Merge pull request #152 from gasbytes/gnutls-wolfssl-fips-off

FIPS-off gnutls recipes + minimal fips-off image.

conf/layer.conf

@@ -170,6 +170,7 @@ BBFILES += "${@bb.utils.contains('WOLFSSL_DEMOS', 'wolfssl-combined-image-minima
 BBFILES += "${@bb.utils.contains('WOLFSSL_DEMOS', 'wolfclu-combined-image-minimal', '${LAYERDIR}/recipes-core/images/wolfclu-combined-image-minimal/*.bb ${LAYERDIR}/recipes-core/images/wolfclu-combined-image-minimal/*.bbappend', '', d)}"
 BBFILES += "${@bb.utils.contains('WOLFSSL_DEMOS', 'libgcrypt-image-minimal', '${LAYERDIR}/recipes-core/images/libgcrypt-image-minimal/*.bb ${LAYERDIR}/recipes-core/images/libgcrypt-image-minimal/*.bbappend', '', d)}"
 BBFILES += "${@bb.utils.contains('WOLFSSL_DEMOS', 'gnutls-image-minimal', '${LAYERDIR}/recipes-core/images/gnutls-image-minimal/*.bb ${LAYERDIR}/recipes-core/images/gnutls-image-minimal/*.bbappend', '', d)}"
+BBFILES += "${@bb.utils.contains('WOLFSSL_DEMOS', 'gnutls-nonfips-image-minimal', '${LAYERDIR}/recipes-core/images/gnutls-nonfips-image-minimal/*.bb ${LAYERDIR}/recipes-core/images/gnutls-nonfips-image-minimal/*.bbappend', '', d)}"
 BBFILES += "${@bb.utils.contains('WOLFSSL_DEMOS', 'fips-image-minimal', '${LAYERDIR}/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/*.bb ${LAYERDIR}/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/*.bbappend', '', d)}"
 
 # Versions of OpenEmbedded-Core which layer has been tested against

inc/gnutls/scarthgap/gnutls-enable-wolfssl-modern.inc

@@ -19,8 +19,8 @@ SRCREV:class-target = "${AUTOREV}"
 S:class-target = "${WORKDIR}/git"
 B:class-target = "${S}"
 
-# Enable FIPS mode
-PACKAGECONFIG:append:class-target = " fips"
+# Enable FIPS mode only if using wolfssl-fips provider
+PACKAGECONFIG:append:class-target = "${@' fips' if d.getVar('PREFERRED_PROVIDER_virtual/wolfssl') == 'wolfssl-fips' else ''}"
 
 # Configure options for wolfSSL backend
 EXTRA_OECONF:class-target = "\
@@ -34,6 +34,7 @@ EXTRA_OECONF:class-target = "\
     --disable-dependency-tracking \
     --enable-srp-authentication \
     --enable-fips140-mode \
+    ${@'--enable-fips140-mode' if d.getVar('PREFERRED_PROVIDER_virtual/wolfssl') == 'wolfssl-fips' else ''} \
 "
 
 TARGET_CFLAGS:append:class-target = " -DGNUTLS_WOLFSSL"

inc/wolfssl/wolfssl-enable-gnutls.inc

@@ -0,0 +1,33 @@
+# Non-FIPS wolfSSL configuration for GnuTLS
+EXTRA_OECONF += " \
+      --enable-cmac \
+      --with-eccminsz=192 \
+      --enable-ed25519 \
+      --enable-ed448 \
+      --enable-md5 \
+      --enable-curve25519 \
+      --enable-curve448 \
+      --enable-aesccm \
+      --enable-aesxts \
+      --enable-aescfb \
+      --enable-keygen \
+      --enable-shake128 \
+      --enable-shake256 \
+"
+
+TARGET_CFLAGS += " \
+      -DWOLFSSL_PUBLIC_ASN \
+      -DHAVE_FFDHE_3072 \
+      -DHAVE_FFDHE_4096 \
+      -DWOLFSSL_DH_EXTRA \
+      -DWOLFSSL_PSS_SALT_LEN_DISCOVER \
+      -DWOLFSSL_PUBLIC_MP \
+      -DWOLFSSL_RSA_KEY_CHECK \
+      -DHAVE_FFDHE_Q \
+      -DHAVE_FFDHE_6144 \
+      -DHAVE_FFDHE_8192 \
+      -DWOLFSSL_ECDSA_DETERMINISTIC_K \
+      -DWOLFSSL_VALIDATE_ECC_IMPORT \
+      -DRSA_MIN_SIZE=1024 \
+      -DWOLFSSL_AES_COUNTER \
+"

recipes-core/images/gnutls-nonfips-image-minimal/gnutls-nonfips-image-minimal.bb

@@ -0,0 +1,15 @@
+SUMMARY = "Minimal image with gnutls-wolfssl (non-FIPS)"
+DESCRIPTION = "This image includes gnutls configured to use standard wolfSSL \
+(non-FIPS) as the crypto backend."
+
+require recipes-core/images/wolfssl-minimal-image/wolfssl-image-minimal.bb
+
+IMAGE_INSTALL += " \
+      nettle \
+      gnutls \
+      gnutls-dev \
+      gnutls-bin \
+      wolfssl-gnutls-wrapper \
+      wolfssl-gnutls-wrapper-dev \
+      pkgconfig \
+"

recipes-core/images/gnutls-nonfips-image-minimal/gnutls_%.bbappend

@@ -0,0 +1,10 @@
+# Configure gnutls for gnutls-nonfips-image-minimal
+inherit wolfssl-osp-support
+
+python __anonymous() {
+    wolfssl_osp_include_if_provider(
+        d,
+        inc_file='inc/gnutls/gnutls-enable-wolfssl.inc',
+        allowed_providers=['wolfssl']  # Standard wolfSSL only
+        )
+}

recipes-core/images/gnutls-nonfips-image-minimal/nettle_%.bbappend

@@ -0,0 +1,6 @@
+# Configure nettle for gnutls (non-FIPS).
+# nettle 3.10 in order to correctly build
+# the latest release of gnutls.
+#
+
+require ${WOLFSSL_LAYERDIR}/inc/nettle/nettle.inc

recipes-core/images/gnutls-nonfips-image-minimal/wolfssl_%.bbappend

@@ -0,0 +1,2 @@
+# Configure wolfssl for gnutls-nonfips-image-minimal
+require ${WOLFSSL_LAYERDIR}/inc/wolfssl/wolfssl-enable-gnutls.inc