Skip to content

Commit 88a55cd

Browse files
kareem-wolfsslkareem-wolfssl
committed
Merge branch 'master' of https://github.com/wolfSSL/wolfssl into zd20603
2 parents 8d41d1c + 832e23a commit 88a55cd

128 files changed

Lines changed: 11732 additions & 25745 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/mono.yml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
name: Linux Mono C# Build Test
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ 'master', 'main', 'release/**' ]
7+
pull_request:
8+
branches: [ '*' ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
# END OF COMMON SECTION
14+
15+
jobs:
16+
build_wolfssl:
17+
name: Build wolfSSL C# Wrapper
18+
if: github.repository_owner == 'wolfssl'
19+
runs-on: ubuntu-24.04
20+
timeout-minutes: 10
21+
steps:
22+
23+
# Build wolfSSL using the user_settings.h from the C# wrapper directory
24+
- name: Build wolfSSL
25+
uses: wolfSSL/actions-build-autotools-project@v1
26+
with:
27+
path: wolfssl
28+
configure: --enable-usersettings CPPFLAGS=-I$GITHUB_WORKSPACE/wolfssl/wrapper/CSharp
29+
install: true
30+
check: false
31+
32+
- name: Install mono-complete
33+
run: |
34+
sudo apt-get update
35+
sudo apt-get install -y mono-complete
36+
37+
- name: Copy wolfSSL.dll to C# wrapper directory
38+
run: |
39+
echo "Copying wolfSSL.dll to C# wrapper directory. $GITHUB_WORKSPACE/build-dir/lib contains:"
40+
ls -la $GITHUB_WORKSPACE/build-dir/lib/*
41+
cp $GITHUB_WORKSPACE/build-dir/lib/libwolfssl.so $GITHUB_WORKSPACE/wolfssl/wrapper/CSharp/wolfssl.dll
42+
cp $GITHUB_WORKSPACE/build-dir/lib/libwolfssl.so $GITHUB_WORKSPACE/wolfssl/wrapper/CSharp/libwolfssl.so
43+
44+
- name: Build and run wolfCrypt test wrapper
45+
working-directory: wolfssl/wrapper/CSharp
46+
run: |
47+
mcs wolfCrypt-Test/wolfCrypt-Test.cs wolfSSL_CSharp/wolfCrypt.cs wolfSSL_CSharp/wolfSSL.cs wolfSSL_CSharp/X509.cs -OUT:wolfcrypttest.exe
48+
mono wolfcrypttest.exe
49+
50+
- name: Build wolfSSL client/server test
51+
working-directory: wolfssl/wrapper/CSharp
52+
env:
53+
LD_LIBRARY_PATH: $GITHUB_WORKSPACE/build-dir/lib
54+
run: |
55+
mcs wolfSSL_CSharp/wolfSSL.cs wolfSSL_CSharp/X509.cs wolfSSL-TLS-Server/wolfSSL-TLS-Server.cs -OUT:server.exe
56+
mcs wolfSSL_CSharp/wolfCrypt.cs wolfSSL-TLS-Client/wolfSSL-TLS-Client.cs wolfSSL_CSharp/wolfSSL.cs wolfSSL_CSharp/X509.cs -OUT:client.exe
57+
58+
- name: Test wolfSSL client/server communication
59+
working-directory: wolfssl/wrapper/CSharp
60+
env:
61+
LD_LIBRARY_PATH: $GITHUB_WORKSPACE/build-dir/lib
62+
run: |
63+
# Start server in background and capture its PID
64+
timeout 10s mono server.exe > server.log 2>&1 &
65+
SERVER_PID=$!
66+
67+
# Wait for server to start
68+
sleep 2
69+
70+
# Run client and capture output
71+
timeout 5s mono client.exe > client.log 2>&1
72+
CLIENT_EXIT_CODE=$?
73+
74+
# Wait a moment for server to process
75+
sleep 1
76+
77+
# Kill server
78+
kill $SERVER_PID 2>/dev/null || true
79+
80+
# Check if client completed successfully (exit code 0)
81+
if [ $CLIENT_EXIT_CODE -eq 0 ]; then
82+
echo "Client completed successfully"
83+
else
84+
echo "Client failed with exit code $CLIENT_EXIT_CODE"
85+
cat client.log
86+
exit 1
87+
fi
88+
89+
# Check for success indicators in logs
90+
if grep -q "SSL version is" client.log && grep -q "SSL cipher suite is" client.log; then
91+
echo "TLS handshake successful - SSL version and cipher suite detected"
92+
else
93+
echo "TLS handshake failed - no SSL version/cipher detected"
94+
echo "Client log:"
95+
cat client.log
96+
echo "Server log:"
97+
cat server.log
98+
exit 1
99+
fi
100+
101+
- name: Test SNI functionality
102+
working-directory: wolfssl/wrapper/CSharp
103+
env:
104+
LD_LIBRARY_PATH: $GITHUB_WORKSPACE/build-dir/lib
105+
run: |
106+
# Start server with SNI support in background
107+
timeout 10s mono server.exe -S > server_sni.log 2>&1 &
108+
SERVER_PID=$!
109+
110+
# Wait for server to start
111+
sleep 2
112+
113+
# Run client with SNI and capture output
114+
timeout 5s mono client.exe -S localhost > client_sni.log 2>&1
115+
CLIENT_EXIT_CODE=$?
116+
117+
# Wait a moment for server to process
118+
sleep 1
119+
120+
# Kill server
121+
kill $SERVER_PID 2>/dev/null || true
122+
123+
# Check if client completed successfully
124+
if [ $CLIENT_EXIT_CODE -eq 0 ]; then
125+
echo "SNI client completed successfully"
126+
else
127+
echo "SNI client failed with exit code $CLIENT_EXIT_CODE"
128+
cat client_sni.log
129+
exit 1
130+
fi
131+
132+
# Check for SNI success indicators
133+
if grep -q "SSL version is" client_sni.log && grep -q "SSL cipher suite is" client_sni.log; then
134+
echo "SNI TLS handshake successful"
135+
else
136+
echo "SNI TLS handshake failed"
137+
echo "Client log:"
138+
cat client_sni.log
139+
echo "Server log:"
140+
cat server_sni.log
141+
exit 1
142+
fi

