From 5b4216c63b4c4f24423831d653f94721ac4d322b Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Mon, 8 Jul 2024 14:25:35 -0700 Subject: [PATCH 01/12] Initial implementation of WolfSSL TLS for zephyr --- include/zephyr/net/socket.h | 4 +- include/zephyr/net/tls_ciphersuites.h | 265 +++ .../sockets/echo_server/overlay-wolfssl.conf | 23 + subsys/net/lib/sockets/Kconfig | 25 +- subsys/net/lib/sockets/sockets_tls.c | 1833 ++++++++++++++++- subsys/random/Kconfig | 2 +- subsys/random/random_ctr_drbg.c | 28 + tests/net/socket/tls/overlay-wolfssl.conf | 10 + tests/net/socket/tls/prj.conf | 4 +- tests/net/socket/tls/src/main.c | 459 ++++- tests/net/socket/tls_ext/overlay-wolfssl.conf | 6 + tests/subsys/random/rng/overlay-wolfssl.conf | 5 + west.yml | 8 + 13 files changed, 2602 insertions(+), 70 deletions(-) create mode 100644 include/zephyr/net/tls_ciphersuites.h create mode 100644 samples/net/sockets/echo_server/overlay-wolfssl.conf create mode 100644 tests/net/socket/tls/overlay-wolfssl.conf create mode 100644 tests/net/socket/tls_ext/overlay-wolfssl.conf create mode 100644 tests/subsys/random/rng/overlay-wolfssl.conf diff --git a/include/zephyr/net/socket.h b/include/zephyr/net/socket.h index 9af729faecd8..a405eee2d502 100644 --- a/include/zephyr/net/socket.h +++ b/include/zephyr/net/socket.h @@ -167,7 +167,9 @@ extern "C" { /** Socket option for preventing certificates from being copied to the mbedTLS * heap if possible. The option is only effective for DER certificates and is - * ignored for PEM certificates. + * ignored for PEM certificates. This option has no effect when using wolfSSL + * as the underlying TLS implementation, the cert data is always copied to the + * heap in that case. */ #define TLS_CERT_NOCOPY 10 /** TLS socket option to use with offloading. The option instructs the network diff --git a/include/zephyr/net/tls_ciphersuites.h b/include/zephyr/net/tls_ciphersuites.h new file mode 100644 index 000000000000..95c60375039d --- /dev/null +++ b/include/zephyr/net/tls_ciphersuites.h @@ -0,0 +1,265 @@ +/* + * Copyright (c) 2018 Nordic Semiconductor ASA + * + * SPDX-License-Identifier: Apache-2.0 + */ + +/** @file + * @brief TLS ciphersuite list + * + * The ciphersuite list for TLS. + */ + +#ifndef ZEPHYR_INCLUDE_NET_TLS_CIPHERSUITES_H_ +#define ZEPHYR_INCLUDE_NET_TLS_CIPHERSUITES_H_ + +/** + * @brief TLS ciphersuite list + * @ingroup networking + * @{ + */ + +#ifdef __cplusplus +extern "C" { +#endif + + +/* + * Supported ciphersuites (Official IANA names) + */ +#define TLS_RSA_WITH_NULL_MD5 0x01 /**< Weak! */ +#define TLS_RSA_WITH_NULL_SHA 0x02 /**< Weak! */ + +#define TLS_PSK_WITH_NULL_SHA 0x2C /**< Weak! */ +#define TLS_DHE_PSK_WITH_NULL_SHA 0x2D /**< Weak! */ +#define TLS_RSA_PSK_WITH_NULL_SHA 0x2E /**< Weak! */ +#define TLS_RSA_WITH_AES_128_CBC_SHA 0x2F + +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x33 +#define TLS_RSA_WITH_AES_256_CBC_SHA 0x35 +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x39 + +#define TLS_RSA_WITH_NULL_SHA256 0x3B /**< Weak! */ +#define TLS_RSA_WITH_AES_128_CBC_SHA256 0x3C /**< TLS 1.2 */ +#define TLS_RSA_WITH_AES_256_CBC_SHA256 0x3D /**< TLS 1.2 */ + +#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x41 +#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x45 + +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x67 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x6B /**< TLS 1.2 */ + +#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x84 +#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x88 + +#define TLS_PSK_WITH_AES_128_CBC_SHA 0x8C +#define TLS_PSK_WITH_AES_256_CBC_SHA 0x8D + +#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x90 +#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x91 + +#define TLS_RSA_PSK_WITH_AES_128_CBC_SHA 0x94 +#define TLS_RSA_PSK_WITH_AES_256_CBC_SHA 0x95 + +#define TLS_RSA_WITH_AES_128_GCM_SHA256 0x9C /**< TLS 1.2 */ +#define TLS_RSA_WITH_AES_256_GCM_SHA384 0x9D /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x9E /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x9F /**< TLS 1.2 */ + +#define TLS_PSK_WITH_AES_128_GCM_SHA256 0xA8 /**< TLS 1.2 */ +#define TLS_PSK_WITH_AES_256_GCM_SHA384 0xA9 /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 0xAA /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 0xAB /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 0xAC /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 0xAD /**< TLS 1.2 */ + +#define TLS_PSK_WITH_AES_128_CBC_SHA256 0xAE +#define TLS_PSK_WITH_AES_256_CBC_SHA384 0xAF +#define TLS_PSK_WITH_NULL_SHA256 0xB0 /**< Weak! */ +#define TLS_PSK_WITH_NULL_SHA384 0xB1 /**< Weak! */ + +#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 0xB2 +#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 0xB3 +#define TLS_DHE_PSK_WITH_NULL_SHA256 0xB4 /**< Weak! */ +#define TLS_DHE_PSK_WITH_NULL_SHA384 0xB5 /**< Weak! */ + +#define TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 0xB6 +#define TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 0xB7 +#define TLS_RSA_PSK_WITH_NULL_SHA256 0xB8 /**< Weak! */ +#define TLS_RSA_PSK_WITH_NULL_SHA384 0xB9 /**< Weak! */ + +#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBA /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBE /**< TLS 1.2 */ + +#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC0 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4 /**< TLS 1.2 */ + +#define TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 /**< Weak! */ +#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 +#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 + +#define TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 /**< Weak! */ +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A + +#define TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B /**< Weak! */ +#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E +#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F + +#define TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 /**< Weak! */ +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 + +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 0xC025 /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 0xC026 /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /**< TLS 1.2 */ + +#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0xC02E /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /**< TLS 1.2 */ + +#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035 +#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036 +#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037 +#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038 +#define TLS_ECDHE_PSK_WITH_NULL_SHA 0xC039 +#define TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A +#define TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B + +#define TLS_RSA_WITH_ARIA_128_CBC_SHA256 0xC03C /**< TLS 1.2 */ +#define TLS_RSA_WITH_ARIA_256_CBC_SHA384 0xC03D /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC044 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC045 /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC048 /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC049 /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC04A /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC04B /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC04C /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC04D /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 0xC04E /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 0xC04F /**< TLS 1.2 */ +#define TLS_RSA_WITH_ARIA_128_GCM_SHA256 0xC050 /**< TLS 1.2 */ +#define TLS_RSA_WITH_ARIA_256_GCM_SHA384 0xC051 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC052 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC053 /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05C /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05D /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05E /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05F /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC060 /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC061 /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 0xC062 /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 0xC063 /**< TLS 1.2 */ +#define TLS_PSK_WITH_ARIA_128_CBC_SHA256 0xC064 /**< TLS 1.2 */ +#define TLS_PSK_WITH_ARIA_256_CBC_SHA384 0xC065 /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC066 /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC067 /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 0xC068 /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 0xC069 /**< TLS 1.2 */ +#define TLS_PSK_WITH_ARIA_128_GCM_SHA256 0xC06A /**< TLS 1.2 */ +#define TLS_PSK_WITH_ARIA_256_GCM_SHA384 0xC06B /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 0xC06C /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 0xC06D /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 0xC06E /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 0xC06F /**< TLS 1.2 */ +#define TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC070 /**< TLS 1.2 */ +#define TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC071 /**< TLS 1.2 */ + +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC075 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC076 +#define TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC077 +#define TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC078 +#define TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC079 + +#define TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07A /**< TLS 1.2 */ +#define TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07B /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07C /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07D /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC086 /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC087 /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC088 /**< TLS 1.2 */ +#define TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC089 /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08A /**< TLS 1.2 */ +#define TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08B /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08C /**< TLS 1.2 */ +#define TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08D /**< TLS 1.2 */ + +#define TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC08E /**< TLS 1.2 */ +#define TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC08F /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC090 /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC091 /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC092 /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC093 /**< TLS 1.2 */ + +#define TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC094 +#define TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC095 +#define TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC096 +#define TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC097 +#define TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC098 +#define TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC099 +#define TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A +#define TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B + +#define TLS_RSA_WITH_AES_128_CCM 0xC09C /**< TLS 1.2 */ +#define TLS_RSA_WITH_AES_256_CCM 0xC09D /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_AES_128_CCM 0xC09E /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_AES_256_CCM 0xC09F /**< TLS 1.2 */ +#define TLS_RSA_WITH_AES_128_CCM_8 0xC0A0 /**< TLS 1.2 */ +#define TLS_RSA_WITH_AES_256_CCM_8 0xC0A1 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_AES_128_CCM_8 0xC0A2 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_AES_256_CCM_8 0xC0A3 /**< TLS 1.2 */ +#define TLS_PSK_WITH_AES_128_CCM 0xC0A4 /**< TLS 1.2 */ +#define TLS_PSK_WITH_AES_256_CCM 0xC0A5 /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_AES_128_CCM 0xC0A6 /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_AES_256_CCM 0xC0A7 /**< TLS 1.2 */ +#define TLS_PSK_WITH_AES_128_CCM_8 0xC0A8 /**< TLS 1.2 */ +#define TLS_PSK_WITH_AES_256_CCM_8 0xC0A9 /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_AES_128_CCM_8 0xC0AA /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_AES_256_CCM_8 0xC0AB /**< TLS 1.2 */ +/* The last two are named with PSK_DHE in the RFC, which looks like a typo */ + +#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM 0xC0AC /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM 0xC0AD /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 0xC0AE /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 0xC0AF /**< TLS 1.2 */ + +#define TLS_ECJPAKE_WITH_AES_128_CCM_8 0xC0FF /**< experimental */ + +/* RFC 7905 */ +#define TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 /**< TLS 1.2 */ +#define TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /**< TLS 1.2 */ +#define TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA /**< TLS 1.2 */ +#define TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAB /**< TLS 1.2 */ +#define TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAC /**< TLS 1.2 */ +#define TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAD /**< TLS 1.2 */ +#define TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAE /**< TLS 1.2 */ + +/* RFC 8446, Appendix B.4 */ +#define TLS1_3_AES_128_GCM_SHA256 0x1301 /**< TLS 1.3 */ +#define TLS1_3_AES_256_GCM_SHA384 0x1302 /**< TLS 1.3 */ +#define TLS1_3_CHACHA20_POLY1305_SHA256 0x1303 /**< TLS 1.3 */ +#define TLS1_3_AES_128_CCM_SHA256 0x1304 /**< TLS 1.3 */ +#define TLS1_3_AES_128_CCM_8_SHA256 0x1305 /**< TLS 1.3 */ + +#ifdef __cplusplus +} +#endif + +/** + * @} + */ + +#endif /* ZEPHYR_INCLUDE_NET_TLS_CIPHERSUITES_H_ */ \ No newline at end of file diff --git a/samples/net/sockets/echo_server/overlay-wolfssl.conf b/samples/net/sockets/echo_server/overlay-wolfssl.conf new file mode 100644 index 000000000000..f12b3e641614 --- /dev/null +++ b/samples/net/sockets/echo_server/overlay-wolfssl.conf @@ -0,0 +1,23 @@ +CONFIG_MAIN_STACK_SIZE=3072 +CONFIG_NET_BUF_RX_COUNT=80 +CONFIG_NET_BUF_TX_COUNT=80 + +# TLS configuration +CONFIG_MBEDTLS=n +CONFIG_NET_SAMPLE_CERTS_WITH_SC=y + +CONFIG_NET_SOCKETS_SOCKOPT_TLS=y +CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=6 +CONFIG_NET_SOCKETS_ENABLE_DTLS=y +CONFIG_NET_SOCKETS_DTLS_TIMEOUT=30000 +CONFIG_NET_SOCKETS_DTLS_MAX_FRAGMENT_LENGTH=2048 +CONFIG_ZVFS_OPEN_MAX=20 + +CONFIG_POSIX_API=y +CONFIG_POSIX_CLOCK=y +CONFIG_PTHREAD_IPC=y +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_DTLS=y +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 + + diff --git a/subsys/net/lib/sockets/Kconfig b/subsys/net/lib/sockets/Kconfig index 2fe534678fa1..26317a33cb37 100644 --- a/subsys/net/lib/sockets/Kconfig +++ b/subsys/net/lib/sockets/Kconfig @@ -145,7 +145,7 @@ config NET_SOCKETS_SERVICE_STACK_SIZE config NET_SOCKETS_SOCKOPT_TLS bool "TCP TLS socket option support" imply TLS_CREDENTIALS - select MBEDTLS if NET_NATIVE + select MBEDTLS if NET_NATIVE && !WOLFSSL imply MBEDTLS_TLS_VERSION_1_2 if !NET_L2_OPENTHREAD imply MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if !NET_L2_OPENTHREAD imply MBEDTLS_CIPHER_AES_ENABLED if !NET_L2_OPENTHREAD @@ -166,15 +166,18 @@ config NET_SOCKETS_TLS_SET_MAX_FRAGMENT_LENGTH bool "Set Maximum Fragment Length (MFL)" default y help - Call mbedtls_ssl_conf_max_frag_len() on created TLS context - configuration, so that Maximum Fragment Length (MFL) will be sent to - peer using RFC 6066 max_fragment_length extension. + Configure the created TLS context so that Maximum Fragment Length (MFL) + will be sent to peer using RFC 6066 max_fragment_length extension. - Maximum Fragment Length (MFL) value is automatically chosen based on - MBEDTLS_SSL_OUT_CONTENT_LEN and MBEDTLS_SSL_IN_CONTENT_LEN mbed TLS - macros (which are configured by CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN in - case of default mbed TLS config). With DTLS, MFL value may be further - limited with NET_SOCKETS_DTLS_MAX_FRAGMENT_LENGTH. + For MbedTLS, Maximum Fragment Length (MFL) value is automatically + chosen based on MBEDTLS_SSL_OUT_CONTENT_LEN and + MBEDTLS_SSL_IN_CONTENT_LEN mbed TLS macros (which are configured by + CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN in case of default mbed TLS config). + With DTLS, MFL value may be further limited with + NET_SOCKETS_DTLS_MAX_FRAGMENT_LENGTH. + + For WolfSSL, Maximum Fragment Length (MFL) value is set by the + configuration option WOLFSSL_MAX_FRAGMENT_LEN. This is mostly useful for TLS client side to tell TLS server what is the maximum supported receive record length. @@ -182,7 +185,7 @@ config NET_SOCKETS_TLS_SET_MAX_FRAGMENT_LENGTH config NET_SOCKETS_ENABLE_DTLS bool "DTLS socket support" depends on NET_SOCKETS_SOCKOPT_TLS - select MBEDTLS_DTLS if NET_NATIVE + select MBEDTLS_DTLS if NET_NATIVE && !WOLFSSL help Enable DTLS socket support. By default only TLS over TCP is supported. @@ -256,7 +259,7 @@ config NET_SOCKETS_TLS_MAX_CIPHERSUITES config NET_SOCKETS_TLS_MAX_APP_PROTOCOLS int "Maximum number of supported application layer protocols" default 2 - depends on NET_SOCKETS_SOCKOPT_TLS && MBEDTLS_SSL_ALPN + depends on NET_SOCKETS_SOCKOPT_TLS && (MBEDTLS_SSL_ALPN || WOLFSSL_ALPN) help This variable sets maximum number of supported application layer protocols over TLS/DTLS that can be set explicitly by a socket option. diff --git a/subsys/net/lib/sockets/sockets_tls.c b/subsys/net/lib/sockets/sockets_tls.c index c04882d92398..8b5ea12c90a1 100644 --- a/subsys/net/lib/sockets/sockets_tls.c +++ b/subsys/net/lib/sockets/sockets_tls.c @@ -47,6 +47,12 @@ LOG_MODULE_REGISTER(net_sock_tls, CONFIG_NET_SOCKETS_LOG_LEVEL); #include #include #include + +#define ZTLS_IS_CLIENT MBEDTLS_SSL_IS_CLIENT +#define ZTLS_IS_SERVER MBEDTLS_SSL_IS_SERVER +#define ZTLS_ERROR_WANT_READ MBEDTLS_ERR_SSL_WANT_READ +#define ZTLS_ERROR_WANT_WRITE MBEDTLS_ERR_SSL_WANT_WRITE + #endif /* CONFIG_MBEDTLS */ #include "sockets_internal.h" @@ -56,6 +62,30 @@ LOG_MODULE_REGISTER(net_sock_tls, CONFIG_NET_SOCKETS_LOG_LEVEL); #include #endif +#if defined(CONFIG_WOLFSSL) +#include +#include +#include +#include + +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) && !defined(WOLFSSL_DTLS) +#error "DTLS sockets enabled but wolfssl DTLS not enabled" +#endif + +#define ZTLS_IS_CLIENT 0 +#define ZTLS_IS_SERVER 1 +#define ZTLS_ERROR_WANT_READ WOLFSSL_ERROR_WANT_READ +#define ZTLS_ERROR_WANT_WRITE WOLFSSL_ERROR_WANT_WRITE + +/* DTLS default timeout values, copied from mbedtls to replicate existing default behavior */ +/* + * Default range for DTLS retransmission timer value, in milliseconds. + * RFC 6347 4.2.4.1 says from 1 second to 60 seconds. + */ +#define DTLS_TIMEOUT_DFL_MIN 1000 +#define DTLS_TIMEOUT_DFL_MAX 60000 +#endif /* CONFIG_WOLFSSL */ + #if defined(CONFIG_NET_SOCKETS_TLS_MAX_APP_PROTOCOLS) #define ALPN_MAX_PROTOCOLS (CONFIG_NET_SOCKETS_TLS_MAX_APP_PROTOCOLS + 1) #else @@ -115,12 +145,21 @@ struct tls_session_cache { }; #if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) +#if defined(CONFIG_WOLFSSL) +/* Currently no support for DTLS CID, use dummy struct instead */ struct tls_dtls_cid { - bool enabled; - unsigned char cid[MAX(MBEDTLS_SSL_CID_OUT_LEN_MAX, - MBEDTLS_SSL_CID_IN_LEN_MAX)]; - size_t cid_len; + bool enabled; + unsigned char cid[1]; + size_t cid_len; }; +#else +struct tls_dtls_cid { + bool enabled; + unsigned char cid[MAX(MBEDTLS_SSL_CID_OUT_LEN_MAX, + MBEDTLS_SSL_CID_IN_LEN_MAX)]; + size_t cid_len; +}; +#endif #endif /** TLS context information. */ @@ -213,8 +252,10 @@ __net_socket struct tls_context { /** Context information for DTLS timing. */ struct dtls_timing_context dtls_timing; +#if defined(CONFIG_MBEDTLS) /** mbedTLS cookie context for DTLS */ mbedtls_ssl_cookie_ctx cookie; +#endif /** DTLS peer address. */ struct sockaddr dtls_peer_addr; @@ -223,7 +264,33 @@ __net_socket struct tls_context { socklen_t dtls_peer_addrlen; #endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ -#if defined(CONFIG_MBEDTLS) +#if defined(CONFIG_WOLFSSL) + /** The wolfSSL context */ + WOLFSSL_CTX* ctx; + + /** The wolfSSL SSL context */ + WOLFSSL* wssl; + + /** The hostname to use as the SNI */ + byte * host_name; + + /* Length in bytes of the host_name */ + word32 host_len; +#ifndef NO_PSK + /* The Pre Shared Key to be used */ + byte * psk; + + /* Length in bytes of the Pre Shared Key data */ + word32 psk_len; + + /* The Identity associated with the value in psk */ + byte * psk_id; + + /* The Length in bytes of the psk identity */ + word32 psk_id_len; +#endif + +#elif defined(CONFIG_MBEDTLS) /** mbedTLS context. */ mbedtls_ssl_context ssl; @@ -248,7 +315,9 @@ __net_socket struct tls_context { /* A global pool of TLS contexts. */ static struct tls_context tls_contexts[CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS]; +#if defined(CONFIG_MBEDTLS) static struct tls_session_cache client_cache[CONFIG_NET_SOCKETS_TLS_MAX_CLIENT_SESSION_COUNT]; +#endif #if defined(MBEDTLS_SSL_CACHE_C) static mbedtls_ssl_cache_context server_cache; @@ -262,6 +331,14 @@ static struct k_mutex context_lock; */ #define TLS_WAIT_MS 100 +static int tls_release(struct tls_context *tls); + +bool net_socket_is_tls(void *obj) +{ + return PART_OF_ARRAY(tls_contexts, (struct tls_context *)obj); +} + +#if defined(CONFIG_MBEDTLS) static void tls_session_cache_reset(void) { for (int i = 0; i < ARRAY_SIZE(client_cache); i++) { @@ -273,11 +350,6 @@ static void tls_session_cache_reset(void) (void)memset(client_cache, 0, sizeof(client_cache)); } -bool net_socket_is_tls(void *obj) -{ - return PART_OF_ARRAY(tls_contexts, (struct tls_context *)obj); -} - static int tls_ctr_drbg_random(void *ctx, unsigned char *buf, size_t len) { ARG_UNUSED(ctx); @@ -354,6 +426,7 @@ static int dtls_get_remaining_timeout(struct tls_context *ctx) return timing->fin_ms - elapsed_ms; } #endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ +#endif /* CONFIG_MBEDTLS */ /* Initialize TLS internals. */ static int tls_init(void) @@ -365,7 +438,9 @@ static int tls_init(void) #endif (void)memset(tls_contexts, 0, sizeof(tls_contexts)); +#if defined(CONFIG_MBEDTLS) (void)memset(client_cache, 0, sizeof(client_cache)); +#endif k_mutex_init(&context_lock); @@ -383,6 +458,8 @@ static inline bool is_handshake_complete(struct tls_context *ctx) return k_sem_count_get(&ctx->tls_established) != 0; } +#if defined(CONFIG_MBEDTLS) + /* * Copied from include/mbedtls/ssl_internal.h * @@ -435,6 +512,7 @@ static inline void tls_set_max_frag_len(mbedtls_ssl_config *config, enum net_soc #else static inline void tls_set_max_frag_len(mbedtls_ssl_config *config, enum net_sock_type type) {} #endif +#endif /* CONFIG_MBEDTLS */ /* Allocate TLS context. */ static struct tls_context *tls_alloc(void) @@ -463,7 +541,15 @@ static struct tls_context *tls_alloc(void) if (tls) { k_sem_init(&tls->tls_established, 0, 1); - +#if defined(CONFIG_WOLFSSL) +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + tls->options.dtls_handshake_timeout_min = DTLS_TIMEOUT_DFL_MIN; + tls->options.dtls_handshake_timeout_max = DTLS_TIMEOUT_DFL_MAX; + tls->options.dtls_cid.cid_len = 0; + tls->options.dtls_cid.enabled = false; + tls->options.dtls_handshake_on_connect = true; +#endif +#else mbedtls_ssl_init(&tls->ssl); mbedtls_ssl_config_init(&tls->config); #if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) @@ -485,6 +571,7 @@ static struct tls_context *tls_alloc(void) #if defined(CONFIG_MBEDTLS_DEBUG) mbedtls_ssl_conf_dbg(&tls->config, zephyr_mbedtls_debug, NULL); #endif +#endif /* CONFIG_WOLFSSL */ } else { NET_WARN("Failed to allocate TLS context"); } @@ -508,12 +595,59 @@ static struct tls_context *tls_clone(struct tls_context *source_tls) memcpy(&target_tls->options, &source_tls->options, sizeof(target_tls->options)); +#if defined(CONFIG_WOLFSSL) + if (NULL != source_tls->host_name) + { + target_tls->host_name = (byte *)XMALLOC( + source_tls->host_len, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (target_tls->host_name == NULL) { + tls_release(target_tls); + return NULL; + } + + XMEMCPY(target_tls->host_name, source_tls->host_name, + source_tls->host_len); + + target_tls->host_len = source_tls->host_len; + } +#ifndef NO_PSK + if (NULL != source_tls->psk) + { + target_tls->psk = (byte *)XMALLOC( + source_tls->psk_len, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (target_tls->psk == NULL) { + tls_release(target_tls); + return NULL; + } + + XMEMCPY(target_tls->psk, source_tls->psk, + source_tls->psk_len); + + target_tls->psk_len = source_tls->psk_len; + } + if (NULL != source_tls->psk_id) + { + target_tls->psk_id = (byte *)XMALLOC( + source_tls->psk_id_len, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (target_tls->psk_id == NULL) { + tls_release(target_tls); + return NULL; + } + + XMEMCPY(target_tls->psk_id, source_tls->psk_id, + source_tls->psk_id_len); + + target_tls->psk_id_len = source_tls->psk_id_len; + } +#endif +#else #if defined(MBEDTLS_X509_CRT_PARSE_C) if (target_tls->options.is_hostname_set) { mbedtls_ssl_set_hostname(&target_tls->ssl, source_tls->ssl.hostname); } #endif +#endif /* CONFIG_WOLFSSL */ return target_tls; } @@ -531,6 +665,23 @@ static int tls_release(struct tls_context *tls) return -EBADF; } +#if defined(CONFIG_WOLFSSL) + if (NULL != tls->host_name) + XFREE(tls->host_name, NULL, DYNAMIC_TYPE_TMP_BUFFER); +#ifndef NO_PSK + if (NULL != tls->psk) { + XMEMSET(tls->psk, 0, tls->psk_len); + XFREE(tls->psk, NULL, DYNAMIC_TYPE_TMP_BUFFER); + } + if (NULL != tls->psk_id) + XFREE(tls->psk_id, NULL, DYNAMIC_TYPE_TMP_BUFFER); +#endif + wolfSSL_shutdown(tls->wssl); + wolfSSL_free(tls->wssl); + tls->wssl = NULL; + wolfSSL_CTX_free(tls->ctx); + tls->ctx = NULL; +#else #if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) mbedtls_ssl_cookie_free(&tls->cookie); #endif @@ -541,6 +692,7 @@ static int tls_release(struct tls_context *tls) mbedtls_x509_crt_free(&tls->own_cert); mbedtls_pk_free(&tls->priv_key); #endif +#endif /* CONFIG_WOLFSSL */ tls->is_used = false; @@ -571,6 +723,7 @@ static bool peer_addr_cmp(const struct sockaddr *addr, return false; } +#if defined(CONFIG_MBEDTLS) static int tls_session_save(const struct sockaddr *peer_addr, mbedtls_ssl_session *session) { @@ -731,6 +884,7 @@ static void tls_session_purge(void) mbedtls_ssl_cache_init(&server_cache); #endif } +#endif /* CONFIG_MBEDTLS */ static inline int time_left(uint32_t start, uint32_t timeout) { @@ -777,11 +931,11 @@ static int wait(int sock, int timeout, int event) static int wait_for_reason(int sock, int timeout, int reason) { - if (reason == MBEDTLS_ERR_SSL_WANT_READ) { + if (reason == ZTLS_ERROR_WANT_READ) { return wait(sock, timeout, ZSOCK_POLLIN); } - if (reason == MBEDTLS_ERR_SSL_WANT_WRITE) { + if (reason == ZTLS_ERROR_WANT_WRITE) { return wait(sock, timeout, ZSOCK_POLLOUT); } @@ -850,6 +1004,65 @@ static void dtls_peer_address_get(struct tls_context *context, *addrlen = len; } +#if defined(CONFIG_WOLFSSL) +static int dtls_wolf_tx(WOLFSSL *ssl, char *buf, int len, void *ctx) +{ + struct tls_context *tls_ctx = ctx; + ssize_t sent; + + sent = zsock_sendto(tls_ctx->sock, buf, len, ZSOCK_MSG_DONTWAIT, + &tls_ctx->dtls_peer_addr, + tls_ctx->dtls_peer_addrlen); + if (sent < 0) { + if (errno == EAGAIN) { + return WOLFSSL_CBIO_ERR_WANT_WRITE; + } + + return WOLFSSL_CBIO_ERR_GENERAL; + } + + return sent; +} + +static int dtls_wolf_rx(WOLFSSL *ssl, char *buf, int len, void *ctx) +{ + struct tls_context *tls_ctx = ctx; + socklen_t addrlen = sizeof(struct sockaddr); + struct sockaddr addr; + ssize_t received; + + received = zsock_recvfrom(tls_ctx->sock, buf, len, + ZSOCK_MSG_DONTWAIT, &addr, &addrlen); + if (received < 0) { + if (errno == EAGAIN) { + return WOLFSSL_CBIO_ERR_WANT_READ; + } + + return WOLFSSL_CBIO_ERR_GENERAL; + } + + if (tls_ctx->dtls_peer_addrlen == 0) { + /* Only allow to store peer address for DTLS servers. */ + if (tls_ctx->options.role == ZTLS_IS_SERVER) { + dtls_peer_address_set(tls_ctx, &addr, addrlen); + + if (wolfSSL_dtls_set_peer(ssl, (void *)&addr, + (unsigned int)addrlen) != WOLFSSL_SUCCESS) { + return WOLFSSL_CBIO_ERR_GENERAL; + } + } else { + /* For clients it's incorrect to receive when + * no peer has been set up. + */ + return WOLFSSL_CBIO_ERR_GENERAL; + } + } else if (!dtls_is_peer_addr_valid(tls_ctx, &addr, addrlen)) { + return WOLFSSL_CBIO_ERR_WANT_READ; + } + + return received; +} +#else static int dtls_tx(void *ctx, const unsigned char *buf, size_t len) { struct tls_context *tls_ctx = ctx; @@ -910,8 +1123,10 @@ static int dtls_rx(void *ctx, unsigned char *buf, size_t len) return received; } +#endif /* CONFIG_WOLFSSL */ #endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ +#if defined(CONFIG_MBEDTLS) static int tls_tx(void *ctx, const unsigned char *buf, size_t len) { struct tls_context *tls_ctx = ctx; @@ -947,6 +1162,80 @@ static int tls_rx(void *ctx, unsigned char *buf, size_t len) return received; } +#endif + + +#if defined(CONFIG_WOLFSSL) +static int tls_wolf_tx(WOLFSSL *ssl, char *buf, int len, void *ctx) +{ + struct tls_context *tls_ctx = ctx; + ssize_t sent; + + sent = zsock_sendto(tls_ctx->sock, buf, len, + ZSOCK_MSG_DONTWAIT, NULL, 0); + if (sent < 0) { + switch(errno) { + case EAGAIN: + return WOLFSSL_CBIO_ERR_WANT_WRITE; + case ECONNRESET: + return WOLFSSL_CBIO_ERR_CONN_RST; + case EINTR: + return WOLFSSL_CBIO_ERR_ISR; + case EPIPE: + return WOLFSSL_CBIO_ERR_CONN_CLOSE; + default: + return WOLFSSL_CBIO_ERR_GENERAL; + + } + } + + return sent; +} + +static int tls_wolf_rx(WOLFSSL *ssl, char *buf, int len, void *ctx) +{ + struct tls_context *tls_ctx = ctx; + ssize_t received; + + received = zsock_recvfrom(tls_ctx->sock, buf, len, + ZSOCK_MSG_DONTWAIT, NULL, 0); + if (received < 0) { + switch(errno) { + case EAGAIN: + if (!wolfSSL_dtls(ssl)) { + return WOLFSSL_CBIO_ERR_WANT_READ; + } + else { + return WOLFSSL_CBIO_ERR_TIMEOUT; + } + case ECONNRESET: + return WOLFSSL_CBIO_ERR_CONN_RST; + case EINTR: + return WOLFSSL_CBIO_ERR_ISR; + case ECONNREFUSED: + return WOLFSSL_CBIO_ERR_WANT_READ; + case ECONNABORTED: + return WOLFSSL_CBIO_ERR_CONN_CLOSE; + default: + return WOLFSSL_CBIO_ERR_GENERAL; + + } + } + else if (received == 0) { + return WOLFSSL_CBIO_ERR_CONN_CLOSE; + } + + return received; +} + +/* wolfssl implementation also used this check for private keys, so only check + * -----BEGIN to match -----BEGIN CERTIFICATE and -----BEGIN PRIVATE KEY */ +static bool crt_is_pem(const unsigned char *buf, size_t buflen) +{ + return (buflen != 0 && buf[buflen - 1] == '\0' && + strstr((const char *)buf, "-----BEGIN") != NULL); +} +#endif /* CONFIG_WOLFSSL */ #if defined(MBEDTLS_X509_CRT_PARSE_C) static bool crt_is_pem(const unsigned char *buf, size_t buflen) @@ -959,7 +1248,23 @@ static bool crt_is_pem(const unsigned char *buf, size_t buflen) static int tls_add_ca_certificate(struct tls_context *tls, struct tls_credential *ca_cert) { -#if defined(MBEDTLS_X509_CRT_PARSE_C) +#if defined(CONFIG_WOLFSSL) + int ret; + int format = WOLFSSL_FILETYPE_ASN1; + + if (crt_is_pem(ca_cert->buf, ca_cert->len)) { + format = WOLFSSL_FILETYPE_PEM; + } + ret = wolfSSL_CTX_load_verify_buffer(tls->ctx, ca_cert->buf, + ca_cert->len, format); + + if (ret != WOLFSSL_SUCCESS) { + NET_ERR("Failed to parse CA certificate"); + return -EINVAL; + } + + return 0; +#elif defined(MBEDTLS_X509_CRT_PARSE_C) int err; if (tls->options.cert_nocopy == TLS_CERT_NOCOPY_NONE || @@ -983,6 +1288,7 @@ static int tls_add_ca_certificate(struct tls_context *tls, return -ENOTSUP; } +#if defined(CONFIG_MBEDTLS) static void tls_set_ca_chain(struct tls_context *tls) { #if defined(MBEDTLS_X509_CRT_PARSE_C) @@ -991,11 +1297,27 @@ static void tls_set_ca_chain(struct tls_context *tls) &mbedtls_x509_crt_profile_default); #endif /* MBEDTLS_X509_CRT_PARSE_C */ } +#endif static int tls_add_own_cert(struct tls_context *tls, struct tls_credential *own_cert) { -#if defined(MBEDTLS_X509_CRT_PARSE_C) +#if defined(CONFIG_WOLFSSL) + int ret = 0; + int format = WOLFSSL_FILETYPE_ASN1; + + if (crt_is_pem(own_cert->buf, own_cert->len)) { + format = WOLFSSL_FILETYPE_PEM; + } + ret = wolfSSL_CTX_use_certificate_buffer(tls->ctx, own_cert->buf, + own_cert->len, format); + if (ret != WOLFSSL_SUCCESS) { + NET_ERR("Failed to parse certificate"); + return -EINVAL; + } + + return 0; +#elif defined(MBEDTLS_X509_CRT_PARSE_C) int err; if (tls->options.cert_nocopy == TLS_CERT_NOCOPY_NONE || @@ -1018,6 +1340,7 @@ static int tls_add_own_cert(struct tls_context *tls, return -ENOTSUP; } +#if defined(CONFIG_MBEDTLS) static int tls_set_own_cert(struct tls_context *tls) { #if defined(MBEDTLS_X509_CRT_PARSE_C) @@ -1032,11 +1355,26 @@ static int tls_set_own_cert(struct tls_context *tls) return -ENOTSUP; } +#endif static int tls_set_private_key(struct tls_context *tls, struct tls_credential *priv_key) { -#if defined(MBEDTLS_X509_CRT_PARSE_C) +#if defined(CONFIG_WOLFSSL) + int ret = 0; + int format = WOLFSSL_FILETYPE_ASN1; + if (crt_is_pem(priv_key->buf, priv_key->len)) { + format = WOLFSSL_FILETYPE_PEM; + } + ret = wolfSSL_CTX_use_PrivateKey_buffer(tls->ctx, priv_key->buf, + priv_key->len, format); + if (ret != WOLFSSL_SUCCESS) { + NET_ERR("Failed to parse private key"); + return -EINVAL; + } + + return 0; +#elif defined(MBEDTLS_X509_CRT_PARSE_C) int err; err = mbedtls_pk_parse_key(&tls->priv_key, priv_key->buf, @@ -1056,6 +1394,40 @@ static int tls_set_psk(struct tls_context *tls, struct tls_credential *psk, struct tls_credential *psk_id) { +#if defined(CONFIG_WOLFSSL) +#ifndef NO_PSK + if (NULL != tls->psk) + { + XFREE(tls->psk, NULL, DYNAMIC_TYPE_TMP_BUFFER); + } + tls->psk = (byte *)XMALLOC( + psk->len, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (tls->psk == NULL) { + return -ENOMEM; + } + + XMEMCPY(tls->psk, psk->buf, psk->len); + tls->psk_len = psk->len; + + if (NULL != tls->psk_id) + { + XFREE(tls->psk_id, NULL, DYNAMIC_TYPE_TMP_BUFFER); + } + tls->psk_id = (byte *)XMALLOC( + psk_id->len + 1, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (tls->psk_id == NULL) { + return -ENOMEM; + } + + XMEMCPY(tls->psk_id, psk_id->buf, psk_id->len); + tls->psk_id[psk_id->len] = '\0'; + tls->psk_id_len = psk_id->len; + + return 0; +#else + return -ENOTSUP; +#endif +#else #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) int err = mbedtls_ssl_conf_psk(&tls->config, psk->buf, psk->len, @@ -1067,6 +1439,7 @@ static int tls_set_psk(struct tls_context *tls, return 0; #endif +#endif /* CONFIG_WOLFSSL */ return -ENOTSUP; } @@ -1109,6 +1482,7 @@ static int tls_set_credential(struct tls_context *tls, return 0; } +#if defined(CONFIG_MBEDTLS) static int tls_mbedtls_set_credentials(struct tls_context *tls) { struct tls_credential *cred; @@ -1447,6 +1821,752 @@ static int tls_mbedtls_init(struct tls_context *context, bool is_server) return 0; } +#endif /* CONFIG_MBEDTLS */ + +#if defined(CONFIG_WOLFSSL) + +static int tls_wolfssl_reset(struct tls_context *context) +{ + k_sem_reset(&context->tls_established); + +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + /* Server role: reset the address so that a new + * client can connect w/o a need to reopen a socket + * Client role: keep peer addr so socket can continue to be used + * even on handshake timeout + */ + if (context->options.role == ZTLS_IS_SERVER) { + (void)memset(&context->dtls_peer_addr, 0, + sizeof(context->dtls_peer_addr)); + context->dtls_peer_addrlen = 0; + } +#endif + + return 0; +} + +static ssize_t send_tls_wolfssl(struct tls_context *ctx, const void *buf, + size_t len, int flags) +{ + const bool is_block = is_blocking(ctx->sock, flags); + int ret = 0; + int err = 0; + k_timeout_t timeout; + k_timepoint_t end; + + if (ctx->error != 0) { + errno = ctx->error; + return -1; + } + + if (ctx->session_closed) { + errno = ECONNABORTED; + return -1; + } + + if (!is_block) { + timeout = K_NO_WAIT; + } else { + timeout = ctx->options.timeout_tx; + } + + end = sys_timepoint_calc(timeout); + + do { + ret = wolfSSL_write(ctx->wssl, buf, len); + if (ret > 0) { + return ret; + } + + err = wolfSSL_get_error(ctx->wssl, ret); + + if (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE) { + int timeout_ms; + + if (!is_block) { + errno = EAGAIN; + break; + } + + /* Blocking timeout. */ + timeout = sys_timepoint_timeout(end); + if (K_TIMEOUT_EQ(timeout, K_NO_WAIT)) { + errno = EAGAIN; + break; + } + + /* Block. */ + timeout_ms = timeout_to_ms(&timeout); + ret = wait_for_reason(ctx->sock, timeout_ms, err); + if (ret != 0) { + errno = -ret; + break; + } + } + else { + NET_ERR("TLS send error: %x", err); + tls_wolfssl_reset(ctx); + ctx->error = ECONNABORTED; + errno = ECONNABORTED; + break; + } + } while (true); + + return -1; +} + +static ssize_t recv_tls_wolfssl(struct tls_context *ctx, void *buf, + size_t max_len, int flags) +{ + size_t recv_len = 0; + const bool waitall = flags & ZSOCK_MSG_WAITALL; + const bool is_block = is_blocking(ctx->sock, flags); + k_timeout_t timeout; + k_timepoint_t end; + int ret; + int err; + + if (ctx->error != 0) { + errno = ctx->error; + return -1; + } + + if (ctx->session_closed) { + return 0; + } + + if (!is_block) { + timeout = K_NO_WAIT; + } else { + timeout = ctx->options.timeout_rx; + } + + end = sys_timepoint_calc(timeout); + + do { + size_t read_len = max_len - recv_len; + + ret = wolfSSL_read(ctx->wssl, (uint8_t *)buf + recv_len, + read_len); + if (ret < 0) { + err = wolfSSL_get_error(ctx->wssl, ret); + if (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE) { + int timeout_ms; + + if (!is_block) { + ret = -EAGAIN; + goto err; + } + + /* Blocking timeout. */ + timeout = sys_timepoint_timeout(end); + if (K_TIMEOUT_EQ(timeout, K_NO_WAIT)) { + ret = -EAGAIN; + goto err; + } + + timeout_ms = timeout_to_ms(&timeout); + + /* Block. */ + k_mutex_unlock(ctx->lock); + ret = wait_for_reason(ctx->sock, timeout_ms, err); + k_mutex_lock(ctx->lock, K_FOREVER); + + if (ret == 0) { + /* Retry. */ + continue; + } + } + else if (err == WOLFSSL_ERROR_ZERO_RETURN || + err == SOCKET_PEER_CLOSED_E) { + ctx->session_closed = true; + break; + } + else { + NET_ERR("TLS recv error: %x", err); + ret = -EIO; + } + +err: + errno = -ret; + return -1; + } + + if (ret == 0) { + break; + } + + recv_len += ret; + } while ((recv_len == 0) || (waitall && (recv_len < max_len))); + + return recv_len; +} + +static int tls_wolfssl_connect(struct tls_context *context, k_timeout_t timeout) +{ + int ret = 0; + int err = 0; + k_timepoint_t end; + + context->handshake_in_progress = true; + + end = sys_timepoint_calc(timeout); + + while ((ret = wolfSSL_connect(context->wssl)) != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(context->wssl, ret); + if (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE) { + int timeout_ms; + + /* Blocking timeout. */ + timeout = sys_timepoint_timeout(end); + if (K_TIMEOUT_EQ(timeout, K_NO_WAIT)) { + ret = -EAGAIN; + break; + } + + /* Block. */ + timeout_ms = timeout_to_ms(&timeout); + +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (context->type == SOCK_DGRAM) { + int timeout_dtls = + wolfSSL_dtls_get_current_timeout(context->wssl); + + if (timeout_ms == SYS_FOREVER_MS) { + timeout_ms = timeout_dtls; + } else { + timeout_ms = MIN(timeout_dtls, + timeout_ms); + } + } +#endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ + + ret = wait_for_reason(context->sock, timeout_ms, err); + if (ret != 0) { + break; + } + + continue; + } else { + NET_ERR("TLS handshake error: %x", err); + tls_wolfssl_reset(context); + context->error = ECONNABORTED; + ret = -ECONNABORTED; + break; + } + + /* Avoid constant loop if tls_mbedtls_reset fails */ + NET_ERR("TLS handshake error: %x", err); + context->error = ECONNABORTED; + ret = -ECONNABORTED; + break; + } + + if (ret == WOLFSSL_SUCCESS) { + k_sem_give(&context->tls_established); + } + + context->handshake_in_progress = false; + + return ret; +} + +static int tls_wolfssl_accept(struct tls_context *context, k_timeout_t timeout) +{ + int ret = 0; + int err = 0; + k_timepoint_t end; + + context->handshake_in_progress = true; + + end = sys_timepoint_calc(timeout); + + while ((ret = wolfSSL_accept(context->wssl)) != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(context->wssl, ret); + if (err == WOLFSSL_ERROR_WANT_READ || + err == WOLFSSL_ERROR_WANT_WRITE) { + int timeout_ms; + + /* Blocking timeout. */ + timeout = sys_timepoint_timeout(end); + if (K_TIMEOUT_EQ(timeout, K_NO_WAIT)) { + ret = -EAGAIN; + break; + } + + /* Block. */ + timeout_ms = timeout_to_ms(&timeout); + +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (context->type == SOCK_DGRAM) { + int timeout_dtls = + wolfSSL_dtls_get_current_timeout(context->wssl); + + if (timeout_ms == SYS_FOREVER_MS) { + timeout_ms = timeout_dtls; + } else { + timeout_ms = MIN(timeout_dtls, + timeout_ms); + } + } +#endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ + + ret = wait_for_reason(context->sock, timeout_ms, err); + if (ret != 0) { + break; + } + + continue; + } else { + /* MbedTLS API documentation requires session to + * be reset in other error cases + */ + NET_ERR("TLS handshake error: %x", err); + tls_wolfssl_reset(context); + context->error = ECONNABORTED; + ret = -ECONNABORTED; + break; + } + + /* Avoid constant loop if tls_mbedtls_reset fails */ + NET_ERR("TLS handshake error: %x", err); + context->error = ECONNABORTED; + ret = -ECONNABORTED; + break; + } + + if (ret == WOLFSSL_SUCCESS) { + k_sem_give(&context->tls_established); + } + + context->handshake_in_progress = false; + + return ret; +} + +#ifndef NO_PSK +static unsigned int tls_psk_server_cb(WOLFSSL* ssl, const char* identity, + unsigned char* key, unsigned int key_max_len) +{ + struct tls_context *context = NULL; + + context = (struct tls_context *)wolfSSL_get_psk_callback_ctx(ssl); + if (context == NULL) { + return 0; + } + + if (context->psk == NULL || context->psk_id == NULL) { + return 0; + } + + if (context->psk_len == 0 || context->psk_len > key_max_len) { + return 0; + } + + if (XSTRCMP(identity, context->psk_id) != 0) { + return 0; + } + + XMEMCPY(key, context->psk, context->psk_len); + + return context->psk_len; +} + +static unsigned int tls_psk_client_cb(WOLFSSL* ssl, const char* hint, + char* identity, unsigned int id_max_len, unsigned char* key, + unsigned int key_max_len) +{ + struct tls_context *context = NULL; + + context = (struct tls_context *)wolfSSL_get_psk_callback_ctx(ssl); + if (context == NULL) { + return 0; + } + + if (context->psk == NULL || context->psk_id == NULL) { + return 0; + } + + if (context->psk_len == 0 || context->psk_len > key_max_len || + context->psk_id_len == 0 || context->psk_id_len > id_max_len ) { + return 0; + } + + XMEMCPY(identity, context->psk_id, context->psk_id_len); + XMEMCPY(key, context->psk, context->psk_len); + + return context->psk_len; +} +#endif + +static int tls_wolfssl_set_credentials(struct tls_context *tls) +{ + struct tls_credential *cred; + sec_tag_t tag; + int i, err = 0; + bool tag_found; + + credentials_lock(); + + for (i = 0; i < tls->options.sec_tag_list.sec_tag_count; i++) { + tag = tls->options.sec_tag_list.sec_tags[i]; + cred = NULL; + tag_found = false; + + while ((cred = credential_next_get(tag, cred)) != NULL) { + tag_found = true; + + err = tls_set_credential(tls, cred); + if (err != 0) { + goto exit; + } + } + + if (!tag_found) { + err = -ENOENT; + goto exit; + } + } + +exit: + credentials_unlock(); + + return err; +} + +static int tls_wolfssl_set_session_cache_mode(struct tls_context *context) +{ + if ((context->options.role == ZTLS_IS_SERVER) && + (0 == context->options.cache_enabled)) { + if (wolfSSL_CTX_set_session_cache_mode(context->ctx, \ + SSL_SESS_CACHE_OFF) != WOLFSSL_SUCCESS) { + return -EINVAL; + } + } + + return 0; +} + +static int tls_wolfssl_set_hostname(struct tls_context *context) +{ + if (context->options.is_hostname_set) { + if (wolfSSL_UseSNI(context->wssl, WOLFSSL_SNI_HOST_NAME, + (const char *)context->host_name, context->host_len) \ + != WOLFSSL_SUCCESS) { + return -EINVAL; + } + } + + return 0; +} + +static int tls_wolfssl_set_verify(struct tls_context *context) +{ + int verifyLevel = -1; + + if (context->options.verify_level != -1) { + switch(context->options.verify_level) + { + case TLS_PEER_VERIFY_NONE: + verifyLevel = WOLFSSL_VERIFY_NONE; + break; + case TLS_PEER_VERIFY_OPTIONAL: + verifyLevel = WOLFSSL_VERIFY_DEFAULT; + break; + case TLS_PEER_VERIFY_REQUIRED: + verifyLevel = WOLFSSL_VERIFY_PEER; + break; + default: + return -EINVAL; + } + + wolfSSL_set_verify(context->wssl, verifyLevel, NULL); + } + + return 0; +} + +static int tls_wolfssl_set_ciphersuites(struct tls_context *context) +{ + int i = 0; + int cipher_cnt = 0; + int tmp = 0; + uint16_t sh = 0; + byte *cs = NULL; + byte *cs_bytes = NULL; + byte *iter = NULL; + byte arr[2]; + + /* Nothing to set */ + if (context->options.ciphersuites[0] == 0) { + return 0; + } + + i = 0; + while (context->options.ciphersuites[i] != 0) { + cipher_cnt++; + i++; + } + + cs = (byte *)context->options.ciphersuites; + cs_bytes = XMALLOC(cipher_cnt * 2, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (cs_bytes == NULL) { + return -ENOMEM; + } + + XMEMSET(cs_bytes, 0, cipher_cnt * 2); + + /* Convert mbedtls style integer format to wolfssl + * cipher byte style (2 bytes only per ciphersuite) */ + iter = cs; + i = 0; + while(iter < (cs + (cipher_cnt * sizeof(int)))) { + tmp = *((int *)iter); + /* All ciphersuites are 2 byte values, high order bytes should not be set */ + if (tmp > 0xFFFF) { + XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) + return -EINVAL; + } + /* Check above guarantees this is not a narrowing conversion */ + sh = (uint16_t)tmp; + + /* Convert from host order 16 bit int to big endian array */ + sys_put_be16(sh, arr); + cs_bytes[i] = arr[0]; + cs_bytes[i+1] = arr[1]; + i+=2; + iter += sizeof(int); + } + + if (wolfSSL_set_cipher_list_bytes(context->wssl, cs_bytes, + cipher_cnt * 2) != WOLFSSL_SUCCESS) { + XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) + return -EINVAL; + } + + XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) + return 0; +} + +#ifdef HAVE_ALPN +static int tls_wolfssl_set_alpn(struct tls_context *context) +{ + byte *alpn_buf = NULL; + int alpn_buf_len = 0; + byte *iter = NULL; + int len = 0; + int i = 0; + + if (ALPN_MAX_PROTOCOLS && context->options.alpn_list[0] != NULL) { + /* Convert from mbedtls format array of char * to single char * + * comma delimited list */ + i = 0; + while(context->options.alpn_list[i] != NULL) { + alpn_buf_len += XSTRLEN(context->options.alpn_list[i]) + 1; + i++; + } + + alpn_buf = XMALLOC(alpn_buf_len, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (alpn_buf == NULL) { + return -ENOMEM; + } + + i = 0; + iter = alpn_buf; + while(context->options.alpn_list[i] != NULL) { + len = XSTRLEN(context->options.alpn_list[i]); + XMEMCPY(iter, context->options.alpn_list[i], len); + iter += len; + *iter++ = ','; + i++; + } + + /* Replace final trailing comma with NULL terminator */ + *(iter - 1) = '\0'; + if (wolfSSL_UseALPN(context->wssl, alpn_buf, alpn_buf_len - 1, + WOLFSSL_ALPN_FAILED_ON_MISMATCH) != WOLFSSL_SUCCESS) { + XFREE(alpn_buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); + return -EINVAL; + } + + XFREE(alpn_buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); + } + + return 0; +} +#endif + +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) +static int tls_wolfssl_set_dtls_timeouts(struct tls_context *context) +{ + if (context->type == SOCK_DGRAM) { + if (wolfSSL_dtls_set_timeout_max(context->wssl, + (int)context->options.dtls_handshake_timeout_max) != WOLFSSL_SUCCESS) { + return -EINVAL; + } + if (wolfSSL_dtls_set_timeout_init(context->wssl, + (int)context->options.dtls_handshake_timeout_min) != WOLFSSL_SUCCESS) { + return -EINVAL; + } + + /* Underlying socket always acts like non-blocking due to IO callback overrides */ + wolfSSL_dtls_set_using_nonblock(context->wssl, 1); + } + + return 0; +} +#endif + +static int tls_wolfssl_set_options(struct tls_context *context) +{ + int ret = 0; + bool is_server = FALSE; + + if (context->options.role == ZTLS_IS_SERVER) { + is_server = TRUE; + } + + ret = tls_wolfssl_set_verify(context); + if (ret != 0) { + return ret; + } + + ret = tls_wolfssl_set_hostname(context); + if (ret != 0) { + return ret; + } + + ret = tls_wolfssl_set_session_cache_mode(context); + if (ret != 0) { + return ret; + } + + ret = tls_wolfssl_set_ciphersuites(context); + if (ret != 0) { + return ret; + } + +#ifdef HAVE_ALPN + ret = tls_wolfssl_set_alpn(context); + if (ret != 0) { + return ret; + } +#endif + +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + ret = tls_wolfssl_set_dtls_timeouts(context); + if (ret != 0) { + return ret; + } +#endif + + return 0; +} + +static int tls_wolfssl_init(struct tls_context *context, bool is_server) +{ + int ret; + + context->options.role = is_server ? ZTLS_IS_SERVER : ZTLS_IS_CLIENT; + +#if defined(CONFIG_WOLFSSL_DEBUG) + wolfSSL_Debugging_ON(); +#endif + + if (context->type == SOCK_STREAM) { + if (is_server) { + if (NULL == context->ctx) + context->ctx = wolfSSL_CTX_new(wolfTLSv1_2_server_method()); + } + else { + if (NULL == context->ctx) + context->ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method()); + } + + wolfSSL_CTX_SetIORecv(context->ctx, tls_wolf_rx); + wolfSSL_CTX_SetIOSend(context->ctx, tls_wolf_tx); + } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + else if (context->type == SOCK_DGRAM) { +#ifdef WOLFSSL_DTLS + if (is_server) { + if (NULL == context->ctx) + context->ctx = wolfSSL_CTX_new(wolfDTLSv1_2_server_method()); + } + else { + if (NULL == context->ctx) + context->ctx = wolfSSL_CTX_new(wolfDTLSv1_2_client_method()); + } + wolfSSL_CTX_SetIORecv(context->ctx, dtls_wolf_rx); + wolfSSL_CTX_SetIOSend(context->ctx, dtls_wolf_tx); +#else + return -ENOTSUP; +#endif + } +#endif + else { + return -EINVAL; + } + + ret = tls_wolfssl_set_credentials(context); + if (ret != 0) { + return -EINVAL; + } + +#ifndef NO_PSK + if (NULL != context->psk) { + if (is_server) { + wolfSSL_CTX_set_psk_server_callback(context->ctx, tls_psk_server_cb); + /* TODO: review psk hint */ + wolfSSL_CTX_use_psk_identity_hint(context->ctx, "zephyr wolfssl TLS server"); + } + else { + wolfSSL_CTX_set_psk_client_callback(context->ctx, tls_psk_client_cb); + } + } +#endif + +#if defined(CONFIG_WOLFSSL_MAX_FRAGMENT_LEN) + if (wolfSSL_CTX_UseMaxFragment(context->ctx, CONFIG_WOLFSSL_MAX_FRAGMENT_LEN) \ + != WOLFSSL_SUCCESS) { + return -EINVAL; + } +#endif + + if (NULL == context->wssl) { + if ((context->wssl = wolfSSL_new(context->ctx)) == NULL) { + return -EINVAL; + } + } + + if ((ret = wolfSSL_set_fd( + context->wssl, context->sock)) != WOLFSSL_SUCCESS) { + return -EINVAL; + } + + /* Set our TLS context as the read/write context since it contains the socket */ + wolfSSL_SetIOReadCtx(context->wssl, (void *)context); + wolfSSL_SetIOWriteCtx(context->wssl, (void *)context); + +#ifndef NO_PSK + if (NULL != context->psk) { + wolfSSL_set_psk_callback_ctx(context->wssl, (void *)context); + } +#endif + + ret = tls_wolfssl_set_options(context); + if (ret != 0) { + return ret; + } + + context->is_initialized = true; + + return 0; +} +#endif /* CONFIG_WOLFSSL */ static int tls_opt_sec_tag_list_set(struct tls_context *context, const void *optval, socklen_t optlen) @@ -1509,18 +2629,50 @@ static int tls_opt_hostname_set(struct tls_context *context, const void *optval, socklen_t optlen) { ARG_UNUSED(optlen); - -#if defined(MBEDTLS_X509_CRT_PARSE_C) - if (mbedtls_ssl_set_hostname(&context->ssl, optval) != 0) { - return -EINVAL; - } +#if defined(CONFIG_WOLFSSL) + int ret = 0; + + if (NULL != context->host_name) + { + XFREE(context->host_name, NULL, DYNAMIC_TYPE_TMP_BUFFER); + } + context->host_name = (byte *)XMALLOC( + optlen + 1, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (context->host_name == NULL) { + return -ENOMEM; + } + + XMEMCPY(context->host_name, optval, optlen); + context->host_name[optlen] = '\0'; + context->host_len = optlen; + + context->options.is_hostname_set = true; + + /* If the SSL context has been initialized then set value here, + * otherwise value will be set in next init */ + if (NULL != context->wssl) { + ret = tls_wolfssl_set_hostname(context); + if (ret != 0) { + XFREE(context->host_name, NULL, DYNAMIC_TYPE_TMP_BUFFER); + context->host_len = 0; + return ret; + } + } + + return 0; #else - return -ENOPROTOOPT; -#endif +#if defined(MBEDTLS_X509_CRT_PARSE_C) + if (mbedtls_ssl_set_hostname(&context->ssl, optval) != 0) { + return -EINVAL; + } - context->options.is_hostname_set = true; + context->options.is_hostname_set = true; - return 0; + return 0; +#else + return -ENOPROTOOPT; +#endif +#endif /* CONFIG_WOLFSSL */ } static int tls_opt_ciphersuite_list_set(struct tls_context *context, @@ -1538,6 +2690,24 @@ static int tls_opt_ciphersuite_list_set(struct tls_context *context, cipher_cnt = optlen / sizeof(int); +#if defined(CONFIG_WOLFSSL) + int ret = 0; + + XMEMCPY(context->options.ciphersuites, optval, optlen); + context->options.ciphersuites[cipher_cnt] = 0; + + /* If the SSL context has been initialized then set value here, + * otherwise value will be set in next init */ + if (NULL != context->wssl) { + ret = tls_wolfssl_set_ciphersuites(context); + if (ret != 0) { + return ret; + } + } + + return 0; +#else + /* + 1 for 0-termination. */ if (cipher_cnt + 1 > ARRAY_SIZE(context->options.ciphersuites)) { return -EINVAL; @@ -1549,11 +2719,15 @@ static int tls_opt_ciphersuite_list_set(struct tls_context *context, mbedtls_ssl_conf_ciphersuites(&context->config, context->options.ciphersuites); return 0; +#endif /* CONFIG_WOLFSSL */ } static int tls_opt_ciphersuite_list_get(struct tls_context *context, void *optval, socklen_t *optlen) { +#if defined(CONFIG_WOLFSSL) + byte *selected_buf = NULL; +#endif const int *selected_ciphers; int cipher_cnt, i = 0; int *ciphers = optval; @@ -1564,7 +2738,36 @@ static int tls_opt_ciphersuite_list_get(struct tls_context *context, if (context->options.ciphersuites[0] == 0) { /* No specific ciphersuites configured, return all available. */ - selected_ciphers = mbedtls_ssl_list_ciphersuites(); +#if defined(CONFIG_WOLFSSL) + byte arr[2]; + uint16_t sh = 0; + byte *cs_bytes = XMALLOC(GetCipherNamesSize() * 2, NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (cs_bytes == NULL) { + return -ENOMEM; + } + if (wolfSSL_get_cipher_list_bytes(cs_bytes, GetCipherNamesSize() * 2) \ + != WOLFSSL_SUCCESS) { + XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) + return -EINVAL; + } + + selected_buf = XMALLOC(GetCipherNamesSize() * sizeof(int), NULL, DYNAMIC_TYPE_TMP_BUFFER); + if (selected_buf == NULL) { + XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) + return -EINVAL; + } + + selected_ciphers = (const int *)selected_buf; + while(i < GetCipherNamesSize() * 2) { + arr[0] = cs_bytes[i]; + arr[1] = cs_bytes[i+1]; + sh = sys_get_be16(arr); + *selected_buf++ = (int)(sh); + i += 2; + } +#else + selected_ciphers = mbedtls_ssl_list_ciphersuites(); +#endif } else { selected_ciphers = context->options.ciphersuites; } @@ -1580,6 +2783,12 @@ static int tls_opt_ciphersuite_list_get(struct tls_context *context, *optlen = i * sizeof(int); +#if defined(CONFIG_WOLFSSL) + if (NULL != selected_buf) { + XFREE(selected_buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); + } +#endif + return 0; } @@ -1592,6 +2801,29 @@ static int tls_opt_ciphersuite_used_get(struct tls_context *context, return -EINVAL; } +#if defined(CONFIG_WOLFSSL) + byte arr[2]; + byte b1; + byte b2; + int flags = 0; + if (context->wssl == NULL) { + return -ENOTCONN; + } + + ciph = wolfSSL_get_cipher_name(context->wssl); + if (ciph == NULL) { + return -ENOTCONN; + } + + if (wolfSSL_get_cipher_suite_from_name(ciph, &b1, &b2, &flags) != 0) { + return -ENOTCONN; + } + + arr[0] = b1; + arr[1] = b2; + *(int *)optval = (int)(sys_get_be16(arr)); + return 0; +#else ciph = mbedtls_ssl_get_ciphersuite(&context->ssl); if (ciph == NULL) { return -ENOTCONN; @@ -1600,6 +2832,7 @@ static int tls_opt_ciphersuite_used_get(struct tls_context *context, *(int *)optval = mbedtls_ssl_get_ciphersuite_id(ciph); return 0; +#endif /* CONFIG_WOLFSSL */ } static int tls_opt_alpn_list_set(struct tls_context *context, @@ -1674,12 +2907,22 @@ static int tls_opt_dtls_handshake_timeout_set(struct tls_context *context, context->options.dtls_handshake_timeout_min = *val; } +#if defined(CONFIG_WOLFSSL) + int ret = 0; + if (NULL != context->wssl) { + ret = tls_wolfssl_set_options(context); + if (ret != 0) { + return ret; + } + } +#else /* If mbedTLS context already inited, we need to * update mbedTLS config for it to take effect */ mbedtls_ssl_conf_handshake_timeout(&context->config, context->options.dtls_handshake_timeout_min, context->options.dtls_handshake_timeout_max); +#endif /* CONFIG_WOLFSSL */ return 0; } @@ -1947,10 +3190,17 @@ static int tls_opt_session_cache_purge_set(struct tls_context *context, ARG_UNUSED(context); ARG_UNUSED(optval); ARG_UNUSED(optlen); +#if defined(CONFIG_WOLFSSL) + if (NULL != context->ctx) { + wolfSSL_CTX_flush_sessions(context->ctx, -1); + } + return 0; +#else tls_session_purge(); return 0; +#endif } static int tls_opt_peer_verify_set(struct tls_context *context, @@ -1968,9 +3218,9 @@ static int tls_opt_peer_verify_set(struct tls_context *context, peer_verify = (int *)optval; - if (*peer_verify != MBEDTLS_SSL_VERIFY_NONE && - *peer_verify != MBEDTLS_SSL_VERIFY_OPTIONAL && - *peer_verify != MBEDTLS_SSL_VERIFY_REQUIRED) { + if (*peer_verify != TLS_PEER_VERIFY_NONE && + *peer_verify != TLS_PEER_VERIFY_OPTIONAL && + *peer_verify != TLS_PEER_VERIFY_REQUIRED) { return -EINVAL; } @@ -2018,8 +3268,8 @@ static int tls_opt_dtls_role_set(struct tls_context *context, } role = (int *)optval; - if (*role != MBEDTLS_SSL_IS_CLIENT && - *role != MBEDTLS_SSL_IS_SERVER) { + if (*role != ZTLS_IS_CLIENT && + *role != ZTLS_IS_SERVER) { return -EINVAL; } @@ -2111,7 +3361,10 @@ int ztls_close_ctx(struct tls_context *ctx) /* Try to send close notification. */ ctx->flags = 0; + /* wolfssl will notify in tls_release() */ +#if defined(CONFIG_MBEDTLS) (void)mbedtls_ssl_close_notify(&ctx->ssl); +#endif err = tls_release(ctx); ret = zsock_close(ctx->sock); @@ -2164,6 +3417,17 @@ int ztls_connect_ctx(struct tls_context *ctx, const struct sockaddr *addr, || (ctx->type == SOCK_DGRAM && ctx->options.dtls_handshake_on_connect) #endif ) { +#if defined(CONFIG_WOLFSSL) + ret = tls_wolfssl_init(ctx, false); + if (ret < 0) { + goto error; + } + + ret = tls_wolfssl_connect(ctx, K_FOREVER); + if (ret < 0) { + goto error; + } +#else ret = tls_mbedtls_init(ctx, false); if (ret < 0) { goto error; @@ -2183,6 +3447,7 @@ int ztls_connect_ctx(struct tls_context *ctx, const struct sockaddr *addr, } tls_session_store(ctx, addr, addrlen); +#endif } return 0; @@ -2223,6 +3488,21 @@ int ztls_accept_ctx(struct tls_context *parent, struct sockaddr *addr, child->sock = sock; +#if defined(CONFIG_WOLFSSL) + ret = tls_wolfssl_init(child, true); + if (ret < 0) { + goto error; + } + + child->flags = 0; + + ret = tls_wolfssl_accept(child, K_FOREVER); + if (ret < 0) { + goto error; + } + + return fd; +#else ret = tls_mbedtls_init(child, true); if (ret < 0) { goto error; @@ -2240,6 +3520,7 @@ int ztls_accept_ctx(struct tls_context *parent, struct sockaddr *addr, } return fd; +#endif /* CONFIG_WOLFSSL */ error: if (child != NULL) { @@ -2258,6 +3539,7 @@ int ztls_accept_ctx(struct tls_context *parent, struct sockaddr *addr, return -1; } +#if defined(CONFIG_MBEDTLS) static ssize_t send_tls(struct tls_context *ctx, const void *buf, size_t len, int flags) { @@ -2336,8 +3618,86 @@ static ssize_t send_tls(struct tls_context *ctx, const void *buf, return -1; } +#endif #if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) +#if defined(CONFIG_WOLFSSL) +static ssize_t sendto_dtls_client_wolfssl(struct tls_context *ctx, const void *buf, + size_t len, int flags, + const struct sockaddr *dest_addr, + socklen_t addrlen) +{ + int ret; + + if (!dest_addr) { + /* No address provided, check if we have stored one, + * otherwise return error. + */ + if (ctx->dtls_peer_addrlen == 0) { + ret = -EDESTADDRREQ; + goto error; + } + } else if (ctx->dtls_peer_addrlen == 0) { + /* Address provided and no peer address stored. */ + dtls_peer_address_set(ctx, dest_addr, addrlen); + } else if (!dtls_is_peer_addr_valid(ctx, dest_addr, addrlen) != 0) { + /* Address provided but it does not match stored one */ + ret = -EISCONN; + goto error; + } + + if (!ctx->is_initialized) { + ret = tls_wolfssl_init(ctx, false); + if (ret < 0) { + goto error; + } + } + + if (!is_handshake_complete(ctx)) { + /* TODO For simplicity, TLS handshake blocks the socket even for + * non-blocking socket. + */ + ret = tls_wolfssl_connect(ctx, K_FOREVER); + if (ret < 0) { + goto error; + } + + /* Client socket ready to use again. */ + ctx->error = 0; + } + + return send_tls_wolfssl(ctx, buf, len, flags); + +error: + errno = -ret; + return -1; +} + +static ssize_t sendto_dtls_server_wolfssl(struct tls_context *ctx, const void *buf, + size_t len, int flags, + const struct sockaddr *dest_addr, + socklen_t addrlen) +{ + /* For DTLS server, require to have established DTLS connection + * in order to send data. + */ + if (!is_handshake_complete(ctx)) { + errno = ENOTCONN; + return -1; + } + + /* Verify we are sending to a peer that we have connection with. */ + if (dest_addr && + !dtls_is_peer_addr_valid(ctx, dest_addr, addrlen) != 0) { + errno = EISCONN; + return -1; + } + + return send_tls_wolfssl(ctx, buf, len, flags); +} + +#else + static ssize_t sendto_dtls_client(struct tls_context *ctx, const void *buf, size_t len, int flags, const struct sockaddr *dest_addr, @@ -2417,6 +3777,7 @@ static ssize_t sendto_dtls_server(struct tls_context *ctx, const void *buf, return send_tls(ctx, buf, len, flags); } +#endif /* CONFIG_WOLFSSL */ #endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ ssize_t ztls_sendto_ctx(struct tls_context *ctx, const void *buf, size_t len, @@ -2425,6 +3786,25 @@ ssize_t ztls_sendto_ctx(struct tls_context *ctx, const void *buf, size_t len, { ctx->flags = flags; +#if defined(CONFIG_WOLFSSL) + /* TLS */ + if (ctx->type == SOCK_STREAM) { + return send_tls_wolfssl(ctx, buf, len, flags); + } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + /* DTLS */ + if (ctx->options.role == ZTLS_IS_SERVER) { + return sendto_dtls_server_wolfssl(ctx, buf, len, flags, + dest_addr, addrlen); + } + + return sendto_dtls_client_wolfssl(ctx, buf, len, flags, dest_addr, addrlen); +#else + errno = ENOTSUP; + return -1; +#endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ +#else + /* TLS */ if (ctx->type == SOCK_STREAM) { return send_tls(ctx, buf, len, flags); @@ -2442,6 +3822,7 @@ ssize_t ztls_sendto_ctx(struct tls_context *ctx, const void *buf, size_t len, errno = ENOTSUP; return -1; #endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ +#endif /* CONFIG_WOLFSSL */ } static ssize_t dtls_sendmsg_merge_and_send(struct tls_context *ctx, @@ -2547,6 +3928,7 @@ ssize_t ztls_sendmsg_ctx(struct tls_context *ctx, const struct msghdr *msg, return tls_sendmsg_loop_and_send(ctx, msg, flags); } +#if defined(CONFIG_MBEDTLS) static ssize_t recv_tls(struct tls_context *ctx, void *buf, size_t max_len, int flags) { @@ -2645,8 +4027,244 @@ static ssize_t recv_tls(struct tls_context *ctx, void *buf, return recv_len; } +#endif /* CONFIG_MBEDTLS */ #if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) +#if defined(CONFIG_WOLFSSL) +static ssize_t recvfrom_dtls_common_wolfssl(struct tls_context *ctx, void *buf, + size_t max_len, int flags, + struct sockaddr *src_addr, + socklen_t *addrlen, int *werr) +{ + int ret; + bool is_block = is_blocking(ctx->sock, flags); + k_timeout_t timeout; + k_timepoint_t end; + + if (ctx->error != 0) { + errno = ctx->error; + return -1; + } + + if (!is_block) { + timeout = K_NO_WAIT; + } else { + timeout = ctx->options.timeout_rx; + } + + end = sys_timepoint_calc(timeout); + + do { + size_t remaining; + *werr = 0; + + ret = wolfSSL_read(ctx->wssl, buf, max_len); + if (ret < 0) { + *werr = wolfSSL_get_error(ctx->wssl, ret); + if (*werr == WOLFSSL_ERROR_WANT_READ || + *werr == WOLFSSL_ERROR_WANT_WRITE) { + int timeout_dtls, timeout_sock, timeout_ms; + + if (!is_block) { + return ret; + } + + /* Blocking timeout. */ + timeout = sys_timepoint_timeout(end); + if (K_TIMEOUT_EQ(timeout, K_NO_WAIT)) { + return ret; + } + + timeout_dtls = wolfSSL_dtls_get_current_timeout(ctx->wssl); + timeout_sock = timeout_to_ms(&timeout); + if (timeout_sock == SYS_FOREVER_MS) { + timeout_ms = MAX(timeout_dtls, timeout_sock); + } else { + timeout_ms = MIN(timeout_dtls, timeout_sock); + } + + /* Block. */ + k_mutex_unlock(ctx->lock); + ret = wait_for_reason(ctx->sock, timeout_ms, *werr); + k_mutex_lock(ctx->lock, K_FOREVER); + + if (ret == 0) { + /* Retry. */ + continue; + } else { + return -1; + } + } else { + return ret; + } + } + + if (src_addr && addrlen) { + dtls_peer_address_get(ctx, src_addr, addrlen); + } + + /* mbedtls_ssl_get_bytes_avail() indicate the data length + * remaining in the current datagram. + */ + remaining = wolfSSL_pending(ctx->wssl); + + /* No more data in the datagram, or dummy read. */ + if ((remaining == 0) || (max_len == 0)) { + return ret; + } + + if (flags & ZSOCK_MSG_TRUNC) { + ret += remaining; + } + + for (int i = 0; i < remaining; i++) { + uint8_t b; + int err; + + err = wolfSSL_read(ctx->wssl, &b, sizeof(b)); + if (err <= 0) { + NET_ERR("Error while flushing the rest of the" + " datagram, err %d", err); + ret = -1; + break; + } + } + + break; + } while (true); + + + return ret; +} + +static ssize_t recvfrom_dtls_client_wolfssl(struct tls_context *ctx, void *buf, + size_t max_len, int flags, + struct sockaddr *src_addr, + socklen_t *addrlen) +{ + int ret; + int err = 0; + + if (!is_handshake_complete(ctx)) { + ret = -ENOTCONN; + goto error; + } + + ret = recvfrom_dtls_common_wolfssl(ctx, buf, max_len, flags, src_addr, addrlen, &err); + if (ret >= 0) { + return ret; + } + + switch (err) { + case SOCKET_PEER_CLOSED_E: + /* Peer notified that it's closing the connection. */ + tls_wolfssl_reset(ctx); + ctx->error = ENOTCONN; + ret = -ENOTCONN; + break; + + case WOLFSSL_ERROR_WANT_READ: + case WOLFSSL_ERROR_WANT_WRITE: + case WOLFSSL_ERROR_ZERO_RETURN: + ret = -EAGAIN; + break; + + default: + NET_ERR("DTLS client recv error: -%x", -ret); + + tls_wolfssl_reset(ctx); + ctx->error = ECONNABORTED; + ret = -ECONNABORTED; + + break; + } + +error: + errno = -ret; + return -1; +} + +static ssize_t recvfrom_dtls_server_wolfssl(struct tls_context *ctx, void *buf, + size_t max_len, int flags, + struct sockaddr *src_addr, + socklen_t *addrlen) +{ + int ret; + bool repeat; + k_timeout_t timeout; + int err = 0; + + if (!ctx->is_initialized) { + ret = tls_wolfssl_init(ctx, true); + if (ret < 0) { + goto error; + } + } + + if (is_blocking(ctx->sock, flags)) { + timeout = ctx->options.timeout_rx; + } else { + timeout = K_NO_WAIT; + } + + /* Loop to enable DTLS reconnection for servers without closing + * a socket. + */ + do { + repeat = false; + + if (!is_handshake_complete(ctx)) { + ret = tls_wolfssl_accept(ctx, timeout); + if (ret < 0) { + /* In case of EAGAIN, just exit. */ + if (ret == -EAGAIN) { + break; + } + + tls_wolfssl_reset(ctx); + repeat = true; + continue; + } + + /* Server socket ready to use again. */ + ctx->error = 0; + } + + ret = recvfrom_dtls_common_wolfssl(ctx, buf, max_len, flags, + src_addr, addrlen, &err); + if (ret >= 0) { + return ret; + } + + switch (err) { + case SOCKET_PEER_CLOSED_E: + tls_wolfssl_reset(ctx); + repeat = true; + break; + + case WOLFSSL_ERROR_WANT_READ: + case WOLFSSL_ERROR_WANT_WRITE: + case WOLFSSL_ERROR_ZERO_RETURN: + case BUFFER_ERROR: + ret = -EAGAIN; + break; + + default: + NET_ERR("DTLS server recv error: -%x", -ret); + tls_wolfssl_reset(ctx); + ctx->error = ECONNABORTED; + ret = -ECONNABORTED; + break; + } + } while (repeat); + +error: + errno = -ret; + return -1; +} + +#else + static ssize_t recvfrom_dtls_common(struct tls_context *ctx, void *buf, size_t max_len, int flags, struct sockaddr *src_addr, @@ -2920,6 +4538,7 @@ static ssize_t recvfrom_dtls_server(struct tls_context *ctx, void *buf, errno = -ret; return -1; } +#endif /* CONFIG_WOLFSSL */ #endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ ssize_t ztls_recvfrom_ctx(struct tls_context *ctx, void *buf, size_t max_len, @@ -2936,6 +4555,28 @@ ssize_t ztls_recvfrom_ctx(struct tls_context *ctx, void *buf, size_t max_len, ctx->flags = flags; +#if defined(CONFIG_WOLFSSL) + + /* TLS */ + if (ctx->type == SOCK_STREAM) { + return recv_tls_wolfssl(ctx, buf, max_len, flags); + } + +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + /* DTLS */ + if (ctx->options.role == ZTLS_IS_SERVER) { + return recvfrom_dtls_server_wolfssl(ctx, buf, max_len, flags, + src_addr, addrlen); + } + + return recvfrom_dtls_client_wolfssl(ctx, buf, max_len, flags, + src_addr, addrlen); +#else + errno = ENOTSUP; + return -1; +#endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ +#else + /* TLS */ if (ctx->type == SOCK_STREAM) { return recv_tls(ctx, buf, max_len, flags); @@ -2954,10 +4595,20 @@ ssize_t ztls_recvfrom_ctx(struct tls_context *ctx, void *buf, size_t max_len, errno = ENOTSUP; return -1; #endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */ +#endif /* CONFIG_WOLFSSL */ } static int ztls_poll_prepare_pollin(struct tls_context *ctx) { +#if defined(CONFIG_WOLFSSL) + if (!ctx->is_listening) { + if (wolfSSL_pending(ctx->wssl) > 0) { + return -EALREADY; + } + } + + return 0; +#else /* If there already is mbedTLS data to read, there is no * need to set the k_poll_event object. Return EALREADY * so we won't block in the k_poll. @@ -2969,6 +4620,7 @@ static int ztls_poll_prepare_pollin(struct tls_context *ctx) } return 0; +#endif } static int ztls_poll_prepare_ctx(struct tls_context *ctx, @@ -2986,7 +4638,7 @@ static int ztls_poll_prepare_ctx(struct tls_context *ctx, * it actually starts to poll for data. */ if ((pfd->events & ZSOCK_POLLIN) && (ctx->type == SOCK_DGRAM) && - (ctx->options.role == MBEDTLS_SSL_IS_CLIENT) && + (ctx->options.role == ZTLS_IS_CLIENT) && !is_handshake_complete(ctx)) { (*pev)->obj = &ctx->tls_established; (*pev)->type = K_POLL_TYPE_SEM_AVAILABLE; @@ -3032,6 +4684,85 @@ static int ztls_poll_prepare_ctx(struct tls_context *ctx, static int ztls_socket_data_check(struct tls_context *ctx) { +#if defined(CONFIG_WOLFSSL) + int ret; + byte dummy[1]; + int err = 0; + + if (ctx->type == SOCK_STREAM) { + if (!ctx->is_initialized) { + return -ENOTCONN; + } + } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + else { + if (!ctx->is_initialized) { + bool is_server = ctx->options.role == ZTLS_IS_SERVER; + + ret = tls_wolfssl_init(ctx, is_server); + if (ret < 0) { + return -ENOMEM; + } + } + + if (!is_handshake_complete(ctx)) { + if (ctx->options.role == ZTLS_IS_SERVER) { + ret = tls_wolfssl_accept(ctx, K_NO_WAIT); + } + else { + ret = tls_wolfssl_connect(ctx, K_NO_WAIT); + } + + if (ret < 0) { + if (ret == -EAGAIN) { + return 0; + } + + tls_wolfssl_reset(ctx); + return 0; + } + + /* Socket ready to use again. */ + ctx->error = 0; + + return 0; + } + } +#endif + + ctx->flags = ZSOCK_MSG_DONTWAIT; + + /* Use a dummy peek to yield equivalent behavior to existing mbedtls usage, + * trigger a attempted processing of the next SSL record but do nothing with it */ + ret = wolfSSL_peek(ctx->wssl, (void *)dummy, 1); + if (ret < 0) + { + err = wolfSSL_get_error(ctx->wssl, ret); + if (err == SOCKET_PEER_CLOSED_E || + err == WOLFSSL_ERROR_ZERO_RETURN) { + if (ctx->type == SOCK_DGRAM) { + tls_wolfssl_reset(ctx); + } else { + ctx->session_closed = true; + } + + return -ENOTCONN; + } + + if (wolfSSL_want_read(ctx->wssl) == 1 || + wolfSSL_want_write(ctx->wssl) == 1) + { + return 0; + } + + tls_wolfssl_reset(ctx); + + return -ECONNABORTED; + } + + return wolfSSL_pending(ctx->wssl); + +#else int ret; if (ctx->type == SOCK_STREAM) { @@ -3119,6 +4850,7 @@ static int ztls_socket_data_check(struct tls_context *ctx) } return mbedtls_ssl_get_bytes_avail(&ctx->ssl); +#endif /* CONFIG_WOLFSSL */ } static int ztls_poll_update_pollin(int fd, struct tls_context *ctx, @@ -3128,10 +4860,17 @@ static int ztls_poll_update_pollin(int fd, struct tls_context *ctx, if (!ctx->is_listening) { /* Already had TLS data to read on socket. */ +#if defined(CONFIG_WOLFSSL) + if (wolfSSL_pending(ctx->wssl) > 0) { + pfd->revents |= ZSOCK_POLLIN; + goto next; + } +#else if (mbedtls_ssl_get_bytes_avail(&ctx->ssl) > 0) { pfd->revents |= ZSOCK_POLLIN; goto next; } +#endif } if (ctx->type == SOCK_STREAM) { @@ -3263,7 +5002,7 @@ static bool poll_offload_dtls_client_retry(struct tls_context *ctx, * reports that data is ready. */ if ((ctx->type != SOCK_DGRAM) || - (ctx->options.role != MBEDTLS_SSL_IS_CLIENT)) { + (ctx->options.role != ZTLS_IS_CLIENT)) { return false; } @@ -3276,13 +5015,13 @@ static bool poll_offload_dtls_client_retry(struct tls_context *ctx, pfd->revents &= ~ZSOCK_POLLIN; return true; } else if (!is_handshake_complete(ctx)) { - uint8_t byte; + uint8_t b; int ret; /* Handshake didn't start yet - just drop the incoming data - * it's the client who should initiate the handshake. */ - ret = zsock_recv(ctx->sock, &byte, sizeof(byte), + ret = zsock_recv(ctx->sock, &b, sizeof(b), ZSOCK_MSG_DONTWAIT); if (ret < 0) { pfd->revents |= ZSOCK_POLLERR; @@ -3639,6 +5378,21 @@ int ztls_setsockopt_ctx(struct tls_context *ctx, int level, int optname, } #if defined(CONFIG_NET_TEST) +#if defined(CONFIG_WOLFSSL) +WOLFSSL *ztls_get_wolfssl_context(int fd) +{ + struct tls_context *ctx; + + ctx = zvfs_get_fd_obj(fd, (const struct fd_op_vtable *) + &tls_sock_fd_op_vtable, EBADF); + if (ctx == NULL) { + return NULL; + } + + return ctx->wssl; +} +#endif +#if defined(CONFIG_MBEDTLS) mbedtls_ssl_context *ztls_get_mbedtls_ssl_context(int fd) { struct tls_context *ctx; @@ -3651,17 +5405,18 @@ mbedtls_ssl_context *ztls_get_mbedtls_ssl_context(int fd) return &ctx->ssl; } +#endif #endif /* CONFIG_NET_TEST */ -static ssize_t tls_sock_read_vmeth(void *obj, void *buffer, size_t count) +static ssize_t tls_sock_read_vmeth(void *obj, void *buf, size_t count) { - return ztls_recvfrom_ctx(obj, buffer, count, 0, NULL, 0); + return ztls_recvfrom_ctx(obj, buf, count, 0, NULL, 0); } -static ssize_t tls_sock_write_vmeth(void *obj, const void *buffer, +static ssize_t tls_sock_write_vmeth(void *obj, const void *buf, size_t count) { - return ztls_sendto_ctx(obj, buffer, count, 0, NULL, 0); + return ztls_sendto_ctx(obj, buf, count, 0, NULL, 0); } static int tls_sock_ioctl_vmeth(void *obj, unsigned int request, va_list args) diff --git a/subsys/random/Kconfig b/subsys/random/Kconfig index 4f6619fea221..66f39b783b60 100644 --- a/subsys/random/Kconfig +++ b/subsys/random/Kconfig @@ -105,7 +105,7 @@ config HARDWARE_DEVICE_CS_GENERATOR config CTR_DRBG_CSPRNG_GENERATOR bool "Use CTR-DRBG CSPRNG" - depends on MBEDTLS || TINYCRYPT + depends on WOLFSSL || MBEDTLS || TINYCRYPT depends on ENTROPY_HAS_DRIVER select MBEDTLS_CIPHER_AES_ENABLED if MBEDTLS select TINYCRYPT_CTR_PRNG if TINYCRYPT diff --git a/subsys/random/random_ctr_drbg.c b/subsys/random/random_ctr_drbg.c index 88c591075f18..bdd70194afdb 100644 --- a/subsys/random/random_ctr_drbg.c +++ b/subsys/random/random_ctr_drbg.c @@ -24,6 +24,11 @@ #include #include +#elif defined(CONFIG_WOLFSSL) +#include +#include +#include + #endif /* CONFIG_MBEDTLS */ /* @@ -48,6 +53,15 @@ static int ctr_drbg_entropy_func(void *ctx, unsigned char *buf, size_t len) static TCCtrPrng_t ctr_ctx; +#elif defined(CONFIG_WOLFSSL) + +static WC_RNG ctr_ctx; + +static int ctr_drbg_entropy_cb(OS_Seed* os, byte* seed, word32 sz) +{ + return entropy_get_entropy(entropy_dev, (void *)seed, (size_t)sz); +} + #endif /* CONFIG_MBEDTLS */ @@ -97,6 +111,14 @@ static int ctr_drbg_initialize(void) return -EIO; } +#elif defined(CONFIG_WOLFSSL) + ret = wc_SetSeed_Cb(ctr_drbg_entropy_cb); + if (ret != 0) + return -EIO; + + ret = wc_InitRngNonce_ex(&ctr_ctx, (byte *)drbg_seed, sizeof(drbg_seed), NULL, 0); + if (ret != 0) + return -EIO; #endif ctr_initialised = true; return 0; @@ -151,7 +173,13 @@ int z_impl_sys_csrand_get(void *dst, uint32_t outlen) } else { ret = -EIO; } + +#elif defined(CONFIG_WOLFSSL) + + ret = wc_RNG_GenerateBlock(&ctr_ctx, (byte *)dst, (word32)outlen); + #endif + end: k_mutex_unlock(&ctr_lock); diff --git a/tests/net/socket/tls/overlay-wolfssl.conf b/tests/net/socket/tls/overlay-wolfssl.conf new file mode 100644 index 000000000000..292ce31f3a42 --- /dev/null +++ b/tests/net/socket/tls/overlay-wolfssl.conf @@ -0,0 +1,10 @@ +CONFIG_MBEDTLS=n +CONFIG_POSIX_API=y +CONFIG_POSIX_CLOCK=y +CONFIG_PTHREAD_IPC=y +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_DTLS=y +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 +CONFIG_WOLFSSL_ALPN=y +CONFIG_WOLFSSL_PSK=y +CONFIG_WOLFSSL_ALPN=y diff --git a/tests/net/socket/tls/prj.conf b/tests/net/socket/tls/prj.conf index ebbb19a1d934..536abcd1cca6 100644 --- a/tests/net/socket/tls/prj.conf +++ b/tests/net/socket/tls/prj.conf @@ -42,10 +42,12 @@ CONFIG_NET_BUF_TX_COUNT=32 CONFIG_NET_BUF_RX_COUNT=32 CONFIG_ZTEST=y -CONFIG_ZTEST_STACK_SIZE=3072 +CONFIG_ZTEST_STACK_SIZE=4096 CONFIG_MBEDTLS_ENABLE_HEAP=y CONFIG_MBEDTLS_HEAP_SIZE=18000 CONFIG_MBEDTLS_KEY_EXCHANGE_PSK_ENABLED=y CONFIG_MBEDTLS_HASH_ALL_ENABLED=y CONFIG_MBEDTLS_CMAC=y +CONFIG_MBEDTLS_SSL_ALPN=y +CONFIG_NET_SOCKETS_TLS_MAX_APP_PROTOCOLS=3 diff --git a/tests/net/socket/tls/src/main.c b/tests/net/socket/tls/src/main.c index f532060f8f55..002c335eb82c 100644 --- a/tests/net/socket/tls/src/main.c +++ b/tests/net/socket/tls/src/main.c @@ -12,15 +12,42 @@ LOG_MODULE_REGISTER(net_test, CONFIG_NET_SOCKETS_LOG_LEVEL); #include #include #include +#include + +#if defined(CONFIG_MBEDTLS) #include +#endif + +#if defined(CONFIG_WOLFSSL) +#include +#endif #include "../../socket_helpers.h" +static const int cipher_list_psk[] = { + TLS_PSK_WITH_AES_128_CBC_SHA, + TLS_PSK_WITH_AES_256_CBC_SHA +}; + +/* Test test_set_ciphersuites() assumes [0] of this list is the + * cipher that will be negotiated */ +static const int cipher_list_psk2[] = { + TLS_PSK_WITH_AES_128_CBC_SHA, +}; + +static const int cipher_list_psk3[] = { + TLS_PSK_WITH_AES_256_CBC_SHA, +}; + #define TEST_STR_SMALL "test" #define MY_IPV4_ADDR "127.0.0.1" #define MY_IPV6_ADDR "::1" +#ifndef MY_DEFLT_HOSTNAME +#define MY_DEFLT_HOSTNAME "localhost" +#endif + #define ANY_PORT 0 #define SERVER_PORT 4242 @@ -118,6 +145,20 @@ static void test_connect(int sock, struct sockaddr *addr, socklen_t addrlen) } } +static void test_connect_err(int sock, struct sockaddr *addr, socklen_t addrlen) +{ + k_yield(); + + zassert_equal(zsock_connect(sock, addr, addrlen), + -1, + "connect expected to fail but succeeded"); + + if (IS_ENABLED(CONFIG_NET_TC_THREAD_PREEMPTIVE)) { + /* Let the connection proceed */ + k_yield(); + } +} + static void test_send(int sock, const void *buf, size_t len, int flags) { zassert_equal(zsock_send(sock, buf, len, flags), @@ -149,6 +190,15 @@ static void test_accept(int sock, int *new_sock, struct sockaddr *addr, zassert_true(*new_sock >= 0, "accept failed"); } +static void test_accept_err(int sock, int *new_sock, struct sockaddr *addr, + socklen_t *addrlen) +{ + zassert_not_null(new_sock, "null newsock"); + + *new_sock = zsock_accept(sock, addr, addrlen); + zassert_true(*new_sock < 0, "accept expected to fail but succeeded"); +} + static void test_shutdown(int sock, int how) { zassert_equal(zsock_shutdown(sock, how), @@ -290,6 +340,16 @@ static void client_connect_work_handler(struct k_work *work) sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)); } +static void client_connect_work_handler_err(struct k_work *work) +{ + struct k_work_delayable *dwork = k_work_delayable_from_work(work); + struct connect_data *data = + CONTAINER_OF(dwork, struct connect_data, work); + + test_connect_err(data->sock, data->addr, data->addr->sa_family == AF_INET ? + sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)); +} + static void dtls_client_connect_send_work_handler(struct k_work *work) { struct k_work_delayable *dwork = k_work_delayable_from_work(work); @@ -397,7 +457,7 @@ static void test_prepare_dtls_connection(sa_family_t family) */ fds[0].fd = s_sock; fds[0].events = ZSOCK_POLLIN; - ret = zsock_poll(fds, 1, 1000); + ret = zsock_poll(fds, 1, 3000); zassert_equal(ret, 1, "poll() did not report data ready"); /* Flush the dummy byte. */ @@ -407,6 +467,70 @@ static void test_prepare_dtls_connection(sa_family_t family) test_work_wait(&test_data.work); } + +typedef void (*tls_cb)(void); +typedef void (*client_work_func)(struct k_work *work); + +static void test_prepare_tls_connection_ex(sa_family_t family, bool accept_err, tls_cb cb, client_work_func cw) +{ + struct sockaddr c_saddr; + struct sockaddr s_saddr; + socklen_t exp_addrlen = family == AF_INET6 ? + sizeof(struct sockaddr_in6) : + sizeof(struct sockaddr_in); + struct sockaddr addr; + socklen_t addrlen = sizeof(addr); + struct connect_data test_data; + + if (family == AF_INET6) { + prepare_sock_tls_v6(MY_IPV6_ADDR, ANY_PORT, &c_sock, + (struct sockaddr_in6 *)&c_saddr, + IPPROTO_TLS_1_2); + prepare_sock_tls_v6(MY_IPV6_ADDR, ANY_PORT, &s_sock, + (struct sockaddr_in6 *)&s_saddr, + IPPROTO_TLS_1_2); + } else { + prepare_sock_tls_v4(MY_IPV4_ADDR, ANY_PORT, &c_sock, + (struct sockaddr_in *)&c_saddr, + IPPROTO_TLS_1_2); + prepare_sock_tls_v4(MY_IPV4_ADDR, ANY_PORT, &s_sock, + (struct sockaddr_in *)&s_saddr, + IPPROTO_TLS_1_2); + } + + if (NULL != cb) { + cb(); + } + + test_config_psk(s_sock, c_sock); + + test_bind(s_sock, &s_saddr, exp_addrlen); + test_listen(s_sock); + + /* Helper work for the connect operation - need to handle client/server + * in parallel due to handshake. + */ + test_data.sock = c_sock; + test_data.addr = &s_saddr; + if (cw != NULL) { + k_work_init_delayable(&test_data.work, cw); + } + else { + k_work_init_delayable(&test_data.work, client_connect_work_handler); + } + test_work_reschedule(&test_data.work, K_NO_WAIT); + + if (accept_err == true) { + test_accept_err(s_sock, &new_sock, &addr, &addrlen); + } + else { + test_accept(s_sock, &new_sock, &addr, &addrlen); + zassert_equal(addrlen, exp_addrlen, "Wrong addrlen"); + + test_work_wait(&test_data.work); + } +} + ZTEST(net_socket_tls, test_v4_msg_waitall) { struct test_msg_waitall_data test_data = { @@ -537,6 +661,7 @@ static void send_work_handler(struct k_work *work) void test_msg_trunc(sa_family_t family) { +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) int rv; uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1]; struct send_data test_data = { @@ -571,6 +696,9 @@ void test_msg_trunc(sa_family_t family) /* Small delay for the final alert exchange */ k_msleep(10); +#else + ztest_test_skip(); +#endif } ZTEST(net_socket_tls, test_v4_msg_trunc) @@ -665,18 +793,26 @@ static void test_dtls_sendmsg_no_buf(sa_family_t family) ZTEST(net_socket_tls, test_v4_dtls_sendmsg_no_buf) { - if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE > 0) { - ztest_test_skip(); - } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE > 0) { + ztest_test_skip(); + } +#else + ztest_test_skip(); +#endif test_dtls_sendmsg_no_buf(AF_INET); } ZTEST(net_socket_tls, test_v6_dtls_sendmsg_no_buf) { - if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE > 0) { - ztest_test_skip(); - } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE > 0) { + ztest_test_skip(); + } +#else + ztest_test_skip(); +#endif test_dtls_sendmsg_no_buf(AF_INET6); } @@ -785,18 +921,26 @@ static void test_dtls_sendmsg(sa_family_t family) ZTEST(net_socket_tls, test_v4_dtls_sendmsg) { - if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE == 0) { - ztest_test_skip(); - } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE <= 0) { + ztest_test_skip(); + } +#else + ztest_test_skip(); +#endif test_dtls_sendmsg(AF_INET); } ZTEST(net_socket_tls, test_v6_dtls_sendmsg) { - if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE == 0) { - ztest_test_skip(); - } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (CONFIG_NET_SOCKETS_DTLS_SENDMSG_BUF_SIZE <= 0) { + ztest_test_skip(); + } +#else + ztest_test_skip(); +#endif test_dtls_sendmsg(AF_INET6); } @@ -1165,7 +1309,11 @@ ZTEST(net_socket_tls, test_recv_eof_on_close) k_sleep(TCP_TEARDOWN_TIMEOUT); } +#if defined(CONFIG_WOLFSSL) +#define TLS_RECORD_OVERHEAD 29 +#else #define TLS_RECORD_OVERHEAD 81 +#endif ZTEST(net_socket_tls, test_send_non_block) { @@ -1316,7 +1464,7 @@ ZTEST(net_socket_tls, test_send_on_close) new_sock = -1; /* Small delay for packets to propagate. */ - k_msleep(10); + k_msleep(20); /* Verify send() reports an error after connection is closed. */ ret = zsock_send(c_sock, TEST_STR_SMALL, strlen(TEST_STR_SMALL), 0); @@ -1338,7 +1486,7 @@ ZTEST(net_socket_tls, test_send_on_close) new_sock = -1; /* Small delay for packets to propagate. */ - k_msleep(10); + k_msleep(20); /* Graceful connection