crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

Merge pull request #11542 from Frauschi/zephyr-cert-kconfig

Browse Source 
Zephyr: Kconfig options for certificate management, PKCS#7 and the OpenSSL layer
This commit is contained in:
philljj
2026-10-20 16:07:54 -05:00
committed by GitHub
parent 3846e798c1 725fe0edfa
commit 85cd9d0514
12 changed files with 282 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.github/scripts/zephyr-4.x/builds.txt vendored
View File

@@ -1,11 +1,15 @@
# Builds run by zephyr-4.x.yml for each Zephyr version:
# <board> <app under zephyr/> [Kconfig overlay in this directory]
# <board> <app under zephyr/> [Kconfig overlay in this directory or the app's]
native_sim samples/wolfssl_tls_sock
native_sim samples/wolfssl_tls_sock external_libc.conf
native_sim samples/wolfssl_tls_sock tls_cert.conf
native_sim samples/wolfssl_test
native_sim samples/wolfssl_test external_libc.conf
native_sim samples/wolfssl_benchmark
native_sim samples/wolfssl_benchmark external_libc.conf
native_sim samples/wolfssl_test prj-cert.conf
native_sim samples/wolfssl_test prj-x25519-ed448.conf
native_sim samples/wolfssl_test prj-ed25519-x448.conf
# external_libc overlay is native_sim-only in the original Jenkins matrix
frdm_rw612/rw612 samples/wolfssl_tls_sock
frdm_rw612/rw612 samples/wolfssl_test

7
.github/scripts/zephyr-4.x/tls_cert.conf vendored Normal file
View File

@@ -0,0 +1,7 @@
# Certificate options that only the TLS layer links in
CONFIG_WOLFSSL_POST_HANDSHAKE_AUTH=y
CONFIG_WOLFSSL_IP_ALT_NAME=y
CONFIG_WOLFSSL_KEEP_PEER_CERT=y
CONFIG_WOLFSSL_CERT_GEN=y
CONFIG_WOLFSSL_CERT_EXT=y
CONFIG_WOLFSSL_ALT_NAMES=y

9
.github/scripts/zephyr-4.x/zephyr-test.sh vendored
View File

@@ -14,7 +14,8 @@
# -d, --subdir <dir> App subdir under zephyr/ (samples or tests; default samples)
# -m, --modules <list> West modules to fetch besides wolfSSL (default: all)
# -l, --list <file> Build each "<board> <app> [overlay]" line of <file>
# in one workspace, instead of -t/-s/-d/--extra-conf
# in one workspace, instead of -t/-s/-d/--extra-conf;
# an overlay not beside <file> is read from the app
# -v, --verbose Verbose compile output (show full compiler commands)
# -W, --werror Build with -Werror (treat warnings as errors)
# --commit <sha> Checkout specific commit after fetching branch
@@ -120,6 +121,7 @@ DOCKER_IMAGE=$(select_docker_image "$ZEPHYR_VERSION")
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# One "<board> <app> [overlay]" line per build; overlays are read from CONF_DIR
# or, failing that, from the app directory
CONF_DIR="${SCRIPT_DIR}"
if [[ -n "$BUILD_LIST" ]]; then
BUILDS=$(grep -Ev '^[[:space:]]*(#|$)' "$BUILD_LIST")
@@ -287,8 +289,11 @@ build_app() {
local args="${CMAKE_ARGS}"
local f
if [[ -f "/conf/${conf}" ]]; then
conf="/conf/${conf}"
fi
if [[ -n "$conf" ]]; then
args="${args} -DOVERLAY_CONFIG=/conf/${conf}"
args="${args} -DOVERLAY_CONFIG=${conf}"
fi
echo "==> [container] Building ${app} for ${board}..."

