTLSv1_2_client_method, wolfDTLSv1_2_server_method,
+          "ECDHE-RSA-AES128-SHA256" },
+#endif
+#endif
+#ifdef WOLFSSL_DTLS13
+        { wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method, NULL },
+#endif
+    };
+
+    for (i = 0; i < XELEM_CNT(params) && !EXPECT_FAIL(); i++) {
+        XMEMSET(&test_ctx, 0, sizeof(test_ctx));
+        ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c,
+            &ssl_s, params[i].client_meth, params[i].server_meth), 0);
+        if (params[i].cipher != NULL) {
+            ExpectIntEQ(wolfSSL_set_cipher_list(ssl_c, params[i].cipher),
+                WOLFSSL_SUCCESS);
+            ExpectIntEQ(wolfSSL_set_cipher_list(ssl_s, params[i].cipher),
+                WOLFSSL_SUCCESS);
+        }
+        ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
+        test_memio_clear_buffer(&test_ctx, 1);
+
+        ExpectIntEQ(wolfSSL_write(ssl_s, "A", 1), 1);
+        ExpectIntEQ(wolfSSL_write(ssl_s, "B", 1), 1);
+
+        /* Deliver both records in one datagram */
+        ExpectIntEQ(test_ctx.c_msg_count, 2);
+        if (EXPECT_SUCCESS()) {
+            test_ctx.c_msg_sizes[0] += test_ctx.c_msg_sizes[1];
+            test_ctx.c_msg_count = 1;
+        }
+
+        ExpectIntEQ(wolfSSL_read(ssl_c, reply, sizeof(reply)), 1);
+        ExpectIntEQ(reply[0], 'A');
+        ExpectIntEQ(wolfSSL_pending(ssl_c), 0);
+        ExpectIntEQ(wolfSSL_has_pending(ssl_c), 1);
+
+        ExpectIntEQ(wolfSSL_read(ssl_c, reply, sizeof(reply)), 1);
+        ExpectIntEQ(reply[0], 'B');
+        ExpectIntEQ(wolfSSL_has_pending(ssl_c), 0);
+
+        wolfSSL_free(ssl_c);
+        ssl_c = NULL;
+        wolfSSL_free(ssl_s);
+        ssl_s = NULL;
+        wolfSSL_CTX_free(ctx_c);
+        ctx_c = NULL;
+        wolfSSL_CTX_free(ctx_s);
+        ctx_s = NULL;
+    }
+#endif
+    return EXPECT_RESULT();
+}
+
 /* Test parameter validation across the read/write APIs.
  *
  * Every entry point in ssl_api_rw.c rejects a NULL object, a NULL buffer or a

tests/api/test_ssl_rw.h

@@ -29,6 +29,7 @@ int test_wolfSSL_writev(void);
 int test_wolfSSL_get_shutdown(void);
 int test_wolfSSL_want(void);
 int test_wolfSSL_pending_api(void);
+int test_wolfSSL_has_pending_dtls_datagram(void);
 int test_wolfSSL_rw_bad_args(void);
 int test_wolfSSL_rw_info_callback(void);
 int test_wolfSSL_write_ex_partial(void);
@@ -58,6 +59,7 @@ int test_wolfSSL_write_dup_max_fragment(void);
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_get_shutdown),                  \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_want),                          \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_pending_api),                   \
+        TEST_DECL_GROUP("ssl_rw", test_wolfSSL_has_pending_dtls_datagram),     \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_rw_bad_args),                   \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_rw_info_callback),              \
         TEST_DECL_GROUP("ssl_rw", test_wolfSSL_write_ex_partial),              \

wolfssl/wolfcrypt/settings.h

@@ -3176,6 +3176,14 @@
     #include <zephyr/kernel.h>
     #include <zephyr/sys/printk.h>
     #include <zephyr/sys/util.h>
+    #if defined(WOLFSSL_HAVE_MIN) || defined(WOLFSSL_HAVE_MAX)
+        /* Zephyr 4.5 moved the lowercase min() and max() out of util.h */
+        #ifdef __has_include
+            #if __has_include(<zephyr/sys/minmax.h>)
+                #include <zephyr/sys/minmax.h>
+            #endif
+        #endif
+    #endif
 #else
     #include <kernel.h>
     #include <sys/printk.h>

zephyr/CMakeLists.txt

@@ -18,6 +18,16 @@ if(CONFIG_WOLFSSL)
         ${ZEPHYR_CURRENT_MODULE_DIR}/zephyr
         )
 
+    # user_settings.h builds without DH, so TLS needs one of these groups.
+    if(NOT CONFIG_WOLFSSL_HAS_SETTINGS_FILE AND NOT CONFIG_WOLFCRYPT_FIPS
+       AND NOT CONFIG_WOLFSSL_CRYPTO_ONLY AND NOT CONFIG_WOLFSSL_ECC
+       AND NOT CONFIG_WOLFSSL_CURVE25519 AND NOT CONFIG_WOLFSSL_CURVE448
+       AND NOT CONFIG_WOLFSSL_MLKEM)
+      message(FATAL_ERROR "wolfSSL TLS needs a key exchange group: enable "
+              "CONFIG_WOLFSSL_ECC, CONFIG_WOLFSSL_CURVE25519, CONFIG_WOLFSSL_CURVE448 "
+              "or CONFIG_WOLFSSL_MLKEM, or set CONFIG_WOLFSSL_CRYPTO_ONLY")
+    endif()
+
     zephyr_library()
     # Library sources only, never the application, as the top-level CMake does.
     # The v5 kdf.c predates libwolfssl_sources.h: without this, types.h pulls

zephyr/Kconfig

@@ -251,8 +251,18 @@ config WOLFSSL_TLS_VERSION_1_3
 config WOLFSSL_DTLS
   bool "wolfSSL DTLS support"
   depends on !WOLFSSL_HAS_SETTINGS_FILE
+  depends on WOLFSSL_TLS_VERSION_1_2 || WOLFSSL_TLS_VERSION_1_3
+  select WOLFSSL_DTLS_VERSION_1_3 if !WOLFSSL_TLS_VERSION_1_2
   help
-    Enable DTLS support
+    Enable DTLS (WOLFSSL_DTLS). DTLS 1.2 is built with
+    WOLFSSL_TLS_VERSION_1_2 and DTLS 1.3 with WOLFSSL_DTLS_VERSION_1_3.
+
+config WOLFSSL_DTLS_VERSION_1_3
+  bool "DTLS 1.3"
+  depends on WOLFSSL_DTLS && WOLFSSL_TLS_VERSION_1_3
+  help
+    Enable DTLS 1.3 (WOLFSSL_DTLS13). Zephyr's socket API offers DTLS 1.2
+    only, so this serves applications that use the wolfSSL API directly.
 
 config WOLFSSL_ALPN
   bool "wolfSSL ALPN support"
@@ -312,6 +322,30 @@ config WOLFSSL_RSA
   help
     Enable RSA (define RSA support; NO_RSA when off).
 
+choice WOLFSSL_RSA_MAX_BITS
+  prompt "Largest RSA key size"
+  depends on WOLFSSL_RSA && !WOLFCRYPT_FIPS
+  default WOLFSSL_RSA_MAX_BITS_4096
+  help
+    Largest RSA modulus wolfCrypt can sign, verify or decrypt with, so
+    also the largest RSA key a certificate chain may carry. The big
+    integers of the RSA and DH math are sized for this length, so a
+    smaller choice saves stack and heap in each handshake. The
+    single-precision math handles 2048, 3072 and 4096-bit keys up to the
+    chosen size; other sizes need WOLFSSL_SP_MATH_ALL.
+    A FIPS build takes its math sizes from the module settings instead.
+
+config WOLFSSL_RSA_MAX_BITS_2048
+  bool "2048 bits"
+
+config WOLFSSL_RSA_MAX_BITS_3072
+  bool "3072 bits"
+
+config WOLFSSL_RSA_MAX_BITS_4096
+  bool "4096 bits"
+
+endchoice
+
 config WOLFSSL_ECC
   bool "wolfCrypt ECC support"
   depends on !WOLFSSL_HAS_SETTINGS_FILE
@@ -787,6 +821,18 @@ config WOLFCRYPT_SP_SMALL
 	  turning it off is what makes WOLFCRYPT_ASM pay off on a part with
 	  the flash to spare.
 
+config WOLFCRYPT_SP_SMALL_STACK
+	bool "Single-precision math temporaries on the heap"
+	depends on WOLFSSL_BUILTIN && !WOLFSSL_HAS_SETTINGS_FILE && !WOLFCRYPT_FIPS
+	default y
+	help
+	  Allocate the temporaries of the fixed-size single-precision RSA, DH
+	  and ECC routines (sp_c32.c, sp_c64.c and the assembly sources) on
+	  the heap (WOLFSSL_SP_SMALL_STACK) instead of the stack of the calling
+	  thread. An RSA-3072 operation otherwise needs over 4 KB of stack. The
+	  generic sp_int.c math and the rest of wolfSSL keep their stack use
+	  unless WOLFSSL_SMALL_STACK is set in a settings file.
+
 config WOLFSSL_NO_HAVE_MIN_MAX
 	bool "Force wolfSSL to use its own min/max"
 	help