close should be reported first. */ ret = zsock_recv(c_sock, rx_buf, sizeof(rx_buf), 0); @@ -1542,6 +1690,243 @@ ZTEST(net_socket_tls, test_send_while_recv) k_sleep(TCP_TEARDOWN_TIMEOUT); } + +void tls_set_cs_cb() +{ + int ret = zsock_setsockopt(s_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, + (void*)cipher_list_psk, sizeof(cipher_list_psk)); + zassert_equal(ret, 0, "Unable to set ciphersuites on server"); + ret = zsock_setsockopt(c_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, + (void*)cipher_list_psk2, sizeof(cipher_list_psk2)); + zassert_equal(ret, 0, "Unable to set ciphersuites on client"); +} + +void tls_set_cs_mismatch_cb() +{ + /* Set mismatched ciphersuites, should not connect */ + int ret = zsock_setsockopt(c_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, + (void*)cipher_list_psk2, sizeof(cipher_list_psk2)); + zassert_equal(ret, 0, "Unable to set ciphersuites on client"); + ret = zsock_setsockopt(s_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, + (void*)cipher_list_psk3, sizeof(cipher_list_psk3)); + zassert_equal(ret, 0, "Unable to set ciphersuites on server"); +} + +ZTEST(net_socket_tls, test_set_ciphersuites) +{ +#define TLS_CS_TEST_MAX_CS_NUM 3 + int ret; + uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1] = { 0 }; + struct send_data test_data = { + .data = TEST_STR_SMALL, + .datalen = sizeof(TEST_STR_SMALL) - 1 + }; + int ciphersuites[TLS_CS_TEST_MAX_CS_NUM]; + int cs_len = sizeof(ciphersuites); + int curr_cipher = 0; + int cc_len = sizeof(int); + int i; + + for (i = 0; i < TLS_CS_TEST_MAX_CS_NUM; i++) { + ciphersuites[i] = 0; + } + + test_prepare_tls_connection_ex(AF_INET, false, tls_set_cs_cb, NULL); + + /* Verify the ciphersuite list is what we set for server */ + ret = zsock_getsockopt(s_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, + (void *)ciphersuites, &cs_len); + zassert_equal(ret, 0, "Unable to get ciphersuites for server"); + zassert_equal(cs_len, sizeof(cipher_list_psk), "Incorrect get ciphersuite len"); + + for (i = 0; i < cs_len / sizeof(int); i++) { + zassert_equal(ciphersuites[i], cipher_list_psk[i], "Retrieved ciphersuite list element does not match set value"); + } + + /* Same for client */ + for (i = 0; i < TLS_CS_TEST_MAX_CS_NUM; i++) { + ciphersuites[i] = 0; + } + + cs_len = sizeof(ciphersuites); + ret = zsock_getsockopt(c_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, + (void *)ciphersuites, &cs_len); + zassert_equal(ret, 0, "Unable to get ciphersuites for client"); + zassert_equal(cs_len, sizeof(cipher_list_psk2), "Incorrect get ciphersuite len"); + + for (i = 0; i < cs_len / sizeof(int); i++) { + zassert_equal(ciphersuites[i], cipher_list_psk2[i], "Retrieved ciphersuite list element does not match set value"); + } + + /* Check that the actual negotiated cipher is correct for server */ + ret = zsock_getsockopt(new_sock, SOL_TLS, TLS_CIPHERSUITE_USED, + (void *)&curr_cipher, &cc_len); + zassert_equal(ret, 0, "Unable to get current ciphersuite for server"); + zassert_equal(curr_cipher, cipher_list_psk2[0]); + + /* Same for the client */ + curr_cipher = 0; + ret = zsock_getsockopt(c_sock, SOL_TLS, TLS_CIPHERSUITE_USED, + (void *)&curr_cipher, &cc_len); + zassert_equal(ret, 0, "Unable to get current ciphersuite for client"); + zassert_equal(curr_cipher, cipher_list_psk2[0]); + + test_data.sock = c_sock; + k_work_init_delayable(&test_data.tx_work, send_work_handler); + test_work_reschedule(&test_data.tx_work, K_MSEC(10)); + + /* recv() shall block until send work sends the data. */ + ret = zsock_recv(new_sock, rx_buf, sizeof(rx_buf), 0); + zassert_equal(ret, sizeof(TEST_STR_SMALL) - 1, "recv() failed"); + zassert_mem_equal(rx_buf, TEST_STR_SMALL, ret, "Invalid data received"); + + test_sockets_close(); + + k_sleep(TCP_TEARDOWN_TIMEOUT); +} + +ZTEST(net_socket_tls, test_set_ciphersuites_err) +{ + /* Expect failure to connect and accept due to mismatched ciphersuites */ + test_prepare_tls_connection_ex(AF_INET, true, + tls_set_cs_mismatch_cb, client_connect_work_handler_err); + + test_sockets_close(); + + k_sleep(TCP_TEARDOWN_TIMEOUT); + +#if defined(CONFIG_BOARD_NATIVE_POSIX) + /* Native simulator isnt quite done yet, wait a bit more */ + k_sleep(TCP_TEARDOWN_TIMEOUT); +#endif +} + +void tls_set_hostname_cb() +{ + int ret = zsock_setsockopt(c_sock, SOL_TLS, TLS_HOSTNAME, + (void*)MY_DEFLT_HOSTNAME, strlen(MY_DEFLT_HOSTNAME)); + zassert_equal(ret, 0, "Unable to set hostname on client"); +} + +ZTEST(net_socket_tls, test_set_hostname) +{ + int ret; + uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1] = { 0 }; + struct send_data test_data = { + .data = TEST_STR_SMALL, + .datalen = sizeof(TEST_STR_SMALL) - 1 + }; + + test_prepare_tls_connection_ex(AF_INET, false, tls_set_hostname_cb, NULL); + + test_data.sock = c_sock; + k_work_init_delayable(&test_data.tx_work, send_work_handler); + test_work_reschedule(&test_data.tx_work, K_MSEC(10)); + + /* recv() shall block until send work sends the data. */ + ret = zsock_recv(new_sock, rx_buf, sizeof(rx_buf), 0); + zassert_equal(ret, sizeof(TEST_STR_SMALL) - 1, "recv() failed"); + zassert_mem_equal(rx_buf, TEST_STR_SMALL, ret, "Invalid data received"); + + test_sockets_close(); + + k_sleep(TCP_TEARDOWN_TIMEOUT); +} + +void tls_set_session_cache_cb() +{ + int t = TLS_SESSION_CACHE_ENABLED; + int l = sizeof(int); + int ret = zsock_setsockopt(s_sock, SOL_TLS, TLS_SESSION_CACHE, + (void*)&t, l); + zassert_equal(ret, 0, "Unable to set session cache on server"); +} + +ZTEST(net_socket_tls, test_session_cache) +{ + int ret; + int enabled = 0; + int len = sizeof(int); + uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1] = { 0 }; + struct send_data test_data = { + .data = TEST_STR_SMALL, + .datalen = sizeof(TEST_STR_SMALL) - 1 + }; + + test_prepare_tls_connection_ex(AF_INET, false, tls_set_session_cache_cb, NULL); + + /* Check that the session cache is enabled */ + ret = zsock_getsockopt(s_sock, SOL_TLS, TLS_SESSION_CACHE, + (void *)&enabled, &len); + zassert_equal(ret, 0, "Unable to get session cache enabled status"); + zassert_equal(enabled, TLS_SESSION_CACHE_ENABLED, "Session cache value does not match what was set"); + + test_data.sock = c_sock; + k_work_init_delayable(&test_data.tx_work, send_work_handler); + test_work_reschedule(&test_data.tx_work, K_MSEC(10)); + + /* recv() shall block until send work sends the data. */ + ret = zsock_recv(new_sock, rx_buf, sizeof(rx_buf), 0); + zassert_equal(ret, sizeof(TEST_STR_SMALL) - 1, "recv() failed"); + zassert_mem_equal(rx_buf, TEST_STR_SMALL, ret, "Invalid data received"); + + test_sockets_close(); + + k_sleep(TCP_TEARDOWN_TIMEOUT); +} + +const char *alpn_list[] = { + "http/1.0", + "http/1.1" +}; + +void tls_set_alpn_cb() +{ + socklen_t len = sizeof(alpn_list); + int ret = zsock_setsockopt(s_sock, SOL_TLS, TLS_ALPN_LIST, + (void*)alpn_list, len); + zassert_equal(ret, 0, "Unable to set alpn on server"); +} + +ZTEST(net_socket_tls, test_alpn) +{ + int ret; + uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1] = { 0 }; + struct send_data test_data = { + .data = TEST_STR_SMALL, + .datalen = sizeof(TEST_STR_SMALL) - 1 + }; + const char *alpn_buf[2]; + int alpn_len = sizeof(alpn_buf); + alpn_buf[0] = NULL; + alpn_buf[1] = NULL; + + test_prepare_tls_connection_ex(AF_INET, false, tls_set_alpn_cb, NULL); + + /* Check that the ALPN list is the one we set */ + ret = zsock_getsockopt(s_sock, SOL_TLS, TLS_ALPN_LIST, + (void *)alpn_buf, &alpn_len); + zassert_equal(ret, 0, "Unable to get alpn list"); + zassert_equal(alpn_len, sizeof(alpn_list), "Retrieved ALPN list length incorrect"); + zassert_equal(strlen(alpn_buf[0]), strlen(alpn_list[0]), "Retrieved ALPN list element length incorrect"); + zassert_mem_equal(alpn_buf[0], alpn_list[0], strlen(alpn_list[0]), "Retrieved ALPN element does not match what was set"); + zassert_equal(strlen(alpn_buf[1]), strlen(alpn_list[1]), "Retrieved ALPN list element length incorrect"); + zassert_mem_equal(alpn_buf[1], alpn_list[1], strlen(alpn_list[1]), "Retrieved ALPN element does not match what was set"); + + test_data.sock = c_sock; + k_work_init_delayable(&test_data.tx_work, send_work_handler); + test_work_reschedule(&test_data.tx_work, K_MSEC(10)); + + /* recv() shall block until send work sends the data. */ + ret = zsock_recv(new_sock, rx_buf, sizeof(rx_buf), 0); + zassert_equal(ret, sizeof(TEST_STR_SMALL) - 1, "recv() failed"); + zassert_mem_equal(rx_buf, TEST_STR_SMALL, ret, "Invalid data received"); + + test_sockets_close(); + + k_sleep(TCP_TEARDOWN_TIMEOUT); +} + ZTEST(net_socket_tls, test_poll_tls_pollin) { uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1]; @@ -1575,6 +1960,7 @@ ZTEST(net_socket_tls, test_poll_tls_pollin) ZTEST(net_socket_tls, test_poll_dtls_pollin) { +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1]; struct send_data test_data = { .data = TEST_STR_SMALL, @@ -1608,6 +1994,9 @@ ZTEST(net_socket_tls, test_poll_dtls_pollin) /* Small delay for the final alert exchange */ k_msleep(10); +#else + ztest_test_skip(); +#endif } ZTEST(net_socket_tls, test_poll_tls_pollout) @@ -1660,6 +2049,7 @@ ZTEST(net_socket_tls, test_poll_tls_pollout) ZTEST(net_socket_tls, test_poll_dtls_pollout) { +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) struct zsock_pollfd fds[1]; int ret; @@ -1677,6 +2067,9 @@ ZTEST(net_socket_tls, test_poll_dtls_pollout) /* Small delay for the final alert exchange */ k_msleep(10); +#else + ztest_test_skip(); +#endif } ZTEST(net_socket_tls, test_poll_tls_pollhup) @@ -1709,6 +2102,7 @@ ZTEST(net_socket_tls, test_poll_tls_pollhup) ZTEST(net_socket_tls, test_poll_dtls_pollhup) { +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) struct zsock_pollfd fds[1]; uint8_t rx_buf; int ret; @@ -1734,9 +2128,18 @@ ZTEST(net_socket_tls, test_poll_dtls_pollhup) /* Small delay for the final alert exchange */ k_msleep(10); +#else + ztest_test_skip(); +#endif } +#if defined(CONFIG_WOLFSSL) +int SendAlert(WOLFSSL* ssl, int severity, int type); +WOLFSSL *ztls_get_wolfssl_context(int fd); +#endif +#if defined(CONFIG_MBEDTLS) mbedtls_ssl_context *ztls_get_mbedtls_ssl_context(int fd); +#endif ZTEST(net_socket_tls, test_poll_tls_pollerr) { @@ -1745,17 +2148,26 @@ ZTEST(net_socket_tls, test_poll_tls_pollerr) struct zsock_pollfd fds[1]; int optval; socklen_t optlen = sizeof(optval); - mbedtls_ssl_context *ssl_ctx; +#if defined(CONFIG_WOLFSSL) + WOLFSSL *ssl_ctx = NULL; +#else + mbedtls_ssl_context *ssl_ctx; +#endif test_prepare_tls_connection(AF_INET6); fds[0].fd = new_sock; fds[0].events = ZSOCK_POLLIN; +#if defined(CONFIG_WOLFSSL) + ssl_ctx = ztls_get_wolfssl_context(c_sock); + SendAlert(ssl_ctx, alert_fatal, wolfssl_alert_protocol_version); +#else /* Get access to the underlying ssl context, and send alert. */ ssl_ctx = ztls_get_mbedtls_ssl_context(c_sock); mbedtls_ssl_send_alert_message(ssl_ctx, MBEDTLS_SSL_ALERT_LEVEL_FATAL, MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR); +#endif ret = zsock_poll(fds, 1, 100); zassert_equal(ret, 1, "poll() should've report event"); @@ -1777,22 +2189,32 @@ ZTEST(net_socket_tls, test_poll_tls_pollerr) ZTEST(net_socket_tls, test_poll_dtls_pollerr) { +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) uint8_t rx_buf; int ret; struct zsock_pollfd fds[1]; int optval; socklen_t optlen = sizeof(optval); - mbedtls_ssl_context *ssl_ctx; +#if defined(CONFIG_WOLFSSL) + WOLFSSL *ssl_ctx = NULL; +#else + mbedtls_ssl_context *ssl_ctx; +#endif test_prepare_dtls_connection(AF_INET6); fds[0].fd = s_sock; fds[0].events = ZSOCK_POLLIN; +#if defined(CONFIG_WOLFSSL) + ssl_ctx = ztls_get_wolfssl_context(c_sock); + SendAlert(ssl_ctx, alert_fatal, wolfssl_alert_protocol_version); +#else /* Get access to the underlying ssl context, and send alert. */ ssl_ctx = ztls_get_mbedtls_ssl_context(c_sock); mbedtls_ssl_send_alert_message(ssl_ctx, MBEDTLS_SSL_ALERT_LEVEL_FATAL, MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR); +#endif ret = zsock_poll(fds, 1, 100); zassert_equal(ret, 1, "poll() should've report event"); @@ -1812,6 +2234,9 @@ ZTEST(net_socket_tls, test_poll_dtls_pollerr) /* Small delay for the final alert exchange */ k_msleep(10); +#else + ztest_test_skip(); +#endif } static void *tls_tests_setup(void) diff --git a/tests/net/socket/tls_ext/overlay-wolfssl.conf b/tests/net/socket/tls_ext/overlay-wolfssl.conf new file mode 100644 index 000000000000..dd51cb152310 --- /dev/null +++ b/tests/net/socket/tls_ext/overlay-wolfssl.conf @@ -0,0 +1,6 @@ +CONFIG_MBEDTLS=n +CONFIG_POSIX_API=y +CONFIG_POSIX_CLOCK=y +CONFIG_PTHREAD_IPC=y +CONFIG_WOLFSSL=y +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 diff --git a/tests/subsys/random/rng/overlay-wolfssl.conf b/tests/subsys/random/rng/overlay-wolfssl.conf new file mode 100644 index 000000000000..ab2ba6d7012b --- /dev/null +++ b/tests/subsys/random/rng/overlay-wolfssl.conf @@ -0,0 +1,5 @@ +CONFIG_POSIX_API=y +CONFIG_POSIX_CLOCK=y +CONFIG_PTHREAD_IPC=y +CONFIG_WOLFSSL=y +CONFIG_CTR_DRBG_CSPRNG_GENERATOR=y diff --git a/west.yml b/west.yml index b66fd66f33e2..3e9aa1721c5a 100644 --- a/west.yml +++ b/west.yml @@ -23,6 +23,8 @@ manifest: url-base: https://github.com/zephyrproject-rtos - name: babblesim url-base: https://github.com/BabbleSim + - name: wolfssl + url-base: https://github.com/wolfssl group-filter: [-babblesim, -optional] @@ -326,6 +328,12 @@ manifest: path: modules/crypto/tinycrypt groups: - crypto + - name: wolfssl + path: modules/crypto/wolfssl + revision: master + remote: wolfssl + groups: + - crypto - name: trusted-firmware-m revision: f8d3a903578192d226ac1552f383d95b94ee8780 path: modules/tee/tf-m/trusted-firmware-m From 7525a528792e86ca78a2b97aed29bd86d9143209 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 9 Jul 2024 12:54:06 -0700 Subject: [PATCH 02/12] Update DTLS timeout handling, cleanup test code --- subsys/net/lib/sockets/sockets_tls.c | 49 ++++++++++++++++++++++++---- tests/net/socket/tls/src/main.c | 35 +++++++++++--------- 2 files changed, 62 insertions(+), 22 deletions(-) diff --git a/subsys/net/lib/sockets/sockets_tls.c b/subsys/net/lib/sockets/sockets_tls.c index 8b5ea12c90a1..06d8bde6daf6 100644 --- a/subsys/net/lib/sockets/sockets_tls.c +++ b/subsys/net/lib/sockets/sockets_tls.c @@ -66,7 +66,6 @@ LOG_MODULE_REGISTER(net_sock_tls, CONFIG_NET_SOCKETS_LOG_LEVEL); #include #include #include -#include #if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) && !defined(WOLFSSL_DTLS) #error "DTLS sockets enabled but wolfssl DTLS not enabled" @@ -2049,6 +2048,19 @@ static int tls_wolfssl_connect(struct tls_context *context, k_timeout_t timeout) break; } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (context->type == SOCK_DGRAM) { + ret = wolfSSL_dtls_got_timeout(context->wssl); + if (ret != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(context->wssl, ret); + if (err != WOLFSSL_ERROR_WANT_READ && + err != WOLFSSL_ERROR_WANT_WRITE) { + break; + } + } + } +#endif + continue; } else { NET_ERR("TLS handshake error: %x", err); @@ -2119,6 +2131,19 @@ static int tls_wolfssl_accept(struct tls_context *context, k_timeout_t timeout) break; } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) + if (context->type == SOCK_DGRAM) { + ret = wolfSSL_dtls_got_timeout(context->wssl); + if (ret != WOLFSSL_SUCCESS) { + err = wolfSSL_get_error(context->wssl, ret); + if (err != WOLFSSL_ERROR_WANT_READ && + err != WOLFSSL_ERROR_WANT_WRITE) { + break; + } + } + } +#endif + continue; } else { /* MbedTLS API documentation requires session to @@ -2520,8 +2545,6 @@ static int tls_wolfssl_init(struct tls_context *context, bool is_server) if (NULL != context->psk) { if (is_server) { wolfSSL_CTX_set_psk_server_callback(context->ctx, tls_psk_server_cb); - /* TODO: review psk hint */ - wolfSSL_CTX_use_psk_identity_hint(context->ctx, "zephyr wolfssl TLS server"); } else { wolfSSL_CTX_set_psk_client_callback(context->ctx, tls_psk_client_cb); @@ -2741,24 +2764,36 @@ static int tls_opt_ciphersuite_list_get(struct tls_context *context, #if defined(CONFIG_WOLFSSL) byte arr[2]; uint16_t sh = 0; - byte *cs_bytes = XMALLOC(GetCipherNamesSize() * 2, NULL, DYNAMIC_TYPE_TMP_BUFFER); + byte *cs_bytes = NULL; + int cs_bytes_len = 0; + + if (wolfSSL_get_cipher_list_bytes(NULL, &cs_bytes_len) \ + != WOLFSSL_SUCCESS) { + return -EINVAL; + } + + if (cs_bytes_len == 0) + return -EINVAL; + + cs_bytes = XMALLOC(cs_bytes_len, NULL, DYNAMIC_TYPE_TMP_BUFFER); if (cs_bytes == NULL) { return -ENOMEM; } - if (wolfSSL_get_cipher_list_bytes(cs_bytes, GetCipherNamesSize() * 2) \ + + if (wolfSSL_get_cipher_list_bytes(cs_bytes, &cs_bytes_len) \ != WOLFSSL_SUCCESS) { XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) return -EINVAL; } - selected_buf = XMALLOC(GetCipherNamesSize() * sizeof(int), NULL, DYNAMIC_TYPE_TMP_BUFFER); + selected_buf = XMALLOC(((cs_bytes_len / 2) * sizeof(int)), NULL, DYNAMIC_TYPE_TMP_BUFFER); if (selected_buf == NULL) { XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) return -EINVAL; } selected_ciphers = (const int *)selected_buf; - while(i < GetCipherNamesSize() * 2) { + while(i < cs_bytes_len - 1) { arr[0] = cs_bytes[i]; arr[1] = cs_bytes[i+1]; sh = sys_get_be16(arr); diff --git a/tests/net/socket/tls/src/main.c b/tests/net/socket/tls/src/main.c index 002c335eb82c..c67fc5e7de72 100644 --- a/tests/net/socket/tls/src/main.c +++ b/tests/net/socket/tls/src/main.c @@ -457,7 +457,7 @@ static void test_prepare_dtls_connection(sa_family_t family) */ fds[0].fd = s_sock; fds[0].events = ZSOCK_POLLIN; - ret = zsock_poll(fds, 1, 3000); + ret = zsock_poll(fds, 1, 1000); zassert_equal(ret, 1, "poll() did not report data ready"); /* Flush the dummy byte. */ @@ -467,11 +467,15 @@ static void test_prepare_dtls_connection(sa_family_t family) test_work_wait(&test_data.work); } - -typedef void (*tls_cb)(void); +/* Function pointer type for function to be called after socket creation but + * before any bind/listen/connect operations */ +typedef void (*tls_pre_cb)(void); +/* Function pointer type for function to be used to perform client work + * instead of client_connect_work_handler() */ typedef void (*client_work_func)(struct k_work *work); -static void test_prepare_tls_connection_ex(sa_family_t family, bool accept_err, tls_cb cb, client_work_func cw) +static void test_prepare_tls_connection_ex(sa_family_t family, bool accept_err, + tls_pre_cb cb, client_work_func cw) { struct sockaddr c_saddr; struct sockaddr s_saddr; @@ -1735,7 +1739,7 @@ ZTEST(net_socket_tls, test_set_ciphersuites) /* Verify the ciphersuite list is what we set for server */ ret = zsock_getsockopt(s_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, - (void *)ciphersuites, &cs_len); + (void *)ciphersuites, (socklen_t *)&cs_len); zassert_equal(ret, 0, "Unable to get ciphersuites for server"); zassert_equal(cs_len, sizeof(cipher_list_psk), "Incorrect get ciphersuite len"); @@ -1750,7 +1754,7 @@ ZTEST(net_socket_tls, test_set_ciphersuites) cs_len = sizeof(ciphersuites); ret = zsock_getsockopt(c_sock, SOL_TLS, TLS_CIPHERSUITE_LIST, - (void *)ciphersuites, &cs_len); + (void *)ciphersuites, (socklen_t *)&cs_len); zassert_equal(ret, 0, "Unable to get ciphersuites for client"); zassert_equal(cs_len, sizeof(cipher_list_psk2), "Incorrect get ciphersuite len"); @@ -1760,14 +1764,14 @@ ZTEST(net_socket_tls, test_set_ciphersuites) /* Check that the actual negotiated cipher is correct for server */ ret = zsock_getsockopt(new_sock, SOL_TLS, TLS_CIPHERSUITE_USED, - (void *)&curr_cipher, &cc_len); + (void *)&curr_cipher, (socklen_t *)&cc_len); zassert_equal(ret, 0, "Unable to get current ciphersuite for server"); zassert_equal(curr_cipher, cipher_list_psk2[0]); /* Same for the client */ curr_cipher = 0; ret = zsock_getsockopt(c_sock, SOL_TLS, TLS_CIPHERSUITE_USED, - (void *)&curr_cipher, &cc_len); + (void *)&curr_cipher, (socklen_t *)&cc_len); zassert_equal(ret, 0, "Unable to get current ciphersuite for client"); zassert_equal(curr_cipher, cipher_list_psk2[0]); @@ -1793,12 +1797,9 @@ ZTEST(net_socket_tls, test_set_ciphersuites_err) test_sockets_close(); + /* Wait a bit longer to ensure everything is closed up before we exit */ + k_sleep(K_MSEC(150)); k_sleep(TCP_TEARDOWN_TIMEOUT); - -#if defined(CONFIG_BOARD_NATIVE_POSIX) - /* Native simulator isnt quite done yet, wait a bit more */ - k_sleep(TCP_TEARDOWN_TIMEOUT); -#endif } void tls_set_hostname_cb() @@ -1857,7 +1858,7 @@ ZTEST(net_socket_tls, test_session_cache) /* Check that the session cache is enabled */ ret = zsock_getsockopt(s_sock, SOL_TLS, TLS_SESSION_CACHE, - (void *)&enabled, &len); + (void *)&enabled, (socklen_t *)&len); zassert_equal(ret, 0, "Unable to get session cache enabled status"); zassert_equal(enabled, TLS_SESSION_CACHE_ENABLED, "Session cache value does not match what was set"); @@ -1890,6 +1891,7 @@ void tls_set_alpn_cb() ZTEST(net_socket_tls, test_alpn) { +#if CONFIG_NET_SOCKETS_TLS_MAX_APP_PROTOCOLS > 0 int ret; uint8_t rx_buf[sizeof(TEST_STR_SMALL) - 1] = { 0 }; struct send_data test_data = { @@ -1905,7 +1907,7 @@ ZTEST(net_socket_tls, test_alpn) /* Check that the ALPN list is the one we set */ ret = zsock_getsockopt(s_sock, SOL_TLS, TLS_ALPN_LIST, - (void *)alpn_buf, &alpn_len); + (void *)alpn_buf, (socklen_t *)&alpn_len); zassert_equal(ret, 0, "Unable to get alpn list"); zassert_equal(alpn_len, sizeof(alpn_list), "Retrieved ALPN list length incorrect"); zassert_equal(strlen(alpn_buf[0]), strlen(alpn_list[0]), "Retrieved ALPN list element length incorrect"); @@ -1925,6 +1927,9 @@ ZTEST(net_socket_tls, test_alpn) test_sockets_close(); k_sleep(TCP_TEARDOWN_TIMEOUT); +#else + ztest_test_skip(); +#endif } ZTEST(net_socket_tls, test_poll_tls_pollin) From 6bd141c0c2eb2a6a05c0b3f239a2273482bb1df9 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 9 Jul 2024 13:03:09 -0700 Subject: [PATCH 03/12] Add flag guard to user settings include --- subsys/net/lib/sockets/sockets_tls.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/subsys/net/lib/sockets/sockets_tls.c b/subsys/net/lib/sockets/sockets_tls.c index 06d8bde6daf6..a9e3fcc214bf 100644 --- a/subsys/net/lib/sockets/sockets_tls.c +++ b/subsys/net/lib/sockets/sockets_tls.c @@ -63,7 +63,9 @@ LOG_MODULE_REGISTER(net_sock_tls, CONFIG_NET_SOCKETS_LOG_LEVEL); #endif #if defined(CONFIG_WOLFSSL) +#ifndef WOLFSSL_USER_SETTINGS #include +#endif #include #include From be3bfe32fad1e6b54ac109e828508f971892a008 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 9 Jul 2024 13:06:28 -0700 Subject: [PATCH 04/12] Add flag guard to user settings include in random_ctr_drbg --- subsys/random/random_ctr_drbg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/subsys/random/random_ctr_drbg.c b/subsys/random/random_ctr_drbg.c index bdd70194afdb..2b37ed6024a4 100644 --- a/subsys/random/random_ctr_drbg.c +++ b/subsys/random/random_ctr_drbg.c @@ -25,7 +25,9 @@ #include #elif defined(CONFIG_WOLFSSL) +#ifndef WOLFSSL_USER_SETTINGS #include +#endif #include #include From 1c15ad3c6f0d6994680d67ceed73968dffbcdfc4 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 9 Jul 2024 14:38:48 -0700 Subject: [PATCH 05/12] Update default certificates, fix bug in test code for wait handling on error --- samples/net/sockets/echo_server/src/ca.der | Bin 783 -> 780 bytes .../net/sockets/echo_server/src/server.der | Bin 693 -> 790 bytes .../echo_server/src/server_privkey.der | Bin 1219 -> 1216 bytes tests/net/socket/tls/src/main.c | 5 +---- 4 files changed, 1 insertion(+), 4 deletions(-) diff --git a/samples/net/sockets/echo_server/src/ca.der b/samples/net/sockets/echo_server/src/ca.der index b1d3e097cadcea344d9b172b4a540ddd57dae71e..6b1bcaa182c62fb28c3472e001215f960953cad8 100644 GIT binary patch delta 699 zcmeBY>tRziXkz9tXkz@ZfSHMriAjV@t>7w$fnH{>59jv}_USTPGa_0iDr?D@7?>Ma z8W|cJnV3XL@EaK#0R;>VAOaIJE$WX`vLG^{i*R)RTh172o!6Z@XPC&auhvx9!e#Gv$No17a(M4=&9wySe4Kj$Y5tCy)*92C{6-p|X4| zVk{z;+n<*OePY~}?Yh74{qB0xS=U584dg-6$}AEFVhz|8@PHHuv#=U4Gcx`+;AP{~ zYV&CO&dbQi&C0;s#K_1HecbAAP~qH-lBXhW)kIGhON*^v-76D%`LSI0MYR}Xk1r7m z-}I+mcmDWj-?TN2v*Qw5p2n^U_i3JzUbW`Da0y#=-zI*Omz-Q8xU+6rH0SYEAMnxELzU0CLQYW>N0bB#>dPv@RCaC-f;Rta};`C^-=)^ev$^WKY7 zmkR&!?VTlcA|>Dg+um7EUw#&ARLR!oTG}7|$#-Vm?PJ`0R}MA$M2SA>kQEM0RlS(m ed1b}6&g!UlpM#YHUNEma&Fvp`Hmy4OMLqyE4K9cP delta 680 zcmV;Z0$2Tv29E|KFoFXMFoFT|paTK{0s<5pLFFSglmNRltf)?F_p-v&`Dl=lBPtv) zFflPVFgY+VF*#Zo4>B<^IWaOaG%z_ZFfloiX*hqnu#BEmM6D*}pBa8$Vxp(v&aRL& zc*CPJON#76EQ>b}IAA#*b?l6RIQDH?C4?Nsz}U;>g8IHZmfwkNB}YHO*GtuP-3163U(1Q;+DfD}=D-FzQe6F8)f6SgO-$!cqAHPg27WzfkX*I}DLGc3efR+`PE~F-c>D8SmRbnBF_BQ*EyYLV> z(K&*pD;T?kX4y!X*e}vN{_K(|!-8unlKn%+f74@=tqYiKf0XOruy*_o)FGZvurVQo z9;uF^pfEq$K?C!jhtd_S&*mF*fqfow9H$)OLKN2s{n&eOd--ocRKpo&3tHk{yLhL0 zH=LfPlpw6_woFOuc!jm0fY*q;7=J^+Rgas5TxCJ1R_eFGZr+mhj#0-ecq$1j8QD&( Otdu89KwH@n0vc$Ob~CL2 diff --git a/samples/net/sockets/echo_server/src/server.der b/samples/net/sockets/echo_server/src/server.der index 2b664a4bdb2ce64d9e2f92d88aa163d09fd0a073..7463c562914caaf85233736bb051133e30816e55 100644 GIT binary patch delta 694 zcmV;n0!jU~1(pUQFoFXTFoFU4paTK{0s<6yC7b+?8NaFLp)hpM@u5TU5zF3@9x5C( zFgGwcGBGnVH8ENk4>B<_G%zipH zb1h=R+Q*0$6q$RNLbsOMN{H7m0^ik{xsZx-K-o_!_m%C0dgECeh>(Gg9)N=eJNJ_^ zDOE~+f{@bwWm^w(DhFaIu$$2#qA6UnsBq&71)0#BpgLb;(N-jrV5O%@Is_3C`Gv8g z0QP@Wi#yN03`!OJDjV!}JucPWK>!%m6E4|HpZ}v8j$`65_;n?qTSv4$3Q;C=`KkS} z{SemBeCmAVcIgxHOTpqKAzV$*w~D6VFb@~0HroAJ1-!t(253rb`&(^CFQC5IgNq!U zDak-Z`yqIUq{~^iEOdh&>?0&-l*C%!^`~Q{T>=9E00E;~Fjz1j1_Mqc9S#H* z1QgPl5!PdZp6hRE4XC!V_c8Sa2wIb&0Th2OJ_*+RiWA3GkKoLOCLiK4&daQ2^ZanK zbM_e<+TTZzv$003a~vu->NZaGm2?z_{uNFghdYS+`n+6$o#=`TpN@(GTO zh~zHgL4Z_Z0>!`*vz=hCtf=oR9odL{;d3T|AY~w;rce$OUQ%myeAc4v$+K4BZ6|+t z85VJV<6t=)cjwe?y*j98b=kfL|F2ZZ64X{ehAAv&C&jd>lQNWSSZnP^JRSl_qpCod5s; delta 612 zcmV-q0-ODo2DJqqFoFWHFoFS@0u)li8OJ}RcI|G7(j3bCCftF z!#tL=fUhppdrG&L7r=hm%A-`v1%HV50s{d60Wb{)2`Yw2hW8Bt0Sg5H1A+ko09_$R zd>VNST>{bI9lDQb^a;?R8-V-}X1fl+K`)m~SKL)A@G-_D0(=FdKQ(dOslHbn5+j?> zwESMfT86Sk(cJn3x`a>YActATPRI~I%`I2zd+F$B%7wpT65nTP`wTw>0W2?i)ePpDC@n7Zw{2f0(J%;*wif?<=1K_$;OL*QYqF9ikC2MbOh&i<4ycJsj diff --git a/samples/net/sockets/echo_server/src/server_privkey.der b/samples/net/sockets/echo_server/src/server_privkey.der index 2269293fe790f2276d24bb62e5347e2d6e5b9cdf..e60321ff06232aadaa3c8ede95fa0314004a66bc 100644 GIT binary patch literal 1216 zcmV;x1V8&Qf&{z*0RS)!1_>&LNQUrrZ9p8q5=T`0)hbn0G-VYg#(Z9 zF2ck0fwaPm2K#vbY=LtvV#3dzeDEmfA{)*DwO#)tR}FigG~NPb&A7?Sy*c zSsRFufsY=5g9bbIlQJn)N_~Qm(*9*z4|6I9Vkxkj(IKKKT(hWf;|c|t(3_w-Ut`f$ zB$HsJr%E~m5fb@@v7-R?REs;$z6?qg{3;vlc0DfD-a!Bu))Ow-OP~Lv8jfS)F!*&P zpj$_@J_=DLbNQ+LvHcL%(0uBA<#y>4@=L+uBq3Z)&$o)E;4lvtsW#gESp~enzy@ea zZ2MbnM=zkh*n^84ohivcMf)Lmh@{I|w=8sn9_%9|Xq3cS-}R@ZT>=9E009Dm0RRGk zXYn8z)Z0e(j!6i%5fjGWTev~UQ)C6T|2~@(2rLF|E3f z33ZpUm$P4_>CRVT#_o)3xVdbr6(Bkic1T(^N*AZ{9-1~1zxwk zP_bN71KMjN>d)*eLh`TXnBABgQ%qUKy7a?hWhR-~j{ITUlOF7U0HR#|b8(GEFT)G& z?VfB>;z=0++5`|m%X?8yVEPvI#|ZJ-I)sIRJA1A| zI8oNpb5_jt8rqT{v5#Q&)0Pz4uYCf6fdI^%W)Ig-n`5X)T=06vq4PxU+A6G@Gf)-m zM7PO8&CH=+4rBTHGp=eR0~;Wlc8W?foG?elFO%u(7D=k2x3(@hvR-}~*mPMnH2r%+ zmb4+68bGr_f&OC)7c@v)>$Y3K))M2J=zKpFIa-TPrP;HAw&$NuMNZI^`+ldcb72C3 zfFM5SXO`}zN#A%bW3LZYC)p6v?)Ri+&UID2T3cM%cfm;t-NdhbTzL)3H^J&LbIdmh z$2OTDD*Zh-L5}$AHF<-HL!`T|CU|9J_!!rDUd&_5`l$cEE(e8?_uFuR_v49$&LNQUrsW5^Br2+u}0)hbn0Nqb)D1e?a zp8&aImt7ZC<#fYJP1_)U~2r>KV;Sh&|uxsbgd+Wqim>*RQP17 zN+MEv!KZt7vePp6ZiiY`B3-!n^tlvMkNVKSfk9}HQT!-(cC48Vb1jwcV*qTso3%p= zQOxF6a;8$l+WAY$!e4q1-E5KRYMu^m^R8*?f@AY^R3J|xb1OnZyf)d%@7jF-n#bq{w z_V0-_an4m}EhQL0a0eyJLfgYUma~AbF4TKUx0e^de%Z>SRLcd3_W}a}009Dm0RaG! zDnpyyq31e$(;f_OH=9&LUdAGWmcg)_U4%E0mb$XCnj(|v8LAHpDTtP?vr%m06^$EJ zZpnTE;H3hyxV~h-V=#o!93n{(=c4FC>CFRKQ-|zrZ1|YaIP9Ik-N}{ zy2<3cWREtdn{P+&|LN!)p7{mIkU|!Zt`2R(;Pg#_N=yr%0Vbp2xs8}fq?+{ zc_*4}atI@kiq43z4w}weDdyNNVAbB4NkS;27(x^wl z9J%b|Zc?z3;9TOiJK1`TB(hH8#oFnIv_f(!BjM<1Tj6}HlvN;ezG8sA3fPIW5j-m0 zrtNkO#a&BWxBBTNvSLcW2Sl27{uX5dfq?+z1E4J%6tye))MkM!X;Uf?8bH~Szs0u6 z*)cirwi2tZjOy@!RH&>XpF<1p??`R2z_I*@ponczcJ58;AN9n=lmO7)}?cPxq}S7K$e| z%_M>YTZQ&9fy?JR7<=cE*V;m7sn;&-g+MhbC^OY4hZM-K;ApehPU?Alz@8rI#vgD* ziCnquP~ol5;^064q^Ud%WP58WWvLp2efKx^7FEPDLiY hlYUM(QL<8v)b323|FJ#?NUg;s4_k!y09su`yV-?yRI&g7 diff --git a/tests/net/socket/tls/src/main.c b/tests/net/socket/tls/src/main.c index c67fc5e7de72..7cb45d9f409a 100644 --- a/tests/net/socket/tls/src/main.c +++ b/tests/net/socket/tls/src/main.c @@ -530,9 +530,8 @@ static void test_prepare_tls_connection_ex(sa_family_t family, bool accept_err, else { test_accept(s_sock, &new_sock, &addr, &addrlen); zassert_equal(addrlen, exp_addrlen, "Wrong addrlen"); - - test_work_wait(&test_data.work); } + test_work_wait(&test_data.work); } ZTEST(net_socket_tls, test_v4_msg_waitall) @@ -1797,8 +1796,6 @@ ZTEST(net_socket_tls, test_set_ciphersuites_err) test_sockets_close(); - /* Wait a bit longer to ensure everything is closed up before we exit */ - k_sleep(K_MSEC(150)); k_sleep(TCP_TEARDOWN_TIMEOUT); } From b49d8b6a0f4e3779d510645c6df5c960017f67d2 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 10 Jul 2024 11:20:32 -0700 Subject: [PATCH 06/12] Fix warning for non-dtls build, more efficient dtls flush --- subsys/net/lib/sockets/sockets_tls.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/subsys/net/lib/sockets/sockets_tls.c b/subsys/net/lib/sockets/sockets_tls.c index a9e3fcc214bf..4b077c8626f6 100644 --- a/subsys/net/lib/sockets/sockets_tls.c +++ b/subsys/net/lib/sockets/sockets_tls.c @@ -700,6 +700,7 @@ static int tls_release(struct tls_context *tls) return 0; } +#if defined(CONFIG_NET_SOCKETS_ENABLE_DTLS) static bool peer_addr_cmp(const struct sockaddr *addr, const struct sockaddr *peer_addr) { @@ -723,6 +724,7 @@ static bool peer_addr_cmp(const struct sockaddr *addr, return false; } +#endif #if defined(CONFIG_MBEDTLS) static int tls_session_save(const struct sockaddr *peer_addr, @@ -4155,7 +4157,7 @@ static ssize_t recvfrom_dtls_common_wolfssl(struct tls_context *ctx, void *buf, } for (int i = 0; i < remaining; i++) { - uint8_t b; + uint8_t b[10]; int err; err = wolfSSL_read(ctx->wssl, &b, sizeof(b)); @@ -4165,6 +4167,7 @@ static ssize_t recvfrom_dtls_common_wolfssl(struct tls_context *ctx, void *buf, ret = -1; break; } + i += err; } break; From 761e167fe60d1a2e8dc991a4c84104939e04bf99 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Thu, 11 Jul 2024 14:36:36 -0700 Subject: [PATCH 07/12] Rework get ciphersuite list to use existing functions --- subsys/net/lib/sockets/sockets_tls.c | 68 ++++++++++++---------------- 1 file changed, 28 insertions(+), 40 deletions(-) diff --git a/subsys/net/lib/sockets/sockets_tls.c b/subsys/net/lib/sockets/sockets_tls.c index 4b077c8626f6..80f0fe79188e 100644 --- a/subsys/net/lib/sockets/sockets_tls.c +++ b/subsys/net/lib/sockets/sockets_tls.c @@ -2752,9 +2752,6 @@ static int tls_opt_ciphersuite_list_set(struct tls_context *context, static int tls_opt_ciphersuite_list_get(struct tls_context *context, void *optval, socklen_t *optlen) { -#if defined(CONFIG_WOLFSSL) - byte *selected_buf = NULL; -#endif const int *selected_ciphers; int cipher_cnt, i = 0; int *ciphers = optval; @@ -2766,44 +2763,41 @@ static int tls_opt_ciphersuite_list_get(struct tls_context *context, if (context->options.ciphersuites[0] == 0) { /* No specific ciphersuites configured, return all available. */ #if defined(CONFIG_WOLFSSL) - byte arr[2]; + unsigned char arr[2]; uint16_t sh = 0; - byte *cs_bytes = NULL; - int cs_bytes_len = 0; + char *current = NULL; + int numCipherSuites = 0; + int ret = 0; + int flags = 0; + unsigned char cipherSuite0, cipherSuite; + + cipher_cnt = *optlen / sizeof(int); + if (cipher_cnt == 0) + return -EINVAL; - if (wolfSSL_get_cipher_list_bytes(NULL, &cs_bytes_len) \ - != WOLFSSL_SUCCESS) { - return -EINVAL; - } + while (current != NULL) { + current = wolfSSL_get_cipher_list(numCipherSuites); + if (current == NULL) + break; - if (cs_bytes_len == 0) - return -EINVAL; + numCipherSuites++; + ret = wolfSSL_get_cipher_suite_from_name(current, &cipherSuite0, + &cipherSuite, &flags); + if (ret != WOLFSSL_SUCCESS) + return -EINVAL; - cs_bytes = XMALLOC(cs_bytes_len, NULL, DYNAMIC_TYPE_TMP_BUFFER); - if (cs_bytes == NULL) { - return -ENOMEM; - } + arr[0] = cipherSuite0; + arr[1] = cipherSuite; + sh = sys_get_be16(arr); + ciphers[i++] = (int)(sh); - if (wolfSSL_get_cipher_list_bytes(cs_bytes, &cs_bytes_len) \ - != WOLFSSL_SUCCESS) { - XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) - return -EINVAL; - } + if (i == cipher_cnt) + break; + } - selected_buf = XMALLOC(((cs_bytes_len / 2) * sizeof(int)), NULL, DYNAMIC_TYPE_TMP_BUFFER); - if (selected_buf == NULL) { - XFREE(cs_bytes, NULL, DYNAMIC_TYPE_TMP_BUFFER) - return -EINVAL; - } + *optlen = i * sizeof(int); + return 0; - selected_ciphers = (const int *)selected_buf; - while(i < cs_bytes_len - 1) { - arr[0] = cs_bytes[i]; - arr[1] = cs_bytes[i+1]; - sh = sys_get_be16(arr); - *selected_buf++ = (int)(sh); - i += 2; - } #else selected_ciphers = mbedtls_ssl_list_ciphersuites(); #endif @@ -2822,12 +2816,6 @@ static int tls_opt_ciphersuite_list_get(struct tls_context *context, *optlen = i * sizeof(int); -#if defined(CONFIG_WOLFSSL) - if (NULL != selected_buf) { - XFREE(selected_buf, NULL, DYNAMIC_TYPE_TMP_BUFFER); - } -#endif - return 0; } From c6c9e6b168489cc5bd5ff6bba872ddf63d15984a Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Fri, 12 Jul 2024 09:36:56 -0700 Subject: [PATCH 08/12] Add wolfssl to standard modules --- modules/wolfssl/CMakeLists.txt | 193 +++++ modules/wolfssl/Kconfig | 134 ++++ modules/wolfssl/Kconfig.tls-generic | 267 +++++++ modules/wolfssl/README.md | 104 +++ modules/wolfssl/include.am | 43 ++ .../samples/wolfssl_benchmark/CMakeLists.txt | 8 + .../wolfssl/samples/wolfssl_benchmark/README | 12 + .../boards/nrf5340dk_nrf5340_cpuapp.conf | 22 + .../boards/nrf5340dk_nrf5340_cpuapp_ns.conf | 25 + .../samples/wolfssl_benchmark/install_test.sh | 49 ++ .../samples/wolfssl_benchmark/prj.conf | 36 + .../samples/wolfssl_benchmark/sample.yaml | 15 + .../samples/wolfssl_test/CMakeLists.txt | 9 + modules/wolfssl/samples/wolfssl_test/README | 12 + .../boards/nrf5340dk_nrf5340_cpuapp.conf | 22 + .../boards/nrf5340dk_nrf5340_cpuapp_ns.conf | 25 + .../samples/wolfssl_test/install_test.sh | 49 ++ .../samples/wolfssl_test/prj-no-malloc.conf | 30 + modules/wolfssl/samples/wolfssl_test/prj.conf | 29 + .../wolfssl/samples/wolfssl_test/sample.yaml | 21 + .../samples/wolfssl_tls_sock/CMakeLists.txt | 8 + .../wolfssl/samples/wolfssl_tls_sock/README | 12 + .../wolfssl_tls_sock/install_sample.sh | 31 + .../wolfssl_tls_sock/prj-no-malloc.conf | 57 ++ .../wolfssl/samples/wolfssl_tls_sock/prj.conf | 57 ++ .../samples/wolfssl_tls_sock/sample.yaml | 23 + .../samples/wolfssl_tls_sock/src/tls_sock.c | 532 ++++++++++++++ .../samples/wolfssl_tls_thread/CMakeLists.txt | 8 + .../wolfssl/samples/wolfssl_tls_thread/README | 12 + .../boards/nrf5340dk_nrf5340_cpuapp.conf | 22 + .../boards/nrf5340dk_nrf5340_cpuapp_ns.conf | 25 + .../wolfssl_tls_thread/install_sample.sh | 31 + .../samples/wolfssl_tls_thread/prj.conf | 43 ++ .../samples/wolfssl_tls_thread/sample.yaml | 18 + .../wolfssl_tls_thread/src/tls_threaded.c | 671 ++++++++++++++++++ modules/wolfssl/user_settings-no-malloc.h | 170 +++++ modules/wolfssl/user_settings.h | 462 ++++++++++++ modules/wolfssl/wolfssl/options.h | 1 + modules/wolfssl/zephyr_init.c | 22 + west.yml | 7 +- 40 files changed, 3315 insertions(+), 2 deletions(-) create mode 100644 modules/wolfssl/CMakeLists.txt create mode 100644 modules/wolfssl/Kconfig create mode 100644 modules/wolfssl/Kconfig.tls-generic create mode 100644 modules/wolfssl/README.md create mode 100644 modules/wolfssl/include.am create mode 100644 modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt create mode 100644 modules/wolfssl/samples/wolfssl_benchmark/README create mode 100644 modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf create mode 100644 modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf create mode 100755 modules/wolfssl/samples/wolfssl_benchmark/install_test.sh create mode 100644 modules/wolfssl/samples/wolfssl_benchmark/prj.conf create mode 100644 modules/wolfssl/samples/wolfssl_benchmark/sample.yaml create mode 100644 modules/wolfssl/samples/wolfssl_test/CMakeLists.txt create mode 100644 modules/wolfssl/samples/wolfssl_test/README create mode 100644 modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf create mode 100644 modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf create mode 100755 modules/wolfssl/samples/wolfssl_test/install_test.sh create mode 100644 modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf create mode 100644 modules/wolfssl/samples/wolfssl_test/prj.conf create mode 100644 modules/wolfssl/samples/wolfssl_test/sample.yaml create mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt create mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/README create mode 100755 modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh create mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf create mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/prj.conf create mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml create mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c create mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt create mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/README create mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf create mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf create mode 100755 modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh create mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/prj.conf create mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml create mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c create mode 100644 modules/wolfssl/user_settings-no-malloc.h create mode 100644 modules/wolfssl/user_settings.h create mode 100644 modules/wolfssl/wolfssl/options.h create mode 100644 modules/wolfssl/zephyr_init.c diff --git a/modules/wolfssl/CMakeLists.txt b/modules/wolfssl/CMakeLists.txt new file mode 100644 index 000000000000..ed5900aaec7f --- /dev/null +++ b/modules/wolfssl/CMakeLists.txt @@ -0,0 +1,193 @@ +if(CONFIG_WOLFSSL) + zephyr_interface_library_named(wolfSSL) + + if(CONFIG_WOLFSSL_BUILTIN) + if(CONFIG_WOLFSSL_SETTINGS_FILE) + target_compile_definitions(wolfSSL INTERFACE + WOLFSSL_SETTINGS_FILE="${CONFIG_WOLFSSL_SETTINGS_FILE}" + ) + zephyr_include_directories( + ${APPLICATION_CONFIG_DIR} + ${APPLICATION_CONFIG_DIR}/src + ) + endif() + + zephyr_include_directories( + ${ZEPHYR_CURRENT_MODULE_DIR} + ${ZEPHYR_CURRENT_MODULE_DIR}/wolfssl + ${ZEPHYR_CURRENT_MODULE_DIR}/zephyr + ) + + zephyr_library() + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/zephyr/zephyr_init.c) + + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/crl.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/dtls.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/dtls13.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/internal.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/keys.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/ocsp.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/sniffer.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/ssl.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/tls.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/tls13.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/wolfio.c) + + # FIPS Boundary + if(CONFIG_WOLFCRYPT_FIPS) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfcrypt_first.c) + endif() + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/hmac.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/random.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/kdf.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/rsa.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ecc.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha256.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha512.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha3.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/dh.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/cmac.c) + if(CONFIG_WOLFCRYPT_FIPS) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fips.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fips_test.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfcrypt_last.c) + endif() + + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/arc4.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/asm.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/asn.c) + #zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/async.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/blake2b.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/blake2s.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/camellia.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/chacha.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/chacha20_poly1305.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/coding.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/compress.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/cpuid.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/cryptocb.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/curve25519.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/curve448.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/des3.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/dilithium.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/dsa.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ecc_fp.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/eccsi.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ed25519.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ed448.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/error.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ext_kyber.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/falcon.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fe_448.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fe_low_mem.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fe_operations.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ge_448.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ge_low_mem.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ge_operations.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/hash.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/integer.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/logging.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/md2.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/md4.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/md5.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/memory.c) + #zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/misc.