14
.wolfssl_known_macro_extras
View File

@@ -194,15 +194,21 @@ CONFIG_WOLFSSL_AES_TOUCH_LINES
CONFIG_WOLFSSL_ALLOW_TLS13
CONFIG_WOLFSSL_ALPN
CONFIG_WOLFSSL_ALT_CERT_CHAINS
CONFIG_WOLFSSL_ALT_NAMES
CONFIG_WOLFSSL_ALWAYS_VERIFY_CB
CONFIG_WOLFSSL_APPLE_HOMEKIT
CONFIG_WOLFSSL_ASN_ALLOW_0_SERIAL
CONFIG_WOLFSSL_CERTIFICATE_BUNDLE
CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE
CONFIG_WOLFSSL_CERT_EXT
CONFIG_WOLFSSL_CERT_GEN
CONFIG_WOLFSSL_CERT_NAME_ALL
CONFIG_WOLFSSL_CERT_REQ
CONFIG_WOLFSSL_CHACHA_POLY
CONFIG_WOLFSSL_CRYPTO_CB
CONFIG_WOLFSSL_CRYPTO_ONLY
CONFIG_WOLFSSL_CURVE25519
CONFIG_WOLFSSL_CURVE448
CONFIG_WOLFSSL_DTLS
CONFIG_WOLFSSL_ECC
CONFIG_WOLFSSL_ECC_256
@@ -211,6 +217,8 @@ CONFIG_WOLFSSL_ECC_512
CONFIG_WOLFSSL_ECC_521
CONFIG_WOLFSSL_ECC_ALLOW_ZERO_HASH
CONFIG_WOLFSSL_ECC_BRAINPOOL
CONFIG_WOLFSSL_ED25519
CONFIG_WOLFSSL_ED448
CONFIG_WOLFSSL_ENABLE_KYBER
CONFIG_WOLFSSL_EXAMPLE_NAME_ESP32_SSH_SERVER
CONFIG_WOLFSSL_EXAMPLE_NAME_ESP8266_SSH_SERVER
@@ -227,7 +235,9 @@ CONFIG_WOLFSSL_GHASH_SMALL
CONFIG_WOLFSSL_GHASH_TABLE_4BIT
CONFIG_WOLFSSL_GHASH_TABLE_8BIT
CONFIG_WOLFSSL_HKDF
CONFIG_WOLFSSL_IP_ALT_NAME
CONFIG_WOLFSSL_KEEP_PEER_CERT
CONFIG_WOLFSSL_KEY_GEN
CONFIG_WOLFSSL_LMS
CONFIG_WOLFSSL_MAX_FRAGMENT
CONFIG_WOLFSSL_MLDSA
@@ -236,7 +246,10 @@ CONFIG_WOLFSSL_NO_ASN_STRICT
CONFIG_WOLFSSL_OCSP
CONFIG_WOLFSSL_OCSP_STAPLING
CONFIG_WOLFSSL_OPENSSL_EXTRA_X509_SMALL
CONFIG_WOLFSSL_PKCS7
CONFIG_WOLFSSL_POST_HANDSHAKE_AUTH
CONFIG_WOLFSSL_PSK
CONFIG_WOLFSSL_PUBLIC_ASN
CONFIG_WOLFSSL_RSA
CONFIG_WOLFSSL_RSA_PSS
CONFIG_WOLFSSL_SESSION_CACHE
@@ -249,6 +262,7 @@ CONFIG_WOLFSSL_TARGET_HOST
CONFIG_WOLFSSL_TARGET_PORT
CONFIG_WOLFSSL_TLS_VERSION_1_2
CONFIG_WOLFSSL_TLS_VERSION_1_3
CONFIG_WOLFSSL_USER_IO
CONFIG_WOLFSSL_XMSS
CONFIG_WOLFTPM
CONFIG_WOLFTPM_EXAMPLE_NAME_ESPRESSIF

