Combine refactor changes and add replace default and fips modes
Test User
night1rider
parent
871848e991
commit
885c99c462
|
|
@ -80,7 +80,8 @@ BBFILES += "${LAYERDIR}/recipes-wolfssl/wolfssl/*.bb \
|
|||
|
||||
BBFILE_COLLECTIONS += "wolfssl"
|
||||
BBFILE_PATTERN_wolfssl := "^${LAYERDIR}/"
|
||||
BBFILE_PRIORITY_wolfssl = "5"
|
||||
# When doing a build with replace default mode enabled, we need to prioritize the wolfssl layer
|
||||
BBFILE_PRIORITY_wolfssl = "60"
|
||||
|
||||
# Weak default preferred providers for wolf libraries
|
||||
# These can be overridden by local.conf or distro configurations
|
||||
|
|
|
|||
|
|
@ -0,0 +1,49 @@
|
|||
# OpenSSL wolfProvider REPLACE-DEFAULT mode configuration
|
||||
# This file is included when wolfProvider is configured to replace OpenSSL's default crypto provider
|
||||
# It should be included from the image recipe when replace-default mode is desired
|
||||
|
||||
# Build OpenSSL as plain, non-FIPS OpenSSL
|
||||
# wolfProvider will provide FIPS functionality using wolfSSL FIPS
|
||||
PACKAGECONFIG:class-target:pn-openssl = ""
|
||||
EXTRA_OECONF:append:class-target = " no-fips"
|
||||
|
||||
# OpenSSL target-only tweaks for replace-default mode
|
||||
do_configure:prepend:class-target () {
|
||||
set -eu
|
||||
|
||||
# Be explicit about where we are
|
||||
echo "TARGET do_configure prepend: S='${S}', B='${B}'"
|
||||
|
||||
vfile="${S}/VERSION.dat"
|
||||
|
||||
# Sanity check: VERSION.dat must exist at the top of the OpenSSL tree
|
||||
if [ ! -f $vfile ]; then
|
||||
echo "ERROR: $vfile not found in ${S}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Injecting BUILD_METADATA into VERSION.dat (target only)"
|
||||
sed -i 's/^BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/' $vfile
|
||||
|
||||
# Optional FIPS tag based on image features
|
||||
if echo "${IMAGE_FEATURES}" | grep -qw "fips"; then
|
||||
sed -i 's/^BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/' $vfile
|
||||
fi
|
||||
}
|
||||
|
||||
# Ensure provider is present on TARGET runtime (doesn't touch -native/-nativesdk)
|
||||
RDEPENDS:libcrypto3:append:class-target = " wolfprovider"
|
||||
|
||||
# Bring in the replace-default patch (target only)
|
||||
SRC_URI:append:class-target = " \
|
||||
git://github.com/wolfSSL/wolfProvider.git;protocol=https;nobranch=1;rev=v1.1.0;destsuffix=git/wolfProvider \
|
||||
"
|
||||
|
||||
python do_patch:append:class-target () {
|
||||
import os, subprocess
|
||||
s = d.getVar("S")
|
||||
patch_path = os.path.join(d.getVar("WORKDIR"), "git/wolfProvider/patches/openssl3-replace-default.patch")
|
||||
bb.note("REPLACE-DEFAULT MODE: Applying replace-default patch")
|
||||
subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path], check=True)
|
||||
}
|
||||
|
||||
|
|
@ -1,2 +1,5 @@
|
|||
# OpenSSL standalone wolfProvider mode configuration
|
||||
# Include this file for standard wolfProvider integration as a provider plugin
|
||||
|
||||
EXTRA_OECONF += " no-fips shared "
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,5 @@
|
|||
# Configuration to enable wolfprovider FIPS support in wolfssl
|
||||
|
||||
EXTRA_OECONF += " --enable-opensslcoexist --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf --enable-compkey --enable-certgen --enable-aeskeywrap --enable-enckeys --enable-base16 "
|
||||
TARGET_CFLAGS += " -DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DHAVE_PUBLIC_FFDHE -DWOLFSSL_DH_EXTRA -DRSA_MIN_SIZE=1024 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER"
|
||||
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
# Configuration to enable wolfprovider support in wolfssl
|
||||
|
||||
EXTRA_OECONF += " --enable-opensslcoexist --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf --enable-compkey --enable-certgen --enable-aeskeywrap --enable-enckeys --enable-base16 "
|
||||
TARGET_CFLAGS += " -DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DHAVE_PUBLIC_FFDHE -DWOLFSSL_DH_EXTRA -DRSA_MIN_SIZE=1024"
|
||||
TARGET_CFLAGS += " ${@'-DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER' if d.getVar('WOLFSSL_TYPE') not in ("fips", "fips-ready") else ''}"
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,10 @@
|
|||
# Manual configuration for wolfprovider-image-minimal
|
||||
# Configure OpenSSL for wolfProvider support
|
||||
|
||||
# WARNING: need to specify replace default or standalone mode not both
|
||||
# Uncomment this to use wolfProvider in standalone mode
|
||||
require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc
|
||||
# Uncomment this to use wolfProvider in replace-default mode
|
||||
# require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,9 @@
|
|||
# Manual configuration for wolfprovider-image-minimal
|
||||
# Enable wolfProvider support in wolfSSL
|
||||
|
||||
# WARNING: need to specify non-FIPS or FIPS mode not both
|
||||
# Uncomment this to use wolfProvider non-FIPS
|
||||
require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/wolfssl-enable-wolfprovider.inc
|
||||
|
||||
# Uncomment this to use wolfProvider FIPS
|
||||
# require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc
|
||||
|
||||
|
|
|
|||
|
|
@ -36,44 +36,81 @@ The `wolfprovidertest` yocto package will provide two apps, `wolfproviderenv` an
|
|||
|
||||
3. **Add wolfprovider to your image**:
|
||||
|
||||
Modify your image recipe or `local.conf` file to include `wolfprovider`, `wolfssl`, `openssl`, `openssl-bin`, and `wolfprovidertest`. You will only need `openssl-bin` and `wolfprovidertest` if you want to use and test with our included example and conf file.
|
||||
|
||||
|
||||
For yocto kirkstone or newer:
|
||||
```
|
||||
IMAGE_INSTALL:append = "wolfprovider wolfssl openssl openssl-bin wolfprovidertest"
|
||||
Enable the wolfprovider demo image in your `local.conf` file:
|
||||
```bitbake
|
||||
WOLFSSL_DEMOS = "wolfprovider-image-minimal"
|
||||
```
|
||||
|
||||
For yocto dunfell or earlier:
|
||||
```
|
||||
IMAGE_INSTALL_append = "wolfprovider wolfssl openssl openssl-bin wolfprovidertest"
|
||||
4. **Configure wolfProvider Mode (Optional)**:
|
||||
|
||||
wolfProvider can operate in two modes:
|
||||
|
||||
**Normal Mode (Default)**: wolfProvider acts as a supplementary provider alongside OpenSSL's default provider. No configuration needed.
|
||||
|
||||
**Replace-Default Mode**: wolfProvider replaces OpenSSL's default provider by patching OpenSSL, making wolfSSL the primary crypto backend.
|
||||
|
||||
To enable replace-default mode, simply uncomment the mode you want in the `.inc` files here `recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend`
|
||||
|
||||
to rebuild with replace default we need to run a clean on the wolfprovider and openssl then rebuild:
|
||||
|
||||
```sh
|
||||
bitbake -c cleanall openssl wolfprovider
|
||||
bitbake wolfprovider-image-minimal
|
||||
```
|
||||
|
||||
4. **Build Your Image**:
|
||||
5. **Build Your Image**:
|
||||
|
||||
With the `meta-wolfssl` layer added and the necessary packages included in your image configuration, proceed to build your Yocto image as usual.
|
||||
|
||||
```sh
|
||||
bitbake <your_image_recipe_name>
|
||||
bitbake wolfprovider-image-minimal
|
||||
```
|
||||
|
||||
### Testing wolfprovider
|
||||
|
||||
After building and deploying your image to the target device, you can test `wolfprovider` functionality through the `wolfproviderenv` script.
|
||||
After building and deploying your image to the target device, you can test `wolfprovider` functionality with three test suites:
|
||||
|
||||
1. **Execute the wolfproviderenv Script**:
|
||||
|
||||
`wolfproviderenv` is located in `/usr/bin`, so just execute the script upon entering into your terminal.
|
||||
1. **Environment Setup and Verification**:
|
||||
|
||||
```sh
|
||||
wolfproviderenv
|
||||
```
|
||||
|
||||
This sets up the environment and verifies wolfProvider is correctly installed and loaded. It automatically detects replace-default mode.
|
||||
|
||||
The script performs necessary setup actions, executes `wolfprovidertest` to validate the integration, and lists available OpenSSL providers to confirm `wolfprovider` is active and correctly configured.
|
||||
2. **Unit Tests**:
|
||||
|
||||
2. **Expected Output**:
|
||||
```sh
|
||||
wolfprovidertest
|
||||
```
|
||||
|
||||
Runs the comprehensive wolfProvider unit test suite from the upstream wolfProvider repository. Tests cover all cryptographic operations.
|
||||
|
||||
Look for messages indicating a successful environment setup, execution of `wolfprovidertest` with a custom provider loaded successfully, and `libwolfprovider` listed among active OpenSSL providers.
|
||||
3. **Command-Line Tests**:
|
||||
|
||||
```sh
|
||||
wolfprovidercmd
|
||||
```
|
||||
|
||||
Runs OpenSSL command-line tests including:
|
||||
- Hash operations (SHA, MD5, etc.)
|
||||
- AES encryption/decryption
|
||||
- RSA operations
|
||||
- ECC operations
|
||||
- Certificate operations
|
||||
|
||||
### Demo Image
|
||||
|
||||
A demo image is provided to verify wolfProvider works:
|
||||
|
||||
**wolfprovider-image-minimal**: Demonstrates wolfProvider with all test suites
|
||||
```bash
|
||||
# In local.conf
|
||||
WOLFSSL_DEMOS = "wolfprovider-image-minimal"
|
||||
|
||||
# Build
|
||||
bitbake wolfprovider-image-minimal
|
||||
```
|
||||
|
||||
### Documentation and Support
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,25 @@
|
|||
inherit wolfssl-helper
|
||||
|
||||
python __anonymous() {
|
||||
# standalone
|
||||
wolfssl_conditional_require(d, 'wolfprovider', 'inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc')
|
||||
# replace default
|
||||
wolfssl_conditional_require(d, 'wolfprovider', 'inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc')
|
||||
|
||||
# non-FIPS mode
|
||||
wolfssl_osp_conditional_include(
|
||||
d,
|
||||
feature_name='wolfprovider',
|
||||
inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider.inc',
|
||||
allowed_providers=['wolfssl']
|
||||
)
|
||||
# FIPS mode
|
||||
wolfssl_osp_conditional_include(
|
||||
d,
|
||||
feature_name='wolfprovider',
|
||||
inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc',
|
||||
allowed_providers=['wolfssl-fips']
|
||||
)
|
||||
}
|
||||
|
||||
# OpenSSL is a dependency of wolfprovider, not a direct image package
|
||||
|
|
|
|||
|
|
@ -22,16 +22,8 @@ inherit autotools pkgconfig wolfssl-helper
|
|||
|
||||
S = "${WORKDIR}/git"
|
||||
|
||||
# Pass replace-default mode to runtime
|
||||
# Core build configuration
|
||||
do_install:append() {
|
||||
install -d ${D}${sysconfdir}/wolfprovider
|
||||
if [ "${WOLFPROVIDER_REPLACE_DEFAULT}" = "1" ]; then
|
||||
echo "1" > ${D}${sysconfdir}/wolfprovider/replace-default-mode
|
||||
else
|
||||
echo "0" > ${D}${sysconfdir}/wolfprovider/replace-default-mode
|
||||
fi
|
||||
|
||||
# Create symlink for unversioned .so
|
||||
install -d ${D}${libdir}
|
||||
ln -sf libwolfprov.so.0.0.0 ${D}${libdir}/libwolfprov.so
|
||||
}
|
||||
|
|
@ -47,8 +39,9 @@ FILES_SOLIBSDEV = ""
|
|||
# Explicitly list what goes to -dev instead (headers, pc)
|
||||
FILES:${PN}-dev = "${includedir} ${libdir}/pkgconfig/*.pc"
|
||||
|
||||
# Ensure the symlink and config are assigned to runtime
|
||||
FILES:${PN} += "${libdir}/libwolfprov.so ${sysconfdir}/wolfprovider/replace-default-mode"
|
||||
# Ensure the symlink is assigned to runtime
|
||||
FILES:${PN} += "${libdir}/libwolfprov.so"
|
||||
|
||||
# Shipping an unversioned .so in runtime: suppress QA warning
|
||||
INSANE_SKIP:${PN} += "dev-so"
|
||||
INSANE_SKIP:${PN} += "dev-so"
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue