b41d12c0b8
* Regenerate the CRL that expired in September 2025 * Refresh the expired certificates embedded in certloadverifybuffer * Return 0 from tls servers that returned a wolfSSL_write byte count * Send a client certificate from client-tls and client-tls13-resume * Return 0 from certverify instead of WOLFSSL_SUCCESS * Give the XTS demo key two different halves * Exit success after ml_dsa prints its parameter table * Report failure from the custom io file client and server * Latch failures across every ecc-params curve lookup * Ignore SIGPIPE in the btle fifo transport * Fix the dtls rw-threads certificate paths * Make runall.sh fail when an example fails * Make openssl-verify.sh actually verify and actually fail * Raise the generate_ssl.sh common name length limit * Port the PQ examples to the current wolfSSL API * Return 0 from csr_w_ed25519_example and rsa-public-decrypt-app * Build the x509_acert openssl example against the right headers * Give the examples Makefiles a consistent wolfSSL prefix * Fix the double free and NULL derefs in the custom io cleanup paths * Stop forcing the ESP32 examples to include a developer private config * Add the missing WiFi Kconfig to the DTLS13 station examples * Use XSTRLCPY in client-dtls13 since wolfSSL has no XSTRCPY * Make the DTLS13 example ctx static so it stops colliding with libnet80211 * Set SO_REUSEADDR on the tls servers that lacked it * Give puf the wolfSSL sources and stop building the IDF 4.4 only ENC28J60 examples * Set SO_REUSEADDR on server-tcp as well * Exit the can-bus client on EOF and give it real input in CI * Re-arm the select timeout each pass in the nonblocking dtls server * Keep the shared memory BIOs alive until both sides are done * Port the ebpf tracers to the libbpf 1.0 perf_buffer__new signature * Clone wolfSSL before make builds its graph so uefi-static builds from a clean tree * Raise wolfcryptjni compileSdk to 32 for the BigInteger API its submodule uses * Link wolfentropy.o and keep wc_port socket helpers out of the UEFI build * Track the wolfSSL dilithium.c to wc_mldsa.c rename and drop a stale java import * Move uefi-library to the wc_MlDsa API after the wolfSSL dilithium rename * Declare the launcher activity exported, required from API 31 * Configure wolfSSL before make in the fullstack setup script * Track the wolfSSL io.c to wolfio.c rename in the ndk sample * Keep glibc headers out of the freestanding uefi-library build * Track the wolfSSL mlkem.h rename and give RT1060 the SDK name it selects on * Track the wolfIP struct ll rename and pin wolfIP to its v1.0 release * Use getaddrinfo in the ndk sample since bionic does not declare gethostbyname * Cross compile RT1060 with arm-none-eabi and document the SDK value the Makefile matches * Enable wolfIP HTTP so its httpd.h actually declares the API the example calls * Define HAVE_NETDB_H so wolfio.c includes the header its getaddrinfo path needs * Link pkcs12.o, which RT1060 enables by default and wolfcrypt test calls * Port the ENC28J60 examples to the ESP-IDF 5.x ethernet API * Compile dtls.c in the ndk sample, which enables WOLFSSL_DTLS * Define the PHY identifier registers the removed IDF header supplied * Compile kdf.c in the ndk sample for the TLS PRF * Give RT1060 a current_time so the benchmark stops needing clock_gettime * Port the ENC28J60 PHY to the IDF 5.x autonego_ctrl vtable * Remove the ENC28J60 server's duplicate driver copy that main already builds * Return the DTLS server to accept on close_notify so a resume is heard * Run the C# pq client/server pair under mono * Define WOLFSSL_CERT_REQ so the ndk-gradle app links wolfssljni's X509_REQ calls * Refresh the expired client ECC DER certificate * Add CI that builds and runs every example against wolfSSL master and stable * Sign OCSP staples with a responder intermediate1 actually delegated * Report a failing PKCS#11 example instead of always exiting 0 * Link the PSA library the README's PSA_LIB_PATH names * Widen the mynewt pointer prints so they build on a 64 bit native BSP * Test RSA under UEFI with a 2048 bit key so it clears wolfSSL's minimum * Left pad the ECDSA r and s so a leading zero cannot shift the signature * Document the smime and indef flags the pkcs7 examples need * Fail ecc-verify when the signature does not verify * Fail ecc-sign when a round produces an invalid signature * Fail aesgcm-file-encrypt when its sanity test does not pass * Check that ML-KEM derives the same shared secret on both sides * Fail ecdh_gen_secret when the two sides derive different secrets * Return the DH key agreement error instead of always exiting 0 * Retry the fullstack HTTPS probe so a slow sim start does not fail it * Confirm the custom-io file transfer succeeded so CI can assert it * Print a success line from the silent file-encrypt and ecc-export examples * Add device-sims job running ATECC608 STSAFE and TROPIC01 sim wolfcrypt tests * Extend device-sims to STM32 and PIC32MZ for the full sim fleet * Mount wolfSSL for the STM32 and PIC32MZ sim wolfcrypt runs * Accept the zero success return from wolfSSL_CTX_set_max_early_data * Read the earlydata reply so the client processes the session ticket before resuming * Read the earlydata reply in the DTLS client so it processes the session ticket * Run the tls13 and dtls13 earlydata pairs now that the clients process the ticket * Let expect_fail clear on refs that carry the fix via a fixed_on marker * Retry the PSA TLS 1.3 handshake so an intermittent ECC reject does not fail CI * Retry network fetches across CI so a transient blip does not fail a job * Normalize do_ecc and do_25519 exit codes like do_448 so an error is never masked to 0 * Build and run the merged-in hsm dtls_client example in CI via a dedicated hsm.yml job * Add a make check target to each applicable example * Run only the example and lint smoke set on draft PRs * Only run a per-target workflow when its own example dir changes * Assert the real se050 wolfcrypt result instead of an early sub-test line * Size the RSA 2048 key export buffers so the UEFI test does not fail on BUFFER_E * Call the always-present MLDSA context API from the UEFI driver * Cross uefi-static and uefi-library with both wolfSSL refs in the matrix * Give each tpm matrix leg a ref-unique results file and artifact * Add a codespell spellcheck pass to the lint job * Run push CI on master only so a PR branch does not double-trigger * Select valgrind by caller_run_id since event_name is the caller under workflow_call * Make example check targets catch real failures with pipefail exit checks and inputs * Wire the harness to run make check for mode check examples starting with ecc * Migrate the single-entry exec examples to mode check and fold their inputs into the check targets * Fix four make check assertions that misfired under pipefail * Give the tpm manifest entry a run step so it asserts output * Skip uefi-static in the lint make -n loop so it does not clone * Assert the actual verify result in the pkcs7 and rsa-nb checks * Return nonzero from pkcs12-create-example on a failed create so the check is not a false pass * Return nonzero from rsa-kg on any key generate or write failure * Assert the static memory checks by exit code instead of a pipefail grep that BSD make lacks * Run pkcs7 signedData stream through make check so it asserts the real verify result * Check DER certificates and CRLs in the expiry canary too * Feed the wolfHSM client its stdin so run_client actually exchanges data * Assert every make check by exit code and captured output instead of a pipefail grep so they hold under BSD make |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| README.md | ||
| apps.wolfsslclienttlsmn.pkg.yml | ||
| apps.wolfsslclienttlsmn.syscfg.yml | ||
| ci-compile-check.sh | ||
| client-tls-mn.c | ||
| custom_ca.h | ||
| jenkins.sh | ||
| setup.sh | ||
| test_client-tls.expect | ||
README.md
Apache Mynewt examples
Overview
Mynewt is a security-oriented OS for IoT.
WolfSSL integration with the Mynewt OS may be found in the /IDE/mynewt
directory in the wolfssl source-tree. Support includes the wolfCrypt test
application which demonstrates the cryptography provided by the wolfCrypt
component of wolfSSL.
wolfssl provides the following mynewt packages:
- crypto/wolfsslwolfssl - wolfSSL SSL/TLS and wolfCrypt cryptography library
- apps/wolfcrypttest - wolfCrypt unit test application
The examples for wolfSSL and Mynewt found in the mynewt directory of
wolfssl-examples (this directory) includes demonstration of additional
wolfSSL capabilities such as TLS.
wolfssl-examples provides the follows mynewt packages:
- apps/wolfsslclienttlsmn - simple client TLS application for
mn_socket
The Mynewt OS has a primary command-line tool called newt which is used to
configure and build Mynewt for targets. Targets include a simulated environment
for Linux hosts, which will be used by the wolfSSL applications. Mynewt installs
to a project directory from which the newt command is run.
Setup
- Install Mynewt
newtcommand using instructions found at:
http://mynewt.apache.org/latest/get_started/native_install/index.html
- Create Mynewt project directory (e.g.
mynewt).
In parent folder of new Mynewt project directory:
$ newt new mynewt
NOTE: If problems are encountered creating a new Mynewt project an alternative:
$ git clone git@github.com:apache/mynewt-blinky.git mynewt
$ cd mynewt
$ newt upgrade
- Install wolfSSL support into Mynewt project.
In the wolfssl/IDE/mynewt directory:
$ ./setup path-to-mynewt
- Install wolfSSL examples support into Mynewt project.
In the wolfssl-examples/mynewt directory:
$ ./setup path-to-mynewt
Configuration
- Create client TLS application for simulator target.
In Mynewt project directory:
$ newt target create wolfsslclienttlsmn_sim
$ newt target set wolfsslclienttlsmn_sim app=apps/wolfsslclienttlsmn
$ newt target set wolfsslclienttlsmn_sim bsp=@apache-mynewt-core/hw/bsp/native
$ newt target set wolfsslclienttlsmn_sim build_profile=debug
Build and Run
- Build client TLS application.
In Mynewt project directory:
$ newt clean wolfsslclienttlsmn_sim
$ newt build wolfsslclienttlsmn_sim
- Run client TLS application
In Mynewt project directory:
$ ./bin/targets/wolfsslclienttlsmn_sim/app/apps/wolfsslclienttlsmn/wolfsslclienttlsmn.elf
The Mynewt simulator will display the linux host device where the application's
uart is accessible via a terminal emulator program such as picocom, screen or
kermit. For example: uart0 at /dev/pts/3
- Connect terminal emulator (e.g. picocom) to simulated application UART.
$ sudo picocom -b 115200 /dev/pts/3
The application will display the Mynewt shell prompt compat> (press ENTER if
shell prompt is not visiable). Entering help will display commands available,
including the wolfssl command with represents the client TLS application.
Usage
Run a local TLS server to connect to
This example uses the repo's test CA (certs/ca-cert.pem, embedded as local_ca.h).
To avoid dependencies on live internet hosts, point the client at the local
tls/server-tls example.
In a separate terminal, from the wolfssl-examples directory:
$ cd tls
$ make
$ ./server-tls
Leave this running. It handles one connection at a time.
Connecting to a different target instead
To connect to a real host, build with WOLFSSL_MN_USE_CUSTOM_CA:
$ newt target set wolfsslclienttlsmn_sim syscfg=WOLFSSL_MN_USE_CUSTOM_CA=1
Fill in mynewt/custom_ca.h with your target's root CA. Set DEFAULT_IPADDR
and DEFAULT_PORT in client-tls-mn.c, then rebuild.
Note: This demo pins the CA and IP address at build time. Update them manually if the target changes.
Command list
The client TLS application wolfssl has the following commands:
| command | argument | describe | example |
|---|---|---|---|
| time | "unix timestamp" | To set the time | "time 1532616682" |
| net | udp | create udp socket | "net udp" |
| net | tcp | create tcp socket | "net tcp" |
| net | connect "ipaddress" port | connect "ipaddress" | "net connect 127.0.0.1 11111" |
| net | close | close socket | "net close" |
| net | send "string" "ipaddress" "port" | send string | "net send "hello" 127.0.0.1 11111" |
| net | recv "ipaddress" | recv from ipaddress | "net recv 127.0.0.1 11111" |
| wolfssl | init | initialize wolfssl library | "wolfssl init" |
| wolfssl | connect | connect via ssl | "wolfssl connect" |
| wolfssl | write "string" | send string via ssl | "wolfssl write "hello wolfssl!"" |
| wolfssl | read | recv via ssl | "wolfssl recv" |
| wolfssl | clear | finish wolfssl library | "wolfssl clear" |
Command examples
Connect to the locally-run tls/server-tls example (127.0.0.1:11111)
using Mynewt TCP networking and the wolfSSL TLS and crypto. Make sure
./server-tls (see above) is running first.
At the Mynewt compat> shell prompt:
net tcp
net connect 127.0.0.1 11111
wolfssl init
wolfssl connect
wolfssl write "hello wolfssl!"
wolfssl read
wolfssl clear
net close
The resulting application output should be similar to the following:
compat> net tcp
001143 mn_socket(TCP) = 0 566b7800
compat> net connect 127.0.0.1 11111
005078 127.0.0.1/11111
005078 mn_connect() = 0
compat> net_test_writable 0 - 0
wolfssl init
005853 wolfssl contexts are initialized
005854 wolfSSL ctx initialize
compat> wolfssl connect
006517 wolfSSL_connect() = 1
compat> wolfssl write "hello wolfssl!"
009182 wolfSSL_write() = 14L
compat> wolfssl read
010564 I hear ya fa shizzle!
010578
compat> wolfssl clear
012551 clear wolfssl contexts
012553 wolfSSL ctx clear
compat> net close
012893 mn_close() = 0
compat>
server-tls handles one request per connection and loops. It can be reused for repeated wolfssl connect runs.
Notes
-
Client TLS example run on Ubuntu 22.04LTS host with wolfSSL v5.6.0.
-
See
wolfssl/IDE/mynewt/README.mdfor details on wolfSSL integration and use of the wolfCrypt test application.
Jenkins script (test automation)
Setup for jenkins node
Install:
- git
- expect
- bash
- screen
- openssl
- xxd
- python3
- fuser
- newt(v1.4.1 over)
Usage
Execute jenkins.sh script on jenkins.
./mynewt/jenkins.sh