More Zephyr fixes

.wolfssl_known_macro_extras

@@ -189,6 +189,7 @@ CONFIG_WOLFSSL_ASN_ALLOW_0_SERIAL
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE
 CONFIG_WOLFSSL_CHACHA_POLY
+CONFIG_WOLFSSL_CRYPTO_CB
 CONFIG_WOLFSSL_CRYPTO_ONLY
 CONFIG_WOLFSSL_CURVE25519
 CONFIG_WOLFSSL_DTLS
@@ -212,6 +213,8 @@ CONFIG_WOLFSSL_MAX_FRAGMENT_LEN
 CONFIG_WOLFSSL_MLDSA
 CONFIG_WOLFSSL_MLKEM
 CONFIG_WOLFSSL_NO_ASN_STRICT
+CONFIG_WOLFSSL_OCSP
+CONFIG_WOLFSSL_OCSP_STAPLING
 CONFIG_WOLFSSL_OPENSSL_EXTRA_X509_SMALL
 CONFIG_WOLFSSL_PSK
 CONFIG_WOLFSSL_RSA

src/wolfio.c

@@ -652,8 +652,9 @@ int wolfIO_SockIsDGram(int sfd)
     /* optvalue 'type' is of size int */
     XSOCKLENT length = (XSOCKLENT)sizeof(type);
 
-    if (getsockopt(sfd, SOL_SOCKET, SO_TYPE, (XSOCKOPT_TYPE_OPTVAL_TYPE)&type,
-            &length) == 0 && type != SOCK_DGRAM) {
+    if (XSOCKET_GETSOCKOPT(sfd, SOL_SOCKET, SO_TYPE,
+            (XSOCKOPT_TYPE_OPTVAL_TYPE)&type, &length) == 0 &&
+            type != SOCK_DGRAM) {
         return 0;
     }
     else {
@@ -798,7 +799,7 @@ int EmbedReceiveFrom(WOLFSSL *ssl, char *buf, int sz, void *ctx)
             #endif /* WOLFSSL_DTLS13 */
                 timeout.tv_sec = dtls_timeout;
         #endif /* USE_WINDOWS_API */
-            if (setsockopt(sd, SOL_SOCKET, SO_RCVTIMEO, (char*)&timeout,
+            if (XSOCKET_SETSOCKOPT(sd, SOL_SOCKET, SO_RCVTIMEO, (char*)&timeout,
                     sizeof(timeout)) != 0) {
                 WOLFSSL_MSG("setsockopt rcvtimeo failed");
             }
@@ -1029,7 +1030,7 @@ int EmbedGenerateCookie(WOLFSSL* ssl, byte *buf, int sz, void *ctx)
         return BAD_FUNC_ARG;
 
     XMEMSET(&peer, 0, sizeof(peer));
-    if (getpeername(sd, (SOCKADDR*)&peer, &peerSz) != 0) {
+    if (XSOCKET_GETPEERNAME(sd, (SOCKADDR*)&peer, &peerSz) != 0) {
         WOLFSSL_MSG("getpeername failed in EmbedGenerateCookie");
         return GEN_COOKIE_E;
     }
@@ -1562,7 +1563,7 @@ int wolfIO_TcpConnect(SOCKET_T* sockfd, const char* ip, word16 port, int to_sec)
     (void)to_sec;
 #endif /* HAVE_IO_TIMEOUT */
 
-    ret = connect(*sockfd, (SOCKADDR *)&addr, sockaddr_len);
+    ret = XSOCKET_CONNECT(*sockfd, (SOCKADDR *)&addr, sockaddr_len);
 #ifdef HAVE_IO_TIMEOUT
     if ((ret != 0) && (to_sec > 0)) {
 #ifdef USE_WINDOWS_API
@@ -1643,14 +1644,15 @@ int wolfIO_TcpBind(SOCKET_T* sockfd, word16 port)
     {
         int optval  = 1;
         XSOCKLENT optlen = sizeof(optval);
-        ret = setsockopt(*sockfd, SOL_SOCKET, SO_REUSEADDR, &optval, optlen);
+        ret = XSOCKET_SETSOCKOPT(*sockfd, SOL_SOCKET, SO_REUSEADDR, &optval,
+                                 optlen);
     }
 #endif
 
     if (ret == 0)
-        ret = bind(*sockfd, (SOCKADDR *)sin, sockaddr_len);
+        ret = XSOCKET_BIND(*sockfd, (SOCKADDR *)sin, sockaddr_len);
     if (ret == 0)
-        ret = listen(*sockfd, SOMAXCONN);
+        ret = XSOCKET_LISTEN(*sockfd, SOMAXCONN);
 
     if (ret != 0) {
         WOLFSSL_MSG("wolfIO_TcpBind failed");

wolfcrypt/benchmark/benchmark.c

@@ -6498,7 +6498,8 @@ static void bench_gmac_internal(int useDeviceID, word32 ivSz,
 
     wc_AesFree((Aes*)&gmac);
 
-    bench_stats_sym_finish(gmacStr, 0, count, bench_size, start, ret);
+    bench_stats_sym_finish(gmacStr, useDeviceID, count, bench_size, start,
+                           ret);
 #ifdef MULTI_VALUE_STATISTICS
     bench_multi_value_stats(max, min, sum, squareSum, runs);
 #endif

wolfcrypt/src/wc_port.c

@@ -4601,7 +4601,11 @@ time_t z_time(time_t * timer)
 
     /* Fallback to uptime since boot. This works for relative times, but
      * not for ASN.1 date validation */
+    #ifdef SYS_CLOCK_REALTIME
+    if (sys_clock_gettime(SYS_CLOCK_REALTIME, &ts) == 0)
+    #else
     if (clock_gettime(CLOCK_REALTIME, &ts) == 0)
+    #endif
         if (timer != NULL)
             *timer = ts.tv_sec;
 

wolfcrypt/test/test.c

@@ -3654,7 +3654,11 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
         struct timespec utctime;
         utctime.tv_sec = 1521725159; /* dummy time: 2018-03-22T13:25:59+00:00 */
         utctime.tv_nsec = 0;
+    #ifdef SYS_CLOCK_REALTIME
+        sys_clock_settime(SYS_CLOCK_REALTIME, &utctime);
+    #else
         clock_settime(CLOCK_REALTIME, &utctime);
+    #endif
 #endif
 #ifdef DEVKITPRO
         void *framebuffer;

wolfssl/test.h

@@ -224,6 +224,27 @@
     #define SOCKET_T int
     #define WOLFSSL_USE_GETADDRINFO
 
+    #if KERNEL_VERSION_NUMBER >= 0x40100
+    /* Zephyr 4.1 dropped CONFIG_NET_SOCKETS_POSIX_NAMES, so this harness calls
+     * the zsock_ API. Function-like on purpose: an object-like macro would also
+     * rewrite identically named structure members, such as sendto/recvfrom in
+     * WOLFSSL_DTLS_CTX or Zephyr's own struct socket_op_vtable. */
+    #define socket(a,b,c)           zsock_socket((a),(b),(c))
+    #define bind(a,b,c)             zsock_bind((a),(b),(c))
+    #define connect(a,b,c)          zsock_connect((a),(b),(c))
+    #define listen(a,b)             zsock_listen((a),(b))
+    #define accept(a,b,c)           zsock_accept((a),(b),(c))
+    #define send(a,b,c,d)           zsock_send((a),(b),(c),(d))
+    #define recv(a,b,c,d)           zsock_recv((a),(b),(c),(d))
+    #define sendto(a,b,c,d,e,f)     zsock_sendto((a),(b),(c),(d),(e),(f))
+    #define recvfrom(a,b,c,d,e,f)   zsock_recvfrom((a),(b),(c),(d),(e),(f))
+    #define setsockopt(a,b,c,d,e)   zsock_setsockopt((a),(b),(c),(d),(e))
+    #define getsockopt(a,b,c,d,e)   zsock_getsockopt((a),(b),(c),(d),(e))
+    #define shutdown(a,b)           zsock_shutdown((a),(b))
+    #define getpeername(a,b,c)      zsock_getpeername((a),(b),(c))
+    #define getsockname(a,b,c)      zsock_getsockname((a),(b),(c))
+    #endif
+
     #if !defined(CONFIG_POSIX_API)
     #define SOL_SOCKET 1
     static unsigned long inet_addr(const char *cp)

wolfssl/wolfcrypt/settings.h

@@ -3168,34 +3168,10 @@
     void *z_realloc(void *ptr, size_t size);
     #define realloc   z_realloc
 
