aab3257de8
A crypto callback that returns WC_PENDING_E for a TLS record cipher silently corrupted records: Encrypt()/Decrypt() advance the cipher state to CIPHER_STATE_END before the pending check, so on resume the record is shipped without re-running the cipher. WOLF_CRYPTO_CB_ASYNC_POLL gives crypto callback devices the QAT/Nitrox "poll to fill output" completion model. On WC_PENDING_E the async event stays queued; wolfSSL_AsyncPoll() re-enters the device with the new WC_ALGO_TYPE_ASYNC_POLL (wc_CryptoCb_Poll) to finish the job and fill the output buffer. The re-entry only polls while the event is still pending, and a device that cannot complete the job (no poll support, or it reports nothing pending) hard-fails with WC_HW_E rather than reporting the op done with an unfilled buffer. Only the two async record ciphers (AES and 3DES markers) are routed to poll completion, and only when crypto callbacks are the async backend (not QAT/Cavium/SW); handshake PK keeps the re-invoke model. The wolfSSL_AsyncPop eviction is gated for poll-capable devices so the existing resume-at-CIPHER_STATE_END path becomes correct with no record state-machine changes. Without the feature (and without a software/QAT/Cavium backend) a pending bulk cipher op now errors out with ASYNC_OP_E instead of corrupting the record, and configure/cryptocb.c warn about the unsupported combination. Tests in tests/api/test_async.c cover direct AES-GCM/CBC/CCM and 3DES poll completion in both directions at multiple pend depths, negative cases for cipher types defined but not dispatched (ChaCha, single DES), and full TLS 1.3 handshake+echo: an encrypt-offload run, a both- directions run that offloads encrypt and decrypt on both peers using a per-peer device, and the no-poll failure path. |
||
|---|---|---|
| .. | ||
| asn1 | ||
| async | ||
| benchmark | ||
| client | ||
| configs | ||
| crypto_policies | ||
| echoclient | ||
| echoserver | ||
| ocsp_responder | ||
| pem | ||
| sctp | ||
| server | ||
| tls13 | ||
| tsp | ||
| README.md | ||
| include.am | ||
README.md
wolfSSL examples directory
client and server
These directories contain a client (client.c) and server (server.c) that utilize a variety of the wolfSSL library's capabilities. The manner in which both programs operate can depend on the configure or can be specified at run-time depending on the end goal. Both applications contain testing as well as benchmarking code.
Compile
./configure
make
Usage
./examples/server/server
./examples/client/client
Run ./examples/server/server -h and ./examples/client/client -h for usage details.
For simpler wolfSSL TLS server/client examples, visit https://github.com/wolfSSL/wolfssl-examples/tree/master/tls
echoclient and echoserver
These directories contain a client (echoclient.c) and server (echoserver.c) that establish a connection encrypted by wolfSSL. Like the names indicate, once the connection has been established any messages entered into echoclient are sent to and displayed on the echoserver and are then echoed back to echoclient. The nature of the encryption, as well as additional behavior of the two programs, depends on how wolfSSL was configured ( DTLS enabled/disabled, Filesystem enabled/disabled, etc ... ).
Compile
./configure
make
Usage
./examples/echoserver/echoserver
./examples/echoclient/echoclient
benchmark
The benchmark directory offers an application that can help you grasp just how well wolfSSL's TLS functionality is performing on your local machine.
Compile
./configure
make
Usage
./examples/benchmark/tls_bench
The tls_bench executable can also be compiled separately with gcc -lwolfssl -lpthread -o tls_bench tls_bench.c.
Run ./examples/benchmark/tls_bench -? for usage details.
sctp
This directory contains servers and clients that demonstrate wolfSSL's DTLS-SCTP support.
Compile
./configure --enable-sctp
make
Usage
./examples/sctp/sctp-server
./examples/sctp/sctp-client
and
./examples/sctp/sctp-server-dtls
./examples/sctp/sctp-client-dtls
configs
This directory contains example wolfSSL configuration file templates for use when autoconf is not available, such as building with a custom IDE.
See configs/README.md for more details.
asn1
This directory contains an example that prints the ASN.1 data of a BER/DER or PEM encoded file. Configure wolfSSL with --enable-asn-print.
pem
This directory contains an example of converting to/from PEM and DER. Configure wolfSSL with --enable-coding