b41d12c0b8
* Regenerate the CRL that expired in September 2025 * Refresh the expired certificates embedded in certloadverifybuffer * Return 0 from tls servers that returned a wolfSSL_write byte count * Send a client certificate from client-tls and client-tls13-resume * Return 0 from certverify instead of WOLFSSL_SUCCESS * Give the XTS demo key two different halves * Exit success after ml_dsa prints its parameter table * Report failure from the custom io file client and server * Latch failures across every ecc-params curve lookup * Ignore SIGPIPE in the btle fifo transport * Fix the dtls rw-threads certificate paths * Make runall.sh fail when an example fails * Make openssl-verify.sh actually verify and actually fail * Raise the generate_ssl.sh common name length limit * Port the PQ examples to the current wolfSSL API * Return 0 from csr_w_ed25519_example and rsa-public-decrypt-app * Build the x509_acert openssl example against the right headers * Give the examples Makefiles a consistent wolfSSL prefix * Fix the double free and NULL derefs in the custom io cleanup paths * Stop forcing the ESP32 examples to include a developer private config * Add the missing WiFi Kconfig to the DTLS13 station examples * Use XSTRLCPY in client-dtls13 since wolfSSL has no XSTRCPY * Make the DTLS13 example ctx static so it stops colliding with libnet80211 * Set SO_REUSEADDR on the tls servers that lacked it * Give puf the wolfSSL sources and stop building the IDF 4.4 only ENC28J60 examples * Set SO_REUSEADDR on server-tcp as well * Exit the can-bus client on EOF and give it real input in CI * Re-arm the select timeout each pass in the nonblocking dtls server * Keep the shared memory BIOs alive until both sides are done * Port the ebpf tracers to the libbpf 1.0 perf_buffer__new signature * Clone wolfSSL before make builds its graph so uefi-static builds from a clean tree * Raise wolfcryptjni compileSdk to 32 for the BigInteger API its submodule uses * Link wolfentropy.o and keep wc_port socket helpers out of the UEFI build * Track the wolfSSL dilithium.c to wc_mldsa.c rename and drop a stale java import * Move uefi-library to the wc_MlDsa API after the wolfSSL dilithium rename * Declare the launcher activity exported, required from API 31 * Configure wolfSSL before make in the fullstack setup script * Track the wolfSSL io.c to wolfio.c rename in the ndk sample * Keep glibc headers out of the freestanding uefi-library build * Track the wolfSSL mlkem.h rename and give RT1060 the SDK name it selects on * Track the wolfIP struct ll rename and pin wolfIP to its v1.0 release * Use getaddrinfo in the ndk sample since bionic does not declare gethostbyname * Cross compile RT1060 with arm-none-eabi and document the SDK value the Makefile matches * Enable wolfIP HTTP so its httpd.h actually declares the API the example calls * Define HAVE_NETDB_H so wolfio.c includes the header its getaddrinfo path needs * Link pkcs12.o, which RT1060 enables by default and wolfcrypt test calls * Port the ENC28J60 examples to the ESP-IDF 5.x ethernet API * Compile dtls.c in the ndk sample, which enables WOLFSSL_DTLS * Define the PHY identifier registers the removed IDF header supplied * Compile kdf.c in the ndk sample for the TLS PRF * Give RT1060 a current_time so the benchmark stops needing clock_gettime * Port the ENC28J60 PHY to the IDF 5.x autonego_ctrl vtable * Remove the ENC28J60 server's duplicate driver copy that main already builds * Return the DTLS server to accept on close_notify so a resume is heard * Run the C# pq client/server pair under mono * Define WOLFSSL_CERT_REQ so the ndk-gradle app links wolfssljni's X509_REQ calls * Refresh the expired client ECC DER certificate * Add CI that builds and runs every example against wolfSSL master and stable * Sign OCSP staples with a responder intermediate1 actually delegated * Report a failing PKCS#11 example instead of always exiting 0 * Link the PSA library the README's PSA_LIB_PATH names * Widen the mynewt pointer prints so they build on a 64 bit native BSP * Test RSA under UEFI with a 2048 bit key so it clears wolfSSL's minimum * Left pad the ECDSA r and s so a leading zero cannot shift the signature * Document the smime and indef flags the pkcs7 examples need * Fail ecc-verify when the signature does not verify * Fail ecc-sign when a round produces an invalid signature * Fail aesgcm-file-encrypt when its sanity test does not pass * Check that ML-KEM derives the same shared secret on both sides * Fail ecdh_gen_secret when the two sides derive different secrets * Return the DH key agreement error instead of always exiting 0 * Retry the fullstack HTTPS probe so a slow sim start does not fail it * Confirm the custom-io file transfer succeeded so CI can assert it * Print a success line from the silent file-encrypt and ecc-export examples * Add device-sims job running ATECC608 STSAFE and TROPIC01 sim wolfcrypt tests * Extend device-sims to STM32 and PIC32MZ for the full sim fleet * Mount wolfSSL for the STM32 and PIC32MZ sim wolfcrypt runs * Accept the zero success return from wolfSSL_CTX_set_max_early_data * Read the earlydata reply so the client processes the session ticket before resuming * Read the earlydata reply in the DTLS client so it processes the session ticket * Run the tls13 and dtls13 earlydata pairs now that the clients process the ticket * Let expect_fail clear on refs that carry the fix via a fixed_on marker * Retry the PSA TLS 1.3 handshake so an intermittent ECC reject does not fail CI * Retry network fetches across CI so a transient blip does not fail a job * Normalize do_ecc and do_25519 exit codes like do_448 so an error is never masked to 0 * Build and run the merged-in hsm dtls_client example in CI via a dedicated hsm.yml job * Add a make check target to each applicable example * Run only the example and lint smoke set on draft PRs * Only run a per-target workflow when its own example dir changes * Assert the real se050 wolfcrypt result instead of an early sub-test line * Size the RSA 2048 key export buffers so the UEFI test does not fail on BUFFER_E * Call the always-present MLDSA context API from the UEFI driver * Cross uefi-static and uefi-library with both wolfSSL refs in the matrix * Give each tpm matrix leg a ref-unique results file and artifact * Add a codespell spellcheck pass to the lint job * Run push CI on master only so a PR branch does not double-trigger * Select valgrind by caller_run_id since event_name is the caller under workflow_call * Make example check targets catch real failures with pipefail exit checks and inputs * Wire the harness to run make check for mode check examples starting with ecc * Migrate the single-entry exec examples to mode check and fold their inputs into the check targets * Fix four make check assertions that misfired under pipefail * Give the tpm manifest entry a run step so it asserts output * Skip uefi-static in the lint make -n loop so it does not clone * Assert the actual verify result in the pkcs7 and rsa-nb checks * Return nonzero from pkcs12-create-example on a failed create so the check is not a false pass * Return nonzero from rsa-kg on any key generate or write failure * Assert the static memory checks by exit code instead of a pipefail grep that BSD make lacks * Run pkcs7 signedData stream through make check so it asserts the real verify result * Check DER certificates and CRLs in the expiry canary too * Feed the wolfHSM client its stdin so run_client actually exchanges data * Assert every make check by exit code and captured output instead of a pipefail grep so they hold under BSD make |
||
|---|---|---|
| .. | ||
| README-images | ||
| trusted | ||
| untrusted | ||
| Makefile | ||
| README.md | ||
| build.sh | ||
| sgx_t.mk | ||
| sgx_u.mk | ||
README.md
wolfSSL Linux Enclave Example
This repository contains an example application, written in C, which demonstrates how to link with the wolfSSL lightweight SSL/TLS library with a simple Enclave using Linux. The example has been tested with Ubuntu 16.04.
Note that the example passes pointers using [user_check]. For more information about what [user_check] is, and precautions needed when developing an application that uses it, see Intel documentation located here https://software.intel.com/en-us/sgx-sdk-dev-reference-attribute-user-check. An application could be developed to completely avoid passing the WOLFSSL_CTX pointer between trusted and untrusted code for more security.
Prerequisites
Must have a copy of wolfSSL from either the website or github.
To download a stable release head on over to https://www.wolfssl.com/download/ and look for the wolfssl-x.x.x.zip (latest release)
To grab a copy of the development master use git clone https://github.com/wolfssl/wolfssl.git
NOTE: When cloning the github repository the file wolfssl/options.h is expected, in downloaded bundles from wolfssl.com this file exists but when building from a cloned version of wolfSSL from GitHub then the file needs created. This is done either through cd wolfssl && ./autogen.sh && ./configure && ./config.status or by cd wolfssl && touch wolfssl/options.h.
Once the options.h is created you can now go the SGX directory and follow the README instructions referenced in the line below.
First create the trusted static wolfssl library from <wolfssl-root>/IDE/LINUX-SGX. Steps for creating the static library can be found in <wolfssl-root>/IDE/LINUX-SGX/README.md
Build
After creating the static library, build the example untrusted application using make. For make the user should specify:
-
Specify SGX Mode. This can be either SIM or HW
SGX_MODE=[SIM,HW] -
Whether SGX should be built as Prerelease or regular release
SGX_PRERELEASE=[1,0] -
Specify if SGX Debug should be set. (This also controls whether wolfssl debug prints, if it was enabled at compile-time for the static library).
SGX_DEBUG=[1,0] -
The location of the prebuilt static library (this will probably point to
<wolfssl-root>/IDE/LINUX-SGX)SGX_WOLFSSL_LIB=[location/to/libwolfssl.sgx.static.a] -
The location of wolfssl root directory for the header files.
WOLFSSL_ROOT=[location/to/wolfssl_root] -
Whether benchmark tests have been enabled. NOTE: These must be enabled during compilation of the static library as well. See the README in
<wolfssl-root>/IDE/LINUX-SGX/README.mdHAVE_WOLFSSL_BENCHMARK=[0/1] -
Whether wolfcrypt tests have been enabled. NOTE: These must be enabled during compilation of the static library as well. See the README in
<wolfssl-root>/IDE/LINUX-SGX/README.mdHAVE_WOLFSSL_TEST=[0/1]
With these three options, simply call, for example:
make SGX_MODE=SIM SGX_PRERELEASE=0 SGX_WOLFSSL_LIB=~/wolfssl/IDE/LINUX-SGX/ WOLFSSL_ROOT=../../wolfssl SGX_DEBUG=0 HAVE_WOLFSSL_TEST=1
Expected Output
Running
After building, the user can specify one of a set of options to be run via the command line. These are:
- -c: Run a TLS Client in an enclave
- This option runs an example TLS client in enclave to connect to a server on port 11111.
- -s: Run a TLS Server in an enclave
- This option runs an example TLS server in enclave to receive clients on port 11111.
- -t: Run wolfCrypt tests in an enclave
- This option runs the wolfCrypt tests. NOTE: These must be enabled during compilation of the static library as well. See the README in
<wolfssl-root>/IDE/LINUX-SGX/README.md
- This option runs the wolfCrypt tests. NOTE: These must be enabled during compilation of the static library as well. See the README in
- -b: Run wolfCrypt benchmarks in an enclave
- This option runs the wolfCrypt benchmarks in an enclave. These benchmarks will be somewhat faster than standard benchmarks because the benchmarks are operating entirely within the enclave and buffers don't need to be moved across the enclave boundary between calls. NOTE: These must be enabled during compilation of the static library as well. See the README in
<wolfssl-root>/IDE/LINUX-SGX/README.md
- This option runs the wolfCrypt benchmarks in an enclave. These benchmarks will be somewhat faster than standard benchmarks because the benchmarks are operating entirely within the enclave and buffers don't need to be moved across the enclave boundary between calls. NOTE: These must be enabled during compilation of the static library as well. See the README in
To test the enclave client against the enclave server:
First, start the enclave server.
./App -s
Then, start the enclave client
./App -c
This will connect an enclave client, in one enclave, to an enclave server, in a second enclave. These can also be replaced by the wolfssl example client/server. For example, to test a standard client against an enclave server, start the enclave server and then run /examples/client/client.
Expected Output
Limitations
-
Single Threaded
-
No Filesystem
-
Untrusted Code Must Load Private Key/Certificate Chain
i) In order to successfully load a private key and certificate into the enclave, these APIs are exposed to the untrusted application. This means that the untrusted region must be "trusted" to load the correct Private Key/ Certificate to start a connection. This method of loading certificates should not be used for production code as it violates the trust assumptions for Intel's SGX. Contact support@wolfssl.com if you wish to use wolfSSL in your product.
-
Default max number of WOLFSSL_CTX and WOLFSSL structures set to 2. This was introduced as a side effect of avoiding passing the pointers of the opaque structures from untrusted to trusted code.
Support
Please contact wolfSSL at support@wolfssl.com with any questions, bug fixes, or suggested feature additions.