Skip to content

Commit 213f0cc

Browse files
jackctj117jackctj117
committed
zephyr: test RNG init without wolfcrypt_test()
Both wolfSSL_Init() and wolfcrypt_test() register the DRBG seed callback themselves, so the test sample passes even when the port's own registration in zephyr_init.c is broken, and under FIPS v5 that is the only registration a wolfCrypt-only image has. Call wc_InitRng() from a ztest in such an image instead. Without a bundle, which is how CI runs it, it covers the tree's Zephyr wc_GenerateSeed().
1 parent 655bb9c commit 213f0cc

7 files changed

Lines changed: 125 additions & 0 deletions

File tree

‎.github/scripts/zephyr-4.x/builds.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,5 @@ frdm_rw612/rw612 samples/wolfssl_benchmark
1919
# lack native_sim or clash with ztest on POSIX headers
2020
native_sim tests/wolfssl_condvar
2121
native_sim tests/wolfssl_condvar crypto_only.conf
22+
# wc_InitRng() at boot in a wolfCrypt-only image that never runs wolfcrypt_test()
23+
native_sim tests/wolfssl_rng

‎zephyr/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,18 @@ FIPS v2, v5 and v6 `CONFIG_WOLFCRYPT_ASM` accelerates only the SP math: those
104104
boundaries keep their AES and SHA assembly in a form this module does not
105105
build.
106106

107+
`tests/wolfssl_rng` calls `wc_InitRng()` in a wolfCrypt-only image, which
108+
under v5 only works once the hook in `zephyr_init.c` has registered the seed
109+
callback; `wolfcrypt_test()` registers it itself, so the test sample cannot
110+
tell. CI runs the test without a bundle. With one:
111+
112+
```
113+
west build -p always -b native_sim modules/crypto/wolfssl/zephyr/tests/wolfssl_rng -- -DEXTRA_CONF_FILE=fips-v5.conf
114+
west build -t run
115+
```
116+
117+
Add `CONFIG_WOLFCRYPT_FIPS_V5_2_3=y` to the overlay for a 5.2.3 bundle.
118+
107119
## Build and Run wolfCrypt Benchmark Application
108120

109121
build and execute `wolfssl_benchmark`

‎zephyr/tests/wolfssl_rng/CMakeLists.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
cmake_minimum_required(VERSION 3.20.0)
2+
find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
3+
project(wolfssl_rng)
4+
5+
target_sources(app PRIVATE src/main.c)
6+
add_definitions(-DWOLFSSL_USER_SETTINGS)

‎zephyr/tests/wolfssl_rng/fips-v5.conf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Hand run against a FIPS v5 bundle dropped into wolfcrypt/src/; no CI has one.
2+
# Add CONFIG_WOLFCRYPT_FIPS_V5_2_3=y for a 5.2.3 bundle.
3+
CONFIG_WOLFCRYPT_FIPS=y
4+
CONFIG_WOLFCRYPT_FIPS_V5=y
5+
CONFIG_LINKER_SORT_BY_ALIGNMENT=n

‎zephyr/tests/wolfssl_rng/prj.conf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# wolfCrypt RNG boot ztest: wc_InitRng() in a wolfCrypt-only image that never
2+
# calls wolfSSL_Init() or wolfcrypt_test(), both of which register the DRBG seed
3+
# callback themselves. Under FIPS v5 the module refuses to seed until the hook
4+
# in zephyr_init.c has registered it, so this is the test of that hook.
5+
CONFIG_ZTEST=y
6+
CONFIG_MAIN_STACK_SIZE=32768
7+
CONFIG_ZTEST_STACK_SIZE=16384
8+
CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=16384
9+
10+
CONFIG_WOLFSSL=y
11+
CONFIG_WOLFSSL_BUILTIN=y
12+
CONFIG_WOLFSSL_CRYPTO_ONLY=y
13+
# No boot-time wolfCrypt_Init() either: the test makes the first call.
14+
CONFIG_WOLFSSL_SYS_INIT=n
15+
16+
# Seed source. native_sim has a fake entropy driver, so this takes the hardware
17+
# CSPRNG path; the test generator stands in on a board without one.
18+
CONFIG_TEST_RANDOM_GENERATOR=y
19+
CONFIG_ENTROPY_GENERATOR=y

‎zephyr/tests/wolfssl_rng/src/main.c‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/* main.c
2+
*
3+
* Copyright (C) 2006-2026 wolfSSL Inc.
4+
*
5+
* This file is part of wolfSSL.
6+
*
7+
* wolfSSL is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 3 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfSSL is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
/*
23+
* Brings up the wolfCrypt DRBG in a wolfCrypt-only image that never calls
24+
* wolfSSL_Init() or wolfcrypt_test(). Both of those register the DRBG seed
25+
* callback themselves (src/ssl.c, wolfcrypt/test/test.c), so the wolfssl_test
26+
* sample passes even when the port's own registration is broken; here nothing
27+
* else can have registered it. Under FIPS v5 the module refuses to seed until
28+
* the callback is set, so wc_InitRng() fails with DRBG_NO_SEED_CB unless the
29+
* APPLICATION-level hook in zephyr_init.c ran. Without a bundle, which is how
30+
* CI runs it, the same test covers the tree's Zephyr wc_GenerateSeed(); see
31+
* fips-v5.conf for the hand run with a bundle.
32+
*/
33+
34+
#include <zephyr/ztest.h>
35+
36+
#include <wolfssl/wolfcrypt/settings.h>
37+
#include <wolfssl/wolfcrypt/wc_port.h>
38+
#include <wolfssl/wolfcrypt/types.h>
39+
#include <wolfssl/wolfcrypt/random.h>
40+
41+
ZTEST(wolfssl_rng, test_init_rng_at_boot)
42+
{
43+
WC_RNG rng;
44+
byte block[32];
45+
byte zero[32];
46+
int ret;
47+
48+
zassert_equal(wolfCrypt_Init(), 0, "wolfCrypt_Init");
49+
50+
/* Nothing in this image calls wc_SetSeed_Cb(), so under FIPS v5 this is
51+
* where a missing boot-time registration shows. */
52+
ret = wc_InitRng(&rng);
53+
zassert_equal(ret, 0, "wc_InitRng: %d", ret);
54+
55+
XMEMSET(block, 0, sizeof(block));
56+
XMEMSET(zero, 0, sizeof(zero));
57+
ret = wc_RNG_GenerateBlock(&rng, block, sizeof(block));
58+
zassert_equal(ret, 0, "wc_RNG_GenerateBlock: %d", ret);
59+
zassert_true(XMEMCMP(block, zero, sizeof(block)) != 0,
60+
"generated block is all zero");
61+
62+
zassert_equal(wc_FreeRng(&rng), 0, "wc_FreeRng");
63+
zassert_equal(wolfCrypt_Cleanup(), 0, "wolfCrypt_Cleanup");
64+
}
65+
66+
ZTEST_SUITE(wolfssl_rng, NULL, NULL, NULL, NULL, NULL);

‎zephyr/tests/wolfssl_rng/testcase.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
common:
2+
tags:
3+
- wolfssl
4+
- random
5+
harness: ztest
6+
tests:
7+
crypto.wolfssl.rng_crypto_only:
8+
# native_sim only, as tests/wolfssl_condvar: wc_port.c's z_time() reads the
9+
# native_sim RTC, so another board would need the POSIX clock enabled.
10+
platform_allow:
11+
- native_sim
12+
- native_sim/native/64
13+
integration_platforms:
14+
- native_sim
15+
- native_sim/native/64

0 commit comments

Comments
 (0)