From 885c99c46223625ef14f2bc6022f2ec83558fa37 Mon Sep 17 00:00:00 2001 From: Test User Date: Wed, 12 Nov 2025 14:41:48 -0800 Subject: [PATCH] Combine refactor changes and add replace default and fips modes --- conf/layer.conf | 3 +- ...sl-enable-wolfprovider-replace-default.inc | 49 +++++++++++++ .../openssl/openssl-enable-wolfprovider.inc | 3 + .../wolfssl-enable-wolfprovider-fips.inc | 5 ++ .../wolfssl-enable-wolfprovider.inc | 2 +- .../openssl_%.bbappend | 4 + .../wolfssl_%.bbappend | 5 +- recipes-wolfssl/wolfprovider/README.md | 73 ++++++++++++++----- .../wolfprovider/openssl_3.%.bbappend | 18 +++++ .../wolfprovider/wolfprovider_1.1.0.bb | 17 ++--- 10 files changed, 146 insertions(+), 33 deletions(-) create mode 100644 inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc create mode 100644 inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc diff --git a/conf/layer.conf b/conf/layer.conf index df6cdb9..1fdbfac 100644 --- a/conf/layer.conf +++ b/conf/layer.conf @@ -80,7 +80,8 @@ BBFILES += "${LAYERDIR}/recipes-wolfssl/wolfssl/*.bb \ BBFILE_COLLECTIONS += "wolfssl" BBFILE_PATTERN_wolfssl := "^${LAYERDIR}/" -BBFILE_PRIORITY_wolfssl = "5" +# When doing a build with replace default mode enabled, we need to prioritize the wolfssl layer +BBFILE_PRIORITY_wolfssl = "60" # Weak default preferred providers for wolf libraries # These can be overridden by local.conf or distro configurations diff --git a/inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc b/inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc new file mode 100644 index 0000000..dfd9a32 --- /dev/null +++ b/inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc @@ -0,0 +1,49 @@ +# OpenSSL wolfProvider REPLACE-DEFAULT mode configuration +# This file is included when wolfProvider is configured to replace OpenSSL's default crypto provider +# It should be included from the image recipe when replace-default mode is desired + +# Build OpenSSL as plain, non-FIPS OpenSSL +# wolfProvider will provide FIPS functionality using wolfSSL FIPS +PACKAGECONFIG:class-target:pn-openssl = "" +EXTRA_OECONF:append:class-target = " no-fips" + +# OpenSSL target-only tweaks for replace-default mode +do_configure:prepend:class-target () { + set -eu + + # Be explicit about where we are + echo "TARGET do_configure prepend: S='${S}', B='${B}'" + + vfile="${S}/VERSION.dat" + + # Sanity check: VERSION.dat must exist at the top of the OpenSSL tree + if [ ! -f $vfile ]; then + echo "ERROR: $vfile not found in ${S}" >&2 + exit 1 + fi + + echo "Injecting BUILD_METADATA into VERSION.dat (target only)" + sed -i 's/^BUILD_METADATA=.*/BUILD_METADATA=wolfProvider/' $vfile + + # Optional FIPS tag based on image features + if echo "${IMAGE_FEATURES}" | grep -qw "fips"; then + sed -i 's/^BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/' $vfile + fi +} + +# Ensure provider is present on TARGET runtime (doesn't touch -native/-nativesdk) +RDEPENDS:libcrypto3:append:class-target = " wolfprovider" + +# Bring in the replace-default patch (target only) +SRC_URI:append:class-target = " \ + git://github.com/wolfSSL/wolfProvider.git;protocol=https;nobranch=1;rev=v1.1.0;destsuffix=git/wolfProvider \ +" + +python do_patch:append:class-target () { + import os, subprocess + s = d.getVar("S") + patch_path = os.path.join(d.getVar("WORKDIR"), "git/wolfProvider/patches/openssl3-replace-default.patch") + bb.note("REPLACE-DEFAULT MODE: Applying replace-default patch") + subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path], check=True) +} + diff --git a/inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc b/inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc index 0e0c9e1..a46a4d8 100644 --- a/inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc +++ b/inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc @@ -1,2 +1,5 @@ +# OpenSSL standalone wolfProvider mode configuration +# Include this file for standard wolfProvider integration as a provider plugin + EXTRA_OECONF += " no-fips shared " diff --git a/inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc b/inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc new file mode 100644 index 0000000..a8a7665 --- /dev/null +++ b/inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc @@ -0,0 +1,5 @@ +# Configuration to enable wolfprovider FIPS support in wolfssl + +EXTRA_OECONF += " --enable-opensslcoexist --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf --enable-compkey --enable-certgen --enable-aeskeywrap --enable-enckeys --enable-base16 " +TARGET_CFLAGS += " -DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DHAVE_PUBLIC_FFDHE -DWOLFSSL_DH_EXTRA -DRSA_MIN_SIZE=1024 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER" + diff --git a/inc/wolfprovider/wolfssl-enable-wolfprovider.inc b/inc/wolfprovider/wolfssl-enable-wolfprovider.inc index addd53c..40f84fc 100644 --- a/inc/wolfprovider/wolfssl-enable-wolfprovider.inc +++ b/inc/wolfprovider/wolfssl-enable-wolfprovider.inc @@ -1,5 +1,5 @@ # Configuration to enable wolfprovider support in wolfssl + EXTRA_OECONF += " --enable-opensslcoexist --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf --enable-compkey --enable-certgen --enable-aeskeywrap --enable-enckeys --enable-base16 " TARGET_CFLAGS += " -DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DHAVE_PUBLIC_FFDHE -DWOLFSSL_DH_EXTRA -DRSA_MIN_SIZE=1024" -TARGET_CFLAGS += " ${@'-DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER' if d.getVar('WOLFSSL_TYPE') not in ("fips", "fips-ready") else ''}" diff --git a/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend b/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend index dc8c149..ee83200 100644 --- a/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend +++ b/recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend @@ -1,6 +1,10 @@ # Manual configuration for wolfprovider-image-minimal # Configure OpenSSL for wolfProvider support +# WARNING: need to specify replace default or standalone mode not both +# Uncomment this to use wolfProvider in standalone mode require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc +# Uncomment this to use wolfProvider in replace-default mode +# require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc diff --git a/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend b/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend index 0f46065..ad3471a 100644 --- a/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend +++ b/recipes-core/images/wolfprovider-image-minimal/wolfssl_%.bbappend @@ -1,6 +1,9 @@ # Manual configuration for wolfprovider-image-minimal # Enable wolfProvider support in wolfSSL +# WARNING: need to specify non-FIPS or FIPS mode not both +# Uncomment this to use wolfProvider non-FIPS require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/wolfssl-enable-wolfprovider.inc - +# Uncomment this to use wolfProvider FIPS +# require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc diff --git a/recipes-wolfssl/wolfprovider/README.md b/recipes-wolfssl/wolfprovider/README.md index 28528db..9435f66 100644 --- a/recipes-wolfssl/wolfprovider/README.md +++ b/recipes-wolfssl/wolfprovider/README.md @@ -36,44 +36,81 @@ The `wolfprovidertest` yocto package will provide two apps, `wolfproviderenv` an 3. **Add wolfprovider to your image**: - Modify your image recipe or `local.conf` file to include `wolfprovider`, `wolfssl`, `openssl`, `openssl-bin`, and `wolfprovidertest`. You will only need `openssl-bin` and `wolfprovidertest` if you want to use and test with our included example and conf file. - - - For yocto kirkstone or newer: - ``` - IMAGE_INSTALL:append = "wolfprovider wolfssl openssl openssl-bin wolfprovidertest" + Enable the wolfprovider demo image in your `local.conf` file: + ```bitbake + WOLFSSL_DEMOS = "wolfprovider-image-minimal" ``` - For yocto dunfell or earlier: - ``` - IMAGE_INSTALL_append = "wolfprovider wolfssl openssl openssl-bin wolfprovidertest" +4. **Configure wolfProvider Mode (Optional)**: + + wolfProvider can operate in two modes: + + **Normal Mode (Default)**: wolfProvider acts as a supplementary provider alongside OpenSSL's default provider. No configuration needed. + + **Replace-Default Mode**: wolfProvider replaces OpenSSL's default provider by patching OpenSSL, making wolfSSL the primary crypto backend. + + To enable replace-default mode, simply uncomment the mode you want in the `.inc` files here `recipes-core/images/wolfprovider-image-minimal/openssl_%.bbappend` + + to rebuild with replace default we need to run a clean on the wolfprovider and openssl then rebuild: + + ```sh + bitbake -c cleanall openssl wolfprovider + bitbake wolfprovider-image-minimal ``` -4. **Build Your Image**: +5. **Build Your Image**: With the `meta-wolfssl` layer added and the necessary packages included in your image configuration, proceed to build your Yocto image as usual. ```sh - bitbake + bitbake wolfprovider-image-minimal ``` ### Testing wolfprovider -After building and deploying your image to the target device, you can test `wolfprovider` functionality through the `wolfproviderenv` script. +After building and deploying your image to the target device, you can test `wolfprovider` functionality with three test suites: -1. **Execute the wolfproviderenv Script**: - - `wolfproviderenv` is located in `/usr/bin`, so just execute the script upon entering into your terminal. +1. **Environment Setup and Verification**: ```sh wolfproviderenv ``` + + This sets up the environment and verifies wolfProvider is correctly installed and loaded. It automatically detects replace-default mode. - The script performs necessary setup actions, executes `wolfprovidertest` to validate the integration, and lists available OpenSSL providers to confirm `wolfprovider` is active and correctly configured. +2. **Unit Tests**: -2. **Expected Output**: + ```sh + wolfprovidertest + ``` + + Runs the comprehensive wolfProvider unit test suite from the upstream wolfProvider repository. Tests cover all cryptographic operations. - Look for messages indicating a successful environment setup, execution of `wolfprovidertest` with a custom provider loaded successfully, and `libwolfprovider` listed among active OpenSSL providers. +3. **Command-Line Tests**: + + ```sh + wolfprovidercmd + ``` + + Runs OpenSSL command-line tests including: + - Hash operations (SHA, MD5, etc.) + - AES encryption/decryption + - RSA operations + - ECC operations + - Certificate operations + +### Demo Image + +A demo image is provided to verify wolfProvider works: + +**wolfprovider-image-minimal**: Demonstrates wolfProvider with all test suites +```bash +# In local.conf +WOLFSSL_DEMOS = "wolfprovider-image-minimal" + +# Build +bitbake wolfprovider-image-minimal +``` ### Documentation and Support diff --git a/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend b/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend index c62bfaf..4839773 100644 --- a/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend +++ b/recipes-wolfssl/wolfprovider/openssl_3.%.bbappend @@ -1,7 +1,25 @@ inherit wolfssl-helper python __anonymous() { + # standalone wolfssl_conditional_require(d, 'wolfprovider', 'inc/wolfprovider/openssl/openssl-enable-wolfprovider.inc') + # replace default + wolfssl_conditional_require(d, 'wolfprovider', 'inc/wolfprovider/openssl/openssl-enable-wolfprovider-replace-default.inc') + + # non-FIPS mode + wolfssl_osp_conditional_include( + d, + feature_name='wolfprovider', + inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider.inc', + allowed_providers=['wolfssl'] + ) + # FIPS mode + wolfssl_osp_conditional_include( + d, + feature_name='wolfprovider', + inc_file='inc/wolfprovider/wolfssl-enable-wolfprovider-fips.inc', + allowed_providers=['wolfssl-fips'] + ) } # OpenSSL is a dependency of wolfprovider, not a direct image package diff --git a/recipes-wolfssl/wolfprovider/wolfprovider_1.1.0.bb b/recipes-wolfssl/wolfprovider/wolfprovider_1.1.0.bb index 9999226..d24b773 100644 --- a/recipes-wolfssl/wolfprovider/wolfprovider_1.1.0.bb +++ b/recipes-wolfssl/wolfprovider/wolfprovider_1.1.0.bb @@ -22,16 +22,8 @@ inherit autotools pkgconfig wolfssl-helper S = "${WORKDIR}/git" -# Pass replace-default mode to runtime +# Core build configuration do_install:append() { - install -d ${D}${sysconfdir}/wolfprovider - if [ "${WOLFPROVIDER_REPLACE_DEFAULT}" = "1" ]; then - echo "1" > ${D}${sysconfdir}/wolfprovider/replace-default-mode - else - echo "0" > ${D}${sysconfdir}/wolfprovider/replace-default-mode - fi - - # Create symlink for unversioned .so install -d ${D}${libdir} ln -sf libwolfprov.so.0.0.0 ${D}${libdir}/libwolfprov.so } @@ -47,8 +39,9 @@ FILES_SOLIBSDEV = "" # Explicitly list what goes to -dev instead (headers, pc) FILES:${PN}-dev = "${includedir} ${libdir}/pkgconfig/*.pc" -# Ensure the symlink and config are assigned to runtime -FILES:${PN} += "${libdir}/libwolfprov.so ${sysconfdir}/wolfprovider/replace-default-mode" +# Ensure the symlink is assigned to runtime +FILES:${PN} += "${libdir}/libwolfprov.so" # Shipping an unversioned .so in runtime: suppress QA warning -INSANE_SKIP:${PN} += "dev-so" \ No newline at end of file +INSANE_SKIP:${PN} += "dev-so" +