diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras index 02f4e52f550..d7ccfdafe64 100644 --- a/.wolfssl_known_macro_extras +++ b/.wolfssl_known_macro_extras @@ -189,6 +189,7 @@ CONFIG_WOLFSSL_ASN_ALLOW_0_SERIAL CONFIG_WOLFSSL_CERTIFICATE_BUNDLE CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE CONFIG_WOLFSSL_CHACHA_POLY +CONFIG_WOLFSSL_CRYPTO_CB CONFIG_WOLFSSL_CRYPTO_ONLY CONFIG_WOLFSSL_CURVE25519 CONFIG_WOLFSSL_DTLS @@ -212,6 +213,8 @@ CONFIG_WOLFSSL_MAX_FRAGMENT_LEN CONFIG_WOLFSSL_MLDSA CONFIG_WOLFSSL_MLKEM CONFIG_WOLFSSL_NO_ASN_STRICT +CONFIG_WOLFSSL_OCSP +CONFIG_WOLFSSL_OCSP_STAPLING CONFIG_WOLFSSL_OPENSSL_EXTRA_X509_SMALL CONFIG_WOLFSSL_PSK CONFIG_WOLFSSL_RSA diff --git a/src/wolfio.c b/src/wolfio.c index 09d0b6818f6..7734abf6c3f 100644 --- a/src/wolfio.c +++ b/src/wolfio.c @@ -652,8 +652,9 @@ int wolfIO_SockIsDGram(int sfd) /* optvalue 'type' is of size int */ XSOCKLENT length = (XSOCKLENT)sizeof(type); - if (getsockopt(sfd, SOL_SOCKET, SO_TYPE, (XSOCKOPT_TYPE_OPTVAL_TYPE)&type, - &length) == 0 && type != SOCK_DGRAM) { + if (XSOCKET_GETSOCKOPT(sfd, SOL_SOCKET, SO_TYPE, + (XSOCKOPT_TYPE_OPTVAL_TYPE)&type, &length) == 0 && + type != SOCK_DGRAM) { return 0; } else { @@ -798,7 +799,7 @@ int EmbedReceiveFrom(WOLFSSL *ssl, char *buf, int sz, void *ctx) #endif /* WOLFSSL_DTLS13 */ timeout.tv_sec = dtls_timeout; #endif /* USE_WINDOWS_API */ - if (setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, (char*)&timeout, + if (XSOCKET_SETSOCKOPT(sd, SOL_SOCKET, SO_RCVTIMEO, (char*)&timeout, sizeof(timeout)) != 0) { WOLFSSL_MSG("setsockopt rcvtimeo failed"); } @@ -1029,7 +1030,7 @@ int EmbedGenerateCookie(WOLFSSL* ssl, byte *buf, int sz, void *ctx) return BAD_FUNC_ARG; XMEMSET(&peer, 0, sizeof(peer)); - if (getpeername(sd, (SOCKADDR*)&peer, &peerSz) != 0) { + if (XSOCKET_GETPEERNAME(sd, (SOCKADDR*)&peer, &peerSz) != 0) { WOLFSSL_MSG("getpeername failed in EmbedGenerateCookie"); return GEN_COOKIE_E; } @@ -1562,7 +1563,7 @@ int wolfIO_TcpConnect(SOCKET_T* sockfd, const char* ip, word16 port, int to_sec) (void)to_sec; #endif /* HAVE_IO_TIMEOUT */ - ret = connect(*sockfd, (SOCKADDR *)&addr, sockaddr_len); + ret = XSOCKET_CONNECT(*sockfd, (SOCKADDR *)&addr, sockaddr_len); #ifdef HAVE_IO_TIMEOUT if ((ret != 0) && (to_sec > 0)) { #ifdef USE_WINDOWS_API @@ -1643,14 +1644,15 @@ int wolfIO_TcpBind(SOCKET_T* sockfd, word16 port) { int optval = 1; XSOCKLENT optlen = sizeof(optval); - ret = setsockopt(*sockfd, SOL_SOCKET, SO_REUSEADDR, &optval, optlen); + ret = XSOCKET_SETSOCKOPT(*sockfd, SOL_SOCKET, SO_REUSEADDR, &optval, + optlen); } #endif if (ret == 0) - ret = bind(*sockfd, (SOCKADDR *)sin, sockaddr_len); + ret = XSOCKET_BIND(*sockfd, (SOCKADDR *)sin, sockaddr_len); if (ret == 0) - ret = listen(*sockfd, SOMAXCONN); + ret = XSOCKET_LISTEN(*sockfd, SOMAXCONN); if (ret != 0) { WOLFSSL_MSG("wolfIO_TcpBind failed"); diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c index 3e6b8b304cf..ca01b9f4555 100644 --- a/wolfcrypt/benchmark/benchmark.c +++ b/wolfcrypt/benchmark/benchmark.c @@ -6498,7 +6498,8 @@ static void bench_gmac_internal(int useDeviceID, word32 ivSz, wc_AesFree((Aes*)&gmac); - bench_stats_sym_finish(gmacStr, 0, count, bench_size, start, ret); + bench_stats_sym_finish(gmacStr, useDeviceID, count, bench_size, start, + ret); #ifdef MULTI_VALUE_STATISTICS bench_multi_value_stats(max, min, sum, squareSum, runs); #endif diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c index 4c6fbe7bdf6..154529d33c0 100644 --- a/wolfcrypt/src/wc_port.c +++ b/wolfcrypt/src/wc_port.c @@ -4601,7 +4601,11 @@ time_t z_time(time_t * timer) /* Fallback to uptime since boot. This works for relative times, but * not for ASN.1 date validation */ + #ifdef SYS_CLOCK_REALTIME + if (sys_clock_gettime(SYS_CLOCK_REALTIME, &ts) == 0) + #else if (clock_gettime(CLOCK_REALTIME, &ts) == 0) + #endif if (timer != NULL) *timer = ts.tv_sec; diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index e4407f710d8..4ce36b1c5fe 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -3654,7 +3654,11 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\ struct timespec utctime; utctime.tv_sec = 1521725159; /* dummy time: 2018-03-22T13:25:59+00:00 */ utctime.tv_nsec = 0; + #ifdef SYS_CLOCK_REALTIME + sys_clock_settime(SYS_CLOCK_REALTIME, &utctime); + #else clock_settime(CLOCK_REALTIME, &utctime); + #endif #endif #ifdef DEVKITPRO void *framebuffer; diff --git a/wolfssl/test.h b/wolfssl/test.h index 57906a3b793..6c506a5e265 100644 --- a/wolfssl/test.h +++ b/wolfssl/test.h @@ -224,6 +224,27 @@ #define SOCKET_T int #define WOLFSSL_USE_GETADDRINFO + #if KERNEL_VERSION_NUMBER >= 0x40100 + /* Zephyr 4.1 dropped CONFIG_NET_SOCKETS_POSIX_NAMES, so this harness calls + * the zsock_ API. Function-like on purpose: an object-like macro would also + * rewrite identically named structure members, such as sendto/recvfrom in + * WOLFSSL_DTLS_CTX or Zephyr's own struct socket_op_vtable. */ + #define socket(a,b,c) zsock_socket((a),(b),(c)) + #define bind(a,b,c) zsock_bind((a),(b),(c)) + #define connect(a,b,c) zsock_connect((a),(b),(c)) + #define listen(a,b) zsock_listen((a),(b)) + #define accept(a,b,c) zsock_accept((a),(b),(c)) + #define send(a,b,c,d) zsock_send((a),(b),(c),(d)) + #define recv(a,b,c,d) zsock_recv((a),(b),(c),(d)) + #define sendto(a,b,c,d,e,f) zsock_sendto((a),(b),(c),(d),(e),(f)) + #define recvfrom(a,b,c,d,e,f) zsock_recvfrom((a),(b),(c),(d),(e),(f)) + #define setsockopt(a,b,c,d,e) zsock_setsockopt((a),(b),(c),(d),(e)) + #define getsockopt(a,b,c,d,e) zsock_getsockopt((a),(b),(c),(d),(e)) + #define shutdown(a,b) zsock_shutdown((a),(b)) + #define getpeername(a,b,c) zsock_getpeername((a),(b),(c)) + #define getsockname(a,b,c) zsock_getsockname((a),(b),(c)) + #endif + #if !defined(CONFIG_POSIX_API) #define SOL_SOCKET 1 static unsigned long inet_addr(const char *cp) diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index a57a4c06b7d..e9003a5448d 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -3168,34 +3168,10 @@ void *z_realloc(void *ptr, size_t size); #define realloc z_realloc - #if KERNEL_VERSION_NUMBER >= 0x40100 - /* Zephyr >= 4.1 removed CONFIG_NET_SOCKETS_POSIX_NAMES and the - * corresponding macro block in . - * Define our own compile-time remapping to zsock_* so that wolfSSL - * always calls Zephyr's network stack directly, avoiding host-libc - * symbol conflicts on native_sim. */ - #define socket zsock_socket - #define bind zsock_bind - #define connect zsock_connect - #define listen zsock_listen - #define accept zsock_accept - #define send zsock_send - #define recv zsock_recv - #define sendto zsock_sendto - #define recvfrom zsock_recvfrom - #define setsockopt zsock_setsockopt - #define getsockopt zsock_getsockopt - #define shutdown zsock_shutdown - #define getpeername zsock_getpeername - #define getsockname zsock_getsockname - /* Note: close, poll, inet_pton, inet_ntop are NOT remapped here. - * They are general POSIX functions still declared in Zephyr's POSIX - * headers; redefining them conflicts with __syscall declarations in - * . close is handled via CloseSocket in wolfio.h, - * inet_pton/inet_ntop via XINET_PTON/XINET_NTOP in wolfio.h. */ - #else - /* Zephyr < 4.1: define CONFIG_NET_SOCKETS_POSIX_NAMES so that - * provides the POSIX name remapping macros. */ + /* Zephyr < 4.1: ask for the POSIX socket names. Newer + * Zephyr dropped this option; wolfSSL reaches the zsock_* API by name + * through the XSOCKET_* macros in wolfio.h instead. */ + #if KERNEL_VERSION_NUMBER < 0x40100 #if !defined(CONFIG_NET_SOCKETS_POSIX_NAMES) && !defined(CONFIG_POSIX_API) #define CONFIG_NET_SOCKETS_POSIX_NAMES #endif diff --git a/wolfssl/wolfcrypt/wc_port.h b/wolfssl/wolfcrypt/wc_port.h index 0d400713438..b69e13c4bd8 100644 --- a/wolfssl/wolfcrypt/wc_port.h +++ b/wolfssl/wolfcrypt/wc_port.h @@ -1729,14 +1729,6 @@ WOLFSSL_ABI WOLFSSL_API int wolfCrypt_Cleanup(void); #include #endif - #ifndef CLOCK_REALTIME - #ifdef SYS_CLOCK_REALTIME - #define CLOCK_REALTIME SYS_CLOCK_REALTIME - #define clock_gettime sys_clock_gettime - #define clock_settime sys_clock_settime - #endif - #endif - #if defined(CONFIG_RTC) #if defined(CONFIG_PICOLIBC) || defined(CONFIG_NEWLIB_LIBC) #include @@ -2066,11 +2058,20 @@ WOLFSSL_ABI WOLFSSL_API int wolfCrypt_Cleanup(void); #if !defined(NO_FILESYSTEM) #define wc_fopen_owner_only(path) XFOPEN((path), "w+b") #endif +#if defined(WOLFSSL_ZEPHYR) && KERNEL_VERSION_NUMBER >= 0x40100 + /* Zephyr offers these under their zsock_ names in every configuration; + * the POSIX aliases need the compat mode from 4.4 on. */ + #define wc_socket_cloexec(domain, type, protocol) \ + zsock_socket((domain), (type), (protocol)) + #define wc_accept_cloexec(sockfd, addr, addrlen) \ + zsock_accept((sockfd), (addr), (addrlen)) +#else #define wc_socket_cloexec(domain, type, protocol) \ socket((domain), (type), (protocol)) #define wc_accept_cloexec(sockfd, addr, addrlen) \ accept((sockfd), (addr), (addrlen)) #endif +#endif #ifdef __cplusplus } /* extern "C" */ diff --git a/wolfssl/wolfio.h b/wolfssl/wolfio.h index 2194c254c29..4572d598592 100644 --- a/wolfssl/wolfio.h +++ b/wolfssl/wolfio.h @@ -497,8 +497,24 @@ #define WOLFSSL_MAX_SEND_SZ 256 #endif - #define SEND_FUNCTION send - #define RECV_FUNCTION recv + #if KERNEL_VERSION_NUMBER >= 0x40100 + /* Zephyr 4.1 removed CONFIG_NET_SOCKETS_POSIX_NAMES. The zsock_ names + * are always present; the types and constants below still need + * CONFIG_NET_NAMESPACE_COMPAT_MODE from 4.4 on. */ + #define SEND_FUNCTION zsock_send + #define RECV_FUNCTION zsock_recv + #define DTLS_SENDTO_FUNCTION zsock_sendto + #define DTLS_RECVFROM_FUNCTION zsock_recvfrom + #define XSOCKET_BIND zsock_bind + #define XSOCKET_CONNECT zsock_connect + #define XSOCKET_LISTEN zsock_listen + #define XSOCKET_GETSOCKOPT zsock_getsockopt + #define XSOCKET_SETSOCKOPT zsock_setsockopt + #define XSOCKET_GETPEERNAME zsock_getpeername + #else + #define SEND_FUNCTION send + #define RECV_FUNCTION recv + #endif #elif defined(WOLFSSL_LINUXKM) #define SEND_FUNCTION linuxkm_send #define RECV_FUNCTION linuxkm_recv @@ -513,6 +529,28 @@ #endif #endif +/* Socket calls wolfSSL makes that have no wrapper of their own. A port that + * spells them differently overrides these above; everyone else gets the BSD + * names, so the expansion is unchanged. */ +#ifndef XSOCKET_BIND + #define XSOCKET_BIND bind +#endif +#ifndef XSOCKET_CONNECT + #define XSOCKET_CONNECT connect +#endif +#ifndef XSOCKET_LISTEN + #define XSOCKET_LISTEN listen +#endif +#ifndef XSOCKET_GETSOCKOPT + #define XSOCKET_GETSOCKOPT getsockopt +#endif +#ifndef XSOCKET_SETSOCKOPT + #define XSOCKET_SETSOCKOPT setsockopt +#endif +#ifndef XSOCKET_GETPEERNAME + #define XSOCKET_GETPEERNAME getpeername +#endif + #ifndef WOLFSSL_NO_SOCK #ifndef XSOCKLENT #ifdef USE_WINDOWS_API diff --git a/zephyr/CMakeLists.txt b/zephyr/CMakeLists.txt index 39f5c58d805..7a21bced1de 100644 --- a/zephyr/CMakeLists.txt +++ b/zephyr/CMakeLists.txt @@ -222,6 +222,6 @@ if(CONFIG_WOLFSSL) # after wolfssl_external on the linkers command line. endif() - target_link_libraries(wolfSSL INTERFACE zephyr_interface) + zephyr_link_libraries(wolfSSL) endif() diff --git a/zephyr/Kconfig b/zephyr/Kconfig index 1e96b8bf46b..b4eeaf2c84b 100644 --- a/zephyr/Kconfig +++ b/zephyr/Kconfig @@ -111,6 +111,17 @@ config WOLFCRYPT_FIPS_READY endchoice +config WOLFSSL_CRYPTO_CB + bool "wolfCrypt crypto callbacks" + depends on !WOLFSSL_HAS_SETTINGS_FILE + default n + help + Enable the crypto callback interface (WOLF_CRYPTO_CB), through which an + application registers a device with wc_CryptoCb_RegisterDevice() and + routes wolfCrypt operations to it. Also enables key references + (WOLF_PRIVATE_KEY_ID), which is what lets a TLS key live on that device + instead of in the application's memory. + config WOLFSSL_CRYPTO_ONLY bool "Build wolfCrypt only (no TLS layer)" depends on WOLFSSL_BUILTIN @@ -204,6 +215,22 @@ config WOLFSSL_SESSION_CACHE help Enable the TLS session cache (SMALL_SESSION_CACHE; NO_SESSION_CACHE off). +config WOLFSSL_OCSP + bool "wolfSSL OCSP certificate revocation checking" + depends on !WOLFSSL_HAS_SETTINGS_FILE + default n + help + Enable OCSP (HAVE_OCSP). + +config WOLFSSL_OCSP_STAPLING + bool "wolfSSL OCSP stapling" + depends on WOLFSSL_OCSP + default n + help + Enable the TLS certificate status request extension + (HAVE_CERTIFICATE_STATUS_REQUEST), with which a client asks the server + to staple an OCSP response for its own certificate to the handshake. + config WOLFSSL_SESSION_TICKET bool "wolfSSL TLS session tickets" default y diff --git a/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c b/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c index fc3faf71d04..aa09d8fd653 100644 --- a/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c +++ b/zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c @@ -587,7 +587,11 @@ int main() struct timespec utctime; utctime.tv_sec = 1658510212; /* Friday, July 22, 2022 5:16:52 PM GMT */ utctime.tv_nsec = 0; +#ifdef SYS_CLOCK_REALTIME + sys_clock_settime(SYS_CLOCK_REALTIME, &utctime); +#else clock_settime(CLOCK_REALTIME, &utctime); +#endif #ifdef HAVE_FIPS wolfCrypt_SetCb_fips(myFipsCb); diff --git a/zephyr/user_settings.h b/zephyr/user_settings.h index caacdd2e116..fe8f98074a2 100644 --- a/zephyr/user_settings.h +++ b/zephyr/user_settings.h @@ -209,6 +209,14 @@ extern "C" { #define IGNORE_NAME_CONSTRAINTS #endif +/* OCSP */ +#if defined(CONFIG_WOLFSSL_OCSP) + #define HAVE_OCSP +#endif +#if defined(CONFIG_WOLFSSL_OCSP_STAPLING) + #define HAVE_CERTIFICATE_STATUS_REQUEST +#endif + /* Session Cache */ #if defined(CONFIG_WOLFSSL_SESSION_CACHE) #define SMALL_SESSION_CACHE @@ -271,9 +279,15 @@ extern "C" { #define WOLFSSL_SET_CIPHER_BYTES #endif +#if defined(CONFIG_WOLFSSL_CRYPTO_CB) + #define WOLF_CRYPTO_CB +#endif + /* wolfTPM Zephyr */ #if defined(CONFIG_WOLFTPM) - #define WOLF_CRYPTO_CB + #ifndef WOLF_CRYPTO_CB + #define WOLF_CRYPTO_CB + #endif #define WOLFSSL_AES_CFB #endif