From cf77626d65edaa72caca9dd295c27fc1614246de Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 13 Aug 2025 12:55:02 -0700 Subject: [PATCH 01/13] Initial draft of option to replace openssl default provider --- Makefile.am | 9 ++- configure.ac | 9 ++- default_stub/.gitignore | 15 +++++ default_stub/Makefile.am | 2 + default_stub/README.md | 21 +++++++ default_stub/autogen.sh | 5 ++ default_stub/configure.ac | 7 +++ default_stub/wp_default_stub.c | 40 ++++++++++++ patches/ossl-replace-default-3.5.patch | 30 +++++++++ scripts/build-wolfprovider.sh | 9 ++- scripts/utils-openssl.sh | 84 ++++++++++++++++++++++---- scripts/utils-wolfprovider.sh | 60 ++++++++++++++++++ src/wp_default_replace.c | 59 ++++++++++++++++++ 13 files changed, 334 insertions(+), 16 deletions(-) create mode 100644 default_stub/.gitignore create mode 100644 default_stub/Makefile.am create mode 100644 default_stub/README.md create mode 100755 default_stub/autogen.sh create mode 100644 default_stub/configure.ac create mode 100644 default_stub/wp_default_stub.c create mode 100644 patches/ossl-replace-default-3.5.patch create mode 100644 src/wp_default_replace.c diff --git a/Makefile.am b/Makefile.am index 69ad2f6a..392e1f8e 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,5 +1,5 @@ -SUFFIXES = +SUFFIXES = TESTS = noinst_PROGRAMS = noinst_HEADERS = @@ -14,6 +14,13 @@ AM_CPPFLAGS = -I$(top_srcdir)/include lib_LTLIBRARIES = libwolfprov.la +# Conditionally build libdefault.so when --replace-default is enabled +if BUILD_REPLACE_DEFAULT +lib_LTLIBRARIES += libdefault.la +libdefault_la_SOURCES = src/wp_default_replace.c +libdefault_la_LIBADD = libwolfprov.la +endif + EXTRA_DIST+=ChangeLog.md EXTRA_DIST+=README.md EXTRA_DIST+=IDE diff --git a/configure.ac b/configure.ac index d1962b1b..f9618d64 100644 --- a/configure.ac +++ b/configure.ac @@ -123,8 +123,14 @@ AS_IF([ test "x$ENABLED_SINGLETHREADED" = "xno" ],[ ]) ]) +# Replace default provider +AC_ARG_ENABLE([replace-default], + [AS_HELP_STRING([--enable-replace-default],[Build real libdefault.so from wp_default_replace.c (default: disabled).])], + [ ENABLED_REPLACE_DEFAULT=$enableval ], + [ ENABLED_REPLACE_DEFAULT=no ] + ) - +AM_CONDITIONAL([BUILD_REPLACE_DEFAULT], [test "x$ENABLED_REPLACE_DEFAULT" = "xyes"]) AX_HARDEN_CC_COMPILER_FLAGS @@ -170,6 +176,7 @@ echo echo " Features " echo " * User settings: $ENABLED_USERSETTINGS" echo " * Dynamic provider: $ENABLED_DYNAMIC_PROVIDER" +echo " * Replace default: $ENABLED_REPLACE_DEFAULT" echo "" echo "---" diff --git a/default_stub/.gitignore b/default_stub/.gitignore new file mode 100644 index 00000000..f13db083 --- /dev/null +++ b/default_stub/.gitignore @@ -0,0 +1,15 @@ +Makefile +Makefile.in +.deps/ +.libs/ +*.la +*.lo +*.o +aclocal.m4 +autom4te.cache/ +config.log +config.status +configure +libtool +*.so +*.so.* diff --git a/default_stub/Makefile.am b/default_stub/Makefile.am new file mode 100644 index 00000000..e31303de --- /dev/null +++ b/default_stub/Makefile.am @@ -0,0 +1,2 @@ +lib_LTLIBRARIES = libdefault.la +libdefault_la_SOURCES = wp_default_stub.c diff --git a/default_stub/README.md b/default_stub/README.md new file mode 100644 index 00000000..3bf15917 --- /dev/null +++ b/default_stub/README.md @@ -0,0 +1,21 @@ +# libdefault - Default Provider Stub Library + +Minimal autotools build for a stub version of the default provider. + +## Building + +```bash +# Generate build system +./autogen.sh + +# Configure and build +./configure +make + +# Clean build artifacts +make clean +``` + +## Output + +The build produces `libdefault.so` in the `.libs/` directory. diff --git a/default_stub/autogen.sh b/default_stub/autogen.sh new file mode 100755 index 00000000..c350c05b --- /dev/null +++ b/default_stub/autogen.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +set -e + +autoreconf -fiv diff --git a/default_stub/configure.ac b/default_stub/configure.ac new file mode 100644 index 00000000..5c44872c --- /dev/null +++ b/default_stub/configure.ac @@ -0,0 +1,7 @@ +AC_INIT([libdefault], [1.0], [support@wolfssl.com]) +AM_INIT_AUTOMAKE([-Wall -Werror foreign]) +AC_PROG_CC +AM_PROG_AR +LT_INIT +AC_CONFIG_FILES([Makefile]) +AC_OUTPUT diff --git a/default_stub/wp_default_stub.c b/default_stub/wp_default_stub.c new file mode 100644 index 00000000..52d9ea28 --- /dev/null +++ b/default_stub/wp_default_stub.c @@ -0,0 +1,40 @@ +/* + * Copyright (C) 2006-2024 wolfSSL Inc. + * + * This file is part of wolfProvider. + * + * wolfProvider is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfProvider is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with wolfProvider. If not, see . + */ + +#include + +/* Prototype of public function that initializes the wolfSSL provider. */ +OSSL_provider_init_fn wolfssl_provider_init; + +/* Prototype for the wolfprov_provider_init function */ +int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, + const OSSL_DISPATCH* in, + const OSSL_DISPATCH** out, + void** provCtx); + +/* + * Provider implementation stub + */ +int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, + const OSSL_DISPATCH* in, + const OSSL_DISPATCH** out, + void** provCtx) +{ + return 0; +} diff --git a/patches/ossl-replace-default-3.5.patch b/patches/ossl-replace-default-3.5.patch new file mode 100644 index 00000000..37aa2578 --- /dev/null +++ b/patches/ossl-replace-default-3.5.patch @@ -0,0 +1,30 @@ +diff --git a/crypto/provider_predefined.c b/crypto/provider_predefined.c +index 068e0b7..499a9ca 100644 +--- a/crypto/provider_predefined.c ++++ b/crypto/provider_predefined.c +@@ -10,21 +10,15 @@ + #include + #include "provider_local.h" + +-OSSL_provider_init_fn ossl_default_provider_init; ++OSSL_provider_init_fn wolfprov_provider_init; + OSSL_provider_init_fn ossl_base_provider_init; + OSSL_provider_init_fn ossl_null_provider_init; +-OSSL_provider_init_fn ossl_fips_intern_provider_init; +-#ifdef STATIC_LEGACY +-OSSL_provider_init_fn ossl_legacy_provider_init; +-#endif + const OSSL_PROVIDER_INFO ossl_predefined_providers[] = { + #ifdef FIPS_MODULE +- { "fips", NULL, ossl_fips_intern_provider_init, NULL, 1 }, ++ { "fips", NULL, wolfprov_provider_init, NULL, 1 }, + #else +- { "default", NULL, ossl_default_provider_init, NULL, 1 }, +-# ifdef STATIC_LEGACY +- { "legacy", NULL, ossl_legacy_provider_init, NULL, 0 }, +-# endif ++ { "default", NULL, wolfprov_provider_init, NULL, 1 }, ++ { "legacy", NULL, wolfprov_provider_init, NULL, 0 }, + { "base", NULL, ossl_base_provider_init, NULL, 0 }, + { "null", NULL, ossl_null_provider_init, NULL, 0 }, + #endif diff --git a/scripts/build-wolfprovider.sh b/scripts/build-wolfprovider.sh index a499eb2a..b50b8fb8 100755 --- a/scripts/build-wolfprovider.sh +++ b/scripts/build-wolfprovider.sh @@ -20,6 +20,7 @@ show_help() { echo " --fips-version=VER Choose the wolfSSL FIPS version" echo " --debian Build a Debian package" echo " --quicktest Disable some tests for a faster testing suite" + echo " --replace-default Patch OpenSSL and build it so that wolfProvider is the default provider" echo "" echo "Environment Variables:" echo " OPENSSL_TAG OpenSSL tag to use (e.g., openssl-3.5.0)" @@ -81,7 +82,6 @@ for arg in "$@"; do WOLFSSL_ISFIPS=1 ;; --fips-bundle=*) - unset WOLFSSL_ISFIPS unset WOLFSSL_FIPS_CHECK_TAG IFS='=' read -r trash fips_bun <<< "$arg" if [ -z "$fips_bun" ]; then @@ -113,6 +113,9 @@ for arg in "$@"; do --quicktest) WOLFPROV_QUICKTEST=1 ;; + --replace-default) + WOLFPROV_REPLACE_DEFAULT=1 + ;; *) args_wrong+="$arg, " ;; @@ -144,6 +147,10 @@ source ${SCRIPT_DIR}/utils-wolfprovider.sh echo "Using openssl: $OPENSSL_TAG, wolfssl: $WOLFSSL_TAG" +if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + build_default_stub +fi + init_wolfprov exit $? diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index 2fd908e7..ed4da056 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -93,19 +93,74 @@ clone_openssl() { fi } +patch_openssl() { + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + printf "\tApplying OpenSSL default provider patch ... " + cd ${OPENSSL_SOURCE_DIR} + + # Check if patch is already applied + if grep -q "wolfprov_provider_init" crypto/provider_predefined.c 2>/dev/null; then + printf "Already applied.\n" + return 0 + fi + + # Apply the patch + patch -p1 < ${SCRIPT_DIR}/../patches/ossl-replace-default-3.5.patch >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "ERROR.\n" + printf "\n\nPatch application failed. Last 40 lines of log:\n" + tail -n 40 $LOG_FILE + do_cleanup + exit 1 + fi + printf "Done.\n" + + cd ${SCRIPT_DIR}/.. + fi +} + install_openssl() { printf "\nInstalling OpenSSL ${OPENSSL_TAG} ...\n" clone_openssl + patch_openssl cd ${OPENSSL_SOURCE_DIR} if [ ! -d ${OPENSSL_INSTALL_DIR} ]; then printf "\tConfigure OpenSSL ${OPENSSL_TAG} ... " + + # Build configure command + CONFIG_CMD="./config shared --prefix=${OPENSSL_INSTALL_DIR}" if [ "$WOLFPROV_DEBUG" = "1" ]; then - ./config shared enable-trace --prefix=${OPENSSL_INSTALL_DIR} --debug >>$LOG_FILE 2>&1 - RET=$? + CONFIG_CMD+=" enable-trace --debug" + fi + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + CONFIG_CMD+=" no-external-tests no-tests" + + # Set up library paths to find the stub libdefault + STUB_LIB_DIR=${SCRIPT_DIR}/../libdefault-stub-install/lib + if [ -d "${STUB_LIB_DIR}" ]; then + export PKG_CONFIG_PATH="${STUB_LIB_DIR}/pkgconfig:${PKG_CONFIG_PATH}" + # Link the stub library directly into libcrypto using LDFLAGS and LDLIBS + CONFIGURE_LDFLAGS="-L${STUB_LIB_DIR}" + CONFIGURE_LDLIBS="-ldefault" + else + printf "ERROR - stub libdefault not found in: ${STUB_LIB_DIR}\n" + do_cleanup + exit 1 + fi + fi + + # Execute configure + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + $CONFIG_CMD LDFLAGS="${CONFIGURE_LDFLAGS}" LDLIBS="${CONFIGURE_LDLIBS}" >>$LOG_FILE 2>&1 else - ./config shared --prefix=${OPENSSL_INSTALL_DIR} >>$LOG_FILE 2>&1 - RET=$? + $CONFIG_CMD >>$LOG_FILE 2>&1 + fi + RET=$? + + # Clean up environment + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + unset LDFLAGS fi if [ $RET != 0 ]; then printf "ERROR.\n" @@ -143,15 +198,18 @@ init_openssl() { install_openssl printf "\tOpenSSL ${OPENSSL_TAG} installed in: ${OPENSSL_INSTALL_DIR}\n" - OSSL_VER=`LD_LIBRARY_PATH=${OPENSSL_LIB_DIRS} $OPENSSL_BIN version | tail -n1` - case $OSSL_VER in - OpenSSL\ 3.*) ;; - *) - echo "OpenSSL ($OPENSSL_BIN) has wrong version: $OSSL_VER" - echo "Set: OPENSSL_DIR" - exit 1 - ;; - esac + # Skip version check for replace-default mode since we only build libraries + if [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ]; then + OSSL_VER=`LD_LIBRARY_PATH=${OPENSSL_LIB_DIRS} $OPENSSL_BIN version | tail -n1` + case $OSSL_VER in + OpenSSL\ 3.*) ;; + *) + echo "OpenSSL ($OPENSSL_BIN) has wrong version: $OSSL_VER" + echo "Set: OPENSSL_DIR" + exit 1 + ;; + esac + fi if [ -z $LD_LIBRARY_PATH ]; then export LD_LIBRARY_PATH=${OPENSSL_LIB_DIRS} diff --git a/scripts/utils-wolfprovider.sh b/scripts/utils-wolfprovider.sh index d3dd82d8..c0d715b5 100755 --- a/scripts/utils-wolfprovider.sh +++ b/scripts/utils-wolfprovider.sh @@ -25,6 +25,7 @@ source ${SCRIPT_DIR}/utils-general.sh WOLFPROV_SOURCE_DIR=${SCRIPT_DIR}/.. WOLFPROV_INSTALL_DIR=${SCRIPT_DIR}/../wolfprov-install +LIBDEFAULT_STUB_INSTALL_DIR=${SCRIPT_DIR}/../libdefault-stub-install WOLFPROV_CONFIG_OPTS=${WOLFPROV_CONFIG_OPTS:-"--with-openssl=${OPENSSL_INSTALL_DIR} --with-wolfssl=${WOLFSSL_INSTALL_DIR} --prefix=${WOLFPROV_INSTALL_DIR}"} WOLFPROV_CONFIG_CFLAGS=${WOLFPROV_CONFIG_CFLAGS:-''} @@ -46,6 +47,55 @@ WOLFPROV_DEBUG=${WOLFPROV_DEBUG:-0} WOLFPROV_CLEAN=${WOLFPROV_CLEAN:-0} WOLFPROV_DISTCLEAN=${WOLFPROV_DISTCLEAN:-0} +build_default_stub() { + printf "\nBuilding default stub library ...\n" + cd ${SCRIPT_DIR}/../default_stub + + printf "\tGenerate build system ... " + if [ ! -e "configure" ]; then + ./autogen.sh >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "\n\n...\n" + tail -n 40 $LOG_FILE + do_cleanup + exit 1 + fi + fi + printf "Done.\n" + + printf "\tConfigure default stub ... " + ./configure --prefix=${LIBDEFAULT_STUB_INSTALL_DIR} >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "\n\n...\n" + tail -n 40 $LOG_FILE + do_cleanup + exit 1 + fi + printf "Done.\n" + + printf "\tBuild default stub ... " + make >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "\n\n...\n" + tail -n 40 $LOG_FILE + do_cleanup + exit 1 + fi + printf "Done.\n" + + printf "\tInstall default stub ... " + make install >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "\n\n...\n" + tail -n 40 $LOG_FILE + do_cleanup + exit 1 + fi + printf "Done.\n" + + cd ${SCRIPT_DIR}/.. +} + clean_wolfprov() { printf "\n" @@ -78,6 +128,16 @@ install_wolfprov() { WOLFPROV_CONFIG_OPTS+=" --enable-debug" fi + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + WOLFPROV_CONFIG_OPTS+=" --enable-replace-default" + # Add stub library path for replace-default functionality + if [ -z "$LD_LIBRARY_PATH" ]; then + export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib" + else + export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib:$LD_LIBRARY_PATH" + fi + fi + ./configure ${WOLFPROV_CONFIG_OPTS} CFLAGS="${WOLFPROV_CONFIG_CFLAGS}" >>$LOG_FILE 2>&1 RET=$? diff --git a/src/wp_default_replace.c b/src/wp_default_replace.c new file mode 100644 index 00000000..046a48ec --- /dev/null +++ b/src/wp_default_replace.c @@ -0,0 +1,59 @@ +/* + * Copyright (C) 2006-2024 wolfSSL Inc. + * + * This file is part of wolfProvider. + * + * wolfProvider is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfProvider is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with wolfProvider. If not, see . + */ + +/* + * wolfProvider Real Implementation for libdefault.so + * + * This is the real implementation of wolfprov_provider_init that bridges + * OpenSSL's default provider interface to wolfProvider by dynamically + * loading libwolfprov.so and calling wolfssl_provider_init. + * + * This replaces the stub implementation after wolfProvider is fully built. + */ + +#include + +/* Prototype of public function that initializes the wolfSSL provider. */ +OSSL_provider_init_fn wolfssl_provider_init; + +/* Prototype for the wolfprov_provider_init function */ +int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, + const OSSL_DISPATCH* in, + const OSSL_DISPATCH** out, + void** provCtx); + +/* + * Real implementation of wolfprov_provider_init. + * + * This function dynamically loads libwolfprov.so and calls its + * wolfssl_provider_init function to provide full wolfProvider functionality. + * + * @param [in] handle Handle to the core. + * @param [in] in Dispatch table from previous provider. + * @param [out] out Dispatch table of wolfSSL provider. + * @param [out] provCtx New provider context. + * @return 1 on success, 0 on failure. + */ +int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, + const OSSL_DISPATCH* in, + const OSSL_DISPATCH** out, + void** provCtx) +{ + return wolfssl_provider_init(handle, in, out, provCtx); +} From d81f133f50493b107cb710e9b546b0193aa94b86 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Mon, 18 Aug 2025 12:32:37 -0700 Subject: [PATCH 02/13] New test framework for standlone binary testing, including tests validating the default swap works as expected. --- Makefile.am | 9 + configure.ac | 12 ++ scripts/build-wolfprovider.sh | 4 +- scripts/env-setup | 4 +- scripts/utils-openssl.sh | 2 + scripts/utils-wolfprovider.sh | 21 ++- scripts/utils-wolfssl.sh | 7 +- test/include.am | 2 + test/standalone/include.am | 36 ++++ test/standalone/provider-default.conf | 10 ++ .../runners/run_standalone_tests.sh | 49 +++++ test/standalone/test_common.h | 89 ++++++++++ .../tests/.libs/test_sha256_simple.standalone | Bin 0 -> 36176 bytes test/standalone/tests/hardload/run.sh | 132 ++++++++++++++ .../standalone/tests/hardload/test_hardload.c | 168 ++++++++++++++++++ test/standalone/tests/sha256_simple/run.sh | 159 +++++++++++++++++ .../tests/sha256_simple/test_sha256_simple.c | 143 +++++++++++++++ 17 files changed, 836 insertions(+), 11 deletions(-) create mode 100644 test/standalone/include.am create mode 100644 test/standalone/provider-default.conf create mode 100755 test/standalone/runners/run_standalone_tests.sh create mode 100644 test/standalone/test_common.h create mode 100755 test/standalone/tests/.libs/test_sha256_simple.standalone create mode 100755 test/standalone/tests/hardload/run.sh create mode 100644 test/standalone/tests/hardload/test_hardload.c create mode 100755 test/standalone/tests/sha256_simple/run.sh create mode 100644 test/standalone/tests/sha256_simple/test_sha256_simple.c diff --git a/Makefile.am b/Makefile.am index 392e1f8e..34266b8f 100644 --- a/Makefile.am +++ b/Makefile.am @@ -19,6 +19,15 @@ if BUILD_REPLACE_DEFAULT lib_LTLIBRARIES += libdefault.la libdefault_la_SOURCES = src/wp_default_replace.c libdefault_la_LIBADD = libwolfprov.la + +# Install libdefault.so to OpenSSL lib directory for replace-default builds +install-exec-hook: + @echo "Installing libdefault.so to OpenSSL lib directory..." + $(INSTALL) -m 755 "$(DESTDIR)$(libdir)/libdefault.so" "$(OPENSSL_LIB_DIR)/libdefault.so" + +uninstall-hook: + @echo "Removing libdefault.so from OpenSSL lib directory..." + rm -f "$(OPENSSL_LIB_DIR)/libdefault.so" endif EXTRA_DIST+=ChangeLog.md diff --git a/configure.ac b/configure.ac index f9618d64..17e31303 100644 --- a/configure.ac +++ b/configure.ac @@ -132,6 +132,18 @@ AC_ARG_ENABLE([replace-default], AM_CONDITIONAL([BUILD_REPLACE_DEFAULT], [test "x$ENABLED_REPLACE_DEFAULT" = "xyes"]) +# Set OpenSSL lib directory for installing libdefault.so +if test "x$ENABLED_REPLACE_DEFAULT" = "xyes"; then + if test -d "$OPENSSL_INSTALL_DIR/lib64"; then + OPENSSL_LIB_DIR="$OPENSSL_INSTALL_DIR/lib64" + elif test -d "$OPENSSL_INSTALL_DIR/lib"; then + OPENSSL_LIB_DIR="$OPENSSL_INSTALL_DIR/lib" + else + OPENSSL_LIB_DIR="$OPENSSL_INSTALL_DIR/lib" + fi +fi +AC_SUBST([OPENSSL_LIB_DIR]) + AX_HARDEN_CC_COMPILER_FLAGS diff --git a/scripts/build-wolfprovider.sh b/scripts/build-wolfprovider.sh index b50b8fb8..cda04f2d 100755 --- a/scripts/build-wolfprovider.sh +++ b/scripts/build-wolfprovider.sh @@ -8,7 +8,7 @@ show_help() { echo "Script Arguments:" echo " --help, -help, -h Display this help menu and exit" echo " --clean Run make clean in OpenSSL, wolfSSL, and wolfProvider" - echo " --distclean Remove source directories of OpenSSL and wolfSSL" + echo " --distclean Remove source and install directories of OpenSSL, wolfSSL, and wolfProvider" echo " --debug Builds OpenSSL, wolfSSL, and WolfProvider with debugging enabled. This is the same as setting WOLFPROV_DEBUG=1" echo " --debug-asn-template Enable debug information for asn within wolfSSL" echo " --disable-err-trace No debug trace messages from library errors in wolfSSL" @@ -30,7 +30,7 @@ show_help() { echo " WOLFSSL_FIPS_VERSION Version of wolfSSL FIPS bundle (v5, v6, ready), used as an argument for --enable-fips when configuring wolfSSL" echo " WOLFSSL_FIPS_CHECK_TAG Tag for wolfSSL FIPS bundle (linuxv5.2.1, v6.0.0, etc), used as an argument for fips-check.sh when cloning a wolfSSL FIPS version" echo " WOLFPROV_CLEAN If set to 1, run make clean in OpenSSL, wolfSSL, and wolfProvider" - echo " WOLFPROV_DISTCLEAN If set to 1, remove the source directories of OpenSSL and wolfSSL" + echo " WOLFPROV_DISTCLEAN If set to 1, remove the source and install directories of OpenSSL, wolfSSL, and wolfProvider" echo " WOLFPROV_DEBUG If set to 1, builds OpenSSL, wolfSSL, and wolfProvider with debug options enabled" echo " WOLFPROV_QUICKTEST If set to 1, disables some tests in the test suite to increase test speed" echo " WOLFPROV_DISABLE_ERR_TRACE If set to 1, wolfSSL will not be configured with --enable-debug-trace-errcodes=backtrace" diff --git a/scripts/env-setup b/scripts/env-setup index 4077cdff..cc10369a 100755 --- a/scripts/env-setup +++ b/scripts/env-setup @@ -33,9 +33,9 @@ echo "PWD: $PWD" # Detect the openssl library path if [ -d $REPO_ROOT/openssl-install/lib ]; then - OPENSSL_LIB_PATH=$REPO_ROOT/openssl-install/lib + export OPENSSL_LIB_PATH=$REPO_ROOT/openssl-install/lib elif [ -d $REPO_ROOT/openssl-install/lib64 ]; then - OPENSSL_LIB_PATH=$REPO_ROOT/openssl-install/lib64 + export OPENSSL_LIB_PATH=$REPO_ROOT/openssl-install/lib64 else echo "Error: Could not find OpenSSL lib directory in $REPO_ROOT/openssl-install" exit 1 diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index ed4da056..851e718d 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -50,6 +50,8 @@ clean_openssl() { if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then printf "Removing OpenSSL source ...\n" rm -rf "${OPENSSL_SOURCE_DIR}" + printf "Removing OpenSSL install ...\n" + rm -rf "${OPENSSL_INSTALL_DIR}" fi } diff --git a/scripts/utils-wolfprovider.sh b/scripts/utils-wolfprovider.sh index c0d715b5..757878a2 100755 --- a/scripts/utils-wolfprovider.sh +++ b/scripts/utils-wolfprovider.sh @@ -106,17 +106,32 @@ clean_wolfprov() { fi rm -rf ${WOLFPROV_INSTALL_DIR} fi + if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then + printf "Removing wolfProvider install ...\n" + rm -rf ${WOLFPROV_INSTALL_DIR} + rm -rf ${LIBDEFAULT_STUB_INSTALL_DIR} + fi } install_wolfprov() { cd ${WOLFPROV_SOURCE_DIR} + # Add stub library path for replace-default functionality after dependencies are installed + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + if [ -z "$LD_LIBRARY_PATH" ]; then + export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib" + else + export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib:$LD_LIBRARY_PATH" + fi + fi + init_openssl init_wolfssl printf "\nConsolidating wolfProvider ...\n" unset OPENSSL_MODULES unset OPENSSL_CONF + printf "LD_LIBRARY_PATH: $LD_LIBRARY_PATH\n" printf "\tConfigure wolfProvider ... " @@ -130,12 +145,6 @@ install_wolfprov() { if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then WOLFPROV_CONFIG_OPTS+=" --enable-replace-default" - # Add stub library path for replace-default functionality - if [ -z "$LD_LIBRARY_PATH" ]; then - export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib" - else - export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib:$LD_LIBRARY_PATH" - fi fi ./configure ${WOLFPROV_CONFIG_OPTS} CFLAGS="${WOLFPROV_CONFIG_CFLAGS}" >>$LOG_FILE 2>&1 diff --git a/scripts/utils-wolfssl.sh b/scripts/utils-wolfssl.sh index d1163cea..50d61301 100755 --- a/scripts/utils-wolfssl.sh +++ b/scripts/utils-wolfssl.sh @@ -49,6 +49,8 @@ clean_wolfssl() { if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then printf "Removing wolfSSL source ...\n" rm -rf "${WOLFSSL_SOURCE_DIR}" + printf "Removing wolfSSL install ...\n" + rm -rf "${WOLFSSL_INSTALL_DIR}" fi } @@ -72,7 +74,10 @@ clone_wolfssl() { DEPTH_ARG=${WOLFPROV_DEBUG:+""} DEPTH_ARG=${DEPTH_ARG:---depth=1} - git clone ${DEPTH_ARG} -b ${CLONE_TAG} ${WOLFSSL_GIT} ${WOLFSSL_SOURCE_DIR} >>$LOG_FILE 2>&1 + # If we are replacing default provider, our current built openssl still + # links to the default stub and is non-functional. Run the clone with + # no explicitly LD_LIBRARY_PATH to ensure use of global openssl for clone + LD_LIBRARY_PATH="" git clone ${DEPTH_ARG} -b ${CLONE_TAG} ${WOLFSSL_GIT} ${WOLFSSL_SOURCE_DIR} >>$LOG_FILE 2>&1 RET=$? if [ $RET != 0 ]; then diff --git a/test/include.am b/test/include.am index a2eed11c..6dbad0cc 100644 --- a/test/include.am +++ b/test/include.am @@ -35,3 +35,5 @@ test_unit_test_SOURCES = \ test_unit_test_LDADD = libwolfprov.la noinst_HEADERS += test/unit.h +# Include standalone binary tests +include test/standalone/include.am diff --git a/test/standalone/include.am b/test/standalone/include.am new file mode 100644 index 00000000..303da443 --- /dev/null +++ b/test/standalone/include.am @@ -0,0 +1,36 @@ +# vim:ft=automake +# included from test/include.am +# All paths should be given relative to the root + +# Standalone test programs use no extension - simple and clean! + +# Common standalone test headers +noinst_HEADERS += test/standalone/test_common.h + +# Standalone test programs +# Each test compiles to its own binary for isolated execution +check_PROGRAMS += test/sha256_simple.test test/hardload.test +noinst_PROGRAMS += test/sha256_simple.test test/hardload.test +DISTCLEANFILES += test/.libs/sha256_simple.test test/.libs/hardload.test + +# Common flags for all standalone tests +STANDALONE_COMMON_CPPFLAGS = -DCERTS_DIR='"$(abs_top_srcdir)/certs"' \ + -I$(srcdir)/test/standalone +STANDALONE_COMMON_LDADD = libwolfprov.la + +# Individual test configurations +test_sha256_simple_test_CPPFLAGS = $(STANDALONE_COMMON_CPPFLAGS) +test_sha256_simple_test_SOURCES = test/standalone/tests/sha256_simple/test_sha256_simple.c +test_sha256_simple_test_LDADD = $(STANDALONE_COMMON_LDADD) + +test_hardload_test_CPPFLAGS = $(STANDALONE_COMMON_CPPFLAGS) +test_hardload_test_SOURCES = test/standalone/tests/hardload/test_hardload.c +test_hardload_test_LDADD = $(STANDALONE_COMMON_LDADD) + +# Common test utilities are built automatically by automake + +# Add standalone tests to the test suite +# We'll run these through our multi-environment runner manually +# TESTS += test/sha256_simple.test + +# Note: test results are cleaned by the test runner automatically diff --git a/test/standalone/provider-default.conf b/test/standalone/provider-default.conf new file mode 100644 index 00000000..12da8cb5 --- /dev/null +++ b/test/standalone/provider-default.conf @@ -0,0 +1,10 @@ +openssl_conf = openssl_init + +[openssl_init] +providers = provider_sect + +[provider_sect] +default = default_sect + +[default_sect] +activate = 1 diff --git a/test/standalone/runners/run_standalone_tests.sh b/test/standalone/runners/run_standalone_tests.sh new file mode 100755 index 00000000..9fcf6c01 --- /dev/null +++ b/test/standalone/runners/run_standalone_tests.sh @@ -0,0 +1,49 @@ +#!/bin/bash +# run_standalone_tests.sh - Master runner for all standalone tests + +set -e + +# Get the directory of this script and find the root +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "$SCRIPT_DIR/../../.." && pwd)" + +echo "Running all standalone tests..." +echo "================================" + +TOTAL_FAILURES=0 + +# Run SHA256 simple test +echo "" +echo "Running SHA256 simple test..." +set +e +"$ROOT_DIR/test/standalone/tests/sha256_simple/run.sh" +if [ $? -eq 0 ]; then + echo "SHA256 simple test: PASSED" +else + echo "SHA256 simple test: FAILED" + TOTAL_FAILURES=$((TOTAL_FAILURES + 1)) +fi +set -e + +# Run hardload test +echo "" +echo "Running hardload test..." +set +e +"$ROOT_DIR/test/standalone/tests/hardload/run.sh" +if [ $? -eq 0 ]; then + echo "Hardload test: PASSED" +else + echo "Hardload test: FAILED" + TOTAL_FAILURES=$((TOTAL_FAILURES + 1)) +fi +set -e + +echo "" +echo "================================" +if [ $TOTAL_FAILURES -eq 0 ]; then + echo "All standalone tests passed!" + exit 0 +else + echo "$TOTAL_FAILURES standalone test(s) failed" + exit 1 +fi \ No newline at end of file diff --git a/test/standalone/test_common.h b/test/standalone/test_common.h new file mode 100644 index 00000000..9cff9cd6 --- /dev/null +++ b/test/standalone/test_common.h @@ -0,0 +1,89 @@ +/* test_common.h + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfProvider. + * + * wolfProvider is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfProvider is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with wolfProvider. If not, see . + */ + +#ifndef TEST_COMMON_H +#define TEST_COMMON_H + +#include +#include + +#ifdef WOLFPROV_USER_SETTINGS +#include +#endif +#include +#include + +#include +#include + +/* Test result codes */ +#define TEST_SUCCESS 0 +#define TEST_FAILURE 1 + +/* Debug printing macros */ +#define TEST_INFO(fmt, ...) printf("[INFO] " fmt "\n", ##__VA_ARGS__) +#define TEST_ERROR(fmt, ...) fprintf(stderr, "[ERROR] " fmt "\n", ##__VA_ARGS__) +#define TEST_DEBUG(fmt, ...) do { \ + if (getenv("TEST_DEBUG")) { \ + printf("[DEBUG] " fmt "\n", ##__VA_ARGS__); \ + } \ +} while(0) + +/* Buffer printing for debugging */ +#ifdef WOLFPROV_DEBUG +#define TEST_PRINT_BUFFER(desc, buf, len) test_print_buffer(desc, buf, len) +static inline void test_print_buffer(const char *desc, const unsigned char *buffer, size_t len) +{ + size_t i; + printf("[BUFFER] %s (%zu bytes):\n", desc, len); + for (i = 0; i < len; i++) { + printf("%02x ", buffer[i]); + if ((i % 16) == 15) { + printf("\n"); + } + } + if ((i % 16) != 0) { + printf("\n"); + } + printf("\n"); +} +#else +#define TEST_PRINT_BUFFER(desc, buf, len) +#endif + +/* Utility functions */ +static inline int test_bytes_to_hex(const unsigned char *bytes, size_t len, char *hex, size_t hex_size) +{ + size_t i; + + if (hex_size < (len * 2 + 1)) { + TEST_ERROR("Hex buffer too small"); + return TEST_FAILURE; + } + + for (i = 0; i < len; i++) { + sprintf(hex + (i * 2), "%02x", bytes[i]); + } + hex[len * 2] = '\0'; + + return TEST_SUCCESS; +} + +#endif /* TEST_COMMON_H */ diff --git a/test/standalone/tests/.libs/test_sha256_simple.standalone b/test/standalone/tests/.libs/test_sha256_simple.standalone new file mode 100755 index 0000000000000000000000000000000000000000..e47d2b431a74c4015ceb4b41ddef248a535b4527 GIT binary patch literal 36176 zcmeHwd3aRS`Tt$!&YDa@5+GrnK!RaONJ2oi)C3ZoVAw*?AmWf^vS>1inF)ebKmjGi zRIsiU0lR6f3$?Z)wF=t0d}}RQ^ovWCx^+@FYSn7B=J$Eea_7z@>9^1K`Tg;GeoyZ_ z_nz~<=Y8Mvp7*@x+;h&obMDs4>Lr@0D)P{kZzu$Hjpmp#k+5gGh#)9a<|@g!o}o-p z?0{_y$J5JrfK+~*)Z#;@!0QN!FOwoegyT3`k)hO(LgE|l*p|#wWT>QanD`8e3OF$w zpTg;6DAUdSd^}xA2p76JUWQgavdz;oc>2=|<3qnFcdG~`ADN5zP71!0f=`A%VNV%K zdy-A)oGaudhJ{F@LxzcbQjf&2g0m?yq&(8g9wvEG59;Ic7bfUknwqyUgeUJD3X;;NX7rEbkzMcPZrN-oE$-+7V_F=B1Fs_(3V+2g^uHel z|H3eGDu>Qo9lbp zK_9H|Zfp&7)kj(x-?ECp;@Y}ED0rz-SyL0}>TU}`LU(s(cR0}8B}tltkw#9>^I6gs zs&A)^C~Jsl?hXcdrqxx8n83jpmW8S5ny#k$2zW$U8ry^Qp`NY;#oIgUn`9QGWlX49 zww@3p>gtJvVL=$L@!~*Z>&1cQ`nGl;Sb3TWql6>f?ZFTcS&#t~l8Vep0s(ZejiL%V z>f1tKLTz<}sc}<%pqWbDc3Dtq2}XjUjY>zbqp_n4iEZJ|#(DEl7mf9yW~KSk?lu$+ zqEI>1InSbaWB2B+NM{VB*c`L`vkD3e3YD{Ay~Tmzf)X=!rWu{J<=JPd1+^RGrO$p?%dc0?PrD?yW6@V;h6;m3=gI9+d{BZdpq4v$U`;s=r;Ux z_9KY@41{*Yp*Rszs*O>qh^hE-9=bme^Z|UH?h`&br+48tU{})U#(;y;zZjIRTha~1 z30ir7%xG)Fh{>t=1a35g9m+HTKe+cM$TyS{0r!k)bJ0lSECENd2-cKy0MjAIIkFwD z%;fmvVjLs!sRHjT3N3gxP8A7rEqJnpJjyJ1 z(n%hE3trlk(pFmVs4(-Wv*5*0mZfd5;5{a_qO@A@NfvyU1@E=sH(Bsvh|N;BS@6;q zDPfldKf)qsj|FeNZ`@+Rr(5U`TJSXPlE+;Z{78vJc*ueuWx*e|;Kh`Pr5?55vn=#a zTkzIF*l`PNi5b%6a3#9-?9`o9;0sl)5P zJ_b`q*MC(ErVg&ZI|ft7*543=sYC0piNVy7^)HIS)PeOE$6)HX`X|L;x{>s!#bD~d z`n4EL9asOyUz_En4y*so7)%{i{|hmgI;j4~V=#40{SU-o>X7=s7lWxI>c2h)QwP+4 zRSc$%r@uP}(+#e_!Gs5Ly{Mh$l!+AztDk|~Ir;H$K>|D_0iKWmk4k{O39vl@{u;x4 zYyO`lz#k^S?RCcwW)fbUCyf0O|4Pk?VqfWMspU!4GNNq{%T z!R6=r`$}(1Qk3#F<+W>8`>%ZeG%B#kzuT6Zhlsy-M@|%B(b1{sP&IPZ( z_X)J^lpQyMEBfDX9e?j{7~(QCR*?3-?(cmnx&;Z_qiV{|GLTjG<$nb&s{3*saNz3R zkD~VzA9{$f50eL1_rCcUwe+H+$mkI$9^LxSfq^4D>0LkQ-w@(ao$L{-Z!Eh1n;IoQjwyMqNjLo1|$VR%!C}FbtFi- z0c||Gl}R$G_kfzI1BMdG0NO1mRrw>NLUbA9;P!9wPv;eqvU3H><-hXRR81AVr`D}6 zzo2}5`GrqF&im6KlWI*C;XQOVQG0yGqe;!3pnjC7b1c*yq~=LhsM0%-7`^AKfq{NE zRnYF_Jw!d#Lj7lweK)5L6ZIBQTg-7k>b!ppn5+Ama(w>2+MFa9ue$f$=uQx_ihKs* zV85hlc*=(A-akKlB@orUA4k8BPPM%E*W@x|VG2=`NI_+$qQi?m@FnD;DvnT|sPr-Z zzLEFAa!5}?x?qUz23f^!IPT&;o3j1$vXq@4B8T$rpZg+PP^*uiJQcmi9+i$V@|$FV zo2b+o%xKBq1x1{VvZ>S$vXYiwfyC%8WYPa2GedGaQBShi=r*Fhnp3YJ>hp>EFsPZQ zLECcVD7F3LKTsGHYBn*zzmh@BT#H#XdLiyqaFC_A0Yu*V5t~fA5?A?Qfr6SzB3jwCEY+ z`aB2*MxFyfpEMVwOxyusOq(`f{C!3P1@k_SjKr2(O4GC}#oZ|hqN zeYp60b(AD!2d#Wn_sy)pSq$C39)+toaP<^f6v5MlBIesMg#q5N`k9C>H?LEG~ZqN0urNt z{G17h?nKy+{L$3@9^GWg=0W1P#>{3FWz!nVCS}Jj1=C^+(|;3F4G={~&Av$1_wMAi zq*XE4WS6wZ3Gy(=52NhLd(YCijr2H8%AvTUs(b%}BEAeV*)D$bccyoB?}yR(pn}0t zcK#OavwtD0$};M`|C)<@iY)nTpnN>Y=e?WYM8aQpCqF}UtIqz;2=#vqmRUf%;1S037ab z(Nqo^Xz%1vDnN8#xY0#FW0~-ZK0;a>M2cMf+ZGh{EZ+7_ctk0AiG#dE>1ji8H7dp& zOEG>-jN^zAqhn@TUKwzIvhPRHJ(gVhpi}e!LwpdilPmTtBtBV#vb_;so!~oxJ1XjB zGxCx3lK&a3`v~ktbcKTMAwR1>KeCW?2GJcb?b}znifqz1zKqn!B)-1VedI;&gAjR~ zBYEKu{@%y^DHVSxIvRcKQ%1O*2%q4DXAVht6DPcl2*1k-Cl5*3!3iHE(_I2WrZ4h$ zfI2Sg3QjlxiR=1XKxyqi&Z8crs`u0K+N$0YYy7?cT#YG9rey$CkpsgMekYK)R>=pPwF^u1TfU*KSOKo%Rm$aZoFBfID?A?m%KMRO3y`BphAe|c?nU(TF0 zRecpXDwW^qpLeXg6;`S0eaVm3R0g~Fd;d_~SNa*OU8SC2^MQ(#U!ec$eWSYf3#POG zsmIZx(UG968VasP=YN7`GViUP7Z*Qi3&8|2A1%KSD#!Ynzh*<<@s!A0=bb{RVYW4}Ge8{}ii=&kYD!03pAkes5iGl+$hlK=ehRuj+lKs`oUw zaGSmr+93rGrf=*H;xUJBS%t5$GZYDK ziZIf_bfyA9UlV(h!|5t27p*yay>D@62Oe-(EYR6J-!~~YJjs`rds&aKVKYoI6&!=* z_OQn+R+(gh!F2M`Mm*(UI+Oy2jR-QbNNaGDEWRn1KP2+uaZ5|2)z{G$?x@G}BVS%{ zQ&+Gt5^VB8>lwb5&WJC!$EtT#Xd^12N!piNLWr3UT8o5P#bA{F!QG;fS&7$RxTmo( z7!Ei0wEOZ!M$Ak@mrv%~Ro`9TfoD72VJaE<7k|jsB_5@OMM;OS3$N!DUBM6@z4`E5 zrMtd+b6lm9-9>$_4n|mQc62uNz>)bgIUhZfLn)ETVEOcr%SVrPq|3(nM>SH(JH$gi zpVXIo`%v}GQU$^GYiKW2r4gT+xE>o2U)Ijsm*OBO~`gWJR_6MQP7EYdftla zCG-R@P`SK(QFUc$k*}dA;*-w;m#wH+Q(d{*7lMD_(IvE!@~sB&!FWMbF1KOWV!c>- z{lQH>JoY1nq%ZbBuZEy6xG@-t*;&>^8kmF25fS5}zXGTf5#s_M!Lw~|m*<^xMnNoLhZ z7qnIpJ@zD++))wEW(rumV)+u2yMjNRHXWB$u9+%Z6>Qhs*1}7dC%j{-Qd(N-V=7yF ze;^Z8=X?oH7LO#II3{Le4ny9Mhg-=l-eg*i{H=leMWnOShil+0_GH>;$vzGU9)dGm@I z&YU~DxMA+>*>S=E_=D~3oipP42MjAP3m&U4Xh(?ooN_WcFmMpzroRjf(3oNu!czz{ z-yazG9AVz+fq`8F|8-!17TWSKve|~P4&gq8yD%7epI{8F=vi$YhQqZ8X&nC`zg@F; zi6BBzFRM}1O{wbGB!_bkcxd&Fo;%(0(ZB%ag;;!XV9iERXc4LeXCdhZI>np1#GAP^ z#dE21n{w8edDCX)OahkiUx4tg{(%9;NJtzcmxcfbfv0@rQGv*{I5XcH81UKjFo zwpQiM?9&%{eb?H`y?Iv~<=(>W_OrbQHT_Q2?JcbE=9PPWi@ceOys3-4PFkN)7UDdC z^EmWQrZO@)ps~uSAUXOX$cPi*hk#75WI(TjuxTFRN~Je-yLO@1iD)&>LZm&2w0zPX zvir1^-pp%t=y5gaxZQwk?Q#fS;`NnF%_=>uz$~_4C@Yp1)z=Ll4-7m5nCGQEMw$5m zQXTqHmtRpD^14n#IlfKy=(AON^RA`5uC`Zr=WcgYcvot7xxI5?A!q>#(<+NS3e`gt zvc7_>hlh~0h-6igtR-AlnYI?P77vo;_tbmmE*XTL3z>e{`U3ddy+Z!AT7@_BYO>3A zo3_O5%`9hiRN-kvd@+kN8xZ+_j{jKT{}l_!_e|t_CDhF6pm$~HkTAU)V}+@IrGw_R zbetz(>c`n3Izg;ba&RIKzm@; zWWXmetnV@qEZCIKzd=y!9nw0%PyIO^SiN9}e77M_ z2$uMjB4erdNkNZQ6n4n`Mfo89Ea&O|5zCpZy!-fGvqb}NdW*ImyccBAqtt`i%}8C(bhu0V0`Uu76}TSK9!6@wJq_{0 z+L@r=!1Ot)WkSyeCk=Xktt9mzusgEoRq^acKx9n!CVvE+Z5&+)okBH2+N6>T0GWY! z@->uPMzQn3Wm}3EBWyy15vHSdK|PufHmb+bAzUWWJIKj5dnpdDpgRbh>PrN+n}M3_ zQnibro{ehQm1=th2}x6t;Fy;E5Q5~#fKQqQ3P;zN-vKe=5yBn>BFT>=$0ZY9C&X$Z zO9r#!i7`}~c5lM;bQv)Nj7p`+cLU5O<*ZvDWrJ;C|F4{lo1mU_wGkQ zGt&v}(hJW31rA18Cn?L65%k{^FWum>(h2R-PfcNjO8Q2yJByOYkH3QyJ&fFRg7h}T zGL-ZMh&xLd!Tm(Q(#U)nm|=j~waoq`;SIV_OtJk0sUuI|;{K=hM?%v@v5`?mo`b0S zr1lA+>7v+P06P6{L|v;4575TCJDsxB_io$b z{Q%&kH1bV-@B3GH>7NUe-F9^1`re~krgjG-ikjmhwQ?zMoYM|t1zx>EojwXgcZ$1* zixgI;8q@7)=s8GO3CiU-?e_?Ztw5^k8kg?$fs`E%k}yY%X;c}JW3m;-E-9=Df*MHJ zDnU$c4qme!fVwc%7OG}!XK2vWkd=uaV>HP;Wt1q{fUDMe?C$82FRiV#Sp^J5W-Ih zQcXrCb4sPxwO8p$r<)=6lMZk+ZBA~D_*rs`viySfQJW}TGr#eQn-vr;pe-qkix0= zyT}y&Ux~su2z8}*YtBi+-mgmGG9qU?ml`jUaO$3RK=4&K?SB)*@%5MoS#+4~o%|zB z%(gTck%RVYT$3>WVsiIE=66Z%1VLl<+d<<_6CEJk;xFO? zwT;wKYGJAt(7THS2@Mmj5+qlEwO-(9eDT9LR=PW^LOAkWXw0+*cV$>k6qIR8 zcV!I11ko4Ba}$>?Tq!_%BsD()%5mB}1?1r5yMyi4Gj9xqt{_m={of zLvUIi=D3v^^v_-P@7=|yPnxpQjB^s3veK&vG-ch8Fxe%&<+OD^(&MMCljXEEb19__ zHEqp_pSJ!5O~;l$mPE-ZY&XTl6qe$SJ8{Xn9Tzc=%_KywoX3ub&SD;WG4OI8OZ0Lc zOK~}mrMR5OQrsuzu@sl{Sc=PeEXCzKmf~_AOK~}mrMR5OQe4hs=Rh?%kEL0joX3)$ zavn?Zh~~p}sb?pyavpmw;@iYLc0J;99$N-Eavr-9aXF9O3mQ3(Js)^EkENlzoX3(5 zavtjky`0AuATH;zq>r4(lHRs)jHikOaw_7fG>>(x zp%~3$9Rb7`;bue_VY=eD57b$Na8NyFZO7#dn#ZQz?4@}8Jl1g!P!rD_r--FJOKH0(OGdB- zu@TCI{glBx?R83|X}L0irg_OPsHX`-R#m+JO?hXfQkEXbV{}|U?#8Egt>u+&(tmYFE& zPa%4kin2j0%ifDP9qPVzh;$E7`b;mf_!v_Dg3~<#`5sHKM$qTDEQR%IlM^2hPC(Fh^7$3UY|L2&B# z3F7O(9h;1u&S4C|h{+i4*O2}!I1fwdGBTc%Dv!I!jco6LW+Wu1lI zkB?NJHnXU~d`}3EO5rjxSqT4?YZ?m6gy%sp)hZY65u>7b;kU#ISJgT;-dL-DU#-C% zZi~nzD;+H!VriK3eN03#%=tb>7AP}HtM3t1oyZFmE`36-P=>FP+)1^3P?Y{*k)-bX zt^+j_1<#!`sQ$>w=HVPk|H{5|KGk0cAZ_3=5-(yXcUF=EeGeclaKJOcxQeJw0DKnb z#5U!}1k?J&-*F~?44a-3*{U}o<)^MPbNh#+;O0O{%(?6!h`H(~^}y_C`c2^W); z#v!G2#Y@>KrF22cZsSfVWg8@HAt~1mDdnnoDUwM0CZt?z{25ZR$*}f=qbC6~^Hw3m zwCnXIzx@+obLy7ts43Pp?al=o9rp2pm6CI1@@;1F5=(N0Onyx!>z$TlCfL&F)kFNn z7vpkp4CREjg*zY}>b@~vG{!aIQ1_Dv1y(|lLa-uMU9qzDjRDJ05{OmkvN!ZckYh0BQ4^qa0jQqvp=o?2Cag}LwG~1V9PhX#dB04KIo=zViW*oxL;W4#M>v^}+Qo=Zl@aNqRj%3; z;a2Im!HvMFrwL-yM}HFYQ5q9Wlfq;~`cifBZW2bVX%YnaaI)5&5=I4F4MD4L@}A|7g2U`tTB(P} z5$josg{GfM;W9FcQ!0yHBe6=!iroysO{A$um^Z#NIB5!BMa_YChk3FlWJD@m>gp!B zq%{5U=~7eaO2J_&ebAIEM;S$E6K9^qFac{#X$$CEW@ z8JVR}$#`5O((u`?3d2x79}CJYz-J3QO$tY#5a4y`PfPF3SS^xi7MZb50Mt9_B)2yBo7Pe_6G+bwLDS=dfn@Yl!i`Y2&Wnyo-LRwEAfl$ko0v1~PsdIj<< zv6{x`zhl{I8YR(SU#zClBw4Jc397wl{o{y=CNf3X@=4Lgsow+4$i}IhY&5L`e28=O zOx$g0I5}Fbsuj!Cvy^fB$KcK1A>S}|E9~Wt8IYSYe*f4ZUl0b;?N(A~c~88LJ^V}Z zpv&GrQPK_hPBch-`zJ_}px_;YFSi zYMP@iTV3lp&!Zy2=~p;~D@XBozTwg7_QSa-*+asx05OWP_3&IV4o?TT5dP&YVd|(n zL4$%Rs#=v!oT=H+YbF#NF@-6ZR-m4h#e^91JZEH8r7z4PvUC%T62;IN)Y3+pX~w*4 z`x#lBV-$AAf(bOK%;+&t~cGIPaHdO&FB$oD$F|pMn?%J3e%yd@};Y~*W=-)qVi?O zEQcEs(?*z)zMq zYB*(W3PVkEn>CE}Y13QQjIQ%YSD6vB33UEfE-AeZYgeW#!Y#==g-4QU9Hz@U&HNI) z)9RG6ewpVBt%q?>QykQfxw<#eCfv>`yv9?dPmdtiOB>2>q_1X^zh@idH&(M|$fktl z64;kf#XND4+s3RpKYIl8uuR@kvbaM_FZC>lYcON~h4YS+jc>ecd=tzvTbs~C<^a4H zNoHH|Ny)5uXm8fSVf_YG3DZo9H3LegW-ysIgPd41$W3epc!0!Q8I=cr9o!7^s2NPP zDC-G%W4*yN)4`c3$ib(_qo_NF7W zNVO;8MXUnN?yfjiRnYRcxJzQoJmnf{1giR_H<<#Ob>c*1qH{XpH8@*w?#B5b&OhSB zHUmlpPEDPtrKHd}N@bT-ggYM>y^&%U<6`Tk3xURF!d-)lowjN*Zo|d#1B%i68IA{V zQ4AH2gyg$F`dHPj+BCzh&u@;{R72I5s81V)-8s`pvyV2?uRwgSkzrRUOs69wJp=Tr zK3z5R48v_#>%eB%^;&hE;R2l#3$tn+FuP*l+YIzFDbBTqlSOVelEI9WQWIhFlL|NC z&!sli?yO@$9c4ONWa->bc>=H7_08(YSVkWsx|gYUnN-ht1hg*u=wBL!J{7Ta*bUKf z6g7+;{Q9op((l_^z&NuKIQ3?te@0P9js)3AMpGeaw8?3__@%I&Jslb8cWl+Bkx5m3 zqNEZ!=o?7V?}a42g5@_-mWk`>B|VFoo{wy0h1Sy&#dN4dbd1T-SJ%ag?_3JI-E4vH z0elV9rPCB5>MIpqNcO!dW?nsH677i@I28t-MHRcpSYW@&Fh;WKa@kv$-1AKquD_m3 zWpuLwRB-(Pa8HqD=wbTLql!z{>o`$3ktm4~P2$z0Z{k$zO)7F$cwH_NVy(w?rq(h^ zc!Y|JTJi8IX_t7XOc=`(;1oj1mpH?CDhEstFH!Bfw+?R?sA?sqr_`LUr{*|Rb9PX3 zeiO|su{oPfIqd{eRdyM+DbwE!G}fM-7%|&N;KEz>IEu0MoJ%ok-gau)c1z2qI}#3k z8d^3?bPm)XagQ;%G_p1fu+*5$(C4#SOm^lP#wPoB(+v;9?p$Z2Ad*ZzVQrc>fjVMj zN%RAZc^n5BHUb-OAM8*bX;tPNphtrZtLerFWRgPcZ-eg~BZ=~~ucey9ONFdgaZ&{* z+XKJc&Uzoz;AM4#NV6(WAb)O?fcdmlesVWNbLEB zZ$3nQgO|zD-BM4@r`vDYfBu<2y`^BXxDm&7kz_P#TtYv7%B_a@ETv?%qA*=s_%{wkjaYeM1jFhI=U?kz(9d^ zOr3xp<~H7AGDMmeMueF^;%3$~+&TkQD+2ffb|4sPQsib6fpBX*b`1&8Gvz>MdsCpZ zxf$CEVB7A7p0;-E!w?Xghg&uR7u%X+&v7NVu`AHg6ljcW!oJ{2g!Y7BTZ?Q)Cb8`e zDC2Pb#vsc%+}epPGU)$1VeA$jKvuMId3P|3?ZqL3Z7faS@lJMoX`0`g2`|`1cd41PLUw%H@5u-F5 z?#k!?YtN?=VZVm_=KApFP-820Tj}fx=l6szZ3{K!M`$DaFcR55?D;531p9q-cIRUg zhE8n4AQKwf>%*-wnYLHRZ*FY1zzW~_gH;*!5Fi_1pM30Z(b+>g<%><(8H!!V)G??h z6mDw?VK)Rq$M(h-JI)8%I~y;K-)CM4H1>1{uzz|_M@SL-!CM%s#HRYODq|H<-`%p2 zRl*YNlpuGh=Nsh{Wh1tyXxtc4Ol@dm35!&73w_9Ggfn*4H_iT+Tkz8s`!T;{JN8pP z+#M8nIh>AapY8oGw&6#~T4@{mKu@SA9Be9%ISqLo+n0fh6c$&oV@q2oNUmqeify~k zd=r%+TS8z_XD98jFB_5A^`12l){^4d2XBM2G0BF+Hm(UoI$1^YR%4orDi6E!ci?I^ z6>8Q2YQJ+z(5i%!(CZ`Enjb+YZ=T{?0%k*^4+DUQ+95S0d?BEx3jwty*6d&v+Djy6 z8=kh2d9&GDkP_HVKY-5`)H71n+&O8&M+63ag#hj!tnc93F@9zx+VjV%Byu3%gq|#! zwzH}44pM)HjYh&8iB62{#SCXLzW5RWNQ>g?pLq%KP_tEFq9UaeThvfDLz`(Ra(52Y z75fGSt7N7ZdPv%$CQPpI?|n@oo=SX|L40e0vM!F-jDO1^;qwoPpHdLtY={?4d)J`s zJ@63b2eL$BCm3^w5nc{_9|Kb8I}Kz9<}9Yq#(xV!ZVghkys9>^y0W&mYWdl#71*>G zo0o(eSq02Q-G-X#(b)uNQZ0qqRo-Iw##9B3Lwu2;V{>;9yUE0TnPF&&%FLc{_sq6X zV|!0ia3(tDz?>5Cy`Pp)&&-B4eCdLbpfS#DX>1%!QZ!4l{~NMqMmBc^A#u<*B!<#> zrm(g70ST$5zz$R*K*O1tLrrhUo5Tj0C7><;kGSM}OK* zG;|B*;sD|H%qd_E0=v68*w%?~A?uu=>^BA}#s%=&6T$}9uuz)x3`O$E;X+J0?I?tZ zyi+48zV3md;FBM%$}2RD#)MuTcDXQSQnfqH)*sX~$UXz@Uu@aF&6-1-I|Lj$kH{^Bs%t;_$EF?#dwV{X0Bq=y{y zpI>hMlofCOY0Itevf|DETe)@l2P!7t{J)f2mw$j_c=L}=Zu3t|3~&BZ$*mu@$~XUH zgmPKSYyLmTt>;Zr*ulyx|K^ZnKe(6K5;idZrUTtg8Ni$WutAG>ph$n!}rCV{K=fbGSkFA4D_ z7X!qV;D^)14zS*uq^`2vN*UJ53|A55fn?wh@C;Y+*2Vd_b~Tc?hKO%T#yg3(B;TE^ zuC?9Gd1|aY#L4;Uz;_}^y})*Yt64{CZc7GYTQVyx5LYJOn2d?ojil`b@HX4elb%aL z1?F%C4iM_aq)&m8ulF+4mB~LzcI)z`+*tOuqwX)=u-=#MV;*kKW1drZhG0A8`GO<3 zTz2KewIF`Pqpr6-;$b|n-7(M09+>E5&VxQBc5t3m;Ca-eUTAxi^T3M7JSRM`;t9@U zu_EWFkt)H4$2`CHz=pr)q|$hr?Oo_j?fpyl9UjL<1wGxk1GYOnKk_&c^=(upv7&$J z{*lM6KSvK;a1e?PFx~Ef1KjTUAr<$B;L^ie7{f8oJ7AD6(#99Y`H>UUA31M!p-a2j zb%UE5?FRQlZXh0VKf)0#3zp4M;;02juNx-ob$^=(V6tz6R9&Ayw+eLExKZENa5|WY z(OtmkY^R+APV{y+xF2+@E2$isZM*Ac7n$H@*I!)lUR3_Gh`Dw7J}fKH4ep=2-MV~F zm7zYd?{e4=o)%5bcDLiF4!17f`lKS;{@{28DESH}Lw)7g?sV(&eN2Y>q4OS~TePn~KAK6|vVCA{;L9EdKuzgKLU)%mG~7N55%SzyX~ zo^D&uYcFfuLtfVUAS70F{0F?&HvR<-WqE-U!6_Kgxq`@+Hv`3SgUK4Zsc^^4F6=exyF2+7DhSi~C>do2pw^CUdE*xP98Kn*HGSCB@^~a{!-_ z;LF-SH8>Chd3&+lsQ*NVQLU(_^>=`hZzUa2sQ;0Dwb6`cjC9x(hpl{x;*g^fywcqR zw4}4Wss35DordPv>B0Vq-S#PN$hPf{T@J-|gX5rsxus(JmE#!)b4SJYuH$2ejoc9R z?!3)uBllBm_c(v%v_0s27}0~SAGmCHx$bq@9zr`%Y}-7ydRUi0>I{2Omta%=I*>?! zx24IV%C&e5N{5eK@gfJpq3H8~SMg;(x%q_nx1mxj@N%n(av^8QFmhG_uPLd@LGj-} zL9USh5dL@qzFFYq{!fzrazs?@#*|maF;q@EcHvZ&QHtE3i6L>hA1BF|`$DK^@Tp1`{^%9YLL0*PfL9Xmt)L%4Irum|$k=fy@S@QO3=ggcekgr@ zI1HY4*G_{*i7&4{I}APj_iZToE=|Z0?Ne@6eahAoWl?pir$8r2u zB6-Cya@vN$-#!ffQ7K=%z9-*ve`y%{PYJJ$P*Nwx>-ps{^jT=nL)mA}F!*yB9_>-Q zxB0NhhQ1d(l$>jZ!LNX0P(8};ON%jya>p?Av|m%2hSz2BW~=phoY6y$un+Y+bi6!_ zoX>!#dQ2^2WafqbgEo}@^zX5u@NU*PAz*Bos66BxD@MDz11pGRI_a)$4fFCN~ zO$-nJ7yk~rSCjxZjv?vq90vcmkdye2o0oz237OX5(_!SKV`4HC{iI>=3xOZ1Tp)XaN5^KcSRlTuwUyMms6wmJOKQrORbqSQ3i=Xl0FMv?m41QrSJWthinYtjmsKrR z0%upRSX5peSg~XYR?Gsmw4F0?#Ga*;$&Z@O!mCf#wQ2UqqD(Hj@eiN|g0baQT677} zsx`z}zrJb;q|c!81;RKKUki;xvC<_hw~F;`T82zeB7U`zFJvZ=utzx9+?kg%_PyK$ zGSpKTi`!T+#8V5VM8f*5Hw_I1L8hiY?71rNY|#1HYe!9Bn^H%^RK>3ZL!S|jpg6| zYIV##`GdFw#rWeRvlwJpr69by0}o*kM!I>}Dq~oR4R&`a1=s~VSb$~m0<6V$;ll)* zEht+2ZOU(J5~%V;Rd_(zqA>DSJb+XRnl^`!1rPB&jHRG~gz-o+4hSHvJJ?=N3?kOm z9#IO&Ka~PR3-B!i9tj5++EgHk~KF{nFPmsSvL6+Lik6QoIq%iz5>=a6w^Ro~GD zVVoV_p%l=1G`e=+f(<<_psWw!tKSlA3pIDjczr`dcW|SG+VM&CQg4n!_XIV7=F-3igd_O3|Bc4SE98ZlL6orIg@{`;Fn>cl^Ahn z0z3z>m7m6kbjUD=gXR^(i@2i-kdyc>xOOQx=<4Q8QAFd3` z1hdp%(#a72AW~?rT?rqe2|NxN9%K-=G3hDw7igsq5wfY|m;3+9@T4G=`AdFT{+k8= zB0(qj6PBUef0+1*Cz1aS;K(LYzB%p}K14vHte~ZRPg~J{cZNFu0sn$neet z{-gM-7acN`bQ~L-mPq^|Bv|u5F8F0=-8-LTNIn_TyvoWi*NtR&FFB{>kbDyL7$R1F zIUkfE{=OP_B--ycf?w9Z;uGW|r1xj7hd`UC-yuf%OMba-A;Wf)l1CEre>H*s@EM#= zhC8HSAxHX;0F`$Tp(ib(nVRc0Pt#w=a3s=8ScZQE4gMu+^2_z1S5Et@L<|9Q&J_#p* znQ$_HUl~tH9fse>lg;Z0k-s1}@sgk3uC^YeD;+W%BltNsc3mI@Zit~+O!7(e)M5B< z6a4>}Bq@2A$Ul1+{u^oG5y!QduUd~p{>8)aXRqa4nF;MTk$;8YPqg2>CeFX!>=-#L z`DIA|E1`HI|4kQhdfL9(dPqJQUL^RfG!#E38t%6e97gg<`pbslKZjPmaooWJ^P0#{ zaDs}A_O#%?OO!tsSXx__>d5;K-R`9CGDdN^<#HYg{SWm=-StrX_NzGmw-OXi0G0m( DvP`U3 literal 0 HcmV?d00001 diff --git a/test/standalone/tests/hardload/run.sh b/test/standalone/tests/hardload/run.sh new file mode 100755 index 00000000..fc0b9e5c --- /dev/null +++ b/test/standalone/tests/hardload/run.sh @@ -0,0 +1,132 @@ +#!/bin/bash +# Hardload test runner + +set -e + +# Get the directory of this script and find the root +TEST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "$TEST_DIR/../../../.." && pwd)" + +# Binary should be in the test/.libs/ directory +BINARY="hardload.test" +BINARY_PATH="$ROOT_DIR/test/.libs/$BINARY" + +# Make sure we can find the binary +if [ ! -f "$BINARY_PATH" ]; then + echo "Error: Cannot find binary $BINARY_PATH" + echo "Make sure you've built the test with: make test/hardload.test" + exit 1 +fi + +# Source env-setup +if ! source "$ROOT_DIR/scripts/env-setup" >/dev/null 2>&1; then + echo "Error: env-setup failed" + exit 1 +fi + +WP_USING_REPLACE_DEFAULT="0" +if [ -f "$OPENSSL_LIB_PATH/libcrypto.so" ]; then + # Check for wolfProvider symbols in libcrypto + if nm -D "$OPENSSL_LIB_PATH/libcrypto.so" 2>/dev/null | grep -q "wolfprov_provider_init"; then + WP_USING_REPLACE_DEFAULT="1" + fi +fi + +# Configure environment based on build type +if [ "$WP_USING_REPLACE_DEFAULT" = "1" ]; then + echo "Detected: --replace-default build" + unset OPENSSL_CONF +fi + +echo "Using environment:" +echo "LD_LIBRARY_PATH: $LD_LIBRARY_PATH" +echo "OPENSSL_CONF: $OPENSSL_CONF" +echo "OPENSSL_BIN: $OPENSSL_BIN" + +# Check that wolfProvider is loaded in place of default +if [ "$WP_USING_REPLACE_DEFAULT" = "1" ]; then + if ! ${OPENSSL_BIN} list -providers | grep -q "wolf"; then + echo "Error: wolfProvider is not loaded in place of default" + exit 1 + fi +fi + +# Function to run a test scenario +run_test() { + local test_name="$1" + local should_fail="$2" + local set_force_fail="$3" + local output_file + + echo "=== $test_name ===" + + if [ "$set_force_fail" = "true" ]; then + export WOLFPROV_FORCE_FAIL=1 + echo "Setting WOLFPROV_FORCE_FAIL=1" + else + unset WOLFPROV_FORCE_FAIL + echo "WOLFPROV_FORCE_FAIL not set" + fi + + if [ "$should_fail" = "true" ]; then + expected="FAIL" + else + expected="PASS" + fi + + # Create temporary file for test output + output_file=$(mktemp) + + if "$BINARY_PATH" >"$output_file" 2>&1; then + result="PASS" + else + result="FAIL" + fi + + echo "Expected: $expected, Got: $result" + + if [ "$result" = "$expected" ]; then + echo "PASS" + rm -f "$output_file" + return 0 + else + echo "FAILED" + echo "Test output:" + cat "$output_file" + rm -f "$output_file" + return 1 + fi +} + +echo "Running hardload test: $BINARY_PATH" +echo "" + +FAILURES=0 + +# Run normal scenario - should always pass +if ! run_test "Normal operation" false false; then + FAILURES=$((FAILURES + 1)) +fi +echo "" + +# Run force-fail scenario - success criteria depends on build type +if [ "$WP_USING_REPLACE_DEFAULT" = "1" ]; then + # Replace-default: force-fail should actually fail (can't escape wolfProvider) + if ! run_test "Force fail test (should fail)" true true; then + FAILURES=$((FAILURES + 1)) + fi +else + # Normal build: force-fail should pass (hardload bypasses wolfProvider) + if ! run_test "Force fail test (should pass)" false true; then + FAILURES=$((FAILURES + 1)) + fi +fi + +echo "" +if [ $FAILURES -gt 0 ]; then + echo "$FAILURES scenarios failed" + exit 1 +else + echo "All scenarios passed" + exit 0 +fi diff --git a/test/standalone/tests/hardload/test_hardload.c b/test/standalone/tests/hardload/test_hardload.c new file mode 100644 index 00000000..aba0cf1f --- /dev/null +++ b/test/standalone/tests/hardload/test_hardload.c @@ -0,0 +1,168 @@ +/* test_hardload.c + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfProvider. + * + * wolfProvider is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfProvider is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with wolfProvider. If not, see . + */ + +#include +#include +#include +#include + +#ifdef WOLFPROV_USER_SETTINGS +#include +#endif +#include +#include + +#include +#include +#include +#include +#include + +#include +#include + +#include "../../test_common.h" + +/* Test data and expected results */ +static const char test_data[] = "Hello, hardload test!"; + +int main(int argc, char *argv[]) +{ + OSSL_LIB_CTX *libctx = NULL; + OSSL_PROVIDER *default_prov = NULL; + EVP_MD_CTX *mdctx = NULL; + const EVP_MD *sha256 = NULL; + unsigned char digest[EVP_MAX_MD_SIZE]; + unsigned int digest_len = 0; + char digest_hex[EVP_MAX_MD_SIZE * 2 + 1]; + int ret = TEST_FAILURE; + + (void)argc; + (void)argv; + + /* Initialize OpenSSL */ + OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL); + + /* Create library context */ + libctx = OSSL_LIB_CTX_new(); + if (libctx == NULL) { + TEST_ERROR("Failed to create OpenSSL library context"); + goto cleanup; + } + + /* Hard load the default provider - ignore environment variables */ + TEST_DEBUG("Hard loading default provider (ignoring environment)"); + default_prov = OSSL_PROVIDER_load(libctx, "default"); + if (default_prov == NULL) { + TEST_ERROR("Failed to hard load default provider"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Verify the default provider is loaded */ + if (!OSSL_PROVIDER_available(libctx, "default")) { + TEST_ERROR("Default provider is not available after loading"); + goto cleanup; + } + + TEST_INFO("Default provider hard loaded successfully"); + + /* Get SHA256 algorithm from the explicitly loaded default provider */ + sha256 = EVP_MD_fetch(libctx, "SHA256", NULL); + if (sha256 == NULL) { + TEST_ERROR("Failed to fetch SHA256 algorithm from default provider"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Create message digest context */ + mdctx = EVP_MD_CTX_new(); + if (mdctx == NULL) { + TEST_ERROR("Failed to create MD context"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Initialize digest operation */ + if (EVP_DigestInit_ex(mdctx, sha256, NULL) != 1) { + TEST_ERROR("Failed to initialize digest"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + TEST_DEBUG("Computing SHA256 of: \"%s\" (%zu bytes)", test_data, strlen(test_data)); + + /* Update digest with test data */ + if (EVP_DigestUpdate(mdctx, test_data, strlen(test_data)) != 1) { + TEST_ERROR("Failed to update digest"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Finalize digest */ + if (EVP_DigestFinal_ex(mdctx, digest, &digest_len) != 1) { + TEST_ERROR("Failed to finalize digest"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Convert to hex string for logging */ + if (test_bytes_to_hex(digest, digest_len, digest_hex, sizeof(digest_hex)) != TEST_SUCCESS) { + TEST_ERROR("Failed to convert digest to hex"); + goto cleanup; + } + + TEST_INFO("Computed SHA256: %s", digest_hex); + + /* Verify we got a 32-byte SHA256 result */ + if (digest_len != 32) { + TEST_ERROR("Invalid SHA256 digest length: %u (expected 32)", digest_len); + goto cleanup; + } + + TEST_PRINT_BUFFER("SHA256 digest", digest, digest_len); + + TEST_INFO("SHA256 computation successful using hard loaded default provider - got %u byte digest", digest_len); + + /* Test passed */ + ret = TEST_SUCCESS; + +cleanup: + if (mdctx != NULL) { + EVP_MD_CTX_free(mdctx); + } + if (sha256 != NULL) { + EVP_MD_free((EVP_MD*)sha256); + } + if (default_prov != NULL) { + OSSL_PROVIDER_unload(default_prov); + } + if (libctx != NULL) { + OSSL_LIB_CTX_free(libctx); + } + + if (ret == TEST_SUCCESS) { + TEST_INFO("Test PASSED"); + } else { + TEST_ERROR("Test FAILED"); + } + + return ret; +} diff --git a/test/standalone/tests/sha256_simple/run.sh b/test/standalone/tests/sha256_simple/run.sh new file mode 100755 index 00000000..058f3ede --- /dev/null +++ b/test/standalone/tests/sha256_simple/run.sh @@ -0,0 +1,159 @@ +#!/bin/bash +# SHA256 simple test runner + +set -e + +# Get the directory of this script and find the root +TEST_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "$TEST_DIR/../../../.." && pwd)" + +# Binary should be in the test/.libs/ directory +BINARY="sha256_simple.test" +BINARY_PATH="$ROOT_DIR/test/.libs/$BINARY" + +# Make sure we can find the binary +if [ ! -f "$BINARY_PATH" ]; then + echo "Error: Cannot find binary $BINARY_PATH" + echo "Make sure you've built the test with: make test/sha256_simple.test" + exit 1 +fi + +# Source env-setup +if ! source "$ROOT_DIR/scripts/env-setup" >/dev/null 2>&1; then + echo "Error: env-setup failed" + exit 1 +fi + +WP_USING_REPLACE_DEFAULT="0" +if [ -f "$OPENSSL_LIB_PATH/libcrypto.so" ]; then + # Check for wolfProvider symbols in libcrypto + if nm -D "$OPENSSL_LIB_PATH/libcrypto.so" 2>/dev/null | grep -q "wolfprov_provider_init"; then + WP_USING_REPLACE_DEFAULT="1" + fi +fi + +# Configure environment based on build type +if [ "$WP_USING_REPLACE_DEFAULT" = "1" ]; then + echo "Detected: --replace-default build" + unset OPENSSL_CONF +fi + +echo "Using environment:" +echo "LD_LIBRARY_PATH: $LD_LIBRARY_PATH" +echo "OPENSSL_CONF: $OPENSSL_CONF" +echo "OPENSSL_BIN: $OPENSSL_BIN" + +# Check that wolfProvider is loaded in place of default +if [ "$WP_USING_REPLACE_DEFAULT" = "1" ]; then + if ! ${OPENSSL_BIN} list -providers | grep -q "wolf"; then + echo "Error: wolfProvider is not loaded in place of default" + exit 1 + fi +fi + +# Function to run a test scenario +run_test() { + local test_name="$1" + local should_fail="$2" + local custom_conf="$3" + local output_file + + echo "=== $test_name ===" + + if [ "$should_fail" = "true" ]; then + export WOLFPROV_FORCE_FAIL=1 + expected="FAIL" + else + unset WOLFPROV_FORCE_FAIL + expected="PASS" + fi + + # Set custom config if provided + local original_openssl_conf="$OPENSSL_CONF" + if [ -n "$custom_conf" ]; then + export OPENSSL_CONF="$custom_conf" + echo "Using custom config: $OPENSSL_CONF" + fi + + # Create temporary file for test output + output_file=$(mktemp) + + if "$BINARY_PATH" >"$output_file" 2>&1; then + result="PASS" + else + result="FAIL" + fi + + # Restore original config + if [ -n "$custom_conf" ]; then + if [ -n "$original_openssl_conf" ]; then + export OPENSSL_CONF="$original_openssl_conf" + else + unset OPENSSL_CONF + fi + fi + + echo "Expected: $expected, Got: $result" + + if [ "$result" = "$expected" ]; then + echo "PASS" + rm -f "$output_file" + return 0 + else + echo "FAILED" + echo "Test output:" + cat "$output_file" + rm -f "$output_file" + return 1 + fi +} + +echo "Running SHA256 test: $BINARY_PATH" +echo "" + +FAILURES=0 + +if [ "$WP_USING_REPLACE_DEFAULT" = "1" ]; then + echo "Replace-default build detected - running 4 test scenarios" + + if ! run_test "No config, normal operation" false; then + FAILURES=$((FAILURES + 1)) + fi + echo "" + + if ! run_test "No config, force fail" true; then + FAILURES=$((FAILURES + 1)) + fi + echo "" + + if ! run_test "Explicit default config, normal operation" false "$ROOT_DIR/test/standalone/provider-default.conf"; then + FAILURES=$((FAILURES + 1)) + fi + echo "" + + if ! run_test "Explicit default config, force fail" true "$ROOT_DIR/test/standalone/provider-default.conf"; then + FAILURES=$((FAILURES + 1)) + fi + echo "" +else + echo "Standard build - running 2 test scenarios" + + if ! run_test "Normal operation" false; then + FAILURES=$((FAILURES + 1)) + fi + echo "" + + if ! run_test "Force fail test" true; then + FAILURES=$((FAILURES + 1)) + fi + echo "" +fi + +echo "" +if [ $FAILURES -gt 0 ]; then + echo "$FAILURES scenarios failed" + exit 1 +else + echo "All scenarios passed" + exit 0 +fi diff --git a/test/standalone/tests/sha256_simple/test_sha256_simple.c b/test/standalone/tests/sha256_simple/test_sha256_simple.c new file mode 100644 index 00000000..1168b807 --- /dev/null +++ b/test/standalone/tests/sha256_simple/test_sha256_simple.c @@ -0,0 +1,143 @@ +/* test_sha256_simple.c + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfProvider. + * + * wolfProvider is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfProvider is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with wolfProvider. If not, see . + */ + +#include +#include +#include +#include + +#ifdef WOLFPROV_USER_SETTINGS +#include +#endif +#include +#include + +#include +#include +#include +#include +#include + +#include +#include + +#include "../../test_common.h" + +/* Test data and expected results */ +static const char test_data[] = "Hello, wolfProvider!"; +static const char expected_sha256_hex[] = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"; + +int main(int argc, char *argv[]) +{ + EVP_MD_CTX *mdctx = NULL; + const EVP_MD *sha256 = NULL; + unsigned char digest[EVP_MAX_MD_SIZE]; + unsigned int digest_len = 0; + char digest_hex[EVP_MAX_MD_SIZE * 2 + 1]; + int ret = TEST_FAILURE; + + (void)argc; + (void)argv; + + TEST_INFO("Starting SHA256 simple test"); + + /* Get SHA256 algorithm */ + sha256 = EVP_MD_fetch(NULL, "SHA256", NULL); + if (sha256 == NULL) { + TEST_ERROR("Failed to fetch SHA256 algorithm"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Create message digest context */ + mdctx = EVP_MD_CTX_new(); + if (mdctx == NULL) { + TEST_ERROR("Failed to create MD context"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Initialize digest operation */ + if (EVP_DigestInit_ex(mdctx, sha256, NULL) != 1) { + TEST_ERROR("Failed to initialize digest"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + TEST_DEBUG("Computing SHA256 of: \"%s\" (%zu bytes)", test_data, strlen(test_data)); + + /* Update digest with test data */ + if (EVP_DigestUpdate(mdctx, test_data, strlen(test_data)) != 1) { + TEST_ERROR("Failed to update digest"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Finalize digest */ + if (EVP_DigestFinal_ex(mdctx, digest, &digest_len) != 1) { + TEST_ERROR("Failed to finalize digest"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + /* Convert to hex string for comparison */ + if (test_bytes_to_hex(digest, digest_len, digest_hex, sizeof(digest_hex)) != TEST_SUCCESS) { + TEST_ERROR("Failed to convert digest to hex"); + goto cleanup; + } + + TEST_INFO("Computed SHA256: %s", digest_hex); + TEST_DEBUG("Expected SHA256: %s", expected_sha256_hex); + + /* Verify the result */ + if (strlen(expected_sha256_hex) != digest_len * 2) { + TEST_ERROR("Digest length mismatch (expected %zu, got %u)", + strlen(expected_sha256_hex) / 2, digest_len); + goto cleanup; + } + + TEST_PRINT_BUFFER("SHA256 digest", digest, digest_len); + + /* For now, just verify we got a 32-byte SHA256 result */ + if (digest_len != 32) { + TEST_ERROR("Invalid SHA256 digest length: %u (expected 32)", digest_len); + goto cleanup; + } + + TEST_INFO("SHA256 computation successful - got %u byte digest", digest_len); + + ret = TEST_SUCCESS; + +cleanup: + if (mdctx != NULL) { + EVP_MD_CTX_free(mdctx); + } + if (sha256 != NULL) { + EVP_MD_free((EVP_MD*)sha256); + } + + if (ret == TEST_SUCCESS) { + TEST_INFO("Test PASSED"); + } else { + TEST_ERROR("Test FAILED"); + } + + return ret; +} From 819787b04212a7e8274b947282fbe536a7922073 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Mon, 18 Aug 2025 12:38:09 -0700 Subject: [PATCH 03/13] Add default stub cleanup handling --- scripts/utils-wolfprovider.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/scripts/utils-wolfprovider.sh b/scripts/utils-wolfprovider.sh index 757878a2..40661051 100755 --- a/scripts/utils-wolfprovider.sh +++ b/scripts/utils-wolfprovider.sh @@ -104,6 +104,13 @@ clean_wolfprov() { if [ -f "Makefile" ]; then make clean >>$LOG_FILE 2>&1 fi + # Clean default_stub build artifacts + if [ -f "default_stub/Makefile" ]; then + printf "Cleaning default stub ...\n" + make -C default_stub clean >>$LOG_FILE 2>&1 + fi + # Remove root libdefault.la file + rm -f libdefault.la rm -rf ${WOLFPROV_INSTALL_DIR} fi if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then From c29534b56008ee65c6e47548ccf373ce42740728 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 19 Aug 2025 10:03:50 -0700 Subject: [PATCH 04/13] Update with explicit provider name checks, add workflow for replace default --- .github/workflows/replace-default.yml | 66 +++++++++++++++++++ .gitignore | 24 +++++++ test/standalone/include.am | 7 +- test/standalone/tests/hardload/run.sh | 7 +- .../standalone/tests/hardload/test_hardload.c | 36 +++++++++- 5 files changed, 133 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/replace-default.yml diff --git a/.github/workflows/replace-default.yml b/.github/workflows/replace-default.yml new file mode 100644 index 00000000..4a9860e8 --- /dev/null +++ b/.github/workflows/replace-default.yml @@ -0,0 +1,66 @@ +name: Replace Default Tests + +# START OF COMMON SECTION +on: + push: + branches: [ 'master', 'main', 'release/**' ] + pull_request: + branches: [ '*' ] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true +# END OF COMMON SECTION + +jobs: + replace_default_test: + name: Replace Default Test + runs-on: ubuntu-22.04 + timeout-minutes: 30 + strategy: + matrix: + # Test both standard and replace-default builds + replace_default: ['', '--replace-default'] + # Test with stable versions + wolfssl_ref: ['v5.8.0-stable'] + openssl_ref: ['openssl-3.5.0'] + steps: + - name: Checkout wolfProvider + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Build wolfProvider ${{ matrix.replace_default && 'with replace-default' || 'standard' }} + run: | + OPENSSL_TAG=${{ matrix.openssl_ref }} \ + WOLFSSL_TAG=${{ matrix.wolfssl_ref }} \ + ./scripts/build-wolfprovider.sh ${{ matrix.replace_default }} + + - name: Run standalone test suite + run: | + ./test/standalone/runners/run_standalone_tests.sh + + - name: Print errors on failure + if: ${{ failure() }} + run: | + # Build failure log + if [ -f scripts/build-release.log ]; then + echo "=== Build log (last 50 lines) ===" + tail -n 50 scripts/build-release.log + fi + + # Test suite failure log + if [ -f test-suite.log ]; then + echo "=== Test suite log ===" + cat test-suite.log + fi + + # Standalone test failures + if [ -d test/standalone/runners/test_results ]; then + for log in test/standalone/runners/test_results/*.log; do + if [ -f "$log" ]; then + echo "=== $log ===" + cat "$log" + fi + done + fi diff --git a/.gitignore b/.gitignore index 6c79bf33..483d9a6c 100644 --- a/.gitignore +++ b/.gitignore @@ -61,6 +61,30 @@ /wolfprov-install/ /artifacts +# Default stub autotools files +default_stub/ar-lib +default_stub/compile +default_stub/config.guess +default_stub/config.sub +default_stub/depcomp +default_stub/install-sh +default_stub/ltmain.sh +default_stub/missing + +# Build install directories +*-install/ + +# Libtool archive files +*.la + +# Test artifacts in subdirectories +test/**/*.log +test/**/*.test +test/**/*.trs +test/**/*.o +test/**/.deps/ +test/**/.dirstamp + IDE/Android/android-ndk-r26b/ IDE/Android/openssl-source/ IDE/Android/openssl-install/ diff --git a/test/standalone/include.am b/test/standalone/include.am index 303da443..f61b2dba 100644 --- a/test/standalone/include.am +++ b/test/standalone/include.am @@ -9,7 +9,7 @@ noinst_HEADERS += test/standalone/test_common.h # Standalone test programs # Each test compiles to its own binary for isolated execution -check_PROGRAMS += test/sha256_simple.test test/hardload.test +# Note: These are NOT in check_PROGRAMS because they must be run through scripts, not directly noinst_PROGRAMS += test/sha256_simple.test test/hardload.test DISTCLEANFILES += test/.libs/sha256_simple.test test/.libs/hardload.test @@ -29,8 +29,7 @@ test_hardload_test_LDADD = $(STANDALONE_COMMON_LDADD) # Common test utilities are built automatically by automake -# Add standalone tests to the test suite -# We'll run these through our multi-environment runner manually -# TESTS += test/sha256_simple.test +# Standalone tests are available for manual execution but not part of make check +# Run manually with: ./test/standalone/runners/run_standalone_tests.sh # Note: test results are cleaned by the test runner automatically diff --git a/test/standalone/tests/hardload/run.sh b/test/standalone/tests/hardload/run.sh index fc0b9e5c..1bc0cbda 100755 --- a/test/standalone/tests/hardload/run.sh +++ b/test/standalone/tests/hardload/run.sh @@ -36,8 +36,13 @@ fi if [ "$WP_USING_REPLACE_DEFAULT" = "1" ]; then echo "Detected: --replace-default build" unset OPENSSL_CONF + EXPECTED_PROVIDER_NAME="wolfSSL Provider" +else + EXPECTED_PROVIDER_NAME="OpenSSL Default Provider" fi +echo "Expected provider name: $EXPECTED_PROVIDER_NAME" + echo "Using environment:" echo "LD_LIBRARY_PATH: $LD_LIBRARY_PATH" echo "OPENSSL_CONF: $OPENSSL_CONF" @@ -77,7 +82,7 @@ run_test() { # Create temporary file for test output output_file=$(mktemp) - if "$BINARY_PATH" >"$output_file" 2>&1; then + if "$BINARY_PATH" "$EXPECTED_PROVIDER_NAME" >"$output_file" 2>&1; then result="PASS" else result="FAIL" diff --git a/test/standalone/tests/hardload/test_hardload.c b/test/standalone/tests/hardload/test_hardload.c index aba0cf1f..db79f832 100644 --- a/test/standalone/tests/hardload/test_hardload.c +++ b/test/standalone/tests/hardload/test_hardload.c @@ -52,10 +52,20 @@ int main(int argc, char *argv[]) unsigned char digest[EVP_MAX_MD_SIZE]; unsigned int digest_len = 0; char digest_hex[EVP_MAX_MD_SIZE * 2 + 1]; + const char *expected_provider_name = "default"; int ret = TEST_FAILURE; + const char *wpProviderName = NULL; + OSSL_PARAM wpParams[] = { + { OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, &wpProviderName, 0, 0 }, + { NULL, 0, NULL, 0, 0 } + }; + + /* Parse command line arguments */ + if (argc > 1) { + expected_provider_name = argv[1]; + } - (void)argc; - (void)argv; + TEST_INFO("Expected provider name: %s", expected_provider_name); /* Initialize OpenSSL */ OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL); @@ -84,6 +94,28 @@ int main(int argc, char *argv[]) TEST_INFO("Default provider hard loaded successfully"); + /* Validate the provider name matches expected using OSSL_PROVIDER_get_params */ + if (OSSL_PROVIDER_get_params(default_prov, wpParams) != 1) { + TEST_ERROR("Failed to get provider parameters"); + ERR_print_errors_fp(stderr); + goto cleanup; + } + + if (wpProviderName == NULL) { + TEST_ERROR("Provider name parameter returned NULL"); + goto cleanup; + } + + TEST_INFO("Actual provider name: %s", wpProviderName); + + if (strcmp(wpProviderName, expected_provider_name) != 0) { + TEST_ERROR("Provider name mismatch - Expected: '%s', Got: '%s'", + expected_provider_name, wpProviderName); + goto cleanup; + } + + TEST_INFO("Provider name validation passed: %s", wpProviderName); + /* Get SHA256 algorithm from the explicitly loaded default provider */ sha256 = EVP_MD_fetch(libctx, "SHA256", NULL); if (sha256 == NULL) { From 34c80740185e865ac0eca6b41bd3117ba2ce147a Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 19 Aug 2025 10:17:56 -0700 Subject: [PATCH 05/13] Allow error output from env script --- test/standalone/tests/hardload/run.sh | 2 +- test/standalone/tests/sha256_simple/run.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/test/standalone/tests/hardload/run.sh b/test/standalone/tests/hardload/run.sh index 1bc0cbda..17326bea 100755 --- a/test/standalone/tests/hardload/run.sh +++ b/test/standalone/tests/hardload/run.sh @@ -19,7 +19,7 @@ if [ ! -f "$BINARY_PATH" ]; then fi # Source env-setup -if ! source "$ROOT_DIR/scripts/env-setup" >/dev/null 2>&1; then +if ! source "$ROOT_DIR/scripts/env-setup" >/dev/null; then echo "Error: env-setup failed" exit 1 fi diff --git a/test/standalone/tests/sha256_simple/run.sh b/test/standalone/tests/sha256_simple/run.sh index 058f3ede..3062b99d 100755 --- a/test/standalone/tests/sha256_simple/run.sh +++ b/test/standalone/tests/sha256_simple/run.sh @@ -19,7 +19,7 @@ if [ ! -f "$BINARY_PATH" ]; then fi # Source env-setup -if ! source "$ROOT_DIR/scripts/env-setup" >/dev/null 2>&1; then +if ! source "$ROOT_DIR/scripts/env-setup" >/dev/null; then echo "Error: env-setup failed" exit 1 fi From db2cf27c6b53c999d432356d9b84a500a7d37968 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 19 Aug 2025 11:13:34 -0700 Subject: [PATCH 06/13] Fix libdefault installation --- Makefile.am | 5 +++-- scripts/env-setup | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/Makefile.am b/Makefile.am index 34266b8f..7fbc8644 100644 --- a/Makefile.am +++ b/Makefile.am @@ -23,11 +23,12 @@ libdefault_la_LIBADD = libwolfprov.la # Install libdefault.so to OpenSSL lib directory for replace-default builds install-exec-hook: @echo "Installing libdefault.so to OpenSSL lib directory..." - $(INSTALL) -m 755 "$(DESTDIR)$(libdir)/libdefault.so" "$(OPENSSL_LIB_DIR)/libdefault.so" + $(INSTALL) -m 755 "$(DESTDIR)$(libdir)/libdefault.so.0.0.0" "$(OPENSSL_LIB_DIR)/libdefault.so.0" + cd "$(OPENSSL_LIB_DIR)" && ln -sf libdefault.so.0 libdefault.so uninstall-hook: @echo "Removing libdefault.so from OpenSSL lib directory..." - rm -f "$(OPENSSL_LIB_DIR)/libdefault.so" + rm -f "$(OPENSSL_LIB_DIR)/libdefault.so" "$(OPENSSL_LIB_DIR)/libdefault.so.0" endif EXTRA_DIST+=ChangeLog.md diff --git a/scripts/env-setup b/scripts/env-setup index cc10369a..66e0f35d 100755 --- a/scripts/env-setup +++ b/scripts/env-setup @@ -44,8 +44,9 @@ fi WOLFSSL_LIB_PATH="$REPO_ROOT/wolfssl-install/lib" WOLFPROV_LIB_PATH="$REPO_ROOT/wolfprov-install/lib" -# Set variables with default values if not already set -export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:=$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH}" +# Always reconstruct LD_LIBRARY_PATH with correctly detected OPENSSL_LIB_PATH +# (avoids conditional assignment that would skip update if LD_LIBRARY_PATH already set) +export LD_LIBRARY_PATH="$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" # Auto-detect FIPS mode and use appropriate config if [ "${WOLFSSL_ISFIPS:-0}" = "1" ]; then From 2ae0832cdc1caf836608cc3c7ec610546b8d6492 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Tue, 19 Aug 2025 13:31:07 -0700 Subject: [PATCH 07/13] Clarify script comments --- scripts/env-setup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/env-setup b/scripts/env-setup index 66e0f35d..46ca81ba 100755 --- a/scripts/env-setup +++ b/scripts/env-setup @@ -45,7 +45,7 @@ WOLFSSL_LIB_PATH="$REPO_ROOT/wolfssl-install/lib" WOLFPROV_LIB_PATH="$REPO_ROOT/wolfprov-install/lib" # Always reconstruct LD_LIBRARY_PATH with correctly detected OPENSSL_LIB_PATH -# (avoids conditional assignment that would skip update if LD_LIBRARY_PATH already set) +# ${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} expands to :$LD_LIBRARY_PATH only if LD_LIBRARY_PATH was already set export LD_LIBRARY_PATH="$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" # Auto-detect FIPS mode and use appropriate config From f9befa32b9a65e478c18147f95763075a0abb010 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 20 Aug 2025 09:47:43 -0700 Subject: [PATCH 08/13] Only install libdefault into openssl install location --- Makefile.am | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/Makefile.am b/Makefile.am index 7fbc8644..6d3e43af 100644 --- a/Makefile.am +++ b/Makefile.am @@ -16,19 +16,11 @@ lib_LTLIBRARIES = libwolfprov.la # Conditionally build libdefault.so when --replace-default is enabled if BUILD_REPLACE_DEFAULT -lib_LTLIBRARIES += libdefault.la +# Install libdefault.la directly to OpenSSL lib directory +openssldir = $(OPENSSL_LIB_DIR) +openssl_LTLIBRARIES = libdefault.la libdefault_la_SOURCES = src/wp_default_replace.c libdefault_la_LIBADD = libwolfprov.la - -# Install libdefault.so to OpenSSL lib directory for replace-default builds -install-exec-hook: - @echo "Installing libdefault.so to OpenSSL lib directory..." - $(INSTALL) -m 755 "$(DESTDIR)$(libdir)/libdefault.so.0.0.0" "$(OPENSSL_LIB_DIR)/libdefault.so.0" - cd "$(OPENSSL_LIB_DIR)" && ln -sf libdefault.so.0 libdefault.so - -uninstall-hook: - @echo "Removing libdefault.so from OpenSSL lib directory..." - rm -f "$(OPENSSL_LIB_DIR)/libdefault.so" "$(OPENSSL_LIB_DIR)/libdefault.so.0" endif EXTRA_DIST+=ChangeLog.md From 59b84e92fb938786c7983d4048348279d5063177 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 20 Aug 2025 13:03:58 -0700 Subject: [PATCH 09/13] Add logic to check for replace default mismatch and error --- scripts/utils-openssl.sh | 34 +++++++++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index 851e718d..65e30bc5 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -95,6 +95,37 @@ clone_openssl() { fi } +check_openssl_replace_default_mismatch() { + # Only check if OpenSSL is already installed + if [ -d "${OPENSSL_INSTALL_DIR}" ]; then + local openssl_is_patched=0 + + # Check if the source was patched for --replace-default + if [ -f "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" ]; then + if grep -q "wolfprov_provider_init" "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" 2>/dev/null; then + openssl_is_patched=1 + fi + fi + + # Check for mismatch + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$openssl_is_patched" = "0" ]; then + printf "ERROR: --replace-default build mode mismatch!\n" + printf "Existing OpenSSL was built WITHOUT --replace-default patch\n" + printf "Current request: --replace-default build\n\n" + printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n" + printf "Then rebuild with desired configuration.\n" + exit 1 + elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$openssl_is_patched" = "1" ]; then + printf "ERROR: Standard build mode mismatch!\n" + printf "Existing OpenSSL was built WITH --replace-default patch\n" + printf "Current request: standard build\n\n" + printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n" + printf "Then rebuild with desired configuration.\n" + exit 1 + fi + fi +} + patch_openssl() { if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then printf "\tApplying OpenSSL default provider patch ... " @@ -102,7 +133,7 @@ patch_openssl() { # Check if patch is already applied if grep -q "wolfprov_provider_init" crypto/provider_predefined.c 2>/dev/null; then - printf "Already applied.\n" + printf "Already applied.\n" return 0 fi @@ -124,6 +155,7 @@ patch_openssl() { install_openssl() { printf "\nInstalling OpenSSL ${OPENSSL_TAG} ...\n" clone_openssl + check_openssl_replace_default_mismatch patch_openssl cd ${OPENSSL_SOURCE_DIR} From bb0bc1052eb8d269c88b58d9a01c014c0b308ea8 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 20 Aug 2025 13:10:48 -0700 Subject: [PATCH 10/13] Rename patch and add a readme --- patches/README.md | 4 ++++ ...place-default-3.5.patch => openssl3-replace-default.patch} | 0 2 files changed, 4 insertions(+) create mode 100644 patches/README.md rename patches/{ossl-replace-default-3.5.patch => openssl3-replace-default.patch} (100%) diff --git a/patches/README.md b/patches/README.md new file mode 100644 index 00000000..abc4faee --- /dev/null +++ b/patches/README.md @@ -0,0 +1,4 @@ +This patch replaces the openssl default provider with wolfProvider. This means +wolfProvider will be registered under the name "default" and any attempts +to fetch the default provider will yield wolfProvider instead. This patch +works for all versions of openssl > 3.0 diff --git a/patches/ossl-replace-default-3.5.patch b/patches/openssl3-replace-default.patch similarity index 100% rename from patches/ossl-replace-default-3.5.patch rename to patches/openssl3-replace-default.patch From 639088dd603cb1d991adcb384728bed6cf7c2656 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 20 Aug 2025 13:12:25 -0700 Subject: [PATCH 11/13] Accurate version info in readme --- patches/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/patches/README.md b/patches/README.md index abc4faee..2e5dd081 100644 --- a/patches/README.md +++ b/patches/README.md @@ -1,4 +1,4 @@ This patch replaces the openssl default provider with wolfProvider. This means wolfProvider will be registered under the name "default" and any attempts to fetch the default provider will yield wolfProvider instead. This patch -works for all versions of openssl > 3.0 +works for all versions of openssl >= 3.0 From 9c506640450864c39692104d7df556dd2c84bee6 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 20 Aug 2025 13:19:53 -0700 Subject: [PATCH 12/13] Update patch name in script --- scripts/utils-openssl.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index 65e30bc5..18ec096d 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -138,7 +138,7 @@ patch_openssl() { fi # Apply the patch - patch -p1 < ${SCRIPT_DIR}/../patches/ossl-replace-default-3.5.patch >>$LOG_FILE 2>&1 + patch -p1 < ${SCRIPT_DIR}/../patches/openssl3-replace-default.patch >>$LOG_FILE 2>&1 if [ $? != 0 ]; then printf "ERROR.\n" printf "\n\nPatch application failed. Last 40 lines of log:\n" From 664aadb549d28c557fa4942e06093ff15c463724 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Wed, 20 Aug 2025 14:29:23 -0700 Subject: [PATCH 13/13] Check for patch mismatch even if openssl is not installed, update readme --- patches/README.md | 20 +++++++++++--- scripts/utils-openssl.sh | 59 ++++++++++++++++++++++------------------ 2 files changed, 49 insertions(+), 30 deletions(-) diff --git a/patches/README.md b/patches/README.md index 2e5dd081..abfcd2cb 100644 --- a/patches/README.md +++ b/patches/README.md @@ -1,4 +1,16 @@ -This patch replaces the openssl default provider with wolfProvider. This means -wolfProvider will be registered under the name "default" and any attempts -to fetch the default provider will yield wolfProvider instead. This patch -works for all versions of openssl >= 3.0 +# OpenSSL Default Provider Replacement Patch + +> **Note**: For comprehensive Open Source Project (OSP) patches and integration work, visit the main wolfSSL OSP repository: **https://github.com/wolfSSL/osp/tree/master/wolfProvider** + +This directory contains the patch for replacing OpenSSL's default provider with wolfProvider. + +## Purpose + +The patch modifies OpenSSL's provider registration to substitute wolfProvider as the "default" provider, ensuring that all default provider operations are handled by wolfProvider instead of OpenSSL's built-in implementation. + +## Compatibility + +- **Supported Versions**: OpenSSL 3.0 and later +- **Patch Target**: `crypto/provider_predefined.c` + +This directory contains only the OpenSSL default provider replacement functionality. \ No newline at end of file diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index 18ec096d..ca320667 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -96,38 +96,45 @@ clone_openssl() { } check_openssl_replace_default_mismatch() { - # Only check if OpenSSL is already installed - if [ -d "${OPENSSL_INSTALL_DIR}" ]; then - local openssl_is_patched=0 - - # Check if the source was patched for --replace-default - if [ -f "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" ]; then - if grep -q "wolfprov_provider_init" "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" 2>/dev/null; then - openssl_is_patched=1 - fi - fi + local openssl_is_patched=0 - # Check for mismatch - if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$openssl_is_patched" = "0" ]; then - printf "ERROR: --replace-default build mode mismatch!\n" - printf "Existing OpenSSL was built WITHOUT --replace-default patch\n" - printf "Current request: --replace-default build\n\n" - printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n" - printf "Then rebuild with desired configuration.\n" - exit 1 - elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$openssl_is_patched" = "1" ]; then - printf "ERROR: Standard build mode mismatch!\n" - printf "Existing OpenSSL was built WITH --replace-default patch\n" - printf "Current request: standard build\n\n" - printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n" - printf "Then rebuild with desired configuration.\n" - exit 1 + # Check if the source was patched for --replace-default + if [ -f "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" ]; then + if grep -q "wolfprov_provider_init" "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" 2>/dev/null; then + openssl_is_patched=1 + printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n" fi fi + + # Check for mismatch + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ] && [ "$openssl_is_patched" = "0" ]; then + printf "ERROR: --replace-default build mode mismatch!\n" + printf "Existing OpenSSL was built WITHOUT --replace-default patch\n" + printf "Current request: --replace-default build\n\n" + printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n" + printf "Then rebuild with desired configuration.\n" + exit 1 + elif [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ] && [ "$openssl_is_patched" = "1" ]; then + printf "ERROR: Standard build mode mismatch!\n" + printf "Existing OpenSSL was built WITH --replace-default patch\n" + printf "Current request: standard build\n\n" + printf "Fix: ./scripts/build-wolfprovider.sh --distclean\n" + printf "Then rebuild with desired configuration.\n" + exit 1 + fi } patch_openssl() { if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + + if [ -d "${OPENSSL_INSTALL_DIR}" ]; then + # If openssl is already installed, patching makes no sense as + # it will not be rebuilt. It may already be built as patched, + # just return and let check_openssl_replace_default_mismatch + # check for the mismatch. + return 0 + fi + printf "\tApplying OpenSSL default provider patch ... " cd ${OPENSSL_SOURCE_DIR} @@ -155,8 +162,8 @@ patch_openssl() { install_openssl() { printf "\nInstalling OpenSSL ${OPENSSL_TAG} ...\n" clone_openssl - check_openssl_replace_default_mismatch patch_openssl + check_openssl_replace_default_mismatch cd ${OPENSSL_SOURCE_DIR} if [ ! -d ${OPENSSL_INSTALL_DIR} ]; then