Fix TLS CBC MAC verify and benchmark PQ option table for crypto callback builds

.github/workflows/cryptocb-only.yml

@@ -1,3 +1,3 @@
 name: cryptocb-only Tests
 
 # START OF COMMON SECTION
@@ -141,7 +141,10 @@
            "configure": ["--enable-slhdsa=yes,sha2", "CPPFLAGS=-DWOLF_CRYPTO_CB_ONLY_ECC -DWOLF_CRYPTO_CB_ONLY_RSA -DWOLF_CRYPTO_CB_ONLY_SHA256 -DWOLF_CRYPTO_CB_ONLY_SHA512 -DWOLF_CRYPTO_CB_ONLY_AES -DWOLF_CRYPTO_CB_ONLY_ED25519 -DWOLF_CRYPTO_CB_ONLY_CURVE25519 -DWOLF_CRYPTO_CB_ONLY_CURVE448 -DWOLF_CRYPTO_CB_ONLY_SLHDSA"]},
           {"name": "only", "minutes": 4.0,
            "comment": "Same coverage as the \"all\" entry above, but driven by ./configure --enable-cryptocb=only instead of a hand-written CPPFLAGS list. This is the regression test for the configure option: it must emit exactly the WOLF_CRYPTO_CB_ONLY_* set that \"all\" passes by hand, for the algorithms this base enables. The \"all\" entry deliberately stays on explicit CPPFLAGS so a bug in the configure logic cannot silently weaken both. Note the base already passes --enable-cryptocb; this entry's flags are appended after the base, so --enable-cryptocb=only wins.",
-           "configure": ["--enable-cryptocb=only"]}
+           "configure": ["--enable-cryptocb=only"]},
+          {"name": "setkey", "minutes": 4.0,
+           "comment": "--enable-cryptocbutils turns on all cryptocb utilities (COPY/FREE/SETKEY/EXPORT_KEY/KEYSTORE); this entry needs WOLF_CRYPTO_CB_SETKEY. Exercises test_wc_CryptoCb_TLS_CBC_HMAC: a TLS 1.2 MAC-then-Encrypt CBC handshake whose record HMAC is computed by a callback that owns the key (services the SETKEY op) and leaves the software hash state empty, so TLS_hmac must route it through Hmac_UpdateFinal. No ONLY_* strip here so the device's own software HMAC keeps its providers; the base already enables swdev. No other cryptocb config enables SETKEY, so the test is skipped everywhere else.",
+           "configure": ["--enable-cryptocbutils"]}
           ]}
           EOF
           .github/scripts/parallel-make-check.py \

src/tls.c

@@ -1196,8 +1196,15 @@ static int Hmac_UpdateFinal_CT(Hmac* hmac, byte* digest, const byte* in,
 
 #endif
 
+/* A crypto-callback device that services the HMAC SETKEY operation owns the
+ * key: wc_HmacSetKey() returns before it derives the software ipad/opad, so it
+ * leaves hmac->keyRaw NULL and the raw-hash constant-time path no software
+ * state to read. keyRaw NULL is the exact signal for that case -- it also
+ * covers a WOLF_CRYPTO_CB_FIND device found by algorithm with no devId -- and
+ * only WOLF_CRYPTO_CB_SETKEY builds can reach it. */
 #if defined(WOLFSSL_NO_HASH_RAW) || defined(HAVE_FIPS) || \
-    defined(HAVE_SELFTEST) || defined(HAVE_BLAKE2B)
+    defined(HAVE_SELFTEST) || defined(HAVE_BLAKE2B) || \
+    (defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_SETKEY))
 
 /* Calculate the HMAC of the header + message data.
  * Constant time implementation using normal hashing operations.
@@ -1467,6 +1474,20 @@ int TLS_hmac(WOLFSSL* ssl, byte* digest, const byte* in, word32 sz, int padSz,
         if (verify && padSz >= 0) {
 #if !defined(WOLFSSL_NO_HASH_RAW) && !defined(HAVE_FIPS) && \
     !defined(HAVE_SELFTEST)
+    #if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_SETKEY)
+            /* keyRaw NULL means a crypto-callback device owns the key and the
+             * software hash state the raw-hash path reads is uncomputed. Use
+             * the update/final variant: the padding-time equalization (dummy
+             * blocks) is preserved and the timing profile is the device's,
+             * outside the Lucky13 software threat model. When software holds
+             * the key (keyRaw set, incl. PK-only offload or a device that
+             * declined the HMAC) the raw-hash path below is kept. */
+            if (hmac->keyRaw == NULL) {
+                ret = Hmac_UpdateFinal(hmac, digest, in,
+                        totalSz, myInner, innerSz);
+            }
+            else
+    #endif
     #ifdef HAVE_BLAKE2B
             if (wolfSSL_GetHmacType(ssl) == WC_HASH_TYPE_BLAKE2B) {
                 ret = Hmac_UpdateFinal(hmac, digest, in,