Fix VaultIC port PR review feedback

Author: dgarske

CMakeLists.txt

@@ -524,6 +524,9 @@ endif()
 add_option("WOLFSSL_VAULTIC" "Enable WISeKey/SealSQ VaultIC support (default: disabled)" "no" "yes;no")
 if(WOLFSSL_VAULTIC)
     list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_VAULTIC")
+    # VaultIC port requires PK callbacks (mirror autotools --enable-vaultic).
+    # WOLFSSL_PKCALLBACKS is declared later, so force it before its add_option().
+    force_option(WOLFSSL_PKCALLBACKS "yes")
 endif()
 
 add_option("WOLFSSL_WOLFSENTRY" "Enable wolfSentry support (default: disabled)" "no" "yes;no")

wolfcrypt/src/port/sealsq/README.md

@@ -145,7 +145,7 @@ controller base addresses for the Pi 2/3 (`0x3f804000`) and Pi 4
 ### Raspberry Pi 5 (RP1 / DesignWare I2C) - use a bit-banged bus
 
 The Pi 5 does not work with the SDK's built-in bitrate control: its I2C
-controller lives in the RP1 chip (a Synopsys DesignWare controller behind
+controller lives in the RP1 chip (a DesignWare I2C controller behind
 PCIe) at a different address, so the SDK's `/dev/mem` register poke targets a
 controller that is not there and has no effect. Worse, the RP1 DesignWare
 controller itself hangs on the VaultIC's clock stretching during longer

wolfcrypt/src/port/sealsq/vaultic.c

@@ -114,11 +114,11 @@ int WOLFSSL_VAULTIC_EccVerifyCb(WOLFSSL* ssl,
 
     (void)ssl;
     (void)ctx;
-    *result = 0;
 
     if (keyDer == NULL || sig == NULL || hash == NULL || result == NULL) {
         return BAD_FUNC_ARG;
     }
+    *result = 0;
 
     if ((err = wc_ecc_init(&key)) != 0) {
         WOLFSSL_MSG("wc_ecc_init");
@@ -369,7 +369,9 @@ int WOLFSSL_VAULTIC_LoadCertificates(WOLFSSL_CTX* ctx)
     }
 
     WOLFSSL_MSG("[Device certificate]");
+#ifdef WOLFSSL_VAULTIC_DEBUG
     WOLFSSL_BUFFER(device_cert, sizeof_device_cert);
+#endif
 
     /* Read CA certificate in VaultIC */
     WOLFSSL_MSG("Read CA Certificate in VaultIC");
@@ -391,19 +393,23 @@ int WOLFSSL_VAULTIC_LoadCertificates(WOLFSSL_CTX* ctx)
     }
 
     WOLFSSL_MSG("[CA certificate]");
+#ifdef WOLFSSL_VAULTIC_DEBUG
     WOLFSSL_BUFFER(ca_cert, sizeof_ca_cert);
+#endif
 
     /* Load CA certificate into WOLFSSL_CTX */
-    if ((ret = wolfSSL_CTX_load_verify_buffer(ctx, ca_cert,
-            sizeof_ca_cert, WOLFSSL_FILETYPE_ASN1)) != WOLFSSL_SUCCESS) {
+    if (wolfSSL_CTX_load_verify_buffer(ctx, ca_cert,
+            sizeof_ca_cert, WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) {
         WOLFSSL_MSG("failed to load CA certificate");
+        ret = WC_HW_E;
         goto free_cert_buffers;
     }
 
     /* Load Device certificate into WOLFSSL_CTX */
-    if ((ret = wolfSSL_CTX_use_certificate_buffer(ctx, device_cert,
-            sizeof_device_cert, WOLFSSL_FILETYPE_ASN1)) != WOLFSSL_SUCCESS) {
+    if (wolfSSL_CTX_use_certificate_buffer(ctx, device_cert,
+            sizeof_device_cert, WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) {
         WOLFSSL_MSG("failed to load Device certificate");
+        ret = WC_HW_E;
         goto free_cert_buffers;
     }
 

wolfssl/wolfcrypt/port/sealsq/vaultic.h

@@ -21,8 +21,8 @@
 
 /* WISeKey/SealSQ VaultIC secure element port (PK callbacks) */
 
-#ifndef _WOLFPORT_VAULTIC_H_
-#define _WOLFPORT_VAULTIC_H_
+#ifndef WOLFPORT_SEALSQ_VAULTIC_H
+#define WOLFPORT_SEALSQ_VAULTIC_H
 
 #include <wolfssl/wolfcrypt/settings.h>
 
@@ -57,7 +57,7 @@ WOLFSSL_API int WOLFSSL_VAULTIC_EccSharedSecretCb(WOLFSSL* ssl,
 
 WOLFSSL_API int WOLFSSL_VAULTIC_LoadCertificates(WOLFSSL_CTX* ctx);
 
-/* Helper API's for setting up callbacks */
+/* Helper APIs for setting up callbacks */
 WOLFSSL_API int WOLFSSL_VAULTIC_SetupPkCallbacks(WOLFSSL_CTX* ctx);
 WOLFSSL_API int WOLFSSL_VAULTIC_SetupPkCallbackCtx(WOLFSSL* ssl, void* user_ctx);
 
@@ -67,4 +67,4 @@ WOLFSSL_API int WOLFSSL_VAULTIC_SetupPkCallbackCtx(WOLFSSL* ssl, void* user_ctx)
 
 #endif /* WOLFSSL_VAULTIC */
 
-#endif /* _WOLFPORT_VAULTIC_H_ */
+#endif /* WOLFPORT_SEALSQ_VAULTIC_H */