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/pkcs12.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/pkcs7.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/poly1305.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/pwdbased.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ripemd.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sakke.c) + #zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/selftest.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/signature.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/siphash.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_arm32.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_arm64.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_armthumb.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_c32.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_c64.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_cortexm.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_dsp32.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_int.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_x86_64.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sphincs.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/srp.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/tfm.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_dsp.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_encrypt.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_pkcs11.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_port.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfevent.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfmath.c) + + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/liboqs/liboqs.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_aes.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_hash.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_pkcbs.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/st/stm32.c) + + if(CONFIG_WOLFCRYPT_ARMASM) + # tested with board: "qemu_kvm_arm64" + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-aes.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha256.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha512.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha512-asm_c.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha3-asm_c.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-poly1305.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-chacha.c) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-curve25519_c.c) + + # Note: The cmake/gcc-m-cpu.cmake make need updated to add "+crypto -mstrict-align" + set(TOOLCHAIN_C_FLAGS "-mcpu=cortex-a53+crypto -mstrict-align") + endif() + + if(CONFIG_WOLFCRYPT_INTELASM) + # tested with board: "qemu_x86_64" + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha256_asm.S) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha512_asm.S) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha3_asm.S) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/chacha_asm.S) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/poly1305_asm.S) + + # AESNI + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes_asm.S) + zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes_gcm_x86_asm.S) + set(TOOLCHAIN_C_FLAGS "-march=native -maes -msse4 -mpclmul ") + endif() + + zephyr_library_link_libraries(wolfSSL) + + target_compile_definitions(wolfSSL INTERFACE WOLFSSL_ZEPHYR) + target_compile_definitions(wolfSSL INTERFACE WOLFSSL_USER_SETTINGS) + if(CONFIG_WOLFSSL_DEBUG) + target_compile_definitions(wolfSSL INTERFACE DEBUG_WOLFSSL) + zephyr_library_compile_options(-g3 -O0) + endif() + else() + assert(CONFIG_WOLFSSL_LIBRARY "wolfSSL was enabled, but neither BUILTIN or LIBRARY was selected.") + + # NB: CONFIG_WOLFSSL_LIBRARY is not regression tested and is + # therefore susceptible to bit rot + + target_include_directories(wolfSSL INTERFACE + ${CONFIG_WOLFSSL_INSTALL_PATH} + ) + + zephyr_link_libraries( + wolfssl_external + -L${CONFIG_WOLFSSL_INSTALL_PATH} + gcc + ) + # Lib wolfssl depends on libgcc so to allow + # wolfssl to link with gcc we need to ensure it is placed + # after wolfssl_external on the linkers command line. + endif() + + target_link_libraries(wolfSSL INTERFACE zephyr_interface) + +endif() diff --git a/modules/wolfssl/Kconfig b/modules/wolfssl/Kconfig new file mode 100644 index 000000000000..1bf1f25bd924 --- /dev/null +++ b/modules/wolfssl/Kconfig @@ -0,0 +1,134 @@ +# Kconfig - Cryptography primitive options for wolfSSL + +# +# Copyright (c) 2016 Intel Corporation +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +config ZEPHYR_WOLFSSL_MODULE + bool +config WOLFSSL_PROMPTLESS + bool + help + Symbol to disable the prompt for WOLFSSL selection. + This symbol may be used internally in a Kconfig tree to hide the + wolfSSL menu prompt and instead handle the selection of WOLFSSL from + dependent sub-configurations and thus prevent stuck symbol behavior. + + +menuconfig WOLFSSL + bool "wolfSSL Support" if !WOLFSSL_PROMPTLESS + help + This option enables the wolfSSL cryptography library. + +if WOLFSSL + +choice WOLFSSL_IMPLEMENTATION + prompt "Select implementation" + default WOLFSSL_BUILTIN + +config WOLFSSL_BUILTIN + bool "Enable wolfSSL integrated sources" + help + Link with local wolfSSL sources instead of external library. + +config WOLFSSL_LIBRARY + bool "Enable wolfSSL external library" + help + This option enables wolfSSL library. + +endchoice + +config WOLFSSL_SETTINGS_FILE + string "wolfSSL settings file" + depends on WOLFSSL_BUILTIN + help + Use a specific wolfSSL settings file. The default config file + file can be tweaked with Kconfig. The default settings is + suitable to communicate with majority of HTTPS servers on the Internet, + but has relatively many features enabled. To optimize resources for + special TLS usage, use available Kconfig settings, or select an + alternative config. + +rsource "Kconfig.tls-generic" + +config WOLFCRYPT_FIPS + bool "wolfCrypt FIPS support" + depends on WOLFSSL_BUILTIN + help + Enables FIPS support in wolfCrypt. Requires the wolfSSL FIPS ready + download that includes fips.c/fips_test.c. + +config WOLFSSL_DTLS + bool "wolfSSL DTLS support" + help + Enable DTLS support + +config WOLFSSL_ALPN + bool "wolfSSL ALPN support" + help + Enable ALPN support + +config WOLFSSL_PSK + bool "wolfSSL PSK support" + help + Enable PSK support + +config WOLFSSL_MAX_FRAGMENT_LEN + int + default 3 + range 1 6 + help + Sets the maximum fragment length wolfSSL will use, values 1-6 correspond to enum values + WOLFSSL_MFL_* in ssl.h + +config WOLFCRYPT_ARMASM + bool "wolfCrypt ARM Assembly support" + depends on WOLFSSL_BUILTIN + help + wolfCrypt ARM (ARMv8/ARMv7) assembly support for AES, SHA-2, SHA-3, + ChaCha20/Poly1305 and Curve25519 + +config WOLFCRYPT_INTELASM + bool "wolfCrypt Intel Assembly support" + depends on WOLFSSL_BUILTIN + help + wolfCrypt Intel Aassembly support (AVX/AVX2/AESNI) + +config WOLFSSL_DEBUG + bool "wolfSSL debug activation" + depends on WOLFSSL_BUILTIN + help + Enable debugging activation for wolfSSL configuration. If you use + wolfSSL/Zephyr integration (e.g. net_app), this will activate debug + logging (of the level configured by WOLFSSL_DEBUG_LEVEL). + +config WOLFSSL_INSTALL_PATH + string "wolfSSL install path" + depends on WOLFSSL_LIBRARY + help + This option holds the path where the wolfSSL libraries and headers are + installed. Make sure this option is properly set when WOLFSSL_LIBRARY + is enabled otherwise the build will fail. + +config APP_LINK_WITH_WOLFSSL + bool "Link 'app' with WOLFSSL" + default y + help + Add WOLFSSL header files to the 'app' include path. It may be + disabled if the include paths for WOLFSSL are causing aliasing + issues for 'app'. + +endif + diff --git a/modules/wolfssl/Kconfig.tls-generic b/modules/wolfssl/Kconfig.tls-generic new file mode 100644 index 000000000000..bc46a8fd47dc --- /dev/null +++ b/modules/wolfssl/Kconfig.tls-generic @@ -0,0 +1,267 @@ +# Kconfig.tls - TLS/DTLS related options + +# +# Copyright (c) 2018 Intel Corporation +# Copyright (c) 2018 Nordic Semiconductor ASA +# +# SPDX-License-Identifier: Apache-2.0 +# + +menu "TLS configuration" + +menu "Supported TLS version" + +config WOLFSSL_TLS_VERSION_1_0 + bool "Enable support for TLS 1.0" + select WOLFSSL_ALLOW_TLSV10_ENABLED + +config WOLFSSL_TLS_VERSION_1_1 + bool "Enable support for TLS 1.1" + select WOLFSSL_NO_OLD_TLS_DISABLED + +config WOLFSSL_TLS_VERSION_1_2 + bool "Enable support for TLS 1.2" + default y + +config WOLFSSL_TLS_VERSION_1_3 + bool "Enable support for TLS 1.3" + select WOLFSSL_TLS13_ENABLED + +endmenu + +menu "Ciphersuite configuration" + +comment "Supported key exchange modes" + +config WOLFSSL_KEY_EXCHANGE_ALL_ENABLED + bool "Enable all available ciphersuite modes" + select WOLFSSL_KEY_EXCHANGE_PSK_ENABLED + select WOLFSSL_KEY_EXCHANGE_DHE_PSK_ENABLED + select WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED + select WOLFSSL_KEY_EXCHANGE_RSA_PSK_ENABLED + select WOLFSSL_KEY_EXCHANGE_RSA_ENABLED + select WOLFSSL_KEY_EXCHANGE_DHE_RSA_ENABLED + select WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED + select WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + select WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + select WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + select WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED + select WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED + +config WOLFSSL_KEY_EXCHANGE_PSK_ENABLED + bool "Enable the PSK based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_DHE_PSK_ENABLED + bool "Enable the DHE-PSK based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED + bool "Enable the ECDHE-PSK based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_RSA_PSK_ENABLED + bool "Enable the RSA-PSK based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_RSA_ENABLED + bool "Enable the RSA-only based ciphersuite modes" + default y + +config WOLFSSL_KEY_EXCHANGE_DHE_RSA_ENABLED + bool "Enable the DHE-RSA based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED + bool "Enable the ECDHE-RSA based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + bool "Enable the ECDHE-ECDSA based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + bool "Enable the ECDH-ECDSA based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED + bool "Enable the ECDH-RSA based ciphersuite modes" + +config WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED + bool "Enable the ECJPAKE based ciphersuite modes" + +if WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED || \ + WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED || \ + WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || \ + WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED || \ + WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED || \ + WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED + +comment "Supported elliptic curves" + +config WOLFSSL_ECP_ALL_ENABLED + bool "Enable all available elliptic curves" + select WOLFSSL_ECP_DP_SECP192R1_ENABLED + select WOLFSSL_ECP_DP_SECP192R1_ENABLED + select WOLFSSL_ECP_DP_SECP224R1_ENABLED + select WOLFSSL_ECP_DP_SECP256R1_ENABLED + select WOLFSSL_ECP_DP_SECP384R1_ENABLED + select WOLFSSL_ECP_DP_SECP521R1_ENABLED + select WOLFSSL_ECP_DP_SECP192K1_ENABLED + select WOLFSSL_ECP_DP_SECP224K1_ENABLED + select WOLFSSL_ECP_DP_SECP256K1_ENABLED + select WOLFSSL_ECP_DP_BP256R1_ENABLED + select WOLFSSL_ECP_DP_BP384R1_ENABLED + select WOLFSSL_ECP_DP_BP512R1_ENABLED + select WOLFSSL_ECP_DP_CURVE25519_ENABLED + select WOLFSSL_ECP_DP_CURVE448_ENABLED + select WOLFSSL_ECP_NIST_OPTIM + +config WOLFSSL_ECP_DP_SECP192R1_ENABLED + bool "Enable SECP192R1 elliptic curve" + +config WOLFSSL_ECP_DP_SECP224R1_ENABLED + bool "Enable SECP224R1 elliptic curve" + +config WOLFSSL_ECP_DP_SECP256R1_ENABLED + bool "Enable SECP256R1 elliptic curve" + +config WOLFSSL_ECP_DP_SECP384R1_ENABLED + bool "Enable SECP384R1 elliptic curve" + +config WOLFSSL_ECP_DP_SECP521R1_ENABLED + bool "Enable SECP521R1 elliptic curve" + +config WOLFSSL_ECP_DP_SECP192K1_ENABLED + bool "Enable SECP192K1 elliptic curve" + +config WOLFSSL_ECP_DP_SECP224K1_ENABLED + bool "Enable SECP224K1 elliptic curve" + +config WOLFSSL_ECP_DP_SECP256K1_ENABLED + bool "Enable SECP256K1 elliptic curve" + +config WOLFSSL_ECP_DP_BP256R1_ENABLED + bool "Enable BP256R1 elliptic curve" + +config WOLFSSL_ECP_DP_BP384R1_ENABLED + bool "Enable BP384R1 elliptic curve" + +config WOLFSSL_ECP_DP_BP512R1_ENABLED + bool "Enable BP512R1 elliptic curve" + +config WOLFSSL_ECP_DP_CURVE25519_ENABLED + bool "Enable CURVE25519 elliptic curve" + +config WOLFSSL_ECP_DP_CURVE448_ENABLED + bool "Enable CURVE448 elliptic curve" + +config WOLFSSL_ECP_NIST_OPTIM + bool "Enable NSIT curves optimization" + +endif + +comment "Supported cipher modes" + +config WOLFSSL_CIPHER_ALL_ENABLED + bool "Enable all available ciphers" + select WOLFSSL_CIPHER_AES_ENABLED + select WOLFSSL_CIPHER_CAMELLIA_ENABLED + select WOLFSSL_CIPHER_DES_ENABLED + select WOLFSSL_CIPHER_ARC4_ENABLED + select WOLFSSL_CIPHER_CHACHA20_ENABLED + select WOLFSSL_CIPHER_BLOWFISH_ENABLED + select WOLFSSL_CIPHER_CCM_ENABLED + select WOLFSSL_CIPHER_MODE_XTS_ENABLED + select WOLFSSL_CIPHER_MODE_GCM_ENABLED + select WOLFSSL_CIPHER_CBC_ENABLED + select WOLFSSL_CHACHAPOLY_AEAD_ENABLED + +config WOLFSSL_CIPHER_AES_ENABLED + bool "Enable the AES block cipher" + default y + +config WOLFSSL_AES_ROM_TABLES + depends on WOLFSSL_CIPHER_AES_ENABLED + bool "Use precomputed AES tables stored in ROM." + default y + +config WOLFSSL_CIPHER_CAMELLIA_ENABLED + bool "Enable the Camellia block cipher" + +config WOLFSSL_CIPHER_DES_ENABLED + bool "Enable the DES block cipher" + default y + +config WOLFSSL_CIPHER_ARC4_ENABLED + bool "Enable the ARC4 stream cipher" + +config WOLFSSL_CIPHER_CHACHA20_ENABLED + bool "Enable the ChaCha20 stream cipher" + +config WOLFSSL_CIPHER_BLOWFISH_ENABLED + bool "Enable the Blowfish block cipher" + +config WOLFSSL_CIPHER_CCM_ENABLED + bool "Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher" + depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED + +config WOLFSSL_CIPHER_MODE_XTS_ENABLED + bool "Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES" + depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED + +config WOLFSSL_CIPHER_MODE_GCM_ENABLED + bool "Enable the Galois/Counter Mode (GCM) for AES" + depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED + +config WOLFSSL_CIPHER_CBC_ENABLED + bool "Enable Cipher Block Chaining mode (CBC) for symmetric ciphers" + default y + +config WOLFSSL_CHACHAPOLY_AEAD_ENABLED + bool "Enable the ChaCha20-Poly1305 AEAD algorithm" + depends on WOLFSSL_CIPHER_CHACHA20_ENABLED || WOLFSSL_MAC_POLY1305_ENABLED + +comment "Supported message authentication methods" + +config WOLFSSL_MAC_ALL_ENABLED + bool "Enable all available MAC methods" + select WOLFSSL_MAC_MD4_ENABLED + select WOLFSSL_MAC_MD5_ENABLED + select WOLFSSL_MAC_SHA1_ENABLED + select WOLFSSL_MAC_SHA256_ENABLED + select WOLFSSL_MAC_SHA512_ENABLED + select WOLFSSL_MAC_POLY1305_ENABLED + +config WOLFSSL_MAC_MD4_ENABLED + bool "Enable the MD4 hash algorithm" + +config WOLFSSL_MAC_MD5_ENABLED + bool "Enable the MD5 hash algorithm" + default y + +config WOLFSSL_MAC_SHA1_ENABLED + bool "Enable the SHA1 hash algorithm" + default y + +config WOLFSSL_MAC_SHA256_ENABLED + bool "Enable the SHA-224 and SHA-256 hash algorithms" + default y + +config WOLFSSL_MAC_SHA512_ENABLED + bool "Enable the SHA-384 and SHA-512 hash algorithms" + +config WOLFSSL_MAC_POLY1305_ENABLED + bool "Enable the Poly1305 MAC algorithm" + +endmenu + +comment "Random number generators" + +config WOLFSSL_HMAC_DRBG_ENABLED + bool "Enable the HMAC_DRBG random generator" + default y + +comment "Other configurations" + +config WOLFSSL_HAVE_ASM + bool "Enable use of assembly code" + default y + help + Enable use of assembly code in wolfSSL. This improves the performances + of asymmetric cryptography, however this might have an impact on the + code size. + +endmenu diff --git a/modules/wolfssl/README.md b/modules/wolfssl/README.md new file mode 100644 index 000000000000..098d51c96ca0 --- /dev/null +++ b/modules/wolfssl/README.md @@ -0,0 +1,104 @@ +Zephyr Project Port +=================== + +## Overview + +This port is for the Zephyr RTOS Project, available [here](https://www.zephyrproject.org/). + +It provides the following zephyr code. + +- modules/crypto/wolfssl + - wolfssl library code +- modules/crypto/wolfssl/zephyr/ + - Configuration and CMake files for wolfSSL as a Zephyr module +- modules/crypto/wolfssl/zephyr/samples/wolfssl_test + - wolfCrypt test application +- modules/crypto/wolfssl/zephyr/samples/wolfssl_bench + - wolfCrypt benchmark application +- modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_sock + - socket based sample of TLS +- modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_thread + - socket based sample of TLS using threads + +## How to setup as a Zephyr Module + +### Modify your project's west manifest + +Add wolfssl as a project to your west.yml: +``` +manifest: + remotes: + # + - name: wolfssl + url-base: https://github.com/wolfssl + + projects: + # + - name: wolfssl + path: modules/crypto/wolfssl + revision: master + remote: wolfssl +``` + +If you are using the Nordic nRF Connect SDK with Zephyr, the sdk-nrf manifest +file is located at: `vX.X.X/nrf/west.yml`. On OSX the default installation +location for the nRF Connect SDK is at `/opt/nordic/ncs/vX.X.X`. + +Update west's modules: + +```bash +west update +``` + +Now west recognizes 'wolfssl' as a module, and will include it's Kconfig and +CMakeFiles.txt in the build system. + +If using the Nordic nRF Connect SDK, to get access to a terminal with west +tool access, open "nRF Connect for Desktop", then "Toolchain Manager", +and finally next to the SDK version you are using click the drop down arrow, +then "Open Terminal". + +## Build and Run wolfCrypt Test Application + +If you want to run build apps without running `west zephyr-export` then it is +possible by setting the `CMAKE_PREFIX_PATH` variable to the location of the +zephyr sdk and building from the `zephyr` directory. For example: + +``` +CMAKE_PREFIX_PATH=/path/to/zephyr-sdk- west build -p always -b qemu_x86 ../modules/crypto/wolfssl/zephyr/samples/wolfssl_test/ +``` + +build and execute `wolfssl_test` + +``` +cd [zephyrproject] +west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_test +west build -t run +``` + +## Build and Run wolfCrypt Benchmark Application + +build and execute `wolfssl_benchmark` + +``` +cd [zephyrproject] +west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_benchmark +west build -t run +``` + +### Build and Run wolfSSL example `wolfssl_tls_sock` + +``` +cd [zephyrproject] +west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_sock +west build -t run +``` + +### Build and Run wolfSSL example `wolfssl_tls_thread` + +``` +cd [zephyrproject] +west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_thread +west build -t run +``` + diff --git a/modules/wolfssl/include.am b/modules/wolfssl/include.am new file mode 100644 index 000000000000..ef67bcc108ca --- /dev/null +++ b/modules/wolfssl/include.am @@ -0,0 +1,43 @@ +# vim:ft=automake +# included from Top Level Makefile.am +# All paths should be given relative to the root + +EXTRA_DIST+= zephyr/CMakeLists.txt +EXTRA_DIST+= zephyr/Kconfig +EXTRA_DIST+= zephyr/Kconfig.tls-generic +EXTRA_DIST+= zephyr/zephyr_init.c +EXTRA_DIST+= zephyr/module.yml +EXTRA_DIST+= zephyr/wolfssl/options.h +EXTRA_DIST+= zephyr/user_settings.h +EXTRA_DIST+= zephyr/README.md +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/ +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/CMakeLists.txt +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/README +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/install_test.sh +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/prj.conf +EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/sample.yaml +EXTRA_DIST+= zephyr/samples/wolfssl_test/CMakeLists.txt +EXTRA_DIST+= zephyr/samples/wolfssl_test/README +EXTRA_DIST+= zephyr/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf +EXTRA_DIST+= zephyr/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf +EXTRA_DIST+= zephyr/samples/wolfssl_test/install_test.sh +EXTRA_DIST+= zephyr/samples/wolfssl_test/prj.conf +EXTRA_DIST+= zephyr/samples/wolfssl_test/sample.yaml +EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/CMakeLists.txt +EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/README +EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/install_sample.sh +EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/prj.conf +EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/sample.yaml +EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/src +EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/src/tls_sock.c +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/CMakeLists.txt +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/README +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/install_sample.sh +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/prj.conf +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/sample.yaml +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/src +EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c diff --git a/modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt new file mode 100644 index 000000000000..1b68e1bfb7c6 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt @@ -0,0 +1,8 @@ +cmake_minimum_required(VERSION 3.13.1) +find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE}) +project(wolfssl_benchmark) + +target_sources(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/benchmark/benchmark.c) +target_include_directories(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/benchmark) +target_sources(app PRIVATE ${app_sources}) +add_definitions(-DWOLFSSL_USER_SETTINGS) diff --git a/modules/wolfssl/samples/wolfssl_benchmark/README b/modules/wolfssl/samples/wolfssl_benchmark/README new file mode 100644 index 000000000000..906a6c9bac81 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_benchmark/README @@ -0,0 +1,12 @@ + +wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use +under the GPLv2 or a standard commercial license. For our users who cannot use +wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. +Please contact wolfSSL Inc. directly at: + +Email: licensing@wolfssl.com +Phone: +1 425 245-8247 + +More information can be found on the wolfSSL website at www.wolfssl.com. + + diff --git a/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf b/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf new file mode 100644 index 000000000000..98d8bc49632a --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf @@ -0,0 +1,22 @@ +# Set user_settings.h file to be used for native wolfSSL build settings +#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" + +##### PSA and CC3XX ##### +# Enable Nordic Security Module +CONFIG_NRF_SECURITY=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y +# Enable PSA API support (comes from mbedTLS) +CONFIG_MBEDTLS_PSA_CRYPTO_C=y +# Enable/configure mbedTLS heap +CONFIG_MBEDTLS_ENABLE_HEAP=y +CONFIG_MBEDTLS_HEAP_SIZE=8192 +# Disable nrf_oberon crypto library PSA backend +CONFIG_PSA_CRYPTO_DRIVER_OBERON=n +# Enable ARM CryptoCell cc3xx driver PSA backend +CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +##### Logging ##### +CONFIG_USE_SEGGER_RTT=y +CONFIG_LOG_BACKEND_RTT=y +CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 + diff --git a/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf new file mode 100644 index 000000000000..aa3bbe18ad3b --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf @@ -0,0 +1,25 @@ +CONFIG_BUILD_WITH_TFM=y +CONFIG_TFM_PROFILE_TYPE_NOT_SET=y + +# Set user_settings.h file to be used for native wolfSSL build settings +#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" + +##### PSA and CC3XX ##### +# Enable Nordic Security Module +CONFIG_NRF_SECURITY=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y +# Enable PSA API support (comes from mbedTLS) +CONFIG_MBEDTLS_PSA_CRYPTO_C=y +# Enable/configure mbedTLS heap +CONFIG_MBEDTLS_ENABLE_HEAP=y +CONFIG_MBEDTLS_HEAP_SIZE=8192 +# Disable nrf_oberon crypto library PSA backend +CONFIG_PSA_CRYPTO_DRIVER_OBERON=n +# Enable ARM CryptoCell cc3xx driver PSA backend +CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +##### Logging ##### +CONFIG_USE_SEGGER_RTT=y +CONFIG_LOG_BACKEND_RTT=y +CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 + diff --git a/modules/wolfssl/samples/wolfssl_benchmark/install_test.sh b/modules/wolfssl/samples/wolfssl_benchmark/install_test.sh new file mode 100755 index 000000000000..fff8da420838 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_benchmark/install_test.sh @@ -0,0 +1,49 @@ +#!/bin/sh + +WOLFSSL_SRC_DIR=../../.. + +if [ ! -d $WOLFSSL_SRC_DIR ]; then + echo "Directory does not exist: $WOLFSSL_SRC_DIR" + exit 1 +fi +if [ ! -f $WOLFSSL_SRC_DIR/wolfcrypt/benchmark/benchmark.c ]; then + echo "Missing source file: $WOLFSSL_SRC_DIR/wolfcrypt/benchmark/benchmark.h" + exit 1 +fi + +ZEPHYR_DIR= +if [ $# -ne 1 ]; then + echo "Need location of zephyr project as a command line argument" + exit 1 +else + ZEPHYR_DIR=$1 +fi +if [ ! -d $ZEPHR_DIR ]; then + echo "Zephyr project directory does not exist: $ZEPHYR_DIR" + exit 1 +fi +ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules +if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then + echo "Zephyr samples/modules directory does not exist: $ZEPHYR_SAMPLES_DIR" + exit 1 +fi +ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_benchmark + +echo "wolfSSL directory:" +echo " $ZEPHYR_WOLFSSL_DIR" +rm -rf $ZEPHYR_WOLFSSL_DIR +mkdir $ZEPHYR_WOLFSSL_DIR + +echo "Copy in Build files ..." +cp -r * $ZEPHYR_WOLFSSL_DIR/ +rm $ZEPHYR_WOLFSSL_DIR/$0 + +echo "Copy Source Code ..." +rm -rf $ZEPHYR_WOLFSSL_DIR/src +mkdir $ZEPHYR_WOLFSSL_DIR/src + +cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/benchmark/benchmark.c $ZEPHYR_WOLFSSL_DIR/src/ +cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/benchmark/benchmark.h $ZEPHYR_WOLFSSL_DIR/src/ + +echo "Done" + diff --git a/modules/wolfssl/samples/wolfssl_benchmark/prj.conf b/modules/wolfssl/samples/wolfssl_benchmark/prj.conf new file mode 100644 index 000000000000..017988024946 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_benchmark/prj.conf @@ -0,0 +1,36 @@ +# Configure stack and heap sizes +CONFIG_MAIN_STACK_SIZE=32768 +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=8192 + +# Pthreads +CONFIG_PTHREAD_IPC=y + +# Clock for time() +CONFIG_POSIX_CLOCK=y + +# TLS configuration +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_BUILTIN=y + +# Floating Point +CONFIG_FPU=y + +# Logging +CONFIG_PRINTK=y +CONFIG_CBPRINTF_LIBC_SUBSTS=y +CONFIG_CBPRINTF_FP_SUPPORT=y +CONFIG_CONSOLE=y +CONFIG_LOG=y +CONFIG_LOG_BACKEND_UART=y +CONFIG_LOG_BUFFER_SIZE=15360 +CONFIG_LOG_MODE_IMMEDIATE=y +#CONFIG_WOLFSSL_DEBUG=y + +# Entropy +CONFIG_TEST_RANDOM_GENERATOR=y +CONFIG_ENTROPY_GENERATOR=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y + +# Optional ARM or Intel Assembly +#CONFIG_WOLFCRYPT_ARMASM=y +#CONFIG_WOLFCRYPT_INTELASM=y diff --git a/modules/wolfssl/samples/wolfssl_benchmark/sample.yaml b/modules/wolfssl/samples/wolfssl_benchmark/sample.yaml new file mode 100644 index 000000000000..4c5d1fcea80e --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_benchmark/sample.yaml @@ -0,0 +1,15 @@ +sample: + description: wolfCrypt benchmark sample app + name: wolfCrypt benchmark +common: + tags: crypto wolfssl userspace random + harness: console + harness_config: + type: one_line + regex: + - "Benchmark complete" +tests: + sample.crypto.wolfssl_benchmark: + platform_allow: qemu_x86 + integration_platforms: + - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_test/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_test/CMakeLists.txt new file mode 100644 index 000000000000..bae4c165472b --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/CMakeLists.txt @@ -0,0 +1,9 @@ +cmake_minimum_required(VERSION 3.13.1) +find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE}) +project(wolfssl_test) + +target_sources(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/test/test.c) +target_include_directories(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/test) +target_sources(app PRIVATE ${app_sources}) +add_definitions(-DWOLFSSL_USER_SETTINGS) + diff --git a/modules/wolfssl/samples/wolfssl_test/README b/modules/wolfssl/samples/wolfssl_test/README new file mode 100644 index 000000000000..906a6c9bac81 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/README @@ -0,0 +1,12 @@ + +wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use +under the GPLv2 or a standard commercial license. For our users who cannot use +wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. +Please contact wolfSSL Inc. directly at: + +Email: licensing@wolfssl.com +Phone: +1 425 245-8247 + +More information can be found on the wolfSSL website at www.wolfssl.com. + + diff --git a/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf b/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf new file mode 100644 index 000000000000..98d8bc49632a --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf @@ -0,0 +1,22 @@ +# Set user_settings.h file to be used for native wolfSSL build settings +#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" + +##### PSA and CC3XX ##### +# Enable Nordic Security Module +CONFIG_NRF_SECURITY=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y +# Enable PSA API support (comes from mbedTLS) +CONFIG_MBEDTLS_PSA_CRYPTO_C=y +# Enable/configure mbedTLS heap +CONFIG_MBEDTLS_ENABLE_HEAP=y +CONFIG_MBEDTLS_HEAP_SIZE=8192 +# Disable nrf_oberon crypto library PSA backend +CONFIG_PSA_CRYPTO_DRIVER_OBERON=n +# Enable ARM CryptoCell cc3xx driver PSA backend +CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +##### Logging ##### +CONFIG_USE_SEGGER_RTT=y +CONFIG_LOG_BACKEND_RTT=y +CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 + diff --git a/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf new file mode 100644 index 000000000000..aa3bbe18ad3b --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf @@ -0,0 +1,25 @@ +CONFIG_BUILD_WITH_TFM=y +CONFIG_TFM_PROFILE_TYPE_NOT_SET=y + +# Set user_settings.h file to be used for native wolfSSL build settings +#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" + +##### PSA and CC3XX ##### +# Enable Nordic Security Module +CONFIG_NRF_SECURITY=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y +# Enable PSA API support (comes from mbedTLS) +CONFIG_MBEDTLS_PSA_CRYPTO_C=y +# Enable/configure mbedTLS heap +CONFIG_MBEDTLS_ENABLE_HEAP=y +CONFIG_MBEDTLS_HEAP_SIZE=8192 +# Disable nrf_oberon crypto library PSA backend +CONFIG_PSA_CRYPTO_DRIVER_OBERON=n +# Enable ARM CryptoCell cc3xx driver PSA backend +CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +##### Logging ##### +CONFIG_USE_SEGGER_RTT=y +CONFIG_LOG_BACKEND_RTT=y +CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 + diff --git a/modules/wolfssl/samples/wolfssl_test/install_test.sh b/modules/wolfssl/samples/wolfssl_test/install_test.sh new file mode 100755 index 000000000000..f0ab5ad96cee --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/install_test.sh @@ -0,0 +1,49 @@ +#!/bin/sh + +WOLFSSL_SRC_DIR=../../.. + +if [ ! -d $WOLFSSL_SRC_DIR ]; then + echo "Directory does not exist: $WOLFSSL_SRC_DIR" + exit 1 +fi +if [ ! -f $WOLFSSL_SRC_DIR/wolfcrypt/test/test.c ]; then + echo "Missing source file: $WOLFSSL_SRC_DIR/wolfcrypt/test/test.h" + exit 1 +fi + +ZEPHYR_DIR= +if [ $# -ne 1 ]; then + echo "Need location of zephyr project as a command line argument" + exit 1 +else + ZEPHYR_DIR=$1 +fi +if [ ! -d $ZEPHR_DIR ]; then + echo "Zephyr project directory does not exist: $ZEPHYR_DIR" + exit 1 +fi +ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules +if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then + echo "Zephyr samples/modules directory does not exist: $ZEPHYR_SAMPLES_DIR" + exit 1 +fi +ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_test + +echo "wolfSSL directory:" +echo " $ZEPHYR_WOLFSSL_DIR" +rm -rf $ZEPHYR_WOLFSSL_DIR +mkdir $ZEPHYR_WOLFSSL_DIR + +echo "Copy in Build files ..." +cp -r * $ZEPHYR_WOLFSSL_DIR/ +rm $ZEPHYR_WOLFSSL_DIR/$0 + +echo "Copy Source Code ..." +rm -rf $ZEPHYR_WOLFSSL_DIR/src +mkdir $ZEPHYR_WOLFSSL_DIR/src + +cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/test/test.c $ZEPHYR_WOLFSSL_DIR/src/ +cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/test/test.h $ZEPHYR_WOLFSSL_DIR/src/ + +echo "Done" + diff --git a/modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf b/modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf new file mode 100644 index 000000000000..42f98d431d6e --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf @@ -0,0 +1,30 @@ +# Configure stack and heap sizes +CONFIG_MAIN_STACK_SIZE=655360 +#CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 + +# Pthreads +CONFIG_PTHREAD_IPC=y + +# Clock for time() +CONFIG_POSIX_CLOCK=y + +# TLS configuration +CONFIG_WOLFSSL_SETTINGS_FILE="user_settings-no-malloc.h" +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_BUILTIN=y + +# Logging +CONFIG_PRINTK=y +CONFIG_CBPRINTF_LIBC_SUBSTS=y +CONFIG_CBPRINTF_FP_SUPPORT=y +CONFIG_CONSOLE=y +CONFIG_LOG=y +CONFIG_LOG_BACKEND_UART=y +CONFIG_LOG_BUFFER_SIZE=15360 +CONFIG_LOG_MODE_IMMEDIATE=y +#CONFIG_WOLFSSL_DEBUG=y + +# Entropy +CONFIG_TEST_RANDOM_GENERATOR=y +CONFIG_ENTROPY_GENERATOR=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y diff --git a/modules/wolfssl/samples/wolfssl_test/prj.conf b/modules/wolfssl/samples/wolfssl_test/prj.conf new file mode 100644 index 000000000000..38b1ce49b4fd --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/prj.conf @@ -0,0 +1,29 @@ +# Configure stack and heap sizes +CONFIG_MAIN_STACK_SIZE=32768 +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=16384 + +# Pthreads +CONFIG_PTHREAD_IPC=y + +# Clock for time() +CONFIG_POSIX_CLOCK=y + +# TLS configuration +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_BUILTIN=y + +# Logging +CONFIG_PRINTK=y +CONFIG_CBPRINTF_LIBC_SUBSTS=y +CONFIG_CBPRINTF_FP_SUPPORT=y +CONFIG_CONSOLE=y +CONFIG_LOG=y +CONFIG_LOG_BACKEND_UART=y +CONFIG_LOG_BUFFER_SIZE=15360 +CONFIG_LOG_MODE_IMMEDIATE=y +#CONFIG_WOLFSSL_DEBUG=y + +# Entropy +CONFIG_TEST_RANDOM_GENERATOR=y +CONFIG_ENTROPY_GENERATOR=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y diff --git a/modules/wolfssl/samples/wolfssl_test/sample.yaml b/modules/wolfssl/samples/wolfssl_test/sample.yaml new file mode 100644 index 000000000000..50010f76ae3d --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_test/sample.yaml @@ -0,0 +1,21 @@ +sample: + description: wolfCrypt test sample app + name: wolfCrypt test +common: + harness: console + harness_config: + type: one_line + regex: + - "Exiting main with return code: 0" +tests: + sample.crypto.wolfssl_test: + timeout: 120 + platform_allow: qemu_x86 + integration_platforms: + - qemu_x86 + sample.crypto.wolfssl_test_no_malloc: + timeout: 120 + platform_allow: qemu_x86 + extra_args: CONF_FILE="prj-no-malloc.conf" + integration_platforms: + - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt new file mode 100644 index 000000000000..a1208f502937 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt @@ -0,0 +1,8 @@ +cmake_minimum_required(VERSION 3.13.1) +include($ENV{ZEPHYR_BASE}/cmake/app/boilerplate.cmake NO_POLICY_SCOPE) +project(wolfssl_tls_sock) + +FILE(GLOB app_sources src/*.c) +target_sources(app PRIVATE ${app_sources}) +add_definitions(-DWOLFSSL_USER_SETTINGS) + diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/README b/modules/wolfssl/samples/wolfssl_tls_sock/README new file mode 100644 index 000000000000..906a6c9bac81 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_sock/README @@ -0,0 +1,12 @@ + +wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use +under the GPLv2 or a standard commercial license. For our users who cannot use +wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. +Please contact wolfSSL Inc. directly at: + +Email: licensing@wolfssl.com +Phone: +1 425 245-8247 + +More information can be found on the wolfSSL website at www.wolfssl.com. + + diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh b/modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh new file mode 100755 index 000000000000..d32e6e8c99bd --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh @@ -0,0 +1,31 @@ +#!/bin/sh + +ZEPHYR_DIR= +if [ $# -ne 1 ]; then + echo "Need location of zephyr project as a command line argument" + exit 1 +else + ZEPHYR_DIR=$1 +fi +if [ ! -d $ZEPHR_DIR ]; then + echo "Zephyr project directory does not exist: $ZEPHYR_DIR" + exit 1 +fi +ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules +if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then + echo "Zephyr samples/module directory does not exist: $ZEPHYR_SAMPLES_DIR" + exit 1 +fi +ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_tls_sock + +echo "wolfSSL directory:" +echo " $ZEPHYR_WOLFSSL_DIR" +rm -rf $ZEPHYR_WOLFSSL_DIR +mkdir $ZEPHYR_WOLFSSL_DIR + +echo "Copy in Sample files ..." +cp -r * $ZEPHYR_WOLFSSL_DIR/ +rm $ZEPHYR_WOLFSSL_DIR/$0 + +echo "Done" + diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf b/modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf new file mode 100644 index 000000000000..830b1944dbc9 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf @@ -0,0 +1,57 @@ +# Kernel options +CONFIG_MAIN_STACK_SIZE=655360 +CONFIG_ENTROPY_GENERATOR=y +CONFIG_INIT_STACKS=y + +# General config +CONFIG_NEWLIB_LIBC=y + +# Pthreads +CONFIG_PTHREAD_IPC=y + +# Clock for time() +CONFIG_POSIX_CLOCK=y + +# Networking config +CONFIG_NETWORKING=y +CONFIG_NET_IPV4=y +CONFIG_NET_IPV6=n +CONFIG_NET_TCP=y +CONFIG_NET_SOCKETS=y +CONFIG_NET_SOCKETS_POSIX_NAMES=y + +CONFIG_NET_TEST=y +CONFIG_NET_LOOPBACK=y + +# Network driver config +CONFIG_TEST_RANDOM_GENERATOR=y + +# Network address config +CONFIG_NET_CONFIG_SETTINGS=y +CONFIG_NET_CONFIG_NEED_IPV4=y +CONFIG_NET_CONFIG_MY_IPV4_ADDR="192.0.2.1" +CONFIG_NET_CONFIG_PEER_IPV4_ADDR="192.0.2.2" +CONFIG_NET_CONFIG_MY_IPV4_GW="192.0.2.2" + +CONFIG_NET_PKT_TX_COUNT=10 + +# Network debug config +#CONFIG_NET_LOG=y +#CONFIG_NET_PKT_LOG_LEVEL_DBG=y + +# Logging +CONFIG_PRINTK=y +#CONFIG_WOLFSSL_DEBUG=y +CONFIG_LOG=y +CONFIG_LOG_MODE_IMMEDIATE=y + +# TLS configuration +CONFIG_WOLFSSL_SETTINGS_FILE="user_settings-no-malloc.h" +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_BUILTIN=y + +CONFIG_WOLFSSL_TLS_VERSION_1_2=y +CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y +CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y +CONFIG_WOLFSSL_MAC_ALL_ENABLED=y +CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/prj.conf b/modules/wolfssl/samples/wolfssl_tls_sock/prj.conf new file mode 100644 index 000000000000..549bc07ab0b0 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_sock/prj.conf @@ -0,0 +1,57 @@ +# Kernel options +CONFIG_MAIN_STACK_SIZE=16384 +CONFIG_ENTROPY_GENERATOR=y +CONFIG_INIT_STACKS=y +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=8192 + +# General config +CONFIG_NEWLIB_LIBC=y + +# Pthreads +CONFIG_PTHREAD_IPC=y + +# Clock for time() +CONFIG_POSIX_CLOCK=y + +# Networking config +CONFIG_NETWORKING=y +CONFIG_NET_IPV4=y +CONFIG_NET_IPV6=n +CONFIG_NET_TCP=y +CONFIG_NET_SOCKETS=y +CONFIG_NET_SOCKETS_POSIX_NAMES=y + +CONFIG_NET_TEST=y +CONFIG_NET_LOOPBACK=y + +# Network driver config +CONFIG_TEST_RANDOM_GENERATOR=y + +# Network address config +CONFIG_NET_CONFIG_SETTINGS=y +CONFIG_NET_CONFIG_NEED_IPV4=y +CONFIG_NET_CONFIG_MY_IPV4_ADDR="192.0.2.1" +CONFIG_NET_CONFIG_PEER_IPV4_ADDR="192.0.2.2" +CONFIG_NET_CONFIG_MY_IPV4_GW="192.0.2.2" + +CONFIG_NET_PKT_TX_COUNT=10 + +# Network debug config +#CONFIG_NET_LOG=y +#CONFIG_NET_PKT_LOG_LEVEL_DBG=y + +# Logging +CONFIG_PRINTK=y +#CONFIG_WOLFSSL_DEBUG=y +CONFIG_LOG=y +CONFIG_LOG_MODE_IMMEDIATE=y + +# TLS configuration +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_BUILTIN=y + +CONFIG_WOLFSSL_TLS_VERSION_1_3=y +CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y +CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y +CONFIG_WOLFSSL_MAC_ALL_ENABLED=y +CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml b/modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml new file mode 100644 index 000000000000..a1b26e879443 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml @@ -0,0 +1,23 @@ +sample: + description: wolfSSL TLS test application + name: wolfSSL TLS Test +common: + harness: console + harness_config: + type: multi_line + regex: + - "Server Return: 0" + - "Client Return: 0" + - "Done" +tests: + sample.crypto.wolfssl_tls_sock: + timeout: 60 + platform_allow: qemu_x86 + integration_platforms: + - qemu_x86 + sample.crypto.wolfssl_tls_sock_no_malloc: + timeout: 60 + platform_allow: qemu_x86 + extra_args: CONF_FILE="prj-no-malloc.conf" + integration_platforms: + - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c b/modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c new file mode 100644 index 000000000000..c25277820b16 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c @@ -0,0 +1,532 @@ +/* tls_sock.c + * + * Copyright (C) 2006-2023 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#ifndef WOLFSSL_USER_SETTINGS + #include +#endif +#include +#define USE_CERT_BUFFERS_2048 +#include +#include + +#ifdef WOLFSSL_ZEPHYR +#define printf printk +#endif + +#define BUFFER_SIZE 2048 +#define STATIC_MEM_SIZE (256*1024) +#define MAX_SEND_SIZE 256 + +#ifdef WOLFSSL_STATIC_MEMORY + static WOLFSSL_HEAP_HINT* HEAP_HINT_SERVER; + static WOLFSSL_HEAP_HINT* HEAP_HINT_CLIENT; + + static byte gMemoryServer[STATIC_MEM_SIZE]; + static byte gMemoryClient[STATIC_MEM_SIZE]; +#else + #define HEAP_HINT_SERVER NULL + #define HEAP_HINT_CLIENT NULL +#endif /* WOLFSSL_STATIC_MEMORY */ + +/* Application data to send. */ +static const char msgHTTPGet[] = "GET /index.html HTTP/1.0\r\n\r\n"; +static const char msgHTTPIndex[] = + "HTTP/1.1 200 OK\n" + "Content-Type: text/html\n" + "Connection: close\n" + "\n" + "\n" + "\n" + "Welcome to wolfSSL!\n" + "\n" + "\n" + "

wolfSSL has successfully performed handshake!

\n" + "\n" + "\n"; + +#ifdef HAVE_FIPS +static void myFipsCb(int ok, int err, const char* hash) +{ + printf("in my Fips callback, ok = %d, err = %d\n", ok, err); + printf("message = %s\n", wc_GetErrorString(err)); + printf("hash = %s\n", hash); + + if (err == IN_CORE_FIPS_E) { + printf("In core integrity hash check failure, copy above hash\n"); + printf("into verifyCore[] in fips_test.c and rebuild\n"); + } +} +#endif + +/* DO NOT use this in production. You should implement a way + * to get the current date. */ +static int verifyIgnoreDateError(int preverify, WOLFSSL_X509_STORE_CTX* store) +{ + if (store->error == ASN_BEFORE_DATE_E) + return 1; /* override error */ + else + return preverify; +} + +/* Create a new wolfSSL client with a server CA certificate. */ +static int wolfssl_client_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) +{ + int ret = 0; + WOLFSSL_CTX* client_ctx = NULL; + WOLFSSL* client_ssl = NULL; + + /* Create and initialize WOLFSSL_CTX */ + if ((client_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_client_method_ex(HEAP_HINT_CLIENT), + HEAP_HINT_CLIENT)) == NULL) { + printf("ERROR: failed to create WOLFSSL_CTX\n"); + ret = -1; + } + + if (ret == 0) { + /* Load client certificates into WOLFSSL_CTX */ + if (wolfSSL_CTX_load_verify_buffer_ex(client_ctx, ca_cert_der_2048, + sizeof_ca_cert_der_2048, WOLFSSL_FILETYPE_ASN1, 0, + /* DO NOT use this in production. You should + * implement a way to get the current date. */ + WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY) != + WOLFSSL_SUCCESS) { + printf("ERROR: failed to load CA certificate\n"); + ret = -1; + } + } + + if (ret == 0) { + /* Create a WOLFSSL object */ + if ((client_ssl = wolfSSL_new(client_ctx)) == NULL) { + printf("ERROR: failed to create WOLFSSL object\n"); + ret = -1; + } + } + + if (ret == 0) + wolfSSL_set_verify(client_ssl, + WOLFSSL_VERIFY_PEER|WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT, + verifyIgnoreDateError); + + if (ret == 0) { + /* Return newly created wolfSSL context and object */ + *ctx = client_ctx; + *ssl = client_ssl; + } + else { + if (client_ssl != NULL) + wolfSSL_free(client_ssl); + if (client_ctx != NULL) + wolfSSL_CTX_free(client_ctx); + } + + return ret; +} + +/* Client connecting to server using TLS */ +static int wolfssl_client_connect(WOLFSSL* ssl) +{ + int ret = 0; + + if (wolfSSL_connect(ssl) != WOLFSSL_SUCCESS) { + printf("wolfSSL Error: %d\n", wolfSSL_get_error(ssl, -1)); + if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) + ret = -1; + } + + return ret; +} + + + +/* Create a new wolfSSL server with a certificate for authentication. */ +static int wolfssl_server_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) +{ + int ret = 0; + WOLFSSL_CTX* server_ctx = NULL; + WOLFSSL* server_ssl = NULL; + + /* Create and initialize WOLFSSL_CTX */ + if ((server_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_server_method_ex(HEAP_HINT_SERVER), + HEAP_HINT_SERVER)) == NULL) { + printf("ERROR: failed to create WOLFSSL_CTX\n"); + ret = -1; + } + + if (ret == 0) { + /* Load client certificates into WOLFSSL_CTX */ + if (wolfSSL_CTX_use_certificate_buffer(server_ctx, + server_cert_der_2048, sizeof_server_cert_der_2048, + WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { + printf("ERROR: failed to load server certificate\n"); + ret = -1; + } + } + + if (ret == 0) { + /* Load client certificates into WOLFSSL_CTX */ + if (wolfSSL_CTX_use_PrivateKey_buffer(server_ctx, + server_key_der_2048, sizeof_server_key_der_2048, + WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { + printf("ERROR: failed to load server key\n"); + ret = -1; + } + } + + if (ret == 0) { + /* Create a WOLFSSL object */ + if ((server_ssl = wolfSSL_new(server_ctx)) == NULL) { + printf("ERROR: failed to create WOLFSSL object\n"); + ret = -1; + } + } + + if (ret == 0) + wolfSSL_set_verify(server_ssl, WOLFSSL_VERIFY_PEER, + verifyIgnoreDateError); + + if (ret == 0) { + /* Return newly created wolfSSL context and object */ + *ctx = server_ctx; + *ssl = server_ssl; + } + else { + if (server_ssl != NULL) + wolfSSL_free(server_ssl); + if (server_ctx != NULL) + wolfSSL_CTX_free(server_ctx); + } + + return ret; +} + +/* Server accepting a client using TLS */ +static int wolfssl_server_accept(WOLFSSL* ssl) +{ + int ret = 0; + + if (wolfSSL_accept(ssl) != WOLFSSL_SUCCESS) { + printf("wolfSSL Error: %d\n", wolfSSL_get_error(ssl, -1)); + if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) + ret = -1; + } + + return ret; +} + + +/* Send application data. */ +static int wolfssl_send(WOLFSSL* ssl, const char* msg) +{ + int ret = 0; + int len; + + printf("Sending:\n%s\n", msg); + len = wolfSSL_write(ssl, msg, XSTRLEN(msg)); + if (len < 0) + ret = len; + else if (len != XSTRLEN(msg)) + ret = -1; + + return ret; +} + +/* Receive application data. */ +static int wolfssl_recv(WOLFSSL* ssl) +{ + int ret; + byte reply[256]; + + ret = wolfSSL_read(ssl, reply, sizeof(reply)-1); + if (ret > 0) { + reply[ret] = '\0'; + printf("Received:\n%s\n", reply); + ret = 1; + } + else if (wolfSSL_want_read(ssl) || wolfSSL_want_write(ssl)) + ret = 0; + + return ret; +} + + +/* Free the WOLFSSL object and context. */ +static void wolfssl_free(WOLFSSL_CTX* ctx, WOLFSSL* ssl) +{ + if (ssl != NULL) + wolfSSL_free(ssl); + if (ctx != NULL) + wolfSSL_CTX_free(ctx); +} + + +/* Display the static memory usage. */ +static void wolfssl_memstats(WOLFSSL* ssl) +{ +#ifdef WOLFSSL_STATIC_MEMORY + WOLFSSL_MEM_CONN_STATS ssl_stats; + + XMEMSET(&ssl_stats, 0 , sizeof(ssl_stats)); + + if (wolfSSL_is_static_memory(ssl, &ssl_stats) != 1) + printf("static memory was not used with ssl"); + else { + printf("*** This is memory state before wolfSSL_free is called\n"); + printf("peak connection memory = %d\n", ssl_stats.peakMem); + printf("current memory in use = %d\n", ssl_stats.curMem); + printf("peak connection allocs = %d\n", ssl_stats.peakAlloc); + printf("current connection allocs = %d\n",ssl_stats.curAlloc); + printf("total connection allocs = %d\n",ssl_stats.totalAlloc); + printf("total connection frees = %d\n\n", ssl_stats.totalFr); + } +#else + (void)ssl; +#endif +} + +int wolfssl_server_accept_tcp(WOLFSSL* ssl, SOCKET_T* fd, SOCKET_T* acceptfd) +{ + int ret = 0; + SOCKET_T sockfd; + SOCKET_T clientfd = WOLFSSL_SOCKET_INVALID; + SOCKADDR_IN_T client; + socklen_t client_len = sizeof(client); + word16 port = 443; + struct sockaddr_in bind_addr; + + sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + bind_addr.sin_family = AF_INET; + bind_addr.sin_addr.s_addr = htonl(INADDR_ANY); + bind_addr.sin_port = htons(port); + if (bind(sockfd, (struct sockaddr *)&bind_addr, sizeof(bind_addr)) != 0) + ret = -1; + + if (ret == 0) { + *fd = sockfd; + printf("Server Listen\n"); + listen(sockfd, 5); + if (WOLFSSL_SOCKET_IS_INVALID(sockfd)) + ret = -1; + } + if (ret == 0) { + printf("Server Accept\n"); + clientfd = accept(sockfd, (struct sockaddr*)&client, + (ACCEPT_THIRD_T)&client_len); + if (WOLFSSL_SOCKET_IS_INVALID(clientfd)) + ret = -1; + } + if (ret == 0) { + *acceptfd = clientfd; + tcp_set_nonblocking(&clientfd); + + printf("Server has client\n"); + if (wolfSSL_set_fd(ssl, clientfd) != WOLFSSL_SUCCESS) + ret = -1; + } + + return ret; +} + +/* Thread to do the server operations. */ +void server_thread(void* arg1) +{ + int ret = 0; + WOLFSSL_CTX* server_ctx = NULL; + WOLFSSL* server_ssl = NULL; + SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID; + SOCKET_T clientfd = WOLFSSL_SOCKET_INVALID; + + +#ifdef WOLFSSL_STATIC_MEMORY + if (wc_LoadStaticMemory(&HEAP_HINT_SERVER, gMemoryServer, + sizeof(gMemoryServer), + WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { + printf("unable to load static memory"); + ret = -1; + } + + if (ret == 0) +#endif + ret = wolfssl_server_new(&server_ctx, &server_ssl); + + if (ret == 0) + ret = wolfssl_server_accept_tcp(server_ssl, &sockfd, &clientfd); + + while (ret == 0) { + k_sleep(Z_TIMEOUT_TICKS(100)); + ret = wolfssl_server_accept(server_ssl); + if (ret == 0 && wolfSSL_is_init_finished(server_ssl)) + break; + } + + /* Receive HTTP request */ + while (ret == 0) { + ret = wolfssl_recv(server_ssl); + } + if (ret == 1) + ret = 0; + /* Send HTTP response */ + if (ret == 0) + ret = wolfssl_send(server_ssl, msgHTTPIndex); + + printf("Server Return: %d\n", ret); + +#ifdef WOLFSSL_STATIC_MEMORY + printf("Server Memory Stats\n"); +#endif + wolfssl_memstats(server_ssl); + wolfssl_free(server_ctx, server_ssl); + if (clientfd != WOLFSSL_SOCKET_INVALID) + CloseSocket(clientfd); + if (sockfd != WOLFSSL_SOCKET_INVALID) + CloseSocket(sockfd); +} + +int wolfssl_client_connect_tcp(WOLFSSL* ssl, SOCKET_T* fd) +{ + int ret = 0; + SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID; + static struct addrinfo hints; + struct addrinfo* res; + + XMEMSET(&hints, 0, sizeof(hints)); + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_STREAM; + if (getaddrinfo("192.0.2.1", "443", &hints, &res) != 0) + ret = -1; + + if (ret == 0) { + printf("Client socket\n"); + sockfd = socket(res->ai_family, res->ai_socktype, res->ai_protocol); + if (WOLFSSL_SOCKET_IS_INVALID(sockfd)) + ret = -1; + } + if (ret == 0) { + *fd = sockfd; + tcp_set_nonblocking(&sockfd); + + printf("Client Connect\n"); + if (connect(sockfd, res->ai_addr, res->ai_addrlen) != 0) + ret = -1; + } + + if (ret == 0) { + printf("Client Connected\n"); + if (wolfSSL_set_fd(ssl, sockfd) != WOLFSSL_SUCCESS) + ret = -1; + } + + return ret; +} + +/* Thread to do the client operations. */ +void client_thread() +{ + int ret = 0; + WOLFSSL_CTX* client_ctx = NULL; + WOLFSSL* client_ssl = NULL; + SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID; + + /* Client connection */ + ret = wolfssl_client_new(&client_ctx, &client_ssl); + + if (ret == 0) + ret = wolfssl_client_connect_tcp(client_ssl, &sockfd); + + while (ret == 0) { + k_sleep(Z_TIMEOUT_TICKS(10)); + ret = wolfssl_client_connect(client_ssl); + if (ret == 0 && wolfSSL_is_init_finished(client_ssl)) + break; + } + + if (ret == 0) { + printf("Handshake complete\n"); + + /* Send HTTP request */ + ret = wolfssl_send(client_ssl, msgHTTPGet); + } + /* Receive HTTP response */ + while (ret == 0) { + k_sleep(Z_TIMEOUT_TICKS(10)); + ret = wolfssl_recv(client_ssl); + } + if (ret == 1) + ret = 0; + + printf("Client Return: %d\n", ret); + +#ifdef WOLFSSL_STATIC_MEMORY + printf("Client Memory Stats\n"); +#endif + wolfssl_memstats(client_ssl); + wolfssl_free(client_ctx, client_ssl); + if (sockfd != WOLFSSL_SOCKET_INVALID) + CloseSocket(sockfd); +} + +int main() +{ + THREAD_TYPE serverThread; + +#ifdef HAVE_FIPS + wolfCrypt_SetCb_fips(myFipsCb); +#endif + wolfSSL_Init(); +#ifdef DEBUG_WOLFSSL + wolfSSL_Debugging_ON(); +#endif + +#ifdef WOLFSSL_STATIC_MEMORY + if (wc_LoadStaticMemory(&HEAP_HINT_CLIENT, gMemoryClient, + sizeof(gMemoryClient), + WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { + printf("unable to load static memory"); + return -1; + } + + wolfsslThreadHeapHint = HEAP_HINT_CLIENT; +#endif + + /* Start server */ + if (wolfSSL_NewThread(&serverThread, server_thread, NULL) != 0) { + printf("Failed to start server thread\n"); + return -1; + } + + k_sleep(Z_TIMEOUT_TICKS(100)); + client_thread(); + /* Join is not working in qemu when the thread is still active. Wait for it + * to shut down to join it. */ + k_sleep(Z_TIMEOUT_TICKS(100)); + + if (wolfSSL_JoinThread(serverThread) != 0) { + printf("Failed to join server thread\n"); + return -1; + } + + wolfSSL_Cleanup(); + + printf("Done\n"); + + return 0; +} + diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt new file mode 100644 index 000000000000..55c2199ec565 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt @@ -0,0 +1,8 @@ +cmake_minimum_required(VERSION 3.13.1) +find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE}) +project(wolfssl_tls_threaded) + +FILE(GLOB app_sources src/*.c) +target_sources(app PRIVATE ${app_sources}) +add_definitions(-DWOLFSSL_USER_SETTINGS) + diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/README b/modules/wolfssl/samples/wolfssl_tls_thread/README new file mode 100644 index 000000000000..906a6c9bac81 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/README @@ -0,0 +1,12 @@ + +wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use +under the GPLv2 or a standard commercial license. For our users who cannot use +wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. +Please contact wolfSSL Inc. directly at: + +Email: licensing@wolfssl.com +Phone: +1 425 245-8247 + +More information can be found on the wolfSSL website at www.wolfssl.com. + + diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf b/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf new file mode 100644 index 000000000000..98d8bc49632a --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf @@ -0,0 +1,22 @@ +# Set user_settings.h file to be used for native wolfSSL build settings +#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" + +##### PSA and CC3XX ##### +# Enable Nordic Security Module +CONFIG_NRF_SECURITY=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y +# Enable PSA API support (comes from mbedTLS) +CONFIG_MBEDTLS_PSA_CRYPTO_C=y +# Enable/configure mbedTLS heap +CONFIG_MBEDTLS_ENABLE_HEAP=y +CONFIG_MBEDTLS_HEAP_SIZE=8192 +# Disable nrf_oberon crypto library PSA backend +CONFIG_PSA_CRYPTO_DRIVER_OBERON=n +# Enable ARM CryptoCell cc3xx driver PSA backend +CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +##### Logging ##### +CONFIG_USE_SEGGER_RTT=y +CONFIG_LOG_BACKEND_RTT=y +CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 + diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf new file mode 100644 index 000000000000..aa3bbe18ad3b --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf @@ -0,0 +1,25 @@ +CONFIG_BUILD_WITH_TFM=y +CONFIG_TFM_PROFILE_TYPE_NOT_SET=y + +# Set user_settings.h file to be used for native wolfSSL build settings +#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" + +##### PSA and CC3XX ##### +# Enable Nordic Security Module +CONFIG_NRF_SECURITY=y +CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y +# Enable PSA API support (comes from mbedTLS) +CONFIG_MBEDTLS_PSA_CRYPTO_C=y +# Enable/configure mbedTLS heap +CONFIG_MBEDTLS_ENABLE_HEAP=y +CONFIG_MBEDTLS_HEAP_SIZE=8192 +# Disable nrf_oberon crypto library PSA backend +CONFIG_PSA_CRYPTO_DRIVER_OBERON=n +# Enable ARM CryptoCell cc3xx driver PSA backend +CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y + +##### Logging ##### +CONFIG_USE_SEGGER_RTT=y +CONFIG_LOG_BACKEND_RTT=y +CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 + diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh b/modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh new file mode 100755 index 000000000000..210821f753c7 --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh @@ -0,0 +1,31 @@ +#!/bin/sh + +ZEPHYR_DIR= +if [ $# -ne 1 ]; then + echo "Need location of zephyr project as a command line argument" + exit 1 +else + ZEPHYR_DIR=$1 +fi +if [ ! -d $ZEPHR_DIR ]; then + echo "Zephyr project directory does not exist: $ZEPHYR_DIR" + exit 1 +fi +ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules +if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then + echo "Zephyr samples/modules directory does not exist: $ZEPHYR_SAMPLES_DIR" + exit 1 +fi +ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_tls_thread + +echo "wolfSSL directory:" +echo " $ZEPHYR_WOLFSSL_DIR" +rm -rf $ZEPHYR_WOLFSSL_DIR +mkdir $ZEPHYR_WOLFSSL_DIR + +echo "Copy in Sample files ..." +cp -r * $ZEPHYR_WOLFSSL_DIR/ +rm $ZEPHYR_WOLFSSL_DIR/$0 + +echo "Done" + diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/prj.conf b/modules/wolfssl/samples/wolfssl_tls_thread/prj.conf new file mode 100644 index 000000000000..185a7b24c07b --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/prj.conf @@ -0,0 +1,43 @@ +# Kernel options +CONFIG_MAIN_STACK_SIZE=16384 +CONFIG_ENTROPY_GENERATOR=y +CONFIG_TEST_RANDOM_GENERATOR=y +CONFIG_INIT_STACKS=y +CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=131072 + +# Pthreads +CONFIG_PTHREAD_IPC=y + +# Clock for time() +CONFIG_POSIX_CLOCK=y + +# Networking +CONFIG_NETWORKING=y +CONFIG_NET_TEST=y +CONFIG_NET_IPV4=y +CONFIG_NET_IPV6=y +CONFIG_NET_SOCKETS=y +CONFIG_DNS_RESOLVER=y + +# Logging +CONFIG_PRINTK=y +CONFIG_LOG=y +CONFIG_LOG_MODE_IMMEDIATE=y +CONFIG_WOLFSSL_DEBUG=y + +# Enable logging using RTT and UART +#CONFIG_CBPRINTF_LIBC_SUBSTS=y +#CONFIG_CBPRINTF_FP_SUPPORT=y +#CONFIG_CONSOLE=y +#CONFIG_LOG_BACKEND_UART=y +#CONFIG_LOG_BUFFER_SIZE=15360 + +# TLS configuration +CONFIG_WOLFSSL=y +CONFIG_WOLFSSL_BUILTIN=y + +CONFIG_WOLFSSL_TLS_VERSION_1_3=y +CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y +CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y +CONFIG_WOLFSSL_MAC_ALL_ENABLED=y +CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml b/modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml new file mode 100644 index 000000000000..270648b60d4f --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml @@ -0,0 +1,18 @@ +sample: + description: wolfSSL TLS test application + name: wolfSSL TLS Test +common: + harness: console + harness_config: + type: multi_line + regex: + - "Server Return: 0" + - "Server Error: 0" + - "Client Return: 0" + - "Client Error: 0" +tests: + sample.crypto.wolfssl_tls_thread: + timeout: 60 + platform_allow: qemu_x86 + integration_platforms: + - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c b/modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c new file mode 100644 index 000000000000..cd7aad9016ea --- /dev/null +++ b/modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c @@ -0,0 +1,671 @@ +/* tls_threaded.c + * + * Copyright (C) 2006-2023 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#ifndef WOLFSSL_USER_SETTINGS + #include +#endif +#include +#include +#define USE_CERT_BUFFERS_256 +#include +#include + +#ifdef WOLFSSL_ZEPHYR +#define printf printk +#endif + +/* wolfSSL PSA Crypto API integration with ECDH/ECDSA currently requires + * use of wolfSSL Public Key (PK) callbacks. + * + * PSA Crypto API integration for this sample was tested on a + * Nordic nRF5340dk. + */ +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + #include +#endif + +#define BUFFER_SIZE 2048 +#define STATIC_MEM_SIZE (192*1024) + +#ifdef WOLFSSL_STATIC_MEMORY + static WOLFSSL_HEAP_HINT* HEAP_HINT_SERVER; + static WOLFSSL_HEAP_HINT* HEAP_HINT_CLIENT; + + static byte gMemoryServer[STATIC_MEM_SIZE]; + static byte gMemoryClient[STATIC_MEM_SIZE]; +#else + #define HEAP_HINT_SERVER NULL + #define HEAP_HINT_CLIENT NULL +#endif /* WOLFSSL_STATIC_MEMORY */ + +/* Buffer to hold data for client to read. */ +unsigned char client_buffer[BUFFER_SIZE]; +int client_buffer_sz = 0; +wolfSSL_Mutex client_mutex; + +/* Buffer to hold data for server to read. */ +unsigned char server_buffer[BUFFER_SIZE]; +int server_buffer_sz = 0; +wolfSSL_Mutex server_mutex; + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) +static struct psa_ssl_ctx server_psa_ctx; +static struct psa_ssl_ctx client_psa_ctx; +/* psa_key_id_t representing server key loaded into PSA Crypto API */ +static psa_key_id_t ecc_key_id; +#endif + +/* Application data to send. */ +static const char msgHTTPGet[] = "GET /index.html HTTP/1.0\r\n\r\n"; +static const char msgHTTPIndex[] = + "HTTP/1.1 200 OK\n" + "Content-Type: text/html\n" + "Connection: close\n" + "\n" + "\n" + "\n" + "Welcome to wolfSSL!\n" + "\n" + "\n" + "

wolfSSL has successfully performed handshake!

\n" + "\n" + "\n"; + +#ifdef HAVE_FIPS +static void myFipsCb(int ok, int err, const char* hash) +{ + printf("in my Fips callback, ok = %d, err = %d\n", ok, err); + printf("message = %s\n", wc_GetErrorString(err)); + printf("hash = %s\n", hash); + + if (err == IN_CORE_FIPS_E) { + printf("In core integrity hash check failure, copy above hash\n"); + printf("into verifyCore[] in fips_test.c and rebuild\n"); + } +} +#endif + +/* wolfSSL client wants to read data from the server. */ +static int recv_client(WOLFSSL* ssl, char* buff, int sz, void* ctx) +{ + wc_LockMutex(&client_mutex); + if (client_buffer_sz > 0) { + /* Take as many bytes is available or requested from buffer. */ + if (sz > client_buffer_sz) + sz = client_buffer_sz; + XMEMCPY(buff, client_buffer, sz); + if (sz < client_buffer_sz) { + XMEMMOVE(client_buffer, client_buffer + sz, client_buffer_sz - sz); + } + client_buffer_sz -= sz; + } + else + sz = WOLFSSL_CBIO_ERR_WANT_READ; + wc_UnLockMutex(&client_mutex); + + return sz; +} + +/* wolfSSL client wants to write data to the server. */ +static int send_client(WOLFSSL* ssl, char* buff, int sz, void* ctx) +{ + wc_LockMutex(&server_mutex); + if (server_buffer_sz < BUFFER_SIZE) + { + /* Put in as many bytes requested or will fit in buffer. */ + if (sz > BUFFER_SIZE - server_buffer_sz) + sz = BUFFER_SIZE - server_buffer_sz; + XMEMCPY(server_buffer + server_buffer_sz, buff, sz); + server_buffer_sz += sz; + } + else + sz = WOLFSSL_CBIO_ERR_WANT_WRITE; + wc_UnLockMutex(&server_mutex); + + return sz; +} + +/* wolfSSL server wants to read data from the client. */ +static int recv_server(WOLFSSL* ssl, char* buff, int sz, void* ctx) +{ + wc_LockMutex(&server_mutex); + if (server_buffer_sz > 0) { + /* Take as many bytes is available or requested from buffer. */ + if (sz > server_buffer_sz) + sz = server_buffer_sz; + XMEMCPY(buff, server_buffer, sz); + if (sz < server_buffer_sz) { + XMEMMOVE(server_buffer, server_buffer + sz, server_buffer_sz - sz); + } + server_buffer_sz -= sz; + } + else + sz = WOLFSSL_CBIO_ERR_WANT_READ; + wc_UnLockMutex(&server_mutex); + + return sz; +} + +/* wolfSSL server wants to write data to the client. */ +static int send_server(WOLFSSL* ssl, char* buff, int sz, void* ctx) +{ + wc_LockMutex(&client_mutex); + if (client_buffer_sz < BUFFER_SIZE) + { + /* Put in as many bytes requested or will fit in buffer. */ + if (sz > BUFFER_SIZE - client_buffer_sz) + sz = BUFFER_SIZE - client_buffer_sz; + XMEMCPY(client_buffer + client_buffer_sz, buff, sz); + client_buffer_sz += sz; + } + else + sz = WOLFSSL_CBIO_ERR_WANT_WRITE; + wc_UnLockMutex(&client_mutex); + + return sz; +} + +/* DO NOT use this in production. You should implement a way + * to get the current date. */ +static int verifyIgnoreDateError(int preverify, WOLFSSL_X509_STORE_CTX* store) +{ + if (store->error == ASN_BEFORE_DATE_E) + return 1; /* override error */ + else + return preverify; +} + +/* Create a new wolfSSL client with a server CA certificate. */ +static int wolfssl_client_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) +{ + int ret = 0; + WOLFSSL_CTX* client_ctx = NULL; + WOLFSSL* client_ssl = NULL; + + /* Create and initialize WOLFSSL_CTX */ + if ((client_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_client_method(), + HEAP_HINT_CLIENT)) == NULL) { + printf("ERROR: failed to create WOLFSSL_CTX\n"); + ret = -1; + } + + if (ret == 0) { + /* Load client certificates into WOLFSSL_CTX */ + if (wolfSSL_CTX_load_verify_buffer_ex(client_ctx, ca_ecc_cert_der_256, + sizeof_ca_ecc_cert_der_256, WOLFSSL_FILETYPE_ASN1, 0, + /* DO NOT use this in production. You should + * implement a way to get the current date. */ + WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY) != + WOLFSSL_SUCCESS) { + printf("ERROR: failed to load CA certificate\n"); + ret = -1; + } + } + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + if (ret == 0) { + if (wolfSSL_CTX_psa_enable(client_ctx) != WOLFSSL_SUCCESS) { + printf("ERROR: failed to enable PSA Crypto API for WOLFSSL_CTX\n"); + ret = -1; + } + } +#endif + + if (ret == 0) { + /* Register callbacks */ + wolfSSL_SetIORecv(client_ctx, recv_client); + wolfSSL_SetIOSend(client_ctx, send_client); + + /* Create a WOLFSSL object */ + if ((client_ssl = wolfSSL_new(client_ctx)) == NULL) { + printf("ERROR: failed to create WOLFSSL object\n"); + ret = -1; + } + } + + if (ret == 0) + wolfSSL_set_verify(client_ssl, + WOLFSSL_VERIFY_PEER|WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT, + verifyIgnoreDateError); + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + if (ret == 0) { + XMEMSET(&client_psa_ctx, 0, sizeof(client_psa_ctx)); + if (wolfSSL_set_psa_ctx(client_ssl, &client_psa_ctx) != WOLFSSL_SUCCESS) { + printf("ERROR: wolfSSL_set_psa_ctx() failed\n"); + ret = -1; + } + } +#endif + + if (ret == 0) { + /* make wolfSSL object nonblocking */ + wolfSSL_set_using_nonblock(client_ssl, 1); + + /* Return newly created wolfSSL context and object */ + *ctx = client_ctx; + *ssl = client_ssl; + } + else { + if (client_ssl != NULL) { +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + wolfSSL_free_psa_ctx(&client_psa_ctx); +#endif + wolfSSL_free(client_ssl); + } + if (client_ctx != NULL) + wolfSSL_CTX_free(client_ctx); + } + + return ret; +} + +/* Client connecting to server using TLS */ +static int wolfssl_client_connect(WOLFSSL* ssl) +{ + int ret = 0; + + if (wolfSSL_connect(ssl) != WOLFSSL_SUCCESS) { + if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) + ret = -1; + } + + return ret; +} + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + +/* ./certs/ecc-key.pem */ +static const unsigned char ecc_key_256[] = +{ + 0x45, 0xB6, 0x69, 0x02, 0x73, 0x9C, 0x6C, 0x85, 0xA1, 0x38, + 0x5B, 0x72, 0xE8, 0xE8, 0xC7, 0xAC, 0xC4, 0x03, 0x8D, 0x53, + 0x35, 0x04, 0xFA, 0x6C, 0x28, 0xDC, 0x34, 0x8D, 0xE1, 0xA8, + 0x09, 0x8C +}; + +/* Provision server private key using PSA Crypto API. + * + * key_id - resulting psa_key_id_t + * + * Returns - 0 on success, negative on error + */ +static int psa_private_key_provisioning(psa_key_id_t *key_id) +{ + psa_key_attributes_t key_attr = { 0 }; + psa_key_type_t key_type; + psa_status_t status; + + key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1); + + psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_SIGN_HASH); + psa_set_key_lifetime(&key_attr, PSA_KEY_LIFETIME_VOLATILE); + psa_set_key_algorithm(&key_attr, PSA_ALG_ECDSA(PSA_ALG_SHA_256)); + psa_set_key_type(&key_attr, key_type); + psa_set_key_bits(&key_attr, 256); + + status = psa_import_key(&key_attr, ecc_key_256, + sizeof(ecc_key_256), key_id); + + if (status != PSA_SUCCESS) { + printf("ERROR: provisioning of private key failed: [%d] \n", status); + return -1; + } + + return 0; +} + +#endif /* WOLFSSL_HAVE_PSA & HAVE_PK_CALLBACKS */ + +/* Create a new wolfSSL server with a certificate for authentication. */ +static int wolfssl_server_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) +{ + int ret = 0; + WOLFSSL_CTX* server_ctx = NULL; + WOLFSSL* server_ssl = NULL; + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + /* Provision ECC private key with PSA Crypto API */ + if (psa_private_key_provisioning(&ecc_key_id) != 0) { + printf("ERROR: failed to provision PSA private key\n"); + ret = -1; + } + + if (ret == 0) { + XMEMSET(&server_psa_ctx, 0, sizeof(server_psa_ctx)); + wolfSSL_psa_set_private_key_id(&server_psa_ctx, ecc_key_id); + } +#endif + + if (ret == 0) { + /* Create and initialize WOLFSSL_CTX */ + if ((server_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_server_method(), + HEAP_HINT_SERVER)) == NULL) { + printf("ERROR: failed to create WOLFSSL_CTX\n"); + ret = -1; + } + } + + if (ret == 0) { + /* Load client certificates into WOLFSSL_CTX */ + if (wolfSSL_CTX_use_certificate_buffer(server_ctx, + serv_ecc_der_256, sizeof_serv_ecc_der_256, + WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { + printf("ERROR: failed to load server certificate\n"); + ret = -1; + } + } + +#if !defined(WOLFSSL_HAVE_PSA) || \ + (defined(WOLFSSL_HAVE_PSA) && !defined(HAVE_PK_CALLBACKS)) + if (ret == 0) { + /* Load client certificates into WOLFSSL_CTX */ + if (wolfSSL_CTX_use_PrivateKey_buffer(server_ctx, + ecc_key_der_256, sizeof_ecc_key_der_256, + WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { + printf("ERROR: failed to load server key\n"); + ret = -1; + } + } +#else + if (ret == 0) { + if (wolfSSL_CTX_psa_enable(server_ctx) != WOLFSSL_SUCCESS) { + printf("ERROR: failed to enable PSA\n"); + ret = -1; + } + } +#endif /* WOLFSSL_HAVE_PSA */ + + if (ret == 0) { + /* Register callbacks */ + wolfSSL_SetIORecv(server_ctx, recv_server); + wolfSSL_SetIOSend(server_ctx, send_server); + + /* Create a WOLFSSL object */ + if ((server_ssl = wolfSSL_new(server_ctx)) == NULL) { + printf("ERROR: failed to create WOLFSSL object\n"); + ret = -1; + } + } + + if (ret == 0) + wolfSSL_set_verify(server_ssl, WOLFSSL_VERIFY_PEER, + verifyIgnoreDateError); + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + if (ret == 0) { + if (wolfSSL_set_psa_ctx(server_ssl, &server_psa_ctx) + != WOLFSSL_SUCCESS) { + printf("ERROR: failed to enable PSA in WOLFSSL struct\n"); + ret = -1; + } + } +#endif + + if (ret == 0) { + /* make wolfSSL object nonblocking */ + wolfSSL_set_using_nonblock(server_ssl, 1); + + /* Return newly created wolfSSL context and object */ + *ctx = server_ctx; + *ssl = server_ssl; + } + else { + if (server_ssl != NULL) { +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + wolfSSL_free_psa_ctx(&server_psa_ctx); +#endif + wolfSSL_free(server_ssl); + } + if (server_ctx != NULL) + wolfSSL_CTX_free(server_ctx); + } + + return ret; +} + +/* Server accepting a client using TLS */ +static int wolfssl_server_accept(WOLFSSL* ssl) +{ + int ret = 0; + + if (wolfSSL_accept(ssl) != WOLFSSL_SUCCESS) { + if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) + ret = -1; + } + + return ret; +} + + +/* Send application data. */ +static int wolfssl_send(WOLFSSL* ssl, const char* msg) +{ + int ret = 0; + int len; + + printf("Sending:\n%s\n", msg); + len = wolfSSL_write(ssl, msg, XSTRLEN(msg)); + if (len < 0) + ret = len; + else if (len != XSTRLEN(msg)) + ret = -1; + + return ret; +} + +/* Receive application data. */ +static int wolfssl_recv(WOLFSSL* ssl) +{ + int ret; + byte reply[256]; + + ret = wolfSSL_read(ssl, reply, sizeof(reply)-1); + if (ret > 0) { + reply[ret] = '\0'; + printf("Received:\n%s\n", reply); + ret = 1; + } + else if (wolfSSL_want_read(ssl) || wolfSSL_want_write(ssl)) + ret = 0; + + return ret; +} + + +/* Free the WOLFSSL object and context. */ +static void wolfssl_free(WOLFSSL_CTX* ctx, WOLFSSL* ssl) +{ + if (ssl != NULL) + wolfSSL_free(ssl); + if (ctx != NULL) + wolfSSL_CTX_free(ctx); +} + + +/* Display the static memory usage. */ +static void wolfssl_memstats(WOLFSSL* ssl) +{ +#ifdef WOLFSSL_STATIC_MEMORY + WOLFSSL_MEM_CONN_STATS ssl_stats; + + XMEMSET(&ssl_stats, 0 , sizeof(ssl_stats)); + + if (wolfSSL_is_static_memory(ssl, &ssl_stats) != 1) + printf("static memory was not used with ssl"); + else { + printf("*** This is memory state before wolfSSL_free is called\n"); + printf("peak connection memory = %d\n", ssl_stats.peakMem); + printf("current memory in use = %d\n", ssl_stats.curMem); + printf("peak connection allocs = %d\n", ssl_stats.peakAlloc); + printf("current connection allocs = %d\n",ssl_stats.curAlloc); + printf("total connection allocs = %d\n",ssl_stats.totalAlloc); + printf("total connection frees = %d\n\n", ssl_stats.totalFr); + } +#else + (void)ssl; +#endif +} + +/* Thread to do the server operations. */ +void server_thread(void* arg1) +{ + int ret = 0; + WOLFSSL_CTX* server_ctx = NULL; + WOLFSSL* server_ssl = NULL; + +#ifdef WOLFSSL_STATIC_MEMORY + if (wc_LoadStaticMemory(&HEAP_HINT_SERVER, gMemoryServer, + sizeof(gMemoryServer), + WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { + printf("unable to load static memory"); + ret = -1; + } + + if (ret == 0) +#endif + ret = wolfssl_server_new(&server_ctx, &server_ssl); + + while (ret == 0) { + ret = wolfssl_server_accept(server_ssl); + if (ret == 0 && wolfSSL_is_init_finished(server_ssl)) + break; + } + + /* Receive HTTP request */ + while (ret == 0) { + ret = wolfssl_recv(server_ssl); + } + if (ret == 1) + ret = 0; + /* Send HTTP response */ + if (ret == 0) + ret = wolfssl_send(server_ssl, msgHTTPIndex); + + printf("Server Return: %d\n", ret); + printf("Server Error: %d\n", wolfSSL_get_error(server_ssl, ret)); + +#ifdef WOLFSSL_STATIC_MEMORY + printf("Server Memory Stats\n"); +#endif + wolfssl_memstats(server_ssl); + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + if (server_ssl != NULL) { + wolfSSL_free_psa_ctx(&server_psa_ctx); + } +#endif + wolfssl_free(server_ctx, server_ssl); +} + +int main() +{ + int ret = 0; + WOLFSSL_CTX* client_ctx = NULL; + WOLFSSL* client_ssl = NULL; + THREAD_TYPE serverThread; + + /* set dummy wallclock time for cert validation without NTP/etc */ + struct timespec utctime; + utctime.tv_sec = 1658510212; /* Friday, July 22, 2022 5:16:52 PM GMT */ + utctime.tv_nsec = 0; + clock_settime(CLOCK_REALTIME, &utctime); + +#ifdef HAVE_FIPS + wolfCrypt_SetCb_fips(myFipsCb); +#endif + wolfSSL_Init(); +#ifdef DEBUG_WOLFSSL + wolfSSL_Debugging_ON(); +#endif + + wc_InitMutex(&client_mutex); + wc_InitMutex(&server_mutex); + + /* Start server */ + if (wolfSSL_NewThread(&serverThread, server_thread, NULL) != 0) { + printf("Failed to start server thread\n"); + return -1; + } + +#ifdef WOLFSSL_STATIC_MEMORY + if (wc_LoadStaticMemory(&HEAP_HINT_CLIENT, gMemoryClient, + sizeof(gMemoryClient), + WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { + printf("unable to load static memory"); + ret = -1; + } + + if (ret == 0) +#endif + { + /* Client connection */ + ret = wolfssl_client_new(&client_ctx, &client_ssl); + } + + while (ret == 0) { + ret = wolfssl_client_connect(client_ssl); + if (ret == 0 && wolfSSL_is_init_finished(client_ssl)) + break; + k_sleep(Z_TIMEOUT_TICKS(10)); + } + + if (ret == 0) { + printf("Handshake complete\n"); + + /* Send HTTP request */ + ret = wolfssl_send(client_ssl, msgHTTPGet); + } + /* Receive HTTP response */ + while (ret == 0) { + k_sleep(Z_TIMEOUT_TICKS(10)); + ret = wolfssl_recv(client_ssl); + } + if (ret == 1) + ret = 0; + + printf("Client Return: %d\n", ret); + printf("Client Error: %d\n", wolfSSL_get_error(client_ssl, ret)); + + if (wolfSSL_JoinThread(serverThread) != 0) { + printf("Failed to join server thread\n"); + return -1; + } + +#ifdef WOLFSSL_STATIC_MEMORY + printf("Client Memory Stats\n"); +#endif + wolfssl_memstats(client_ssl); + +#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) + if (client_ssl != NULL) { + wolfSSL_free_psa_ctx(&client_psa_ctx); + } +#endif + wolfssl_free(client_ctx, client_ssl); + + wolfSSL_Cleanup(); + + printf("Done\n"); + + return (ret == 0) ? 