Compare commits
1 Commits
wolfEntrop
...
revert-554
| Author | SHA1 | Date | |
|---|---|---|---|
|
abe6846841 |
40
.cyignore
40
.cyignore
@@ -1,40 +0,0 @@
|
||||
# wolfSSL folders
|
||||
$(SEARCH_wolfssl)/IDE
|
||||
$(SEARCH_wolfssl)/examples
|
||||
$(SEARCH_wolfssl)/linuxkm
|
||||
$(SEARCH_wolfssl)/mcapi
|
||||
$(SEARCH_wolfssl)/mplabx
|
||||
$(SEARCH_wolfssl)/mqx
|
||||
$(SEARCH_wolfssl)/tirtos
|
||||
$(SEARCH_wolfssl)/tests
|
||||
$(SEARCH_wolfssl)/testsuite
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/autosar
|
||||
$(SEARCH_wolfssl)/zephyr
|
||||
|
||||
# wolfSSL files
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/aes_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/aes_xts_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/aes_gcm_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/aes_gcm_x86_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/chacha_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/fe_x25519_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/poly1305_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/sha256_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/sha512_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/sha3_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/sm3_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/sp_x86_64_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/sp_sm2_x86_64_asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/wc_kyber_asm.S
|
||||
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/armv8-32-aes-asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/armv8-32-curve25519.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/armv8-curve25519.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/armv8-sha3-asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/armv8-sha512-asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/thumb2-aes-asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/thumb2-curve25519.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/thumb2-sha256-asm.S
|
||||
$(SEARCH_wolfssl)/wolfcrypt/src/port/arm/thumb2-sha512-asm.S
|
||||
@@ -1,10 +0,0 @@
|
||||
# http://editorconfig.org
|
||||
root = true
|
||||
|
||||
[*]
|
||||
indent_style = space
|
||||
indent_size = 4
|
||||
end_of_line = lf
|
||||
charset = utf-8
|
||||
trim_trailing_whitespace = true
|
||||
insert_final_newline = true
|
||||
2
.github/SECURITY.md
vendored
2
.github/SECURITY.md
vendored
@@ -6,7 +6,7 @@ If you discover a vulnerability, please report it to support@wolfssl.com
|
||||
|
||||
1. Include a detailed description
|
||||
2. Include method to reproduce and/or method of discovery
|
||||
3. We will evaluate the report promptly and respond to you with findings.
|
||||
3. We will evaulate the report promptly and respond to you with findings.
|
||||
4. We will credit you with the report if you would like.
|
||||
|
||||
**Please keep the vulnerability private** until a fix has been released.
|
||||
|
||||
44
.github/workflows/async.yml
vendored
44
.github/workflows/async.yml
vendored
@@ -1,44 +0,0 @@
|
||||
name: Async Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
make_check:
|
||||
strategy:
|
||||
matrix:
|
||||
config: [
|
||||
# Add new configs here
|
||||
'--enable-asynccrypt --enable-all --enable-dtls13',
|
||||
'--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2',
|
||||
'--enable-ocsp CFLAGS="-DTEST_NONBLOCK_CERTS"',
|
||||
]
|
||||
name: make check
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 6
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
name: Checkout wolfSSL
|
||||
|
||||
- name: Test wolfSSL async
|
||||
run: |
|
||||
./async-check.sh install
|
||||
./configure ${{ matrix.config }}
|
||||
make check
|
||||
|
||||
- name: Print errors
|
||||
if: ${{ failure() }}
|
||||
run: |
|
||||
if [ -f test-suite.log ] ; then
|
||||
cat test-suite.log
|
||||
fi
|
||||
70
.github/workflows/curl.yml
vendored
70
.github/workflows/curl.yml
vendored
@@ -1,70 +0,0 @@
|
||||
name: curl Test
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-curl
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-curl
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
test_curl:
|
||||
name: ${{ matrix.curl_ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 15
|
||||
needs: build_wolfssl
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
curl_ref: [ 'master', 'curl-8_4_0' ]
|
||||
steps:
|
||||
- name: Install test dependencies
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install nghttp2 libpsl5 libpsl-dev
|
||||
sudo pip install impacket
|
||||
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-curl
|
||||
path: build-dir
|
||||
|
||||
- name: Build curl
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
repository: curl/curl
|
||||
path: curl
|
||||
ref: ${{ matrix.curl_ref }}
|
||||
configure: --with-wolfssl=$GITHUB_WORKSPACE/build-dir
|
||||
check: false
|
||||
|
||||
- name: Test curl
|
||||
working-directory: curl
|
||||
run: make -j test-ci
|
||||
60
.github/workflows/disabled/haproxy.yml
vendored
60
.github/workflows/disabled/haproxy.yml
vendored
@@ -1,60 +0,0 @@
|
||||
name: HaProxy Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
haproxy_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# List of refs to test
|
||||
ref: [ master ]
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-quic --enable-haproxy
|
||||
install: true
|
||||
|
||||
- name: Checkout VTest
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: vtest/VTest
|
||||
path: VTest
|
||||
|
||||
- name: Build VTest
|
||||
working-directory: VTest
|
||||
# Special flags due to: https://github.com/vtest/VTest/issues/12
|
||||
run: make FLAGS='-O2 -s -Wall'
|
||||
|
||||
- name: Checkout HaProxy
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: haproxy/haproxy
|
||||
path: haproxy
|
||||
ref: ${{ matrix.ref }}
|
||||
|
||||
- name: Build HaProxy
|
||||
working-directory: haproxy
|
||||
run: >-
|
||||
make -j TARGET=linux-glibc DEBUG='-DDEBUG_MEMORY_POOLS -DDEBUG_STRICT'
|
||||
USE_OPENSSL_WOLFSSL=1 USE_QUIC=1 SSL_INC=$GITHUB_WORKSPACE/build-dir/include/
|
||||
SSL_LIB=$GITHUB_WORKSPACE/build-dir/lib/ ADDLIB=-Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
|
||||
- name: Test HaProxy
|
||||
working-directory: haproxy
|
||||
run: make reg-tests reg-tests/ssl VTEST_PROGRAM=$GITHUB_WORKSPACE/VTest/vtest
|
||||
|
||||
292
.github/workflows/disabled/hostap.yml
vendored
292
.github/workflows/disabled/hostap.yml
vendored
@@ -1,292 +0,0 @@
|
||||
name: hostap and wpa-supplicant Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
strategy:
|
||||
matrix:
|
||||
include:
|
||||
- build_id: hostap-build1
|
||||
wolf_extra_config: --disable-tls13
|
||||
- build_id: hostap-build2
|
||||
wolf_extra_config: --enable-brainpool --enable-wpas-dpp
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-20.04
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
# No way to view the full strategy in the browser (really weird)
|
||||
- name: Print strategy
|
||||
run: |
|
||||
cat <<EOF
|
||||
${{ toJSON(matrix) }}
|
||||
EOF
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Enable wolfSSL debug logging
|
||||
run: |
|
||||
echo "wolf_debug_flags=--enable-debug" >> $GITHUB_ENV
|
||||
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: >-
|
||||
--enable-wpas CFLAGS=-DWOLFSSL_STATIC_RSA
|
||||
${{ env.wolf_debug_flags }} ${{ matrix.wolf_extra_config }}
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ${{ matrix.build_id }}
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
# Build wpa_supplicant with wolfSSL and hostapd with OpenSSL and interop.
|
||||
hostap_test:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# should hostapd be compiled with wolfssl
|
||||
hostapd: [true, false]
|
||||
# should wpa_supplicant be compiled with wolfssl
|
||||
wpa_supplicant: [true, false]
|
||||
# Fix the versions of hostap and osp to not break testing when a new
|
||||
# patch is added in to osp. hostap_cherry_pick is used to apply the
|
||||
# commit that updates the certificates used for testing. Tests are read
|
||||
# from the corresponding configs/hostap_ref/tests file.
|
||||
config: [
|
||||
{
|
||||
hostap_ref: hostap_2_10,
|
||||
hostap_cherry_pick: 36fcbb1a4ee4aa604f15079eae2ffa4fe7f44680,
|
||||
remove_teap: true,
|
||||
# TLS 1.3 does not work for this version
|
||||
build_id: hostap-build1,
|
||||
},
|
||||
# Test the dpp patch
|
||||
{
|
||||
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
|
||||
hostap_cherry_pick: 36fcbb1a4ee4aa604f15079eae2ffa4fe7f44680,
|
||||
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
|
||||
build_id: hostap-build2
|
||||
},
|
||||
]
|
||||
# parallelize the tests to be able to run all tests within 10 minutes
|
||||
# Update the <total server> in the ./run-tests.py step when changing.
|
||||
server: [1, 2, 3, 4, 5]
|
||||
exclude:
|
||||
# don't test openssl on both sides
|
||||
- hostapd: false
|
||||
wpa_supplicant: false
|
||||
# no hostapd support for dpp yet
|
||||
- hostapd: true
|
||||
config: {
|
||||
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
|
||||
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
|
||||
build_id: hostap-build2
|
||||
}
|
||||
name: hwsim test
|
||||
# For openssl 1.1
|
||||
runs-on: ubuntu-20.04
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 12
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
# No way to view the full strategy in the browser (really weird)
|
||||
- name: Print strategy
|
||||
run: |
|
||||
cat <<EOF
|
||||
${{ toJSON(matrix) }}
|
||||
EOF
|
||||
|
||||
- name: Print computed job run ID
|
||||
run: |
|
||||
SHA_SUM=$(sha256sum << 'END_OF_HEREDOC' | cut -d " " -f 1
|
||||
${{ toJSON(github) }}
|
||||
END_OF_HEREDOC
|
||||
)
|
||||
echo "our_job_run_id=$SHA_SUM" >> $GITHUB_ENV
|
||||
echo Our job run ID is $SHA_SUM
|
||||
|
||||
- name: Checkout wolfSSL
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
path: wolfssl
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
# Don't prompt for anything
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
sudo apt-get update
|
||||
# hostap dependencies
|
||||
sudo apt-get install -y libpcap0.8 libpcap-dev curl libcurl4-openssl-dev \
|
||||
libnl-3-dev binutils-dev libssl-dev libiberty-dev libnl-genl-3-dev \
|
||||
libnl-route-3-dev libdbus-1-dev linux-modules-extra-`uname -r` \
|
||||
bridge-utils
|
||||
sudo pip3 install pycryptodome
|
||||
|
||||
- name: Enable mac80211
|
||||
run: |
|
||||
sudo modprobe mac80211
|
||||
lsmod | grep mac80211
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Enable hostap debug logging
|
||||
run: |
|
||||
echo "hostap_debug_flags=-d" >> $GITHUB_ENV
|
||||
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: ${{ matrix.config.build_id }}
|
||||
path: build-dir
|
||||
|
||||
- name: Setup d-bus
|
||||
working-directory: wolfssl/.github/workflows/hostap-files
|
||||
run: |
|
||||
sudo cp dbus-wpa_supplicant.conf /usr/share/dbus-1/system.d/wpa_supplicant.conf
|
||||
sudo service dbus reload
|
||||
|
||||
# This is super hack-ish :P
|
||||
# If you are trying to reproduce this on a more generic system, you can
|
||||
# just run `sudo apt install linux-modules-extra-$(uname -r)` and
|
||||
# this should have the module in the package. No need to compile it.
|
||||
- name: Compile and install mac80211_hwsim
|
||||
working-directory: wolfssl/.github/workflows/hostap-files
|
||||
run: |
|
||||
# The tag will be the first two numbers of from uname -r
|
||||
LINUX_TAG=$(uname -r | grep -oP '^\d+\.\d+')
|
||||
# Download the correct version of the driver
|
||||
wget https://raw.githubusercontent.com/torvalds/linux/v$LINUX_TAG/drivers/net/wireless/mac80211_hwsim.c
|
||||
wget https://raw.githubusercontent.com/torvalds/linux/v$LINUX_TAG/drivers/net/wireless/mac80211_hwsim.h
|
||||
make
|
||||
sudo make install
|
||||
sudo modprobe mac80211_hwsim
|
||||
lsmod | grep mac80211_hwsim
|
||||
sudo rmmod mac80211_hwsim
|
||||
|
||||
- name: Checkout hostap
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: julek-wolfssl/hostap-mirror
|
||||
path: hostap
|
||||
ref: ${{ matrix.config.hostap_ref }}
|
||||
# necessary for cherry pick step
|
||||
fetch-depth: 0
|
||||
|
||||
- if: ${{ matrix.config.hostap_cherry_pick }}
|
||||
name: Cherry pick certificate update
|
||||
working-directory: hostap
|
||||
run: git cherry-pick -n -X theirs ${{ matrix.config.hostap_cherry_pick }}
|
||||
|
||||
- if: ${{ matrix.config.osp_ref }}
|
||||
name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
ref: ${{ matrix.config.osp_ref }}
|
||||
|
||||
- if: ${{ matrix.config.osp_ref }}
|
||||
name: Apply patch files
|
||||
working-directory: hostap
|
||||
run: |
|
||||
for f in $GITHUB_WORKSPACE/osp/hostap-patches/pending/*
|
||||
do
|
||||
patch -p1 < $f
|
||||
done
|
||||
|
||||
- if: ${{ matrix.hostapd }}
|
||||
name: Setup hostapd config file
|
||||
run: |
|
||||
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/hostapd.config \
|
||||
hostap/hostapd/.config
|
||||
cat <<EOF >> hostap/hostapd/.config
|
||||
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
EOF
|
||||
|
||||
- if: ${{ matrix.wpa_supplicant }}
|
||||
name: Setup wpa_supplicant config file
|
||||
run: |
|
||||
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/wpa_supplicant.config \
|
||||
hostap/wpa_supplicant/.config
|
||||
cat <<EOF >> hostap/wpa_supplicant/.config
|
||||
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
EOF
|
||||
|
||||
- name: Build hostap
|
||||
working-directory: hostap/tests/hwsim/
|
||||
run: ./build.sh
|
||||
|
||||
- if: ${{ matrix.hostapd }}
|
||||
name: Confirm hostapd linking with wolfSSL
|
||||
run: ldd hostap/hostapd/hostapd | grep wolfssl
|
||||
|
||||
- if: ${{ matrix.wpa_supplicant }}
|
||||
name: Confirm wpa_supplicant linking with wolfSSL
|
||||
run: ldd hostap/wpa_supplicant/wpa_supplicant | grep wolfssl
|
||||
|
||||
- if: ${{ matrix.config.remove_teap }}
|
||||
name: Remove EAP-TEAP from test configuration
|
||||
working-directory: hostap/tests/hwsim/auth_serv
|
||||
run: |
|
||||
sed -e 's/"erp-teap@example.com"\tTEAP//' -i eap_user.conf
|
||||
sed -e 's/"erp-teap@example.com"\tMSCHAPV2\t"password"\t\[2\]//' -i eap_user.conf
|
||||
sed -e 's/"TEAP"\t\tTEAP//' -i eap_user.conf
|
||||
sed -e 's/TEAP,//' -i eap_user.conf
|
||||
|
||||
- name: Run tests
|
||||
id: testing
|
||||
working-directory: hostap/tests/hwsim/
|
||||
run: |
|
||||
# Run tests in increments of 50 to cut down on the uploaded log size.
|
||||
while mapfile -t -n 50 ary && ((${#ary[@]})); do
|
||||
TESTS=$(printf '%s\n' "${ary[@]}" | tr '\n' ' ')
|
||||
# Retry up to three times
|
||||
for i in {1..3}; do
|
||||
HWSIM_RES=0 # Not set when command succeeds
|
||||
# Logs can grow quickly especially in debug mode
|
||||
sudo rm -rf logs
|
||||
sudo ./start.sh
|
||||
sudo ./run-tests.py ${{ env.hostap_debug_flags }} --split ${{ matrix.server }}/5 $TESTS || HWSIM_RES=$?
|
||||
sudo ./stop.sh
|
||||
if [ "$HWSIM_RES" -eq "0" ]; then
|
||||
break
|
||||
fi
|
||||
done
|
||||
echo "test ran $i times"
|
||||
if [ "$HWSIM_RES" -ne "0" ]; then
|
||||
exit $HWSIM_RES
|
||||
fi
|
||||
done < $GITHUB_WORKSPACE/wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/tests
|
||||
|
||||
- name: Change failure log permissions
|
||||
if: ${{ failure() && steps.testing.outcome == 'failure' }}
|
||||
working-directory: hostap/tests/hwsim/
|
||||
run: |
|
||||
sudo chown -R $USER:$USER logs
|
||||
zip -9 -r logs.zip logs/current
|
||||
|
||||
- name: Upload failure logs
|
||||
if: ${{ failure() && steps.testing.outcome == 'failure' }}
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: hostap-logs-${{ env.our_job_run_id }}
|
||||
path: hostap/tests/hwsim/logs.zip
|
||||
retention-days: 5
|
||||
|
||||
43
.github/workflows/docker-Espressif.yml
vendored
43
.github/workflows/docker-Espressif.yml
vendored
@@ -1,43 +0,0 @@
|
||||
name: Espressif examples tests
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
espressif_latest:
|
||||
name: latest Docker container
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 12
|
||||
container:
|
||||
image: espressif/idf:latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Initialize Espressif IDE and build examples
|
||||
run: . /opt/esp/idf/export.sh; IDE/Espressif/ESP-IDF/compileAllExamples.sh
|
||||
espressif_v4_4:
|
||||
name: v4.4 Docker container
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
image: espressif/idf:release-v4.4
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Initialize Espressif IDE and build examples
|
||||
run: . /opt/esp/idf/export.sh; IDE/Espressif/ESP-IDF/compileAllExamples.sh
|
||||
espressif_v5_0:
|
||||
name: v5.0 Docker container
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
image: espressif/idf:release-v5.0
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Initialize Espressif IDE and build examples
|
||||
run: . /opt/esp/idf/export.sh; IDE/Espressif/ESP-IDF/compileAllExamples.sh
|
||||
63
.github/workflows/docker-OpenWrt.yml
vendored
63
.github/workflows/docker-OpenWrt.yml
vendored
@@ -1,63 +0,0 @@
|
||||
# This workflow tests out new libraries with existing OpenWrt builds to check
|
||||
# there aren't any compatibility issues. Take a look at Docker/OpenWrt/README.md
|
||||
name: OpenWrt test
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_library:
|
||||
name: Compile libwolfssl.so
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
container:
|
||||
image: alpine:latest
|
||||
steps:
|
||||
- name: Install required tools
|
||||
run: apk add argp-standalone asciidoc bash bc binutils bzip2 cdrkit coreutils diffutils elfutils-dev findutils flex musl-fts-dev g++ gawk gcc gettext git grep intltool libxslt linux-headers make musl-libintl musl-obstack-dev ncurses-dev openssl-dev patch perl python3-dev rsync tar unzip util-linux wget zlib-dev autoconf automake libtool
|
||||
- uses: actions/checkout@v4
|
||||
- name: Compile libwolfssl.so
|
||||
run: ./autogen.sh && ./configure --enable-all && make
|
||||
- name: Upload libwolfssl.so
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: openwrt-libwolfssl.so
|
||||
path: src/.libs/libwolfssl.so
|
||||
retention-days: 5
|
||||
compile_container:
|
||||
name: Compile container
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 2
|
||||
needs: build_library
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
release: [ "22.03.6", "21.02.7" ] # some other versions: 21.02.0 21.02.5 22.03.0 22.03.3 snapshot
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
- uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: openwrt-libwolfssl.so
|
||||
path: Docker/OpenWrt/.
|
||||
- name: Build but dont push
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: Docker/OpenWrt
|
||||
platforms: linux/amd64
|
||||
push: false
|
||||
tags: openwrt-test:latest
|
||||
build-args: DOCKER_BASE_CONTAINER=openwrt/rootfs:x86-64-${{ matrix.release }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
101
.github/workflows/grpc.yml
vendored
101
.github/workflows/grpc.yml
vendored
@@ -1,101 +0,0 @@
|
||||
name: grpc Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-all 'CPPFLAGS=-DWOLFSSL_RSA_KEY_CHECK -DHAVE_EX_DATA_CLEANUP_HOOKS'
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-grpc
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
grpc_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- ref: v1.60.0
|
||||
tests: >-
|
||||
bad_ssl_alpn_test bad_ssl_cert_test client_ssl_test
|
||||
crl_ssl_transport_security_test server_ssl_test
|
||||
ssl_transport_security_test ssl_transport_security_utils_test
|
||||
test_core_security_ssl_credentials_test test_cpp_end2end_ssl_credentials_test
|
||||
h2_ssl_cert_test h2_ssl_session_reuse_test
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 30
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Confirm IPv4 and IPv6 support
|
||||
run: |
|
||||
ip addr list lo | grep 'inet '
|
||||
ip addr list lo | grep 'inet6 '
|
||||
|
||||
- name: Install prereqs
|
||||
run:
|
||||
sudo apt-get install build-essential autoconf libtool pkg-config cmake clang libc++-dev
|
||||
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-grpc
|
||||
path: build-dir
|
||||
|
||||
- name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
|
||||
- name: Checkout grpc
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: grpc/grpc
|
||||
path: grpc
|
||||
ref: ${{ matrix.ref }}
|
||||
|
||||
- name: Build grpc
|
||||
working-directory: ./grpc
|
||||
run: |
|
||||
patch -p1 < ../osp/grpc/grpc-${{ matrix.ref }}.patch
|
||||
git submodule update --init
|
||||
mkdir cmake/build
|
||||
cd cmake/build
|
||||
cmake -DgRPC_BUILD_TESTS=ON -DgRPC_SSL_PROVIDER=wolfssl \
|
||||
-DWOLFSSL_INSTALL_DIR=$GITHUB_WORKSPACE/build-dir ../..
|
||||
make -j $(nproc) ${{ matrix.tests }}
|
||||
|
||||
- name: Run grpc tests
|
||||
working-directory: ./grpc
|
||||
run: |
|
||||
export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH
|
||||
./tools/run_tests/start_port_server.py
|
||||
for t in ${{ matrix.tests }} ; do
|
||||
./cmake/build/$t
|
||||
done
|
||||
103
.github/workflows/hitch.yml
vendored
103
.github/workflows/hitch.yml
vendored
@@ -1,103 +0,0 @@
|
||||
name: hitch Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-hitch
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-hitch
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
hitch_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# List of releases to test
|
||||
include:
|
||||
- ref: 1.7.3
|
||||
ignore-tests: >-
|
||||
test13-r82.sh test15-proxy-v2-npn.sh test39-client-cert-proxy.sh
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-hitch
|
||||
path: build-dir
|
||||
|
||||
- name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y libev-dev libssl-dev automake python3-docutils flex bison pkg-config make
|
||||
|
||||
- name: Checkout hitch
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: varnish/hitch
|
||||
ref: 1.7.3
|
||||
path: hitch
|
||||
|
||||
# Do this before configuring so that it only detects the updated list of
|
||||
# tests
|
||||
- if: ${{ matrix.ignore-tests }}
|
||||
name: Remove tests that we want to ignore
|
||||
working-directory: ./hitch/src/tests
|
||||
run: |
|
||||
rm ${{ matrix.ignore-tests }}
|
||||
|
||||
- name: Configure and build hitch
|
||||
run: |
|
||||
cd $GITHUB_WORKSPACE/hitch/
|
||||
patch -p1 < $GITHUB_WORKSPACE/osp/hitch/hitch_1.7.3.patch
|
||||
autoreconf -ivf
|
||||
SSL_CFLAGS="-I$GITHUB_WORKSPACE/build-dir/include/ -I$GITHUB_WORKSPACE/build-dir/include/wolfssl" SSL_LIBS="-L$GITHUB_WORKSPACE/build-dir/lib -lwolfssl" ./configure --with-wolfssl=$GITHUB_WORKSPACE/build-dir/ --enable-silent-rules --enable-documentation --enable-warnings --with-lex --with-yacc --prefix=$GITHUB_WORKSPACE/build-dir
|
||||
make -j$(nproc)
|
||||
|
||||
- name: Confirm hitch built with wolfSSL
|
||||
working-directory: ./hitch
|
||||
run: |
|
||||
export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH
|
||||
ldd src/hitch | grep wolfssl
|
||||
|
||||
- name: Run hitch tests, skipping ignored tests
|
||||
working-directory: ./hitch
|
||||
run: |
|
||||
export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH
|
||||
make check
|
||||
11
.github/workflows/hostap-files/Makefile
vendored
11
.github/workflows/hostap-files/Makefile
vendored
@@ -1,11 +0,0 @@
|
||||
obj-m := mac80211_hwsim.o
|
||||
KDIR := /lib/modules/$(shell uname -r)/build
|
||||
PWD := $(shell pwd)
|
||||
default:
|
||||
$(MAKE) -C $(KDIR) M=$(PWD) modules
|
||||
install:
|
||||
$(MAKE) -C $(KDIR) M=$(PWD) modules_install
|
||||
depmod -A
|
||||
clean:
|
||||
$(MAKE) -C $(KDIR) M=$(PWD) clean
|
||||
|
||||
2
.github/workflows/hostap-files/README
vendored
2
.github/workflows/hostap-files/README
vendored
@@ -1,2 +0,0 @@
|
||||
Makefile and directory used in .github/workflows/hostap.yml to
|
||||
compile the mac80211_hwsim kernel module.
|
||||
@@ -1,122 +0,0 @@
|
||||
#CC=ccache gcc
|
||||
|
||||
CONFIG_DRIVER_NONE=y
|
||||
CONFIG_DRIVER_NL80211=y
|
||||
CONFIG_RSN_PREAUTH=y
|
||||
|
||||
#CONFIG_TLS=internal
|
||||
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||
#CONFIG_TLS=openssl
|
||||
CONFIG_TLS=wolfssl
|
||||
|
||||
CONFIG_EAP=y
|
||||
CONFIG_ERP=y
|
||||
CONFIG_EAP_MD5=y
|
||||
CONFIG_EAP_TLS=y
|
||||
CONFIG_EAP_MSCHAPV2=y
|
||||
CONFIG_EAP_PEAP=y
|
||||
CONFIG_EAP_GTC=y
|
||||
CONFIG_EAP_TTLS=y
|
||||
CONFIG_EAP_SIM=y
|
||||
CONFIG_EAP_AKA=y
|
||||
CONFIG_EAP_AKA_PRIME=y
|
||||
CONFIG_EAP_GPSK=y
|
||||
CONFIG_EAP_GPSK_SHA256=y
|
||||
CONFIG_EAP_SAKE=y
|
||||
CONFIG_EAP_PAX=y
|
||||
CONFIG_EAP_PSK=y
|
||||
CONFIG_EAP_VENDOR_TEST=y
|
||||
CONFIG_EAP_FAST=y
|
||||
CONFIG_EAP_TEAP=y
|
||||
CONFIG_EAP_IKEV2=y
|
||||
CONFIG_EAP_TNC=y
|
||||
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||
LIBS += -rdynamic
|
||||
CONFIG_EAP_UNAUTH_TLS=y
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
CONFIG_EAP_EKE=y
|
||||
CONFIG_PKCS12=y
|
||||
CONFIG_RADIUS_SERVER=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_TLSV11=y
|
||||
CONFIG_TLSV12=y
|
||||
|
||||
CONFIG_FULL_DYNAMIC_VLAN=y
|
||||
CONFIG_VLAN_NETLINK=y
|
||||
CONFIG_LIBNL32=y
|
||||
CONFIG_LIBNL3_ROUTE=y
|
||||
CONFIG_IEEE80211R=y
|
||||
CONFIG_IEEE80211AC=y
|
||||
CONFIG_IEEE80211AX=y
|
||||
|
||||
CONFIG_OCV=y
|
||||
|
||||
CONFIG_WPS=y
|
||||
CONFIG_WPS_UPNP=y
|
||||
CONFIG_WPS_NFC=y
|
||||
#CONFIG_WPS_STRICT=y
|
||||
CONFIG_WPA_TRACE=y
|
||||
CONFIG_WPA_TRACE_BFD=y
|
||||
|
||||
CONFIG_P2P_MANAGER=y
|
||||
CONFIG_DEBUG_FILE=y
|
||||
CONFIG_DEBUG_LINUX_TRACING=y
|
||||
CONFIG_WPA_CLI_EDIT=y
|
||||
CONFIG_ACS=y
|
||||
CONFIG_NO_RANDOM_POOL=y
|
||||
CONFIG_WNM=y
|
||||
CONFIG_INTERWORKING=y
|
||||
CONFIG_HS20=y
|
||||
CONFIG_SQLITE=y
|
||||
CONFIG_SAE=y
|
||||
CONFIG_SAE_PK=y
|
||||
CFLAGS += -DALL_DH_GROUPS
|
||||
|
||||
CONFIG_FST=y
|
||||
CONFIG_FST_TEST=y
|
||||
|
||||
CONFIG_TESTING_OPTIONS=y
|
||||
CFLAGS += -DCONFIG_RADIUS_TEST
|
||||
CONFIG_MODULE_TESTS=y
|
||||
|
||||
CONFIG_SUITEB=y
|
||||
CONFIG_SUITEB192=y
|
||||
|
||||
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||
# This can be used as a more efficient memory error detector than valgrind
|
||||
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||
# memory allocated for the guest).
|
||||
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_h += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_n += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
|
||||
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||
# following lines.
|
||||
#CFLAGS += -Wno-format-nonliteral
|
||||
#CFLAGS += -fsanitize=undefined
|
||||
##CFLAGS += -fno-sanitize-recover
|
||||
#LIBS += -fsanitize=undefined
|
||||
##LIBS += -fno-sanitize-recover
|
||||
#LIBS_h += -fsanitize=undefined
|
||||
#LIBS_n += -fsanitize=undefined
|
||||
#LIBS_c += -fsanitize=undefined
|
||||
CONFIG_MBO=y
|
||||
|
||||
CONFIG_TAXONOMY=y
|
||||
CONFIG_FILS=y
|
||||
CONFIG_FILS_SK_PFS=y
|
||||
CONFIG_OWE=y
|
||||
CONFIG_DPP=y
|
||||
CONFIG_DPP2=y
|
||||
CONFIG_WEP=y
|
||||
CONFIG_PASN=y
|
||||
CONFIG_AIRTIME_POLICY=y
|
||||
CONFIG_IEEE80211BE=y
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,164 +0,0 @@
|
||||
#CC=ccache gcc
|
||||
|
||||
#CONFIG_TLS=openssl
|
||||
CONFIG_TLS=wolfssl
|
||||
#CONFIG_TLS=internal
|
||||
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||
|
||||
CONFIG_IEEE8021X_EAPOL=y
|
||||
|
||||
CONFIG_ERP=y
|
||||
CONFIG_EAP_MD5=y
|
||||
CONFIG_MSCHAPV2=y
|
||||
CONFIG_EAP_TLS=y
|
||||
CONFIG_EAP_PEAP=y
|
||||
CONFIG_EAP_TTLS=y
|
||||
CONFIG_EAP_GTC=y
|
||||
CONFIG_EAP_OTP=y
|
||||
CONFIG_EAP_PSK=y
|
||||
CONFIG_EAP_PAX=y
|
||||
CONFIG_EAP_LEAP=y
|
||||
CONFIG_EAP_SIM=y
|
||||
CONFIG_EAP_AKA=y
|
||||
CONFIG_EAP_AKA_PRIME=y
|
||||
CONFIG_EAP_VENDOR_TEST=y
|
||||
CONFIG_EAP_TLV=y
|
||||
CONFIG_EAP_SAKE=y
|
||||
CONFIG_EAP_GPSK=y
|
||||
CONFIG_EAP_GPSK_SHA256=y
|
||||
CONFIG_EAP_EKE=y
|
||||
CONFIG_EAP_TNC=y
|
||||
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||
LIBS += -rdynamic
|
||||
CONFIG_EAP_FAST=y
|
||||
CONFIG_EAP_TEAP=y
|
||||
CONFIG_EAP_IKEV2=y
|
||||
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
|
||||
CONFIG_USIM_SIMULATOR=y
|
||||
CONFIG_SIM_SIMULATOR=y
|
||||
|
||||
#CONFIG_PCSC=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_DRIVER_NONE=y
|
||||
CONFIG_PKCS12=y
|
||||
CONFIG_CTRL_IFACE=unix
|
||||
|
||||
CONFIG_WPA_CLI_EDIT=y
|
||||
|
||||
CONFIG_OCSP=y
|
||||
|
||||
#CONFIG_ELOOP_POLL=y
|
||||
|
||||
CONFIG_CTRL_IFACE_DBUS_NEW=y
|
||||
CONFIG_CTRL_IFACE_DBUS_INTRO=y
|
||||
|
||||
CONFIG_IEEE80211R=y
|
||||
CONFIG_IEEE80211AC=y
|
||||
CONFIG_IEEE80211AX=y
|
||||
|
||||
CONFIG_OCV=y
|
||||
|
||||
CONFIG_DEBUG_FILE=y
|
||||
|
||||
CONFIG_WPS=y
|
||||
#CONFIG_WPS_STRICT=y
|
||||
CONFIG_WPS_UPNP=y
|
||||
CONFIG_WPS_NFC=y
|
||||
CONFIG_WPS_ER=y
|
||||
#CONFIG_WPS_REG_DISABLE_OPEN=y
|
||||
|
||||
CONFIG_DRIVER_WEXT=y
|
||||
|
||||
CONFIG_DRIVER_NL80211=y
|
||||
CFLAGS += -I/usr/include/libnl3
|
||||
CONFIG_LIBNL32=y
|
||||
|
||||
CONFIG_IBSS_RSN=y
|
||||
|
||||
CONFIG_AP=y
|
||||
CONFIG_MESH=y
|
||||
CONFIG_P2P=y
|
||||
CONFIG_WIFI_DISPLAY=y
|
||||
|
||||
CONFIG_ACS=y
|
||||
|
||||
CONFIG_BGSCAN_SIMPLE=y
|
||||
CONFIG_BGSCAN_LEARN=y
|
||||
|
||||
CONFIG_WPA_TRACE=y
|
||||
CONFIG_WPA_TRACE_BFD=y
|
||||
|
||||
CONFIG_TDLS=y
|
||||
CONFIG_TDLS_TESTING=y
|
||||
CONFIG_NO_RANDOM_POOL=y
|
||||
|
||||
CONFIG_TLSV11=y
|
||||
CONFIG_TLSV12=y
|
||||
|
||||
CONFIG_HT_OVERRIDES=y
|
||||
CONFIG_VHT_OVERRIDES=y
|
||||
CONFIG_HE_OVERRIDES=y
|
||||
|
||||
CONFIG_DEBUG_LINUX_TRACING=y
|
||||
|
||||
CONFIG_INTERWORKING=y
|
||||
CONFIG_HS20=y
|
||||
|
||||
CONFIG_AUTOSCAN_EXPONENTIAL=y
|
||||
CONFIG_AUTOSCAN_PERIODIC=y
|
||||
|
||||
CONFIG_EXT_PASSWORD_TEST=y
|
||||
CONFIG_EXT_PASSWORD_FILE=y
|
||||
|
||||
CONFIG_EAP_UNAUTH_TLS=y
|
||||
|
||||
CONFIG_SAE=y
|
||||
CONFIG_SAE_PK=y
|
||||
CFLAGS += -DALL_DH_GROUPS
|
||||
|
||||
CONFIG_WNM=y
|
||||
|
||||
CONFIG_FST=y
|
||||
CONFIG_FST_TEST=y
|
||||
|
||||
CONFIG_TESTING_OPTIONS=y
|
||||
CONFIG_MODULE_TESTS=y
|
||||
|
||||
CONFIG_SUITEB=y
|
||||
CONFIG_SUITEB192=y
|
||||
|
||||
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||
# This can be used as a more efficient memory error detector than valgrind
|
||||
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||
# memory allocated for the guest).
|
||||
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_p += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
|
||||
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||
# following lines.
|
||||
#CFLAGS += -Wno-format-nonliteral
|
||||
#CFLAGS += -fsanitize=undefined
|
||||
##CFLAGS += -fno-sanitize-recover
|
||||
#LIBS += -fsanitize=undefined
|
||||
##LIBS += -fno-sanitize-recover
|
||||
#LIBS_c += -fsanitize=undefined
|
||||
#LIBS_p += -fsanitize=undefined
|
||||
CONFIG_MBO=y
|
||||
CONFIG_FILS=y
|
||||
CONFIG_FILS_SK_PFS=y
|
||||
CONFIG_PMKSA_CACHE_EXTERNAL=y
|
||||
CONFIG_OWE=y
|
||||
CONFIG_DPP=y
|
||||
CONFIG_DPP2=y
|
||||
CONFIG_WEP=y
|
||||
CONFIG_PASN=y
|
||||
@@ -1,120 +0,0 @@
|
||||
#CC=ccache gcc
|
||||
|
||||
CONFIG_DRIVER_NONE=y
|
||||
CONFIG_DRIVER_NL80211=y
|
||||
CONFIG_RSN_PREAUTH=y
|
||||
|
||||
#CONFIG_TLS=internal
|
||||
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||
#CONFIG_TLS=openssl
|
||||
CONFIG_TLS=wolfssl
|
||||
|
||||
CONFIG_EAP=y
|
||||
CONFIG_ERP=y
|
||||
CONFIG_EAP_MD5=y
|
||||
CONFIG_EAP_TLS=y
|
||||
CONFIG_EAP_MSCHAPV2=y
|
||||
CONFIG_EAP_PEAP=y
|
||||
CONFIG_EAP_GTC=y
|
||||
CONFIG_EAP_TTLS=y
|
||||
CONFIG_EAP_SIM=y
|
||||
CONFIG_EAP_AKA=y
|
||||
CONFIG_EAP_AKA_PRIME=y
|
||||
CONFIG_EAP_GPSK=y
|
||||
CONFIG_EAP_GPSK_SHA256=y
|
||||
CONFIG_EAP_SAKE=y
|
||||
CONFIG_EAP_PAX=y
|
||||
CONFIG_EAP_PSK=y
|
||||
CONFIG_EAP_VENDOR_TEST=y
|
||||
CONFIG_EAP_FAST=y
|
||||
CONFIG_EAP_TEAP=y
|
||||
CONFIG_EAP_IKEV2=y
|
||||
CONFIG_EAP_TNC=y
|
||||
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||
LIBS += -rdynamic
|
||||
CONFIG_EAP_UNAUTH_TLS=y
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
CONFIG_EAP_EKE=y
|
||||
CONFIG_PKCS12=y
|
||||
CONFIG_RADIUS_SERVER=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_TLSV11=y
|
||||
CONFIG_TLSV12=y
|
||||
|
||||
CONFIG_FULL_DYNAMIC_VLAN=y
|
||||
CONFIG_VLAN_NETLINK=y
|
||||
CONFIG_LIBNL32=y
|
||||
CONFIG_LIBNL3_ROUTE=y
|
||||
CONFIG_IEEE80211R=y
|
||||
CONFIG_IEEE80211AC=y
|
||||
CONFIG_IEEE80211AX=y
|
||||
|
||||
CONFIG_OCV=y
|
||||
|
||||
CONFIG_WPS=y
|
||||
CONFIG_WPS_UPNP=y
|
||||
CONFIG_WPS_NFC=y
|
||||
#CONFIG_WPS_STRICT=y
|
||||
CONFIG_WPA_TRACE=y
|
||||
CONFIG_WPA_TRACE_BFD=y
|
||||
|
||||
CONFIG_P2P_MANAGER=y
|
||||
CONFIG_DEBUG_FILE=y
|
||||
CONFIG_DEBUG_LINUX_TRACING=y
|
||||
CONFIG_WPA_CLI_EDIT=y
|
||||
CONFIG_ACS=y
|
||||
CONFIG_NO_RANDOM_POOL=y
|
||||
CONFIG_WNM=y
|
||||
CONFIG_INTERWORKING=y
|
||||
CONFIG_HS20=y
|
||||
CONFIG_SQLITE=y
|
||||
CONFIG_SAE=y
|
||||
CONFIG_SAE_PK=y
|
||||
CFLAGS += -DALL_DH_GROUPS
|
||||
|
||||
CONFIG_FST=y
|
||||
CONFIG_FST_TEST=y
|
||||
|
||||
CONFIG_TESTING_OPTIONS=y
|
||||
CFLAGS += -DCONFIG_RADIUS_TEST
|
||||
CONFIG_MODULE_TESTS=y
|
||||
|
||||
CONFIG_SUITEB=y
|
||||
|
||||
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||
# This can be used as a more efficient memory error detector than valgrind
|
||||
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||
# memory allocated for the guest).
|
||||
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_h += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_n += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
|
||||
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||
# following lines.
|
||||
#CFLAGS += -Wno-format-nonliteral
|
||||
#CFLAGS += -fsanitize=undefined
|
||||
##CFLAGS += -fno-sanitize-recover
|
||||
#LIBS += -fsanitize=undefined
|
||||
##LIBS += -fno-sanitize-recover
|
||||
#LIBS_h += -fsanitize=undefined
|
||||
#LIBS_n += -fsanitize=undefined
|
||||
#LIBS_c += -fsanitize=undefined
|
||||
CONFIG_MBO=y
|
||||
|
||||
CONFIG_TAXONOMY=y
|
||||
CONFIG_FILS=y
|
||||
CONFIG_FILS_SK_PFS=y
|
||||
CONFIG_OWE=y
|
||||
CONFIG_DPP=y
|
||||
CONFIG_DPP2=y
|
||||
CONFIG_WEP=y
|
||||
CONFIG_PASN=y
|
||||
CONFIG_AIRTIME_POLICY=y
|
||||
@@ -1,656 +0,0 @@
|
||||
sae_pk
|
||||
sae_pk_group_negotiation
|
||||
sae_pk_sec_3
|
||||
sae_pk_sec_5
|
||||
sae_pk_group_20
|
||||
sae_pk_group_21
|
||||
sae_pk_group_20_sae_group_19
|
||||
sae_pk_group_20_sae_group_21
|
||||
sae_pk_group_19_sae_group_20
|
||||
sae_pk_password_without_pk
|
||||
sae_pk_only
|
||||
sae_pk_modes
|
||||
sae_pk_not_on_ap
|
||||
sae_pk_mixed
|
||||
sae_pk_mixed_immediate_confirm
|
||||
sae_pk_missing_ie
|
||||
sae_pk_unexpected_status
|
||||
sae_pk_invalid_signature
|
||||
sae_pk_invalid_fingerprint
|
||||
sae_pk_and_psk
|
||||
sae_pk_and_psk_invalid_password
|
||||
sae_pk_invalid_pw
|
||||
sae
|
||||
sae_password_ecc
|
||||
sae_pmksa_caching
|
||||
sae_pmksa_caching_pmkid
|
||||
sae_pmksa_caching_disabled
|
||||
sae_groups
|
||||
sae_group_nego
|
||||
sae_group_nego_no_match
|
||||
sae_anti_clogging
|
||||
sae_forced_anti_clogging
|
||||
sae_mixed
|
||||
sae_and_psk
|
||||
sae_and_psk2
|
||||
sae_wpa3_roam
|
||||
sae_mixed_mfp
|
||||
sae_mfp
|
||||
sae_missing_password
|
||||
sae_key_lifetime_in_memory
|
||||
sae_oom_wpas
|
||||
sae_proto_ecc
|
||||
sae_proto_ffc
|
||||
sae_proto_commit_delayed
|
||||
sae_proto_commit_replay
|
||||
sae_proto_confirm_replay
|
||||
sae_proto_hostapd
|
||||
sae_proto_hostapd_ecc
|
||||
sae_proto_hostapd_ffc
|
||||
sae_proto_hostapd_status_126
|
||||
sae_proto_hostapd_status_127
|
||||
sae_reflection_attack_ecc
|
||||
sae_reflection_attack_ecc_internal
|
||||
sae_commit_override
|
||||
sae_commit_override2
|
||||
sae_commit_invalid_scalar_element_ap
|
||||
sae_commit_invalid_element_ap
|
||||
sae_commit_invalid_scalar_element_sta
|
||||
sae_commit_invalid_element_sta
|
||||
sae_anti_clogging_proto
|
||||
sae_no_random
|
||||
sae_invalid_anti_clogging_token_req
|
||||
sae_password
|
||||
sae_password_short
|
||||
sae_password_long
|
||||
sae_connect_cmd
|
||||
sae_password_id
|
||||
sae_password_id_ecc
|
||||
sae_password_id_ffc
|
||||
sae_password_id_only
|
||||
sae_password_id_pwe_looping
|
||||
sae_password_id_pwe_check_ap
|
||||
sae_password_id_pwe_check_sta
|
||||
sae_forced_anti_clogging_pw_id
|
||||
sae_reauth
|
||||
sae_sync
|
||||
sae_confirm_immediate
|
||||
sae_confirm_immediate2
|
||||
sae_pwe_group_19
|
||||
sae_pwe_group_20
|
||||
sae_pwe_group_21
|
||||
sae_pwe_group_28
|
||||
sae_pwe_group_29
|
||||
sae_pwe_group_30
|
||||
sae_pwe_group_1
|
||||
sae_pwe_group_2
|
||||
sae_pwe_group_22
|
||||
sae_pwe_h2e_only_ap
|
||||
sae_pwe_h2e_only_ap_sta_forcing_loop
|
||||
sae_pwe_loop_only_ap
|
||||
sae_h2e_rejected_groups
|
||||
sae_h2e_rejected_groups_unexpected
|
||||
sae_h2e_password_id
|
||||
sae_pwe_in_psk_ap
|
||||
sae_auth_restart
|
||||
sae_rsne_mismatch
|
||||
sae_h2e_rsnxe_mismatch
|
||||
sae_h2e_rsnxe_mismatch_retries
|
||||
sae_h2e_rsnxe_mismatch_assoc
|
||||
sae_h2e_rsnxe_mismatch_ap
|
||||
sae_h2e_rsnxe_mismatch_ap2
|
||||
sae_h2e_rsnxe_mismatch_ap3
|
||||
sae_forced_anti_clogging_h2e
|
||||
sae_forced_anti_clogging_h2e_loop
|
||||
sae_okc
|
||||
sae_okc_sta_only
|
||||
sae_okc_pmk_lifetime
|
||||
sae_pmk_lifetime
|
||||
sae_and_psk_multiple_passwords
|
||||
sae_pmf_roam
|
||||
sae_ocv_pmk
|
||||
sae_ocv_pmk_failure
|
||||
sae_reject
|
||||
eap_tls_pkcs8_pkcs5_v2_des3
|
||||
eap_tls_pkcs8_pkcs5_v15
|
||||
eap_tls_session_resumption
|
||||
eap_tls_session_resumption_expiration
|
||||
eap_tls_session_resumption_radius
|
||||
eap_tls_sha512
|
||||
eap_tls_sha384
|
||||
eap_tls_ext_cert_check
|
||||
eap_tls_errors
|
||||
ap_wpa2_delayed_m3_retransmission
|
||||
ap_wpa2_delayed_m1_m3_retransmission
|
||||
ap_wpa2_delayed_m1_m3_retransmission2
|
||||
ap_wpa2_delayed_group_m1_retransmission
|
||||
ap_wpa2_delayed_group_m1_retransmission_igtk
|
||||
ap_wpa2_delayed_m1_m3_zero_tk
|
||||
ap_wpa2_plaintext_m1_m3
|
||||
ap_wpa2_plaintext_m1_m3_pmf
|
||||
ap_wpa2_plaintext_m3
|
||||
ap_wpa2_plaintext_group_m1
|
||||
ap_wpa2_plaintext_group_m1_pmf
|
||||
ap_wpa2_test_command_failures
|
||||
ap_wpa2_gtk_initial_rsc_tkip
|
||||
ap_wpa2_gtk_initial_rsc_ccmp
|
||||
ap_wpa2_gtk_initial_rsc_ccmp_256
|
||||
ap_wpa2_gtk_initial_rsc_gcmp
|
||||
ap_wpa2_gtk_initial_rsc_gcmp_256
|
||||
ap_wpa2_igtk_initial_rsc_aes_128_cmac
|
||||
ap_wpa2_igtk_initial_rsc_bip_gmac_128
|
||||
ap_wpa2_igtk_initial_rsc_bip_gmac_256
|
||||
ap_wpa2_igtk_initial_rsc_bip_cmac_256
|
||||
ap_wpa2_psk
|
||||
ap_wpa2_psk_file
|
||||
ap_wpa2_psk_file_keyid
|
||||
ap_wpa2_psk_mem
|
||||
ap_wpa2_ptk_rekey
|
||||
ap_wpa2_ptk_rekey_blocked_ap
|
||||
ap_wpa2_ptk_rekey_blocked_sta
|
||||
ap_wpa2_ptk_rekey_anonce
|
||||
ap_wpa2_ptk_rekey_ap
|
||||
ap_wpa2_sha256_ptk_rekey
|
||||
ap_wpa2_sha256_ptk_rekey_ap
|
||||
ap_wpa2_psk_file_errors
|
||||
ap_wpa2_psk_wildcard_ssid
|
||||
ap_wpa2_gtk_rekey
|
||||
ap_wpa2_gtk_rekey_request
|
||||
ap_wpa2_gtk_rekey_failure
|
||||
ap_wpa2_gtk_rekey_fail_1_sta
|
||||
ap_wpa2_gmk_rekey
|
||||
ap_wpa2_strict_rekey
|
||||
ap_wpa2_psk_ext
|
||||
ap_wpa2_psk_unexpected
|
||||
ap_wpa2_psk_ext_retry_msg_3
|
||||
ap_wpa2_psk_ext_retry_msg_3b
|
||||
ap_wpa2_psk_ext_retry_msg_3c
|
||||
ap_wpa2_psk_ext_retry_msg_3d
|
||||
ap_wpa2_psk_ext_retry_msg_3e
|
||||
ap_wpa2_psk_ext_delayed_ptk_rekey
|
||||
ap_wpa2_psk_ext_eapol
|
||||
ap_wpa2_psk_ext_eapol_retry1
|
||||
ap_wpa2_psk_ext_eapol_retry1b
|
||||
ap_wpa2_psk_ext_eapol_retry1c
|
||||
ap_wpa2_psk_ext_eapol_retry1d
|
||||
ap_wpa2_psk_ext_eapol_type_diff
|
||||
ap_wpa2_psk_ext_eapol_key_info
|
||||
ap_wpa2_psk_supp_proto
|
||||
ap_wpa2_psk_supp_proto_no_ie
|
||||
ap_wpa2_psk_supp_proto_ie_mismatch
|
||||
ap_wpa2_psk_supp_proto_ok
|
||||
ap_wpa2_psk_supp_proto_no_gtk
|
||||
ap_wpa2_psk_supp_proto_anonce_change
|
||||
ap_wpa2_psk_supp_proto_unexpected_group_msg
|
||||
ap_wpa2_psk_supp_proto_msg_1_invalid_kde
|
||||
ap_wpa2_psk_supp_proto_wrong_pairwise_key_len
|
||||
ap_wpa2_psk_supp_proto_wrong_group_key_len
|
||||
ap_wpa2_psk_supp_proto_gtk_tx_bit_workaround
|
||||
ap_wpa2_psk_supp_proto_gtk_keyidx_0_and_3
|
||||
ap_wpa2_psk_supp_proto_no_gtk_in_group_msg
|
||||
ap_wpa2_psk_supp_proto_too_long_gtk_in_group_msg
|
||||
ap_wpa2_psk_supp_proto_too_long_gtk_kde
|
||||
ap_wpa2_psk_supp_proto_gtk_not_encrypted
|
||||
ap_wpa2_psk_wep
|
||||
ap_wpa2_psk_drop_first_msg_4
|
||||
ap_wpa2_psk_disable_enable
|
||||
ap_wpa2_psk_incorrect_passphrase
|
||||
ap_wpa2_psk_no_random
|
||||
ap_wpa2_psk_assoc_rsn
|
||||
ap_wpa2_psk_ft_workaround
|
||||
ap_wpa2_psk_assoc_rsn_pmkid
|
||||
ap_wpa2_eapol_retry_limit
|
||||
ap_wpa2_disable_eapol_retry
|
||||
ap_wpa2_disable_eapol_retry_group
|
||||
ap_wpa2_psk_mic_0
|
||||
ap_wpa2_psk_local_error
|
||||
ap_wpa2_psk_ap_control_port
|
||||
ap_wpa2_psk_rsne_mismatch_ap
|
||||
ap_wpa2_psk_rsne_mismatch_ap2
|
||||
ap_wpa2_psk_rsne_mismatch_ap3
|
||||
ap_wpa2_psk_rsnxe_mismatch_ap
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_ap0
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_ap1
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_ap2
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_sta0
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_sta1
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_sta2
|
||||
ap_wpa2_eap_sim
|
||||
ap_wpa2_eap_sim_imsi_identity
|
||||
ap_wpa2_eap_sim_imsi_privacy_key
|
||||
ap_wpa2_eap_sim_imsi_privacy_attr
|
||||
ap_wpa2_eap_sim_sql
|
||||
ap_wpa2_eap_sim_config
|
||||
ap_wpa2_eap_sim_id_0
|
||||
ap_wpa2_eap_sim_id_1
|
||||
ap_wpa2_eap_sim_id_2
|
||||
ap_wpa2_eap_sim_id_3
|
||||
ap_wpa2_eap_sim_ext
|
||||
ap_wpa2_eap_sim_ext_replace_sim
|
||||
ap_wpa2_eap_sim_ext_replace_sim2
|
||||
ap_wpa2_eap_sim_ext_replace_sim3
|
||||
ap_wpa2_eap_sim_ext_auth_fail
|
||||
ap_wpa2_eap_sim_change_bssid
|
||||
ap_wpa2_eap_sim_no_change_set
|
||||
ap_wpa2_eap_sim_ext_anonymous
|
||||
ap_wpa2_eap_sim_ext_anonymous_no_pseudonym
|
||||
ap_wpa2_eap_sim_oom
|
||||
ap_wpa2_eap_aka
|
||||
ap_wpa2_eap_aka_imsi_identity
|
||||
ap_wpa2_eap_aka_imsi_privacy_key
|
||||
ap_wpa2_eap_aka_imsi_privacy_attr
|
||||
ap_wpa2_eap_aka_imsi_privacy_key_expired
|
||||
ap_wpa2_eap_aka_sql
|
||||
ap_wpa2_eap_aka_config
|
||||
ap_wpa2_eap_aka_ext
|
||||
ap_wpa2_eap_aka_ext_auth_fail
|
||||
ap_wpa2_eap_aka_prime_imsi_identity
|
||||
ap_wpa2_eap_aka_prime_imsi_privacy_key
|
||||
ap_wpa2_eap_aka_prime_ext_auth_fail
|
||||
ap_wpa2_eap_aka_prime_ext
|
||||
ap_wpa2_eap_ttls_pap
|
||||
ap_wpa2_eap_ttls_pap_subject_match
|
||||
ap_wpa2_eap_ttls_pap_check_cert_subject
|
||||
ap_wpa2_eap_ttls_pap_incorrect_password
|
||||
ap_wpa2_eap_ttls_chap
|
||||
ap_wpa2_eap_ttls_chap_altsubject_match
|
||||
ap_wpa2_eap_ttls_chap_incorrect_password
|
||||
ap_wpa2_eap_ttls_mschap
|
||||
ap_wpa2_eap_ttls_mschap_incorrect_password
|
||||
ap_wpa2_eap_ttls_mschapv2
|
||||
ap_wpa2_eap_ttls_invalid_phase2
|
||||
ap_wpa2_eap_ttls_mschapv2_suffix_match
|
||||
ap_wpa2_eap_ttls_mschapv2_domain_match
|
||||
ap_wpa2_eap_ttls_mschapv2_incorrect_password
|
||||
ap_wpa2_eap_ttls_mschapv2_utf8
|
||||
ap_wpa2_eap_ttls_eap_gtc
|
||||
ap_wpa2_eap_ttls_eap_gtc_incorrect_password
|
||||
ap_wpa2_eap_ttls_eap_gtc_no_password
|
||||
ap_wpa2_eap_ttls_eap_gtc_server_oom
|
||||
ap_wpa2_eap_ttls_eap_gtc_oom
|
||||
ap_wpa2_eap_ttls_eap_md5
|
||||
ap_wpa2_eap_ttls_eap_md5_incorrect_password
|
||||
ap_wpa2_eap_ttls_eap_md5_no_password
|
||||
ap_wpa2_eap_ttls_eap_md5_server_oom
|
||||
ap_wpa2_eap_ttls_eap_mschapv2
|
||||
ap_wpa2_eap_ttls_eap_mschapv2_no_password
|
||||
ap_wpa2_eap_ttls_eap_mschapv2_server_oom
|
||||
ap_wpa2_eap_ttls_eap_sim
|
||||
ap_wpa2_eap_ttls_eap_sim_ext
|
||||
ap_wpa2_eap_ttls_eap_vendor
|
||||
ap_wpa2_eap_peap_eap_sim
|
||||
ap_wpa2_eap_peap_eap_sim_ext
|
||||
ap_wpa2_eap_fast_eap_sim_ext
|
||||
ap_wpa2_eap_ttls_eap_aka
|
||||
ap_wpa2_eap_peap_eap_aka
|
||||
ap_wpa2_eap_peap_eap_mschapv2
|
||||
ap_wpa2_eap_peap_eap_mschapv2_domain
|
||||
ap_wpa2_eap_peap_eap_mschapv2_incorrect_password
|
||||
ap_wpa2_eap_peap_crypto_binding
|
||||
ap_wpa2_eap_peap_crypto_binding_server_oom
|
||||
ap_wpa2_eap_peap_params
|
||||
ap_wpa2_eap_peap_eap_gtc
|
||||
ap_wpa2_eap_peap_eap_tls
|
||||
ap_wpa2_eap_peap_eap_vendor
|
||||
ap_wpa2_eap_tls
|
||||
ap_wpa2_eap_tls_blob
|
||||
ap_wpa2_eap_tls_blob_pem
|
||||
ap_wpa2_eap_tls_blob_missing
|
||||
ap_wpa2_eap_tls_with_tls_len
|
||||
ap_wpa2_eap_tls_pkcs12
|
||||
ap_wpa2_eap_tls_pkcs12_blob
|
||||
ap_wpa2_eap_tls_pkcs12_blob_pem
|
||||
ap_wpa2_eap_tls_diff_ca_trust
|
||||
ap_wpa2_eap_tls_diff_ca_trust2
|
||||
ap_wpa2_eap_tls_diff_ca_trust3
|
||||
ap_wpa2_eap_tls_neg_suffix_match
|
||||
ap_wpa2_eap_tls_neg_domain_match
|
||||
ap_wpa2_eap_tls_neg_subject_match
|
||||
ap_wpa2_eap_tls_neg_altsubject_match
|
||||
ap_wpa2_eap_unauth_tls
|
||||
ap_wpa2_eap_ttls_server_cert_hash
|
||||
ap_wpa2_eap_ttls_server_cert_hash_invalid
|
||||
ap_wpa2_eap_pwd
|
||||
ap_wpa2_eap_pwd_nthash
|
||||
ap_wpa2_eap_pwd_salt_sha1
|
||||
ap_wpa2_eap_pwd_salt_sha256
|
||||
ap_wpa2_eap_pwd_salt_sha512
|
||||
ap_wpa2_eap_pwd_groups
|
||||
ap_wpa2_eap_pwd_invalid_group
|
||||
ap_wpa2_eap_pwd_disabled_group
|
||||
ap_wpa2_eap_pwd_as_frag
|
||||
ap_wpa2_eap_gpsk
|
||||
ap_wpa2_eap_sake
|
||||
ap_wpa2_eap_eke
|
||||
ap_wpa2_eap_eke_many
|
||||
ap_wpa2_eap_eke_serverid_nai
|
||||
ap_wpa2_eap_eke_server_oom
|
||||
ap_wpa2_eap_ikev2
|
||||
ap_wpa2_eap_ikev2_as_frag
|
||||
ap_wpa2_eap_ikev2_oom
|
||||
ap_wpa2_eap_pax
|
||||
ap_wpa2_eap_psk
|
||||
ap_wpa2_eap_psk_oom
|
||||
ap_wpa2_eap_interactive
|
||||
ap_wpa2_eap_ext_enable_network_while_connected
|
||||
ap_wpa2_eap_vendor_test
|
||||
ap_wpa2_eap_vendor_test_oom
|
||||
ap_wpa2_eap_fast_gtc_identity_change
|
||||
ap_wpa2_eap_fast_eap_vendor
|
||||
ap_wpa2_eap_tls_ocsp
|
||||
ap_wpa2_eap_tls_ocsp_multi
|
||||
ap_wpa2_eap_tls_ocsp_key_id
|
||||
ap_wpa2_eap_tls_ocsp_ca_signed_good
|
||||
ap_wpa2_eap_tls_ocsp_ca_signed_revoked
|
||||
ap_wpa2_eap_tls_ocsp_ca_signed_unknown
|
||||
ap_wpa2_eap_tls_ocsp_server_signed
|
||||
ap_wpa2_eap_tls_ocsp_invalid_data
|
||||
ap_wpa2_eap_tls_ocsp_invalid
|
||||
ap_wpa2_eap_tls_ocsp_unknown_sign
|
||||
ap_wpa2_eap_tls_intermediate_ca
|
||||
ap_wpa2_eap_tls_ocsp_multi_revoked
|
||||
ap_wpa2_eap_tls_domain_suffix_match_cn_full
|
||||
ap_wpa2_eap_tls_domain_match_cn
|
||||
ap_wpa2_eap_tls_domain_suffix_match_cn
|
||||
ap_wpa2_eap_tls_domain_suffix_mismatch_cn
|
||||
ap_wpa2_eap_tls_domain_mismatch_cn
|
||||
ap_wpa2_eap_ttls_long_duration
|
||||
ap_wpa2_eap_ttls_server_cert_eku_client
|
||||
ap_wpa2_eap_ttls_server_cert_eku_client_server
|
||||
ap_wpa2_eap_ttls_server_pkcs12
|
||||
ap_wpa2_eap_ttls_server_pkcs12_extra
|
||||
ap_wpa2_eap_ttls_dh_params_server
|
||||
ap_wpa2_eap_ttls_dh_params_dsa_server
|
||||
ap_wpa2_eap_ttls_dh_params_not_found
|
||||
ap_wpa2_eap_ttls_dh_params_invalid
|
||||
ap_wpa2_eap_reauth
|
||||
ap_wpa2_eap_reauth_ptk_rekey_blocked_sta
|
||||
ap_wpa2_eap_request_identity_message
|
||||
ap_wpa2_eap_sim_aka_result_ind
|
||||
ap_wpa2_eap_sim_zero_db_timeout
|
||||
ap_wpa2_eap_too_many_roundtrips
|
||||
ap_wpa2_eap_too_many_roundtrips_server
|
||||
ap_wpa2_eap_too_many_roundtrips_server2
|
||||
ap_wpa2_eap_expanded_nak
|
||||
ap_wpa2_eap_sql
|
||||
ap_wpa2_eap_non_ascii_identity
|
||||
ap_wpa2_eap_non_ascii_identity2
|
||||
ap_wpa2_eap_unexpected_wep_eapol_key
|
||||
ap_wpa2_eap_session_ticket
|
||||
ap_wpa2_eap_no_workaround
|
||||
ap_wpa2_eap_tls_check_crl
|
||||
ap_wpa2_eap_tls_check_crl_not_strict
|
||||
ap_wpa2_eap_tls_crl_reload
|
||||
ap_wpa2_eap_tls_check_cert_subject
|
||||
ap_wpa2_eap_tls_check_cert_subject_neg
|
||||
ap_wpa2_eap_tls_oom
|
||||
ap_wpa2_eap_tls_macacl
|
||||
ap_wpa2_eap_oom
|
||||
ap_wpa2_eap_tls_13
|
||||
ap_wpa2_eap_tls_13_ocsp
|
||||
ap_wpa2_eap_tls_13_missing_prot_success
|
||||
ap_wpa2_eap_tls_13_fragmentation
|
||||
ap_wpa2_eap_ttls_13
|
||||
ap_wpa2_eap_peap_13
|
||||
ap_wpa2_eap_tls_13_ec
|
||||
ap_wpa2_eap_sim_db
|
||||
ap_wpa2_eap_sim_db_sqlite
|
||||
ap_wpa2_eap_assoc_rsn
|
||||
ap_wpa2_eap_status
|
||||
ap_wpa2_eap_gpsk_ptk_rekey_ap
|
||||
ap_wpa2_eap_wildcard_ssid
|
||||
ap_wpa2_eap_psk_mac_addr_change
|
||||
ap_wpa2_eap_server_get_id
|
||||
ap_wpa2_radius_server_get_id
|
||||
ap_wpa2_eap_tls_tod
|
||||
ap_wpa2_eap_tls_tod_tofu
|
||||
ap_wpa2_eap_sake_no_control_port
|
||||
dpp_network_intro_version
|
||||
dpp_network_intro_version_change
|
||||
dpp_network_intro_version_missing_req
|
||||
dpp_tcp_pkex
|
||||
dpp_tcp_pkex_auto_connect_2
|
||||
dpp_tcp_pkex_auto_connect_2_status
|
||||
dpp_tcp_pkex_auto_connect_2_status_fail
|
||||
dpp_tcp_pkex_while_associated
|
||||
dpp_tcp_pkex_while_associated_conn_status
|
||||
dpp_controller_relay_pkex
|
||||
dpp_push_button
|
||||
dpp_push_button_session_overlap_sta
|
||||
dpp_push_button_session_overlap_ap
|
||||
dpp_push_button_session_overlap_configurator
|
||||
dpp_push_button_2sta
|
||||
dpp_push_button_r_hash_mismatch_sta
|
||||
dpp_push_button_i_hash_mismatch_ap
|
||||
dpp_push_button_r_hash_mismatch_ap
|
||||
dpp_push_button_ext_conf
|
||||
dpp_push_button_wpas_conf
|
||||
dpp_private_peer_introduction
|
||||
dpp_qr_code_parsing
|
||||
dpp_uri_version
|
||||
dpp_uri_supported_curves
|
||||
dpp_uri_host
|
||||
dpp_qr_code_parsing_fail
|
||||
dpp_qr_code_curves
|
||||
dpp_qr_code_curves_brainpool
|
||||
dpp_qr_code_unsupported_curve
|
||||
dpp_qr_code_keygen_fail
|
||||
dpp_qr_code_auth_broadcast
|
||||
dpp_configurator_enrollee_prime256v1
|
||||
dpp_configurator_enrollee_secp384r1
|
||||
dpp_configurator_enrollee_brainpoolP256r1
|
||||
dpp_configurator_enrollee_brainpoolP384r1
|
||||
dpp_configurator_enrollee_brainpoolP512r1
|
||||
dpp_configurator_enroll_conf
|
||||
dpp_qr_code_curve_prime256v1
|
||||
dpp_qr_code_curve_secp384r1
|
||||
dpp_qr_code_curve_secp521r1
|
||||
dpp_qr_code_curve_brainpoolP256r1
|
||||
dpp_qr_code_curve_brainpoolP384r1
|
||||
dpp_qr_code_curve_brainpoolP512r1
|
||||
dpp_qr_code_set_key
|
||||
dpp_qr_code_auth_mutual
|
||||
dpp_qr_code_auth_mutual_p_256
|
||||
dpp_qr_code_auth_mutual_p_384
|
||||
dpp_qr_code_auth_mutual_p_521
|
||||
dpp_qr_code_auth_mutual_bp_256
|
||||
dpp_qr_code_auth_mutual_bp_384
|
||||
dpp_qr_code_auth_mutual_bp_512
|
||||
dpp_auth_resp_retries
|
||||
dpp_qr_code_auth_mutual_not_used
|
||||
dpp_qr_code_auth_mutual_curve_mismatch
|
||||
dpp_qr_code_auth_hostapd_mutual2
|
||||
dpp_qr_code_listen_continue
|
||||
dpp_qr_code_auth_initiator_enrollee
|
||||
dpp_qr_code_auth_initiator_either_2
|
||||
dpp_qr_code_auth_initiator_either_3
|
||||
dpp_config_legacy
|
||||
dpp_config_legacy_psk_hex
|
||||
dpp_config_fragmentation
|
||||
dpp_config_legacy_gen
|
||||
dpp_config_legacy_gen_psk
|
||||
dpp_config_dpp_gen_prime256v1
|
||||
dpp_config_dpp_gen_secp384r1
|
||||
dpp_config_dpp_gen_secp521r1
|
||||
dpp_config_dpp_gen_expiry
|
||||
dpp_config_dpp_gen_expired_key
|
||||
dpp_config_dpp_gen_3rd_party
|
||||
dpp_config_dpp_override_prime256v1
|
||||
dpp_config_dpp_override_secp384r1
|
||||
dpp_config_override_objects
|
||||
dpp_config_signed_connector_error_no_dot_1
|
||||
dpp_config_signed_connector_error_no_dot_2
|
||||
dpp_config_signed_connector_error_unexpected_signature_len
|
||||
dpp_config_no_csign
|
||||
dpp_config_no_signed_connector
|
||||
dpp_config_unexpected_signed_connector_char
|
||||
dpp_config_root_not_an_object
|
||||
dpp_config_no_wi_fi_tech
|
||||
dpp_config_no_discovery
|
||||
dpp_config_no_discovery_ssid
|
||||
dpp_config_too_long_discovery_ssid
|
||||
dpp_config_no_cred
|
||||
dpp_config_no_cred_akm
|
||||
dpp_config_error_legacy_no_pass
|
||||
dpp_config_error_legacy_too_long_pass
|
||||
dpp_config_error_legacy_psk_with_sae
|
||||
dpp_config_error_legacy_no_pass_for_sae
|
||||
dpp_config_error_legacy_invalid_psk
|
||||
dpp_config_error_legacy_too_short_psk
|
||||
dpp_config_connector_error_ext_sign
|
||||
dpp_config_connector_error_too_short_timestamp
|
||||
dpp_config_connector_error_invalid_timestamp
|
||||
dpp_config_connector_error_invalid_timestamp_date
|
||||
dpp_config_connector_error_expired_1
|
||||
dpp_config_connector_error_expired_2
|
||||
dpp_config_connector_error_expired_3
|
||||
dpp_config_connector_error_expired_4
|
||||
dpp_config_connector_error_expired_6
|
||||
dpp_config_connector_error_no_groups
|
||||
dpp_config_connector_error_empty_groups
|
||||
dpp_config_connector_error_missing_group_id
|
||||
dpp_config_connector_error_missing_net_role
|
||||
dpp_config_connector_error_missing_net_access_key
|
||||
dpp_config_connector_error_net_access_key_mismatch
|
||||
dpp_akm_sha256
|
||||
dpp_akm_sha384
|
||||
dpp_akm_sha512
|
||||
dpp_network_introduction
|
||||
dpp_network_introduction_expired
|
||||
dpp_and_sae_akm
|
||||
dpp_ap_config
|
||||
dpp_ap_config_p256_p256
|
||||
dpp_ap_config_p256_p384
|
||||
dpp_ap_config_p384_p256
|
||||
dpp_ap_config_p384_p384
|
||||
dpp_ap_config_p521_p256
|
||||
dpp_ap_config_p521_p384
|
||||
dpp_ap_config_bp256_bp256
|
||||
dpp_ap_config_bp384_bp384
|
||||
dpp_ap_config_bp512_bp512
|
||||
dpp_ap_config_p256_bp256
|
||||
dpp_ap_config_bp256_p256
|
||||
dpp_ap_config_p521_bp512
|
||||
dpp_ap_config_reconfig_configurator
|
||||
dpp_auto_connect_legacy
|
||||
dpp_auto_connect_legacy_ssid_charset
|
||||
dpp_auto_connect_legacy_sae_1
|
||||
dpp_auto_connect_legacy_sae_2
|
||||
dpp_auto_connect_legacy_psk_sae_1
|
||||
dpp_auto_connect_legacy_psk_sae_2
|
||||
dpp_auto_connect_legacy_psk_sae_3
|
||||
dpp_auto_connect_legacy_pmf_required
|
||||
dpp_test_vector_p_256
|
||||
dpp_test_vector_p_256_b
|
||||
dpp_test_vector_p_521
|
||||
dpp_pkex
|
||||
dpp_pkex_v2
|
||||
dpp_pkex_p256
|
||||
dpp_pkex_p384
|
||||
dpp_pkex_p521
|
||||
dpp_pkex_bp256
|
||||
dpp_pkex_bp384
|
||||
dpp_pkex_bp512
|
||||
dpp_pkex_config
|
||||
dpp_pkex_no_identifier
|
||||
dpp_pkex_identifier_mismatch
|
||||
dpp_pkex_identifier_mismatch2
|
||||
dpp_pkex_identifier_mismatch3
|
||||
dpp_pkex_test_vector
|
||||
dpp_pkex_code_mismatch
|
||||
dpp_pkex_code_mismatch_limit
|
||||
dpp_pkex_curve_mismatch
|
||||
dpp_pkex_curve_mismatch_failure
|
||||
dpp_pkex_curve_mismatch_failure2
|
||||
dpp_pkex_exchange_resp_processing_failure
|
||||
dpp_pkex_commit_reveal_req_processing_failure
|
||||
dpp_pkex_config2
|
||||
dpp_pkex_no_responder
|
||||
dpp_pkex_after_retry
|
||||
dpp_pkex_hostapd_responder
|
||||
dpp_pkex_v2_hostapd_responder
|
||||
dpp_pkex_hostapd_initiator
|
||||
dpp_pkex_v2_hostapd_initiator
|
||||
dpp_pkex_hostapd_initiator_fallback
|
||||
dpp_pkex_hostapd_initiator_no_response
|
||||
dpp_pkex_hostapd_errors
|
||||
dpp_pkex_nak_curve_change
|
||||
dpp_pkex_nak_curve_change2
|
||||
dpp_hostapd_configurator
|
||||
dpp_hostapd_configurator_responder
|
||||
dpp_hostapd_configurator_fragmentation
|
||||
dpp_hostapd_enrollee_fragmentation
|
||||
dpp_hostapd_enrollee_gas_timeout
|
||||
dpp_hostapd_enrollee_gas_timeout_comeback
|
||||
dpp_hostapd_enrollee_gas_errors
|
||||
dpp_hostapd_enrollee_gas_proto
|
||||
dpp_hostapd_enrollee_gas_tx_status_errors
|
||||
dpp_hostapd_configurator_override_objects
|
||||
dpp_own_config
|
||||
dpp_own_config_group_id
|
||||
dpp_proto_after_wrapped_data_auth_req
|
||||
dpp_auth_req_stop_after_ack
|
||||
dpp_auth_req_retries
|
||||
dpp_auth_req_retries_multi_chan
|
||||
dpp_proto_after_wrapped_data_auth_resp
|
||||
dpp_proto_after_wrapped_data_auth_conf
|
||||
dpp_proto_after_wrapped_data_conf_req
|
||||
dpp_proto_after_wrapped_data_conf_resp
|
||||
dpp_proto_stop_at_pkex_exchange_resp
|
||||
dpp_proto_stop_at_pkex_cr_req
|
||||
dpp_proto_stop_at_pkex_cr_resp
|
||||
dpp_proto_network_introduction
|
||||
dpp_hostapd_auth_conf_timeout
|
||||
dpp_tcp
|
||||
dpp_tcp_port
|
||||
dpp_tcp_mutual
|
||||
dpp_tcp_mutual_hostapd_conf
|
||||
dpp_tcp_conf_init
|
||||
dpp_tcp_conf_init_hostapd_enrollee
|
||||
dpp_tcp_controller_management_hostapd
|
||||
dpp_tcp_controller_management_hostapd2
|
||||
dpp_tcp_controller_start_failure
|
||||
dpp_tcp_init_failure
|
||||
dpp_controller_rx_failure
|
||||
dpp_controller_rx_errors
|
||||
dpp_conn_status_success
|
||||
dpp_conn_status_wrong_passphrase
|
||||
dpp_conn_status_no_ap
|
||||
dpp_conn_status_connector_mismatch
|
||||
dpp_conn_status_assoc_reject
|
||||
dpp_conn_status_success_hostapd_configurator
|
||||
dpp_mud_url
|
||||
dpp_mud_url_hostapd
|
||||
dpp_config_save
|
||||
dpp_config_save2
|
||||
dpp_config_save3
|
||||
dpp_nfc_uri
|
||||
dpp_nfc_uri_hostapd
|
||||
dpp_nfc_uri_hostapd_tag_read
|
||||
dpp_nfc_negotiated_handover
|
||||
dpp_nfc_negotiated_handover_diff_curve
|
||||
dpp_nfc_negotiated_handover_hostapd_sel
|
||||
dpp_nfc_negotiated_handover_hostapd_req
|
||||
dpp_nfc_errors_hostapd
|
||||
dpp_with_p2p_device
|
||||
dpp_pfs_ap_0
|
||||
dpp_pfs_ap_1
|
||||
dpp_pfs_ap_2
|
||||
dpp_pfs_connect_cmd
|
||||
dpp_pfs_connect_cmd_ap_2
|
||||
dpp_pfs_connect_cmd_ap_2_sae
|
||||
dpp_pfs_ap_0_sta_ver1
|
||||
dpp_pfs_errors
|
||||
dpp_qr_code_auth_rand_mac_addr
|
||||
dpp_enterprise
|
||||
dpp_enterprise_tcp
|
||||
dpp_enterprise_tcp2
|
||||
dpp_qr_code_config_event_initiator
|
||||
dpp_qr_code_config_event_initiator_set_comeback
|
||||
dpp_qr_code_config_event_initiator_slow
|
||||
dpp_qr_code_config_event_initiator_failure
|
||||
dpp_qr_code_config_event_initiator_no_response
|
||||
dpp_qr_code_config_event_initiator_both
|
||||
dpp_tcp_qr_code_config_event_initiator
|
||||
dpp_discard_public_action
|
||||
|
||||
@@ -1,163 +0,0 @@
|
||||
#CC=ccache gcc
|
||||
|
||||
#CONFIG_TLS=openssl
|
||||
CONFIG_TLS=wolfssl
|
||||
#CONFIG_TLS=internal
|
||||
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||
|
||||
CONFIG_IEEE8021X_EAPOL=y
|
||||
|
||||
CONFIG_ERP=y
|
||||
CONFIG_EAP_MD5=y
|
||||
CONFIG_MSCHAPV2=y
|
||||
CONFIG_EAP_TLS=y
|
||||
CONFIG_EAP_PEAP=y
|
||||
CONFIG_EAP_TTLS=y
|
||||
CONFIG_EAP_GTC=y
|
||||
CONFIG_EAP_OTP=y
|
||||
CONFIG_EAP_PSK=y
|
||||
CONFIG_EAP_PAX=y
|
||||
CONFIG_EAP_LEAP=y
|
||||
CONFIG_EAP_SIM=y
|
||||
CONFIG_EAP_AKA=y
|
||||
CONFIG_EAP_AKA_PRIME=y
|
||||
CONFIG_EAP_VENDOR_TEST=y
|
||||
CONFIG_EAP_TLV=y
|
||||
CONFIG_EAP_SAKE=y
|
||||
CONFIG_EAP_GPSK=y
|
||||
CONFIG_EAP_GPSK_SHA256=y
|
||||
CONFIG_EAP_EKE=y
|
||||
CONFIG_EAP_TNC=y
|
||||
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||
LIBS += -rdynamic
|
||||
CONFIG_EAP_FAST=y
|
||||
CONFIG_EAP_TEAP=y
|
||||
CONFIG_EAP_IKEV2=y
|
||||
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
|
||||
CONFIG_USIM_SIMULATOR=y
|
||||
CONFIG_SIM_SIMULATOR=y
|
||||
|
||||
#CONFIG_PCSC=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_DRIVER_NONE=y
|
||||
CONFIG_PKCS12=y
|
||||
CONFIG_CTRL_IFACE=unix
|
||||
|
||||
CONFIG_WPA_CLI_EDIT=y
|
||||
|
||||
CONFIG_OCSP=y
|
||||
|
||||
#CONFIG_ELOOP_POLL=y
|
||||
|
||||
CONFIG_CTRL_IFACE_DBUS_NEW=y
|
||||
CONFIG_CTRL_IFACE_DBUS_INTRO=y
|
||||
|
||||
CONFIG_IEEE80211R=y
|
||||
CONFIG_IEEE80211AC=y
|
||||
CONFIG_IEEE80211AX=y
|
||||
|
||||
CONFIG_OCV=y
|
||||
|
||||
CONFIG_DEBUG_FILE=y
|
||||
|
||||
CONFIG_WPS=y
|
||||
#CONFIG_WPS_STRICT=y
|
||||
CONFIG_WPS_UPNP=y
|
||||
CONFIG_WPS_NFC=y
|
||||
CONFIG_WPS_ER=y
|
||||
#CONFIG_WPS_REG_DISABLE_OPEN=y
|
||||
|
||||
CONFIG_DRIVER_WEXT=y
|
||||
|
||||
CONFIG_DRIVER_NL80211=y
|
||||
CFLAGS += -I/usr/include/libnl3
|
||||
CONFIG_LIBNL32=y
|
||||
|
||||
CONFIG_IBSS_RSN=y
|
||||
|
||||
CONFIG_AP=y
|
||||
CONFIG_MESH=y
|
||||
CONFIG_P2P=y
|
||||
CONFIG_WIFI_DISPLAY=y
|
||||
|
||||
CONFIG_ACS=y
|
||||
|
||||
CONFIG_BGSCAN_SIMPLE=y
|
||||
CONFIG_BGSCAN_LEARN=y
|
||||
|
||||
CONFIG_WPA_TRACE=y
|
||||
CONFIG_WPA_TRACE_BFD=y
|
||||
|
||||
CONFIG_TDLS=y
|
||||
CONFIG_TDLS_TESTING=y
|
||||
CONFIG_NO_RANDOM_POOL=y
|
||||
|
||||
CONFIG_TLSV11=y
|
||||
CONFIG_TLSV12=y
|
||||
|
||||
CONFIG_HT_OVERRIDES=y
|
||||
CONFIG_VHT_OVERRIDES=y
|
||||
CONFIG_HE_OVERRIDES=y
|
||||
|
||||
CONFIG_DEBUG_LINUX_TRACING=y
|
||||
|
||||
CONFIG_INTERWORKING=y
|
||||
CONFIG_HS20=y
|
||||
|
||||
CONFIG_AUTOSCAN_EXPONENTIAL=y
|
||||
CONFIG_AUTOSCAN_PERIODIC=y
|
||||
|
||||
CONFIG_EXT_PASSWORD_TEST=y
|
||||
CONFIG_EXT_PASSWORD_FILE=y
|
||||
|
||||
CONFIG_EAP_UNAUTH_TLS=y
|
||||
|
||||
CONFIG_SAE=y
|
||||
CONFIG_SAE_PK=y
|
||||
CFLAGS += -DALL_DH_GROUPS
|
||||
|
||||
CONFIG_WNM=y
|
||||
|
||||
CONFIG_FST=y
|
||||
CONFIG_FST_TEST=y
|
||||
|
||||
CONFIG_TESTING_OPTIONS=y
|
||||
CONFIG_MODULE_TESTS=y
|
||||
|
||||
CONFIG_SUITEB=y
|
||||
|
||||
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||
# This can be used as a more efficient memory error detector than valgrind
|
||||
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||
# memory allocated for the guest).
|
||||
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_p += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
|
||||
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||
# following lines.
|
||||
#CFLAGS += -Wno-format-nonliteral
|
||||
#CFLAGS += -fsanitize=undefined
|
||||
##CFLAGS += -fno-sanitize-recover
|
||||
#LIBS += -fsanitize=undefined
|
||||
##LIBS += -fno-sanitize-recover
|
||||
#LIBS_c += -fsanitize=undefined
|
||||
#LIBS_p += -fsanitize=undefined
|
||||
CONFIG_MBO=y
|
||||
CONFIG_FILS=y
|
||||
CONFIG_FILS_SK_PFS=y
|
||||
CONFIG_PMKSA_CACHE_EXTERNAL=y
|
||||
CONFIG_OWE=y
|
||||
CONFIG_DPP=y
|
||||
CONFIG_DPP2=y
|
||||
CONFIG_WEP=y
|
||||
CONFIG_PASN=y
|
||||
@@ -1,47 +0,0 @@
|
||||
From a53a6a67dc121b45d611318e2a37815cc209839c Mon Sep 17 00:00:00 2001
|
||||
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
|
||||
Date: Fri, 19 Apr 2024 16:41:38 +0200
|
||||
Subject: [PATCH] Fixes for running tests under UML
|
||||
|
||||
- Apply commit ID fix from more recent commit
|
||||
- priv_sz and pub_sz are checked and fail on UML. Probably because stack is zeroed out.
|
||||
---
|
||||
src/crypto/crypto_wolfssl.c | 2 +-
|
||||
tests/hwsim/run-all.sh | 8 +++++++-
|
||||
2 files changed, 8 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/crypto/crypto_wolfssl.c b/src/crypto/crypto_wolfssl.c
|
||||
index 00ecf61352..a57fa50697 100644
|
||||
--- a/src/crypto/crypto_wolfssl.c
|
||||
+++ b/src/crypto/crypto_wolfssl.c
|
||||
@@ -785,7 +785,7 @@ int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len, u8 *privkey,
|
||||
int ret = -1;
|
||||
WC_RNG rng;
|
||||
DhKey *dh = NULL;
|
||||
- word32 priv_sz, pub_sz;
|
||||
+ word32 priv_sz = prime_len, pub_sz = prime_len;
|
||||
|
||||
if (TEST_FAIL())
|
||||
return -1;
|
||||
diff --git a/tests/hwsim/run-all.sh b/tests/hwsim/run-all.sh
|
||||
index ee48cd0581..75c3a58b52 100755
|
||||
--- a/tests/hwsim/run-all.sh
|
||||
+++ b/tests/hwsim/run-all.sh
|
||||
@@ -15,7 +15,13 @@ export LOGDIR
|
||||
if [ -z "$DBFILE" ]; then
|
||||
DB=""
|
||||
else
|
||||
- DB="-S $DBFILE --commit $(git rev-parse HEAD)"
|
||||
+ DB="-S $DBFILE"
|
||||
+ if [ -z "$COMMITID" ]; then
|
||||
+ COMMITID="$(git rev-parse HEAD)"
|
||||
+ fi
|
||||
+ if [ -n "$COMMITID" ]; then
|
||||
+ DB="$DB --commit $COMMITID"
|
||||
+ fi
|
||||
if [ -n "$BUILD" ]; then
|
||||
DB="$DB -b $BUILD"
|
||||
fi
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@@ -1,119 +0,0 @@
|
||||
#CC=ccache gcc
|
||||
|
||||
CONFIG_DRIVER_NONE=y
|
||||
CONFIG_DRIVER_NL80211=y
|
||||
CONFIG_RSN_PREAUTH=y
|
||||
|
||||
#CONFIG_TLS=internal
|
||||
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||
CONFIG_TLS=wolfssl
|
||||
|
||||
CONFIG_EAP=y
|
||||
CONFIG_ERP=y
|
||||
CONFIG_EAP_MD5=y
|
||||
CONFIG_EAP_TLS=y
|
||||
CONFIG_EAP_MSCHAPV2=y
|
||||
CONFIG_EAP_PEAP=y
|
||||
CONFIG_EAP_GTC=y
|
||||
CONFIG_EAP_TTLS=y
|
||||
CONFIG_EAP_SIM=y
|
||||
CONFIG_EAP_AKA=y
|
||||
CONFIG_EAP_AKA_PRIME=y
|
||||
CONFIG_EAP_GPSK=y
|
||||
CONFIG_EAP_GPSK_SHA256=y
|
||||
CONFIG_EAP_SAKE=y
|
||||
CONFIG_EAP_PAX=y
|
||||
CONFIG_EAP_PSK=y
|
||||
CONFIG_EAP_VENDOR_TEST=y
|
||||
CONFIG_EAP_FAST=y
|
||||
#CONFIG_EAP_TEAP=y
|
||||
CONFIG_EAP_IKEV2=y
|
||||
CONFIG_EAP_TNC=y
|
||||
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||
LIBS += -rdynamic
|
||||
CONFIG_EAP_UNAUTH_TLS=y
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
CONFIG_EAP_EKE=y
|
||||
CONFIG_PKCS12=y
|
||||
CONFIG_RADIUS_SERVER=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_TLSV11=y
|
||||
CONFIG_TLSV12=y
|
||||
|
||||
CONFIG_FULL_DYNAMIC_VLAN=y
|
||||
CONFIG_VLAN_NETLINK=y
|
||||
CONFIG_LIBNL32=y
|
||||
CONFIG_LIBNL3_ROUTE=y
|
||||
CONFIG_IEEE80211R=y
|
||||
CONFIG_IEEE80211AC=y
|
||||
CONFIG_IEEE80211AX=y
|
||||
|
||||
CONFIG_OCV=y
|
||||
|
||||
CONFIG_WPS=y
|
||||
CONFIG_WPS_UPNP=y
|
||||
CONFIG_WPS_NFC=y
|
||||
#CONFIG_WPS_STRICT=y
|
||||
CONFIG_WPA_TRACE=y
|
||||
CONFIG_WPA_TRACE_BFD=y
|
||||
|
||||
CONFIG_P2P_MANAGER=y
|
||||
CONFIG_DEBUG_FILE=y
|
||||
CONFIG_DEBUG_LINUX_TRACING=y
|
||||
CONFIG_WPA_CLI_EDIT=y
|
||||
CONFIG_ACS=y
|
||||
CONFIG_NO_RANDOM_POOL=y
|
||||
CONFIG_WNM=y
|
||||
CONFIG_INTERWORKING=y
|
||||
CONFIG_HS20=y
|
||||
CONFIG_SQLITE=y
|
||||
CONFIG_SAE=y
|
||||
#CONFIG_SAE_PK=y
|
||||
CFLAGS += -DALL_DH_GROUPS
|
||||
|
||||
CONFIG_FST=y
|
||||
CONFIG_FST_TEST=y
|
||||
|
||||
CONFIG_TESTING_OPTIONS=y
|
||||
CFLAGS += -DCONFIG_RADIUS_TEST
|
||||
CONFIG_MODULE_TESTS=y
|
||||
|
||||
CONFIG_SUITEB=y
|
||||
|
||||
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||
# This can be used as a more efficient memory error detector than valgrind
|
||||
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||
# memory allocated for the guest).
|
||||
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_h += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_n += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
|
||||
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||
# following lines.
|
||||
#CFLAGS += -Wno-format-nonliteral
|
||||
#CFLAGS += -fsanitize=undefined
|
||||
##CFLAGS += -fno-sanitize-recover
|
||||
#LIBS += -fsanitize=undefined
|
||||
##LIBS += -fno-sanitize-recover
|
||||
#LIBS_h += -fsanitize=undefined
|
||||
#LIBS_n += -fsanitize=undefined
|
||||
#LIBS_c += -fsanitize=undefined
|
||||
CONFIG_MBO=y
|
||||
|
||||
CONFIG_TAXONOMY=y
|
||||
CONFIG_FILS=y
|
||||
CONFIG_FILS_SK_PFS=y
|
||||
CONFIG_OWE=y
|
||||
#CONFIG_DPP=y
|
||||
#CONFIG_DPP2=y
|
||||
CONFIG_WEP=y
|
||||
CONFIG_PASN=y
|
||||
CONFIG_AIRTIME_POLICY=y
|
||||
@@ -1,270 +0,0 @@
|
||||
sae
|
||||
sae_password_ecc
|
||||
sae_pmksa_caching
|
||||
sae_pmksa_caching_pmkid
|
||||
sae_pmksa_caching_disabled
|
||||
sae_groups
|
||||
sae_group_nego
|
||||
sae_group_nego_no_match
|
||||
sae_anti_clogging
|
||||
sae_forced_anti_clogging
|
||||
sae_mixed
|
||||
sae_and_psk
|
||||
sae_and_psk2
|
||||
sae_wpa3_roam
|
||||
sae_mixed_mfp
|
||||
sae_mfp
|
||||
sae_missing_password
|
||||
sae_key_lifetime_in_memory
|
||||
sae_oom_wpas
|
||||
sae_proto_ecc
|
||||
sae_proto_ffc
|
||||
sae_proto_commit_delayed
|
||||
sae_proto_commit_replay
|
||||
sae_proto_confirm_replay
|
||||
sae_proto_hostapd
|
||||
sae_proto_hostapd_ecc
|
||||
sae_proto_hostapd_ffc
|
||||
sae_proto_hostapd_status_126
|
||||
sae_proto_hostapd_status_127
|
||||
sae_reflection_attack_ecc
|
||||
sae_reflection_attack_ecc_internal
|
||||
sae_commit_override
|
||||
sae_commit_override2
|
||||
sae_commit_invalid_scalar_element_ap
|
||||
sae_commit_invalid_element_ap
|
||||
sae_commit_invalid_scalar_element_sta
|
||||
sae_commit_invalid_element_sta
|
||||
sae_anti_clogging_proto
|
||||
sae_no_random
|
||||
sae_bignum_failure_unsafe_group
|
||||
sae_invalid_anti_clogging_token_req
|
||||
sae_password
|
||||
sae_password_short
|
||||
sae_password_long
|
||||
sae_connect_cmd
|
||||
sae_password_id
|
||||
sae_password_id_ecc
|
||||
sae_password_id_ffc
|
||||
sae_password_id_only
|
||||
sae_password_id_pwe_looping
|
||||
sae_password_id_pwe_check_ap
|
||||
sae_password_id_pwe_check_sta
|
||||
sae_forced_anti_clogging_pw_id
|
||||
sae_reauth
|
||||
sae_sync
|
||||
sae_confirm_immediate
|
||||
sae_confirm_immediate2
|
||||
sae_pwe_group_19
|
||||
sae_pwe_group_20
|
||||
sae_pwe_group_21
|
||||
sae_pwe_group_1
|
||||
sae_pwe_group_2
|
||||
sae_pwe_group_22
|
||||
sae_pwe_h2e_only_ap
|
||||
sae_pwe_h2e_only_ap_sta_forcing_loop
|
||||
sae_pwe_loop_only_ap
|
||||
sae_h2e_rejected_groups
|
||||
sae_h2e_rejected_groups_unexpected
|
||||
sae_h2e_password_id
|
||||
sae_pwe_in_psk_ap
|
||||
sae_auth_restart
|
||||
sae_rsne_mismatch
|
||||
sae_h2e_rsnxe_mismatch
|
||||
sae_h2e_rsnxe_mismatch_retries
|
||||
sae_h2e_rsnxe_mismatch_assoc
|
||||
sae_h2e_rsnxe_mismatch_ap
|
||||
sae_h2e_rsnxe_mismatch_ap2
|
||||
sae_h2e_rsnxe_mismatch_ap3
|
||||
sae_forced_anti_clogging_h2e
|
||||
sae_forced_anti_clogging_h2e_loop
|
||||
sae_okc
|
||||
sae_okc_sta_only
|
||||
sae_okc_pmk_lifetime
|
||||
sae_pmk_lifetime
|
||||
sae_and_psk_multiple_passwords
|
||||
sae_pmf_roam
|
||||
sae_ocv_pmk
|
||||
sae_ocv_pmk_failure
|
||||
sae_reject
|
||||
eap_tls_pkcs8_pkcs5_v2_des3
|
||||
eap_tls_pkcs8_pkcs5_v15
|
||||
eap_tls_sha512
|
||||
eap_tls_sha384
|
||||
eap_tls_errors
|
||||
eap_proto_peap_errors_server
|
||||
eap_proto_peap_errors
|
||||
ap_wpa2_delayed_m3_retransmission
|
||||
ap_wpa2_delayed_m1_m3_retransmission
|
||||
ap_wpa2_delayed_m1_m3_retransmission2
|
||||
ap_wpa2_delayed_group_m1_retransmission
|
||||
ap_wpa2_delayed_group_m1_retransmission_igtk
|
||||
ap_wpa2_delayed_m1_m3_zero_tk
|
||||
ap_wpa2_plaintext_m1_m3
|
||||
ap_wpa2_plaintext_m1_m3_pmf
|
||||
ap_wpa2_plaintext_m3
|
||||
ap_wpa2_plaintext_group_m1
|
||||
ap_wpa2_plaintext_group_m1_pmf
|
||||
ap_wpa2_test_command_failures
|
||||
ap_wpa2_gtk_initial_rsc_tkip
|
||||
ap_wpa2_gtk_initial_rsc_ccmp
|
||||
ap_wpa2_gtk_initial_rsc_ccmp_256
|
||||
ap_wpa2_gtk_initial_rsc_gcmp
|
||||
ap_wpa2_gtk_initial_rsc_gcmp_256
|
||||
ap_wpa2_igtk_initial_rsc_aes_128_cmac
|
||||
ap_wpa2_igtk_initial_rsc_bip_gmac_128
|
||||
ap_wpa2_igtk_initial_rsc_bip_gmac_256
|
||||
ap_wpa2_igtk_initial_rsc_bip_cmac_256
|
||||
ap_wpa2_psk
|
||||
ap_wpa2_psk_file
|
||||
ap_wpa2_psk_file_keyid
|
||||
ap_wpa2_psk_mem
|
||||
ap_wpa2_ptk_rekey
|
||||
ap_wpa2_ptk_rekey_blocked_ap
|
||||
ap_wpa2_ptk_rekey_blocked_sta
|
||||
ap_wpa2_ptk_rekey_anonce
|
||||
ap_wpa2_ptk_rekey_ap
|
||||
ap_wpa2_sha256_ptk_rekey
|
||||
ap_wpa2_sha256_ptk_rekey_ap
|
||||
ap_wpa2_psk_file_errors
|
||||
ap_wpa2_psk_wildcard_ssid
|
||||
ap_wpa2_gtk_rekey
|
||||
ap_wpa2_gtk_rekey_request
|
||||
ap_wpa2_gtk_rekey_failure
|
||||
ap_wpa2_gmk_rekey
|
||||
ap_wpa2_strict_rekey
|
||||
ap_wpa2_psk_ext
|
||||
ap_wpa2_psk_unexpected
|
||||
ap_wpa2_psk_ext_retry_msg_3
|
||||
ap_wpa2_psk_ext_retry_msg_3b
|
||||
ap_wpa2_psk_ext_retry_msg_3c
|
||||
ap_wpa2_psk_ext_retry_msg_3d
|
||||
ap_wpa2_psk_ext_retry_msg_3e
|
||||
ap_wpa2_psk_ext_delayed_ptk_rekey
|
||||
ap_wpa2_psk_ext_eapol
|
||||
ap_wpa2_psk_ext_eapol_retry1
|
||||
ap_wpa2_psk_ext_eapol_retry1b
|
||||
ap_wpa2_psk_ext_eapol_retry1c
|
||||
ap_wpa2_psk_ext_eapol_retry1d
|
||||
ap_wpa2_psk_ext_eapol_type_diff
|
||||
ap_wpa2_psk_ext_eapol_key_info
|
||||
ap_wpa2_psk_wep
|
||||
ap_wpa2_psk_ifdown
|
||||
ap_wpa2_psk_drop_first_msg_4
|
||||
ap_wpa2_psk_disable_enable
|
||||
ap_wpa2_psk_incorrect_passphrase
|
||||
ap_wpa2_psk_no_random
|
||||
ap_wpa2_psk_assoc_rsn
|
||||
ap_wpa2_psk_ft_workaround
|
||||
ap_wpa2_psk_assoc_rsn_pmkid
|
||||
ap_wpa2_eapol_retry_limit
|
||||
ap_wpa2_disable_eapol_retry
|
||||
ap_wpa2_disable_eapol_retry_group
|
||||
ap_wpa2_psk_mic_0
|
||||
ap_wpa2_psk_local_error
|
||||
ap_wpa2_psk_inject_assoc
|
||||
ap_wpa2_psk_ap_control_port
|
||||
ap_wpa2_psk_ap_control_port_disabled
|
||||
ap_wpa2_psk_rsne_mismatch_ap
|
||||
ap_wpa2_psk_rsne_mismatch_ap2
|
||||
ap_wpa2_psk_rsne_mismatch_ap3
|
||||
ap_wpa2_psk_rsnxe_mismatch_ap
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_ap0
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_ap1
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_ap2
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_sta0
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_sta1
|
||||
ap_wpa2_psk_ext_key_id_ptk_rekey_sta2
|
||||
ap_wpa2_eap_sim
|
||||
ap_wpa2_eap_sim_sql
|
||||
ap_wpa2_eap_sim_config
|
||||
ap_wpa2_eap_sim_id_0
|
||||
ap_wpa2_eap_sim_id_1
|
||||
ap_wpa2_eap_sim_id_2
|
||||
ap_wpa2_eap_sim_id_3
|
||||
ap_wpa2_eap_sim_ext
|
||||
ap_wpa2_eap_sim_ext_replace_sim
|
||||
ap_wpa2_eap_sim_ext_replace_sim2
|
||||
ap_wpa2_eap_sim_ext_replace_sim3
|
||||
ap_wpa2_eap_sim_ext_auth_fail
|
||||
ap_wpa2_eap_sim_change_bssid
|
||||
ap_wpa2_eap_sim_no_change_set
|
||||
ap_wpa2_eap_sim_ext_anonymous
|
||||
ap_wpa2_eap_sim_ext_anonymous_no_pseudonym
|
||||
ap_wpa2_eap_sim_oom
|
||||
ap_wpa2_eap_aka
|
||||
ap_wpa2_eap_aka_sql
|
||||
ap_wpa2_eap_aka_config
|
||||
ap_wpa2_eap_aka_ext
|
||||
ap_wpa2_eap_aka_ext_auth_fail
|
||||
ap_wpa2_eap_aka_prime
|
||||
ap_wpa2_eap_aka_prime_sql
|
||||
ap_wpa2_eap_aka_prime_ext_auth_fail
|
||||
ap_wpa2_eap_aka_prime_ext
|
||||
ap_wpa2_eap_ttls_invalid_phase2
|
||||
ap_wpa2_eap_ttls_eap_vendor
|
||||
ap_wpa2_eap_fast_eap_sim
|
||||
ap_wpa2_eap_fast_eap_aka
|
||||
ap_wpa2_eap_peap_params
|
||||
ap_wpa2_eap_peap_eap_gtc
|
||||
ap_wpa2_eap_peap_eap_vendor
|
||||
ap_wpa2_eap_ttls_server_cert_hash
|
||||
ap_wpa2_eap_ttls_server_cert_hash_invalid
|
||||
ap_wpa2_eap_pwd
|
||||
ap_wpa2_eap_pwd_nthash
|
||||
ap_wpa2_eap_pwd_salt_sha1
|
||||
ap_wpa2_eap_pwd_salt_sha256
|
||||
ap_wpa2_eap_pwd_salt_sha512
|
||||
ap_wpa2_eap_pwd_groups
|
||||
ap_wpa2_eap_pwd_invalid_group
|
||||
ap_wpa2_eap_pwd_disabled_group
|
||||
ap_wpa2_eap_pwd_as_frag
|
||||
ap_wpa2_eap_gpsk
|
||||
ap_wpa2_eap_sake
|
||||
ap_wpa2_eap_ikev2
|
||||
ap_wpa2_eap_ikev2_as_frag
|
||||
ap_wpa2_eap_ikev2_oom
|
||||
ap_wpa2_eap_pax
|
||||
ap_wpa2_eap_psk
|
||||
ap_wpa2_eap_psk_oom
|
||||
ap_wpa2_eap_interactive
|
||||
ap_wpa2_eap_ext_enable_network_while_connected
|
||||
ap_wpa2_eap_vendor_test
|
||||
ap_wpa2_eap_vendor_test_oom
|
||||
ap_wpa2_eap_ttls_ocsp_revoked
|
||||
ap_wpa2_eap_ttls_ocsp_unknown
|
||||
ap_wpa2_eap_ttls_optional_ocsp_unknown
|
||||
ap_wpa2_eap_ttls_long_duration
|
||||
ap_wpa2_eap_ttls_server_cert_eku_client
|
||||
ap_wpa2_eap_ttls_server_cert_eku_client_server
|
||||
ap_wpa2_eap_ttls_dh_params
|
||||
ap_wpa2_eap_ttls_dh_params_dsa
|
||||
ap_wpa2_eap_ttls_dh_params_not_found
|
||||
ap_wpa2_eap_ttls_dh_params_invalid
|
||||
ap_wpa2_eap_ttls_dh_params_blob
|
||||
ap_wpa2_eap_ttls_dh_params_server
|
||||
ap_wpa2_eap_ttls_dh_params_dsa_server
|
||||
ap_wpa2_eap_reauth
|
||||
ap_wpa2_eap_reauth_ptk_rekey_blocked_sta
|
||||
ap_wpa2_eap_request_identity_message
|
||||
ap_wpa2_eap_sim_aka_result_ind
|
||||
ap_wpa2_eap_sim_zero_db_timeout
|
||||
ap_wpa2_eap_too_many_roundtrips
|
||||
ap_wpa2_eap_too_many_roundtrips_server
|
||||
ap_wpa2_eap_too_many_roundtrips_server2
|
||||
ap_wpa2_eap_expanded_nak
|
||||
ap_wpa2_eap_sql
|
||||
ap_wpa2_eap_non_ascii_identity
|
||||
ap_wpa2_eap_non_ascii_identity2
|
||||
ap_wpa2_eap_unexpected_wep_eapol_key
|
||||
ap_wpa2_eap_oom
|
||||
ap_wpa2_eap_sim_db
|
||||
ap_wpa2_eap_sim_db_sqlite
|
||||
ap_wpa2_eap_assoc_rsn
|
||||
ap_wpa2_eap_status
|
||||
ap_wpa2_eap_gpsk_ptk_rekey_ap
|
||||
ap_wpa2_eap_wildcard_ssid
|
||||
ap_wpa2_eap_psk_mac_addr_change
|
||||
ap_wpa2_eap_server_get_id
|
||||
ap_wpa2_radius_server_get_id
|
||||
ap_wpa2_eap_sake_no_control_port
|
||||
@@ -1,163 +0,0 @@
|
||||
#CC=ccache gcc
|
||||
|
||||
#CONFIG_TLS=openssl
|
||||
CONFIG_TLS=wolfssl
|
||||
#CONFIG_TLS=internal
|
||||
#CONFIG_INTERNAL_LIBTOMMATH=y
|
||||
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
||||
|
||||
CONFIG_IEEE8021X_EAPOL=y
|
||||
|
||||
CONFIG_ERP=y
|
||||
CONFIG_EAP_MD5=y
|
||||
CONFIG_MSCHAPV2=y
|
||||
CONFIG_EAP_TLS=y
|
||||
CONFIG_EAP_PEAP=y
|
||||
CONFIG_EAP_TTLS=y
|
||||
CONFIG_EAP_GTC=y
|
||||
CONFIG_EAP_OTP=y
|
||||
CONFIG_EAP_PSK=y
|
||||
CONFIG_EAP_PAX=y
|
||||
CONFIG_EAP_LEAP=y
|
||||
CONFIG_EAP_SIM=y
|
||||
CONFIG_EAP_AKA=y
|
||||
CONFIG_EAP_AKA_PRIME=y
|
||||
CONFIG_EAP_VENDOR_TEST=y
|
||||
CONFIG_EAP_TLV=y
|
||||
CONFIG_EAP_SAKE=y
|
||||
CONFIG_EAP_GPSK=y
|
||||
CONFIG_EAP_GPSK_SHA256=y
|
||||
CONFIG_EAP_EKE=y
|
||||
CONFIG_EAP_TNC=y
|
||||
CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
|
||||
LIBS += -rdynamic
|
||||
CONFIG_EAP_FAST=y
|
||||
#CONFIG_EAP_TEAP=y
|
||||
CONFIG_EAP_IKEV2=y
|
||||
|
||||
ifeq ($(CONFIG_TLS), wolfssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
ifeq ($(CONFIG_TLS), openssl)
|
||||
CONFIG_EAP_PWD=y
|
||||
endif
|
||||
|
||||
CONFIG_USIM_SIMULATOR=y
|
||||
CONFIG_SIM_SIMULATOR=y
|
||||
|
||||
#CONFIG_PCSC=y
|
||||
CONFIG_IPV6=y
|
||||
CONFIG_DRIVER_NONE=y
|
||||
CONFIG_PKCS12=y
|
||||
CONFIG_CTRL_IFACE=unix
|
||||
|
||||
CONFIG_WPA_CLI_EDIT=y
|
||||
|
||||
CONFIG_OCSP=y
|
||||
|
||||
#CONFIG_ELOOP_POLL=y
|
||||
|
||||
CONFIG_CTRL_IFACE_DBUS_NEW=y
|
||||
CONFIG_CTRL_IFACE_DBUS_INTRO=y
|
||||
|
||||
CONFIG_IEEE80211R=y
|
||||
CONFIG_IEEE80211AC=y
|
||||
CONFIG_IEEE80211AX=y
|
||||
|
||||
CONFIG_OCV=y
|
||||
|
||||
CONFIG_DEBUG_FILE=y
|
||||
|
||||
CONFIG_WPS=y
|
||||
#CONFIG_WPS_STRICT=y
|
||||
CONFIG_WPS_UPNP=y
|
||||
CONFIG_WPS_NFC=y
|
||||
CONFIG_WPS_ER=y
|
||||
#CONFIG_WPS_REG_DISABLE_OPEN=y
|
||||
|
||||
CONFIG_DRIVER_WEXT=y
|
||||
|
||||
CONFIG_DRIVER_NL80211=y
|
||||
CFLAGS += -I/usr/include/libnl3
|
||||
CONFIG_LIBNL32=y
|
||||
|
||||
CONFIG_IBSS_RSN=y
|
||||
|
||||
CONFIG_AP=y
|
||||
CONFIG_MESH=y
|
||||
CONFIG_P2P=y
|
||||
CONFIG_WIFI_DISPLAY=y
|
||||
|
||||
CONFIG_ACS=y
|
||||
|
||||
CONFIG_BGSCAN_SIMPLE=y
|
||||
CONFIG_BGSCAN_LEARN=y
|
||||
|
||||
CONFIG_WPA_TRACE=y
|
||||
CONFIG_WPA_TRACE_BFD=y
|
||||
|
||||
CONFIG_TDLS=y
|
||||
CONFIG_TDLS_TESTING=y
|
||||
CONFIG_NO_RANDOM_POOL=y
|
||||
|
||||
CONFIG_TLSV11=y
|
||||
CONFIG_TLSV12=y
|
||||
|
||||
CONFIG_HT_OVERRIDES=y
|
||||
CONFIG_VHT_OVERRIDES=y
|
||||
CONFIG_HE_OVERRIDES=y
|
||||
|
||||
CONFIG_DEBUG_LINUX_TRACING=y
|
||||
|
||||
CONFIG_INTERWORKING=y
|
||||
CONFIG_HS20=y
|
||||
|
||||
CONFIG_AUTOSCAN_EXPONENTIAL=y
|
||||
CONFIG_AUTOSCAN_PERIODIC=y
|
||||
|
||||
CONFIG_EXT_PASSWORD_TEST=y
|
||||
CONFIG_EXT_PASSWORD_FILE=y
|
||||
|
||||
CONFIG_EAP_UNAUTH_TLS=y
|
||||
|
||||
CONFIG_SAE=y
|
||||
#CONFIG_SAE_PK=y
|
||||
CFLAGS += -DALL_DH_GROUPS
|
||||
|
||||
CONFIG_WNM=y
|
||||
|
||||
CONFIG_FST=y
|
||||
CONFIG_FST_TEST=y
|
||||
|
||||
CONFIG_TESTING_OPTIONS=y
|
||||
CONFIG_MODULE_TESTS=y
|
||||
|
||||
CONFIG_SUITEB=y
|
||||
|
||||
# AddressSanitizer (ASan) can be enabled by uncommenting the following lines.
|
||||
# This can be used as a more efficient memory error detector than valgrind
|
||||
# (though, with still some CPU and memory cost, so VM cases will need more
|
||||
# memory allocated for the guest).
|
||||
#CFLAGS += -fsanitize=address -O1 -fno-omit-frame-pointer -g
|
||||
#LIBS += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_c += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
#LIBS_p += -fsanitize=address -fno-omit-frame-pointer -g
|
||||
|
||||
# Undefined Behavior Sanitizer (UBSan) can be enabled by uncommenting the
|
||||
# following lines.
|
||||
#CFLAGS += -Wno-format-nonliteral
|
||||
#CFLAGS += -fsanitize=undefined
|
||||
##CFLAGS += -fno-sanitize-recover
|
||||
#LIBS += -fsanitize=undefined
|
||||
##LIBS += -fno-sanitize-recover
|
||||
#LIBS_c += -fsanitize=undefined
|
||||
#LIBS_p += -fsanitize=undefined
|
||||
CONFIG_MBO=y
|
||||
CONFIG_FILS=y
|
||||
CONFIG_FILS_SK_PFS=y
|
||||
CONFIG_PMKSA_CACHE_EXTERNAL=y
|
||||
CONFIG_OWE=y
|
||||
#CONFIG_DPP=y
|
||||
#CONFIG_DPP2=y
|
||||
CONFIG_WEP=y
|
||||
CONFIG_PASN=y
|
||||
@@ -1,23 +0,0 @@
|
||||
<!DOCTYPE busconfig PUBLIC
|
||||
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
|
||||
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
|
||||
<busconfig>
|
||||
<policy user="root">
|
||||
<allow own="fi.epitest.hostap.WPASupplicant"/>
|
||||
<allow send_destination="fi.epitest.hostap.WPASupplicant"/>
|
||||
<allow send_interface="fi.epitest.hostap.WPASupplicant"/>
|
||||
<allow own="fi.w1.wpa_supplicant1"/>
|
||||
<allow send_destination="fi.w1.wpa_supplicant1"/>
|
||||
<allow send_interface="fi.w1.wpa_supplicant1"/>
|
||||
<allow receive_sender="fi.w1.wpa_supplicant1" receive_type="signal"/>
|
||||
</policy>
|
||||
<policy context="default">
|
||||
<deny own="fi.epitest.hostap.WPASupplicant"/>
|
||||
<deny send_destination="fi.epitest.hostap.WPASupplicant"/>
|
||||
<deny send_interface="fi.epitest.hostap.WPASupplicant"/>
|
||||
<deny own="fi.w1.wpa_supplicant1"/>
|
||||
<deny send_destination="fi.w1.wpa_supplicant1"/>
|
||||
<deny send_interface="fi.w1.wpa_supplicant1"/>
|
||||
<deny receive_sender="fi.w1.wpa_supplicant1" receive_type="signal"/>
|
||||
</policy>
|
||||
</busconfig>
|
||||
313
.github/workflows/hostap-vm.yml
vendored
313
.github/workflows/hostap-vm.yml
vendored
@@ -1,313 +0,0 @@
|
||||
name: hostap and wpa-supplicant Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
env:
|
||||
LINUX_REF: v6.6
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
strategy:
|
||||
matrix:
|
||||
include:
|
||||
- build_id: hostap-vm-build1
|
||||
wolf_extra_config: --disable-tls13
|
||||
- build_id: hostap-vm-build2
|
||||
wolf_extra_config: >-
|
||||
--enable-wpas-dpp --enable-brainpool --with-eccminsz=192
|
||||
--enable-tlsv10 --enable-oldtls
|
||||
name: Build wolfSSL
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
# No way to view the full strategy in the browser (really weird)
|
||||
- name: Print strategy
|
||||
run: |
|
||||
cat <<EOF
|
||||
${{ toJSON(matrix) }}
|
||||
EOF
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Enable wolfSSL debug logging
|
||||
run: |
|
||||
echo "wolf_debug_flags=--enable-debug" >> $GITHUB_ENV
|
||||
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: >-
|
||||
--enable-wpas CPPFLAGS=-DWOLFSSL_STATIC_RSA
|
||||
${{ env.wolf_debug_flags }} ${{ matrix.wolf_extra_config }}
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ${{ matrix.build_id }}
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
build_uml_linux:
|
||||
name: Build UML (UserMode Linux)
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- name: Checking if we have kernel in cache
|
||||
uses: actions/cache@v4
|
||||
id: cache
|
||||
with:
|
||||
path: linux/linux
|
||||
key: ${{ env.LINUX_REF }}
|
||||
lookup-only: true
|
||||
|
||||
- name: Checkout hostap
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: julek-wolfssl/hostap-mirror
|
||||
path: hostap
|
||||
|
||||
- name: Checkout linux
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: torvalds/linux
|
||||
path: linux
|
||||
|
||||
- name: Compile linux
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
run: |
|
||||
cp hostap/tests/hwsim/vm/kernel-config.uml linux/.config
|
||||
cd linux
|
||||
yes "" | ARCH=um make -j $(nproc)
|
||||
|
||||
hostap_test:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# should hostapd be compiled with wolfssl
|
||||
hostapd: [true, false]
|
||||
# should wpa_supplicant be compiled with wolfssl
|
||||
wpa_supplicant: [true, false]
|
||||
# Fix the versions of hostap and osp to not break testing when a new
|
||||
# patch is added in to osp. Tests are read from the corresponding
|
||||
# configs/hostap_ref/tests file.
|
||||
config: [
|
||||
{
|
||||
hostap_ref: hostap_2_10,
|
||||
remove_teap: true,
|
||||
# TLS 1.3 does not work for this version
|
||||
build_id: hostap-vm-build1,
|
||||
},
|
||||
# Test the dpp patch
|
||||
{
|
||||
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
|
||||
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
|
||||
build_id: hostap-vm-build2
|
||||
},
|
||||
{
|
||||
hostap_ref: 07c9f183ea744ac04585fb6dd10220c75a5e2e74,
|
||||
osp_ref: e1876fbbf298ee442bc7ab8561331ebc7de17528,
|
||||
build_id: hostap-vm-build2
|
||||
},
|
||||
]
|
||||
exclude:
|
||||
# don't test openssl on both sides
|
||||
- hostapd: false
|
||||
wpa_supplicant: false
|
||||
# no hostapd support for dpp yet
|
||||
- hostapd: true
|
||||
config: {
|
||||
hostap_ref: b607d2723e927a3446d89aed813f1aa6068186bb,
|
||||
osp_ref: ad5b52a49b3cc2a5bfb47ccc1d6a5137132e9446,
|
||||
build_id: hostap-vm-build2
|
||||
}
|
||||
name: hwsim test
|
||||
# For openssl 1.1
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 45
|
||||
needs: [build_wolfssl, build_uml_linux]
|
||||
steps:
|
||||
- name: Checking if we have kernel in cache
|
||||
uses: actions/cache/restore@v4
|
||||
id: cache
|
||||
with:
|
||||
path: linux/linux
|
||||
key: ${{ env.LINUX_REF }}
|
||||
fail-on-cache-miss: true
|
||||
|
||||
- name: show file structure
|
||||
run: tree
|
||||
|
||||
# No way to view the full strategy in the browser (really weird)
|
||||
- name: Print strategy
|
||||
run: |
|
||||
cat <<EOF
|
||||
${{ toJSON(matrix) }}
|
||||
EOF
|
||||
|
||||
- name: Print computed job run ID
|
||||
run: |
|
||||
SHA_SUM=$(sha256sum << 'END_OF_HEREDOC' | cut -d " " -f 1
|
||||
${{ toJSON(github) }}
|
||||
END_OF_HEREDOC
|
||||
)
|
||||
echo "our_job_run_id=$SHA_SUM" >> $GITHUB_ENV
|
||||
echo Our job run ID is $SHA_SUM
|
||||
|
||||
- name: Checkout wolfSSL
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
path: wolfssl
|
||||
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: ${{ matrix.config.build_id }}
|
||||
path: build-dir
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
# Don't prompt for anything
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
sudo apt-get update
|
||||
# hostap dependencies
|
||||
sudo apt-get install -y libpcap0.8 libpcap-dev curl libcurl4-openssl-dev \
|
||||
libnl-3-dev binutils-dev libssl-dev libiberty-dev libnl-genl-3-dev \
|
||||
libnl-route-3-dev libdbus-1-dev bridge-utils tshark
|
||||
sudo pip3 install pycryptodome
|
||||
|
||||
- name: Checkout hostap
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: julek-wolfssl/hostap-mirror
|
||||
path: hostap
|
||||
ref: ${{ matrix.config.hostap_ref }}
|
||||
|
||||
- name: Update certs
|
||||
working-directory: hostap/tests/hwsim/auth_serv
|
||||
run: ./update.sh
|
||||
|
||||
- if: ${{ matrix.config.osp_ref }}
|
||||
name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
ref: ${{ matrix.config.osp_ref }}
|
||||
|
||||
- if: ${{ matrix.config.osp_ref }}
|
||||
name: Apply patch files
|
||||
working-directory: hostap
|
||||
run: |
|
||||
for f in $GITHUB_WORKSPACE/osp/hostap-patches/pending/*
|
||||
do
|
||||
patch -p1 < $f
|
||||
done
|
||||
|
||||
- name: Apply extra patches
|
||||
working-directory: hostap
|
||||
run: |
|
||||
FILE=$GITHUB_WORKSPACE/wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/extra.patch
|
||||
if [ -f "$FILE" ]; then
|
||||
patch -p1 < $FILE
|
||||
fi
|
||||
|
||||
- if: ${{ matrix.hostapd }}
|
||||
name: Setup hostapd config file
|
||||
run: |
|
||||
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/hostapd.config \
|
||||
hostap/hostapd/.config
|
||||
cat <<EOF >> hostap/hostapd/.config
|
||||
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
EOF
|
||||
|
||||
- if: ${{ matrix.wpa_supplicant }}
|
||||
name: Setup wpa_supplicant config file
|
||||
run: |
|
||||
cp wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/wpa_supplicant.config \
|
||||
hostap/wpa_supplicant/.config
|
||||
cat <<EOF >> hostap/wpa_supplicant/.config
|
||||
CFLAGS += -I$GITHUB_WORKSPACE/build-dir/include -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
LIBS += -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib
|
||||
EOF
|
||||
|
||||
- name: Build hostap and wpa_supplicant
|
||||
working-directory: hostap/tests/hwsim/
|
||||
run: ./build.sh
|
||||
|
||||
- if: ${{ matrix.hostapd }}
|
||||
name: Confirm hostapd linking with wolfSSL
|
||||
run: ldd hostap/hostapd/hostapd | grep wolfssl
|
||||
|
||||
- if: ${{ matrix.wpa_supplicant }}
|
||||
name: Confirm wpa_supplicant linking with wolfSSL
|
||||
run: ldd hostap/wpa_supplicant/wpa_supplicant | grep wolfssl
|
||||
|
||||
- if: ${{ matrix.config.remove_teap }}
|
||||
name: Remove EAP-TEAP from test configuration
|
||||
working-directory: hostap/tests/hwsim/auth_serv
|
||||
run: |
|
||||
sed -e 's/"erp-teap@example.com"\tTEAP//' -i eap_user.conf
|
||||
sed -e 's/"erp-teap@example.com"\tMSCHAPV2\t"password"\t\[2\]//' -i eap_user.conf
|
||||
sed -e 's/"TEAP"\t\tTEAP//' -i eap_user.conf
|
||||
sed -e 's/TEAP,//' -i eap_user.conf
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Enable hostap debug logging
|
||||
run: |
|
||||
echo "hostap_debug_flags=--debug" >> $GITHUB_ENV
|
||||
|
||||
- name: Run tests
|
||||
id: testing
|
||||
working-directory: hostap/tests/hwsim/
|
||||
run: |
|
||||
cat <<EOF >> vm/vm-config
|
||||
KERNELDIR=$GITHUB_WORKSPACE/linux
|
||||
KVMARGS="-cpu host"
|
||||
EOF
|
||||
# Run tests in increments of 200 to not stall out the parallel-vm script
|
||||
while mapfile -t -n 200 ary && ((${#ary[@]})); do
|
||||
TESTS=$(printf '%s\n' "${ary[@]}" | tr '\n' ' ')
|
||||
HWSIM_RES=0 # Not set when command succeeds
|
||||
./vm/parallel-vm.py ${{ env.hostap_debug_flags }} --nocurses $(nproc) $TESTS || HWSIM_RES=$?
|
||||
if [ "$HWSIM_RES" -ne "0" ]; then
|
||||
# Let's re-run the failing tests. We gather the failed tests from the log file.
|
||||
FAILED_TESTS=$(grep 'failed tests' /tmp/hwsim-test-logs/*-parallel.log | sed 's/failed tests: //' | tr ' ' '\n' | sort | uniq | tr '\n' ' ')
|
||||
printf 'failed tests: %s\n' "$FAILED_TESTS"
|
||||
./vm/parallel-vm.py ${{ env.hostap_debug_flags }} --nocurses $(nproc) $FAILED_TESTS
|
||||
fi
|
||||
rm -r /tmp/hwsim-test-logs
|
||||
done < $GITHUB_WORKSPACE/wolfssl/.github/workflows/hostap-files/configs/${{ matrix.config.hostap_ref }}/tests
|
||||
|
||||
# The logs are quite big. It hasn't been useful so far so let's not waste
|
||||
# precious gh space.
|
||||
#- name: zip logs
|
||||
# if: ${{ failure() && steps.testing.outcome == 'failure' }}
|
||||
# working-directory: hostap/tests/hwsim/
|
||||
# run: |
|
||||
# rm /tmp/hwsim-test-logs/latest
|
||||
# zip -9 -r logs.zip /tmp/hwsim-test-logs
|
||||
#
|
||||
#- name: Upload failure logs
|
||||
# if: ${{ failure() && steps.testing.outcome == 'failure' }}
|
||||
# uses: actions/upload-artifact@v4
|
||||
# with:
|
||||
# name: hostap-logs-${{ env.our_job_run_id }}
|
||||
# path: hostap/tests/hwsim/logs.zip
|
||||
# retention-days: 5
|
||||
96
.github/workflows/krb5.yml
vendored
96
.github/workflows/krb5.yml
vendored
@@ -1,96 +0,0 @@
|
||||
name: Kerberos 5 Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- name: workaround high-entropy ASLR
|
||||
# not needed after either an update to llvm or runner is done
|
||||
run: sudo sysctl vm.mmap_rnd_bits=28
|
||||
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-krb CC='gcc -fsanitize=address'
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-krb5
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
krb5_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# List of releases to test
|
||||
ref: [ 1.21.1 ]
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 8
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-krb5
|
||||
path: build-dir
|
||||
|
||||
- name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
|
||||
- name: Checkout krb5
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: krb5/krb5
|
||||
ref: krb5-${{ matrix.ref }}-final
|
||||
path: krb5
|
||||
|
||||
- name: Apply patch
|
||||
working-directory: ./krb5
|
||||
run: |
|
||||
patch -p1 < $GITHUB_WORKSPACE/osp/krb5/Patch-for-Kerberos-5-${{ matrix.ref }}.patch
|
||||
|
||||
- name: workaround high-entropy ASLR
|
||||
# not needed after either an update to llvm or runner is done
|
||||
run: sudo sysctl vm.mmap_rnd_bits=28
|
||||
|
||||
- name: Build krb5
|
||||
working-directory: ./krb5/src
|
||||
run: |
|
||||
autoreconf -ivf
|
||||
# Using rpath because LD_LIBRARY_PATH is overwritten during testing
|
||||
export WOLFSSL_CFLAGS="-I$GITHUB_WORKSPACE/build-dir/include -I$GITHUB_WORKSPACE/build-dir/include/wolfssl -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib"
|
||||
export WOLFSSL_LIBS="-lwolfssl -L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath=$GITHUB_WORKSPACE/build-dir/lib"
|
||||
./configure --with-crypto-impl=wolfssl --with-tls-impl=wolfssl --disable-pkinit \
|
||||
CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address'
|
||||
CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address' make -j
|
||||
|
||||
- name: Run tests
|
||||
working-directory: ./krb5/src
|
||||
run: |
|
||||
CFLAGS='-fsanitize=address' LDFLAGS='-fsanitize=address' make -j check
|
||||
|
||||
67
.github/workflows/libssh2.yml
vendored
67
.github/workflows/libssh2.yml
vendored
@@ -1,67 +0,0 @@
|
||||
name: libssh2 Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-all
|
||||
check: false # config is already tested in many other PRB's
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-libssh2
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
libssh2_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# List of releases to test
|
||||
ref: [ 1.11.0 ]
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 8
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-libssh2
|
||||
path: build-dir
|
||||
|
||||
- name: Build and test libssh2
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
repository: libssh2/libssh2
|
||||
ref: libssh2-${{ matrix.ref }}
|
||||
path: libssh2
|
||||
configure: --with-crypto=wolfssl --with-libwolfssl-prefix=$GITHUB_WORKSPACE/build-dir
|
||||
check: true
|
||||
|
||||
- name: Confirm libssh2 built with wolfSSL
|
||||
working-directory: ./libssh2
|
||||
run: ldd src/.libs/libssh2.so | grep wolfssl
|
||||
28
.github/workflows/macos-check.yml
vendored
Normal file
28
.github/workflows/macos-check.yml
vendored
Normal file
@@ -0,0 +1,28 @@
|
||||
name: macOS Build Test
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ '*' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
jobs:
|
||||
build:
|
||||
|
||||
runs-on: macos-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- name: brew
|
||||
run: brew install automake libtool
|
||||
- name: autogen
|
||||
run: ./autogen.sh
|
||||
- name: configure
|
||||
run: ./configure
|
||||
- name: make
|
||||
run: make
|
||||
- name: make check
|
||||
run: make check
|
||||
- name: make distcheck
|
||||
run: make distcheck
|
||||
|
||||
14
.github/workflows/memcached.sh
vendored
14
.github/workflows/memcached.sh
vendored
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
if [ -z "$GITHUB_WORKSPACE" ]; then
|
||||
echo '$GITHUB_WORKSPACE is not set'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$HOST_ROOT" ]; then
|
||||
echo '$HOST_ROOT is not set'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
chroot $HOST_ROOT make -C $GITHUB_WORKSPACE/memcached \
|
||||
-j$(nproc) PARALLEL=$(nproc) test_tls
|
||||
116
.github/workflows/memcached.yml
vendored
116
.github/workflows/memcached.yml
vendored
@@ -1,116 +0,0 @@
|
||||
name: memcached Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-memcached
|
||||
install: true
|
||||
|
||||
- name: Bundle Docker entry point
|
||||
run: cp wolfssl/.github/workflows/memcached.sh build-dir/bin
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-memcached
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
memcached_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# List of releases to test
|
||||
include:
|
||||
- ref: 1.6.22
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-memcached
|
||||
path: build-dir
|
||||
|
||||
- name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y libevent-dev libevent-2.1-7 automake pkg-config make libio-socket-ssl-perl
|
||||
|
||||
- name: Checkout memcached
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: memcached/memcached
|
||||
ref: 1.6.22
|
||||
path: memcached
|
||||
|
||||
- name: Configure and build memcached
|
||||
run: |
|
||||
cd $GITHUB_WORKSPACE/memcached/
|
||||
patch -p1 < $GITHUB_WORKSPACE/osp/memcached/memcached_1.6.22.patch
|
||||
./autogen.sh
|
||||
export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH
|
||||
PKG_CONFIG_PATH=$GITHUB_WORKSPACE/build-dir/lib/pkgconfig ./configure --enable-wolfssl
|
||||
make -j$(nproc)
|
||||
|
||||
- name: Confirm memcached built with wolfSSL
|
||||
working-directory: ./memcached
|
||||
run: |
|
||||
export LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH
|
||||
ldd memcached | grep wolfssl
|
||||
|
||||
- name: Run memcached tests
|
||||
working-directory: ./memcached
|
||||
run: |
|
||||
# Retry up to three times
|
||||
# Using docker because interrupting the tests doesn't close running
|
||||
# background servers. They can become daemonized and then all re-runs
|
||||
# will always fail.
|
||||
chmod +x $GITHUB_WORKSPACE/build-dir/bin/memcached.sh
|
||||
for i in {1..3}; do
|
||||
echo "-------- RUNNING TESTS --------"
|
||||
MEMCACHED_RES=0 # Not set when command succeeds
|
||||
# Tests should usually take less than 4 minutes. If already taking
|
||||
# 5 minutes then they are probably stuck. Interrupt and re-run.
|
||||
time timeout -s SIGKILL 5m docker run -v /:/host \
|
||||
-v $GITHUB_WORKSPACE/build-dir/bin/memcached.sh:/memcached.sh \
|
||||
-e GITHUB_WORKSPACE=$GITHUB_WORKSPACE \
|
||||
-e HOST_ROOT=/host \
|
||||
-e LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$LD_LIBRARY_PATH \
|
||||
alpine:latest /memcached.sh || MEMCACHED_RES=$?
|
||||
|
||||
if [ "$MEMCACHED_RES" -eq "0" ]; then
|
||||
break
|
||||
fi
|
||||
done
|
||||
echo "test ran $i times"
|
||||
if [ "$MEMCACHED_RES" -ne "0" ]; then
|
||||
exit $MEMCACHED_RES
|
||||
fi
|
||||
63
.github/workflows/multi-arch.yml
vendored
63
.github/workflows/multi-arch.yml
vendored
@@ -1,63 +0,0 @@
|
||||
name: Multiple architectures
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
my_matrix:
|
||||
name: Multi-arch test
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- HOST: aarch64-linux-gnu
|
||||
CC: aarch64-linux-gnu-gcc
|
||||
ARCH: arm64
|
||||
EXTRA_OPTS: --enable-sp-asm --enable-armasm
|
||||
- HOST: arm-linux-gnueabihf
|
||||
CC: arm-linux-gnueabihf-gcc
|
||||
ARCH: armhf
|
||||
EXTRA_OPTS: --enable-sp-asm
|
||||
- HOST: riscv64-linux-gnu
|
||||
CC: riscv64-linux-gnu-gcc
|
||||
ARCH: riscv64
|
||||
# Config to ensure CPUs without Thumb instructions compiles
|
||||
- HOST: arm-linux-gnueabi
|
||||
CC: arm-linux-gnueabi-gcc
|
||||
CFLAGS: -marm -DWOLFSSL_SP_ARM_ARCH=6
|
||||
ARCH: armel
|
||||
EXTRA_OPTS: --enable-sp-asm
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- name: Install Compiler
|
||||
run: |
|
||||
sudo apt update
|
||||
sudo apt install -y crossbuild-essential-${{ matrix.ARCH }} qemu-user
|
||||
- uses: actions/checkout@v4
|
||||
- name: Build
|
||||
env:
|
||||
CC: ${{ matrix.CC }}
|
||||
CFLAGS: ${{ matrix.CFLAGS }}
|
||||
QEMU_LD_PREFIX: /usr/${{ matrix.HOST }}
|
||||
run: ./autogen.sh && ./configure --host=${{ matrix.HOST }} --enable-all --disable-examples ${{ matrix.EXTRA_OPTS }} && make
|
||||
- name: Print errors
|
||||
if: ${{ failure() }}
|
||||
run: |
|
||||
if [ -f config.log ] ; then
|
||||
cat config.log
|
||||
fi
|
||||
- name: Run WolfCrypt Tests
|
||||
env:
|
||||
QEMU_LD_PREFIX: /usr/${{ matrix.HOST }}
|
||||
run: ./wolfcrypt/test/testwolfcrypt
|
||||
62
.github/workflows/multi-compiler.yml
vendored
62
.github/workflows/multi-compiler.yml
vendored
@@ -1,62 +0,0 @@
|
||||
name: Multiple compilers and versions
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
my_matrix:
|
||||
name: Compiler test
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- CC: gcc-9
|
||||
CXX: g++-9
|
||||
OS: ubuntu-latest
|
||||
- CC: gcc-10
|
||||
CXX: g++-10
|
||||
OS: ubuntu-latest
|
||||
- CC: gcc-11
|
||||
CXX: g++-11
|
||||
OS: ubuntu-latest
|
||||
- CC: gcc-12
|
||||
CXX: g++-12
|
||||
OS: ubuntu-latest
|
||||
- CC: clang-10
|
||||
CXX: clang++-10
|
||||
OS: ubuntu-20.04
|
||||
- CC: clang-11
|
||||
CXX: clang++-11
|
||||
OS: ubuntu-20.04
|
||||
- CC: clang-12
|
||||
CXX: clang++-12
|
||||
OS: ubuntu-20.04
|
||||
- CC: clang-13
|
||||
CXX: clang++-13
|
||||
OS: ubuntu-latest
|
||||
- CC: clang-14
|
||||
CXX: clang++-14
|
||||
OS: ubuntu-latest
|
||||
runs-on: ${{ matrix.OS }}
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Build
|
||||
env:
|
||||
CC: ${{ matrix.CC }}
|
||||
CXX: ${{ matrix.CXX }}
|
||||
run: ./autogen.sh && ./configure && make && make dist
|
||||
- name: Show log on errors
|
||||
if: ${{ failure() }}
|
||||
run: |
|
||||
cat config.log
|
||||
219
.github/workflows/nginx.yml
vendored
219
.github/workflows/nginx.yml
vendored
@@ -1,219 +0,0 @@
|
||||
name: nginx Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- if: ${{ runner.debug }}
|
||||
name: Enable wolfSSL debug logging
|
||||
run: |
|
||||
# We don't use --enable-debug since it makes the logs too loud
|
||||
echo "wolf_debug_flags= CFLAGS='-g3 -O0'" >> $GITHUB_ENV
|
||||
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-nginx ${{ env.wolf_debug_flags }}
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-nginx
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
nginx_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
# in general we want to pass all tests that match *ssl*
|
||||
- ref: 1.25.0
|
||||
test-ref: 5b2894ea1afd01a26c589ce11f310df118e42592
|
||||
# Following tests pass with sanitizer on
|
||||
sanitize-ok: >-
|
||||
h2_ssl_proxy_cache.t h2_ssl.t h2_ssl_variables.t h2_ssl_verify_client.t
|
||||
mail_imap_ssl.t mail_ssl_conf_command.t mail_ssl_session_reuse.t
|
||||
mail_ssl.t proxy_ssl_certificate_empty.t proxy_ssl_certificate.t
|
||||
proxy_ssl_certificate_vars.t proxy_ssl_conf_command.t proxy_ssl_name.t
|
||||
ssl_certificate_chain.t ssl_certificate_perl.t ssl_certificates.t
|
||||
ssl_certificate.t ssl_client_escaped_cert.t ssl_conf_command.t
|
||||
ssl_crl.t ssl_curve.t ssl_engine_keys.t ssl_ocsp.t ssl_password_file.t
|
||||
ssl_proxy_protocol.t ssl_proxy_upgrade.t ssl_reject_handshake.t
|
||||
ssl_session_reuse.t ssl_session_ticket_key.t ssl_sni_reneg.t
|
||||
ssl_sni_sessions.t ssl_sni.t ssl_stapling.t ssl.t ssl_verify_client.t
|
||||
ssl_verify_depth.t stream_proxy_ssl_certificate.t stream_proxy_ssl_certificate_vars.t
|
||||
stream_proxy_ssl_conf_command.t stream_proxy_ssl_name_complex.t
|
||||
stream_proxy_ssl_name.t stream_ssl_certificate.t stream_ssl_conf_command.t
|
||||
stream_ssl_preread_alpn.t stream_ssl_preread_protocol.t stream_ssl_preread.t
|
||||
stream_ssl_realip.t stream_ssl_session_reuse.t stream_ssl.t stream_ssl_variables.t
|
||||
stream_ssl_verify_client.t stream_upstream_zone_ssl.t upstream_zone_ssl.t
|
||||
uwsgi_ssl_certificate.t uwsgi_ssl_certificate_vars.t uwsgi_ssl.t
|
||||
uwsgi_ssl_verify.t
|
||||
# Following tests do not pass with sanitizer on (with OpenSSL too)
|
||||
sanitize-not-ok: >-
|
||||
grpc_ssl.t h2_proxy_request_buffering_ssl.t h2_proxy_ssl.t
|
||||
proxy_request_buffering_ssl.t proxy_ssl_keepalive.t proxy_ssl.t
|
||||
proxy_ssl_verify.t stream_proxy_protocol_ssl.t stream_proxy_ssl.t
|
||||
stream_proxy_ssl_verify.t stream_ssl_alpn.t
|
||||
- ref: 1.24.0
|
||||
test-ref: 212d9d003886e3a24542855fb60355a417f037de
|
||||
# Following tests pass with sanitizer on
|
||||
sanitize-ok: >-
|
||||
h2_ssl_proxy_cache.t h2_ssl.t h2_ssl_variables.t h2_ssl_verify_client.t
|
||||
mail_imap_ssl.t mail_ssl_conf_command.t mail_ssl_session_reuse.t mail_ssl.t
|
||||
proxy_ssl_certificate_empty.t proxy_ssl_certificate.t proxy_ssl_certificate_vars.t
|
||||
proxy_ssl_name.t ssl_certificate_chain.t ssl_certificate_perl.t ssl_certificates.t
|
||||
ssl_certificate.t ssl_client_escaped_cert.t ssl_conf_command.t ssl_crl.t
|
||||
ssl_engine_keys.t ssl_ocsp.t ssl_password_file.t ssl_proxy_protocol.t
|
||||
ssl_proxy_upgrade.t ssl_reject_handshake.t ssl_session_reuse.t
|
||||
ssl_session_ticket_key.t ssl_sni_reneg.t ssl_sni_sessions.t ssl_sni.t
|
||||
ssl_stapling.t ssl.t ssl_verify_client.t stream_proxy_ssl_certificate.t
|
||||
stream_proxy_ssl_certificate_vars.t stream_proxy_ssl_name_complex.t
|
||||
stream_proxy_ssl_name.t stream_ssl_alpn.t stream_ssl_certificate.t
|
||||
stream_ssl_conf_command.t stream_ssl_preread_alpn.t stream_ssl_preread_protocol.t
|
||||
stream_ssl_preread.t stream_ssl_realip.t stream_ssl_session_reuse.t stream_ssl.t
|
||||
stream_ssl_variables.t stream_ssl_verify_client.t stream_upstream_zone_ssl.t
|
||||
upstream_zone_ssl.t uwsgi_ssl_certificate.t uwsgi_ssl_certificate_vars.t
|
||||
uwsgi_ssl.t uwsgi_ssl_verify.t
|
||||
# Following tests do not pass with sanitizer on (with OpenSSL too)
|
||||
sanitize-not-ok: >-
|
||||
grpc_ssl.t h2_proxy_request_buffering_ssl.t h2_proxy_ssl.t
|
||||
proxy_request_buffering_ssl.t proxy_ssl_conf_command.t proxy_ssl_keepalive.t
|
||||
proxy_ssl.t proxy_ssl_verify.t ssl_curve.t ssl_verify_depth.t
|
||||
stream_proxy_protocol_ssl.t stream_proxy_ssl_conf_command.t stream_proxy_ssl.t
|
||||
stream_proxy_ssl_verify.t
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 6
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-nginx
|
||||
path: build-dir
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo cpan -iT Proc::Find Net::SSLeay IO::Socket::SSL
|
||||
|
||||
- name: Checkout wolfssl-nginx
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/wolfssl-nginx
|
||||
path: wolfssl-nginx
|
||||
|
||||
- name: Checkout nginx
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: nginx/nginx
|
||||
path: nginx
|
||||
ref: release-${{ matrix.ref }}
|
||||
|
||||
- name: Apply nginx patch
|
||||
working-directory: nginx
|
||||
run: patch -p1 < ../wolfssl-nginx/nginx-${{ matrix.ref }}-wolfssl.patch
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Apply nginx debug patch
|
||||
working-directory: nginx
|
||||
run: patch -p1 < ../wolfssl-nginx/nginx-${{ matrix.ref }}-wolfssl-debug.patch
|
||||
|
||||
- name: Checkout nginx-tests
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: nginx/nginx-tests
|
||||
path: nginx-tests
|
||||
ref: ${{ matrix.test-ref }}
|
||||
|
||||
- name: Apply nginx-tests patch
|
||||
working-directory: nginx-tests
|
||||
run: patch -p1 < ../wolfssl-nginx/nginx-tests-patches/*${{ matrix.test-ref }}.patch
|
||||
|
||||
- name: Build nginx without sanitizer
|
||||
working-directory: nginx
|
||||
run: |
|
||||
./auto/configure --with-wolfssl=$GITHUB_WORKSPACE/build-dir --with-http_ssl_module \
|
||||
--with-stream --with-stream_ssl_module --with-stream_ssl_preread_module \
|
||||
--with-http_v2_module --with-mail --with-mail_ssl_module
|
||||
make -j
|
||||
|
||||
- name: Confirm nginx built with wolfSSL
|
||||
working-directory: nginx
|
||||
run: ldd objs/nginx | grep wolfssl
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Run nginx-tests without sanitizer (debug)
|
||||
working-directory: nginx-tests
|
||||
run: |
|
||||
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib \
|
||||
TMPDIR=$GITHUB_WORKSPACE TEST_NGINX_VERBOSE=y TEST_NGINX_CATLOG=y \
|
||||
TEST_NGINX_BINARY=../nginx/objs/nginx prove -v ${{ matrix.sanitize-not-ok }}
|
||||
|
||||
- if: ${{ !runner.debug }}
|
||||
name: Run nginx-tests without sanitizer
|
||||
working-directory: nginx-tests
|
||||
run: |
|
||||
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib \
|
||||
TMPDIR=$GITHUB_WORKSPACE TEST_NGINX_BINARY=../nginx/objs/nginx \
|
||||
prove ${{ matrix.sanitize-not-ok }}
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Enable wolfSSL debug logging
|
||||
run: |
|
||||
echo "nginx_c_flags=-O0" >> $GITHUB_ENV
|
||||
|
||||
- name: workaround high-entropy ASLR
|
||||
# not needed after either an update to llvm or runner is done
|
||||
run: sudo sysctl vm.mmap_rnd_bits=28
|
||||
|
||||
- name: Build nginx with sanitizer
|
||||
working-directory: nginx
|
||||
run: |
|
||||
./auto/configure --with-wolfssl=$GITHUB_WORKSPACE/build-dir --with-http_ssl_module \
|
||||
--with-stream --with-stream_ssl_module --with-stream_ssl_preread_module \
|
||||
--with-http_v2_module --with-mail --with-mail_ssl_module \
|
||||
--with-cc-opt='-fsanitize=address -DNGX_DEBUG_PALLOC=1 -g3 ${{ env.nginx_c_flags }}' \
|
||||
--with-ld-opt='-fsanitize=address ${{ env.nginx_c_flags }}'
|
||||
make -j
|
||||
|
||||
- name: Confirm nginx built with wolfSSL
|
||||
working-directory: nginx
|
||||
run: ldd objs/nginx | grep wolfssl
|
||||
|
||||
- if: ${{ runner.debug }}
|
||||
name: Run nginx-tests with sanitizer (debug)
|
||||
working-directory: nginx-tests
|
||||
run: |
|
||||
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib \
|
||||
TMPDIR=$GITHUB_WORKSPACE TEST_NGINX_VERBOSE=y TEST_NGINX_CATLOG=y \
|
||||
TEST_NGINX_BINARY=../nginx/objs/nginx prove -v ${{ matrix.sanitize-ok }}
|
||||
|
||||
- if: ${{ !runner.debug }}
|
||||
name: Run nginx-tests with sanitizer
|
||||
working-directory: nginx-tests
|
||||
run: |
|
||||
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib \
|
||||
TMPDIR=$GITHUB_WORKSPACE TEST_NGINX_BINARY=../nginx/objs/nginx \
|
||||
prove ${{ matrix.sanitize-ok }}
|
||||
|
||||
43
.github/workflows/no-malloc.yml
vendored
43
.github/workflows/no-malloc.yml
vendored
@@ -1,43 +0,0 @@
|
||||
name: No Malloc Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
make_check:
|
||||
strategy:
|
||||
matrix:
|
||||
config: [
|
||||
# Add new configs here
|
||||
'--enable-rsa --enable-keygen --disable-dh CFLAGS="-DWOLFSSL_NO_MALLOC"',
|
||||
]
|
||||
name: make check
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 6
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
name: Checkout wolfSSL
|
||||
|
||||
- name: Test wolfSSL
|
||||
run: |
|
||||
./autogen.sh
|
||||
./configure ${{ matrix.config }}
|
||||
make
|
||||
./wolfcrypt/test/testwolfcrypt
|
||||
|
||||
- name: Print errors
|
||||
if: ${{ failure() }}
|
||||
run: |
|
||||
if [ -f test-suite.log ] ; then
|
||||
cat test-suite.log
|
||||
fi
|
||||
37
.github/workflows/ocsp.yml
vendored
37
.github/workflows/ocsp.yml
vendored
@@ -1,37 +0,0 @@
|
||||
name: OCSP Test
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
ocsp_stapling:
|
||||
name: ocsp stapling
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- name: Checkout wolfSSL
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Build wolfSSL
|
||||
run: autoreconf -ivf && ./configure --enable-ocsp --enable-ocspstapling && make
|
||||
|
||||
- name: Start OCSP responder 1
|
||||
run: openssl ocsp -port 22221 -ndays 1000 -index certs/ocsp/index-intermediate1-ca-issued-certs.txt -rsigner certs/ocsp/ocsp-responder-cert.pem -rkey certs/ocsp/ocsp-responder-key.pem -CA certs/ocsp/intermediate1-ca-cert.pem &
|
||||
|
||||
- name: Start OCSP responder 2
|
||||
run: openssl ocsp -port 22220 -ndays 1000 -index certs/ocsp/index-ca-and-intermediate-cas.txt -rsigner certs/ocsp/ocsp-responder-cert.pem -rkey certs/ocsp/ocsp-responder-key.pem -CA certs/ocsp/root-ca-cert.pem &
|
||||
|
||||
- name: Start TLS server
|
||||
run: ./examples/server/server -p 11111 -c ./certs/ocsp/server1-cert.pem -k ./certs/ocsp/server1-key.pem -d &
|
||||
|
||||
- name: Test Look Up
|
||||
run: ./examples/client/client -A ./certs/ocsp/root-ca-cert.pem -o
|
||||
77
.github/workflows/openssh.yml
vendored
77
.github/workflows/openssh.yml
vendored
@@ -1,77 +0,0 @@
|
||||
name: openssh Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: >-
|
||||
--enable-openssh --enable-dsa --with-max-rsa-bits=8192
|
||||
--enable-intelasm --enable-sp-asm
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-openssh
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
openssh_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- git_ref: 'V_9_6_P1'
|
||||
osp_ver: '9.6'
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-openssh
|
||||
path: build-dir
|
||||
|
||||
- name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
|
||||
- name: Build and test openssh
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
repository: openssh/openssh-portable
|
||||
ref: ${{ matrix.git_ref }}
|
||||
path: openssh
|
||||
patch-file: $GITHUB_WORKSPACE/osp/openssh-patches/openssh-${{ matrix.osp_ver }}.patch
|
||||
configure: --with-wolfssl=$GITHUB_WORKSPACE/build-dir --with-rpath=-Wl,-rpath=
|
||||
check: false
|
||||
|
||||
# make tests take >20 minutes. Consider limiting?
|
||||
- name: Run tests
|
||||
working-directory: ./openssh
|
||||
run: |
|
||||
# Run all the tests except (t-exec) as it takes too long
|
||||
make file-tests interop-tests extra-tests unit
|
||||
86
.github/workflows/openvpn.yml
vendored
86
.github/workflows/openvpn.yml
vendored
@@ -1,86 +0,0 @@
|
||||
name: OpenVPN Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-openvpn
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-openvpn
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
openvpn_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# List of refs to test
|
||||
ref: [ release/2.6, v2.6.0, master ]
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 10
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-openvpn
|
||||
path: build-dir
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install liblzo2-dev libpam0g-dev liblz4-dev libcap-ng-dev \
|
||||
linux-libc-dev man2html libcmocka-dev python3-docutils \
|
||||
libtool automake autoconf libnl-genl-3-dev libnl-genl-3-200
|
||||
|
||||
- name: workaround high-entropy ASLR
|
||||
# not needed after either an update to llvm or runner is done
|
||||
run: sudo sysctl vm.mmap_rnd_bits=28
|
||||
|
||||
- if: ${{ matrix.ref != 'master' }}
|
||||
name: Build and test openvpn with fsanitize
|
||||
run: |
|
||||
echo 'extra_c_flags=CC="gcc -fsanitize=address" CFLAGS="-fno-omit-frame-pointer -O2"' >> $GITHUB_ENV
|
||||
|
||||
- name: Build and test openvpn
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
repository: OpenVPN/openvpn
|
||||
ref: ${{ matrix.ref }}
|
||||
path: openvpn
|
||||
configure: >-
|
||||
--with-crypto-library=wolfssl
|
||||
WOLFSSL_CFLAGS="-I$GITHUB_WORKSPACE/build-dir/include/ -I$GITHUB_WORKSPACE/build-dir/include/wolfssl"
|
||||
WOLFSSL_LIBS="-L$GITHUB_WORKSPACE/build-dir/lib -lwolfssl"
|
||||
${{ env.extra_c_flags }}
|
||||
check: true
|
||||
|
||||
- name: Confirm OpenVPN built with wolfSSL
|
||||
working-directory: ./openvpn
|
||||
run: ldd src/openvpn/openvpn | grep wolfssl
|
||||
151
.github/workflows/os-check.yml
vendored
151
.github/workflows/os-check.yml
vendored
@@ -1,151 +0,0 @@
|
||||
name: Ubuntu-Macos-Windows Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
make_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os: [ ubuntu-latest, macos-latest ]
|
||||
config: [
|
||||
# Add new configs here
|
||||
'',
|
||||
'--enable-all --enable-asn=template',
|
||||
'--enable-all --enable-asn=original',
|
||||
'--enable-harden-tls',
|
||||
'--enable-tls13 --enable-session-ticket --enable-dtls --enable-dtls13
|
||||
--enable-opensslextra --enable-sessioncerts
|
||||
CPPFLAGS=''-DWOLFSSL_DTLS_NO_HVR_ON_RESUME -DHAVE_EXT_CACHE
|
||||
-DWOLFSSL_TICKET_HAVE_ID -DHAVE_EX_DATA -DSESSION_CACHE_DYNAMIC_MEM'' ',
|
||||
'--enable-all --enable-secure-renegotiation',
|
||||
'--enable-all --enable-haproxy --enable-quic',
|
||||
'--enable-dtls --enable-dtls13 --enable-earlydata
|
||||
--enable-session-ticket --enable-psk
|
||||
CPPFLAGS=''-DWOLFSSL_DTLS13_NO_HRR_ON_RESUME'' ',
|
||||
]
|
||||
name: make check
|
||||
runs-on: ${{ matrix.os }}
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 14
|
||||
steps:
|
||||
- name: Build and test wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
configure: ${{ matrix.config }}
|
||||
check: true
|
||||
|
||||
make_user_settings:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os: [ ubuntu-latest, macos-latest ]
|
||||
user-settings: [
|
||||
# Add new user_settings.h here
|
||||
'examples/configs/user_settings_all.h',
|
||||
]
|
||||
name: make user_setting.h
|
||||
runs-on: ${{ matrix.os }}
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 14
|
||||
steps:
|
||||
- name: Build and test wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
configure: --enable-usersettings
|
||||
check: true
|
||||
user-settings: ${{ matrix.user-settings }}
|
||||
|
||||
make_user_settings_testwolfcrypt:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os: [ ubuntu-latest, macos-latest ]
|
||||
user-settings: [
|
||||
# Add new user_settings.h here
|
||||
'examples/configs/user_settings_min_ecc.h',
|
||||
'examples/configs/user_settings_wolfboot_keytools.h',
|
||||
'examples/configs/user_settings_wolftpm.h',
|
||||
'examples/configs/user_settings_tls12.h',
|
||||
]
|
||||
name: make user_setting.h (testwolfcrypt only)
|
||||
runs-on: ${{ matrix.os }}
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 14
|
||||
steps:
|
||||
- name: Build and test wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
configure: --enable-usersettings --disable-examples
|
||||
check: false
|
||||
user-settings: ${{ matrix.user-settings }}
|
||||
|
||||
- name: Run wolfcrypt/test/testwolfcrypt
|
||||
run: ./wolfcrypt/test/testwolfcrypt
|
||||
|
||||
# Has to be dedicated function due to the sed call
|
||||
make_user_all:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os: [ ubuntu-latest, macos-latest ]
|
||||
name: make user_setting.h (with sed)
|
||||
runs-on: ${{ matrix.os }}
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 14
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- if: ${{ matrix.os == 'macos-latest' }}
|
||||
run: brew install automake libtool
|
||||
- run: ./autogen.sh
|
||||
- name: user_settings_all.h with compatibility layer
|
||||
run: |
|
||||
cp ./examples/configs/user_settings_all.h user_settings.h
|
||||
sed -i -e "s/if 0/if 1/" user_settings.h
|
||||
./configure --enable-usersettings
|
||||
make
|
||||
make check
|
||||
|
||||
windows_build:
|
||||
name: Windows Build Test
|
||||
runs-on: windows-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 6
|
||||
env:
|
||||
# Path to the solution file relative to the root of the project.
|
||||
SOLUTION_FILE_PATH: wolfssl64.sln
|
||||
|
||||
# Configuration type to build.
|
||||
# You can convert this to a build matrix if you need coverage of multiple configuration types.
|
||||
# https://docs.github.com/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix
|
||||
BUILD_CONFIGURATION: Release
|
||||
BUILD_PLATFORM: x64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Add MSBuild to PATH
|
||||
uses: microsoft/setup-msbuild@v2
|
||||
|
||||
- name: Restore NuGet packages
|
||||
working-directory: ${{env.GITHUB_WORKSPACE}}
|
||||
run: nuget restore ${{env.SOLUTION_FILE_PATH}}
|
||||
|
||||
- name: Build
|
||||
working-directory: ${{env.GITHUB_WORKSPACE}}
|
||||
# Add additional options to the MSBuild command line here (like platform or verbosity level).
|
||||
# See https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference
|
||||
run: msbuild /m /p:PlatformToolset=v142 /p:Platform=${{env.BUILD_PLATFORM}} /p:Configuration=${{env.BUILD_CONFIGURATION}} ${{env.SOLUTION_FILE_PATH}}
|
||||
|
||||
- name: Run Test
|
||||
working-directory: ${{env.GITHUB_WORKSPACE}}
|
||||
run: Release/x64/testsuite.exe
|
||||
54
.github/workflows/packaging.yml
vendored
54
.github/workflows/packaging.yml
vendored
@@ -1,54 +0,0 @@
|
||||
name: Packaging Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Package wolfSSL
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- name: Checkout wolfSSL
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Configure wolfSSL
|
||||
run: |
|
||||
autoreconf -ivf
|
||||
./configure --enable-distro --enable-all \
|
||||
--disable-openssl-compatible-defaults --enable-intelasm \
|
||||
--enable-dtls13 --enable-dtls-mtu \
|
||||
--enable-sp-asm --disable-examples --disable-silent-rules
|
||||
|
||||
- name: Make sure OPENSSL_COMPATIBLE_DEFAULTS is not present in options.h
|
||||
run: |
|
||||
! grep OPENSSL_COMPATIBLE_DEFAULTS wolfssl/options.h
|
||||
|
||||
- name: Build wolfSSL .deb
|
||||
run: make deb-docker
|
||||
|
||||
- name: Build wolfSSL .rpm
|
||||
run: make rpm-docker
|
||||
|
||||
- name: Confirm packages built
|
||||
run: |
|
||||
DEB_COUNT=$(find -name 'libwolfssl*.deb' | wc -l)
|
||||
if [ "$DEB_COUNT" != "2" ]; then
|
||||
echo Did not find exactly two deb packages!!!
|
||||
exit 1
|
||||
fi
|
||||
RPM_COUNT=$(find -name 'wolfssl*.rpm' | wc -l)
|
||||
if [ "$RPM_COUNT" != "4" ]; then
|
||||
echo Did not find exactly four rpm packages!!!
