Refactor All SetUp fucntions to use GetOpt and Handle new error codes / Standardization by aidankeefe2022 · Pull Request #260 · wolfSSL/wolfCLU

aidankeefe2022 · 2026-06-30T22:21:46Z

Rewriting Every Setup Function and Standardizing help function locations; Also slight refactor to wolfCLU_getOpt func

Why

Three main issues were pervasive before this change:

Hanging on bad args.
OOB reads due to absolute positional arguments (ie. argv[2] is accessed unchecked).
unchecked illegal arguments.
Consistency and locality of behavior

There was also a lot of legacy argument checking via the use of strcmp and checkForArgument calls that made understanding what was set when very difficult and adding new functionality much harder than in the modern functions that used getOpt. Moving the help functions just made the code base consistent in style.

Benefits

All handling of args works the same way across every setup function. This makes it much easier to reason about and understand flow of the program.
By moving to the modern system and adding new return codes to getOpt we are able to catch and act on specific situations rather than have the same exit code be used for the successful parsing of all args and issues like repeat args (WOLFCLU_FATAL_ERROR).

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 5
5 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

JacobBarthelmeh

Overall it is a nice refactor to have.

Copilot

Pull request overview

This PR refactors wolfCLU subcommand setup/argument parsing to consistently use wolfCLU_GetOpt() (with new standardized end-of-args and duplicate-arg error codes), relocates/help-standardizes multiple *_Help() functions, and updates tests/feature guards (notably BLAKE2B-related macros) to match the revised CLI.

Changes:

Standardize option parsing across many setup functions by switching GetOpt loops to terminate on END_OF_ARGS and handle duplicate arguments via ARG_FOUND_TWICE.
Move/inline various help functions closer to their owning subcommands for consistency and locality.
Update tests and feature guards (e.g., HAVE_BLAKE2B, -hash -sha* flags) and add a base64 expected-output fixture.

Reviewed changes

Copilot reviewed 35 out of 36 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
wolfclu/clu_optargs.h	Adds new option/command enum values for expanded x509/hash/genkey parsing.
wolfclu/clu_header_main.h	Updates BLAKE2 guard macro and removes help prototypes that were relocated.
wolfclu/clu_error_codes.h	Adds `ARG_FOUND_TWICE` and `END_OF_ARGS` error codes used by GetOpt loops.
wolfclu/certgen/clu_certgen.h	Minor whitespace adjustment.
tests/testjunk/tests.sh	Updates build-option grep to `HAVE_BLAKE2B`.
tests/hash/hash-test.py	Updates hash CLI tests to new flag-style algorithms; adds base64 enc/dec coverage.
tests/hash/base64enc-expect.b64	Adds expected output fixture for base64 encoding test.
tests/dgst/dgst-test.py	Updates `-hash` invocation and sha256 shortcut invocation to new flag style.
src/x509/clu_request_setup.c	Switches GetOpt loop to `END_OF_ARGS`, adds duplicate-arg handling, and relocates certgen help.
src/x509/clu_cert_setup.c	Refactors x509 arg parsing to GetOpt and adds option table/help locally.
src/x509/clu_ca_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/tools/clu_rand.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/tools/clu_funcs.c	Updates `wolfCLU_GetOpt()` to return `END_OF_ARGS` and introduce `ARG_FOUND_TWICE`.
src/tools/clu_base64.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/sign-verify/clu_x509_verify.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/sign-verify/clu_sign_verify_setup.c	Refactors sign/verify setup to GetOpt; relocates sign/verify help locally.
src/sign-verify/clu_dgst_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/sign-verify/clu_crl_verify.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/server/clu_server_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkey/clu_rsa.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkey/clu_pkey.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkcs/clu_pkcs8.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkcs/clu_pkcs7.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkcs/clu_pkcs12.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/ocsp/clu_ocsp.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/hash/clu_hash.c	Updates BLAKE2 guard macro and improves base64 output handling (raw vs hex).
src/hash/clu_hash_setup.c	Refactors `-hash` setup to GetOpt with new per-algorithm flags and help updates.
src/genkey/clu_genkey_setup.c	Refactors genkey setup to GetOpt and centralizes output directive parsing.
src/ecparam/clu_ecparam.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/dsa/clu_dsa.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/dh/clu_dh.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/crypto/clu_crypto_setup.c	Relocates encrypt/decrypt help and switches GetOpt loop to `END_OF_ARGS`.
src/client/clu_client_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/benchmark/clu_benchmark.c	Updates BLAKE2 guard macro.
src/benchmark/clu_bench_setup.c	Refactors bench setup to GetOpt and introduces a benchmark-index enum.
.gitignore	Adds ignores for wolfclu-configure artifacts, IDE files, and compile_commands.json.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src
Findings: 2
1 finding(s) posted as inline comments (see file-level comments below)

Low (1)

In-loop error returns in wolfCLU_setup leak mode and key buffers without zeroizing

File: src/crypto/clu_crypto_setup.c:590
Function: wolfCLU_setup
Category: Resource leaks

The WOLFCLU_MD invalid-digest path (and the -pwd/-key/-iv error returns) return without freeing the heap-allocated mode and, when a password or key was already parsed, without XMEMSET-ing pwdKey/key, leaving key material in freed/unfreed heap. The PR added mode cleanup only to the malloc-failure and duplicate-arg paths.

Recommendation: Route these error returns through the common cleanup that zeroizes pwdKey/key/iv and frees mode.

Referenced code: src/crypto/clu_crypto_setup.c:590-595 (6 lines)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 · 2026-07-01T19:18:16Z

Jenkins retest this please

aidankeefe2022 · 2026-07-01T20:17:14Z

Jenkins retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src
Findings: 2
1 finding(s) posted as inline comments (see file-level comments below)

Low (1)

Missing-value early returns in crypto setup leak key buffers without ForceZero

File: src/crypto/clu_crypto_setup.c:370
Function: wolfCLU_setup
Category: Missing ForceZero

In the new option loop, case WOLFCLU_IV and case WOLFCLU_PASSWORD return WOLFCLU_FATAL_ERROR on optarg == NULL without calling wolfCLU_freeBins, leaking pwdKey, iv, key, and mode; on the -iv path pwdKey may already hold the password and is freed (later) without zeroing.

Recommendation: Zero pwdKey and call wolfCLU_freeBins(pwdKey, iv, key, (byte*)mode, NULL) before returning on these paths.

Referenced code: src/crypto/clu_crypto_setup.c:370-372 (3 lines)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 · 2026-07-02T19:15:53Z

Jenkins retest this please

refactored setup fucntions to use new GetOpt format HAVE_BLAKE2 not a real gaurd moved all help fucntions to their setup files for consitancy and to declutter func file skoll fixes skoll and github review fixes skoll and github review fixes null ptr defreference fix fixed old memory leak applied skoll fixes and added new test check fixed fenrir skoll review fixes skoll fixes

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-07-02T21:15:43Z


+            case ARG_FOUND_TWICE:
+                wolfCLU_LogError("Found duplicate argument");
+                ret = WOLFCLU_FATAL_ERROR;


🔵 [Low] Duplicate-argument error can be overwritten by -passout handling · Incorrect error handling

The new ARG_FOUND_TWICE case sets ret = WOLFCLU_FATAL_ERROR but does not stop the parse loop, and there is no post-switch error guard. A later `-passout` (WOLFCLU_PASSWORD_OUT, near the end of req_options) unconditionally does ret = wolfCLU_GetPassword(...), clobbering the FATAL error so a duplicate of any earlier option is silently accepted.

Fix: Add if (ret != WOLFCLU_SUCCESS) break; after the switch, as done in the cert/sign-verify setups.

JacobBarthelmeh · 2026-07-02T21:46:32Z

        self.assertIn(expected, r.stdout,
                      "Failed to get expected hash with sha256")

-    # Slow when run inside a Windows VM (large file I/O over network share)


What speeds does it take for the windows test in comparison to before? Just digging into the reasoning for removing the skip, if it was no longer an issue to run it and we gain more coverage?

This skip is junk code ever since I sped up the windows CI/CD by making the 4 Gib hash test file sparse instead of actually written and read from disk. It was already sparse on linux but windows required some system calls to get the same behavior.

JacobBarthelmeh

Thanks Aidan! I had the comment about the change in windows test coverage but overall looks good.

aidankeefe2022 self-assigned this Jun 30, 2026

aidankeefe2022 changed the title ~~Refactor All SetUp fucntions to use GetOpt and Handle new error codes~~ Refactor All SetUp fucntions to use GetOpt and Handle new error codes / Standardization Jun 30, 2026

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 30, 2026 22:22

wolfSSL-Fenrir-bot reviewed Jun 30, 2026

View reviewed changes

Comment thread src/crypto/clu_crypto_setup.c

Comment thread src/sign-verify/clu_dgst_setup.c Outdated

Comment thread src/server/clu_server_setup.c Outdated

Comment thread src/x509/clu_cert_setup.c Outdated

Comment thread src/x509/clu_request_setup.c Outdated

JacobBarthelmeh requested changes Jul 1, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot July 1, 2026 15:47

Copilot started reviewing on behalf of JacobBarthelmeh July 1, 2026 15:48 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes