fips support

conf/layer.conf

@@ -45,6 +45,7 @@ BBFILES += "${LAYERDIR}/recipes-wolfssl/wolfssl/*.bb \
              ${LAYERDIR}/recipes-wolfssl/wolfssl/*.bbappend \
              ${LAYERDIR}/recipes-support/gnutls-wolfssl/*.bb \
              ${LAYERDIR}/recipes-examples/gnutls-wolfssl/*.bb \
+             ${LAYERDIR}/recipes-examples/wolfcrypt/wolfcrypttest/*.bb \
              ${LAYERDIR}/recipes-support/gnutls-wolfssl/*.bbappend"
 
 # Uncomment if building bind with wolfSSL.

recipes-examples/gnutls-wolfssl/gnutls-wolfssl-tests_git.bb

@@ -19,7 +19,10 @@ S = "${WORKDIR}/git/wolfssl-gnutls-wrapper/tests"
 
 inherit pkgconfig
 
-# Use standard system paths
+# Custom installation prefix
+WOLFSSL_GNUTLS_PREFIX = "/opt/wolfssl-gnutls-wrapper"
+
+# Use standard system paths for compilation
 CFLAGS:append = " \
     -I${STAGING_INCDIR} \
 "
@@ -27,6 +30,7 @@ CFLAGS:append = " \
 LDFLAGS:append = " \
     -L${STAGING_LIBDIR} \
     -Wl,-rpath,${libdir} \
+    -Wl,-rpath,${WOLFSSL_GNUTLS_PREFIX}/lib \
 "
 
 do_compile() {
@@ -38,44 +42,53 @@ do_compile() {
         LDFLAGS="${LDFLAGS}" \
         GNUTLS_INSTALL="${STAGING_DIR_TARGET}${prefix}" \
         WOLFSSL_INSTALL="${STAGING_DIR_TARGET}${prefix}" \
+        PROVIDER_PATH="${WOLFSSL_GNUTLS_PREFIX}" \
         all
 }
 
 do_install() {
-    # Install tests to /usr/lib/gnutls-wolfssl-tests/
-    install -d ${D}${libdir}/gnutls-wolfssl-tests
+    # Install tests to /opt/wolfssl-gnutls-wrapper/tests
+    install -d ${D}${WOLFSSL_GNUTLS_PREFIX}/tests
 
     # Install Makefile
-    install -m 0644 ${S}/Makefile ${D}${libdir}/gnutls-wolfssl-tests/
+    install -m 0644 ${S}/Makefile ${D}${WOLFSSL_GNUTLS_PREFIX}/tests/
+
+    # Install test utility header
+    if [ -f ${S}/test_util.h ]; then
+        install -m 0644 ${S}/test_util.h ${D}${WOLFSSL_GNUTLS_PREFIX}/tests/
+    fi
 
     # Install all test executables
     for test in ${S}/test_*; do
         if [ -f "$test" ] && [ -x "$test" ]; then
-            install -m 0755 "$test" ${D}${libdir}/gnutls-wolfssl-tests/
+            install -m 0755 "$test" ${D}${WOLFSSL_GNUTLS_PREFIX}/tests/
         fi
     done
 
     # Install any additional test files
     if [ -f ${S}/run ]; then
-        install -m 0755 ${S}/run ${D}${libdir}/gnutls-wolfssl-tests/
+        install -m 0755 ${S}/run ${D}${WOLFSSL_GNUTLS_PREFIX}/tests/
     fi
 
     # Create a helper script to run tests with proper environment
-    cat > ${D}${libdir}/gnutls-wolfssl-tests/run-tests.sh << 'EOF'
+    cat > ${D}${WOLFSSL_GNUTLS_PREFIX}/tests/run-tests.sh << 'EOF'
 #!/bin/bash
 # Helper script to run GnuTLS-wolfSSL tests with proper environment
 
-export LD_LIBRARY_PATH=${libdir}:$LD_LIBRARY_PATH
-export LD_PRELOAD=${libdir}/gnutls/libgnutls-wolfssl-wrapper.so
+export LD_LIBRARY_PATH=/usr/lib:/opt/wolfssl-gnutls-wrapper/lib:$LD_LIBRARY_PATH
+export LD_PRELOAD=/opt/wolfssl-gnutls-wrapper/lib/libgnutls-wolfssl-wrapper.so
 export GNUTLS_DEBUG_LEVEL=3
 
+# Optional: Enable FIPS mode
+# export GNUTLS_FORCE_FIPS_MODE=1
+
 echo "=== GnuTLS-wolfSSL Test Environment ==="
 echo "LD_LIBRARY_PATH: $LD_LIBRARY_PATH"
 echo "LD_PRELOAD: $LD_PRELOAD"
-echo "Test directory: ${libdir}/gnutls-wolfssl-tests"
+echo "Test directory: /opt/wolfssl-gnutls-wrapper/tests"
 echo ""
 
