Refactor All SetUp fucntions to use GetOpt and Handle new error codes / Standardization by aidankeefe2022 · Pull Request #260 · wolfSSL/wolfCLU

aidankeefe2022 · 2026-06-30T22:21:46Z

Rewriting Every Setup Function and Standardizing help function locations; Also slight refactor to wolfCLU_getOpt func

Why

Three main issues were pervasive before this change:

Hanging on bad args.
OOB reads due to absolute positional arguments (ie. argv[2] is accessed unchecked).
unchecked illegal arguments.
Consistency and locality of behavior

There was also a lot of legacy argument checking via the use of strcmp and checkForArgument calls that made understanding what was set when very difficult and adding new functionality much harder than in the modern functions that used getOpt. Moving the help functions just made the code base consistent in style.

Benefits

All handling of args works the same way across every setup function. This makes it much easier to reason about and understand flow of the program.
By moving to the modern system and adding new return codes to getOpt we are able to catch and act on specific situations rather than have the same exit code be used for the successful parsing of all args and issues like repeat args (WOLFCLU_FATAL_ERROR).

…eclutter func file

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 5
5 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

JacobBarthelmeh

Overall it is a nice refactor to have.

JacobBarthelmeh · 2026-07-01T15:28:28Z

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 */
-
+#include "wolfclu/clu_error_codes.h"


Use same <> instead of "" for search pattern when finding wolfclu header files.

JacobBarthelmeh · 2026-07-01T15:30:36Z

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 */

+#include "wolfclu/clu_error_codes.h"


Same as earlier, "" vs <>

JacobBarthelmeh · 2026-07-01T15:35:06Z

        expected = "3e5915162b1974ac0d57a5a45113a1efcc1edc5e71e5e55ca69f9a7c60ca11fd"

-        r = run_wolfssl("-hash", "sha256", "-in", self.LARGE_FILE)
+        r = run_wolfssl("-hash", "-sha256", "-in", self.LARGE_FILE)


The -sha256 versus sha256 might be expected but please compare this to drop in replacement of openssl command line args to make sure. We would not want to change the test case if it is a test added for confirming a specific format of the command is accepted.

#260 (comment)

JacobBarthelmeh · 2026-07-01T15:35:45Z

-    def test_sha_base64enc(self):
-        r = run_wolfssl("-hash", "sha", "-in", CERT_FILE, "-base64enc")
+    def test_sha_(self):
+        r = run_wolfssl("-hash", "-sha", "-in", CERT_FILE)


Same as -sha256. Confirm this is an okay adjustment to make.

The OpenSSL CLU does not have a hash sub command so we are already deviating from them. Making this change should be okay to make.

JacobBarthelmeh · 2026-07-01T15:37:02Z

 #endif
 #ifndef NO_RSA
    #include <wolfssl/wolfcrypt/rsa.h>
+


Extra newline with no purpose? If not needed please remove it. It's one less file touched as changed in the PR.

JacobBarthelmeh · 2026-07-01T15:40:50Z

    DER_TO_PEM_ERROR = -1004, /* converting der to pem failed */
    OUTPUT_FILE_ERROR = -1005,
    FEATURE_COMING_SOON = -1006, /* Feature not yet implemented */
+    ARG_FOUND_TWICE     = -1007,


This is a nice sanity check on most args. I have a suspecion though that it could backfire on some cases. Like with req -addext <ext> -addext <ext> or cms -recip <recipient 1> -recip <recipient 2>. Is the ARG_FOUND_TWICE handling cases where it is expected that multiples of the same arg are used?

This change is just surfacing what happened via an error code. The wolfCLU_GetOpt function previously just logged and noopt on duplicate args. All of the rewritten setup funcs did not use duplicate args either.

JacobBarthelmeh · 2026-07-01T15:42:21Z

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 */

+#include "wolfclu/clu_error_codes.h"


"" versus <>

Looking at this, I also think flu_header_main.h should be included before cpu_error_codes.h in all of the files.

I fixed this across the code base should be good now!

Copilot

Pull request overview

This PR refactors wolfCLU subcommand setup/argument parsing to consistently use wolfCLU_GetOpt() (with new standardized end-of-args and duplicate-arg error codes), relocates/help-standardizes multiple *_Help() functions, and updates tests/feature guards (notably BLAKE2B-related macros) to match the revised CLI.

Changes:

Standardize option parsing across many setup functions by switching GetOpt loops to terminate on END_OF_ARGS and handle duplicate arguments via ARG_FOUND_TWICE.
Move/inline various help functions closer to their owning subcommands for consistency and locality.
Update tests and feature guards (e.g., HAVE_BLAKE2B, -hash -sha* flags) and add a base64 expected-output fixture.

Reviewed changes

Copilot reviewed 35 out of 36 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
wolfclu/clu_optargs.h	Adds new option/command enum values for expanded x509/hash/genkey parsing.
wolfclu/clu_header_main.h	Updates BLAKE2 guard macro and removes help prototypes that were relocated.
wolfclu/clu_error_codes.h	Adds `ARG_FOUND_TWICE` and `END_OF_ARGS` error codes used by GetOpt loops.
wolfclu/certgen/clu_certgen.h	Minor whitespace adjustment.
tests/testjunk/tests.sh	Updates build-option grep to `HAVE_BLAKE2B`.
tests/hash/hash-test.py	Updates hash CLI tests to new flag-style algorithms; adds base64 enc/dec coverage.
tests/hash/base64enc-expect.b64	Adds expected output fixture for base64 encoding test.
tests/dgst/dgst-test.py	Updates `-hash` invocation and sha256 shortcut invocation to new flag style.
src/x509/clu_request_setup.c	Switches GetOpt loop to `END_OF_ARGS`, adds duplicate-arg handling, and relocates certgen help.
src/x509/clu_cert_setup.c	Refactors x509 arg parsing to GetOpt and adds option table/help locally.
src/x509/clu_ca_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/tools/clu_rand.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/tools/clu_funcs.c	Updates `wolfCLU_GetOpt()` to return `END_OF_ARGS` and introduce `ARG_FOUND_TWICE`.
src/tools/clu_base64.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/sign-verify/clu_x509_verify.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/sign-verify/clu_sign_verify_setup.c	Refactors sign/verify setup to GetOpt; relocates sign/verify help locally.
src/sign-verify/clu_dgst_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/sign-verify/clu_crl_verify.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/server/clu_server_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkey/clu_rsa.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkey/clu_pkey.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkcs/clu_pkcs8.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkcs/clu_pkcs7.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/pkcs/clu_pkcs12.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/ocsp/clu_ocsp.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/hash/clu_hash.c	Updates BLAKE2 guard macro and improves base64 output handling (raw vs hex).
src/hash/clu_hash_setup.c	Refactors `-hash` setup to GetOpt with new per-algorithm flags and help updates.
src/genkey/clu_genkey_setup.c	Refactors genkey setup to GetOpt and centralizes output directive parsing.
src/ecparam/clu_ecparam.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/dsa/clu_dsa.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/dh/clu_dh.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/crypto/clu_crypto_setup.c	Relocates encrypt/decrypt help and switches GetOpt loop to `END_OF_ARGS`.
src/client/clu_client_setup.c	Switches GetOpt loop to `END_OF_ARGS` and adds duplicate-arg handling.
src/benchmark/clu_benchmark.c	Updates BLAKE2 guard macro.
src/benchmark/clu_bench_setup.c	Refactors bench setup to GetOpt and introduces a benchmark-index enum.
.gitignore	Adds ignores for wolfclu-configure artifacts, IDE files, and compile_commands.json.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #260

Scan targets checked: wolfclu-bugs, wolfclu-src
Findings: 2
1 finding(s) posted as inline comments (see file-level comments below)

Low (1)

In-loop error returns in wolfCLU_setup leak mode and key buffers without zeroizing

File: src/crypto/clu_crypto_setup.c:590
Function: wolfCLU_setup
Category: Resource leaks

The WOLFCLU_MD invalid-digest path (and the -pwd/-key/-iv error returns) return without freeing the heap-allocated mode and, when a password or key was already parsed, without XMEMSET-ing pwdKey/key, leaving key material in freed/unfreed heap. The PR added mode cleanup only to the malloc-failure and duplicate-arg paths.