-    #if KERNEL_VERSION_NUMBER >= 0x40100
-    /* Zephyr >= 4.1 removed CONFIG_NET_SOCKETS_POSIX_NAMES and the
-     * corresponding macro block in <zephyr/net/socket.h>.
-     * Define our own compile-time remapping to zsock_* so that wolfSSL
-     * always calls Zephyr's network stack directly, avoiding host-libc
-     * symbol conflicts on native_sim. */
-    #define socket      zsock_socket
-    #define bind        zsock_bind
-    #define connect     zsock_connect
-    #define listen      zsock_listen
-    #define accept      zsock_accept
-    #define send        zsock_send
-    #define recv        zsock_recv
-    #define sendto      zsock_sendto
-    #define recvfrom    zsock_recvfrom
-    #define setsockopt  zsock_setsockopt
-    #define getsockopt  zsock_getsockopt
-    #define shutdown    zsock_shutdown
-    #define getpeername zsock_getpeername
-    #define getsockname zsock_getsockname
-    /* Note: close, poll, inet_pton, inet_ntop are NOT remapped here.
-     * They are general POSIX functions still declared in Zephyr's POSIX
-     * headers; redefining them conflicts with __syscall declarations in
-     * <zephyr/net/socket.h>. close is handled via CloseSocket in wolfio.h,
-     * inet_pton/inet_ntop via XINET_PTON/XINET_NTOP in wolfio.h. */
-    #else
-    /* Zephyr < 4.1: define CONFIG_NET_SOCKETS_POSIX_NAMES so that
-     * <net/socket.h> provides the POSIX name remapping macros. */
+    /* Zephyr < 4.1: ask <net/socket.h> for the POSIX socket names. Newer
+     * Zephyr dropped this option; wolfSSL reaches the zsock_* API by name
+     * through the XSOCKET_* macros in wolfio.h instead. */
+    #if KERNEL_VERSION_NUMBER < 0x40100
     #if !defined(CONFIG_NET_SOCKETS_POSIX_NAMES) && !defined(CONFIG_POSIX_API)
     #define CONFIG_NET_SOCKETS_POSIX_NAMES
     #endif

wolfssl/wolfcrypt/wc_port.h

@@ -1729,14 +1729,6 @@ WOLFSSL_ABI WOLFSSL_API int wolfCrypt_Cleanup(void);
         #include <posix/time.h>
     #endif
 
-    #ifndef CLOCK_REALTIME
-        #ifdef SYS_CLOCK_REALTIME
-            #define CLOCK_REALTIME  SYS_CLOCK_REALTIME
-            #define clock_gettime   sys_clock_gettime
-            #define clock_settime   sys_clock_settime
-        #endif
-    #endif
-
     #if defined(CONFIG_RTC)
         #if defined(CONFIG_PICOLIBC) || defined(CONFIG_NEWLIB_LIBC)
             #include <zephyr/drivers/rtc.h>
@@ -2066,11 +2058,20 @@ WOLFSSL_ABI WOLFSSL_API int wolfCrypt_Cleanup(void);
 #if !defined(NO_FILESYSTEM)
     #define wc_fopen_owner_only(path) XFOPEN((path), "w+b")
 #endif
+#if defined(WOLFSSL_ZEPHYR) && KERNEL_VERSION_NUMBER >= 0x40100
+    /* Zephyr offers these under their zsock_ names in every configuration;
+     * the POSIX aliases need the compat mode from 4.4 on. */
+    #define wc_socket_cloexec(domain, type, protocol) \
+        zsock_socket((domain), (type), (protocol))
+    #define wc_accept_cloexec(sockfd, addr, addrlen) \
+        zsock_accept((sockfd), (addr), (addrlen))
+#else
     #define wc_socket_cloexec(domain, type, protocol) \
         socket((domain), (type), (protocol))
     #define wc_accept_cloexec(sockfd, addr, addrlen) \
         accept((sockfd), (addr), (addrlen))
 #endif
+#endif
 
 #ifdef __cplusplus
     }  /* extern "C" */

wolfssl/wolfio.h

@@ -497,8 +497,24 @@
         #define WOLFSSL_MAX_SEND_SZ       256
     #endif
 
-    #define SEND_FUNCTION send
-    #define RECV_FUNCTION recv
+    #if KERNEL_VERSION_NUMBER >= 0x40100
+        /* Zephyr 4.1 removed CONFIG_NET_SOCKETS_POSIX_NAMES. The zsock_ names
+         * are always present; the types and constants below still need
+         * CONFIG_NET_NAMESPACE_COMPAT_MODE from 4.4 on. */
+        #define SEND_FUNCTION          zsock_send
+        #define RECV_FUNCTION          zsock_recv
+        #define DTLS_SENDTO_FUNCTION   zsock_sendto
+        #define DTLS_RECVFROM_FUNCTION zsock_recvfrom
+        #define XSOCKET_BIND           zsock_bind
+        #define XSOCKET_CONNECT        zsock_connect
+        #define XSOCKET_LISTEN         zsock_listen
+        #define XSOCKET_GETSOCKOPT     zsock_getsockopt
+        #define XSOCKET_SETSOCKOPT     zsock_setsockopt
+        #define XSOCKET_GETPEERNAME    zsock_getpeername
+    #else
+        #define SEND_FUNCTION send
+        #define RECV_FUNCTION recv
+    #endif
 #elif defined(WOLFSSL_LINUXKM)
     #define SEND_FUNCTION linuxkm_send
     #define RECV_FUNCTION linuxkm_recv
@@ -513,6 +529,28 @@
     #endif
 #endif
 
+/* Socket calls wolfSSL makes that have no wrapper of their own. A port that
+ * spells them differently overrides these above; everyone else gets the BSD
+ * names, so the expansion is unchanged. */
+#ifndef XSOCKET_BIND
+    #define XSOCKET_BIND        bind
+#endif
+#ifndef XSOCKET_CONNECT
+    #define XSOCKET_CONNECT     connect
+#endif
+#ifndef XSOCKET_LISTEN
+    #define XSOCKET_LISTEN      listen
+#endif
+#ifndef XSOCKET_GETSOCKOPT
+    #define XSOCKET_GETSOCKOPT  getsockopt
+#endif
+#ifndef XSOCKET_SETSOCKOPT
+    #define XSOCKET_SETSOCKOPT  setsockopt
+#endif
+#ifndef XSOCKET_GETPEERNAME
+    #define XSOCKET_GETPEERNAME getpeername
+#endif
+
 #ifndef WOLFSSL_NO_SOCK
     #ifndef XSOCKLENT
         #ifdef USE_WINDOWS_API

zephyr/CMakeLists.txt

@@ -222,6 +222,6 @@ if(CONFIG_WOLFSSL)
     # after wolfssl_external on the linkers command line.
   endif()
 
-  target_link_libraries(wolfSSL INTERFACE zephyr_interface)
+  zephyr_link_libraries(wolfSSL)
 
 endif()

zephyr/Kconfig

@@ -111,6 +111,17 @@ config WOLFCRYPT_FIPS_READY
 
 endchoice
 
+config WOLFSSL_CRYPTO_CB
+  bool "wolfCrypt crypto callbacks"
+  depends on !WOLFSSL_HAS_SETTINGS_FILE
+  default n
+  help
+    Enable the crypto callback interface (WOLF_CRYPTO_CB), through which an
+    application registers a device with wc_CryptoCb_RegisterDevice() and
+    routes wolfCrypt operations to it. Also enables key references
+    (WOLF_PRIVATE_KEY_ID), which is what lets a TLS key live on that device
+    instead of in the application's memory.
+
 config WOLFSSL_CRYPTO_ONLY
 	bool "Build wolfCrypt only (no TLS layer)"
 	depends on WOLFSSL_BUILTIN
@@ -204,6 +215,22 @@ config WOLFSSL_SESSION_CACHE
   help
     Enable the TLS session cache (SMALL_SESSION_CACHE; NO_SESSION_CACHE off).
 
+config WOLFSSL_OCSP
+  bool "wolfSSL OCSP certificate revocation checking"
+  depends on !WOLFSSL_HAS_SETTINGS_FILE
+  default n
+  help
+    Enable OCSP (HAVE_OCSP).
+
+config WOLFSSL_OCSP_STAPLING
+  bool "wolfSSL OCSP stapling"
+  depends on WOLFSSL_OCSP
+  default n
+  help
+    Enable the TLS certificate status request extension
+    (HAVE_CERTIFICATE_STATUS_REQUEST), with which a client asks the server
+    to staple an OCSP response for its own certificate to the handshake.
+
 config WOLFSSL_SESSION_TICKET
   bool "wolfSSL TLS session tickets"
   default y

zephyr/samples/wolfssl_tls_thread/src/tls_threaded.c

@@ -587,7 +587,11 @@ int main()
     struct timespec utctime;
     utctime.tv_sec = 1658510212; /* Friday, July 22, 2022 5:16:52 PM GMT */
     utctime.tv_nsec = 0;
+#ifdef SYS_CLOCK_REALTIME
+    sys_clock_settime(SYS_CLOCK_REALTIME, &utctime);
+#else
     clock_settime(CLOCK_REALTIME, &utctime);
+#endif
 
 #ifdef HAVE_FIPS
     wolfCrypt_SetCb_fips(myFipsCb);

zephyr/user_settings.h

@@ -209,6 +209,14 @@ extern "C" {
     #define IGNORE_NAME_CONSTRAINTS
 #endif
 
+/* OCSP */
+#if defined(CONFIG_WOLFSSL_OCSP)
+    #define HAVE_OCSP
+#endif
+#if defined(CONFIG_WOLFSSL_OCSP_STAPLING)
+    #define HAVE_CERTIFICATE_STATUS_REQUEST
+#endif
+
 /* Session Cache */
 #if defined(CONFIG_WOLFSSL_SESSION_CACHE)
     #define SMALL_SESSION_CACHE
@@ -271,9 +279,15 @@ extern "C" {
     #define WOLFSSL_SET_CIPHER_BYTES
 #endif
 
+#if defined(CONFIG_WOLFSSL_CRYPTO_CB)
+    #define WOLF_CRYPTO_CB
+#endif
+
 /* wolfTPM Zephyr */
 #if defined(CONFIG_WOLFTPM)
-    #define WOLF_CRYPTO_CB
+    #ifndef WOLF_CRYPTO_CB
+        #define WOLF_CRYPTO_CB
+    #endif
     #define WOLFSSL_AES_CFB
 #endif