0 : 1; +} + diff --git a/modules/wolfssl/user_settings-no-malloc.h b/modules/wolfssl/user_settings-no-malloc.h new file mode 100644 index 000000000000..5a5ca131c71b --- /dev/null +++ b/modules/wolfssl/user_settings-no-malloc.h @@ -0,0 +1,170 @@ +/* user_settings-tls-generic.h + * generated from configure options + * + * Copyright (C) 2006-2023 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#ifndef WOLFSSL_OPTIONS_H +#define WOLFSSL_OPTIONS_H + + +#ifdef __cplusplus +extern "C" { +#endif + +#if 0 +#undef SINGLE_THREADED +#define SINGLE_THREADED +#endif + +#undef TFM_TIMING_RESISTANT +#define TFM_TIMING_RESISTANT + +#undef ECC_TIMING_RESISTANT +#define ECC_TIMING_RESISTANT + +#undef WC_RSA_BLINDING +#define WC_RSA_BLINDING + +#undef HAVE_AESGCM +#define HAVE_AESGCM + +#undef WOLFSSL_SHA512 +#define WOLFSSL_SHA512 + +#undef WOLFSSL_SHA384 +#define WOLFSSL_SHA384 + +#undef NO_DSA +#define NO_DSA + +#undef HAVE_ECC +#define HAVE_ECC + +#undef TFM_ECC256 +#define TFM_ECC256 + +#undef WOLFSSL_BASE64_ENCODE +#define WOLFSSL_BASE64_ENCODE + +#undef NO_RC4 +#define NO_RC4 + +#undef WOLFSSL_SHA224 +#define WOLFSSL_SHA224 + +#undef WOLFSSL_SHA3 +#define WOLFSSL_SHA3 + +#undef HAVE_POLY1305 +#define HAVE_POLY1305 + +#undef HAVE_ONE_TIME_AUTH +#define HAVE_ONE_TIME_AUTH + +#undef HAVE_CHACHA +#define HAVE_CHACHA + +#undef HAVE_HASHDRBG +#define HAVE_HASHDRBG + +#undef NO_FILESYSTEM +#define NO_FILESYSTEM + +#undef HAVE_TLS_EXTENSIONS +#define HAVE_TLS_EXTENSIONS + +#undef HAVE_SUPPORTED_CURVES +#define HAVE_SUPPORTED_CURVES + +#undef HAVE_EXTENDED_MASTER +#define HAVE_EXTENDED_MASTER + +#undef NO_PSK +#define NO_PSK + +#undef NO_MD4 +#define NO_MD4 + +#undef USE_FAST_MATH +#define USE_FAST_MATH + +#undef WOLFSSL_NO_ASM +#define WOLFSSL_NO_ASM + +#undef WOLFSSL_X86_BUILD +#define WOLFSSL_X86_BUILD + +#undef WC_NO_ASYNC_THREADING +#define WC_NO_ASYNC_THREADING + +#undef WOLFSSL_STATIC_MEMORY +#define WOLFSSL_STATIC_MEMORY + +#undef WOLFSSL_TLS13 +#define WOLFSSL_TLS13 + +#undef HAVE_HKDF +#define HAVE_HKDF + +#undef WC_RSA_PSS +#define WC_RSA_PSS + +#undef HAVE_FFDHE_2048 +#define HAVE_FFDHE_2048 + +#undef WOLFSSL_NO_MALLOC +#define WOLFSSL_NO_MALLOC +//#define WOLFSSL_DEBUG_STATIC_MEMORY +//#define WOLFSSL_DEBUG_MEMORY_PRINT +//#define WOLFSSL_DEBUG_MEMORY +//#define WOLFSSL_TRACK_MEMORY +#define LARGEST_MEM_BUCKET 65536 + +#undef WOLFSSL_DYN_CERT +#define WOLFSSL_DYN_CERT + +#undef WOLFSSL_CERT_GEN +#define WOLFSSL_CERT_GEN + +#undef WOLFSSL_CERT_REQ +#define WOLFSSL_CERT_REQ + +#undef HAVE_PKCS12 +#define HAVE_PKCS12 + +#undef WOLFSSL_TLS13 +#define WOLFSSL_TLS13 + +#if 0 +#undef WOLFSSL_HAVE_SP_RSA +#define WOLFSSL_HAVE_SP_RSA +#undef WOLFSSL_HAVE_SP_DH +#define WOLFSSL_HAVE_SP_DH +#undef WOLFSSL_HAVE_SP_ECC +#define WOLFSSL_HAVE_SP_ECC +#endif + +#ifdef __cplusplus +} +#endif + + +#endif /* WOLFSSL_OPTIONS_H */ + diff --git a/modules/wolfssl/user_settings.h b/modules/wolfssl/user_settings.h new file mode 100644 index 000000000000..68266da5f010 --- /dev/null +++ b/modules/wolfssl/user_settings.h @@ -0,0 +1,462 @@ +/* user_settings.h + * + * Copyright (C) 2006-2024 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#ifndef USER_SETTINGS_H +#define USER_SETTINGS_H + +#ifdef CONFIG_WOLFSSL + +/* If a custom user_settings file is provided use it instead. + * CONFIG_WOLFSSL_SETTINGS_FILE is always defined. If it is not explicitly set + * in prj.conf then it is auto-defined to "". This obviously causes issues here. + * That is why we define WOLFSSL_SETTINGS_FILE in CMakeLists.txt. */ +#ifdef WOLFSSL_SETTINGS_FILE +#include WOLFSSL_SETTINGS_FILE +#else + +#ifdef __cplusplus +extern "C" { +#endif + + +/* ------------------------------------------------------------------------- */ +/* Platform */ +/* ------------------------------------------------------------------------- */ +#define WOLFSSL_GENERAL_ALIGNMENT 4 /* platform requires 32-bit alignment on uint32_t */ +#define SIZEOF_LONG_LONG 8 /* long long is 8 bytes / 64-bit */ +//#define WOLFSSL_NO_ASM /* optionally disable inline assembly support */ +#define WOLFSSL_IGNORE_FILE_WARN /* ignore file includes not required */ +//#define WOLFSSL_SMALL_STACK /* option to reduce stack size, offload to heap */ +#define BENCH_EMBEDDED /* use smaller buffers in benchmark / tests */ + +/* Network stack */ +/* Default is POSIX sockets */ +//#define WOLFSSL_USER_IO /* Use the SetIO callbacks, not the internal wolfio.c socket code */ +//#define WOLFSSL_LWIP +//#define WOLFSSL_LWIP_NATIVE +//#define FREERTOS_TCP + +/* RTOS */ +/* Default is POSIX mutex and pthreads*/ +//#define SINGLE_THREADED +//#define FREERTOS +#define NO_FILESYSTEM +#define NO_WRITEV + +/* ------------------------------------------------------------------------- */ +/* Hardware */ +/* ------------------------------------------------------------------------- */ +/* CryptoCell support */ +#if 0 + //#define WOLFSSL_CRYPTOCELL + //#define WOLFSSL_CRYPTOCELL_AES +#endif +/* PSA support */ +#ifdef CONFIG_MBEDTLS_PSA_CRYPTO_C + #define WOLFSSL_HAVE_PSA + #ifndef SINGLE_THREADED + #define WOLFSSL_PSA_GLOBAL_LOCK + #endif + #define WC_NO_HASHDRBG /* use PSA RNG directly via wc_psa_get_random */ +#endif + +/* ------------------------------------------------------------------------- */ +/* FIPS */ +/* ------------------------------------------------------------------------- */ +#ifdef CONFIG_WOLFCRYPT_FIPS + /* FIPS Ready */ + #define HAVE_FIPS_VERSION 5 + #define HAVE_FIPS_VERSION_MINOR 3 +#endif + + +/* ------------------------------------------------------------------------- */ +/* TLS */ +/* ------------------------------------------------------------------------- */ +/* TLS v1.2 (on by default) */ +#ifdef CONFIG_WOLFSSL_TLS_VERSION_1_2 + #undef WOLFSSL_NO_TLS12 +#else + #define WOLFSSL_NO_TLS12 +#endif +//#define NO_WOLFSSL_SERVER /* Optionally disable TLS server code */ +//#define NO_WOLFSSL_CLIENT /* Optionally disable TLS client code */ + +/* TLS v1.3 */ +#if defined(CONFIG_WOLFSSL_TLS_VERSION_1_3) || defined(CONFIG_WOLFSSL_TLS13_ENABLED) + #define WOLFSSL_TLS13 +#endif + +/* Disable older TLS version prior to 1.2 */ +#define NO_OLD_TLS + +/* Enable default TLS extensions */ +#define HAVE_TLS_EXTENSIONS +#define HAVE_SUPPORTED_CURVES +#define HAVE_EXTENDED_MASTER +#define HAVE_ENCRYPT_THEN_MAC +#define HAVE_SERVER_RENEGOTIATION_INFO +#define HAVE_SNI /* optional Server Name Indicator (SNI) */ + +/* ASN */ +#define WOLFSSL_ASN_TEMPLATE /* use newer ASN template asn.c code (default) */ +#if 0 /* optional space reductions */ + #define WOLFSSL_NO_ASN_STRICT + #define IGNORE_NAME_CONSTRAINTS +#endif + +/* Session Cache */ +#if 1 + #define SMALL_SESSION_CACHE + #ifdef WOLFSSL_TLS13 + #define HAVE_SESSION_TICKET /* session tickets required for resumption in TLS v1.3 */ + #endif +#else + #define NO_SESSION_CACHE /* disable session resumption */ +#endif + +/* DTLS */ +#if defined(CONFIG_WOLFSSL_DTLS) + #define WOLFSSL_DTLS + #define HAVE_SOCKADDR +#endif + +/* PSK */ +#if defined(CONFIG_WOLFSSL_PSK) + #undef NO_PSK + #define WOLFSSL_STATIC_PSK +#else + #define NO_PSK /* disable pre-shared-key support */ +#endif + +/* ALPN */ +#if defined(CONFIG_WOLFSSL_ALPN) + #define HAVE_ALPN +#endif + +#if defined(CONFIG_WOLFSSL_MAX_FRAGMENT_LEN) + #define HAVE_MAX_FRAGMENT +#endif + +#if defined(CONFIG_NET_SOCKETS_SOCKOPT_TLS) + #define WOLFSSL_SET_CIPHER_BYTES +#endif + +/* ------------------------------------------------------------------------- */ +/* Algorithms */ +/* ------------------------------------------------------------------------- */ +/* RNG */ +#ifndef WC_NO_HASHDRBG + #define HAVE_HASHDRBG /* Use DRBG SHA2-256 and seed */ + #ifdef CONFIG_CSPRNG_ENABLED + #define WC_RNG_SEED_CB + #endif +#endif + +/* ECC */ +#if 1 + #define HAVE_ECC + #define ECC_USER_CURVES /* Enable only ECC curves specific */ + #undef NO_ECC256 /* Enable SECP256R1 only (on by default) */ + #define ECC_TIMING_RESISTANT /* Enable Timing Resistance */ + + //#define ECC_SHAMIR /* Optional ECC calculation speed improvement if not using SP implementation */ + //#define WOLFSSL_CUSTOM_CURVES /* enable other curves (not just prime) */ + //#define HAVE_ECC_SECPR2 + //#define HAVE_ECC_SECPR3 + //#define HAVE_ECC_BRAINPOOL + //#define HAVE_ECC_KOBLITZ + //#define HAVE_ECC_CDH /* Co-factor */ + //#define HAVE_COMP_KEY /* Compressed key support */ + //#define FP_ECC /* Fixed point caching - speed repeated operations against same key */ + //#define HAVE_ECC_ENCRYPT + //#define WOLFCRYPT_HAVE_ECCSI + //#define WOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT +#endif + +#define WOLFSSL_OLD_PRIME_CHECK /* Use faster DH prime checking */ + +/* RSA */ +#if 1 + #undef NO_RSA + #define WC_RSA_BLINDING + //#define WC_RSA_NO_PADDING + //#define RSA_LOW_MEM + + #if 0 + #define WOLFSSL_KEY_GEN /* For RSA Key gen only */ + #endif + #if defined(WOLFSSL_TLS13) || defined(CONFIG_WOLFSSL_RSA_PSS) + /* TLS v1.3 requires RSA PSS padding */ + #define WC_RSA_PSS + //#define WOLFSSL_PSS_LONG_SALT + #endif +#else + #define NO_RSA +#endif + +/* DH */ +#if 0 + #undef NO_DH /* on by default */ + #define WOLFSSL_DH_CONST /* don't rely on pow/log */ + #define HAVE_FFDHE_2048 + #define HAVE_FFDHE_3072 + #define HAVE_DH_DEFAULT_PARAMS + //#define WOLFSSL_DH_EXTRA /* Enable additional DH key import/export */ +#else + #define NO_DH +#endif + +/* ChaCha20 / Poly1305 */ +#if 1 + #define HAVE_CHACHA + #define HAVE_POLY1305 + + /* Needed for Poly1305 */ + #define HAVE_ONE_TIME_AUTH +#endif + +/* Ed25519 / Curve25519 */ +#if 0 + #define HAVE_CURVE25519 + #define HAVE_ED25519 /* ED25519 Requires SHA512 */ + + /* Optionally use small math (less flash usage, but much slower) */ + //#define CURVED25519_SMALL +#endif + +/* SHA-1 */ +#if 0 + #undef NO_SHA /* on by default */ + //#define USE_SLOW_SHA /* 1k smaller, but 25% slower */ +#else + // #define NO_SHA /* Necessary for pkcs12 tests */ +#endif + +/* SHA2-256 */ +#if 1 + #undef NO_SHA256 /* on by default */ + //#define USE_SLOW_SHA256 /* ~2k smaller and about 25% slower */ + #define WOLFSSL_SHA224 +#else + #define NO_SHA256 +#endif + +/* SHA2-384/512 */ +#if 1 + #define WOLFSSL_SHA384 + #define WOLFSSL_SHA512 + //#define USE_SLOW_SHA512 /* Over twice as small, but 50% slower */ +#endif + +/* SHA-3 */ +#if 1 + #define WOLFSSL_SHA3 +#endif + +/* AES */ +#define HAVE_AES_ECB +/* AES-CBC */ +#if 1 + #define HAVE_AES_CBC +#else + #define NO_AES_CBC +#endif +/* AES-GCM */ +#if 1 + #define HAVE_AESGCM + #define GCM_SMALL /* GCM Method: GCM_TABLE_4BIT, GCM_SMALL, GCM_WORD32 or GCM_TABLE */ + //#define WOLFSSL_AESGCM_STREAM +#endif +//#define HAVE_AES_DECRYPT +//#define WOLFSSL_AES_COUNTER +//#define WOLFSSL_AES_CFB +//#define WOLFSSL_AES_OFB +//#define HAVE_AESCCM +//#define WOLFSSL_AES_XTS + +//#define NO_AES_128 +//#define NO_AES_192 +//#define NO_AES_256 +//#define WOLFSSL_AES_SMALL_TABLES +//#define WOLFSSL_AES_NO_UNROLL + + +/* HKDF */ +#if defined(WOLFSSL_TLS13) || defined(CONFIG_WOLFSSL_HKDF) + #define HAVE_HKDF +#endif + +/* CMAC - Zephyr nRF BTLE needs CMAC */ +#if 1 + #define WOLFSSL_AES_DIRECT + #define WOLFSSL_CMAC +#endif + + +/* Optional Features */ +#define WOLFSSL_BASE64_ENCODE /* Enable Base64 encoding */ +//#define WC_NO_CACHE_RESISTANT /* systems with cache should enable this for AES, ECC, RSA and DH */ +//#define WOLFSSL_CERT_GEN +//#define WOLFSSL_CERT_REQ +//#define WOLFSSL_CERT_EXT +//#define NO_PWDBASED + + +/* Disable Algorithms */ +#define NO_DSA +#define NO_RC4 +#define NO_MD4 +#define NO_MD5 +//#define NO_DES3 /* Necessary for pkcs12 tests */ +#define WOLFSSL_NO_SHAKE128 +#define WOLFSSL_NO_SHAKE256 + + + +/* ------------------------------------------------------------------------- */ +/* Math */ +/* ------------------------------------------------------------------------- */ +/* Math Options */ +/* Multi-precision - generic math for all keys sizes and curves */ +#if 1 + #define WOLFSSL_SP_MATH /* no multi-precision math, only single */ +#elif 1 + /* wolf mp math (sp_int.c) */ + #define WOLFSSL_SP_MATH_ALL /* use SP math for all key sizes and curves */ + //#define WOLFSSL_SP_NO_MALLOC + + /* use smaller version of code */ + #define WOLFSSL_SP_SMALL + + /* Define the maximum math bits used */ + #if !defined(NO_RSA) || !defined(NO_DH) + #define SP_INT_BITS 2048 + #elif defined(HAVE_ECC) + #define SP_INT_BITS 256 + #endif + +#elif 1 + /* Fast Math (tfm.c) (stack based and timing resistant) */ + #define USE_FAST_MATH + #define TFM_TIMING_RESISTANT + + /* Define the maximum math bits used (2 * max) */ + #if !defined(NO_RSA) || !defined(NO_DH) + #define FP_MAX_BITS (2*2048) + #ifdef HAVE_ECC + #define ALT_ECC_SIZE /* use heap allocation for ECC point */ + #endif + #elif defined(HAVE_ECC) + #define FP_MAX_BITS (2*256) + #endif + #ifdef HAVE_ECC + //#define TFM_ECC256 /* optional speedup for ECC-256 bit */ + #endif +#else + /* Normal (integer.c) (heap based, not timing resistant) - not recommended */ + #define USE_INTEGER_HEAP_MATH +#endif + +/* Single Precision (optional) */ +/* Math written for specific curves and key sizes */ +#if 1 + #ifdef HAVE_ECC + #define WOLFSSL_HAVE_SP_ECC + //#define WOLFSSL_SP_NO_256 + //#define WOLFSSL_SP_384 + //#define WOLFSSL_SP_521 + #endif + #ifndef NO_RSA + #define WOLFSSL_HAVE_SP_RSA + //#define WOLFSSL_SP_NO_2048 + //#define WOLFSSL_SP_NO_3072 + //#define WOLFSSL_SP_4096 + #endif + #ifndef NO_DH + #define WOLFSSL_HAVE_SP_DH + #endif + + #define WOLFSSL_SP_SMALL /* use smaller version of code */ + //#define WOLFSSL_SP_NO_MALLOC /* disable heap in wolf/SP math */ + //#define SP_DIV_WORD_USE_DIV /* no div64 */ + + #if 0 + /* optional speedup with inline assembly */ + //#define WOLFSSL_SP_ARM_CORTEX_M_ASM /* Cortex-M3+ */ + //#define WOLFSSL_SP_ARM_THUMB_ASM /* Cortex-M0+ thumb */ + //#define WOLFSSL_SP_ARM32_ASM /* Cortex-R */ + //#define WOLFSSL_SP_ARM64_ASM /* Cortex-A */ + //#define WOLFSSL_SP_USE_UDIV + #endif +#endif + +/* ------------------------------------------------------------------------- */ +/* Assembly Speedups for Symmetric Algorithms */ +/* ------------------------------------------------------------------------- */ + +#ifdef CONFIG_WOLFCRYPT_ARMASM + #define WOLFSSL_ARMASM + #define WOLFSSL_NO_HASH_RAW + #define WOLFSSL_ARMASM_INLINE /* use inline .c versions */ + #define WOLFSSL_ARMASM_NO_NEON + + /* Default is ARMv8 */ + + #if 0 /* ARMv7 */ + #define WOLFSSL_ARM_ARCH 7 + #define WOLFSSL_ARMASM_NO_HW_CRYPTO /* enable if processor does not support aes/sha instructions */ + #endif +#endif + +#ifdef CONFIG_WOLFCRYPT_INTELASM + #define USE_INTEL_SPEEDUP + #define WOLFSSL_X86_64_BUILD /* 64-bit */ + //#define WOLFSSL_X86_BUILD /* 32-bit */ + + /* Issues with building AESNI "_mm_aesimc_si128" always_inline */ + //#define WOLFSSL_AESNI +#endif + + +/* ------------------------------------------------------------------------- */ +/* Debugging */ +/* ------------------------------------------------------------------------- */ +#undef DEBUG_WOLFSSL +#undef NO_ERROR_STRINGS +#ifdef CONFIG_WOLFSSL_DEBUG + #define DEBUG_WOLFSSL +#else + #if 1 + #define NO_ERROR_STRINGS + #endif +#endif + + +#ifdef __cplusplus +} +#endif + +#endif /* CONFIG_WOLFSSL_SETTINGS_FILE */ +#endif /* CONFIG_WOLFSSL */ + +#endif /* USER_SETTINGS_H */ + diff --git a/modules/wolfssl/wolfssl/options.h b/modules/wolfssl/wolfssl/options.h new file mode 100644 index 000000000000..5c637481bb9c --- /dev/null +++ b/modules/wolfssl/wolfssl/options.h @@ -0,0 +1 @@ +/* default blank options to appease code that may require it */ diff --git a/modules/wolfssl/zephyr_init.c b/modules/wolfssl/zephyr_init.c new file mode 100644 index 000000000000..cd8ae98e6d12 --- /dev/null +++ b/modules/wolfssl/zephyr_init.c @@ -0,0 +1,22 @@ +/* zephyr_init.c + * + * Copyright (C) 2006-2023 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +/* Not needed. Keeping file for backwards compatibility. */ diff --git a/west.yml b/west.yml index 3e9aa1721c5a..f0d622d90e13 100644 --- a/west.yml +++ b/west.yml @@ -23,8 +23,6 @@ manifest: url-base: https://github.com/zephyrproject-rtos - name: babblesim url-base: https://github.com/BabbleSim - - name: wolfssl - url-base: https://github.com/wolfssl group-filter: [-babblesim, -optional] @@ -288,6 +286,11 @@ manifest: path: modules/crypto/mbedtls groups: - crypto + - name: wolfssl + revision: 1cf96eb72c0113767daf34c3a916f0c8c8741aac + path: modules/crypto/wolfssl + groups: + - crypto - name: mcuboot revision: 898a1ca64a759541d9fcc37fef921db93d99ad70 path: bootloader/mcuboot From 8a86cc903d7bd1c6a32d622120ef51677ae06d56 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Fri, 12 Jul 2024 10:29:31 -0700 Subject: [PATCH 09/12] Remove wolfssl samples --- .../samples/wolfssl_benchmark/CMakeLists.txt | 8 - .../wolfssl/samples/wolfssl_benchmark/README | 12 - .../boards/nrf5340dk_nrf5340_cpuapp.conf | 22 - .../boards/nrf5340dk_nrf5340_cpuapp_ns.conf | 25 - .../samples/wolfssl_benchmark/install_test.sh | 49 -- .../samples/wolfssl_benchmark/prj.conf | 36 - .../samples/wolfssl_benchmark/sample.yaml | 15 - .../samples/wolfssl_test/CMakeLists.txt | 9 - modules/wolfssl/samples/wolfssl_test/README | 12 - .../boards/nrf5340dk_nrf5340_cpuapp.conf | 22 - .../boards/nrf5340dk_nrf5340_cpuapp_ns.conf | 25 - .../samples/wolfssl_test/install_test.sh | 49 -- .../samples/wolfssl_test/prj-no-malloc.conf | 30 - modules/wolfssl/samples/wolfssl_test/prj.conf | 29 - .../wolfssl/samples/wolfssl_test/sample.yaml | 21 - .../samples/wolfssl_tls_sock/CMakeLists.txt | 8 - .../wolfssl/samples/wolfssl_tls_sock/README | 12 - .../wolfssl_tls_sock/install_sample.sh | 31 - .../wolfssl_tls_sock/prj-no-malloc.conf | 57 -- .../wolfssl/samples/wolfssl_tls_sock/prj.conf | 57 -- .../samples/wolfssl_tls_sock/sample.yaml | 23 - .../samples/wolfssl_tls_sock/src/tls_sock.c | 532 -------------- .../samples/wolfssl_tls_thread/CMakeLists.txt | 8 - .../wolfssl/samples/wolfssl_tls_thread/README | 12 - .../boards/nrf5340dk_nrf5340_cpuapp.conf | 22 - .../boards/nrf5340dk_nrf5340_cpuapp_ns.conf | 25 - .../wolfssl_tls_thread/install_sample.sh | 31 - .../samples/wolfssl_tls_thread/prj.conf | 43 -- .../samples/wolfssl_tls_thread/sample.yaml | 18 - .../wolfssl_tls_thread/src/tls_threaded.c | 671 ------------------ 30 files changed, 1914 deletions(-) delete mode 100644 modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt delete mode 100644 modules/wolfssl/samples/wolfssl_benchmark/README delete mode 100644 modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf delete mode 100644 modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf delete mode 100755 modules/wolfssl/samples/wolfssl_benchmark/install_test.sh delete mode 100644 modules/wolfssl/samples/wolfssl_benchmark/prj.conf delete mode 100644 modules/wolfssl/samples/wolfssl_benchmark/sample.yaml delete mode 100644 modules/wolfssl/samples/wolfssl_test/CMakeLists.txt delete mode 100644 modules/wolfssl/samples/wolfssl_test/README delete mode 100644 modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf delete mode 100644 modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf delete mode 100755 modules/wolfssl/samples/wolfssl_test/install_test.sh delete mode 100644 modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf delete mode 100644 modules/wolfssl/samples/wolfssl_test/prj.conf delete mode 100644 modules/wolfssl/samples/wolfssl_test/sample.yaml delete mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt delete mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/README delete mode 100755 modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh delete mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf delete mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/prj.conf delete mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml delete mode 100644 modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c delete mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt delete mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/README delete mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf delete mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf delete mode 100755 modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh delete mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/prj.conf delete mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml delete mode 100644 modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c diff --git a/modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt deleted file mode 100644 index 1b68e1bfb7c6..000000000000 --- a/modules/wolfssl/samples/wolfssl_benchmark/CMakeLists.txt +++ /dev/null @@ -1,8 +0,0 @@ -cmake_minimum_required(VERSION 3.13.1) -find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE}) -project(wolfssl_benchmark) - -target_sources(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/benchmark/benchmark.c) -target_include_directories(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/benchmark) -target_sources(app PRIVATE ${app_sources}) -add_definitions(-DWOLFSSL_USER_SETTINGS) diff --git a/modules/wolfssl/samples/wolfssl_benchmark/README b/modules/wolfssl/samples/wolfssl_benchmark/README deleted file mode 100644 index 906a6c9bac81..000000000000 --- a/modules/wolfssl/samples/wolfssl_benchmark/README +++ /dev/null @@ -1,12 +0,0 @@ - -wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use -under the GPLv2 or a standard commercial license. For our users who cannot use -wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. -Please contact wolfSSL Inc. directly at: - -Email: licensing@wolfssl.com -Phone: +1 425 245-8247 - -More information can be found on the wolfSSL website at www.wolfssl.com. - - diff --git a/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf b/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf deleted file mode 100644 index 98d8bc49632a..000000000000 --- a/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf +++ /dev/null @@ -1,22 +0,0 @@ -# Set user_settings.h file to be used for native wolfSSL build settings -#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" - -##### PSA and CC3XX ##### -# Enable Nordic Security Module -CONFIG_NRF_SECURITY=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y -# Enable PSA API support (comes from mbedTLS) -CONFIG_MBEDTLS_PSA_CRYPTO_C=y -# Enable/configure mbedTLS heap -CONFIG_MBEDTLS_ENABLE_HEAP=y -CONFIG_MBEDTLS_HEAP_SIZE=8192 -# Disable nrf_oberon crypto library PSA backend -CONFIG_PSA_CRYPTO_DRIVER_OBERON=n -# Enable ARM CryptoCell cc3xx driver PSA backend -CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y - -##### Logging ##### -CONFIG_USE_SEGGER_RTT=y -CONFIG_LOG_BACKEND_RTT=y -CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 - diff --git a/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf deleted file mode 100644 index aa3bbe18ad3b..000000000000 --- a/modules/wolfssl/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf +++ /dev/null @@ -1,25 +0,0 @@ -CONFIG_BUILD_WITH_TFM=y -CONFIG_TFM_PROFILE_TYPE_NOT_SET=y - -# Set user_settings.h file to be used for native wolfSSL build settings -#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" - -##### PSA and CC3XX ##### -# Enable Nordic Security Module -CONFIG_NRF_SECURITY=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y -# Enable PSA API support (comes from mbedTLS) -CONFIG_MBEDTLS_PSA_CRYPTO_C=y -# Enable/configure mbedTLS heap -CONFIG_MBEDTLS_ENABLE_HEAP=y -CONFIG_MBEDTLS_HEAP_SIZE=8192 -# Disable nrf_oberon crypto library PSA backend -CONFIG_PSA_CRYPTO_DRIVER_OBERON=n -# Enable ARM CryptoCell cc3xx driver PSA backend -CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y - -##### Logging ##### -CONFIG_USE_SEGGER_RTT=y -CONFIG_LOG_BACKEND_RTT=y -CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 - diff --git a/modules/wolfssl/samples/wolfssl_benchmark/install_test.sh b/modules/wolfssl/samples/wolfssl_benchmark/install_test.sh deleted file mode 100755 index fff8da420838..000000000000 --- a/modules/wolfssl/samples/wolfssl_benchmark/install_test.sh +++ /dev/null @@ -1,49 +0,0 @@ -#!/bin/sh - -WOLFSSL_SRC_DIR=../../.. - -if [ ! -d $WOLFSSL_SRC_DIR ]; then - echo "Directory does not exist: $WOLFSSL_SRC_DIR" - exit 1 -fi -if [ ! -f $WOLFSSL_SRC_DIR/wolfcrypt/benchmark/benchmark.c ]; then - echo "Missing source file: $WOLFSSL_SRC_DIR/wolfcrypt/benchmark/benchmark.h" - exit 1 -fi - -ZEPHYR_DIR= -if [ $# -ne 1 ]; then - echo "Need location of zephyr project as a command line argument" - exit 1 -else - ZEPHYR_DIR=$1 -fi -if [ ! -d $ZEPHR_DIR ]; then - echo "Zephyr project directory does not exist: $ZEPHYR_DIR" - exit 1 -fi -ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules -if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then - echo "Zephyr samples/modules directory does not exist: $ZEPHYR_SAMPLES_DIR" - exit 1 -fi -ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_benchmark - -echo "wolfSSL directory:" -echo " $ZEPHYR_WOLFSSL_DIR" -rm -rf $ZEPHYR_WOLFSSL_DIR -mkdir $ZEPHYR_WOLFSSL_DIR - -echo "Copy in Build files ..." -cp -r * $ZEPHYR_WOLFSSL_DIR/ -rm $ZEPHYR_WOLFSSL_DIR/$0 - -echo "Copy Source Code ..." -rm -rf $ZEPHYR_WOLFSSL_DIR/src -mkdir $ZEPHYR_WOLFSSL_DIR/src - -cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/benchmark/benchmark.c $ZEPHYR_WOLFSSL_DIR/src/ -cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/benchmark/benchmark.h $ZEPHYR_WOLFSSL_DIR/src/ - -echo "Done" - diff --git a/modules/wolfssl/samples/wolfssl_benchmark/prj.conf b/modules/wolfssl/samples/wolfssl_benchmark/prj.conf deleted file mode 100644 index 017988024946..000000000000 --- a/modules/wolfssl/samples/wolfssl_benchmark/prj.conf +++ /dev/null @@ -1,36 +0,0 @@ -# Configure stack and heap sizes -CONFIG_MAIN_STACK_SIZE=32768 -CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=8192 - -# Pthreads -CONFIG_PTHREAD_IPC=y - -# Clock for time() -CONFIG_POSIX_CLOCK=y - -# TLS configuration -CONFIG_WOLFSSL=y -CONFIG_WOLFSSL_BUILTIN=y - -# Floating Point -CONFIG_FPU=y - -# Logging -CONFIG_PRINTK=y -CONFIG_CBPRINTF_LIBC_SUBSTS=y -CONFIG_CBPRINTF_FP_SUPPORT=y -CONFIG_CONSOLE=y -CONFIG_LOG=y -CONFIG_LOG_BACKEND_UART=y -CONFIG_LOG_BUFFER_SIZE=15360 -CONFIG_LOG_MODE_IMMEDIATE=y -#CONFIG_WOLFSSL_DEBUG=y - -# Entropy -CONFIG_TEST_RANDOM_GENERATOR=y -CONFIG_ENTROPY_GENERATOR=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y - -# Optional ARM or Intel Assembly -#CONFIG_WOLFCRYPT_ARMASM=y -#CONFIG_WOLFCRYPT_INTELASM=y diff --git a/modules/wolfssl/samples/wolfssl_benchmark/sample.yaml b/modules/wolfssl/samples/wolfssl_benchmark/sample.yaml deleted file mode 100644 index 4c5d1fcea80e..000000000000 --- a/modules/wolfssl/samples/wolfssl_benchmark/sample.yaml +++ /dev/null @@ -1,15 +0,0 @@ -sample: - description: wolfCrypt benchmark sample app - name: wolfCrypt benchmark -common: - tags: crypto wolfssl userspace random - harness: console - harness_config: - type: one_line - regex: - - "Benchmark complete" -tests: - sample.crypto.wolfssl_benchmark: - platform_allow: qemu_x86 - integration_platforms: - - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_test/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_test/CMakeLists.txt deleted file mode 100644 index bae4c165472b..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/CMakeLists.txt +++ /dev/null @@ -1,9 +0,0 @@ -cmake_minimum_required(VERSION 3.13.1) -find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE}) -project(wolfssl_test) - -target_sources(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/test/test.c) -target_include_directories(app PRIVATE ${ZEPHYR_WOLFSSL_MODULE_DIR}/wolfcrypt/test) -target_sources(app PRIVATE ${app_sources}) -add_definitions(-DWOLFSSL_USER_SETTINGS) - diff --git a/modules/wolfssl/samples/wolfssl_test/README b/modules/wolfssl/samples/wolfssl_test/README deleted file mode 100644 index 906a6c9bac81..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/README +++ /dev/null @@ -1,12 +0,0 @@ - -wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use -under the GPLv2 or a standard commercial license. For our users who cannot use -wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. -Please contact wolfSSL Inc. directly at: - -Email: licensing@wolfssl.com -Phone: +1 425 245-8247 - -More information can be found on the wolfSSL website at www.wolfssl.com. - - diff --git a/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf b/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf deleted file mode 100644 index 98d8bc49632a..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf +++ /dev/null @@ -1,22 +0,0 @@ -# Set user_settings.h file to be used for native wolfSSL build settings -#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" - -##### PSA and CC3XX ##### -# Enable Nordic Security Module -CONFIG_NRF_SECURITY=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y -# Enable PSA API support (comes from mbedTLS) -CONFIG_MBEDTLS_PSA_CRYPTO_C=y -# Enable/configure mbedTLS heap -CONFIG_MBEDTLS_ENABLE_HEAP=y -CONFIG_MBEDTLS_HEAP_SIZE=8192 -# Disable nrf_oberon crypto library PSA backend -CONFIG_PSA_CRYPTO_DRIVER_OBERON=n -# Enable ARM CryptoCell cc3xx driver PSA backend -CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y - -##### Logging ##### -CONFIG_USE_SEGGER_RTT=y -CONFIG_LOG_BACKEND_RTT=y -CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 - diff --git a/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf deleted file mode 100644 index aa3bbe18ad3b..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf +++ /dev/null @@ -1,25 +0,0 @@ -CONFIG_BUILD_WITH_TFM=y -CONFIG_TFM_PROFILE_TYPE_NOT_SET=y - -# Set user_settings.h file to be used for native wolfSSL build settings -#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" - -##### PSA and CC3XX ##### -# Enable Nordic Security Module -CONFIG_NRF_SECURITY=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y -# Enable PSA API support (comes from mbedTLS) -CONFIG_MBEDTLS_PSA_CRYPTO_C=y -# Enable/configure mbedTLS heap -CONFIG_MBEDTLS_ENABLE_HEAP=y -CONFIG_MBEDTLS_HEAP_SIZE=8192 -# Disable nrf_oberon crypto library PSA backend -CONFIG_PSA_CRYPTO_DRIVER_OBERON=n -# Enable ARM CryptoCell cc3xx driver PSA backend -CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y - -##### Logging ##### -CONFIG_USE_SEGGER_RTT=y -CONFIG_LOG_BACKEND_RTT=y -CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 - diff --git a/modules/wolfssl/samples/wolfssl_test/install_test.sh b/modules/wolfssl/samples/wolfssl_test/install_test.sh deleted file mode 100755 index f0ab5ad96cee..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/install_test.sh +++ /dev/null @@ -1,49 +0,0 @@ -#!/bin/sh - -WOLFSSL_SRC_DIR=../../.. - -if [ ! -d $WOLFSSL_SRC_DIR ]; then - echo "Directory does not exist: $WOLFSSL_SRC_DIR" - exit 1 -fi -if [ ! -f $WOLFSSL_SRC_DIR/wolfcrypt/test/test.c ]; then - echo "Missing source file: $WOLFSSL_SRC_DIR/wolfcrypt/test/test.h" - exit 1 -fi - -ZEPHYR_DIR= -if [ $# -ne 1 ]; then - echo "Need location of zephyr project as a command line argument" - exit 1 -else - ZEPHYR_DIR=$1 -fi -if [ ! -d $ZEPHR_DIR ]; then - echo "Zephyr project directory does not exist: $ZEPHYR_DIR" - exit 1 -fi -ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules -if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then - echo "Zephyr samples/modules directory does not exist: $ZEPHYR_SAMPLES_DIR" - exit 1 -fi -ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_test - -echo "wolfSSL directory:" -echo " $ZEPHYR_WOLFSSL_DIR" -rm -rf $ZEPHYR_WOLFSSL_DIR -mkdir $ZEPHYR_WOLFSSL_DIR - -echo "Copy in Build files ..." -cp -r * $ZEPHYR_WOLFSSL_DIR/ -rm $ZEPHYR_WOLFSSL_DIR/$0 - -echo "Copy Source Code ..." -rm -rf $ZEPHYR_WOLFSSL_DIR/src -mkdir $ZEPHYR_WOLFSSL_DIR/src - -cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/test/test.c $ZEPHYR_WOLFSSL_DIR/src/ -cp -rf ${WOLFSSL_SRC_DIR}/wolfcrypt/test/test.h $ZEPHYR_WOLFSSL_DIR/src/ - -echo "Done" - diff --git a/modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf b/modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf deleted file mode 100644 index 42f98d431d6e..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/prj-no-malloc.conf +++ /dev/null @@ -1,30 +0,0 @@ -# Configure stack and heap sizes -CONFIG_MAIN_STACK_SIZE=655360 -#CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=65536 - -# Pthreads -CONFIG_PTHREAD_IPC=y - -# Clock for time() -CONFIG_POSIX_CLOCK=y - -# TLS configuration -CONFIG_WOLFSSL_SETTINGS_FILE="user_settings-no-malloc.h" -CONFIG_WOLFSSL=y -CONFIG_WOLFSSL_BUILTIN=y - -# Logging -CONFIG_PRINTK=y -CONFIG_CBPRINTF_LIBC_SUBSTS=y -CONFIG_CBPRINTF_FP_SUPPORT=y -CONFIG_CONSOLE=y -CONFIG_LOG=y -CONFIG_LOG_BACKEND_UART=y -CONFIG_LOG_BUFFER_SIZE=15360 -CONFIG_LOG_MODE_IMMEDIATE=y -#CONFIG_WOLFSSL_DEBUG=y - -# Entropy -CONFIG_TEST_RANDOM_GENERATOR=y -CONFIG_ENTROPY_GENERATOR=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y diff --git a/modules/wolfssl/samples/wolfssl_test/prj.conf b/modules/wolfssl/samples/wolfssl_test/prj.conf deleted file mode 100644 index 38b1ce49b4fd..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/prj.conf +++ /dev/null @@ -1,29 +0,0 @@ -# Configure stack and heap sizes -CONFIG_MAIN_STACK_SIZE=32768 -CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=16384 - -# Pthreads -CONFIG_PTHREAD_IPC=y - -# Clock for time() -CONFIG_POSIX_CLOCK=y - -# TLS configuration -CONFIG_WOLFSSL=y -CONFIG_WOLFSSL_BUILTIN=y - -# Logging -CONFIG_PRINTK=y -CONFIG_CBPRINTF_LIBC_SUBSTS=y -CONFIG_CBPRINTF_FP_SUPPORT=y -CONFIG_CONSOLE=y -CONFIG_LOG=y -CONFIG_LOG_BACKEND_UART=y -CONFIG_LOG_BUFFER_SIZE=15360 -CONFIG_LOG_MODE_IMMEDIATE=y -#CONFIG_WOLFSSL_DEBUG=y - -# Entropy -CONFIG_TEST_RANDOM_GENERATOR=y -CONFIG_ENTROPY_GENERATOR=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y diff --git a/modules/wolfssl/samples/wolfssl_test/sample.yaml b/modules/wolfssl/samples/wolfssl_test/sample.yaml deleted file mode 100644 index 50010f76ae3d..000000000000 --- a/modules/wolfssl/samples/wolfssl_test/sample.yaml +++ /dev/null @@ -1,21 +0,0 @@ -sample: - description: wolfCrypt test sample app - name: wolfCrypt test -common: - harness: console - harness_config: - type: one_line - regex: - - "Exiting main with return code: 0" -tests: - sample.crypto.wolfssl_test: - timeout: 120 - platform_allow: qemu_x86 - integration_platforms: - - qemu_x86 - sample.crypto.wolfssl_test_no_malloc: - timeout: 120 - platform_allow: qemu_x86 - extra_args: CONF_FILE="prj-no-malloc.conf" - integration_platforms: - - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt deleted file mode 100644 index a1208f502937..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_sock/CMakeLists.txt +++ /dev/null @@ -1,8 +0,0 @@ -cmake_minimum_required(VERSION 3.13.1) -include($ENV{ZEPHYR_BASE}/cmake/app/boilerplate.cmake NO_POLICY_SCOPE) -project(wolfssl_tls_sock) - -FILE(GLOB app_sources src/*.c) -target_sources(app PRIVATE ${app_sources}) -add_definitions(-DWOLFSSL_USER_SETTINGS) - diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/README b/modules/wolfssl/samples/wolfssl_tls_sock/README deleted file mode 100644 index 906a6c9bac81..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_sock/README +++ /dev/null @@ -1,12 +0,0 @@ - -wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use -under the GPLv2 or a standard commercial license. For our users who cannot use -wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. -Please contact wolfSSL Inc. directly at: - -Email: licensing@wolfssl.com -Phone: +1 425 245-8247 - -More information can be found on the wolfSSL website at www.wolfssl.com. - - diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh b/modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh deleted file mode 100755 index d32e6e8c99bd..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_sock/install_sample.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/sh - -ZEPHYR_DIR= -if [ $# -ne 1 ]; then - echo "Need location of zephyr project as a command line argument" - exit 1 -else - ZEPHYR_DIR=$1 -fi -if [ ! -d $ZEPHR_DIR ]; then - echo "Zephyr project directory does not exist: $ZEPHYR_DIR" - exit 1 -fi -ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules -if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then - echo "Zephyr samples/module directory does not exist: $ZEPHYR_SAMPLES_DIR" - exit 1 -fi -ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_tls_sock - -echo "wolfSSL directory:" -echo " $ZEPHYR_WOLFSSL_DIR" -rm -rf $ZEPHYR_WOLFSSL_DIR -mkdir $ZEPHYR_WOLFSSL_DIR - -echo "Copy in Sample files ..." -cp -r * $ZEPHYR_WOLFSSL_DIR/ -rm $ZEPHYR_WOLFSSL_DIR/$0 - -echo "Done" - diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf b/modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf deleted file mode 100644 index 830b1944dbc9..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_sock/prj-no-malloc.conf +++ /dev/null @@ -1,57 +0,0 @@ -# Kernel options -CONFIG_MAIN_STACK_SIZE=655360 -CONFIG_ENTROPY_GENERATOR=y -CONFIG_INIT_STACKS=y - -# General config -CONFIG_NEWLIB_LIBC=y - -# Pthreads -CONFIG_PTHREAD_IPC=y - -# Clock for time() -CONFIG_POSIX_CLOCK=y - -# Networking config -CONFIG_NETWORKING=y -CONFIG_NET_IPV4=y -CONFIG_NET_IPV6=n -CONFIG_NET_TCP=y -CONFIG_NET_SOCKETS=y -CONFIG_NET_SOCKETS_POSIX_NAMES=y - -CONFIG_NET_TEST=y -CONFIG_NET_LOOPBACK=y - -# Network driver config -CONFIG_TEST_RANDOM_GENERATOR=y - -# Network address config -CONFIG_NET_CONFIG_SETTINGS=y -CONFIG_NET_CONFIG_NEED_IPV4=y -CONFIG_NET_CONFIG_MY_IPV4_ADDR="192.0.2.1" -CONFIG_NET_CONFIG_PEER_IPV4_ADDR="192.0.2.2" -CONFIG_NET_CONFIG_MY_IPV4_GW="192.0.2.2" - -CONFIG_NET_PKT_TX_COUNT=10 - -# Network debug config -#CONFIG_NET_LOG=y -#CONFIG_NET_PKT_LOG_LEVEL_DBG=y - -# Logging -CONFIG_PRINTK=y -#CONFIG_WOLFSSL_DEBUG=y -CONFIG_LOG=y -CONFIG_LOG_MODE_IMMEDIATE=y - -# TLS configuration -CONFIG_WOLFSSL_SETTINGS_FILE="user_settings-no-malloc.h" -CONFIG_WOLFSSL=y -CONFIG_WOLFSSL_BUILTIN=y - -CONFIG_WOLFSSL_TLS_VERSION_1_2=y -CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y -CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y -CONFIG_WOLFSSL_MAC_ALL_ENABLED=y -CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/prj.conf b/modules/wolfssl/samples/wolfssl_tls_sock/prj.conf deleted file mode 100644 index 549bc07ab0b0..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_sock/prj.conf +++ /dev/null @@ -1,57 +0,0 @@ -# Kernel options -CONFIG_MAIN_STACK_SIZE=16384 -CONFIG_ENTROPY_GENERATOR=y -CONFIG_INIT_STACKS=y -CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=8192 - -# General config -CONFIG_NEWLIB_LIBC=y - -# Pthreads -CONFIG_PTHREAD_IPC=y - -# Clock for time() -CONFIG_POSIX_CLOCK=y - -# Networking config -CONFIG_NETWORKING=y -CONFIG_NET_IPV4=y -CONFIG_NET_IPV6=n -CONFIG_NET_TCP=y -CONFIG_NET_SOCKETS=y -CONFIG_NET_SOCKETS_POSIX_NAMES=y - -CONFIG_NET_TEST=y -CONFIG_NET_LOOPBACK=y - -# Network driver config -CONFIG_TEST_RANDOM_GENERATOR=y - -# Network address config -CONFIG_NET_CONFIG_SETTINGS=y -CONFIG_NET_CONFIG_NEED_IPV4=y -CONFIG_NET_CONFIG_MY_IPV4_ADDR="192.0.2.1" -CONFIG_NET_CONFIG_PEER_IPV4_ADDR="192.0.2.2" -CONFIG_NET_CONFIG_MY_IPV4_GW="192.0.2.2" - -CONFIG_NET_PKT_TX_COUNT=10 - -# Network debug config -#CONFIG_NET_LOG=y -#CONFIG_NET_PKT_LOG_LEVEL_DBG=y - -# Logging -CONFIG_PRINTK=y -#CONFIG_WOLFSSL_DEBUG=y -CONFIG_LOG=y -CONFIG_LOG_MODE_IMMEDIATE=y - -# TLS configuration -CONFIG_WOLFSSL=y -CONFIG_WOLFSSL_BUILTIN=y - -CONFIG_WOLFSSL_TLS_VERSION_1_3=y -CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y -CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y -CONFIG_WOLFSSL_MAC_ALL_ENABLED=y -CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml b/modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml deleted file mode 100644 index a1b26e879443..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_sock/sample.yaml +++ /dev/null @@ -1,23 +0,0 @@ -sample: - description: wolfSSL TLS test application - name: wolfSSL TLS Test -common: - harness: console - harness_config: - type: multi_line - regex: - - "Server Return: 0" - - "Client Return: 0" - - "Done" -tests: - sample.crypto.wolfssl_tls_sock: - timeout: 60 - platform_allow: qemu_x86 - integration_platforms: - - qemu_x86 - sample.crypto.wolfssl_tls_sock_no_malloc: - timeout: 60 - platform_allow: qemu_x86 - extra_args: CONF_FILE="prj-no-malloc.conf" - integration_platforms: - - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c b/modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c deleted file mode 100644 index c25277820b16..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_sock/src/tls_sock.c +++ /dev/null @@ -1,532 +0,0 @@ -/* tls_sock.c - * - * Copyright (C) 2006-2023 wolfSSL Inc. - * - * This file is part of wolfSSL. - * - * wolfSSL is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * wolfSSL is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA - */ - -#ifndef WOLFSSL_USER_SETTINGS - #include -#endif -#include -#define USE_CERT_BUFFERS_2048 -#include -#include - -#ifdef WOLFSSL_ZEPHYR -#define printf printk -#endif - -#define BUFFER_SIZE 2048 -#define STATIC_MEM_SIZE (256*1024) -#define MAX_SEND_SIZE 256 - -#ifdef WOLFSSL_STATIC_MEMORY - static WOLFSSL_HEAP_HINT* HEAP_HINT_SERVER; - static WOLFSSL_HEAP_HINT* HEAP_HINT_CLIENT; - - static byte gMemoryServer[STATIC_MEM_SIZE]; - static byte gMemoryClient[STATIC_MEM_SIZE]; -#else - #define HEAP_HINT_SERVER NULL - #define HEAP_HINT_CLIENT NULL -#endif /* WOLFSSL_STATIC_MEMORY */ - -/* Application data to send. */ -static const char msgHTTPGet[] = "GET /index.html HTTP/1.0\r\n\r\n"; -static const char msgHTTPIndex[] = - "HTTP/1.1 200 OK\n" - "Content-Type: text/html\n" - "Connection: close\n" - "\n" - "\n" - "\n" - "Welcome to wolfSSL!\n" - "\n" - "\n" - "

wolfSSL has successfully performed handshake!

\n" - "\n" - "\n"; - -#ifdef HAVE_FIPS -static void myFipsCb(int ok, int err, const char* hash) -{ - printf("in my Fips callback, ok = %d, err = %d\n", ok, err); - printf("message = %s\n", wc_GetErrorString(err)); - printf("hash = %s\n", hash); - - if (err == IN_CORE_FIPS_E) { - printf("In core integrity hash check failure, copy above hash\n"); - printf("into verifyCore[] in fips_test.c and rebuild\n"); - } -} -#endif - -/* DO NOT use this in production. You should implement a way - * to get the current date. */ -static int verifyIgnoreDateError(int preverify, WOLFSSL_X509_STORE_CTX* store) -{ - if (store->error == ASN_BEFORE_DATE_E) - return 1; /* override error */ - else - return preverify; -} - -/* Create a new wolfSSL client with a server CA certificate. */ -static int wolfssl_client_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) -{ - int ret = 0; - WOLFSSL_CTX* client_ctx = NULL; - WOLFSSL* client_ssl = NULL; - - /* Create and initialize WOLFSSL_CTX */ - if ((client_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_client_method_ex(HEAP_HINT_CLIENT), - HEAP_HINT_CLIENT)) == NULL) { - printf("ERROR: failed to create WOLFSSL_CTX\n"); - ret = -1; - } - - if (ret == 0) { - /* Load client certificates into WOLFSSL_CTX */ - if (wolfSSL_CTX_load_verify_buffer_ex(client_ctx, ca_cert_der_2048, - sizeof_ca_cert_der_2048, WOLFSSL_FILETYPE_ASN1, 0, - /* DO NOT use this in production. You should - * implement a way to get the current date. */ - WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY) != - WOLFSSL_SUCCESS) { - printf("ERROR: failed to load CA certificate\n"); - ret = -1; - } - } - - if (ret == 0) { - /* Create a WOLFSSL object */ - if ((client_ssl = wolfSSL_new(client_ctx)) == NULL) { - printf("ERROR: failed to create WOLFSSL object\n"); - ret = -1; - } - } - - if (ret == 0) - wolfSSL_set_verify(client_ssl, - WOLFSSL_VERIFY_PEER|WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT, - verifyIgnoreDateError); - - if (ret == 0) { - /* Return newly created wolfSSL context and object */ - *ctx = client_ctx; - *ssl = client_ssl; - } - else { - if (client_ssl != NULL) - wolfSSL_free(client_ssl); - if (client_ctx != NULL) - wolfSSL_CTX_free(client_ctx); - } - - return ret; -} - -/* Client connecting to server using TLS */ -static int wolfssl_client_connect(WOLFSSL* ssl) -{ - int ret = 0; - - if (wolfSSL_connect(ssl) != WOLFSSL_SUCCESS) { - printf("wolfSSL Error: %d\n", wolfSSL_get_error(ssl, -1)); - if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) - ret = -1; - } - - return ret; -} - - - -/* Create a new wolfSSL server with a certificate for authentication. */ -static int wolfssl_server_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) -{ - int ret = 0; - WOLFSSL_CTX* server_ctx = NULL; - WOLFSSL* server_ssl = NULL; - - /* Create and initialize WOLFSSL_CTX */ - if ((server_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_server_method_ex(HEAP_HINT_SERVER), - HEAP_HINT_SERVER)) == NULL) { - printf("ERROR: failed to create WOLFSSL_CTX\n"); - ret = -1; - } - - if (ret == 0) { - /* Load client certificates into WOLFSSL_CTX */ - if (wolfSSL_CTX_use_certificate_buffer(server_ctx, - server_cert_der_2048, sizeof_server_cert_der_2048, - WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { - printf("ERROR: failed to load server certificate\n"); - ret = -1; - } - } - - if (ret == 0) { - /* Load client certificates into WOLFSSL_CTX */ - if (wolfSSL_CTX_use_PrivateKey_buffer(server_ctx, - server_key_der_2048, sizeof_server_key_der_2048, - WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { - printf("ERROR: failed to load server key\n"); - ret = -1; - } - } - - if (ret == 0) { - /* Create a WOLFSSL object */ - if ((server_ssl = wolfSSL_new(server_ctx)) == NULL) { - printf("ERROR: failed to create WOLFSSL object\n"); - ret = -1; - } - } - - if (ret == 0) - wolfSSL_set_verify(server_ssl, WOLFSSL_VERIFY_PEER, - verifyIgnoreDateError); - - if (ret == 0) { - /* Return newly created wolfSSL context and object */ - *ctx = server_ctx; - *ssl = server_ssl; - } - else { - if (server_ssl != NULL) - wolfSSL_free(server_ssl); - if (server_ctx != NULL) - wolfSSL_CTX_free(server_ctx); - } - - return ret; -} - -/* Server accepting a client using TLS */ -static int wolfssl_server_accept(WOLFSSL* ssl) -{ - int ret = 0; - - if (wolfSSL_accept(ssl) != WOLFSSL_SUCCESS) { - printf("wolfSSL Error: %d\n", wolfSSL_get_error(ssl, -1)); - if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) - ret = -1; - } - - return ret; -} - - -/* Send application data. */ -static int wolfssl_send(WOLFSSL* ssl, const char* msg) -{ - int ret = 0; - int len; - - printf("Sending:\n%s\n", msg); - len = wolfSSL_write(ssl, msg, XSTRLEN(msg)); - if (len < 0) - ret = len; - else if (len != XSTRLEN(msg)) - ret = -1; - - return ret; -} - -/* Receive application data. */ -static int wolfssl_recv(WOLFSSL* ssl) -{ - int ret; - byte reply[256]; - - ret = wolfSSL_read(ssl, reply, sizeof(reply)-1); - if (ret > 0) { - reply[ret] = '\0'; - printf("Received:\n%s\n", reply); - ret = 1; - } - else if (wolfSSL_want_read(ssl) || wolfSSL_want_write(ssl)) - ret = 0; - - return ret; -} - - -/* Free the WOLFSSL object and context. */ -static void wolfssl_free(WOLFSSL_CTX* ctx, WOLFSSL* ssl) -{ - if (ssl != NULL) - wolfSSL_free(ssl); - if (ctx != NULL) - wolfSSL_CTX_free(ctx); -} - - -/* Display the static memory usage. */ -static void wolfssl_memstats(WOLFSSL* ssl) -{ -#ifdef WOLFSSL_STATIC_MEMORY - WOLFSSL_MEM_CONN_STATS ssl_stats; - - XMEMSET(&ssl_stats, 0 , sizeof(ssl_stats)); - - if (wolfSSL_is_static_memory(ssl, &ssl_stats) != 1) - printf("static memory was not used with ssl"); - else { - printf("*** This is memory state before wolfSSL_free is called\n"); - printf("peak connection memory = %d\n", ssl_stats.peakMem); - printf("current memory in use = %d\n", ssl_stats.curMem); - printf("peak connection allocs = %d\n", ssl_stats.peakAlloc); - printf("current connection allocs = %d\n",ssl_stats.curAlloc); - printf("total connection allocs = %d\n",ssl_stats.totalAlloc); - printf("total connection frees = %d\n\n", ssl_stats.totalFr); - } -#else - (void)ssl; -#endif -} - -int wolfssl_server_accept_tcp(WOLFSSL* ssl, SOCKET_T* fd, SOCKET_T* acceptfd) -{ - int ret = 0; - SOCKET_T sockfd; - SOCKET_T clientfd = WOLFSSL_SOCKET_INVALID; - SOCKADDR_IN_T client; - socklen_t client_len = sizeof(client); - word16 port = 443; - struct sockaddr_in bind_addr; - - sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); - bind_addr.sin_family = AF_INET; - bind_addr.sin_addr.s_addr = htonl(INADDR_ANY); - bind_addr.sin_port = htons(port); - if (bind(sockfd, (struct sockaddr *)&bind_addr, sizeof(bind_addr)) != 0) - ret = -1; - - if (ret == 0) { - *fd = sockfd; - printf("Server Listen\n"); - listen(sockfd, 5); - if (WOLFSSL_SOCKET_IS_INVALID(sockfd)) - ret = -1; - } - if (ret == 0) { - printf("Server Accept\n"); - clientfd = accept(sockfd, (struct sockaddr*)&client, - (ACCEPT_THIRD_T)&client_len); - if (WOLFSSL_SOCKET_IS_INVALID(clientfd)) - ret = -1; - } - if (ret == 0) { - *acceptfd = clientfd; - tcp_set_nonblocking(&clientfd); - - printf("Server has client\n"); - if (wolfSSL_set_fd(ssl, clientfd) != WOLFSSL_SUCCESS) - ret = -1; - } - - return ret; -} - -/* Thread to do the server operations. */ -void server_thread(void* arg1) -{ - int ret = 0; - WOLFSSL_CTX* server_ctx = NULL; - WOLFSSL* server_ssl = NULL; - SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID; - SOCKET_T clientfd = WOLFSSL_SOCKET_INVALID; - - -#ifdef WOLFSSL_STATIC_MEMORY - if (wc_LoadStaticMemory(&HEAP_HINT_SERVER, gMemoryServer, - sizeof(gMemoryServer), - WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { - printf("unable to load static memory"); - ret = -1; - } - - if (ret == 0) -#endif - ret = wolfssl_server_new(&server_ctx, &server_ssl); - - if (ret == 0) - ret = wolfssl_server_accept_tcp(server_ssl, &sockfd, &clientfd); - - while (ret == 0) { - k_sleep(Z_TIMEOUT_TICKS(100)); - ret = wolfssl_server_accept(server_ssl); - if (ret == 0 && wolfSSL_is_init_finished(server_ssl)) - break; - } - - /* Receive HTTP request */ - while (ret == 0) { - ret = wolfssl_recv(server_ssl); - } - if (ret == 1) - ret = 0; - /* Send HTTP response */ - if (ret == 0) - ret = wolfssl_send(server_ssl, msgHTTPIndex); - - printf("Server Return: %d\n", ret); - -#ifdef WOLFSSL_STATIC_MEMORY - printf("Server Memory Stats\n"); -#endif - wolfssl_memstats(server_ssl); - wolfssl_free(server_ctx, server_ssl); - if (clientfd != WOLFSSL_SOCKET_INVALID) - CloseSocket(clientfd); - if (sockfd != WOLFSSL_SOCKET_INVALID) - CloseSocket(sockfd); -} - -int wolfssl_client_connect_tcp(WOLFSSL* ssl, SOCKET_T* fd) -{ - int ret = 0; - SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID; - static struct addrinfo hints; - struct addrinfo* res; - - XMEMSET(&hints, 0, sizeof(hints)); - hints.ai_family = AF_INET; - hints.ai_socktype = SOCK_STREAM; - if (getaddrinfo("192.0.2.1", "443", &hints, &res) != 0) - ret = -1; - - if (ret == 0) { - printf("Client socket\n"); - sockfd = socket(res->ai_family, res->ai_socktype, res->ai_protocol); - if (WOLFSSL_SOCKET_IS_INVALID(sockfd)) - ret = -1; - } - if (ret == 0) { - *fd = sockfd; - tcp_set_nonblocking(&sockfd); - - printf("Client Connect\n"); - if (connect(sockfd, res->ai_addr, res->ai_addrlen) != 0) - ret = -1; - } - - if (ret == 0) { - printf("Client Connected\n"); - if (wolfSSL_set_fd(ssl, sockfd) != WOLFSSL_SUCCESS) - ret = -1; - } - - return ret; -} - -/* Thread to do the client operations. */ -void client_thread() -{ - int ret = 0; - WOLFSSL_CTX* client_ctx = NULL; - WOLFSSL* client_ssl = NULL; - SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID; - - /* Client connection */ - ret = wolfssl_client_new(&client_ctx, &client_ssl); - - if (ret == 0) - ret = wolfssl_client_connect_tcp(client_ssl, &sockfd); - - while (ret == 0) { - k_sleep(Z_TIMEOUT_TICKS(10)); - ret = wolfssl_client_connect(client_ssl); - if (ret == 0 && wolfSSL_is_init_finished(client_ssl)) - break; - } - - if (ret == 0) { - printf("Handshake complete\n"); - - /* Send HTTP request */ - ret = wolfssl_send(client_ssl, msgHTTPGet); - } - /* Receive HTTP response */ - while (ret == 0) { - k_sleep(Z_TIMEOUT_TICKS(10)); - ret = wolfssl_recv(client_ssl); - } - if (ret == 1) - ret = 0; - - printf("Client Return: %d\n", ret); - -#ifdef WOLFSSL_STATIC_MEMORY - printf("Client Memory Stats\n"); -#endif - wolfssl_memstats(client_ssl); - wolfssl_free(client_ctx, client_ssl); - if (sockfd != WOLFSSL_SOCKET_INVALID) - CloseSocket(sockfd); -} - -int main() -{ - THREAD_TYPE serverThread; - -#ifdef HAVE_FIPS - wolfCrypt_SetCb_fips(myFipsCb); -#endif - wolfSSL_Init(); -#ifdef DEBUG_WOLFSSL - wolfSSL_Debugging_ON(); -#endif - -#ifdef WOLFSSL_STATIC_MEMORY - if (wc_LoadStaticMemory(&HEAP_HINT_CLIENT, gMemoryClient, - sizeof(gMemoryClient), - WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { - printf("unable to load static memory"); - return -1; - } - - wolfsslThreadHeapHint = HEAP_HINT_CLIENT; -#endif - - /* Start server */ - if (wolfSSL_NewThread(&serverThread, server_thread, NULL) != 0) { - printf("Failed to start server thread\n"); - return -1; - } - - k_sleep(Z_TIMEOUT_TICKS(100)); - client_thread(); - /* Join is not working in qemu when the thread is still active. Wait for it - * to shut down to join it. */ - k_sleep(Z_TIMEOUT_TICKS(100)); - - if (wolfSSL_JoinThread(serverThread) != 0) { - printf("Failed to join server thread\n"); - return -1; - } - - wolfSSL_Cleanup(); - - printf("Done\n"); - - return 0; -} - diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt b/modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt deleted file mode 100644 index 55c2199ec565..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/CMakeLists.txt +++ /dev/null @@ -1,8 +0,0 @@ -cmake_minimum_required(VERSION 3.13.1) -find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE}) -project(wolfssl_tls_threaded) - -FILE(GLOB app_sources src/*.c) -target_sources(app PRIVATE ${app_sources}) -add_definitions(-DWOLFSSL_USER_SETTINGS) - diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/README b/modules/wolfssl/samples/wolfssl_tls_thread/README deleted file mode 100644 index 906a6c9bac81..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/README +++ /dev/null @@ -1,12 +0,0 @@ - -wolfSSL (formerly known as CyaSSL) and wolfCrypt are either licensed for use -under the GPLv2 or a standard commercial license. For our users who cannot use -wolfSSL under GPLv2, a commercial license to wolfSSL and wolfCrypt is available. -Please contact wolfSSL Inc. directly at: - -Email: licensing@wolfssl.com -Phone: +1 425 245-8247 - -More information can be found on the wolfSSL website at www.wolfssl.com. - - diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf b/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf deleted file mode 100644 index 98d8bc49632a..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf +++ /dev/null @@ -1,22 +0,0 @@ -# Set user_settings.h file to be used for native wolfSSL build settings -#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" - -##### PSA and CC3XX ##### -# Enable Nordic Security Module -CONFIG_NRF_SECURITY=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y -# Enable PSA API support (comes from mbedTLS) -CONFIG_MBEDTLS_PSA_CRYPTO_C=y -# Enable/configure mbedTLS heap -CONFIG_MBEDTLS_ENABLE_HEAP=y -CONFIG_MBEDTLS_HEAP_SIZE=8192 -# Disable nrf_oberon crypto library PSA backend -CONFIG_PSA_CRYPTO_DRIVER_OBERON=n -# Enable ARM CryptoCell cc3xx driver PSA backend -CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y - -##### Logging ##### -CONFIG_USE_SEGGER_RTT=y -CONFIG_LOG_BACKEND_RTT=y -CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 - diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf b/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf deleted file mode 100644 index aa3bbe18ad3b..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf +++ /dev/null @@ -1,25 +0,0 @@ -CONFIG_BUILD_WITH_TFM=y -CONFIG_TFM_PROFILE_TYPE_NOT_SET=y - -# Set user_settings.h file to be used for native wolfSSL build settings -#CONFIG_WOLFSSL_SETTINGS_FILE="user_settings_custom.h" - -##### PSA and CC3XX ##### -# Enable Nordic Security Module -CONFIG_NRF_SECURITY=y -CONFIG_ENTROPY_DEVICE_RANDOM_GENERATOR=y -# Enable PSA API support (comes from mbedTLS) -CONFIG_MBEDTLS_PSA_CRYPTO_C=y -# Enable/configure mbedTLS heap -CONFIG_MBEDTLS_ENABLE_HEAP=y -CONFIG_MBEDTLS_HEAP_SIZE=8192 -# Disable nrf_oberon crypto library PSA backend -CONFIG_PSA_CRYPTO_DRIVER_OBERON=n -# Enable ARM CryptoCell cc3xx driver PSA backend -CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y - -##### Logging ##### -CONFIG_USE_SEGGER_RTT=y -CONFIG_LOG_BACKEND_RTT=y -CONFIG_SEGGER_RTT_BUFFER_SIZE_UP=15360 - diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh b/modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh deleted file mode 100755 index 210821f753c7..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/install_sample.sh +++ /dev/null @@ -1,31 +0,0 @@ -#!/bin/sh - -ZEPHYR_DIR= -if [ $# -ne 1 ]; then - echo "Need location of zephyr project as a command line argument" - exit 1 -else - ZEPHYR_DIR=$1 -fi -if [ ! -d $ZEPHR_DIR ]; then - echo "Zephyr project directory does not exist: $ZEPHYR_DIR" - exit 1 -fi -ZEPHYR_SAMPLES_DIR=$ZEPHYR_DIR/zephyr/samples/modules -if [ ! -d $ZEPHYR_SAMPLES_DIR ]; then - echo "Zephyr samples/modules directory does not exist: $ZEPHYR_SAMPLES_DIR" - exit 1 -fi -ZEPHYR_WOLFSSL_DIR=$ZEPHYR_SAMPLES_DIR/wolfssl_tls_thread - -echo "wolfSSL directory:" -echo " $ZEPHYR_WOLFSSL_DIR" -rm -rf $ZEPHYR_WOLFSSL_DIR -mkdir $ZEPHYR_WOLFSSL_DIR - -echo "Copy in Sample files ..." -cp -r * $ZEPHYR_WOLFSSL_DIR/ -rm $ZEPHYR_WOLFSSL_DIR/$0 - -echo "Done" - diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/prj.conf b/modules/wolfssl/samples/wolfssl_tls_thread/prj.conf deleted file mode 100644 index 185a7b24c07b..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/prj.conf +++ /dev/null @@ -1,43 +0,0 @@ -# Kernel options -CONFIG_MAIN_STACK_SIZE=16384 -CONFIG_ENTROPY_GENERATOR=y -CONFIG_TEST_RANDOM_GENERATOR=y -CONFIG_INIT_STACKS=y -CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=131072 - -# Pthreads -CONFIG_PTHREAD_IPC=y - -# Clock for time() -CONFIG_POSIX_CLOCK=y - -# Networking -CONFIG_NETWORKING=y -CONFIG_NET_TEST=y -CONFIG_NET_IPV4=y -CONFIG_NET_IPV6=y -CONFIG_NET_SOCKETS=y -CONFIG_DNS_RESOLVER=y - -# Logging -CONFIG_PRINTK=y -CONFIG_LOG=y -CONFIG_LOG_MODE_IMMEDIATE=y -CONFIG_WOLFSSL_DEBUG=y - -# Enable logging using RTT and UART -#CONFIG_CBPRINTF_LIBC_SUBSTS=y -#CONFIG_CBPRINTF_FP_SUPPORT=y -#CONFIG_CONSOLE=y -#CONFIG_LOG_BACKEND_UART=y -#CONFIG_LOG_BUFFER_SIZE=15360 - -# TLS configuration -CONFIG_WOLFSSL=y -CONFIG_WOLFSSL_BUILTIN=y - -CONFIG_WOLFSSL_TLS_VERSION_1_3=y -CONFIG_WOLFSSL_KEY_EXCHANGE_ALL_ENABLED=y -CONFIG_WOLFSSL_CIPHER_ALL_ENABLED=y -CONFIG_WOLFSSL_MAC_ALL_ENABLED=y -CONFIG_WOLFSSL_HMAC_DRBG_ENABLED=y diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml b/modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml deleted file mode 100644 index 270648b60d4f..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/sample.yaml +++ /dev/null @@ -1,18 +0,0 @@ -sample: - description: wolfSSL TLS test application - name: wolfSSL TLS Test -common: - harness: console - harness_config: - type: multi_line - regex: - - "Server Return: 0" - - "Server Error: 0" - - "Client Return: 0" - - "Client Error: 0" -tests: - sample.crypto.wolfssl_tls_thread: - timeout: 60 - platform_allow: qemu_x86 - integration_platforms: - - qemu_x86 diff --git a/modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c b/modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c deleted file mode 100644 index cd7aad9016ea..000000000000 --- a/modules/wolfssl/samples/wolfssl_tls_thread/src/tls_threaded.c +++ /dev/null @@ -1,671 +0,0 @@ -/* tls_threaded.c - * - * Copyright (C) 2006-2023 wolfSSL Inc. - * - * This file is part of wolfSSL. - * - * wolfSSL is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * wolfSSL is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA - */ - -#ifndef WOLFSSL_USER_SETTINGS - #include -#endif -#include -#include -#define USE_CERT_BUFFERS_256 -#include -#include - -#ifdef WOLFSSL_ZEPHYR -#define printf printk -#endif - -/* wolfSSL PSA Crypto API integration with ECDH/ECDSA currently requires - * use of wolfSSL Public Key (PK) callbacks. - * - * PSA Crypto API integration for this sample was tested on a - * Nordic nRF5340dk. - */ -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - #include -#endif - -#define BUFFER_SIZE 2048 -#define STATIC_MEM_SIZE (192*1024) - -#ifdef WOLFSSL_STATIC_MEMORY - static WOLFSSL_HEAP_HINT* HEAP_HINT_SERVER; - static WOLFSSL_HEAP_HINT* HEAP_HINT_CLIENT; - - static byte gMemoryServer[STATIC_MEM_SIZE]; - static byte gMemoryClient[STATIC_MEM_SIZE]; -#else - #define HEAP_HINT_SERVER NULL - #define HEAP_HINT_CLIENT NULL -#endif /* WOLFSSL_STATIC_MEMORY */ - -/* Buffer to hold data for client to read. */ -unsigned char client_buffer[BUFFER_SIZE]; -int client_buffer_sz = 0; -wolfSSL_Mutex client_mutex; - -/* Buffer to hold data for server to read. */ -unsigned char server_buffer[BUFFER_SIZE]; -int server_buffer_sz = 0; -wolfSSL_Mutex server_mutex; - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) -static struct psa_ssl_ctx server_psa_ctx; -static struct psa_ssl_ctx client_psa_ctx; -/* psa_key_id_t representing server key loaded into PSA Crypto API */ -static psa_key_id_t ecc_key_id; -#endif - -/* Application data to send. */ -static const char msgHTTPGet[] = "GET /index.html HTTP/1.0\r\n\r\n"; -static const char msgHTTPIndex[] = - "HTTP/1.1 200 OK\n" - "Content-Type: text/html\n" - "Connection: close\n" - "\n" - "\n" - "\n" - "Welcome to wolfSSL!\n" - "\n" - "\n" - "

wolfSSL has successfully performed handshake!

\n" - "\n" - "\n"; - -#ifdef HAVE_FIPS -static void myFipsCb(int ok, int err, const char* hash) -{ - printf("in my Fips callback, ok = %d, err = %d\n", ok, err); - printf("message = %s\n", wc_GetErrorString(err)); - printf("hash = %s\n", hash); - - if (err == IN_CORE_FIPS_E) { - printf("In core integrity hash check failure, copy above hash\n"); - printf("into verifyCore[] in fips_test.c and rebuild\n"); - } -} -#endif - -/* wolfSSL client wants to read data from the server. */ -static int recv_client(WOLFSSL* ssl, char* buff, int sz, void* ctx) -{ - wc_LockMutex(&client_mutex); - if (client_buffer_sz > 0) { - /* Take as many bytes is available or requested from buffer. */ - if (sz > client_buffer_sz) - sz = client_buffer_sz; - XMEMCPY(buff, client_buffer, sz); - if (sz < client_buffer_sz) { - XMEMMOVE(client_buffer, client_buffer + sz, client_buffer_sz - sz); - } - client_buffer_sz -= sz; - } - else - sz = WOLFSSL_CBIO_ERR_WANT_READ; - wc_UnLockMutex(&client_mutex); - - return sz; -} - -/* wolfSSL client wants to write data to the server. */ -static int send_client(WOLFSSL* ssl, char* buff, int sz, void* ctx) -{ - wc_LockMutex(&server_mutex); - if (server_buffer_sz < BUFFER_SIZE) - { - /* Put in as many bytes requested or will fit in buffer. */ - if (sz > BUFFER_SIZE - server_buffer_sz) - sz = BUFFER_SIZE - server_buffer_sz; - XMEMCPY(server_buffer + server_buffer_sz, buff, sz); - server_buffer_sz += sz; - } - else - sz = WOLFSSL_CBIO_ERR_WANT_WRITE; - wc_UnLockMutex(&server_mutex); - - return sz; -} - -/* wolfSSL server wants to read data from the client. */ -static int recv_server(WOLFSSL* ssl, char* buff, int sz, void* ctx) -{ - wc_LockMutex(&server_mutex); - if (server_buffer_sz > 0) { - /* Take as many bytes is available or requested from buffer. */ - if (sz > server_buffer_sz) - sz = server_buffer_sz; - XMEMCPY(buff, server_buffer, sz); - if (sz < server_buffer_sz) { - XMEMMOVE(server_buffer, server_buffer + sz, server_buffer_sz - sz); - } - server_buffer_sz -= sz; - } - else - sz = WOLFSSL_CBIO_ERR_WANT_READ; - wc_UnLockMutex(&server_mutex); - - return sz; -} - -/* wolfSSL server wants to write data to the client. */ -static int send_server(WOLFSSL* ssl, char* buff, int sz, void* ctx) -{ - wc_LockMutex(&client_mutex); - if (client_buffer_sz < BUFFER_SIZE) - { - /* Put in as many bytes requested or will fit in buffer. */ - if (sz > BUFFER_SIZE - client_buffer_sz) - sz = BUFFER_SIZE - client_buffer_sz; - XMEMCPY(client_buffer + client_buffer_sz, buff, sz); - client_buffer_sz += sz; - } - else - sz = WOLFSSL_CBIO_ERR_WANT_WRITE; - wc_UnLockMutex(&client_mutex); - - return sz; -} - -/* DO NOT use this in production. You should implement a way - * to get the current date. */ -static int verifyIgnoreDateError(int preverify, WOLFSSL_X509_STORE_CTX* store) -{ - if (store->error == ASN_BEFORE_DATE_E) - return 1; /* override error */ - else - return preverify; -} - -/* Create a new wolfSSL client with a server CA certificate. */ -static int wolfssl_client_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) -{ - int ret = 0; - WOLFSSL_CTX* client_ctx = NULL; - WOLFSSL* client_ssl = NULL; - - /* Create and initialize WOLFSSL_CTX */ - if ((client_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_client_method(), - HEAP_HINT_CLIENT)) == NULL) { - printf("ERROR: failed to create WOLFSSL_CTX\n"); - ret = -1; - } - - if (ret == 0) { - /* Load client certificates into WOLFSSL_CTX */ - if (wolfSSL_CTX_load_verify_buffer_ex(client_ctx, ca_ecc_cert_der_256, - sizeof_ca_ecc_cert_der_256, WOLFSSL_FILETYPE_ASN1, 0, - /* DO NOT use this in production. You should - * implement a way to get the current date. */ - WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY) != - WOLFSSL_SUCCESS) { - printf("ERROR: failed to load CA certificate\n"); - ret = -1; - } - } - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - if (ret == 0) { - if (wolfSSL_CTX_psa_enable(client_ctx) != WOLFSSL_SUCCESS) { - printf("ERROR: failed to enable PSA Crypto API for WOLFSSL_CTX\n"); - ret = -1; - } - } -#endif - - if (ret == 0) { - /* Register callbacks */ - wolfSSL_SetIORecv(client_ctx, recv_client); - wolfSSL_SetIOSend(client_ctx, send_client); - - /* Create a WOLFSSL object */ - if ((client_ssl = wolfSSL_new(client_ctx)) == NULL) { - printf("ERROR: failed to create WOLFSSL object\n"); - ret = -1; - } - } - - if (ret == 0) - wolfSSL_set_verify(client_ssl, - WOLFSSL_VERIFY_PEER|WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT, - verifyIgnoreDateError); - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - if (ret == 0) { - XMEMSET(&client_psa_ctx, 0, sizeof(client_psa_ctx)); - if (wolfSSL_set_psa_ctx(client_ssl, &client_psa_ctx) != WOLFSSL_SUCCESS) { - printf("ERROR: wolfSSL_set_psa_ctx() failed\n"); - ret = -1; - } - } -#endif - - if (ret == 0) { - /* make wolfSSL object nonblocking */ - wolfSSL_set_using_nonblock(client_ssl, 1); - - /* Return newly created wolfSSL context and object */ - *ctx = client_ctx; - *ssl = client_ssl; - } - else { - if (client_ssl != NULL) { -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - wolfSSL_free_psa_ctx(&client_psa_ctx); -#endif - wolfSSL_free(client_ssl); - } - if (client_ctx != NULL) - wolfSSL_CTX_free(client_ctx); - } - - return ret; -} - -/* Client connecting to server using TLS */ -static int wolfssl_client_connect(WOLFSSL* ssl) -{ - int ret = 0; - - if (wolfSSL_connect(ssl) != WOLFSSL_SUCCESS) { - if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) - ret = -1; - } - - return ret; -} - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - -/* ./certs/ecc-key.pem */ -static const unsigned char ecc_key_256[] = -{ - 0x45, 0xB6, 0x69, 0x02, 0x73, 0x9C, 0x6C, 0x85, 0xA1, 0x38, - 0x5B, 0x72, 0xE8, 0xE8, 0xC7, 0xAC, 0xC4, 0x03, 0x8D, 0x53, - 0x35, 0x04, 0xFA, 0x6C, 0x28, 0xDC, 0x34, 0x8D, 0xE1, 0xA8, - 0x09, 0x8C -}; - -/* Provision server private key using PSA Crypto API. - * - * key_id - resulting psa_key_id_t - * - * Returns - 0 on success, negative on error - */ -static int psa_private_key_provisioning(psa_key_id_t *key_id) -{ - psa_key_attributes_t key_attr = { 0 }; - psa_key_type_t key_type; - psa_status_t status; - - key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1); - - psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_SIGN_HASH); - psa_set_key_lifetime(&key_attr, PSA_KEY_LIFETIME_VOLATILE); - psa_set_key_algorithm(&key_attr, PSA_ALG_ECDSA(PSA_ALG_SHA_256)); - psa_set_key_type(&key_attr, key_type); - psa_set_key_bits(&key_attr, 256); - - status = psa_import_key(&key_attr, ecc_key_256, - sizeof(ecc_key_256), key_id); - - if (status != PSA_SUCCESS) { - printf("ERROR: provisioning of private key failed: [%d] \n", status); - return -1; - } - - return 0; -} - -#endif /* WOLFSSL_HAVE_PSA & HAVE_PK_CALLBACKS */ - -/* Create a new wolfSSL server with a certificate for authentication. */ -static int wolfssl_server_new(WOLFSSL_CTX** ctx, WOLFSSL** ssl) -{ - int ret = 0; - WOLFSSL_CTX* server_ctx = NULL; - WOLFSSL* server_ssl = NULL; - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - /* Provision ECC private key with PSA Crypto API */ - if (psa_private_key_provisioning(&ecc_key_id) != 0) { - printf("ERROR: failed to provision PSA private key\n"); - ret = -1; - } - - if (ret == 0) { - XMEMSET(&server_psa_ctx, 0, sizeof(server_psa_ctx)); - wolfSSL_psa_set_private_key_id(&server_psa_ctx, ecc_key_id); - } -#endif - - if (ret == 0) { - /* Create and initialize WOLFSSL_CTX */ - if ((server_ctx = wolfSSL_CTX_new_ex(wolfTLSv1_3_server_method(), - HEAP_HINT_SERVER)) == NULL) { - printf("ERROR: failed to create WOLFSSL_CTX\n"); - ret = -1; - } - } - - if (ret == 0) { - /* Load client certificates into WOLFSSL_CTX */ - if (wolfSSL_CTX_use_certificate_buffer(server_ctx, - serv_ecc_der_256, sizeof_serv_ecc_der_256, - WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { - printf("ERROR: failed to load server certificate\n"); - ret = -1; - } - } - -#if !defined(WOLFSSL_HAVE_PSA) || \ - (defined(WOLFSSL_HAVE_PSA) && !defined(HAVE_PK_CALLBACKS)) - if (ret == 0) { - /* Load client certificates into WOLFSSL_CTX */ - if (wolfSSL_CTX_use_PrivateKey_buffer(server_ctx, - ecc_key_der_256, sizeof_ecc_key_der_256, - WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) { - printf("ERROR: failed to load server key\n"); - ret = -1; - } - } -#else - if (ret == 0) { - if (wolfSSL_CTX_psa_enable(server_ctx) != WOLFSSL_SUCCESS) { - printf("ERROR: failed to enable PSA\n"); - ret = -1; - } - } -#endif /* WOLFSSL_HAVE_PSA */ - - if (ret == 0) { - /* Register callbacks */ - wolfSSL_SetIORecv(server_ctx, recv_server); - wolfSSL_SetIOSend(server_ctx, send_server); - - /* Create a WOLFSSL object */ - if ((server_ssl = wolfSSL_new(server_ctx)) == NULL) { - printf("ERROR: failed to create WOLFSSL object\n"); - ret = -1; - } - } - - if (ret == 0) - wolfSSL_set_verify(server_ssl, WOLFSSL_VERIFY_PEER, - verifyIgnoreDateError); - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - if (ret == 0) { - if (wolfSSL_set_psa_ctx(server_ssl, &server_psa_ctx) - != WOLFSSL_SUCCESS) { - printf("ERROR: failed to enable PSA in WOLFSSL struct\n"); - ret = -1; - } - } -#endif - - if (ret == 0) { - /* make wolfSSL object nonblocking */ - wolfSSL_set_using_nonblock(server_ssl, 1); - - /* Return newly created wolfSSL context and object */ - *ctx = server_ctx; - *ssl = server_ssl; - } - else { - if (server_ssl != NULL) { -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - wolfSSL_free_psa_ctx(&server_psa_ctx); -#endif - wolfSSL_free(server_ssl); - } - if (server_ctx != NULL) - wolfSSL_CTX_free(server_ctx); - } - - return ret; -} - -/* Server accepting a client using TLS */ -static int wolfssl_server_accept(WOLFSSL* ssl) -{ - int ret = 0; - - if (wolfSSL_accept(ssl) != WOLFSSL_SUCCESS) { - if (!wolfSSL_want_read(ssl) && !wolfSSL_want_write(ssl)) - ret = -1; - } - - return ret; -} - - -/* Send application data. */ -static int wolfssl_send(WOLFSSL* ssl, const char* msg) -{ - int ret = 0; - int len; - - printf("Sending:\n%s\n", msg); - len = wolfSSL_write(ssl, msg, XSTRLEN(msg)); - if (len < 0) - ret = len; - else if (len != XSTRLEN(msg)) - ret = -1; - - return ret; -} - -/* Receive application data. */ -static int wolfssl_recv(WOLFSSL* ssl) -{ - int ret; - byte reply[256]; - - ret = wolfSSL_read(ssl, reply, sizeof(reply)-1); - if (ret > 0) { - reply[ret] = '\0'; - printf("Received:\n%s\n", reply); - ret = 1; - } - else if (wolfSSL_want_read(ssl) || wolfSSL_want_write(ssl)) - ret = 0; - - return ret; -} - - -/* Free the WOLFSSL object and context. */ -static void wolfssl_free(WOLFSSL_CTX* ctx, WOLFSSL* ssl) -{ - if (ssl != NULL) - wolfSSL_free(ssl); - if (ctx != NULL) - wolfSSL_CTX_free(ctx); -} - - -/* Display the static memory usage. */ -static void wolfssl_memstats(WOLFSSL* ssl) -{ -#ifdef WOLFSSL_STATIC_MEMORY - WOLFSSL_MEM_CONN_STATS ssl_stats; - - XMEMSET(&ssl_stats, 0 , sizeof(ssl_stats)); - - if (wolfSSL_is_static_memory(ssl, &ssl_stats) != 1) - printf("static memory was not used with ssl"); - else { - printf("*** This is memory state before wolfSSL_free is called\n"); - printf("peak connection memory = %d\n", ssl_stats.peakMem); - printf("current memory in use = %d\n", ssl_stats.curMem); - printf("peak connection allocs = %d\n", ssl_stats.peakAlloc); - printf("current connection allocs = %d\n",ssl_stats.curAlloc); - printf("total connection allocs = %d\n",ssl_stats.totalAlloc); - printf("total connection frees = %d\n\n", ssl_stats.totalFr); - } -#else - (void)ssl; -#endif -} - -/* Thread to do the server operations. */ -void server_thread(void* arg1) -{ - int ret = 0; - WOLFSSL_CTX* server_ctx = NULL; - WOLFSSL* server_ssl = NULL; - -#ifdef WOLFSSL_STATIC_MEMORY - if (wc_LoadStaticMemory(&HEAP_HINT_SERVER, gMemoryServer, - sizeof(gMemoryServer), - WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { - printf("unable to load static memory"); - ret = -1; - } - - if (ret == 0) -#endif - ret = wolfssl_server_new(&server_ctx, &server_ssl); - - while (ret == 0) { - ret = wolfssl_server_accept(server_ssl); - if (ret == 0 && wolfSSL_is_init_finished(server_ssl)) - break; - } - - /* Receive HTTP request */ - while (ret == 0) { - ret = wolfssl_recv(server_ssl); - } - if (ret == 1) - ret = 0; - /* Send HTTP response */ - if (ret == 0) - ret = wolfssl_send(server_ssl, msgHTTPIndex); - - printf("Server Return: %d\n", ret); - printf("Server Error: %d\n", wolfSSL_get_error(server_ssl, ret)); - -#ifdef WOLFSSL_STATIC_MEMORY - printf("Server Memory Stats\n"); -#endif - wolfssl_memstats(server_ssl); - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - if (server_ssl != NULL) { - wolfSSL_free_psa_ctx(&server_psa_ctx); - } -#endif - wolfssl_free(server_ctx, server_ssl); -} - -int main() -{ - int ret = 0; - WOLFSSL_CTX* client_ctx = NULL; - WOLFSSL* client_ssl = NULL; - THREAD_TYPE serverThread; - - /* set dummy wallclock time for cert validation without NTP/etc */ - struct timespec utctime; - utctime.tv_sec = 1658510212; /* Friday, July 22, 2022 5:16:52 PM GMT */ - utctime.tv_nsec = 0; - clock_settime(CLOCK_REALTIME, &utctime); - -#ifdef HAVE_FIPS - wolfCrypt_SetCb_fips(myFipsCb); -#endif - wolfSSL_Init(); -#ifdef DEBUG_WOLFSSL - wolfSSL_Debugging_ON(); -#endif - - wc_InitMutex(&client_mutex); - wc_InitMutex(&server_mutex); - - /* Start server */ - if (wolfSSL_NewThread(&serverThread, server_thread, NULL) != 0) { - printf("Failed to start server thread\n"); - return -1; - } - -#ifdef WOLFSSL_STATIC_MEMORY - if (wc_LoadStaticMemory(&HEAP_HINT_CLIENT, gMemoryClient, - sizeof(gMemoryClient), - WOLFMEM_GENERAL | WOLFMEM_TRACK_STATS, 1) != 0) { - printf("unable to load static memory"); - ret = -1; - } - - if (ret == 0) -#endif - { - /* Client connection */ - ret = wolfssl_client_new(&client_ctx, &client_ssl); - } - - while (ret == 0) { - ret = wolfssl_client_connect(client_ssl); - if (ret == 0 && wolfSSL_is_init_finished(client_ssl)) - break; - k_sleep(Z_TIMEOUT_TICKS(10)); - } - - if (ret == 0) { - printf("Handshake complete\n"); - - /* Send HTTP request */ - ret = wolfssl_send(client_ssl, msgHTTPGet); - } - /* Receive HTTP response */ - while (ret == 0) { - k_sleep(Z_TIMEOUT_TICKS(10)); - ret = wolfssl_recv(client_ssl); - } - if (ret == 1) - ret = 0; - - printf("Client Return: %d\n", ret); - printf("Client Error: %d\n", wolfSSL_get_error(client_ssl, ret)); - - if (wolfSSL_JoinThread(serverThread) != 0) { - printf("Failed to join server thread\n"); - return -1; - } - -#ifdef WOLFSSL_STATIC_MEMORY - printf("Client Memory Stats\n"); -#endif - wolfssl_memstats(client_ssl); - -#if defined(WOLFSSL_HAVE_PSA) && defined(HAVE_PK_CALLBACKS) - if (client_ssl != NULL) { - wolfSSL_free_psa_ctx(&client_psa_ctx); - } -#endif - wolfssl_free(client_ctx, client_ssl); - - wolfSSL_Cleanup(); - - printf("Done\n"); - - return (ret == 0) ? 0 : 1; -} - From 2bab8b03d520eb6b15305606116a9d0caff6483d Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Fri, 12 Jul 2024 10:31:23 -0700 Subject: [PATCH 10/12] Update wolfssl place in west.yml to be in alphabetical order --- west.yml | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/west.yml b/west.yml index 59529054eac9..4166bf9aae12 100644 --- a/west.yml +++ b/west.yml @@ -286,11 +286,6 @@ manifest: path: modules/crypto/mbedtls groups: - crypto - - name: wolfssl - revision: 1cf96eb72c0113767daf34c3a916f0c8c8741aac - path: modules/crypto/wolfssl - groups: - - crypto - name: mcuboot revision: fb2cf0ec3da3687b93f28e556ab682bdd4b85223 path: bootloader/mcuboot @@ -331,12 +326,6 @@ manifest: path: modules/crypto/tinycrypt groups: - crypto - - name: wolfssl - path: modules/crypto/wolfssl - revision: master - remote: wolfssl - groups: - - crypto - name: trusted-firmware-m revision: f8d3a903578192d226ac1552f383d95b94ee8780 path: modules/tee/tf-m/trusted-firmware-m @@ -350,6 +339,11 @@ manifest: - name: uoscore-uedhoc revision: 84ef879a46d7bfd9a423fbfb502b04289861f9ea path: modules/lib/uoscore-uedhoc + - name: wolfssl + revision: 1cf96eb72c0113767daf34c3a916f0c8c8741aac + path: modules/crypto/wolfssl + groups: + - crypto - name: zcbor revision: 75d088037eb237b18e7ec1f47c9ce494b9b95aab path: modules/lib/zcbor From c879dca3f20d6fe7f4f5f5c11b1fd7c63426578f Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 23 Jul 2024 08:35:48 -0700 Subject: [PATCH 11/12] Remove wolfssl from west manifest --- west.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/west.yml b/west.yml index 0d9bb8ca1145..4e3e8efcdd43 100644 --- a/west.yml +++ b/west.yml @@ -339,11 +339,6 @@ manifest: - name: uoscore-uedhoc revision: 84ef879a46d7bfd9a423fbfb502b04289861f9ea path: modules/lib/uoscore-uedhoc - - name: wolfssl - revision: 1cf96eb72c0113767daf34c3a916f0c8c8741aac - path: modules/crypto/wolfssl - groups: - - crypto - name: zcbor revision: 75d088037eb237b18e7ec1f47c9ce494b9b95aab path: modules/lib/zcbor From 6e7fda180879338f471b7ce5edaf7479917dc346 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 23 Jul 2024 08:46:26 -0700 Subject: [PATCH 12/12] Remove wolfssl as default module --- modules/wolfssl/CMakeLists.txt | 193 --------- modules/wolfssl/Kconfig | 134 ------- modules/wolfssl/Kconfig.tls-generic | 267 ------------- modules/wolfssl/README.md | 104 ----- modules/wolfssl/include.am | 43 -- modules/wolfssl/user_settings-no-malloc.h | 170 -------- modules/wolfssl/user_settings.h | 462 ---------------------- modules/wolfssl/wolfssl/options.h | 1 - modules/wolfssl/zephyr_init.c | 22 -- 9 files changed, 1396 deletions(-) delete mode 100644 modules/wolfssl/CMakeLists.txt delete mode 100644 modules/wolfssl/Kconfig delete mode 100644 modules/wolfssl/Kconfig.tls-generic delete mode 100644 modules/wolfssl/README.md delete mode 100644 modules/wolfssl/include.am delete mode 100644 modules/wolfssl/user_settings-no-malloc.h delete mode 100644 modules/wolfssl/user_settings.h delete mode 100644 modules/wolfssl/wolfssl/options.h delete mode 100644 modules/wolfssl/zephyr_init.c diff --git a/modules/wolfssl/CMakeLists.txt b/modules/wolfssl/CMakeLists.txt deleted file mode 100644 index ed5900aaec7f..000000000000 --- a/modules/wolfssl/CMakeLists.txt +++ /dev/null @@ -1,193 +0,0 @@ -if(CONFIG_WOLFSSL) - zephyr_interface_library_named(wolfSSL) - - if(CONFIG_WOLFSSL_BUILTIN) - if(CONFIG_WOLFSSL_SETTINGS_FILE) - target_compile_definitions(wolfSSL INTERFACE - WOLFSSL_SETTINGS_FILE="${CONFIG_WOLFSSL_SETTINGS_FILE}" - ) - zephyr_include_directories( - ${APPLICATION_CONFIG_DIR} - ${APPLICATION_CONFIG_DIR}/src - ) - endif() - - zephyr_include_directories( - ${ZEPHYR_CURRENT_MODULE_DIR} - ${ZEPHYR_CURRENT_MODULE_DIR}/wolfssl - ${ZEPHYR_CURRENT_MODULE_DIR}/zephyr - ) - - zephyr_library() - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/zephyr/zephyr_init.c) - - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/crl.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/dtls.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/dtls13.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/internal.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/keys.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/ocsp.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/sniffer.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/ssl.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/tls.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/tls13.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/src/wolfio.c) - - # FIPS Boundary - if(CONFIG_WOLFCRYPT_FIPS) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfcrypt_first.c) - endif() - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/hmac.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/random.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/kdf.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/rsa.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ecc.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha256.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha512.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha3.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/dh.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/cmac.c) - if(CONFIG_WOLFCRYPT_FIPS) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fips.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fips_test.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfcrypt_last.c) - endif() - - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/arc4.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/asm.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/asn.c) - #zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/async.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/blake2b.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/blake2s.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/camellia.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/chacha.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/chacha20_poly1305.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/coding.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/compress.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/cpuid.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/cryptocb.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/curve25519.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/curve448.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/des3.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/dilithium.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/dsa.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ecc_fp.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/eccsi.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ed25519.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ed448.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/error.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ext_kyber.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/falcon.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fe_448.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fe_low_mem.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/fe_operations.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ge_448.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ge_low_mem.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ge_operations.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/hash.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/integer.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/logging.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/md2.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/md4.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/md5.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/memory.c) - #zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/misc.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/pkcs12.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/pkcs7.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/poly1305.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/pwdbased.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/ripemd.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sakke.c) - #zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/selftest.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/signature.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/siphash.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_arm32.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_arm64.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_armthumb.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_c32.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_c64.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_cortexm.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_dsp32.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_int.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sp_x86_64.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sphincs.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/srp.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/tfm.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_dsp.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_encrypt.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_pkcs11.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wc_port.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfevent.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/wolfmath.c) - - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/liboqs/liboqs.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_aes.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_hash.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/psa/psa_pkcbs.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/st/stm32.c) - - if(CONFIG_WOLFCRYPT_ARMASM) - # tested with board: "qemu_kvm_arm64" - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-aes.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha256.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha512.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha512-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-sha3-asm_c.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-poly1305.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-chacha.c) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/port/arm/armv8-curve25519_c.c) - - # Note: The cmake/gcc-m-cpu.cmake make need updated to add "+crypto -mstrict-align" - set(TOOLCHAIN_C_FLAGS "-mcpu=cortex-a53+crypto -mstrict-align") - endif() - - if(CONFIG_WOLFCRYPT_INTELASM) - # tested with board: "qemu_x86_64" - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha256_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha512_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/sha3_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/chacha_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/poly1305_asm.S) - - # AESNI - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes_asm.S) - zephyr_library_sources(${ZEPHYR_CURRENT_MODULE_DIR}/wolfcrypt/src/aes_gcm_x86_asm.S) - set(TOOLCHAIN_C_FLAGS "-march=native -maes -msse4 -mpclmul ") - endif() - - zephyr_library_link_libraries(wolfSSL) - - target_compile_definitions(wolfSSL INTERFACE WOLFSSL_ZEPHYR) - target_compile_definitions(wolfSSL INTERFACE WOLFSSL_USER_SETTINGS) - if(CONFIG_WOLFSSL_DEBUG) - target_compile_definitions(wolfSSL INTERFACE DEBUG_WOLFSSL) - zephyr_library_compile_options(-g3 -O0) - endif() - else() - assert(CONFIG_WOLFSSL_LIBRARY "wolfSSL was enabled, but neither BUILTIN or LIBRARY was selected.") - - # NB: CONFIG_WOLFSSL_LIBRARY is not regression tested and is - # therefore susceptible to bit rot - - target_include_directories(wolfSSL INTERFACE - ${CONFIG_WOLFSSL_INSTALL_PATH} - ) - - zephyr_link_libraries( - wolfssl_external - -L${CONFIG_WOLFSSL_INSTALL_PATH} - gcc - ) - # Lib wolfssl depends on libgcc so to allow - # wolfssl to link with gcc we need to ensure it is placed - # after wolfssl_external on the linkers command line. - endif() - - target_link_libraries(wolfSSL INTERFACE zephyr_interface) - -endif() diff --git a/modules/wolfssl/Kconfig b/modules/wolfssl/Kconfig deleted file mode 100644 index 1bf1f25bd924..000000000000 --- a/modules/wolfssl/Kconfig +++ /dev/null @@ -1,134 +0,0 @@ -# Kconfig - Cryptography primitive options for wolfSSL - -# -# Copyright (c) 2016 Intel Corporation -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# - -config ZEPHYR_WOLFSSL_MODULE - bool -config WOLFSSL_PROMPTLESS - bool - help - Symbol to disable the prompt for WOLFSSL selection. - This symbol may be used internally in a Kconfig tree to hide the - wolfSSL menu prompt and instead handle the selection of WOLFSSL from - dependent sub-configurations and thus prevent stuck symbol behavior. - - -menuconfig WOLFSSL - bool "wolfSSL Support" if !WOLFSSL_PROMPTLESS - help - This option enables the wolfSSL cryptography library. - -if WOLFSSL - -choice WOLFSSL_IMPLEMENTATION - prompt "Select implementation" - default WOLFSSL_BUILTIN - -config WOLFSSL_BUILTIN - bool "Enable wolfSSL integrated sources" - help - Link with local wolfSSL sources instead of external library. - -config WOLFSSL_LIBRARY - bool "Enable wolfSSL external library" - help - This option enables wolfSSL library. - -endchoice - -config WOLFSSL_SETTINGS_FILE - string "wolfSSL settings file" - depends on WOLFSSL_BUILTIN - help - Use a specific wolfSSL settings file. The default config file - file can be tweaked with Kconfig. The default settings is - suitable to communicate with majority of HTTPS servers on the Internet, - but has relatively many features enabled. To optimize resources for - special TLS usage, use available Kconfig settings, or select an - alternative config. - -rsource "Kconfig.tls-generic" - -config WOLFCRYPT_FIPS - bool "wolfCrypt FIPS support" - depends on WOLFSSL_BUILTIN - help - Enables FIPS support in wolfCrypt. Requires the wolfSSL FIPS ready - download that includes fips.c/fips_test.c. - -config WOLFSSL_DTLS - bool "wolfSSL DTLS support" - help - Enable DTLS support - -config WOLFSSL_ALPN - bool "wolfSSL ALPN support" - help - Enable ALPN support - -config WOLFSSL_PSK - bool "wolfSSL PSK support" - help - Enable PSK support - -config WOLFSSL_MAX_FRAGMENT_LEN - int - default 3 - range 1 6 - help - Sets the maximum fragment length wolfSSL will use, values 1-6 correspond to enum values - WOLFSSL_MFL_* in ssl.h - -config WOLFCRYPT_ARMASM - bool "wolfCrypt ARM Assembly support" - depends on WOLFSSL_BUILTIN - help - wolfCrypt ARM (ARMv8/ARMv7) assembly support for AES, SHA-2, SHA-3, - ChaCha20/Poly1305 and Curve25519 - -config WOLFCRYPT_INTELASM - bool "wolfCrypt Intel Assembly support" - depends on WOLFSSL_BUILTIN - help - wolfCrypt Intel Aassembly support (AVX/AVX2/AESNI) - -config WOLFSSL_DEBUG - bool "wolfSSL debug activation" - depends on WOLFSSL_BUILTIN - help - Enable debugging activation for wolfSSL configuration. If you use - wolfSSL/Zephyr integration (e.g. net_app), this will activate debug - logging (of the level configured by WOLFSSL_DEBUG_LEVEL). - -config WOLFSSL_INSTALL_PATH - string "wolfSSL install path" - depends on WOLFSSL_LIBRARY - help - This option holds the path where the wolfSSL libraries and headers are - installed. Make sure this option is properly set when WOLFSSL_LIBRARY - is enabled otherwise the build will fail. - -config APP_LINK_WITH_WOLFSSL - bool "Link 'app' with WOLFSSL" - default y - help - Add WOLFSSL header files to the 'app' include path. It may be - disabled if the include paths for WOLFSSL are causing aliasing - issues for 'app'. - -endif - diff --git a/modules/wolfssl/Kconfig.tls-generic b/modules/wolfssl/Kconfig.tls-generic deleted file mode 100644 index bc46a8fd47dc..000000000000 --- a/modules/wolfssl/Kconfig.tls-generic +++ /dev/null @@ -1,267 +0,0 @@ -# Kconfig.tls - TLS/DTLS related options - -# -# Copyright (c) 2018 Intel Corporation -# Copyright (c) 2018 Nordic Semiconductor ASA -# -# SPDX-License-Identifier: Apache-2.0 -# - -menu "TLS configuration" - -menu "Supported TLS version" - -config WOLFSSL_TLS_VERSION_1_0 - bool "Enable support for TLS 1.0" - select WOLFSSL_ALLOW_TLSV10_ENABLED - -config WOLFSSL_TLS_VERSION_1_1 - bool "Enable support for TLS 1.1" - select WOLFSSL_NO_OLD_TLS_DISABLED - -config WOLFSSL_TLS_VERSION_1_2 - bool "Enable support for TLS 1.2" - default y - -config WOLFSSL_TLS_VERSION_1_3 - bool "Enable support for TLS 1.3" - select WOLFSSL_TLS13_ENABLED - -endmenu - -menu "Ciphersuite configuration" - -comment "Supported key exchange modes" - -config WOLFSSL_KEY_EXCHANGE_ALL_ENABLED - bool "Enable all available ciphersuite modes" - select WOLFSSL_KEY_EXCHANGE_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_DHE_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_RSA_PSK_ENABLED - select WOLFSSL_KEY_EXCHANGE_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_DHE_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED - select WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED - -config WOLFSSL_KEY_EXCHANGE_PSK_ENABLED - bool "Enable the PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_DHE_PSK_ENABLED - bool "Enable the DHE-PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED - bool "Enable the ECDHE-PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_RSA_PSK_ENABLED - bool "Enable the RSA-PSK based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_RSA_ENABLED - bool "Enable the RSA-only based ciphersuite modes" - default y - -config WOLFSSL_KEY_EXCHANGE_DHE_RSA_ENABLED - bool "Enable the DHE-RSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED - bool "Enable the ECDHE-RSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - bool "Enable the ECDHE-ECDSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED - bool "Enable the ECDH-ECDSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED - bool "Enable the ECDH-RSA based ciphersuite modes" - -config WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED - bool "Enable the ECJPAKE based ciphersuite modes" - -if WOLFSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED || \ - WOLFSSL_KEY_EXCHANGE_ECJPAKE_ENABLED - -comment "Supported elliptic curves" - -config WOLFSSL_ECP_ALL_ENABLED - bool "Enable all available elliptic curves" - select WOLFSSL_ECP_DP_SECP192R1_ENABLED - select WOLFSSL_ECP_DP_SECP192R1_ENABLED - select WOLFSSL_ECP_DP_SECP224R1_ENABLED - select WOLFSSL_ECP_DP_SECP256R1_ENABLED - select WOLFSSL_ECP_DP_SECP384R1_ENABLED - select WOLFSSL_ECP_DP_SECP521R1_ENABLED - select WOLFSSL_ECP_DP_SECP192K1_ENABLED - select WOLFSSL_ECP_DP_SECP224K1_ENABLED - select WOLFSSL_ECP_DP_SECP256K1_ENABLED - select WOLFSSL_ECP_DP_BP256R1_ENABLED - select WOLFSSL_ECP_DP_BP384R1_ENABLED - select WOLFSSL_ECP_DP_BP512R1_ENABLED - select WOLFSSL_ECP_DP_CURVE25519_ENABLED - select WOLFSSL_ECP_DP_CURVE448_ENABLED - select WOLFSSL_ECP_NIST_OPTIM - -config WOLFSSL_ECP_DP_SECP192R1_ENABLED - bool "Enable SECP192R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP224R1_ENABLED - bool "Enable SECP224R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP256R1_ENABLED - bool "Enable SECP256R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP384R1_ENABLED - bool "Enable SECP384R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP521R1_ENABLED - bool "Enable SECP521R1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP192K1_ENABLED - bool "Enable SECP192K1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP224K1_ENABLED - bool "Enable SECP224K1 elliptic curve" - -config WOLFSSL_ECP_DP_SECP256K1_ENABLED - bool "Enable SECP256K1 elliptic curve" - -config WOLFSSL_ECP_DP_BP256R1_ENABLED - bool "Enable BP256R1 elliptic curve" - -config WOLFSSL_ECP_DP_BP384R1_ENABLED - bool "Enable BP384R1 elliptic curve" - -config WOLFSSL_ECP_DP_BP512R1_ENABLED - bool "Enable BP512R1 elliptic curve" - -config WOLFSSL_ECP_DP_CURVE25519_ENABLED - bool "Enable CURVE25519 elliptic curve" - -config WOLFSSL_ECP_DP_CURVE448_ENABLED - bool "Enable CURVE448 elliptic curve" - -config WOLFSSL_ECP_NIST_OPTIM - bool "Enable NSIT curves optimization" - -endif - -comment "Supported cipher modes" - -config WOLFSSL_CIPHER_ALL_ENABLED - bool "Enable all available ciphers" - select WOLFSSL_CIPHER_AES_ENABLED - select WOLFSSL_CIPHER_CAMELLIA_ENABLED - select WOLFSSL_CIPHER_DES_ENABLED - select WOLFSSL_CIPHER_ARC4_ENABLED - select WOLFSSL_CIPHER_CHACHA20_ENABLED - select WOLFSSL_CIPHER_BLOWFISH_ENABLED - select WOLFSSL_CIPHER_CCM_ENABLED - select WOLFSSL_CIPHER_MODE_XTS_ENABLED - select WOLFSSL_CIPHER_MODE_GCM_ENABLED - select WOLFSSL_CIPHER_CBC_ENABLED - select WOLFSSL_CHACHAPOLY_AEAD_ENABLED - -config WOLFSSL_CIPHER_AES_ENABLED - bool "Enable the AES block cipher" - default y - -config WOLFSSL_AES_ROM_TABLES - depends on WOLFSSL_CIPHER_AES_ENABLED - bool "Use precomputed AES tables stored in ROM." - default y - -config WOLFSSL_CIPHER_CAMELLIA_ENABLED - bool "Enable the Camellia block cipher" - -config WOLFSSL_CIPHER_DES_ENABLED - bool "Enable the DES block cipher" - default y - -config WOLFSSL_CIPHER_ARC4_ENABLED - bool "Enable the ARC4 stream cipher" - -config WOLFSSL_CIPHER_CHACHA20_ENABLED - bool "Enable the ChaCha20 stream cipher" - -config WOLFSSL_CIPHER_BLOWFISH_ENABLED - bool "Enable the Blowfish block cipher" - -config WOLFSSL_CIPHER_CCM_ENABLED - bool "Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher" - depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED - -config WOLFSSL_CIPHER_MODE_XTS_ENABLED - bool "Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES" - depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED - -config WOLFSSL_CIPHER_MODE_GCM_ENABLED - bool "Enable the Galois/Counter Mode (GCM) for AES" - depends on WOLFSSL_CIPHER_AES_ENABLED || WOLFSSL_CIPHER_CAMELLIA_ENABLED - -config WOLFSSL_CIPHER_CBC_ENABLED - bool "Enable Cipher Block Chaining mode (CBC) for symmetric ciphers" - default y - -config WOLFSSL_CHACHAPOLY_AEAD_ENABLED - bool "Enable the ChaCha20-Poly1305 AEAD algorithm" - depends on WOLFSSL_CIPHER_CHACHA20_ENABLED || WOLFSSL_MAC_POLY1305_ENABLED - -comment "Supported message authentication methods" - -config WOLFSSL_MAC_ALL_ENABLED - bool "Enable all available MAC methods" - select WOLFSSL_MAC_MD4_ENABLED - select WOLFSSL_MAC_MD5_ENABLED - select WOLFSSL_MAC_SHA1_ENABLED - select WOLFSSL_MAC_SHA256_ENABLED - select WOLFSSL_MAC_SHA512_ENABLED - select WOLFSSL_MAC_POLY1305_ENABLED - -config WOLFSSL_MAC_MD4_ENABLED - bool "Enable the MD4 hash algorithm" - -config WOLFSSL_MAC_MD5_ENABLED - bool "Enable the MD5 hash algorithm" - default y - -config WOLFSSL_MAC_SHA1_ENABLED - bool "Enable the SHA1 hash algorithm" - default y - -config WOLFSSL_MAC_SHA256_ENABLED - bool "Enable the SHA-224 and SHA-256 hash algorithms" - default y - -config WOLFSSL_MAC_SHA512_ENABLED - bool "Enable the SHA-384 and SHA-512 hash algorithms" - -config WOLFSSL_MAC_POLY1305_ENABLED - bool "Enable the Poly1305 MAC algorithm" - -endmenu - -comment "Random number generators" - -config WOLFSSL_HMAC_DRBG_ENABLED - bool "Enable the HMAC_DRBG random generator" - default y - -comment "Other configurations" - -config WOLFSSL_HAVE_ASM - bool "Enable use of assembly code" - default y - help - Enable use of assembly code in wolfSSL. This improves the performances - of asymmetric cryptography, however this might have an impact on the - code size. - -endmenu diff --git a/modules/wolfssl/README.md b/modules/wolfssl/README.md deleted file mode 100644 index 098d51c96ca0..000000000000 --- a/modules/wolfssl/README.md +++ /dev/null @@ -1,104 +0,0 @@ -Zephyr Project Port -=================== - -## Overview - -This port is for the Zephyr RTOS Project, available [here](https://www.zephyrproject.org/). - -It provides the following zephyr code. - -- modules/crypto/wolfssl - - wolfssl library code -- modules/crypto/wolfssl/zephyr/ - - Configuration and CMake files for wolfSSL as a Zephyr module -- modules/crypto/wolfssl/zephyr/samples/wolfssl_test - - wolfCrypt test application -- modules/crypto/wolfssl/zephyr/samples/wolfssl_bench - - wolfCrypt benchmark application -- modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_sock - - socket based sample of TLS -- modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_thread - - socket based sample of TLS using threads - -## How to setup as a Zephyr Module - -### Modify your project's west manifest - -Add wolfssl as a project to your west.yml: -``` -manifest: - remotes: - # - - name: wolfssl - url-base: https://github.com/wolfssl - - projects: - # - - name: wolfssl - path: modules/crypto/wolfssl - revision: master - remote: wolfssl -``` - -If you are using the Nordic nRF Connect SDK with Zephyr, the sdk-nrf manifest -file is located at: `vX.X.X/nrf/west.yml`. On OSX the default installation -location for the nRF Connect SDK is at `/opt/nordic/ncs/vX.X.X`. - -Update west's modules: - -```bash -west update -``` - -Now west recognizes 'wolfssl' as a module, and will include it's Kconfig and -CMakeFiles.txt in the build system. - -If using the Nordic nRF Connect SDK, to get access to a terminal with west -tool access, open "nRF Connect for Desktop", then "Toolchain Manager", -and finally next to the SDK version you are using click the drop down arrow, -then "Open Terminal". - -## Build and Run wolfCrypt Test Application - -If you want to run build apps without running `west zephyr-export` then it is -possible by setting the `CMAKE_PREFIX_PATH` variable to the location of the -zephyr sdk and building from the `zephyr` directory. For example: - -``` -CMAKE_PREFIX_PATH=/path/to/zephyr-sdk- west build -p always -b qemu_x86 ../modules/crypto/wolfssl/zephyr/samples/wolfssl_test/ -``` - -build and execute `wolfssl_test` - -``` -cd [zephyrproject] -west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_test -west build -t run -``` - -## Build and Run wolfCrypt Benchmark Application - -build and execute `wolfssl_benchmark` - -``` -cd [zephyrproject] -west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_benchmark -west build -t run -``` - -### Build and Run wolfSSL example `wolfssl_tls_sock` - -``` -cd [zephyrproject] -west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_sock -west build -t run -``` - -### Build and Run wolfSSL example `wolfssl_tls_thread` - -``` -cd [zephyrproject] -west build -p auto -b qemu_x86 modules/crypto/wolfssl/zephyr/samples/wolfssl_tls_thread -west build -t run -``` - diff --git a/modules/wolfssl/include.am b/modules/wolfssl/include.am deleted file mode 100644 index ef67bcc108ca..000000000000 --- a/modules/wolfssl/include.am +++ /dev/null @@ -1,43 +0,0 @@ -# vim:ft=automake -# included from Top Level Makefile.am -# All paths should be given relative to the root - -EXTRA_DIST+= zephyr/CMakeLists.txt -EXTRA_DIST+= zephyr/Kconfig -EXTRA_DIST+= zephyr/Kconfig.tls-generic -EXTRA_DIST+= zephyr/zephyr_init.c -EXTRA_DIST+= zephyr/module.yml -EXTRA_DIST+= zephyr/wolfssl/options.h -EXTRA_DIST+= zephyr/user_settings.h -EXTRA_DIST+= zephyr/README.md -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/ -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/CMakeLists.txt -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/README -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp.conf -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/boards/nrf5340dk_nrf5340_cpuapp_ns.conf -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/install_test.sh -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/prj.conf -EXTRA_DIST+= zephyr/samples/wolfssl_benchmark/sample.yaml -EXTRA_DIST+= zephyr/samples/wolfssl_test/CMakeLists.txt -EXTRA_DIST+= zephyr/samples/wolfssl_test/README -EXTRA_DIST+= zephyr/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf -EXTRA_DIST+= zephyr/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf -EXTRA_DIST+= zephyr/samples/wolfssl_test/install_test.sh -EXTRA_DIST+= zephyr/samples/wolfssl_test/prj.conf -EXTRA_DIST+= zephyr/samples/wolfssl_test/sample.yaml -EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/CMakeLists.txt -EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/README -EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/install_sample.sh -EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/prj.conf -EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/sample.yaml -EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/src -EXTRA_DIST+= zephyr/samples/wolfssl_tls_sock/src/tls_sock.c -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/CMakeLists.txt -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/README -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp.conf -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/boards/nrf5340dk_nrf5340_cpuapp_ns.conf -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/install_sample.sh -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/prj.conf -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/sample.yaml -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/src -EXTRA_DIST+= zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c diff --git a/modules/wolfssl/user_settings-no-malloc.h b/modules/wolfssl/user_settings-no-malloc.h deleted file mode 100644 index 5a5ca131c71b..000000000000 --- a/modules/wolfssl/user_settings-no-malloc.h +++ /dev/null @@ -1,170 +0,0 @@ -/* user_settings-tls-generic.h - * generated from configure options - * - * Copyright (C) 2006-2023 wolfSSL Inc. - * - * This file is part of wolfSSL. - * - * wolfSSL is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * wolfSSL is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA - */ - -#ifndef WOLFSSL_OPTIONS_H -#define WOLFSSL_OPTIONS_H - - -#ifdef __cplusplus -extern "C" { -#endif - -#if 0 -#undef SINGLE_THREADED -#define SINGLE_THREADED -#endif - -#undef TFM_TIMING_RESISTANT -#define TFM_TIMING_RESISTANT - -#undef ECC_TIMING_RESISTANT -#define ECC_TIMING_RESISTANT - -#undef WC_RSA_BLINDING -#define WC_RSA_BLINDING - -#undef HAVE_AESGCM -#define HAVE_AESGCM - -#undef WOLFSSL_SHA512 -#define WOLFSSL_SHA512 - -#undef WOLFSSL_SHA384 -#define WOLFSSL_SHA384 - -#undef NO_DSA -#define NO_DSA - -#undef HAVE_ECC -#define HAVE_ECC - -#undef TFM_ECC256 -#define TFM_ECC256 - -#undef WOLFSSL_BASE64_ENCODE -#define WOLFSSL_BASE64_ENCODE - -#undef NO_RC4 -#define NO_RC4 - -#undef WOLFSSL_SHA224 -#define WOLFSSL_SHA224 - -#undef WOLFSSL_SHA3 -#define WOLFSSL_SHA3 - -#undef HAVE_POLY1305 -#define HAVE_POLY1305 - -#undef HAVE_ONE_TIME_AUTH -#define HAVE_ONE_TIME_AUTH - -#undef HAVE_CHACHA -#define HAVE_CHACHA - -#undef HAVE_HASHDRBG -#define HAVE_HASHDRBG - -#undef NO_FILESYSTEM -#define NO_FILESYSTEM - -#undef HAVE_TLS_EXTENSIONS -#define HAVE_TLS_EXTENSIONS - -#undef HAVE_SUPPORTED_CURVES -#define HAVE_SUPPORTED_CURVES - -#undef HAVE_EXTENDED_MASTER -#define HAVE_EXTENDED_MASTER - -#undef NO_PSK -#define NO_PSK - -#undef NO_MD4 -#define NO_MD4 - -#undef USE_FAST_MATH -#define USE_FAST_MATH - -#undef WOLFSSL_NO_ASM -#define WOLFSSL_NO_ASM - -#undef WOLFSSL_X86_BUILD -#define WOLFSSL_X86_BUILD - -#undef WC_NO_ASYNC_THREADING -#define WC_NO_ASYNC_THREADING - -#undef WOLFSSL_STATIC_MEMORY -#define WOLFSSL_STATIC_MEMORY - -#undef WOLFSSL_TLS13 -#define WOLFSSL_TLS13 - -#undef HAVE_HKDF -#define HAVE_HKDF - -#undef WC_RSA_PSS -#define WC_RSA_PSS - -#undef HAVE_FFDHE_2048 -#define HAVE_FFDHE_2048 - -#undef WOLFSSL_NO_MALLOC -#define WOLFSSL_NO_MALLOC -//#define WOLFSSL_DEBUG_STATIC_MEMORY -//#define WOLFSSL_DEBUG_MEMORY_PRINT -//#define WOLFSSL_DEBUG_MEMORY -//#define WOLFSSL_TRACK_MEMORY -#define LARGEST_MEM_BUCKET 65536 - -#undef WOLFSSL_DYN_CERT -#define WOLFSSL_DYN_CERT - -#undef WOLFSSL_CERT_GEN -#define WOLFSSL_CERT_GEN - -#undef WOLFSSL_CERT_REQ -#define WOLFSSL_CERT_REQ - -#undef HAVE_PKCS12 -#define HAVE_PKCS12 - -#undef WOLFSSL_TLS13 -#define WOLFSSL_TLS13 - -#if 0 -#undef WOLFSSL_HAVE_SP_RSA -#define WOLFSSL_HAVE_SP_RSA -#undef WOLFSSL_HAVE_SP_DH -#define WOLFSSL_HAVE_SP_DH -#undef WOLFSSL_HAVE_SP_ECC -#define WOLFSSL_HAVE_SP_ECC -#endif - -#ifdef __cplusplus -} -#endif - - -#endif /* WOLFSSL_OPTIONS_H */ - diff --git a/modules/wolfssl/user_settings.h b/modules/wolfssl/user_settings.h deleted file mode 100644 index 68266da5f010..000000000000 --- a/modules/wolfssl/user_settings.h +++ /dev/null @@ -1,462 +0,0 @@ -/* user_settings.h - * - * Copyright (C) 2006-2024 wolfSSL Inc. - * - * This file is part of wolfSSL. - * - * wolfSSL is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * wolfSSL is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA - */ - -#ifndef USER_SETTINGS_H -#define USER_SETTINGS_H - -#ifdef CONFIG_WOLFSSL - -/* If a custom user_settings file is provided use it instead. - * CONFIG_WOLFSSL_SETTINGS_FILE is always defined. If it is not explicitly set - * in prj.conf then it is auto-defined to "". This obviously causes issues here. - * That is why we define WOLFSSL_SETTINGS_FILE in CMakeLists.txt. */ -#ifdef WOLFSSL_SETTINGS_FILE -#include WOLFSSL_SETTINGS_FILE -#else - -#ifdef __cplusplus -extern "C" { -#endif - - -/* ------------------------------------------------------------------------- */ -/* Platform */ -/* ------------------------------------------------------------------------- */ -#define WOLFSSL_GENERAL_ALIGNMENT 4 /* platform requires 32-bit alignment on uint32_t */ -#define SIZEOF_LONG_LONG 8 /* long long is 8 bytes / 64-bit */ -//#define WOLFSSL_NO_ASM /* optionally disable inline assembly support */ -#define WOLFSSL_IGNORE_FILE_WARN /* ignore file includes not required */ -//#define WOLFSSL_SMALL_STACK /* option to reduce stack size, offload to heap */ -#define BENCH_EMBEDDED /* use smaller buffers in benchmark / tests */ - -/* Network stack */ -/* Default is POSIX sockets */ -//#define WOLFSSL_USER_IO /* Use the SetIO callbacks, not the internal wolfio.c socket code */ -//#define WOLFSSL_LWIP -//#define WOLFSSL_LWIP_NATIVE -//#define FREERTOS_TCP - -/* RTOS */ -/* Default is POSIX mutex and pthreads*/ -//#define SINGLE_THREADED -//#define FREERTOS -#define NO_FILESYSTEM -#define NO_WRITEV - -/* ------------------------------------------------------------------------- */ -/* Hardware */ -/* ------------------------------------------------------------------------- */ -/* CryptoCell support */ -#if 0 - //#define WOLFSSL_CRYPTOCELL - //#define WOLFSSL_CRYPTOCELL_AES -#endif -/* PSA support */ -#ifdef CONFIG_MBEDTLS_PSA_CRYPTO_C - #define WOLFSSL_HAVE_PSA - #ifndef SINGLE_THREADED - #define WOLFSSL_PSA_GLOBAL_LOCK - #endif - #define WC_NO_HASHDRBG /* use PSA RNG directly via wc_psa_get_random */ -#endif - -/* ------------------------------------------------------------------------- */ -/* FIPS */ -/* ------------------------------------------------------------------------- */ -#ifdef CONFIG_WOLFCRYPT_FIPS - /* FIPS Ready */ - #define HAVE_FIPS_VERSION 5 - #define HAVE_FIPS_VERSION_MINOR 3 -#endif - - -/* ------------------------------------------------------------------------- */ -/* TLS */ -/* ------------------------------------------------------------------------- */ -/* TLS v1.2 (on by default) */ -#ifdef CONFIG_WOLFSSL_TLS_VERSION_1_2 - #undef WOLFSSL_NO_TLS12 -#else - #define WOLFSSL_NO_TLS12 -#endif -//#define NO_WOLFSSL_SERVER /* Optionally disable TLS server code */ -//#define NO_WOLFSSL_CLIENT /* Optionally disable TLS client code */ - -/* TLS v1.3 */ -#if defined(CONFIG_WOLFSSL_TLS_VERSION_1_3) || defined(CONFIG_WOLFSSL_TLS13_ENABLED) - #define WOLFSSL_TLS13 -#endif - -/* Disable older TLS version prior to 1.2 */ -#define NO_OLD_TLS - -/* Enable default TLS extensions */ -#define HAVE_TLS_EXTENSIONS -#define HAVE_SUPPORTED_CURVES -#define HAVE_EXTENDED_MASTER -#define HAVE_ENCRYPT_THEN_MAC -#define HAVE_SERVER_RENEGOTIATION_INFO -#define HAVE_SNI /* optional Server Name Indicator (SNI) */ - -/* ASN */ -#define WOLFSSL_ASN_TEMPLATE /* use newer ASN template asn.c code (default) */ -#if 0 /* optional space reductions */ - #define WOLFSSL_NO_ASN_STRICT - #define IGNORE_NAME_CONSTRAINTS -#endif - -/* Session Cache */ -#if 1 - #define SMALL_SESSION_CACHE - #ifdef WOLFSSL_TLS13 - #define HAVE_SESSION_TICKET /* session tickets required for resumption in TLS v1.3 */ - #endif -#else - #define NO_SESSION_CACHE /* disable session resumption */ -#endif - -/* DTLS */ -#if defined(CONFIG_WOLFSSL_DTLS) - #define WOLFSSL_DTLS - #define HAVE_SOCKADDR -#endif - -/* PSK */ -#if defined(CONFIG_WOLFSSL_PSK) - #undef NO_PSK - #define WOLFSSL_STATIC_PSK -#else - #define NO_PSK /* disable pre-shared-key support */ -#endif - -/* ALPN */ -#if defined(CONFIG_WOLFSSL_ALPN) - #define HAVE_ALPN -#endif - -#if defined(CONFIG_WOLFSSL_MAX_FRAGMENT_LEN) - #define HAVE_MAX_FRAGMENT -#endif - -#if defined(CONFIG_NET_SOCKETS_SOCKOPT_TLS) - #define WOLFSSL_SET_CIPHER_BYTES -#endif - -/* ------------------------------------------------------------------------- */ -/* Algorithms */ -/* ------------------------------------------------------------------------- */ -/* RNG */ -#ifndef WC_NO_HASHDRBG - #define HAVE_HASHDRBG /* Use DRBG SHA2-256 and seed */ - #ifdef CONFIG_CSPRNG_ENABLED - #define WC_RNG_SEED_CB - #endif -#endif - -/* ECC */ -#if 1 - #define HAVE_ECC - #define ECC_USER_CURVES /* Enable only ECC curves specific */ - #undef NO_ECC256 /* Enable SECP256R1 only (on by default) */ - #define ECC_TIMING_RESISTANT /* Enable Timing Resistance */ - - //#define ECC_SHAMIR /* Optional ECC calculation speed improvement if not using SP implementation */ - //#define WOLFSSL_CUSTOM_CURVES /* enable other curves (not just prime) */ - //#define HAVE_ECC_SECPR2 - //#define HAVE_ECC_SECPR3 - //#define HAVE_ECC_BRAINPOOL - //#define HAVE_ECC_KOBLITZ - //#define HAVE_ECC_CDH /* Co-factor */ - //#define HAVE_COMP_KEY /* Compressed key support */ - //#define FP_ECC /* Fixed point caching - speed repeated operations against same key */ - //#define HAVE_ECC_ENCRYPT - //#define WOLFCRYPT_HAVE_ECCSI - //#define WOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT -#endif - -#define WOLFSSL_OLD_PRIME_CHECK /* Use faster DH prime checking */ - -/* RSA */ -#if 1 - #undef NO_RSA - #define WC_RSA_BLINDING - //#define WC_RSA_NO_PADDING - //#define RSA_LOW_MEM - - #if 0 - #define WOLFSSL_KEY_GEN /* For RSA Key gen only */ - #endif - #if defined(WOLFSSL_TLS13) || defined(CONFIG_WOLFSSL_RSA_PSS) - /* TLS v1.3 requires RSA PSS padding */ - #define WC_RSA_PSS - //#define WOLFSSL_PSS_LONG_SALT - #endif -#else - #define NO_RSA -#endif - -/* DH */ -#if 0 - #undef NO_DH /* on by default */ - #define WOLFSSL_DH_CONST /* don't rely on pow/log */ - #define HAVE_FFDHE_2048 - #define HAVE_FFDHE_3072 - #define HAVE_DH_DEFAULT_PARAMS - //#define WOLFSSL_DH_EXTRA /* Enable additional DH key import/export */ -#else - #define NO_DH -#endif - -/* ChaCha20 / Poly1305 */ -#if 1 - #define HAVE_CHACHA - #define HAVE_POLY1305 - - /* Needed for Poly1305 */ - #define HAVE_ONE_TIME_AUTH -#endif - -/* Ed25519 / Curve25519 */ -#if 0 - #define HAVE_CURVE25519 - #define HAVE_ED25519 /* ED25519 Requires SHA512 */ - - /* Optionally use small math (less flash usage, but much slower) */ - //#define CURVED25519_SMALL -#endif - -/* SHA-1 */ -#if 0 - #undef NO_SHA /* on by default */ - //#define USE_SLOW_SHA /* 1k smaller, but 25% slower */ -#else - // #define NO_SHA /* Necessary for pkcs12 tests */ -#endif - -/* SHA2-256 */ -#if 1 - #undef NO_SHA256 /* on by default */ - //#define USE_SLOW_SHA256 /* ~2k smaller and about 25% slower */ - #define WOLFSSL_SHA224 -#else - #define NO_SHA256 -#endif - -/* SHA2-384/512 */ -#if 1 - #define WOLFSSL_SHA384 - #define WOLFSSL_SHA512 - //#define USE_SLOW_SHA512 /* Over twice as small, but 50% slower */ -#endif - -/* SHA-3 */ -#if 1 - #define WOLFSSL_SHA3 -#endif - -/* AES */ -#define HAVE_AES_ECB -/* AES-CBC */ -#if 1 - #define HAVE_AES_CBC -#else - #define NO_AES_CBC -#endif -/* AES-GCM */ -#if 1 - #define HAVE_AESGCM - #define GCM_SMALL /* GCM Method: GCM_TABLE_4BIT, GCM_SMALL, GCM_WORD32 or GCM_TABLE */ - //#define WOLFSSL_AESGCM_STREAM -#endif -//#define HAVE_AES_DECRYPT -//#define WOLFSSL_AES_COUNTER -//#define WOLFSSL_AES_CFB -//#define WOLFSSL_AES_OFB -//#define HAVE_AESCCM -//#define WOLFSSL_AES_XTS - -//#define NO_AES_128 -//#define NO_AES_192 -//#define NO_AES_256 -//#define WOLFSSL_AES_SMALL_TABLES -//#define WOLFSSL_AES_NO_UNROLL - - -/* HKDF */ -#if defined(WOLFSSL_TLS13) || defined(CONFIG_WOLFSSL_HKDF) - #define HAVE_HKDF -#endif - -/* CMAC - Zephyr nRF BTLE needs CMAC */ -#if 1 - #define WOLFSSL_AES_DIRECT - #define WOLFSSL_CMAC -#endif - - -/* Optional Features */ -#define WOLFSSL_BASE64_ENCODE /* Enable Base64 encoding */ -//#define WC_NO_CACHE_RESISTANT /* systems with cache should enable this for AES, ECC, RSA and DH */ -//#define WOLFSSL_CERT_GEN -//#define WOLFSSL_CERT_REQ -//#define WOLFSSL_CERT_EXT -//#define NO_PWDBASED - - -/* Disable Algorithms */ -#define NO_DSA -#define NO_RC4 -#define NO_MD4 -#define NO_MD5 -//#define NO_DES3 /* Necessary for pkcs12 tests */ -#define WOLFSSL_NO_SHAKE128 -#define WOLFSSL_NO_SHAKE256 - - - -/* ------------------------------------------------------------------------- */ -/* Math */ -/* ------------------------------------------------------------------------- */ -/* Math Options */ -/* Multi-precision - generic math for all keys sizes and curves */ -#if 1 - #define WOLFSSL_SP_MATH /* no multi-precision math, only single */ -#elif 1 - /* wolf mp math (sp_int.c) */ - #define WOLFSSL_SP_MATH_ALL /* use SP math for all key sizes and curves */ - //#define WOLFSSL_SP_NO_MALLOC - - /* use smaller version of code */ - #define WOLFSSL_SP_SMALL - - /* Define the maximum math bits used */ - #if !defined(NO_RSA) || !defined(NO_DH) - #define SP_INT_BITS 2048 - #elif defined(HAVE_ECC) - #define SP_INT_BITS 256 - #endif - -#elif 1 - /* Fast Math (tfm.c) (stack based and timing resistant) */ - #define USE_FAST_MATH - #define TFM_TIMING_RESISTANT - - /* Define the maximum math bits used (2 * max) */ - #if !defined(NO_RSA) || !defined(NO_DH) - #define FP_MAX_BITS (2*2048) - #ifdef HAVE_ECC - #define ALT_ECC_SIZE /* use heap allocation for ECC point */ - #endif - #elif defined(HAVE_ECC) - #define FP_MAX_BITS (2*256) - #endif - #ifdef HAVE_ECC - //#define TFM_ECC256 /* optional speedup for ECC-256 bit */ - #endif -#else - /* Normal (integer.c) (heap based, not timing resistant) - not recommended */ - #define USE_INTEGER_HEAP_MATH -#endif - -/* Single Precision (optional) */ -/* Math written for specific curves and key sizes */ -#if 1 - #ifdef HAVE_ECC - #define WOLFSSL_HAVE_SP_ECC - //#define WOLFSSL_SP_NO_256 - //#define WOLFSSL_SP_384 - //#define WOLFSSL_SP_521 - #endif - #ifndef NO_RSA - #define WOLFSSL_HAVE_SP_RSA - //#define WOLFSSL_SP_NO_2048 - //#define WOLFSSL_SP_NO_3072 - //#define WOLFSSL_SP_4096 - #endif - #ifndef NO_DH - #define WOLFSSL_HAVE_SP_DH - #endif - - #define WOLFSSL_SP_SMALL /* use smaller version of code */ - //#define WOLFSSL_SP_NO_MALLOC /* disable heap in wolf/SP math */ - //#define SP_DIV_WORD_USE_DIV /* no div64 */ - - #if 0 - /* optional speedup with inline assembly */ - //#define WOLFSSL_SP_ARM_CORTEX_M_ASM /* Cortex-M3+ */ - //#define WOLFSSL_SP_ARM_THUMB_ASM /* Cortex-M0+ thumb */ - //#define WOLFSSL_SP_ARM32_ASM /* Cortex-R */ - //#define WOLFSSL_SP_ARM64_ASM /* Cortex-A */ - //#define WOLFSSL_SP_USE_UDIV - #endif -#endif - -/* ------------------------------------------------------------------------- */ -/* Assembly Speedups for Symmetric Algorithms */ -/* ------------------------------------------------------------------------- */ - -#ifdef CONFIG_WOLFCRYPT_ARMASM - #define WOLFSSL_ARMASM - #define WOLFSSL_NO_HASH_RAW - #define WOLFSSL_ARMASM_INLINE /* use inline .c versions */ - #define WOLFSSL_ARMASM_NO_NEON - - /* Default is ARMv8 */ - - #if 0 /* ARMv7 */ - #define WOLFSSL_ARM_ARCH 7 - #define WOLFSSL_ARMASM_NO_HW_CRYPTO /* enable if processor does not support aes/sha instructions */ - #endif -#endif - -#ifdef CONFIG_WOLFCRYPT_INTELASM - #define USE_INTEL_SPEEDUP - #define WOLFSSL_X86_64_BUILD /* 64-bit */ - //#define WOLFSSL_X86_BUILD /* 32-bit */ - - /* Issues with building AESNI "_mm_aesimc_si128" always_inline */ - //#define WOLFSSL_AESNI -#endif - - -/* ------------------------------------------------------------------------- */ -/* Debugging */ -/* ------------------------------------------------------------------------- */ -#undef DEBUG_WOLFSSL -#undef NO_ERROR_STRINGS -#ifdef CONFIG_WOLFSSL_DEBUG - #define DEBUG_WOLFSSL -#else - #if 1 - #define NO_ERROR_STRINGS - #endif -#endif - - -#ifdef __cplusplus -} -#endif - -#endif /* CONFIG_WOLFSSL_SETTINGS_FILE */ -#endif /* CONFIG_WOLFSSL */ - -#endif /* USER_SETTINGS_H */ - diff --git a/modules/wolfssl/wolfssl/options.h b/modules/wolfssl/wolfssl/options.h deleted file mode 100644 index 5c637481bb9c..000000000000 --- a/modules/wolfssl/wolfssl/options.h +++ /dev/null @@ -1 +0,0 @@ -/* default blank options to appease code that may require it */ diff --git a/modules/wolfssl/zephyr_init.c b/modules/wolfssl/zephyr_init.c deleted file mode 100644 index cd8ae98e6d12..000000000000 --- a/modules/wolfssl/zephyr_init.c +++ /dev/null @@ -1,22 +0,0 @@ -/* zephyr_init.c - * - * Copyright (C) 2006-2023 wolfSSL Inc. - * - * This file is part of wolfSSL. - * - * wolfSSL is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * wolfSSL is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA - */ - -/* Not needed. Keeping file for backwards compatibility. */