Merge pull request #83 from night1rider/wolfprovider
Adding wolfprovider/engine recipes and a usage example/testpull/84/head
JacobBarthelmeh
GitHub
commit
8bcfb2eab3
|
|
@ -359,6 +359,14 @@ to add a DNS server to /etc/resolv.conf like such with root perms
|
||||||
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
|
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
|
||||||
```
|
```
|
||||||
|
|
||||||
|
wolfProvider
|
||||||
|
------------
|
||||||
|
To build wolfProvider view the instructions in this [README](recipes-wolfssl/wolfprovider/README.md)
|
||||||
|
|
||||||
|
wolfEngine
|
||||||
|
------------
|
||||||
|
To build wolfEngine view the instructions in this [README](recipes-wolfssl/wolfengine/README.md)
|
||||||
|
|
||||||
FIPS-READY
|
FIPS-READY
|
||||||
----------
|
----------
|
||||||
For building FIPS-Ready for wolfSSL view the instruction in this [README](recipes-wolfssl/wolfssl/fips-ready/README.md)
|
For building FIPS-Ready for wolfSSL view the instruction in this [README](recipes-wolfssl/wolfssl/fips-ready/README.md)
|
||||||
|
|
|
||||||
|
|
@ -91,6 +91,27 @@ BBFILES += "${@bb.utils.contains('IMAGE_INSTALL', \
|
||||||
'', d)}"
|
'', d)}"
|
||||||
|
|
||||||
|
|
||||||
|
BBFILES += "${@bb.utils.contains('IMAGE_INSTALL', \
|
||||||
|
'wolfprovider', \
|
||||||
|
'${LAYERDIR}/recipes-wolfssl/wolfprovider/*.bb ${LAYERDIR}/recipes-wolfssl/wolfprovider/*.bbappend', \
|
||||||
|
'', d)}"
|
||||||
|
|
||||||
|
BBFILES += "${@bb.utils.contains('IMAGE_INSTALL', \
|
||||||
|
'wolfprovidertest', \
|
||||||
|
'${LAYERDIR}/recipes-examples/wolfprovider/wolfprovidertest/*.bb', \
|
||||||
|
'', d)}"
|
||||||
|
|
||||||
|
BBFILES += "${@bb.utils.contains('IMAGE_INSTALL', \
|
||||||
|
'wolfengine', \
|
||||||
|
'${LAYERDIR}/recipes-wolfssl/wolfengine/*.bb ${LAYERDIR}/recipes-wolfssl/wolfengine/*.bbappend', \
|
||||||
|
'', d)}"
|
||||||
|
|
||||||
|
BBFILES += "${@bb.utils.contains('IMAGE_INSTALL', \
|
||||||
|
'wolfenginetest', \
|
||||||
|
'${LAYERDIR}/recipes-examples/wolfengine/wolfenginetest/*.bb ${LAYERDIR}/recipes-examples/wolfengine/wolfenginetest/*.bbappend', \
|
||||||
|
'', d)}"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Uncomment if building bind with wolfSSL.
|
# Uncomment if building bind with wolfSSL.
|
||||||
#BBFILES += "${LAYERDIR}/recipes-connectivity/bind/*.bbappend"
|
#BBFILES += "${LAYERDIR}/recipes-connectivity/bind/*.bbappend"
|
||||||
|
|
@ -159,6 +180,10 @@ BBFILES += "${@bb.utils.contains('WOLFTPM_TYPE', \
|
||||||
'${LAYERDIR}/recipes-wolfssl/wolftpm/commercial/*.bbappend ${LAYERDIR}/recipes-wolfssl/wolftpm/commercial/commercial-details/*.bbappend', \
|
'${LAYERDIR}/recipes-wolfssl/wolftpm/commercial/*.bbappend ${LAYERDIR}/recipes-wolfssl/wolftpm/commercial/commercial-details/*.bbappend', \
|
||||||
'', d)}"
|
'', d)}"
|
||||||
|
|
||||||
|
BBFILES += "${@bb.utils.contains('WOLFENGINE_TYPE', \
|
||||||
|
'commercial', \
|
||||||
|
'${LAYERDIR}/recipes-wolfssl/wolfengine/commercial/*.bbappend ${LAYERDIR}/recipes-wolfssl/wolfengine/commercial/commercial-details/*.bbappend', \
|
||||||
|
'', d)}"
|
||||||
|
|
||||||
# Versions of OpenEmbedded-Core which layer has been tested against
|
# Versions of OpenEmbedded-Core which layer has been tested against
|
||||||
LAYERSERIES_COMPAT_wolfssl = "sumo thud warrior zeus hardknott gatesgarth dunfell kirkstone nanbield"
|
LAYERSERIES_COMPAT_wolfssl = "sumo thud warrior zeus hardknott gatesgarth dunfell kirkstone nanbield"
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Setup for libwolfprov.so
|
||||||
|
mkdir -p /usr/lib/ssl-1.1/engines
|
||||||
|
if [ ! -L /usr/lib/ssl-1.1/engines/libwolfprov.so ]; then
|
||||||
|
ln -s /usr/lib/libwolfengine.so.1.0.4 /usr/lib/ssl-1.1/engines/libwolfengine.so
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Environment variables
|
||||||
|
export OPENSSL_ENGINES=/usr/lib/ssl-1.1/engines
|
||||||
|
export LD_LIBRARY_PATH=/usr/lib:/lib:$LD_LIBRARY_PATH
|
||||||
|
|
||||||
|
echo "Programmatic Test"
|
||||||
|
if wolfenginetest; then
|
||||||
|
echo "Passed!"
