Mcdc test coverage - part 7

.github/workflows/whitebox-smoke.yml

@@ -0,0 +1,60 @@
+name: White-box Smoke
+
+# The tests/unit-mcdc/*_whitebox.c translation units each #include one library
+# source and exercise its file-static functions directly - code the public API
+# cannot reach. They are not part of tests/unit.test, so nothing else in CI
+# builds or runs them: a change to a library source can break one and every
+# other job still passes.
+#
+# This builds --enable-all once and runs the subset that works against that
+# configuration (see tests/unit-mcdc/run-whitebox-smoke.sh). It is a smoke
+# gate, not a coverage measurement - no instrumentation, no llvm tooling, and
+# the cost does not depend on which files the pull request touches.
+#
+# Scope note: the TUs that need a narrower configuration are reported as skips
+# rather than run here, so a green result means "nothing that worked before is
+# broken", not "every white-box passed".
+
+on:
+  push:
+    branches: [ master, main ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ master, main ]
+
+concurrency:
+  group: whitebox-smoke-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  whitebox-smoke:
+    name: White-box smoke
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y autoconf automake libtool
+
+      - name: Configure and build
+        # --enable-static is required: each white-box relinks against
+        # libwolfssl.a with the object it replaces removed.
+        run: |
+          ./autogen.sh
+          ./configure --enable-all --enable-static --disable-shared \
+                      CPPFLAGS=-DWOLFSSL_TEST_STATIC_BUILD
+          make -j"$(nproc)"
+
+      - name: Run white-box smoke
+        # smoke-expected.txt is generated with gcc; six TUs build under clang
+        # and not gcc, so the compiler has to match or the run reports false
+        # regressions.
+        env:
+          CC: gcc
+        run: ./tests/unit-mcdc/run-whitebox-smoke.sh .

CMakeLists.txt

@@ -4551,6 +4551,9 @@ if(WOLFSSL_EXAMPLES)
         tests/api/test_evp.c
         tests/api/test_tls_ext.c
         tests/api/test_tls.c
+        tests/api/test_tls_bounds.c
+        tests/api/test_tls_msgtype.c
+        tests/api/test_tls_parse.c
         tests/api/test_session.c
         tests/api/test_x509.c
         tests/api/test_asn.c
@@ -4591,6 +4594,8 @@ if(WOLFSSL_EXAMPLES)
         tests/api/test_evp_pkey.c
         tests/api/test_certman.c
         tests/api/test_tls13.c
+        tests/api/test_tls13_bounds.c
+        tests/api/test_tls13_features.c
         tests/srp.c
         tests/suites.c
         tests/w64wrapper.c

tests/api.c

@@ -268,6 +268,9 @@
 #include <tests/api/test_evp.h>
 #include <tests/api/test_tls_ext.h>
 #include <tests/api/test_tls.h>
+#include <tests/api/test_tls_bounds.h>
+#include <tests/api/test_tls_msgtype.h>
+#include <tests/api/test_tls_parse.h>
 #include <tests/api/test_session.h>
 #include <tests/api/test_x509.h>
 #include <tests/api/test_asn.h>
@@ -309,6 +312,8 @@
 #include <tests/api/test_evp_pkey.h>
 #include <tests/api/test_certman.h>
 #include <tests/api/test_tls13.h>
+#include <tests/api/test_tls13_bounds.h>
+#include <tests/api/test_tls13_features.h>
 #if !defined(NO_CERTS) && defined(WOLFSSL_ASN_TEMPLATE) && defined(HAVE_ECC)
 #include <tests/api/test_x500_unique_id_certs.h>
 #endif
@@ -40356,6 +40361,8 @@ TEST_CASE testCases[] = {
     TEST_DECL(test_wolfSSL_set_options),
 
     TEST_TLS13_DECLS,
+    TEST_TLS13_BOUNDS_DECLS,
+    TEST_TLS13_FEATURES_DECLS,
 
     TEST_DECL(test_wolfSSL_tmp_dh),
     TEST_DECL(test_wolfSSL_tmp_dh_regression),
@@ -40759,6 +40766,9 @@ TEST_CASE testCases[] = {
     TEST_DECL(test_ocsp_responder),
     TEST_DECL(test_wolfIO_DecodeUrl_crlf_reject),
     TEST_TLS_DECLS,
+    TEST_TLS_BOUNDS_DECLS,
+    TEST_TLS_MSGTYPE_DECLS,
+    TEST_TLS_PARSE_DECLS,
     TEST_SESSION_DECLS,
     TEST_DECL(test_wc_DhSetNamedKey),
     TEST_DECL(test_DhAgree_rejects_p_minus_1),

tests/api/include.am

@@ -81,6 +81,9 @@ tests_unit_test_SOURCES += tests/api/test_ocsp.c
 tests_unit_test_SOURCES += tests/api/test_evp.c
 tests_unit_test_SOURCES += tests/api/test_tls_ext.c
 tests_unit_test_SOURCES += tests/api/test_tls.c
+tests_unit_test_SOURCES += tests/api/test_tls_bounds.c
+tests_unit_test_SOURCES += tests/api/test_tls_msgtype.c
+tests_unit_test_SOURCES += tests/api/test_tls_parse.c
 tests_unit_test_SOURCES += tests/api/test_session.c
 # Certs
 tests_unit_test_SOURCES += tests/api/test_x509.c
@@ -138,6 +141,8 @@ tests_unit_test_SOURCES += tests/api/test_evp_pkey.c
 tests_unit_test_SOURCES += tests/api/test_certman.c
 # TLS 1.3 specific
 tests_unit_test_SOURCES += tests/api/test_tls13.c
+tests_unit_test_SOURCES += tests/api/test_tls13_bounds.c
+tests_unit_test_SOURCES += tests/api/test_tls13_features.c
 endif
 
 EXTRA_DIST += tests/api/api.h
@@ -216,6 +221,9 @@ EXTRA_DIST += tests/api/create_x500_unique_id_certs.py
 EXTRA_DIST += tests/api/test_evp.h
 EXTRA_DIST += tests/api/test_tls_ext.h
 EXTRA_DIST += tests/api/test_tls.h
+EXTRA_DIST += tests/api/test_tls_bounds.h
+EXTRA_DIST += tests/api/test_tls_msgtype.h
+EXTRA_DIST += tests/api/test_tls_parse.h
 EXTRA_DIST += tests/api/test_session.h
 EXTRA_DIST += tests/api/test_x509.h
 EXTRA_DIST += tests/api/test_asn.h
@@ -256,4 +264,6 @@ EXTRA_DIST += tests/api/test_evp_cipher.h
 EXTRA_DIST += tests/api/test_evp_pkey.h
 EXTRA_DIST += tests/api/test_certman.h
 EXTRA_DIST += tests/api/test_tls13.h
+EXTRA_DIST += tests/api/test_tls13_bounds.h
+EXTRA_DIST += tests/api/test_tls13_features.h
 

tests/api/test_aes.c

@@ -8520,7 +8520,7 @@ int test_wc_AesFeatureCoverage(void)
  * GCM/GMAC block works on all of them, so it only excludes HAVE_SELFTEST; the
  * CCM block additionally excludes old FIPS (its AAD-only case diverges there,
  * see the per-block note); the key-wrap block excludes all FIPS + self-test.
- * The open MC/DC campaign builds are unaffected. */
+ * The open MC/DC builds are unaffected. */
 #if !defined(NO_AES) && defined(HAVE_AESGCM) && !defined(HAVE_SELFTEST)
     /* ---- AES-GCM streaming API: multi-chunk AAD and data ---- */
     /* Uses a hardcoded 256-bit key, so requires AES-256. */

tests/api/test_asn.c

@@ -901,6 +901,43 @@ static int dirNameEnc(byte* out, word32 outSz, const DirTestAttr* attrs,
     return (int)idx;
 }
 
+/* Encode "Forbid" <cp> "den" as a UTF8String value, i.e. one code point in
+ * the middle of a name that is otherwise "Forbidden". A code point RFC 4518
+ * Sec. 2.2 maps to nothing drops out and leaves "Forbidden"; any other one
+ * stays and makes it a different name. Returns the encoded length. */
+static word32 dirUtf8Probe(byte* out, word32 cp)
+{
+    static const byte head[] = { 'F','o','r','b','i','d' };
+    static const byte tail[] = { 'd','e','n' };
+    word32 idx = (word32)sizeof(head);
+
+    XMEMCPY(out, head, sizeof(head));
+
+    if (cp < 0x80U) {
+        out[idx++] = (byte)cp;
+    }
+    else if (cp < 0x800U) {
+        out[idx++] = (byte)(0xC0U | (cp >> 6));
+        out[idx++] = (byte)(0x80U | (cp & 0x3FU));
+    }
+    else if (cp < 0x10000U) {
+        out[idx++] = (byte)(0xE0U | (cp >> 12));
+        out[idx++] = (byte)(0x80U | ((cp >> 6) & 0x3FU));
+        out[idx++] = (byte)(0x80U | (cp & 0x3FU));
+    }
+    else {
+        out[idx++] = (byte)(0xF0U | (cp >> 18));
+        out[idx++] = (byte)(0x80U | ((cp >> 12) & 0x3FU));
+        out[idx++] = (byte)(0x80U | ((cp >> 6) & 0x3FU));
+        out[idx++] = (byte)(0x80U | (cp & 0x3FU));
+    }
+
+    XMEMCPY(out + idx, tail, sizeof(tail));
+    idx += (word32)sizeof(tail);
+
+    return idx;
+}
+
 /* Encode both names and run them through the directoryName matcher. */
 static int dirMatch(const DirTestAttr* nm, int nmCnt, const DirTestAttr* bs,
                     int bsCnt)
@@ -1315,6 +1352,131 @@ int test_wolfssl_local_MatchBaseName(void)
                 ExpectIntEQ(dirMatch(nm, 1, bForBid, 1),
                             WC_NO_ERR_TRACE(ASN_PARSE_E));
             }
+
+            /* EN SPACE, one of the EN QUAD (U+2000) to HAIR SPACE (U+200A)
+             * block that Sec. 2.2 gives as a range rather than one by one. */
+            {
+                static const byte forEnSpBid[] =
+                    { 'F','o','r', 0xe2,0x80,0x82, 'b','i','d' };
+                const DirTestAttr nm[] = {
+                    { DIR_OID_O, ASN_UTF8STRING, forEnSpBid,
+                      sizeof(forEnSpBid) }
+                };
+                ExpectIntEQ(dirMatch(nm, 1, bForBid, 1), 1);
+            }
+
+            /* The code points Sec. 2.2 maps to nothing, given there as
+             * ranges. Each range is probed just inside and just outside
+             * both of its bounds: inside, the code point drops out of the
+             * name and what is left is "Forbidden"; outside, it stays and
+             * the name is a different one. A range left unmapped would let
+             * a certificate carrying one of its code points inside a name
+             * pass an excluded subtree. */
+            {
+                static const struct {
+                    word32 cp;      /* Code point placed inside the name. */
+                    int    drops;   /* 1 when Sec. 2.2 maps it to nothing. */
+                } probes[] = {
+                    /* Below CHARACTER TABULATION, and the C0 controls above
+                     * CARRIAGE RETURN. */
+                    { 0x00001, 1 }, { 0x00010, 1 },
+                    /* DELETE through U+0084, and the C1 controls above NEXT
+                     * LINE; U+0100 is past both. */
+                    { 0x00080, 1 }, { 0x00090, 1 }, { 0x00100, 0 },
+                    /* The MONGOLIAN FREE VARIATION SELECTORs. */
+                    { 0x0180B, 1 }, { 0x01900, 0 },
+                    /* ZERO WIDTH NON-JOINER through RIGHT-TO-LEFT MARK. */
+                    { 0x0200C, 1 }, { 0x02010, 0 },
+                    /* The bidirectional formatting characters. */
+                    { 0x0202A, 1 }, { 0x02030, 0 },
+                    /* WORD JOINER and the invisible operators. */
+                    { 0x02060, 1 }, { 0x02064, 0 },
+                    /* INHIBIT SYMMETRIC SWAPPING through NOMINAL DIGIT
+                     * SHAPES. */
+                    { 0x0206A, 1 }, { 0x02100, 0 },
+                    /* The VARIATION SELECTORs. */
+                    { 0x0FE00, 1 }, { 0x0FE10, 0 },
+                    /* The interlinear annotation characters. */
+                    { 0x0FFF9, 1 }, { 0x0FFFD, 0 },
+                    /* The musical symbol combining stems. */
+                    { 0x1D173, 1 }, { 0x1D180, 0 },
+                    /* The deprecated tag characters. */
+                    { 0xE0020, 1 }, { 0xE0080, 0 }
+                };
+                byte probe[32];
+                int  p;
+
+                for (p = 0; p < (int)(sizeof(probes) / sizeof(probes[0]));
+                        p++) {
+                    DirTestAttr nm[1];
+
+                    nm[0].oid   = DIR_OID_O;
+                    nm[0].tag   = ASN_UTF8STRING;
+                    nm[0].val   = probe;
+                    nm[0].valSz = dirUtf8Probe(probe, probes[p].cp);
+                    ExpectIntEQ(dirMatch(nm, 1, bForbidden, 1),
+                                probes[p].drops);
+                }
+            }
+        }
+
+        /* A UTF-16 surrogate pair in a BMPString is one code point, and is
+         * the same character as the one the UTF-8 spelling holds. */
+        {
+            /* U+10000 as a surrogate pair and as UTF-8. */
+            static const byte astralBmp[]  = { 0xd8, 0x00, 0xdc, 0x00 };
+            static const byte astralUtf8[] = { 0xf0, 0x90, 0x80, 0x80 };
+            const DirTestAttr nm[] = {
+                { DIR_OID_O, ASN_BMPSTRING, astralBmp, sizeof(astralBmp) }
+            };
+            const DirTestAttr bs[] = {
+                { DIR_OID_O, ASN_UTF8STRING, astralUtf8, sizeof(astralUtf8) }
+            };
+            ExpectIntEQ(dirMatch(nm, 1, bs, 1), 1);
+        }
+        /* A code unit just above the surrogate block is an ordinary
+         * character in both of the wide string types. */
+        {
+            /* U+E000, the first Private Use character. */
+            static const byte puaBmp[] = { 0xe0, 0x00 };
+            static const byte puaUcs[] = { 0x00, 0x00, 0xe0, 0x00 };
+            const DirTestAttr nmBmp[] = {
+                { DIR_OID_O, ASN_BMPSTRING, puaBmp, sizeof(puaBmp) }
+            };
+            const DirTestAttr nmUcs[] = {
+                { DIR_OID_O, ASN_UNIVERSALSTRING, puaUcs, sizeof(puaUcs) }
+            };
+            ExpectIntEQ(dirMatch(nmBmp, 1, bForbidden, 1), 0);
+            ExpectIntEQ(dirMatch(nmUcs, 1, bForbidden, 1), 0);
+        }
+        /* Case folding covers the ASCII letters and leaves everything below
+         * them alone. */
+        {
+            static const byte forbid1[]   = { 'F','o','r','b','i','d','1' };
+            static const byte forbid1Up[] = { 'F','O','R','B','I','D','1' };
+            const DirTestAttr nm[] = {
+                { DIR_OID_O, ASN_UTF8STRING, forbid1Up, sizeof(forbid1Up) }
+            };
+            const DirTestAttr bs[] = {
+                { DIR_OID_O, ASN_UTF8STRING, forbid1, sizeof(forbid1) }
+            };
+            ExpectIntEQ(dirMatch(nm, 1, bs, 1), 1);
+        }
+        /* A value that is not a character string type is compared octet for
+         * octet: the same octets under a different tag are a different
+         * value, and the string rules are not applied to either side. */
+        {
+            const DirTestAttr nm[] = {
+                { DIR_OID_O, ASN_OCTET_STRING, forbidden, sizeof(forbidden) }
+            };
+            const DirTestAttr up[] = {
+                { DIR_OID_O, ASN_OCTET_STRING, forbiddenUp,
+                  sizeof(forbiddenUp) }
+            };
+            ExpectIntEQ(dirMatch(nm, 1, bForbidden, 1), 0);
+            ExpectIntEQ(dirMatch(bForbidden, 1, nm, 1), 0);
+            ExpectIntEQ(dirMatch(nm, 1, nm, 1), 1);
+            ExpectIntEQ(dirMatch(nm, 1, up, 1), 0);
         }
 
         /* Negative tests - should NOT match */
@@ -1470,10 +1632,16 @@ int test_wolfssl_local_MatchBaseName(void)
             static const byte loneHiBmp[] = { 0xd8, 0x00, 0x00, 'F' };
             /* BMPString low surrogate with no high surrogate before it. */
             static const byte loneLoBmp[] = { 0xdc, 0x00, 0x00, 'F' };
+            /* BMPString high surrogate followed by a code unit that is not
+             * a low surrogate. */
+            static const byte hiThenPua[] = { 0xd8, 0x00, 0xe0, 0x00 };
             /* UniversalString with a length that is not a multiple of 4. */
             static const byte shortUcs[]  = { 0x00, 0x00, 0x00 };
             /* UniversalString code point past the end of Unicode. */
             static const byte bigUcs[]    = { 0x00, 0x11, 0x00, 0x00 };
+            /* UniversalString holding a surrogate code point, which is not
+             * a character. */
+            static const byte surrUcs[]   = { 0x00, 0x00, 0xd8, 0x00 };
             static const struct {
                 byte        tag;
                 const byte* val;
@@ -1485,8 +1653,10 @@ int test_wolfssl_local_MatchBaseName(void)
                 { ASN_BMPSTRING,       oddBmp,    sizeof(oddBmp)    },
                 { ASN_BMPSTRING,       loneHiBmp, sizeof(loneHiBmp) },
                 { ASN_BMPSTRING,       loneLoBmp, sizeof(loneLoBmp) },
+                { ASN_BMPSTRING,       hiThenPua, sizeof(hiThenPua) },
                 { ASN_UNIVERSALSTRING, shortUcs,  sizeof(shortUcs)  },
-                { ASN_UNIVERSALSTRING, bigUcs,    sizeof(bigUcs)    }
+                { ASN_UNIVERSALSTRING, bigUcs,    sizeof(bigUcs)    },
+                { ASN_UNIVERSALSTRING, surrUcs,   sizeof(surrUcs)   }
             };
             int i;
 

tests/api/test_chacha.c

@@ -73,7 +73,7 @@ int test_wc_Chacha_SetKey(void)
 
     /* misaligned key pointer: exercises the (wc_ptr_t)key % 4 realignment
      * decision in wc_Chacha_SetKey when XSTREAM_ALIGN is forced on (the
-     * xstream_align campaign variant). settings.h compiles XSTREAM_ALIGN out
+     * xstream_align variant). settings.h compiles XSTREAM_ALIGN out
      * by default on x86_64/i386/ia64 (NO_XSTREAM_ALIGN), so this call is a
      * harmless no-op realignment-free copy on every other build. */
     {

tests/api/test_dh.c

@@ -39,7 +39,7 @@
  * DH_MAX_SIZE expands to WC_BITS_FULL_BYTES(SP_INT_BITS), and
  * WC_BITS_FULL_BYTES(x) is defined as (WC_BITS_TO_BYTES(x) << 3) - i.e. it
  * returns SP_INT_BITS itself (rounded up to a byte multiple), NOT
- * SP_INT_BITS/8 as its name suggests. With this campaign's SP_INT_BITS 4096,
+ * SP_INT_BITS/8 as its name suggests. With this suite's SP_INT_BITS 4096,
  * DH_MAX_SIZE is therefore 4096 (bytes!), not the 512 a caller would
  * reasonably expect. Passing that value as *privSz (a requested private-key
  * size, not just a buffer capacity) to wc_DhGenerateKeyPair overflows the