14
wolfssl/wolfio.h
View File

@@ -1134,6 +1134,20 @@ WOLFSSL_API void wolfSSL_SetIOWriteFlags(WOLFSSL* ssl, int flags);
#endif
#endif
#if defined(WOLFSSL_ZEPHYR) && KERNEL_VERSION_NUMBER >= 0x40400
/* Zephyr 4.4 keeps the unprefixed address family names only under
* CONFIG_NET_NAMESPACE_COMPAT_MODE. */
#ifndef WOLFSSL_IP4
#define WOLFSSL_IP4 NET_AF_INET
#endif
#ifndef WOLFSSL_IP6
#define WOLFSSL_IP6 NET_AF_INET6
#endif
#ifndef WOLFSSL_SOCKADDR_IN6
#define WOLFSSL_SOCKADDR_IN6 struct net_sockaddr_in6
#endif
#endif
#ifndef WOLFSSL_IP4
#define WOLFSSL_IP4 AF_INET
#endif

118
zephyr/Kconfig
View File

@@ -442,11 +442,34 @@ config WOLFSSL_CHACHA_POLY
Enable ChaCha20 and Poly1305 (HAVE_CHACHA, HAVE_POLY1305).
config WOLFSSL_CURVE25519
bool "wolfCrypt Curve25519 / Ed25519 support"
bool "wolfCrypt Curve25519 (X25519) support"
depends on !WOLFSSL_HAS_SETTINGS_FILE
default n
help
Enable Curve25519 and Ed25519 (HAVE_CURVE25519, HAVE_ED25519).
Enable X25519 key agreement (HAVE_CURVE25519).
config WOLFSSL_ED25519
bool "wolfCrypt Ed25519 support"
depends on !WOLFSSL_HAS_SETTINGS_FILE
default y if WOLFSSL_CURVE25519
help
Enable Ed25519 signatures (HAVE_ED25519). Defaults on with
WOLFSSL_CURVE25519, which used to enable both.
config WOLFSSL_CURVE448
bool "wolfCrypt Curve448 (X448) support"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Enable X448 key agreement (HAVE_CURVE448).
config WOLFSSL_ED448
bool "wolfCrypt Ed448 support"
depends on !WOLFSSL_HAS_SETTINGS_FILE
depends on !WOLFCRYPT_FIPS_V2 && !WOLFCRYPT_FIPS_V5
default y if WOLFSSL_CURVE448
help
Enable Ed448 signatures (HAVE_ED448), together with the SHAKE-256
that Ed448 hashes with.
config WOLFSSL_SNI
bool "wolfSSL Server Name Indication (SNI)"
@@ -455,6 +478,14 @@ config WOLFSSL_SNI
help
Enable TLS Server Name Indication (HAVE_SNI).
config WOLFSSL_POST_HANDSHAKE_AUTH
bool "wolfSSL TLS 1.3 post-handshake authentication"
depends on !WOLFSSL_HAS_SETTINGS_FILE
depends on WOLFSSL_TLS_VERSION_1_3
help
Enable TLS 1.3 post-handshake client authentication
(WOLFSSL_POST_HANDSHAKE_AUTH).
config WOLFSSL_SESSION_CACHE
bool "wolfSSL TLS session cache"
depends on !WOLFSSL_HAS_SETTINGS_FILE
@@ -516,6 +547,89 @@ config WOLFSSL_OPENSSL_EXTRA_X509_SMALL
helpers (wolfSSL_X509_free, wolfSSL_get_verify_result, ...) without
the rest of OPENSSL_EXTRA.
config WOLFSSL_USER_IO
bool "wolfSSL transport supplied by the application"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Define WOLFSSL_USER_IO. Leaves the built-in socket send/receive
callbacks out of the build, for an application that installs its own
with wolfSSL_CTX_SetIOSend()/SetIORecv(). Without a transport of its
own such a build cannot do TLS at all; with one it needs no network
stack, so CONFIG_NETWORKING can stay off.
config WOLFSSL_CERT_GEN
bool "wolfSSL certificate generation"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Define WOLFSSL_CERT_GEN. Builds wc_InitCert(), wc_MakeCert() and
wc_SignCert(), so the application can issue X.509 certificates.
config WOLFSSL_CERT_REQ
bool "wolfCrypt certificate request generation"
depends on WOLFSSL_CERT_GEN
help
Enable PKCS#10 certificate signing request generation
(WOLFSSL_CERT_REQ).
config WOLFSSL_CERT_EXT
bool "wolfSSL certificate extensions"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Define WOLFSSL_CERT_EXT. Decodes further certificate extensions, such
as certificate policies, and with WOLFSSL_CERT_GEN adds the v3
extension setters - wc_SetKeyUsage(), wc_SetExtKeyUsage(),
wc_SetSubjectKeyId...() and wc_SetAuthKeyId...().
config WOLFSSL_KEY_GEN
bool "wolfCrypt key generation"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Enable RSA key generation and private key export to DER and PEM
(WOLFSSL_KEY_GEN).
config WOLFSSL_ALT_NAMES
bool "wolfCrypt subject alternative names in generated certificates"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Write subject alternative names into generated certificates and
requests (WOLFSSL_ALT_NAMES).
config WOLFSSL_IP_ALT_NAME
bool "wolfCrypt IP address subject alternative names"
depends on !WOLFSSL_HAS_SETTINGS_FILE
depends on NETWORKING || WOLFSSL_USER_IO || WOLFSSL_CRYPTO_ONLY
help
Decode and match IP address subject alternative names
(WOLFSSL_IP_ALT_NAME).
With the built-in socket I/O this needs NETWORKING, as the TLS
layer's IPv6 matching uses the socket address types.
config WOLFSSL_CERT_NAME_ALL
bool "wolfCrypt all certificate name attributes"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Add the given name, initials, DN qualifier and name attributes to
certificate subjects (WOLFSSL_CERT_NAME_ALL).
config WOLFSSL_PUBLIC_ASN
bool "wolfCrypt public ASN.1 helpers"
depends on !WOLFSSL_HAS_SETTINGS_FILE
help
Define WOLFSSL_PUBLIC_ASN, which makes the ASN.1 helpers declared
WOLFSSL_ASN_API, such as wc_SetDNSEntry(), wc_SetAltNamesFromList()
and SetLength(), public API. The module builds without hidden symbol
visibility, so this changes what the headers promise, not what links.
config WOLFSSL_PKCS7
bool "wolfCrypt PKCS#7 / CMS"
depends on !WOLFSSL_HAS_SETTINGS_FILE
depends on WOLFSSL_RSA || WOLFSSL_ECC || WOLFSSL_MLDSA
help
Enable PKCS#7 (HAVE_PKCS7) with the AES key wrap and, with ECC, the
X9.63 KDF that its enveloped-data recipients need, as
--enable-pkcs7 does.
config WOLFCRYPT_ASM
bool "wolfCrypt assembly optimisations"
depends on WOLFSSL_BUILTIN && !WOLFSSL_HAS_SETTINGS_FILE

6
zephyr/include.am
View File

@@ -27,6 +27,12 @@ EXTRA_DIST+= zephyr/samples/wolfssl_test/boards/native_sim.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/boards/nrf5340dk_nrf5340_cpuapp_ns.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/install_test.sh
EXTRA_DIST+= zephyr/samples/wolfssl_test/prj-cert.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/prj-ecc-custom.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/prj-ecc-nist.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/prj-ed25519-x448.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/prj-no-malloc.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/prj-x25519-ed448.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/prj.conf
EXTRA_DIST+= zephyr/samples/wolfssl_test/sample.yaml
EXTRA_DIST+= zephyr/samples/wolfssl_test/zephyr_legacy.conf

25
zephyr/samples/wolfssl_test/prj-cert.conf Normal file
View File

@@ -0,0 +1,25 @@
# Every certificate and PKCS#7 option at once, as a certificate-management
# consumer needs them. Layered on top of prj.conf.
CONFIG_WOLFSSL_KEY_GEN=y
CONFIG_WOLFSSL_CERT_GEN=y
CONFIG_WOLFSSL_CERT_REQ=y
CONFIG_WOLFSSL_CERT_EXT=y
CONFIG_WOLFSSL_ALT_NAMES=y
CONFIG_WOLFSSL_IP_ALT_NAME=y
CONFIG_WOLFSSL_CERT_NAME_ALL=y
CONFIG_WOLFSSL_PUBLIC_ASN=y
CONFIG_WOLFSSL_KEEP_PEER_CERT=y
CONFIG_WOLFSSL_PKCS7=y
CONFIG_WOLFSSL_CURVE25519=y
CONFIG_WOLFSSL_ED25519=y
CONFIG_WOLFSSL_CURVE448=y
CONFIG_WOLFSSL_ED448=y
CONFIG_WOLFSSL_POST_HANDSHAKE_AUTH=y
# IP_ALT_NAME without USER_IO needs the network stack.
CONFIG_NETWORKING=y
CONFIG_NET_TEST=y
CONFIG_MAIN_STACK_SIZE=65536
CONFIG_COMMON_LIBC_MALLOC_ARENA_SIZE=131072

5
zephyr/samples/wolfssl_test/prj-ed25519-x448.conf Normal file
View File

@@ -0,0 +1,5 @@
# Ed25519 and X448 without their counterparts. Layered on top of prj.conf.
CONFIG_WOLFSSL_ED25519=y
CONFIG_WOLFSSL_CURVE448=y
CONFIG_WOLFSSL_ED448=n

8
zephyr/samples/wolfssl_test/prj-x25519-ed448.conf Normal file
View File

@@ -0,0 +1,8 @@
# X25519 and Ed448 without their counterparts, plus user I/O and IP SANs with
# no network stack. Layered on top of prj.conf.
CONFIG_WOLFSSL_CURVE25519=y
CONFIG_WOLFSSL_ED25519=n
CONFIG_WOLFSSL_ED448=y
CONFIG_WOLFSSL_USER_IO=y
CONFIG_WOLFSSL_IP_ALT_NAME=y

18
zephyr/samples/wolfssl_test/sample.yaml
View File

@@ -54,6 +54,24 @@ tests:
- CONFIG_WOLFSSL_AES_CONSTANT_TIME=y
integration_platforms:
- qemu_x86
sample.crypto.wolfssl_test_cert:
timeout: 600
platform_allow: qemu_x86
extra_args: CONF_FILE="prj.conf;prj-cert.conf"
integration_platforms:
- qemu_x86
sample.crypto.wolfssl_test_x25519_ed448:
timeout: 200
platform_allow: qemu_x86
extra_args: CONF_FILE="prj.conf;prj-x25519-ed448.conf"
integration_platforms:
- qemu_x86
sample.crypto.wolfssl_test_ed25519_x448:
timeout: 200
platform_allow: qemu_x86
extra_args: CONF_FILE="prj.conf;prj-ed25519-x448.conf"
integration_platforms:
- qemu_x86
# One scenario per assembly port CONFIG_WOLFCRYPT_ASM can select, so a
# regression in the generated sources or in the arch dispatch fails here
# rather than on hardware.

66
zephyr/user_settings.h
View File

@@ -56,7 +56,9 @@ extern "C" {
/* Network stack */
/* Default is POSIX sockets */
//#define WOLFSSL_USER_IO /* Use the SetIO callbacks, not the internal wolfio.c socket code */
#if defined(CONFIG_WOLFSSL_USER_IO)
#define WOLFSSL_USER_IO /* Use the SetIO callbacks, not the internal wolfio.c socket code */
#endif
//#define WOLFSSL_LWIP
//#define WOLFSSL_LWIP_NATIVE
//#define FREERTOS_TCP
@@ -196,6 +198,9 @@ extern "C" {
#if defined(CONFIG_WOLFSSL_SNI)
#define HAVE_SNI /* optional Server Name Indication (SNI) */
#endif
#if defined(CONFIG_WOLFSSL_POST_HANDSHAKE_AUTH)
#define WOLFSSL_POST_HANDSHAKE_AUTH
#endif
/* ASN */
#define WOLFSSL_ASN_TEMPLATE /* use newer ASN template asn.c code (default) */
@@ -368,9 +373,6 @@ extern "C" {
//#define WC_RSA_NO_PADDING
//#define RSA_LOW_MEM
#if 0
#define WOLFSSL_KEY_GEN /* For RSA Key gen only */
#endif
#if defined(WOLFSSL_TLS13) || defined(CONFIG_WOLFSSL_RSA_PSS)
/* TLS v1.3 requires RSA PSS padding */
#define WC_RSA_PSS
@@ -404,10 +406,19 @@ extern "C" {
/* Ed25519 / Curve25519 */
#if defined(CONFIG_WOLFSSL_CURVE25519)
#define HAVE_CURVE25519
#endif
#if defined(CONFIG_WOLFSSL_ED25519)
#define HAVE_ED25519 /* ED25519 Requires SHA512 */
#endif
/* Optionally use small math (less flash usage, but much slower) */
//#define CURVED25519_SMALL
/* Optionally use small math (less flash usage, but much slower) */
//#define CURVED25519_SMALL
/* Ed448 / Curve448 */
#if defined(CONFIG_WOLFSSL_CURVE448)
#define HAVE_CURVE448
#endif
#if defined(CONFIG_WOLFSSL_ED448)
#define HAVE_ED448 /* ED448 Requires SHAKE256 */
#endif
/* SHA-1 */
@@ -498,11 +509,45 @@ extern "C" {
/* Optional Features */
#define WOLFSSL_BASE64_ENCODE /* Enable Base64 encoding */
//#define WC_NO_CACHE_RESISTANT /* systems with cache should enable this for AES, ECC, RSA and DH */
//#define WOLFSSL_CERT_GEN
//#define WOLFSSL_CERT_REQ
//#define WOLFSSL_CERT_EXT
//#define NO_PWDBASED
/* Certificate generation */
#if defined(CONFIG_WOLFSSL_CERT_GEN)
#define WOLFSSL_CERT_GEN
#endif
#if defined(CONFIG_WOLFSSL_CERT_REQ)
#define WOLFSSL_CERT_REQ
#endif
#if defined(CONFIG_WOLFSSL_CERT_EXT)
#define WOLFSSL_CERT_EXT
#endif
#if defined(CONFIG_WOLFSSL_ALT_NAMES)
#define WOLFSSL_ALT_NAMES
#endif
#if defined(CONFIG_WOLFSSL_IP_ALT_NAME)
#define WOLFSSL_IP_ALT_NAME
#endif
#if defined(CONFIG_WOLFSSL_CERT_NAME_ALL)
#define WOLFSSL_CERT_NAME_ALL
#endif
#if defined(CONFIG_WOLFSSL_PUBLIC_ASN)
#define WOLFSSL_PUBLIC_ASN
#endif
/* Key generation */
#if defined(CONFIG_WOLFSSL_KEY_GEN)
#define WOLFSSL_KEY_GEN
#endif
/* PKCS#7 */
#if defined(CONFIG_WOLFSSL_PKCS7)
#define HAVE_PKCS7
#define HAVE_AES_KEYWRAP
#ifdef HAVE_ECC
#define HAVE_X963_KDF
#endif
#endif
/* Disable Algorithms */
#define NO_DSA
@@ -570,6 +615,9 @@ extern "C" {
#define WOLFSSL_SHA3_SMALL
#define WOLFSSL_SHAKE128
#define WOLFSSL_SHAKE256
#elif defined(CONFIG_WOLFSSL_ED448)
#define WOLFSSL_NO_SHAKE128
#define WOLFSSL_SHAKE256
#else
#define WOLFSSL_NO_SHAKE128
#define WOLFSSL_NO_SHAKE256