-cd ${libdir}/gnutls-wolfssl-tests
+cd /opt/wolfssl-gnutls-wrapper/tests
 
 if [ $# -eq 0 ]; then
     echo "Running all tests..."
@@ -86,17 +99,15 @@ else
 fi
 EOF
 
-    # Make it executable and substitute variables
-    chmod 755 ${D}${libdir}/gnutls-wolfssl-tests/run-tests.sh
-    sed -i "s|\${libdir}|${libdir}|g" ${D}${libdir}/gnutls-wolfssl-tests/run-tests.sh
+    chmod 755 ${D}${WOLFSSL_GNUTLS_PREFIX}/tests/run-tests.sh
 
     # Create a convenience symlink in /usr/bin
     install -d ${D}${bindir}
-    ln -sf ${libdir}/gnutls-wolfssl-tests/run-tests.sh ${D}${bindir}/gnutls-wolfssl-tests
+    ln -sf ${WOLFSSL_GNUTLS_PREFIX}/tests/run-tests.sh ${D}${bindir}/gnutls-wolfssl-tests
 }
 
 FILES:${PN} = "\
-    ${libdir}/gnutls-wolfssl-tests/* \
+    ${WOLFSSL_GNUTLS_PREFIX}/tests/* \
     ${bindir}/gnutls-wolfssl-tests \
 "
 

recipes-support/gnutls-wolfssl/gnutls_%.bbappend

@@ -36,6 +36,7 @@ EXTRA_OECONF:class-target = "\
     --disable-valgrind-tests \
     --disable-dependency-tracking \
     --enable-srp-authentication \
+    --enable-fips140-mode \
 "
 
 TARGET_CFLAGS:append:class-target = " -DGNUTLS_WOLFSSL"

recipes-support/gnutls-wolfssl/wolfssl_%.bbappend

@@ -2,34 +2,19 @@
 
 EXTRA_OECONF += " \
     --enable-cmac \
-    --with-eccminsz=192 \
-    --enable-ed25519 \
-    --enable-ed448 \
-    --enable-md5 \
-    --enable-curve25519 \
-    --enable-curve448 \
     --enable-aesccm \
-    --enable-aesxts \
-    --enable-aescfb \
     --enable-keygen \
-    --enable-shake128 \
-    --enable-shake256 \
-    --enable-reproducible-build \
+    --enable-fips=v5 \
 "
 
 TARGET_CFLAGS += " \
     -DWOLFSSL_PUBLIC_ASN \
+    -DHAVE_PUBLIC_FFDHE \
     -DHAVE_FFDHE_3072 \
     -DHAVE_FFDHE_4096 \
     -DWOLFSSL_DH_EXTRA \
     -DWOLFSSL_PSS_SALT_LEN_DISCOVER \
     -DWOLFSSL_PUBLIC_MP \
     -DWOLFSSL_RSA_KEY_CHECK \
-    -DHAVE_FFDHE_Q \
-    -DHAVE_FFDHE_6144 \
-    -DHAVE_FFDHE_8192 \
-    -DWOLFSSL_ECDSA_DETERMINISTIC_K \
-    -DWOLFSSL_VALIDATE_ECC_IMPORT \
-    -DRSA_MIN_SIZE=1024 \
-    -DWOLFSSL_AES_COUNTER \
+    -DNO_MD5 \
 "

recipes-wolfssl/wolfssl/commercial/wolfssl_%.bbappend

@@ -27,4 +27,20 @@ python() {
     else:
         # For Kirkstone and later
         d.appendVar('do_configure:prepend', autogen_create)
+
+    # Install wolfcrypttest binary
+    wolfcrypt_test_dir = '${B}/wolfcrypt/test/.libs'
+    wolfcrypt_test = 'testwolfcrypt'
+    wolfcrypt_test_yocto = 'wolfcrypttest'
+    wolfcrypt_install_dir = '${D}${bindir}'
+
+    bbnote = 'bbnote "Installing wolfCrypt Tests"\n'
+    installDir = 'install -m 0755 -d "%s"\n' % (wolfcrypt_install_dir)
+    cpTest = 'if [ -f "%s/%s" ]; then cp "%s/%s" "%s/%s"; fi\n' % (wolfcrypt_test_dir, wolfcrypt_test, wolfcrypt_test_dir, wolfcrypt_test, wolfcrypt_install_dir, wolfcrypt_test_yocto)
+
+    d.appendVar('do_install', bbnote)
+    d.appendVar('do_install', installDir)
+    d.appendVar('do_install', cpTest)
 }
+
+TARGET_CFLAGS += "-DUSE_CERT_BUFFERS_2048 -DUSE_CERT_BUFFERS_256 -DWOLFSSL_RSA_KEY_CHECK -DNO_WRITE_TEMP_FILES"