Un-nest Ed25519 cryptocb cases from HAVE_CURVE25519

[yosuke-wolfssl]

Problem

In wh_Client_CryptoCbStd, the #ifdef HAVE_ED25519 block holding the
WC_PK_TYPE_ED25519_KEYGEN, _SIGN and _VERIFY cases was nested inside the
#ifdef HAVE_CURVE25519 block. These are independent wolfSSL build options, so
the three dispatch cases compiled only when both were defined.

In a build with Ed25519 enabled and Curve25519 disabled, every Ed25519 operation
on a wolfHSM devId fell through to default: ret = CRYPTOCB_UNAVAILABLE;, which
wh_Client_CryptoCb deliberately propagates, so wolfCrypt silently used its
software implementation. For a key whose private scalar lives only in the HSM
(devCtx holds a keyId, no local material) that path cannot sign at all — HSM
offload broke with no diagnostic. The DMA sibling wh_Client_CryptoCbDma
already had the correct sibling layout, confirming the nesting was accidental.

Closes F-7149.

Fix (src/wh_client_cryptocb.c)

Moved #endif /* HAVE_CURVE25519 */ up to just after the WC_PK_TYPE_CURVE25519
case so the Ed25519 group is a sibling rather than a child:

         } break;              /* end WC_PK_TYPE_CURVE25519 */
+#endif /* HAVE_CURVE25519 */
 
 #ifdef HAVE_ED25519
         ...
 #endif /* HAVE_ED25519 */
-#endif /* HAVE_CURVE25519 */

One line moved, net zero. Every other Curve25519/Ed25519 guard pair in the repo
was audited and already correct.

Test harness

The existing Ed25519 tests did not catch this: they call the
wh_Client_Ed25519* APIs directly, bypassing the crypto callback, and the inline
test signs with a key that still holds local private material. The whole suite
passed with the dispatch cases compiled out.

• _whTest_CryptoEd25519CryptoCbHsmKey (test-refactor/client-server/wh_test_crypto_ed25519.c)
  signs via wc_ed25519_sign_msg() on a key reduced to a bare keyId, so the
  callback must handle it. A software fallback returns BAD_FUNC_ARG.
• NOCURVE25519=1 build knob added to both harness Makefiles, gating
  HAVE_CURVE25519 in the shared test/config/user_settings.h.
• One CI row added to build-and-test-refactor.yml.

Verification

Negative control on unfixed source: NOCURVE25519=1 failed with rc=-173
(BAD_FUNC_ARG); the default build passed — isolating the defect to the guard.

Config	Result
refactor NOCURVE25519=1	42 passed, 0 failed (was failing)
refactor DMA=1	47 passed, 0 failed
refactor DMA=1 ASAN=1 NOCURVE25519=1	43 passed, 0 failed
legacy, default and NOCURVE25519=1	exit 0

[Copilot]

Pull request overview

This PR fixes a conditional-compilation bug in the client crypto callback dispatch so Ed25519 operations are available even when Curve25519 is disabled (they are independent wolfSSL build options). It also adds a targeted regression test and CI coverage to prevent future guard/dispatch regressions in Ed25519 offload.

Changes:

• Un-nests the Ed25519 WC_PK_TYPE_ED25519_{KEYGEN,SIGN,VERIFY} cases from #ifdef HAVE_CURVE25519 in wh_Client_CryptoCbStd.
• Adds a new refactor test that signs/verifies via wolfCrypt APIs using a server-only Ed25519 keyId (ensuring the cryptocb path is required).
• Introduces an NOCURVE25519=1 build knob for both test harness Makefiles and adds a CI job to exercise Ed25519-without-Curve25519.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/wh_client_cryptocb.c	Moves the #endif /* HAVE_CURVE25519 */ to make Ed25519 dispatch cases compile independently of Curve25519.
test-refactor/client-server/wh_test_crypto_ed25519.c	Adds a regression test that forces Ed25519 sign/verify through the crypto callback using server-only keyIds.
test/config/user_settings.h	Allows disabling HAVE_CURVE25519 for tests via WOLFHSM_CFG_TEST_NO_CURVE25519.
test/Makefile	Adds NOCURVE25519=1 knob to define WOLFHSM_CFG_TEST_NO_CURVE25519.
test-refactor/posix/Makefile	Adds the same NOCURVE25519=1 knob for the refactor harness.
.github/workflows/build-and-test-refactor.yml	Adds a CI build/test row that runs with NOCURVE25519=1 to cover the fixed dispatch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #493

Scan targets checked: wolfhsm-crypto-bugs, wolfhsm-src

No new issues found in the changed files. ✅