‎.github/workflows/symbol-prefixes.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: WOLFSSL_API_PREFIX_MAP
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ 'master', 'main', 'release/**' ]
7+
pull_request:
8+
branches: [ '*' ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
# END OF COMMON SECTION
14+
15+
jobs:
16+
make_and_analyze:
17+
strategy:
18+
matrix:
19+
config: [
20+
'--enable-all --enable-mlkem --enable-mldsa --enable-xmss --enable-lms --enable-acert --with-sys-crypto-policy CFLAGS=-DWOLFSSL_API_PREFIX_MAP'
21+
]
22+
name: make and analyze
23+
if: github.repository_owner == 'wolfssl'
24+
runs-on: ubuntu-22.04
25+
# This should be a safe limit for the tests to run.
26+
timeout-minutes: 6
27+
steps:
28+
- uses: actions/checkout@v4
29+
name: Checkout wolfSSL
30+
31+
- name: Test --enable-opensslcoexist and TEST_OPENSSL_COEXIST
32+
run: |
33+
./autogen.sh || $(exit 2)
34+
./configure ${{ matrix.config }} || $(exit 3)
35+
make -j 4 || $(exit 4)
36+
# ignore properly prefixed symbols, and symbols associated with asm implementations (all internal) regardless of prefix:
37+
readelf --symbols --wide src/.libs/libwolfssl.so | \
38+
awk '
39+
BEGIN {
40+
total_public_symbols = 0;
41+
unprefixed_public_symbols = 0;
42+
}
43+
{
44+
if (($5 == "GLOBAL") && ($6 != "HIDDEN") && ($7 ~ /^[0-9]+$/)) {
45+
++total_public_symbols;
46+
}
47+
}
48+
{
49+
if (($7 !~ /^[0-9]+$/) ||
50+
($8 ~ /^(wc_|wolf|WOLF|__pfx|fe_|sp_[a-zA-Z090-0_]*[0-9])/) ||
51+
($8 ~ /(_avx[12]|_AVX[12]|_sse[12]|_SSE[12]|_aesni|_AESNI|_bmi2|_x64$)/))
52+
{
53+
next;
54+
}
55+
}
56+
{
57+
if (($4 == "FUNC") && ($5 == "GLOBAL") && ($6 == "DEFAULT")) {
58+
++unprefixed_public_symbols;
59+
print;
60+
}
61+
}
62+
END {
63+
if (unprefixed_public_symbols) {
64+
print unprefixed_public_symbols " unprefixed public symbols found, of " total_public_symbols " total." >"/dev/stderr";
65+
exit(1);
66+
} else {
67+
print total_public_symbols " public symbols found in libwolfssl, all OK.";
68+
exit(0);
69+
}
70+
}' || $(exit 5)

‎.wolfssl_known_macro_extras‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -428,6 +428,7 @@ NO_WOLFSSL_AUTOSAR_CRYPTO
428428
NO_WOLFSSL_AUTOSAR_CSM
429429
NO_WOLFSSL_BASE64_DECODE
430430
NO_WOLFSSL_BN_CTX
431+
NO_WOLFSSL_CURVE25519_BLINDING
431432
NO_WOLFSSL_MSG_EX
432433
NO_WOLFSSL_RENESAS_FSPSM_AES
433434
NO_WOLFSSL_RENESAS_FSPSM_HASH
@@ -942,6 +943,7 @@ _NETOS
942943
_POSIX_C_SOURCE
943944
_SDCC_VERSION_PATCHLEVEL
944945
_SH3
946+
_SILICON_LABS_32B_SERIES_3_CONFIG_301
945947
_SILICON_LABS_SECURITY_FEATURE
946948
_SOCKLEN_T
947949
_SYS_DEVCON_LOCAL_H
@@ -1079,6 +1081,7 @@ __svr4__
10791081
__thumb__
10801082
__ti__
10811083
__x86_64__
1084+
__xtensa__
10821085
byte
10831086
configTICK_RATE_HZ
10841087
fallthrough

‎README‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -29,24 +29,29 @@ of the wolfSSL manual. (https://www.wolfssl.com/docs/wolfssl-manual/ch4/)
2929
*** Notes, Please read ***
3030

3131
Note 1)
32-
wolfSSL as of 3.6.6 no longer enables SSLv3 by default. wolfSSL also no longer
33-
supports static key cipher suites with PSK, RSA, or ECDH. This means if you
34-
plan to use TLS cipher suites you must enable DH (DH is on by default), or
35-
enable ECC (ECC is on by default), or you must enable static key cipher suites
36-
with
37-
38-
WOLFSSL_STATIC_DH
39-
WOLFSSL_STATIC_RSA
40-
or
41-
WOLFSSL_STATIC_PSK
42-
43-
though static key cipher suites are deprecated and will be removed from future
44-
versions of TLS. They also lower your security by removing PFS.
45-
46-
When compiling ssl.c, wolfSSL will now issue a compiler error if no cipher
32+
wolfSSL as of 3.6.6 no longer enables SSLv3 by default. By default, wolfSSL
33+
disables static key cipher suites that use PSK, RSA, or ECDH without ephemeral
34+
key exchange. Instead, wolfSSL enables cipher suites that provide perfect
35+
forward secrecy (PFS) using ephemeral Diffie-Hellman (DH) or Elliptic Curve
36+
(ECC) key exchange, both of which are enabled by default.
37+
38+
If you need to support legacy systems that require static key cipher suites,
39+
you can enable them using one or more of these defines:
40+
41+
WOLFSSL_STATIC_DH
42+
WOLFSSL_STATIC_RSA
43+
WOLFSSL_STATIC_PSK
44+
45+
Important: Static key cipher suites reduce security by eliminating perfect
46+
forward secrecy. These cipher suites reuse the same long-term private key for
47+
all session key exchanges. In contrast, PFS-enabled cipher suites (the wolfSSL
48+
default) generate a new ephemeral key for each session, ensuring that
49+
compromising a long-term key cannot decrypt past sessions.
50+
51+
When compiling `ssl.c`, wolfSSL will now issue a compiler error if no cipher
4752
suites are available. You can remove this error by defining
48-
WOLFSSL_ALLOW_NO_SUITES in the event that you desire that, i.e., you're not
49-
using TLS cipher suites.
53+
`WOLFSSL_ALLOW_NO_SUITES` in the event that you desire that, i.e., you're
54+
not using TLS cipher suites.
5055

5156
Note 2)
5257
wolfSSL takes a different approach to certificate verification than OpenSSL

‎README.md‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -33,19 +33,24 @@ of the wolfSSL manual.
3333
## Notes, Please Read
3434

3535
### Note 1
36-
wolfSSL as of 3.6.6 no longer enables SSLv3 by default. wolfSSL also no longer
37-
supports static key cipher suites with PSK, RSA, or ECDH. This means if you
38-
plan to use TLS cipher suites you must enable DH (DH is on by default), or
39-
enable ECC (ECC is on by default), or you must enable static key cipher suites
40-
with one or more of the following defines:
41-
42-
```
43-
WOLFSSL_STATIC_DH
44-
WOLFSSL_STATIC_RSA
45-
WOLFSSL_STATIC_PSK
46-
```
47-
Though static key cipher suites are deprecated and will be removed from future
48-
versions of TLS. They also lower your security by removing PFS.
36+
wolfSSL as of 3.6.6 no longer enables SSLv3 by default. By default, wolfSSL
37+
disables static key cipher suites that use PSK, RSA, or ECDH without ephemeral
38+
key exchange. Instead, wolfSSL enables cipher suites that provide perfect
39+
forward secrecy (PFS) using ephemeral Diffie-Hellman (DH) or Elliptic Curve
40+
(ECC) key exchange, both of which are enabled by default.
41+
42+
If you need to support legacy systems that require static key cipher suites,
43+
you can enable them using one or more of these defines:
44+
45+
* `WOLFSSL_STATIC_DH`
46+
* `WOLFSSL_STATIC_RSA`
47+
* `WOLFSSL_STATIC_PSK`
48+
49+
**Important:** Static key cipher suites reduce security by eliminating perfect
50+
forward secrecy. These cipher suites reuse the same long-term private key for
51+
all session key exchanges. In contrast, PFS-enabled cipher suites (the wolfSSL
52+
default) generate a new ephemeral key for each session, ensuring that
53+
compromising a long-term key cannot decrypt past sessions.
4954

5055
When compiling `ssl.c`, wolfSSL will now issue a compiler error if no cipher
5156
suites are available. You can remove this error by defining

‎configure.ac‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1503,14 +1503,14 @@ AC_ARG_WITH([liboqs],
15031503
# MLKEM
15041504
# Used:
15051505
# - SHA3, Shake128 and Shake256
1506-
AC_ARG_ENABLE([kyber],
1507-
[AS_HELP_STRING([--enable-kyber],[Enable Kyber/MLKEM (default: disabled)])],
1506+
AC_ARG_ENABLE([mlkem],
1507+
[AS_HELP_STRING([--enable-mlkem],[Enable MLKEM (default: disabled)])],
15081508
[ ENABLED_MLKEM=$enableval ],
15091509
[ ENABLED_MLKEM=no ]
15101510
)
1511-
# note, inherits default from "kyber" clause above.
1512-
AC_ARG_ENABLE([mlkem],
1513-
[AS_HELP_STRING([--enable-mlkem],[Enable MLKEM (default: disabled)])],
1511+
# note, inherits default from "mlkem" clause above.
1512+
AC_ARG_ENABLE([kyber],
1513+
[AS_HELP_STRING([--enable-kyber],[Enable Kyber/MLKEM (default: disabled)])],
15141514
[ ENABLED_MLKEM=$enableval ]
15151515
)
15161516

@@ -1639,11 +1639,16 @@ fi
16391639

16401640
# Dilithium
16411641
# - SHA3, Shake128, Shake256 and AES-CTR
1642-
AC_ARG_ENABLE([dilithium],
1643-
[AS_HELP_STRING([--enable-dilithium],[Enable DILITHIUM (default: disabled)])],
1642+
AC_ARG_ENABLE([mldsa],
1643+
[AS_HELP_STRING([--enable-mldsa],[Enable MLDSA (default: disabled)])],
16441644
[ ENABLED_DILITHIUM=$enableval ],
16451645
[ ENABLED_DILITHIUM=no ]
16461646
)
1647+
# note, inherits default from "mldsa" clause above.
1648+
AC_ARG_ENABLE([dilithium],
1649+
[AS_HELP_STRING([--enable-dilithium],[Enable Dilithium/MLDSA (default: disabled)])],
1650+
[ ENABLED_DILITHIUM=$enableval ]
1651+
)
16471652

16481653
ENABLED_DILITHIUM_OPTS=$ENABLED_DILITHIUM
16491654
ENABLED_DILITHIUM_MAKE_KEY=no
@@ -4924,15 +4929,6 @@ AC_ARG_ENABLE([tlsv12],
49244929
[ ENABLED_TLSV12=yes ]
49254930
)
49264931

4927-
if test "$ENABLED_CRYPTONLY" = "yes"
4928-
then
4929-
ENABLED_TLSV12=no
4930-
fi
4931-
if test "$ENABLED_TLSV12" = "no"
4932-
then
4933-
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_TLS12 -DNO_OLD_TLS"
4934-
fi
4935-
49364932
# STACK SIZE info for testwolfcrypt and examples
49374933
AC_ARG_ENABLE([stacksize],
49384934
[AS_HELP_STRING([--enable-stacksize],[Enable stack size info on examples (default: disabled)])],

0 commit comments

Comments
 (0)