Recommendation: Route these error returns through the common cleanup that zeroizes pwdKey/key/iv and frees mode.

Referenced code: src/crypto/clu_crypto_setup.c:590-595 (6 lines)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 · 2026-07-01T19:18:16Z

Jenkins retest this please

aidankeefe2022 · 2026-07-01T20:17:14Z

Jenkins retest this please

aidankeefe2022 added 4 commits June 30, 2026 10:51

partially complete setup fucntion refactor

b5e1a19

refactored setup fucntions to use new GetOpt format

dbf9380

HAVE_BLAKE2 not a real gaurd

026ba72

moved all help fucntions to their setup files for consitancy and to d…

5c30ae1

…eclutter func file

aidankeefe2022 self-assigned this Jun 30, 2026

aidankeefe2022 changed the title ~~Refactor All SetUp fucntions to use GetOpt and Handle new error codes~~ Refactor All SetUp fucntions to use GetOpt and Handle new error codes / Standardization Jun 30, 2026

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 30, 2026 22:22

wolfSSL-Fenrir-bot reviewed Jun 30, 2026

View reviewed changes

Comment thread src/crypto/clu_crypto_setup.c

Comment thread src/sign-verify/clu_dgst_setup.c Outdated

Comment thread src/server/clu_server_setup.c Outdated

Comment thread src/x509/clu_cert_setup.c Outdated

Comment thread src/x509/clu_request_setup.c Outdated

skoll fixes

8c002be

JacobBarthelmeh requested changes Jul 1, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot July 1, 2026 15:47

Copilot started reviewing on behalf of JacobBarthelmeh July 1, 2026 15:48 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

aidankeefe2022 commented Jul 1, 2026

View reviewed changes

Comment thread src/x509/clu_request_setup.c Outdated

aidankeefe2022 commented Jul 1, 2026

View reviewed changes

Comment thread src/x509/clu_cert_setup.c Outdated

aidankeefe2022 commented Jul 1, 2026

View reviewed changes

Comment thread src/server/clu_server_setup.c Outdated

aidankeefe2022 commented Jul 1, 2026

View reviewed changes

Comment thread src/sign-verify/clu_dgst_setup.c Outdated

aidankeefe2022 commented Jul 1, 2026

View reviewed changes

Comment thread src/crypto/clu_crypto_setup.c

skoll and github review fixes

186709f

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot July 1, 2026 17:52

skoll and github review fixes

e6f48eb

wolfSSL-Fenrir-bot reviewed Jul 1, 2026

View reviewed changes

Comment thread src/hash/clu_hash_setup.c Outdated

aidankeefe2022 commented Jul 1, 2026

View reviewed changes

Comment thread src/hash/clu_hash_setup.c Outdated

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot July 1, 2026 18:16

wolfSSL-Fenrir-bot reviewed Jul 1, 2026

View reviewed changes

Comment thread src/hash/clu_hash_setup.c Outdated

null ptr defreference fix

6b4078f

aidankeefe2022 force-pushed the refactor-setup-to-GetOpt branch from 27866c3 to 6b4078f Compare July 1, 2026 18:47

fixed old memory leak

d0b8679

Uh oh!

Conversation

aidankeefe2022 commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rewriting Every Setup Function and Standardizing help function locations; Also slight refactor to wolfCLU_getOpt func

Why

Benefits

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #260

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JacobBarthelmeh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #260

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #260

Low (1)

In-loop error returns in wolfCLU_setup leak mode and key buffers without zeroizing

Uh oh!

aidankeefe2022 commented Jun 30, 2026 •

edited

Loading