|
||||
exit 1
|
||||
fi
|
||||
74
.github/workflows/stunnel.yml
vendored
74
.github/workflows/stunnel.yml
vendored
@@ -1,74 +0,0 @@
|
||||
name: stunnel Tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
build_wolfssl:
|
||||
name: Build wolfSSL
|
||||
# Just to keep it the same as the testing target
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
steps:
|
||||
- name: Build wolfSSL
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
path: wolfssl
|
||||
configure: --enable-stunnel
|
||||
install: true
|
||||
|
||||
- name: Upload built lib
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: wolf-install-stunnel
|
||||
path: build-dir
|
||||
retention-days: 5
|
||||
|
||||
stunnel_check:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# List of releases to test
|
||||
ref: [ 5.67 ]
|
||||
name: ${{ matrix.ref }}
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 4
|
||||
needs: build_wolfssl
|
||||
steps:
|
||||
- name: Download lib
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: wolf-install-stunnel
|
||||
path: build-dir
|
||||
|
||||
- name: Checkout OSP
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: wolfssl/osp
|
||||
path: osp
|
||||
|
||||
- name: Build and test stunnel
|
||||
uses: wolfSSL/actions-build-autotools-project@v1
|
||||
with:
|
||||
repository: mtrojnar/stunnel
|
||||
ref: stunnel-${{ matrix.ref }}
|
||||
path: stunnel
|
||||
patch-file: $GITHUB_WORKSPACE/osp/stunnel/${{ matrix.ref }}/stunnel-${{ matrix.ref }}.patch
|
||||
configure: --enable-wolfssl SSLDIR=$GITHUB_WORKSPACE/build-dir
|
||||
check: true
|
||||
|
||||
- name: Confirm stunnel built with wolfSSL
|
||||
working-directory: ./stunnel
|
||||
run: ldd src/stunnel | grep wolfssl
|
||||
|
||||
26
.github/workflows/ubuntu-check.yml
vendored
Normal file
26
.github/workflows/ubuntu-check.yml
vendored
Normal file
@@ -0,0 +1,26 @@
|
||||
name: Ubuntu Build Test
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ '*' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
jobs:
|
||||
build:
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- name: autogen
|
||||
run: ./autogen.sh
|
||||
- name: configure
|
||||
run: ./configure
|
||||
- name: make
|
||||
run: make
|
||||
- name: make check
|
||||
run: make check
|
||||
- name: make distcheck
|
||||
run: make distcheck
|
||||
|
||||
38
.github/workflows/windows-check.yml
vendored
Normal file
38
.github/workflows/windows-check.yml
vendored
Normal file
@@ -0,0 +1,38 @@
|
||||
name: Windows Build Test
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ '*' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
env:
|
||||
# Path to the solution file relative to the root of the project.
|
||||
SOLUTION_FILE_PATH: wolfssl64.sln
|
||||
|
||||
# Configuration type to build.
|
||||
# You can convert this to a build matrix if you need coverage of multiple configuration types.
|
||||
# https://docs.github.com/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix
|
||||
BUILD_CONFIGURATION: Release
|
||||
BUILD_PLATFORM: x64
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: windows-latest
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
|
||||
- name: Add MSBuild to PATH
|
||||
uses: microsoft/setup-msbuild@v1
|
||||
|
||||
- name: Restore NuGet packages
|
||||
working-directory: ${{env.GITHUB_WORKSPACE}}
|
||||
run: nuget restore ${{env.SOLUTION_FILE_PATH}}
|
||||
|
||||
- name: Build
|
||||
working-directory: ${{env.GITHUB_WORKSPACE}}
|
||||
# Add additional options to the MSBuild command line here (like platform or verbosity level).
|
||||
# See https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference
|
||||
run: msbuild /m /p:PlatformToolset=v142 /p:Platform=${{env.BUILD_PLATFORM}} /p:Configuration=${{env.BUILD_CONFIGURATION}} ${{env.SOLUTION_FILE_PATH}}
|
||||
|
||||
128
.github/workflows/zephyr.yml
vendored
128
.github/workflows/zephyr.yml
vendored
@@ -1,128 +0,0 @@
|
||||
name: Zephyr tests
|
||||
|
||||
# START OF COMMON SECTION
|
||||
on:
|
||||
push:
|
||||
branches: [ 'master', 'main', 'release/**' ]
|
||||
pull_request:
|
||||
branches: [ '*' ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
# END OF COMMON SECTION
|
||||
|
||||
jobs:
|
||||
run_test:
|
||||
name: Build and run
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
config:
|
||||
- zephyr-ref: v3.4.0
|
||||
zephyr-sdk: 0.16.1
|
||||
- zephyr-ref: v3.5.0
|
||||
zephyr-sdk: 0.16.3
|
||||
- zephyr-ref: v2.7.4
|
||||
zephyr-sdk: 0.16.3
|
||||
runs-on: ubuntu-latest
|
||||
# This should be a safe limit for the tests to run.
|
||||
timeout-minutes: 25
|
||||
steps:
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
# Don't prompt for anything
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
sudo apt-get update
|
||||
# most of the ci-base zephyr docker image packages
|
||||
sudo apt-get install -y zip bridge-utils uml-utilities \
|
||||
git cmake ninja-build gperf ccache dfu-util device-tree-compiler wget \
|
||||
python3-dev python3-pip python3-setuptools python3-tk python3-wheel xz-utils file \
|
||||
make gcc gcc-multilib g++-multilib libsdl2-dev libmagic1 \
|
||||
autoconf automake bison build-essential ca-certificates cargo ccache chrpath cmake \
|
||||
cpio device-tree-compiler dfu-util diffstat dos2unix doxygen file flex g++ gawk gcc \
|
||||
gcovr git git-core gnupg gperf gtk-sharp2 help2man iproute2 lcov libcairo2-dev \
|
||||
libglib2.0-dev libgtk2.0-0 liblocale-gettext-perl libncurses5-dev libpcap-dev \
|
||||
libpopt0 libsdl1.2-dev libsdl2-dev libssl-dev libtool libtool-bin locales make \
|
||||
net-tools ninja-build openssh-client parallel pkg-config python3-dev python3-pip \
|
||||
python3-ply python3-setuptools python-is-python3 qemu rsync socat srecord sudo \
|
||||
texinfo unzip wget ovmf xz-utils
|
||||
|
||||
- name: Install west
|
||||
run: sudo pip install west
|
||||
|
||||
- name: Init west workspace
|
||||
run: west init --mr ${{ matrix.config.zephyr-ref }} zephyr
|
||||
|
||||
- name: Update west.yml
|
||||
working-directory: zephyr/zephyr
|
||||
run: |
|
||||
REF=$(echo '${{ github.ref }}' | sed -e 's/\//\\\//g')
|
||||
sed -e 's/remotes:/remotes:\n \- name: wolfssl\n url\-base: https:\/\/github.com\/${{ github.repository_owner }}/' -i west.yml
|
||||
sed -e "s/projects:/projects:\n \- name: wolfssl\n path: modules\/crypto\/wolfssl\n remote: wolfssl\n revision: $REF/" -i west.yml
|
||||
|
||||
- name: Update west workspace
|
||||
working-directory: zephyr
|
||||
run: west update -n -o=--depth=1
|
||||
|
||||
- name: Export zephyr
|
||||
working-directory: zephyr
|
||||
run: west zephyr-export
|
||||
|
||||
- name: Install pip dependencies
|
||||
working-directory: zephyr
|
||||
run: sudo pip install -r zephyr/scripts/requirements.txt
|
||||
|
||||
- name: Install zephyr SDK
|
||||
run: |
|
||||
wget -q https://github.com/zephyrproject-rtos/sdk-ng/releases/download/v${{ matrix.config.zephyr-sdk }}/zephyr-sdk-${{ matrix.config.zephyr-sdk }}_linux-x86_64_minimal.tar.xz
|
||||
tar xf zephyr-sdk-${{ matrix.config.zephyr-sdk }}_linux-x86_64_minimal.tar.xz
|
||||
cd zephyr-sdk-${{ matrix.config.zephyr-sdk }}
|
||||
./setup.sh -h -c -t x86_64-zephyr-elf
|
||||
|
||||
- name: Fix options for 2.7.4
|
||||
if: ${{ matrix.config.zephyr-ref == 'v2.7.4' }}
|
||||
working-directory: zephyr/modules/crypto/wolfssl
|
||||
run: |
|
||||
sed -i -e 's/CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE/CONFIG_MINIMAL_LIBC_MALLOC_ARENA_SIZE/g' $(find -name prj.conf)
|
||||
|
||||
- name: Run wolfssl test
|
||||
id: wolfssl-test
|
||||
working-directory: zephyr
|
||||
run: |
|
||||
./zephyr/scripts/twister -T modules/crypto/wolfssl --test zephyr/samples/wolfssl_test/sample.crypto.wolfssl_test -vvv
|
||||
rm -rf zephyr/twister-out
|
||||
./zephyr/scripts/twister -T modules/crypto/wolfssl --test zephyr/samples/wolfssl_test/sample.crypto.wolfssl_test_no_malloc -vvv
|
||||
rm -rf zephyr/twister-out
|
||||
|
||||
- name: Run wolfssl TLS sock test
|
||||
# Results in a page fault that I can't trace
|
||||
if: ${{ matrix.config.zephyr-ref != 'v2.7.4' }}
|
||||
id: wolfssl-tls-sock
|
||||
working-directory: zephyr
|
||||
run: |
|
||||
./zephyr/scripts/twister -T modules/crypto/wolfssl --test zephyr/samples/wolfssl_tls_sock/sample.crypto.wolfssl_tls_sock -vvv
|
||||
rm -rf zephyr/twister-out
|
||||
./zephyr/scripts/twister -T modules/crypto/wolfssl --test zephyr/samples/wolfssl_tls_sock/sample.crypto.wolfssl_tls_sock_no_malloc -vvv
|
||||
rm -rf zephyr/twister-out
|
||||
|
||||
- name: Run wolfssl TLS thread test
|
||||
if: ${{ matrix.config.zephyr-ref != 'v2.7.4' }}
|
||||
id: wolfssl-tls-thread
|
||||
working-directory: zephyr
|
||||
run: |
|
||||
./zephyr/scripts/twister -T modules/crypto/wolfssl --test zephyr/samples/wolfssl_tls_thread/sample.crypto.wolfssl_tls_thread -vvv
|
||||
rm -rf zephyr/twister-out
|
||||
|
||||
- name: Zip failure logs
|
||||
if: ${{ failure() && (steps.wolfssl-test.outcome == 'failure' || steps.wolfssl-tls-sock.outcome == 'failure' || steps.wolfssl-tls-thread.outcome == 'failure') }}
|
||||
run: |
|
||||
zip -9 -r logs.zip zephyr/twister-out
|
||||
|
||||
- name: Upload failure logs
|
||||
if: ${{ failure() && (steps.wolfssl-test.outcome == 'failure' || steps.wolfssl-tls-sock.outcome == 'failure' || steps.wolfssl-tls-thread.outcome == 'failure') }}
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: zephyr-client-test-logs
|
||||
path: logs.zip
|
||||
retention-days: 5
|
||||
91
.gitignore
vendored
91
.gitignore
vendored
@@ -64,8 +64,6 @@ ctaocrypt/benchmark/benchmark
|
||||
ctaocrypt/test/testctaocrypt
|
||||
wolfcrypt/benchmark/benchmark
|
||||
wolfcrypt/test/testwolfcrypt
|
||||
examples/async/async_client
|
||||
examples/async/async_server
|
||||
examples/benchmark/tls_bench
|
||||
examples/client/client
|
||||
examples/echoclient/echoclient
|
||||
@@ -75,26 +73,20 @@ examples/sctp/sctp-server
|
||||
examples/sctp/sctp-server-dtls
|
||||
examples/sctp/sctp-client
|
||||
examples/sctp/sctp-client-dtls
|
||||
examples/asn1/asn1
|
||||
examples/pem/pem
|
||||
server_ready
|
||||
snifftest
|
||||
output
|
||||
mcapi/test
|
||||
testsuite/testsuite
|
||||
testsuite/testsuite.test
|
||||
testsuite/*.der
|
||||
testsuite/*.pem
|
||||
testsuite/*.raw
|
||||
testsuite/*.obj
|
||||
testsuite/*.pdb
|
||||
testsuite/*.idb
|
||||
tests/unit
|
||||
testsuite/testsuite.test
|
||||
tests/unit.test
|
||||
tests/bio_write_test.txt
|
||||
tests/test-log-dump-to-file.txt
|
||||
tests/cert_cache.tmp
|
||||
test-write-dhparams.pem
|
||||
testsuite/*.der
|
||||
testsuite/*.pem
|
||||
testsuite/*.raw
|
||||
cert.der
|
||||
cert.pem
|
||||
certecc.der
|
||||
@@ -289,6 +281,23 @@ mqx/wolfcrypt_benchmark/.settings
|
||||
mqx/wolfcrypt_benchmark/.cwGeneratedFileSetLog
|
||||
mqx/wolfcrypt_benchmark/SaAnalysispointsManager.apconfig
|
||||
|
||||
# User Crypto example build
|
||||
wolfcrypt/user-crypto/aclocal.m4
|
||||
wolfcrypt/user-crypto/config.guess
|
||||
wolfcrypt/user-crypto/autom4te.cache
|
||||
wolfcrypt/user-crypto/config.log
|
||||
wolfcrypt/user-crypto/config.status
|
||||
wolfcrypt/user-crypto/config.sub
|
||||
wolfcrypt/user-crypto/depcomp
|
||||
wolfcrypt/user-crypto/install-sh
|
||||
wolfcrypt/user-crypto/libtool
|
||||
wolfcrypt/user-crypto/ltmain.sh
|
||||
wolfcrypt/user-crypto/m4
|
||||
wolfcrypt/user-crypto/missing
|
||||
wolfcrypt/user-crypto/Makefile.in
|
||||
wolfcrypt/user-crypto/lib/libusercrypto.*
|
||||
*.hzs
|
||||
|
||||
# wolfSSL CSharp wrapper
|
||||
wrapper/CSharp/x64/
|
||||
|
||||
@@ -325,10 +334,6 @@ wolfcrypt/src/port/intel/qat_test
|
||||
# Arduino Generated Files
|
||||
/IDE/ARDUINO/wolfSSL
|
||||
scripts/memtest.txt
|
||||
/IDE/ARDUINO/Arduino_README_prepend.md.tmp
|
||||
/IDE/ARDUINO/library.properties.tmp
|
||||
/IDE/ARDUINO/library.properties.tmp.backup
|
||||
/IDE/ARDUINO/PREPENDED_README.md
|
||||
|
||||
# Doxygen generated files
|
||||
doc/doxygen_warnings
|
||||
@@ -337,8 +342,6 @@ doc/pdf
|
||||
|
||||
# XCODE Index
|
||||
IDE/XCODE/Index
|
||||
IDE/**/xcshareddata
|
||||
IDE/**/DerivedData
|
||||
|
||||
# ARM DS-5 && Eclipse
|
||||
\.settings/
|
||||
@@ -376,9 +379,6 @@ IDE/**/DerivedData
|
||||
/IDE/QNX/example-cmac/cmac-test
|
||||
/IDE/QNX/CAAM-DRIVER/wolfCrypt
|
||||
|
||||
# Xilinx
|
||||
/IDE/XilinxSDK/data
|
||||
|
||||
# Emacs
|
||||
*~
|
||||
|
||||
@@ -390,54 +390,5 @@ cmake_install.cmake
|
||||
# GDB Settings
|
||||
\.gdbinit
|
||||
|
||||
libFuzzer
|
||||
|
||||
# Pycharm and other IDEs
|
||||
\.idea
|
||||
|
||||
# FIPS
|
||||
XXX-fips-test
|
||||
|
||||
# ASYNC
|
||||
/wolfAsyncCrypt
|
||||
/async
|
||||
|
||||
# Generated user_settings_asm.h.
|
||||
user_settings_asm.h
|
||||
|
||||
# VisualGDB
|
||||
**/.visualgdb
|
||||
|
||||
# Espressif sdk config default should be saved in sdkconfig.defaults
|
||||
# we won't track the actual working sdkconfig files
|
||||
/IDE/Espressif/**/sdkconfig
|
||||
/IDE/Espressif/**/sdkconfig.old
|
||||
|
||||
# MPLAB
|
||||
/IDE/MPLABX16/wolfssl.X/dist/default/
|
||||
/IDE/MPLABX16/wolfssl.X/.generated_files
|
||||
/IDE/MPLABX16/wolfcrypt_test.X/dist/default/
|
||||
/IDE/MPLABX16/wolfcrypt_test.X/.generated_files
|
||||
|
||||
# auto-created CMake backups
|
||||
**/CMakeLists.txt.old
|
||||
|
||||
# MagicCrypto (ARIA Cipher)
|
||||
MagicCrypto
|
||||
|
||||
# CMake build directory
|
||||
/out
|
||||
/out_temp
|
||||
|
||||
# debian packaging
|
||||
debian/changelog
|
||||
debian/control
|
||||
*.deb
|
||||
|
||||
# PlatformIO
|
||||
/**/.pio
|
||||
/**/.vscode/.browse.c_cpp.db*
|
||||
/**/.vscode/c_cpp_properties.json
|
||||
/**/.vscode/launch.json
|
||||
/**/.vscode/ipch
|
||||
/**/sdkconfig.esp32dev
|
||||
|
||||
834
CMakeLists.txt
834
CMakeLists.txt
File diff suppressed because it is too large
Load Diff
812
ChangeLog.md
812
ChangeLog.md
@@ -1,813 +1,3 @@
|
||||
# wolfSSL Release 5.7.0 (Mar 20, 2024)
|
||||
|
||||
Release 5.7.0 has been developed according to wolfSSL's development and QA
|
||||
process (see link below) and successfully passed the quality criteria.
|
||||
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
|
||||
|
||||
NOTE: * --enable-heapmath is being deprecated and will be removed by end of 2024
|
||||
|
||||
NOTE: In future releases, --enable-des3 (which is disabled by default) will be insufficient in itself to enable DES3 in TLS cipher suites. A new option, --enable-des3-tls-suites, will need to be supplied in addition. This option should only be used in backward compatibility scenarios, as it is inherently insecure.
|
||||
|
||||
NOTE: This release switches the default ASN.1 parser to the new ASN template code. If the original ASN.1 code is preferred define `WOLFSSL_ASN_ORIGINAL` to use it. See PR #7199.
|
||||
|
||||
|
||||
## Vulnerabilities
|
||||
* [High] CVE-2024-0901 Potential denial of service and out of bounds read. Affects TLS 1.3 on the server side when accepting a connection from a malicious TLS 1.3 client. If using TLS 1.3 on the server side it is recommended to update the version of wolfSSL used. Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7099
|
||||
|
||||
|
||||
* [Med] CVE-2024-1545 Fault Injection vulnerability in RsaPrivateDecryption function that potentially allows an attacker that has access to the same system with a victims process to perform a Rowhammer fault injection. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia)."
|
||||
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7167
|
||||
|
||||
|
||||
* [Med] Fault injection attack with EdDSA signature operations. This affects ed25519 sign operations where the system could be susceptible to Rowhammer attacks. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia).
|
||||
Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7212
|
||||
|
||||
|
||||
## New Feature Additions
|
||||
|
||||
* Added --enable-experimental configure flag to gate out features that are currently experimental. Now liboqs, kyber, lms, xmss, and dual-alg-certs require the --enable-experimental flag.
|
||||
|
||||
### POST QUANTUM SUPPORT ADDITIONS
|
||||
* Experimental framework for using wolfSSL’s XMSS implementation (PR 7161)
|
||||
* Experimental framework for using wolfSSL’s LMS implementation (PR 7283)
|
||||
* Experimental wolfSSL Kyber implementation and assembly optimizations, enabled with --enable-experimental --enable-kyber (PR 7318)
|
||||
* Experimental support for post quantum dual key/signature certificates. A few known issues and sanitizer checks are in progress with this feature. Enabled with the configure flags --enable-experimental --enable-dual-alg-certs (PR 7112)
|
||||
* CryptoCb support for PQC algorithms (PR 7110)
|
||||
|
||||
### OTHER FEATURE ADDITIONS
|
||||
* The Linux kernel module now supports registration of AES-GCM, AES-XTS, AES-CBC, and AES-CFB with the kernel cryptosystem through the new --enable-linuxkm-lkcapi-register option, enabling automatic use of wolfCrypt implementations by the dm-crypt/luks and ESP subsystems. In particular, wolfCrypt AES-XTS with –enable-aesni is faster than the native kernel implementation.
|
||||
* CryptoCb hook to one-shot CMAC functions (PR 7059)
|
||||
* BER content streaming support for PKCS7_VerifySignedData and sign/encrypt operations (PR 6961 & 7184)
|
||||
* IoT-Safe SHA-384 and SHA-512 support (PR 7176)
|
||||
* I/O callbacks for content and output with PKCS7 bundle sign/encrypt to reduce peak memory usage (PR 7272)
|
||||
* Microchip PIC24 support and example project (PR 7151)
|
||||
* AutoSAR shim layer for RNG, SHA256, and AES (PR 7296)
|
||||
* wolfSSL_CertManagerUnloadIntermediateCerts API to clear intermediate certs added to certificate store (PR 7245)
|
||||
* Implement SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid (PR 7236)
|
||||
|
||||
|
||||
## Enhancements and Optimizations
|
||||
|
||||
* Remove obsolete user-crypto functionality and Intel IPP support (PR 7097)
|
||||
* Support for RSA-PSS signatures with CRL use (PR 7119)
|
||||
* Enhancement for AES-GCM use with Xilsecure on Microblaze (PR 7051)
|
||||
* Support for crypto cb only build with ECC and NXP CAAM (PR 7269)
|
||||
* Improve liboqs integration adding locking and init/cleanup functions (PR 7026)
|
||||
* Prevent memory access before clientSession->serverRow and clientSession->serverIdx are sanitized (PR 7096)
|
||||
* Enhancements to reproducible build (PR 7267)
|
||||
* Update Arduino example TLS Client/Server and improve support for ESP32 (PR 7304 & 7177)
|
||||
* XC32 compiler version 4.x compatibility (PR 7128)
|
||||
* Porting for build on PlayStation 3 and 4 (PR 7072)
|
||||
* Improvements for Espressif use; SHA HW/SW selection and use on ESP32-C2/ESP8684, wolfSSL_NewThread() type, component cmake fix, and update TLS client example for ESP8266 (PR 7081, 7173, 7077, 7148, 7240)
|
||||
* Allow crypto callbacks with SHA-1 HW (PR 7087)
|
||||
* Update OpenSSH port to version 9.6p1(PR 7203)
|
||||
* ARM Thumb2 enhancements, AES-GCM support for GCM_SMALL, alignment fix on key, fix for ASM clobber list (PR 7291,7301,7221)
|
||||
* Expand heap hint support for static memory build with more x509 functions (PR 7136)
|
||||
* Improving ARMv8 ChaCha20 ASM (alignment) (PR 7182)
|
||||
* Unknown extension callback wolfSSL_CertManagerSetUnknownExtCallback added to CertManager (PR 7194)
|
||||
* Implement wc_rng_new_ex for use with devID’s with crypto callback (PR 7271)
|
||||
* Allow reading 0-RTT data after writing 0.5-RTT data (PR 7102)
|
||||
* Send alert on bad PSK binder error (PR 7235)
|
||||
* Enhancements to CMake build files for use with cross compiling (PR 7188)
|
||||
|
||||
|
||||
## Fixes
|
||||
|
||||
* Fix for checking result of MAC verify when no AAD is used with AES-GCM and Xilinx Xilsecure (PR 7051)
|
||||
* Fix for Aria sign use (PR 7082)
|
||||
* Fix for invalid `dh_ffdhe_test` test case using Intel QuickAssist (PR 7085)
|
||||
* Fixes for TI AES and SHA on TM4C with HW acceleration and add full AES GCM and CCM support with TLS (PR 7018)
|
||||
* Fixes for STM32 PKA use with ECC (PR 7098)
|
||||
* Fixes for TLS 1.3 with crypto callbacks to offload KDF / HMAC operation (PR 7070)
|
||||
* Fix include path for FSP 3.5 on Renesas RA6M4 (PR 7101)
|
||||
* Siphash x64 asm fix for use with older compilers (PR 7299)
|
||||
* Fix for SGX build with SP (PR 7308)
|
||||
* Fix to Make it mandatory that the cookie is sent back in new ClientHello when seen in a HelloRetryRequest with (PR 7190)
|
||||
* Fix for wrap around behavior with BIO pairs (PR 7169)
|
||||
* OCSP fixes for parsing of response correctly when there was a revocation reason and returning correct error value with date checks (PR 7241 & 7255)
|
||||
* Fix build with `NO_STDIO_FILESYSTEM` and improve checks for `XGETENV` (PR 7150)
|
||||
* Fix for DTLS sequence number and cookie when downgrading DTLS version (PR 7214)
|
||||
* Fix for write_dup use with chacha-poly cipher suites (PR 7206)
|
||||
* Fix for multiple handshake messages in one record failing with OUT_OF_ORDER_E when downgrading from TLS 1.3 to TLS 1.2 (PR 7141)
|
||||
* Fix for AES ECB build with Thumb and alignment (PR 7094)
|
||||
* Fix for negotiate handshake until the end in wolfSSL_read/wolfSSL_write if hitting an edge case with want read/write (PR 7237)
|
||||
|
||||
# wolfSSL Release 5.6.6 (Dec 19, 2023)
|
||||
|
||||
Release 5.6.6 has been developed according to wolfSSL's development and QA
|
||||
process (see link below) and successfully passed the quality criteria.
|
||||
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
|
||||
|
||||
NOTE: * --enable-heapmath is being deprecated and will be removed by 2024
|
||||
|
||||
REMINDER: When working with AES Block Cipher algorithms, `wc_AesInit()` should
|
||||
always be called first to initialize the `Aes` structure, before calling other
|
||||
Aes API functions. Recently we found several places in our documentation,
|
||||
comments, and codebase where this pattern was not observed. We have since
|
||||
fixed this omission in several PRs for this release.
|
||||
|
||||
## Vulnerabilities
|
||||
|
||||
* [Medium] CVE-2023-6935: After review of the previous RSA timing fix in wolfSSL 5.6.4, additional changes were found to be required. A complete resistant change is delivered in this release. This fix is for the Marvin attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a very large number of trial connections. This issue is around RSA decryption and affects the optional static RSA cipher suites on the server side, which are considered weak, not recommended to be used and are off by default in wolfSSL (even with `--enable-all`). Static RSA cipher suites were also removed from the TLS 1.3 protocol and are only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It is recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. Thanks to Hubert Kario for the report. The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6955.
|
||||
|
||||
* [Low] CVE-2023-6936: A potential heap overflow read is possible in servers connecting over TLS 1.3 when the optional `WOLFSSL_CALLBACKS` has been defined. The out of bounds read can occur when a server receives a malicious malformed ClientHello. Users should either discontinue use of `WOLFSSL_CALLBACKS` on the server side or update versions of wolfSSL to 5.6.6. Thanks to the tlspuffin fuzzer team for the report which was designed and developed by; Lucca Hirschi (Inria, LORIA), Steve Kremer (Inria, LORIA), and Max Ammann (Trail of Bits). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6949.
|
||||
|
||||
* [Low] A side channel vulnerability with AES T-Tables is possible in a very controlled environment where precision sub-cache-line inspection can happen, such as inside an Intel SGX enclave. This can lead to recovery of the AES key. To prevent this type of attack, wolfSSL added an AES bitsliced implementation which can be enabled with the “`--enable-aes-bitsliced`” configure option. Thanks to Florian Sieck, Zhiyuan Zhang, Sebastian Berndt, Chitchanok Chuengsatiansup, Thomas Eisenbarth, and Yuval Yarom for the report (Universities of Lübeck, Melbourne, Adelaide and Bochum). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6854.
|
||||
|
||||
* [Low] CVE-2023-6937: wolfSSL prior to 5.6.6 did not check that messages in a single (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and then the rest of the first server flight would be accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted after the ServerHello but a wolfSSL client would accept an unencrypted flight from the server. This does not compromise key negotiation and authentication so it is assigned a low severity rating. Thanks to Johannes Wilson for the report (Sectra Communications and Linköping University). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/7029.
|
||||
|
||||
## New Feature Additions
|
||||
|
||||
* Build option for disabling CRL date checks (`WOLFSSL_NO_CRL_DATE_CHECK`) (PR 6927)
|
||||
* Support for STM32WL55 and improvements to PKA ECC support (PR 6937)
|
||||
* Add option to skip cookie exchange on DTLS 1.3 session resumption (PR 6929)
|
||||
* Add implementation of SRTP KDF and SRTCP KDF (`--enable-srtp-kdf`) (PR 6888)
|
||||
* Add `wolfSSL_EXTENDED_KEY_USAGE_free()` (PR 6916)
|
||||
* Add AES bitsliced implementation that is cache attack safe (`--enable-aes-bitsliced`) (PR 6854)
|
||||
* Add memcached support and automated testing (PR 6430, 7022)
|
||||
* Add Hardware Encryption Acceleration for ESP32-C3, ESP32-C6, and ESP32-S2 (PR 6990)
|
||||
* Add (D)TLS 1.3 support for 0.5-RTT data (PR 7010)
|
||||
|
||||
## Enhancements and Optimizations
|
||||
|
||||
* Better built in testing of “`--sys-ca-certs`” configure option (PR 6910)
|
||||
* Updated CMakeLists.txt for Espressif wolfSSL component usage (PR 6877)
|
||||
* Disable TLS 1.1 by default (unless SSL 3.0 or TLS 1.0 is enabled) (PR 6946)
|
||||
* Add “`--enable-quic`” to “`--enable-all`” configure option (PR 6957)
|
||||
* Add support to SP C implementation for RSA exponent up to 64-bits (PR 6959)
|
||||
* Add result of “`HAVE___UINT128_T`” to options.h for CMake builds (PR 6965)
|
||||
* Add optimized assembly for AES-GCM on ARM64 using hardware crypto instructions (PR 6967)
|
||||
* Add built-in cipher suite tests for DTLS 1.3 PQC (PR 6952)
|
||||
* Add wolfCrypt test and unit test to ctest (PR 6977)
|
||||
* Move OpenSSL compatibility crypto APIs into `ssl_crypto.c` file (PR 6935)
|
||||
* Validate time generated from XGMTIME() (PR 6958)
|
||||
* Allow wolfCrypt benchmark to run with microsecond accuracy (PR 6868)
|
||||
* Add GitHub Actions testing with nginx 1.24.0 (PR 6982)
|
||||
* Allow encoding of CA:FALSE BasicConstraint during cert generation (PR 6953)
|
||||
* Add CMake option to enable DTLS-SRTP (PR 6991)
|
||||
* Add CMake options for enabling QUIC and cURL (PR 7049)
|
||||
* Improve RSA blinding to make code more constant time (PR 6955)
|
||||
* Refactor AES-NI implementation macros to allow dynamic fallback to C (PR 6981)
|
||||
* Default to native Windows threading API on MinGW (PR 7015)
|
||||
* Return better error codes from OCSP response check (PR 7028)
|
||||
* Updated Espressif ESP32 TLS client and server examples (PR 6844)
|
||||
* Add/clean up support for ESP-IDF v5.1 for a variety of ESP32 chips (PR 7035, 7037)
|
||||
* Add API to choose dynamic certs based on client ciphers/sigalgs (PR 6963)
|
||||
* Improve Arduino IDE 1.5 project file to match recursive style (PR 7007)
|
||||
* Simplify and improve apple-universal build script (PR 7025)
|
||||
|
||||
## Fixes
|
||||
|
||||
* Fix for async edge case with Intel QuickAssist/Cavium Nitrox (PR 6931)
|
||||
* Fix for building PKCS#7 with RSA disabled (PR 6902)
|
||||
* Fix for advancing output pointer in `wolfSSL_i2d_X509()` (PR 6891)
|
||||
* Fix for `EVP_EncodeBlock()` appending a newline (PR 6900)
|
||||
* Fix for `wolfSSL_RSA_verify_PKCS1_PSS()` with `RSA_PSS_SALTLEN_AUTO` (PR 6938)
|
||||
* Fixes for CODESonar reports around `isalpha()` and `isalnum()` calls (PR 6810)
|
||||
* Fix for SP ARM64 integer math to avoid compiler optimization issues (PR 6942)
|
||||
* Fix for SP Thumb2 inline assembly to add IAR build support (PR 6943, 6971)
|
||||
* Fix for SP Thumb2 to make functions not inlined (PR 6993)
|
||||
* Fix for SP Cortex-M assembly large build with IAR (PR 6954)
|
||||
* Fix for SP ARM64 assembly montgomery reduction by 4 (PR 6947)
|
||||
* Fix for SP ARM64 P-256 for not inlining functions for iOS compatibility (PR 6979)
|
||||
* Fix for `WOLFSSL_CALLBACKS` and potential memory error (PR 6949)
|
||||
* Fixes for wolfSSL’s Zephyr OS port (PR 6930)
|
||||
* Fix for build errors when building for NXP mmCAU (`FREESCALE_MMCAU`) (PR 6970)
|
||||
* Fix for TLS 1.3 `SendBuffered()` return code in non-blocking mode (PR 7001)
|
||||
* Fix for TLS `Hmac_UpdateFinal()` when padding byte is invalid (PR 6998)
|
||||
* Fix for ARMv8 AES-GCM streaming to check size of IV before storing (PR 6996)
|
||||
* Add missing calls to `wc_AesInit()` before `wc_AesSetKey()` (PR 7011)
|
||||
* Fix build errors with DTLS 1.3 enabled but TLS 1.2 disabled (PR 6976)
|
||||
* Fixes for building wolfSSL in Visual Studio (PR 7040)
|
||||
|
||||
# wolfSSL Release 5.6.4 (Oct 30, 2023)
|
||||
|
||||
Release 5.6.4 has been developed according to wolfSSL's development and QA process (see link below) and successfully passed the quality criteria.
|
||||
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
|
||||
|
||||
NOTE: * --enable-heapmath is being deprecated and will be removed by 2024
|
||||
* Old CyaSSL/CtaoCrypt shim layer was removed in this release (5.6.4)
|
||||
|
||||
## Vulnerabilities
|
||||
|
||||
* [Medium] A fix was added, but still under review for completeness, for a Bleichenbacher style attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a large number of trial connections. This issue is around RSA decryption and affects static RSA cipher suites on the server side, which are not recommended to be used and are off by default. Static RSA cipher suites were also removed from the TLS 1.3 protocol and only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It's recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. The fix is located in this pull request (https://github.com/wolfSSL/wolfssl/pull/6896)
|
||||
|
||||
## New Feature Additions
|
||||
|
||||
* DTLS 1.3 PQC: support fragmenting the second ClientHello message. This allows arbitrarily long keys to be used, opening up support for all PQC ciphersuites in DTLS 1.3.
|
||||
* SM2/SM3/SM4: Chinese cipher support including TLS 1.3 and 1.2 cipher suites. SM2 SP implementation available.
|
||||
* Ability to parse ASN1 only with SMIME_read_PKCS7
|
||||
* Added support for MemUse Entropy on Windows
|
||||
* Added Ada Bindings for wolfSSL
|
||||
* Added a PEM example that converts to and from DER/PEM.
|
||||
* Added LMS/HSS and XMSS/XMSS^MT wolfcrypt hooks, both normal and verify-only options.
|
||||
* Added support for the AES EAX mode of operation
|
||||
* Port for use with Hitch (https://github.com/varnish/hitch) added
|
||||
* Add XTS API's to handle multiple sectors in new port to VeraCrypt
|
||||
|
||||
## Enhancements and Optimizations
|
||||
|
||||
* Turned on SNI by default on hosts with resources
|
||||
* Improved support for Silicon Labs Simplicity Studio and the ERF32 Gecko SDK
|
||||
* Thumb-2 and ARM32 Curve25519 and Ed25519 assembly have significantly improved performance.
|
||||
* Thumb-2 AES assembly code added.
|
||||
* Thumb-2 and ARM32 SP implementations of RSA, DH and ECC have significantly improved performance.
|
||||
* Minor performance improvements to SP ECC for Intel x64.
|
||||
* AES-XTS assembly code added for Intel x64, Aarch64 and ARM32.
|
||||
* Added support for X963 KDFs to ECIES.
|
||||
* Added 32-bit type only implementation of AES GMULT using tables.
|
||||
* Add support for nginx version 1.25.0
|
||||
* Add support for Kerberos version 5 1.21.1
|
||||
* Check all CRL entries in case a single issuer has multiple CRL's loaded
|
||||
* CRL verify the entire chain including loaded CA's
|
||||
* Added example for building wolfSSL as an Apple universal binary framework using configure
|
||||
* Sniffer tool now supports decrypting TLS sessions using secrets obtained from a SSLKEYLOGFILE
|
||||
* Updates made for EBSNET port
|
||||
* Update "--enable-jni" to include additional defines for expanded JNI support. Also includes JCE and JSSE builds under the single enable option now.
|
||||
|
||||
## Fixes
|
||||
|
||||
* Fixed error handling when decrypted pre-master secret is too long when using static RSA.
|
||||
* Added a fix for keymod use with i.MX RT1170 CAAM blobs
|
||||
* Added a fix for AES-GCM use with Petalinux Xilinx
|
||||
* Fixed `wc_SignatureGenerate_ex` to not call verify twice
|
||||
* Fixed wolfCrypt FIPS DLL on Win32
|
||||
* Fixed TFM math library big-endian reading implementation when a zero length buffer is passed in.
|
||||
* Fixed NO_CERT configurations to build correctly.
|
||||
* Fixed ARM AES-GCM streaming assembly when –enable-opensslextra defined.
|
||||
* Added modulus checks to heap math implementation of mp_exptmod().
|
||||
* Fixed Windows assembly code to handle that certain XMM registers are non-volatile.
|
||||
* Aarch64 SP ECC implementation of sp_256_mont_dbl_4 has the register list for the assembly code fixed to include all used registers.
|
||||
* mp_sqrt_mod_prime fixed to limit the number of iterations of a loop to handle malicious non-prime values being passed in.
|
||||
* Ignore session ID's shorter than 32 bytes instead of erroring out
|
||||
|
||||
# wolfSSL Release 5.6.3 (Jun 16, 2023)
|
||||
|
||||
Release 5.6.3 of wolfSSL embedded TLS has 4 bug fixes:
|
||||
|
||||
* Fix for setting the atomic macro options introduced in release 5.6.2. This issue affects GNU gcc autoconf builds. The fix resolves a potential mismatch of the generated macros defined in options.h file and the macros used when the wolfSSL library is compiled. In version 5.6.2 this mismatch could result in unstable runtime behavior.
|
||||
* Fix for invalid suffix error with Windows build using the macro GCM_TABLE_4BIT.
|
||||
* Improvements to Encrypted Memory support (WC_PROTECT_ENCRYPTED_MEM) implementations for modular exponentiation in SP math-all (sp_int.c) and TFM (tfm.c).
|
||||
* Improvements to SendAlert for getting output buffer.
|
||||
|
||||
# wolfSSL Release 5.6.2 (Jun 09, 2023)
|
||||
|
||||
Release 5.6.2 has been developed according to wolfSSL's development and QA process (see link below) and successfully passed the quality criteria.
|
||||
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
|
||||
|
||||
NOTE: * --enable-heapmath is being deprecated and will be removed by 2024
|
||||
|
||||
Release 5.6.2 of wolfSSL embedded TLS has bug fixes and new features including:
|
||||
|
||||
## Vulnerabilities
|
||||
* [Low] In cases where a malicious agent could analyze cache timing at a very detailed level, information about the AES key used could be leaked during T/S Box lookups. One such case was shown on RISC-V hardware using the MicroWalk tool (https://github.com/microwalk-project/Microwalk). A hardened version of T/S Box lookups was added in wolfSSL to help mitigate this potential attack and is now on by default with RISC-V builds and can be enabled on other builds if desired by compiling wolfSSL with the macro WOLFSSL_AES_TOUCH_LINES. Thanks to Jan Wichelmann, Christopher Peredy, Florian Sieck, Anna Pätschke, Thomas Eisenbarth (University of Lübeck): MAMBO-V: Dynamic Side-Channel Leakage Analysis on RISC-V. Fixed in the following GitHub pull request https://github.com/wolfSSL/wolfssl/pull/6309
|
||||
* [High] In previous versions of wolfSSL if a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key generated, allowing an eavesdropper to reconstruct it and potentially allowing surreptitious access to or meddling with message contents in the session. This issue does not affect client validation of connected servers, nor expose private key information, but could result in an insecure TLS 1.3 session when not controlling both sides of the connection. We recommend that TLS 1.3 client side users update the version of wolfSSL used. Thanks to Johannes from Sectra Communications and Linköping University for the report. Fixed in the following GitHub pull request https://github.com/wolfSSL/wolfssl/pull/6412
|
||||
|
||||
## New Feature Additions
|
||||
|
||||
### New Ports and Expansions
|
||||
* Add support for STM32H5
|
||||
* Add support for Renesas TSIP v1.17
|
||||
* Add Renesas SCE RSA crypto-only support
|
||||
* STARCORE DSP port and example builds added
|
||||
* Add the function wc_PKCS7_SetDefaultSignedAttribs for setting PKCS7 signed attributes to use with PKCS7 bundle creation
|
||||
* NXP IMX6Q CAAM port with QNX and performance optimizations for AES-CTR
|
||||
|
||||
### New Build Options
|
||||
* ASN.1 print utility to decode ASN.1 syntax and print out human readable text --enable-asn-print. Utility app is located in the directory ./examples/asn1/
|
||||
* Add introspection for math build, wc_GetMathInfo() to get information about the math library compiled into the linked wolfSSL library
|
||||
* Implement TLS recommendations from RFC 9325 for hardening TLS/DTLS security. Enabled with the autoconf flag --enable-harden-tls.
|
||||
* Add option to support disabling thread local storage, --disable-threadlocal
|
||||
* Added wc_DsaSign_ex() and wc_DsaVerify_ex() for handling alternative digest algorithms with DSA Sign/Verify
|
||||
* Implement atomic operations interface. Macros auto-detect if atomic operations are expected to be available, can be turned off with the macro WOLFSSL_NO_ATOMICS
|
||||
* Added support for DTLS 1.3 Authentication and Integrity-Only Cipher Suites
|
||||
* Expand crypto callback to have a device ID find callback function with wc_CryptoCb_SetDeviceFindCb. Enabled with the macro WOLF_CRYPTO_CB_FIND
|
||||
|
||||
## Enhancements and Optimizations
|
||||
|
||||
### Optimizations
|
||||
* Increased performance with ChaCha20 C implementation and general XOR operations
|
||||
* Added integer type to the ASN.1 sequencing with ASN.1 Integer sequence
|
||||
* With wolfSSL_get_x509_next_altname reset alt name list to head once cycled through if compiling with the macro WOLFSSL_MULTICIRCULATE_ALTNAMELIST
|
||||
* Additional key validity sanity checks on input to wolfSSL_EC_KEY_set_private_key
|
||||
* adds support for TLSv1.3 stateful session tickets when using SSL_OP_NO_TICKET
|
||||
|
||||
### Memory Optimizations
|
||||
* Improvements to stack usage and management with SP int math library
|
||||
* Optimization to TLS 1.3 server to remove caching messages for Ed25519/Ed448
|
||||
* Added a HAVE_CURL macro build for building a subset of the wolfSSL library when linking with cURL
|
||||
* Memory usage improvement with reducing the size of alignment needed with AES
|
||||
* Reduce run time memory used with ECC operations and ALT_ECC_SIZE
|
||||
* Fixes and improvements for building edge cases such as crypto callback without hash-drbg with low footprint options
|
||||
* Support HAVE_SESSION_TICKET build option without depending on realloc
|
||||
|
||||
### Documentation
|
||||
* Instructions for GPDMA on STM32 configuration added
|
||||
* Add in instructions for compiling with zephyr on STM32
|
||||
* Documentation fixup for wolfSSL_get_chain_cert()
|
||||
* Fix the file pointed to in the TI RTOS documentation that we maintain
|
||||
* Documentation for wolfSSL_CertManagerFreeCRL
|
||||
* Updates made to AES and Chacha documentation
|
||||
* Update Japanese comments for Ed25519, AES, and other miscellaneous items
|
||||
|
||||
### Tests
|
||||
* Add in an option for easily testing malloc failures when building with WOLFSSL_MEM_FAIL_COUNT macro
|
||||
* Updated in process for using Expect vs Assert to facilitate more malloc failure tests
|
||||
* Enhance wolfCrypt test for builds that do not have ECC SECP curves enabled
|
||||
* ESP32 platform-specific VisualGDB test & benchmark projects
|
||||
* Update to dependencies in docker container file used for tests
|
||||
* Fix up for base 10 output with bundled benchmark application
|
||||
|
||||
### Port Updates
|
||||
* Zephyr port update, compile time warning fixes, misc. fixes when used with TLS and update of includes
|
||||
* Update RIOT-OS to not compile out use of writev by default
|
||||
* Update Micrium port to enable use of STM32_RNG
|
||||
* Micrium updates for XMEMOVE and XSTRTOK use
|
||||
* Various Espressif HW crypto, SHA2, AES, MP updates
|
||||
* Added in ASIO build option with CMake builds
|
||||
|
||||
### General Enhancements
|
||||
* Global codebase cleanup for C89 compliance and wolfCrypt -Wconversion hygiene
|
||||
* PKCS#11 enhancement adding a callback for RSA key size when using a hardware key, by default 2048 bit key is used
|
||||
* Allow for unknown OIDs in extensions in wolfSSL_X509_set_ext()
|
||||
* Allow user to override XSTAT by defining the macro XSTAT when compiling
|
||||
* Support UPN and SID with x509 certificate extensions and custom OID build
|
||||
* Write next IV in wolfSSL_DES_ede3_cbc_encrypt for better handling of inline encryption
|
||||
* Adding NO_ASN_TIME_CHECK build option for compiling out certificate before/after checks
|
||||
* Improve different peer recvfrom handling and error reporting with ipv4 vs ipv6
|
||||
|
||||
## Fixes
|
||||
* Fix for STM32 ECC sign and verify out of bounds buffer write when the hash length passed in is larger than the key size. Thanks to Maximilian for the report.
|
||||
* Fix to skip Async_DevCtxInit when using init rsa/ecc label/id api's
|
||||
* Revert WOLFSSL_NO_ASN_STRICT macro guard around alternate names directory list
|
||||
* In async mode, don't retry decrypting if a valid error is encountered on a packet parse attempt
|
||||
* Add additional sanity check on PKCS7 index value in wc_PKCS7_DecryptKekri
|
||||
* Fix for padding when using an AuthEnvelope PKCS7 type with GCM/CCM stream ciphers
|
||||
* Fix siphash assembly so that no register is left behind
|
||||
* Fix to not send a TLS 1.3 session ID resume response when resuming and downgrading to a protocol less than TLS 1.3
|
||||
* Fix overwriting serialNumber by favouriteDrink when generating a certificate using Cert struct
|
||||
* Fix for the default realloc used with EspressIf builds
|
||||
* Track SetDigest usage to avoid invalid free under error conditions
|
||||
* DTLS v1.3 fix for epoch 0 check on plaintext message
|
||||
* Fix for session ticket memory leak in wolfSSL_Cleanup
|
||||
* Fixes for propagating SendAlert errors when the peer disconnects
|
||||
* Replace XMEMCPY with XMEMMOVE to fix valgrind-3.15.0 reports "Source and destination overlap in memcpy" when using --enable-aesgcm-stream
|
||||
* Fix for potential out-of-bounds write edge case in fp_mod_2d with --enable-fastmath math library
|
||||
* Fix getting ECC key size in stm32_ecc_sign_hash_ex
|
||||
* Fix for case where wc_PeekErrorNodeLineData was not unlocking error queue on error
|
||||
* Fix for async ECC shared secret state
|
||||
* Fix for better error checking with sp_gcd with SP int math library
|
||||
* Fix memory leak in TLSX_KeyShare_Setup when handling an error case
|
||||
* Fix for double free edge case in InitOCSPRequest when handling a memory allocation failure
|
||||
* X509 NAME Entry fix for leaking memory on error case
|
||||
* Fix wolfssl_asn1_time_to_tm setting unexpected fields in tm struct
|
||||
* Fix for FIPS ECC integrity check with crypto callback set
|
||||
* BN_to_ASN1_INTEGER fix for handling leading zero byte padding when needed
|
||||
* Fix a typo in PP macro and add a ceiling to guard against implementation bugs
|
||||
* DTLS 1.3 fix for using the correct label when deriving the resumption key
|
||||
* OCSP fix for GetDateInfo edge case with non ASN template builds
|
||||
* Allow a user set certificate callback function to override the skipAddCA flag when parsing a certificate
|
||||
* SP int: sp_radix_size when radix 10 fix temp size for handling edge case
|
||||
* Fixes and improvements for handling failures with memory allocations
|
||||
* Fix for DecodeECC_DSA_Sig to handle r and s being initialized
|
||||
* Fix for wc_ecc_is_point to ensure that the x and y are in range [0, p-1] and z is one (affine ordinates)
|
||||
|
||||
### Build Fixes
|
||||
* Fix for building on Windows with CMake and using USER_SETTINGS and fix for options.h creation with CMake when using USER_SETTINGS
|
||||
* CMake fixes and improvements for use with mingw32
|
||||
* Fix for building with wpas and x509 small options
|
||||
* Check if colrm is available for options.h creation when using autoconf
|
||||
* Clean up NO_BIG_INT build, removing WOLFSSL_SP_MATH macro and heapmath compile
|
||||
* Fix PKCS#7 build with NO_PKCS7_STREAM
|
||||
* Fix compilation error in CC-RX and remove unnecessary public key import
|
||||
* SP Build fixes for ARM assembly with ARMv6 clz and ARM thumb debug build
|
||||
* For to not advertise support for RSA in TLS extensions when compiled with NO_RSA
|
||||
|
||||
# wolfSSL Release 5.6.0 (Mar 24, 2023)
|
||||
|
||||
Release 5.6.0 has been developed according to wolfSSL's development and QA process (see link below) and successfully passed the quality criteria.
|
||||
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
|
||||
|
||||
NOTE: * --enable-heapmath is being deprecated and will be removed by 2024
|
||||
* This release makes ASN Template the default with ./configure, the previous ASN parsing can be built with --enable-asn=original
|
||||
|
||||
Release 5.6.0 of wolfSSL embedded TLS has bug fixes and new features including:
|
||||
|
||||
## New Feature Additions
|
||||
|
||||
* ASN template is now the default ASN parsing implementation when compiling with configure
|
||||
* Added in support for TLS v1.3 Encrypted Client Hello (ECH) and HPKE (Hybrid Public Key Encryption)
|
||||
* DTLS 1.3 stateless server ClientHello parsing support added
|
||||
|
||||
### Ports
|
||||
* Add RX64/RX71 SHA hardware support
|
||||
* Port to RT1170 and expand NXP CAAM driver support
|
||||
* Add NuttX integration files for ease of use
|
||||
* Updated Stunnel support for version 5.67
|
||||
Compatibility Layer
|
||||
* Add in support for AES-CCM with EVP
|
||||
* BN compatibility API refactoring and separate API created
|
||||
* Expanding public key type cipher suite list strings support
|
||||
|
||||
### Misc.
|
||||
* Support pthread_rwlock and add enable option
|
||||
* Add wolfSSL_CertManagerLoadCABuffer_ex() that takes a user certificate chain flag and additional verify flag options
|
||||
* Docker build additions for wolfSSL library and wolfCLU application
|
||||
* Add favorite drink pilot attribute type to get it from the encoding
|
||||
* Added in support for indefinite length BER parsing with PKCS12
|
||||
* Add dynamic session cache which allocates sessions from the heap with macro SESSION_CACHE_DYNAMIC_MEM
|
||||
|
||||
|
||||
## Improvements / Optimizations
|
||||
|
||||
### Tests
|
||||
* Additional CI (continuous integration) testing and leveraging of GitHub workflows
|
||||
* Add CI testing for wpa_supplicant, OpenWrt and OpenVPN using GitHub workflows
|
||||
* Add compilation of Espressif to GitHub workflows tests
|
||||
* Refactoring and improving error results with wolfCrypt unit test application
|
||||
* Minor warning fixes from Coverity static analysis scan
|
||||
* Add new SHA-512/224 and SHA-512/256 tests
|
||||
* Used codespell and fixed some minor typos
|
||||
|
||||
### Ports
|
||||
* Improve TLS1.2 client authentication to use TSIP
|
||||
* Updated Kyber macro to be WOLFSSL_HAVE_KYBER and made changes that make Kyber work on STM32
|
||||
* AES-GCM Windows assembly additions
|
||||
* CRLF line endings, trailing spaces for C# Wrapper Projects
|
||||
Compatibility Layer
|
||||
* Update `PubKey` and `Key` PEM-to-DER APIs to support return of needed DER size
|
||||
* Allow reading ENC EC PRIVATE KEY as well via wolfSSL_PEM_read_bio_ECPrivateKey
|
||||
* Improve wolfSSL_EC_POINT_cmp to handle Jacobian ordinates
|
||||
* Fix issue with BIO_reset() and add BIO_FLAGS_MEM_RDONLY flag support for read only BIOs
|
||||
|
||||
### SP
|
||||
* In SP math library rework mod 3 and use count leading zero instruction
|
||||
* Fix with SP ECC sign to reject the random k generated when r is 0
|
||||
* With SP math add better detection of when add won't work and double is needed with point_add_qz1 internal function
|
||||
* With SP int fail when buffer writing to is too small for number rather than discarding the extra values
|
||||
|
||||
### Builds
|
||||
* Define WOLFSSL_SP_SMALL_STACK if wolfSSL is build with --enable-smallstack
|
||||
* Fix CMake to exclude libm when DH is not enabled
|
||||
* Allow building of SAKKE as external non-FIPS algorithm with wolfmikey product
|
||||
* Add option to add library suffix, --with-libsuffix
|
||||
* ASN template compile option WOLFSSL_ASN_INT_LEAD_0_ANY to allow leading zeros
|
||||
* Add user_settings.h template for wolfTPM to examples/configs/user_settings_wolftpm.h
|
||||
* Purge the AES variant of Dilithium
|
||||
* Expand WOLFSSL_NO_ASN_STRICT to allow parsing of explicit ECC public key
|
||||
* Remove relocatable text in ARMv7a AES assembly for use with FIPS builds
|
||||
* Expand checking for hardware that supports ARMv7a neon with autotools configure
|
||||
* Sanity check on allocation fails with DSA and FP_ECC build when zeroizing internal buffer
|
||||
* Additional TLS alerts sent when compiling with WOLFSSL_EXTRA_ALERTS macro defined
|
||||
|
||||
### Benchmarking
|
||||
* Update wolfCrypt benchmark Windows build files to support x64 Platform
|
||||
* Add SHA512/224 and SHA512/256 benchmarks, fixed CVS macro and display sizes
|
||||
* Separate AES-GCM streaming runs when benchmarked
|
||||
* No longer call external implementation of Kyber from benchmark
|
||||
* Fix for benchmarking shake with custom block size
|
||||
* Fixes for benchmark help `-alg` list and block format
|
||||
Documentation/Examples
|
||||
* Document use of wc_AesFree() and update documentation of Ed25519 with Doxygen
|
||||
* Move the wolfSSL Configuration section higher in QUIC.md
|
||||
* Add Japanese Doxygen documentation for cmac.h, quic.h and remove incomplete Japanese doxygen in asn_public.h
|
||||
* Espressif examples run with local wolfSSL now with no additional setup needed
|
||||
* Added a fix for StartTLS use In the example client
|
||||
* Add a base-line user_settings.h for use with FIPS 140-3 in XCode example app
|
||||
|
||||
### Optimizations
|
||||
* AES-NI usage added for AES modes ECB/CTR/XTS
|
||||
|
||||
### Misc
|
||||
* Update AES-GCM stream decryption to allow long IVs
|
||||
* Internal refactor to use wolfSSL_Ref functions when incrementing or decrementing the structures reference count and fixes for static analysis reports
|
||||
* Cleanup function logging making adjustments to the debug log print outs
|
||||
* Remove realloc dependency in DtlsMsgCombineFragBuckets function
|
||||
* Refactor to use WOLFSSL_CTX’s cipher suite list when possible
|
||||
* Update internal padding of 0’s with DSA sign and additional tests with mp_to_unsigned_bin_len function
|
||||
* With DTLS SRTP use wolfSSL_export_keying_material instead of wc_PRF_TLS
|
||||
* Updated macro naming from HAVE_KYBER to be WOLFSSL_HAVE_KYBER
|
||||
* Update AES XTS encrypt to handle in-place encryption properly
|
||||
* With TLS 1.3 add option to require only PSK with DHE
|
||||
|
||||
## Fixes
|
||||
|
||||
### Ports
|
||||
* Fix for AES use with CAAM on imx8qxp with SECO builds
|
||||
* Fix for PIC32 crypto HW and unused `TLSX_SetResponse`
|
||||
* Fix warning if ltime is unsigned seen with QNX build
|
||||
* Updates and fix for Zephyr project support
|
||||
* Include sys/time.h for WOLFSSL_RIOT_OS
|
||||
* Move X509_V errors from enums to defines for use with HAProxy CLI
|
||||
* Fix IAR compiler warnings resolved
|
||||
* Fix for STM32 Hash peripherals (like on F437) with FIFO depth = 1
|
||||
* ESP32 fix for SHA384 init with hardware acceleration
|
||||
|
||||
### Builds
|
||||
* Add WOLFSSL_IP_ALT_NAME macro define to --enable-curl
|
||||
* Fixes for building with C++17 and avoiding clashing with byte naming
|
||||
* Fixes SP math all build issue with small-stack and no hardening
|
||||
* Fix for building with ASN template with `NO_ASN_TIME` defined
|
||||
* Fix building FIPSv2 with WOLFSSL_ECDSA_SET_K defined
|
||||
* Don't allow aesgcm-stream option with kcapi
|
||||
* Fix DTLS test case for when able to read peers close notify alert on FreeBSD systems
|
||||
* Fix for "expression must have a constant value" in tls13.c with Green Hills compiler
|
||||
* Fixes for building KCAPI with opensslextra enabled
|
||||
* Fix warnings of shadows min and subscript with i486-netbsd-gcc compiler
|
||||
* Fix issue with async and `WOLFSSL_CHECK_ALERT_ON_ERR`
|
||||
* Fix for PKCS7 with asynchronous crypto enabled
|
||||
|
||||
### Math Library
|
||||
* SP Aarch64 fix for conditional changed in asm needing "cc" and fix for ECC P256 mont reduce
|
||||
* In SP builds add sanity check with DH exp. to check the output length for minimum size
|
||||
* In SP math fix scalar length check with EC scalar multiply
|
||||
* With SP int fix handling negative character properly with read radix
|
||||
* Add error checks before setting variable err in SP int with the function sp_invmod_mont_ct
|
||||
* Fix to add sanity check for malloc of zero size in fastmath builds
|
||||
* In fastmath fix a possible overflow in fp_to_unsigned_bin_len length check
|
||||
* Heapmath fast mod. reduce fix
|
||||
|
||||
### Compatibility Layer
|
||||
* Fixes for encoding/decoding ecc public keys and ensure i2d public key functions do not include any private key information
|
||||
* Fix for EVP_EncryptUpdate to update outl on empty input
|
||||
* Fix SE050 RSA public key loading and RSA/ECC SE050 TLS Compatibility
|
||||
* Rework EC API and validate point after setting it
|
||||
* Fix for X509 RSA PSS with compatibility layer functions
|
||||
* Fix size of structures used with SHA operations when built with opensslextra for Espressif hardware accelerated hashing
|
||||
* Added sanity check on key length with wolfSSL_CMAC_Init function
|
||||
* Fix for return value type conversion of bad mutex error in logging function
|
||||
* Fix NID conflict NID_givenName and NID_md5WithRSAEncryption
|
||||
* Fix unguarded XFPRINTF calls with opensslextra build
|
||||
* Fix wolfSSL_ASN1_INTEGER_to_BN for negative values
|
||||
* Fix for potential ASN1_STRING leak in wolfSSL_X509_NAME_ENTRY_create_by_txt and wolfSSL_X509_NAME_ENTRY_create_by_NID when memory allocation fails
|
||||
|
||||
### Misc.
|
||||
* Add sanity check to prevent an out of bounds read with OCSP response decoding
|
||||
* Sanity check to not allow 0 length with bit string and integer when parsing ASN1 syntax
|
||||
* Adjust RNG sanity checks and remove error prone first byte comparison
|
||||
* With PKCS7 add a fix for GetAsnTimeString() to correctly increment internal data pointer
|
||||
* PKCS7 addition of sequence around algo parameters with authenvelop
|
||||
* DSA fixes for clearing mp_int before re-reading data and avoid mp_clear without first calling mp_init
|
||||
* Fix for SRTP setting bitfield when it is encoded for the TLS extension
|
||||
* Fix for handling small http headers when doing CRL verification
|
||||
* Fix for ECCSI hash function to validate the output size and curve size
|
||||
* Fix for value of givenName and name being reversed with CSR generation
|
||||
* Fix for error type returned (OCSP_CERT_UNKNOWN) with OCSP verification
|
||||
* Fix for a potential memory leak with ProcessCSR when handling OCSP responses
|
||||
* Fix for VERIFY_SKIP_DATE flag not ignoring date errors when set
|
||||
* Fix for zlib decompression buffer issue with PKCS7
|
||||
* Fix for DTLS message pool send size used and DTLS server saving of the handshake sequence
|
||||
* Fix to propagate WOLFSSL_TICKET_RET_CREATE error return value from DoDecryptTicket()
|
||||
* Fix for handling long session IDs with TLS 1.3 session tickets
|
||||
* Fix for AES-GCM streaming when caching an IV
|
||||
* Fix for test case with older selftest that returns bad padding instead of salt len error
|
||||
* Add fix for siphash cache and added in additional tests
|
||||
* Fix potential out of bounds memset to 0 in error case with session export function used with --enable-sessionexport builds
|
||||
* Fix possible NULL dereference in TLSX_CSR_Parse with TLS 1.3
|
||||
* Fix for sanity check on RSA pad length with no padding using the build macro WC_RSA_NO_PADDING
|
||||
|
||||
# wolfSSL Release 5.5.4 (Dec 21, 2022)
|
||||
|
||||
Release 5.5.4 of wolfSSL embedded TLS has bug fixes and new features including:
|
||||
|
||||
## New Feature Additions
|
||||
|
||||
* QUIC related changes for HAProxy integration and config option
|
||||
* Support for Analog Devices MAXQ1080 and MAXQ1065
|
||||
* Testing and build of wolfSSL with NuttX
|
||||
* New software based entropy gatherer with configure option --enable-entropy-memuse
|
||||
* NXP SE050 feature expansion and fixes, adding in RSA support and conditional compile of AES and CMAC
|
||||
* Support for multi-threaded sniffer
|
||||
|
||||
## Improvements / Optimizations
|
||||
|
||||
### Benchmark and Tests
|
||||
* Add alternate test case for unsupported static memory API when testing mutex allocations
|
||||
* Additional unit test cases added for AES CCM 256-bit
|
||||
* Initialize and free AES object with benchmarking AES-OFB
|
||||
* Kyber with DTLS 1.3 tests added
|
||||
* Tidy up Espressif ESP32 test and benchmark examples
|
||||
* Rework to be able to run API tests individually and add display of time taken per test
|
||||
|
||||
### Build and Port Improvements
|
||||
* Add check for 64-bit ABI on MIPS64 before declaring a 64-bit CPU
|
||||
* Add support to detect SIZEOF_LONG in armclang and diab
|
||||
* Added in a simple example working on Rx72n
|
||||
* Update azsphere support to prevent compilation of file included inline
|
||||
* --enable-brainpool configure option added and default to on when custom curves are also on
|
||||
* Add RSA PSS salt defines to engine builds if not FIPS v2
|
||||
|
||||
### Post Quantum
|
||||
* Remove kyber-90s and route all Kyber through wolfcrypt
|
||||
* Purge older version of NTRU and SABER from wolfSSL
|
||||
|
||||
### SP Math
|
||||
* Support static memory build with sp-math
|
||||
* SP C, SP int: improve performance
|
||||
* SP int: support mingw64 again
|
||||
* SP int: enhancements to guess 64-bit type and check on NO_64BIT macro set before using long long
|
||||
* SP int: check size required when using sp_int on stack
|
||||
* SP: --enable-sp-asm now enables SP by default if not set
|
||||
* SP: support aarch64 big endian
|
||||
|
||||
### DTLS
|
||||
* Allow DTLS 1.3 to compile when FIPS is enabled
|
||||
* Allow for stateless DTLS client hello parsing
|
||||
|
||||
### Misc.
|
||||
* Easier detection of DRBG health when using Intel’s RDRAND by updating the structures status value
|
||||
* Detection of duplicate known extensions with TLS
|
||||
* PKCS#11 handle a user PIN that is a NULL_PTR, compile time check in finding keys, add initialization API
|
||||
* Update max Cert Policy size based on RFC 5280
|
||||
* Add Android CA certs path for wolfSSL_CTX_load_system_CA_certs()
|
||||
* Improve logic for enabling system CA certs on Apple devices
|
||||
* Stub functions to allow for cpuid public functions with non-intel builds
|
||||
* Increase RNG_SECURITY_STRENGTH for FIPS
|
||||
* Improvements in OpenSSL Compat ERR Queue handling
|
||||
* Support ASN1/DER CRLs in LoadCertByIssuer
|
||||
* Expose more ECC math functions and improve async shared secret
|
||||
* Improvement for sniffer error messages
|
||||
* Warning added that renegotiation in TLS 1.3 requires session ticket
|
||||
* Adjustment for TLS 1.3 post auth support
|
||||
* Rework DH API and improve PEM read/write
|
||||
|
||||
## Fixes
|
||||
|
||||
### Build Fixes
|
||||
* Fix --enable-devcrypto build error for sys without u_int8_t type
|
||||
* Fix casts in evp.c and build issue in ParseCRL
|
||||
* Fixes for compatibility layer building with heap hint and OSSL callbacks
|
||||
* fix compile error due to Werro=undef on gcc-4.8
|
||||
* Fix mingw-w64 build issues on windows
|
||||
* Xcode project fixes for different build settings
|
||||
* Initialize variable causing failures with gcc-11 and gcc-12 with a unique wolfSSL build configuration
|
||||
* Prevent WOLFSSL_NO_MALLOC from breaking RSA certificate verification
|
||||
* Fixes for various tests that do not properly handle `WC_PENDING_E` with async. builds
|
||||
* Fix for misc `HashObject` to be excluded for `WOLFCRYPT_ONLY`
|
||||
|
||||
### OCSP Fixes
|
||||
* Correctly save next status with OCSP response verify
|
||||
* When the OCSP responder returns an unknown exception, continue through to checking the CRL
|
||||
|
||||
### Math Fixes
|
||||
* Fix for implicit conversion with 32-bit in SP math
|
||||
* Fix for error checks when modulus is even with SP int build
|
||||
* Fix for checking of err in _sp_exptmod_nct with SP int build
|
||||
* ECC cofactor fix when checking scalar bits
|
||||
* ARM32 ASM: don't use ldrd on user data
|
||||
* SP int, fix when ECC specific size code included
|
||||
|
||||
### Port Fixes
|
||||
* Fixes for STM32 PKA ECC (not 256-bit) and improvements for AES-GCM
|
||||
* Fix for cryptocell signature verification with ECC
|
||||
* Benchmark devid changes, CCM with SECO fix, set IV on AES import into SECO
|
||||
|
||||
### Compat. Layer Fixes
|
||||
* Fix for handling DEFAULT:... cipher suite list
|
||||
* Fix memory leak in wolfSSL_X509_NAME_ENTRY_get_object
|
||||
* Set alt name type to V_ASN1_IA5STRING
|
||||
* Update name hash functions wolfSSL_X509_subject_name_hash and wolfSSL_X509_issuer_name_hash to hash the canonical form of subject
|
||||
* Fix wolfSSL_set_SSL_CTX() to be usable during handshake
|
||||
* Fix X509_get1_ocsp to set num of elements in stack
|
||||
* X509v3 EXT d2i: fix freeing of aia
|
||||
* Fix to remove recreation of certificate with wolfSSL_PEM_write_bio_X509()
|
||||
* Link newly created x509 store's certificate manager to self by default to assist with CRL verification
|
||||
* Fix for compatibility `EC_KEY_new_by_curve_name` to not create a key if the curve is not found
|
||||
|
||||
### Misc.
|
||||
* Free potential signer malloc in a fail case
|
||||
* fix other name san parsing and add RID cert to test parsing
|
||||
* WOLFSSL_OP_NO_TICKET fix for TLSv1.2
|
||||
* fix ASN template parsing of X509 subject directory attribute
|
||||
* Fix the wrong IV size with the cipher suite TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256
|
||||
* Fix incorrect self signed error return when compiled with certreq and certgen.
|
||||
* Fix wrong function name in debug comment with wolfSSL_X509_get_name_oneline()
|
||||
* Fix for decryption after second handshake with async sniffer
|
||||
* Allow session tickets to properly resume when using PQ KEMs
|
||||
* Add sanity overflow check to DecodeAltNames input buffer access
|
||||
|
||||
# wolfSSL Release 5.5.3 (Nov 2, 2022)
|
||||
|
||||
Release 5.5.3 of wolfSSL embedded TLS has the following bug fix:
|
||||
|
||||
## Fixes
|
||||
|
||||
* Fix for possible buffer zeroization overrun introduced at the end of v5.5.2 release cycle in GitHub pull request 5743 (https://github.com/wolfSSL/wolfssl/pull/5743) and fixed in pull request 5757 (https://github.com/wolfSSL/wolfssl/pull/5757). In the case where a specific memory allocation failed or a hardware fault happened there was the potential for an overrun of 0’s when masking the buffer used for (D)TLS 1.2 and lower operations. (D)TLS 1.3 only and crypto only users are not affected by the issue. This is not related in any way to recent issues reported in OpenSSL.
|
||||
|
||||
|
||||
# wolfSSL Release 5.5.2 (Oct 28, 2022)
|
||||
Release 5.5.2 of wolfSSL embedded TLS has bug fixes and new features including:
|
||||
|
||||
## Vulnerabilities
|
||||
* [Med] In the case that the WOLFSSL_CALLBACKS macro is set when building wolfSSL, there is a potential heap over read of 5 bytes when handling TLS 1.3 client connections. This heap over read is limited to wolfSSL builds explicitly setting the macro WOLFSSL_CALLBACKS, the feature does not get turned on by any other build options. The macro WOLFSSL_CALLBACKS is intended for debug use only, but if having it enabled in production, users are recommended to disable WOLFSSL_CALLBACKS. Users enabling WOLFSSL_CALLBACKS are recommended to update their version of wolfSSL. Thanks to Lucca Hirschi and Steve Kremer from LORIA, Inria and Max Ammann from Trail of Bits for finding and reporting the bug with the tlspuffin tool developed partly at LORIA and Trail of Bits. CVE 2022-42905
|
||||
|
||||
Release 5.5.2 of wolfSSL embedded TLS has bug fixes and new features including:
|
||||
|
||||
## New Feature Additions
|
||||
* Add function wolfSSL_CTX_load_system_CA_certs to load system CA certs into a WOLFSSL_CTX and --sys-ca-certs option to example client
|
||||
* Add wolfSSL_set1_host to OpenSSL compatible API
|
||||
* Added the function sk_X509_shift
|
||||
* AES x86 ASM for AES-CBC and GCM performance enhancements
|
||||
* Add assembly for AES for ARM32 without using crypto hardware instructions
|
||||
* Xilinx Versal port and hardware acceleration tie in
|
||||
* SP Cortex-M support for ICCARM
|
||||
|
||||
## Enhancements
|
||||
* Add snifftest vcxproj file and documentation
|
||||
* Nucleus Thread Types supported
|
||||
* Handle certificates with RSA-PSS signature that have RSAk public keys
|
||||
* Small stack build improvements
|
||||
* DTLS 1.3 improvements for Alerts and unit tests
|
||||
* Add a binary search for CRL
|
||||
* Improvement of SSL/CTX_set_max_early_data() for client side
|
||||
* Remove unused ASN1_GENERALIZEDTIME enum value from wolfssl/ssl.h
|
||||
* Add user_settings.h for Intel/M1 FIPSv2 macOS C++ projects
|
||||
* Add dtlscid.test to ‘make check’ unit testing
|
||||
* Generate an assembler-safe user_settings.h in configure.ac and CMakeLists.txt
|
||||
* ForceZero enabled with USE_FAST_MATH
|
||||
* Add TLS 1.3 support of ticketNonce sizes bigger than MAX_TICKET_NONCE_SZ
|
||||
* FIPSv2 builds on win10 adjust for new fastmath default in settings.h
|
||||
* Add IRQ install for Aruix example
|
||||
|
||||
## Fixes
|
||||
* When looking up the session by ID on the server, check that the protocol version of the SSL and session match on TLS 1.3 or not
|
||||
* Fix for potential EVP_PKEY_DH memory leak with OPENSSL_EXTRA
|
||||
* Curve448 32-bit C code: handle corner case
|
||||
* Fixup builds using WOLFSSL_LOG_PRINTF
|
||||
* Correct DIST_POINT_NAME type value
|
||||
* Do not perform IV Wrap test when using cert3389 inlined armasm
|
||||
* Fix for Linux kernel module and stdio.h
|
||||
* (D)TLS: send alert on version mismatch
|
||||
* Fix PKCS#7 SignedData verification when signer cert is not first in SET
|
||||
* Fix bug with wolfIO_TcpConnect not working with timeout on Windows
|
||||
* Fix output length bug in SP non-blocking ECC shared secret gen
|
||||
* Fix build with enable-fastmath and disable-rsa
|
||||
* Correct wolfSSL_sk_X509_new in OpenSSL compatible API
|
||||
* Fixes for SP and x86_64 with MSVC
|
||||
* Fix wrong size using DTLSv1.3 in RestartHandshakeHashWithCookie
|
||||
* Fix redundant file include with TI RTOS build
|
||||
* Fix wolfCrypt only build with wincrypt.h
|
||||
* DTLS 1.2: Reset state when sending HelloVerifyRequest
|
||||
|
||||
# wolfSSL Release 5.5.1 (Sep 28, 2022)
|
||||
Release 5.5.1 of wolfSSL embedded TLS has bug fixes and new features including:
|
||||
|
||||
## Vulnerabilities
|
||||
* [Med] Denial of service attack and buffer overflow against TLS 1.3 servers using session ticket resumption. When built with --enable-session-ticket and making use of TLS 1.3 server code in wolfSSL, there is the possibility of a malicious client to craft a malformed second ClientHello packet that causes the server to crash. This issue is limited to when using both --enable-session-ticket and TLS 1.3 on the server side. Users with TLS 1.3 servers, and having --enable-session-ticket, should update to the latest version of wolfSSL. Thanks to Max at Trail of Bits for the report, found by Lucca Hirschi from LORIA, Inria, France with the tlspuffin tool developed partly at LORIA and Trail of Bits. CVE-2022-39173
|
||||
|
||||
## New Feature Additions
|
||||
* Add support for non-blocking ECC key gen and shared secret gen for P-256/384/521
|
||||
* Add support for non-blocking ECDHE/ECDSA in TLS/DTLS layer.
|
||||
* Port to NXP RT685 with FreeRTOS
|
||||
* Add option to build post quantum Kyber API (--enable-kyber)
|
||||
* Add post quantum algorithm sphincs to wolfCrypt
|
||||
* Config. option to force no asm with SP build (--enable-sp=noasm)
|
||||
* Allow post quantum keyshare for DTLS 1.3
|
||||
|
||||
## Enhancements
|
||||
* DTLSv1.3: Do HRR Cookie exchange by default
|
||||
* Add wolfSSL_EVP_PKEY_new_CMAC_key to OpenSSL compatible API
|
||||
* Update ide win10 build files to add missing sp source files
|
||||
* Improve Workbench docs
|
||||
* Improve EVP support for CHACHA20_POLY1305
|
||||
* Improve `wc_SetCustomExtension` documentation
|
||||
* RSA-PSS with OCSP and add simple OCSP response DER verify test case
|
||||
* Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h
|
||||
* Don't over-allocate memory for DTLS fragments
|
||||
* Add WOLFSSL_ATECC_TFLXTLS for Atmel port
|
||||
* SHA-3 performance improvements with x86_64 assembly
|
||||
* Add code to fallback to S/W if TSIP cannot handle
|
||||
* Improves entropy with VxWorks
|
||||
* Make time in milliseconds 64-bits for longer session ticket lives
|
||||
* Support for setting cipher list with bytes
|
||||
* wolfSSL_set1_curves_list(), wolfSSL_CTX_set1_curves_list() improvements
|
||||
* Add to RSAES-OAEP key parsing for pkcs7
|
||||
* Add missing DN nid to work with PrintName()
|
||||
* SP int: default to 16 bit word size when NO_64BIT defined
|
||||
* Limit the amount of fragments we store per a DTLS connection and error out when max limit is reached
|
||||
* Detect when certificate's RSA public key size is too big and fail on loading of certificate
|
||||
|
||||
## Fixes
|
||||
* Fix for async with OCSP non-blocking in `ProcessPeerCerts`
|
||||
* Fixes for building with 32-bit and socket size sign/unsigned mismatch
|
||||
* Fix Windows CMakeList compiler options
|
||||
* TLS 1.3 Middle-Box compat: fix missing brace
|
||||
* Configuration consistency fixes for RSA keys and way to force disable of private keys
|
||||
* Fix for Aarch64 Mac M1 SP use
|
||||
* Fix build errors and warnings for MSVC with DTLS 1.3
|
||||
* Fix HMAC compat layer function for SHA-1
|
||||
* Fix DTLS 1.3 do not negotiate ConnectionID in HelloRetryRequest
|
||||
* Check return from call to wc_Time
|
||||
* SP math: fix build configuration with opensslall
|
||||
* Fix for async session tickets
|
||||
* SP int mp_init_size fixes when SP_WORD_SIZE == 8
|
||||
* Ed. function to make public key now checks for if the private key flag is set
|
||||
* Fix HashRaw WC_SHA256_DIGEST_SIZE for wc_Sha256GetHash
|
||||
* Fix for building with PSK only
|
||||
* Set correct types in wolfSSL_sk_*_new functions
|
||||
* Sanity check that size passed to mp_init_size() is no more than SP_INT_DIGITS
|
||||
|
||||
|
||||
# wolfSSL Release 5.5.0 (Aug 30, 2022)
|
||||
|
||||
Note:
|
||||
@@ -3497,7 +2687,7 @@ More info can be found on-line at //http://wolfssl.com/yaSSL/Docs.html
|
||||
a) If using wolfSSL for DTLS on the server side of a publicly accessible
|
||||
machine you MUST update.
|
||||
b) If using wolfSSL for TLS on the server side with private RSA keys allowing
|
||||
ephemeral key exchange without low memory optimizations you MUST update and
|
||||
ephemeral key exchange without low memory optimziations you MUST update and
|
||||
regenerate the private RSA keys.
|
||||
|
||||
Please see https://www.wolfssl.com/wolfSSL/Blog/Blog.html for more details
|
||||
|
||||
@@ -1,56 +0,0 @@
|
||||
ARG DOCKER_BASE_IMAGE=ubuntu:22.04
|
||||
FROM $DOCKER_BASE_IMAGE
|
||||
|
||||
USER root
|
||||
|
||||
# Set timezone to UTC
|
||||
RUN ln -snf /usr/share/zoneinfo/UTC /etc/localtime && echo UTC > /etc/timezone
|
||||
|
||||
ARG DEPS_WOLFSSL="build-essential autoconf libtool clang clang-tools zlib1g-dev libuv1-dev libpam0g-dev valgrind git linux-headers-generic gcc-multilib g++-multilib libpcap-dev bubblewrap gdb iputils-ping lldb bsdmainutils netcat binutils-arm-linux-gnueabi binutils-aarch64-linux-gnu"
|
||||
ARG DEPS_LIBOQS="astyle cmake gcc ninja-build libssl-dev python3-pytest python3-pytest-xdist unzip xsltproc doxygen graphviz python3-yaml valgrind git"
|
||||
ARG DEPS_UDP_PROXY="wget libevent-dev"
|
||||
ARG DEPS_TESTS="abi-dumper libcurl4-openssl-dev tcpdump libpsl-dev python3-pandas python3-tabulate libnl-genl-3-dev libcap-ng-dev"
|
||||
ARG DEPS_TOOLS="ccache clang-tidy maven"
|
||||
RUN DEBIAN_FRONTEND=noninteractive apt update && apt install -y apt-utils \
|
||||
&& apt install -y ${DEPS_WOLFSSL} ${DEPS_LIBOQS} ${DEPS_UDP_PROXY} ${DEPS_TESTS} ${DEPS_TOOLS} \
|
||||
&& apt clean -y && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Add 'docker' user
|
||||
ARG USER=docker
|
||||
ARG UID=1000
|
||||
ARG GID=1000
|
||||
RUN groupadd -f -g ${GID} docker && ( getent passwd ${UID} || useradd -ms /bin/bash ${USER} -u ${UID} -g ${GID} )
|
||||
|
||||
# Add github.com as an SSH known host
|
||||
RUN ssh -o StrictHostKeyChecking=no -T git@github.com; cat ~/.ssh/known_hosts >> /etc/ssh/ssh_known_hosts
|
||||
|
||||
# install ccache
|
||||
RUN mkdir -p /opt/ccache/bin && for prog in gcc g++ cc c++ cpp arm-none-eabi-c++ arm-none-eabi-cpp arm-none-eabi-gcc arm-none-eabi-g++; do ln -s /usr/bin/ccache /opt/ccache/bin/$(basename $prog); done
|
||||
ENV PATH /opt/ccache/bin:$PATH
|
||||
|
||||
# install liboqs
|
||||
RUN git clone --single-branch https://github.com/open-quantum-safe/liboqs.git && cd liboqs && git checkout db08f12b5a96aa6582a82aac7f65cf8a4d8b231f \
|
||||
&& mkdir build && cd build && cmake -DOQS_DIST_BUILD=ON -DOQS_USE_CPUFEATURE_INSTRUCTIONS=OFF -DOQS_USE_OPENSSL=0 .. && make -j8 all && make install && cd ../.. && rm -rf liboqs
|
||||
|
||||
RUN mkdir /opt/sources
|
||||
|
||||
# install liblms
|
||||
RUN cd /opt/sources && git clone --single-branch https://github.com/cisco/hash-sigs.git && cd hash-sigs && git checkout b0631b8891295bf2929e68761205337b7c031726 \
|
||||
&& sed -i 's/USE_OPENSSL 1/USE_OPENSSL 0/g' sha256.h && make -j4 hss_lib_thread.a
|
||||
|
||||
# Install pkixssh to /opt/pkixssh for X509 interop testing with wolfSSH
|
||||
RUN mkdir /var/empty
|
||||
RUN cd /opt/sources && wget -q -O- https://roumenpetrov.info/secsh/src/pkixssh-14.1.1.tar.gz | tar xzf - && cd pkixssh-14.1.1 && ./configure --prefix=/opt/pkixssh/ --exec-prefix=/opt/pkixssh/ && make install
|
||||
|
||||
# Install udp/tcp-proxy
|
||||
RUN cd /opt/sources && git clone --depth=1 --single-branch --branch=main http://github.com/wolfssl/udp-proxy && cd udp-proxy && make && cp tcp_proxy udp_proxy /bin/.
|
||||
|
||||
# Allow non-root to use tcpdump (will need NET_RAW and NET_ADMIN capability when running the container)
|
||||
RUN setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/tcpdump
|
||||
# Allow non-root to use gdb on processes (will need SYS_PTRACE capability when running the container)
|
||||
RUN setcap 'CAP_SYS_PTRACE+eip' /usr/bin/gdb
|
||||
|
||||
# Add in Jenkins userID
|
||||
RUN for i in $(seq 1001 1010); do ( getent passwd ${i} || useradd -ms /bin/bash jenkins${i} -u ${i} -g ${GID} ); done
|
||||
|
||||
USER ${UID}:${GID}
|
||||
@@ -1,11 +0,0 @@
|
||||
ARG DOCKER_BASE_IMAGE=wolfssl/wolfssl-builder
|
||||
FROM $DOCKER_BASE_IMAGE
|
||||
|
||||
USER root
|
||||
|
||||
ARG DEPS_TESTING="gcc-arm-linux-gnueabi gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu gcc-powerpc-linux-gnu gcc-powerpc64-linux-gnu gcc-arm-none-eabi"
|
||||
RUN DEBIAN_FRONTEND=noninteractive apt update \
|
||||
&& apt install -y ${DEPS_TESTING} \
|
||||
&& apt clean -y && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
USER docker
|
||||
@@ -1,12 +0,0 @@
|
||||
# This Dockerfile is used in conjunction with the docker-OpenWrt.yml GitHub Action.
|
||||
ARG DOCKER_BASE_CONTAINER=openwrt/rootfs:x86-64-snapshot
|
||||
FROM $DOCKER_BASE_CONTAINER
|
||||
|
||||
RUN mkdir -p /var/lock # Fix for parent container
|
||||
COPY libwolfssl.so /tmp/libwolfssl.so
|
||||
RUN export LIBWOLFSSL=$(ls /usr/lib/libwolfssl.so.* -1); \
|
||||
rm ${LIBWOLFSSL} && ln -s /tmp/libwolfssl.so ${LIBWOLFSSL}
|
||||
# for debugging purposes to make sure the correct library is tested
|
||||
RUN ls -Ll /usr/lib/libwolfssl* && ldd /lib/libustream-ssl.so | grep wolfssl
|
||||
COPY runTests.sh /tmp/.
|
||||
RUN /tmp/runTests.sh
|
||||
@@ -1,13 +0,0 @@
|
||||
This container is really only useful in conjunction with the GitHub Workflow
|
||||
found in .github/workflows/docker-OpenWrt.yml. The idea is that we will
|
||||
compile a new libwolfssl that gets placed in official OpenWrt containers to
|
||||
run some tests ensuring the library is still compatible with existing
|
||||
binaries.
|
||||
|
||||
To run the test locally, build libwolfssl.so (or download from the GitHub Action)
|
||||
and put it in Docker/OpenWrt. Then switch to that folder and run:
|
||||
docker build -t openwrt --build-args DOCKER_BASE_CONTAINER=<openwrtContainer> .
|
||||
where 'openwrtContainer' => "openwrt/rootfs:x86-64-22.03-SNAPSHOT" or similar
|
||||
|
||||
This should run some sample tests. The resulting container then can be used to
|
||||
evaluate OpenWrt with the latest wolfSSL library.
|
||||
@@ -1,27 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
runCMD() { # usage: runCMD "<command>" "<retVal>"
|
||||
TMP_FILE=$(mktemp)
|
||||
eval $1 > $TMP_FILE 2>&1
|
||||
RETVAL=$?
|
||||
if [ "$RETVAL" != "$2" ]; then
|
||||
echo "Command ($1) returned ${RETVAL}, but expected $2. Error output:"
|
||||
cat $TMP_FILE
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Successful tests
|
||||
runCMD "ldd /lib/libustream-ssl.so" 0
|
||||
# Temporary workaround: comment out missing kmods repo line for 21.02 specifically.
|
||||
# Remove after fixed upstream.
|
||||
runCMD "sed '\/src\/gz openwrt_kmods https:\/\/downloads.openwrt.org\/releases\/21.02-SNAPSHOT\/targets\/x86\/64\/kmods\/5.4.238-1-5a722da41bc36de95a7195be6fce1b45/s//#&/' -i /etc/opkg/distfeeds.conf" 0
|
||||
runCMD "opkg update" 0
|
||||
runCMD "uclient-fetch 'https://letsencrypt.org'" 0
|
||||
# Negative tests
|
||||
runCMD "uclient-fetch --ca-certificate=/dev/null 'https://letsencrypt.org'" 5
|
||||
runCMD "uclient-fetch 'https://self-signed.badssl.com/'" 5
|
||||
runCMD "uclient-fetch 'https://untrusted-root.badssl.com/'" 5
|
||||
runCMD "uclient-fetch 'https://expired.badssl.com/'" 5
|
||||
|
||||
echo "All tests passed."
|
||||
@@ -1,16 +0,0 @@
|
||||
# Overview
|
||||
This is a Docker environment for compiling, testing and running WolfSSL. Use `run.sh` to build everything (Docker container, WolfSSL, etc.). This script takes in arguments that can be passed to `./configure`. For example: `run.sh --enable-all`
|
||||
|
||||
When the compilation and tests succeed, you will be dropped in to a shell environment within the container. This can be useful to build other things within the environment. Additional tests can be run as well as debugging of code.
|
||||
|
||||
# Docker Hub
|
||||
These images are also uploaded to the wolfSSL's [Docker Hub page](https://hub.docker.com/orgs/wolfssl/repositories). There is a convenience script here `buildAndPush.sh` that will create the appropriate containers and push them to the repo.
|
||||
|
||||
# FAQ
|
||||
## permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock
|
||||
You need to be added to the `docker` group to run Docker containers. Run `sudo usermod -aG docker $USER`. You may need to restart the Docker daemon.
|
||||
|
||||
## Unable to access symlinked files outside of WolfSSL
|
||||
The volume mounted in the Docker container needs to have all files that your compilation will need. To solve this, you have a couple options:
|
||||
1. Change the `WOLFSSL_DIR` variable in the `run.sh` to one higher up (by adding `/..` to the path). Then update the `docker build` to include the correct path to the Dockerfile and the `docker run` argument to the working directory (`-w`) to the WolfSSL source directory
|
||||
2. Move the external repository to within the WolfSSL directory. For example create an `external` folder which has your files. This route may have complications when stashing Git work.
|
||||
@@ -1,37 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Assume we're in wolfssl/Docker
|
||||
WOLFSSL_DIR=$(builtin cd ${BASH_SOURCE%/*}/..; pwd)
|
||||
|
||||
DOCKER_BUILD_OPTIONS="$1"
|
||||
if [ "${DOCKER_BASE_IMAGE}" != "" ]; then
|
||||
DOCKER_BUILD_OPTIONS+=" --build-arg DOCKER_BASE_IMAGE=${DOCKER_BASE_IMAGE}"
|
||||
fi
|
||||
|
||||
NUM_FAILURES=0
|
||||
|
||||
CUR_DATE=$(date -u +%F)
|
||||
echo "Building wolfssl/wolfssl-builder:${CUR_DATE} as ${DOCKER_BUILD_OPTIONS}"
|
||||
docker build -t wolfssl/wolfssl-builder:${CUR_DATE} ${DOCKER_BUILD_OPTIONS} "${WOLFSSL_DIR}/Docker" && \
|
||||
docker tag wolfssl/wolfssl-builder:${CUR_DATE} wolfssl/wolfssl-builder:latest && \
|
||||
docker build --build-arg DOCKER_BASE_IMAGE=wolfssl/wolfssl-builder:${CUR_DATE} -t wolfssl/testing-cross-compiler:${CUR_DATE} "${WOLFSSL_DIR}/Docker" -f Dockerfile.cross-compiler && \
|
||||
docker tag wolfssl/testing-cross-compiler:${CUR_DATE} wolfssl/testing-cross-compiler:latest
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Pushing containers to DockerHub"
|
||||
docker push wolfssl/wolfssl-builder:${CUR_DATE} && docker push wolfssl/wolfssl-builder:latest && \
|
||||
docker push wolfssl/testing-cross-compiler:${CUR_DATE} && docker push wolfssl/testing-cross-compiler:latest
|
||||
else
|
||||
echo "Warning: Build wolfssl/wolfssl-builder failed. Continuing"
|
||||
((NUM_FAILURES++))
|
||||
fi
|
||||
|
||||
echo "Building wolfssl/wolfCLU:${CUR_DATE}"
|
||||
docker buildx build --pull --push --build-arg DUMMY=${CUR_DATE} -t wolfssl/wolfclu:${CUR_DATE} --platform=linux/amd64,linux/arm64,linux/arm/v7 "${WOLFSSL_DIR}/Docker/wolfCLU" && \
|
||||
docker buildx build --pull --push --build-arg DUMMY=${CUR_DATE} -t wolfssl/wolfclu:latest --platform=linux/amd64,linux/arm64,linux/arm/v7 "${WOLFSSL_DIR}/Docker/wolfCLU"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Warning: Build wolfssl/wolfclu failed. Continuing"
|
||||
((NUM_FAILURES++))
|
||||
fi
|
||||
|
||||
echo "Script completed in $SECONDS seconds. Had $NUM_FAILURES failures."
|
||||
@@ -1,13 +0,0 @@
|
||||
# vim:ft=automake
|
||||
# included from Top Level Makefile.am
|
||||
# All paths should be given relative to the root
|
||||
|
||||
EXTRA_DIST+= Docker/Dockerfile
|
||||
EXTRA_DIST+= Docker/Dockerfile.cross-compiler
|
||||
EXTRA_DIST+= Docker/run.sh
|
||||
EXTRA_DIST+= Docker/README.md
|
||||
|
||||
ignore_files+=Docker/buildAndPush.sh
|
||||
ignore_files+=Docker/OpenWRT/Dockerfile
|
||||
ignore_files+=Docker/OpenWRT/runTests.sh
|
||||
ignore_files+=Docker/OpenWRT/README.md
|
||||
@@ -1,6 +0,0 @@
|
||||
FROM debian:latest
|
||||
|
||||
RUN apt-get -y update
|
||||
RUN apt-get -y upgrade
|
||||
RUN apt-get install -y build-essential autoconf gawk debhelper lintian
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
FROM fedora:latest
|
||||
|
||||
RUN dnf install -y make automake gcc rpmdevtools
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
echo "Running with \"${*}\"..."
|
||||
|
||||
# Assume we're in wolfssl/Docker
|
||||
WOLFSSL_DIR=$(builtin cd ${BASH_SOURCE%/*}/..; pwd)
|
||||
|
||||
docker build -t wolfssl/wolfssl-builder --build-arg UID=$(id -u) --build-arg GID=$(id -g) "${WOLFSSL_DIR}/Docker" && \
|
||||
docker run --rm -it -v ${HOME}/.gitconfig:/home/docker/.gitconfig:ro -v ${HOME}/.ssh:/home/docker/.ssh:ro -v "${WOLFSSL_DIR}:/tmp/wolfssl" -w /tmp/wolfssl wolfssl/wolfssl-builder /bin/bash -c "./autogen.sh && ./configure ${*@Q} && make" && \
|
||||
docker run --rm -it -v ${HOME}/.gitconfig:/home/docker/.gitconfig:ro -v ${HOME}/.ssh:/home/docker/.ssh:ro -v "${WOLFSSL_DIR}:/tmp/wolfssl" -w /tmp/wolfssl wolfssl/wolfssl-builder /bin/bash
|
||||
|
||||
exitval=$?
|
||||
echo "Exited with error code $exitval"
|
||||
exit $exitval
|
||||
@@ -1,26 +0,0 @@
|
||||
ARG DOCKER_BASE_IMAGE=ubuntu
|
||||
FROM ubuntu as BUILDER
|
||||
|
||||
ARG DEPS_WOLFSSL="build-essential autoconf libtool zlib1g-dev libuv1-dev libpam0g-dev git libpcap-dev libcurl4-openssl-dev bsdmainutils netcat iputils-ping bubblewrap"
|
||||
RUN DEBIAN_FRONTEND=noninteractive apt update && apt install -y apt-utils \
|
||||
&& apt install -y ${DEPS_WOLFSSL} ${DEPS_LIBOQS} \
|
||||
&& apt clean -y && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
ARG NUM_CPU=16
|
||||
|
||||
# This arg is to force a rebuild starting from this line
|
||||
ARG DUMMY=date
|
||||
# install wolfssl
|
||||
RUN DUMMY=${DUMMY} git clone --depth=1 --single-branch --branch=master http://github.com/wolfssl/wolfssl && cd wolfssl && ./autogen.sh && ./configure --enable-all && make -j $NUM_CPU && make install && ldconfig
|
||||
|
||||
# install wolfCLU
|
||||
RUN git clone --depth=1 --single-branch --branch=main http://github.com/wolfssl/wolfCLU && cd wolfCLU && ./autogen.sh && ./configure && make -j $NUM_CPU && make install
|
||||
|
||||
FROM ${DOCKER_BASE_IMAGE}
|
||||
USER root
|
||||
COPY --from=BUILDER /usr/local/lib/libwolfssl.so /usr/local/lib/
|
||||
COPY --from=BUILDER /usr/local/bin/wolfssl* /usr/local/bin/
|
||||
RUN ldconfig
|
||||
ENTRYPOINT ["/usr/local/bin/wolfssl"]
|
||||
LABEL org.opencontainers.image.source=https://github.com/wolfssl/wolfssl
|
||||
LABEL org.opencontainers.image.description="Simple wolfCLU in a container"
|
||||
@@ -1,10 +0,0 @@
|
||||
This is a small container that has wolfCLU installed for quick access. To build your own run the following:
|
||||
```
|
||||
docker build --pull --build-arg DUMMY=$(date +%s) -t wolfclu .
|
||||
```
|
||||
|
||||
To run the container, you can use:
|
||||
```
|
||||
docker run -it --rm -v $(pwd):/ws -w /ws wolfclu version
|
||||
```
|
||||
This command will allow you to use the certs/keys in your local directory.
|
||||
@@ -1,29 +0,0 @@
|
||||
FROM ubuntu
|
||||
|
||||
# Set timezone to UTC
|
||||
RUN ln -snf /usr/share/zoneinfo/UTC /etc/localtime && echo UTC > /etc/timezone
|
||||
|
||||
RUN DEBIAN_FRONTEND=noninteractive apt update && apt install -y gawk wget git diffstat unzip texinfo gcc build-essential chrpath socat cpio python3 python3-pip python3-pexpect xz-utils debianutils iputils-ping python3-git python3-jinja2 libegl1-mesa libsdl1.2-dev python3-subunit mesa-common-dev zstd liblz4-tool file locales libacl1 vim && apt clean -y && rm -rf /var/lib/apt/lists/*
|
||||
RUN locale-gen en_US.UTF-8
|
||||
|
||||
# Add in non-root user
|
||||
ENV UID_OF_DOCKERUSER 1000
|
||||
RUN useradd -m -s /bin/bash -g users -u ${UID_OF_DOCKERUSER} dockerUser
|
||||
RUN chown -R dockerUser:users /home/dockerUser && chown dockerUser:users /opt
|
||||
|
||||
USER dockerUser
|
||||
|
||||
RUN cd /opt && git clone git://git.yoctoproject.org/poky
|
||||
WORKDIR /opt/poky
|
||||
|
||||
ARG YOCTO_VERSION=kirkstone
|
||||
RUN git checkout -t origin/${YOCTO_VERSION} -b ${YOCTO_VERSION} && git pull
|
||||
|
||||
# This arg is to be able to force a rebuild starting from this line
|
||||
ARG DUMMY=date
|
||||
RUN DUMMY=${DUMMY} git clone --single-branch --branch=master https://github.com/wolfssl/meta-wolfssl.git && \
|
||||
/bin/bash -c "source oe-init-build-env" && \
|
||||
echo 'IMAGE_INSTALL:append = " wolfssl wolfclu wolfssh wolfmqtt wolftpm wolfclu "' >> /opt/poky/build/conf/local.conf && \
|
||||
sed -i '/\/opt\/poky\/meta-poky \\/a \\t/opt/poky/meta-wolfssl \\' /opt/poky/build/conf/bblayers.conf
|
||||
|
||||
RUN /bin/bash -c "source oe-init-build-env && bitbake core-image-minimal"
|
||||
@@ -1,27 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Assume we're in wolfssl/Docker/yocto
|
||||
WOLFSSL_DIR=$(builtin cd ${BASH_SOURCE%/*}/../..; pwd)
|
||||
|
||||
DOCKER_BUILD_OPTIONS="$1"
|
||||
if [ "${DOCKER_BASE_IMAGE}" != "" ]; then
|
||||
DOCKER_BUILD_OPTIONS+=" --build-arg DOCKER_BASE_IMAGE=${DOCKER_BASE_IMAGE}"
|
||||
fi
|
||||
|
||||
NUM_FAILURES=0
|
||||
|
||||
CUR_DATE=$(date -u +%F)
|
||||
for ver in kirkstone langdale scarthgap; do
|
||||
echo "Building wolfssl/yocto:${ver}-${CUR_DATE} as ${DOCKER_BUILD_OPTIONS}"
|
||||
docker build -t wolfssl/yocto:${ver}-${CUR_DATE} --build-arg YOCTO_VERSION=${ver} --build-arg BUILD_DATE=${CUR_DATE} -f Dockerfile "${WOLFSSL_DIR}/Docker/yocto" && \
|
||||
docker tag wolfssl/yocto:${ver}-${CUR_DATE} wolfssl/yocto:${ver}-latest
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "Pushing containers to DockerHub"
|
||||
docker push wolfssl/yocto:${ver}-${CUR_DATE} && docker push wolfssl/yocto:${ver}-latest
|
||||
else
|
||||
echo "Warning: Build wolfssl/yocto:${ver} failed. Continuing"
|
||||
((NUM_FAILURES++))
|
||||
fi
|
||||
done
|
||||
|
||||
echo "Script completed in $SECONDS seconds. Had $NUM_FAILURES failures."
|
||||
@@ -1,13 +0,0 @@
|
||||
# Arduino wolfSSL Library
|
||||
|
||||
This library is restructured from [wolfSSL](https://github.com/wolfSSL/wolfssl/) Release ${WOLFSSL_VERSION} for the Arduino platform.
|
||||
|
||||
The Official wolfSSL Arduino Library is found in [The Library Manager index](http://downloads.arduino.cc/libraries/library_index.json).
|
||||
|
||||
See the [Arduino-wolfSSL logs](https://downloads.arduino.cc/libraries/logs/github.com/wolfSSL/Arduino-wolfSSL/).
|
||||
|
||||
## Arduino Releases
|
||||
|
||||
The first Official wolfSSL Arduino Library is `5.6.6-Arduino.1`: a slightly modified, post [release 5.6.6](https://github.com/wolfSSL/wolfssl/releases/tag/v5.6.6-stable) version update.
|
||||
|
||||
See other [wolfSSL releases versions](https://github.com/wolfSSL/wolfssl/releases). The `./wolfssl-arduino.sh INSTALL` [script](https://github.com/wolfSSL/wolfssl/tree/master/IDE/ARDUINO) can be used to install specific GitHub versions as needed.
|
||||
@@ -1,89 +1,29 @@
|
||||
# wolfSSL with Arduino
|
||||
### wolfSSL with Arduino
|
||||
|
||||
See the [example sketches](./sketches/README.md):
|
||||
##### Reformatting wolfSSL as a compatible Arduino Library
|
||||
This is a shell script that will re-organize the wolfSSL library to be
|
||||
compatible with Arduino projects. The Arduino IDE requires a library's source
|
||||
files to be in the library's root directory with a header file in the name of
|
||||
the library. This script moves all src/ files to the `IDE/ARDUINO/wolfSSL`
|
||||
directory and creates a stub header file called `wolfssl.h`.
|
||||
|
||||
- [sketches/wolfssl_server](./sketches/wolfssl_server/README.md)
|
||||
- [sketches/wolfssl_client](./sketches/wolfssl_client/README.md)
|
||||
Step 1: To configure wolfSSL with Arduino, enter the following from within the
|
||||
wolfssl/IDE/ARDUINO directory:
|
||||
|
||||
When publishing a new version to the Arduino Registry, be sure to edit `WOLFSSL_VERSION_ARUINO_SUFFIX` in the `wolfssl-arduino.sh` script.
|
||||
`./wolfssl-arduino.sh`
|
||||
|
||||
## Boards
|
||||
Step 2: Copy the directory wolfSSL that was just created to:
|
||||
`~/Documents/Arduino/libraries/` directory so the Arduino IDE can find it.
|
||||
|
||||
Many of the supported boards are natively built-in to the [Arduino IDE Board Manager](https://docs.arduino.cc/software/ide-v2/tutorials/ide-v2-board-manager/)
|
||||
and by adding [additional cores](https://docs.arduino.cc/learn/starting-guide/cores/) as needed.
|
||||
|
||||
STM32 Support can be added by including this link in the "Additional Boards Managers URLs" field
|
||||
from [stm32duino/Arduino_Core_STM32](https://github.com/stm32duino/Arduino_Core_STM32?tab=readme-ov-file#getting-started) .
|
||||
|
||||
```
|
||||
https://github.com/stm32duino/BoardManagerFiles/raw/main/package_stmicroelectronics_index.json
|
||||
```
|
||||
|
||||
## Using wolfSSL from the Arduino IDE
|
||||
|
||||
The Official wolfSSL: https://github.com/wolfSSL/arduino-wolfSSL See [PR #1](https://github.com/wolfSSL/Arduino-wolfSSL/pull/1).
|
||||
|
||||
This option will allow wolfSSL to be installed directly using the native Arduino tools.
|
||||
|
||||
## Manually Reformatting wolfSSL as a Compatible Arduino Library
|
||||
|
||||
Use [this](./wolfssl-arduino.sh) shell script that will re-organize the wolfSSL library to be
|
||||
compatible with [Arduino Library Specification](https://arduino.github.io/arduino-cli/0.35/library-specification/)
|
||||
for projects that use Arduino IDE 1.5.0 or newer.
|
||||
|
||||
The Arduino IDE requires a library's source files to be in the library's root directory with a
|
||||
header file in the name of the library. This script moves all `src/` files to the `IDE/ARDUINO/wolfSSL/src`
|
||||
directory and creates a stub header file called `wolfssl.h` inside that directory.
|
||||
|
||||
### Step 1:
|
||||
|
||||
To configure wolfSSL with Arduino, enter ONE of the following 4 commands
|
||||
from within the `wolfssl/IDE/ARDUINO` directory:
|
||||
|
||||
1. `./wolfssl-arduino.sh`
|
||||
- Creates an Arduino Library directory structure in the local `wolfSSL` directory of `IDE/ARDUINO`.
|
||||
- You can add your own `user_settings.h`, or copy/rename the [default](../../examples/configs/user_settings_arduino.h).
|
||||
|
||||
2. `./wolfssl-arduino.sh INSTALL` (The most common option)
|
||||
- Creates an Arduino Library in the local `wolfSSL` directory
|
||||
- Moves that directory to the Arduino library directory:
|
||||
- `$HOME/Arduino/libraries` for most bash environments
|
||||
- `/mnt/c/Users/$USER/Documents/Arduino/libraries` (for WSL)
|
||||
- Adds the [default](../../examples/configs/user_settings_arduino.h) as `user_settings.h`.
|
||||
- The wolfSSL library is now available from the Arduino IDE.
|
||||
|
||||
3. `./wolfssl-arduino.sh INSTALL /path/to/repository` (Used to update [arduino-wolfSSL](https://github.com/wolfSSL/arduino-wolfSSL))
|
||||
- Creates an Arduino Library in `wolfSSL` directory
|
||||
- Copies that directory contents to the specified `/path/to/repository`
|
||||
- Adds the [default](../../examples/configs/user_settings_arduino.h) as `user_settings.h`.
|
||||
|
||||
4. `./wolfssl-arduino.sh INSTALL /path/to/any/other/directory`
|
||||
- Creates an Arduino Library in `wolfSSL` directory
|
||||
- Copies that directory contents to the specified `/path/to/any/other/directory`
|
||||
|
||||
### Step 2:
|
||||
|
||||
Edit `<arduino-libraries>/wolfSSL/src/user_settings.h`
|
||||
Step 3: Edit `<arduino-libraries>/wolfSSL/user_settings.h`
|
||||
If building for Intel Galileo platform add: `#define INTEL_GALILEO`.
|
||||
Add any other custom settings. For a good start see the examples in wolfssl root
|
||||
"[/examples/configs/user_settings_*.h](https://github.com/wolfssl/wolfssl/tree/master/examples/configs)"
|
||||
Add any other custom settings, for a good start see the examples in wolfssl root
|
||||
"/examples/configs/user_settings_*.h"
|
||||
|
||||
### Step 3:
|
||||
|
||||
If you experience any issues with custom `user_settings.h` see the wolfssl
|
||||
Step 4: If you experience any issues with custom user_settings.h see the wolfssl
|
||||
porting guide here for more assistance: https://www.wolfssl.com/docs/porting-guide/
|
||||
|
||||
If you have any issues contact support@wolfssl.com for help.
|
||||
|
||||
# Including wolfSSL in Arduino Libraries (for Arduino version 2.0 or greater)
|
||||
|
||||
1. In the Arduino IDE:
|
||||
|
||||
The wolfSSL library should automatically be detected when found in the `libraries`
|
||||
directory.
|
||||
|
||||
- In `Sketch -> Include Library` choose wolfSSL for new sketches.
|
||||
|
||||
Step 5: If you still have any issues contact support@wolfssl.com for more help.
|
||||
|
||||
##### Including wolfSSL in Arduino Libraries (for Arduino version 1.6.6)
|
||||
|
||||
@@ -92,90 +32,6 @@ directory.
|
||||
`IDE/ARDUNIO/wolfSSL` folder.
|
||||
- In `Sketch -> Include Library` choose wolfSSL.
|
||||
|
||||
##### wolfSSL Examples
|
||||
|
||||
Open an example Arduino sketch for wolfSSL:
|
||||
|
||||
- wolfSSL [Client INO sketch](./sketches/wolfssl_client/README.md): `sketches/wolfssl_client/wolfssl_client.ino`
|
||||
|
||||
- wolfSSL [Server INO sketch](./sketches/wolfssl_server/README.md): `sketches/wolfssl_server/wolfssl_server.ino`
|
||||
|
||||
#### Script Examples
|
||||
|
||||
Refresh the local Windows Arduino wolfSSL library from GitHub repository directory using WSL:
|
||||
|
||||
Don't forget to edit `WOLFSSL_VERSION_ARUINO_SUFFIX`!
|
||||
|
||||
```bash
|
||||
# Change to the wolfSSL Arduino IDE directory
|
||||
cd /mnt/c/workspace/wolfssl-$USER/IDE/ARDUINO
|
||||
|
||||
# remove current Arduino wolfSSL library
|
||||
rm -rf /mnt/c/Users/$USER/Documents/Arduino/libraries/wolfssl
|
||||
|
||||
# Install wolfSSL as an Arduino library
|
||||
./wolfssl-arduino.sh INSTALL
|
||||
```
|
||||
|
||||
Publish wolfSSL from WSL to a `Arduino-wolfSSL-$USER` repository.
|
||||
|
||||
```bash
|
||||
cd /mnt/c/workspace/wolfssl-$USER/IDE/ARDUINO
|
||||
rm -rf /mnt/c/Users/$USER/Documents/Arduino/libraries/wolfSSL
|
||||
rm -rf /mnt/c/workspace/wolfssl-$USER/IDE/ARDUINO/wolfSSL
|
||||
./wolfssl-arduino.sh INSTALL /mnt/c/workspace/Arduino-wolfSSL-$USER/
|
||||
```
|
||||
|
||||
Publish wolfSSL from WSL to default Windows local library.
|
||||
|
||||
```bash
|
||||
cd /mnt/c/workspace/wolfssl-$USER/IDE/ARDUINO
|
||||
rm -rf /mnt/c/Users/$USER/Documents/Arduino/libraries/wolfSSL
|
||||
rm -rf /mnt/c/workspace/wolfssl-arduino/IDE/ARDUINO/wolfSSL
|
||||
./wolfssl-arduino.sh INSTALL
|
||||
```
|
||||
|
||||
Test the TLS server by running a local command-line client.
|
||||
|
||||
```bash
|
||||
cd /mnt/c/workspace/wolfssl-$USER
|
||||
./examples/client/client -h 192.168.1.43 -p 11111 -v 3
|
||||
```
|
||||
|
||||
Build wolfSSL to include wolfSSH support to an alternate development directory.
|
||||
|
||||
```bash
|
||||
cd /mnt/c/workspace/wolfssl-$USER
|
||||
./configure --prefix=/mnt/c/workspace/wolfssh-$USER/wolfssl_install --enable-ssh
|
||||
make
|
||||
make install
|
||||
|
||||
```
|
||||
|
||||
Build wolfSSH with wolfSSL not installed to default directory.
|
||||
|
||||
```bash
|
||||
cd /mnt/c/workspace/wolfssh-$USER
|
||||
./configure --with-wolfssl=/mnt/c/workspace/wolfssh-$USER/wolfssl_install
|
||||
make
|
||||
./examples/client/client -u jill -h 192.168.1.34 -p 22222 -P upthehill
|
||||
```
|
||||
|
||||
Test the current wolfSSL.
|
||||
|
||||
```bash
|
||||
cd /mnt/c/workspace/wolfssl-arduino
|
||||
git status
|
||||
./autogen.sh
|
||||
./configure --enable-all
|
||||
make clean
|
||||
make && make test
|
||||
```
|
||||
|
||||
Build and run `testwolfcrypt`.
|
||||
|
||||
```bash
|
||||
./autogen.sh
|
||||
./configure --enable-all
|
||||
make clean && make && ./wolfcrypt/test/testwolfcrypt
|
||||
```
|
||||
2. Open an example Arduino sketch for wolfSSL:
|
||||
- wolfSSL Client INO sketch: `sketches/wolfssl_client/wolfssl_client.ino`
|
||||
- wolfSSL Server INO sketch: `sketches/wolfssl_server/wolfssl_server.ino`
|
||||
|
||||
@@ -3,15 +3,6 @@
|
||||
# All paths should be given relative to the root
|
||||
|
||||
EXTRA_DIST+= IDE/ARDUINO/README.md
|
||||
EXTRA_DIST+= IDE/ARDUINO/Arduino_README_prepend.md
|
||||
EXTRA_DIST+= IDE/ARDUINO/keywords.txt
|
||||
EXTRA_DIST+= IDE/ARDUINO/library.properties.template
|
||||
EXTRA_DIST+= IDE/ARDUINO/sketches/README.md
|
||||
EXTRA_DIST+= IDE/ARDUINO/sketches/wolfssl_client/README.md
|
||||
EXTRA_DIST+= IDE/ARDUINO/sketches/wolfssl_client/wolfssl_client.ino
|
||||
EXTRA_DIST+= IDE/ARDUINO/sketches/wolfssl_server/README.md
|
||||
EXTRA_DIST+= IDE/ARDUINO/sketches/wolfssl_server/wolfssl_server.ino
|
||||
EXTRA_DIST+= IDE/ARDUINO/sketches/wolfssl_version/README.md
|
||||
EXTRA_DIST+= IDE/ARDUINO/sketches/wolfssl_version/wolfssl_version.ino
|
||||
EXTRA_DIST+= IDE/ARDUINO/wolfssl.h
|
||||
EXTRA_DIST+= IDE/ARDUINO/wolfssl-arduino.sh
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
# Syntax Coloring Map For wolfSSL
|
||||
# See https://arduino.github.io/arduino-cli/0.35/library-specification/#keywords
|
||||
#
|
||||
# Be sure to use tabs, not spaces. This might help:
|
||||
# tr ' ' '\t' < keywords1.txt > keywords.txt
|
||||
|
||||
#=============================================
|
||||
# Datatypes (KEYWORD1)
|
||||
#=============================================
|
||||
|
||||
|
||||
#=============================================
|
||||
# Methods and Functions (KEYWORD2)
|
||||
#=============================================
|
||||
wolfSSL_SetIORecv KEYWORD1
|
||||
|
||||
#=============================================
|
||||
# Instances (KEYWORD2)
|
||||
#=============================================
|
||||
ctx KEYWORD2
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
name=wolfssl
|
||||
version=${WOLFSSL_VERSION}${WOLFSSL_VERSION_ARUINO_SUFFIX}
|
||||
author=wolfSSL Inc.
|
||||
maintainer=wolfSSL inc <support@wolfssl.com>
|
||||
sentence=A lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments.
|
||||
paragraph=Manual: https://www.wolfssl.com/documentation/manuals/wolfssl/index.html.
|
||||
category=Communication
|
||||
url=https://www.wolfssl.com/
|
||||
architectures=*
|
||||
@@ -1,12 +0,0 @@
|
||||
# wolfSSL Arduino Examples
|
||||
|
||||
There are currently two example Arduino sketches:
|
||||
|
||||
* [wolfssl_client](./wolfssl_client/README.md): Basic TLS listening client.
|
||||
* [wolfssl_server](./wolfssl_server/README.md): Basic TLS server.
|
||||
|
||||
Examples have been most recently confirmed operational on the
|
||||
[Arduino IDE](https://www.arduino.cc/en/software) 2.2.1.
|
||||
|
||||
For examples on other platforms, see the [IDE directory](https://github.com/wolfssl/wolfssl/tree/master/IDE).
|
||||
Additional examples can be found on [wolfSSL/wolfssl-examples](https://github.com/wolfSSL/wolfssl-examples/).
|
||||
@@ -1,22 +0,0 @@
|
||||
# Arduino Basic TLS Listening Client
|
||||
|
||||
Open the [wolfssl_client.ino](./wolfssl_client.ino) file in the Arduino IDE.
|
||||
|
||||
Other IDE products are also supported, such as:
|
||||
|
||||
- [PlatformIO in VS Code](https://docs.platformio.org/en/latest/frameworks/arduino.html)
|
||||
- [VisualGDB](https://visualgdb.com/tutorials/arduino/)
|
||||
- [VisualMicro](https://www.visualmicro.com/)
|
||||
|
||||
For examples on other platforms, see the [IDE directory](https://github.com/wolfssl/wolfssl/tree/master/IDE).
|
||||
Additional examples can be found on [wolfSSL/wolfssl-examples](https://github.com/wolfSSL/wolfssl-examples/).
|
||||
|
||||
|
||||
### Troubleshooting
|
||||
|
||||
When encountering odd errors such as `undefined reference to ``_impure_ptr'`, try cleaning the Arduino
|
||||
cache directories. For Windows, that's typically in:
|
||||
|
||||
```text
|
||||
C:\Users\%USERNAME%\AppData\Local\Temp\arduino\sketches
|
||||
```
|
||||
@@ -1,6 +1,6 @@
|
||||
/* wolfssl_client.ino
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -19,876 +19,141 @@
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
||||
*/
|
||||
|
||||
/*
|
||||
Tested with:
|
||||
|
||||
1) Intel Galileo acting as the Client, with a laptop acting as a server using
|
||||
the server example provided in examples/server.
|
||||
Legacy Arduino v1.86 was used to compile and program the Galileo
|
||||
|
||||
2) Espressif ESP32 WiFi
|
||||
|
||||
3) Arduino Due, Nano33 IoT, Nano RP-2040
|
||||
*/
|
||||
|
||||
/*
|
||||
* Note to code editors: the Arduino client and server examples are edited in
|
||||
* parallel for side-by-side comparison between examples.
|
||||
*/
|
||||
|
||||
/* If you have a private include, define it here, otherwise edit WiFi params */
|
||||
#define MY_PRIVATE_CONFIG "/workspace/my_private_config.h"
|
||||
|
||||
/* set REPEAT_CONNECTION to a non-zero value to continually run the example. */
|
||||
#define REPEAT_CONNECTION 0
|
||||
|
||||
/* Edit this with your other TLS host server address to connect to: */
|
||||
#define WOLFSSL_TLS_SERVER_HOST "192.168.1.39"
|
||||
|
||||
/* wolfssl TLS examples communicate on port 11111 */
|
||||
#define WOLFSSL_PORT 11111
|
||||
|
||||
/* Choose a monitor serial baud rate: 9600, 14400, 19200, 57600, 74880, etc. */
|
||||
#define SERIAL_BAUD 115200
|
||||
|
||||
/* We'll wait up to 2000 milliseconds to properly shut down connection */
|
||||
#define SHUTDOWN_DELAY_MS 2000
|
||||
|
||||
/* Number of times to retry connection. */
|
||||
#define RECONNECT_ATTEMPTS 20
|
||||
|
||||
/* Optional stress test. Define to consume memory until exhausted: */
|
||||
/* #define MEMORY_STRESS_TEST */
|
||||
|
||||
/* Choose client or server example, not both. */
|
||||
#define WOLFSSL_CLIENT_EXAMPLE
|
||||
/* #define WOLFSSL_SERVER_EXAMPLE */
|
||||
|
||||
#if defined(MY_PRIVATE_CONFIG)
|
||||
/* the /workspace directory may contain a private config
|
||||
* excluded from GitHub with items such as WiFi passwords */
|
||||
#include MY_PRIVATE_CONFIG
|
||||
static const char* ssid PROGMEM = MY_ARDUINO_WIFI_SSID;
|
||||
static const char* password PROGMEM = MY_ARDUINO_WIFI_PASSWORD;
|
||||
#else
|
||||
/* when using WiFi capable boards: */
|
||||
static const char* ssid PROGMEM = "your_SSID";
|
||||
static const char* password PROGMEM = "your_PASSWORD";
|
||||
#endif
|
||||
|
||||
#define BROADCAST_ADDRESS "255.255.255.255"
|
||||
|
||||
/* There's an optional 3rd party NTPClient library by Fabrice Weinberg.
|
||||
* If it is installed, uncomment define USE_NTP_LIB here: */
|
||||
/* #define USE_NTP_LIB */
|
||||
#ifdef USE_NTP_LIB
|
||||
#include <NTPClient.h>
|
||||
#endif
|
||||
|
||||
#include <wolfssl.h>
|
||||
/* Important: make sure settings.h appears before any other wolfSSL headers */
|
||||
#include <wolfssl/wolfcrypt/settings.h>
|
||||
/* Reminder: settings.h includes user_settings.h
|
||||
* For ALL project wolfSSL settings, see:
|
||||
* [your path]/Arduino\libraries\wolfSSL\src\user_settings.h */
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <wolfssl/certs_test.h>
|
||||
#include <wolfssl/wolfcrypt/error-crypt.h>
|
||||
#include <Ethernet.h>
|
||||
|
||||
/* Define DEBUG_WOLFSSL in user_settings.h for more verbose logging. */
|
||||
#if defined(DEBUG_WOLFSSL)
|
||||
#define PROGRESS_DOT F("")
|
||||
#else
|
||||
#define PROGRESS_DOT F(".")
|
||||
#endif
|
||||
const char host[] = "192.168.1.148"; /* server to connect to */
|
||||
const int port = 11111; /* port on server to connect to */
|
||||
|
||||
/* Convert a macro to a string */
|
||||
#define xstr(x) str(x)
|
||||
#define str(x) #x
|
||||
int EthernetSend(WOLFSSL* ssl, char* msg, int sz, void* ctx);
|
||||
int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx);
|
||||
int reconnect = 10;
|
||||
|
||||
/* optional board-specific networking includes */
|
||||
#if defined(ESP32)
|
||||
#define USING_WIFI
|
||||
#include <WiFi.h>
|
||||
#include <WiFiUdp.h>
|
||||
#ifdef USE_NTP_LIB
|
||||
WiFiUDP ntpUDP;
|
||||
#endif
|
||||
/* Ensure the F() flash macro is defined */
|
||||
#ifndef F
|
||||
#define F
|
||||
#endif
|
||||
WiFiClient client;
|
||||
EthernetClient client;
|
||||
|
||||
#elif defined(ESP8266)
|
||||
#define USING_WIFI
|
||||
#include <ESP8266WiFi.h>
|
||||
WiFiClient client;
|
||||
WOLFSSL_CTX* ctx = NULL;
|
||||
WOLFSSL* ssl = NULL;
|
||||
|
||||
#elif defined(ARDUINO_SAM_DUE)
|
||||
#include <SPI.h>
|
||||
/* There's no WiFi/Ethernet on the Due. Requires Ethernet Shield.
|
||||
/* Needs "Ethernet by Various" library to be installed. Tested with V2.0.2 */
|
||||
#include <Ethernet.h>
|
||||
EthernetClient client;
|
||||
void setup() {
|
||||
WOLFSSL_METHOD* method;
|
||||
|
||||
#elif defined(ARDUINO_SAMD_NANO_33_IOT)
|
||||
#define USING_WIFI
|
||||
#include <SPI.h>
|
||||
#include <WiFiNINA.h> /* Needs Arduino WiFiNINA library installed manually */
|
||||
WiFiClient client;
|
||||
Serial.begin(9600);
|
||||
|
||||
#elif defined(ARDUINO_ARCH_RP2040)
|
||||
#define USING_WIFI
|
||||
#include <SPI.h>
|
||||
#include <WiFiNINA.h>
|
||||
WiFiClient client;
|
||||
|
||||
#elif defined(USING_WIFI)
|
||||
#define USING_WIFI
|
||||
#include <WiFi.h>
|
||||
#include <WiFiUdp.h>
|
||||
#ifdef USE_NTP_LIB
|
||||
WiFiUDP ntpUDP;
|
||||
#endif
|
||||
WiFiClient client;
|
||||
|
||||
/* TODO
|
||||
#elif defined(OTHER_BOARD)
|
||||
*/
|
||||
#else
|
||||
#define USING_WIFI
|
||||
WiFiClient client;
|
||||
|
||||
#endif
|
||||
|
||||
/* Only for syntax highlighters to show interesting options enabled: */
|
||||
#if defined(HAVE_SNI) \
|
||||
|| defined(HAVE_MAX_FRAGMENT) \
|
||||
|| defined(HAVE_TRUSTED_CA) \
|
||||
|| defined(HAVE_TRUNCATED_HMAC) \
|
||||
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|
||||
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) \
|
||||
|| defined(HAVE_SUPPORTED_CURVES) \
|
||||
|| defined(HAVE_ALPN) \
|
||||
|| defined(HAVE_SESSION_TICKET) \
|
||||
|| defined(HAVE_SECURE_RENEGOTIATION) \
|
||||
|| defined(HAVE_SERVER_RENEGOTIATION_INFO)
|
||||
#endif
|
||||
|
||||
static const char host[] PROGMEM = WOLFSSL_TLS_SERVER_HOST; /* server to connect to */
|
||||
static const int port PROGMEM = WOLFSSL_PORT; /* port on server to connect to */
|
||||
|
||||
static WOLFSSL_CTX* ctx = NULL;
|
||||
static WOLFSSL* ssl = NULL;
|
||||
static char* wc_error_message = (char*)malloc(80 + 1);
|
||||
static char errBuf[80];
|
||||
|
||||
#if defined(MEMORY_STRESS_TEST)
|
||||
#define MEMORY_STRESS_ITERATIONS 100
|
||||
#define MEMORY_STRESS_BLOCK_SIZE 1024
|
||||
#define MEMORY_STRESS_INITIAL (4*1024)
|
||||
static char* memory_stress[MEMORY_STRESS_ITERATIONS]; /* typically 1K per item */
|
||||
static int mem_ctr = 0;
|
||||
#endif
|
||||
|
||||
static int EthernetSend(WOLFSSL* ssl, char* msg, int sz, void* ctx);
|
||||
static int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx);
|
||||
static int reconnect = RECONNECT_ATTEMPTS;
|
||||
static int lng_index PROGMEM = 0; /* 0 = English */
|
||||
|
||||
#if defined(__arm__)
|
||||
#include <malloc.h>
|
||||
extern char _end;
|
||||
extern "C" char *sbrk(int i);
|
||||
static char *ramstart=(char *)0x20070000;
|
||||
static char *ramend=(char *)0x20088000;
|
||||
#endif
|
||||
|
||||
/*****************************************************************************/
|
||||
/* fail_wait - in case of unrecoverable error */
|
||||
/*****************************************************************************/
|
||||
int fail_wait(void) {
|
||||
show_memory();
|
||||
|
||||
Serial.println(F("Failed. Halt."));
|
||||
while (1) {
|
||||
delay(1000);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* show_memory() to optionally view during debugging. */
|
||||
/*****************************************************************************/
|
||||
int show_memory(void)
|
||||
{
|
||||
#if defined(__arm__)
|
||||
struct mallinfo mi = mallinfo();
|
||||
|
||||
char *heapend=sbrk(0);
|
||||
register char * stack_ptr asm("sp");
|
||||
#if defined(DEBUG_WOLFSSL_VERBOSE)
|
||||
Serial.print(" arena=");
|
||||
Serial.println(mi.arena);
|
||||
Serial.print(" ordblks=");
|
||||
Serial.println(mi.ordblks);
|
||||
Serial.print(" uordblks=");
|
||||
Serial.println(mi.uordblks);
|
||||
Serial.print(" fordblks=");
|
||||
Serial.println(mi.fordblks);
|
||||
Serial.print(" keepcost=");
|
||||
Serial.println(mi.keepcost);
|
||||
#endif
|
||||
|
||||
#if defined(DEBUG_WOLFSSL) || defined(MEMORY_STRESS_TEST)
|
||||
Serial.print("Estimated free memory: ");
|
||||
Serial.print(stack_ptr - heapend + mi.fordblks);
|
||||
Serial.println(F(" bytes"));
|
||||
#endif
|
||||
|
||||
#if (0)
|
||||
/* Experimental: not supported on all devices: */
|
||||
Serial.print("RAM Start %lx\n", (unsigned long)ramstart);
|
||||
Serial.print("Data/Bss end %lx\n", (unsigned long)&_end);
|
||||
Serial.print("Heap End %lx\n", (unsigned long)heapend);
|
||||
Serial.print("Stack Ptr %lx\n",(unsigned long)stack_ptr);
|
||||
Serial.print("RAM End %lx\n", (unsigned long)ramend);
|
||||
|
||||
Serial.print("Heap RAM Used: ",mi.uordblks);
|
||||
Serial.print("Program RAM Used ",&_end - ramstart);
|
||||
Serial.print("Stack RAM Used ",ramend - stack_ptr);
|
||||
|
||||
Serial.print("Estimated Free RAM: %d\n\n",stack_ptr - heapend + mi.fordblks);
|
||||
#endif
|
||||
#else
|
||||
Serial.println(F("show_memory() not implemented for this platform"));
|
||||
#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* EthernetSend() to send a message string. */
|
||||
/*****************************************************************************/
|
||||
int EthernetSend(WOLFSSL* ssl, char* message, int sz, void* ctx) {
|
||||
int sent = 0;
|
||||
(void)ssl;
|
||||
(void)ctx;
|
||||
|
||||
sent = client.write((byte*)message, sz);
|
||||
return sent;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* EthernetReceive() to receive a reply string. */
|
||||
/*****************************************************************************/
|
||||
int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx) {
|
||||
int ret = 0;
|
||||
(void)ssl;
|
||||
(void)ctx;
|
||||
|
||||
while (client.available() > 0 && ret < sz) {
|
||||
reply[ret++] = client.read();
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_hardware() */
|
||||
/*****************************************************************************/
|
||||
int setup_hardware(void) {
|
||||
int ret = 0;
|
||||
|
||||
#if defined(ARDUINO_SAMD_NANO_33_IOT)
|
||||
Serial.println(F("Detected known tested and working Arduino Nano 33 IoT"));
|
||||
#elif defined(ARDUINO_ARCH_RP2040)
|
||||
Serial.println(F("Detected known tested and working Arduino RP-2040"));
|
||||
#elif defined(__arm__) && defined(ID_TRNG) && defined(TRNG)
|
||||
/* need to manually turn on random number generator on Arduino Due, etc. */
|
||||
pmc_enable_periph_clk(ID_TRNG);
|
||||
trng_enable(TRNG);
|
||||
Serial.println(F("Enabled ARM TRNG"));
|
||||
#endif
|
||||
|
||||
show_memory();
|
||||
randomSeed(analogRead(0));
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_datetime() */
|
||||
/* The device needs to have a valid date within the valid range of certs. */
|
||||
/*****************************************************************************/
|
||||
int setup_datetime(void) {
|
||||
int ret = 0;
|
||||
int ntp_tries = 20;
|
||||
|
||||
/* we need a date in the range of cert expiration */
|
||||
#ifdef USE_NTP_LIB
|
||||
#if defined(ESP32)
|
||||
NTPClient timeClient(ntpUDP, "pool.ntp.org");
|
||||
|
||||
timeClient.begin();
|
||||
timeClient.update();
|
||||
delay(1000);
|
||||
while (!timeClient.isTimeSet() && (ntp_tries > 0)) {
|
||||
timeClient.forceUpdate();
|
||||
Serial.println(F("Waiting for NTP update"));
|
||||
delay(2000);
|
||||
ntp_tries--;
|
||||
}
|
||||
if (ntp_tries <= 0) {
|
||||
Serial.println(F("Warning: gave up waiting on NTP"));
|
||||
}
|
||||
Serial.println(timeClient.getFormattedTime());
|
||||
Serial.println(timeClient.getEpochTime());
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(ESP32)
|
||||
/* see esp32-hal-time.c */
|
||||
ntp_tries = 5;
|
||||
/* Replace "pool.ntp.org" with your preferred NTP server */
|
||||
configTime(0, 0, "pool.ntp.org");
|
||||
|
||||
/* Wait for time to be set */
|
||||
while ((time(nullptr) <= 100000) && ntp_tries > 0) {
|
||||
Serial.println(F("Waiting for time to be set..."));
|
||||
delay(2000);
|
||||
ntp_tries--;
|
||||
}
|
||||
#endif
|
||||
|
||||
return ret;
|
||||
} /* setup_datetime */
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_network() */
|
||||
/*****************************************************************************/
|
||||
int setup_network(void) {
|
||||
int ret = 0;
|
||||
|
||||
#if defined(USING_WIFI)
|
||||
int status = WL_IDLE_STATUS;
|
||||
|
||||
/* The ESP8266 & ESP32 support both AP and STA. We'll use STA: */
|
||||
#if defined(ESP8266) || defined(ESP32)
|
||||
WiFi.mode(WIFI_STA);
|
||||
#else
|
||||
String fv;
|
||||
if (WiFi.status() == WL_NO_MODULE) {
|
||||
Serial.println("Communication with WiFi module failed!");
|
||||
/* don't continue if no network */
|
||||
while (true) ;
|
||||
}
|
||||
|
||||
fv = WiFi.firmwareVersion();
|
||||
if (fv < WIFI_FIRMWARE_LATEST_VERSION) {
|
||||
Serial.println("Please upgrade the firmware");
|
||||
}
|
||||
#endif
|
||||
|
||||
Serial.print(F("Connecting to WiFi "));
|
||||
Serial.print(ssid);
|
||||
status = WiFi.begin(ssid, password);
|
||||
while (status != WL_CONNECTED) {
|
||||
delay(1000);
|
||||
Serial.print(F("."));
|
||||
Serial.print(status);
|
||||
status = WiFi.status();
|
||||
}
|
||||
|
||||
Serial.println(F(" Connected!"));
|
||||
#else
|
||||
/* Newer Ethernet shields have a
|
||||
* MAC address printed on a sticker on the shield */
|
||||
byte mac[] = { 0xDE, 0xAD, 0xBE, 0xEF, 0xFE, 0xED };
|
||||
IPAddress ip(192, 168, 1, 42);
|
||||
IPAddress myDns(192, 168, 1, 1);
|
||||
Ethernet.init(10); /* Most Arduino shields */
|
||||
/* Ethernet.init(5); * MKR ETH Shield */
|
||||
/* Ethernet.init(0); * Teensy 2.0 */
|
||||
/* Ethernet.init(20); * Teensy++ 2.0 */
|
||||
/* Ethernet.init(15); * ESP8266 with Adafruit FeatherWing Ethernet */
|
||||
/* Ethernet.init(33); * ESP32 with Adafruit FeatherWing Ethernet */
|
||||
Serial.println(F("Initialize Ethernet with DHCP:"));
|
||||
if (Ethernet.begin(mac) == 0) {
|
||||
Serial.println(F("Failed to configure Ethernet using DHCP"));
|
||||
/* Check for Ethernet hardware present */
|
||||
if (Ethernet.hardwareStatus() == EthernetNoHardware) {
|
||||
Serial.println(F("Ethernet shield was not found."));
|
||||
while (true) {
|
||||
delay(1); /* do nothing */
|
||||
}
|
||||
}
|
||||
if (Ethernet.linkStatus() == LinkOFF) {
|
||||
Serial.println(F("Ethernet cable is not connected."));
|
||||
}
|
||||
/* try to configure using IP address instead of DHCP : */
|
||||
Ethernet.begin(mac, ip, myDns);
|
||||
}
|
||||
else {
|
||||
Serial.print(F(" DHCP assigned IP "));
|
||||
Serial.println(Ethernet.localIP());
|
||||
}
|
||||
/* We'll assume the Ethernet connection is ready to go. */
|
||||
#endif
|
||||
|
||||
Serial.println(F("********************************************************"));
|
||||
Serial.print(F(" wolfSSL Example Client IP = "));
|
||||
#if defined(USING_WIFI)
|
||||
Serial.println(WiFi.localIP());
|
||||
#else
|
||||
Serial.println(Ethernet.localIP());
|
||||
#endif
|
||||
Serial.print(F(" Configured Server Host to connect to: "));
|
||||
Serial.println(host);
|
||||
Serial.println(F("********************************************************"));
|
||||
Serial.println(F("Setup network complete."));
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_wolfssl() */
|
||||
/*****************************************************************************/
|
||||
int setup_wolfssl(void) {
|
||||
int ret = 0;
|
||||
WOLFSSL_METHOD* method;
|
||||
|
||||
/* Show a revision of wolfssl user_settings.h file in use when available: */
|
||||
#if defined(WOLFSSL_USER_SETTINGS_ID)
|
||||
Serial.print(F("WOLFSSL_USER_SETTINGS_ID: "));
|
||||
Serial.println(F(WOLFSSL_USER_SETTINGS_ID));
|
||||
#else
|
||||
Serial.println(F("No WOLFSSL_USER_SETTINGS_ID found."));
|
||||
#endif
|
||||
|
||||
#if defined(NO_WOLFSSL_SERVER)
|
||||
Serial.println(F("wolfSSL server code disabled to save space."));
|
||||
#endif
|
||||
#if defined(NO_WOLFSSL_CLIENT)
|
||||
Serial.println(F("wolfSSL client code disabled to save space."));
|
||||
#endif
|
||||
|
||||
#if defined(DEBUG_WOLFSSL)
|
||||
wolfSSL_Debugging_ON();
|
||||
Serial.println(F("wolfSSL Debugging is On!"));
|
||||
#else
|
||||
Serial.println(F("wolfSSL Debugging is Off! (enable with DEBUG_WOLFSSL)"));
|
||||
#endif
|
||||
|
||||
/* See ssl.c for TLS cache settings. Larger cache = use more RAM. */
|
||||
#if defined(NO_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS NO_SESSION_CACHE"));
|
||||
#elif defined(MICRO_SESSION_CACHEx)
|
||||
Serial.println(F("wolfSSL TLS MICRO_SESSION_CACHE"));
|
||||
#elif defined(SMALL_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS SMALL_SESSION_CACHE"));
|
||||
#elif defined(MEDIUM_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS MEDIUM_SESSION_CACHE"));
|
||||
#elif defined(BIG_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS BIG_SESSION_CACHE"));
|
||||
#elif defined(HUGE_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS HUGE_SESSION_CACHE"));
|
||||
#elif defined(HUGE_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS HUGE_SESSION_CACHE"));
|
||||
#else
|
||||
Serial.println(F("WARNING: Unknown or no TLS session cache setting."));
|
||||
/* See wolfssl/src/ssl.c for amount of memory used.
|
||||
* It is best on embedded devices to choose a TLS session cache size. */
|
||||
#endif
|
||||
|
||||
ret = wolfSSL_Init();
|
||||
if (ret == WOLFSSL_SUCCESS) {
|
||||
Serial.println("Successfully called wolfSSL_Init");
|
||||
}
|
||||
else {
|
||||
Serial.println("ERROR: wolfSSL_Init failed");
|
||||
}
|
||||
|
||||
/* See companion server example with wolfSSLv23_server_method here.
|
||||
* method = wolfSSLv23_client_method()); SSL 3.0 - TLS 1.3.
|
||||
* method = wolfTLSv1_2_client_method(); only TLS 1.2
|
||||
* method = wolfTLSv1_3_client_method(); only TLS 1.3
|
||||
*
|
||||
* see Arduino\libraries\wolfssl\src\user_settings.h */
|
||||
|
||||
Serial.println("Here we go!");
|
||||
|
||||
method = wolfSSLv23_client_method();
|
||||
if (method == NULL) {
|
||||
Serial.println(F("unable to get wolfssl client method"));
|
||||
fail_wait();
|
||||
}
|
||||
ctx = wolfSSL_CTX_new(method);
|
||||
if (ctx == NULL) {
|
||||
Serial.println(F("unable to get ctx"));
|
||||
fail_wait();
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_certificates() */
|
||||
/*****************************************************************************/
|
||||
int setup_certificates(void) {
|
||||
int ret = 0;
|
||||
|
||||
Serial.println(F("Initializing certificates..."));
|
||||
show_memory();
|
||||
|
||||
/* Use built-in validation, No verification callback function: */
|
||||
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, 0);
|
||||
|
||||
/* Certificate */
|
||||
Serial.println("Initializing certificates...");
|
||||
ret = wolfSSL_CTX_use_certificate_buffer(ctx,
|
||||
CTX_CLIENT_CERT,
|
||||
CTX_CLIENT_CERT_SIZE,
|
||||
CTX_CLIENT_CERT_TYPE);
|
||||
if (ret == WOLFSSL_SUCCESS) {
|
||||
Serial.print("Success: use certificate: ");
|
||||
Serial.println(xstr(CTX_SERVER_CERT));
|
||||
}
|
||||
else {
|
||||
Serial.println(F("Error: wolfSSL_CTX_use_certificate_buffer failed: "));
|
||||
wc_ErrorString(ret, wc_error_message);
|
||||
Serial.println(wc_error_message);
|
||||
fail_wait();
|
||||
}
|
||||
|
||||
/* Setup private client key */
|
||||
ret = wolfSSL_CTX_use_PrivateKey_buffer(ctx,
|
||||
CTX_CLIENT_KEY,
|
||||
CTX_CLIENT_KEY_SIZE,
|
||||
CTX_CLIENT_KEY_TYPE);
|
||||
if (ret == WOLFSSL_SUCCESS) {
|
||||
Serial.print("Success: use private key buffer: ");
|
||||
Serial.println(xstr(CTX_SERVER_KEY));
|
||||
}
|
||||
else {
|
||||
Serial.println(F("Error: wolfSSL_CTX_use_PrivateKey_buffer failed: "));
|
||||
wc_ErrorString(ret, wc_error_message);
|
||||
Serial.println(wc_error_message);
|
||||
fail_wait();
|
||||
}
|
||||
|
||||
ret = wolfSSL_CTX_load_verify_buffer(ctx,
|
||||
CTX_CA_CERT,
|
||||
CTX_CA_CERT_SIZE,
|
||||
CTX_CA_CERT_TYPE);
|
||||
if (ret == WOLFSSL_SUCCESS) {
|
||||
Serial.println(F("Success: load_verify CTX_CA_CERT"));
|
||||
}
|
||||
else {
|
||||
Serial.println(F("Error: wolfSSL_CTX_load_verify_buffer failed: "));
|
||||
wc_ErrorString(ret, wc_error_message);
|
||||
Serial.println(wc_error_message);
|
||||
fail_wait();
|
||||
}
|
||||
|
||||
|
||||
|
||||
return ret;
|
||||
} /* Arduino setup */
|
||||
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup() */
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
void setup(void) {
|
||||
int i = 0;
|
||||
Serial.begin(SERIAL_BAUD);
|
||||
while (!Serial && (i < 10)) {
|
||||
/* wait for serial port to connect. Needed for native USB port only */
|
||||
delay(1000);
|
||||
i++;
|
||||
}
|
||||
Serial.println(F(""));
|
||||
Serial.println(F(""));
|
||||
Serial.println(F("wolfSSL TLS Client Example Startup."));
|
||||
|
||||
/* define DEBUG_WOLFSSL in wolfSSL user_settings.h for diagnostics */
|
||||
#if defined(DEBUG_WOLFSSL)
|
||||
wolfSSL_Debugging_ON();
|
||||
#endif
|
||||
|
||||
/* Optionally pre-allocate a large block of memory for testing */
|
||||
#if defined(MEMORY_STRESS_TEST)
|
||||
Serial.println(F("WARNING: Memory Stress Test Active!"));
|
||||
Serial.print(F("Allocating extra memory: "));
|
||||
Serial.print(MEMORY_STRESS_INITIAL);
|
||||
Serial.println(F(" bytes..."));
|
||||
memory_stress[mem_ctr] = (char*)malloc(MEMORY_STRESS_INITIAL);
|
||||
show_memory();
|
||||
#endif
|
||||
|
||||
setup_hardware();
|
||||
|
||||
setup_network();
|
||||
|
||||
setup_datetime();
|
||||
|
||||
setup_wolfssl();
|
||||
|
||||
setup_certificates();
|
||||
|
||||
/* Initialize wolfSSL using callback functions. */
|
||||
wolfSSL_SetIOSend(ctx, EthernetSend);
|
||||
wolfSSL_SetIORecv(ctx, EthernetReceive);
|
||||
|
||||
Serial.println(F("Completed Arduino setup!"));
|
||||
/* See companion wolfssl_server.ino code; server begins listening here
|
||||
* https://github.com/wolfSSL/wolfssl/tree/master/IDE/ARDUINO/sketches/wolfssl_server
|
||||
* Any other server will work. See also:
|
||||
* https://github.com/wolfSSL/wolfssl/tree/master/examples/client
|
||||
*/
|
||||
/* See companion wolfssl_server.ino code */
|
||||
method = wolfTLSv1_2_client_method();
|
||||
if (method == NULL) {
|
||||
Serial.println("unable to get method");
|
||||
return;
|
||||
} /* Arduino setup */
|
||||
|
||||
/*****************************************************************************/
|
||||
/* wolfSSL error_check() */
|
||||
/*****************************************************************************/
|
||||
int error_check(int this_ret, bool halt_on_error,
|
||||
const __FlashStringHelper* message) {
|
||||
int ret = 0;
|
||||
if (this_ret == WOLFSSL_SUCCESS) {
|
||||
Serial.print(F("Success: "));
|
||||
Serial.println(message);
|
||||
}
|
||||
else {
|
||||
Serial.print(F("ERROR: return = "));
|
||||
Serial.print(this_ret);
|
||||
Serial.print(F(": "));
|
||||
Serial.println(message);
|
||||
Serial.println(wc_GetErrorString(this_ret));
|
||||
if (halt_on_error) {
|
||||
fail_wait();
|
||||
}
|
||||
}
|
||||
show_memory();
|
||||
|
||||
return ret;
|
||||
} /* error_check */
|
||||
|
||||
/*****************************************************************************/
|
||||
/* wolfSSL error_check_ssl */
|
||||
/* Parameters: */
|
||||
/* ssl is the current WOLFSSL object pointer */
|
||||
/* halt_on_error set to true to suspend operations for critical error */
|
||||
/* message is expected to be a memory-efficient F("") macro string */
|
||||
/*****************************************************************************/
|
||||
int error_check_ssl(WOLFSSL* ssl, int this_ret, bool halt_on_error,
|
||||
const __FlashStringHelper* message) {
|
||||
int err = 0;
|
||||
|
||||
if (ssl == NULL) {
|
||||
Serial.println(F("ssl is Null; Unable to allocate SSL object?"));
|
||||
#ifndef DEBUG_WOLFSSL
|
||||
Serial.println(F("Define DEBUG_WOLFSSL in user_settings.h for more."));
|
||||
#else
|
||||
Serial.println(F("See wolfssl/wolfcrypt/error-crypt.h for codes."));
|
||||
#endif
|
||||
Serial.print(F("ERROR: "));
|
||||
Serial.println(message);
|
||||
show_memory();
|
||||
if (halt_on_error) {
|
||||
fail_wait();
|
||||
}
|
||||
}
|
||||
else {
|
||||
err = wolfSSL_get_error(ssl, this_ret);
|
||||
if (err == WOLFSSL_SUCCESS) {
|
||||
Serial.print(F("Success m: "));
|
||||
Serial.println(message);
|
||||
}
|
||||
else {
|
||||
if (err < 0) {
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print(F("WOLFSSL Error: "));
|
||||
Serial.print(err);
|
||||
Serial.print(F("; "));
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
else {
|
||||
Serial.println(F("Success: ssl object."));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return err;
|
||||
}
|
||||
ctx = wolfSSL_CTX_new(method);
|
||||
if (ctx == NULL) {
|
||||
Serial.println("unable to get ctx");
|
||||
return;
|
||||
}
|
||||
/* initialize wolfSSL using callback functions */
|
||||
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
|
||||
wolfSSL_SetIOSend(ctx, EthernetSend);
|
||||
wolfSSL_SetIORecv(ctx, EthernetReceive);
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
int EthernetSend(WOLFSSL* ssl, char* msg, int sz, void* ctx) {
|
||||
int sent = 0;
|
||||
|
||||
sent = client.write((byte*)msg, sz);
|
||||
|
||||
return sent;
|
||||
}
|
||||
|
||||
int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx) {
|
||||
int ret = 0;
|
||||
|
||||
while (client.available() > 0 && ret < sz) {
|
||||
reply[ret++] = client.read();
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
/* Arduino loop() */
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
void loop() {
|
||||
char reply[80];
|
||||
char msg[32] = "hello wolfssl!";
|
||||
const char* cipherName;
|
||||
int retry_shutdown = SHUTDOWN_DELAY_MS; /* max try, once per millisecond */
|
||||
int total_input = 0;
|
||||
int msgSz = 0;
|
||||
int input = 0;
|
||||
int ret = 0;
|
||||
int err = 0;
|
||||
msgSz = (int)strlen(msg);
|
||||
Serial.println(F(""));
|
||||
Serial.println(F("Starting Arduino loop() ..."));
|
||||
int err = 0;
|
||||
int input = 0;
|
||||
int total_input = 0;
|
||||
char msg[32] = "hello wolfssl!";
|
||||
int msgSz = (int)strlen(msg);
|
||||
char errBuf[80];
|
||||
char reply[80];
|
||||
const char* cipherName;
|
||||
|
||||
if (reconnect) {
|
||||
reconnect--;
|
||||
|
||||
if (client.connect(host, port)) {
|
||||
|
||||
if (reconnect) {
|
||||
reconnect--;
|
||||
/* WiFi client returns true if connection succeeds, false if not. */
|
||||
/* Wired client returns int (1,-1,-2,-3,-4) for connection status. */
|
||||
Serial.print(F("Connecting to "));
|
||||
Serial.print(host);
|
||||
Serial.print(F(":"));
|
||||
Serial.println(port);
|
||||
/* can also use: IPAddress server(192,168,1,37); */
|
||||
Serial.println(F("Here we go..."));
|
||||
ret = client.connect(host, port);
|
||||
Serial.println(F("Ok, checking..."));
|
||||
if (ret > 0) {
|
||||
Serial.println(F("Connected!"));
|
||||
Serial.print("Connected to ");
|
||||
Serial.println(host);
|
||||
|
||||
/* initialize wolfSSL */
|
||||
ret = wolfSSL_Init();
|
||||
error_check(ret, false, F("calling wolfSSL_Init") );
|
||||
ssl = wolfSSL_new(ctx);
|
||||
if (ssl == NULL) {
|
||||
Serial.println("Unable to allocate SSL object");
|
||||
return;
|
||||
}
|
||||
|
||||
/* create secure connection object. see setup for ctx certs. */
|
||||
Serial.println(F("Calling ssl = wolfSSL_new(ctx)"));
|
||||
ssl = wolfSSL_new(ctx);
|
||||
error_check_ssl(ssl, 0, true, F("Create WOLFSSL object from ctx"));
|
||||
err = wolfSSL_connect(ssl);
|
||||
if (err != WOLFSSL_SUCCESS) {
|
||||
err = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print("TLS Connect Error: ");
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
|
||||
Serial.print(F("Connecting to wolfSSL TLS Secure Server..."));
|
||||
do {
|
||||
err = 0; /* reset error */
|
||||
Serial.println(F("wolfSSL_connect ..."));
|
||||
ret = wolfSSL_connect(ssl);
|
||||
Serial.print("wolfSSL_connect return result =");
|
||||
Serial.println(ret);
|
||||
if ((ret != WOLFSSL_SUCCESS) && (ret != WC_PENDING_E)) {
|
||||
Serial.println(F("Failed connection, checking error."));
|
||||
err = error_check_ssl(ssl, ret, true,
|
||||
F("Create WOLFSSL object from ctx"));
|
||||
Serial.print("err =");
|
||||
Serial.println(err);
|
||||
}
|
||||
else {
|
||||
Serial.print(PROGRESS_DOT);
|
||||
}
|
||||
} while (err == WC_PENDING_E);
|
||||
Serial.print("SSL version is ");
|
||||
Serial.println(wolfSSL_get_version(ssl));
|
||||
|
||||
cipherName = wolfSSL_get_cipher(ssl);
|
||||
Serial.print("SSL cipher suite is ");
|
||||
Serial.println(cipherName);
|
||||
|
||||
if ((wolfSSL_write(ssl, msg, msgSz)) == msgSz) {
|
||||
|
||||
Serial.print("Server response: ");
|
||||
/* wait for data */
|
||||
while (!client.available()) {}
|
||||
/* read data */
|
||||
while (wolfSSL_pending(ssl)) {
|
||||
input = wolfSSL_read(ssl, reply, sizeof(reply) - 1);
|
||||
total_input += input;
|
||||
if (input < 0) {
|
||||
err = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print("TLS Read Error: ");
|
||||
Serial.println(errBuf);
|
||||
break;
|
||||
} else if (input > 0) {
|
||||
reply[input] = '\0';
|
||||
Serial.print(reply);
|
||||
} else {
|
||||
Serial.println();
|
||||
Serial.println(F("Connected!"));
|
||||
Serial.print(F("SSL version is "));
|
||||
Serial.println(wolfSSL_get_version(ssl));
|
||||
}
|
||||
}
|
||||
} else {
|
||||
err = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print("TLS Write Error: ");
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
|
||||
wolfSSL_shutdown(ssl);
|
||||
wolfSSL_free(ssl);
|
||||
|
||||
cipherName = wolfSSL_get_cipher(ssl);
|
||||
Serial.print(F("SSL cipher suite is "));
|
||||
Serial.println(cipherName);
|
||||
|
||||
/* see test.h
|
||||
* TODO: test.h needs a little bit of Arduino work for these:
|
||||
showPeerEx(ssl, lng_index);
|
||||
showPeerPEM(ssl);
|
||||
*/
|
||||
|
||||
Serial.print(F("Sending secure message to server: "));
|
||||
Serial.println(msg);
|
||||
ret = wolfSSL_write(ssl, msg, msgSz);
|
||||
if (ret == msgSz) {
|
||||
Serial.print(F("Waiting for Server response..."));
|
||||
|
||||
while (!client.available()) {
|
||||
/* wait for data */
|
||||
delay(1); /* 1 ms delay */
|
||||
}
|
||||
|
||||
Serial.print(F("Reading response.."));
|
||||
/* read data */
|
||||
do {
|
||||
ret = wolfSSL_read(ssl, reply, sizeof(reply) - 1);
|
||||
if (ret < 0) {
|
||||
error_check_ssl(ssl, ret, false,
|
||||
F("during TLS Read"));
|
||||
}
|
||||
else {
|
||||
Serial.print(PROGRESS_DOT);
|
||||
}
|
||||
} while (err == WC_PENDING_E);
|
||||
Serial.println();
|
||||
|
||||
Serial.println();
|
||||
Serial.println(reply); /* typically: I hear you fa shizzle! */
|
||||
Serial.println();
|
||||
|
||||
} /* wolfSSL_write message size matched */
|
||||
else {
|
||||
error_check_ssl(ssl, ret, false,
|
||||
F("during TLS Write"));
|
||||
} /* any wolfSSL_write message size mismatch is an error */
|
||||
|
||||
Serial.print(F("Shutting down.."));
|
||||
do {
|
||||
delay(1);
|
||||
Serial.print(PROGRESS_DOT);
|
||||
retry_shutdown--;
|
||||
ret = wolfSSL_shutdown(ssl);
|
||||
} while ( (ret == WOLFSSL_SHUTDOWN_NOT_DONE)
|
||||
&& (retry_shutdown > 0)
|
||||
); /* There may be pending data, so wait until done. */
|
||||
Serial.println();
|
||||
|
||||
if (retry_shutdown <= 0) {
|
||||
/* if wolfSSL_free is called before properly shutting down the
|
||||
* ssl object, undesired results may occur. */
|
||||
Serial.println(F("Warning! Shutdown did not properly complete."));
|
||||
}
|
||||
|
||||
wolfSSL_free(ssl);
|
||||
client.stop();
|
||||
Serial.println(F("Connection complete."));
|
||||
if (REPEAT_CONNECTION) {
|
||||
reconnect = RECONNECT_ATTEMPTS;
|
||||
}
|
||||
else {
|
||||
reconnect = 0;
|
||||
}
|
||||
} /* client.connect(host, port) */
|
||||
else {
|
||||
Serial.println(F("Problem sending message. Trying to reconnect..."));
|
||||
}
|
||||
client.stop();
|
||||
Serial.println("Connection complete.");
|
||||
reconnect = 0;
|
||||
} else {
|
||||
Serial.println("Trying to reconnect...");
|
||||
}
|
||||
delay(1000);
|
||||
if ((reconnect > 0) && (REPEAT_CONNECTION)) {
|
||||
Serial.println(F("Arduino loop repeating..."));
|
||||
Serial.println();
|
||||
}
|
||||
else {
|
||||
printf("wow");
|
||||
Serial.println(F("Done!"));
|
||||
while(1) {
|
||||
/* wait forever */
|
||||
}
|
||||
}
|
||||
|
||||
#if defined(MEMORY_STRESS_TEST)
|
||||
if (mem_ctr < MEMORY_STRESS_ITERATIONS) {
|
||||
/* reminder: mem_ctr == 0 is MEMORY_STRESS_INITIAL allocation */
|
||||
mem_ctr++;
|
||||
Serial.print(F("Memory stress increment: "));
|
||||
Serial.print(mem_ctr);
|
||||
Serial.print(F(". Allocating addition memory (bytes): "));
|
||||
Serial.println(MEMORY_STRESS_BLOCK_SIZE);
|
||||
memory_stress[mem_ctr] = (char*)malloc(MEMORY_STRESS_BLOCK_SIZE);
|
||||
show_memory();
|
||||
}
|
||||
#endif
|
||||
} /* Arduino loop repeats */
|
||||
}
|
||||
delay(1000);
|
||||
}
|
||||
|
||||
@@ -1,134 +0,0 @@
|
||||
# Arduino Basic TLS Server
|
||||
|
||||
Open the [wolfssl_server.ino](./wolfssl_server.ino) file in the Arduino IDE.
|
||||
|
||||
Other IDE products are also supported, such as:
|
||||
|
||||
- [PlatformIO in VS Code](https://docs.platformio.org/en/latest/frameworks/arduino.html)
|
||||
- [VisualGDB](https://visualgdb.com/tutorials/arduino/)
|
||||
- [VisualMicro](https://www.visualmicro.com/)
|
||||
|
||||
For examples on other platforms, see the [IDE directory](https://github.com/wolfssl/wolfssl/tree/master/IDE).
|
||||
Additional examples can be found on [wolfSSL/wolfssl-examples](https://github.com/wolfSSL/wolfssl-examples/).
|
||||
|
||||
## Connect with an Arduino Sketch
|
||||
|
||||
See the companion [Arduino Sketch Client](../wolfssl_client/wolfssl_client.ino).
|
||||
|
||||
## Connect with Linux Client
|
||||
|
||||
See also the [wolfSSL Example TLS Client](https://github.com/wolfSSL/wolfssl/tree/master/examples/client)
|
||||
and [wolfSSL Example TLS Server](https://github.com/wolfSSL/wolfssl/tree/master/examples/server).
|
||||
|
||||
Assuming a listening [Arduino Sketch Server](./wolfssl_server.ino) at `192.168.1.38` on port `11111`,
|
||||
connect with the `client` executable:
|
||||
|
||||
```
|
||||
./examples/client/client -h 192.168.1.38 -p 11111 -v 3
|
||||
```
|
||||
|
||||
## wolfSSL Error -308 wolfSSL_connect error state on socket
|
||||
|
||||
When using a wired Ethernet connection, and this error is encountered, simply
|
||||
press the reset button or power cycle the Arduino before making a connection.
|
||||
|
||||
Here's one possible script to test the server from a command-line client:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
echo "client log " > client_log.txt
|
||||
counter=1
|
||||
THIS_ERR=0
|
||||
while [ $THIS_ERR -eq 0 ]; do
|
||||
./examples/client/client -h 192.168.1.38 -p 11111 -v 3 >> client_log.txt
|
||||
|
||||
THIS_ERR=$?
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed!"
|
||||
exit 1
|
||||
fi
|
||||
echo "Iteration $counter"
|
||||
echo "Iteration $counter" >> client_log.txt
|
||||
((counter++))
|
||||
done
|
||||
```
|
||||
|
||||
Output expected from the `client` command:
|
||||
|
||||
```
|
||||
$ ./examples/client/client -h 192.168.1.38 -p 11111 -v 3
|
||||
Alternate cert chain used
|
||||
issuer : /C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
|
||||
subject: /C=US/ST=Montana/L=Bozeman/O=wolfSSL/OU=Support/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
|
||||
altname = example.com
|
||||
altname = 127.0.0.1
|
||||
serial number:01
|
||||
SSL version is TLSv1.2
|
||||
SSL cipher suite is ECDHE-RSA-AES128-GCM-SHA256
|
||||
SSL curve name is SECP256R1
|
||||
---
|
||||
Server certificate
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIE6DCCA9CgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMx
|
||||
EDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNh
|
||||
d3Rvb3RoMRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNz
|
||||
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjMxMjEz
|
||||
MjIxOTI4WhcNMjYwOTA4MjIxOTI4WjCBkDELMAkGA1UEBhMCVVMxEDAOBgNVBAgM
|
||||
B01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxEDAO
|
||||
BgNVBAsMB1N1cHBvcnQxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
|
||||
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
|
||||
ADCCAQoCggEBAMCVCOFXQfJxbbfSRUEnAWXGRa7yvCQwuJXOL07W9hyIvHyf+6hn
|
||||
f/5cnFF194rKB+c1L4/hvXvAL3yrZKgX/Mpde7rgIeVyLm8uhtiVc9qsG1O5Xz/X
|
||||
GQ0lT+FjY1GLC2Q/rUO4pRxcNLOuAKBjxfZ/C1loeHOmjBipAm2vwxkBLrgQ48bM
|
||||
QLRpo0YzaYduxLsXpvPo3a1zvHsvIbX9ZlEMvVSz4W1fHLwjc9EJA4kU0hC5ZMMq
|
||||
0KGWSrzh1Bpbx6DAwWN4D0Q3MDKWgDIjlaF3uhPSl3PiXSXJag3DOWCktLBpQkIJ
|
||||
6dgIvDMgs1gip6rrxOHmYYPF0pbf2dBPrdcCAwEAAaOCAUUwggFBMB0GA1UdDgQW
|
||||
BBSzETLJkpiE4sn40DtuA0LKHw6OPDCB1AYDVR0jBIHMMIHJgBQnjmcRdMMmHT/t
|
||||
M2OzpNgdMOXo1aGBmqSBlzCBlDELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRh
|
||||
bmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3RoMRMwEQYDVQQL
|
||||
DApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20xHzAdBgkqhkiG
|
||||
9w0BCQEWEGluZm9Ad29sZnNzbC5jb22CFDNEGqhsAez2YPJwUQpM0RT6vOlEMAwG
|
||||
A1UdEwQFMAMBAf8wHAYDVR0RBBUwE4ILZXhhbXBsZS5jb22HBH8AAAEwHQYDVR0l
|
||||
BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQBK/7nl
|
||||
hZvaU2Z/ByK/thnqQuukEQdi/zlfMzc6hyZxPROyyrhkOHuKmUgOpaRrsZlu4EZR
|
||||
vRlSrbymfip6fCOnzNteQ31rBMi33ZWt8JGAWcUZkSYnkbhIHOtVtqp9pDjxA7xs
|
||||
i6qU1jwFepbFBvEmFC51+93lNbMBLLOtYlohmgi+Vvz5okKHhuWpxZnPrhS+4LkI
|
||||
JA0dXNYU4UyfQLOp6S1Si0y/rEQxZ8GNBoXsD+SZ10t7IQZm1OT1nf+O8IY5WB2k
|
||||
W+Jj73zJGIeoAiUQPoco+fXvR56lgAgRkGj+0aOoUbk3/9XKfId/a7wsEsjFhYv8
|
||||
DMa5hrjJBMNRN9JP
|
||||
-----END CERTIFICATE-----
|
||||
Session timeout set to 500 seconds
|
||||
Client Random : 56A0BB9647B064D3F20947032B74B31FDB4C93DBAC9460BA8AEA213A2B2DD4A8
|
||||
SSL-Session:
|
||||
Protocol : TLSv1.2
|
||||
Cipher : TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
Session-ID: 3255404E997FA9C27ECB4F1A20A70E722E4AA504B63A945FC175434D1907EC31
|
||||
Session-ID-ctx:
|
||||
Master-Key: 67F22168BBADD678643BBA76B398277270C29788AC18FD05B57F6B715F49A7BCEEF75BEAF7FE266B0CC058534AF76C1F
|
||||
TLS session ticket: NONE
|
||||
Start Time: 1705533296
|
||||
Timeout : 500 (sec)
|
||||
Extended master secret: no
|
||||
I hear you fa shizzle!
|
||||
```
|
||||
|
||||
### Troubleshooting
|
||||
|
||||
When encountering odd errors such as `undefined reference to ``_impure_ptr'`, such as this:
|
||||
|
||||
```text
|
||||
c:/users/gojimmypi/appdata/local/arduino15/packages/esp32/tools/xtensa-esp32-elf-gcc/esp-2021r2-patch5-8.4.0/bin/../lib/gcc/xtensa-esp32-elf/8.4.0/../../../../xtensa-esp32-elf/bin/ld.exe: C:\Users\gojimmypi\AppData\Local\Temp\arduino\sketches\EAB8D79A02D1ECF107884802D893914E\libraries\wolfSSL\wolfcrypt\src\logging.c.o:(.literal.wolfssl_log+0x8): undefined reference to `_impure_ptr'
|
||||
collect2.exe: error: ld returned 1 exit status
|
||||
|
||||
exit status 1
|
||||
|
||||
Compilation error: exit status 1
|
||||
```
|
||||
|
||||
Try cleaning the Arduino cache directories. For Windows, that's typically in:
|
||||
|
||||
```text
|
||||
C:\Users\%USERNAME%\AppData\Local\Temp\arduino\sketches
|
||||
```
|
||||
|
||||
Remove all other boards from other serial ports, leaving one the one being programmed.
|
||||
@@ -1,6 +1,6 @@
|
||||
/* wolfssl_server.ino
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -19,820 +19,161 @@
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
||||
*/
|
||||
|
||||
/*
|
||||
Tested with:
|
||||
|
||||
1) Intel Galileo acting as the Client, with a laptop acting as a server using
|
||||
the server example provided in examples/server.
|
||||
Legacy Arduino v1.86 was used to compile and program the Galileo
|
||||
|
||||
2) Espressif ESP32 WiFi
|
||||
|
||||
3) Arduino Due, Nano33 IoT, Nano RP-2040
|
||||
*/
|
||||
|
||||
/*
|
||||
* Note to code editors: the Arduino client and server examples are edited in
|
||||
* parallel for side-by-side comparison between examples.
|
||||
*/
|
||||
|
||||
/* If you have a private include, define it here, otherwise edit WiFi params */
|
||||
#define MY_PRIVATE_CONFIG "/workspace/my_private_config.h"
|
||||
|
||||
/* set REPEAT_CONNECTION to a non-zero value to continually run the example. */
|
||||
#define REPEAT_CONNECTION 1
|
||||
|
||||
/* Edit this with your other TLS host server address to connect to: */
|
||||
/* #define WOLFSSL_TLS_SERVER_HOST "192.168.1.34" */
|
||||
|
||||
/* wolfssl TLS examples communicate on port 11111 */
|
||||
#define WOLFSSL_PORT 11111
|
||||
|
||||
/* Choose a monitor serial baud rate: 9600, 14400, 19200, 57600, 74880, etc. */
|
||||
#define SERIAL_BAUD 115200
|
||||
|
||||
/* We'll wait up to 2000 milliseconds to properly shut down connection */
|
||||
#define SHUTDOWN_DELAY_MS 2000
|
||||
|
||||
/* Number of times to retry connection. */
|
||||
#define RECONNECT_ATTEMPTS 20
|
||||
|
||||
/* Optional stress test. Define to consume memory until exhausted: */
|
||||
/* #define MEMORY_STRESS_TEST */
|
||||
|
||||
/* Choose client or server example, not both. */
|
||||
/* #define WOLFSSL_CLIENT_EXAMPLE */
|
||||
#define WOLFSSL_SERVER_EXAMPLE
|
||||
|
||||
#if defined(MY_PRIVATE_CONFIG)
|
||||
/* the /workspace directory may contain a private config
|
||||
* excluded from GitHub with items such as WiFi passwords */
|
||||
#include MY_PRIVATE_CONFIG
|
||||
static const char* ssid PROGMEM = MY_ARDUINO_WIFI_SSID;
|
||||
static const char* password PROGMEM = MY_ARDUINO_WIFI_PASSWORD;
|
||||
#else
|
||||
/* when using WiFi capable boards: */
|
||||
static const char* ssid PROGMEM = "your_SSID";
|
||||
static const char* password PROGMEM = "your_PASSWORD";
|
||||
#endif
|
||||
|
||||
#define BROADCAST_ADDRESS "255.255.255.255"
|
||||
|
||||
/* There's an optional 3rd party NTPClient library by Fabrice Weinberg.
|
||||
* If it is installed, uncomment define USE_NTP_LIB here: */
|
||||
/* #define USE_NTP_LIB */
|
||||
#ifdef USE_NTP_LIB
|
||||
#include <NTPClient.h>
|
||||
#endif
|
||||
|
||||
#include <wolfssl.h>
|
||||
/* Important: make sure settings.h appears before any other wolfSSL headers */
|
||||
#include <wolfssl/wolfcrypt/settings.h>
|
||||
/* Reminder: settings.h includes user_settings.h
|
||||
* For ALL project wolfSSL settings, see:
|
||||
* [your path]/Arduino\libraries\wolfSSL\src\user_settings.h */
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <Ethernet.h>
|
||||
|
||||
#define USE_CERT_BUFFERS_256
|
||||
#include <wolfssl/certs_test.h>
|
||||
#include <wolfssl/wolfcrypt/error-crypt.h>
|
||||
|
||||
/* Define DEBUG_WOLFSSL in user_settings.h for more verbose logging. */
|
||||
#if defined(DEBUG_WOLFSSL)
|
||||
#define PROGRESS_DOT F("")
|
||||
#else
|
||||
#define PROGRESS_DOT F(".")
|
||||
#ifdef NO_WOLFSSL_SERVER
|
||||
#error Please undefine NO_WOLFSSL_SERVER for this example
|
||||
#endif
|
||||
|
||||
/* Convert a macro to a string */
|
||||
#define xstr(x) str(x)
|
||||
#define str(x) #x
|
||||
const int port = 11111; /* port to listen on */
|
||||
|
||||
/* optional board-specific networking includes */
|
||||
#if defined(ESP32)
|
||||
#define USING_WIFI
|
||||
#include <WiFi.h>
|
||||
#include <WiFiUdp.h>
|
||||
#ifdef USE_NTP_LIB
|
||||
WiFiUDP ntpUDP;
|
||||
#endif
|
||||
/* Ensure the F() flash macro is defined */
|
||||
#ifndef F
|
||||
#define F
|
||||
#endif
|
||||
WiFiClient client;
|
||||
WiFiServer server(WOLFSSL_PORT);
|
||||
#elif defined(ESP8266)
|
||||
#define USING_WIFI
|
||||
#include <ESP8266WiFi.h>
|
||||
WiFiClient client;
|
||||
WiFiServer server(WOLFSSL_PORT);
|
||||
#elif defined(ARDUINO_SAM_DUE)
|
||||
#include <SPI.h>
|
||||
/* There's no WiFi/Ethernet on the Due. Requires Ethernet Shield.
|
||||
/* Needs "Ethernet by Various" library to be installed. Tested with V2.0.2 */
|
||||
#include <Ethernet.h>
|
||||
EthernetClient client;
|
||||
EthernetClient server(WOLFSSL_PORT);
|
||||
#elif defined(ARDUINO_SAMD_NANO_33_IOT)
|
||||
#define USING_WIFI
|
||||
#include <SPI.h>
|
||||
#include <WiFiNINA.h> /* Needs Arduino WiFiNINA library installed manually */
|
||||
WiFiClient client;
|
||||
WiFiServer server(WOLFSSL_PORT);
|
||||
#elif defined(ARDUINO_ARCH_RP2040)
|
||||
#define USING_WIFI
|
||||
#include <SPI.h>
|
||||
#include <WiFiNINA.h>
|
||||
WiFiClient client;
|
||||
WiFiServer server(WOLFSSL_PORT);
|
||||
#elif defined(USING_WIFI)
|
||||
#define USING_WIFI
|
||||
#include <WiFi.h>
|
||||
#include <WiFiUdp.h>
|
||||
#ifdef USE_NTP_LIB
|
||||
WiFiUDP ntpUDP;
|
||||
#endif
|
||||
WiFiClient client;
|
||||
WiFiServer server(WOLFSSL_PORT);
|
||||
/* TODO
|
||||
#elif defined(OTHER_BOARD)
|
||||
*/
|
||||
#else
|
||||
#define USING_WIFI
|
||||
WiFiClient client;
|
||||
WiFiServer server(WOLFSSL_PORT);
|
||||
#endif
|
||||
int EthernetSend(WOLFSSL* ssl, char* msg, int sz, void* ctx);
|
||||
int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx);
|
||||
|
||||
/* Only for syntax highlighters to show interesting options enabled: */
|
||||
#if defined(HAVE_SNI) \
|
||||
|| defined(HAVE_MAX_FRAGMENT) \
|
||||
|| defined(HAVE_TRUSTED_CA) \
|
||||
|| defined(HAVE_TRUNCATED_HMAC) \
|
||||
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|
||||
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) \
|
||||
|| defined(HAVE_SUPPORTED_CURVES) \
|
||||
|| defined(HAVE_ALPN) \
|
||||
|| defined(HAVE_SESSION_TICKET) \
|
||||
|| defined(HAVE_SECURE_RENEGOTIATION) \
|
||||
|| defined(HAVE_SERVER_RENEGOTIATION_INFO)
|
||||
#endif
|
||||
EthernetServer server(port);
|
||||
EthernetClient client;
|
||||
|
||||
WOLFSSL_CTX* ctx = NULL;
|
||||
WOLFSSL* ssl = NULL;
|
||||
|
||||
/* we expect our IP address from DHCP */
|
||||
void setup() {
|
||||
int err;
|
||||
WOLFSSL_METHOD* method;
|
||||
|
||||
static WOLFSSL_CTX* ctx = NULL;
|
||||
static WOLFSSL* ssl = NULL;
|
||||
static char* wc_error_message = (char*)malloc(80 + 1);
|
||||
static char errBuf[80];
|
||||
Serial.begin(9600);
|
||||
|
||||
#if defined(MEMORY_STRESS_TEST)
|
||||
#define MEMORY_STRESS_ITERATIONS 100
|
||||
#define MEMORY_STRESS_BLOCK_SIZE 1024
|
||||
#define MEMORY_STRESS_INITIAL (4*1024)
|
||||
static char* memory_stress[MEMORY_STRESS_ITERATIONS]; /* typically 1K per item */
|
||||
static int mem_ctr = 0;
|
||||
#endif
|
||||
|
||||
static int EthernetSend(WOLFSSL* ssl, char* msg, int sz, void* ctx);
|
||||
static int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx);
|
||||
static int reconnect = RECONNECT_ATTEMPTS;
|
||||
static int lng_index PROGMEM = 0; /* 0 = English */
|
||||
|
||||
#if defined(__arm__)
|
||||
#include <malloc.h>
|
||||
extern char _end;
|
||||
extern "C" char *sbrk(int i);
|
||||
static char *ramstart=(char *)0x20070000;
|
||||
static char *ramend=(char *)0x20088000;
|
||||
#endif
|
||||
|
||||
/*****************************************************************************/
|
||||
/* fail_wait - in case of unrecoverable error */
|
||||
/*****************************************************************************/
|
||||
int fail_wait(void) {
|
||||
show_memory();
|
||||
|
||||
Serial.println(F("Failed. Halt."));
|
||||
while (1) {
|
||||
delay(1000);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* show_memory() to optionally view during debugging. */
|
||||
/*****************************************************************************/
|
||||
int show_memory(void)
|
||||
{
|
||||
#if defined(__arm__)
|
||||
struct mallinfo mi = mallinfo();
|
||||
|
||||
char *heapend=sbrk(0);
|
||||
register char * stack_ptr asm("sp");
|
||||
#if defined(DEBUG_WOLFSSL_VERBOSE)
|
||||
Serial.print(" arena=");
|
||||
Serial.println(mi.arena);
|
||||
Serial.print(" ordblks=");
|
||||
Serial.println(mi.ordblks);
|
||||
Serial.print(" uordblks=");
|
||||
Serial.println(mi.uordblks);
|
||||
Serial.print(" fordblks=");
|
||||
Serial.println(mi.fordblks);
|
||||
Serial.print(" keepcost=");
|
||||
Serial.println(mi.keepcost);
|
||||
#endif
|
||||
|
||||
#if defined(DEBUG_WOLFSSL) || defined(MEMORY_STRESS_TEST)
|
||||
Serial.print("Estimated free memory: ");
|
||||
Serial.print(stack_ptr - heapend + mi.fordblks);
|
||||
Serial.println(F(" bytes"));
|
||||
#endif
|
||||
|
||||
#if (0)
|
||||
/* Experimental: not supported on all devices: */
|
||||
Serial.print("RAM Start %lx\n", (unsigned long)ramstart);
|
||||
Serial.print("Data/Bss end %lx\n", (unsigned long)&_end);
|
||||
Serial.print("Heap End %lx\n", (unsigned long)heapend);
|
||||
Serial.print("Stack Ptr %lx\n",(unsigned long)stack_ptr);
|
||||
Serial.print("RAM End %lx\n", (unsigned long)ramend);
|
||||
|
||||
Serial.print("Heap RAM Used: ",mi.uordblks);
|
||||
Serial.print("Program RAM Used ",&_end - ramstart);
|
||||
Serial.print("Stack RAM Used ",ramend - stack_ptr);
|
||||
|
||||
Serial.print("Estimated Free RAM: %d\n\n",stack_ptr - heapend + mi.fordblks);
|
||||
#endif
|
||||
#else
|
||||
Serial.println(F("show_memory() not implemented for this platform"));
|
||||
#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* EthernetSend() to send a message string. */
|
||||
/*****************************************************************************/
|
||||
int EthernetSend(WOLFSSL* ssl, char* message, int sz, void* ctx) {
|
||||
int sent = 0;
|
||||
(void)ssl;
|
||||
(void)ctx;
|
||||
|
||||
sent = client.write((byte*)message, sz);
|
||||
return sent;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* EthernetReceive() to receive a reply string. */
|
||||
/*****************************************************************************/
|
||||
int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx) {
|
||||
int ret = 0;
|
||||
(void)ssl;
|
||||
(void)ctx;
|
||||
|
||||
while (client.available() > 0 && ret < sz) {
|
||||
reply[ret++] = client.read();
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_hardware() */
|
||||
/*****************************************************************************/
|
||||
int setup_hardware(void) {
|
||||
int ret = 0;
|
||||
|
||||
#if defined(ARDUINO_SAMD_NANO_33_IOT)
|
||||
Serial.println(F("Detected known tested and working Arduino Nano 33 IoT"));
|
||||
#elif defined(ARDUINO_ARCH_RP2040)
|
||||
Serial.println(F("Detected known tested and working Arduino RP-2040"));
|
||||
#elif defined(__arm__) && defined(ID_TRNG) && defined(TRNG)
|
||||
/* need to manually turn on random number generator on Arduino Due, etc. */
|
||||
pmc_enable_periph_clk(ID_TRNG);
|
||||
trng_enable(TRNG);
|
||||
Serial.println(F("Enabled ARM TRNG"));
|
||||
#endif
|
||||
|
||||
show_memory();
|
||||
randomSeed(analogRead(0));
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_datetime() */
|
||||
/* The device needs to have a valid date within the valid range of certs. */
|
||||
/*****************************************************************************/
|
||||
int setup_datetime(void) {
|
||||
int ret = 0;
|
||||
int ntp_tries = 20;
|
||||
|
||||
/* we need a date in the range of cert expiration */
|
||||
#ifdef USE_NTP_LIB
|
||||
#if defined(ESP32)
|
||||
NTPClient timeClient(ntpUDP, "pool.ntp.org");
|
||||
|
||||
timeClient.begin();
|
||||
timeClient.update();
|
||||
delay(1000);
|
||||
while (!timeClient.isTimeSet() && (ntp_tries > 0)) {
|
||||
timeClient.forceUpdate();
|
||||
Serial.println(F("Waiting for NTP update"));
|
||||
delay(2000);
|
||||
ntp_tries--;
|
||||
}
|
||||
if (ntp_tries <= 0) {
|
||||
Serial.println(F("Warning: gave up waiting on NTP"));
|
||||
}
|
||||
Serial.println(timeClient.getFormattedTime());
|
||||
Serial.println(timeClient.getEpochTime());
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#if defined(ESP32)
|
||||
/* see esp32-hal-time.c */
|
||||
ntp_tries = 5;
|
||||
/* Replace "pool.ntp.org" with your preferred NTP server */
|
||||
configTime(0, 0, "pool.ntp.org");
|
||||
|
||||
/* Wait for time to be set */
|
||||
while ((time(nullptr) <= 100000) && ntp_tries > 0) {
|
||||
Serial.println(F("Waiting for time to be set..."));
|
||||
delay(2000);
|
||||
ntp_tries--;
|
||||
}
|
||||
#endif
|
||||
|
||||
return ret;
|
||||
} /* setup_datetime */
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_network() */
|
||||
/*****************************************************************************/
|
||||
int setup_network(void) {
|
||||
int ret = 0;
|
||||
|
||||
#if defined(USING_WIFI)
|
||||
int status = WL_IDLE_STATUS;
|
||||
|
||||
/* The ESP8266 & ESP32 support both AP and STA. We'll use STA: */
|
||||
#if defined(ESP8266) || defined(ESP32)
|
||||
WiFi.mode(WIFI_STA);
|
||||
#else
|
||||
String fv;
|
||||
if (WiFi.status() == WL_NO_MODULE) {
|
||||
Serial.println("Communication with WiFi module failed!");
|
||||
/* don't continue if no network */
|
||||
while (true) ;
|
||||
}
|
||||
|
||||
fv = WiFi.firmwareVersion();
|
||||
if (fv < WIFI_FIRMWARE_LATEST_VERSION) {
|
||||
Serial.println("Please upgrade the firmware");
|
||||
}
|
||||
#endif
|
||||
|
||||
Serial.print(F("Connecting to WiFi "));
|
||||
Serial.print(ssid);
|
||||
status = WiFi.begin(ssid, password);
|
||||
while (status != WL_CONNECTED) {
|
||||
delay(1000);
|
||||
Serial.print(F("."));
|
||||
Serial.print(status);
|
||||
status = WiFi.status();
|
||||
}
|
||||
|
||||
Serial.println(F(" Connected!"));
|
||||
#else
|
||||
/* Newer Ethernet shields have a
|
||||
* MAC address printed on a sticker on the shield */
|
||||
byte mac[] = { 0xDE, 0xAD, 0xBE, 0xEF, 0xFE, 0xED };
|
||||
IPAddress ip(192, 168, 1, 42);
|
||||
IPAddress myDns(192, 168, 1, 1);
|
||||
Ethernet.init(10); /* Most Arduino shields */
|
||||
/* Ethernet.init(5); * MKR ETH Shield */
|
||||
/* Ethernet.init(0); * Teensy 2.0 */
|
||||
/* Ethernet.init(20); * Teensy++ 2.0 */
|
||||
/* Ethernet.init(15); * ESP8266 with Adafruit FeatherWing Ethernet */
|
||||
/* Ethernet.init(33); * ESP32 with Adafruit FeatherWing Ethernet */
|
||||
Serial.println(F("Initialize Ethernet with DHCP:"));
|
||||
if (Ethernet.begin(mac) == 0) {
|
||||
Serial.println(F("Failed to configure Ethernet using DHCP"));
|
||||
/* Check for Ethernet hardware present */
|
||||
if (Ethernet.hardwareStatus() == EthernetNoHardware) {
|
||||
Serial.println(F("Ethernet shield was not found."));
|
||||
while (true) {
|
||||
delay(1); /* do nothing */
|
||||
}
|
||||
}
|
||||
if (Ethernet.linkStatus() == LinkOFF) {
|
||||
Serial.println(F("Ethernet cable is not connected."));
|
||||
}
|
||||
/* try to configure using IP address instead of DHCP : */
|
||||
Ethernet.begin(mac, ip, myDns);
|
||||
}
|
||||
else {
|
||||
Serial.print(F(" DHCP assigned IP "));
|
||||
Serial.println(Ethernet.localIP());
|
||||
}
|
||||
/* We'll assume the Ethernet connection is ready to go. */
|
||||
#endif
|
||||
|
||||
Serial.println(F("********************************************************"));
|
||||
Serial.print(F(" wolfSSL Example Server IP = "));
|
||||
#if defined(USING_WIFI)
|
||||
Serial.println(WiFi.localIP());
|
||||
#else
|
||||
Serial.println(Ethernet.localIP());
|
||||
#endif
|
||||
/* In server mode, there's no host definition. */
|
||||
/* See companion example: wolfssl_client.ino */
|
||||
Serial.println(F("********************************************************"));
|
||||
Serial.println(F("Setup network complete."));
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_wolfssl() */
|
||||
/*****************************************************************************/
|
||||
int setup_wolfssl(void) {
|
||||
int ret = 0;
|
||||
WOLFSSL_METHOD* method;
|
||||
|
||||
/* Show a revision of wolfssl user_settings.h file in use when available: */
|
||||
#if defined(WOLFSSL_USER_SETTINGS_ID)
|
||||
Serial.print(F("WOLFSSL_USER_SETTINGS_ID: "));
|
||||
Serial.println(F(WOLFSSL_USER_SETTINGS_ID));
|
||||
#else
|
||||
Serial.println(F("No WOLFSSL_USER_SETTINGS_ID found."));
|
||||
#endif
|
||||
|
||||
#if defined(NO_WOLFSSL_SERVER)
|
||||
Serial.println(F("wolfSSL server code disabled to save space."));
|
||||
#endif
|
||||
#if defined(NO_WOLFSSL_CLIENT)
|
||||
Serial.println(F("wolfSSL client code disabled to save space."));
|
||||
#endif
|
||||
|
||||
#if defined(DEBUG_WOLFSSL)
|
||||
wolfSSL_Debugging_ON();
|
||||
Serial.println(F("wolfSSL Debugging is On!"));
|
||||
#else
|
||||
Serial.println(F("wolfSSL Debugging is Off! (enable with DEBUG_WOLFSSL)"));
|
||||
#endif
|
||||
|
||||
/* See ssl.c for TLS cache settings. Larger cache = use more RAM. */
|
||||
#if defined(NO_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS NO_SESSION_CACHE"));
|
||||
#elif defined(MICRO_SESSION_CACHEx)
|
||||
Serial.println(F("wolfSSL TLS MICRO_SESSION_CACHE"));
|
||||
#elif defined(SMALL_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS SMALL_SESSION_CACHE"));
|
||||
#elif defined(MEDIUM_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS MEDIUM_SESSION_CACHE"));
|
||||
#elif defined(BIG_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS BIG_SESSION_CACHE"));
|
||||
#elif defined(HUGE_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS HUGE_SESSION_CACHE"));
|
||||
#elif defined(HUGE_SESSION_CACHE)
|
||||
Serial.println(F("wolfSSL TLS HUGE_SESSION_CACHE"));
|
||||
#else
|
||||
Serial.println(F("WARNING: Unknown or no TLS session cache setting."));
|
||||
/* See wolfssl/src/ssl.c for amount of memory used.
|
||||
* It is best on embedded devices to choose a TLS session cache size. */
|
||||
#endif
|
||||
|
||||
ret = wolfSSL_Init();
|
||||
if (ret == WOLFSSL_SUCCESS) {
|
||||
Serial.println("Successfully called wolfSSL_Init");
|
||||
}
|
||||
else {
|
||||
Serial.println("ERROR: wolfSSL_Init failed");
|
||||
}
|
||||
|
||||
/* See companion server example with wolfSSLv23_server_method here.
|
||||
* method = wolfSSLv23_client_method()); SSL 3.0 - TLS 1.3.
|
||||
* method = wolfTLSv1_2_client_method(); only TLS 1.2
|
||||
* method = wolfTLSv1_3_client_method(); only TLS 1.3
|
||||
*
|
||||
* see Arduino\libraries\wolfssl\src\user_settings.h */
|
||||
|
||||
Serial.println("Here we go!");
|
||||
|
||||
method = wolfSSLv23_server_method();
|
||||
if (method == NULL) {
|
||||
Serial.println(F("unable to get wolfssl server method"));
|
||||
fail_wait();
|
||||
}
|
||||
ctx = wolfSSL_CTX_new(method);
|
||||
if (ctx == NULL) {
|
||||
Serial.println(F("unable to get ctx"));
|
||||
fail_wait();
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup_certificates() */
|
||||
/*****************************************************************************/
|
||||
int setup_certificates(void) {
|
||||
int ret = 0;
|
||||
|
||||
Serial.println(F("Initializing certificates..."));
|
||||
show_memory();
|
||||
|
||||
/* Use built-in validation, No verification callback function: */
|
||||
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
|
||||
|
||||
/* Certificate */
|
||||
Serial.println("Initializing certificates...");
|
||||
ret = wolfSSL_CTX_use_certificate_buffer(ctx,
|
||||
CTX_SERVER_CERT,
|
||||
CTX_SERVER_CERT_SIZE,
|
||||
CTX_CA_CERT_TYPE);
|
||||
if (ret == WOLFSSL_SUCCESS) {
|
||||
Serial.print("Success: use certificate: ");
|
||||
Serial.println(xstr(CTX_SERVER_CERT));
|
||||
}
|
||||
else {
|
||||
Serial.print("Error: wolfSSL_CTX_use_certificate_buffer failed: ");
|
||||
wc_ErrorString(ret, wc_error_message);
|
||||
Serial.println(wc_error_message);
|
||||
fail_wait();
|
||||
}
|
||||
|
||||
/* Setup private server key */
|
||||
ret = wolfSSL_CTX_use_PrivateKey_buffer(ctx,
|
||||
CTX_SERVER_KEY,
|
||||
CTX_SERVER_KEY_SIZE,
|
||||
CTX_SERVER_KEY_TYPE);
|
||||
if (ret == WOLFSSL_SUCCESS) {
|
||||
Serial.print("Success: use private key buffer: ");
|
||||
Serial.println(xstr(CTX_SERVER_KEY));
|
||||
}
|
||||
else {
|
||||
Serial.print("Error: wolfSSL_CTX_use_PrivateKey_buffer failed: ");
|
||||
wc_ErrorString(ret, wc_error_message);
|
||||
Serial.println(wc_error_message);
|
||||
fail_wait();
|
||||
}
|
||||
|
||||
return ret;
|
||||
} /* Arduino setup */
|
||||
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
/* Arduino setup() */
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
void setup(void) {
|
||||
int i = 0;
|
||||
Serial.begin(SERIAL_BAUD);
|
||||
while (!Serial && (i < 10)) {
|
||||
/* wait for serial port to connect. Needed for native USB port only */
|
||||
delay(1000);
|
||||
i++;
|
||||
}
|
||||
|
||||
Serial.println(F(""));
|
||||
Serial.println(F(""));
|
||||
Serial.println(F("wolfSSL TLS Server Example Startup."));
|
||||
|
||||
/* define DEBUG_WOLFSSL in wolfSSL user_settings.h for diagnostics */
|
||||
#if defined(DEBUG_WOLFSSL)
|
||||
wolfSSL_Debugging_ON();
|
||||
#endif
|
||||
|
||||
/* Optionally pre-allocate a large block of memory for testing */
|
||||
#if defined(MEMORY_STRESS_TEST)
|
||||
Serial.println(F("WARNING: Memory Stress Test Active!"));
|
||||
Serial.print(F("Allocating extra memory: "));
|
||||
Serial.print(MEMORY_STRESS_INITIAL);
|
||||
Serial.println(F(" bytes..."));
|
||||
memory_stress[mem_ctr] = (char*)malloc(MEMORY_STRESS_INITIAL);
|
||||
show_memory();
|
||||
#endif
|
||||
|
||||
setup_hardware();
|
||||
|
||||
setup_network();
|
||||
|
||||
setup_datetime();
|
||||
|
||||
setup_wolfssl();
|
||||
|
||||
setup_certificates();
|
||||
|
||||
/* Initialize wolfSSL using callback functions. */
|
||||
wolfSSL_SetIOSend(ctx, EthernetSend);
|
||||
wolfSSL_SetIORecv(ctx, EthernetReceive);
|
||||
|
||||
#if defined THIS_USER_SETTINGS_VERSION
|
||||
Serial.print(F("This user_settings.h version:"))
|
||||
Serial.println(THIS_USER_SETTINGS_VERSION)
|
||||
#endif
|
||||
|
||||
/* Start the server
|
||||
* See https://www.arduino.cc/reference/en/libraries/ethernet/server.begin/
|
||||
*/
|
||||
|
||||
Serial.println(F("Completed Arduino setup()"));
|
||||
|
||||
server.begin();
|
||||
Serial.println("Begin Server... (waiting for remote client to connect)");
|
||||
|
||||
/* See companion wolfssl_client.ino code */
|
||||
method = wolfTLSv1_2_server_method();
|
||||
if (method == NULL) {
|
||||
Serial.println("unable to get method");
|
||||
return;
|
||||
} /* Arduino setup */
|
||||
}
|
||||
ctx = wolfSSL_CTX_new(method);
|
||||
if (ctx == NULL) {
|
||||
Serial.println("unable to get ctx");
|
||||
return;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* wolfSSL error_check() */
|
||||
/*****************************************************************************/
|
||||
int error_check(int this_ret, bool halt_on_error,
|
||||
const __FlashStringHelper* message) {
|
||||
int ret = 0;
|
||||
if (this_ret == WOLFSSL_SUCCESS) {
|
||||
Serial.print(F("Success: "));
|
||||
Serial.println(message);
|
||||
}
|
||||
else {
|
||||
Serial.print(F("ERROR: return = "));
|
||||
Serial.print(this_ret);
|
||||
Serial.print(F(": "));
|
||||
Serial.println(message);
|
||||
Serial.println(wc_GetErrorString(this_ret));
|
||||
if (halt_on_error) {
|
||||
fail_wait();
|
||||
}
|
||||
}
|
||||
show_memory();
|
||||
/* initialize wolfSSL using callback functions */
|
||||
wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, 0);
|
||||
wolfSSL_SetIOSend(ctx, EthernetSend);
|
||||
wolfSSL_SetIORecv(ctx, EthernetReceive);
|
||||
|
||||
return ret;
|
||||
} /* error_check */
|
||||
/* setup the private key and certificate */
|
||||
err = wolfSSL_CTX_use_PrivateKey_buffer(ctx, ecc_key_der_256,
|
||||
sizeof_ecc_key_der_256, WOLFSSL_FILETYPE_ASN1);
|
||||
if (err != WOLFSSL_SUCCESS) {
|
||||
Serial.println("error setting key");
|
||||
return;
|
||||
}
|
||||
err = wolfSSL_CTX_use_certificate_buffer(ctx, serv_ecc_der_256,
|
||||
sizeof_serv_ecc_der_256, WOLFSSL_FILETYPE_ASN1);
|
||||
if (err != WOLFSSL_SUCCESS) {
|
||||
Serial.println("error setting certificate");
|
||||
return;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/* wolfSSL error_check_ssl */
|
||||
/* Parameters: */
|
||||
/* ssl is the current WOLFSSL object pointer */
|
||||
/* halt_on_error set to true to suspend operations for critical error */
|
||||
/* message is expected to be a memory-efficient F("") macro string */
|
||||
/*****************************************************************************/
|
||||
int error_check_ssl(WOLFSSL* ssl, int this_ret, bool halt_on_error,
|
||||
const __FlashStringHelper* message) {
|
||||
int err = 0;
|
||||
|
||||
if (ssl == NULL) {
|
||||
Serial.println(F("ssl is Null; Unable to allocate SSL object?"));
|
||||
#ifndef DEBUG_WOLFSSL
|
||||
Serial.println(F("Define DEBUG_WOLFSSL in user_settings.h for more."));
|
||||
#else
|
||||
Serial.println(F("See wolfssl/wolfcrypt/error-crypt.h for codes."));
|
||||
#endif
|
||||
Serial.print(F("ERROR: "));
|
||||
Serial.println(message);
|
||||
show_memory();
|
||||
if (halt_on_error) {
|
||||
fail_wait();
|
||||
}
|
||||
}
|
||||
else {
|
||||
err = wolfSSL_get_error(ssl, this_ret);
|
||||
if (err == WOLFSSL_SUCCESS) {
|
||||
Serial.print(F("Success m: "));
|
||||
Serial.println(message);
|
||||
}
|
||||
else {
|
||||
if (err < 0) {
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print(F("WOLFSSL Error: "));
|
||||
Serial.print(err);
|
||||
Serial.print(F("; "));
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
else {
|
||||
Serial.println(F("Success: ssl object."));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return err;
|
||||
/* Start the server */
|
||||
server.begin();
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
int EthernetSend(WOLFSSL* ssl, char* msg, int sz, void* ctx) {
|
||||
int sent = 0;
|
||||
|
||||
sent = client.write((byte*)msg, sz);
|
||||
|
||||
return sent;
|
||||
}
|
||||
|
||||
int EthernetReceive(WOLFSSL* ssl, char* reply, int sz, void* ctx) {
|
||||
int ret = 0;
|
||||
|
||||
while (client.available() > 0 && ret < sz) {
|
||||
reply[ret++] = client.read();
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
/* Arduino loop() */
|
||||
/*****************************************************************************/
|
||||
/*****************************************************************************/
|
||||
void loop() {
|
||||
char errBuf[80] = "(no error";
|
||||
char reply[80] = "(no reply)";
|
||||
const char msg[] = "I hear you fa shizzle!";
|
||||
const char* cipherName;
|
||||
int input = 0;
|
||||
int replySz = 0;
|
||||
int retry_shutdown = SHUTDOWN_DELAY_MS; /* max try, once per millisecond */
|
||||
int ret = 0;
|
||||
IPAddress broadcast_address(255, 255, 255, 255);
|
||||
int err = 0;
|
||||
int input = 0;
|
||||
char errBuf[80];
|
||||
char reply[80];
|
||||
int replySz = 0;
|
||||
const char* cipherName;
|
||||
|
||||
/* Listen for incoming client requests. */
|
||||
client = server.available();
|
||||
if (client) {
|
||||
Serial.println("Have Client");
|
||||
while (!client.connected()) {
|
||||
/* wait for the client to actually connect */
|
||||
delay(10);
|
||||
}
|
||||
Serial.print("Client connected from remote IP: ");
|
||||
Serial.println(client.remoteIP());
|
||||
/* Listen for incoming client requests. */
|
||||
client = server.available();
|
||||
if (!client) {
|
||||
return;
|
||||
}
|
||||
|
||||
ssl = wolfSSL_new(ctx);
|
||||
if (ssl == NULL) {
|
||||
Serial.println("Unable to allocate SSL object");
|
||||
fail_wait();
|
||||
}
|
||||
if (client.connected()) {
|
||||
|
||||
ret = wolfSSL_accept(ssl);
|
||||
if (ret != WOLFSSL_SUCCESS) {
|
||||
ret = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(ret, errBuf);
|
||||
Serial.print("TLS Accept Error: ");
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
Serial.println("Client connected");
|
||||
|
||||
cipherName = wolfSSL_get_cipher(ssl);
|
||||
Serial.print("SSL cipher suite is ");
|
||||
Serial.println(cipherName);
|
||||
|
||||
Serial.print("Server Read: ");
|
||||
while (!client.available()) {
|
||||
/* wait for data */
|
||||
}
|
||||
|
||||
/* read data */
|
||||
while (wolfSSL_pending(ssl)) {
|
||||
input = wolfSSL_read(ssl, reply, sizeof(reply) - 1);
|
||||
if (input < 0) {
|
||||
ret = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(ret, errBuf);
|
||||
Serial.print("TLS Read Error: ");
|
||||
Serial.println(errBuf);
|
||||
break;
|
||||
}
|
||||
else if (input > 0) {
|
||||
replySz = input;
|
||||
reply[input] = '\0';
|
||||
Serial.print(reply);
|
||||
}
|
||||
else {
|
||||
Serial.println("<end of reply, input == 0>");
|
||||
}
|
||||
}
|
||||
|
||||
/* Write our message into reply buffer to send */
|
||||
memset(reply, 0, sizeof(reply));
|
||||
memcpy(reply, msg, sizeof(msg));
|
||||
replySz = strnlen(reply, sizeof(reply));
|
||||
|
||||
Serial.println("Sending reply...");
|
||||
if ((wolfSSL_write(ssl, reply, replySz)) != replySz) {
|
||||
ret = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(ret, errBuf);
|
||||
Serial.print("TLS Write Error: ");
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
else {
|
||||
Serial.println("Reply sent!");
|
||||
}
|
||||
|
||||
Serial.println("Shutdown!");
|
||||
do {
|
||||
delay(1);
|
||||
retry_shutdown--;
|
||||
ret = wolfSSL_shutdown(ssl);
|
||||
} while ((ret == WOLFSSL_SHUTDOWN_NOT_DONE) && (retry_shutdown > 0));
|
||||
|
||||
if (retry_shutdown <= 0) {
|
||||
/* if wolfSSL_free is called before properly shutting down the
|
||||
* ssl object, undesired results may occur. */
|
||||
Serial.println("Warning! Shutdown did not properly complete.");
|
||||
}
|
||||
|
||||
wolfSSL_free(ssl);
|
||||
Serial.println("Connection complete.");
|
||||
if (REPEAT_CONNECTION) {
|
||||
Serial.println();
|
||||
Serial.println("Waiting for next connection.");
|
||||
}
|
||||
else {
|
||||
client.stop();
|
||||
Serial.println("Done!");
|
||||
while (1) {
|
||||
/* wait forever if not repeating */
|
||||
delay(100);
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
/* Serial.println("Client not connected. Trying again..."); */
|
||||
ssl = wolfSSL_new(ctx);
|
||||
if (ssl == NULL) {
|
||||
Serial.println("Unable to allocate SSL object");
|
||||
return;
|
||||
}
|
||||
|
||||
delay(100);
|
||||
} /* Arduino loop repeats */
|
||||
err = wolfSSL_accept(ssl);
|
||||
if (err != WOLFSSL_SUCCESS) {
|
||||
err = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print("TLS Accept Error: ");
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
|
||||
Serial.print("SSL version is ");
|
||||
Serial.println(wolfSSL_get_version(ssl));
|
||||
|
||||
cipherName = wolfSSL_get_cipher(ssl);
|
||||
Serial.print("SSL cipher suite is ");
|
||||
Serial.println(cipherName);
|
||||
|
||||
Serial.print("Server Read: ");
|
||||
/* wait for data */
|
||||
while (!client.available()) {}
|
||||
/* read data */
|
||||
while (wolfSSL_pending(ssl)) {
|
||||
input = wolfSSL_read(ssl, reply, sizeof(reply) - 1);
|
||||
if (input < 0) {
|
||||
err = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print("TLS Read Error: ");
|
||||
Serial.println(errBuf);
|
||||
break;
|
||||
} else if (input > 0) {
|
||||
replySz = input;
|
||||
reply[input] = '\0';
|
||||
Serial.print(reply);
|
||||
} else {
|
||||
Serial.println();
|
||||
}
|
||||
}
|
||||
|
||||
/* echo data */
|
||||
if ((wolfSSL_write(ssl, reply, replySz)) != replySz) {
|
||||
err = wolfSSL_get_error(ssl, 0);
|
||||
wolfSSL_ERR_error_string(err, errBuf);
|
||||
Serial.print("TLS Write Error: ");
|
||||
Serial.println(errBuf);
|
||||
}
|
||||
|
||||
wolfSSL_shutdown(ssl);
|
||||
wolfSSL_free(ssl);
|
||||
}
|
||||
|
||||
client.stop();
|
||||
Serial.println("Connection complete");
|
||||
}
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
# Arduino Basic Hello World
|
||||
|
||||
This example simply compiles in wolfSSL and shows the current version number.
|
||||
@@ -1,24 +0,0 @@
|
||||
#include <Arduino.h>
|
||||
#include <wolfssl.h>
|
||||
#include <wolfssl/version.h>
|
||||
|
||||
/* Choose a monitor serial baud rate: 9600, 14400, 19200, 57600, 74880, etc. */
|
||||
#define SERIAL_BAUD 115200
|
||||
|
||||
/* Arduino setup */
|
||||
void setup() {
|
||||
Serial.begin(SERIAL_BAUD);
|
||||
while (!Serial) {
|
||||
/* wait for serial port to connect. Needed for native USB port only */
|
||||
}
|
||||
Serial.println(F(""));
|
||||
Serial.println(F(""));
|
||||
Serial.println(F("wolfSSL setup complete!"));
|
||||
}
|
||||
|
||||
/* Arduino main application loop. */
|
||||
void loop() {
|
||||
Serial.print("wolfSSL Version: ");
|
||||
Serial.println(LIBWOLFSSL_VERSION_STRING);
|
||||
delay(60000);
|
||||
}
|
||||
@@ -2,323 +2,89 @@
|
||||
|
||||
# this script will reformat the wolfSSL source code to be compatible with
|
||||
# an Arduino project
|
||||
# run as bash ./wolfssl-arduino.sh [INSTALL] [path]
|
||||
#
|
||||
# ./wolfssl-arduino.sh
|
||||
# The default is to install to a local wolfSSL directory (`ROOT_DIR`).
|
||||
# If successfully built, and the INSTALL option is used, tis directory
|
||||
# is then moved to the target.
|
||||
#
|
||||
# ./wolfssl-arduino.sh INSTALL
|
||||
# Creates a local wolfSSL directory and then moves it to the ARDUINO_ROOT
|
||||
#
|
||||
# ./wolfssl-arduino.sh INSTALL /mnt/c/workspace/Arduino-wolfSSL-$USER
|
||||
# Updates the Arduino-wolfSSL fork for $USER to refresh versions.
|
||||
#
|
||||
# To ensure a pristine build, the directory must not exist.
|
||||
#
|
||||
# Reminder there's typically no $USER for GitHub actions, but:
|
||||
# ROOT_DIR="/mnt/c/Users/$USER/Documents/Arduino/libraries"
|
||||
#
|
||||
# The company name is "wolfSSL Inc."; There’s a space, no comma, and a period after "Inc."
|
||||
# The Arduino library name is "wolfssl" (all lower case)
|
||||
# The Arduino library directory name is "wolfssl" (all lower case)
|
||||
# The Arduino library include file is "wolfssl.h" (all lower case)
|
||||
# The Published wolfSSL Arduino Registry is at https://github.com/wolfSSL/Arduino-wolfSSL.git
|
||||
# See https://downloads.arduino.cc/libraries/logs/github.com/wolfSSL/Arduino-wolfSSL/
|
||||
ROOT_DIR="/wolfssl"
|
||||
# run as bash ./wolfssl-arduino.sh
|
||||
|
||||
# The Arduino Version will initially have a suffix appended during fine tuning stage.
|
||||
WOLFSSL_VERSION_ARUINO_SUFFIX="-Arduino.3"
|
||||
DIR=${PWD##*/}
|
||||
|
||||
# For verbose copy, set CP_CMD="-v", otherwise clear it: CP_CMD="cp"
|
||||
# Do not set to empty string, as copy will fail with this: CP_CMD=""
|
||||
# CP_CMD="cp -v "
|
||||
CP_CMD="cp "
|
||||
space(){
|
||||
echo "" >> "$1"
|
||||
}
|
||||
|
||||
# Specify the executable shell checker you want to use:
|
||||
MY_SHELLCHECK="shellcheck"
|
||||
|
||||
# There are special circumstances to publish to GitHub repository.
|
||||
# Typically: https://github.com/wolfSSL/Arduino-wolfSSL
|
||||
#
|
||||
# Unlike a local Arduino library that requires a clean directory,
|
||||
# we'll allow extra files, overwrites, etc.
|
||||
#
|
||||
# Note in all cases, the local IDE/ARDUINO/wolfssl must be empty.
|
||||
THIS_INSTALL_IS_GITHUB="false"
|
||||
|
||||
# Check if the executable is available in the PATH
|
||||
if command -v "$MY_SHELLCHECK" >/dev/null 2>&1; then
|
||||
# Run your command here
|
||||
shellcheck "$0" || exit 1
|
||||
else
|
||||
echo "$MY_SHELLCHECK is not installed. Please install it if changes to this script have been made."
|
||||
fi
|
||||
|
||||
if ! [ "$CP_CMD" = "cp " ]; then
|
||||
if [ "$CP_CMD" = "cp -v" ]; then
|
||||
echo "Copy verbose mode"
|
||||
else
|
||||
echo "ERROR: Copy mode not supported: $CP_CMD"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check environment
|
||||
if [ -n "$WSL_DISTRO_NAME" ]; then
|
||||
# we found a non-blank WSL environment distro name
|
||||
current_path="$(pwd)"
|
||||
pattern="/mnt/?"
|
||||
if echo "$current_path" | grep -Eq "^$pattern"; then
|
||||
# if we are in WSL and shared Windows file system, 'ln' does not work.
|
||||
ARDUINO_ROOT="/mnt/c/Users/$USER/Documents/Arduino/libraries"
|
||||
else
|
||||
ARDUINO_ROOT="$HOME/Arduino/libraries"
|
||||
fi
|
||||
fi
|
||||
echo "The Arduino library root is: $ARDUINO_ROOT"
|
||||
|
||||
if [ $# -gt 0 ]; then
|
||||
THIS_OPERATION="$1"
|
||||
if [ "$THIS_OPERATION" = "INSTALL" ]; then
|
||||
THIS_INSTALL_DIR=$2
|
||||
|
||||
echo "Install is active."
|
||||
|
||||
if [ "$THIS_INSTALL_DIR" = "" ]; then
|
||||
if [ -d "$ARDUINO_ROOT$ROOT_DIR" ]; then
|
||||
echo "Error: the installation directory already exists: $ARDUINO_ROOT$ROOT_DIR"
|
||||
echo "A new directory needs to be created to ensure there are no stray files"
|
||||
echo "Please delete or move the directory and try again."
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "Installing to $THIS_INSTALL_DIR"
|
||||
if [ -d "$THIS_INSTALL_DIR/.git" ];then
|
||||
echo "Target is a GitHub repository."
|
||||
THIS_INSTALL_IS_GITHUB="true"
|
||||
else
|
||||
echo "Target is NOT a GitHub repository."
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "Error: not a valid operation: $THIS_OPERATION"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
ROOT_SRC_DIR="${ROOT_DIR}/src"
|
||||
EXAMPLES_DIR="${ROOT_DIR}/examples"
|
||||
WOLFSSL_SRC="${ROOT_SRC_DIR}/src"
|
||||
WOLFSSL_HEADERS="${ROOT_SRC_DIR}/wolfssl"
|
||||
WOLFCRYPT_ROOT="${ROOT_SRC_DIR}/wolfcrypt"
|
||||
WOLFCRYPT_SRC="${WOLFCRYPT_ROOT}/src"
|
||||
WOLFCRYPT_HEADERS="${WOLFSSL_HEADERS}/wolfcrypt"
|
||||
OPENSSL_DIR="${WOLFSSL_HEADERS}/openssl"
|
||||
|
||||
|
||||
# TOP indicates the file directory for top level of the wolfssl repository.
|
||||
TOP_DIR="../.."
|
||||
WOLFSSL_SRC_TOP="${TOP_DIR}/src"
|
||||
WOLFSSL_HEADERS_TOP="${TOP_DIR}/wolfssl"
|
||||
WOLFCRYPT_ROOT_TOP="${TOP_DIR}/wolfcrypt"
|
||||
WOLFCRYPT_SRC_TOP="${WOLFCRYPT_ROOT_TOP}/src"
|
||||
WOLFCRYPT_HEADERS_TOP="${WOLFSSL_HEADERS_TOP}/wolfcrypt"
|
||||
OPENSSL_DIR_TOP="${WOLFSSL_HEADERS_TOP}/openssl"
|
||||
|
||||
|
||||
WOLFSSL_VERSION=$(grep -i "LIBWOLFSSL_VERSION_STRING" ${TOP_DIR}/wolfssl/version.h | cut -d '"' -f 2)
|
||||
if [ "$WOLFSSL_VERSION" = "" ]; then
|
||||
echo "ERROR: Could not find wolfSSL Version in ${TOP_DIR}/wolfssl/version.h"
|
||||
exit 1
|
||||
else
|
||||
echo "Found wolfSSL version $WOLFSSL_VERSION"
|
||||
echo "# WOLFSSL_VERSION_ARUINO_SUFFIX $WOLFSSL_VERSION_ARUINO_SUFFIX"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
THIS_DIR=${PWD##*/}
|
||||
|
||||
if [ "$THIS_DIR" = "ARDUINO" ]; then
|
||||
# mkdir ./wolfssl
|
||||
if [ -d ".${ROOT_DIR}" ]; then
|
||||
echo "ERROR: $(realpath ".${ROOT_DIR}") is not empty"
|
||||
exit 1
|
||||
else
|
||||
echo "Step 01: mkdir .${ROOT_DIR}"
|
||||
mkdir ."${ROOT_DIR}"
|
||||
if [ "$DIR" = "ARDUINO" ]; then
|
||||
if [ ! -d "wolfSSL" ]; then
|
||||
mkdir wolfSSL
|
||||
fi
|
||||
|
||||
# mkdir ./wolfssl/src
|
||||
if [ ! -d ".${ROOT_SRC_DIR}" ]; then
|
||||
echo "Step 02: mkdir .${ROOT_SRC_DIR}"
|
||||
mkdir ."${ROOT_SRC_DIR}"
|
||||
cp ../../src/*.c ./wolfSSL
|
||||
cp ../../wolfcrypt/src/*.c ./wolfSSL
|
||||
|
||||
if [ ! -d "wolfSSL/wolfssl" ]; then
|
||||
mkdir wolfSSL/wolfssl
|
||||
fi
|
||||
|
||||
# mkdir ./wolfssl/src/wolfssl
|
||||
if [ ! -d ".${WOLFSSL_HEADERS}" ]; then
|
||||
echo "Step 03: mkdir .${WOLFSSL_HEADERS}"
|
||||
mkdir ."${WOLFSSL_HEADERS}"
|
||||
cp ../../wolfssl/*.h ./wolfSSL/wolfssl
|
||||
if [ ! -d "wolfSSL/wolfssl/wolfcrypt" ]; then
|
||||
mkdir wolfSSL/wolfssl/wolfcrypt
|
||||
fi
|
||||
cp ../../wolfssl/wolfcrypt/*.h ./wolfSSL/wolfssl/wolfcrypt
|
||||
|
||||
# cp ../../wolfssl/*.h ./wolfssl/src/wolfssl
|
||||
echo "Step 04: cp ${WOLFSSL_HEADERS_TOP}/*.h .${WOLFSSL_HEADERS}"
|
||||
$CP_CMD "${WOLFSSL_HEADERS_TOP}"/*.h ."${WOLFSSL_HEADERS}"
|
||||
if [ ! -d ".${WOLFCRYPT_HEADERS}" ]; then
|
||||
# mkdir ./wolfssl/src/wolfssl/wolfcrypt
|
||||
echo "Step 05: mkdir .${WOLFCRYPT_HEADERS}"
|
||||
mkdir ."${WOLFCRYPT_HEADERS}"
|
||||
mkdir ."${WOLFCRYPT_HEADERS}/port"
|
||||
mkdir ."${WOLFCRYPT_HEADERS}/port/atmel"
|
||||
mkdir ."${WOLFCRYPT_HEADERS}/port/Espressif"
|
||||
# support misc.c as include in wolfcrypt/src
|
||||
if [ ! -d "./wolfSSL/wolfcrypt" ]; then
|
||||
mkdir ./wolfSSL/wolfcrypt
|
||||
fi
|
||||
|
||||
# cp ../../wolfssl/wolfcrypt/*.h ./wolfssl/src/wolfssl/wolfcrypt
|
||||
echo "Step 06: cp ${WOLFCRYPT_HEADERS_TOP}/*.h .${WOLFCRYPT_HEADERS}"
|
||||
$CP_CMD "${WOLFCRYPT_HEADERS_TOP}"/*.h ."${WOLFCRYPT_HEADERS}" || exit 1
|
||||
$CP_CMD "${WOLFCRYPT_HEADERS_TOP}"/port/atmel/*.h ."${WOLFCRYPT_HEADERS}/port/atmel" || exit 1
|
||||
$CP_CMD "${WOLFCRYPT_HEADERS_TOP}"/port/Espressif/*.h ."${WOLFCRYPT_HEADERS}/port/Espressif" || exit 1
|
||||
|
||||
# Add in source files to wolfcrypt/src
|
||||
if [ ! -d ".${WOLFCRYPT_ROOT}" ]; then
|
||||
# mkdir ./wolfssl/src/wolfcrypt
|
||||
echo "Step 07: mkdir .${WOLFCRYPT_ROOT}"
|
||||
mkdir ."${WOLFCRYPT_ROOT}"
|
||||
if [ ! -d "./wolfSSL/wolfcrypt/src" ]; then
|
||||
mkdir ./wolfSSL/wolfcrypt/src
|
||||
fi
|
||||
cp ../../wolfcrypt/src/misc.c ./wolfSSL/wolfcrypt/src
|
||||
cp ../../wolfcrypt/src/asm.c ./wolfSSL/wolfcrypt/src
|
||||
|
||||
# mkdir ./wolfssl/src/wolfcrypt/src
|
||||
if [ ! -d ".${WOLFCRYPT_SRC}" ]; then
|
||||
echo "Step 08: mkdir .${WOLFCRYPT_SRC}"
|
||||
mkdir ."${WOLFCRYPT_SRC}"
|
||||
mkdir ."${WOLFCRYPT_SRC}"/port
|
||||
mkdir ."${WOLFCRYPT_SRC}"/port/atmel
|
||||
mkdir ."${WOLFCRYPT_SRC}"/port/Espressif
|
||||
fi
|
||||
|
||||
# cp ../../wolfcrypt/src/*.c ./wolfssl/src/wolfcrypt/src
|
||||
echo "Step 09: cp ${WOLFCRYPT_SRC_TOP}/*.c .${WOLFCRYPT_SRC}"
|
||||
$CP_CMD -r "${WOLFCRYPT_SRC_TOP}"/*.c ."${WOLFCRYPT_SRC}" || exit 1
|
||||
$CP_CMD -r "${WOLFCRYPT_SRC_TOP}"/port/atmel/*.c ."${WOLFCRYPT_SRC}"/port/atmel || exit 1
|
||||
$CP_CMD -r "${WOLFCRYPT_SRC_TOP}"/port/Espressif/*.c ."${WOLFCRYPT_SRC}"/port/Espressif || exit 1
|
||||
|
||||
# Add in source files to top level src folders
|
||||
if [ ! -d ".${WOLFSSL_SRC}" ]; then
|
||||
# mkdir ./wolfssl/src/src
|
||||
echo "Step 10: mkdir .${WOLFSSL_SRC}"
|
||||
mkdir ."${WOLFSSL_SRC}"
|
||||
fi
|
||||
$CP_CMD "${WOLFSSL_SRC_TOP}"/*.c ."${WOLFSSL_SRC}" || exit 1
|
||||
# put bio and evp as includes
|
||||
$CP_CMD ."${WOLFSSL_SRC}"/bio.c ."${WOLFSSL_HEADERS}" || exit 1
|
||||
$CP_CMD ."${WOLFCRYPT_SRC}"/evp.c ."${WOLFSSL_HEADERS}" || exit 1
|
||||
mv ./wolfSSL/bio.c ./wolfSSL/wolfssl
|
||||
mv ./wolfSSL/evp.c ./wolfSSL/wolfssl
|
||||
|
||||
# make a copy of evp.c and bio.c for ssl.c to include inline
|
||||
$CP_CMD ."${WOLFSSL_HEADERS}"/evp.c ."${WOLFCRYPT_SRC}"/evp.c || exit 1
|
||||
$CP_CMD ."${WOLFSSL_HEADERS}"/bio.c ."${WOLFCRYPT_SRC}"/bio.c || exit 1
|
||||
|
||||
cp ./wolfSSL/wolfssl/evp.c ./wolfSSL/wolfcrypt/src/evp.c
|
||||
cp ./wolfSSL/wolfssl/bio.c ./wolfSSL/wolfcrypt/src/bio.c
|
||||
|
||||
# copy openssl compatibility headers to their appropriate location
|
||||
if [ ! -d ".${OPENSSL_DIR}" ]; then
|
||||
mkdir ."${OPENSSL_DIR}"
|
||||
if [ ! -d "./wolfSSL/wolfssl/openssl" ]; then
|
||||
mkdir ./wolfSSL/wolfssl/openssl
|
||||
fi
|
||||
$CP_CMD "${OPENSSL_DIR_TOP}"/* ."${OPENSSL_DIR}" || exit 1
|
||||
cp ../../wolfssl/openssl/* ./wolfSSL/wolfssl/openssl
|
||||
|
||||
# Finally, copy the Arduino-specific wolfssl library files into place: [lib]/src
|
||||
$CP_CMD ./wolfssl.h ".${ROOT_SRC_DIR}"/wolfssl.h
|
||||
echo "/* Generated wolfSSL header file for Arduino */" > ./wolfSSL/wolfssl.h
|
||||
echo "#include <user_settings.h>" >> ./wolfSSL/wolfssl.h
|
||||
echo "#include <wolfssl/wolfcrypt/settings.h>" >> ./wolfSSL/wolfssl.h
|
||||
echo "#include <wolfssl/ssl.h>" >> ./wolfSSL/wolfssl.h
|
||||
|
||||
echo "Copy examples...."
|
||||
# Copy examples
|
||||
mkdir -p ".${ROOT_SRC_DIR}"/examples
|
||||
if [ ! -f "./wolfSSL/user_settings.h" ]; then
|
||||
echo "/* Generated wolfSSL user_settings.h file for Arduino */" > ./wolfSSL/user_settings.h
|
||||
echo "#ifndef ARDUINO_USER_SETTINGS_H" >> ./wolfSSL/user_settings.h
|
||||
echo "#define ARDUINO_USER_SETTINGS_H" >> ./wolfSSL/user_settings.h
|
||||
space ./wolfSSL/user_settings.h
|
||||
echo "/* Platform */" >> ./wolfSSL/user_settings.h
|
||||
echo "#define WOLFSSL_ARDUINO" >> ./wolfSSL/user_settings.h
|
||||
space ./wolfSSL/user_settings.h
|
||||
echo "/* Math library (remove this to use normal math)*/" >> ./wolfSSL/user_settings.h
|
||||
echo "#define USE_FAST_MATH" >> ./wolfSSL/user_settings.h
|
||||
echo "#define TFM_NO_ASM" >> ./wolfSSL/user_settings.h
|
||||
space ./wolfSSL/user_settings.h
|
||||
echo "/* RNG DEFAULT !!FOR TESTING ONLY!! */" >> ./wolfSSL/user_settings.h
|
||||
echo "/* comment out the error below to get started w/ bad entropy source" >> ./wolfSSL/user_settings.h
|
||||
echo " * This will need fixed before distribution but is OK to test with */" >> ./wolfSSL/user_settings.h
|
||||
echo "#error \"needs solved, see: https://www.wolfssl.com/docs/porting-guide/\"" >> ./wolfSSL/user_settings.h
|
||||
echo "#define WOLFSSL_GENSEED_FORTEST" >> ./wolfSSL/user_settings.h
|
||||
space ./wolfSSL/user_settings.h
|
||||
echo "#endif /* ARDUINO_USER_SETTINGS_H */" >> ./wolfSSL/user_settings.h
|
||||
fi
|
||||
|
||||
echo "Copy wolfssl_client example...."
|
||||
mkdir -p ".${EXAMPLES_DIR}"/wolfssl_client
|
||||
$CP_CMD ./sketches/wolfssl_client/wolfssl_client.ino ".${EXAMPLES_DIR}"/wolfssl_client/wolfssl_client.ino || exit 1
|
||||
$CP_CMD ./sketches/wolfssl_client/README.md ".${EXAMPLES_DIR}"/wolfssl_client/README.md || exit 1
|
||||
cp wolfSSL/wolfssl/wolfcrypt/settings.h wolfSSL/wolfssl/wolfcrypt/settings.h.bak
|
||||
echo " /* wolfSSL Generated ARDUINO settings */" > ./wolfSSL/wolfssl/wolfcrypt/settings.h
|
||||
echo "#ifndef WOLFSSL_USER_SETTINGS" >> ./wolfSSL/wolfssl/wolfcrypt/settings.h
|
||||
echo " #define WOLFSSL_USER_SETTINGS" >> ./wolfSSL/wolfssl/wolfcrypt/settings.h
|
||||
echo "#endif /* WOLFSSL_USER_SETTINGS */" >> ./wolfSSL/wolfssl/wolfcrypt/settings.h
|
||||
echo " /* wolfSSL Generated ARDUINO settings: END */" >> ./wolfSSL/wolfssl/wolfcrypt/settings.h
|
||||
cat ./wolfSSL/wolfssl/wolfcrypt/settings.h.bak >> ./wolfSSL/wolfssl/wolfcrypt/settings.h
|
||||
|
||||
echo "Copy wolfssl_server example...."
|
||||
mkdir -p .${EXAMPLES_DIR}/wolfssl_server
|
||||
$CP_CMD ./sketches/wolfssl_server/wolfssl_server.ino ".${EXAMPLES_DIR}"/wolfssl_server/wolfssl_server.ino || exit 1
|
||||
$CP_CMD ./sketches/wolfssl_server/README.md ".${EXAMPLES_DIR}"/wolfssl_server/README.md || exit 1
|
||||
|
||||
echo "Copy wolfssl_server example...."
|
||||
mkdir -p .${EXAMPLES_DIR}/wolfssl_version
|
||||
$CP_CMD ./sketches/wolfssl_version/wolfssl_version.ino ".${EXAMPLES_DIR}"/wolfssl_version/wolfssl_version.ino || exit 1
|
||||
$CP_CMD ./sketches/wolfssl_version/README.md ".${EXAMPLES_DIR}"/wolfssl_version/README.md || exit 1
|
||||
else
|
||||
echo "ERROR: You must be in the IDE/ARDUINO directory to run this script"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# At this point, the library is complete, but we need some additional files.
|
||||
#
|
||||
# optional diagnostics:
|
||||
# echo ".${ROOT_DIR}"
|
||||
# echo "${TOP_DIR}"
|
||||
# echo "cp ${TOP_DIR}/README.md .${ROOT_DIR}/"
|
||||
|
||||
# Replace the `${WOLFSSL_VERSION}` text in Arduino_README_prepend.md,
|
||||
# saving it to a .tmp file. Prepend that file to the wolfSSL README.md
|
||||
# file as PREPENDED_README.md, then copy that to the publish directory
|
||||
# as an Arduino-specific README.md file.
|
||||
VERSION_PLACEHOLDER="\${WOLFSSL_VERSION}"
|
||||
ARDUINO_VERSION_SUFFIX_PLACEHOLDER="\${WOLFSSL_VERSION_ARUINO_SUFFIX}"
|
||||
PREPEND_FILE="Arduino_README_prepend.md"
|
||||
PROPERTIES_FILE_TEMPLATE="library.properties.template"
|
||||
sed s/"$VERSION_PLACEHOLDER"/"$WOLFSSL_VERSION"/ "$PREPEND_FILE" > "$PREPEND_FILE.tmp"
|
||||
cat "$PREPEND_FILE.tmp" ${TOP_DIR}/README.md > PREPENDED_README.md
|
||||
|
||||
# Here we'll insert the wolfSSL version into the `library.properties.tmp` file, along with an Arduino version suffix.
|
||||
# The result should be something like version=5.6.6.Arduino.1 (for the 1st incremental version on top of 5.6.6)
|
||||
sed s/"$VERSION_PLACEHOLDER"/"$WOLFSSL_VERSION"/ "$PROPERTIES_FILE_TEMPLATE" > "library.properties.tmp"
|
||||
sed -i.backup s/"$ARDUINO_VERSION_SUFFIX_PLACEHOLDER"/"$WOLFSSL_VERSION_ARUINO_SUFFIX"/ "library.properties.tmp"
|
||||
|
||||
# cat library.properties.tmp
|
||||
# echo "${WOLFSSL_VERSION_ARUINO_SUFFIX}"
|
||||
|
||||
echo "Step 11: Final root file copy"
|
||||
$CP_CMD PREPENDED_README.md ."${ROOT_DIR}"/README.md || exit 1
|
||||
$CP_CMD library.properties.tmp ."${ROOT_DIR}"/library.properties || exit 1
|
||||
$CP_CMD "${TOP_DIR}"/"LICENSING" ."${ROOT_DIR}"/ || exit 1
|
||||
$CP_CMD "${TOP_DIR}"/"README" ."${ROOT_DIR}"/ || exit 1
|
||||
$CP_CMD "${TOP_DIR}"/"COPYING" ."${ROOT_DIR}"/ || exit 1
|
||||
$CP_CMD "${TOP_DIR}"/"ChangeLog.md" ."${ROOT_DIR}"/ || exit 1
|
||||
$CP_CMD "${TOP_DIR}"/".editorconfig" ."${ROOT_DIR}"/ || exit 1
|
||||
$CP_CMD "${TOP_DIR}"/".gitignore" ."${ROOT_DIR}"/ || exit 1
|
||||
|
||||
$CP_CMD "keywords.txt" ."${ROOT_DIR}"/ || exit 1
|
||||
|
||||
|
||||
echo "Step 12: Workspace to publish:"
|
||||
echo ""
|
||||
head -n 3 PREPENDED_README.md
|
||||
echo ""
|
||||
ls ./wolfssl -al
|
||||
echo ""
|
||||
|
||||
# Optionally install to a separate directory.
|
||||
# Note we should have exited above if a problem was encountered,
|
||||
# as we'll never want to install a bad library.
|
||||
if [ "$THIS_OPERATION" = "INSTALL" ]; then
|
||||
if [ "$THIS_INSTALL_IS_GITHUB" = "true" ]; then
|
||||
echo "Installing to GitHub directory: $THIS_INSTALL_DIR"
|
||||
cp -r ."$ROOT_DIR"/* "$THIS_INSTALL_DIR" || exit 1
|
||||
else
|
||||
echo "Config:"
|
||||
echo "cp ../../examples/configs/user_settings_arduino.h ".${ROOT_SRC_DIR}"/user_settings.h"
|
||||
# Nearly an ordinary copy, but we remove any lines with ">>" (typically edit with caution warning in comments)
|
||||
grep -v '>>' ../../examples/configs/user_settings_arduino.h > ".${ROOT_SRC_DIR}"/user_settings.h || exit 1
|
||||
|
||||
# Show the user_settings.h revision string:
|
||||
grep "WOLFSSL_USER_SETTINGS_ID" ."${ROOT_SRC_DIR}/user_settings.h"
|
||||
echo ""
|
||||
|
||||
echo "Install:"
|
||||
echo "mv .$ROOT_DIR $ARDUINO_ROOT"
|
||||
mv ."$ROOT_DIR" "$ARDUINO_ROOT" || exit 1
|
||||
|
||||
echo "Arduino wolfSSL Version: $WOLFSSL_VERSION$WOLFSSL_VERSION_ARUINO_SUFFIX"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "Done!"
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
/* wolfssl.h
|
||||
*
|
||||
* Copyright (C) 2006-2024 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
* wolfSSL is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfSSL is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
||||
*/
|
||||
|
||||
/* Edit with caution. This is an Arduino-library specific header for wolfSSL */
|
||||
|
||||
#ifndef WOLFSSL_USER_SETTINGS
|
||||
#define WOLFSSL_USER_SETTINGS
|
||||
#endif
|
||||
|
||||
#include <Arduino.h>
|
||||
|
||||
/* wolfSSL user_settings.h must be included from settings.h */
|
||||
#include <wolfssl/wolfcrypt/settings.h>
|
||||
#include <wolfssl/ssl.h>
|
||||
|
||||
int wolfSSL_Arduino_Serial_Print(const char *const s)
|
||||
{
|
||||
/* See wolfssl/wolfcrypt/logging.c */
|
||||
Serial.println(F(s));
|
||||
return 0;
|
||||
};
|
||||
@@ -1,6 +1,6 @@
|
||||
/* Cpu0_Main.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -81,8 +81,6 @@ static void init_UART(void)
|
||||
{
|
||||
IfxAsclin_Asc_Config ascConfig;
|
||||
|
||||
IfxCpu_Irq_installInterruptHandler(asclin0_Tx_ISR, INTPRIO_ASCLIN0_TX);
|
||||
|
||||
/* Port pins configuration */
|
||||
const IfxAsclin_Asc_Pins pins = {
|
||||
NULL_PTR, IfxPort_InputMode_pullUp, /* CTS pin not used */
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* user_settings.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -98,6 +98,7 @@ extern unsigned int my_rng_seed_gen(void);
|
||||
|
||||
#define WOLFSSL_SP_NO_MALLOC
|
||||
//#define WOLFSSL_SP_DIV_32 /* do not use 64-bit divides */
|
||||
//#define WOLFSSL_SP_CACHE_RESISTANT
|
||||
|
||||
/* use smaller version of code */
|
||||
#define WOLFSSL_SP_SMALL
|
||||
@@ -204,7 +205,7 @@ extern unsigned int my_rng_seed_gen(void);
|
||||
/* use heap allocation for ECC points */
|
||||
#define ALT_ECC_SIZE
|
||||
|
||||
/* wolfSSL will compute the FP_MAX_BITS_ECC, but it can be overridden */
|
||||
/* wolfSSL will compute the FP_MAX_BITS_ECC, but it can be overriden */
|
||||
//#define FP_MAX_BITS_ECC (256 * 2)
|
||||
#endif
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* wolf_main.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
#ifdef __aarch64__
|
||||
#if !defined(__clang__) || \
|
||||
(defined(__clang__) && defined(__clang_major__) && __clang_major__ >= 5)
|
||||
/* older clang v4 has issue with inline assembly constraints */
|
||||
/* older clang v4 has issue with inline assembly contraints */
|
||||
#define WOLFSSL_ARMASM
|
||||
#endif
|
||||
#endif
|
||||
@@ -58,7 +58,7 @@
|
||||
#define HAVE_PK_CALLBACKS
|
||||
/* crypto callback support is not in FIPS 3389 */
|
||||
#ifndef HAVE_FIPS
|
||||
#define WOLF_CRYPTO_CB
|
||||
#define WOLF_CRYPTO_CB
|
||||
#endif
|
||||
|
||||
#define KEEP_OUR_CERT
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* main.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -27,7 +27,7 @@
|
||||
/* wolfCrypt_Init/wolfCrypt_Cleanup to turn CryptoCell hardware on/off */
|
||||
#include <wolfssl/wolfcrypt/wc_port.h>
|
||||
|
||||
/* SEGGER_RTT_Init, you can potentially replace it with other serial terminal */
|
||||
/* SEGGER_RTT_Init, you can potential replace it with other serial terminal */
|
||||
#include "SEGGER_RTT.h"
|
||||
|
||||
int main(void)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* user_settings.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -88,6 +88,7 @@ extern "C" {
|
||||
#define WOLFSSL_HAVE_SP_RSA
|
||||
#define WOLFSSL_HAVE_SP_DH
|
||||
#define WOLFSSL_HAVE_SP_ECC
|
||||
#define WOLFSSL_SP_CACHE_RESISTANT
|
||||
//#define WOLFSSL_SP_MATH /* only SP math - eliminates fast math code */
|
||||
|
||||
/* Assembly */
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* deos_malloc.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* tls_wolfssl.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -31,19 +31,19 @@ int setupTransport(clientConnectionHandleType* connectionHandle,
|
||||
char* connectionId) {
|
||||
int ret, error;
|
||||
void * sendBuffer;
|
||||
size_t bufferSizeInBytes;
|
||||
DWORD bufferSizeInBytes;
|
||||
|
||||
if ((ret = socketTransportInitialize("mailbox-transport.config",
|
||||
"transportConfigurationId",
|
||||
waitIndefinitely,&error)) != transportSuccess)
|
||||
(DWORD)waitIndefinitely,&error)) != transportSuccess)
|
||||
printf("Initialize 0x%x, error=%d\n", ret, error);
|
||||
|
||||
else if ((ret = socketTransportClientInitialize(waitIndefinitely,
|
||||
else if ((ret = socketTransportClientInitialize((DWORD)waitIndefinitely,
|
||||
&error)) != transportSuccess)
|
||||
printf("ClientInitialize 0x%x, error=%d\n", ret, error);
|
||||
|
||||
else if ((ret = socketTransportCreateConnection(connectionId,
|
||||
waitIndefinitely,
|
||||
(DWORD)waitIndefinitely,
|
||||
COMPATIBILITY_ID_2,
|
||||
connectionHandle,
|
||||
&sendBuffer,
|
||||
@@ -53,7 +53,7 @@ int setupTransport(clientConnectionHandleType* connectionHandle,
|
||||
|
||||
else if ((ret = socketTransportSetConnectionForThread(currentThreadHandle(),
|
||||
*connectionHandle,
|
||||
waitIndefinitely,
|
||||
(DWORD)waitIndefinitely,
|
||||
&error)) != transportSuccess)
|
||||
printf("SetConnectionForThread 0x%x, error=%d\n", ret, error);
|
||||
|
||||
@@ -162,7 +162,7 @@ void wolfssl_client_test(uintData_t statusPtr) {
|
||||
TCP_SERVER_IP_ADDR, TCP_SERVER_PORT);
|
||||
|
||||
server_addr.sin_family = AF_INET;
|
||||
server_addr.sin_addr.s_addr = inet_addr(TCP_SERVER_IP_ADDR);
|
||||
server_addr.sin_addr = inet_addr(TCP_SERVER_IP_ADDR);
|
||||
server_addr.sin_port = htons(TCP_SERVER_PORT);
|
||||
|
||||
printf("Calling connect on socket\n");
|
||||
@@ -407,7 +407,7 @@ void wolfssl_server_test(uintData_t statusPtr)
|
||||
|
||||
printf("Setting up server_addr struct\n");
|
||||
server_addr.sin_family = AF_INET;
|
||||
server_addr.sin_addr.s_addr = INADDR_ANY;
|
||||
server_addr.sin_addr = INADDR_ANY;
|
||||
server_addr.sin_port = htons(TLS_SERVER_PORT);
|
||||
|
||||
bindStatus = bind(sock_listen, (sockaddr *) &server_addr, sizeof(server_addr));
|
||||
@@ -510,7 +510,7 @@ void wolfssl_server_test(uintData_t statusPtr)
|
||||
wolfSSL_CTX_free(ctx);
|
||||
return;
|
||||
}
|
||||
/* goToSleep() for 500 milliseconds */
|
||||
/* goToSleep() for 500 milli sec*/
|
||||
}
|
||||
} while ((ret != SSL_SUCCESS) && (error == SSL_ERROR_WANT_READ));
|
||||
|
||||
@@ -580,14 +580,14 @@ int wolfsslRunTests (void)
|
||||
ts = createThread("TCPclient", "TCPThreadTemplate", wolfssl_client_test,
|
||||
0, &TCPhandle );
|
||||
if (ts != threadSuccess) {
|
||||
printf("Unable to create TCP client thread, %i ", (size_t)ts);
|
||||
printf("Unable to create TCP client thread, %i ", (DWORD)ts);
|
||||
}
|
||||
#endif
|
||||
#if !defined(NO_WOLFSSL_SERVER)
|
||||
ts = createThread("TCPserver", "TCPThreadTemplate", wolfssl_server_test,
|
||||
0, &TCPhandle );
|
||||
if (ts != threadSuccess) {
|
||||
printf("Unable to create TCP server thread, %i ", (size_t)ts);
|
||||
printf("Unable to create TCP server thread, %i ", (DWORD)ts);
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* tls_wolfssl.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* user_setting.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
@@ -26,140 +26,75 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if 0
|
||||
/* RTEMS */
|
||||
#define WOLFSSL_DEOS_RTEMS
|
||||
#define WOLFSSL_DEOS
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <netinet/in.h>
|
||||
#include <sys/socket.h>
|
||||
#include <pthread.h>
|
||||
#include <stdint.h>
|
||||
#include <stddef.h> /* for size_t */
|
||||
#include <stdlib.h> /* for malloc/free */
|
||||
/* You can select none or all of the following tests
|
||||
using #define instead of #undef.
|
||||
By default, all four tests run*/
|
||||
|
||||
#if (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
|
||||
#define BIG_ENDIAN_ORDER
|
||||
#else
|
||||
#undef BIG_ENDIAN_ORDER
|
||||
#define LITTLE_ENDIAN_ORDER
|
||||
#endif
|
||||
#else
|
||||
/* DEOS Native */
|
||||
#define WOLFSSL_DEOS
|
||||
|
||||
#include <deos.h>
|
||||
#include <timeout.h>
|
||||
#include <socketapi.h>
|
||||
#include <lwip-socket.h>
|
||||
#include <mem.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h> /* for rand_r: pseudo-random number generator */
|
||||
#include <stdio.h> /* for snprintf */
|
||||
#endif
|
||||
|
||||
/* Porting */
|
||||
#undef NO_CRYPT_TEST
|
||||
#undef NO_CRYPT_BENCHMARK
|
||||
#undef NO_WOLFSSL_CLIENT
|
||||
#undef NO_WOLFSSL_SERVER
|
||||
|
||||
/* adjust CURRENT_UNIX_TIMESTAMP to seconds since Jan 01 1970. (UTC)
|
||||
You can get the current time from https://www.unixtimestamp.com/ */
|
||||
#define CURRENT_UNIX_TIMESTAMP 1663020069
|
||||
You can get the current time from https://www.unixtimestamp.com/
|
||||
*/
|
||||
#define CURRENT_UNIX_TIMESTAMP 1545864916
|
||||
|
||||
#define BENCH_EMBEDDED /* use kB instead of mB for embedded benchmarking */
|
||||
#define WOLFSSL_IGNORE_FILE_WARN /* ignore warning for include of files not required */
|
||||
|
||||
/* Math */
|
||||
#define USE_FAST_MATH
|
||||
#define FP_MAX_BITS (4096*2)
|
||||
#define NO_FILESYSTEM
|
||||
#define SIZEOF_LONG_LONG 8
|
||||
#define TFM_TIMING_RESISTANT
|
||||
#define ECC_TIMING_RESISTANT
|
||||
#define WC_RSA_BLINDING
|
||||
|
||||
/* Wolf Single Precision Math */
|
||||
#undef WOLFSSL_SP
|
||||
#if 1
|
||||
#define WOLFSSL_HAVE_SP_RSA
|
||||
#define WOLFSSL_HAVE_SP_DH
|
||||
#define WOLFSSL_HAVE_SP_ECC
|
||||
#define WOLFSSL_SP_4096 /* Enable RSA/RH 4096-bit support */
|
||||
#define WOLFSSL_SP_384 /* Enable ECC 384-bit SECP384R1 support */
|
||||
/* prevents from including multiple definition of main() */
|
||||
#define NO_MAIN_DRIVER
|
||||
#define NO_TESTSUITE_MAIN_DRIVER
|
||||
|
||||
#define WOLFSSL_SP_MATH /* only SP math - disables integer.c/tfm.c */
|
||||
//#define WOLFSSL_SP_MATH_ALL /* use SP math for all key sizes and curves */
|
||||
/* includes certificate test buffers via header files */
|
||||
#define USE_CERT_BUFFERS_2048
|
||||
|
||||
#define WOLFSSL_SP_NO_MALLOC
|
||||
//#define WOLFSSL_SP_DIV_32 /* do not use 64-bit divides */
|
||||
/*use kB instead of mB for embedded benchmarking*/
|
||||
#define BENCH_EMBEDDED
|
||||
|
||||
/* use smaller version of code */
|
||||
#define WOLFSSL_SP_SMALL
|
||||
#endif
|
||||
#define NO_WRITE_TEMP_FILES
|
||||
|
||||
/* Algorithms */
|
||||
#undef NO_RSA
|
||||
#undef NO_DH
|
||||
#define WOLFSSL_DH_CONST
|
||||
#define HAVE_ECC
|
||||
#define ECC_USER_CURVES
|
||||
#define HAVE_ECC384
|
||||
|
||||
#if 1
|
||||
#define HAVE_CURVE25519
|
||||
#define HAVE_ED25519
|
||||
#define CURVED25519_SMALL
|
||||
#endif
|
||||
|
||||
#undef NO_SHA
|
||||
#undef NO_MD5
|
||||
#undef NO_SHA256
|
||||
#define HAVE_AESGCM
|
||||
#define WOLFSSL_SHA384
|
||||
#define WOLFSSL_SHA512
|
||||
#define HAVE_ECC
|
||||
#define HAVE_CURVE25519
|
||||
#define CURVE25519_SMALL
|
||||
#define HAVE_ED25519
|
||||
#define ED25519_SMALL
|
||||
|
||||
/* TLS */
|
||||
#define HAVE_TLS_EXTENSIONS
|
||||
#define HAVE_SUPPORTED_CURVES
|
||||
#define HAVE_EXTENDED_MASTER
|
||||
#define HAVE_ENCRYPT_THEN_MAC
|
||||
|
||||
//#define WOLFSSL_DTLS
|
||||
//#define WOLFSSL_DTLS13
|
||||
//#define WOLFSSL_NO_TLS12
|
||||
#define WOLFSSL_DTLS
|
||||
|
||||
/* TLS 1.3 */
|
||||
#if 0
|
||||
/* TLS 1.3 */
|
||||
#define WOLFSSL_TLS13
|
||||
#define WC_RSA_PSS
|
||||
#define HAVE_HKDF
|
||||
#define HAVE_FFDHE_2048
|
||||
#define HAVE_FFDHE_3072
|
||||
#define HAVE_FFDHE_4096
|
||||
#define HAVE_AEAD
|
||||
#endif
|
||||
|
||||
/* wolfSentry */
|
||||
#if 0
|
||||
#define WOLFSSL_WOLFSENTRY_HOOKS
|
||||
#define HAVE_EX_DATA
|
||||
#define HAVE_EX_DATA_CLEANUP_HOOKS
|
||||
|
||||
/* You can use your own custom random generator function with
|
||||
no input parameters and a `CUSTOM_RAND_TYPE` return type*/
|
||||
|
||||
#ifndef CUSTOM_RAND_GENERATE
|
||||
#define CUSTOM_RAND_TYPE int
|
||||
#define CUSTOM_RAND_GENERATE yourRandGenFunc
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
||||
/* compatibility layer */
|
||||
#if 0
|
||||
#define OPENSSL_EXTRA
|
||||
#endif
|
||||
|
||||
/* Random */
|
||||
#ifdef WOLFSSL_DEOS_RTEMS
|
||||
extern int rtems_wolf_seed(unsigned char* output, unsigned int sz);
|
||||
#define CUSTOM_RAND_GENERATE_SEED rtems_wolf_seed
|
||||
#endif
|
||||
|
||||
/* custom heap handling */
|
||||
#ifdef WOLFSSL_DEOS
|
||||
#define WOLFSSL_NO_MALLOC
|
||||
#if 1
|
||||
#undef XMALLOC_OVERRIDE
|
||||
#define XMALLOC_OVERRIDE
|
||||
|
||||
/* prototypes for user heap override functions */
|
||||
|
||||
#include <stddef.h> /* for size_t */
|
||||
|
||||
extern void *malloc_deos(size_t size);
|
||||
extern void free_deos(void *ptr);
|
||||
extern void *realloc_deos(void *ptr, size_t size);
|
||||
@@ -167,40 +102,9 @@ You can get the current time from https://www.unixtimestamp.com/ */
|
||||
#define XMALLOC(n, h, t) malloc_deos(n)
|
||||
#define XFREE(p, h, t) free_deos(p)
|
||||
#define XREALLOC(p, n, h, t) realloc_deos(p, n)
|
||||
|
||||
#endif
|
||||
|
||||
#if 0
|
||||
#define DEBUG_WOLFSSL
|
||||
#endif
|
||||
|
||||
/* You can select none or all of the following tests
|
||||
* using #define instead of #undef.
|
||||
* By default, all four tests run*/
|
||||
#define NO_CRYPT_TEST
|
||||
#define NO_CRYPT_BENCHMARK
|
||||
#undef NO_WOLFSSL_CLIENT
|
||||
#undef NO_WOLFSSL_SERVER
|
||||
|
||||
/* file system has not been ported since it is a separate product */
|
||||
#define NO_FILESYSTEM
|
||||
#define NO_WOLFSSL_DIR
|
||||
#define NO_WRITEV
|
||||
#define NO_WRITE_TEMP_FILES
|
||||
|
||||
/* disable old protocols and algorithms */
|
||||
#define NO_OLD_TLS
|
||||
#define NO_PSK
|
||||
#define NO_DSA
|
||||
#define NO_RC4
|
||||
#define NO_MD4
|
||||
|
||||
#define NO_PWDBASED
|
||||
|
||||
/* prevents from including multiple definition of main() */
|
||||
#define NO_MAIN_DRIVER
|
||||
#define NO_TESTSUITE_MAIN_DRIVER
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
} /* extern "C" */
|
||||
#endif
|
||||
|
||||
@@ -40,7 +40,7 @@ The folder hierarchy is the same as the wolfSSL folders with an exception of the
|
||||
|
||||
4. Right click on each folders, add or link all the source code in the corresponding folder in wolfSSL.
|
||||
|
||||
5. Remove non-C platform dependent files from your build. At the moment, only aes_asm.asm, aes_gcm_asm.asm, aes_xts_asm.asm and aes_asm.s must be removed from your wolfssl/wolfcrypt/src folder.
|
||||
5. Remove non-C platform dependent files from your build. At the moment, only aes_asm.asm and aes_asm.s must be removed from your wolfssl/wolfcrypt/src folder.
|
||||
|
||||
6. In your C/C++ compiler preprocessor settings, add the wolfSSL directories to your include paths.
|
||||
Here's an example of the paths that must be added.
|
||||
@@ -118,41 +118,41 @@ memcb test passed!
|
||||
wolfSSL version 3.15.5
|
||||
------------------------------------------------------------------------------
|
||||
wolfCrypt Benchmark (block bytes 1024, min 1.0 sec each)
|
||||
RNG 225 KB took 1.026 seconds, 219.313 KB/s
|
||||
AES-128-CBC-enc 250 KB took 1.105 seconds 226.210 KB/s
|
||||
AES-128-CBC-dec 225 KB took 1.005 seconds, 223.922 KB/s
|
||||
AES-192-CBC-enc 225 KB took 1.076 seconds, 209.104 KB/s
|
||||
AES-192-CBC-dec 225 KB took 1.077 seconds, 208.981 K/s
|
||||
AES-56-CBC-enc 200 KB took 1.029 seconds, 19.396 KB/s
|
||||
AES-256-CBC-dec 200 KB took 1.022 seconds, 195.785 KB/s
|
||||
AES-128-GCM-enc 125 KB took 1.28 seconds, 101.70 KB/s
|
||||
AES-128-GC-dec 125 KB took 1.228 seconds 101.756 KB/s
|
||||
AES-192-GCM-enc 100 KB took 1.026 seconds, 97.493 KB/s
|
||||
AES-192-GCM-dec 100 KB took 1.026 seconds, 97.480 KB/s
|
||||
AES-256-GCM-enc 100 KB took 1.065 seconds, 93.909 KB/s
|
||||
AES-256-GC-dec 100 KB took 1.065 seconds, 93.897 KB/s
|
||||
RABBIT 2 MB took 1.011 seconds, 2.19 MB/s
|
||||
3DES 100 KB took 1.007 seconds, 99.312 KB/s
|
||||
MD5 3MB took 1.008 seconds, 2.907 MBs
|
||||
SHA 1 MB took 1.09 secends, 1.283 MB/s
|
||||
SHA-256 575 KB took 1.037 seconds, 554.501 KB/s
|
||||
SHA-512 200 KB took 1.003 seconds, 199.444 KB/s
|
||||
HMAC-MD5 3 B took 1.002 seconds, 2.876 MB/s
|
||||
HMAC-SHA26 550 KB took 1.000 seconds, 549.95 KB//s
|
||||
HMAC-SHA512 200 KB topk 1.018 seconds, 196.452 KB/s
|
||||
RSA 2048 public 8 ops took 1.025 seconds, avg 128.135 ms, 7.804 ops/s
|
||||
RSA 2048 private 2 ops took 4.972 seconds, avg 2485.951 s, 0.402 ops/s
|
||||
DH 2048 key en 2 ops took 1.927 seconds, avg 96.303 ms, 1.038 ops/s
|
||||
DH 2048 agree 2ops took 1.937 seconds, avg 968.578 ms, 1.032 ops/s
|
||||
ECC 256 key gen 3 ops took 1.185 seconds, avg 394.944 ms, 2.53 ops/s
|
||||
ECDHE 256 agree 4 ops took 1.585 seconds, avg 396.168 ms, 2.524 ops/s
|
||||
ECSA 256 sign 4 ops took 1.611 seconds, avg 402.865 ms, 2.482 ops/s
|
||||
ECDSA 256verif 2 ops took 1.586 seconds, avg 793.153 ms, 1.261 ops/s
|
||||
CURVE 25519 key gen 2 ops took 1.262 seconds, avg 630.907 ms, 1.585 ops/s
|
||||
CURE 25519 agree 2 ops took 1.261 seconds, avg630.469 ms, 1.586 ops/s
|
||||
ED 2519 key gen 2 ops took 1.27 seconds, avg 66.099 ms, 1.572 ops/s
|
||||
ED 25519 sign 2 ops took 1.303 seconds, ag 65.633 ms, 1.35 ops/s
|
||||
ED 25519 verify 2 ops took 2.674 seconds, avg1337.68 ms 0.748 ops/s
|
||||
RNG 225 KB tooks 1.026 seconds, 219.313 KB/s
|
||||
AES-128-CBC-enc 250 KB toks 1.105 seconds 226.210 KB/s
|
||||
AES-128-CBC-dec 225 KB tooks 1.005 seconds, 223.922 KB/s
|
||||
AES-192-CBC-enc 225 KB tooks 1.076 seconds, 209.104 KB/s
|
||||
AES-192-CBC-dec 225 KB tooks 1.077 seconds, 208.981 K/s
|
||||
AES-56-CBC-enc 200 KB tooks 1.029 seconds, 19.396 KB/s
|
||||
AES-256-CBC-dec 200 KB toks 1.022 seconds, 195.785 KB/s
|
||||
AES-128-GCM-enc 125 KB tooks 1.28 secnds, 101.70 KB/s
|
||||
AES-128-GC-dec 125 KB tooks 1.228 seconds 101.756 KB/s
|
||||
AES-192-GCM-enc 100 KB tooks 1.026 seconds, 97.493 KB/s
|
||||
AES-192-GCM-dec 100 KB tooks 1.026 seconds, 97.480 KB/s
|
||||
AES-256-GCM-enc 100 KB tooks 1.065 seconds, 93.909 KB/s
|
||||
AES-256-GC-dec 100 KB tooks 1.065 seconds, 93.897 KB/s
|
||||
RABBIT 2 MB tooks 1.011 seconds, 2.19 MB/s
|
||||
3DES 100 KB tooks 1.007 sconds, 99.312 KB/s
|
||||
MD5 3MB tooks 1.008 seonds, 2.907 MBs
|
||||
SHA 1 MB tooks 1.09 secnds, 1.283 MB/s
|
||||
SHA-256 575 KB tooks 1.037 seconds, 554.501 KB/s
|
||||
SHA-512 200 KB tooks 1.003 seconds, 199.444 KB/s
|
||||
HMAC-MD5 3 B tooks 1.002 seconds, 2.876 MB/s
|
||||
HMAC-SHA26 550 KB tooks 1.000 seconds, 549.95 KB//s
|
||||
HMAC-SHA512 200 KB toks 1.018 seconds, 196.452 KB/s
|
||||
RSA 2048 public 8 ops took 1.025 sec, avg 128.135 ms, 7.804 op/sec
|
||||
RSA 2048 private 2 ops took 4.972 ec, avg 2485.951 s, 0.402 ops/sec
|
||||
DH 2048 key en 2 ops took 1.927 sec, avg 96.303 ms, 1.038 op/sec
|
||||
DH 2048 agree 2ops took 1.937 sc, avg 968.578 ms, 1.032 ops/sec
|
||||
ECC 256 key gen 3 ops took 1.185 sec, avg 394.944 ms, 2.53 ops/sec
|
||||
ECDHE 256 agree 4 ops took 1.585 sec, avg 396.168 ms, 2.524 ops/sec
|
||||
ECSA 256 sign 4 ops took 1.611 sec, avg 402.865 ms, 2.482 ops/sec
|
||||
ECDSA 256verif 2 ops tok 1.586 sec, avg 793.153 ms, 1.261 opssec
|
||||
CURVE 25519 key gen 2 ops took 1.262 sec, avg 630.907 ms, 1.585 ops/sec
|
||||
CURE 25519 agree 2 ops took 1.261 sec, avg630.469 ms, 1.586 ops/sec
|
||||
ED 2519 key gen 2 ops took 1.27 sec, avg 66.099ms, 1.572 ops/sec
|
||||
ED 25519 sign 2 ops took 1.303 sec, ag 65.633 ms, 1.35 op/sec
|
||||
ED 25519 verify 2 ops took 2.674 sec, avg1337.68 ms 0.748 ops/ec
|
||||
```
|
||||
### `WOLFSSL_CLIENT_TEST` wolfssl_client_test()
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* client_wolfssl.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* client_wolfssl.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* server_wolfssl.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* server_wolfssl.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* user_setting.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* wolfsslRunTests.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* user_setting.h
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* wolfsslRunTests.c
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,228 +1,45 @@
|
||||
# ESP-IDF Port
|
||||
# ESP-IDF port
|
||||
|
||||
These Espressif examples have been created and tested with the latest stable release branch of
|
||||
[ESP-IDF V5.2](https://docs.espressif.com/projects/esp-idf/en/release-v5.2/esp32/get-started/index.html).
|
||||
The prior version 4.4 ESP-IDF is still supported, however version 5.2 or greater is recommended.
|
||||
Espressif has [a list of all ESP-IDF versions](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/versions.html).
|
||||
NOTICE: These Espressif examples have been created and tested with the latest stable release branch of
|
||||
[ESP-IDF V4](https://docs.espressif.com/projects/esp-idf/en/v4.4.1/esp32/get-started/index.html)
|
||||
and have not yet been upgraded to the master branch V5.
|
||||
See the latest [migration guides](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/migration-guides/index.html).
|
||||
|
||||
See the latest [Espressif Migration Guides](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/migration-guides/index.html).
|
||||
## Overview
|
||||
ESP-IDF development framework with wolfSSL by setting *WOLFSSL_ESPIDF* definition
|
||||
|
||||
## Examples
|
||||
Including the following examples:
|
||||
|
||||
Included are the following [examples](./examples/README.md):
|
||||
* Simple [TLS client](./examples/wolfssl_client/)/[server](./examples/wolfssl_server/)
|
||||
* Cryptographic [test](./examples/wolfssl_test/)
|
||||
* Cryptographic [benchmark](./examples/wolfssl_benchmark/)
|
||||
|
||||
* Bare-bones [Template](./examples/template/README.md)
|
||||
* Simple [TLS Client](./examples/wolfssl_client/README.md) / [TLS Server](./examples/wolfssl_server/README.md)
|
||||
* Cryptographic [Test](./examples/wolfssl_test/README.md)
|
||||
* Cryptographic [Benchmark](./examples/wolfssl_benchmark/README.md)
|
||||
|
||||
## Important Usage Details
|
||||
|
||||
The wolfSSL code specific to the Espressif ESP-IDF development framework
|
||||
is gated in code with the `WOLFSSL_ESPIDF` definition. This is enabled
|
||||
automatically when the `WOLFSSL_USER_SETTINGS` is defined. The recommended
|
||||
method is to have this line in the main `CMakeLists.txt` file as shown in the
|
||||
[example](./examples/template/main/CMakeLists.txt):
|
||||
|
||||
```cmake
|
||||
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DWOLFSSL_USER_SETTINGS")
|
||||
```
|
||||
|
||||
When defining `WOLFSSL_USER_SETTINGS`, this tells the `settings.h` file to
|
||||
looks for the wolfSSL `user_settings.h` in the project as described below.
|
||||
|
||||
### File: `sdkconfig.h`
|
||||
|
||||
The Espressif `sdkconfig.h`, generated automatically from your `sdkconfig`
|
||||
file at [build](https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/build-system.html)
|
||||
time, should be included before any other files.
|
||||
|
||||
### File: `user_settings.h`
|
||||
|
||||
The `user_settings.h` file enables some of the hardened security settings. There are also some
|
||||
default configuration items in the wolfssl `settings.h`. With the latest version of
|
||||
wolfSSL, some of these defaults can be disabled with `NO_ESPIDF_DEFAULT` and customized
|
||||
in your project `user_settings.h` as desired.
|
||||
|
||||
The `user_settings.h` include file should not be explicitly included in an project source files. Be
|
||||
sure to include `settings.h` (which pulls in `user_settings.h`) before any other wolfSSL include files.
|
||||
|
||||
A new project should also include a compiler option suc as `CFLAGS +=-DWOLFSSL_USER_SETTINGS"` to ensure
|
||||
the `user_settings.h` is included properly. See the [template example](https://github.com/wolfSSL/wolfssl/blob/master/IDE/Espressif/ESP-IDF/examples/template/main/main.c).
|
||||
|
||||
```
|
||||
#ifdef WOLFSSL_USER_SETTINGS
|
||||
#include <wolfssl/wolfcrypt/settings.h>
|
||||
#ifndef WOLFSSL_ESPIDF
|
||||
#warning "Problem with wolfSSL user_settings."
|
||||
#warning "Check components/wolfssl/include"
|
||||
#endif
|
||||
#include <wolfssl/wolfcrypt/port/Espressif/esp32-crypt.h>
|
||||
#else
|
||||
/* Define WOLFSSL_USER_SETTINGS project wide for settings.h to include */
|
||||
/* wolfSSL user settings in ./components/wolfssl/include/user_settings.h */
|
||||
#error "Missing WOLFSSL_USER_SETTINGS in CMakeLists or Makefile:\
|
||||
CFLAGS +=-DWOLFSSL_USER_SETTINGS"
|
||||
#endif
|
||||
```
|
||||
|
||||
See the respective project directory:
|
||||
|
||||
`[project-dir]/components/wolfssl/user_settings.h`
|
||||
|
||||
A typical project will _not_ directly reference the `user_settings.h` file.
|
||||
Here's an example to be included at the top of a given source file:
|
||||
|
||||
```c
|
||||
/* ESP-IDF */
|
||||
#include <esp_log.h>
|
||||
#include "sdkconfig.h"
|
||||
|
||||
/* wolfSSL */
|
||||
#include <wolfssl/wolfcrypt/settings.h> /* references user_settings.h */
|
||||
/* Do not explicitly include wolfSSL user_settings.h */
|
||||
#include <wolfssl/version.h>
|
||||
#include <wolfssl/wolfcrypt/port/Espressif/esp32-crypt.h>
|
||||
```
|
||||
|
||||
Prior versions of the wolfSSL Espressif library expected the `user_settings.h` to be in the root wolfssl folder in a directory
|
||||
called `/include`. This method, while possible, is no longer recommended.
|
||||
|
||||
Be sure to *not* have a `user_settings.h` in _both_ the local project and the wolfssl `include` directories.
|
||||
|
||||
### File: `wolfssl/wolfcrypt/settings.h`
|
||||
|
||||
The wolfSSL built-in `settings.h` references your project `user_settings.h`. The
|
||||
`settings.h` should _not_ be edited directly. Any wolfSSL settings should be adjusted in your local project
|
||||
`user_settings.h` file.
|
||||
|
||||
The `settings.h` has some SoC-target-specific settings, so be sure to `#include "sdkconfig.h"` at the beginning
|
||||
of your source code, particularly before the `#include <wolfssl/wolfcrypt/settings.h>` line.
|
||||
The *user_settings.h* file enables some of the hardened settings.
|
||||
|
||||
## Requirements
|
||||
|
||||
1. [ESP-IDF development framework](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
|
||||
|
||||
## wolfSSL as an Espressif component
|
||||
|
||||
There are various methods available for using wolfSSL as a component:
|
||||
|
||||
* Managed Component - easiest to get started.
|
||||
* Local component directory - best for development.
|
||||
* Install locally - least flexible, but project is fully self-contained.
|
||||
|
||||
## Espressif Managed Components
|
||||
|
||||
Visit https://components.espressif.com/components/wolfssl/wolfssl and see the instructions. Typically:
|
||||
|
||||
```
|
||||
idf.py add-dependency "wolfssl/wolfssl^5.6.0-stable"
|
||||
```
|
||||
|
||||
## Standard local component:
|
||||
|
||||
See the [template example](./examples/template/README.md). Simply created a `wolfssl` directory in the
|
||||
local project `components` directory and place the [CMakeLists.txt](./examples/template/components/CMakeLists.txt)
|
||||
file there. Then add a `components/wolfssl/include` directory and place the [user_settings.h](/examples/template/components/wolfssl/include/user_settings.h)
|
||||
file there. If wolfSSL is in a structure such as `./workspace/wolfssl` with respect to your project at `./workspace/wolfssl`,
|
||||
then the cmake file should automatically find the wolfSSL source code. Otherwise set the cmake `WOLFSSL_ROOT` variable
|
||||
in the top-level CMake file. Examples:
|
||||
|
||||
```cmake
|
||||
set(WOLFSSL_ROOT "C:/some-path/wolfssl")
|
||||
set(WOLFSSL_ROOT "c:/workspace/wolfssl-[username]")
|
||||
set(WOLFSSL_ROOT "/mnt/c/somepath/wolfssl")
|
||||
```
|
||||
|
||||
See the specific examples for additional details.
|
||||
|
||||
## Setup for Linux (wolfSSL local copy)
|
||||
|
||||
This is an alternate method for installation. It is recommended to use the new `CMakeLists.txt` to point to wolfSSL source code.
|
||||
|
||||
## Setup for Linux
|
||||
1. Run `setup.sh` at _/path/to_`/wolfssl/IDE/Espressif/ESP-IDF/` to deploy files into ESP-IDF tree
|
||||
2. Find Wolfssl files at _/path/to/esp_`/esp-idf/components/wolfssl/`
|
||||
3. Find [Example Programs](https://github.com/wolfSSL/wolfssl/tree/master/IDE/Espressif/ESP-IDF/examples) under _/path/to/esp_`/esp-idf/examples/protocols/wolfssl_xxx` (where xxx is the project name)
|
||||
3. Find [Example programs](https://github.com/wolfSSL/wolfssl/tree/master/IDE/Espressif/ESP-IDF/examples) under _/path/to/esp_`/esp-idf/examples/protocols/wolfssl_xxx` (where xxx is the project name)
|
||||
|
||||
## Setup for Windows
|
||||
|
||||
This is an alternate method for installation. It is recommended to use the new `CMakeLists.txt` to point to wolfSSL source code.
|
||||
|
||||
1. Run ESP-IDF Command Prompt (cmd.exe) or Run ESP-IDF PowerShell Environment
|
||||
2. Run `setup_win.bat` at `.\IDE\Espressif\ESP-IDF\`
|
||||
3. Find Wolfssl files at _/path/to/esp_`/esp-idf/components/wolfssl/`
|
||||
4. Find [Example programs](https://github.com/wolfSSL/wolfssl/tree/master/IDE/Espressif/ESP-IDF/examples) under _/path/to/esp_`/esp-idf/examples/protocols/wolfssl_xxx` (where xxx is the project name)
|
||||
|
||||
## Setup for VisualGDB
|
||||
|
||||
See the local project `./VisualGDB` for sample project files. For single-step JTAG debugging on boards that do not
|
||||
have a built-in JTAG port, the wolfSSL examples use the open source [Tigard board](https://github.com/tigard-tools/tigard#readme).
|
||||
|
||||
See also the [gojimmypi blog](https://gojimmypi.github.io/Tigard-JTAG-SingleStep-Debugging-ESP32/) on using the Tigard
|
||||
to JTAG debug the ESP32.
|
||||
|
||||
### Clone a specific version:
|
||||
|
||||
```
|
||||
C:\SysGCC\esp32\esp-idf>git clone -b v5.0.2 --recursive https://github.com/espressif/esp-idf.git v5.0.2
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
1. The `user_settings.h` can be found in `[project]/components/wolfssl/include/user_settings.h`.
|
||||
|
||||
## Configuration (Legacy IDF install)
|
||||
|
||||
1. The `user_settings.h` can be found in _/path/to/esp_`/esp-idf/components/wolfssl/include/user_settings.h`
|
||||
|
||||
## Build examples
|
||||
|
||||
1. See README in each example folder.
|
||||
1. See README in each example folder
|
||||
|
||||
## Support
|
||||
|
||||
For question please email [support@wolfssl.com]
|
||||
|
||||
Note: This is tested with :
|
||||
- OS: Ubuntu 20.04.3 LTS
|
||||
- Microsoft Windows 10 Pro 10.0.19041 / Windows 11 Pro 22H2 22621.2715
|
||||
- Visual Studio 2022 17.7.6 with VisualGDB 5.6R9 (build 4777)
|
||||
- WSL 1 Ubuntu 22.04.3 LTS
|
||||
- ESP-IDF: ESP-IDF v5.1
|
||||
- SoC Module : all those supported in ESP-IDF v5.1
|
||||
|
||||
## JTAG Debugging Notes
|
||||
|
||||
All of the examples are configured to use either the on-board JTAG (when available) or
|
||||
the open source [Tigard multi-protocol tool for hardware hacking](https://github.com/tigard-tools/tigard).
|
||||
|
||||
VisualGDB users should find the configuration file in the `interface\ftdi` directory:
|
||||
|
||||
```
|
||||
C:\Users\%USERNAME%\AppData\Local\VisualGDB\EmbeddedDebugPackages\com.sysprogs.esp32.core\share\openocd\scripts\interface\ftdi
|
||||
```
|
||||
|
||||
For reference, the `tigard.cfg` looks like this:
|
||||
|
||||
```
|
||||
# SPDX-License-Identifier: GPL-2.0-or-later
|
||||
#
|
||||
# Tigard: An FTDI FT2232H-based multi-protocol tool for hardware hacking.
|
||||
# https://github.com/tigard-tools/tigard
|
||||
|
||||
adapter driver ftdi
|
||||
|
||||
ftdi device_desc "Tigard V1.1"
|
||||
ftdi vid_pid 0x0403 0x6010
|
||||
|
||||
ftdi channel 1
|
||||
|
||||
ftdi layout_init 0x0038 0x003b
|
||||
ftdi layout_signal nTRST -data 0x0010
|
||||
ftdi layout_signal nSRST -data 0x0020
|
||||
|
||||
# This board doesn't support open-drain reset modes since its output buffer is
|
||||
# always enabled.
|
||||
reset_config srst_push_pull trst_push_pull
|
||||
|
||||
```
|
||||
- OS: Ubuntu 20.04.3 LTS and Microsoft Windows 10 Pro 10.0.19041 and well as WSL Ubuntu
|
||||
- ESP-IDF: ESP-IDF v4.3.2
|
||||
- Module : ESP32-WROOM-32
|
||||
|
||||
@@ -15,7 +15,7 @@ Including the following examples:
|
||||
2. Microchip CryptoAuthentication Library: https://github.com/MicrochipTech/cryptoauthlib
|
||||
|
||||
## Setup
|
||||
1. Comment out `#define WOLFSSL_ESP32` in `/path/to/wolfssl/IDE/Espressif/ESP-IDF/user_settings.h`\
|
||||
1. Comment out `#define WOLFSSL_ESPWROOM32` in `/path/to/wolfssl/IDE/Espressif/ESP-IDF/user_settings.h`\
|
||||
Uncomment out `#define WOLFSSL_ESPWROOM32SE` in `/path/to/wolfssl/IDE/Espressif/ESP-IDF/user_settings.h`
|
||||
* **Note:** crypt test will fail if enabled `WOLFSSL_ESPWROOM32SE`
|
||||
3. wolfSSL under ESP-IDF. Please see [README.md](https://github.com/wolfSSL/wolfssl/blob/master/IDE/Espressif/ESP-IDF/README.md)
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
# Espressif Updates
|
||||
|
||||
See [#5795]()
|
||||
|
||||
## Changes in November 2022
|
||||
|
||||
Updates to Espressif ESP-IDF wolfssl_benchmark and wolfssl_test examples:
|
||||
|
||||
- Benchmark example no longer runs tests.
|
||||
- Fixed Test example that was missing code files. (no longer installed locally)
|
||||
- Rename `benchmark/main` and `test/main` filenames from `helper.c` to `main.c`, cleaned up.
|
||||
- Added `main.h`
|
||||
- Revised `main/CMakeLists.txt` to use only `main.c`
|
||||
- Set components `main` and `wolfssl` for project `CMakeLists.txt`
|
||||
- Update wolfcrypt esp32_sha.c and sha256.c to now report unexpected reentry as verbose log rather than error message.
|
||||
- `wolfcrypt/test.c` now returns `args.return_code` when `WOLFSSL_ESPIDF` is defined.
|
||||
- `wolfcrypt/test.h` now declares `int wolf_test_task(void)` when `WOLFSSL_ESPIDF` is defined.
|
||||
- `setup.sh` no longer copies benchmark.c(.h) to local project directory.
|
||||
- Added `libs/Tigard.cfg` file for Tigard JTAG debugger.
|
||||
- Update `sdkconfig.defaults` with compiler optimizations and stack check.
|
||||
- Added VisualGDB Project file & Visual Studio solution file.
|
||||
- Added optional `time_helper` for wolfssl_test
|
||||
- Exclude `ssl_misc.c` in component cmake to fix warning: #warning ssl_misc.c does not need to be compiled separately from ssl.c
|
||||
- Exclude `ssl_crypto.c` in component cmake to fix warning: #warning ssl_crypto.c does not need to be compiled separately from ssl.c
|
||||
@@ -1,114 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# testing script: compileAllExamples
|
||||
#
|
||||
# This script will compile all the local examples, optionally installing wolfSSL in the ESP-IDF components directory.
|
||||
#
|
||||
# Example usage:
|
||||
# cd wolfssl && docker run --rm -v $PWD:/project -w /project espressif/idf:latest IDE/Espressif/ESP-IDF/compileAllExamples.sh
|
||||
#
|
||||
# Parameter option to also run the ./setup.sh to install the wolfSSL component in ESP-IDF and test for multiple installs:
|
||||
#
|
||||
# --run-setup
|
||||
#
|
||||
# Note that once installed, the wolfSSL component will need to be manually removed to successfully run this script.
|
||||
#
|
||||
if [[ "$IDF_PATH" == "" ]]; then
|
||||
echo "Error: $IDF_PATH not found; run Espressif export.sh"
|
||||
exit 1
|
||||
fi
|
||||
SCRIPT_DIR=$(builtin cd ${BASH_SOURCE%/*}; pwd)
|
||||
RUN_SETUP=$1
|
||||
THIS_ERR=0
|
||||
|
||||
echo "Found IDF_PATH = $IDF_PATH"
|
||||
|
||||
# Regular tests of wolfSSL in local component directories of each project:
|
||||
#
|
||||
# Note these tests should FAIL if wolfSSL is already installed in ESP-IDF
|
||||
#
|
||||
for file in "benchmark" "client" "server" "test"; do
|
||||
pushd ${SCRIPT_DIR}/examples/wolfssl_${file}/ && idf.py fullclean build;
|
||||
THIS_ERR=$?
|
||||
popd
|
||||
if [ $THIS_ERR -ne 0 ]; then
|
||||
echo "Failed in ${file}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
|
||||
# Check for option to also install wolfSSL.
|
||||
#
|
||||
# When doing so, we'll run a check that multiple installs should cause build failure.
|
||||
if [[ "$RUN_SETUP" == "--run-setup" ]]; then
|
||||
echo "Running wolfSSL setup.sh"
|
||||
|
||||
# install wolfSSL into EDP-IDF shared components directory.
|
||||
./setup.sh --verbose
|
||||
|
||||
THIS_ERR=$?
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed running setup.sh"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check ESP-IDF install:
|
||||
#
|
||||
# The wolfssl_test_idf should NOT have a local components/wolfssl when testing!
|
||||
# This test is to confirm the ESP-IDF component build properly after setup.
|
||||
#
|
||||
echo ""
|
||||
echo "Testing a build of wolfSSL in ESP-IDF components directory"
|
||||
echo ""
|
||||
for file in "test_idf"; do
|
||||
if [ -e "../../../include/user_settings.h" ]; then
|
||||
mv "../../../include/user_settings.h" "../../../include/user_settings.h.${file}.bak"
|
||||
fi
|
||||
pushd ${SCRIPT_DIR}/examples/wolfssl_${file}/ && idf.py fullclean build;
|
||||
THIS_ERR=$?
|
||||
popd
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Failed in ${file}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
# Check multiple installs: the wolfSSL component in ESP-IDF and local directory:
|
||||
#
|
||||
# The wolfssl_test project already has a local wolfSSL component directory.
|
||||
#
|
||||
# Once wolfssl has been installed to ESP-IDF components, the local
|
||||
# component build SHOULD fail:
|
||||
echo ""
|
||||
echo "Testing a build of wolfSSL in both local and ESP-IDF components directory"
|
||||
echo ""
|
||||
for file in "test"; do
|
||||
pushd ${SCRIPT_DIR}/examples/wolfssl_${file}/ && idf.py fullclean build;
|
||||
THIS_ERR=$?
|
||||
popd
|
||||
if [ $THIS_ERR -ne 0 ]; then
|
||||
echo ""
|
||||
echo "Success: Confirmed build fails when wolfSSL found in ESP-IDF and local project."
|
||||
echo ""
|
||||
else
|
||||
echo "Error: build should have failed when wolfSSL found in ESP-IDF and local project."
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
else
|
||||
echo "Skipping ESP-IDF install tests. For these tests, use parameter: --run-setup"
|
||||
fi
|
||||
|
||||
|
||||
# Show a reminder that wolfSSL was installed as a shared component.
|
||||
if [[ "$RUN_SETUP" == "--run-setup" ]]; then
|
||||
echo ""
|
||||
echo "wolfSSL was installed as an ESP-IDF component. This will be in conflict with any project that has a local component."
|
||||
echo ""
|
||||
echo "Delete the installed component before re-running this test."
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# Done
|
||||
echo "Completed compileAllExamples in $SCRIPT_DIR"
|
||||
@@ -1,6 +1,6 @@
|
||||
/* config.h - dummy
|
||||
*
|
||||
* Copyright (C) 2006-2023 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
/* wolfcrypt/test/test_paths.h
|
||||
*
|
||||
* Copyright (C) 2006-2024 wolfSSL Inc.
|
||||
* Copyright (C) 2006-2022 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user