|
||||||
|
else
|
||||||
|
echo "Failed!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Environment and configuration setup is complete. Tests executed."
|
||||||
|
|
@ -0,0 +1,138 @@
|
||||||
|
/* engine_by_id_example.c
|
||||||
|
*
|
||||||
|
* Copyright (C) 2019-2023 wolfSSL Inc.
|
||||||
|
*
|
||||||
|
* This file is part of wolfengine.
|
||||||
|
*
|
||||||
|
* wolfengine is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 3 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* wolfengine is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
#include <openssl/engine.h>
|
||||||
|
|
||||||
|
/* From https://www.openssl.org/docs/man3.0/man3/EVP_MD_CTX_new.html:
|
||||||
|
*
|
||||||
|
* The EVP_MD_CTX_create() and EVP_MD_CTX_destroy() functions were renamed to
|
||||||
|
* EVP_MD_CTX_new() and EVP_MD_CTX_free() in OpenSSL 1.1.0, respectively.
|
||||||
|
*/
|
||||||
|
#if OPENSSL_VERSION_NUMBER < 0x10100000L
|
||||||
|
#define EVP_MD_CTX_new EVP_MD_CTX_create
|
||||||
|
#define EVP_MD_CTX_free EVP_MD_CTX_destroy
|
||||||
|
#endif
|
||||||
|
|
||||||
|
int main()
|
||||||
|
{
|
||||||
|
ENGINE* wolfEngine = NULL;
|
||||||
|
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
||||||
|
const char* engineID = "libwolfengine";
|
||||||
|
#else
|
||||||
|
const char* engineID = "wolfengine";
|
||||||
|
#endif
|
||||||
|
unsigned char someData[] = {0xDE, 0xAD, 0xBE, 0xEF};
|
||||||
|
unsigned char digest[SHA256_DIGEST_LENGTH];
|
||||||
|
unsigned int digestBufLen = sizeof(digest);
|
||||||
|
EVP_MD_CTX *ctx;
|
||||||
|
const EVP_MD* sha256 = EVP_sha256();
|
||||||
|
const EVP_MD* md5 = EVP_md5();
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Load OpenSSL's "dynamic" engine. This is an engine that loads other
|
||||||
|
* engines at runtime. It's used implicitly below to load wolfEngine.
|
||||||
|
*/
|
||||||
|
ENGINE_load_dynamic();
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Load wolfEngine. libwolfengine.so must be located in the directory
|
||||||
|
* pointed to by environment variable OPENSSL_ENGINES for this to succeed.
|
||||||
|
* For example, if you just ran "make" in the wolfEngine source code
|
||||||
|
* directory, .libs/ should contain libwolfengine.so.
|
||||||
|
*/
|
||||||
|
wolfEngine = ENGINE_by_id(engineID);
|
||||||
|
if (wolfEngine == NULL) {
|
||||||
|
fprintf(stderr, "ENGINE_by_id failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Turn on wolfEngine debug messages. These will print to stderr.
|
||||||
|
*/
|
||||||
|
if (ENGINE_ctrl_cmd(wolfEngine, "enable_debug", 1, NULL, NULL, 0) != 1) {
|
||||||
|
fprintf(stderr, "ENGINE_ctrl_cmd enable_debug failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Make wolfEngine the default engine for all algorithms it supports.
|
||||||
|
*/
|
||||||
|
ENGINE_set_default(wolfEngine, ENGINE_METHOD_ALL);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Compute a digest/hash over the data in the "someData" buffer. wolfEngine
|
||||||
|
* provides SHA-256, and since it's the default engine for everything it
|
||||||
|
* provides, we should see wolfEngine debug messages print out. If you
|
||||||
|
* don't see those messages, make sure wolfEngine was built with
|
||||||
|
* --enable-debug (-DWOLFENGINE_DEBUG).
|
||||||
|
*/
|
||||||
|
if ((ctx = EVP_MD_CTX_new()) == NULL) {
|
||||||
|
fprintf(stderr, "EVP_MD_CTX_new SHA-256 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
if (EVP_DigestInit(ctx, sha256) != 1) {
|
||||||
|
fprintf(stderr, "EVP_DigestInit SHA-256 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
if (EVP_DigestUpdate(ctx, someData, sizeof(someData)) != 1) {
|
||||||
|
fprintf(stderr, "EVP_DigestUpdate SHA-256 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
if (EVP_DigestFinal_ex(ctx, digest, &digestBufLen) != 1) {
|
||||||
|
fprintf(stderr, "EVP_DigestFinal_ex SHA-256 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
EVP_MD_CTX_free(ctx);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* MD5 is not considered a secure hash algorithm and isn't FIPS-approved.
|
||||||
|
* wolfEngine doesn't provide support for it. The digest computation below
|
||||||
|
* shouldn't print any wolfEngine debug messages. It will be handled by
|
||||||
|
* OpenSSL's non-FIPS-verified MD5 implementation.
|
||||||
|
*/
|
||||||
|
if ((ctx = EVP_MD_CTX_new()) == NULL) {
|
||||||
|
fprintf(stderr, "EVP_MD_CTX_new MD5 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
if (EVP_DigestInit(ctx, md5) != 1) {
|
||||||
|
fprintf(stderr, "EVP_DigestInit MD5 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
if (EVP_DigestUpdate(ctx, someData, sizeof(someData)) != 1) {
|
||||||
|
fprintf(stderr, "EVP_DigestUpdate MD5 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
if (EVP_DigestFinal_ex(ctx, digest, &digestBufLen) != 1) {
|
||||||
|
fprintf(stderr, "EVP_DigestFinal_ex MD5 failed.\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
EVP_MD_CTX_free(ctx);
|
||||||
|
|
||||||
|
ENGINE_free(wolfEngine);
|
||||||
|
|
||||||
|
printf("Everything worked!\n");
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
EXTRA_OECONF += " --enable-debug "
|
||||||
|
|
@ -0,0 +1,56 @@
|
||||||
|
SUMMARY = "Test program for custom OpenSSL engine "
|
||||||
|
DESCRIPTION = "Compiles and runs a test program to verify the functionality of the custom OpenSSL engine."
|
||||||
|
HOMEPAGE = "https://www.wolfssl.com"
|
||||||
|
SECTION = "examples"
|
||||||
|
LICENSE = "CLOSED"
|
||||||
|
LIC_FILES_CHKSUM = ""
|
||||||
|
|
||||||
|
DEPENDS = "openssl pkgconfig-native wolfssl wolfengine"
|
||||||
|
PROVIDES += "wolfenginetest"
|
||||||
|
|
||||||
|
WOLFENGINE_TEST = "${bindir}/wolfenginetest"
|
||||||
|
WOLFENGINE_ENV = "${bindir}/wolfenginetest"
|
||||||
|
|
||||||
|
SRC_URI = "file://wolfenginetest.c \
|
||||||
|
file://wolfengineenv.sh \
|
||||||
|
"
|
||||||
|
|
||||||
|
S = "${WORKDIR}"
|
||||||
|
|
||||||
|
inherit pkgconfig
|
||||||
|
|
||||||
|
do_compile() {
|
||||||
|
${CC} ${WORKDIR}/wolfenginetest.c -o wolfenginetest \
|
||||||
|
${CFLAGS} ${LDFLAGS} $(pkg-config --cflags --libs openssl) -ldl -lwolfssl -lwolfengine
|
||||||
|
}
|
||||||
|
|
||||||
|
do_install() {
|
||||||
|
install -d ${D}${bindir}
|
||||||
|
install -m 0755 ${WORKDIR}/wolfenginetest ${D}${bindir}/wolfenginetest
|
||||||
|
install -m 0755 ${WORKDIR}/wolfengineenv.sh ${D}${bindir}/wolfengineenv
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
python() {
|
||||||
|
distro_version = d.getVar('DISTRO_VERSION', True)
|
||||||
|
wolfengine_test = d.getVar('WOLFENGINE_TEST', True)
|
||||||
|
wolfengine_env = d.getVar('WOLFENGINE_ENV', True)
|
||||||
|
pn = d.getVar('PN', True)
|
||||||
|
if distro_version and (distro_version.startswith('2.') or distro_version.startswith('3.')):
|
||||||
|
files_var_name = 'FILES_' + pn
|
||||||
|
else:
|
||||||
|
files_var_name = 'FILES:' + pn
|
||||||
|
|
||||||
|
|
||||||
|
current_files = d.getVar(files_var_name, True) or ""
|
||||||
|
new_files = current_files + ' ' + wolfengine_test + ' ' + wolfengine_env
|
||||||
|
d.setVar(files_var_name, new_files)
|
||||||
|
|
||||||
|
rdepends_var_name = 'RDEPENDS_' + pn if (distro_version.startswith('2.') or distro_version.startswith('3.')) else 'RDEPENDS:' + pn
|
||||||
|
|
||||||
|
current_rdepends = d.getVar(rdepends_var_name, True) or ""
|
||||||
|
new_rdepends = current_rdepends + " bash"
|
||||||
|
d.setVar(rdepends_var_name, new_rdepends)
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,43 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Setup for libwolfprov.so
|
||||||
|
mkdir -p /usr/lib/ssl-3/modules
|
||||||
|
if [ ! -L /usr/lib/ssl-3/modules/libwolfprov.so ]; then
|
||||||
|
ln -s /usr/lib/libwolfprov.so.0.0.0 /usr/lib/ssl-3/modules/libwolfprov.so
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Environment variables
|
||||||
|
export OPENSSL_MODULES=/usr/lib/ssl-3/modules
|
||||||
|
export LD_LIBRARY_PATH=/usr/lib:/lib:$LD_LIBRARY_PATH
|
||||||
|
|
||||||
|
# Configuration for wolfprovider
|
||||||
|
mkdir -p /opt/wolfprovider-configs
|
||||||
|
cat > /opt/wolfprovider-configs/wolfprovider.conf <<EOF
|
||||||
|
openssl_conf = openssl_init
|
||||||
|
|
||||||
|
[openssl_init]
|
||||||
|
providers = provider_sect
|
||||||
|
|
||||||
|
[provider_sect]
|
||||||
|
libwolfprov = libwolfprov_sect
|
||||||
|
|
||||||
|
[libwolfprov_sect]
|
||||||
|
activate = 1
|
||||||
|
EOF
|
||||||
|
|
||||||
|
export OPENSSL_CONF="/opt/wolfprovider-configs/wolfprovider.conf"
|
||||||
|
|
||||||
|
# Execute the test program, assuming it's located in the same directory as this script
|
||||||
|
# Adjust the path as necessary depending on where the binary ends up
|
||||||
|
echo "Programmatic Test"
|
||||||
|
if wolfprovidertest; then
|
||||||
|
echo "Passed!"
|
||||||
|
else
|
||||||
|
echo "Failed!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "OpenSSL Conf Test"
|
||||||
|
openssl list -providers -verbose
|
||||||
|
|
||||||
|
echo "Environment and configuration setup is complete. Tests executed."
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <openssl/provider.h>
|
||||||
|
#include <openssl/err.h>
|
||||||
|
|
||||||
|
int main(void) {
|
||||||
|
OSSL_PROVIDER *prov = OSSL_PROVIDER_load(NULL, "libwolfprov");
|
||||||
|
if (!prov) {
|
||||||
|
ERR_print_errors_fp(stderr);
|
||||||
|
exit(EXIT_FAILURE);
|
||||||
|
}
|
||||||
|
printf("Custom provider 'libwolfprov' loaded successfully.\n");
|
||||||
|
OSSL_PROVIDER_unload(prov);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,46 @@
|
||||||
|
SUMMARY = "Test program for custom OpenSSL provider 'libwolfprov'"
|
||||||
|
DESCRIPTION = "Compiles and runs a test program to verify the functionality of the custom OpenSSL provider libwolfprov."
|
||||||
|
HOMEPAGE = "https://www.wolfssl.com"
|
||||||
|
SECTION = "examples"
|
||||||
|
LICENSE = "CLOSED"
|
||||||
|
LIC_FILES_CHKSUM = ""
|
||||||
|
|
||||||
|
DEPENDS = "openssl pkgconfig-native wolfssl wolfprovider"
|
||||||
|
PROVIDES += "wolfprovidertest"
|
||||||
|
RPROVIDES_${PN} = "wolfprovidertest"
|
||||||
|
|
||||||
|
|
||||||
|
SRC_URI = "file://wolfprovidertest.c \
|
||||||
|
file://wolfproviderenv.sh \
|
||||||
|
"
|
||||||
|
|
||||||
|
S = "${WORKDIR}"
|
||||||
|
|
||||||
|
inherit pkgconfig
|
||||||
|
|
||||||
|
do_compile() {
|
||||||
|
${CC} ${WORKDIR}/wolfprovidertest.c -o wolfprovidertest \
|
||||||
|
${CFLAGS} ${LDFLAGS} $(pkg-config --cflags --libs openssl) -ldl -lwolfssl -lwolfprov
|
||||||
|
}
|
||||||
|
|
||||||
|
do_install() {
|
||||||
|
install -d ${D}${bindir}
|
||||||
|
install -m 0755 ${WORKDIR}/wolfprovidertest ${D}${bindir}/wolfprovidertest
|
||||||
|
install -m 0755 ${WORKDIR}/wolfproviderenv.sh ${D}${bindir}/wolfproviderenv
|
||||||
|
}
|
||||||
|
|
||||||
|
FILES_${PN} += "${bindir}/wolfprovidertest \
|
||||||
|
${bindir}/wolfproviderenv \
|
||||||
|
"
|
||||||
|
|
||||||
|
# Dynamic RDEPENDS adjustment for bash
|
||||||
|
python() {
|
||||||
|
distro_version = d.getVar('DISTRO_VERSION', True)
|
||||||
|
pn = d.getVar('PN', True)
|
||||||
|
|
||||||
|
rdepends_var_name = 'RDEPENDS_' + pn if (distro_version.startswith('2.') or distro_version.startswith('3.')) else 'RDEPENDS:' + pn
|
||||||
|
|
||||||
|
current_rdepends = d.getVar(rdepends_var_name, True) or ""
|
||||||
|
new_rdepends = current_rdepends + " bash"
|
||||||
|
d.setVar(rdepends_var_name, new_rdepends)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,80 @@
|
||||||
|
# wolfEngine
|
||||||
|
|
||||||
|
The `wolfengine` recipe enables the integration of wolfSSL's cryptographic functionalities into OpenSSL through a custom engine mechanism. This integration allows applications using OpenSSL to leverage wolfSSL's advanced cryptographic algorithms, combining wolfSSL's lightweight and performance-optimized cryptography with OpenSSL's extensive API and capabilities. `wolfengine` is designed for easy integration into Yocto-based systems, ensuring a seamless blend of security and performance ideal for embedded and constrained environments.
|
||||||
|
|
||||||
|
The `wolfenginetest` yocto package will provide two apps, `wolfengineenv` and `wolfenginetest`. Running `wolfengineenv` will start up a child shell and run `wolfenginetest`. Use `wolfengineenv` to test that the `wolfengine` package is succesfully installed. If you want to run `wolfenginetest` directly you will need to directly source `wolfengineenv` via `source /usr/bin/wolfengineenv` or setup the env on your own, because `wolfenginetest` will fail otherwise. Use `wolfenginetest` to check that your shell env is correctly setup.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- A functioning Yocto Project environment (Dunfell or earlier recommended)
|
||||||
|
- OpenSSL versions 1.x.x, supporting the engine interface (Come by default with Dunfell or earlier)
|
||||||
|
- Access to the `meta-wolfssl` repository
|
||||||
|
|
||||||
|
### Integrating wolfengine with Yocto
|
||||||
|
|
||||||
|
1. **Clone the meta-wolfssl repository**:
|
||||||
|
|
||||||
|
Clone the `meta-wolfssl` repository into your Yocto project's sources directory if not already included in your project.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
git clone https://github.com/wolfSSL/meta-wolfssl.git
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Include meta-wolfssl in your bblayers.conf**:
|
||||||
|
|
||||||
|
Add `meta-wolfssl` to your `bblayers.conf` file to incorporate it into your build environment.
|
||||||
|
|
||||||
|
```bitbake
|
||||||
|
BBLAYERS ?= " \
|
||||||
|
...
|
||||||
|
/path/to/meta-wolfssl \
|
||||||
|
...
|
||||||
|
"
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Add wolfengine to your image**:
|
||||||
|
|
||||||
|
Modify your image recipe or `local.conf` file to include `wolfengine`, `wolfssl`, `openssl`, `openssl-bin`, and `wolfenginetest`. You will only need `openssl-bin` and `wolfenginetest` if you want to use and test with our included example and conf file.
|
||||||
|
|
||||||
|
For yocto kirkstone or newer:
|
||||||
|
```
|
||||||
|
IMAGE_INSTALL:append = "wolfengine wolfssl openssl openssl-bin wolfenginetest"
|
||||||
|
```
|
||||||
|
|
||||||
|
For yocto dunfell or earlier:
|
||||||
|
```
|
||||||
|
IMAGE_INSTALL_append = "wolfengine wolfssl openssl openssl-bin wolfenginetest"
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
4. **Build Your Image**:
|
||||||
|
|
||||||
|
With the `meta-wolfssl` layer added and the necessary packages included in your image configuration, proceed to build your Yocto image as usual.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
bitbake <your_image_recipe_name>
|
||||||
|
```
|
||||||
|
|
||||||
|
### Testing wolfengine
|
||||||
|
|
||||||
|
After building and deploying your image to the target device, you can test `wolfengine` functionality through the `wolfengineenv` script.
|
||||||
|
|
||||||
|
1. **Execute the wolfengineenv Script**:
|
||||||
|
|
||||||
|
`wolfengineenv` is located in `/usr/bin`, so just execute the script upon entering into your terminal.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
wolfengineenv
|
||||||
|
```
|
||||||
|
|
||||||
|
The script performs necessary setup actions, executes `wolfenginetest` to validate the integration.
|
||||||
|
|
||||||
|
2. **Expected Output**:
|
||||||
|
|
||||||
|
Look for messages indicating a successful environment setup, and execution of `wolfenginetest`.
|
||||||
|
|
||||||
|
### Documentation and Support
|
||||||
|
|
||||||
|
For further information about `wolfengine` and `wolfssl`, visit the [wolfSSL Documentation](https://www.wolfssl.com/docs/) and the [wolfEngine Github](https://www.github.com/wolfSSL/wolfengine). If you encounter issues or require support regarding the integration of `wolfengine` with Yocto, feel free to reach out through [wolfSSL Support](support@wolfssl.com).
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
#Adjust these as needed
|
||||||
|
WOLFENGINE_VERSION=""
|
||||||
|
|
||||||
|
WOLF_LICENSE="WolfSSL_LicenseAgmt_JAN-2022.pdf"
|
||||||
|
WOLF_LICENSE_MD5="be28609dc681e98236c52428fadf04dd"
|
||||||
|
WOLF_SRC=""
|
||||||
|
WOLF_SRC_SHA=""
|
||||||
|
WOLF_SRC_PASS=""
|
||||||
|
|
||||||
|
#Do not adjust these variables
|
||||||
|
PR = "commercial"
|
||||||
|
PV = "${WOLFENGINE_VERSION}"
|
||||||
|
|
||||||
|
BBFILE_PRIORITY='1'
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
# Directory for Commerical wolfEngine 7Zip Archives
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
This directory is designated for storing commercially licensed 7Zip archives of wolfEngine.
|
||||||
|
|
||||||
|
## Contact Information
|
||||||
|
|
||||||
|
For questions regarding obtaining a licensed version of wolfEngine,
|
||||||
|
please contact wolfSSL Inc. directly at:
|
||||||
|
|
||||||
|
Email: support@wolfssl.com
|
||||||
|
|
@ -0,0 +1,30 @@
|
||||||
|
BBFILE_PRIORITY='2'
|
||||||
|
COMMERCIAL_CONFIG_DIR := "${@os.path.dirname(d.getVar('FILE', True))}"
|
||||||
|
LICENSE="Proprietary"
|
||||||
|
LIC_FILES_CHKSUM="file://${WOLF_LICENSE};md5=${WOLF_LICENSE_MD5}"
|
||||||
|
|
||||||
|
SRC_URI="file://${COMMERCIAL_CONFIG_DIR}/files/${WOLF_SRC}.7z"
|
||||||
|
SRC_URI[sha256sum]="${WOLF_SRC_SHA}"
|
||||||
|
|
||||||
|
DEPENDS += "p7zip-native"
|
||||||
|
|
||||||
|
S = "${WORKDIR}/${WOLF_SRC}"
|
||||||
|
|
||||||
|
do_unpack[depends] += "p7zip-native:do_populate_sysroot"
|
||||||
|
|
||||||
|
do_unpack() {
|
||||||
|
cp -f "${FILE_DIRNAME}/commercial/files/${WOLF_SRC}.7z" "${WORKDIR}"
|
||||||
|
7za x "${WORKDIR}/${WOLF_SRC}.7z" -p"${WOLF_SRC_PASS}" -o"${WORKDIR}" -aoa
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
python() {
|
||||||
|
distro_version = d.getVar('DISTRO_VERSION', True)
|
||||||
|
autogen_create = 'echo -e "#!/bin/sh\nexit 0" > ${S}/autogen.sh && chmod +x ${S}/autogen.sh'
|
||||||
|
if distro_version and (distro_version.startswith('2.') or distro_version.startswith('3.')):
|
||||||
|
# For Dunfell and earlier
|
||||||
|
d.appendVar('do_configure_prepend', autogen_create)
|
||||||
|
else:
|
||||||
|
# For Kirkstone and later
|
||||||
|
d.appendVar('do_configure:prepend', autogen_create)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
EXTRA_OECONF += " shared "
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
SUMMARY = "wolfEngine is a cryptography engine for openSSL versions 1.X.X"
|
||||||
|
DESCRIPTION = "wolfEngine is an OpenSSL 1.X.X engine backed by wolfSSL's wolfCrypt cryptography library."
|
||||||
|
HOMEPAGE = "https://github.com/wolfSSL/wolfEngine"
|
||||||
|
BUGTRACKER = "https://github.com/wolfSSL/wolfEngine/issues"
|
||||||
|
SECTION = "libs"
|
||||||
|
LICENSE = "GPL-3.0-only"
|
||||||
|
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
|
||||||
|
DEPENDS += "util-linux-native"
|
||||||
|
|
||||||
|
PROVIDES += "wolfengine"
|
||||||
|
|
||||||
|
SRC_URI = "git://github.com/wolfssl/wolfengine.git;nobranch=1;protocol=https;rev=02c18e78d59c1e5a029c171a3879e99a145737ca"
|
||||||
|
|
||||||
|
|
||||||
|
S = "${WORKDIR}/git"
|
||||||
|
|
||||||
|
DEPENDS += " wolfssl \
|
||||||
|
openssl \
|
||||||
|
"
|
||||||
|
|
||||||
|
inherit autotools pkgconfig
|
||||||
|
|
||||||
|
OPENSSL_YOCTO_DIR = "${COMPONENTS_DIR}/${PACKAGE_ARCH}/openssl/usr"
|
||||||
|
WOLFSSL_YOCTO_DIR = "${COMPONENTS_DIR}/${PACKAGE_ARCH}/wolfssl/usr"
|
||||||
|
|
||||||
|
|
||||||
|
# Approach: Use Python to dynamically set function content based on Yocto version
|
||||||
|
python() {
|
||||||
|
distro_version = d.getVar('DISTRO_VERSION', True)
|
||||||
|
autogen_command = "cd ${S}; ./autogen.sh"
|
||||||
|
if distro_version and (distro_version.startswith('2.') or distro_version.startswith('3.')):
|
||||||
|
# For Dunfell and earlier
|
||||||
|
d.appendVar('do_configure_prepend', autogen_command)
|
||||||
|
else:
|
||||||
|
# For Kirkstone and later
|
||||||
|
d.appendVar('do_configure:prepend', autogen_command)
|
||||||
|
}
|
||||||
|
|
||||||
|
CFLAGS += " -I${S}/include -g0 -O2 -ffile-prefix-map=${WORKDIR}=."
|
||||||
|
CXXFLAGS += " -I${S}/include -g0 -O2 -ffile-prefix-map=${WORKDIR}=."
|
||||||
|
LDFLAGS += " -Wl,--build-id=none"
|
||||||
|
EXTRA_OECONF += " --with-openssl=${OPENSSL_YOCTO_DIR} --with-wolfssl=${WOLFSSL_YOCTO_DIR} "
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
|
||||||
|
python() {
|
||||||
|
# Get the package revision (PR) for wolfssl
|
||||||
|
wolfssl_pr = d.getVar('PR', True)
|
||||||
|
|
||||||
|
# Based on the revision, conditionally append to EXTRA_OECONF
|
||||||
|
if wolfssl_pr == 'commerical.fips':
|
||||||
|
d.appendVar('EXTRA_OECONF', ' --enable-engine=fips-v5')
|
||||||
|
elif wolfssl_pr == 'fipsReady':
|
||||||
|
d.appendVar('EXTRA_OECONF', ' --enable-engine=fips-ready')
|
||||||
|
else:
|
||||||
|
d.appendVar('EXTRA_OECONF', ' --enable-engine=no-fips')
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,80 @@
|
||||||
|
# wolfProvider
|
||||||
|
|
||||||
|
The `wolfprovider` recipe enables the integration of wolfSSL's cryptographic functionalities into OpenSSL through a custom provider mechanism. This integration allows applications using OpenSSL to leverage wolfSSL's advanced cryptographic algorithms, combining wolfSSL's lightweight and performance-optimized cryptography with OpenSSL's extensive API and capabilities. `wolfprovider` is designed for easy integration into Yocto-based systems, ensuring a seamless blend of security and performance ideal for embedded and constrained environments.
|
||||||
|
|
||||||
|
The `wolfprovidertest` yocto package will provide two apps, `wolfproviderenv` and `wolfprovidertest`. Running `wolfproviderenv` will start up a child shell and run `wolfprovidertest`. Use `wolfproviderenv` to test that the `wolfprovider` package is succesfully installed. If you want to run `wolfprovidertest` directly you will need to directly source `wolfproviderenv` via `source /usr/bin/wolfproviderenv` or setup the env on your own, because `wolfprovidertest` will fail otherwise. Use `wolfprovidertest` to check that your shell env is correctly setup.
|
||||||
|
|
||||||
|
## Getting Started
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
- A functioning Yocto Project environment (Kirkstone or later recommended)
|
||||||
|
- OpenSSL 3.0 or later, supporting the provider interface (Come by default with Kirkstone or later)
|
||||||
|
- Access to the `meta-wolfssl` repository
|
||||||
|
|
||||||
|
### Integrating wolfprovider with Yocto
|
||||||
|
|
||||||
|
1. **Clone the meta-wolfssl repository**:
|
||||||
|
|
||||||
|
Clone the `meta-wolfssl` repository into your Yocto project's sources directory if not already included in your project.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
git clone https://github.com/wolfSSL/meta-wolfssl.git
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Include meta-wolfssl in your bblayers.conf**:
|
||||||
|
|
||||||
|
Add `meta-wolfssl` to your `bblayers.conf` file to incorporate it into your build environment.
|
||||||
|
|
||||||
|
```bitbake
|
||||||
|
BBLAYERS ?= " \
|
||||||
|
...
|
||||||
|
/path/to/meta-wolfssl \
|
||||||
|
...
|
||||||
|
"
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Add wolfprovider to your image**:
|
||||||
|
|
||||||
|
Modify your image recipe or `local.conf` file to include `wolfprovider`, `wolfssl`, `openssl`, `openssl-bin`, and `wolfprovidertest`. You will only need `openssl-bin` and `wolfprovidertest` if you want to use and test with our included example and conf file.
|
||||||
|
|
||||||
|
|
||||||
|
For yocto kirkstone or newer:
|
||||||
|
```
|
||||||
|
IMAGE_INSTALL:append = "wolfprovider wolfssl openssl openssl-bin wolfprovidertest"
|
||||||
|
```
|
||||||
|
|
||||||
|
For yocto dunfell or earlier:
|
||||||
|
```
|
||||||
|
IMAGE_INSTALL_append = "wolfprovider wolfssl openssl openssl-bin wolfprovidertest"
|
||||||
|
```
|
||||||
|
|
||||||
|
4. **Build Your Image**:
|
||||||
|
|
||||||
|
With the `meta-wolfssl` layer added and the necessary packages included in your image configuration, proceed to build your Yocto image as usual.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
bitbake <your_image_recipe_name>
|
||||||
|
```
|
||||||
|
|
||||||
|
### Testing wolfprovider
|
||||||
|
|
||||||
|
After building and deploying your image to the target device, you can test `wolfprovider` functionality through the `wolfproviderenv` script.
|
||||||
|
|
||||||
|
1. **Execute the wolfproviderenv Script**:
|
||||||
|
|
||||||
|
`wolfproviderenv` is located in `/usr/bin`, so just execute the script upon entering into your terminal.
|
||||||
|
|
||||||
|
```sh
|
||||||
|
wolfproviderenv
|
||||||
|
```
|
||||||
|
|
||||||
|
The script performs necessary setup actions, executes `wolfprovidertest` to validate the integration, and lists available OpenSSL providers to confirm `wolfprovider` is active and correctly configured.
|
||||||
|
|
||||||
|
2. **Expected Output**:
|
||||||
|
|
||||||
|
Look for messages indicating a successful environment setup, execution of `wolfprovidertest` with a custom provider loaded successfully, and `libwolfprovider` listed among active OpenSSL providers.
|
||||||
|
|
||||||
|
### Documentation and Support
|
||||||
|
|
||||||
|
For further information about `wolfprovider` and `wolfssl`, visit the [wolfSSL Documentation](https://www.wolfssl.com/docs/) and the [wolfProvider Github](https://www.github.com/wolfSSL/wolfprovider). If you encounter issues or require support regarding the integration of `wolfprovider` with Yocto, feel free to reach out through [wolfSSL Support](support@wolfssl.com).
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
EXTRA_OECONF += " no-fips shared "
|
||||||
|
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
SUMMARY = "wolfProvider is a Proivder designed for Openssl 3.X.X"
|
||||||
|
DESCRIPTION = "wolfProvider is a library that can be used as an Provider in OpenSSL"
|
||||||
|
HOMEPAGE = "https://github.com/wolfSSL/wolfProvider"
|
||||||
|
BUGTRACKER = "https://github.com/wolfSSL/wolfProvider/issues"
|
||||||
|
SECTION = "libs"
|
||||||
|
LICENSE = "GPL-3.0-only"
|
||||||
|
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
|
||||||
|
DEPENDS += "util-linux-native"
|
||||||
|
|
||||||
|
PROVIDES += "wolfprovider"
|
||||||
|
RPROVIDES_${PN} = "wolfprovider"
|
||||||
|
|
||||||
|
SRC_URI = "git://github.com/wolfssl/wolfProvider.git;protocol=https;branch=master"
|
||||||
|
SRCREV = "${AUTOREV}"
|
||||||
|
S = "${WORKDIR}/git"
|
||||||
|
|
||||||
|
DEPENDS += " wolfssl \
|
||||||
|
openssl \
|
||||||
|
"
|
||||||
|
|
||||||
|
inherit autotools pkgconfig
|
||||||
|
|
||||||
|
OPENSSL_YOCTO_DIR = "${COMPONENTS_DIR}/${PACKAGE_ARCH}/openssl/usr"
|
||||||
|
|
||||||
|
# Approach: Use Python to dynamically set function content based on Yocto version
|
||||||
|
python() {
|
||||||
|
distro_version = d.getVar('DISTRO_VERSION', True)
|
||||||
|
autogen_command = "cd ${S}; ./autogen.sh"
|
||||||
|
if distro_version and (distro_version.startswith('2.') or distro_version.startswith('3.')):
|
||||||
|
# For Dunfell and earlier
|
||||||
|
d.appendVar('do_configure_prepend', autogen_command)
|
||||||
|
else:
|
||||||
|
# For Kirkstone and later
|
||||||
|
d.appendVar('do_configure:prepend', autogen_command)
|
||||||
|
}
|
||||||
|
|
||||||
|
CFLAGS += " -I${S}/include -g0 -O2 -ffile-prefix-map=${WORKDIR}=."
|
||||||
|
CXXFLAGS += " -I${S}/include -g0 -O2 -ffile-prefix-map=${WORKDIR}=."
|
||||||
|
LDFLAGS += " -Wl,--build-id=none"
|
||||||
|
EXTRA_OECONF += " --with-openssl=${OPENSSL_YOCTO_DIR}"
|
||||||
|
|
@ -0,0 +1,2 @@
|
||||||
|
EXTRA_OECONF += " --enable-opensslcoexist --enable-cmac --enable-keygen --enable-sha --enable-des3 --enable-aesctr --enable-aesccm --enable-x963kdf --enable-compkey --enable-certgen --enable-aeskeywrap --enable-enckeys --enable-base16 "
|
||||||
|
CPPFLAGS += " -DHAVE_AES_ECB -DWOLFSSL_AES_DIRECT -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DECC_MIN_KEY_SZ=192 -DHAVE_PUBLIC_FFDHE -DWOLFSSL_DH_EXTRA -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER "
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue