feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity
Files
7c8dafab2fe11793f68ca9a05773c818a7afa33f
wolfssl/configure.ac

8731 lines
277 KiB
Plaintext
Raw Normal View History

update configure.ac name
2011-08-03 11:30:22 -07:00
# configure.ac
Add headers to examples and .i files
2011-07-26 13:27:22 -07:00
#
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
# Copyright (C) 2006-2021 wolfSSL Inc.
Add headers to examples and .i files
2011-07-26 13:27:22 -07:00
#
configure.ac updates
2014-12-31 13:04:03 -07:00
# This file is part of wolfSSL. (formerly known as CyaSSL)
Add headers to examples and .i files
2011-07-26 13:27:22 -07:00
#
#
update copyright to 2020
2020-01-03 15:06:03 -08:00
AC_COPYRIGHT([Copyright (C) 2006-2020 wolfSSL Inc.])
configure.ac: advance AC_PREREQ from 2.63 (2008) to 2.69 (2012) to reflect current automated testing coverage, and to avoid intractable best-practice conflicts between 2.63 and 2.70 (2020); advance AM_INIT_AUTOMAKE from 1.11 (2009) to 1.14.1 (2013) to reflect current automated testing coverage; advance LT_PREREQ from 2.2 (2008) to 2.4.2 (2011) to reflect current automated testing coverage.
2021-03-12 13:49:29 -06:00
AC_PREREQ([2.69])
update changelog for release 5.5.1
2022-09-27 13:40:00 -06:00
AC_INIT([wolfssl],[5.5.1],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[https://www.wolfssl.com])
This should fix the issue around compiling cyassl with a C++ compiler.
2012-10-19 00:30:21 -04:00
AC_CONFIG_AUX_DIR([build-aux])
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
Deprecate some configure flags 1. Add C_EXTRA_FLAGS and C_FLAGS to CFLAGS. 2. Remove the cached copied of C_EXTRA_FLAGS and C_FLAGS. 3. The option.h is set only on CFLAGS, CPPFLAGS, and the AM_ versions.
2020-01-22 14:26:16 -08:00
# The following sets CFLAGS to empty if unset on command line. We do not
# want the default "-g -O2" that AC_PROG_CC sets automatically.
initialize CFLAGS in configure as empty, remove erasing it when hardening CFLAGS
2015-09-17 16:36:53 -07:00
: ${CFLAGS=""}
configure.ac: move the autotools boilerplate/initializations back to the top, before --enable-distro and --enable-reproducible-build handling.
2021-02-24 17:04:33 -06:00
# Capture user C_EXTRA_FLAGS from configure line.
# Use of C_EXTRA_FLAGS is deprecated because CFLAGS was fixed but someone
# might still be using it.
CFLAGS="$CFLAGS $C_EXTRA_FLAGS $C_FLAGS"
Hush ar warning At some point, ar on Ubuntu started throwing the following warning: ar: `u' modifier ignored since `D' is the default (see `U') Add the "U" option to the ar flags if the version of ar supports it. (The version used by macOS does not support the flag, for example.) The AR_FLAGS set in configure will later be used by libtool.
2018-05-16 09:55:16 -04:00
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
AC_PROG_CC
AM_PROG_CC_C_O
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AC_CANONICAL_HOST
fixes for compat with autoconf 2.70 and gcc-10: update m4/ax_pthread.m4 and m4/ax_tls.m4 from upstream, fix declaration syntax in tests/api.c, add AC_CANONICAL_TARGET in configure.ac, and fix two spots with bad quoting syntax in configure.ac and m4/ax_linuxkm.m4. also fix myriad whitespace flubs in api.c.
2021-03-11 17:29:12 -06:00
AC_CANONICAL_TARGET
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
AC_CONFIG_MACRO_DIR([m4])
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
configure.ac: advance AC_PREREQ from 2.63 (2008) to 2.69 (2012) to reflect current automated testing coverage, and to avoid intractable best-practice conflicts between 2.63 and 2.70 (2020); advance AM_INIT_AUTOMAKE from 1.11 (2009) to 1.14.1 (2013) to reflect current automated testing coverage; advance LT_PREREQ from 2.2 (2008) to 2.4.2 (2011) to reflect current automated testing coverage.
2021-03-12 13:49:29 -06:00
AM_INIT_AUTOMAKE([1.14.1 -Wall -Werror -Wno-portability foreign tar-ustar subdir-objects no-define color-tests])
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])])
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
Update autoconf rules. Fixes bug url to point to github issues.
2013-09-15 00:13:30 -07:00
AC_ARG_PROGRAM
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
AC_CONFIG_HEADERS([config.h:config.in])
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
configure.ac: advance AC_PREREQ from 2.63 (2008) to 2.69 (2012) to reflect current automated testing coverage, and to avoid intractable best-practice conflicts between 2.63 and 2.70 (2020); advance AM_INIT_AUTOMAKE from 1.11 (2009) to 1.14.1 (2013) to reflect current automated testing coverage; advance LT_PREREQ from 2.2 (2008) to 2.4.2 (2011) to reflect current automated testing coverage.
2021-03-12 13:49:29 -06:00
LT_PREREQ([2.4.2])
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
LT_INIT([disable-static win32-dll])
1.8.8 init
2011-02-05 11:14:47 -08:00
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
AC_ARG_VAR(EXTRA_CFLAGS, [Extra CFLAGS to add to autoconf-computed arg list. Can also supply directly to make.])
2.0.0 rc1 versioning
2011-04-29 13:08:05 -07:00
#shared library versioning
update changelog for release 5.5.1
2022-09-27 13:40:00 -06:00
WOLFSSL_LIBRARY_VERSION=36:0:1
Release v3.15.0 1. Update configure.ac for new version. 2. Update the version header. 3. Update the README files with the new changelog. 4. Moved all previous change logs from README files to NEWS files.
2018-05-30 17:11:38 -07:00
# | | |
# +------+ | +---+
# | | |
# current:revision:age
# | | |
# | | +- increment if interfaces have been added
# | | set to zero if interfaces have been removed
# | | or changed
# | +- increment if source code has changed
# | set to zero if current is incremented
# +- increment if interfaces have been added, removed or changed
examples not seeing WOLFSSL_API
2014-12-29 16:30:26 -07:00
AC_SUBST([WOLFSSL_LIBRARY_VERSION])
2.0.0 rc1 versioning
2011-04-29 13:08:05 -07:00
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
gl_VISIBILITY
Remove version (it is a generated file), also updated how visibility is done.
2012-10-20 21:24:28 -04:00
AS_IF([ test -n "$CFLAG_VISIBILITY" ], [
Deprecate some configure flags 1. Add C_EXTRA_FLAGS and C_FLAGS to CFLAGS. 2. Remove the cached copied of C_EXTRA_FLAGS and C_FLAGS. 3. The option.h is set only on CFLAGS, CPPFLAGS, and the AM_ versions.
2020-01-22 14:26:16 -08:00
AM_CFLAGS="$AM_CPPFLAGS $CFLAG_VISIBILITY"
Remove version (it is a generated file), also updated how visibility is done.
2012-10-20 21:24:28 -04:00
])
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
Moved the check for the size of long, long long, and __m128 to before the checks for libraries. In some combination of autotools, making a 32-bit build, the autoconf test code can't link libnetwork and crashes, leaving those sizes all set to 0.
2016-12-06 16:15:45 -08:00
# Moved these size of and type checks before the library checks.
# The library checks add the library to subsequent test compiles
# and in some rare cases, the networking check causes these sizeof
# checks to fail.
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
AC_CHECK_SIZEOF([long long])
AC_CHECK_SIZEOF([long])
cast to resolve warning, check size of time_t, and check for null test case
2018-11-12 16:02:33 -07:00
AC_CHECK_SIZEOF([time_t])
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
AC_CHECK_TYPES([__uint128_t])
configure.ac: supplement AC_CHECK_FUNCS() (function link test) with AC_CHECK_DECLS() (function declaration test) to avoid false positives. fixes various build failure modes.
2020-10-09 22:18:51 -05:00
configure.ac: move the autotools boilerplate/initializations back to the top, before --enable-distro and --enable-reproducible-build handling.
2021-02-24 17:04:33 -06:00
# Distro build feature subset (Debian, Ubuntu, etc.)
AC_ARG_ENABLE([distro],
[AS_HELP_STRING([--enable-distro],[Enable wolfSSL distro build (default: disabled)])],
[ ENABLED_DISTRO=$enableval ],
[ ENABLED_DISTRO=no ]
)
if test "$ENABLED_DISTRO" = "yes"
then
enable_shared=yes
enable_static=yes
enable_all=yes
disable early data for --enable-distro addressed jenkins failure
2022-03-04 08:46:43 +09:00
enable_earlydata=no
configure.ac: move the autotools boilerplate/initializations back to the top, before --enable-distro and --enable-reproducible-build handling.
2021-02-24 17:04:33 -06:00
REPRODUCIBLE_BUILD_DEFAULT=yes
else
REPRODUCIBLE_BUILD_DEFAULT=no
fi
Various portability improvements: * Change DTLS epoch size word16. * Allow override of the `RECORD_SIZE` and `STATIC_BUFFER_LEN`. * Remove endianness force from game build. * Add `gmtime_s` option. * Fix for macro conflict with `MAX_KEY_SIZE`. * Expose functions `wolfSSL_X509_notBefore`, `wolfSSL_X509_notAfter`, `wolfSSL_X509_version` without `OPENSSL_EXTRA`.
2022-03-17 14:00:55 -07:00
AC_CHECK_HEADERS([arpa/inet.h fcntl.h limits.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h sys/time.h errno.h sys/un.h])
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
AC_CHECK_LIB([network],[socket])
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AC_C_BIGENDIAN
1.8.8 init
2011-02-05 11:14:47 -08:00
configure.ac: supplement AC_CHECK_FUNCS() (function link test) with AC_CHECK_DECLS() (function declaration test) to avoid false positives. fixes various build failure modes.
2020-10-09 22:18:51 -05:00
# check if functions of interest are linkable, but also check if
# they're declared by the expected headers, and if not, supersede the
# unusable positive from AC_CHECK_FUNCS().
Various portability improvements: * Change DTLS epoch size word16. * Allow override of the `RECORD_SIZE` and `STATIC_BUFFER_LEN`. * Remove endianness force from game build. * Add `gmtime_s` option. * Fix for macro conflict with `MAX_KEY_SIZE`. * Expose functions `wolfSSL_X509_notBefore`, `wolfSSL_X509_notAfter`, `wolfSSL_X509_version` without `OPENSSL_EXTRA`.
2022-03-17 14:00:55 -07:00
AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday gmtime_r gmtime_s inet_ntoa memset socket strftime atexit])
AC_CHECK_DECLS([gethostbyname, getaddrinfo, gettimeofday, gmtime_r, gmtime_s, inet_ntoa, memset, socket, strftime], [], [
configure.ac: supplement AC_CHECK_FUNCS() (function link test) with AC_CHECK_DECLS() (function declaration test) to avoid false positives. fixes various build failure modes.
2020-10-09 22:18:51 -05:00
if test "$(eval echo \$"$(eval 'echo ac_cv_func_${as_decl_name}')")" = "yes"
then
fixes for make check with --enable-all (now including --enable-earlydata) with fips or asynccrypt: in scripts/tls13.test, use fips-compatible server-side cipher suite for "TLS v1.3 cipher suite mismatch" test, and modernize some syntax; in configure.ac, omit earlydata from enable-all when asynccrypt, pending fix; also in configure.ac, fix AC_CHECK_DECLS()-overriding-AC_CHECK_FUNCS() kludge, to fix CPPFLAGS=-std=c99 builds.
2022-03-07 17:19:31 -06:00
AC_MSG_NOTICE([ note: earlier check for $(eval 'echo ${as_decl_name}') superseded.])
eval "ac_cv_func_${as_decl_name}=no"
configure.ac: supplement AC_CHECK_FUNCS() (function link test) with AC_CHECK_DECLS() (function declaration test) to avoid false positives. fixes various build failure modes.
2020-10-09 22:18:51 -05:00
_mask_varname=HAVE_`eval "echo '${as_decl_name}'" | tr 'a-z' 'A-Z'`
fixes for make check with --enable-all (now including --enable-earlydata) with fips or asynccrypt: in scripts/tls13.test, use fips-compatible server-side cipher suite for "TLS v1.3 cipher suite mismatch" test, and modernize some syntax; in configure.ac, omit earlydata from enable-all when asynccrypt, pending fix; also in configure.ac, fix AC_CHECK_DECLS()-overriding-AC_CHECK_FUNCS() kludge, to fix CPPFLAGS=-std=c99 builds.
2022-03-07 17:19:31 -06:00
sed --in-place "s~^#define ${_mask_varname} 1$~~" confdefs.h
configure.ac: supplement AC_CHECK_FUNCS() (function link test) with AC_CHECK_DECLS() (function declaration test) to avoid false positives. fixes various build failure modes.
2020-10-09 22:18:51 -05:00
fi
], [[
#ifdef HAVE_SYS_SOCKET_H
#include <sys/socket.h>
#endif
#ifdef HAVE_STRING_H
#include <string.h>
#endif
#ifdef HAVE_NETDB_H
#include <netdb.h>
#endif
#ifdef HAVE_ARPA_INET_H
#include <arpa/inet.h>
#endif
#ifdef HAVE_SYS_TIME_H
#include <sys/time.h>
#endif
#ifdef HAVE_TIME_H
#include <time.h>
#endif
]])
1.8.8 init
2011-02-05 11:14:47 -08:00
AC_PROG_INSTALL
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AC_TYPE_SIZE_T
AC_TYPE_UINT8_T
Refactor pointer manipulation to be independent of datatype width Tested with `./configure CFLAGS="-DNO_64BIT" --disable-sha512 --disable-sha384 --enable-harden` on a 64-bit machine
2021-05-03 11:23:55 -07:00
AC_TYPE_UINTPTR_T
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AM_PROG_AS
add compiler visibility detection, default hide, add external API linkage and internal LOCAL linkage
2011-04-26 15:41:16 -07:00
Omit -fomit-frame-pointer from CFLAGS.
2020-04-08 14:06:11 -07:00
OPTIMIZE_CFLAGS="-Os"
OPTIMIZE_FAST_CFLAGS="-O2"
break up huge math into individual parts so can add piece by piece, e.g., ECC256
2013-09-03 13:13:13 -07:00
OPTIMIZE_HUGE_CFLAGS="-funroll-loops -DTFM_SMALL_SET -DTFM_HUGE_SET"
configure.ac updates
2014-12-31 13:04:03 -07:00
DEBUG_CFLAGS="-g -DDEBUG -DDEBUG_WOLFSSL"
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
LIB_ADD=
LIB_STATIC_ADD=
1.8.8 init
2011-02-05 11:14:47 -08:00
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
if test "$output_objdir" = ""
then
output_objdir=.
fi
add thread local storage to ecc fp cache, no locking required but cache is per thread, higher conncurrent performance but more memory needed
2013-11-11 17:00:35 -08:00
# Thread local storage
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
AX_TLS([thread_ls_on=yes],[thread_ls_on=no])
AS_IF([test "x$thread_ls_on" = "xyes"],[AM_CFLAGS="$AM_CFLAGS -DHAVE_THREAD_LS"])
1.8.8 init
2011-02-05 11:14:47 -08:00
# DEBUG
This should fix the issue around compiling cyassl with a C++ compiler.
2012-10-19 00:30:21 -04:00
AX_DEBUG
Brian changes
2012-10-24 11:53:33 -07:00
AS_IF([test "$ax_enable_debug" = "yes"],
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
[AM_CFLAGS="$AM_CFLAGS $DEBUG_CFLAGS"],
Brian changes
2012-10-24 11:53:33 -07:00
[AM_CFLAGS="$AM_CFLAGS -DNDEBUG"])
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
AS_IF([test "$ax_enable_debug" = "yes"],
[AM_CCASFLAGS="$DEBUG_CFLAGS $AM_CCASFLAGS"],
[AM_CCASFLAGS="$AM_CCASFLAGS -DNDEBUG"])
1.8.8 init
2011-02-05 11:14:47 -08:00
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
# Start without certificates enabled and enable if a certificate algorithm is
# enabled
ENABLED_CERTS="no"
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
# Support for forcing 32-bit mode
# To force 32-bit instructions use:
# ./configure CFLAGS="-m32" LDFLAGS="-m32" && make
# The checks for sizeof long and long/long are run at the top of configure and require "-m32" to be set directly in the ./configure statement.
AC_ARG_ENABLE([32bit],
[AS_HELP_STRING([--enable-32bit],[Enables 32-bit support (default: disabled)])],
[ ENABLED_32BIT=$enableval ],
[ ENABLED_32BIT=no ]
)
# 16-bit compiler support
AC_ARG_ENABLE([16bit],
[AS_HELP_STRING([--enable-16bit],[Enables 16-bit support (default: disabled)])],
[ ENABLED_16BIT=$enableval ],
[ ENABLED_16BIT=no ]
)
if test "$ENABLED_16BIT" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWC_16BIT_CPU"
fi
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
AC_ARG_ENABLE([64bit],
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
[AS_HELP_STRING([--enable-64bit],[Enables 64-bit support (default: disabled)])],
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
[ ENABLED_64BIT=$enableval ],
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
[ ENABLED_64BIT=no ]
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
)
AC_ARG_ENABLE([kdf],
[AS_HELP_STRING([--enable-kdf],[Enables kdf support (default: enabled)])],
[ ENABLED_KDF=$enableval ],
[ ENABLED_KDF=yes ]
)
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
AC_ARG_ENABLE([hmac],
[AS_HELP_STRING([--enable-hmac],[Enables HMAC support (default: enabled)])],
[ ENABLED_HMAC=$enableval ],
[ ENABLED_HMAC=yes ]
)
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
AC_ARG_ENABLE([do178],
[AS_HELP_STRING([--enable-do178],[Enable DO-178, Will NOT work w/o DO178 license (default: disabled)])],
[ENABLED_DO178=$enableval],
[ENABLED_DO178="no"])
if test "$ENABLED_DO178" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_DO178"
else
AM_CFLAGS="$AM_CFLAGS -DHAVE_DO178"
fi
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
# Support for disabling all ASM
AC_ARG_ENABLE([asm],
[AS_HELP_STRING([--enable-asm],[Enables option for assembly (default: enabled)])],
[ ENABLED_ASM=$enableval ],
[ ENABLED_ASM=yes ]
)
if test "$ENABLED_ASM" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DTFM_NO_ASM -DWOLFSSL_NO_ASM"
fi
AC_SUBST([ENABLED_ASM])
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
# Default math is SP Math all and not fast math
# FIPS v1 and v2 must use fast math
DEF_SP_MATH="yes"
DEF_FAST_MATH="no"
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
# FIPS 140
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
AC_ARG_ENABLE([fips],
[AS_HELP_STRING([--enable-fips],[Enable FIPS 140-2, Will NOT work w/o FIPS license (default: disabled)])],
[ENABLED_FIPS=$enableval],
[ENABLED_FIPS="no"])
Make the code simpler.
2022-02-04 16:05:58 -05:00
# wolfEngine Options
AC_ARG_ENABLE([engine],
[AS_HELP_STRING([--enable-engine],[Enable wolfEngine options (default: disabled)])],
[ ENABLED_WOLFENGINE=$enableval ],
[ ENABLED_WOLFENGINE=no ]
)
AS_CASE([$ENABLED_WOLFENGINE],
[no],[
ENABLED_WOLFENGINE="no"
],
[disabled],[
ENABLED_WOLFENGINE="no"
],
[yes|fips-v2|cert3389],[
ENABLED_WOLFENGINE="yes"
ENABLED_FIPS="v2"
],
[fips-ready],[
ENABLED_WOLFENGINE="yes"
ENABLED_FIPS="ready"
],
[no-fips],[
ENABLED_WOLFENGINE="yes"
ENABLED_FIPS="no"
],
[
AC_MSG_ERROR([Invalid value for --enable-engine "$ENABLED_WOLFENGINE" (options: fips-v2, fips-ready, no-fips, no, disabled)])
])
FIPS 140-3 1. Change the internal version number for the FIPS 140-3 changes as v4. 2. Insert v3 as an alias for FIPS Ready. 3. Use the correct directory for the FIPS old files sources. (For local testing of 140-3 builds.) 4. Change back the check for the FIPS version in internal.c for EccMakeKey().
2020-10-21 11:58:38 -07:00
# The FIPS options are:
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
# no - FIPS build disabled, FIPS sources forbidden in build tree
# disabled - FIPS build disabled, FIPS sources ignored in build tree
FIPS 140-3 1. Change the internal version number for the FIPS 140-3 changes as v4. 2. Insert v3 as an alias for FIPS Ready. 3. Use the correct directory for the FIPS old files sources. (For local testing of 140-3 builds.) 4. Change back the check for the FIPS version in internal.c for EccMakeKey().
2020-10-21 11:58:38 -07:00
# v1 - FIPS 140-2 Cert 2425
# default - same as v1
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
# v2 - FIPS 140-2 Cert 3389
# cert3389 - alias for v2
# rand - wolfRand
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
# v5-RC12 - FIPS 140-3, wolfCrypt/fips WCv5.0-RC12
# v5 - currently, alias for v5-RC12
# ready - FIPS 140-3 settings with in-tree wolfcrypt sources, feature locked
# dev - FIPS 140-3 settings with in-tree wolfcrypt sources, features freely adjustable
Restore v5-dev/v5-ready configure options as customers are currently using them.
2022-09-20 14:26:15 -07:00
# v5-ready - Alias for ready.
# v5-dev - Alias for dev.
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
#
# These options have been retired, but are listed here for historical reference:
# v5-RC8 - historical FIPS 140-3 (wolfCrypt WCv5.0-RC8).
# HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 0.
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
# v5-RC9 - historical FIPS 140-3 (wolfCrypt WCv5.0-RC9)
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
# HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 1.
configure.ac: update fips with RC11.
2021-12-22 13:30:43 -06:00
# v5-RC10 - historical FIPS 140-3, wolfCrypt/fips WCv5.0-RC10
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
# HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 2.
Update configure and fips-check.sh for FIPS RC12.
2021-12-30 15:19:26 -08:00
# v5-RC11 - historical FIPS 140-3, wolfCrypt/fips WCv5.0-RC11
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
# HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 2.
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
AS_CASE([$ENABLED_FIPS],
configure: FIPS error and compatability cleanup Use autotools macros for case and if. Simplify validation logic.
2021-02-23 15:33:52 -08:00
[no],[
FIPS_VERSION="none"
ENABLED_FIPS="no"
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
],
configure.ac: fips tweaks: add --enable-fips=disabled to allow non-fips build in a fips tree, for convenient testing; add ENABLED_SHAKE256=no override to fipsv5 setup; don't add an RSA_MAX_SIZE setting to AM_CFLAGS when FIPS, to avoid a conflict with old rsa.h.
2021-09-24 17:29:00 -05:00
[disabled],[
FIPS_VERSION="disabled"
ENABLED_FIPS="no"
],
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
[v1|yes|cert2425],[
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
FIPS_VERSION="v1"
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
HAVE_FIPS_VERSION=1
ENABLED_FIPS="yes"
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
DEF_SP_MATH="no"
DEF_FAST_MATH="yes"
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
],
[v2|cert3389],[
configure.ac: fixes for --enable-fips logic.
2021-10-26 22:51:59 -05:00
FIPS_VERSION="v2"
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
HAVE_FIPS_VERSION=2
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
HAVE_FIPS_VERSION_MINOR=0
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
ENABLED_FIPS="yes"
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
DEF_SP_MATH="no"
DEF_FAST_MATH="yes"
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
[rand],[
FIPS_VERSION="rand"
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
HAVE_FIPS_VERSION=2
HAVE_FIPS_VERSION_MINOR=1
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
ENABLED_FIPS="yes"
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
DEF_SP_MATH="no"
configure.ac fixes related to change in default math back end (to sp-math-all): wolfRand doesn't use fastmath; FIPS v5-dev follows the non-FIPS default (now sp-math-all); add -DWC_NO_CACHE_RESISTANT to AM_CFLAGS when $ENABLED_HARDEN != yes; add ENABLED_BIGNUM sensor and use it in linuxkm math back end assert; add configuration callout for "Side-channel Hardening" reporting value of $ENABLED_HARDEN.
2022-06-24 15:55:08 -05:00
DEF_FAST_MATH="no"
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
],
Update configure and fips-check.sh for FIPS RC12.
2021-12-30 15:19:26 -08:00
[v5|v5-RC12],[
FIPS_VERSION="v5-RC12"
HAVE_FIPS_VERSION=5
HAVE_FIPS_VERSION_MINOR=2
ENABLED_FIPS="yes"
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
DEF_SP_MATH="no"
DEF_FAST_MATH="yes"
configure.ac: update fips with RC11.
2021-12-22 13:30:43 -06:00
],
Restore v5-dev/v5-ready configure options as customers are currently using them.
2022-09-20 14:26:15 -07:00
[ready|v5-ready],[
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
FIPS_VERSION="ready"
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
HAVE_FIPS_VERSION=5
AES: harmonize wc_Aes{Encrypt,Decrypt} and wc_Aes{Encrypt,Decrypt}Direct implementations to return int; add return values to all static void functions in aes.c that can fail; add WARN_UNUSED_RESULT to all static functions in aes.c with return values; implement missing error percolation around AES block cipher implementations; bump FIPS version for v5-ready and v5-dev to 5.3 (v5-RC12 is 5.2).
2022-01-21 14:48:12 -06:00
HAVE_FIPS_VERSION_MINOR=3
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
ENABLED_FIPS="yes"
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
DEF_SP_MATH="no"
DEF_FAST_MATH="yes"
configure: FIPS error and compatability cleanup Use autotools macros for case and if. Simplify validation logic.
2021-02-23 15:33:52 -08:00
],
Restore v5-dev/v5-ready configure options as customers are currently using them.
2022-09-20 14:26:15 -07:00
[dev|v5-dev],[
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
FIPS_VERSION="dev"
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
HAVE_FIPS_VERSION=5
AES: harmonize wc_Aes{Encrypt,Decrypt} and wc_Aes{Encrypt,Decrypt}Direct implementations to return int; add return values to all static void functions in aes.c that can fail; add WARN_UNUSED_RESULT to all static functions in aes.c with return values; implement missing error percolation around AES block cipher implementations; bump FIPS version for v5-ready and v5-dev to 5.3 (v5-RC12 is 5.2).
2022-01-21 14:48:12 -06:00
HAVE_FIPS_VERSION_MINOR=3
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
ENABLED_FIPS="yes"
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
# for dev, DEF_SP_MATH and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all)
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
],
configure: FIPS error and compatability cleanup Use autotools macros for case and if. Simplify validation logic.
2021-02-23 15:33:52 -08:00
[
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
AC_MSG_ERROR([Invalid value for --enable-fips "$ENABLED_FIPS" (main options: v1, v2, v5, ready, dev, rand, no, disabled)])
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
])
libwebsockets requires *CRYPTO_EX_DATA* APIs
2020-08-06 16:05:03 -07:00
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
if test -z "$HAVE_FIPS_VERSION_MINOR"
then
HAVE_FIPS_VERSION_MINOR=0
fi
if test -z "$HAVE_FIPS_VERSION"
then
HAVE_FIPS_VERSION=0
fi
configure.ac: fix handling of ENABLED_FIPS->REPRODUCIBLE_BUILD_DEFAULT=yes; take JNI back out of from enable-all feature set because it adds -DNO_ERROR_QUEUE to flags; fix typo in FIPS test for --with-max-rsa-bits setup.
2021-10-07 22:33:12 -05:00
if test "$ENABLED_FIPS" != "no"
then
REPRODUCIBLE_BUILD_DEFAULT=yes
fi
configure: FIPS error and compatability cleanup Use autotools macros for case and if. Simplify validation logic.
2021-02-23 15:33:52 -08:00
AS_CASE([$FIPS_VERSION],
[none],
[
AS_IF([ test -s $srcdir/wolfcrypt/src/fips.c -o -s $srcdir/ctaocrypt/src/fips.c ],
configure.ac: revert change (AC_MSG_NOTICE reverted to AC_MSG_ERROR) for "FIPS source tree used for non-FIPS build"; in enable_all set, move enable_stunnel and enable_tcpdump to the !ENABLED_LINUXKM_DEFAULTS section.
2021-08-26 17:59:10 -05:00
[AC_MSG_ERROR([FIPS source tree is incompatible with non-FIPS build (requires --enable-fips)])])
configure: FIPS error and compatability cleanup Use autotools macros for case and if. Simplify validation logic.
2021-02-23 15:33:52 -08:00
],
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
[disabled],
[],
configure: FIPS error and compatability cleanup Use autotools macros for case and if. Simplify validation logic.
2021-02-23 15:33:52 -08:00
[v1],
[
AS_IF([ ! test -s $srcdir/ctaocrypt/src/fips.c],
[AC_MSG_ERROR([non-FIPS-v1 source tree is incompatible with --enable-fips=$enableval])])
],
[
AS_IF([ ! test -s $srcdir/wolfcrypt/src/fips.c],
[AC_MSG_ERROR([non-FIPS source tree is incompatible with --enable-fips=$enableval])])
]
)
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
# For reproducible build, gate out from the build anything that might
# introduce semantically frivolous jitter, maximizing chance of
# identical object files.
AC_ARG_ENABLE([reproducible-build],
[AS_HELP_STRING([--enable-reproducible-build],[Enable maximally reproducible build (default: disabled)])],
[ ENABLED_REPRODUCIBLE_BUILD=$enableval ],
[ ENABLED_REPRODUCIBLE_BUILD=$REPRODUCIBLE_BUILD_DEFAULT ]
)
if test "$ENABLED_REPRODUCIBLE_BUILD" = "yes"
then
configure.ac: refactor setup for --enable-reproducible-build; remove mutex between --enable-sp-math and --enable-sp-math-all (they can now coexist); whitespace cleanup.
2021-11-05 18:18:53 -05:00
# Test ar for the "D" option. Should be checked before the libtool macros.
if test -z "$AR"; then
AR=ar
fi
xxx_ar_flags=$(${AR} --help 2>&1)
if test -z "$RANLIB"; then
RANLIB=ranlib
fi
xxx_ranlib_flags=$(${RANLIB} --help 2>&1)
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_REPRODUCIBLE_BUILD"
configure.ac: fix --enable-reproducible-build to cope with update from libtool-2.4.6 to -2.4.7.
2022-03-29 07:53:43 -05:00
AS_CASE([$xxx_ar_flags],[*'use zero for timestamps and uids/gids'*],[AR_FLAGS="Dcr" lt_ar_flags="Dcr"])
configure.ac: refactor setup for --enable-reproducible-build; remove mutex between --enable-sp-math and --enable-sp-math-all (they can now coexist); whitespace cleanup.
2021-11-05 18:18:53 -05:00
AS_CASE([$xxx_ranlib_flags],[*'Use zero for symbol map timestamp'*],[RANLIB="${RANLIB} -D"])
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
fi
linuxkm: add --enable-benchmark switch (default yes) and BUILD_BENCHMARK conditional to configure.ac to allow build with testwolfcrypt but without benchmark; change gate in wolfcrypt/benchmark/include.am from `if !BUILD_LINUXKM` to `if BUILD_BENCHMARK`.
2021-11-08 18:25:15 -06:00
AC_ARG_ENABLE([benchmark],
[AS_HELP_STRING([--enable-benchmark],[Build benchmark when building crypttests (default: enabled)])],
[ENABLED_BENCHMARK=$enableval],
[ENABLED_BENCHMARK=yes]
)
configure.ac: move AC_ARG_ENABLE([linuxkm] before AC_ARG_ENABLE([filesystem], and add ENABLED_FILESYSTEM_DEFAULT=no when ENABLED_LINUXKM.
2020-09-17 22:15:58 -05:00
# Linux Kernel Module
AC_ARG_ENABLE([linuxkm],
[AS_HELP_STRING([--enable-linuxkm],[Enable Linux Kernel Module (default: disabled)])],
[ENABLED_LINUXKM=$enableval],
[ENABLED_LINUXKM=no]
)
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
AC_ARG_ENABLE([linuxkm-defaults],
[AS_HELP_STRING([--enable-linuxkm-defaults],[Enable feature defaults for Linux Kernel Module (default: disabled)])],
[ENABLED_LINUXKM_DEFAULTS=$enableval],
[ENABLED_LINUXKM_DEFAULTS=$ENABLED_LINUXKM]
)
--enable-linuxkm-pie (FIPS Linux kernel module) (#4276) * Adds `--enable-linuxkm-pie` and associated infrastructure, to support FIPS mode in the Linux kernel module. * Adds `tests/api.c` missing (void) arglist to `test_SSL_CIPHER_get_xxx()`.
2021-08-19 11:15:52 -05:00
AC_ARG_ENABLE([linuxkm-pie],
[AS_HELP_STRING([--enable-linuxkm-pie],[Enable relocatable object build of Linux kernel module (default: disabled)])],
[ENABLED_LINUXKM_PIE=$enableval],
[ENABLED_LINUXKM_PIE=$ENABLED_FIPS]
)
if test "$ENABLED_LINUXKM_PIE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_LINUXKM_PIE_SUPPORT"
configure.ac: fips 140-3: don't insist on linuxkm-pie unless configuring an actual linuxkm build.
2022-04-04 10:14:22 -05:00
elif test "$ENABLED_FIPS" = yes && test "$ENABLED_LINUXKM" = yes
--enable-linuxkm-pie (FIPS Linux kernel module) (#4276) * Adds `--enable-linuxkm-pie` and associated infrastructure, to support FIPS mode in the Linux kernel module. * Adds `tests/api.c` missing (void) arglist to `test_SSL_CIPHER_get_xxx()`.
2021-08-19 11:15:52 -05:00
then
configure.ac: fips 140-3: don't insist on linuxkm-pie unless configuring an actual linuxkm build.
2022-04-04 10:14:22 -05:00
AC_MSG_ERROR([FIPS linuxkm requires linuxkm-pie.])
--enable-linuxkm-pie (FIPS Linux kernel module) (#4276) * Adds `--enable-linuxkm-pie` and associated infrastructure, to support FIPS mode in the Linux kernel module. * Adds `tests/api.c` missing (void) arglist to `test_SSL_CIPHER_get_xxx()`.
2021-08-19 11:15:52 -05:00
fi
AC_SUBST([ENABLED_LINUXKM_PIE])
improve --enable-linuxkm-defaults fidelity.
2020-10-01 18:07:48 -05:00
if test "$ENABLED_LINUXKM_DEFAULTS" = "yes"
then
configure.ac: when $ENABLED_LINUXKM_DEFAULTS, set -DWOLFSSL_OLD_PRIME_CHECK only if $ENABLED_FIPS == no.
2022-04-05 08:10:03 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_CONST -DWOLFSSL_SP_MOD_WORD_RP -DWOLFSSL_SP_DIV_64 -DWOLFSSL_SP_DIV_WORD_HALF -DWOLFSSL_SMALL_STACK_STATIC -DWOLFSSL_TEST_SUBROUTINE=static"
if test "$ENABLED_FIPS" = "no"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_OLD_PRIME_CHECK"
fi
configure.ac fixes related to change in default math back end (to sp-math-all): wolfRand doesn't use fastmath; FIPS v5-dev follows the non-FIPS default (now sp-math-all); add -DWC_NO_CACHE_RESISTANT to AM_CFLAGS when $ENABLED_HARDEN != yes; add ENABLED_BIGNUM sensor and use it in linuxkm math back end assert; add configuration callout for "Side-channel Hardening" reporting value of $ENABLED_HARDEN.
2022-06-24 15:55:08 -05:00
DEF_SP_MATH="yes"
DEF_FAST_MATH="no"
improve --enable-linuxkm-defaults fidelity.
2020-10-01 18:07:48 -05:00
fi
configure.ac: move AC_ARG_ENABLE([linuxkm] before AC_ARG_ENABLE([filesystem], and add ENABLED_FILESYSTEM_DEFAULT=no when ENABLED_LINUXKM.
2020-09-17 22:15:58 -05:00
AC_ARG_WITH([linux-source],
[AS_HELP_STRING([--with-linux-source=PATH],[PATH to root of Linux kernel build tree])],
[KERNEL_ROOT=$withval],
[KERNEL_ROOT=""])
AC_ARG_WITH([linux-arch],
[AS_HELP_STRING([--with-linux-arch=arch],[built arch (SRCARCH) of Linux kernel build tree])],
[KERNEL_ARCH=$withval],
[KERNEL_ARCH=""])
if test "x$ENABLED_LINUXKM" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LINUXKM"
ENABLED_NO_LIBRARY=yes
linuxkm: add --enable-benchmark switch (default yes) and BUILD_BENCHMARK conditional to configure.ac to allow build with testwolfcrypt but without benchmark; change gate in wolfcrypt/benchmark/include.am from `if !BUILD_LINUXKM` to `if BUILD_BENCHMARK`.
2021-11-08 18:25:15 -06:00
ENABLED_BENCHMARK=no
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
output_objdir="$(realpath "$output_objdir")/linuxkm"
configure.ac: move AC_ARG_ENABLE([linuxkm] before AC_ARG_ENABLE([filesystem], and add ENABLED_FILESYSTEM_DEFAULT=no when ENABLED_LINUXKM.
2020-09-17 22:15:58 -05:00
if test "$KERNEL_ROOT" = ""; then
AC_PATH_DEFAULT_KERNEL_SOURCE
KERNEL_ROOT="$DEFAULT_KERNEL_ROOT"
fi
AC_SUBST([KERNEL_ROOT])
if test "$KERNEL_ARCH" = ""; then
AC_DEFAULT_KERNEL_ARCH
KERNEL_ARCH="$DEFAULT_KERNEL_ARCH"
fi
AC_SUBST([KERNEL_ARCH])
if test "${KERNEL_ROOT}" = ""; then
AC_MSG_ERROR([Linux kernel source root not found -- supply with --with-linux-source=PATH.])
fi
if test "${KERNEL_ARCH}" = ""; then
AC_MSG_ERROR([Linux kernel target architecture for build tree ${KERNEL_ROOT} could not be determined. Is target kernel configured?])
fi
AM_CFLAGS="$AM_CFLAGS -DNO_DEV_RANDOM -DNO_WRITEV -DNO_STDIO_FILESYSTEM -DWOLFSSL_NO_SOCK -DWOLFSSL_USER_IO"
fi
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
# MATH LIBRARY SELECTION
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
# Single Precision maths implementation
AC_ARG_ENABLE([sp],
[AS_HELP_STRING([--enable-sp],[Enable Single Precision maths implementation (default: disabled)])],
[ ENABLED_SP=$enableval ],
[ ENABLED_SP=$ENABLED_SP_DEFAULT ],
)
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
AC_ARG_ENABLE([sp-math-all],
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
[AS_HELP_STRING([--enable-sp-math-all],[Enable Single Precision math implementation for full algorithm suite (default: enabled)])],
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
[ ENABLED_SP_MATH_ALL=$enableval ],
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
[ ENABLED_SP_MATH_ALL=$DEF_SP_MATH ],
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
)
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
# Single Precision maths (acceleration for common key sizes and curves)
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
if test "$ENABLED_LINUXKM_DEFAULTS" = "yes" && test "$ENABLED_SP" != "no" && test "$ENABLED_SP_MATH_ALL" = "no"
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
then
ENABLED_SP_MATH_DEFAULT=yes
else
ENABLED_SP_MATH_DEFAULT=no
fi
AC_ARG_ENABLE([sp-math],
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
[AS_HELP_STRING([--enable-sp-math],[Enable Single Precision math implementation with restricted algorithm suite (default: disabled)])],
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
[ ENABLED_SP_MATH=$enableval ],
[ ENABLED_SP_MATH=$ENABLED_SP_MATH_DEFAULT ],
)
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
if test "$enable_sp_math" != ""
then
# When the restricted SP Math is selected and not SP Math ALL, then disable
# SP Math ALL.
if test "$enable_sp_math" != "no" && test "$enable_sp_math_all" = ""
then
ENABLED_SP_MATH_ALL="no"
else
# Can't choose restricted and unrestricted SP Math
if test "$enable_sp_math" != "no" && test "$enable_sp_math_all" != "no"
then
AC_MSG_ERROR([--enable-sp-math and --enable-sp-math-all are incompatible. Use --enable-sp-math-all only when all key sizes need to be supported.])
fi
fi
fi
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
# enable SP math assembly support automatically for x86_64 and aarch64 (except Linux kernel module)
SP_ASM_DEFAULT=no
if test "$ENABLED_SP_MATH" = "yes" && test "$ENABLED_LINUXKM_DEFAULTS" = "no"
then
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" || test "$host_cpu" = "amd64"
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
then
SP_ASM_DEFAULT=yes
fi
fi
SP config: allow asm to be an SP options (--enable-sp=asm.yes)
2021-03-17 11:24:55 +10:00
AC_ARG_ENABLE([sp-asm],
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
[AS_HELP_STRING([--enable-sp-asm],[Enable Single Precision assembly implementation (default: enabled on x86_64/aarch64/amd64)])],
SP config: allow asm to be an SP options (--enable-sp=asm.yes)
2021-03-17 11:24:55 +10:00
[ ENABLED_SP_ASM=$enableval ],
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
[ ENABLED_SP_ASM=$SP_ASM_DEFAULT ],
SP config: allow asm to be an SP options (--enable-sp=asm.yes)
2021-03-17 11:24:55 +10:00
)
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
# fastmath
AC_ARG_ENABLE([fastmath],
[AS_HELP_STRING([--enable-fastmath],[Enable fast math ops (default: disabled)])],
[ ENABLED_FASTMATH=$enableval ],
[ ENABLED_FASTMATH=$DEF_FAST_MATH ]
)
# fast HUGE math
AC_ARG_ENABLE([fasthugemath],
[AS_HELP_STRING([--enable-fasthugemath],[Enable fast math + huge code (default: disabled)])],
[ ENABLED_FASTHUGEMATH=$enableval ],
[ ENABLED_FASTHUGEMATH=no ]
)
if test "$ENABLED_BUMP" = "yes"
then
ENABLED_FASTHUGEMATH="yes"
fi
if test "$ENABLED_FASTHUGEMATH" = "yes"
then
ENABLED_FASTMATH="yes"
fi
AES x86 ASM: new assembly Added new x86 assembly for AES. AES-CBC decrypt only 4 blocks at a time (not 6 or 8) due to reduces register count. GCM implementation for AVX2, AVX1 and AESNI only. Disabled looking for other assembly files for x86.
2022-09-30 16:19:40 +10:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "amd64"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_X86_64_BUILD"
fi
if test "$host_cpu" = "x86"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_X86_BUILD"
fi
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
# if sp-math-all is not set, then enable fast math
SP math: fix configure.ac to allow its use Choosing SP and SP math was resulting in only integer.c being used. Fixed now. Reorder realloc calls for memory logging to ensure scripts can match allocate and free calls.
2022-07-07 12:16:12 +10:00
if test "x$ENABLED_FASTMATH" = "xyes" && test "$enable_sp_math_all" = "" && test "$enable_sp_math" = ""
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
then
# turn off fastmth if leanpsk on or asn off (w/o DH and ECC)
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_ASN" = "no"
then
if test "$ENABLED_DH" = "no" && test "$ENABLED_ECC" = "no" && test "$ENABLED_RSA" = "no"
then
ENABLED_FASTMATH="no"
else
AM_CFLAGS="$AM_CFLAGS -DUSE_FAST_MATH"
ENABLED_HEAPMATH="no"
fi
else
AM_CFLAGS="$AM_CFLAGS -DUSE_FAST_MATH"
ENABLED_HEAPMATH="no"
ENABLED_SP_MATH_ALL="no"
fi
AS_IF([test "x$host_cpu" = "xaarch64"],[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AARCH64_BUILD"])
if test "$ENABLED_SAKKE" = "yes" && test "$ENABLED_SAKKE_SMALL" != "yes"
then
AM_CFLAGS="$AM_CFLAGS -funroll-loops -DTFM_SMALL_SET"
fi
fi
# heap based integer.c math (not timing resistant)
AC_ARG_ENABLE([heapmath],
[AS_HELP_STRING([--enable-heapmath],[Enable heap based integer.c math ops (default: disabled)])],
[ ENABLED_HEAPMATH=$enableval ],
[ ENABLED_HEAPMATH=no]
)
SP math: fix configure.ac to allow its use Choosing SP and SP math was resulting in only integer.c being used. Fixed now. Reorder realloc calls for memory logging to ensure scripts can match allocate and free calls.
2022-07-07 12:16:12 +10:00
if test "x$ENABLED_HEAPMATH" = "xyes" || (test "x$ENABLED_SP_MATH_ALL" = "xno" && test "x$ENABLED_FASTMATH" = "xno" && test "x$ENABLED_SP_MATH" = "xno")
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DUSE_INTEGER_HEAP_MATH"
ENABLED_HEAPMATH="yes"
ENABLED_SP="no"
ENABLED_SP_MATH_ALL="no"
fi
Added new `./configure --enable-all` option to enable all features. Allows building all features without using the `--enable-distro` option, which only allows shared build and does not generate an options.h file.
2017-05-18 10:57:28 -07:00
# ALL FEATURES
AC_ARG_ENABLE([all],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-all],[Enable all wolfSSL features, except SSLv3 (default: disabled)])],
Added new `./configure --enable-all` option to enable all features. Allows building all features without using the `--enable-distro` option, which only allows shared build and does not generate an options.h file.
2017-05-18 10:57:28 -07:00
[ ENABLED_ALL=$enableval ],
[ ENABLED_ALL=no ]
)
if test "$ENABLED_ALL" = "yes"
then
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_dtls" = "" && enable_dtls=yes
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
if test "x$FIPS_VERSION" != "xv1"
then
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_tls13" = "" && enable_tls13=yes
test "$enable_rsapss" = "" && enable_rsapss=yes
fi
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
# this set is also enabled by enable-all-crypto:
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_atomicuser" = "" && enable_atomicuser=yes
test "$enable_aesgcm" = "" && enable_aesgcm=yes
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
test "$enable_aesgcm_stream" = "" && enable_aesgcm_stream=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_aesccm" = "" && enable_aesccm=yes
test "$enable_aesctr" = "" && enable_aesctr=yes
test "$enable_aesofb" = "" && enable_aesofb=yes
test "$enable_aescfb" = "" && enable_aescfb=yes
configure.ac: add --enable-aescbc-length-checks and add it to --enable-all; api.c: fix expected error code in WOLFSSL_AES_CBC_LENGTH_CHECKS path of test_wc_AesCbcEncryptDecrypt(); aes.c: add explanatory comment on WOLFSSL_AES_CBC_LENGTH_CHECKS to top of file.
2021-03-26 14:04:25 -05:00
test "$enable_aescbc_length_checks" = "" && enable_aescbc_length_checks=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_camellia" = "" && enable_camellia=yes
test "$enable_ripemd" = "" && enable_ripemd=yes
test "$enable_sha224" = "" && enable_sha224=yes
test "$enable_sessioncerts" = "" && enable_sessioncerts=yes
test "$enable_keygen" = "" && enable_keygen=yes
test "$enable_certgen" = "" && enable_certgen=yes
test "$enable_certreq" = "" && enable_certreq=yes
test "$enable_certext" = "" && enable_certext=yes
test "$enable_sep" = "" && enable_sep=yes
test "$enable_hkdf" = "" && enable_hkdf=yes
test "$enable_curve25519" = "" && enable_curve25519=yes
test "$enable_curve448" = "" && enable_curve448=yes
test "$enable_fpecc" = "" && enable_fpecc=yes
test "$enable_eccencrypt" = "" && enable_eccencrypt=yes
test "$enable_psk" = "" && enable_psk=yes
test "$enable_cmac" = "" && enable_cmac=yes
test "$enable_xts" = "" && enable_xts=yes
test "$enable_ocsp" = "" && enable_ocsp=yes
test "$enable_ocspstapling" = "" && enable_ocspstapling=yes
test "$enable_ocspstapling2" = "" && enable_ocspstapling2=yes
test "$enable_crl" = "" && enable_crl=yes
test "$enable_supportedcurves" = "" && enable_supportedcurves=yes
test "$enable_tlsx" = "" && enable_tlsx=yes
test "$enable_pwdbased" = "" && enable_pwdbased=yes
test "$enable_aeskeywrap" = "" && enable_aeskeywrap=yes
test "$enable_x963kdf" = "" && enable_x963kdf=yes
test "$enable_scrypt" = "" && enable_scrypt=yes
test "$enable_indef" = "" && enable_indef=yes
test "$enable_enckeys" = "" && enable_enckeys=yes
test "$enable_hashflags" = "" && enable_hashflags=yes
test "$enable_defaultdhparams" = "" && enable_defaultdhparams=yes
Enable Base64 as part of --enable-all. Part of an effort to standardize build options across distributions. When building with all options, this includes Base64, a feature that was requested in the past. This commit passed Debian's Salsa CI pipeline [1] as part of a larger commit streamlining the build options for distributions. [2] A related pull request by douzzer activated reproducible builds for distributions by default. [3] Thanks to David Garske for his generous contributions to this commit! [1] https://salsa.debian.org/lechner/wolfssl/-/pipelines/233601 [2] https://salsa.debian.org/lechner/wolfssl/-/blob/debian/master/debian/patches/standardize-distro-options.patch [3] https://github.com/wolfSSL/wolfssl/commit/e30b3d35549ed4ec07cd63bfffc9ae80bf2a3b16
2021-02-23 19:36:15 -08:00
test "$enable_base64encode" = "" && enable_base64encode=yes
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
test "$enable_base16" = "" && enable_base16=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_arc4" = "" && enable_arc4=yes
test "$enable_des3" = "" && enable_des3=yes
test "$enable_nullcipher" = "" && enable_nullcipher=yes
test "$enable_blake2" = "" && enable_blake2=yes
test "$enable_blake2s" = "" && enable_blake2s=yes
test "$enable_md2" = "" && enable_md2=yes
test "$enable_md4" = "" && enable_md4=yes
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
test "$enable_cryptocb" = "" && enable_cryptocb=yes
test "$enable_anon" = "" && enable_anon=yes
test "$enable_ssh" = "" && enable_ssh=yes
test "$enable_savesession" = "" && enable_savesession=yes
test "$enable_savecert" = "" && enable_savecert=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_postauth" = "" && enable_postauth=yes
test "$enable_hrrcookie" = "" && enable_hrrcookie=yes
test "$enable_fallback_scsv" = "" && enable_fallback_scsv=yes
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
test "$enable_mcast" = "" && enable_mcast=yes
test "$enable_webserver" = "" && enable_webserver=yes
test "$enable_crl_monitor" = "" && enable_crl_monitor=yes
test "$enable_sni" = "" && enable_sni=yes
test "$enable_maxfragment" = "" && enable_maxfragment=yes
test "$enable_alpn" = "" && enable_alpn=yes
test "$enable_truncatedhmac" = "" && enable_truncatedhmac=yes
test "$enable_trusted_ca" = "" && enable_trusted_ca=yes
test "$enable_session_ticket" = "" && enable_session_ticket=yes
Fixes for TLS v1.3 early data with async.
2022-03-11 09:46:42 -08:00
test "$enable_earlydata" = "" && enable_earlydata=yes
enable early data when enabled all
2022-03-03 16:36:03 +09:00
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
if test "$ENABLED_32BIT" != "yes"
then
test "$enable_sha512" = "" && enable_sha512=yes
test "$enable_sha3" = "" && enable_sha3=yes
fi
configure.ac: refactor-for-clarity enable-all[-crypto] feature selection logic conditionalized on sp-math and linuxkm.
2020-09-30 19:23:12 -05:00
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
then
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_compkey" = "" && enable_compkey=yes
configure.ac: refactor-for-clarity enable-all[-crypto] feature selection logic conditionalized on sp-math and linuxkm.
2020-09-30 19:23:12 -05:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL_IO -DHAVE_IO_TIMEOUT"
fi
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
# sp-math is incompatible with opensslextra, ECC custom curves, and DSA.
configure.ac: refactor-for-clarity enable-all[-crypto] feature selection logic conditionalized on sp-math and linuxkm.
2020-09-30 19:23:12 -05:00
if test "$ENABLED_SP_MATH" = "no"
then
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_dsa" = "" && enable_dsa=yes
test "$enable_ecccustcurves" = "" && enable_ecccustcurves=yes
test "$enable_srp" = "" && enable_srp=yes
# linuxkm is incompatible with opensslextra and its dependents.
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
then
if test "$ENABLED_FIPS" = "no"
then
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
if test "$ENABLED_32BIT" != "yes"
then
test "$enable_openssh" = "" && enable_openssh=yes
fi
Added support for reading S/MIME messages via SMIME_read_PKCS7.
2021-02-08 17:12:24 -07:00
# S/MIME support requires PKCS7, which requires no FIPS.
test "$enable_smime" = "" && enable_smime=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
fi
test "$enable_opensslextra" = "" && enable_opensslextra=yes
test "$enable_opensslall" = "" && enable_opensslall=yes
test "$enable_certservice" = "" && enable_certservice=yes
test "$enable_lighty" = "" && enable_lighty=yes
test "$enable_nginx" = "" && enable_nginx=yes
test "$enable_openvpn" = "" && enable_openvpn=yes
test "$enable_asio" = "" && enable_asio=yes
test "$enable_libwebsockets" = "" && enable_libwebsockets=yes
test "$enable_qt" = "" && enable_qt=yes
fi
configure.ac: remove enable_apachehttpd and enable_secure_renegotiation from new --enable-all (valgrind woes).
2020-10-02 18:54:45 -05:00
fi
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
if test "$ENABLED_FIPS" = "no"
configure.ac: remove enable_apachehttpd and enable_secure_renegotiation from new --enable-all (valgrind woes).
2020-10-02 18:54:45 -05:00
then
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
test "$enable_pkcallbacks" = "" && enable_pkcallbacks=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_xchacha" = "" && enable_xchacha=yes
test "$enable_scep" = "" && enable_scep=yes
test "$enable_pkcs7" = "" && enable_pkcs7=yes
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
if test "$ENABLED_32BIT" != "yes"
then
test "$enable_ed25519" = "" && enable_ed25519=yes
test "$enable_ed25519_stream" = "" && enable_ed25519_stream=yes
test "$enable_ed448" = "" && enable_ed448=yes
test "$enable_ed448_stream" = "" && enable_ed448_stream=yes
fi
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
then
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
# these use DES3:
configure.ac: revert change (AC_MSG_NOTICE reverted to AC_MSG_ERROR) for "FIPS source tree used for non-FIPS build"; in enable_all set, move enable_stunnel and enable_tcpdump to the !ENABLED_LINUXKM_DEFAULTS section.
2021-08-26 17:59:10 -05:00
test "$enable_stunnel" = "" && enable_stunnel=yes
Add a --enable-curl build option
2021-12-22 17:34:58 -05:00
test "$enable_curl" = "" && enable_curl=yes
configure.ac: revert change (AC_MSG_NOTICE reverted to AC_MSG_ERROR) for "FIPS source tree used for non-FIPS build"; in enable_all set, move enable_stunnel and enable_tcpdump to the !ENABLED_LINUXKM_DEFAULTS section.
2021-08-26 17:59:10 -05:00
test "$enable_tcpdump" = "" && enable_tcpdump=yes
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
test "$enable_eccsi" = "" && enable_eccsi=yes
test "$enable_sakke" = "" && enable_sakke=yes
fi
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
fi
configure.ac: remove smallstackcache from linuxkm default options; add several feature exclusions to enable-all and enable-all-crypto to make them compatible with fips=ready; render the FIPS option in the feature summary at end.
2020-11-26 00:19:35 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
if test "$ENABLED_FIPS" = "no" || test "$ENABLED_FIPS" = "dev"; then
AES-SIV: in configure.ac, enable SIV only if !ENABLED_FIPS or if building FIPS v5-dev; in cmac.{c,h}, remove !HAVE_FIPS gating on ShiftAndXorRb().
2022-01-20 14:51:30 -06:00
test "$enable_aessiv" = "" && enable_aessiv=yes
fi
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
# Enable DH const table speedups (eliminates `-lm` math lib dependency)
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072"
DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
# Enable multiple attribute additions such as DC
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_MULTI_ATTRIB"
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
# Enable AES Decrypt, AES ECB
AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_DECRYPT -DHAVE_AES_ECB"
configure.ac: refactor setup for --enable-reproducible-build; remove mutex between --enable-sp-math and --enable-sp-math-all (they can now coexist); whitespace cleanup.
2021-11-05 18:18:53 -05:00
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
# Enable Alt Names, DER Load, Keep Certs, CRL IO with Timeout
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALT_NAMES -DWOLFSSL_DER_LOAD -DKEEP_OUR_CERT -DKEEP_PEER_CERT"
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
# Enable DH Extra
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA"
add deterministic k variant for ECC to enable all
2021-12-08 10:49:17 -07:00
# Enable deterministic ECC signing API with variant
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT"
Add ability to store issuer name components when parsing a certificate. This is turned on when `WOLFSSL_HAVE_ISSUER_NAMES` is defined. This allows the user to inspect various issuer name components (e.g. locality, organization, etc.) by using these new fields in a `DecodedCert`.
2022-05-12 14:43:19 -07:00
# Store issuer name components when parsing certificates.
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_ISSUER_NAMES"
add test case for UUID and FASC-N
2022-05-23 09:17:42 -07:00
# Certificate extensions and alt. names for FPKI use
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SUBJ_DIR_ATTR -DWOLFSSL_FPKI -DWOLFSSL_SUBJ_INFO_ACC"
add WOLFSSL_CERT_NAME_ALL macro guard and new values to set subject
2022-08-01 10:52:09 -07:00
# Handle as many subject/issuer name OIDs as possible
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_NAME_ALL"
Expand error queue usage with new macro WOLFSSL_ERROR_VERBOSE. We have users who need to debug errors coming out of libwolfssl in production, where --enable-debug isn't an option. Our error queue implementation is the solution, but our usage of WOLFSSL_ERROR isn't consistent. This commit greatly expands our usage of WOLFSSL_ERROR. There are too many error cases to tackle all at once, and not all error cases are particularly meaningful or likely to be hit in regular operation of the library. I've tried to focus on errors that users are likely to hit, and I've chosen to ignore things like the mountain of BUFFER_E and BAD_FUNC_ARG cases (for the most part). I've also tried to expand WOLFSSL_ERROR usage in files where we haven't been using it historically (e.g. aes.c), so the pattern is now there for other developers to follow. In order to prevent these additions from exploding the size of libwolfssl, they're all behind a new macro, WOLFSSL_ERROR_VERBOSE. If WOLFSSL_VERBOSE_ERRORS is defined, WOLFSSL_ERROR_VERBOSE just maps to WOLFSSL_ERROR.
2022-08-02 13:47:46 -07:00
# More thorough error queue usage.
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VERBOSE_ERRORS"
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
fi
# ALL CRYPTO FEATURES
AC_ARG_ENABLE([all-crypto],
[AS_HELP_STRING([--enable-all-crypto],[Enable all wolfcrypt algorithms (default: disabled)])],
[ ENABLED_ALL_CRYPT=$enableval ],
[ ENABLED_ALL_CRYPT=no ]
)
if test "$ENABLED_ALL_CRYPT" = "yes"
then
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_atomicuser" = "" && enable_atomicuser=yes
test "$enable_aesgcm" = "" && enable_aesgcm=yes
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
test "$enable_aesgcm_stream" = "" && enable_aesgcm_stream=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_aesccm" = "" && enable_aesccm=yes
test "$enable_aesctr" = "" && enable_aesctr=yes
test "$enable_aesofb" = "" && enable_aesofb=yes
test "$enable_aescfb" = "" && enable_aescfb=yes
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
test "$enable_aescbc_length_checks" = "" && enable_aescbc_length_checks=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_camellia" = "" && enable_camellia=yes
test "$enable_ripemd" = "" && enable_ripemd=yes
test "$enable_sha224" = "" && enable_sha224=yes
test "$enable_sessioncerts" = "" && enable_sessioncerts=yes
test "$enable_keygen" = "" && enable_keygen=yes
test "$enable_certgen" = "" && enable_certgen=yes
test "$enable_certreq" = "" && enable_certreq=yes
test "$enable_certext" = "" && enable_certext=yes
test "$enable_sep" = "" && enable_sep=yes
test "$enable_hkdf" = "" && enable_hkdf=yes
test "$enable_curve25519" = "" && enable_curve25519=yes
test "$enable_curve448" = "" && enable_curve448=yes
test "$enable_fpecc" = "" && enable_fpecc=yes
test "$enable_eccencrypt" = "" && enable_eccencrypt=yes
test "$enable_psk" = "" && enable_psk=yes
test "$enable_cmac" = "" && enable_cmac=yes
Add SipHash algorithm
2022-01-14 13:56:23 +10:00
test "$enable_siphash" = "" && enable_siphash=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_xts" = "" && enable_xts=yes
test "$enable_ocsp" = "" && enable_ocsp=yes
test "$enable_ocspstapling" = "" && enable_ocspstapling=yes
test "$enable_ocspstapling2" = "" && enable_ocspstapling2=yes
test "$enable_crl" = "" && enable_crl=yes
test "$enable_supportedcurves" = "" && enable_supportedcurves=yes
test "$enable_tlsx" = "" && enable_tlsx=yes
test "$enable_pwdbased" = "" && enable_pwdbased=yes
test "$enable_aeskeywrap" = "" && enable_aeskeywrap=yes
test "$enable_x963kdf" = "" && enable_x963kdf=yes
test "$enable_scrypt" = "" && enable_scrypt=yes
test "$enable_indef" = "" && enable_indef=yes
test "$enable_enckeys" = "" && enable_enckeys=yes
test "$enable_hashflags" = "" && enable_hashflags=yes
test "$enable_defaultdhparams" = "" && enable_defaultdhparams=yes
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
test "$enable_base64encode" = "" && enable_base64encode=yes
test "$enable_base16" = "" && enable_base16=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_arc4" = "" && enable_arc4=yes
test "$enable_des3" = "" && enable_des3=yes
test "$enable_nullcipher" = "" && enable_nullcipher=yes
test "$enable_blake2" = "" && enable_blake2=yes
test "$enable_blake2s" = "" && enable_blake2s=yes
test "$enable_md2" = "" && enable_md2=yes
test "$enable_md4" = "" && enable_md4=yes
test "$enable_cryptocb" = "" && enable_cryptocb=yes
test "$enable_anon" = "" && enable_anon=yes
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
test "$enable_ssh" = "" && enable_ssh=yes
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
if test "$ENABLED_32BIT" != "yes"
then
test "$enable_sha512" = "" && enable_sha512=yes
test "$enable_sha3" = "" && enable_sha3=yes
fi
configure.ac: refactor-for-clarity enable-all[-crypto] feature selection logic conditionalized on sp-math and linuxkm.
2020-09-30 19:23:12 -05:00
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
then
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_compkey" = "" && enable_compkey=yes
fi
if test "$ENABLED_SP_MATH" = "no"
then
test "$enable_dsa" = "" && enable_dsa=yes
test "$enable_ecccustcurves" = "" && enable_ecccustcurves=yes
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
test "$enable_srp" = "" && enable_srp=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
fi
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
if test "$ENABLED_FIPS" = "no"
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
then
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
test "$enable_pkcallbacks" = "" && enable_pkcallbacks=yes
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
test "$enable_xchacha" = "" && enable_xchacha=yes
test "$enable_pkcs7" = "" && enable_pkcs7=yes
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
if test "$ENABLED_32BIT" != "yes"
then
test "$enable_ed25519" = "" && enable_ed25519=yes
test "$enable_ed25519_stream" = "" && enable_ed25519_stream=yes
test "$enable_ed448" = "" && enable_ed448=yes
test "$enable_ed448_stream" = "" && enable_ed448_stream=yes
fi
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
if test "$ENABLED_LINUXKM_DEFAULTS" != "yes"
then
test "$enable_eccsi" = "" && enable_eccsi=yes
test "$enable_sakke" = "" && enable_sakke=yes
fi
configure.ac: refactor-for-clarity enable-all[-crypto] feature selection logic conditionalized on sp-math and linuxkm.
2020-09-30 19:23:12 -05:00
fi
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
if test "$ENABLED_FIPS" = "no" || test "$ENABLED_FIPS" = "dev"; then
AES-SIV: in configure.ac, enable SIV only if !ENABLED_FIPS or if building FIPS v5-dev; in cmac.{c,h}, remove !HAVE_FIPS gating on ShiftAndXorRb().
2022-01-20 14:51:30 -06:00
test "$enable_aessiv" = "" && enable_aessiv=yes
fi
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
# Enable AES Decrypt, AES ECB, Alt Names, DER Load
AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_DECRYPT -DHAVE_AES_ECB -DWOLFSSL_ALT_NAMES -DWOLFSSL_DER_LOAD"
# Enable DH const table speedups (eliminates `-lm` math lib dependency)
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072"
DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096
Fix for `wc_ecc_import_unsigned` failing if first private key byte is zero (Fixes #2950). Fix `wc_ecc_is_point` to return better code `IS_POINT_E` on failure (was returning -1). Improved ECC import API unit tests. Added `WOLFSSL_VALIDATE_ECC_IMPORT` and `WOLFSSL_VALIDATE_ECC_KEYGEN` to `--enable-all`.
2020-05-15 15:23:38 -07:00
add sanity check on buffer index and regression tests macro guards on use case and adjustment for memory size gcc-8 warning fix adjustement to default memory bucket sizes
2019-05-09 10:08:11 -06:00
# Enable multiple attribute additions such as DC
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_MULTI_ATTRIB"
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
# Enable DH Extra
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA"
# Enable deterministic ECC signing API with variant
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT"
# Store issuer name components when parsing certificates.
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_ISSUER_NAMES"
add distro build option
2016-08-22 10:00:37 -06:00
fi
wolfCrypt support for external Kyber implementations (liboqs and pqm4)
2022-09-09 11:41:30 -04:00
# liboqs
ENABLED_LIBOQS="no"
tryliboqsdir=""
AC_ARG_WITH([liboqs],
[AS_HELP_STRING([--with-liboqs=PATH],[Path to liboqs install (default /usr/local) EXPERIMENTAL!])],
[
AC_MSG_CHECKING([for liboqs])
CPPFLAGS="$CPPFLAGS -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS"
LIBS="$LIBS -loqs"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <oqs/common.h>]], [[ OQS_init(); ]])], [ liboqs_linked=yes ],[ liboqs_linked=no ])
if test "x$liboqs_linked" = "xno" ; then
if test "x$withval" != "xno" ; then
tryliboqsdir=$withval
fi
if test "x$withval" = "xyes" ; then
tryliboqsdir="/usr/local"
fi
LDFLAGS="$AM_LDFLAGS $LDFLAGS -L$tryliboqsdir/lib"
CPPFLAGS="$CPPFLAGS -I$tryliboqsdir/include"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <oqs/common.h>]], [[ OQS_init(); ]])], [ liboqs_linked=yes ],[ liboqs_linked=no ])
if test "x$liboqs_linked" = "xno" ; then
AC_MSG_ERROR([liboqs isn't found.
If it's already installed, specify its path using --with-liboqs=/dir/])
fi
AC_MSG_RESULT([yes])
AM_LDFLAGS="$AM_LDFLAGS -L$tryliboqsdir/lib"
else
AC_MSG_RESULT([yes])
fi
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLEXTRA="yes"
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_LIBOQS -DHAVE_TLS_EXTENSIONS"
ENABLED_LIBOQS="yes"
]
)
Kyber: Add option to build Kyber API wolfSSL Kyber implementation not included. Added tests and benchmarking.
2022-09-08 11:23:30 +10:00
# KYBER
# Used:
# - SHA3, Shake128 and Shake256, or
# - SHA256, SHA512, AES-CTR
AC_ARG_ENABLE([kyber],
[AS_HELP_STRING([--enable-kyber],[Enable KYBER (default: disabled)])],
[ ENABLED_KYBER=$enableval ],
[ ENABLED_KYBER=no ]
)
ENABLED_WC_KYBER=no
for v in `echo $ENABLED_KYBER | tr "," " "`
do
case $v in
yes | all)
ENABLED_KYBER512=yes
ENABLED_KYBER768=yes
ENABLED_KYBER1024=yes
;;
no)
;;
wolfssl)
ENABLED_WC_KYBER=yes
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WC_KYBER"
;;
90s)
ENABLED_KYBER_90S=yes
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KYBER_90S"
;;
small)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KYBER_SMALL"
;;
512)
ENABLED_KYBER512=yes
;;
768)
ENABLED_KYBER768=yes
;;
1024)
ENABLED_KYBER1024=yes
;;
*)
AC_MSG_ERROR([Invalid choice for KYBER []: $ENABLED_KYBER.])
break;;
esac
done
if test "$ENABLED_KYBER" != "no"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_KYBER"
wolfCrypt support for external Kyber implementations (liboqs and pqm4)
2022-09-09 11:41:30 -04:00
if test "$ENABLED_WC_KYBER" = "yes"
then
if test "$ENABLED_KYBER512" = ""; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_KYBER512"
fi
if test "$ENABLED_KYBER768" = ""; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_KYBER768"
fi
if test "$ENABLED_KYBER1024" = ""; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_KYBER1024"
fi
Kyber: Add option to build Kyber API wolfSSL Kyber implementation not included. Added tests and benchmarking.
2022-09-08 11:23:30 +10:00
wolfCrypt support for external Kyber implementations (liboqs and pqm4)
2022-09-09 11:41:30 -04:00
if test "$ENABLED_KYBER_90S" != "yes"; then
test "$enable_sha3" = "" && enable_sha3=yes
test "$enable_shake128" = "" && enable_shake128=yes
test "$enable_shake256" = "" && enable_shake256=yes
else
test "$enable_sha256" = "" && enable_sha256=yes
test "$enable_sha512" = "" && enable_sha512=yes
test "$enable_aesctr" = "" && enable_aesctr=yes
fi
Kyber: Add option to build Kyber API wolfSSL Kyber implementation not included. Added tests and benchmarking.
2022-09-08 11:23:30 +10:00
else
wolfCrypt support for external Kyber implementations (liboqs and pqm4)
2022-09-09 11:41:30 -04:00
# Default is to use liboqs. Make sure its enabled.
if test "$ENABLED_LIBOQS" = "no"; then
AC_MSG_ERROR([The default implementation for kyber is liboqs.
Please use --with-liboqs.])
fi
Kyber: Add option to build Kyber API wolfSSL Kyber implementation not included. Added tests and benchmarking.
2022-09-08 11:23:30 +10:00
fi
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
# SINGLE THREADED
switch enable names to no uppercase to match others
2013-03-13 12:58:50 -07:00
AC_ARG_ENABLE([singlethreaded],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-singlethreaded],[Enable wolfSSL single threaded (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_SINGLETHREADED=$enableval ],
Fix rules around pthread usage to fix clang warning.
2012-10-19 20:09:17 -07:00
[ ENABLED_SINGLETHREADED=no ])
AS_IF([ test "x$ENABLED_SINGLETHREADED" = "xno" ],[
AX_PTHREAD([
AC_DEFINE([HAVE_PTHREAD], [1], [Define if you have POSIX threads libraries and header files.])
Update ax_pthread.m4 1. Updated to the most recent copy of ax_pthread.m4. 2. Removed the darwin-clang check m4. 3. Added a check to see if AX_PTHREAD added the flag `-Qunused-arguments` for clang and if so prepend `-Xcompiler` so libtool will use it. Otherwise when building on Sierra's clang you get "soft" warnings on the build of the dylib.
2018-05-11 10:21:47 -07:00
# If AX_PTHREAD is adding -Qunused-arguments, need to prepend with -Xcompiler libtool will use it. Newer
# versions of clang don't need the -Q flag when using pthreads.
AS_CASE([$PTHREAD_CFLAGS],[-Qunused-arguments*],[PTHREAD_CFLAGS="-Xcompiler $PTHREAD_CFLAGS"])
Proposed changes based on customer report(s) under consideration by the team
2022-09-07 11:34:27 -06:00
AM_CFLAGS="$AM_CFLAGS $PTHREAD_CFLAGS"
move pthread flags/libs to autoconf defines so available to library proper and external tests/examples
2013-04-01 15:50:13 -07:00
LIBS="$LIBS $PTHREAD_LIBS"
Fix rules around pthread usage to fix clang warning.
2012-10-19 20:09:17 -07:00
],[
ENABLED_SINGLETHREADED=yes
])
Autoconf Update 1. Remove many redundant macros. 2. Reorder several macros to more appropriate locations. 3. Several macros take lists of items to process, not just individual items. Combined duplicated macros' parameters into lists. 4. Some macros had unnecessary parameters. 5. Added some AX_REQUIRE_DEFINED() checks for the macros used. 6. Add cyassl/options.h to the AC_CONFIG_FILES list. It will be recreated from the template when running config.status the same as wolfssl/options.h 7. Remove the dist-dir rule from Makefile.am. This is prefering the process rather than automating that one step. Make dist will not run config.status. * AC_PROG_CC must be before any macros that will try to compile for tests. * AC_CHECK_SIZEOF takes a single type, no size values. * Only one of the AC_CANONICAL_X macros are expanded. Removed AC_CANONICAL_BUILD since it is never actually used. * Removed the AC_PROG_CXX and anything C++ related. * Removed LT_LANG([C]) as it is the default and the C doesn't do anything.
2018-06-08 10:47:14 -07:00
])
Fix rules around pthread usage to fix clang warning.
2012-10-19 20:09:17 -07:00
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AS_IF([ test "x$ENABLED_SINGLETHREADED" = "xyes" ],[ AM_CFLAGS="$AM_CFLAGS -DSINGLE_THREADED" ])
1.8.8 init
2011-02-05 11:14:47 -08:00
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
# wolfCrypt Only Build
AC_ARG_ENABLE([cryptonly],
[AS_HELP_STRING([--enable-cryptonly],[Enable wolfCrypt Only build (default: disabled)])],
[ENABLED_CRYPTONLY=$enableval],
[ENABLED_CRYPTONLY=no])
AS_IF([test "x$FIPS_VERSION" = "xrand"],[ENABLED_CRYPTONLY="yes"])
1.8.8 init
2011-02-05 11:14:47 -08:00
# DTLS
Enable All Disable DTLS fixes 1. Remove mcast and jni from enable-all. 2. Add comment to DTLS section. Testing `./configure --enable-all --disable-dtls` would leave DTLS still enabled. enable-all was also enabling mcast, which it doesn't need to do, that would force DTLS back on. JNI also forces DTLS on. The other language wrappers are not included in enable-all, so leave JNI out.
2021-10-01 09:56:58 -07:00
# DTLS is a prereq for the options mcast, sctp, and jni. Enabling any of those
# without DTLS will also enable DTLS.
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([dtls],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-dtls],[Enable wolfSSL DTLS (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_DTLS=$enableval ],
[ ENABLED_DTLS=no ]
)
if test "$ENABLED_DTLS" = "yes"
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
Allow setting of MTU in DTLS
2020-03-18 12:36:11 +10:00
# DTLS change MTU
AC_ARG_ENABLE([dtls-mtu],
[AS_HELP_STRING([--enable-dtls-mtu],[Enable setting the MTU size for wolfSSL DTLS (default: disabled)])],
[ ENABLED_DTLS_MTU=$enableval ],
[ ENABLED_DTLS_MTU=no ]
)
if test "$ENABLED_DTLS_MTU" = "yes"
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS_MTU"
Allow setting of MTU in DTLS
2020-03-18 12:36:11 +10:00
fi
Allow the TLS 13 draft 18 build option and just use the final version. This allows the automated test scripts to pass.
2020-05-12 15:37:26 -07:00
# TLS v1.3 Draft 18 (Note: only final TLS v1.3 supported, here for backwards build compatibility)
AC_ARG_ENABLE([tls13-draft18],
[AS_HELP_STRING([--enable-tls13-draft18],[Enable wolfSSL TLS v1.3 Draft 18 (default: disabled)])],
[ ENABLED_TLS13_DRAFT18=$enableval ],
[ ENABLED_TLS13_DRAFT18=no ]
)
Add TLS v1.3 as an option
2016-11-24 01:31:07 +10:00
# TLS v1.3
AC_ARG_ENABLE([tls13],
Disable TLS v1.3 if none of these are available "ECC, CURVE25519, CURVE448 or DH".
2020-06-02 14:41:19 -07:00
[AS_HELP_STRING([--enable-tls13],[Enable wolfSSL TLS v1.3 (default: enabled)])],
Add TLS v1.3 as an option
2016-11-24 01:31:07 +10:00
[ ENABLED_TLS13=$enableval ],
Enable TLS v1.3 by default. Remove old TLS v1.3 draft build support.
2020-05-04 07:42:50 -07:00
[ ENABLED_TLS13=yes ]
Add TLS v1.3 as an option
2016-11-24 01:31:07 +10:00
)
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
if test "x$FIPS_VERSION" = "xv1" ||
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
( test "$HAVE_FIPS_VERSION" = 2 && test "$HAVE_FIPS_VERSION_MINOR" = 1 ) ||
test "$ENABLED_CRYPTONLY" = "yes"
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
then
ENABLED_TLS13="no"
fi
Add TLS v1.3 as an option
2016-11-24 01:31:07 +10:00
add QUIC support.
2022-08-08 13:24:00 +02:00
# QUIC support
AC_ARG_ENABLE([quic],
[AS_HELP_STRING([--enable-quic],[Enable QUIC API with wolfSSL TLS v1.3 (default: disabled)])],
[ ENABLED_QUIC=$enableval ],
[ ENABLED_QUIC=no ]
)
if test "$ENABLED_QUIC" = "yes"
then
if test "x$ENABLED_TLS13" = "xno"
then
AC_MSG_ERROR([TLS 1.3 is disabled - necessary for QUIC])
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_QUIC"
# QUIC proto handlers need app_data at WOLFSSL*
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA"
fi
Updates from code review
2017-06-22 12:40:41 +10:00
# Post-handshake Authentication
AC_ARG_ENABLE([postauth],
[AS_HELP_STRING([--enable-postauth],[Enable wolfSSL Post-handshake Authentication (default: disabled)])],
[ ENABLED_TLS13_POST_AUTH=$enableval ],
[ ENABLED_TLS13_POST_AUTH=no ]
)
if test "$ENABLED_TLS13_POST_AUTH" = "yes"
then
if test "x$ENABLED_TLS13" = "xno"
then
Configuration: enable all, disable TLS 1.3 - turn off TLS 1.3 only options configuration: --enable-all --disable-tls13 Post-handshake authentication and HRR cookie are enable with '--enable-all' but disabling TLS 1.3 caused configure to fail. Don't enable these TLS 1.3 only options when TLS 1.3 is disabled. Also fix up tests that don't work without TLS 1.3 enabled.
2021-01-06 14:19:57 +10:00
AC_MSG_NOTICE([TLS 1.3 is disabled - disabling Post-handshake Authentication])
ENABLED_TLS13_POST_AUTH="no"
else
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_POST_HANDSHAKE_AUTH"
Updates from code review
2017-06-22 12:40:41 +10:00
fi
fi
Changes for TLS v1.3 Draft 22 Middlebox compatibility available too.
2017-11-20 11:07:32 +10:00
# Hello Retry Request Cookie
Code review fixes Also put in configuration option for sending HRR Cookie extension with state.
2017-06-27 08:52:53 +10:00
AC_ARG_ENABLE([hrrcookie],
[AS_HELP_STRING([--enable-hrrcookie],[Enable the server to send Cookie Extension in HRR with state (default: disabled)])],
[ ENABLED_SEND_HRR_COOKIE=$enableval ],
dtls13: enable hrr cookie by default
2022-08-26 12:25:54 +02:00
[ ENABLED_SEND_HRR_COOKIE=undefined ]
Code review fixes Also put in configuration option for sending HRR Cookie extension with state.
2017-06-27 08:52:53 +10:00
)
if test "$ENABLED_SEND_HRR_COOKIE" = "yes"
then
if test "x$ENABLED_TLS13" = "xno"
then
Configuration: enable all, disable TLS 1.3 - turn off TLS 1.3 only options configuration: --enable-all --disable-tls13 Post-handshake authentication and HRR cookie are enable with '--enable-all' but disabling TLS 1.3 caused configure to fail. Don't enable these TLS 1.3 only options when TLS 1.3 is disabled. Also fix up tests that don't work without TLS 1.3 enabled.
2021-01-06 14:19:57 +10:00
AC_MSG_NOTICE([TLS 1.3 is disabled - disabling HRR Cookie])
ENABLED_SEND_HRR_COOKIE="no"
else
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SEND_HRR_COOKIE"
Code review fixes Also put in configuration option for sending HRR Cookie extension with state.
2017-06-27 08:52:53 +10:00
fi
fi
Random Cleanup 1. Remove redundant calls to the generate function when instantiating and reseeding the DRBG. 2. Added note to the apparently redundant extra call to the generate function when running the self test. This extra call is there to make sure the internal state is updating correctly as a part of the KAT. 3. Removed duplicate enable argument clause for rng from configure.ac.
2019-06-20 11:43:29 -07:00
# RNG
RNG : change to --disable-rng, non-autoconf scenario, help msg
2016-11-01 10:21:29 -06:00
AC_ARG_ENABLE([rng],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-rng],[Enable compiling and using RNG (default: enabled)])],
RNG : change to --disable-rng, non-autoconf scenario, help msg
2016-11-01 10:21:29 -06:00
[ ENABLED_RNG=$enableval ],
[ ENABLED_RNG=yes ]
RNG : option to not use RNG
2016-10-31 16:51:02 -06:00
)
RNG : change to --disable-rng, non-autoconf scenario, help msg
2016-11-01 10:21:29 -06:00
if test "$ENABLED_RNG" = "no"
RNG : option to not use RNG
2016-10-31 16:51:02 -06:00
then
AM_CFLAGS="$AM_CFLAGS -DWC_NO_RNG"
fi
added SCTP to configure.ac
2016-08-01 07:51:42 -07:00
# DTLS-SCTP
AC_ARG_ENABLE([sctp],
[AS_HELP_STRING([--enable-sctp],[Enable wolfSSL DTLS-SCTP support (default: disabled)])],
[ENABLED_SCTP=$enableval],
[ENABLED_SCTP=no])
DTLS-SCTP Tests 1. Added a check to configure for SCTP availablility. 2. Added DTLS-SCTP to the cipher suite test.
2016-08-29 15:15:59 -07:00
AS_IF([test "x$ENABLED_SCTP" = "xyes"],
[AC_MSG_CHECKING([for SCTP])
AC_RUN_IFELSE(
[AC_LANG_PROGRAM(
[[
#include <sys/socket.h>
#include <arpa/inet.h>
]],
[[int s = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP); if (s == -1) return 1;]])],
[AC_MSG_RESULT(yes)],
[AC_MSG_RESULT(no)
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
AC_MSG_ERROR([SCTP not available, remove enable-sctp from configure])],
: ,
: ,
: )])
DTLS-SCTP Tests 1. Added a check to configure for SCTP availablility. 2. Added DTLS-SCTP to the cipher suite test.
2016-08-29 15:15:59 -07:00
DTLS SRTP (RFC5764) support (adds `--enable-srtp`). Used with WebRTC to agree on profile for new real-time session keys.
2022-01-13 16:09:11 -08:00
# DTLS-SRTP
AC_ARG_ENABLE([srtp],
[AS_HELP_STRING([--enable-srtp],[Enable wolfSSL DTLS-SRTP support (default: disabled)])],
[ENABLED_SRTP=$enableval],
[ENABLED_SRTP=no])
added SCTP to configure.ac
2016-08-01 07:51:42 -07:00
Multicast DTLS 1. Add DTLS-multicast to the enable options. 2. Reorg DTLS related enable options together. 3. Update a couple enable option texts to use the AS_HELP_STRING() macro. 4. Add three new APIs for managing a DTLS Multicast session. 5. Add test code for new APIs. 6. Add stub code for the new APIs.
2016-12-06 14:08:52 -08:00
# DTLS-MULTICAST
AC_ARG_ENABLE([mcast],
[AS_HELP_STRING([--enable-mcast],[Enable wolfSSL DTLS multicast support (default: disabled)])],
[ENABLED_MCAST=$enableval],
[ENABLED_MCAST=no])
Added a new `--enable-opensslall` option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build.
2018-04-10 09:55:03 -07:00
# List of open source project defines using our openssl compatibility layer:
Bind 9.17.9 Support - Add `--enable-bind` configuration option - New compatibility API: - `RSA_get0_crt_params` - `RSA_set0_crt_params` - `RSA_get0_factors` - `RSA_set0_factors` - `RSA_test_flags` - `HMAC_CTX_get_md` - `EVP_MD_block_size` - `EC_KEY_check_key` - `o2i_ECPublicKey` - `DH_get0_key` - `DH_set0_key` - Calling `EVP_MD_CTX_cleanup` on an uninitialized `EVP_MD_CTX` structure is no longer an error - `DH_generate_parameters` and `DH_generate_parameters_ex` has been implemented
2021-05-21 16:56:36 +02:00
# bind dns (--enable-bind) WOLFSSL_BIND
Add support for libssh2.
2021-07-30 13:37:31 -07:00
# libssh2 (--enable-libssh2)
WIP
2019-11-14 18:15:04 +01:00
# openssh (--enable-openssh) WOLFSSL_OPENSSH
Fix AES-GCM in EVP layer to have compatiblity with OpenSSL - Tag checking in AES-GCM is done in Final call - Reset `WOLFSSL_EVP_CIPHER_CTX` structure after Final call - Don't zero `ctx->authTag` struct in Init call so that user can get the AES-GCM tag using `EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, AES_BLOCK_SIZE, tag)` - `ctx->authTag` is only zeroed before authenticated, non-confidential data Update call since this means we are entering a new Udate-Final cycle. This doesn't need to be done in the decrypt case since the tag should be supplied by the user before the final call using `EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, AES_BLOCK_SIZE, tag)`
2020-04-27 13:35:51 +02:00
# openvpn (--enable-openvpn) WOLFSSL_OPENVPN
configure.ac: improvement for enable-all and enable-all-crypto: remove haproxy from enable-all set, to avoid SECURE_RENEGOTIATION; add enable-aescbc-length-checks to enable-all-crypto set, inadvertently omitted; add enable-base16 to all (where it was implicit) and to all-crypto (where it was missing); add ssh, rc2 and srp to all-crypto; reorder the portion of the enable-all set that's common with enable-all-crypto, to have matching order.
2021-09-13 23:41:21 -05:00
# nginx (--enable-nginx) WOLFSSL_NGINX
Make changes to support port of NTP from OpenSSL to wolfSSL.
2021-07-26 10:05:13 -07:00
# ntp (--enable-ntp)
OpenResty 1.13.6.2 and 1.19.3.1 support # New or Updated APIs - wolfSSL_get_tlsext_status_type - wolfSSL_X509_chain_up_ref - wolfSSL_get0_verified_chain - SSL_CTX_set_cert_cb - SSL_certs_clear - SSL_add0_chain_cert ssl_cert_add0_chain_cert - SSL_add1_chain_cert ssl_cert_add1_chain_cert - sk_X509_NAME_new_null - SSL_CTX_set_cert_cb - SSL_set0_verify_cert_store - SSL_set_client_CA_list # Other Changes - Ignore gdbinit - Add api.c tests for new API - Add `WOLFSSL_X509_STORE* x509_store_pt` to `WOLFSSL` - Add macro to select the `WOLFSSL` specific store when available and the associated `WOLFSSL_CTX` store otherwise. Calls to `ssl->ctx->cm` and `ssl->ctx->x509_store*` were replaced by macros. - NO-OP when setting existing store - Add reference counter to `WOLFSSL_X509_STORE` - Cleanup MD5 redundant declarations - WOLFSSL_ERROR may map to nothing so make assignment outside of it - refMutex fields are excluded with SINGLE_THREADED macro - Chain cert refactor - Make `wolfSSL_add0_chain_cert` and `wolfSSL_add1_chain_cert` not affect the context associated with the SSL object - `wolfSSL_CTX_add1_chain_cert` now updates the `ctx->certChain` on success and stores the cert in `ctx->x509Chain` for later free'ing
2021-08-12 14:25:19 +02:00
# openresty (--enable-openresty)
Added a new `--enable-opensslall` option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build.
2018-04-10 09:55:03 -07:00
# haproxy (--enable-haproxy) WOLFSSL_HAPROXY
# wpa_supplicant (--enable-wpas) WOLFSSL_WPAS
# ssl fortress (--enable-fortress) FORTRESS
# ssl bump (--enable-bump)
# signal (--enable-signal)
# lighty (--enable-lighty) HAVE_LIGHTY
Add support for rsyslog. - Add an --enable-rsyslog option to configure.ac. - Add a few missing `WOLFSSL_ERROR` calls that were expected by rsyslog unit tests. - Add better documentation around `WOLFSSL_SHUTDOWN_NOT_DONE` and define it to be 0 (rather than 2) when `WOLFSSL_ERROR_CODE_OPENSSL` is defined. This is in accordance with OpenSSL documentation. Without this change, rsyslog was failing to do the bidirectional shutdown properly because it was checking the shutdown return value against 0. I'm keeping the old value when `WOLFSSL_ERROR_CODE_OPENSSL` isn't defined because it's part of the public wolfssl interface (it's in ssl.h).
2021-08-12 09:50:06 -07:00
# rsyslog (--enable-rsyslog)
Added a new `--enable-opensslall` option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build.
2018-04-10 09:55:03 -07:00
# stunnel (--enable-stunnel) HAVE_STUNNEL
Add a --enable-curl build option
2021-12-22 17:34:58 -05:00
# curl (--enable-curl) HAVE_CURL
OpenSSL Compat layer Implment/stub: - wolfSSL_X509_NAME_delete_entry - wolfSSL_X509_get_ext_by_OBJ - wolfSSL_a2i_ASN1_INTEGER - X509V3_parse_list - wolfSSL_TXT_DB_write - wolfSSL_TXT_DB_insert - wolfSSL_EVP_PKEY_get_default_digest_nid
2020-07-29 23:46:08 +02:00
# libest (--enable-libest) HAVE_LIBEST
Added wolfSSl compatability for Asio C++ library
2018-07-02 10:48:02 -06:00
# asio (--enable-asio) WOLFSSL_ASIO
libwebsockets build fixes 1. Add --enable-libwebsockets option 2. Add OPENSSL_NO_EC (used in libwebsockets) 3. Add SSL_MODE_RELEASE_BUFFERS and debug message for when wolfSSL_CTX_set_mode doesn't recognize a mode.
2019-10-21 12:03:18 -06:00
# libwebsockets (--enable-libwebsockets) WOLFSSL_LIBWEBSOCKETS
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
# qt (--enable-qt) WOLFSSL_QT
# qt test (--enable-qt-test) WOLFSSL_QT_TEST
Added a new `--enable-opensslall` option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build.
2018-04-10 09:55:03 -07:00
# HAVE_POCO_LIB
# WOLFSSL_MYSQL_COMPATIBLE
# web server (--enable-webserver) HAVE_WEBSERVER
net-snmp support patch
2021-07-09 15:14:11 +02:00
# net-snmp (--enable-net-snmp)
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
# krb (--enable-krb) WOLFSSL_KRB
Add support for `--enable-ffmpeg`
2022-03-28 12:47:19 +02:00
# FFmpeg (--enable-ffmpeg) WOLFSSL_FFMPEG
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
# strongSwan (--enable-strongswan)
Enhance OpenLDAP support. - Add --enable-openldap to configure.ac - Fix some issues around subject alt names and the WOLFSSL_GENERAL_NAME struct.
2022-06-25 16:14:35 +04:00
# OpenLDAP (--enable-openldap)
Added a new `--enable-opensslall` option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build.
2018-04-10 09:55:03 -07:00
Bind 9.17.9 Support - Add `--enable-bind` configuration option - New compatibility API: - `RSA_get0_crt_params` - `RSA_set0_crt_params` - `RSA_get0_factors` - `RSA_set0_factors` - `RSA_test_flags` - `HMAC_CTX_get_md` - `EVP_MD_block_size` - `EC_KEY_check_key` - `o2i_ECPublicKey` - `DH_get0_key` - `DH_set0_key` - Calling `EVP_MD_CTX_cleanup` on an uninitialized `EVP_MD_CTX` structure is no longer an error - `DH_generate_parameters` and `DH_generate_parameters_ex` has been implemented
2021-05-21 16:56:36 +02:00
# Bind DNS compatibility Build
AC_ARG_ENABLE([bind],
[AS_HELP_STRING([--enable-bind],[Enable Bind DNS compatibility build (default: disabled)])],
[ENABLED_BIND=$enableval],
[ENABLED_BIND=no])
Add support for libssh2.
2021-07-30 13:37:31 -07:00
AC_ARG_ENABLE([libssh2],
[AS_HELP_STRING([--enable-libssh2],[Enable libssh2 compatibility build (default: disabled)])],
[ENABLED_LIBSSH2=$enableval],
[ENABLED_LIBSSH2=no])
add openssh ./configure build
2015-07-17 09:14:58 -07:00
# OpenSSH compatibility Build
AC_ARG_ENABLE([openssh],
[AS_HELP_STRING([--enable-openssh],[Enable OpenSSH compatibility build (default: disabled)])],
[ENABLED_OPENSSH=$enableval],
[ENABLED_OPENSSH=no])
Add --enable-openvpn build option
2020-01-28 15:29:24 +01:00
# OpenVPN compatibility Build
AC_ARG_ENABLE([openvpn],
[AS_HELP_STRING([--enable-openvpn],[Enable OpenVPN compatibility build (default: disabled)])],
[ENABLED_OPENVPN=$enableval],
[ENABLED_OPENVPN=no])
OpenResty 1.13.6.2 and 1.19.3.1 support # New or Updated APIs - wolfSSL_get_tlsext_status_type - wolfSSL_X509_chain_up_ref - wolfSSL_get0_verified_chain - SSL_CTX_set_cert_cb - SSL_certs_clear - SSL_add0_chain_cert ssl_cert_add0_chain_cert - SSL_add1_chain_cert ssl_cert_add1_chain_cert - sk_X509_NAME_new_null - SSL_CTX_set_cert_cb - SSL_set0_verify_cert_store - SSL_set_client_CA_list # Other Changes - Ignore gdbinit - Add api.c tests for new API - Add `WOLFSSL_X509_STORE* x509_store_pt` to `WOLFSSL` - Add macro to select the `WOLFSSL` specific store when available and the associated `WOLFSSL_CTX` store otherwise. Calls to `ssl->ctx->cm` and `ssl->ctx->x509_store*` were replaced by macros. - NO-OP when setting existing store - Add reference counter to `WOLFSSL_X509_STORE` - Cleanup MD5 redundant declarations - WOLFSSL_ERROR may map to nothing so make assignment outside of it - refMutex fields are excluded with SINGLE_THREADED macro - Chain cert refactor - Make `wolfSSL_add0_chain_cert` and `wolfSSL_add1_chain_cert` not affect the context associated with the SSL object - `wolfSSL_CTX_add1_chain_cert` now updates the `ctx->certChain` on success and stores the cert in `ctx->x509Chain` for later free'ing
2021-08-12 14:25:19 +02:00
# openresty compatibility build
AC_ARG_ENABLE([openresty],
[AS_HELP_STRING([--enable-openresty],[Enable openresty (default: disabled)])],
[ ENABLED_OPENRESTY=$enableval ],
[ ENABLED_OPENRESTY=no ]
)
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
# nginx compatibility build
AC_ARG_ENABLE([nginx],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-nginx],[Enable nginx (default: disabled)])],
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
[ ENABLED_NGINX=$enableval ],
[ ENABLED_NGINX=no ]
)
add openssh ./configure build
2015-07-17 09:14:58 -07:00
Add --enable-chrony configure option. This turns on the necessary features for using the chrony NTP package with wolfSSL.
2022-01-18 22:02:50 -08:00
# chrony support. Needs the compatibility layer for SNI callback functionality,
# but otherwise uses pure wolfCrypt.
AC_ARG_ENABLE([chrony],
[AS_HELP_STRING([--enable-chrony],[Enable chrony support (default: disabled)])],
[ ENABLED_CHRONY=$enableval ],
[ ENABLED_CHRONY=no ]
)
if test "$ENABLED_CHRONY" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_KEEP_SNI"
fi
OpenResty 1.13.6.2 and 1.19.3.1 support # New or Updated APIs - wolfSSL_get_tlsext_status_type - wolfSSL_X509_chain_up_ref - wolfSSL_get0_verified_chain - SSL_CTX_set_cert_cb - SSL_certs_clear - SSL_add0_chain_cert ssl_cert_add0_chain_cert - SSL_add1_chain_cert ssl_cert_add1_chain_cert - sk_X509_NAME_new_null - SSL_CTX_set_cert_cb - SSL_set0_verify_cert_store - SSL_set_client_CA_list # Other Changes - Ignore gdbinit - Add api.c tests for new API - Add `WOLFSSL_X509_STORE* x509_store_pt` to `WOLFSSL` - Add macro to select the `WOLFSSL` specific store when available and the associated `WOLFSSL_CTX` store otherwise. Calls to `ssl->ctx->cm` and `ssl->ctx->x509_store*` were replaced by macros. - NO-OP when setting existing store - Add reference counter to `WOLFSSL_X509_STORE` - Cleanup MD5 redundant declarations - WOLFSSL_ERROR may map to nothing so make assignment outside of it - refMutex fields are excluded with SINGLE_THREADED macro - Chain cert refactor - Make `wolfSSL_add0_chain_cert` and `wolfSSL_add1_chain_cert` not affect the context associated with the SSL object - `wolfSSL_CTX_add1_chain_cert` now updates the `ctx->certChain` on success and stores the cert in `ctx->x509Chain` for later free'ing
2021-08-12 14:25:19 +02:00
if test "$ENABLED_OPENRESTY" = "yes"
then
ENABLED_NGINX="yes"
fi
Enhance OpenLDAP support. - Add --enable-openldap to configure.ac - Fix some issues around subject alt names and the WOLFSSL_GENERAL_NAME struct.
2022-06-25 16:14:35 +04:00
# OpenLDAP support
AC_ARG_ENABLE([openldap],
[AS_HELP_STRING([--enable-openldap],[Enable OpenLDAP support (default: disabled)])],
[ ENABLED_OPENLDAP=$enableval ],
[ ENABLED_OPENLDAP=no ]
)
build updates for lighttpd Update configure.ac and various #ifdefs to enable WolfSSL to build features for use by lighttpd. Change signature of wolfSSL_GetVersion() to take const arg. Pass (const WOLFSSL*) to wolfSSL_GetVersion() for use with SSL_CTX_set_info_callback(), where OpenSSL callback takes (const SSL *)
2020-07-01 23:19:13 -04:00
# lighty Support
AC_ARG_ENABLE([lighty],
[AS_HELP_STRING([--enable-lighty],[Enable lighttpd/lighty (default: disabled)])],
[ ENABLED_LIGHTY=$enableval ],
[ ENABLED_LIGHTY=no ]
)
Add support for rsyslog. - Add an --enable-rsyslog option to configure.ac. - Add a few missing `WOLFSSL_ERROR` calls that were expected by rsyslog unit tests. - Add better documentation around `WOLFSSL_SHUTDOWN_NOT_DONE` and define it to be 0 (rather than 2) when `WOLFSSL_ERROR_CODE_OPENSSL` is defined. This is in accordance with OpenSSL documentation. Without this change, rsyslog was failing to do the bidirectional shutdown properly because it was checking the shutdown return value against 0. I'm keeping the old value when `WOLFSSL_ERROR_CODE_OPENSSL` isn't defined because it's part of the public wolfssl interface (it's in ssl.h).
2021-08-12 09:50:06 -07:00
# rsyslog Support
AC_ARG_ENABLE([rsyslog],
[AS_HELP_STRING([--enable-rsyslog],[Enable rsyslog (default: disabled)])],
[ ENABLED_RSYSLOG=$enableval ],
[ ENABLED_RSYSLOG=no ]
)
build updates for lighttpd Update configure.ac and various #ifdefs to enable WolfSSL to build features for use by lighttpd. Change signature of wolfSSL_GetVersion() to take const arg. Pass (const WOLFSSL*) to wolfSSL_GetVersion() for use with SSL_CTX_set_info_callback(), where OpenSSL callback takes (const SSL *)
2020-07-01 23:19:13 -04:00
Grouped HAPROXY compatibility into WOLFSSL_HAPROXY flag now haproxy compatible wolfssl builds with: ./configure --prefix=/usr --sysconfdir=/etc --disable-fastmath \ iam * ] 2:18 PM --disable-fasthugemath --disable-bump \ --enable-opensslextra \ --enable-keygen --enable-certgen \ --disable-ntru --disable-examples \ --enable-tlsx --enable-haproxy \ --enable-savecert --enable-savesession --enable-sessioncerts \ --enable-webserver --enable-sslv3 --enable-stunnel
2017-04-11 14:18:41 +02:00
# haproxy compatibility build
AC_ARG_ENABLE([haproxy],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-haproxy],[Enable haproxy (default: disabled)])],
Grouped HAPROXY compatibility into WOLFSSL_HAPROXY flag now haproxy compatible wolfssl builds with: ./configure --prefix=/usr --sysconfdir=/etc --disable-fastmath \ iam * ] 2:18 PM --disable-fasthugemath --disable-bump \ --enable-opensslextra \ --enable-keygen --enable-certgen \ --disable-ntru --disable-examples \ --enable-tlsx --enable-haproxy \ --enable-savecert --enable-savesession --enable-sessioncerts \ --enable-webserver --enable-sslv3 --enable-stunnel
2017-04-11 14:18:41 +02:00
[ ENABLED_HAPROXY=$enableval ],
[ ENABLED_HAPROXY=no ]
)
Minimal implementation of MP when using SP. --enable-sp-math to include minimal implementation of MP (only with --enable-sp.) Add futher functionality for ECC (conditionally compiled): - check key - is point on curve - API to add and double projective points - API to map from project to affine - Uncompress point (including sqrt) Some configuration options will not work with SP math - configure.ac detects this and errors out. Change test code to better support SP sizes only.
2018-02-08 15:50:17 +10:00
# wpa_supplicant support
AC_ARG_ENABLE([wpas],
[AS_HELP_STRING([--enable-wpas],[Enable wpa_supplicant support (default: disabled)])],
[ ENABLED_WPAS=$enableval ],
[ ENABLED_WPAS=no ]
)
Add option to enable DPP support in wpa_supplicant (note DPP not yet supported as of this commit)
2020-04-03 13:32:49 +02:00
# wpa_supplicant support
AC_ARG_ENABLE([wpas-dpp],
[AS_HELP_STRING([--enable-wpas-dpp],[Enable wpa_supplicant support with dpp (default: disabled)])],
[ ENABLED_WPAS_DPP=$enableval ],
[ ENABLED_WPAS_DPP=no ]
)
Support for new DPP in wpa_supplicant - Add null check to asn template code in MakeCertReq and test - ENABLED_ECCCUSTCURVES can also be "all"
2022-06-10 18:13:39 +02:00
if test "$ENABLED_WPAS_DPP" = "yes"
then
ENABLED_WPAS="yes"
fi
Make changes to support port of NTP from OpenSSL to wolfSSL.
2021-07-26 10:05:13 -07:00
# ntp support
AC_ARG_ENABLE([ntp],
[AS_HELP_STRING([--enable-ntp],[Enable ntp support (default: disabled)])],
[ ENABLED_NTP=$enableval ],
[ ENABLED_NTP=no ]
)
Minimal implementation of MP when using SP. --enable-sp-math to include minimal implementation of MP (only with --enable-sp.) Add futher functionality for ECC (conditionally compiled): - check key - is point on curve - API to add and double projective points - API to map from project to affine - Uncompress point (including sqrt) Some configuration options will not work with SP math - configure.ac detects this and errors out. Change test code to better support SP sizes only.
2018-02-08 15:50:17 +10:00
# Fortress build
AC_ARG_ENABLE([fortress],
[AS_HELP_STRING([--enable-fortress],[Enable SSL fortress build (default: disabled)])],
[ ENABLED_FORTRESS=$enableval ],
[ ENABLED_FORTRESS=no ]
)
libwebsockets build fixes 1. Add --enable-libwebsockets option 2. Add OPENSSL_NO_EC (used in libwebsockets) 3. Add SSL_MODE_RELEASE_BUFFERS and debug message for when wolfSSL_CTX_set_mode doesn't recognize a mode.
2019-10-21 12:03:18 -06:00
# libwebsockets Support
AC_ARG_ENABLE([libwebsockets],
[AS_HELP_STRING([--enable-libwebsockets],[Enable libwebsockets (default: disabled)])],
[ ENABLED_LIBWEBSOCKETS=$enableval ],
[ ENABLED_LIBWEBSOCKETS=no ]
)
if test "$ENABLED_LIBWEBSOCKETS" = "yes"
then
libwebsockets requires *CRYPTO_EX_DATA* APIs
2020-08-06 16:05:03 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LIBWEBSOCKETS -DHAVE_EX_DATA -DOPENSSL_NO_EC"
libwebsockets build fixes 1. Add --enable-libwebsockets option 2. Add OPENSSL_NO_EC (used in libwebsockets) 3. Add SSL_MODE_RELEASE_BUFFERS and debug message for when wolfSSL_CTX_set_mode doesn't recognize a mode.
2019-10-21 12:03:18 -06:00
fi
Minimal implementation of MP when using SP. --enable-sp-math to include minimal implementation of MP (only with --enable-sp.) Add futher functionality for ECC (conditionally compiled): - check key - is point on curve - API to add and double projective points - API to map from project to affine - Uncompress point (including sqrt) Some configuration options will not work with SP math - configure.ac detects this and errors out. Change test code to better support SP sizes only.
2018-02-08 15:50:17 +10:00
if test "$ENABLED_OPENSSH" = "yes"
then
ENABLED_FORTRESS="yes"
keygen-moduli passed Handle trailing newlines in wolfSSL_BN_hex2bn
2019-12-20 17:24:06 +01:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_OPENSSH -DHAVE_EX_DATA -DWOLFSSL_BASE16"
Minimal implementation of MP when using SP. --enable-sp-math to include minimal implementation of MP (only with --enable-sp.) Add futher functionality for ECC (conditionally compiled): - check key - is point on curve - API to add and double projective points - API to map from project to affine - Uncompress point (including sqrt) Some configuration options will not work with SP math - configure.ac detects this and errors out. Change test code to better support SP sizes only.
2018-02-08 15:50:17 +10:00
fi
Implement BIO_new_accept and BIO_do_accept
2021-07-13 20:37:32 +02:00
# net-snmp Build
AC_ARG_ENABLE([net-snmp],
[AS_HELP_STRING([--enable-net-snmp],[Enable net-snmp (default: disabled)])],
[ ENABLED_NETSNMP=$enableval ],
[ ENABLED_NETSNMP=no ]
)
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
# kerberos 5 Build
AC_ARG_ENABLE([krb],
[AS_HELP_STRING([--enable-krb],[Enable kerberos 5 support (default: disabled)])],
[ ENABLED_KRB=$enableval ],
[ ENABLED_KRB=no ]
)
configure.ac: fix whitespace; client.c: make gcc 5.4.0 -Wmaybe-uninitialized happy.
2021-12-04 00:57:49 -06:00
Add support for `--enable-ffmpeg`
2022-03-28 12:47:19 +02:00
# FFmpeg Build
AC_ARG_ENABLE([ffmpeg],
[AS_HELP_STRING([--enable-ffmpeg],[Enable FFmpeg support (default: disabled)])],
[ ENABLED_FFMPEG=$enableval ],
[ ENABLED_FFMPEG=no ]
)
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
Add option `--enable-ip-alt-name` This commit adds the configure option `--enable-ip-alt-name` that enables support for the IP alternative subject name parsing in `wolfcrypt/src/asn.c:DecodeAltNames`.
2020-05-07 12:26:52 +02:00
#IP alternative name Support
AC_ARG_ENABLE([ip-alt-name],
[AS_HELP_STRING([--enable-ip-alt-name],[Enable IP subject alternative name (default: disabled)])],
[ ENABLE_IP_ALT_NAME=$enableval ],
[ ENABLE_IP_ALT_NAME=no ]
)
if test "$ENABLE_IP_ALT_NAME" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_IP_ALT_NAME"
fi
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
#Qt Support
AC_ARG_ENABLE([qt],
[AS_HELP_STRING([--enable-qt],[Enable qt (default: disabled)])],
[ ENABLED_QT=$enableval ],
[ ENABLED_QT=no ]
)
Minimal implementation of MP when using SP. --enable-sp-math to include minimal implementation of MP (only with --enable-sp.) Add futher functionality for ECC (conditionally compiled): - check key - is point on curve - API to add and double projective points - API to map from project to affine - Uncompress point (including sqrt) Some configuration options will not work with SP math - configure.ac detects this and errors out. Change test code to better support SP sizes only.
2018-02-08 15:50:17 +10:00
# ssl bump build
AC_ARG_ENABLE([bump],
[AS_HELP_STRING([--enable-bump],[Enable SSL Bump build (default: disabled)])],
[ ENABLED_BUMP=$enableval ],
[ ENABLED_BUMP=no ]
)
# SNIFFER
AC_ARG_ENABLE([sniffer],
[AS_HELP_STRING([--enable-sniffer],[Enable wolfSSL sniffer support (default: disabled)])],
[ ENABLED_SNIFFER=$enableval ],
[ ENABLED_SNIFFER=no ]
)
Modification for compliling application with libsignal-protocol-c.
2017-11-13 18:12:18 +09:00
# signal compatibility build
AC_ARG_ENABLE([signal],
[AS_HELP_STRING([--enable-signal],[Enable signal (default: disabled)])],
[ ENABLED_SIGNAL=$enableval ],
[ ENABLED_SIGNAL=no ]
)
Grouped HAPROXY compatibility into WOLFSSL_HAPROXY flag now haproxy compatible wolfssl builds with: ./configure --prefix=/usr --sysconfdir=/etc --disable-fastmath \ iam * ] 2:18 PM --disable-fasthugemath --disable-bump \ --enable-opensslextra \ --enable-keygen --enable-certgen \ --disable-ntru --disable-examples \ --enable-tlsx --enable-haproxy \ --enable-savecert --enable-savesession --enable-sessioncerts \ --enable-webserver --enable-sslv3 --enable-stunnel
2017-04-11 14:18:41 +02:00
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
# strongSwan support
AC_ARG_ENABLE([strongswan],
[AS_HELP_STRING([--enable-strongswan],[Enable strongSwan support (default: disabled)])],
[ ENABLED_STRONGSWAN=$enableval ],
[ ENABLED_STRONGSWAN=no ]
)
throw error when opensslcoexist configured with opensslall or opensslextra
2019-10-23 15:51:19 -07:00
# OpenSSL Coexist
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
AC_ARG_ENABLE([opensslcoexist],
[AS_HELP_STRING([--enable-opensslcoexist],[Enable coexistence of wolfssl/openssl (default: disabled)])],
[ ENABLED_OPENSSLCOEXIST=$enableval ],
[ ENABLED_OPENSSLCOEXIST=no ]
)
Created new --enable-engine and --enable-engine-witout-fips flags
2022-01-31 11:56:11 -05:00
Make the code simpler.
2022-02-04 16:05:58 -05:00
if test "x$ENABLED_OPENSSLCOEXIST" = "xyes" || test "$ENABLED_WOLFENGINE" = "yes"
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
then
# make sure old names are disabled
enable_oldnames=no
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_COEXIST"
fi
Added support for reading S/MIME messages via SMIME_read_PKCS7.
2021-02-08 17:12:24 -07:00
# S/MIME
AC_ARG_ENABLE([smime],
[AS_HELP_STRING([--enable-smime],[Enable S/MIME (default: disabled)])],
[ ENABLED_SMIME=$enableval ],
[ ENABLED_SMIME=no ]
)
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
autoconf: add PSA options
2021-12-21 13:24:27 +01:00
# Platform Security Architecture (PSA)
AC_ARG_ENABLE([psa],
[AS_HELP_STRING([--enable-psa],[use Platform Security Architecture (PSA) interface (default: disabled)])],
[ ENABLED_PSA=$enableval ],
[ ENABLED_PSA=no ]
)
AC_ARG_WITH([psa-include],
[AS_HELP_STRING([--with-psa-include=PATH],
[PATH to directory with PSA header files])],
[PSA_INCLUDE=$withval],
[PSA_INCLUDE=""])
AC_ARG_WITH([psa-lib],
[AS_HELP_STRING([--with-psa-lib=PATH],[PATH to directory with the PSA library])],
[PSA_LIB=$withval],
[PSA_LIB=""])
AC_ARG_WITH([psa-lib-name],
[AS_HELP_STRING([--with-psa-lib-name=NAME],[NAME of PSA library])],
[PSA_LIB_NAME=$withval],
[PSA_LIB_NAME=""])
AC_ARG_ENABLE([psa-lib-static],
[AS_HELP_STRING([--enable-psa-lib-static],[Link PSA as static library (default: disable)])],
[ ENABLED_PSA_STATIC=$enableval ],
[ ENABLED_PSA_STATIC=no ]
)
if test "x$ENABLED_PSA" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_PSA"
fi
if test "x$ENABLED_PSA" != "xyes" && \
(test "x$PSA_LIB"! = "x" || test "x$PSA_INCLUDE" != "x" || test "x$PSA_LIB_NAME" != "x" )
then
AC_MSG_ERROR([to use PSA you need to enable it with --enable-psa])
fi
if test -n "$PSA_LIB"
then
AC_MSG_CHECKING([for $PSA_LIB])
if ! test -d "$PSA_LIB"
then
AC_MSG_ERROR([PSA lib dir $PSA_LIB not found.])
fi
AC_MSG_RESULT([yes])
AM_LDFLAGS="$AM_LDFLAGS -L$PSA_LIB"
fi
if test -n "$PSA_LIB_NAME"
then
if test "x$ENABLED_PSA_STATIC" = "xyes"
then
LIB_STATIC_ADD="$LIB_STATIC_ADD $PSA_LIB/$PSA_LIB_NAME"
else
LIB_ADD="$LIB_ADD -l$PSA_LIB_NAME"
fi
fi
if test -n "$PSA_INCLUDE"
then
AC_MSG_CHECKING([for $PSA_INCLUDE])
if ! test -d "$PSA_INCLUDE"
then
AC_MSG_ERROR([psa include dir $PSA_INCLUDE not found.])
fi
AC_MSG_RESULT([yes])
AM_CFLAGS="$AM_CFLAGS -I$PSA_INCLUDE"
fi
AC_SUBST([PSA_LIB])
AC_SUBST([PSA_LIB_NAME])
AC_SUBST([PSA_INCLUDE])
Added a new `--enable-opensslall` option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build.
2018-04-10 09:55:03 -07:00
# OPENSSL Compatibility ALL
AC_ARG_ENABLE([opensslall],
[AS_HELP_STRING([--enable-opensslall],[Enable all OpenSSL API, size++ (default: disabled)])],
[ ENABLED_OPENSSLALL=$enableval ],
[ ENABLED_OPENSSLALL=no ]
)
Add support for rsyslog. - Add an --enable-rsyslog option to configure.ac. - Add a few missing `WOLFSSL_ERROR` calls that were expected by rsyslog unit tests. - Add better documentation around `WOLFSSL_SHUTDOWN_NOT_DONE` and define it to be 0 (rather than 2) when `WOLFSSL_ERROR_CODE_OPENSSL` is defined. This is in accordance with OpenSSL documentation. Without this change, rsyslog was failing to do the bidirectional shutdown properly because it was checking the shutdown return value against 0. I'm keeping the old value when `WOLFSSL_ERROR_CODE_OPENSSL` isn't defined because it's part of the public wolfssl interface (it's in ssl.h).
2021-08-12 09:50:06 -07:00
if test "$ENABLED_LIBWEBSOCKETS" = "yes" || test "$ENABLED_OPENVPN" = "yes" || \
test "$ENABLED_WPAS_DPP" = "yes" || test "$ENABLED_SMIME" = "yes" || \
test "$ENABLED_HAPROXY" = "yes" || test "$ENABLED_BIND" = "yes" || \
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
test "$ENABLED_NTP" = "yes" || test "$ENABLED_NETSNMP" = "yes" || \
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
test "$ENABLED_OPENRESTY" = "yes" || test "$ENABLED_RSYSLOG" = "yes" || \
Add support for `--enable-ffmpeg`
2022-03-28 12:47:19 +02:00
test "$ENABLED_KRB" = "yes" || test "$ENABLED_CHRONY" = "yes" || \
Enhance OpenLDAP support. - Add --enable-openldap to configure.ac - Fix some issues around subject alt names and the WOLFSSL_GENERAL_NAME struct.
2022-06-25 16:14:35 +04:00
test "$ENABLED_FFMPEG" = "yes" || test "$ENABLED_STRONGSWAN" = "yes" || \
test "$ENABLED_OPENLDAP" = "yes"
libwebsockets build fixes 1. Add --enable-libwebsockets option 2. Add OPENSSL_NO_EC (used in libwebsockets) 3. Add SSL_MODE_RELEASE_BUFFERS and debug message for when wolfSSL_CTX_set_mode doesn't recognize a mode.
2019-10-21 12:03:18 -06:00
then
ENABLED_OPENSSLALL="yes"
fi
Added a new `--enable-opensslall` option, which ensures all openssl features are enabled. Documented and tested building the various open source defines we support in our build.
2018-04-10 09:55:03 -07:00
1.8.8 init
2011-02-05 11:14:47 -08:00
# OPENSSL Extra Compatibility
switch enable names to no uppercase to match others
2013-03-13 12:58:50 -07:00
AC_ARG_ENABLE([opensslextra],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-opensslextra],[Enable extra OpenSSL API, size+ (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_OPENSSLEXTRA=$enableval ],
[ ENABLED_OPENSSLEXTRA=no ]
)
add QUIC support.
2022-08-08 13:24:00 +02:00
if test "$ENABLED_QUIC" = "yes"
then
ENABLED_OPENSSLEXTRA="yes"
fi
Add --enable-error-queue-per-thread
2021-02-10 17:14:17 +01:00
# One Error Queue per Thread
AC_ARG_ENABLE([error-queue-per-thread],
[AS_HELP_STRING([--enable-error-queue-per-thread],[Enable one error queue per thread. Requires thread local storage. (default: disabled)])],
[ ENABLED_ERRORQUEUEPERTHREAD=$enableval ],
[ ENABLED_ERRORQUEUEPERTHREAD=no ]
)
if test "$ENABLED_ERRORQUEUEPERTHREAD" = "yes"
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DERROR_QUEUE_PER_THREAD"
Add --enable-error-queue-per-thread
2021-02-10 17:14:17 +01:00
fi
Added --enable-maxstrength configure build to only allow TLSv1.2, PFS, and AEAD ciphers.
2015-04-01 11:55:49 -07:00
# High Strength Build
AC_ARG_ENABLE([maxstrength],
Added some more features to the `--enable-all`. Added new `--enable-webclient` option.
2018-04-10 08:38:14 -07:00
[AS_HELP_STRING([--enable-maxstrength],[Enable Max Strength build, allows TLSv1.2-AEAD-PFS ciphers only (default: disabled)])],
Added --enable-maxstrength configure build to only allow TLSv1.2, PFS, and AEAD ciphers.
2015-04-01 11:55:49 -07:00
[ENABLED_MAXSTRENGTH=$enableval],
[ENABLED_MAXSTRENGTH=no])
add --enable-harden swtich for timing resistance and blinding, on by default
2016-07-25 13:24:36 -07:00
# Harden, enable Timing Resistance and Blinding by default
AC_ARG_ENABLE([harden],
[AS_HELP_STRING([--enable-harden],[Enable Hardened build, Enables Timing Resistance and Blinding (default: enabled)])],
[ENABLED_HARDEN=$enableval],
[ENABLED_HARDEN=yes])
if test "$ENABLED_HARDEN" = "yes"
then
Fixes and improvements for handling the `--disable-rng` case. Valid make check tests requires wolfCrypt only and no asymmetric crypto (`./configure --disable-rng --enable-cryptonly --disable-dh --disable-rsa --disable-ecc`).
2018-09-14 14:09:27 -07:00
AM_CFLAGS="$AM_CFLAGS -DTFM_TIMING_RESISTANT -DECC_TIMING_RESISTANT"
if test "$ENABLED_RNG" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWC_RSA_BLINDING"
fi
Fix up for building without `./configure` to warn if hardening options are not enabled. Currently `./configure` defaults to `--enable-harden`, but if building sources directly and using `settings.h` or `user_settings.h` the hardening defines will not be set by default. If a user wants to use without hardening they can suppress the warning by defining `WC_NO_HARDEN`.
2017-07-10 14:40:07 -07:00
else
configure.ac fixes related to change in default math back end (to sp-math-all): wolfRand doesn't use fastmath; FIPS v5-dev follows the non-FIPS default (now sp-math-all); add -DWC_NO_CACHE_RESISTANT to AM_CFLAGS when $ENABLED_HARDEN != yes; add ENABLED_BIGNUM sensor and use it in linuxkm math back end assert; add configuration callout for "Side-channel Hardening" reporting value of $ENABLED_HARDEN.
2022-06-24 15:55:08 -05:00
AM_CFLAGS="$AM_CFLAGS -DWC_NO_HARDEN -DWC_NO_CACHE_RESISTANT"
add --enable-harden swtich for timing resistance and blinding, on by default
2016-07-25 13:24:36 -07:00
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
# IPv6 Test Apps
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([ipv6],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-ipv6],[Enable testing of IPV6 (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_IPV6=$enableval ],
[ ENABLED_IPV6=no ]
)
if test "$ENABLED_IPV6" = "yes"
then
Fixes for building with IPV6. Added new WOLFSSL_IPV6 define to indicate IPV6 support. Fix to not include connect() and socket() calls unless HAVE_HTTP_CLIENT, HAVE_OCSP or HAVE_CRL_IO defined. Typo fixes.
2017-03-15 11:25:24 -07:00
AM_CFLAGS="$AM_CFLAGS -DTEST_IPV6 -DWOLFSSL_IPV6"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
Restore the normal `--enable-wpas` macro.
2020-09-17 08:55:52 -07:00
if test "$ENABLED_WPAS" = "small"
Added support `--enable-wpas=small` for reduced code size when building against the WPA supplicant with EAP-TLS. This does not use `OPENSSL_EXTRA`, which helps reduce code size.
2020-05-08 13:38:26 -07:00
then
Fixes for building `--enable-wpas=small` with WPA Supplicant v2.7.
2020-09-16 15:41:20 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WPAS_SMALL"
Restore the normal `--enable-wpas` macro.
2020-09-17 08:55:52 -07:00
fi
if test "$ENABLED_WPAS" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WPAS"
Revert of changes in PR #3289, which should not have removed the `HAVE_SECRET_CALLBACK` and `WOLFSSL_PUBLIC_ECC_ADD_DBL`. These are required for hostapd.
2021-02-12 14:11:17 -08:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_SECRET_CALLBACK"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PUBLIC_ECC_ADD_DBL"
Restore the normal `--enable-wpas` macro.
2020-09-17 08:55:52 -07:00
fi
if test "$ENABLED_WPAS" != "no"
then
Added support `--enable-wpas=small` for reduced code size when building against the WPA supplicant with EAP-TLS. This does not use `OPENSSL_EXTRA`, which helps reduce code size.
2020-05-08 13:38:26 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_VERIFY_CB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_KEEP_SNI"
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA"
Fixes for building `--enable-wpas=small` with WPA Supplicant v2.7.
2020-09-16 15:41:20 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_EXT_CACHE"
Added support `--enable-wpas=small` for reduced code size when building against the WPA supplicant with EAP-TLS. This does not use `OPENSSL_EXTRA`, which helps reduce code size.
2020-05-08 13:38:26 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_EITHER_SIDE"
Fixes for building `--enable-wpas=small` with WPA Supplicant v2.7.
2020-09-16 15:41:20 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA_X509_SMALL"
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
Fixes for building `--enable-wpas=small` with WPA Supplicant v2.7.
2020-09-16 15:41:20 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PUBLIC_MP"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DER_LOAD"
AM_CFLAGS="$AM_CFLAGS -DATOMIC_USER"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DES_ECB"
Include stuff needed for EAP in hostap Patch that includes the API needed for EAP in hostapd and wpa_supplicant
2021-08-03 17:52:30 +02:00
AM_CFLAGS="$AM_CFLAGS -DKEEP_OUR_CERT"
AM_CFLAGS="$AM_CFLAGS -DKEEP_PEER_CERT"
Add HAVE_KEYING_MATERIAL requirement to WPAS, to use wolfSSL_export_keying_material
2021-09-01 16:51:03 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_KEYING_MATERIAL"
Free session in `wolfSSL_clear` - Define `NO_SESSION_CACHE_REF` in wpa build
2022-04-22 15:54:04 +02:00
AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE_REF"
wpas: validate ecc points are on the curve
2022-06-13 20:29:56 +02:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VALIDATE_ECC_IMPORT"
wpa_supplicant uses larger challenge passwords for x509 requests
2022-06-14 16:43:35 +02:00
AM_CFLAGS="$AM_CFLAGS -DWC_CTC_NAME_SIZE=128"
configure.ac: WOLFSSL_WPAS[_SMALL] requires OPENSSL_EXTRA.
2022-06-24 16:38:56 -05:00
if test "$ENABLED_OPENSSLEXTRA" = "no"
then
ENABLED_OPENSSLEXTRA="yes"
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
fi
Added support `--enable-wpas=small` for reduced code size when building against the WPA supplicant with EAP-TLS. This does not use `OPENSSL_EXTRA`, which helps reduce code size.
2020-05-08 13:38:26 -07:00
fi
Changes for WPA Supplicant
2017-02-10 08:45:10 +10:00
add direct AES one block access and ECB DES for compatibility
2011-10-26 17:10:44 -07:00
if test "$ENABLED_FORTRESS" = "yes"
then
Minimal implementation of MP when using SP. --enable-sp-math to include minimal implementation of MP (only with --enable-sp.) Add futher functionality for ECC (conditionally compiled): - check key - is point on curve - API to add and double projective points - API to map from project to affine - Uncompress point (including sqrt) Some configuration options will not work with SP math - configure.ac detects this and errors out. Change test code to better support SP sizes only.
2018-02-08 15:50:17 +10:00
AM_CFLAGS="$AM_CFLAGS -DFORTRESS -DWOLFSSL_ALWAYS_VERIFY_CB -DWOLFSSL_AES_COUNTER -DWOLFSSL_AES_DIRECT -DWOLFSSL_DER_LOAD -DWOLFSSL_KEY_GEN"
add direct AES one block access and ECB DES for compatibility
2011-10-26 17:10:44 -07:00
fi
add fastmath to bump, add fastmath FP_MAX_BITS runtime check
2011-10-04 12:29:59 -07:00
if test "$ENABLED_BUMP" = "yes"
then
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
AM_CFLAGS="$AM_CFLAGS -DLARGE_STATIC_BUFFERS -DWOLFSSL_CERT_GEN -DWOLFSSL_KEY_GEN -DHUGE_SESSION_CACHE -DWOLFSSL_DER_LOAD -DWOLFSSL_ALT_NAMES -DWOLFSSL_TEST_CERT"
DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096
add fastmath to bump, add fastmath FP_MAX_BITS runtime check
2011-10-04 12:29:59 -07:00
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# lean psk build
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([leanpsk],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-leanpsk],[Enable Lean PSK build (default: disabled)])],
added build option for leanPSK
2012-10-29 15:39:42 -07:00
[ ENABLED_LEANPSK=$enableval ],
[ ENABLED_LEANPSK=no ]
)
if test "$ENABLED_LEANPSK" = "yes"
then
Purge Rabbit cipher
2022-01-19 14:29:51 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LEANPSK -DWOLFSSL_STATIC_PSK -DHAVE_NULL_CIPHER -DSINGLE_THREADED -DNO_AES -DNO_FILESYSTEM -DNO_RSA -DNO_DSA -DNO_DH -DNO_PWDBASED -DNO_MD4 -DNO_MD5 -DNO_ERROR_STRINGS -DNO_OLD_TLS -DNO_RC4 -DNO_WRITEV -DNO_DEV_RANDOM -DWOLFSSL_USER_IO -DNO_SHA"
for lean-psk build: remove big int math, MD4, error strings
2012-11-02 16:49:31 -07:00
ENABLED_SLOWMATH="no"
Lean PSK trimming 1. leave out memory and io callback functions, expect user supplied 2. leave out cert and DTLS related functions 3. SHA-1 compile option to use slower, rolled-up transform
2012-11-30 15:45:43 -08:00
ENABLED_SINGLETHREADED="yes"
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
enable_lowresource=yes
added build option for leanPSK
2012-10-29 15:39:42 -07:00
fi
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# lean TLS build (TLS 1.2 client only (no client auth), ECC256, AES128 and SHA256 w/o Shamir)
AC_ARG_ENABLE([leantls],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-leantls],[Enable Lean TLS build (default: disabled)])],
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
[ ENABLED_LEANTLS=$enableval ],
[ ENABLED_LEANTLS=no ]
)
if test "$ENABLED_LEANTLS" = "yes"
then
Purge Rabbit cipher
2022-01-19 14:29:51 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LEANTLS -DNO_WRITEV -DHAVE_ECC -DTFM_ECC256 -DECC_USER_CURVES -DNO_WOLFSSL_SERVER -DNO_RSA -DNO_DSA -DNO_DH -DNO_PWDBASED -DNO_MD5 -DNO_ERROR_STRINGS -DNO_OLD_TLS -DNO_RC4 -DNO_SHA -DNO_PSK -DNO_WOLFSSL_MEMORY -DNO_WOLFSSL_CM_VERIFY"
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
enable_lowresource=yes
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
fi
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
# low resource options to reduce flash and memory use
AC_ARG_ENABLE([lowresource],
[AS_HELP_STRING([--enable-lowresource],[Enable low resource options for memory/flash (default: disabled)])],
[ ENABLED_LOWRESOURCE=$enableval ],
[ ENABLED_LOWRESOURCE=no ]
)
if test "$ENABLED_LOWRESOURCE" = "yes"
then
# low memory / flash flags
Add WOLFSSL_NO_ASYNC_IO to low resource build
2022-05-27 14:34:46 +02:00
AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE -DRSA_LOW_MEM -DGCM_SMALL -DCURVE25519_SMALL -DED25519_SMALL -DWOLFSSL_SMALL_CERT_VERIFY -DWOLFSSL_NO_ASYNC_IO"
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
# low flash flags
AM_CFLAGS="$AM_CFLAGS -DUSE_SLOW_SHA -DUSE_SLOW_SHA256 -DUSE_SLOW_SHA512"
fi
Titan Session Cache 1. Added a new build option for a TITAN session cache that can hold just over 2 million session entires. 2. Reordered the cache options from largest to smallest.
2019-07-16 11:21:08 -07:00
# TITAN cache
AC_ARG_ENABLE([titancache],
[AS_HELP_STRING([--enable-titancache],[Enable titan session cache (default: disabled)])],
[ ENABLED_TITANCACHE=$enableval ],
[ ENABLED_TITANCACHE=no ]
1.8.8 init
2011-02-05 11:14:47 -08:00
)
Titan Session Cache 1. Added a new build option for a TITAN session cache that can hold just over 2 million session entires. 2. Reordered the cache options from largest to smallest.
2019-07-16 11:21:08 -07:00
if test "$ENABLED_TITANCACHE" = "yes"
1.8.8 init
2011-02-05 11:14:47 -08:00
then
Titan Session Cache 1. Added a new build option for a TITAN session cache that can hold just over 2 million session entires. 2. Reordered the cache options from largest to smallest.
2019-07-16 11:21:08 -07:00
AM_CFLAGS="$AM_CFLAGS -DTITAN_SESSION_CACHE"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
# HUGE cache
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([hugecache],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-hugecache],[Enable huge session cache (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_HUGECACHE=$enableval ],
[ ENABLED_HUGECACHE=no ]
)
if test "$ENABLED_HUGECACHE" = "yes"
then
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AM_CFLAGS="$AM_CFLAGS -DHUGE_SESSION_CACHE"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
Titan Session Cache 1. Added a new build option for a TITAN session cache that can hold just over 2 million session entires. 2. Reordered the cache options from largest to smallest.
2019-07-16 11:21:08 -07:00
# big cache
AC_ARG_ENABLE([bigcache],
[AS_HELP_STRING([--enable-bigcache],[Enable big session cache (default: disabled)])],
[ ENABLED_BIGCACHE=$enableval ],
[ ENABLED_BIGCACHE=no ]
)
if test "$ENABLED_BIGCACHE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DBIG_SESSION_CACHE"
fi
add SMALL_SESSION_CACHE define and configure option
2011-09-06 16:23:25 -07:00
# SMALL cache
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([smallcache],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-smallcache],[Enable small session cache (default: disabled)])],
add SMALL_SESSION_CACHE define and configure option
2011-09-06 16:23:25 -07:00
[ ENABLED_SMALLCACHE=$enableval ],
[ ENABLED_SMALLCACHE=no ]
)
if test "$ENABLED_SMALLCACHE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DSMALL_SESSION_CACHE"
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Persistent session cache
add persistent session cache, ssn9
2013-04-24 11:10:23 -07:00
AC_ARG_ENABLE([savesession],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-savesession],[Enable persistent session cache (default: disabled)])],
add persistent session cache, ssn9
2013-04-24 11:10:23 -07:00
[ ENABLED_SAVESESSION=$enableval ],
[ ENABLED_SAVESESSION=no ]
)
if test "$ENABLED_SAVESESSION" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DPERSIST_SESSION_CACHE"
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Persistent cert cache
add cert cache persistence
2013-05-02 11:34:26 -07:00
AC_ARG_ENABLE([savecert],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-savecert],[Enable persistent cert cache (default: disabled)])],
add cert cache persistence
2013-05-02 11:34:26 -07:00
[ ENABLED_SAVECERT=$enableval ],
[ ENABLED_SAVECERT=no ]
)
if test "$ENABLED_SAVECERT" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DPERSIST_CERT_CACHE"
fi
add wolfSSL_write_dup(), creates write_only WOLFSSL to allow concurrent access
2017-03-20 15:08:34 -07:00
# Write duplicate WOLFSSL object
AC_ARG_ENABLE([writedup],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-writedup],[Enable write duplication of WOLFSSL objects (default: disabled)])],
add wolfSSL_write_dup(), creates write_only WOLFSSL to allow concurrent access
2017-03-20 15:08:34 -07:00
[ ENABLED_WRITEDUP=$enableval ],
[ ENABLED_WRITEDUP=no ]
)
if test "$ENABLED_WRITEDUP" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_WRITE_DUP"
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Atomic User Record Layer
add atomic user macencrypt cb
2013-08-09 17:27:15 -07:00
AC_ARG_ENABLE([atomicuser],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-atomicuser],[Enable Atomic User Record Layer (default: disabled)])],
add atomic user macencrypt cb
2013-08-09 17:27:15 -07:00
[ ENABLED_ATOMICUSER=$enableval ],
[ ENABLED_ATOMICUSER=no ]
)
if test "$ENABLED_ATOMICUSER" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DATOMIC_USER"
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Public Key Callbacks
add public key callbacks for ecc sign/verify, examples
2013-08-22 18:19:39 -07:00
AC_ARG_ENABLE([pkcallbacks],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-pkcallbacks],[Enable Public Key Callbacks (default: disabled)])],
add public key callbacks for ecc sign/verify, examples
2013-08-22 18:19:39 -07:00
[ ENABLED_PKCALLBACKS=$enableval ],
[ ENABLED_PKCALLBACKS=no ]
)
if test "$ENABLED_PKCALLBACKS" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_PK_CALLBACKS"
fi
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
# Microchip/Atmel CryptoAuthLib
ENABLED_CRYPTOAUTHLIB="no"
trylibatcadir=""
AC_ARG_WITH([cryptoauthlib],
[AS_HELP_STRING([--with-cryptoauthlib=PATH],[PATH to CryptoAuthLib install (default /usr/)])],
[
AC_MSG_CHECKING([for cryptoauthlib])
CPPFLAGS="$CPPFLAGS -DWOLFSSL_ATECC508A"
LIBS="$LIBS -lcryptoauth"
Added new build option for Microchip CryptoAuthLib (--enable-cryptoauthlib). Build fixes with WOLFSSL_ATECC508A enabled.
2018-09-11 15:46:46 -07:00
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <cryptoauthlib.h>]], [[ atcab_init(0); ]])],[ libatca_linked=yes ],[ libatca_linked=no ])
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$libatca_linked" = "xno" ; then
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
if test "x$withval" != "xno" ; then
trylibatcadir=$withval
fi
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$withval" = "xyes" ; then
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
trylibatcadir="/usr"
fi
Added new build option for Microchip CryptoAuthLib (--enable-cryptoauthlib). Build fixes with WOLFSSL_ATECC508A enabled.
2018-09-11 15:46:46 -07:00
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
LDFLAGS="$LDFLAGS -L$trylibatcadir/lib"
CPPFLAGS="$CPPFLAGS -I$trylibatcadir/lib"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <cryptoauthlib.h>]], [[ atcab_init(0); ]])],[ libatca_linked=yes ],[ libatca_linked=no ])
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$libatca_linked" = "xno" ; then
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
AC_MSG_ERROR([cryptoauthlib isn't found.
If it's already installed, specify its path using --with-cryptoauthlib=/dir/])
fi
Updates to the atmel.c code to allow easier customization of the hardware interface.
2018-09-27 15:41:58 -07:00
AM_LDFLAGS="$AM_LDFLAGS -L$trylibatcadir/lib"
AM_CFLAGS="$AM_CFLAGS -I$trylibatcadir/lib"
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
AC_MSG_RESULT([yes])
else
AC_MSG_RESULT([yes])
fi
Updates to the atmel.c code to allow easier customization of the hardware interface.
2018-09-27 15:41:58 -07:00
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
ENABLED_CRYPTOAUTHLIB="yes"
Updates to the atmel.c code to allow easier customization of the hardware interface.
2018-09-27 15:41:58 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ATECC508A"
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
]
)
Added new build option for Microchip CryptoAuthLib (--enable-cryptoauthlib). Build fixes with WOLFSSL_ATECC508A enabled.
2018-09-11 15:46:46 -07:00
SE050 port with support for RNG, SHA, AES, ECC (sign/verify/shared secret) and ED25519
2021-08-20 12:59:41 -06:00
# NXP SE050
Fixes for building NXP SE050. Add support for automatic initialization of the SE050 if `WOLFSSL_SE050_INIT` is defined. Optionally can override the `portName` using `SE050_DEFAULT_PORT`.
2021-09-02 14:17:27 -07:00
# Example: "./configure --with-se050=/home/pi/simw_top"
SE050 port with support for RNG, SHA, AES, ECC (sign/verify/shared secret) and ED25519
2021-08-20 12:59:41 -06:00
ENABLED_SE050="no"
trylibse050dir=""
AC_ARG_WITH([se050],
[AS_HELP_STRING([--with-se050=PATH],[PATH to SE050 install (default /usr/local/lib/)])],
[
AC_MSG_CHECKING([for SE050])
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
LIBS="$LIBS -lSSS_APIs"
SE050 port with support for RNG, SHA, AES, ECC (sign/verify/shared secret) and ED25519
2021-08-20 12:59:41 -06:00
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0);]])],[ libse050_linked=yes ],[ libse050_linked=no ])
if test "x$libse050_linked" = "xno" ; then
if test "x$withval" != "xno" ; then
trylibse050dir=$withval
fi
if test "x$withval" = "xyes" ; then
trylibse050dir="/usr/local/lib/"
fi
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
LDFLAGS="$LDFLAGS -L$trylibse050dir/build/sss"
Fixes for building NXP SE050. Add support for automatic initialization of the SE050 if `WOLFSSL_SE050_INIT` is defined. Optionally can override the `portName` using `SE050_DEFAULT_PORT`.
2021-09-02 14:17:27 -07:00
CPPFLAGS="$CPPFLAGS -I$trylibse050dir/build"
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/inc"
Fixes for building NXP SE050. Add support for automatic initialization of the SE050 if `WOLFSSL_SE050_INIT` is defined. Optionally can override the `portName` using `SE050_DEFAULT_PORT`.
2021-09-02 14:17:27 -07:00
CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/ex/inc"
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
CPPFLAGS="$CPPFLAGS -I$trylibse050dir/sss/port/default"
CPPFLAGS="$CPPFLAGS -I$trylibse050dir/hostlib/hostLib/inc"
Fixes for SE050 Ed25519/Curve25519.
2022-01-04 16:10:57 -08:00
CPPFLAGS="$CPPFLAGS -I$trylibse050dir/hostlib/hostLib/libCommon/log/"
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
CPPFLAGS="$CPPFLAGS -I$trylibse050dir/hostlib/hostLib/libCommon/infra"
configure.ac: refactor AC_CHECK_FILES brought in by rebase, to fix warning.
2021-10-12 12:10:23 -05:00
if test -e "$trylibse050dir/build/sss/libSSS_APIs.a"; then
SE050_STATIC=yes
else
SE050_STATIC=no
fi
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
if test "x$SE050_STATIC" = "xyes"; then
Fixes for building NXP SE050. Add support for automatic initialization of the SE050 if `WOLFSSL_SE050_INIT` is defined. Optionally can override the `portName` using `SE050_DEFAULT_PORT`.
2021-09-02 14:17:27 -07:00
LIB_STATIC_ADD="$trylibse050dir/build/sss/ex/src/libex_common.a \
$trylibse050dir/build/sss/libSSS_APIs.a \
$trylibse050dir/build/hostlib/hostLib/se05x/libse05x.a \
$trylibse050dir/build/hostlib/hostLib/liba7x_utils.a \
Fixes for SE050 Ed25519/Curve25519.
2022-01-04 16:10:57 -08:00
$trylibse050dir/build/hostlib/hostLib/libCommon/log/libmwlog.a \
Fixes for building NXP SE050. Add support for automatic initialization of the SE050 if `WOLFSSL_SE050_INIT` is defined. Optionally can override the `portName` using `SE050_DEFAULT_PORT`.
2021-09-02 14:17:27 -07:00
$trylibse050dir/build/hostlib/hostLib/libCommon/libsmCom.a $LIB_STATIC_ADD"
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
else
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fsl_sss_api.h>]], [[ sss_mac_init(0); ]])],[ libse050_linked=yes ],[ libse050_linked=no ])
if test "x$libse050_linked" = "xno" ; then
AC_MSG_ERROR([SE050 isn't found.
If it's already installed, specify its path using --with-se050=/dir/])
fi
SE050 port with support for RNG, SHA, AES, ECC (sign/verify/shared secret) and ED25519
2021-08-20 12:59:41 -06:00
fi
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
# Requires AES direct
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
SE050 port with support for RNG, SHA, AES, ECC (sign/verify/shared secret) and ED25519
2021-08-20 12:59:41 -06:00
Changed NXP SE050 to not use symmetric offloading by default. If desired use `WOLFSSL_SE050_HASH` and `WOLFSSL_SE050_CRYPT`.
2021-11-01 16:18:59 -07:00
# Does not support SHA2-512 224/256
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
SE050 port with support for RNG, SHA, AES, ECC (sign/verify/shared secret) and ED25519
2021-08-20 12:59:41 -06:00
AC_MSG_RESULT([yes])
else
AC_MSG_RESULT([yes])
fi
ENABLED_SE050="yes"
Fixes for building NXP SE050. Add support for automatic initialization of the SE050 if `WOLFSSL_SE050_INIT` is defined. Optionally can override the `portName` using `SE050_DEFAULT_PORT`.
2021-09-02 14:17:27 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SE050 -DSSS_USE_FTR_FILE"
SE050 port with support for RNG, SHA, AES, ECC (sign/verify/shared secret) and ED25519
2021-08-20 12:59:41 -06:00
]
)
Added new build option for Microchip CryptoAuthLib (--enable-cryptoauthlib). Build fixes with WOLFSSL_ATECC508A enabled.
2018-09-11 15:46:46 -07:00
fix enable-sniffer option in configure.ac
2015-03-12 12:07:48 -07:00
ENABLED_SNIFFTEST=no
AS_IF([ test "x$ENABLED_SNIFFER" = "xyes" ],
[
TLS v1.3 sniffer support: * Added TLS v1.3 sniffer support using static ephemeral key. * Add support for using a static ephemeral DH and ECC keys with TLS v1.3 using `WOLFSSL_STATIC_EPHEMERAL`. * Adds new API's `wolfSSL_CTX_set_ephemeral_key` and `wolfSSL_set_ephemeral_key`. * Expanded TLS extension support in sniffer. * Refactor of the handshake hashing code. * Added parameter checking to the TLS v1.3 key derivations (protects use of "DoTls13Finished" if handshake resources have been free'd). * Added support for loading DH keys via `wc_DhImportKeyPair` and `wc_DhExportKeyPair`, enabled with `WOLFSSL_DH_EXTRA`. * Added sniffer documentation `sslSniffer/README.md`.
2020-07-09 13:52:49 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SNIFFER -DWOLFSSL_STATIC_EPHEMERAL"
fix enable-sniffer option in configure.ac
2015-03-12 12:07:48 -07:00
AC_CHECK_HEADERS([pcap/pcap.h],
[ ENABLED_SNIFFTEST=yes ],
[ AC_MSG_WARN([cannot enable sniffer test without having libpcap available.]) ]
)
])
Fixes for hardening flags. Additional fixes for using C++ compiler to compile. Include file pcap.h now gates sniffer for build.
2012-10-19 22:00:17 -04:00
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
Config option to disable AES-CBC AEAD only detection and removeal of code. Also in single threaded builds, reference the ctx suites in ssl object if it exists.
2018-07-25 11:22:48 +10:00
# AES-CBC
AC_ARG_ENABLE([aescbc],
[AS_HELP_STRING([--enable-aescbc],[Enable wolfSSL AES-CBC support (default: enabled)])],
[ ENABLED_AESCBC=$enableval ],
[ ENABLED_AESCBC=yes ]
)
if test "$ENABLED_AESCBC" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_AES_CBC"
fi
configure.ac: add --enable-aescbc-length-checks and add it to --enable-all; api.c: fix expected error code in WOLFSSL_AES_CBC_LENGTH_CHECKS path of test_wc_AesCbcEncryptDecrypt(); aes.c: add explanatory comment on WOLFSSL_AES_CBC_LENGTH_CHECKS to top of file.
2021-03-26 14:04:25 -05:00
# AES-CBC length checks (checks that input lengths are multiples of block size)
AC_ARG_ENABLE([aescbc_length_checks],
[AS_HELP_STRING([--enable-aescbc-length-checks],[Enable AES-CBC length validity checks (default: disabled)])],
[ ENABLED_AESCBC_LENGTH_CHECKS=$enableval ],
[ ENABLED_AESCBC_LENGTH_CHECKS=no ]
)
if test "$ENABLED_AESCBC_LENGTH_CHECKS" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_CBC_LENGTH_CHECKS"
fi
Config option to disable AES-CBC AEAD only detection and removeal of code. Also in single threaded builds, reference the ctx suites in ssl object if it exists.
2018-07-25 11:22:48 +10:00
# leanpsk and leantls don't need gcm
added stubs for AES-GCM processing and build option
2012-06-13 21:31:32 -07:00
# AES-GCM
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([aesgcm],
update configure help strings for AESGCM and DH
2015-03-31 16:23:28 -07:00
[AS_HELP_STRING([--enable-aesgcm],[Enable wolfSSL AES-GCM support (default: enabled)])],
added stubs for AES-GCM processing and build option
2012-06-13 21:31:32 -07:00
[ ENABLED_AESGCM=$enableval ],
enable gcm by default
2015-03-27 11:12:42 -07:00
[ ENABLED_AESGCM=yes ]
added stubs for AES-GCM processing and build option
2012-06-13 21:31:32 -07:00
)
AES GCM: implement streaming Updated EVP layer to use streaming API when enabled. Assembly for x64 updated to include streaming.
2021-03-04 16:01:45 +10:00
AC_ARG_ENABLE([aesgcm-stream],
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
[AS_HELP_STRING([--enable-aesgcm-stream],[Enable wolfSSL AES-GCM support with streaming APIs (default: disabled)])],
AES GCM: implement streaming Updated EVP layer to use streaming API when enabled. Assembly for x64 updated to include streaming.
2021-03-04 16:01:45 +10:00
[ ENABLED_AESGCM_STREAM=$enableval ],
[ ENABLED_AESGCM_STREAM=no ]
)
added stubs for AES-GCM processing and build option
2012-06-13 21:31:32 -07:00
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# leanpsk and leantls don't need gcm
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
if test "$FIPS_VERSION" = "rand" || test "$ENABLED_LEANPSK" = "yes" ||
(test "$ENABLED_LEANTLS" = "yes" && test "$ENABLED_TLS13" = "no")
leanpsk doesn't need new gcm, poly, chacah defaults
2015-03-29 11:30:05 -07:00
then
ENABLED_AESGCM=no
fi
AES-GCM: GMULT using 4-bit table When 64-bit data type available and not big endian code is faster. --enable-aesgcm=4bit
2020-10-14 14:08:06 +10:00
if test "$ENABLED_AESGCM" = "yes" && test "$ac_cv_c_bigendian" != "yes"
added 64-bit (default), 32-bit version, and 8-bit table based AES-GCM for faster operation. Selection made at configure.
2012-07-19 14:44:08 -07:00
then
AES-GCM: GMULT using 4-bit table When 64-bit data type available and not big endian code is faster. --enable-aesgcm=4bit
2020-10-14 14:08:06 +10:00
ENABLED_AESGCM="4bit"
added stubs for AES-GCM processing and build option
2012-06-13 21:31:32 -07:00
fi
added AES-CCM as a configure option
2013-01-10 16:46:47 -08:00
# AES-CCM
AC_ARG_ENABLE([aesccm],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-aesccm],[Enable wolfSSL AES-CCM support (default: disabled)])],
added AES-CCM as a configure option
2013-01-10 16:46:47 -08:00
[ ENABLED_AESCCM=$enableval ],
[ ENABLED_AESCCM=no ]
)
Make the code simpler.
2022-02-04 16:05:58 -05:00
if test "$ENABLED_AESCCM" = "yes" || test "$ENABLED_WOLFENGINE" = "yes"
added AES-CCM as a configure option
2013-01-10 16:46:47 -08:00
then
AES-GCM does not require SHA-384, but will use it if enabled in build; reorder some of the requirement checks to regroup some NO_RSA suite checks
2013-04-01 14:25:20 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"
added AES-CCM as a configure option
2013-01-10 16:46:47 -08:00
fi
Add AES-SIV (RFC 5297). This commit adds functions to encrypt and decrypt data using AES in SIV mode, as described in RFC 5297. This was added in the process of porting chrony to wolfSSL. chrony is an NTP implementation that can use NTS (network time security), which requires AES-SIV.
2022-01-14 16:52:03 -08:00
# AES-SIV (RFC 5297)
AC_ARG_ENABLE([aessiv],
[AS_HELP_STRING([--enable-aessiv],[Enable AES-SIV (RFC 5297) (default: disabled)])],
[ ENABLED_AESSIV=$enableval ],
[ ENABLED_AESSIV=no ]
)
added AES-CCM as a configure option
2013-01-10 16:46:47 -08:00
Add --enable-chrony configure option. This turns on the necessary features for using the chrony NTP package with wolfSSL.
2022-01-18 22:02:50 -08:00
if test "$ENABLED_CHRONY" = "yes"
then
ENABLED_AESSIV=yes
fi
# AES-CTRf
Adds an --enable-aesctr flag to the configure script to explicitly compile with -DWOLFSSL_AES_COUNTER and -DWOLFSSL_AES_DIRECT If --enable-fortress or --enable-mcapi are used they effectively force --enable-aesctr
2016-12-04 15:23:51 +01:00
AC_ARG_ENABLE([aesctr],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-aesctr],[Enable wolfSSL AES-CTR support (default: disabled)])],
Adds an --enable-aesctr flag to the configure script to explicitly compile with -DWOLFSSL_AES_COUNTER and -DWOLFSSL_AES_DIRECT If --enable-fortress or --enable-mcapi are used they effectively force --enable-aesctr
2016-12-04 15:23:51 +01:00
[ ENABLED_AESCTR=$enableval ],
[ ENABLED_AESCTR=no ]
)
Make the code simpler.
2022-02-04 16:05:58 -05:00
if test "$ENABLED_OPENVPN" = "yes" || test "$ENABLED_LIBSSH2" = "yes" || test "$ENABLED_AESSIV" = "yes" || test "$ENABLED_WOLFENGINE" = "yes"
Add --enable-openvpn build option
2020-01-28 15:29:24 +01:00
then
ENABLED_AESCTR=yes
fi
Adds an --enable-aesctr flag to the configure script to explicitly compile with -DWOLFSSL_AES_COUNTER and -DWOLFSSL_AES_DIRECT If --enable-fortress or --enable-mcapi are used they effectively force --enable-aesctr
2016-12-04 15:23:51 +01:00
add QUIC support.
2022-08-08 13:24:00 +02:00
if test "$ENABLED_QUIC" = "yes"
then
ENABLED_AESCTR=yes
fi
add AES-OFB mode
2020-01-21 15:51:12 -08:00
# AES-OFB
AC_ARG_ENABLE([aesofb],
[AS_HELP_STRING([--enable-aesofb],[Enable wolfSSL AES-OFB support (default: disabled)])],
[ ENABLED_AESOFB=$enableval ],
[ ENABLED_AESOFB=no ]
)
if test "$ENABLED_AESOFB" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB -DWOLFSSL_AES_DIRECT"
fi
add --enable-aescfb, add comments, include of stdio with snprintf
2018-01-12 11:05:43 -07:00
# AES-CFB
AC_ARG_ENABLE([aescfb],
[AS_HELP_STRING([--enable-aescfb],[Enable wolfSSL AES-CFB support (default: disabled)])],
[ ENABLED_AESCFB=$enableval ],
[ ENABLED_AESCFB=no ]
)
if test "$ENABLED_AESCFB" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_CFB"
fi
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
ENABLED_ARMASM_INLINE="no"
ENABLED_ARMASM_SHA3="no"
AARCH64 SHA512: implementation using crypto instructions added Use --enable-armasm=sha512-crypto or define WOLFSSL_ARMASM_CRYPTO_SHA512 to use SHA512 cryptographic instructions. Checks system register for the feature before using the SHA512 instructions. Added SHA512 input data alignment test. Add support for SHA512/224 and SHA512/256 to ARM port.
2021-08-30 22:56:38 +10:00
# ARM Assembly
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
# Both SHA3 and SHA512 instructions available with ARMV8.2-a
initial ARMv8 instructions
2016-07-22 15:49:15 +00:00
AC_ARG_ENABLE([armasm],
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
[AS_HELP_STRING([--enable-armasm],[Enable wolfSSL ARMv8 ASM support (default: disabled). Set to sha512-crypto or sha3-crypto to use SHA512 and SHA3 instructions with Aarch64 CPU.])],
initial ARMv8 instructions
2016-07-22 15:49:15 +00:00
[ ENABLED_ARMASM=$enableval ],
[ ENABLED_ARMASM=no ]
)
AARCH64 SHA512: implementation using crypto instructions added Use --enable-armasm=sha512-crypto or define WOLFSSL_ARMASM_CRYPTO_SHA512 to use SHA512 cryptographic instructions. Checks system register for the feature before using the SHA512 instructions. Added SHA512 input data alignment test. Add support for SHA512/224 and SHA512/256 to ARM port.
2021-08-30 22:56:38 +10:00
if test "$ENABLED_ARMASM" != "no" && test "$ENABLED_ASM" = "yes"
initial ARMv8 instructions
2016-07-22 15:49:15 +00:00
then
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
AARCH64 SHA512: implementation using crypto instructions added Use --enable-armasm=sha512-crypto or define WOLFSSL_ARMASM_CRYPTO_SHA512 to use SHA512 cryptographic instructions. Checks system register for the feature before using the SHA512 instructions. Added SHA512 input data alignment test. Add support for SHA512/224 and SHA512/256 to ARM port.
2021-08-30 22:56:38 +10:00
for v in `echo $ENABLED_ARMASM | tr "," " "`
do
case $v in
yes)
;;
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
inline)
ENABLED_ARMASM_INLINE=yes
;;
sha512-crypto | sha3-crypto)
AARCH64 SHA512: implementation using crypto instructions added Use --enable-armasm=sha512-crypto or define WOLFSSL_ARMASM_CRYPTO_SHA512 to use SHA512 cryptographic instructions. Checks system register for the feature before using the SHA512 instructions. Added SHA512 input data alignment test. Add support for SHA512/224 and SHA512/256 to ARM port.
2021-08-30 22:56:38 +10:00
case $host_cpu in
*aarch64*)
;;
*)
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
AC_MSG_ERROR([SHA512/SHA3 instructions only available on Aarch64 CPU.])
AARCH64 SHA512: implementation using crypto instructions added Use --enable-armasm=sha512-crypto or define WOLFSSL_ARMASM_CRYPTO_SHA512 to use SHA512 cryptographic instructions. Checks system register for the feature before using the SHA512 instructions. Added SHA512 input data alignment test. Add support for SHA512/224 and SHA512/256 to ARM port.
2021-08-30 22:56:38 +10:00
break;;
esac
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
ENABLED_ARMASM_SHA3=yes
AARCH64 SHA512: implementation using crypto instructions added Use --enable-armasm=sha512-crypto or define WOLFSSL_ARMASM_CRYPTO_SHA512 to use SHA512 cryptographic instructions. Checks system register for the feature before using the SHA512 instructions. Added SHA512 input data alignment test. Add support for SHA512/224 and SHA512/256 to ARM port.
2021-08-30 22:56:38 +10:00
;;
*)
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
AC_MSG_ERROR([Invalid choice of ARM asm inclusions (yes, sha512-crypto, sha3-crypto): $ENABLED_ARMASM.])
AARCH64 SHA512: implementation using crypto instructions added Use --enable-armasm=sha512-crypto or define WOLFSSL_ARMASM_CRYPTO_SHA512 to use SHA512 cryptographic instructions. Checks system register for the feature before using the SHA512 instructions. Added SHA512 input data alignment test. Add support for SHA512/224 and SHA512/256 to ARM port.
2021-08-30 22:56:38 +10:00
break;;
esac
done
ENABLED_ARMASM="yes"
Fix for AARCH64 on Linaro Poly1305 using [wx]29 corrupts data - use [wx]30. WOLFSSL_ARMASM is an ASM flag as well.
2019-07-23 09:56:18 +10:00
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_ARMASM"
RAW hash function APIs not supported with ARMv8 build
2018-06-12 16:45:38 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ARMASM -DWOLFSSL_NO_HASH_RAW"
ARMv8 : Aarch32 support, SHA256 speedup
2016-09-28 10:22:27 -06:00
#Check if mcpu and mfpu values already set if not use default
case $CPPFLAGS in
*mcpu* | *mfpu*)
break;; #Do not override user set values
*)
case $host_cpu in
*aarch64*)
ARM asm: fixes for compiling on Mac and ChaCha20 streaming Don't set the CPU to generic on Mac. Implement streaming for ChaCha20.
2020-09-29 13:38:02 +10:00
case $host_os in
*darwin*)
SHA-512 ASM: For Mac computers default to using SHA512 instructions
2022-01-21 16:20:32 +10:00
# All known Aarch64 Mac computers support SHA-512 instructions
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
ENABLED_ARMASM_SHA3=yes
ARM asm: fixes for compiling on Mac and ChaCha20 streaming Don't set the CPU to generic on Mac. Implement streaming for ChaCha20.
2020-09-29 13:38:02 +10:00
;;
*)
# +crypto needed for hardware acceleration
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
if test "$ENABLED_ARMASM_SHA3" = "yes"; then
AM_CPPFLAGS="$AM_CPPFLAGS -march=armv8.2-a+crypto+sha3"
else
AM_CPPFLAGS="$AM_CPPFLAGS -mcpu=generic+crypto"
fi
ARM asm: fixes for compiling on Mac and ChaCha20 streaming Don't set the CPU to generic on Mac. Implement streaming for ChaCha20.
2020-09-29 13:38:02 +10:00
;;
esac
Fix ARM builds Need to include options.h in assembly now. bufPt declared in block but not outside. poly1305_block and poly1305_blocks need prototype - declaration in wolfcrypt/src/port/arm/armv8-poly1305.c (__arch64__ only).
2020-08-10 11:59:10 +10:00
# Include options.h
AM_CCASFLAGS="$AM_CCASFLAGS -DEXTERNAL_OPTS_OPENVPN"
ARM ASM: ARMv7a with NEON instructions Change to build assembly code for ARMv7a with NEON instruction set. ./configure -host=armv7a --enable-armasm Added ARM32 SHA-256 NEON only implementation.
2022-05-18 16:23:48 +10:00
ENABLED_ARMASM_CRYPTO=yes
add -mstrict-align flag with armasm
2018-12-17 17:12:14 -07:00
# Check for and set -mstrict-align compiler flag
# Used to set assumption that Aarch64 systems will not handle
# unaligned memory references. The flag -mstrict-align is needed
# on some compiler versions to avoid an invalid addressing mode
# error with "m" constraint variables in the inline assembly AES
# code. Even though unaligned load/store access is permitted on
# normal memory with Cortex-A series boards with the exception
# being exclusive and ordered access.
case $CPPFLAGS in
*mstrict-align*)
break;; # already set by user
*)
AM_CPPFLAGS="$AM_CPPFLAGS -mstrict-align"
AC_MSG_NOTICE([64bit ARMv8, setting -mstrict-align]);;
esac
ARM ASM: ARMv7a with NEON instructions Change to build assembly code for ARMv7a with NEON instruction set. ./configure -host=armv7a --enable-armasm Added ARM32 SHA-256 NEON only implementation.
2022-05-18 16:23:48 +10:00
AC_MSG_NOTICE([64bit ARMv8 found, setting mcpu to generic+crypto])
;;
armv7a)
Fix define name WOLFSSL_ARMASM_NO_CRYPTO -> WOLFSSL_ARMASM_NO_HW_CRYPTO
2022-09-08 08:39:00 +10:00
AM_CPPFLAGS="$AM_CPPFLAGS -march=armv7-a -mfpu=neon -DWOLFSSL_ARMASM_NO_HW_CRYPTO -DWOLFSSL_ARM_ARCH=7"
ARM ASM: ARMv7a with NEON instructions Change to build assembly code for ARMv7a with NEON instruction set. ./configure -host=armv7a --enable-armasm Added ARM32 SHA-256 NEON only implementation.
2022-05-18 16:23:48 +10:00
# Include options.h
AM_CCASFLAGS="$AM_CCASFLAGS -DEXTERNAL_OPTS_OPENVPN"
ENABLED_ARMASM_CRYPTO=no
Fixup assembly to compile with ARMv7a
2022-08-24 14:24:17 +10:00
AC_MSG_NOTICE([32bit ARMv7-a found, setting mfpu to neon])
ARM ASM: ARMv7a with NEON instructions Change to build assembly code for ARMv7a with NEON instruction set. ./configure -host=armv7a --enable-armasm Added ARM32 SHA-256 NEON only implementation.
2022-05-18 16:23:48 +10:00
;;
ARMv8 : Aarch32 support, SHA256 speedup
2016-09-28 10:22:27 -06:00
*)
AM_CPPFLAGS="$AM_CPPFLAGS -mfpu=crypto-neon-fp-armv8"
Fix ARM builds Need to include options.h in assembly now. bufPt declared in block but not outside. poly1305_block and poly1305_blocks need prototype - declaration in wolfcrypt/src/port/arm/armv8-poly1305.c (__arch64__ only).
2020-08-10 11:59:10 +10:00
# Include options.h
AM_CCASFLAGS="$AM_CCASFLAGS -DEXTERNAL_OPTS_OPENVPN"
ARM ASM: ARMv7a with NEON instructions Change to build assembly code for ARMv7a with NEON instruction set. ./configure -host=armv7a --enable-armasm Added ARM32 SHA-256 NEON only implementation.
2022-05-18 16:23:48 +10:00
ENABLED_ARMASM_CRYPTO=yes
AC_MSG_NOTICE([32bit ARMv8 found, setting mfpu to crypto-neon-fp-armv8])
;;
ARMv8 : Aarch32 support, SHA256 speedup
2016-09-28 10:22:27 -06:00
esac
esac
initial ARMv8 instructions
2016-07-22 15:49:15 +00:00
fi
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
if test "$ENABLED_ARMASM_SHA3" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ARMASM_CRYPTO_SHA512 -DWOLFSSL_ARMASM_CRYPTO_SHA3"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_ARMASM_CRYPTO_SHA512 -DWOLFSSL_ARMASM_CRYPTO_SHA3"
SHA-512 ASM: For Mac computers default to using SHA512 instructions
2022-01-21 16:20:32 +10:00
fi
Xilinx port
2017-06-07 11:37:21 -06:00
# Xilinx hardened crypto
AC_ARG_ENABLE([xilinx],
[AS_HELP_STRING([--enable-xilinx],[Enable wolfSSL support for Xilinx hardened crypto(default: disabled)])],
[ ENABLED_XILINX=$enableval ],
[ ENABLED_XILINX=no ]
)
if test "$ENABLED_XILINX" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_XILINX -DWOLFSSL_XILINX_CRYPT"
fi
first pre alpha code for QNX + CAAM manual run of RNG init and JDKEK print job ring does initial rng is successful on some red key blob operations caam red key blob test pass ecdsa sign/verify ecdsa ecdh/sign/verify with black secure key ecdsa ecdh/sign/verify with black secure key initial cmac addition initial cmac addition black blob encap black keys with cmac add invalidate memory refactoring and clean up more code cleanup add files for dist and remove some printf's remove unneeded macro guard use resource manager
2020-08-07 14:40:44 -06:00
# CAAM build
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
trylibsecodir="/usr"
AC_ARG_WITH([seco],
[AS_HELP_STRING([--with-seco=PATH],[PATH to SECO install (default /usr/lib/)])],
[
AC_MSG_CHECKING([for SECO])
if test "x$withval" != "xno" ; then
trylibsecodir=$withval
fi
]
)
first pre alpha code for QNX + CAAM manual run of RNG init and JDKEK print job ring does initial rng is successful on some red key blob operations caam red key blob test pass ecdsa sign/verify ecdsa ecdh/sign/verify with black secure key ecdsa ecdh/sign/verify with black secure key initial cmac addition initial cmac addition black blob encap black keys with cmac add invalidate memory refactoring and clean up more code cleanup add files for dist and remove some printf's remove unneeded macro guard use resource manager
2020-08-07 14:40:44 -06:00
AC_ARG_ENABLE([caam],
[AS_HELP_STRING([--enable-caam],[Enable wolfSSL support for CAAM (default: disabled)])],
[ ENABLED_CAAM=$enableval ],
[ ENABLED_CAAM=no ]
)
if test "$ENABLED_CAAM" = "yes"
then
add macro guards to handle build with QNX CAAM
2022-03-09 16:48:58 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM -DWOLFSSL_IMX6_CAAM"
first pre alpha code for QNX + CAAM manual run of RNG init and JDKEK print job ring does initial rng is successful on some red key blob operations caam red key blob test pass ecdsa sign/verify ecdsa ecdh/sign/verify with black secure key ecdsa ecdh/sign/verify with black secure key initial cmac addition initial cmac addition black blob encap black keys with cmac add invalidate memory refactoring and clean up more code cleanup add files for dist and remove some printf's remove unneeded macro guard use resource manager
2020-08-07 14:40:44 -06:00
fi
if test "$ENABLED_CAAM" = "qnx"
then
add macro guards to handle build with QNX CAAM
2022-03-09 16:48:58 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM -DWOLFSSL_IMX6_CAAM -DWOLFSSL_QNX_CAAM"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_ECC"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_CMAC"
add support for i.MX8 with QNX CAAM
2022-04-27 02:27:05 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_CIPHER"
first pre alpha code for QNX + CAAM manual run of RNG init and JDKEK print job ring does initial rng is successful on some red key blob operations caam red key blob test pass ecdsa sign/verify ecdsa ecdh/sign/verify with black secure key ecdsa ecdh/sign/verify with black secure key initial cmac addition initial cmac addition black blob encap black keys with cmac add invalidate memory refactoring and clean up more code cleanup add files for dist and remove some printf's remove unneeded macro guard use resource manager
2020-08-07 14:40:44 -06:00
fi
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
if test "$ENABLED_CAAM" = "seco"
then
SECO_DIR=$trylibsecodir
AM_CPPFLAGS="$AM_CPPFLAGS -I$SECO_DIR/include"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM -DWOLFSSL_SECO_CAAM -DWOLFSSL_HASH_KEEP"
add macro guards to handle build with QNX CAAM
2022-03-09 16:48:58 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_ECC"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_CMAC"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_CIPHER"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_HMAC"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_HASH"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CAAM_CURVE25519"
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
AC_CHECK_LIB([hsm_lib],[hsm_open_session])
AC_CHECK_LIB([seco_nvm_manager],[seco_nvm_manager])
LIB_STATIC_ADD="$LIB_STATIC_ADD $SECO_DIR/lib/hsm_lib.a $SECO_DIR/lib/seco_nvm_manager.a"
LIB_ADD="$LIB_ADD -lz"
fi
first pre alpha code for QNX + CAAM manual run of RNG init and JDKEK print job ring does initial rng is successful on some red key blob operations caam red key blob test pass ecdsa sign/verify ecdsa ecdh/sign/verify with black secure key ecdsa ecdh/sign/verify with black secure key initial cmac addition initial cmac addition black blob encap black keys with cmac add invalidate memory refactoring and clean up more code cleanup add files for dist and remove some printf's remove unneeded macro guard use resource manager
2020-08-07 14:40:44 -06:00
Fix RNG issue with Intel RDRAND and RDSEED accelerations not being used because HAVE_HASHDRBG was always being defined if !WOLFSSL_FORCE_RC4_DRBG. Added new --enable-intelrand option to indicate use of RDRAND preference for RNG source (if RDRAND not supported by CPU then HASHDRBG will be used). The --enable-intelasm option enables the RDSEED support for seeding HASHDRBG if CPU supports it. Allow use of seed as RNG source if --disable-hashdbrg (shows build warning). Cleanup to remove old ARC4 RNG support. Fixed random_test return code with !HAVE_HASHDRBG. Cleanup of ./configure --help alignment.
2017-03-17 13:29:03 -07:00
# INTEL AES-NI
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([aesni],
add intelasm ./configure option
2015-03-28 14:34:39 -07:00
[AS_HELP_STRING([--enable-aesni],[Enable wolfSSL AES-NI support (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_AESNI=$enableval ],
[ ENABLED_AESNI=no ]
)
add intelasm ./configure option
2015-03-28 14:34:39 -07:00
# INTEL ASM
AC_ARG_ENABLE([intelasm],
[AS_HELP_STRING([--enable-intelasm],[Enable All Intel ASM speedups (default: disabled)])],
[ ENABLED_INTELASM=$enableval ],
[ ENABLED_INTELASM=no ]
)
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
if test "$ENABLED_ASM" = "yes"
Assembly optimization for AES-NI, and AVX1 and AVX2 Unroll the loop for 8. Use new optimized maths. Fix SHA-384 to use SHA-512 assembly code. Only perform CPU id check in one place.
2017-07-18 10:14:17 +10:00
then
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
if test "$ENABLED_AESNI" = "small"
then
AM_CFLAGS="$AM_CFLAGS -DAES_GCM_AESNI_NO_UNROLL"
ENABLED_AESNI=yes
fi
Fix RNG issue with Intel RDRAND and RDSEED accelerations not being used because HAVE_HASHDRBG was always being defined if !WOLFSSL_FORCE_RC4_DRBG. Added new --enable-intelrand option to indicate use of RDRAND preference for RNG source (if RDRAND not supported by CPU then HASHDRBG will be used). The --enable-intelasm option enables the RDSEED support for seeding HASHDRBG if CPU supports it. Allow use of seed as RNG source if --disable-hashdbrg (shows build warning). Cleanup to remove old ARC4 RNG support. Fixed random_test return code with !HAVE_HASHDRBG. Cleanup of ./configure --help alignment.
2017-03-17 13:29:03 -07:00
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
if test "$ENABLED_AESNI" = "yes" || test "$ENABLED_INTELASM" = "yes"
1.8.8 init
2011-02-05 11:14:47 -08:00
then
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AESNI"
AESNI: fix configure to use minimal compiler flags
2022-07-07 09:30:48 +10:00
if test "$CC" != "icc"
uses most recent version of cyassl
2014-07-10 11:18:49 -06:00
then
AESNI: fix configure to use minimal compiler flags
2022-07-07 09:30:48 +10:00
case $host_os in
mingw*)
# Windows uses intrinsics for GCM which uses SSE4 instructions.
# MSVC has own build files.
AM_CFLAGS="$AM_CFLAGS -maes -msse4 -mpclmul"
;;
*)
# Intrinsics used in AES_set_decrypt_key (TODO: rework)
AM_CFLAGS="$AM_CFLAGS -maes"
;;
esac
uses most recent version of cyassl
2014-07-10 11:18:49 -06:00
fi
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
AS_IF([test "x$ENABLED_AESGCM" != "xno"],[AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_AESGCM"])
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
if test "$ENABLED_INTELASM" = "yes"
then
Remove RDSEED from the intel asm build.
2021-03-31 14:25:57 -07:00
AM_CFLAGS="$AM_CFLAGS -DUSE_INTEL_SPEEDUP"
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
ENABLED_AESNI=yes
fi
AES x86 ASM: new assembly Added new x86 assembly for AES. AES-CBC decrypt only 4 blocks at a time (not 6 or 8) due to reduces register count. GCM implementation for AVX2, AVX1 and AESNI only. Disabled looking for other assembly files for x86.
2022-09-30 16:19:40 +10:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "amd64"
then
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_X86_64_BUILD"
fi
if test "$host_cpu" = "x86"
then
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_X86_BUILD"
ENABLED_X86_ASM=yes
fi
add intelasm ./configure option
2015-03-28 14:34:39 -07:00
fi
address errors with `-fsanitize=undefined` - fix null dereferences or undefined `memcpy` calls - fix alignment in `myCryptoDevCb` - fix default dtls context assignment - add align configure option to force data alignment TESTED: `./configure CFLAGS=-fsanitize=undefined\ -DWOLFSSL_GENERAL_ALIGNMENT=1 --enable-all`
2021-05-26 11:33:33 -07:00
AC_ARG_ENABLE([aligndata],
[AS_HELP_STRING([--enable-aligndata],[align data for ciphers (default: enabled)])],
[ ENABLED_ALIGN_DATA=$enableval ],
[ ENABLED_ALIGN_DATA=yes ]
)
if test "$ENABLED_ALIGN_DATA" = "yes"
then
Changes to compile without XTREAM_ALIGN Use macro to load 32 bits from input parameters key in hc128.c and input in rabbit.c Also fix warning about string copy.
2021-06-30 09:45:19 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_USE_ALIGN"
address errors with `-fsanitize=undefined` - fix null dereferences or undefined `memcpy` calls - fix alignment in `myCryptoDevCb` - fix default dtls context assignment - add align configure option to force data alignment TESTED: `./configure CFLAGS=-fsanitize=undefined\ -DWOLFSSL_GENERAL_ALIGNMENT=1 --enable-all`
2021-05-26 11:33:33 -07:00
fi
Fix RNG issue with Intel RDRAND and RDSEED accelerations not being used because HAVE_HASHDRBG was always being defined if !WOLFSSL_FORCE_RC4_DRBG. Added new --enable-intelrand option to indicate use of RDRAND preference for RNG source (if RDRAND not supported by CPU then HASHDRBG will be used). The --enable-intelasm option enables the RDSEED support for seeding HASHDRBG if CPU supports it. Allow use of seed as RNG source if --disable-hashdbrg (shows build warning). Cleanup to remove old ARC4 RNG support. Fixed random_test return code with !HAVE_HASHDRBG. Cleanup of ./configure --help alignment.
2017-03-17 13:29:03 -07:00
# INTEL RDRAND
AC_ARG_ENABLE([intelrand],
[AS_HELP_STRING([--enable-intelrand],[Enable Intel rdrand as preferred RNG source (default: disabled)])],
[ ENABLED_INTELRDRAND=$enableval ],
[ ENABLED_INTELRDRAND=no ]
)
if test "$ENABLED_INTELRDRAND" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_INTEL_RDRAND"
fi
wolfRand for AMD 1. Add configure option to enable AMD's RDSEED. 2. Add seed parameters when building specifically for AMD using RDSEED. 3. Update the wolfCrypt test to play nice with the larger seed size.
2022-03-15 15:20:08 -07:00
# AMD RDSEED
AC_ARG_ENABLE([amdrand],
[AS_HELP_STRING([--enable-amdrand],[Enable AMD rdseed as preferred RNG seeding source (default: disabled)])],
[ ENABLED_AMDRDSEED=$enableval ],
[ ENABLED_AMDRDSEED=no ]
)
if test "$ENABLED_AMDRDSEED" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_AMD_RDSEED"
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
throw error when opensslcoexist configured with opensslall or opensslextra
2019-10-23 15:51:19 -07:00
# Linux af_alg
inital AES-CBC with af_alg progress on AES-GCM with AF_ALG and add SHA256 add aes-gcm test cases and finish logic of aes-gcm with AF_ALG formating of tabs and white space add files to dist adding ecb and ctr mode with af_alg make length of buffers for ctr be AES_BLOCK_SIZE formating and add support for sha256 copy/gethash sanity checks on arguments cast return values and valgrind tests make it easier to use sha256 with af_alg remove hard tabs add endif for after rebase
2018-07-18 17:26:25 -06:00
AC_ARG_ENABLE([afalg],
[AS_HELP_STRING([--enable-afalg],[Enable Linux af_alg use for crypto (default: disabled)])],
[ ENABLED_AFALG=$enableval ],
[ ENABLED_AFALG=no ]
)
if test "$ENABLED_AFALG" = "yes"
then
build fix for aesccm + devcrypto=cbc + wpas and afalg
2019-08-30 16:15:48 -06:00
if test "$ENABLED_AESCCM" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
fi
inital AES-CBC with af_alg progress on AES-GCM with AF_ALG and add SHA256 add aes-gcm test cases and finish logic of aes-gcm with AF_ALG formating of tabs and white space add files to dist adding ecb and ctr mode with af_alg make length of buffers for ctr be AES_BLOCK_SIZE formating and add support for sha256 copy/gethash sanity checks on arguments cast return values and valgrind tests make it easier to use sha256 with af_alg remove hard tabs add endif for after rebase
2018-07-18 17:26:25 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_HASH"
fi
af_alg sha3 addition hardware acceleration with RSA add AES-GCM hardware acceleration refactor setting RSA IV flag check and set AF_ALG flags fix for default AF_ALG use set buffer alignment with Xilinx RSA macro guard after rebase use ALIGN64 clean up test cases
2018-08-24 10:24:53 -06:00
if test "$ENABLED_AFALG" = "xilinx"
make build more modular
2019-01-18 16:08:23 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_XILINX -DWOLFSSL_AFALG_XILINX_AES"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_XILINX_SHA3 -DWOLFSSL_AFALG_XILINX_RSA"
Sync SHAKE256 default (disabled) with parent default edDSA448 (disabled) and remove WOLFSSL_NO_SHAKE256 flag
2021-06-01 11:38:17 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA3_224 -DWOLFSSL_NOSHA3_256 -DWOLFSSL_NOSHA3_512"
make build more modular
2019-01-18 16:08:23 -07:00
ENABLED_AFALG="yes"
ENABLED_XILINX="yes"
fi
if test "$ENABLED_AFALG" = "xilinx-aes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_XILINX -DWOLFSSL_AFALG_XILINX_AES"
ENABLED_AFALG="yes"
ENABLED_XILINX="yes"
fi
if test "$ENABLED_AFALG" = "xilinx-sha3"
af_alg sha3 addition hardware acceleration with RSA add AES-GCM hardware acceleration refactor setting RSA IV flag check and set AF_ALG flags fix for default AF_ALG use set buffer alignment with Xilinx RSA macro guard after rebase use ALIGN64 clean up test cases
2018-08-24 10:24:53 -06:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_XILINX"
make build more modular
2019-01-18 16:08:23 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_XILINX_SHA3"
Sync SHAKE256 default (disabled) with parent default edDSA448 (disabled) and remove WOLFSSL_NO_SHAKE256 flag
2021-06-01 11:38:17 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA3_224 -DWOLFSSL_NOSHA3_256 -DWOLFSSL_NOSHA3_512"
af_alg sha3 addition hardware acceleration with RSA add AES-GCM hardware acceleration refactor setting RSA IV flag check and set AF_ALG flags fix for default AF_ALG use set buffer alignment with Xilinx RSA macro guard after rebase use ALIGN64 clean up test cases
2018-08-24 10:24:53 -06:00
ENABLED_AFALG="yes"
ENABLED_XILINX="yes"
fi
make build more modular
2019-01-18 16:08:23 -07:00
if test "$ENABLED_AFALG" = "xilinx-rsa"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_XILINX"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_XILINX_RSA"
ENABLED_AFALG="yes"
ENABLED_XILINX="yes"
fi
inital AES-CBC with af_alg progress on AES-GCM with AF_ALG and add SHA256 add aes-gcm test cases and finish logic of aes-gcm with AF_ALG formating of tabs and white space add files to dist adding ecb and ctr mode with af_alg make length of buffers for ctr be AES_BLOCK_SIZE formating and add support for sha256 copy/gethash sanity checks on arguments cast return values and valgrind tests make it easier to use sha256 with af_alg remove hard tabs add endif for after rebase
2018-07-18 17:26:25 -06:00
KCAPI: add support for using libkcapi for crypto (Linux Kernel) RSA, DH and ECC not testable as no Linux Kernel driver to use. ECC implementation is customer specific.
2021-08-19 11:25:59 +10:00
# libkcapi
AC_ARG_ENABLE([kcapi-hash],
[AS_HELP_STRING([--enable-kcapi-hash],[Enable libkcapi use for hashing (default: disabled)])],
[ ENABLED_KCAPI_HASH=$enableval ],
[ ENABLED_KCAPI_HASH=no ]
)
AC_ARG_ENABLE([kcapi-hmac],
[AS_HELP_STRING([--enable-kcapi-hmac],[Enable libkcapi use for HMAC (default: disabled)])],
configure.ac: in fips v5 setup, consider HAVE_AES{CCM,CTR,GCM,OFB}_PORT when auto-setting -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB; refactor KCAPI options for readability and correctness.
2021-12-16 17:03:01 -06:00
[ ENABLED_KCAPI_HMAC=$enableval ],
[ ENABLED_KCAPI_HMAC=no ]
KCAPI: add support for using libkcapi for crypto (Linux Kernel) RSA, DH and ECC not testable as no Linux Kernel driver to use. ECC implementation is customer specific.
2021-08-19 11:25:59 +10:00
)
AC_ARG_ENABLE([kcapi-aes],
[AS_HELP_STRING([--enable-kcapi-aes],[Enable libkcapi use for AES (default: disabled)])],
[ ENABLED_KCAPI_AES=$enableval ],
[ ENABLED_KCAPI_AES=no ]
)
AC_ARG_ENABLE([kcapi-rsa],
[AS_HELP_STRING([--enable-kcapi-rsa],[Enable libkcapi use for RSA (default: disabled)])],
[ ENABLED_KCAPI_RSA=$enableval ],
[ ENABLED_KCAPI_RSA=no ]
)
AC_ARG_ENABLE([kcapi-dh],
[AS_HELP_STRING([--enable-kcapi-dh],[Enable libkcapi use for DH (default: disabled)])],
[ ENABLED_KCAPI_DH=$enableval ],
[ ENABLED_KCAPI_DH=no ]
)
AC_ARG_ENABLE([kcapi-ecc],
[AS_HELP_STRING([--enable-kcapi-ecc],[Enable libkcapi use for ECC (default: disabled)])],
[ ENABLED_KCAPI_ECC=$enableval ],
[ ENABLED_KCAPI_ECC=no ]
)
configure.ac: in fips v5 setup, consider HAVE_AES{CCM,CTR,GCM,OFB}_PORT when auto-setting -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB; refactor KCAPI options for readability and correctness.
2021-12-16 17:03:01 -06:00
AC_ARG_ENABLE([kcapi],
[AS_HELP_STRING([--enable-kcapi],[Enable libkcapi use for crypto (default: disabled)])],
[ ENABLED_KCAPI=$enableval ],
[ ENABLED_KCAPI=no ]
)
if test "$ENABLED_KCAPI" = "yes"
then
AS_IF([test "$enable_kcapi_hash" != "no"], [ENABLED_KCAPI_HASH=yes])
AS_IF([test "$enable_kcapi_hmac" != "no"], [ENABLED_KCAPI_HMAC=yes])
AS_IF([test "$enable_kcapi_aes" != "no"], [ENABLED_KCAPI_AES=yes])
For KCAPI do not force enable ECC curves, set K or seed callback, disable AES GCM tests with non standard IV.
2022-03-17 14:41:35 -07:00
AS_IF([test "$enable_kcapi_rsa" != "no"], [ENABLED_KCAPI_RSA=yes])
AS_IF([test "$enable_kcapi_dh" != "no"], [ENABLED_KCAPI_DH=yes])
AS_IF([test "$enable_kcapi_ecc" != "no"], [ENABLED_KCAPI_ECC=yes])
configure.ac: in fips v5 setup, consider HAVE_AES{CCM,CTR,GCM,OFB}_PORT when auto-setting -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB; refactor KCAPI options for readability and correctness.
2021-12-16 17:03:01 -06:00
fi
For KCAPI do not force enable ECC curves, set K or seed callback, disable AES GCM tests with non standard IV.
2022-03-17 14:41:35 -07:00
if test "$ENABLED_KCAPI_HASH" != "no" ||
test "$ENABLED_KCAPI_HMAC" != "no" ||
test "$ENABLED_KCAPI_AES" != "no" ||
test "$ENABLED_KCAPI_RSA" != "no" ||
test "$ENABLED_KCAPI_DH" != "no" ||
test "$ENABLED_KCAPI_ECC" != "no"
then
LIBS="$LIBS -lkcapi"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KCAPI"
fi
configure.ac: in fips v5 setup, consider HAVE_AES{CCM,CTR,GCM,OFB}_PORT when auto-setting -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB; refactor KCAPI options for readability and correctness.
2021-12-16 17:03:01 -06:00
if test "$ENABLED_KCAPI_HASH" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KCAPI_HASH -DWOLFSSL_KCAPI_HASH_KEEP"
# Linux Kernel doesn't support truncated SHA512 algorithms
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
fi
if test "$ENABLED_KCAPI_HMAC" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KCAPI_HMAC"
fi
if test "$ENABLED_KCAPI_AES" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KCAPI_AES"
HAVE_AESGCM_PORT=yes
if test "$ENABLED_AESCCM" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
fi
fi
if test "$ENABLED_KCAPI_RSA" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KCAPI_RSA"
fi
if test "$ENABLED_KCAPI_DH" = "yes"
then
Fixes for KCAPI ECDH/DH and page alignment. ZD 13763
2022-03-04 15:03:58 -08:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KCAPI_DH -DWOLFSSL_DH_EXTRA"
configure.ac: in fips v5 setup, consider HAVE_AES{CCM,CTR,GCM,OFB}_PORT when auto-setting -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB; refactor KCAPI options for readability and correctness.
2021-12-16 17:03:01 -06:00
fi
KCAPI: add support for using libkcapi for crypto (Linux Kernel) RSA, DH and ECC not testable as no Linux Kernel driver to use. ECC implementation is customer specific.
2021-08-19 11:25:59 +10:00
if test "$ENABLED_KCAPI_ECC" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KCAPI_ECC"
fi
crypto only sha256 cryptodev formating and refactoring update configure for devcrypto add AES algorithms to cyrptodev port increase structure size for compatibility AES with cryptodev add wc_devcrypto.h to install path
2018-08-17 09:46:16 -06:00
# Support for Linux dev/crypto calls
AC_ARG_ENABLE([devcrypto],
[AS_HELP_STRING([--enable-devcrypto],[Enable Linux dev crypto calls: all | aes (all aes support) | hash (all hash algos) | cbc (aes-cbc only) (default: disabled)])],
[ ENABLED_DEVCRYPTO=$enableval ],
[ ENABLED_DEVCRYPTO=no ]
)
if test "$ENABLED_DEVCRYPTO" = "yes" || test "$ENABLED_DEVCRYPTO" = "all"
then
#enable all devcrypto supported algorithms
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_CBC"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_AES"
build with devcrypto and aesccm
2019-08-13 14:12:45 -06:00
if test "$ENABLED_AESCCM" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
fi
crypto only sha256 cryptodev formating and refactoring update configure for devcrypto add AES algorithms to cyrptodev port increase structure size for compatibility AES with cryptodev add wc_devcrypto.h to install path
2018-08-17 09:46:16 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_HASH"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_HASH_RAW"
ENABLED_DEVCRYPTO=yes
fi
if test "$ENABLED_DEVCRYPTO" = "aes"
then
#enable only AES-CBC algorithm support
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_AES"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_CBC"
build with devcrypto and aesccm
2019-08-13 14:12:45 -06:00
if test "$ENABLED_AESCCM" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
fi
crypto only sha256 cryptodev formating and refactoring update configure for devcrypto add AES algorithms to cyrptodev port increase structure size for compatibility AES with cryptodev add wc_devcrypto.h to install path
2018-08-17 09:46:16 -06:00
ENABLED_DEVCRYPTO=yes
fi
if test "$ENABLED_DEVCRYPTO" = "cbc"
then
#enable only AES-CBC algorithm support
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_CBC"
ENABLED_DEVCRYPTO=yes
fi
if test "$ENABLED_DEVCRYPTO" = "hash"
then
#enable only hash algorithm support
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_HASH"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_HASH_RAW"
ENABLED_DEVCRYPTO=yes
fi
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
if test "$ENABLED_DEVCRYPTO" = "hmac"
then
#enable only hmac algorithm support
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_HMAC"
ENABLED_DEVCRYPTO=yes
fi
if test "$ENABLED_DEVCRYPTO" = "rsa"
then
#enable only rsa algorithm support
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_RSA"
ENABLED_DEVCRYPTO=yes
fi
if test "$ENABLED_DEVCRYPTO" = "seco"
then
#enable support of devcrypto for algos not supported with seco
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_HMAC"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_RSA"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_CURVE25519"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_ECDSA"
ENABLED_DEVCRYPTO=yes
fi
crypto only sha256 cryptodev formating and refactoring update configure for devcrypto add AES algorithms to cyrptodev port increase structure size for compatibility AES with cryptodev add wc_devcrypto.h to install path
2018-08-17 09:46:16 -06:00
added stubs, tests, and benchmark for Camellia to ctaocrypt
2013-01-17 21:52:31 -08:00
# Camellia
AC_ARG_ENABLE([camellia],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-camellia],[Enable wolfSSL Camellia support (default: disabled)])],
added stubs, tests, and benchmark for Camellia to ctaocrypt
2013-01-17 21:52:31 -08:00
[ ENABLED_CAMELLIA=$enableval ],
[ ENABLED_CAMELLIA=no ]
)
if test "$ENABLED_CAMELLIA" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_CAMELLIA"
fi
add md2 signature hash support
2012-07-27 14:01:02 -07:00
# MD2
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([md2],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-md2],[Enable wolfSSL MD2 support (default: disabled)])],
add md2 signature hash support
2012-07-27 14:01:02 -07:00
[ ENABLED_MD2=$enableval ],
[ ENABLED_MD2=no ]
)
if test "$ENABLED_BUMP" = "yes"
then
ENABLED_MD2="yes"
fi
if test "$ENABLED_MD2" = "yes"
then
configure.ac updates
2014-12-31 13:04:03 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_MD2"
add md2 signature hash support
2012-07-27 14:01:02 -07:00
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# NULL CIPHER
add --enable-null
2013-03-12 18:49:59 -07:00
AC_ARG_ENABLE([nullcipher],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-nullcipher],[Enable wolfSSL NULL cipher support (default: disabled)])],
add --enable-null
2013-03-12 18:49:59 -07:00
[ ENABLED_NULL_CIPHER=$enableval ],
[ ENABLED_NULL_CIPHER=no ]
)
add openssh ./configure build
2015-07-17 09:14:58 -07:00
if test "$ENABLED_OPENSSH" = "yes"
then
ENABLED_NULL_CIPHER="yes"
fi
add --enable-null
2013-03-12 18:49:59 -07:00
if test "$ENABLED_NULL_CIPHER" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_NULL_CIPHER"
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
# RIPEMD
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([ripemd],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-ripemd],[Enable wolfSSL RIPEMD-160 support (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_RIPEMD=$enableval ],
[ ENABLED_RIPEMD=no ]
)
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
if test "$ENABLED_OPENSSH" = "yes" && test "x$ENABLED_FIPS" = "xno"
add openssh ./configure build
2015-07-17 09:14:58 -07:00
then
ENABLED_RIPEMD="yes"
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
if test "$ENABLED_RIPEMD" = "yes"
then
close to build test with --disable-examples option
2014-12-18 15:40:09 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_RIPEMD"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
init blake2
2012-12-31 13:10:47 -08:00
# BLAKE2
AC_ARG_ENABLE([blake2],
Adds Blake2s support (--enable-blake2s), which provides 32-bit Blake2 support.
2019-05-23 21:47:42 -06:00
[AS_HELP_STRING([--enable-blake2],[Enable wolfSSL BLAKE2b support (default: disabled)])],
init blake2
2012-12-31 13:10:47 -08:00
[ ENABLED_BLAKE2=$enableval ],
[ ENABLED_BLAKE2=no ]
)
if test "$ENABLED_BLAKE2" = "yes"
then
Adds Blake2s support (--enable-blake2s), which provides 32-bit Blake2 support.
2019-05-23 21:47:42 -06:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_BLAKE2 -DHAVE_BLAKE2B"
init blake2
2012-12-31 13:10:47 -08:00
fi
Adds Blake2s support (--enable-blake2s), which provides 32-bit Blake2 support.
2019-05-23 21:47:42 -06:00
AC_ARG_ENABLE([blake2s],
[AS_HELP_STRING([--enable-blake2s],[Enable wolfSSL BLAKE2s support (default: disabled)])],
[ ENABLED_BLAKE2S=$enableval ],
misc fixes for coverage and buildability: add MD2 to --enable-all*; fix spelling of "Sno" to "no" for $ENABLED_BLAKE2S default; when ENABLED_QSH add -DWOLFSSL_STATIC_DH -DWOLFSSL_STATIC_PSK (relates to ZD11073); add missing gating for !defined(WOLFSSL_DEVCRYPTO) in api.c:test_wc_Sha256FinalRaw(); fix tests/api.c:IsValidCipherSuite() to build under gcc10 (relates to ZD11073).
2020-10-15 15:05:29 -05:00
[ ENABLED_BLAKE2S=no ]
Adds Blake2s support (--enable-blake2s), which provides 32-bit Blake2 support.
2019-05-23 21:47:42 -06:00
)
if test "$ENABLED_BLAKE2S" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_BLAKE2S"
ENABLED_BLAKE2="yes"
fi
init blake2
2012-12-31 13:10:47 -08:00
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
# set sha224 default
SHA224_DEFAULT=no
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" || test "$host_cpu" = "amd64"
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
then
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
if test "x$ENABLED_AFALG" = "xno" && test "x$ENABLED_DEVCRYPTO" = "xno" &&
( test "x$ENABLED_FIPS" = "xno" ||
( test "$HAVE_FIPS_VERSION" = 2 && test "$HAVE_FIPS_VERSION_MINOR" != 1 ) )
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
then
SHA224_DEFAULT=yes
fi
fi
# SHA224
AC_ARG_ENABLE([sha224],
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
[AS_HELP_STRING([--enable-sha224],[Enable wolfSSL SHA-224 support (default: enabled on x86_64/amd64/aarch64)])],
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
[ ENABLED_SHA224=$enableval ],
[ ENABLED_SHA224=$SHA224_DEFAULT ]
)
if test "$ENABLED_SHA224" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224"
fi
# set sha3 default
SHA3_DEFAULT=no
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if (test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" || test "$host_cpu" = "amd64") && test "$ENABLED_32BIT" = "no"
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
then
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
if test "x$ENABLED_FIPS" = "xno" || test "$HAVE_FIPS_VERSION" -ge 2
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
then
SHA3_DEFAULT=yes
fi
fi
# SHA3
AC_ARG_ENABLE([sha3],
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
[AS_HELP_STRING([--enable-sha3],[Enable wolfSSL SHA-3 support (default: enabled on x86_64/amd64/aarch64)])],
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
[ ENABLED_SHA3=$enableval ],
[ ENABLED_SHA3=$SHA3_DEFAULT ]
)
if test "$ENABLED_SHA3" = "small"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA3_SMALL"
fi
SHA-3 improvements Add x86_64 assembly code: - BMI2 - AVX2 (using ymm, slower than BMI2) - AVX2 of 4 similtaneous hashes Add SHAKE128 functions and tests. Add Absorb and Squeeze functions for SHAKE128 and SHAK256 and tests. Add doxygen for SHA-3 and SHAKE functions. Update other generated x86_64 assembly files to include settings.h.
2022-09-01 15:07:15 +10:00
# SHAKE128
AC_ARG_ENABLE([shake128],
[AS_HELP_STRING([--enable-shake128],[Enable wolfSSL SHAKE128 support (default: disabled)])],
[ ENABLED_SHAKE128=$enableval ],
[ ENABLED_SHAKE128=no ]
)
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
# SHAKE256
AC_ARG_ENABLE([shake256],
Sync SHAKE256 default (disabled) with parent default edDSA448 (disabled) and remove WOLFSSL_NO_SHAKE256 flag
2021-06-01 11:38:17 -06:00
[AS_HELP_STRING([--enable-shake256],[Enable wolfSSL SHAKE256 support (default: disabled)])],
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
[ ENABLED_SHAKE256=$enableval ],
ED25119 and SHAKE-256: fixes SHAKE-256 is off by default now. Make sure WOLFSSL_SHAKE256 doesn't make it into options.h. Fix openssl.test usage of ed25519 certificates. Add scripts that regenerate certificates
2021-06-11 10:01:05 +10:00
[ ENABLED_SHAKE256=no ]
configure: ED448 to enable SHA3 and SHAKE256 properly SHA3 and SHAKE256 are required for ED448, but were potentially overwritten after being set when ED448, specifically others than x86_64/aarch64
2021-02-18 15:38:11 -08:00
)
1.8.8 init
2011-02-05 11:14:47 -08:00
# SHA512
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([sha512],
Enable ECC for all platforms by default. For aarch64 enable SHA512, SHA224, SHA3 and FastMath by default.
2018-03-07 09:41:07 -08:00
[AS_HELP_STRING([--enable-sha512],[Enable wolfSSL SHA-512 support (default: enabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_SHA512=$enableval ],
Enable ECC for all platforms by default. For aarch64 enable SHA512, SHA224, SHA3 and FastMath by default.
2018-03-07 09:41:07 -08:00
[ ENABLED_SHA512=yes ]
1.8.8 init
2011-02-05 11:14:47 -08:00
)
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
# options that don't require sha512
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes" || test "$ENABLED_32BIT" = "yes" || test "$ENABLED_16BIT" = "yes"
fix leanpsk w/ new defaults
2015-03-31 15:55:39 -07:00
then
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
ENABLED_SHA512="no"
fix leanpsk w/ new defaults
2015-03-31 15:55:39 -07:00
fi
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
# options that require sha512
if test "$ENABLED_OPENSSH" = "yes" || test "$ENABLED_WPAS" = "yes" || test "$ENABLED_FORTRESS" = "yes"
add openssh ./configure build
2015-07-17 09:14:58 -07:00
then
ENABLED_SHA512="yes"
Allow SHA384 to be compiled in without SHA512
2018-07-20 09:42:01 +10:00
ENABLED_SHA384="yes"
add openssh ./configure build
2015-07-17 09:14:58 -07:00
fi
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "$ENABLED_SHA512" = "yes"
1.8.8 init
2011-02-05 11:14:47 -08:00
then
Allow SHA384 to be compiled in without SHA512
2018-07-20 09:42:01 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
Allow SHA384 to be compiled in without SHA512
2018-07-20 09:42:01 +10:00
# SHA384
AC_ARG_ENABLE([sha384],
[AS_HELP_STRING([--enable-sha384],[Enable wolfSSL SHA-384 support (default: enabled)])],
[ ENABLED_SHA384=$enableval ],
[ ENABLED_SHA384=yes ]
)
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
# options that don't require sha384
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes" || test "$ENABLED_32BIT" = "yes" || test "$ENABLED_16BIT" = "yes"
Allow SHA384 to be compiled in without SHA512
2018-07-20 09:42:01 +10:00
then
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
ENABLED_SHA384="no"
Allow SHA384 to be compiled in without SHA512
2018-07-20 09:42:01 +10:00
fi
# options that require sha384
if test "$ENABLED_OPENSSH" = "yes" || test "$ENABLED_WPAS" = "yes" || test "$ENABLED_FORTRESS" = "yes"
then
ENABLED_SHA384="yes"
fi
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "$ENABLED_SHA384" = "yes"
Allow SHA384 to be compiled in without SHA512
2018-07-20 09:42:01 +10:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA384"
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
# SESSION CERTS
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([sessioncerts],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-sessioncerts],[Enable session cert storing (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_SESSIONCERTS=$enableval ],
[ ENABLED_SESSIONCERTS=no ]
)
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
if test "x$ENABLED_NGINX" = "xyes" || test "x$ENABLED_OPENVPN" = "xyes" || \
test "x$ENABLED_LIGHTY" = "xyes" || test "x$ENABLED_NETSNMP" = "xyes" || \
test "x$ENABLED_STRONGSWAN" = "xyes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
then
ENABLED_SESSIONCERTS=yes
fi
Add TLS v1.3 as an option
2016-11-24 01:31:07 +10:00
if test "$ENABLED_TLS13" = "yes" && test "$ENABLED_PSK" = "yes"
then
ENABLED_SESSIONCERTS=yes
fi
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
1.8.8 init
2011-02-05 11:14:47 -08:00
if test "$ENABLED_SESSIONCERTS" = "yes"
then
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AM_CFLAGS="$AM_CFLAGS -DSESSION_CERTS"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
# KEY GENERATION
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([keygen],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-keygen],[Enable key generation (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_KEYGEN=$enableval ],
[ ENABLED_KEYGEN=no ]
)
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
if test "$ENABLED_BIND" = "yes" || test "$ENABLED_NTP" = "yes" || \
test "$ENABLED_LIBSSH2" = "yes" || test "$ENABLED_OPENRESTY" = "yes" || \
test "$ENABLED_NGINX" = "yes" || test "$ENABLED_WOLFENGINE" = "yes" || \
test "$ENABLED_STRONGSWAN" = "yes"
Bind 9.17.9 Support - Add `--enable-bind` configuration option - New compatibility API: - `RSA_get0_crt_params` - `RSA_set0_crt_params` - `RSA_get0_factors` - `RSA_set0_factors` - `RSA_test_flags` - `HMAC_CTX_get_md` - `EVP_MD_block_size` - `EC_KEY_check_key` - `o2i_ECPublicKey` - `DH_get0_key` - `DH_set0_key` - Calling `EVP_MD_CTX_cleanup` on an uninitialized `EVP_MD_CTX` structure is no longer an error - `DH_generate_parameters` and `DH_generate_parameters_ex` has been implemented
2021-05-21 16:56:36 +02:00
then
ENABLED_KEYGEN=yes
configure.ac: refactor setup for --enable-reproducible-build; remove mutex between --enable-sp-math and --enable-sp-math-all (they can now coexist); whitespace cleanup.
2021-11-05 18:18:53 -05:00
fi
Bind 9.17.9 Support - Add `--enable-bind` configuration option - New compatibility API: - `RSA_get0_crt_params` - `RSA_set0_crt_params` - `RSA_get0_factors` - `RSA_set0_factors` - `RSA_test_flags` - `HMAC_CTX_get_md` - `EVP_MD_block_size` - `EC_KEY_check_key` - `o2i_ECPublicKey` - `DH_get0_key` - `DH_set0_key` - Calling `EVP_MD_CTX_cleanup` on an uninitialized `EVP_MD_CTX` structure is no longer an error - `DH_generate_parameters` and `DH_generate_parameters_ex` has been implemented
2021-05-21 16:56:36 +02:00
1.8.8 init
2011-02-05 11:14:47 -08:00
# CERT GENERATION
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([certgen],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-certgen],[Enable cert generation (default: disabled)])],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ ENABLED_CERTGEN=$enableval ],
[ ENABLED_CERTGEN=no ]
)
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
if test "$ENABLED_OPENVPN" = "yes" || test "$ENABLED_OPENSSH" = "yes" || \
test "$ENABLED_BIND" = "yes" || test "$ENABLED_NTP" = "yes" || \
Enhance OpenLDAP support. - Add --enable-openldap to configure.ac - Fix some issues around subject alt names and the WOLFSSL_GENERAL_NAME struct.
2022-06-25 16:14:35 +04:00
test "$ENABLED_CHRONY" = "yes" || test "$ENABLED_STRONGSWAN" = "yes" || \
test "$ENABLED_OPENLDAP" = "yes"
Add --enable-openvpn build option
2020-01-28 15:29:24 +01:00
then
ENABLED_CERTGEN=yes
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
Added enable-certgen to configure.ac.
2014-01-10 11:50:55 -08:00
# CERT REQUEST GENERATION
AC_ARG_ENABLE([certreq],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-certreq],[Enable cert request generation (default: disabled)])],
Added enable-certgen to configure.ac.
2014-01-10 11:50:55 -08:00
[ ENABLED_CERTREQ=$enableval ],
[ ENABLED_CERTREQ=no ]
)
Support for new DPP in wpa_supplicant - Add null check to asn template code in MakeCertReq and test - ENABLED_ECCCUSTCURVES can also be "all"
2022-06-10 18:13:39 +02:00
if test "$ENABLED_WPAS_DPP" = "yes"
then
ENABLED_CERTREQ="yes"
fi
Added enable-certgen to configure.ac.
2014-01-10 11:50:55 -08:00
Add support for : - PEM public key loading - set/get KeyUsage in CSR and X.509 - set/get SKID in CSR and X.509 - set/get AKID in X.509 - set/get two Certificate Policies OID in X.509
2015-09-07 09:51:21 +02:00
# CERT REQUEST EXTENSION
AC_ARG_ENABLE([certext],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-certext],[Enable cert request extensions (default: disabled)])],
Add support for : - PEM public key loading - set/get KeyUsage in CSR and X.509 - set/get SKID in CSR and X.509 - set/get AKID in X.509 - set/get two Certificate Policies OID in X.509
2015-09-07 09:51:21 +02:00
[ ENABLED_CERTEXT=$enableval ],
[ ENABLED_CERTEXT=no ]
)
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
if test "$ENABLED_OPENVPN" = "yes" || test "$ENABLED_STRONGSWAN" = "yes"
Add --enable-openvpn build option
2020-01-28 15:29:24 +01:00
then
ENABLED_CERTEXT=yes
fi
Add support for : - PEM public key loading - set/get KeyUsage in CSR and X.509 - set/get SKID in CSR and X.509 - set/get AKID in X.509 - set/get two Certificate Policies OID in X.509
2015-09-07 09:51:21 +02:00
Decoded cert cache feature
2019-02-28 15:07:38 -06:00
# DECODED CERT CACHE
AC_ARG_ENABLE([certgencache],
[AS_HELP_STRING([--enable-certgencache],[Enable decoded cert caching (default: disabled)])],
[ ENABLED_certgencache=$enableval ],
[ ENABLED_certgencache=no ]
)
if test "$ENABLED_certgencache" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN_CACHE"
fi
SEP Extensions 1. Added configure option to enable SEP extensions. 2. Enabled KEEP_PEER_CERT for the SEP configuration. 3. Copy the Certificate Policy extension into the cert as the device type. 4. Copy an other type Alt Name extension into the cert as the hwType and hwSerialNumber, if the alt name has a hardwareModuleName OID.
2013-06-25 16:26:53 -07:00
# SEP
AC_ARG_ENABLE([sep],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-sep],[Enable sep extensions (default: disabled)])],
SEP Extensions 1. Added configure option to enable SEP extensions. 2. Enabled KEEP_PEER_CERT for the SEP configuration. 3. Copy the Certificate Policy extension into the cert as the device type. 4. Copy an other type Alt Name extension into the cert as the hwType and hwSerialNumber, if the alt name has a hardwareModuleName OID.
2013-06-25 16:26:53 -07:00
[ ENABLED_SEP=$enableval ],
[ ENABLED_SEP=no ]
)
if test "$ENABLED_SEP" = "yes"
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SEP -DKEEP_PEER_CERT"
SEP Extensions 1. Added configure option to enable SEP extensions. 2. Enabled KEEP_PEER_CERT for the SEP configuration. 3. Copy the Certificate Policy extension into the cert as the device type. 4. Copy an other type Alt Name extension into the cert as the hwType and hwSerialNumber, if the alt name has a hardwareModuleName OID.
2013-06-25 16:26:53 -07:00
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# HKDF
add HMAC-KDF
2013-10-31 18:03:00 -07:00
AC_ARG_ENABLE([hkdf],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-hkdf],[Enable HKDF (HMAC-KDF) support (default: disabled)])],
add HMAC-KDF
2013-10-31 18:03:00 -07:00
[ ENABLED_HKDF=$enableval ],
[ ENABLED_HKDF=no ]
)
Add TLS v1.3 as an option
2016-11-24 01:31:07 +10:00
if test "$ENABLED_TLS13" = "yes"
then
ENABLED_HKDF="yes"
fi
add HMAC-KDF
2013-10-31 18:03:00 -07:00
if test "$ENABLED_HKDF" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_HKDF"
fi
add ANSI-X9.63-KDF support [SEC1]
2016-12-07 20:09:54 -07:00
# X9.63 KDF
AC_ARG_ENABLE([x963kdf],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-x963kdf],[Enable X9.63 KDF support (default: disabled)])],
add ANSI-X9.63-KDF support [SEC1]
2016-12-07 20:09:54 -07:00
[ ENABLED_X963KDF=$enableval ],
[ ENABLED_X963KDF=no ]
)
Make the code simpler.
2022-02-04 16:05:58 -05:00
if test "$ENABLED_X963KDF" = "yes" || test "$ENABLED_WOLFENGINE" = "yes"
add ANSI-X9.63-KDF support [SEC1]
2016-12-07 20:09:54 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_X963_KDF"
fi
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
# DSA
AC_ARG_ENABLE([dsa],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-dsa],[Enable DSA (default: disabled)])],
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
[ ENABLED_DSA=$enableval ],
[ ENABLED_DSA=no ]
)
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
if (test "$ENABLED_OPENSSH" = "yes" && test "x$ENABLED_FIPS" = "xno") || test "$ENABLED_OPENVPN" = "yes" || test "$ENABLED_NGINX" = "yes" || test "$ENABLED_WPAS" = "yes" || test "$ENABLED_QT" = "yes" || test "$ENABLED_BIND" = "yes" || test "$ENABLED_LIBSSH2" = "yes" || test "$ENABLED_NTP" = "yes"
add openssh ./configure build
2015-07-17 09:14:58 -07:00
then
ENABLED_DSA="yes"
fi
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
if test "$ENABLED_DSA" = "no"
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_DSA"
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
else
ENABLED_CERTS=yes
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
fi
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
# ECC Shamir
Fixed typo with new "eccshamir" configure option.
2016-05-05 12:24:08 -07:00
AC_ARG_ENABLE([eccshamir],
Enable ECC for all platforms by default. For aarch64 enable SHA512, SHA224, SHA3 and FastMath by default.
2018-03-07 09:41:07 -08:00
[AS_HELP_STRING([--enable-eccshamir],[Enable ECC Shamir (default: enabled)])],
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
[ ENABLED_ECC_SHAMIR=$enableval ],
Enable ECC for all platforms by default. For aarch64 enable SHA512, SHA224, SHA3 and FastMath by default.
2018-03-07 09:41:07 -08:00
[ ENABLED_ECC_SHAMIR=yes ]
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
)
on x86_64 enable sha512, ecc, and increase max_bits by default
2015-03-31 13:28:49 -07:00
# ECC
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
AC_ARG_ENABLE([ecc],
Enable ECC for all platforms by default. For aarch64 enable SHA512, SHA224, SHA3 and FastMath by default.
2018-03-07 09:41:07 -08:00
[AS_HELP_STRING([--enable-ecc],[Enable ECC (default: enabled)])],
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
[ ENABLED_ECC=$enableval ],
Enable ECC for all platforms by default. For aarch64 enable SHA512, SHA224, SHA3 and FastMath by default.
2018-03-07 09:41:07 -08:00
[ ENABLED_ECC=yes ]
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
)
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# lean psk doesn't need ecc
fix leanpsk default changes
2015-04-01 09:37:41 -07:00
if test "$ENABLED_LEANPSK" = "yes"
fix leanpsk w/ new defaults
2015-03-31 15:55:39 -07:00
then
ENABLED_ECC=no
fi
Modification for compliling application with libsignal-protocol-c.
2017-11-13 18:12:18 +09:00
if test "$ENABLED_OPENSSH" = "yes" || test "$ENABLED_NGINX" = "yes" || test "$ENABLED_SIGNAL" = "yes"
add openssh ./configure build
2015-07-17 09:14:58 -07:00
then
ENABLED_ECC="yes"
fi
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
if test "$ENABLED_ECC" != "no"
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
then
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
Various improvements for testing Fix wc_ecc_fp_free() to be called when using HAVE_STACK_SIZE. Increase size of replyin client.c so all HTTP reply is displayed. Fix api.c to support only Ed25519 (not RSA and ECC) Fix suites.c to detect when CA for client won't work (Ed25519 only) For Static Memory add debugging and small profile. Also allow realloc to be called with NULL. Add more Ed25519 certs and keys. Fix names of Ed25519 filenames for client and server. Do NOT turn on ECC_SHAMIR by default with lowresource. Enable WOLFSSL_STATIC_MEMORY_SMALL if low resource and no RSA.
2019-02-22 17:14:19 +10:00
if test "$ENABLED_ECC_SHAMIR" = "yes" && test "$ENABLED_LOWRESOURCE" = "no"
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"
fi
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
if test "$ENABLED_ECC" = "nonblock"
then
AM_CFLAGS="$AM_CFLAGS -DWC_ECC_NONBLOCK"
fi
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
Memory allocation: fixes from memory usage generation 1. Configuration: If not fast math then don't set ALT_ECC_SIZE when configuring. 2. ECC KeyShare: Key share entry's key was allocated with type DYNAMIC_TYPE_PRIVATE_KEY, free with same type. 3. Ed25519: free the SHA-512 temporary object. WOLFSSL_SMALL_STACK_CACHE builds have dynamicaly allocated data. 4. RSA: Don't keep allocating a new hash object in RsaMGF1 when compiled with WOLFSSL_SMALL_STACK_CACHE.
2021-07-20 16:31:56 +10:00
if test "$ENABLED_LOWRESOURCE" = "yes" && test "$ENABLED_FASTMATH" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DALT_ECC_SIZE"
fi
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
ENABLED_CERTS=yes
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
fi
Enable the TFM speedups when used with `--enable-ecccustcurves=all` and fastmath and x86.
2019-04-10 21:06:17 -07:00
Added ECC API's for using custom curves that are not in the "ecc_sets" list. Added wolfCrypt test to validate/demonstrate custom curve using BRAINPOOL256R1. Exposed "wc_ecc_make_key_ex" and added "wc_ecc_import_x963_ex" / "wc_ecc_import_raw_ex" API's that accept "const ecc_set_type*" for custom curve. Internally use "ECC_CUSTOM_IDX" (-1) to define custom curve is used. Added "--enable-ecccustcurves" option to configure.ac.
2016-06-16 10:09:41 -07:00
# ECC Custom Curves
AC_ARG_ENABLE([ecccustcurves],
[AS_HELP_STRING([--enable-ecccustcurves],[Enable ECC custom curves (default: disabled)])],
[ ENABLED_ECCCUSTCURVES=$enableval ],
[ ENABLED_ECCCUSTCURVES=no ]
)
Support for new DPP in wpa_supplicant - Add null check to asn template code in MakeCertReq and test - ENABLED_ECCCUSTCURVES can also be "all"
2022-06-10 18:13:39 +02:00
if test "$ENABLED_WPAS_DPP" = "yes"
then
ENABLED_ECCCUSTCURVES="all"
fi
Added `--enable-ecccustcurves=all` option.
2019-03-14 09:56:03 -07:00
if test "$ENABLED_ECCCUSTCURVES" != "no"
Added ECC API's for using custom curves that are not in the "ecc_sets" list. Added wolfCrypt test to validate/demonstrate custom curve using BRAINPOOL256R1. Exposed "wc_ecc_make_key_ex" and added "wc_ecc_import_x963_ex" / "wc_ecc_import_raw_ex" API's that accept "const ecc_set_type*" for custom curve. Internally use "ECC_CUSTOM_IDX" (-1) to define custom curve is used. Added "--enable-ecccustcurves" option to configure.ac.
2016-06-16 10:09:41 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CUSTOM_CURVES"
Distro fix to enable SHA224 by default. Was causing Debian build error since SHA224 is enabled by default only for the x86_64 architecture. Updated --enable-distro option to include new features for aeskeywrap, x963kdf and scrypt. Changed the ECC custom curve option to enable all curve types when used with distro.
2017-04-10 11:45:26 -07:00
Enable the TFM speedups when used with `--enable-ecccustcurves=all` and fastmath and x86.
2019-04-10 21:06:17 -07:00
# For distro, all or ecccustcurves=all builds, enable all curve types
Added `--enable-ecccustcurves=all` option.
2019-03-14 09:56:03 -07:00
if test "$ENABLED_DISTRO" = "yes" || test "$ENABLED_ALL" = "yes" || test "$ENABLED_ECCCUSTCURVES" = "all"
Distro fix to enable SHA224 by default. Was causing Debian build error since SHA224 is enabled by default only for the x86_64 architecture. Updated --enable-distro option to include new features for aeskeywrap, x963kdf and scrypt. Changed the ECC custom curve option to enable all curve types when used with distro.
2017-04-10 11:45:26 -07:00
then
Added `--enable-ecccustcurves=all` option.
2019-03-14 09:56:03 -07:00
# Enable ECC SECPR2, SECPR3, BRAINPOOL and KOBLITZ curves
Distro fix to enable SHA224 by default. Was causing Debian build error since SHA224 is enabled by default only for the x86_64 architecture. Updated --enable-distro option to include new features for aeskeywrap, x963kdf and scrypt. Changed the ECC custom curve option to enable all curve types when used with distro.
2017-04-10 11:45:26 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC_SECPR2 -DHAVE_ECC_SECPR3 -DHAVE_ECC_BRAINPOOL -DHAVE_ECC_KOBLITZ"
Added `--enable-ecccustcurves=all` option.
2019-03-14 09:56:03 -07:00
# Enable ECC Cofactor support
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC_CDH"
Enable the TFM speedups when used with `--enable-ecccustcurves=all` and fastmath and x86.
2019-04-10 21:06:17 -07:00
# If fastmath enabled and on x86 use speedups
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if test "x$ENABLED_FASTMATH" = "xyes" && test "$host_cpu" = "x86_64" -o "$host_cpu" = "amd64"
Enable the TFM speedups when used with `--enable-ecccustcurves=all` and fastmath and x86.
2019-04-10 21:06:17 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DTFM_ECC192 -DTFM_ECC224 -DTFM_ECC256 -DTFM_ECC384 -DTFM_ECC521"
fi
Distro fix to enable SHA224 by default. Was causing Debian build error since SHA224 is enabled by default only for the x86_64 architecture. Updated --enable-distro option to include new features for aeskeywrap, x963kdf and scrypt. Changed the ECC custom curve option to enable all curve types when used with distro.
2017-04-10 11:45:26 -07:00
fi
Added ECC API's for using custom curves that are not in the "ecc_sets" list. Added wolfCrypt test to validate/demonstrate custom curve using BRAINPOOL256R1. Exposed "wc_ecc_make_key_ex" and added "wc_ecc_import_x963_ex" / "wc_ecc_import_raw_ex" API's that accept "const ecc_set_type*" for custom curve. Internally use "ECC_CUSTOM_IDX" (-1) to define custom curve is used. Added "--enable-ecccustcurves" option to configure.ac.
2016-06-16 10:09:41 -07:00
fi
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
Further refactor the minimum ECC key size. Adds `--with-eccminsz=BITS` option. Fix for FIPSv2 which includes 192-bit support. If `WOLFSSL_MIN_ECC_BITS` is defined that will be used.
2020-10-16 17:18:48 -07:00
# ECC Minimum Key Size
Peer review fixes.
2020-10-28 16:43:18 -07:00
ENABLED_ECCMINSZ=224
Further refactor the minimum ECC key size. Adds `--with-eccminsz=BITS` option. Fix for FIPSv2 which includes 192-bit support. If `WOLFSSL_MIN_ECC_BITS` is defined that will be used.
2020-10-16 17:18:48 -07:00
AC_ARG_WITH([eccminsz],
[AS_HELP_STRING([--with-eccminsz=BITS],[Sets the ECC minimum key size (default: 224 bits)])],
[
ENABLED_ECCMINSZ=$withval
AM_CFLAGS="$AM_CFLAGS -DECC_MIN_KEY_SZ=$withval"
]
)
Disable ECC key sizes < 224 bits by default. Added `--enable-eccweakcurves` or `ECC_WEAK_CURVES` to enable smaller key sizes. Currently this option is automatically enabled if `WOLFSSL_MIN_ECC_BITS` is less than 224-bits.
2020-10-16 15:14:02 -07:00
Fixes for compressed keys. Fix to fast math "mp_cnt_lsb" to return proper value, which fixes "mp_jacobi", which fixes "mp_sqrtmod_prime", which fixes compressed keys for 224-bit key. Removed workarounds for compressed keys. Added new configure option "--enable-compkey". Fixed issue with normal math and custom curves where "t2" could be free'd and used. Fixed issue with mp_dump in integer.c, with not allocating correctly sized buffer for toradix.
2016-06-21 14:06:02 -07:00
# Compressed Key
AC_ARG_ENABLE([compkey],
[AS_HELP_STRING([--enable-compkey],[Enable compressed keys support (default: disabled)])],
[ ENABLED_COMPKEY=$enableval ],
[ ENABLED_COMPKEY=no ]
)
Changes for WPA Supplicant
2017-02-10 08:45:10 +10:00
if test "$ENABLED_WPAS" = "yes"
then
ENABLED_COMPKEY=yes
fi
Fixes for compressed keys. Fix to fast math "mp_cnt_lsb" to return proper value, which fixes "mp_jacobi", which fixes "mp_sqrtmod_prime", which fixes compressed keys for 224-bit key. Removed workarounds for compressed keys. Added new configure option "--enable-compkey". Fixed issue with normal math and custom curves where "t2" could be free'd and used. Fixed issue with mp_dump in integer.c, with not allocating correctly sized buffer for toradix.
2016-06-21 14:06:02 -07:00
curve25519 and ed25519 low memory
2015-06-05 15:39:37 -06:00
# for using memory optimization setting on both curve25519 and ed25519
Enhancement to support different sized Curve/Ed math library implementations for FE/GE. Remains backwards compatible with `CURVED25519_SMALL` define. Adds new defines `CURVE25519_SMALL` and `ED25519_SMALL` to allow individual enabling of math library choice (`_low_mem` or `_operations`). Example: `./configure --enable-ed25519=small --enable-curve25519`.
2017-06-16 09:41:10 -07:00
ENABLED_CURVE25519_SMALL=no
ENABLED_ED25519_SMALL=no
curve25519 and ed25519 low memory
2015-06-05 15:39:37 -06:00
rename ecc25519 to curve25519, less confusing with ed25519 now in play too
2015-03-24 11:56:40 -07:00
# CURVE25519
AC_ARG_ENABLE([curve25519],
[AS_HELP_STRING([--enable-curve25519],[Enable Curve25519 (default: disabled)])],
[ ENABLED_CURVE25519=$enableval ],
[ ENABLED_CURVE25519=no ]
added in curve25519 crypto
2015-02-19 10:59:05 -07:00
)
configure.ac: remove enable-quic from enable-all feature set; remove ENABLED_QUIC="yes" from "$ENABLED_CURL" = "yes" setup section; add ENABLED_CURVE25519=yes if $ENABLED_QUIC = yes; tests/unit.c: move QuicTest() and SrpTest() before SuiteTest().
2022-08-17 14:25:38 -05:00
if test "$ENABLED_QUIC" = "yes" && test "$ENABLED_CURVE25519" = "no"
then
ENABLED_CURVE25519=yes
fi
curve25519 and ed25519 low memory
2015-06-05 15:39:37 -06:00
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
if test "$ENABLED_OPENSSH" = "yes" && test "x$ENABLED_FIPS" = "xno"
add support for curve 25519 and Ed25519 in OpenSSH refactor curve25519 and Ed25519 code fix warning in PEM_xxx_mem_xxx functions
2015-08-01 18:28:18 +02:00
then
ENABLED_CURVE25519="yes"
fi
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
if test "$ENABLED_CURVE25519" != "no"
curve25519 and ed25519 low memory
2015-06-05 15:39:37 -06:00
then
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
if test "$ENABLED_CURVE25519" = "small" || test "$ENABLED_LOWRESOURCE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DCURVE25519_SMALL"
ENABLED_CURVE25519_SMALL=yes
ENABLED_CURVE25519=yes
fi
curve25519 and ed25519 low memory
2015-06-05 15:39:37 -06:00
Removes the forced 32-bit instruction (via `-m32`) from `--enable-32bit` option and replaces with comment. Some compilers do not support the `-m32` option, plus to work properly it must be used with configure directly like `./configure CFLAGS="-m32" LDFLAGS="-m32"`. Removes the `NO_64BIT` option to allow building corect on x86_64 and aarch64 (math libs detect platform properly). Fixes #1985.
2018-12-23 15:59:57 -08:00
if test "$ENABLED_CURVE25519" = "no128bit" || test "$ENABLED_32BIT" = "yes"
Add `USE_SLOW_SHA256` and `USE_SLOW_SHA512` options for reduced code size of SHA. Existing `USE_SLOW_SHA2` applies for SHA512 only. Cleanup formatting of the sha256.c and sha512.c code. Added new `./configure --lowresource` option, which defines the memory reduction defines. Fix for `make check` resume.test scipt with `NO_SESSION_CACHE` defined.
2017-11-09 11:05:28 -08:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_CURVED25519_128BIT"
ENABLED_CURVE25519=yes
fi
Fix issue with ARMv8 not performing 128-bit math against constants correctly in debug builds. Fix was to use the `__int128_t` as const for integers. Also added `./configure --enable-curve25519=no128bit` option to force FE to not use the `int128_t` math.
2017-07-14 10:39:30 -07:00
rename ecc25519 to curve25519, less confusing with ed25519 now in play too
2015-03-24 11:56:40 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_CURVE25519"
curve25519 and ed25519 low memory
2015-06-05 15:39:37 -06:00
ENABLED_FEMATH=yes
added in curve25519 crypto
2015-02-19 10:59:05 -07:00
fi
initial ed25519 implementation
2015-03-19 11:40:41 -06:00
# ED25519
AC_ARG_ENABLE([ed25519],
adjust ./configure format, change ed sign/verify to msg from hash
2015-03-19 12:48:32 -07:00
[AS_HELP_STRING([--enable-ed25519],[Enable ED25519 (default: disabled)])],
initial ed25519 implementation
2015-03-19 11:40:41 -06:00
[ ENABLED_ED25519=$enableval ],
[ ENABLED_ED25519=no ]
)
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
AC_ARG_ENABLE([ed25519-stream],
[AS_HELP_STRING([--enable-ed25519-stream],[Enable wolfSSL ED25519 support with streaming verify APIs (default: disabled)])],
[ ENABLED_ED25519_STREAM=$enableval ],
[ ENABLED_ED25519_STREAM=no ]
)
initial ed25519 implementation
2015-03-19 11:40:41 -06:00
fix --enable-openssh FIPS detection syntax in configure.ac
2022-05-18 12:52:07 -06:00
if (test "$ENABLED_OPENSSH" = "yes" && test "x$ENABLED_FIPS" = "xno") || \
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
test "$ENABLED_CHRONY" = "yes"
add support for curve 25519 and Ed25519 in OpenSSH refactor curve25519 and Ed25519 code fix warning in PEM_xxx_mem_xxx functions
2015-08-01 18:28:18 +02:00
then
ENABLED_ED25519="yes"
fi
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
# for using memory optimization setting on both curve448 and ed448
ENABLED_CURVE448_SMALL=no
ENABLED_ED448_SMALL=no
# CURVE448
AC_ARG_ENABLE([curve448],
[AS_HELP_STRING([--enable-curve448],[Enable Curve448 (default: disabled)])],
[ ENABLED_CURVE448=$enableval ],
[ ENABLED_CURVE448=no ]
)
if test "$ENABLED_CURVE448" != "no"
then
if test "$ENABLED_CURVE448" = "small" || test "$ENABLED_LOWRESOURCE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DCURVE448_SMALL"
ENABLED_CURVE448_SMALL=yes
ENABLED_CURVE448=yes
fi
if test "$ENABLED_CURVE448" = "no128bit" || test "$ENABLED_32BIT" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DNO_CURVED448_128BIT"
ENABLED_CURVE448=yes
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_CURVE448"
ENABLED_FE448=yes
fi
# ED448
AC_ARG_ENABLE([ed448],
[AS_HELP_STRING([--enable-ed448],[Enable ED448 (default: disabled)])],
[ ENABLED_ED448=$enableval ],
[ ENABLED_ED448=no ]
)
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
AC_ARG_ENABLE([ed448-stream],
[AS_HELP_STRING([--enable-ed448-stream],[Enable wolfSSL ED448 support with streaming verify APIs (default: disabled)])],
[ ENABLED_ED448_STREAM=$enableval ],
[ ENABLED_ED448_STREAM=no ]
)
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
if test "$ENABLED_ED448" != "no" && test "$ENABLED_32BIT" = "no"
then
if test "$ENABLED_ED448" = "small" || test "$ENABLED_LOWRESOURCE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DED448_SMALL"
ENABLED_ED448_SMALL=yes
ENABLED_CURVE448_SMALL=yes
ENABLED_ED448=yes
fi
if test "$ENABLED_SHA512" = "no"
then
AC_MSG_ERROR([cannot enable ed448 without enabling sha512.])
fi
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
if test "$HAVE_FIPS_VERSION" = 2
Sync SHAKE256 default (disabled) with parent default edDSA448 (disabled) and remove WOLFSSL_NO_SHAKE256 flag
2021-06-01 11:38:17 -06:00
then
Fix typo
2021-06-01 13:30:32 -06:00
AC_MSG_ERROR([cannot enable ed448 w/ dependency shake256 in FIPSv2 mode])
Sync SHAKE256 default (disabled) with parent default edDSA448 (disabled) and remove WOLFSSL_NO_SHAKE256 flag
2021-06-01 11:38:17 -06:00
fi
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
ENABLED_FE448=yes
ENABLED_GE448=yes
AM_CFLAGS="$AM_CFLAGS -DHAVE_ED448"
# EdDSA448 requires SHAKE256 which requires SHA-3
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
if test "$ENABLED_SHA3" = "no"
then
ENABLED_SHA3=yes
fi
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
ENABLED_SHAKE256=yes
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
ENABLED_CERTS=yes
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
fi
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
if test "$ENABLED_ED448_STREAM" != "no"
then
if test "$ENABLED_ED448" = "no"
then
AC_MSG_ERROR([ED448 verify streaming enabled but ED448 is disabled])
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ED448_STREAMING_VERIFY"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_ED448_STREAMING_VERIFY"
fi
fi
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
initial ed25519 implementation
2015-03-19 11:40:41 -06:00
# FP ECC, Fixed Point cache ECC
add fixed point ecc cache, --enable-fpecc, add locking down to crypt level next
2013-09-06 14:24:31 -07:00
AC_ARG_ENABLE([fpecc],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-fpecc],[Enable Fixed Point cache ECC (default: disabled)])],
add fixed point ecc cache, --enable-fpecc, add locking down to crypt level next
2013-09-06 14:24:31 -07:00
[ ENABLED_FPECC=$enableval ],
[ ENABLED_FPECC=no ]
)
if test "$ENABLED_FPECC" = "yes"
then
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
if test "$ENABLED_ECC" = "no"
then
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
AC_MSG_ERROR([cannot enable fpecc without enabling ecc.])
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
fi
add fixed point ecc cache, --enable-fpecc, add locking down to crypt level next
2013-09-06 14:24:31 -07:00
AM_CFLAGS="$AM_CFLAGS -DFP_ECC"
fi
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
# ECC encrypt
AC_ARG_ENABLE([eccencrypt],
ECIES: Google Pay ECIES Generates IV and places it before msg Uses 12 byte IV with AES-CTR Add API to explicitly set KDF salt.
2022-07-01 09:51:24 +10:00
[AS_HELP_STRING([--enable-eccencrypt],[Enable ECC encrypt (default: disabled). yes = SEC1 standard, geniv = Generate IV, iso18033 = ISO 18033 standard, old = original wolfSSL algorithm])],
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
[ ENABLED_ECC_ENCRYPT=$enableval ],
[ ENABLED_ECC_ENCRYPT=no ]
)
ECIES: Support SEC 1 and ISO 18033 Default is SEC 1. To use old ECIES implementation: --enable-eccencrypt=old or define WOLFSSL_ECIES_OLD To use ISO-18033 implememtation: --enable-eccencrypt=iso18033 or define WOLFSSL_ECIES_ISO18033 Support passing NULL for public key into wc_ecc_decrypt(). Support not having public key in privKey passed into wc_ecc_encrypt() - public key is calculated and stored in priKey. Add decrypt KAT test for ECIES.
2021-07-14 15:23:26 +10:00
if test "$ENABLED_ECC_ENCRYPT" != "no"
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
then
if test "$ENABLED_ECC" = "no"
then
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
AC_MSG_ERROR([cannot enable eccencrypt without enabling ecc.])
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
fi
if test "$ENABLED_HKDF" = "no"
then
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
AC_MSG_ERROR([cannot enable eccencrypt without enabling hkdf.])
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC_ENCRYPT"
ECIES: Support SEC 1 and ISO 18033 Default is SEC 1. To use old ECIES implementation: --enable-eccencrypt=old or define WOLFSSL_ECIES_OLD To use ISO-18033 implememtation: --enable-eccencrypt=iso18033 or define WOLFSSL_ECIES_ISO18033 Support passing NULL for public key into wc_ecc_decrypt(). Support not having public key in privKey passed into wc_ecc_encrypt() - public key is calculated and stored in priKey. Add decrypt KAT test for ECIES.
2021-07-14 15:23:26 +10:00
if test "$ENABLED_ECC_ENCRYPT" = "old"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECIES_OLD"
fi
if test "$ENABLED_ECC_ENCRYPT" = "iso18033"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECIES_ISO18033"
fi
ECIES: Google Pay ECIES Generates IV and places it before msg Uses 12 byte IV with AES-CTR Add API to explicitly set KDF salt.
2022-07-01 09:51:24 +10:00
if test "$ENABLED_ECC_ENCRYPT" = "geniv"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECIES_GEN_IV"
fi
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
fi
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
# Elliptic Curve-Based Certificateless Signatures for Identity-Based Encryption (ECCSI)
AC_ARG_ENABLE([eccsi],
[AS_HELP_STRING([--enable-eccsi],[Enable ECCSI (default: disabled)])],
[ ENABLED_ECCSI=$enableval ],
[ ENABLED_ECCSI=no ]
)
if test "x$ENABLED_ECCSI" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_HAVE_ECCSI -DWOLFSSL_PUBLIC_MP"
fi
# Sakai-Kasahara Key Encryption (SAKKE) - pairing based crypto
AC_ARG_ENABLE([sakke],
[AS_HELP_STRING([--enable-sakke],[Enable SAKKE - paring based crypto (default: disabled)])],
[ ENABLED_SAKKE=$enableval ],
[ ENABLED_SAKKE=no ]
)
if test "x$ENABLED_SAKKE" = "xsmall"
then
ENABLED_SAKKE="yes"
ENABLED_SAKKE_SMALL="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_SAKKE_SMALL"
fi
if test "x$ENABLED_SAKKE" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_HAVE_SAKKE"
fi
add basic ecc encrypt/decrypt
2013-11-07 15:59:31 -08:00
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# PSK
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
AC_ARG_ENABLE([psk],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-psk],[Enable PSK (default: disabled)])],
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
[ ENABLED_PSK=$enableval ],
[ ENABLED_PSK=no ]
)
Use TLS v1.3 PSK callback in extension allow for one call in client New compile time option WOLFSSL_PSK_ONE_ID. Indicates one identity available. No need for client to call callback when generating binder - already cached.
2019-05-17 08:01:40 +10:00
# Single PSK identity
AC_ARG_ENABLE([psk-one-id],
[AS_HELP_STRING([--enable-psk-one-id],[Enable PSK (default: disabled)])],
[ ENABLED_PSK_ONE_ID=$enableval ],
[ ENABLED_PSK_ONE_ID=no ]
)
if test "$ENABLED_PSK_ONE_ID" = "yes"
then
if test "$ENABLED_PSK" = "no"
then
ENABLED_PSK="yes"
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PSK_ONE_ID"
fi
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
add --enable-errorstrings and build check
2013-03-13 11:27:14 -07:00
# ERROR STRINGS
AC_ARG_ENABLE([errorstrings],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-errorstrings],[Enable error strings table (default: enabled)])],
add --enable-errorstrings and build check
2013-03-13 11:27:14 -07:00
[ ENABLED_ERROR_STRINGS=$enableval ],
[ ENABLED_ERROR_STRINGS=yes ]
)
if test "$ENABLED_ERROR_STRINGS" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_ERROR_STRINGS"
else
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# turn off error strings if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
add --enable-errorstrings and build check
2013-03-13 11:27:14 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_ERROR_STRINGS"
ENABLED_ERROR_STRINGS=no
fi
fi
add --disable-errorqueue option
2019-12-11 11:19:58 -07:00
# ERROR QUEUE
AC_ARG_ENABLE([errorqueue],
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
[AS_HELP_STRING([--enable-errorqueue],[Disables adding nodes to error queue when compiled with OPENSSL_EXTRA (default: enabled)])],
add --disable-errorqueue option
2019-12-11 11:19:58 -07:00
[ ENABLED_ERROR_QUEUE=$enableval ],
[ ENABLED_ERROR_QUEUE=yes ]
)
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# OLD TLS
add --enable-oldtls, build and leanpsk check
2013-03-13 11:49:11 -07:00
AC_ARG_ENABLE([oldtls],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-oldtls],[Enable old TLS versions < 1.2 (default: enabled)])],
add --enable-oldtls, build and leanpsk check
2013-03-13 11:49:11 -07:00
[ ENABLED_OLD_TLS=$enableval ],
[ ENABLED_OLD_TLS=yes ]
)
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
if test "$ENABLED_CRYPTONLY" = "yes"
then
ENABLED_OLD_TLS=no
fi
add --enable-oldtls, build and leanpsk check
2013-03-13 11:49:11 -07:00
if test "$ENABLED_OLD_TLS" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_OLD_TLS"
else
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# turn off old if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
add --enable-oldtls, build and leanpsk check
2013-03-13 11:49:11 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_OLD_TLS"
ENABLED_OLD_TLS=no
fi
fi
Allow TLS 1.2 to be compiled out.
2018-05-17 09:08:03 +10:00
# TLSv1.2
AC_ARG_ENABLE([tlsv12],
[AS_HELP_STRING([--enable-tlsv12],[Enable TLS versions 1.2 (default: enabled)])],
[ ENABLED_TLSV12=$enableval ],
[ ENABLED_TLSV12=yes ]
)
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
if test "$ENABLED_CRYPTONLY" = "yes"
then
ENABLED_TLSV12=no
fi
Allow TLS 1.2 to be compiled out.
2018-05-17 09:08:03 +10:00
if test "$ENABLED_TLSV12" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_TLS12 -DNO_OLD_TLS"
fi
Disable TLS v1.0 by default. Added new `--enable-tlsv10` option to force enable (only works if --enable-oldtls is set, which is on by default).
2017-11-14 13:55:48 -08:00
# TLSv1.0
AC_ARG_ENABLE([tlsv10],
[AS_HELP_STRING([--enable-tlsv10],[Enable old TLS versions 1.0 (default: disabled)])],
[ ENABLED_TLSV10=$enableval ],
[ ENABLED_TLSV10=no ]
)
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
if test "$ENABLED_CRYPTONLY" = "yes"
then
ENABLED_TLSV12=no
fi
Disable TLS v1.0 by default. Added new `--enable-tlsv10` option to force enable (only works if --enable-oldtls is set, which is on by default).
2017-11-14 13:55:48 -08:00
if test "$ENABLED_TLSV10" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALLOW_TLSV10"
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# SSLv3
AC_ARG_ENABLE([sslv3],
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-20 13:22:30 +02:00
[AS_HELP_STRING([--enable-sslv3],[Enable SSL version 3.0 (default: disabled)])],
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
[ ENABLED_SSLV3=$enableval ],
[ ENABLED_SSLV3=no]
)
Fix for `--enable-all` (also used by `--enable-distro`) to NOT enable SSLV3 and TLS v1.0.
2020-07-31 13:48:15 -07:00
if test "x$ENABLED_HAPROXY" = "xyes" && test "x$ENABLED_ALL" = "xno"
Define functions required by HAProxy and enable SSLV3 dependency
2018-07-26 12:53:21 -07:00
then
ENABLED_SSLV3="yes"
fi
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
if test "$ENABLED_CRYPTONLY" = "yes"
then
ENABLED_SSLV3=no
fi
Define functions required by HAProxy and enable SSLV3 dependency
2018-07-26 12:53:21 -07:00
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
if test "$ENABLED_SSLV3" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALLOW_SSLV3"
fi
configure.ac: replace --enable-stacksize-verbose with --enable-stacksize=verbose, and change _LINUXKM_DEFAULTS ENABLED_SP_DEFAULT and ENABLED_SP_MATH_ALL_DEFAULT from small to yes.
2020-12-04 17:50:05 -06:00
# STACK SIZE info for testwolfcrypt and examples
add --enable-stacksize to print out stack use info with pthreads for example client/server
2013-03-28 11:28:38 -07:00
AC_ARG_ENABLE([stacksize],
add trackmemory enable option
2017-05-18 16:46:56 -06:00
[AS_HELP_STRING([--enable-stacksize],[Enable stack size info on examples (default: disabled)])],
add --enable-stacksize to print out stack use info with pthreads for example client/server
2013-03-28 11:28:38 -07:00
[ ENABLED_STACKSIZE=$enableval ],
[ ENABLED_STACKSIZE=no ]
)
configure.ac: replace --enable-stacksize-verbose with --enable-stacksize=verbose, and change _LINUXKM_DEFAULTS ENABLED_SP_DEFAULT and ENABLED_SP_MATH_ALL_DEFAULT from small to yes.
2020-12-04 17:50:05 -06:00
if test "$ENABLED_STACKSIZE" != "no"
add --enable-stacksize to print out stack use info with pthreads for example client/server
2013-03-28 11:28:38 -07:00
then
AC_CHECK_FUNC([posix_memalign], [], [AC_MSG_ERROR(stacksize needs posix_memalign)])
configure.ac: supplement AC_CHECK_FUNCS() (function link test) with AC_CHECK_DECLS() (function declaration test) to avoid false positives. fixes various build failure modes.
2020-10-09 22:18:51 -05:00
AC_CHECK_DECL([posix_memalign], [], [AC_MSG_ERROR(stacksize needs posix_memalign)])
Merge branch 'master' of https://github.com/cyassl/cyassl
2013-06-19 17:04:43 -03:00
AC_CHECK_FUNC([pthread_attr_setstack], [], AC_CHECK_LIB([pthread],[pthread_attr_setstack]))
configure.ac: supplement AC_CHECK_FUNCS() (function link test) with AC_CHECK_DECLS() (function declaration test) to avoid false positives. fixes various build failure modes.
2020-10-09 22:18:51 -05:00
AC_CHECK_DECL([pthread_attr_setstack], [], [AC_MSG_ERROR(stacksize needs pthread_attr_setstack)], [[#include <pthread.h>]])
Added support for QAT RSA Key Generation.
2018-12-10 16:51:54 -08:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_STACK_SIZE"
add --enable-stacksize to print out stack use info with pthreads for example client/server
2013-03-28 11:28:38 -07:00
fi
configure.ac: replace --enable-stacksize-verbose with --enable-stacksize=verbose, and change _LINUXKM_DEFAULTS ENABLED_SP_DEFAULT and ENABLED_SP_MATH_ALL_DEFAULT from small to yes.
2020-12-04 17:50:05 -06:00
if test "$ENABLED_STACKSIZE" = "verbose"
wolfssl/test.h: polish implementation of HAVE_STACK_SIZE_VERBOSE, now enabled with --enable-stacksize-verbose; internal symbol renamed from original DEBUG_STACK_SIZE_VERBOSE, helper functions and macros refactored to be formally threadsafe and to track the overall high water mark (reports same "stack used" value as --enable-stacksize after final return); add "setting stack relative offset reference mark in funcname() to x" message at entry; add configure mutexing of --enable-stacksize[-verbose] relative to --enable-linuxkm.
2020-09-02 14:20:51 -05:00
then
if test "$thread_ls_on" != "yes"
then
AC_MSG_ERROR(stacksize-verbose needs thread-local storage.)
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_STACK_SIZE_VERBOSE"
fi
add --enable-stacksize to print out stack use info with pthreads for example client/server
2013-03-28 11:28:38 -07:00
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# MEMORY
add --enable-memory, build, disable runtime memory cbs, check leanpsk
2013-03-12 13:31:14 -07:00
AC_ARG_ENABLE([memory],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-memory],[Enable memory callbacks (default: enabled)])],
add --enable-memory, build, disable runtime memory cbs, check leanpsk
2013-03-12 13:31:14 -07:00
[ ENABLED_MEMORY=$enableval ],
[ ENABLED_MEMORY=yes ]
)
if test "$ENABLED_MEMORY" = "no"
then
configure.ac updates
2014-12-31 13:04:03 -07:00
AM_CFLAGS="$AM_CFLAGS -DNO_WOLFSSL_MEMORY"
add --enable-memory, build, disable runtime memory cbs, check leanpsk
2013-03-12 13:31:14 -07:00
else
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# turn off memory cb if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
add --enable-memory, build, disable runtime memory cbs, check leanpsk
2013-03-12 13:31:14 -07:00
then
configure.ac updates
2014-12-31 13:04:03 -07:00
# but don't turn on NO_WOLFSSL_MEMORY because using own
add --enable-memory, build, disable runtime memory cbs, check leanpsk
2013-03-12 13:31:14 -07:00
ENABLED_MEMORY=no
fi
fi
require using wolfSSL memory when enabling trackmemory
2017-05-19 15:24:38 -06:00
# MEMORY SIZE info
AC_ARG_ENABLE([trackmemory],
[AS_HELP_STRING([--enable-trackmemory],[Enable memory use info on wolfCrypt and wolfSSL cleanup (default: disabled)])],
[ ENABLED_TRACKMEMORY=$enableval ],
[ ENABLED_TRACKMEMORY=no ]
)
add --enable-trackmemory=verbose, and add WOLFSSL_TEST_MAX_RELATIVE_HEAP_{BYTES,ALLOCS} and -m/-a (runtime counterparts) to wolfcrypt_test(). also add -h to wolfcrypt_test() to print available options.
2020-12-23 12:03:06 -06:00
if test "$ENABLED_TRACKMEMORY" != "no"
require using wolfSSL memory when enabling trackmemory
2017-05-19 15:24:38 -06:00
then
if test "$ENABLED_MEMORY" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TRACK_MEMORY"
else
AC_MSG_ERROR([trackmemory requires using wolfSSL memory (--enable-memory).])
fi
add --enable-trackmemory=verbose, and add WOLFSSL_TEST_MAX_RELATIVE_HEAP_{BYTES,ALLOCS} and -m/-a (runtime counterparts) to wolfcrypt_test(). also add -h to wolfcrypt_test() to print available options.
2020-12-23 12:03:06 -06:00
if test "$ENABLED_TRACKMEMORY" = "verbose"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TRACK_MEMORY_VERBOSE"
fi
require using wolfSSL memory when enabling trackmemory
2017-05-19 15:24:38 -06:00
fi
More changes to minimize dynamic memory usage. Change define to WOLFSSL_MEMORY_LOG. Fix for ED25519 server certificate - single cert to allow comparison with ECC dynamic memory usage. Free memory earlier to reduce maximum memory usage in a connection. Make MAX_ENCODED_SIG_SZ only as big as necessary. Change memory allocation type in sha256 from RNG to DIGEST. If we know the key type use it in decoding private key
2018-08-21 09:03:11 +10:00
# MEMORY usage logging
AC_ARG_ENABLE([memorylog],
[AS_HELP_STRING([--enable-memorylog],[Enable dynamic memory logging (default: disabled)])],
[ ENABLED_MEMORYLOG=$enableval ],
[ ENABLED_MEMORYLOG=no ]
)
if test "$ENABLED_MEMORYLOG" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_MEMORY_LOG"
fi
Small stack usage fixes Stack pointer logging added.
2018-08-29 10:16:51 +10:00
# STACK usage logging
AC_ARG_ENABLE([stacklog],
[AS_HELP_STRING([--enable-stacklog],[Enable stack logging (default: disabled)])],
[ ENABLED_STACKLOG=$enableval ],
[ ENABLED_STACKLOG=no ]
)
if test "$ENABLED_STACKLOG" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STACK_LOG -finstrument-functions"
fi
initial implementation of WOLFSSL_NETWORK_INTROSPECTION: --enable-network-introspection, struct wolfSSL_network_connection, wolfSSL_*_endpoints*(), NetworkFilterCallback_t, wolfSSL_*set_AcceptFilter().
2021-03-17 22:49:07 -05:00
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
ENABLED_WOLFSENTRY=no
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
configure.ac: add --with-wolfsentry option.
2021-04-21 03:19:35 -05:00
AC_ARG_WITH([wolfsentry],
[AS_HELP_STRING([--with-wolfsentry=PATH],[PATH to directory with wolfSentry installation])],
[WOLFSENTRY_INSTALLDIR=$withval],
[WOLFSENTRY_INSTALLDIR=""])
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
AC_ARG_WITH([wolfsentry-lib],
[AS_HELP_STRING([--with-wolfsentry-lib=PATH],[PATH to directory with wolfSentry library])],
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
[WOLFSENTRY_LIB=$withval],
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
[WOLFSENTRY_LIB=""])
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
AC_ARG_WITH([wolfsentry-include],
[AS_HELP_STRING([--with-wolfsentry-include=PATH],[PATH to directory with wolfSentry header files])],
[WOLFSENTRY_INCLUDE=$withval],
[WOLFSENTRY_INCLUDE=""])
if test -n "$WOLFSENTRY_INSTALLDIR" || test -n "$WOLFSENTRY_LIB" || test -n "$WOLFSENTRY_INCLUDE"
configure.ac: add --with-wolfsentry option.
2021-04-21 03:19:35 -05:00
then
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
ENABLED_WOLFSENTRY=yes
configure.ac: add --with-wolfsentry option.
2021-04-21 03:19:35 -05:00
fi
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
AC_ARG_ENABLE([wolfsentry],
[AS_HELP_STRING([--enable-wolfsentry],[Enable wolfSentry hooks and plugins (default: disabled)])],
[ ENABLED_WOLFSENTRY=$enableval ],
[ ]
)
if test "$WOLFSENTRY_LIB" = "" && test -n "$WOLFSENTRY_INSTALLDIR"
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
then
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
WOLFSENTRY_LIB="${WOLFSENTRY_INSTALLDIR}/lib"
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
fi
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
if test "$WOLFSENTRY_INCLUDE" = "" && test -n "$WOLFSENTRY_INSTALLDIR"
then
WOLFSENTRY_INCLUDE="${WOLFSENTRY_INSTALLDIR}/include"
fi
if test -n "$WOLFSENTRY_LIB"
then
AC_MSG_CHECKING([for $WOLFSENTRY_LIB])
if ! test -d "$WOLFSENTRY_LIB"
then
AC_MSG_ERROR([wolfSentry lib dir $WOLFSENTRY_LIB not found.])
fi
AC_MSG_RESULT([yes])
WOLFSENTRY_LIB="-L$WOLFSENTRY_LIB"
fi
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
if test -n "$WOLFSENTRY_INCLUDE"
configure.ac: add --with-wolfsentry option.
2021-04-21 03:19:35 -05:00
then
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
AC_MSG_CHECKING([for $WOLFSENTRY_INCLUDE])
if ! test -d "$WOLFSENTRY_INCLUDE"
then
AC_MSG_ERROR([wolfSentry include dir $WOLFSENTRY_INCLUDE not found.])
fi
AC_MSG_RESULT([yes])
WOLFSENTRY_INCLUDE="-I$WOLFSENTRY_INCLUDE"
configure.ac: add --with-wolfsentry option.
2021-04-21 03:19:35 -05:00
fi
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
if test "$ENABLED_WOLFSENTRY" = "yes"
configure.ac: add --with-wolfsentry option.
2021-04-21 03:19:35 -05:00
then
configure.ac: improve dynamics of --enable-wolfsentry and --with-wolfsentry*, including existence-checking user-supplied paths.
2021-04-21 17:28:27 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_WOLFSENTRY_HOOKS -DHAVE_EX_DATA -DHAVE_EX_DATA_CLEANUP_HOOKS"
WOLFSENTRY_LIB="$WOLFSENTRY_LIB -lwolfsentry"
configure.ac: add --with-wolfsentry option.
2021-04-21 03:19:35 -05:00
fi
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
AC_SUBST([WOLFSENTRY_LIB])
AC_SUBST([WOLFSENTRY_INCLUDE])
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
if test "$ENABLED_QT" = "yes"
then
# Requires opensslextra and opensslall
if test "x$ENABLED_OPENSSLALL" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLALL="yes"
ENABLED_OPENSSLEXTRA="yes"
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DOPENSSL_ALL -DHAVE_EX_DATA"
fi
Fix for `--enable-all` (also used by `--enable-distro`) to NOT enable SSLV3 and TLS v1.0.
2020-07-31 13:48:15 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_QT -DSESSION_CERTS -DOPENSSL_NO_SSL2"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN -DHAVE_EX_DATA"
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CUSTOM_CURVES -DHAVE_ECC_SECPR2 -DHAVE_ECC_SECPR3 -DHAVE_ECC_BRAINPOOL -DHAVE_ECC_KOBLITZ"
Fix for `--enable-all` (also used by `--enable-distro`) to NOT enable SSLV3 and TLS v1.0.
2020-07-31 13:48:15 -07:00
if test "x$ENABLED_ALL" = "xno"; then
# Don't enable old SSL/TLS for --enable-all, which is used by distro
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALLOW_SSLV3 -DWOLFSSL_ALLOW_TLSV10"
fi
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
# Requires OCSP make sure on
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
# Requires PSK make sure on
if test "x$ENABLED_PSK" = "xno"
then
Disable RC4 unless forcefully enabled with `--enable-rc4` or if `WOLFSSL_ALLOW_RC4` is specified. Related to issue #4248
2021-07-28 10:31:15 -07:00
ENABLED_PSK="yes"
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
fi
Disable RC4 unless forcefully enabled with `--enable-rc4` or if `WOLFSSL_ALLOW_RC4` is specified. Related to issue #4248
2021-07-28 10:31:15 -07:00
# Requires RC4 make sure on (if not forcefully disabled with --disable-arc4)
test "$enable_arc4" = "" && enable_arc4=yes
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"
fi
Small stack usage fixes Stack pointer logging added.
2018-08-29 10:16:51 +10:00
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
# requires oldnames disabled
enable_oldnames=no
fi
AC_ARG_ENABLE([qt-test],
[AS_HELP_STRING([--enable-qt-test],[Enable qt tests (default: disabled)])],
[ ENABLED_QT_TEST=$enableval ],
[ ENABLED_QT_TEST=no ]
)
Small stack usage fixes Stack pointer logging added.
2018-08-29 10:16:51 +10:00
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
if test "$ENABLED_QT_TEST" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_NO_SSL3 -DWOLFSSL_STATIC_RSA"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_PSK"
fi
require using wolfSSL memory when enabling trackmemory
2017-05-19 15:24:38 -06:00
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# RSA
add --disable-rsa, bump dev version
2013-03-11 12:49:59 -07:00
AC_ARG_ENABLE([rsa],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-rsa],[Enable RSA (default: enabled)])],
add --disable-rsa, bump dev version
2013-03-11 12:49:59 -07:00
[ ENABLED_RSA=$enableval ],
[ ENABLED_RSA=yes ]
)
if test "$ENABLED_RSA" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_RSA"
else
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# turn off RSA if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
add --disable-rsa, bump dev version
2013-03-11 12:49:59 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_RSA"
ENABLED_RSA=no
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
else
ENABLED_CERTS=yes
add --disable-rsa, bump dev version
2013-03-11 12:49:59 -07:00
fi
fi
Allow a very small build based on SHA-256 and RSA verify
2018-12-06 17:27:10 +10:00
AC_ARG_ENABLE([oaep],
[AS_HELP_STRING([--enable-oaep],[Enable RSA OAEP (default: enabled)])],
[ ENABLED_OAEP=$enableval ],
[ ENABLED_OAEP=yes ]
)
if test "$ENABLED_OAEP" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DWC_NO_RSA_OAEP"
fi
AC_ARG_ENABLE([rsapub],
[AS_HELP_STRING([--enable-rsapub],[Enable RSA Public Only (default: disabled)])],
[ ENABLED_RSAPUB=$enableval ],
[ ENABLED_RSAPUB=no ]
)
if test "$ENABLED_RSAPUB" = "yes"
then
if test "$ENABLED_RSA" = "no"
then
ENABLED_RSA="yes"
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_RSA_PUBLIC_ONLY"
fi
AC_ARG_ENABLE([rsavfy],
[AS_HELP_STRING([--enable-rsavfy],[Enable RSA Verify Inline Only (default: disabled)])],
[ ENABLED_RSAVFY=$enableval ],
[ ENABLED_RSAVFY=no ]
)
if test "$ENABLED_RSAVFY" = "yes"
then
if test "$ENABLED_RSA" = "no"
then
ENABLED_RSA="yes"
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_RSA_PUBLIC_ONLY -DWOLFSSL_RSA_VERIFY_ONLY"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_RSA_VERIFY_INLINE -DNO_SIG_WRAPPER"
SP int: get rsavfy and rsapub working again
2021-02-03 17:14:13 +10:00
AM_CFLAGS="$AM_CFLAGS -DNO_CHECK_PRIVATE_KEY"
Allow a very small build based on SHA-256 and RSA verify
2018-12-06 17:27:10 +10:00
fi
add --disable-rsa, bump dev version
2013-03-11 12:49:59 -07:00
TLS v1.2 and PSS Cleanup the TLS v1.3 PSS code as well. Added RSA API wc_RsaPSS_CheckPadding() to check the padding - no longer a simple memcmp with the digest.
2017-05-18 15:32:06 +10:00
# RSA-PSS
AC_ARG_ENABLE([rsapss],
[ --enable-rsapss Enable RSA-PSS (default: disabled)],
[ ENABLED_RSAPSS=$enableval ],
[ ENABLED_RSAPSS=no ]
)
if test "$ENABLED_RSA" = "no"
then
ENABLED_RSAPSS="no"
else
if test "$ENABLED_TLS13" = "yes"
then
ENABLED_RSAPSS="yes"
fi
fi
if test "$ENABLED_RSAPSS" = "yes"
then
Certs with RSA-PSS sig Add support for parsing and verifying certificates with RSA-PSS signatures. Including check PSS parameters in key with those in signature algorithm. Add support for parsing private RSA PSS key. Add support for parsing public RSA PSS key.
2022-07-25 17:36:17 +10:00
AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS -DWOLFSSL_PSS_LONG_SALT"
TLS v1.2 and PSS Cleanup the TLS v1.3 PSS code as well. Added RSA API wc_RsaPSS_CheckPadding() to check the padding - no longer a simple memcmp with the digest.
2017-05-18 15:32:06 +10:00
fi
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
# DH
AC_ARG_ENABLE([dh],
update configure help strings for AESGCM and DH
2015-03-31 16:23:28 -07:00
[AS_HELP_STRING([--enable-dh],[Enable DH (default: enabled)])],
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
[ ENABLED_DH=$enableval ],
enable dh by default
2015-03-27 10:23:15 -07:00
[ ENABLED_DH=yes ]
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
)
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
if test "$ENABLED_OPENSSH" = "yes" && test "$ENABLED_DH" = "no"
add openssh ./configure build
2015-07-17 09:14:58 -07:00
then
ENABLED_DH="yes"
fi
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
if test "$ENABLED_DH" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_DH"
else
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# turn off DH if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_DH"
ENABLED_DH=no
fi
fi
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
if test "$ENABLED_DH" = "const"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_CONST"
fi
if test "$ENABLED_SNIFFER" = "yes" && test "$ENABLED_DH" != "no"
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA"
fi
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
Merge in the ADH-AES128-SHA changes and add a check for it during the packet order sanity checking.
2014-12-01 11:44:32 -08:00
# Anonymous
AC_ARG_ENABLE([anon],
[AS_HELP_STRING([--enable-anon],[Enable Anonymous (default: disabled)])],
[ ENABLED_ANON=$enableval ],
[ ENABLED_ANON=no ]
)
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
if test "x$ENABLED_WPAS" = "xyes" || test "x$ENABLED_NGINX" = "xyes" || \
test "x$ENABLED_HAPROXY" = "xyes" || test "$ENABLED_RSYSLOG" = "yes"
Changes for WPA Supplicant
2017-02-10 08:45:10 +10:00
then
ENABLED_ANON=yes
fi
Merge in the ADH-AES128-SHA changes and add a check for it during the packet order sanity checking.
2014-12-01 11:44:32 -08:00
if test "x$ENABLED_ANON" = "xyes"
then
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
if test "$ENABLED_DH" = "no"
Merge in the ADH-AES128-SHA changes and add a check for it during the packet order sanity checking.
2014-12-01 11:44:32 -08:00
then
AC_MSG_ERROR([Anonymous suite requires DH.])
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_ANON"
fi
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
# ASN
allow dh to be used w/o certs and asn
2015-03-27 14:28:05 -07:00
# turn off asn, which means no certs, no rsa, no dsa, no ecc,
# and no big int (unless dh is on)
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
AC_ARG_ENABLE([asn],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-asn],[Enable ASN (default: enabled)])],
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
[ ENABLED_ASN=$enableval ],
[ ENABLED_ASN=yes ]
)
ASN1 Template: stricter and simpler DER/BER parsing/construction Reduce debug output noise
2020-12-17 13:41:56 +10:00
if test "$ENABLED_ASN" = "template"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_TEMPLATE"
ENABLED_ASN=yes
fi
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
if test "$ENABLED_ASN" = "no"
then
SP RSA verify only: fix to compile Configurations: ./configure --disable-asn --disable-filesystem --enable-cryptonly --disable-dh --disable-sha224 --disable-ecc CFLAGS=-DWOLFSSL_PUBLIC_MP --enable-rsavfy --enable-sp=small2048 --enable-sp-math ./configure --disable-asn --disable-filesystem --enable-cryptonly --disable-dh --disable-sha224 --disable-ecc CFLAGS=-DWOLFSSL_PUBLIC_MP --enable-rsavfy --enable-sp=2048 --enable-sp-math ./configure --disable-asn --disable-filesystem --enable-cryptonly --disable-dh --disable-sha224 --disable-ecc CFLAGS=-DWOLFSSL_PUBLIC_MP --enable-rsavfy --enable-sp=small2048 --enable-sp-math-all ./configure --disable-asn --disable-filesystem --enable-cryptonly --disable-dh --disable-sha224 --disable-ecc CFLAGS=-DWOLFSSL_PUBLIC_MP --enable-rsavfy --enable-sp=small2048 --enable-sp-math --enable-sp-asm ./configure --disable-asn --disable-filesystem --enable-cryptonly --disable-dh --disable-sha224 --disable-ecc CFLAGS=-DWOLFSSL_PUBLIC_MP --enable-rsavfy --enable-sp=2048 --enable-sp-math --enable-sp-asm
2021-08-18 12:59:44 +10:00
AM_CFLAGS="$AM_CFLAGS -DNO_ASN -DNO_ASN_CRYPT"
enable_pwdbased=no
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "$ENABLED_DH" = "no" && test "$ENABLED_ECC" = "no"
allow dh to be used w/o certs and asn
2015-03-27 14:28:05 -07:00
then
Updated the configure.ac comments about big int being used for ECC and DH. Moved the checks for ecc/asn and psk/asn until after cryptonly value is set and fixed so those checks work for normal build and are excluded for crypt only builds.
2016-02-10 13:03:53 -08:00
# DH and ECC need bigint
allow dh to be used w/o certs and asn
2015-03-27 14:28:05 -07:00
AM_CFLAGS="$AM_CFLAGS -DNO_BIG_INT"
fi
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
else
# turn off ASN if leanpsk on
if test "$ENABLED_LEANPSK" = "yes"
then
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
AM_CFLAGS="$AM_CFLAGS -DNO_ASN -DNO_BIG_INT"
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
ENABLED_ASN=no
Added support for building with certificate parsing only. `./configure --enable-asn=nocrypt`. Added new API for parsing PIV format certificates `wc_ParseCertPIV` with `WOLFSSL_CERT_PIV` build option. Added `wc_DeCompress_ex` with ability to decompress GZIP. Moved the ZLIB error codes into wolfCrypt.
2018-09-25 12:16:59 -07:00
else
if test "$ENABLED_ASN" = "nocrypt"
then
AM_CFLAGS="$AM_CFLAGS -DNO_ASN_CRYPT"
Fixes for building with `./configure --enable-asn=nocrypt`. Added wolfCrypt test template for `certpiv_test`, pending test PIV certs to use.
2018-09-26 13:56:10 -07:00
enable_pwdbased=no
Added support for building with certificate parsing only. `./configure --enable-asn=nocrypt`. Added new API for parsing PIV format certificates `wc_ParseCertPIV` with `WOLFSSL_CERT_PIV` build option. Added `wc_DeCompress_ex` with ability to decompress GZIP. Moved the ZLIB error codes into wolfCrypt.
2018-09-25 12:16:59 -07:00
fi
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
fi
fi
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
if test "$ENABLED_RSA" = "yes" && test "$ENABLED_RSAVFY" = "no" && \
test "$ENABLED_ASN" = "no"
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
then
AC_MSG_ERROR([please disable rsa if disabling asn.])
fi
add --enable-dh, build, checks w/o asn
2013-03-12 13:03:42 -07:00
if test "$ENABLED_DSA" = "yes" && test "$ENABLED_ASN" = "no"
then
AC_MSG_ERROR([please disable dsa if disabling asn.])
fi
configure.ac fixes related to change in default math back end (to sp-math-all): wolfRand doesn't use fastmath; FIPS v5-dev follows the non-FIPS default (now sp-math-all); add -DWC_NO_CACHE_RESISTANT to AM_CFLAGS when $ENABLED_HARDEN != yes; add ENABLED_BIGNUM sensor and use it in linuxkm math back end assert; add configuration callout for "Side-channel Hardening" reporting value of $ENABLED_HARDEN.
2022-06-24 15:55:08 -05:00
# No Big Int (ASN, DSA, RSA, DH and ECC need bigint)
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
if test "$ENABLED_ASN" = "no" && test "$ENABLED_DSA" = no && \
test "$ENABLED_DH" = "no" && test "$ENABLED_ECC" = "no" && \
test "$ENABLED_RSA" = "no"
then
ENABLED_SP_MATH_ALL="no"
ENABLED_FASTMATH="no"
ENABLED_HEAPMATH="no"
ENABLED_BIGNUM="no"
configure.ac fixes related to change in default math back end (to sp-math-all): wolfRand doesn't use fastmath; FIPS v5-dev follows the non-FIPS default (now sp-math-all); add -DWC_NO_CACHE_RESISTANT to AM_CFLAGS when $ENABLED_HARDEN != yes; add ENABLED_BIGNUM sensor and use it in linuxkm math back end assert; add configuration callout for "Side-channel Hardening" reporting value of $ENABLED_HARDEN.
2022-06-24 15:55:08 -05:00
else
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
ENABLED_BIGNUM="yes"
make sure no asn doesn't build big int
2013-03-12 15:14:03 -07:00
fi
add --enable-asn, build, and checks for rsa / psk w/o asn
2013-03-12 12:48:41 -07:00
add --enable-aes and build
2013-03-11 17:07:37 -07:00
# AES
AC_ARG_ENABLE([aes],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-aes],[Enable AES (default: enabled)])],
add --enable-aes and build
2013-03-11 17:07:37 -07:00
[ ENABLED_AES=$enableval ],
[ ENABLED_AES=yes ]
)
if test "$ENABLED_AES" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_AES"
fortress relies on aes disallowed pair
2015-07-17 09:30:25 -06:00
if test "$ENABLED_FORTRESS" = "yes"
then
AC_MSG_ERROR([fortress requires aes])
fi
ecc_encrypt + hkdf requires aes
2015-07-16 15:31:36 -06:00
if test "$ENABLED_ECC_ENCRYPT" = "yes"
then
AC_MSG_ERROR([cannot enable eccencrypt and hkdf without aes.])
fi
Fix for --disable-aes without --disable-aesgcm
2022-07-18 10:26:20 -07:00
if test "$ENABLED_AESGCM" != "no"
aes gcm/ccm require aes, duh
2015-03-27 21:30:27 -07:00
then
AC_MSG_ERROR([AESGCM requires AES.])
fi
if test "$ENABLED_AESCCM" = "yes"
then
AC_MSG_ERROR([AESCCM requires AES.])
fi
Adds an --enable-aesctr flag to the configure script to explicitly compile with -DWOLFSSL_AES_COUNTER and -DWOLFSSL_AES_DIRECT If --enable-fortress or --enable-mcapi are used they effectively force --enable-aesctr
2016-12-04 15:23:51 +01:00
if test "$ENABLED_AESCTR" = "yes"
then
AC_MSG_ERROR([AESCTR requires AES.])
fi
add --enable-aes and build
2013-03-11 17:07:37 -07:00
else
# turn off AES if leanpsk on
if test "$ENABLED_LEANPSK" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DNO_AES"
ENABLED_AES=no
fi
fi
dtls13: add autotools, cmake build options and vstudio paths
2022-05-20 09:59:23 +02:00
# DTLSv1.3
AC_ARG_ENABLE([dtls13],
[AS_HELP_STRING([--enable-dtls13],[Enable wolfSSL DTLS v1.3 (default: disabled)])],
[ ENABLED_DTLS13=$enableval ],
[ ENABLED_DTLS13=no ]
)
if test "x$ENABLED_DTLS13" = "xyes"
then
if test "x$ENABLED_DTLS" != "xyes" || test "x$ENABLED_TLS13" != "xyes"
then
AC_MSG_ERROR([You need to enable both DTLS and TLSv1.3 to use DTLSv1.3])
fi
dtls13: enable hrr cookie by default
2022-08-26 12:25:54 +02:00
if test "x$ENABLED_SEND_HRR_COOKIE" == "xundefined"
then
AC_MSG_NOTICE([DTLSv1.3 is enabled, enabling HRR cookie])
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SEND_HRR_COOKIE"
ENABLED_SEND_HRR_COOKIE="yes"
fi
misc.c: introduce w64wrapper to handle 64bit numbers as word64 is not always available, introduce an abstract type and companion operations. They use a word64 if available and fallback on word32[2] otherwise.
2022-05-30 11:17:03 +02:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS13 -DWOLFSSL_W64_WRAPPER"
dtls13: add autotools, cmake build options and vstudio paths
2022-05-20 09:59:23 +02:00
if test "x$ENABLED_AES" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
fi
fi
add --enable-aes and build
2013-03-11 17:07:37 -07:00
add initial support for ConnectionID DTLS extension
2022-08-10 16:39:44 +02:00
# DTLS CID support
AC_ARG_ENABLE([dtlscid],
[AS_HELP_STRING([--enable-dtlscid],[Enable wolfSSL DTLS ConnectionID (default: disabled)])],
[ ENABLED_DTLS_CID=$enableval ],
[ ENABLED_DTLS_CID=no ]
)
if test "x$ENABLED_DTLS_CID" = "xyes"
then
if test "x$ENABLED_DTLS13" != "xyes"
then
AC_MSG_ERROR([You need to enable DTLSv1.3 to use DTLS ConnectionID])
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS_CID"
fi
add --enable-coding, build, leanpsk check
2013-03-12 13:12:10 -07:00
# CODING
AC_ARG_ENABLE([coding],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-coding],[Enable Coding base 16/64 (default: enabled)])],
add --enable-coding, build, leanpsk check
2013-03-12 13:12:10 -07:00
[ ENABLED_CODING=$enableval ],
[ ENABLED_CODING=yes ]
)
if test "$ENABLED_CODING" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_CODING"
else
# turn off CODING if leanpsk on
if test "$ENABLED_LEANPSK" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DNO_CODING"
ENABLED_CODING=no
fi
fi
Added new public "wc_GetTime" API for getting seconds from the asn.c XTIME. Added new "./configure --enable-base64encode" to enable Base64 encoding (now enabled by default for "x86_64").
2016-06-09 16:26:39 -07:00
# Base64 Encode
BASE64ENCODE_DEFAULT=no
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "amd64"
Added new public "wc_GetTime" API for getting seconds from the asn.c XTIME. Added new "./configure --enable-base64encode" to enable Base64 encoding (now enabled by default for "x86_64").
2016-06-09 16:26:39 -07:00
then
BASE64ENCODE_DEFAULT=yes
fi
AC_ARG_ENABLE([base64encode],
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
[AS_HELP_STRING([--enable-base64encode],[Enable Base64 encoding (default: enabled on x86_64/amd64)])],
Added new public "wc_GetTime" API for getting seconds from the asn.c XTIME. Added new "./configure --enable-base64encode" to enable Base64 encoding (now enabled by default for "x86_64").
2016-06-09 16:26:39 -07:00
[ ENABLED_BASE64ENCODE=$enableval ],
[ ENABLED_BASE64ENCODE=$BASE64ENCODE_DEFAULT ]
)
if test "$ENABLED_BASE64ENCODE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_BASE64_ENCODE"
fi
Base16/64 improvements: * Add define `WOLFSSL_BASE16` to explicitly expose base16 support. * Add `./configure --enable-base16` option (disabled by default in configure, but enabled in coding.h when required internally). * Added base16 tests in test.c `base16_test`. * Enabled base64 decode tests when `WOLFSSL_BASE64_ENCODE` is not defined.
2018-03-22 10:36:56 -07:00
# Base16
AC_ARG_ENABLE([base16],
[AS_HELP_STRING([--enable-base16],[Enable Base16 encoding/decoding (default: disabled)])],
[ ENABLED_BASE16=$enableval ],
[ ENABLED_BASE16=no ]
)
first pre alpha code for QNX + CAAM manual run of RNG init and JDKEK print job ring does initial rng is successful on some red key blob operations caam red key blob test pass ecdsa sign/verify ecdsa ecdh/sign/verify with black secure key ecdsa ecdh/sign/verify with black secure key initial cmac addition initial cmac addition black blob encap black keys with cmac add invalidate memory refactoring and clean up more code cleanup add files for dist and remove some printf's remove unneeded macro guard use resource manager
2020-08-07 14:40:44 -06:00
if test "$ENABLED_CAAM" = "qnx"
then
ENABLED_BASE16=yes
fi
Base16/64 improvements: * Add define `WOLFSSL_BASE16` to explicitly expose base16 support. * Add `./configure --enable-base16` option (disabled by default in configure, but enabled in coding.h when required internally). * Added base16 tests in test.c `base16_test`. * Enabled base64 decode tests when `WOLFSSL_BASE64_ENCODE` is not defined.
2018-03-22 10:36:56 -07:00
if test "$ENABLED_BASE16" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_BASE16"
fi
add --enable-des3 and build, no strnstr in tests
2013-03-12 09:46:15 -07:00
# DES3
AC_ARG_ENABLE([des3],
Disable DES3 by default. Force it enabled when it is a prereq for another option. (SCEP and PKCS7)
2016-09-15 11:17:30 -07:00
[AS_HELP_STRING([--enable-des3],[Enable DES3 (default: disabled)])],
add --enable-des3 and build, no strnstr in tests
2013-03-12 09:46:15 -07:00
[ ENABLED_DES3=$enableval ],
Disable DES3 by default. Force it enabled when it is a prereq for another option. (SCEP and PKCS7)
2016-09-15 11:17:30 -07:00
[ ENABLED_DES3=no ]
add --enable-des3 and build, no strnstr in tests
2013-03-12 09:46:15 -07:00
)
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
# Enable 3DES with OpenSSH and FIPS 140-2 but not 140-3
if (test "$ENABLED_OPENSSH" = "yes" && \
(test "x$ENABLED_FIPS" = "xno" || test "$HAVE_FIPS_VERSION" -le 2)) || \
test "$ENABLED_QT" = "yes" || test "$ENABLED_OPENVPN" = "yes" || \
test "x$ENABLED_WPAS" != "xno" || test "$ENABLED_NETSNMP" = "yes" || \
test "$ENABLED_LIBSSH2" = "yes" || test "$ENABLED_KRB" = "yes" || \
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
test "$ENABLED_WOLFENGINE" = "yes" || test "$ENABLED_STRONGSWAN" = "yes"
Update configure to enable des3 when building OpenSSH
2018-07-16 09:49:23 -07:00
then
Fix tab indentation
2018-07-16 13:09:45 -07:00
ENABLED_DES3="yes"
Update configure to enable des3 when building OpenSSH
2018-07-16 09:49:23 -07:00
fi
add --enable-des3 and build, no strnstr in tests
2013-03-12 09:46:15 -07:00
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# ARC4
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
if (test "$ENABLED_OPENSSH" = "yes" && test "x$ENABLED_FIPS" = "xno") || \
test "$ENABLED_WPAS" = "yes" || test "$ENABLED_KRB" = "yes"
Disable RC4 unless forcefully enabled with `--enable-rc4` or if `WOLFSSL_ALLOW_RC4` is specified. Related to issue #4248
2021-07-28 10:31:15 -07:00
then
# Requires RC4 make sure on (if not forcefully disabled with --disable-arc4)
test "$enable_arc4" = "" && enable_arc4=yes
fi
add --enable-arc4 and build
2013-03-11 17:13:24 -07:00
AC_ARG_ENABLE([arc4],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-arc4],[Enable ARC4 (default: disabled)])],
add --enable-arc4 and build
2013-03-11 17:13:24 -07:00
[ ENABLED_ARC4=$enableval ],
remove rc4 from default build
2015-03-27 10:17:22 -07:00
[ ENABLED_ARC4=no ]
add --enable-arc4 and build
2013-03-11 17:13:24 -07:00
)
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# MD5
--enable-md5 and build, needs NO_OLD_TLS, suite test version check
2013-03-11 17:37:08 -07:00
AC_ARG_ENABLE([md5],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-md5],[Enable MD5 (default: enabled)])],
--enable-md5 and build, needs NO_OLD_TLS, suite test version check
2013-03-11 17:37:08 -07:00
[ ENABLED_MD5=$enableval ],
[ ENABLED_MD5=yes ]
)
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# SHA
add --enable-sha and build, disables examples for now since certs still use sha, when add --disable-certs add more thorough check
2013-03-11 17:53:38 -07:00
AC_ARG_ENABLE([sha],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-sha],[Enable SHA (default: enabled)])],
add --enable-sha and build, disables examples for now since certs still use sha, when add --disable-certs add more thorough check
2013-03-11 17:53:38 -07:00
[ ENABLED_SHA=$enableval ],
[ ENABLED_SHA=yes ]
)
if test "$ENABLED_SHA" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_SHA -DNO_OLD_TLS"
else
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# turn off SHA if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
add --enable-sha and build, disables examples for now since certs still use sha, when add --disable-certs add more thorough check
2013-03-11 17:53:38 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_SHA -DNO_OLD_TLS"
ENABLED_SHA=no
fi
fi
Add SipHash algorithm
2022-01-14 13:56:23 +10:00
# SipHash
AC_ARG_ENABLE([siphash],
[AS_HELP_STRING([--enable-siphash],[Enable SipHash (default: disabled)])],
[ ENABLED_SIPHASH=$enableval ],
[ ENABLED_SIPHASH=no ]
)
AS_IF([test "x$ENABLED_SIPHASH" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SIPHASH"])
add AES-CMAC
2016-05-23 17:50:36 -07:00
# CMAC
AC_ARG_ENABLE([cmac],
[AS_HELP_STRING([--enable-cmac],[Enable CMAC (default: disabled)])],
[ ENABLED_CMAC=$enableval ],
[ ENABLED_CMAC=no ]
)
Make the code simpler.
2022-02-04 16:05:58 -05:00
if test "$ENABLED_WPAS" != "no" || test "$ENABLED_NTP" = "yes" || test "$ENABLED_AESSIV" = "yes" || test "$ENABLED_WOLFENGINE" = "yes"
Changes for WPA Supplicant
2017-02-10 08:45:10 +10:00
then
ENABLED_CMAC=yes
fi
add AES-CMAC
2016-05-23 17:50:36 -07:00
AS_IF([test "x$ENABLED_CMAC" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC -DWOLFSSL_AES_DIRECT"])
add AES-XTS mode --enable-xts
2017-08-30 17:50:15 -06:00
# AES-XTS
AC_ARG_ENABLE([xts],
[AS_HELP_STRING([--enable-xts],[Enable XTS (default: disabled)])],
[ ENABLED_XTS=$enableval ],
[ ENABLED_XTS=no ]
)
AS_IF([test "x$ENABLED_XTS" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_XTS -DWOLFSSL_AES_DIRECT"])
configure.ac: refactor setup for --enable-reproducible-build; remove mutex between --enable-sp-math and --enable-sp-math-all (they can now coexist); whitespace cleanup.
2021-11-05 18:18:53 -05:00
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Web Server Build
make sure enable-webserver (HAVE_WEBSERVER) can handle password callbacks as well as opensslextra unless NO_PWDBASED defined
2014-03-03 12:18:26 -08:00
AC_ARG_ENABLE([webserver],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-webserver],[Enable Web Server (default: disabled)])],
make sure enable-webserver (HAVE_WEBSERVER) can handle password callbacks as well as opensslextra unless NO_PWDBASED defined
2014-03-03 12:18:26 -08:00
[ ENABLED_WEBSERVER=$enableval ],
[ ENABLED_WEBSERVER=no ]
)
if test "$ENABLED_WEBSERVER" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_WEBSERVER"
fi
Added some more features to the `--enable-all`. Added new `--enable-webclient` option.
2018-04-10 08:38:14 -07:00
# Web Client Build (HTTP Client)
AC_ARG_ENABLE([webclient],
[AS_HELP_STRING([--enable-webclient],[Enable Web Client (HTTP) (default: disabled)])],
[ ENABLED_WEBCLIENT=$enableval ],
[ ENABLED_WEBCLIENT=no ]
)
if test "$ENABLED_WEBCLIENT" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_HTTP_CLIENT"
fi
make sure enable-webserver (HAVE_WEBSERVER) can handle password callbacks as well as opensslextra unless NO_PWDBASED defined
2014-03-03 12:18:26 -08:00
wolfSSL RC2 template.
2020-09-18 17:04:26 -07:00
# RC2
AC_ARG_ENABLE([rc2],
[AS_HELP_STRING([--enable-rc2],[Enable RC2 encryption (default: disabled)])],
[ ENABLED_RC2=$enableval ],
[ ENABLED_RC2=no ]
)
if test "$ENABLED_RC2" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWC_RC2"
fi
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
# FIPS feature and macro setup
Fixes for building TLSv1.3 with FIPS v1 (no RSA PSS or HKDF).
2020-05-12 11:53:19 -07:00
AS_CASE([$FIPS_VERSION],
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
[v5*|ready|dev], [ # FIPS 140-3
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
AM_CFLAGS="$AM_CFLAGS \
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
-DHAVE_FIPS \
-DHAVE_FIPS_VERSION=$HAVE_FIPS_VERSION \
-DHAVE_FIPS_VERSION_MINOR=$HAVE_FIPS_VERSION_MINOR \
-DHAVE_ECC_CDH \
-DWC_RSA_NO_PADDING \
-DECC_USER_CURVES \
-DHAVE_ECC384 \
-DHAVE_ECC521 \
-DWOLFSSL_VALIDATE_FFC_IMPORT \
-DHAVE_FFDHE_Q \
-DHAVE_FFDHE_3072 \
-DHAVE_FFDHE_4096 \
-DHAVE_FFDHE_6144 \
-DHAVE_FFDHE_8192"
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
For KCAPI do not force enable ECC curves, set K or seed callback, disable AES GCM tests with non standard IV.
2022-03-17 14:41:35 -07:00
# KCAPI API does not support custom k for sign, don't force enable ECC key sizes and do not use seed callback
AS_IF([test "x$ENABLED_KCAPI_ECC" = "xno"],
[AM_CFLAGS="$AM_CFLAGS \
-DWC_RNG_SEED_CB \
-DWOLFSSL_ECDSA_SET_K \
Disable the public key check in import private key for KCAPI. Fix type warning in KCAPI AES.
2022-04-01 11:27:17 -07:00
-DWOLFSSL_VALIDATE_ECC_IMPORT \
-DWOLFSSL_VALIDATE_ECC_KEYGEN \
For KCAPI do not force enable ECC curves, set K or seed callback, disable AES GCM tests with non standard IV.
2022-03-17 14:41:35 -07:00
-DHAVE_ECC192 \
-DHAVE_ECC224 \
-DHAVE_ECC256"])
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=8192
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
# force various features to FIPS 140-3 defaults, unless overridden with dev:
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_KEYGEN" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_keygen" != "no")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[ENABLED_KEYGEN="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_COMPKEY" = "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_compkey" != "yes")],
configure.ac and tests/api.c: lock out compkey on FIPS 140-3 RC12 and ready, and add backward-compat code in test_wc_ecc_export_x963_ex() to allow RC12 compkey builds to pass unit.test.
2022-07-06 17:31:56 -05:00
[ENABLED_COMPKEY="no"])
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_SHA224" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_sha224" != "no")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[ENABLED_SHA224="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_WOLFSSH" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_ssh" != "no")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[enable_ssh="yes"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
SHA-3 improvements Add x86_64 assembly code: - BMI2 - AVX2 (using ymm, slower than BMI2) - AVX2 of 4 similtaneous hashes Add SHAKE128 functions and tests. Add Absorb and Squeeze functions for SHAKE128 and SHAK256 and tests. Add doxygen for SHA-3 and SHAKE functions. Update other generated x86_64 assembly files to include settings.h.
2022-09-01 15:07:15 +10:00
# Shake128 is a SHA-3 algorithm not in our FIPS algorithm list
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_SHAKE128" != "no" && (test "$FIPS_VERSION" != "dev" || test "$enable_shake128" != "yes")],
SHA-3 improvements Add x86_64 assembly code: - BMI2 - AVX2 (using ymm, slower than BMI2) - AVX2 of 4 similtaneous hashes Add SHAKE128 functions and tests. Add Absorb and Squeeze functions for SHAKE128 and SHAK256 and tests. Add doxygen for SHA-3 and SHAKE functions. Update other generated x86_64 assembly files to include settings.h.
2022-09-01 15:07:15 +10:00
[ENABLED_SHAKE128=no; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE128"])
FIPS 140-3 1. Change the internal version number for the FIPS 140-3 changes as v4. 2. Insert v3 as an alias for FIPS Ready. 3. Use the correct directory for the FIPS old files sources. (For local testing of 140-3 builds.) 4. Change back the check for the FIPS version in internal.c for EccMakeKey().
2020-10-21 11:58:38 -07:00
# Shake256 is a SHA-3 algorithm not in our FIPS algorithm list
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_SHAKE256" != "no" && (test "$FIPS_VERSION" != "dev" || test "$enable_shake256" != "yes")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[ENABLED_SHAKE256=no; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE256"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
configure.ac and wolfssl/wolfcrypt/types.h: don't change wc_HashType for FIPS <= v2 (reverts commit 56843fbefd as it affected that definition); add -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256 to FIPS v2 and v3.
2021-09-27 20:33:51 -05:00
# SHA512-224 and SHA512-256 are SHA-2 algorithms not in our FIPS algorithm list
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_AESCCM" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_aesccm" != "no")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[ENABLED_AESCCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_RSAPSS" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_rsapss" != "no")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[ENABLED_RSAPSS="yes"; AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_ECC" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_ecc" != "no")],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
[ENABLED_ECC="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_ECC_SHAMIR" = "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_eccshamir" != "no")],
Disable the public key check in import private key for KCAPI. Fix type warning in KCAPI AES.
2022-04-01 11:27:17 -07:00
[AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"])])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_AESCTR" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_aesctr" != "no")],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
[ENABLED_AESCTR="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER"])
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_CMAC" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_cmac" != "no")],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
[ENABLED_CMAC="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC"])
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_HKDF" != "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_hkdf" != "no")],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
[ENABLED_HKDF="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_HKDF"])
AS_IF([test "$ENABLED_INTELASM" = "yes"],
[AM_CFLAGS="$AM_CFLAGS -DFORCE_FAILURE_RDSEED"])
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_SHA512" = "no" && (test "$FIPS_VERSION" != "dev" || test "$enable_sha512" != "no")],
FIPS 140-3 1. Change the internal version number for the FIPS 140-3 changes as v4. 2. Insert v3 as an alias for FIPS Ready. 3. Use the correct directory for the FIPS old files sources. (For local testing of 140-3 builds.) 4. Change back the check for the FIPS version in internal.c for EccMakeKey().
2020-10-21 11:58:38 -07:00
[ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
AS_IF([test "$ENABLED_AESGCM" = "no" && (test "$FIPS_VERSION" != "dev" || test "$enable_aesgcm" != "no")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
configure.ac: fix hard tab.
2022-10-10 16:51:19 -05:00
# AES-GCM streaming isn't part of the current FIPS suite.
configure.ac: when FIPS 140-3, disable AES-GCM streaming API, unless "dev".
2022-10-10 16:37:38 -05:00
AS_IF([test "$ENABLED_AESGCM_STREAM" = "yes" && (test "$FIPS_VERSION" != "dev" || test "$enable_aesgcm_stream" != "yes")],
[ENABLED_AESGCM_STREAM="no"])
Allow using 3DES and MD5 with FIPS 140-3, as they fall outside of the FIPS boundary.
2022-05-19 12:06:20 -07:00
# Old TLS requires MD5 + HMAC, which is not allowed under FIPS 140-3
AS_IF([test "$ENABLED_OLD_TLS" != "no"],
[ENABLED_OLD_TLS="no"; AM_CFLAGS="$AM_CFLAGS -DNO_OLD_TLS"])
Allow DES3 with FIPS v5-dev.
2022-01-24 12:44:57 -08:00
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
AS_IF([test $HAVE_FIPS_VERSION_MINOR -ge 2],
Clean up some FIPS versioning logic in configure.ac and WIN10 user_settings.h. configure.ac: Get rid of v5-RC8, v5-RC9, v5-RC10, v5-RC11, v5-ready, and v5-dev. v5-ready is now just ready and v5-dev just dev. IDE/WIN10/user_settings.h: Make the FIPS blocks define HAVE_FIPS. Change WCv5.0 block to WCv5.0-RC12. Change FIPS Ready block to use HAVE_FIPS_VERSION_MINOR 3 instead of HAVE_FIPS_VERSION_MINOR 2.
2022-09-19 09:39:33 -07:00
[AS_IF([test "x$ENABLED_AESOFB" = "xno" && (test "$FIPS_VERSION" != "dev" || test "$enable_aesofb" != "no")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[ENABLED_AESOFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB"])])
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
configure.ac: in fips v5 setup, consider HAVE_AES{CCM,CTR,GCM,OFB}_PORT when auto-setting -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB; refactor KCAPI options for readability and correctness.
2021-12-16 17:03:01 -06:00
AS_IF([(test "$ENABLED_AESCCM" = "yes" && test "$HAVE_AESCCM_PORT" != "yes") ||
(test "$ENABLED_AESCTR" = "yes" && test "$HAVE_AESCTR_PORT" != "yes") ||
(test "$ENABLED_AESGCM" = "yes" && test "$HAVE_AESGCM_PORT" != "yes") ||
(test "$ENABLED_AESOFB" = "yes" && test "$HAVE_AESOFB_PORT" != "yes")],
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB"])
FIPS 140-3 1. Change the internal version number for the FIPS 140-3 changes as v4. 2. Insert v3 as an alias for FIPS Ready. 3. Use the correct directory for the FIPS old files sources. (For local testing of 140-3 builds.) 4. Change back the check for the FIPS version in internal.c for EccMakeKey().
2020-10-21 11:58:38 -07:00
],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
[v2],[ # FIPS 140-2, Cert 3389
AM_CFLAGS="$AM_CFLAGS \
configure.ac: fix hard tabs, and fix fips "v5-ready" that should have been "v5-dev".
2021-12-16 12:58:44 -06:00
-DHAVE_FIPS \
-DHAVE_FIPS_VERSION=$HAVE_FIPS_VERSION \
-DHAVE_FIPS_VERSION_MINOR=$HAVE_FIPS_VERSION_MINOR \
-DWOLFSSL_KEY_GEN \
-DWOLFSSL_SHA224 \
-DWOLFSSL_AES_DIRECT \
-DHAVE_AES_ECB \
-DHAVE_ECC_CDH \
-DWC_RSA_NO_PADDING \
-DWOLFSSL_VALIDATE_FFC_IMPORT \
-DHAVE_FFDHE_Q \
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
-DHAVE_PUBLIC_FFDHE"
wolfRand In configure.ac, 1. Change some whitespace in the FIPS enable section. 2. Reorganize the FIPS section a little bit. 3. When enabling wolfRand, also force cryptonly. 4. Treat wolfRand like FIPSv2 at build time. In the source include.am, 5. Add checks against BUILD_FIPS_RAND as appropriate. 6. Add the SHA-256 assembly to the wolfRand source list.
2019-06-24 15:40:05 -07:00
ENABLED_KEYGEN="yes"
ENABLED_SHA224="yes"
FIPS 140-3 1. Change the internal version number for the FIPS 140-3 changes as v4. 2. Insert v3 as an alias for FIPS Ready. 3. Use the correct directory for the FIPS old files sources. (For local testing of 140-3 builds.) 4. Change back the check for the FIPS version in internal.c for EccMakeKey().
2020-10-21 11:58:38 -07:00
ENABLED_DES3="yes"
# Shake256 is a SHA-3 algorithm not in our FIPS algorithm list
configure.ac and wolfssl/wolfcrypt/types.h: don't change wc_HashType for FIPS <= v2 (reverts commit 56843fbefd as it affected that definition); add -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256 to FIPS v2 and v3.
2021-09-27 20:33:51 -05:00
ENABLED_SHAKE256=no
# SHA512-224 and SHA512-256 are SHA-2 algorithms not in our FIPS algorithm list
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
wolfRand In configure.ac, 1. Change some whitespace in the FIPS enable section. 2. Reorganize the FIPS section a little bit. 3. When enabling wolfRand, also force cryptonly. 4. Treat wolfRand like FIPSv2 at build time. In the source include.am, 5. Add checks against BUILD_FIPS_RAND as appropriate. 6. Add the SHA-256 assembly to the wolfRand source list.
2019-06-24 15:40:05 -07:00
AS_IF([test "x$ENABLED_AESCCM" != "xyes"],
[ENABLED_AESCCM="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"])
AS_IF([test "x$ENABLED_RSAPSS" != "xyes"],
[ENABLED_RSAPSS="yes"
AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS"])
AS_IF([test "x$ENABLED_ECC" != "xyes"],
[ENABLED_ECC="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256 -DWOLFSSL_VALIDATE_ECC_IMPORT"
AS_IF([test "x$ENABLED_ECC_SHAMIR" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"])],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VALIDATE_ECC_IMPORT"])
AS_IF([test "x$ENABLED_AESCTR" != "xyes"],
[ENABLED_AESCTR="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER"])
AS_IF([test "x$ENABLED_CMAC" != "xyes"],
[ENABLED_CMAC="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC"])
AS_IF([test "x$ENABLED_HKDF" != "xyes"],
[ENABLED_HKDF="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_HKDF"])
AS_IF([test "x$ENABLED_INTELASM" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DFORCE_FAILURE_RDSEED"])
FIPS 140-3 1. Added enable option for FIPS 140-3 in configure script. 2. Modify DES3 source to disallow DES3 for the new option. 3. Added the new constants to fips_test.h. 4. Added some new test functions. 5. Added API for doing the POST. 6. Added a processing state for the CASTs. 7. Delete some unused prototypes from FIPS test API.
2020-10-12 16:06:20 -07:00
AS_IF([test "x$ENABLED_SHA512" = "xno"],
[ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
AS_IF([test "x$ENABLED_AESGCM" = "xno"],
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"])
wolfRand In configure.ac, 1. Change some whitespace in the FIPS enable section. 2. Reorganize the FIPS section a little bit. 3. When enabling wolfRand, also force cryptonly. 4. Treat wolfRand like FIPSv2 at build time. In the source include.am, 5. Add checks against BUILD_FIPS_RAND as appropriate. 6. Add the SHA-256 assembly to the wolfRand source list.
2019-06-24 15:40:05 -07:00
],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
wolfRand In configure.ac, 1. Change some whitespace in the FIPS enable section. 2. Reorganize the FIPS section a little bit. 3. When enabling wolfRand, also force cryptonly. 4. Treat wolfRand like FIPSv2 at build time. In the source include.am, 5. Add checks against BUILD_FIPS_RAND as appropriate. 6. Add the SHA-256 assembly to the wolfRand source list.
2019-06-24 15:40:05 -07:00
["rand"],[
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_FIPS_RAND -DHAVE_FIPS -DHAVE_FIPS_VERSION=$HAVE_FIPS_VERSION -DHAVE_FIPS_VERSION_MINOR=$HAVE_FIPS_VERSION_MINOR"
wolfRand In configure.ac, 1. Change some whitespace in the FIPS enable section. 2. Reorganize the FIPS section a little bit. 3. When enabling wolfRand, also force cryptonly. 4. Treat wolfRand like FIPSv2 at build time. In the source include.am, 5. Add checks against BUILD_FIPS_RAND as appropriate. 6. Add the SHA-256 assembly to the wolfRand source list.
2019-06-24 15:40:05 -07:00
],
configure.ac: fips cleanup: drop flavor keys "v5-REL" (confusing); drop "v3" aka "v3-ready" (no longer buildable); add flavor "v5-dev" aka "dev"; refactor the "v5*" case of the FIPS setup switch to impose feature locks for v5 and v5-ready, but allow feature overrides with the new v5-dev; fix a debugging echo in the v2 case added in 1c27654300.
2021-12-16 00:02:26 -06:00
configure.ac: fixes for --enable-fips logic.
2021-10-26 22:51:59 -05:00
["v1"],[ # FIPS 140-2, Cert 2425
wolfRand In configure.ac, 1. Change some whitespace in the FIPS enable section. 2. Reorganize the FIPS section a little bit. 3. When enabling wolfRand, also force cryptonly. 4. Treat wolfRand like FIPSv2 at build time. In the source include.am, 5. Add checks against BUILD_FIPS_RAND as appropriate. 6. Add the SHA-256 assembly to the wolfRand source list.
2019-06-24 15:40:05 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_FIPS"
FIPS 140-3 1. Added enable option for FIPS 140-3 in configure script. 2. Modify DES3 source to disallow DES3 for the new option. 3. Added the new constants to fips_test.h. 4. Added some new test functions. 5. Added API for doing the POST. 6. Added a processing state for the CASTs. 7. Delete some unused prototypes from FIPS test API.
2020-10-12 16:06:20 -07:00
AS_IF([test "x$ENABLED_SHA512" = "xno"],
[ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
AS_IF([test "x$ENABLED_AESGCM" = "xno"],
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"])
AS_IF([test "x$ENABLED_DES3" = "xno"],[ENABLED_DES3="yes"])
wolfRand In configure.ac, 1. Change some whitespace in the FIPS enable section. 2. Reorganize the FIPS section a little bit. 3. When enabling wolfRand, also force cryptonly. 4. Treat wolfRand like FIPSv2 at build time. In the source include.am, 5. Add checks against BUILD_FIPS_RAND as appropriate. 6. Add the SHA-256 assembly to the wolfRand source list.
2019-06-24 15:40:05 -07:00
])
AS_IF([test "x$ENABLED_FIPS" = "xyes" && test "x$thread_ls_on" = "xno"],
[AC_MSG_ERROR([FIPS requires Thread Local Storage])])
add fips enable switch
2014-03-19 09:43:57 -07:00
add CAVP selftest option for special build
2018-02-22 16:17:08 -07:00
# SELFTEST
AC_ARG_ENABLE([selftest],
[AS_HELP_STRING([--enable-selftest],[Enable selftest, Will NOT work w/o CAVP selftest license (default: disabled)])],
[ ENABLED_SELFTEST=$enableval ],
add selftest version for newer 4.1.0 validation
2020-06-29 15:57:35 -06:00
[ ENABLED_SELFTEST="no" ]
add CAVP selftest option for special build
2018-02-22 16:17:08 -07:00
)
add selftest version for newer 4.1.0 validation
2020-06-29 15:57:35 -06:00
AS_CASE([$ENABLED_SELFTEST],
["v2"],[
# selftest v2 (wolfCrypt 4.1.0)
ENABLED_SELFTEST="yes"
SELFTEST_VERSION="v2"
],
["no"],[SELFTEST_VERSION="none"],
[
# selftest v1 (wolfCrypt 3.14.2)
ENABLED_SELFTEST="yes"
SELFTEST_VERSION="v1"
])
AS_CASE([$SELFTEST_VERSION],
["v2"],[
Cofactor flag in wolfcrypt test needed a guard.
2021-05-06 11:45:40 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_SELFTEST -DHAVE_SELFTEST_VERSION=2 -DHAVE_PUBLIC_FFDHE"
add selftest version for newer 4.1.0 validation
2020-06-29 15:57:35 -06:00
],
["v1"],[
Cofactor flag in wolfcrypt test needed a guard.
2021-05-06 11:45:40 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_SELFTEST -DHAVE_PUBLIC_FFDHE"
add selftest version for newer 4.1.0 validation
2020-06-29 15:57:35 -06:00
])
add CAVP selftest option for special build
2018-02-22 16:17:08 -07:00
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
# Set SHA-3 flags
if test "$ENABLED_SHA3" != "no" && test "$ENABLED_32BIT" = "no"
Restore a configure check lost in a rebase.
2021-02-24 18:47:53 -08:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA3"
fi
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
SHA-3 improvements Add x86_64 assembly code: - BMI2 - AVX2 (using ymm, slower than BMI2) - AVX2 of 4 similtaneous hashes Add SHAKE128 functions and tests. Add Absorb and Squeeze functions for SHAKE128 and SHAK256 and tests. Add doxygen for SHA-3 and SHAKE functions. Update other generated x86_64 assembly files to include settings.h.
2022-09-01 15:07:15 +10:00
# Set SHAKE128 flags
# FIPS does not support SHAKE 128
AS_IF([test "x$ENABLED_FIPS" = "xyes"],[ENABLED_SHAKE128="no"])
if test "$ENABLED_SHAKE128" != "no" && test "$ENABLED_32BIT" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHAKE128"
if test "$ENABLED_SHA3" = "no"
then
AC_MSG_ERROR([Must have SHA-3 enabled: --enable-sha3])
fi
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE128"
fi
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
# Set SHAKE256 flags
# FIPS does not support SHAKE 256
Fix a bad assignment in the configure script.
2020-12-04 10:42:28 -08:00
AS_IF([test "x$ENABLED_FIPS" = "xyes"],[ENABLED_SHAKE256="no"])
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
if test "$ENABLED_SHAKE256" != "no" && test "$ENABLED_32BIT" = "no"
Fix a bad assignment in the configure script.
2020-12-04 10:42:28 -08:00
then
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHAKE256"
if test "$ENABLED_SHA3" = "no"
Fix a bad assignment in the configure script.
2020-12-04 10:42:28 -08:00
then
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
AC_MSG_ERROR([Must have SHA-3 enabled: --enable-sha3])
Fix a bad assignment in the configure script.
2020-12-04 10:42:28 -08:00
fi
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE256"
Fix a bad assignment in the configure script.
2020-12-04 10:42:28 -08:00
fi
FIPS 140-3 1. Added enable option for FIPS 140-3 in configure script. 2. Modify DES3 source to disallow DES3 for the new option. 3. Added the new constants to fips_test.h. 4. Added some new test functions. 5. Added API for doing the POST. 6. Added a processing state for the CASTs. 7. Delete some unused prototypes from FIPS test API.
2020-10-12 16:06:20 -07:00
# set POLY1305 default
POLY1305_DEFAULT=yes
if test "x$ENABLED_FIPS" = "xyes"
then
POLY1305_DEFAULT=no
fi
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
# POLY1305
AC_ARG_ENABLE([poly1305],
[AS_HELP_STRING([--enable-poly1305],[Enable wolfSSL POLY1305 support (default: enabled)])],
[ ENABLED_POLY1305=$enableval ],
[ ENABLED_POLY1305=$POLY1305_DEFAULT]
)
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# leanpsk and leantls don't need poly1305
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
then
ENABLED_POLY1305=no
fi
Removes the forced 32-bit instruction (via `-m32`) from `--enable-32bit` option and replaces with comment. Some compilers do not support the `-m32` option, plus to work properly it must be used with configure directly like `./configure CFLAGS="-m32" LDFLAGS="-m32"`. Removes the `NO_64BIT` option to allow building corect on x86_64 and aarch64 (math libs detect platform properly). Fixes #1985.
2018-12-23 15:59:57 -08:00
if test "$ENABLED_POLY1305" = "yes"
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
then
Address peer feedback
2022-04-08 10:12:24 -06:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_POLY1305"
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
fi
# set CHACHA default
CHACHA_DEFAULT=yes
if test "x$ENABLED_FIPS" = "xyes"
then
CHACHA_DEFAULT=no
fi
# CHACHA
AC_ARG_ENABLE([chacha],
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
[AS_HELP_STRING([--enable-chacha],[Enable CHACHA (default: enabled). Use `=noasm` to disable ASM AVX/AVX2 speedups])],
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
[ ENABLED_CHACHA=$enableval ],
[ ENABLED_CHACHA=$CHACHA_DEFAULT]
)
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
# leanpsk and leantls don't need chacha
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
then
ENABLED_CHACHA=no
fi
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
if test "$ENABLED_CHACHA" = "noasm" || test "$ENABLED_ASM" = "no"
then
Regression test fixes ./configure --enable-all --disable-rsa ./configure --disable-chacha --disable-asm ./configure --disable-rsa --disable-ecc --disable-dh --enable-curve25519 --enable-cryptonly (and ed25519, curve448, ed448) ./configure --disable-tls13 --enable-psk --disable-rsa --disable-ecc --disable-dh C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK ./configure --disable-oldtls --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding Various build combinations with WOLFSSL_SP_MATH and WOLFSSL_SP_MATH_ALL
2021-06-23 21:25:27 +10:00
AM_CFLAGS="$AM_CFLAGS -DNO_CHACHA_ASM"
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
fi
Regression test fixes ./configure --enable-all --disable-rsa ./configure --disable-chacha --disable-asm ./configure --disable-rsa --disable-ecc --disable-dh --enable-curve25519 --enable-cryptonly (and ed25519, curve448, ed448) ./configure --disable-tls13 --enable-psk --disable-rsa --disable-ecc --disable-dh C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK ./configure --disable-oldtls --enable-psk -disable-rsa --disable-dh -disable-ecc --disable-asn C_EXTRA_FLAGS=-DWOLFSSL_STATIC_PSK --enable-lowresource --enable-singlethreaded --disable-asm --disable-errorstrings --disable-pkcs12 --disable-sha3 --disable-sha224 --disable-sha384 --disable-sha512 --disable-sha --disable-md5 -disable-aescbc --disable-chacha --disable-poly1305 --disable-coding Various build combinations with WOLFSSL_SP_MATH and WOLFSSL_SP_MATH_ALL
2021-06-23 21:25:27 +10:00
if test "$ENABLED_CHACHA" != "no"
remove poly/chacha from fips build
2015-04-12 11:01:16 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_CHACHA"
fi
add wc_XChaCha_init(), wc_XChaCha20Poly1305_Init(), wc_XChaCha20Poly1305_encrypt_oneshot(), wc_XChaCha20Poly1305_decrypt_oneshot(), and wc_Poly1305_EncodeSizes64(). also, remove redundant arg check (typo) in wc_Poly1305Update().
2020-10-01 12:21:38 -05:00
# XCHACHA
AC_ARG_ENABLE([xchacha],
[AS_HELP_STRING([--enable-xchacha],[Enable XCHACHA (default: disabled).])],
[ ENABLED_XCHACHA=$enableval ],
[ ENABLED_XCHACHA=no]
)
if test "$ENABLED_XCHACHA" = "yes"
then
if test "$ENABLED_CHACHA" = "no"
then
AC_MSG_ERROR([XChaCha (--enable-xchacha) depends on ChaCha (--enable-chacha)])
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_XCHACHA"
fi
added Hash DRBG as configure option
2014-05-07 11:54:12 -07:00
# Hash DRBG
AC_ARG_ENABLE([hashdrbg],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-hashdrbg],[Enable Hash DRBG support (default: enabled)])],
added Hash DRBG as configure option
2014-05-07 11:54:12 -07:00
[ ENABLED_HASHDRBG=$enableval ],
make HASH-DRBG default RNG w/ autoconf
2014-12-01 09:12:26 -08:00
[ ENABLED_HASHDRBG=yes ]
added Hash DRBG as configure option
2014-05-07 11:54:12 -07:00
)
if test "x$ENABLED_HASHDRBG" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_HASHDRBG"
else
Allow disabling DRBG with KCAPI. Add KCAPI `/dev/hwrng` support.
2022-03-17 14:42:23 -07:00
# turn on Hash DRBG if FIPS is on (don't force on for KCAPI)
if test "x$ENABLED_FIPS" = "xyes" && test "x$ENABLED_KCAPI" = "xno"
added Hash DRBG as configure option
2014-05-07 11:54:12 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_HASHDRBG"
ENABLED_HASHDRBG=yes
Retain existing HAVE_HASHDRBG functionality and only disable if ./configure --disable-hashdrbg or WC_NO_HASHDRBG defined. Fix use of warning with VS. Fix to only use rng seed as source if no DRBG.
2017-03-17 13:44:53 -07:00
else
AM_CFLAGS="$AM_CFLAGS -DWC_NO_HASHDRBG"
added Hash DRBG as configure option
2014-05-07 11:54:12 -07:00
fi
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Filesystem Build
configure.ac: move AC_ARG_ENABLE([linuxkm] before AC_ARG_ENABLE([filesystem], and add ENABLED_FILESYSTEM_DEFAULT=no when ENABLED_LINUXKM.
2020-09-17 22:15:58 -05:00
if test "$ENABLED_LINUXKM" = "yes"
then
ENABLED_FILESYSTEM_DEFAULT=no
else
ENABLED_FILESYSTEM_DEFAULT=yes
fi
switch --enable-noFilesystem to --enable-filesystem / --disable-filesystem to match others
2013-03-13 12:14:05 -07:00
AC_ARG_ENABLE([filesystem],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-filesystem],[Enable Filesystem support (default: enabled)])],
switch --enable-noFilesystem to --enable-filesystem / --disable-filesystem to match others
2013-03-13 12:14:05 -07:00
[ ENABLED_FILESYSTEM=$enableval ],
configure.ac: move AC_ARG_ENABLE([linuxkm] before AC_ARG_ENABLE([filesystem], and add ENABLED_FILESYSTEM_DEFAULT=no when ENABLED_LINUXKM.
2020-09-17 22:15:58 -05:00
[ ENABLED_FILESYSTEM=$ENABLED_FILESYSTEM_DEFAULT ]
move ProcessChainBufer out of filesystem only, add configure option for noFilesystem
2011-06-30 10:07:49 -07:00
)
switch --enable-noFilesystem to --enable-filesystem / --disable-filesystem to match others
2013-03-13 12:14:05 -07:00
if test "$ENABLED_FILESYSTEM" = "no"
move ProcessChainBufer out of filesystem only, add configure option for noFilesystem
2011-06-30 10:07:49 -07:00
then
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AM_CFLAGS="$AM_CFLAGS -DNO_FILESYSTEM"
switch --enable-noFilesystem to --enable-filesystem / --disable-filesystem to match others
2013-03-13 12:14:05 -07:00
else
# turn off filesystem if leanpsk on
configure.ac: move AC_ARG_ENABLE([linuxkm] before AC_ARG_ENABLE([filesystem], and add ENABLED_FILESYSTEM_DEFAULT=no when ENABLED_LINUXKM.
2020-09-17 22:15:58 -05:00
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LINUXKM" = "yes"
switch --enable-noFilesystem to --enable-filesystem / --disable-filesystem to match others
2013-03-13 12:14:05 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DNO_FILESYSTEM"
ENABLED_FILESYSTEM=no
fi
move ProcessChainBufer out of filesystem only, add configure option for noFilesystem
2011-06-30 10:07:49 -07:00
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# inline Build
switch --enable-noInline to enable/disable-inline to match all others
2013-03-13 12:25:34 -07:00
AC_ARG_ENABLE([inline],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-inline],[Enable inline functions (default: enabled)])],
switch --enable-noInline to enable/disable-inline to match all others
2013-03-13 12:25:34 -07:00
[ ENABLED_INLINE=$enableval ],
[ ENABLED_INLINE=yes ]
add --enable-noInline option for easier testing of it
2011-08-03 10:59:08 -07:00
)
switch --enable-noInline to enable/disable-inline to match all others
2013-03-13 12:25:34 -07:00
if test "$ENABLED_INLINE" = "no"
add --enable-noInline option for easier testing of it
2011-08-03 10:59:08 -07:00
then
add ssl bump configure option
2011-08-25 11:41:14 -07:00
AM_CFLAGS="$AM_CFLAGS -DNO_INLINE"
add --enable-noInline option for easier testing of it
2011-08-03 10:59:08 -07:00
fi
detect configure time build mismatches
2011-06-07 09:02:36 -07:00
Revert "fixes ocsp dependency check on asn during configure." This reverts commit 46ade8f03ff2a53a710beacc438f875dd3610969.
2016-02-23 14:13:52 -03:00
# OCSP
build updates for lighttpd Update configure.ac and various #ifdefs to enable WolfSSL to build features for use by lighttpd. Change signature of wolfSSL_GetVersion() to take const arg. Pass (const WOLFSSL*) to wolfSSL_GetVersion() for use with SSL_CTX_set_info_callback(), where OpenSSL callback takes (const SSL *)
2020-07-01 23:19:13 -04:00
if test "x$ENABLED_OPENSSLALL" = "xyes" || test "x$ENABLED_NGINX" = "xyes" || test "x$ENABLED_LIGHTY" = "xyes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
then
Fixes for edge case builds with openssl all. Improvements to the `test_wolfSSL_PKCS8_d2i`. Allow forceful disable of OCSP with `./configure --enable-opensslall --disable-ocsp`.
2021-07-28 09:55:53 -07:00
test "$enable_ocsp" = "" && enable_ocsp=yes
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
fi
Fixes for edge case builds with openssl all. Improvements to the `test_wolfSSL_PKCS8_d2i`. Allow forceful disable of OCSP with `./configure --enable-opensslall --disable-ocsp`.
2021-07-28 09:55:53 -07:00
AC_ARG_ENABLE([ocsp],
[AS_HELP_STRING([--enable-ocsp],[Enable OCSP (default: disabled)])],
[ ENABLED_OCSP=$enableval ],
[ ENABLED_OCSP=no ]
)
Revert "fixes ocsp dependency check on asn during configure." This reverts commit 46ade8f03ff2a53a710beacc438f875dd3610969.
2016-02-23 14:13:52 -03:00
if test "$ENABLED_OCSP" = "yes"
then
# check openssl command tool for testing ocsp
AC_CHECK_PROG([HAVE_OPENSSL_CMD],[openssl],[yes],[no])
if test "$HAVE_OPENSSL_CMD" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_OPENSSL_CMD"
else
AC_MSG_WARN([openssl command line tool not available for testing ocsp])
fi
fi
cosmetic changes to OCSP Stapling options.
2015-12-30 17:10:25 -03:00
# Certificate Status Request : a.k.a. OCSP Stapling
AC_ARG_ENABLE([ocspstapling],
[AS_HELP_STRING([--enable-ocspstapling],[Enable OCSP Stapling (default: disabled)])],
[ ENABLED_CERTIFICATE_STATUS_REQUEST=$enableval ],
[ ENABLED_CERTIFICATE_STATUS_REQUEST=no ]
)
build updates for lighttpd Update configure.ac and various #ifdefs to enable WolfSSL to build features for use by lighttpd. Change signature of wolfSSL_GetVersion() to take const arg. Pass (const WOLFSSL*) to wolfSSL_GetVersion() for use with SSL_CTX_set_info_callback(), where OpenSSL callback takes (const SSL *)
2020-07-01 23:19:13 -04:00
if test "x$ENABLED_NGINX" = "xyes" || test "x$ENABLED_WPAS" = "xyes" || test "x$ENABLED_HAPROXY" = "xyes" || test "x$ENABLED_LIGHTY" = "xyes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
then
Grouped HAPROXY compatibility into WOLFSSL_HAPROXY flag now haproxy compatible wolfssl builds with: ./configure --prefix=/usr --sysconfdir=/etc --disable-fastmath \ iam * ] 2:18 PM --disable-fasthugemath --disable-bump \ --enable-opensslextra \ --enable-keygen --enable-certgen \ --disable-ntru --disable-examples \ --enable-tlsx --enable-haproxy \ --enable-savecert --enable-savesession --enable-sessioncerts \ --enable-webserver --enable-sslv3 --enable-stunnel
2017-04-11 14:18:41 +02:00
ENABLED_CERTIFICATE_STATUS_REQUEST="yes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
fi
cosmetic changes to OCSP Stapling options.
2015-12-30 17:10:25 -03:00
if test "x$ENABLED_CERTIFICATE_STATUS_REQUEST" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_CERTIFICATE_STATUS_REQUEST"
Revert "fixes ocsp dependency check on asn during configure." This reverts commit 46ade8f03ff2a53a710beacc438f875dd3610969.
2016-02-23 14:13:52 -03:00
# Requires OCSP make sure on
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
cosmetic changes to OCSP Stapling options.
2015-12-30 17:10:25 -03:00
fi
# Certificate Status Request v2 : a.k.a. OCSP stapling v2
AC_ARG_ENABLE([ocspstapling2],
[AS_HELP_STRING([--enable-ocspstapling2],[Enable OCSP Stapling v2 (default: disabled)])],
[ ENABLED_CERTIFICATE_STATUS_REQUEST_V2=$enableval ],
[ ENABLED_CERTIFICATE_STATUS_REQUEST_V2=no ]
)
build updates for lighttpd Update configure.ac and various #ifdefs to enable WolfSSL to build features for use by lighttpd. Change signature of wolfSSL_GetVersion() to take const arg. Pass (const WOLFSSL*) to wolfSSL_GetVersion() for use with SSL_CTX_set_info_callback(), where OpenSSL callback takes (const SSL *)
2020-07-01 23:19:13 -04:00
if test "x$ENABLED_NGINX" = "xyes" || test "x$ENABLED_WPAS" = "xyes" || test "x$ENABLED_HAPROXY" = "xyes" || test "x$ENABLED_LIGHTY" = "xyes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
then
ENABLED_CERTIFICATE_STATUS_REQUEST_V2=yes
fi
cosmetic changes to OCSP Stapling options.
2015-12-30 17:10:25 -03:00
if test "x$ENABLED_CERTIFICATE_STATUS_REQUEST_V2" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_CERTIFICATE_STATUS_REQUEST_V2"
Revert "fixes ocsp dependency check on asn during configure." This reverts commit 46ade8f03ff2a53a710beacc438f875dd3610969.
2016-02-23 14:13:52 -03:00
# Requires OCSP make sure on
if test "x$ENABLED_OCSP" = "xno"
cosmetic changes to OCSP Stapling options.
2015-12-30 17:10:25 -03:00
then
Revert "fixes ocsp dependency check on asn during configure." This reverts commit 46ade8f03ff2a53a710beacc438f875dd3610969.
2016-02-23 14:13:52 -03:00
ENABLED_OCSP="yes"
cosmetic changes to OCSP Stapling options.
2015-12-30 17:10:25 -03:00
fi
fi
crl script initialize
2015-07-21 13:56:47 -06:00
# CRL
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([crl],
Improve CRL error codes. Add `--enable-crl=io` option. ZD 12791
2021-08-24 11:12:12 -07:00
[AS_HELP_STRING([--enable-crl],[Enable CRL (Use =io for inline CRL HTTP GET) (default: disabled)])],
init crl
2012-05-11 12:22:16 -07:00
[ ENABLED_CRL=$enableval ],
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
[ ENABLED_CRL=no ]
init crl
2012-05-11 12:22:16 -07:00
)
Improve CRL error codes. Add `--enable-crl=io` option. ZD 12791
2021-08-24 11:12:12 -07:00
if test "x$ENABLED_NGINX" = "xyes" || test "x$ENABLED_HAPROXY" = "xyes" || test "x$ENABLED_OPENVPN" = "xyes" || \
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
test "x$ENABLED_WPAS" != "xno" || test "x$ENABLED_LIGHTY" = "xyes" || test "x$ENABLED_NETSNMP" = "xyes" || \
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
test "x$ENABLED_KRB" = "xyes" || test "x$ENABLED_STRONGSWAN" = "xyes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
then
ENABLED_CRL=yes
fi
Improve CRL error codes. Add `--enable-crl=io` option. ZD 12791
2021-08-24 11:12:12 -07:00
if test "$ENABLED_CRL" != "no"
init crl
2012-05-11 12:22:16 -07:00
then
have separate --enable-crl-monitor
2012-06-05 11:31:00 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL"
init crl
2012-05-11 12:22:16 -07:00
fi
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
if test "$ENABLED_CRL" = "io"
Improve CRL error codes. Add `--enable-crl=io` option. ZD 12791
2021-08-24 11:12:12 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL_IO"
fi
init crl
2012-05-11 12:22:16 -07:00
have separate --enable-crl-monitor
2012-06-05 11:31:00 -07:00
# CRL Monitor
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([crl-monitor],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-crl-monitor],[Enable CRL Monitor (default: disabled)])],
have separate --enable-crl-monitor
2012-06-05 11:31:00 -07:00
[ ENABLED_CRL_MONITOR=$enableval ],
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
[ ENABLED_CRL_MONITOR=no ]
have separate --enable-crl-monitor
2012-06-05 11:31:00 -07:00
)
if test "$ENABLED_CRL_MONITOR" = "yes"
then
fix ipv6 unused warning, add os check for crl monitor
2012-11-16 10:47:13 -08:00
case $host_os in
add freebsd crl-monitor support
2012-11-16 13:25:45 -08:00
*linux* | *darwin* | *freebsd*)
Fix to disable CRL monitor for single threaded or lighttpd. Do not set `--enable-lighty` with `--enable-all`.
2020-07-31 09:20:39 -07:00
if test "x$ENABLED_SINGLETHREADED" = "xno"; then
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL_MONITOR"
else
ENABLED_CRL_MONITOR="no"
AC_MSG_ERROR([crl monitor requires threading / pthread])
fi
;;
fix ipv6 unused warning, add os check for crl monitor
2012-11-16 10:47:13 -08:00
*)
Fixes for building with CRL monitor when not linux, OS X or FreeBSD and --enable-distro set. Cleanup of the crl.c HAVE_CRL_MONITOR checks for OS and make sure if StopMonitor preprocessor is defined the function will also be defined.
2016-12-07 07:07:27 -08:00
if test "x$ENABLED_DISTRO" = "xyes" ; then
ENABLED_CRL_MONITOR="no"
else
AC_MSG_ERROR( [crl monitor only allowed on linux, OS X, or freebsd])
fi
break;;
fix ipv6 unused warning, add os check for crl monitor
2012-11-16 10:47:13 -08:00
esac
have separate --enable-crl-monitor
2012-06-05 11:31:00 -07:00
fi
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
# USER CRYPTO
ENABLED_USER_CRYPTO="no"
ENABLED_USER_RSA="no"
AC_DEFINE([BUILD_USER_RSA], [], [User RSA is being defined])
trycryptodir=""
AC_ARG_WITH([user-crypto],
[AS_HELP_STRING([--with-user-crypto=PATH],[Path to USER_CRYPTO install (default /usr/local)])],
[
CPPFLAGS="$CPPFLAGS -DHAVE_USER_CRYPTO"
LIBS="$LIBS -lusercrypto"
if test "x$withval" != "xno" ; then
trycryptodir=$withval
fi
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$withval" = "xyes" ; then
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
trycryptodir="/usr/local"
fi
LDFLAGS="$LDFLAGS -L$trycryptodir/lib"
CPPFLAGS="$CPPFLAGS -I$trycryptodir/include"
#Look for RSA Init function in usercrypto lib
AC_CHECK_LIB([usercrypto], [wc_InitRsaKey], [user_rsa_linked=yes], [user_rsa_linked=no])
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$user_rsa_linked" = "xyes" ; then
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
AC_MSG_NOTICE([User user_rsa.h being used])
AM_CFLAGS="$AM_CFLAGS -DHAVE_USER_RSA"
ENABLED_USER_RSA=yes
ENABLED_USER_CRYPTO=yes
fi
#Display check and find result of link attempts
AC_MSG_CHECKING([for USER_CRYPTO])
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$ENABLED_USER_CRYPTO" = "xno" ; then
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
AC_MSG_RESULT([no])
AC_MSG_ERROR([USER_CRYPTO not found. Either move to /usr/include and /usr/lib or
Specify its path using --with-user-crypto=/dir/])
else
AC_MSG_RESULT([yes])
# Check if .la is available if not then rely on exported path
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
if test -e $trycryptodir/lib/libusercrypto.la
then
LIB_ADD="$trycryptodir/lib/libusercrypto.la $LIB_ADD"
else
LIB_ADD="-lusercrypto $LIB_ADD"
fi
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
AM_LDFLAGS="$AM_LDFLAGS -L$trycryptodir/lib"
AM_CFLAGS="$AM_CFLAGS -DHAVE_USER_CRYPTO"
fi
]
)
if test "$ENABLED_USER_CRYPTO" = "yes" && test "$ENABLED_FIPS" = "yes"
then
AC_MSG_ERROR([cannot enable user crypto and fips, user crypto posibility of using code in fips boundary.])
fi
add Whitewood netRandom client library support
2016-05-05 15:31:25 -06:00
# Whitewood netRandom client library
ENABLED_WNR="no"
trywnrdir=""
AC_ARG_WITH([wnr],
[AS_HELP_STRING([--with-wnr=PATH],[Path to Whitewood netRandom install (default /usr/local)])],
[
AC_MSG_CHECKING([for Whitewood netRandom])
CPPFLAGS="$CPPFLAGS -DHAVE_WNR"
LIBS="$LIBS -lwnr"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <wnr.h>]], [[ wnr_setup(0, 0); ]])], [ wnr_linked=yes ],[ wnr_linked=no ])
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$wnr_linked" = "xno" ; then
add Whitewood netRandom client library support
2016-05-05 15:31:25 -06:00
if test "x$withval" != "xno" ; then
trywnrdir=$withval
fi
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$withval" = "xyes" ; then
add Whitewood netRandom client library support
2016-05-05 15:31:25 -06:00
trywnrdir="/usr/local"
fi
LDFLAGS="$AM_LDFLAGS $LDFLAGS -L$trywnrdir/lib"
CPPFLAGS="$CPPFLAGS -I$trywnrdir/include"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <wnr.h>]], [[ wnr_setup(0, 0); ]])], [ wnr_linked=yes ],[ wnr_linked=no ])
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$wnr_linked" = "xno" ; then
add Whitewood netRandom client library support
2016-05-05 15:31:25 -06:00
AC_MSG_ERROR([Whitewood netRandom isn't found.
If it's already installed, specify its path using --with-wnr=/dir/])
fi
AC_MSG_RESULT([yes])
AM_LDFLAGS="$AM_LDFLAGS -L$trywnrdir/lib"
else
AC_MSG_RESULT([yes])
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_WNR"
ENABLED_WNR="yes"
]
)
merge in sni
2013-05-21 14:37:50 -07:00
# SNI
AC_ARG_ENABLE([sni],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-sni],[Enable SNI (default: disabled)])],
merge in sni
2013-05-21 14:37:50 -07:00
[ ENABLED_SNI=$enableval ],
[ ENABLED_SNI=no ]
)
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
if test "x$ENABLED_QT" = "xyes"
then
ENABLED_SNI="yes"
fi
merge in sni
2013-05-21 14:37:50 -07:00
add QUIC support.
2022-08-08 13:24:00 +02:00
if test "$ENABLED_QUIC" = "yes"
then
ENABLED_SNI=yes
fi
merge in sni
2013-05-21 14:37:50 -07:00
if test "x$ENABLED_SNI" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SNI"
fi
added: - max fragment length extension; - CyaSSL_SNI_GetRequest() to get client's request at server side; - Automated tests for SNI;
2013-06-19 15:45:06 -03:00
# Maximum Fragment Length
AC_ARG_ENABLE([maxfragment],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-maxfragment],[Enable Maximum Fragment Length (default: disabled)])],
added: - max fragment length extension; - CyaSSL_SNI_GetRequest() to get client's request at server side; - Automated tests for SNI;
2013-06-19 15:45:06 -03:00
[ ENABLED_MAX_FRAGMENT=$enableval ],
[ ENABLED_MAX_FRAGMENT=no ]
)
fix alpn example client merge command options
2015-10-13 15:00:53 -07:00
# ALPN
AC_ARG_ENABLE([alpn],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-alpn],[Enable ALPN (default: disabled)])],
fix alpn example client merge command options
2015-10-13 15:00:53 -07:00
[ ENABLED_ALPN=$enableval ],
[ ENABLED_ALPN=no ]
)
Whitespace fix.
2022-03-24 10:19:28 -07:00
bind 9.18.0 fixes - return `1` from `wolfSSL_BIO_set_mem_eof_return` instead of `0` for success - bind requires ALPN - `OPENSSL_COMPATIBLE_DEFAULT` defined for bind - `WOLFSSL_ERROR_CODE_OPENSSL` defined when using compatibility layer - return `bio->eof` on no pending data to read in memory BIO (defaults to `WOLFSSL_BIO_ERROR`) - `flags` is no longer an input parameter in `wolfSSL_ERR_get_error_line_data` - allow lazy parameter loading in `wolfSSL_DH_set0_key` - implement reference counter in `WOLFSSL_EC_KEY` - load serial number from `x509->serialNumber` if `x509->serial` is empty
2022-03-11 19:57:54 +01:00
if test "$ENABLED_BIND" = "yes"
then
ENABLED_ALPN=yes
fi
fix alpn example client merge command options
2015-10-13 15:00:53 -07:00
add QUIC support.
2022-08-08 13:24:00 +02:00
if test "$ENABLED_QUIC" = "yes"
then
ENABLED_ALPN=yes
fi
fix alpn example client merge command options
2015-10-13 15:00:53 -07:00
if test "x$ENABLED_ALPN" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_ALPN"
fi
# Maximum Fragment Length
added: - max fragment length extension; - CyaSSL_SNI_GetRequest() to get client's request at server side; - Automated tests for SNI;
2013-06-19 15:45:06 -03:00
if test "x$ENABLED_MAX_FRAGMENT" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_MAX_FRAGMENT"
fi
Trusted CA Key Indication Extension Added an API for enabling the Trusted CA Key Indication extension from RFC6066 section 6. If the server doesn't have a match for the client, the client will abandon the session.
2018-09-28 09:05:59 -07:00
# Trusted CA Indication Extension
AC_ARG_ENABLE([trustedca],
[AS_HELP_STRING([--enable-trustedca],[Enable Trusted CA Indication (default: disabled)])],
[ ENABLED_TRUSTED_CA=$enableval ],[ ENABLED_TRUSTED_CA=no ])
AS_IF([test "x$ENABLED_TRUSTED_CA" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_TRUSTED_CA"])
Truncated HMAC first part (protocol). Extension processing will be coded later.
2013-07-23 15:42:43 -03:00
# Truncated HMAC
AC_ARG_ENABLE([truncatedhmac],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-truncatedhmac],[Enable Truncated HMAC (default: disabled)])],
Truncated HMAC first part (protocol). Extension processing will be coded later.
2013-07-23 15:42:43 -03:00
[ ENABLED_TRUNCATED_HMAC=$enableval ],
[ ENABLED_TRUNCATED_HMAC=no ]
)
if test "x$ENABLED_TRUNCATED_HMAC" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_TRUNCATED_HMAC"
fi
Renames TLSX_Append to TLSX_Push, adding data param and making sure the list doesn't holds duplicate extensions. Adds SecureRenegotiation functions
2014-09-16 20:33:17 -03:00
# Renegotiation Indication - (FAKE Secure Renegotiation)
tls13: fix to not send RENEGOTIATION_INFO ext Introduced in PR #4742 to enable sending of extension in TLS1.2 without fully supporting secure renegotiation in accordance with RFC 5746 4.3 https://datatracker.ietf.org/doc/html/rfc5746#section-4.3
2022-02-17 10:55:51 -08:00
# Client will send TLS_EMPTY_RENEGOTIATION_INFO_SCSV, not supported
# with enabling secure renegotiation
added renegotiation indication SCSV sending on client hello.
2014-01-21 11:36:06 -03:00
AC_ARG_ENABLE([renegotiation-indication],
tls13: fix to not send RENEGOTIATION_INFO ext Introduced in PR #4742 to enable sending of extension in TLS1.2 without fully supporting secure renegotiation in accordance with RFC 5746 4.3 https://datatracker.ietf.org/doc/html/rfc5746#section-4.3
2022-02-17 10:55:51 -08:00
[AS_HELP_STRING([--enable-renegotiation-indication],[Enable Renegotiation Indication for client via empty cipher (default: disabled)])],
added renegotiation indication SCSV sending on client hello.
2014-01-21 11:36:06 -03:00
[ ENABLED_RENEGOTIATION_INDICATION=$enableval ],
[ ENABLED_RENEGOTIATION_INDICATION=no ]
)
if test "x$ENABLED_RENEGOTIATION_INDICATION" = "xyes"
then
fix hello_request processing w/ mac-verify at upper layer
2014-09-05 14:29:18 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_RENEGOTIATION_INDICATION"
added renegotiation indication SCSV sending on client hello.
2014-01-21 11:36:06 -03:00
fi
Renames TLSX_Append to TLSX_Push, adding data param and making sure the list doesn't holds duplicate extensions. Adds SecureRenegotiation functions
2014-09-16 20:33:17 -03:00
# Secure Renegotiation
AC_ARG_ENABLE([secure-renegotiation],
cleanup some configure help text
2015-03-12 12:25:39 -07:00
[AS_HELP_STRING([--enable-secure-renegotiation],[Enable Secure Renegotiation (default: disabled)])],
Renames TLSX_Append to TLSX_Push, adding data param and making sure the list doesn't holds duplicate extensions. Adds SecureRenegotiation functions
2014-09-16 20:33:17 -03:00
[ ENABLED_SECURE_RENEGOTIATION=$enableval ],
[ ENABLED_SECURE_RENEGOTIATION=no ]
)
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
if test "x$ENABLED_HAPROXY" = "xyes"
then
ENABLED_SECURE_RENEGOTIATION=yes
fi
Renames TLSX_Append to TLSX_Push, adding data param and making sure the list doesn't holds duplicate extensions. Adds SecureRenegotiation functions
2014-09-16 20:33:17 -03:00
if test "x$ENABLED_SECURE_RENEGOTIATION" = "xyes"
then
don't allow scr and fake indication together
2014-10-02 10:18:11 -07:00
if test "x$ENABLED_RENEGOTIATION_INDICATION" = "xyes"
then
AC_MSG_ERROR([cannot enable renegotiation-indication and secure-renegotiation.])
fi
Server Side Secure Renegotiation 1. Add the server side renegotiation flag to the secure renegotiation option. 2. Changed the AddEmptyNegotiationInfo so it doesn't create an extension, just adds a reply if SCR is enabled. 3. Fix the server's reaction to the client sending the SCR extension.
2018-11-27 17:33:49 -08:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SECURE_RENEGOTIATION -DHAVE_SERVER_RENEGOTIATION_INFO"
Renames TLSX_Append to TLSX_Push, adding data param and making sure the list doesn't holds duplicate extensions. Adds SecureRenegotiation functions
2014-09-16 20:33:17 -03:00
fi
TLS: Default secure renegotiation compatability By default this change will have servers send the renegotiation info extension, but not allow renegotiation. This is accordance with RFC 5746 From to RFC 5746: > In order to enable clients to probe, even servers that do not support > renegotiation MUST implement the minimal version of the extension > described in this document for initial handshakes, thus signaling > that they have been upgraded. With openSSL 3.0 the default it not allow connections to servers without secure renegotiation extension. See https://github.com/openssl/openssl/pull/15127
2022-01-10 15:55:37 -08:00
# Secure Renegotiation Info
AC_ARG_ENABLE([secure-renegotiation-info],
[AS_HELP_STRING([--enable-secure-renegotiation-info],[Enable Secure Renegotiation info extension (default: enabled)])],
[ ENABLED_SECURE_RENEGOTIATION_INFO=$enableval ],
[ ENABLED_SECURE_RENEGOTIATION_INFO=yes ]
)
Fallback SCSV (Signaling Cipher Suite Value) support on Server only
2019-06-28 15:30:35 +10:00
# Fallback SCSV
AC_ARG_ENABLE([fallback-scsv],
[AS_HELP_STRING([--enable-fallback-scsv],[Enable Fallback SCSV (default: disabled)])],
[ ENABLED_FALLBACK_SCSV=$enableval ],
[ ENABLED_FALLBACK_SCSV=no ]
)
if test "x$ENABLED_FALLBACK_SCSV" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_FALLBACK_SCSV"
fi
Implement RFC 5705: Keying Material Exporters for TLS
2020-11-10 17:50:45 +01:00
# Exporting Keying Material
AC_ARG_ENABLE([keying-material],
[AS_HELP_STRING([--enable-keying-material],[Enable Keying Material Exporters (default: disabled)])],
[ ENABLED_KEYING_MATERIAL=$enableval ],
[ ENABLED_KEYING_MATERIAL=no ]
)
Add --enable-chrony configure option. This turns on the necessary features for using the chrony NTP package with wolfSSL.
2022-01-18 22:02:50 -08:00
if test "$ENABLED_CHRONY" = "yes"
then
ENABLED_KEYING_MATERIAL=yes
fi
Implement RFC 5705: Keying Material Exporters for TLS
2020-11-10 17:50:45 +01:00
if test "x$ENABLED_KEYING_MATERIAL" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_KEYING_MATERIAL"
fi
Renaming Elliptic Curves to Supported Curves for better extension representation and avoid confusion.
2014-02-03 16:11:57 -03:00
# Supported Elliptic Curves Extensions
AC_ARG_ENABLE([supportedcurves],
1. Enable the extension ECC Supported Curves by default. 2. Force the extention disabled if ECC is disabled.
2016-09-16 13:26:56 -07:00
[AS_HELP_STRING([--enable-supportedcurves],[Enable Supported Elliptic Curves (default: enabled)])],
[ENABLED_SUPPORTED_CURVES=$enableval],
Enable ECC for all platforms by default. For aarch64 enable SHA512, SHA224, SHA3 and FastMath by default.
2018-03-07 09:41:07 -08:00
[ENABLED_SUPPORTED_CURVES=yes])
added Elliptic Curves Extensions implementation and configuration.
2013-08-26 12:44:50 -03:00
Renaming Elliptic Curves to Supported Curves for better extension representation and avoid confusion.
2014-02-03 16:11:57 -03:00
if test "x$ENABLED_SUPPORTED_CURVES" = "xyes"
added Elliptic Curves Extensions implementation and configuration.
2013-08-26 12:44:50 -03:00
then
Update OpenSSL interopability testing Added TLS 1.3 testing. Added Ed25519 and Ed448 testing. Added tesitng of OpenSSL client against wolfSSL server. Fixed builds of Curve25519/Curve448/Ed25519/Ed448 in different configurations.
2020-07-07 22:47:28 +10:00
AS_IF([test "x$ENABLED_ECC" = "xno" && test "x$ENABLED_CURVE25519" = "xno" && test "x$ENABLED_CURVE448" = "xno"],
1. Enable the extension ECC Supported Curves by default. 2. Force the extention disabled if ECC is disabled.
2016-09-16 13:26:56 -07:00
[ENABLED_SUPPORTED_CURVES=no],
[AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SUPPORTED_CURVES"])
added Elliptic Curves Extensions implementation and configuration.
2013-08-26 12:44:50 -03:00
fi
Support FFDHE in TLS 1.2 and below. Better TLS 1.3 version support. Add support for the fixed FFDHE curves to TLS 1.2. Same curves in TLS 1.3 already. On by default - no checking of prime required. Add option to require client to see FFDHE parameters from server as per 'may' requirements in RFC 7919. Change TLS 1.3 ClientHello and ServerHello parsing to find the SupportedVersions extension first and process it. Then it can handle other extensions knowing which protocol we are using.
2019-02-18 10:57:12 +10:00
# Diffie-Hellman
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
if test "$ENABLED_DH" != "no"
Support FFDHE in TLS 1.2 and below. Better TLS 1.3 version support. Add support for the fixed FFDHE curves to TLS 1.2. Same curves in TLS 1.3 already. On by default - no checking of prime required. Add option to require client to see FFDHE parameters from server as per 'may' requirements in RFC 7919. Change TLS 1.3 ClientHello and ServerHello parsing to find the SupportedVersions extension first and process it. Then it can handle other extensions knowing which protocol we are using.
2019-02-18 10:57:12 +10:00
then
if test "$ENABLED_TLS13" = "yes" || test "$ENABLED_SUPPORTED_CURVES" = "yes"
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_2048"
Support FFDHE in TLS 1.2 and below. Better TLS 1.3 version support. Add support for the fixed FFDHE curves to TLS 1.2. Same curves in TLS 1.3 already. On by default - no checking of prime required. Add option to require client to see FFDHE parameters from server as per 'may' requirements in RFC 7919. Change TLS 1.3 ClientHello and ServerHello parsing to find the SupportedVersions extension first and process it. Then it can handle other extensions knowing which protocol we are using.
2019-02-18 10:57:12 +10:00
fi
fi
# FFDHE parameters only
AC_ARG_ENABLE([ffdhe-only],
[AS_HELP_STRING([--enable-ffdhe-only],[Enable using only FFDHE in client (default: disabled)])],
[ ENABLED_FFDHE_ONLY=$enableval ],
[ ENABLED_FFDHE_ONLY=no ]
)
if test "x$ENABLED_FFDHE_ONLY" = "xyes"
then
if test "$ENABLED_DH" = "no"
then
AC_MSG_ERROR([FFDHE only support requires DH support])
fi
if test "$ENABLED_SUPPORTED_CURVES" = "no"
then
AC_MSG_ERROR([FFDHE only support requires Supported Curves extension])
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_REQUIRE_FFDHE"
fi
liboqs integration using keyshare/supported_groups extensions in TLS 1.3
2021-04-28 10:28:35 -07:00
# TLS 1.3 Requires either ECC or (RSA/DH), or CURVE25519/ED25519 or CURVE448/ED448 or libOQS
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
if test "x$ENABLED_PSK" = "xno" && test "x$ENABLED_ECC" = "xno" && \
Fix for building without ECC and DH (TLS v1.3 cannot be enabled).
2020-06-05 10:26:32 -07:00
(test "x$ENABLED_RSA" = "xno" || test "x$ENABLED_DH" = "xno") && \
(test "x$ENABLED_CURVE25519" = "xno" || test "x$ENABLED_ED25519" = "xno") && \
liboqs integration using keyshare/supported_groups extensions in TLS 1.3
2021-04-28 10:28:35 -07:00
(test "x$ENABLED_CURVE448" = "xno" || test "x$ENABLED_ED448" = "xno") && \
test "x$ENABLED_LIBOQS" = "xno"
Disable TLS v1.3 if none of these are available "ECC, CURVE25519, CURVE448 or DH".
2020-06-02 14:41:19 -07:00
then
# disable TLS 1.3
ENABLED_TLS13=no
fi
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
if test "$ENABLED_TLS13" = "yes" && (test "x$ENABLED_ECC" = "xyes" || \
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
test "$ENABLED_DH" != "no")
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_SUPPORTED_CURVES"
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
fi
Fix for building without ECC and DH (TLS v1.3 cannot be enabled).
2020-06-05 10:26:32 -07:00
if test "$ENABLED_TLS13" = "yes"
Disable TLS v1.3 if none of these are available "ECC, CURVE25519, CURVE448 or DH".
2020-06-02 14:41:19 -07:00
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TLS13 -DHAVE_TLS_EXTENSIONS"
Disable TLS v1.3 if none of these are available "ECC, CURVE25519, CURVE448 or DH".
2020-06-02 14:41:19 -07:00
fi
fix TURN_ON mask adds --enable-session-ticket configure option
2014-09-29 16:43:28 -03:00
# Session Ticket Extension
AC_ARG_ENABLE([session-ticket],
cleanup some configure help text
2015-03-12 12:25:39 -07:00
[AS_HELP_STRING([--enable-session-ticket],[Enable Session Ticket (default: disabled)])],
fix TURN_ON mask adds --enable-session-ticket configure option
2014-09-29 16:43:28 -03:00
[ ENABLED_SESSION_TICKET=$enableval ],
[ ENABLED_SESSION_TICKET=no ]
)
build updates for lighttpd Update configure.ac and various #ifdefs to enable WolfSSL to build features for use by lighttpd. Change signature of wolfSSL_GetVersion() to take const arg. Pass (const WOLFSSL*) to wolfSSL_GetVersion() for use with SSL_CTX_set_info_callback(), where OpenSSL callback takes (const SSL *)
2020-07-01 23:19:13 -04:00
if test "x$ENABLED_NGINX" = "xyes" || test "$ENABLED_WPAS" = "yes" || test "x$ENABLED_HAPROXY" = "xyes" || test "x$ENABLED_LIGHTY" = "xyes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
then
ENABLED_SESSION_TICKET=yes
fi
fix TURN_ON mask adds --enable-session-ticket configure option
2014-09-29 16:43:28 -03:00
if test "x$ENABLED_SESSION_TICKET" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SESSION_TICKET"
fi
tls13: support ticketNonce bigger than MAX_TICKET_NONCE_SZ to enable it, use WOLFSSL_TICKET_NONCE_MALLOC define
2022-09-14 15:35:12 +02:00
AC_ARG_ENABLE([ticket-nonce-malloc],
[AS_HELP_STRING([--enable-ticket-nonce-malloc], [Enable dynamic allocation of ticket nonces (default: disabled)])],
[ ENABLED_TICKET_NONCE_MALLOC=$enableval ],
[ ENABLED_TICKET_NONCE_MALLOC=no ]
)
if test "$ENABLED_TICKET_NONCE_MALLOC" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TICKET_NONCE_MALLOC"
fi
initial extended master secret support
2016-09-01 15:12:54 -06:00
# Extended Master Secret Extension
AC_ARG_ENABLE([extended-master],
Revising the Extended Master Secret support. Removing the dynamic TLSX support for the extention and treating it like the Signature and Hash algorithms extension. It is to be enabled by default and the user can turn it off at run time or build time.
2016-09-09 23:16:52 -07:00
[AS_HELP_STRING([--enable-extended-master],[Enable Extended Master Secret (default: enabled)])],
initial extended master secret support
2016-09-01 15:12:54 -06:00
[ ENABLED_EXTENDED_MASTER=$enableval ],
Revising the Extended Master Secret support. Removing the dynamic TLSX support for the extention and treating it like the Signature and Hash algorithms extension. It is to be enabled by default and the user can turn it off at run time or build time.
2016-09-09 23:16:52 -07:00
[ ENABLED_EXTENDED_MASTER=yes ]
initial extended master secret support
2016-09-01 15:12:54 -06:00
)
Improvements to `--enable-cryptonly` in configure.ac output. Improvement to math select order in configure.ac and stray heap math=yes.
2022-06-30 10:12:07 -07:00
if test "$ENABLED_CRYPTONLY" = "yes"
then
ENABLED_EXTENDED_MASTER=no
fi
initial extended master secret support
2016-09-01 15:12:54 -06:00
if test "x$ENABLED_EXTENDED_MASTER" = "xyes"
then
Revising the Extended Master Secret support. Removing the dynamic TLSX support for the extention and treating it like the Signature and Hash algorithms extension. It is to be enabled by default and the user can turn it off at run time or build time.
2016-09-09 23:16:52 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_EXTENDED_MASTER"
initial extended master secret support
2016-09-01 15:12:54 -06:00
fi
added: - max fragment length extension; - CyaSSL_SNI_GetRequest() to get client's request at server side; - Automated tests for SNI;
2013-06-19 15:45:06 -03:00
# TLS Extensions
AC_ARG_ENABLE([tlsx],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-tlsx],[Enable all TLS Extensions (default: disabled)])],
added: - max fragment length extension; - CyaSSL_SNI_GetRequest() to get client's request at server side; - Automated tests for SNI;
2013-06-19 15:45:06 -03:00
[ ENABLED_TLSX=$enableval ],
[ ENABLED_TLSX=no ]
)
Add --enable-chrony configure option. This turns on the necessary features for using the chrony NTP package with wolfSSL.
2022-01-18 22:02:50 -08:00
if test "x$ENABLED_NGINX" = "xyes" || test "x$ENABLED_HAPROXY" = "xyes" || test "x$ENABLED_SIGNAL" = "xyes" || test "x$ENABLED_LIGHTY" = "xyes" || test "$ENABLED_CHRONY" = "yes"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
then
ENABLED_TLSX=yes
fi
added: - max fragment length extension; - CyaSSL_SNI_GetRequest() to get client's request at server side; - Automated tests for SNI;
2013-06-19 15:45:06 -03:00
if test "x$ENABLED_TLSX" = "xyes"
then
1. Enable the extension ECC Supported Curves by default. 2. Force the extention disabled if ECC is disabled.
2016-09-16 13:26:56 -07:00
ENABLED_SNI=yes
ENABLED_MAX_FRAGMENT=yes
ENABLED_TRUNCATED_HMAC=yes
ENABLED_ALPN=yes
Trusted CA Key Indication Extension Added an API for enabling the Trusted CA Key Indication extension from RFC6066 section 6. If the server doesn't have a match for the client, the client will abandon the session.
2018-09-28 09:05:59 -07:00
ENABLED_TRUSTED_CA=yes
Add support for Encrypt-Then-MAC to TLS 1.2 and below An extension is used to indicate that ETM is to be used. Only used when doing block ciphers - HMAC performed on encrypted data.
2019-08-22 09:33:38 +10:00
ENABLED_ENCRYPT_THEN_MAC=yes
Add Apache HTTP Server compatibility and --enable-apachehttpd option (#2466) * Added Apache httpd support `--enable-apachehttpd`. * Added `SSL_CIPHER_get_version`, `BIO_new_fp`, `SSL_SESSION_print` and `SSL_in_connect_init` compatibility API's. * Fix to expose `ASN1_UTCTIME_print` stub. * Pulled in `wolfSSL_X509_get_ext_count` from QT. * Added `X509_get_ext_count`, `BIO_set_callback`, `BIO_set_callback_arg` and `BIO_get_callback_arg`. * Added `wolfSSL_ERR_print_errors`. * Added `BIO_set_nbio` template. * Fixes for building with Apache httpd. * Added DH prime functions required for Apache httpd. * Fix and move the BN DH prime macros. * Fix for `SSL_CTX_set_tlsext_servername_arg` to have return code. * Only add the `BN_get_rfc*_prime_*` macro's if older than 1.1.0. * Added `ERR_GET_FUNC`, `SSL_CTX_clear_extra_chain_certs` prototypes. * Added `wolfSSL_CTX_set_client_cert_cb` template and `OPENSSL_load_builtin_modules` stub macro. * Added `X509_INFO` templates (`X509_INFO_new`, `X509_INFO_free`, `sk_X509_INFO_new_null`, `sk_X509_INFO_num`, `sk_X509_INFO_value`, `sk_X509_INFO_free`). Added `sk_X509_shift`. * Added BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg * add BIO_set_nbio, ERR_print_errors and tests * add X509 INFO stack push function * Add ASN1_UTCTIME_print and unit test * Add X509_get_ext_count unit test * initial commit of wolfSSL_PEM_X509_INFO_read_bio * Added `sk_X509_NAME_new`, `sk_X509_NAME_push`, `sk_X509_NAME_find`, `sk_X509_NAME_set_cmp_func` and `sk_X509_NAME_free`. Grouped `sk_X509_NAME_*` functions. * Cleanup sk X509 NAME/INFO pop free template. * Advance openssl compatibility to v1.1.0 for Apache httpd. Added TLS version macros. Implemented sk X509 NAME/INFO pop and pop_free. * Added `TLS_client_method` support. * Added `SSL_get_server_tmp_key` and `EC_curve_nid2nist`. * Added `SSL_CTX_set_min_proto_version` and `SSL_CTX_set_max_proto_version`. Fix for `BN_get_rfc*_prime_*` with the v1.1.0 change. * add test cases for PEM_X509_INFO_read_bio * Fixes for `BN_get_rfc*_prime_*` macros. Added template for `SSL_DH_set0_pqg`. Fix for `SSL_OP_NO_` to use Macro's (as is done in openssl). Added `SSL_set_verify_result`. Added stub for `OPENSSL_malloc_init`. * Apache httpd compatibility functions. BIO setter/getters. * implement ASN1_TIME_check and add test case * add SSL_get_client_CA_list * add initial implementation of wolfSSL_DH_set0_pqg * Add apache support to OBJ_txt2nid and unit test, add stub for OBJ_create * add X509_STORE_CTX_get1_chain, sk_free, sk_X509_dup * Add sk_SSL_COMP_num and SSL_COMP struct * implement and test of SSL_SESSION_print * add SSL_CTX_set_client_cert_cb * expand BIO_printf and add test case * Added `OCSP_CERTID_dup`. Added `ASN1_TYPE`. * add implementation for wolfSSL_get_server_tmp_key * add wolfSSL_BIO_puts and test case * Add X509_EXTENSION_get_object and X509_EXTENSION_get_data * add helper for bio flag set and null x509 stack * add test adn implementation for wolfSSL_i2d_PrivateKey * Added `ASN1_OTHERNAME`, `ACCESS_DESCRIPTION` and `GENERAL_NAME`. Added `sk_ACCESS_DESCRIPTION_pop_free` and `ACCESS_DESCRIPTION_free` stubs. * add wolfSSL_PEM_read_bio_ECPKParameters * add BIO_vfree * add X509_up_ref * add X509_STORE_CTX_set_ex_data * add _GNU_SOURCE macro and wolfSSL_EVP_read_pw_string * add wolfSSL_EVP_PKEY_ref_up function * X509_get_ext, X509V3_EXT_print, and d2i_DISPLAYTEXT stubs * add X509_set_issuer_name * add wolfSSL_sk_SSL_CIPHER_* functions and tests * add prototype for sk_X509_EXTENSION and ACCESS_DESCRIPTION * fix casting to avoid clang warning * adjust test_wolfSSL_X509_STORE_CTX test case * Added `OpenSSL_version` * renegotiate functions and additional stack functions * add aditional stub functions * Add Apache httpd requirements for ALPN, CRL, Cert Gen/Req/Ext and SecRen. Fix for `sk_X509_INFO_new_null`. * add ocsp stub functions * Proper fix for `sk_X509_INFO_new_null`. Added templates for `X509_get_ext_by_NID` and `X509_add_ext`. Added templates for `ASN1_TIME_diff` and `ASN1_TIME_set`. * x509 extension stack additions * Fixed template for `OCSP_id_get0_info`. * add X509 stub functions * add X509_STORE_CTX_get0_store() and unit test * Added `EVP_PKEY_CTX_new_id`, `EVP_PKEY_CTX_set_rsa_keygen_bits`, `EVP_PKEY_keygen_init`, `EVP_PKEY_keygen` and `BN_to_ASN1_INTEGER`. * x509v3 stubs and req add extensions * Add OBJ_txt2obj and unit test; add long name to wolfssl_object_info table for use by OBJ_* functions * wolfSSL_set_alpn_protos implementation * Added `EVP_SignInit_ex` and `TLS_server_method` implementation. Added stubs for `RSA_get0_key` and `i2d_OCSP_REQUEST_bio`. Fix typo on `OCSP_response_create`. Fix warning in `wolfSSL_set_alpn_protos`. * Added `X509_EXTENSION_free` stub. Fixed a few macro typos/adding missing. * add X509_STORE_CTX_get0_current_issuer and unit test * add OBJ_cmp and unit test * add RSA_get0_key and unit test * add OCSP_check_nonce * Implement X509_set_notAfter/notBefore/serialNumber/version,X509_STORE_CTX_set_depth,X509V3_set_ctx. * Modify wolfSSL_X509_set_notAfter/notBefore and add tests for each. * Add test_wolfSSL_X509_set_version w/ fixes to _set_version and fix _set_notBefore/notAfter tests * add OCSP_id_get0_info and unit test, move WOLFSSL_ASN1_INTEGER to asn_public.h from ssl.h * inital implementation of wolfSSL_X509_sign * add debugging messages and set data for BIO's * Add i2d_OCSP_REQUEST_bio. * implementation of some WOLFSSL_BIO_METHOD custom functions * fix for ASN time structure and remove log node * initial eNULL support and sanity checks * fixes after rebasing code * adjust test cases and ASN1_TIME print * Various fixes for memory leaks * Apache compatibility in CTX_set_client_CA_list for X509_NAME use; add X509_NAME_dup as supporting function * Add initial X509_STORE_load_locations stub for Apache * Updates to X509_get_ext_d2i to return GENERAL_NAME struct instead of ASN1_OBJECT for alternative names and add supporting GENERAL_NAME functions * Add X509_STORE_load_locations implementation; add wolfSSL_CertManagerLoadCRL_ex; initial renegotiation fixes/updates * Fix for freeing peer cert in wolfSSL_Rehandshake instead of FreeHandShakeResources during secure renegotiation * Add X509_ALGOR and X509_PUBKEY structs for X509_PUBKEY_get0_param and X509_get_X509_PUBKEY implementation * Initial implementation of wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Add implementation for X509_get0_tbs_sigalg and X509_ALGOR_get0 * Add OBJ_nid2ln implementation * Fix compile errors in tests/api.c for some build options * Updates to X509_STORE_load_locations for non-CRL types; Add additional DETECT_CERT_TYPE enum and logic for detecting certificate type in ProcessFile * Add X509_STORE_load_locations unit test and minor error handling fixes * Add unit test for X509_sign * Set correct alert type for revoked certificates; add/fix a few WOLFSSL_ENTER messages * Add X509_ALGOR member to X509 struct; refactoring and unit tests for wolfSSL_X509_ALGOR_get0 and wolfSSL_X509_get0_tbs_sigalg * Add X509_PUBKEY member to X509 struct; refactoring and unit tests for wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Stack fixes after rebase * Secure renegotiation refactoring: add ACCEPT_BEGIN_RENEG to AcceptState for use in wolfSSL_SSL_in_connect_init; free old peer cert when receiving new cert to fix memory leak * Move enc-then-mac enable option in configure.ac for apache httpd compatibility * Simplify wolfSSL_SSL_in_connect_init logic * Remove unneeded wolfSSL_CertManagerLoadCRL_ex * Fixes for jenkins test failures * SSL_get_secure_renegotiation_support for print statement in Apache
2019-09-19 18:11:10 -06:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SNI -DHAVE_MAX_FRAGMENT -DHAVE_TRUNCATED_HMAC -DHAVE_ALPN -DHAVE_TRUSTED_CA"
1. Enable the extension ECC Supported Curves by default. 2. Force the extention disabled if ECC is disabled.
2016-09-16 13:26:56 -07:00
# Check the ECC supported curves prereq
Update OpenSSL interopability testing Added TLS 1.3 testing. Added Ed25519 and Ed448 testing. Added tesitng of OpenSSL client against wolfSSL server. Fixed builds of Curve25519/Curve448/Ed25519/Ed448 in different configurations.
2020-07-07 22:47:28 +10:00
AS_IF([test "x$ENABLED_ECC" != "xno" || test "x$ENABLED_CURVE25519" = "xyes" || test "x$ENABLED_CURVE448" = "xyes" || test "x$ENABLED_TLS13" = "xyes"],
1. Enable the extension ECC Supported Curves by default. 2. Force the extention disabled if ECC is disabled.
2016-09-16 13:26:56 -07:00
[ENABLED_SUPPORTED_CURVES=yes
AM_CFLAGS="$AM_CFLAGS -DHAVE_SUPPORTED_CURVES"])
added: - max fragment length extension; - CyaSSL_SNI_GetRequest() to get client's request at server side; - Automated tests for SNI;
2013-06-19 15:45:06 -03:00
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
TLS v1.3 0-RTT
2017-06-19 11:37:10 +10:00
# Early Data handshake in TLS v1.3 and above
AC_ARG_ENABLE([earlydata],
[AS_HELP_STRING([--enable-earlydata],[Enable Early Data handshake with wolfSSL TLS v1.3 (default: disabled)])],
Updates from code review
2017-06-22 12:40:41 +10:00
[ ENABLED_TLS13_EARLY_DATA=$enableval ],
[ ENABLED_TLS13_EARLY_DATA=no ]
TLS v1.3 0-RTT
2017-06-19 11:37:10 +10:00
)
Make grouping EarlyData and ClientHello a configuration option
2018-09-03 08:48:28 +10:00
if test "$ENABLED_TLS13_EARLY_DATA" = "group"
then
ENABLED_TLS13_EARLY_DATA="yes"
# Group EarlyData with ClientHello
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_EARLY_DATA_GROUP"
Make grouping EarlyData and ClientHello a configuration option
2018-09-03 08:48:28 +10:00
fi
Updates from code review
2017-06-22 12:40:41 +10:00
if test "$ENABLED_TLS13_EARLY_DATA" = "yes"
TLS v1.3 0-RTT
2017-06-19 11:37:10 +10:00
then
TLS: add peer authentication failsafe for TLS 1.2 and below Tightened the TLS 1.3 failsafe checks too.
2022-03-14 12:03:49 +10:00
if test "x$ENABLED_TLS13" = "xno" && test "X$ENABLED_ALL" = "xno"
TLS v1.3 0-RTT
2017-06-19 11:37:10 +10:00
then
AC_MSG_ERROR([cannot enable earlydata without enabling tls13.])
fi
if test "x$ENABLED_SESSION_TICKET" = "xno" && test "x$ENABLED_PSK" = "xno"
then
AC_MSG_ERROR([cannot enable earlydata without enabling session tickets and/or PSK.])
fi
TLS: add peer authentication failsafe for TLS 1.2 and below Tightened the TLS 1.3 failsafe checks too.
2022-03-14 12:03:49 +10:00
if test "x$ENABLED_TLS13" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_EARLY_DATA"
fi
TLS v1.3 0-RTT
2017-06-19 11:37:10 +10:00
fi
Fixes to work when compiled with TLS 1.3 only TLS 1.3 Early Data can be used with PSK and not session tickets. If only TLS 1.3 and no session tickets then no resumption. External sites don't support TLS 1.3 yet.
2018-08-28 15:37:15 +10:00
if test "$ENABLED_TLSV12" = "no" && test "$ENABLED_TLS13" = "yes" && test "x$ENABLED_SESSION_TICKET" = "xno"
then
AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE"
fi
TLS v1.3 0-RTT
2017-06-19 11:37:10 +10:00
fix --enable-pkcs7 configure.ac
2014-01-10 16:11:17 -07:00
# PKCS7
initial PKCS#7 stubs, tie into ./configure
2014-01-10 15:17:03 -07:00
AC_ARG_ENABLE([pkcs7],
Disable DES3 by default. Force it enabled when it is a prereq for another option. (SCEP and PKCS7)
2016-09-15 11:17:30 -07:00
[AS_HELP_STRING([--enable-pkcs7],[Enable PKCS7 (default: disabled)])],
initial PKCS#7 stubs, tie into ./configure
2014-01-10 15:17:03 -07:00
[ ENABLED_PKCS7=$enableval ],
Added helper configure option '--enable-wolftpm` to enable options used by wolfTPM. This enables (cert gen/req/ext, pkcs7, cryptocb and aes-cfb).
2020-12-23 08:09:24 -08:00
[ ENABLED_PKCS7=no ]
initial PKCS#7 stubs, tie into ./configure
2014-01-10 15:17:03 -07:00
)
Support for new DPP in wpa_supplicant - Add null check to asn template code in MakeCertReq and test - ENABLED_ECCCUSTCURVES can also be "all"
2022-06-10 18:13:39 +02:00
if test "x$ENABLED_WPAS_DPP" = "xyes"
then
ENABLED_PKCS7=yes
fi
initial PKCS#7 stubs, tie into ./configure
2014-01-10 15:17:03 -07:00
wolfSSH Option Added a configure convenience option for building wolfSSL to work with wolfSSH.
2017-10-04 15:24:22 -07:00
# wolfSSH Options
For consistency, add a --enable-wolfssl; keep --enable-ssl for backwards compat.
2022-05-03 12:08:13 -04:00
AC_ARG_ENABLE([wolfssh],
[AS_HELP_STRING([--enable-wolfssh],[Enable wolfSSH options (default: disabled)])],
wolfSSH Option Added a configure convenience option for building wolfSSL to work with wolfSSH.
2017-10-04 15:24:22 -07:00
[ ENABLED_WOLFSSH=$enableval ],
[ ENABLED_WOLFSSH=no ]
)
For consistency, add a --enable-wolfssl; keep --enable-ssl for backwards compat.
2022-05-03 12:08:13 -04:00
AC_ARG_ENABLE([ssh],
[AS_HELP_STRING([--enable-ssh],[Enable wolfSSH options (default: disabled)])],
[ ENABLED_SSH=$enableval ],
[ ENABLED_SSH=no ]
)
if test "x$ENABLED_SSH" = "xyes"
then
WOLFSSL ---> WOLFSSH
2022-05-04 09:28:08 -04:00
ENABLED_WOLFSSH="yes"
For consistency, add a --enable-wolfssl; keep --enable-ssl for backwards compat.
2022-05-03 12:08:13 -04:00
fi
Added helper configure option '--enable-wolftpm` to enable options used by wolfTPM. This enables (cert gen/req/ext, pkcs7, cryptocb and aes-cfb).
2020-12-23 08:09:24 -08:00
# wolfTPM Options
AC_ARG_ENABLE([wolftpm],
[AS_HELP_STRING([--enable-wolftpm],[Enable wolfTPM options (default: disabled)])],
[ ENABLED_WOLFTPM=$enableval ],
[ ENABLED_WOLFTPM=no ]
)
add wolfclu enable option
2021-09-01 08:44:00 -06:00
# wolfCLU Options
AC_ARG_ENABLE([wolfclu],
[AS_HELP_STRING([--enable-wolfclu],[Enable wolfCLU options (default: disabled)])],
[ ENABLED_WOLFCLU=$enableval ],
[ ENABLED_WOLFCLU=no ]
)
Added helper configure option '--enable-wolftpm` to enable options used by wolfTPM. This enables (cert gen/req/ext, pkcs7, cryptocb and aes-cfb).
2020-12-23 08:09:24 -08:00
if test "x$ENABLED_WOLFTPM" = "xyes"
then
# Requires cryptocb (set in its enable section)
# Requires certgen, certreq, certext
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
if test "x$ENABLED_CERTREQ" = "xno"
then
ENABLED_CERTREQ="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_REQ"
fi
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"
fi
# Requires PKCS7
if test "x$ENABLED_PKCS7" = "xno"
then
ENABLED_PKCS7="yes"
fi
# Requires aescfb
if test "x$ENABLED_AESCFB" = "xno"
then
ENABLED_AESCFB="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_CFB"
fi
fi
Added support for reading S/MIME messages via SMIME_read_PKCS7.
2021-02-08 17:12:24 -07:00
if test "x$ENABLED_SMIME" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_SMIME"
# Requires PKCS7
if test "x$ENABLED_PKCS7" = "xno"
then
ENABLED_PKCS7="yes"
fi
fi
Added helper configure option '--enable-wolftpm` to enable options used by wolfTPM. This enables (cert gen/req/ext, pkcs7, cryptocb and aes-cfb).
2020-12-23 08:09:24 -08:00
1. Bumped release version in configure.ac. 2. Added enable option for SCEP. Enables prereqs. 3. Added CyaSSL_wolfSCEP() for ac to test for CyaSSL SCEP.
2014-01-27 11:35:43 -08:00
# Simple Certificate Enrollment Protocol (SCEP)
AC_ARG_ENABLE([scep],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-scep],[Enable wolfSCEP (default: disabled)])],
1. Bumped release version in configure.ac. 2. Added enable option for SCEP. Enables prereqs. 3. Added CyaSSL_wolfSCEP() for ac to test for CyaSSL SCEP.
2014-01-27 11:35:43 -08:00
[ ENABLED_WOLFSCEP=$enableval ],
[ ENABLED_WOLFSCEP=no ]
)
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Secure Remote Password
AC_ARG_ENABLE([srp],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-srp],[Enable Secure Remote Password (default: disabled)])],
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
[ ENABLED_SRP=$enableval ],
[ ENABLED_SRP=no ]
)
if test "x$ENABLED_SRP" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_HAVE_SRP"
fi
Support indefinite length BER encodings in PKCS #7
2018-02-19 13:40:18 +10:00
# Indefinite length encoded BER message support
AC_ARG_ENABLE([indef],
[AS_HELP_STRING([--enable-indef],[Enable parsing of indefinite length encoded msgs (default: disabled)])],
[ ENABLED_BER_INDEF=$enableval ],
[ ENABLED_BER_INDEF=no ]
)
if test "x$ENABLED_BER_INDEF" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DASN_BER_TO_DER"
fi
Configure: add option to enable alternate certificate chains (#4455)
2021-10-06 18:14:51 -07:00
# Alternate certification chains, as oppossed to requiring full chain validataion.
# Certificate validation behavior is relaxed, similar to openssl and
# browsers. Only the peer certificate must validate to a trusted
# certificate. Without this, all certificates sent by a peer must be
# used in the trust chain or the connection will be rejected.
AC_ARG_ENABLE([altcertchains],
[AS_HELP_STRING([--enable-altcertchains],[Enable using alternative certificate chains, only require leaf certificate to validate to trust root (default: disabled)])],
[ ENABLED_ALT_CERT_CHAINS=$enableval ],
[ ENABLED_ALT_CERT_CHAINS=no ]
)
if test "x$ENABLED_ALT_CERT_CHAINS" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALT_CERT_CHAINS"
fi
Support indefinite length BER encodings in PKCS #7
2018-02-19 13:40:18 +10:00
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
# Small Stack - Cache on object
AC_ARG_ENABLE([smallstackcache],
[AS_HELP_STRING([--enable-smallstackcache],[Enable Small Stack Usage Caching (default: disabled)])],
[ ENABLED_SMALL_STACK_CACHE=$enableval ],
configure.ac: remove smallstackcache from linuxkm default options; add several feature exclusions to enable-all and enable-all-crypto to make them compatible with fips=ready; render the FIPS option in the feature summary at end.
2020-11-26 00:19:35 -06:00
[ ENABLED_SMALL_STACK_CACHE=no ]
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
)
if test "x$ENABLED_SMALL_STACK_CACHE" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SMALL_STACK_CACHE"
fi
# Small Stack
configure.ac: improve --enable-all coverage and make it compatible with --enable-sp-math, add --enable-all-crypto (crypto-only subset of --enable-all), and add --enable-linuxkm-defaults ("Enable feature defaults for Linux Kernel Module").
2020-09-30 14:26:17 -05:00
if test "$ENABLED_LINUXKM_DEFAULTS" = "yes"
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
then
ENABLED_SMALL_STACK_DEFAULT=yes
else
ENABLED_SMALL_STACK_DEFAULT=no
fi
AC_ARG_ENABLE([smallstack],
[AS_HELP_STRING([--enable-smallstack],[Enable Small Stack Usage (default: disabled)])],
[ ENABLED_SMALL_STACK=$enableval ],
[ ENABLED_SMALL_STACK=$ENABLED_SMALL_STACK_DEFAULT ]
)
if test "x$ENABLED_SMALL_STACK_CACHE" = "xyes"
then
ENABLED_SMALL_STACK=yes
fi
if test "x$ENABLED_SMALL_STACK" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SMALL_STACK"
fi
WIP: autotools support for LKM
2020-08-17 11:49:09 -05:00
add enable-valgrind
2012-12-04 21:28:18 -08:00
#valgrind
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([valgrind],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-valgrind],[Enable valgrind for unit tests (default: disabled)])],
add enable-valgrind
2012-12-04 21:28:18 -08:00
[ ENABLED_VALGRIND=$enableval ],
[ ENABLED_VALGRIND=no ]
)
if test "$ENABLED_VALGRIND" = "yes"
then
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_CHECK_PROG([HAVE_VALGRIND],[valgrind],[yes],[no])
add enable-valgrind
2012-12-04 21:28:18 -08:00
fix valgrind prog check, catch more failures
2013-05-16 16:20:51 -07:00
if test "$HAVE_VALGRIND" = "no"
then
add enable-valgrind
2012-12-04 21:28:18 -08:00
AC_MSG_ERROR([Valgrind not found.])
fi
enable_shared=no
configure switch to enable_static on if shared off when hardsetting for valgrind or cavium
2013-03-27 15:17:21 -07:00
enable_static=yes
don't output debug messages in testsuite if valgrind on
2013-01-04 15:52:46 -08:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_VALGRIND"
add enable-valgrind
2012-12-04 21:28:18 -08:00
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Test certs, use internal cert functions for extra testing
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([testcert],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-testcert],[Enable Test Cert (default: disabled)])],
fix asn public interface, some potential collisions
2011-06-03 13:01:45 -07:00
[ ENABLED_TESTCERT=$enableval ],
[ ENABLED_TESTCERT=no ]
)
if test "$ENABLED_TESTCERT" = "yes"
then
configure.ac updates
2014-12-31 13:04:03 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TEST_CERT"
fix asn public interface, some potential collisions
2011-06-03 13:01:45 -07:00
fi
add enable-iopool , simple I/O pool example using memory overrides
2014-03-13 18:54:51 -07:00
# I/O Pool, an example to show user how to override memory handler and use
# a pool for the input/output buffer requests
AC_ARG_ENABLE([iopool],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-iopool],[Enable I/O Pool example (default: disabled)])],
add enable-iopool , simple I/O pool example using memory overrides
2014-03-13 18:54:51 -07:00
[ ENABLED_IOPOOL=$enableval ],
[ ENABLED_IOPOOL=no ]
)
if test "$ENABLED_IOPOOL" = "yes"
then
if test "$thread_ls_on" = "no"
then
AC_MSG_ERROR([I/O Pool example requires Thread Local Storage])
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_IO_POOL -DXMALLOC_USER"
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Certificate Service Support
add enable-certservice, ease of use
2014-02-11 13:08:12 -08:00
AC_ARG_ENABLE([certservice],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-certservice],[Enable cert service (default: disabled)])],
add enable-certservice, ease of use
2014-02-11 13:08:12 -08:00
[ ENABLED_CERT_SERVICE=$enableval ],
[ ENABLED_CERT_SERVICE=no ]
)
if test "$ENABLED_CERT_SERVICE" = "yes"
then
add to certservice requirements
2014-02-13 08:53:12 -08:00
# Requires ecc,certgen, and opensslextra make sure on
add enable-certservice, ease of use
2014-02-11 13:08:12 -08:00
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
configure.ac updates
2014-12-31 13:04:03 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
add enable-certservice, ease of use
2014-02-11 13:08:12 -08:00
fi
if test "x$ENABLED_ECC" = "xno"
then
ENABLED_ECC="yes"
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
Pulled in patches from Debian package.
2016-11-22 11:25:40 -08:00
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
if test "$ENABLED_ECC_SHAMIR" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"
fi
add enable-certservice, ease of use
2014-02-11 13:08:12 -08:00
fi
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
add to certservice requirements
2014-02-13 08:53:12 -08:00
then
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
add to certservice requirements
2014-02-13 08:53:12 -08:00
fi
configure.ac updates
2014-12-31 13:04:03 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_CERT_SERVICE"
add enable-certservice, ease of use
2014-02-11 13:08:12 -08:00
fi
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
# wolfSSL JNI
AC_ARG_ENABLE([jni],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-jni],[Enable wolfSSL JNI (default: disabled)])],
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
[ ENABLED_JNI=$enableval ],
[ ENABLED_JNI=no ]
)
if test "$ENABLED_JNI" = "yes"
then
add HAVE_EX_DATA, OPENSSL_ALL, HAVE_ALPN to enable-jni configure option
2020-08-05 15:43:26 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_JNI -DHAVE_EX_DATA"
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
# Enable prereqs if not already enabled
if test "x$ENABLED_DTLS" = "xno"
then
ENABLED_DTLS="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS"
fi
if test "x$ENABLED_OPENSSLEXTRA" = "xno"
then
ENABLED_OPENSSLEXTRA="yes"
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
fi
add HAVE_EX_DATA, OPENSSL_ALL, HAVE_ALPN to enable-jni configure option
2020-08-05 15:43:26 -06:00
if test "x$ENABLED_OPENSSLALL" = "xno"
then
ENABLED_OPENSSLALL="yes"
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_ALL"
fi
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
if test "x$ENABLED_CRL" = "xno"
then
ENABLED_CRL="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL"
fi
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
Fixes for building with CRL monitor when not linux, OS X or FreeBSD and --enable-distro set. Cleanup of the crl.c HAVE_CRL_MONITOR checks for OS and make sure if StopMonitor preprocessor is defined the function will also be defined.
2016-12-07 07:07:27 -08:00
if test "x$ENABLED_CRL_MONITOR" = "xno" && test "x$ENABLED_DISTRO" = "xno"
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
then
ENABLED_CRL_MONITOR="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL_MONITOR"
fi
if test "x$ENABLED_SAVESESSION" = "xno"
then
ENABLED_SAVESESSION="yes"
AM_CFLAGS="$AM_CFLAGS -DPERSIST_SESSION_CACHE"
fi
if test "x$ENABLED_SAVECERT" = "xno"
then
ENABLED_SAVECERT="yes"
AM_CFLAGS="$AM_CFLAGS -DPERSIST_CERT_CACHE"
fi
if test "x$ENABLED_ATOMICUSER" = "xno"
then
ENABLED_ATOMICUSER="yes"
AM_CFLAGS="$AM_CFLAGS -DATOMIC_USER"
fi
if test "x$ENABLED_ECC" = "xno"
then
ENABLED_ECC="yes"
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
Pulled in patches from Debian package.
2016-11-22 11:25:40 -08:00
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
if test "$ENABLED_ECC_SHAMIR" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"
fi
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
fi
do not enable PK Callbacks with JNI in FIPS mode
2022-04-21 11:06:54 -06:00
# Do not enable PK Callbacks in FIPS mode with JNI
if test "x$ENABLED_PKCALLBACKS" = "xno" && test "$ENABLED_FIPS" = "no"
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
then
ENABLED_PKCALLBACKS="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_PK_CALLBACKS"
fi
if test "x$ENABLED_DH" = "xno"
then
ENABLED_DH="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_DH"
fi
if test "x$ENABLED_PSK" = "xno"
then
ENABLED_PSK="yes"
fi
add certgen and certext to jni, add get timeout function
2019-03-06 13:28:53 -07:00
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"
fi
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
enable SNI by default for JNI/JSSE build
2020-06-03 14:24:10 -06:00
if test "x$ENABLED_SNI" = "xno"
then
ENABLED_SNI="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SNI"
fi
add HAVE_EX_DATA, OPENSSL_ALL, HAVE_ALPN to enable-jni configure option
2020-08-05 15:43:26 -06:00
if test "x$ENABLED_ALPN" = "xno"
then
ENABLED_ALPN="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_ALPN"
fi
Update --enable-jni to enable PSK, define WOLFSSL_JNI
2015-10-15 13:27:43 -06:00
fi
add enable lighty
2015-07-09 09:14:33 -06:00
if test "$ENABLED_LIGHTY" = "yes"
then
# Requires opensslextra make sure on
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
add enable lighty
2015-07-09 09:14:33 -06:00
then
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
add enable lighty
2015-07-09 09:14:33 -06:00
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_LIGHTY -DHAVE_WOLFSSL_SSL_H=1"
build updates for lighttpd Update configure.ac and various #ifdefs to enable WolfSSL to build features for use by lighttpd. Change signature of wolfSSL_GetVersion() to take const arg. Pass (const WOLFSSL*) to wolfSSL_GetVersion() for use with SSL_CTX_set_info_callback(), where OpenSSL callback takes (const SSL *)
2020-07-01 23:19:13 -04:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA"
build updates for lighttpd: -DOPENSSL_ALL avoid potential for WolfSSL to silently omit expected functionality
2020-07-02 13:34:06 -04:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_ALL"
lighttpd requires WOLFSSL_KEY_GEN. Without it, a call to wolfSSL_CTX_use_PrivateKey fails.
2022-01-04 13:09:13 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"
restore `--enable-lighty` with `--enable-all` protect lighttpd recommendations (and recommended restrictions) to when building wolfSSL specifically for use by lighttpd, and omit these optional settings when building `--enable-all`
2020-07-31 15:20:22 -04:00
# recommended if building wolfSSL specifically for use by lighttpd
Fix to disable CRL monitor for single threaded or lighttpd. Do not set `--enable-lighty` with `--enable-all`.
2020-07-31 09:20:39 -07:00
if test "x$ENABLED_ALL" = "xno"; then
lighttpd: allow ssl3, tls1.0 if explicitly enabled
2020-08-05 20:32:09 -04:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_NO_SSL2 -DOPENSSL_NO_COMP"
if test "x$ENABLED_SSLV3" = "xno"; then
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_NO_SSL3"
if test "x$ENABLED_TLSV10" = "xno"; then
AM_CFLAGS="$AM_CFLAGS -DNO_OLD_TLS"
ENABLED_OLD_TLS=no
fi
fi
restore `--enable-lighty` with `--enable-all` protect lighttpd recommendations (and recommended restrictions) to when building wolfSSL specifically for use by lighttpd, and omit these optional settings when building `--enable-all`
2020-07-31 15:20:22 -04:00
if test "x$ENABLED_CRL_MONITOR" = "xno"; then
AM_CFLAGS="$AM_CFLAGS -DSINGLE_THREADED"
ENABLED_SINGLETHREADED="yes"
fi
Fix to disable CRL monitor for single threaded or lighttpd. Do not set `--enable-lighty` with `--enable-all`.
2020-07-31 09:20:39 -07:00
restore `--enable-lighty` with `--enable-all` protect lighttpd recommendations (and recommended restrictions) to when building wolfSSL specifically for use by lighttpd, and omit these optional settings when building `--enable-all`
2020-07-31 15:20:22 -04:00
# w/ lighttpd 1.4.56 once wolfSSL updated to expose non-filesystem funcs
build updates for lighttpd: recommend -DNO_BIO (cherry picked from commit bfe12839e18ccc3ab95cfc33b34c875ebe55c14a)
2020-07-08 04:27:09 -04:00
#AM_CFLAGS="$AM_CFLAGS -DNO_BIO"
Fix to disable CRL monitor for single threaded or lighttpd. Do not set `--enable-lighty` with `--enable-all`.
2020-07-31 09:20:39 -07:00
#AM_CFLAGS="$AM_CFLAGS -DNO_FILESYSTEM"
#ENABLED_FILESYSTEM=no
fi
add enable lighty
2015-07-09 09:14:33 -06:00
fi
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
if test "$ENABLED_NGINX" = "yes"
then
Fix support for OCSP and Nginx Store DER copy of CA certificate with signer when WOLFSSL_SIGNER_DER_CERT is defined. Keep the bad issuer error for later when compiling for OpenSSL compatability. Authority Info string needs to be passed back with a nul terminator.
2018-06-25 15:24:40 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NGINX -DWOLFSSL_SIGNER_DER_CERT"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
fi
Introduce HAPROXY config flag + get/set app_data
2017-03-28 13:28:36 +02:00
if test "$ENABLED_HAPROXY" = "yes"
then
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAPROXY -DOPENSSL_COMPATIBLE_DEFAULTS"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SIGNER_DER_CERT"
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
# --enable-all defines its own DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS
if test -z "$DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS"
then
DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=8192
fi
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
# Requires opensslextra and opensslall
if test "x$ENABLED_OPENSSLALL" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
Introduce HAPROXY config flag + get/set app_data
2017-03-28 13:28:36 +02:00
then
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
ENABLED_OPENSSLALL="yes"
Introduce HAPROXY config flag + get/set app_data
2017-03-28 13:28:36 +02:00
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DOPENSSL_ALL"
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
if test "x$ENABLED_CERTREQ" = "xno"
then
ENABLED_CERTREQ="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_REQ"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
HaProxy 2.4-dev18 support *This patch is dependent on https://github.com/wolfSSL/wolfssl/pull/3871 because proto version selection logic is refactored in that pull request.* This patch contains the following changes: - Enable more options with `--enable-haproxy` - Compatibility layer additions - `STACK_TYPE_X509_OBJ` - `OCSP_id_cmp` - `X509_STORE_get0_objects` - `X509V3_EXT_nconf_nid` - `X509V3_EXT_nconf` - `X509_chain_up_ref` - `X509_NAME_hash` - `sk_X509_NAME_new_null` - `X509_OBJECT_get0_X509` - `X509_OBJECT_get0_X509_CRL` - `ASN1_OCTET_STRING_free` - `X509_LOOKUP_TYPE` - `OSSL_HANDSHAKE_STATE` - New `OPENSSL_COMPATIBLE_DEFAULTS` define will set default behaviour that is compatible with OpenSSL - WOLFSSL_CTX - Enable all compiled in protocols - Allow anonymous ciphers - Set message grouping - Set verify to SSL_VERIFY_NONE - In `SetSSL_CTX`, don't change `send` and `recv` callback if currently using `BIO` - `ssl->peerVerifyRet` - Return first that occured - Set correct value on date error - Set revoked error on OCSP or CRL error - Save value in session and restore on resumption - Add to session serialization - With `OPENSSL_EXTRA`, send an alert on invalid downgrade attempt - Handle sni callback `SSL_TLSEXT_ERR_NOACK` - Add `WOLFSSL_VERIFY_DEFAULT` option for `wolfSSL_CTX_set_verify` and `wolfSSL_set_verify` to allow resetting to default behaviour
2021-04-20 16:15:42 +02:00
# Requires sessioncerts make sure on
if test "x$ENABLED_SESSIONCERTS" = "xno"
then
ENABLED_SESSIONCERTS="yes"
AM_CFLAGS="$AM_CFLAGS -DSESSION_CERTS"
Introduce HAPROXY config flag + get/set app_data
2017-03-28 13:28:36 +02:00
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Introduce HAPROXY config flag + get/set app_data
2017-03-28 13:28:36 +02:00
fi
net-snmp support patch
2021-07-09 15:14:11 +02:00
if test "$ENABLED_NETSNMP" = "yes"
then
Implement BIO_new_accept and BIO_do_accept
2021-07-13 20:37:32 +02:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA"
net-snmp support patch
2021-07-09 15:14:11 +02:00
if test "x$ENABLED_AESCFB" = "xno"
then
ENABLED_AESCFB="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_CFB"
fi
if test "x$ENABLED_DTLS" = "xno"
then
ENABLED_DTLS="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS"
fi
fi
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
if test "$ENABLED_KRB" = "yes"
then
Missing config for krb5 1.16.1
2021-12-16 14:35:39 +01:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KRB -DWOLFSSL_AES_DIRECT -DWOLFSSL_DES_ECB"
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA"
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
# Requires PKCS7
if test "x$ENABLED_PKCS7" = "xno"
then
ENABLED_PKCS7="yes"
fi
fi
Add support for `--enable-ffmpeg`
2022-03-28 12:47:19 +02:00
if test "$ENABLED_FFMPEG" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FFMPEG -DOPENSSL_COMPATIBLE_DEFAULTS"
fi
Modification for compliling application with libsignal-protocol-c.
2017-11-13 18:12:18 +09:00
if test "$ENABLED_SIGNAL" = "yes"
then
enable AES-CTR for libsignal build
2020-12-16 12:44:01 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SIGNAL -DWOLFSSL_AES_COUNTER -DWOLFSSL_AES_DIRECT"
Modification for compliling application with libsignal-protocol-c.
2017-11-13 18:12:18 +09:00
# Requires opensslextra make sure on
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
Modification for compliling application with libsignal-protocol-c.
2017-11-13 18:12:18 +09:00
fi
fi
Bind 9.17.9 Support - Add `--enable-bind` configuration option - New compatibility API: - `RSA_get0_crt_params` - `RSA_set0_crt_params` - `RSA_get0_factors` - `RSA_set0_factors` - `RSA_test_flags` - `HMAC_CTX_get_md` - `EVP_MD_block_size` - `EC_KEY_check_key` - `o2i_ECPublicKey` - `DH_get0_key` - `DH_set0_key` - Calling `EVP_MD_CTX_cleanup` on an uninitialized `EVP_MD_CTX` structure is no longer an error - `DH_generate_parameters` and `DH_generate_parameters_ex` has been implemented
2021-05-21 16:56:36 +02:00
if test "$ENABLED_BIND" = "yes"
then
Bind 9.11.22
2021-06-15 17:13:29 +02:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_BIND -DWOLFSSL_DSA_768_MODULUS"
Bind 9.17.9 Support - Add `--enable-bind` configuration option - New compatibility API: - `RSA_get0_crt_params` - `RSA_set0_crt_params` - `RSA_get0_factors` - `RSA_set0_factors` - `RSA_test_flags` - `HMAC_CTX_get_md` - `EVP_MD_block_size` - `EC_KEY_check_key` - `o2i_ECPublicKey` - `DH_get0_key` - `DH_set0_key` - Calling `EVP_MD_CTX_cleanup` on an uninitialized `EVP_MD_CTX` structure is no longer an error - `DH_generate_parameters` and `DH_generate_parameters_ex` has been implemented
2021-05-21 16:56:36 +02:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DWOLFSSL_DES_ECB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224 -DWOLFSSL_SHA384 -DWOLFSSL_SHA512"
bind 9.18.0 fixes - return `1` from `wolfSSL_BIO_set_mem_eof_return` instead of `0` for success - bind requires ALPN - `OPENSSL_COMPATIBLE_DEFAULT` defined for bind - `WOLFSSL_ERROR_CODE_OPENSSL` defined when using compatibility layer - return `bio->eof` on no pending data to read in memory BIO (defaults to `WOLFSSL_BIO_ERROR`) - `flags` is no longer an input parameter in `wolfSSL_ERR_get_error_line_data` - allow lazy parameter loading in `wolfSSL_DH_set0_key` - implement reference counter in `WOLFSSL_EC_KEY` - load serial number from `x509->serialNumber` if `x509->serial` is empty
2022-03-11 19:57:54 +01:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_COMPATIBLE_DEFAULTS"
Code review and mp_int memory leak fixes
2021-06-01 17:36:03 +02:00
ENABLED_SHA224="yes"
ENABLED_SHA384="yes"
ENABLED_SHA512="yes"
Bind 9.17.9 Support - Add `--enable-bind` configuration option - New compatibility API: - `RSA_get0_crt_params` - `RSA_set0_crt_params` - `RSA_get0_factors` - `RSA_set0_factors` - `RSA_test_flags` - `HMAC_CTX_get_md` - `EVP_MD_block_size` - `EC_KEY_check_key` - `o2i_ECPublicKey` - `DH_get0_key` - `DH_set0_key` - Calling `EVP_MD_CTX_cleanup` on an uninitialized `EVP_MD_CTX` structure is no longer an error - `DH_generate_parameters` and `DH_generate_parameters_ex` has been implemented
2021-05-21 16:56:36 +02:00
fi
Add support for rsyslog. - Add an --enable-rsyslog option to configure.ac. - Add a few missing `WOLFSSL_ERROR` calls that were expected by rsyslog unit tests. - Add better documentation around `WOLFSSL_SHUTDOWN_NOT_DONE` and define it to be 0 (rather than 2) when `WOLFSSL_ERROR_CODE_OPENSSL` is defined. This is in accordance with OpenSSL documentation. Without this change, rsyslog was failing to do the bidirectional shutdown properly because it was checking the shutdown return value against 0. I'm keeping the old value when `WOLFSSL_ERROR_CODE_OPENSSL` isn't defined because it's part of the public wolfssl interface (it's in ssl.h).
2021-08-12 09:50:06 -07:00
if test "$ENABLED_RSYSLOG" = "yes"
then
Make improvements for rsyslog port. - Remove FP_MAX_BITS and RSA_MAX_BITS definitions from rsyslog config. A user configuring wolfSSL for rsyslog support should set them as they see fit (i.e. based on the key sizes they need to support). - After testing with wolfSSL FIPS, I discovered that some functions were missing from the compatibility layer that rsyslog needs. Notably wolfSSL_DH_generate_key and wolfSSL_DH_set0_pqg. These were gated out of compilation based on HAVE_FIPS. However, they only need to be compiled out if WOLFSSL_DH_EXTRA is defined. This is because these functions call SetDhInternal, which calls wc_DhImportKeyPair if WOLFSSL_DH_EXTRA is defined. wc_DhImportKeyPair isn't available in the FIPS module's dh.c. So, these functions can exist in the FIPS build provided WOLFSSL_DH_EXTRA isn't defined. This commit accounts for this scenario.
2021-08-16 15:13:36 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_RSYSLOG -DWOLFSSL_ERROR_CODE_OPENSSL"
Add support for rsyslog. - Add an --enable-rsyslog option to configure.ac. - Add a few missing `WOLFSSL_ERROR` calls that were expected by rsyslog unit tests. - Add better documentation around `WOLFSSL_SHUTDOWN_NOT_DONE` and define it to be 0 (rather than 2) when `WOLFSSL_ERROR_CODE_OPENSSL` is defined. This is in accordance with OpenSSL documentation. Without this change, rsyslog was failing to do the bidirectional shutdown properly because it was checking the shutdown return value against 0. I'm keeping the old value when `WOLFSSL_ERROR_CODE_OPENSSL` isn't defined because it's part of the public wolfssl interface (it's in ssl.h).
2021-08-12 09:50:06 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA -DOPENSSL_COMPATIBLE_DEFAULTS"
fi
Add --enable-openvpn build option
2020-01-28 15:29:24 +01:00
if test "$ENABLED_OPENVPN" = "yes"
then
Fix call to wolfSSL_connect when in wolfSSL_connect_TLSv13 If a client is: - TLS 1.3 capable - calls connect with wolfSSL_connect_TLSv13 - on an WOLFSSL object that allows downgrading then the call to wolfSSL_connect should happen before changing state to HELLO_AGAIN. Otherwise wolfSSL_connect will assume that messages up to ServerHelloDone have been read (when in reality only ServerHello had been read). Enable keying material for OpenVPN
2020-12-22 16:11:08 +01:00
ENABLED_SUPPORTED_CURVES="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_OPENVPN -DHAVE_KEYING_MATERIAL"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DES_ECB -DHAVE_EX_DATA -DWOLFSSL_KEY_GEN"
Add --enable-openvpn build option
2020-01-28 15:29:24 +01:00
fi
Fix for Lighttpd 1.4.49, which requires `HAVE_EX_DATA`.
2018-09-25 15:14:57 -07:00
if test "$ENABLED_NGINX" = "yes"|| test "x$ENABLED_HAPROXY" = "xyes" || test "x$ENABLED_LIGHTY" = "xyes"
Grouped HAPROXY compatibility into WOLFSSL_HAPROXY flag now haproxy compatible wolfssl builds with: ./configure --prefix=/usr --sysconfdir=/etc --disable-fastmath \ iam * ] 2:18 PM --disable-fasthugemath --disable-bump \ --enable-opensslextra \ --enable-keygen --enable-certgen \ --disable-ntru --disable-examples \ --enable-tlsx --enable-haproxy \ --enable-savecert --enable-savesession --enable-sessioncerts \ --enable-webserver --enable-sslv3 --enable-stunnel
2017-04-11 14:18:41 +02:00
then
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_VERIFY_CB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_KEEP_SNI"
AM_CFLAGS="$AM_CFLAGS -DKEEP_OUR_CERT -DKEEP_PEER_CERT"
Fixes required after logging changes to master.
2017-02-09 16:28:32 +10:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_EXT_CACHE -DHAVE_EX_DATA"
add cert gen to lighty build for function wolfSSL_PEM_write_bio_X509
2020-12-21 15:34:56 +07:00
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
fi
modify --enable-openssh to not enable non-FIPS algos for FIPS builds
2022-05-12 14:08:20 -06:00
if (test "$ENABLED_OPENSSH" = "yes" && test "x$ENABLED_FIPS" = "xno") || \
test "$ENABLED_WPAS" = "yes" || test "$ENABLED_QT" = "yes"
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
then
Disable RC4 unless forcefully enabled with `--enable-rc4` or if `WOLFSSL_ALLOW_RC4` is specified. Related to issue #4248
2021-07-28 10:31:15 -07:00
test "$enable_arc4" = "" && enable_arc4=yes
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
fi
if test "$ENABLED_ARC4" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_RC4"
else
# turn off ARC4 if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DNO_RC4"
ENABLED_ARC4=no
fi
fi
Added wolfSSl compatability for Asio C++ library
2018-07-02 10:48:02 -06:00
# Asio Support
AC_ARG_ENABLE([asio],
[AS_HELP_STRING([--enable-asio],[Enable asio (default: disabled)])],
[ ENABLED_ASIO=$enableval ],
[ ENABLED_ASIO=no ]
)
if test "$ENABLED_ASIO" = "yes"
then
Fixes for asio build options (so includes OPENSSL_EXTRA). Fix for bad named variable `shutdown`. Fix for the side size in Options struct to support `WOLFSSL_SIDE_NEITHER` (3). Fix to set the side on wolfSS_connect() or wolfSS_accept().
2018-08-01 19:45:09 -07:00
# Requires opensslextra and opensslall
Added wolfSSl compatability for Asio C++ library
2018-07-02 10:48:02 -06:00
if test "x$ENABLED_OPENSSLALL" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLALL="yes"
Fixes for asio build options (so includes OPENSSL_EXTRA). Fix for bad named variable `shutdown`. Fix for the side size in Options struct to support `WOLFSSL_SIDE_NEITHER` (3). Fix to set the side on wolfSS_connect() or wolfSS_accept().
2018-08-01 19:45:09 -07:00
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DOPENSSL_ALL"
Added wolfSSl compatability for Asio C++ library
2018-07-02 10:48:02 -06:00
fi
websocketpp compat. addition, add new define for asio
2018-07-18 12:09:12 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASIO -DASIO_USE_WOLFSSL -DWOLFSSL_KEY_GEN"
Fixes for asio build options (so includes OPENSSL_EXTRA). Fix for bad named variable `shutdown`. Fix for the side size in Options struct to support `WOLFSSL_SIDE_NEITHER` (3). Fix to set the side on wolfSS_connect() or wolfSS_accept().
2018-08-01 19:45:09 -07:00
AM_CFLAGS="$AM_CFLAGS -DBOOST_ASIO_USE_WOLFSSL -DHAVE_EX_DATA"
Fix building ASIO with Old TLS disabled.
2022-01-14 15:00:02 -07:00
AM_CFLAGS="$AM_CFLAGS -DSSL_TXT_TLSV1_2"
Added different tls version support for asio
2018-07-12 11:59:58 -06:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_NO_SSL2 -DOPENSSL_NO_SSL3"
if test "$ENABLED_TLSV10" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DSSL_TXT_TLSV1"
fi
Fix building ASIO with Old TLS disabled.
2022-01-14 15:00:02 -07:00
if test "$ENABLED_OLD_TLS" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DSSL_TXT_TLSV1_1"
fi
Added wolfSSl compatability for Asio C++ library
2018-07-02 10:48:02 -06:00
# Requires OCSP make sure on
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
fi
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
Add Apache HTTP Server compatibility and --enable-apachehttpd option (#2466) * Added Apache httpd support `--enable-apachehttpd`. * Added `SSL_CIPHER_get_version`, `BIO_new_fp`, `SSL_SESSION_print` and `SSL_in_connect_init` compatibility API's. * Fix to expose `ASN1_UTCTIME_print` stub. * Pulled in `wolfSSL_X509_get_ext_count` from QT. * Added `X509_get_ext_count`, `BIO_set_callback`, `BIO_set_callback_arg` and `BIO_get_callback_arg`. * Added `wolfSSL_ERR_print_errors`. * Added `BIO_set_nbio` template. * Fixes for building with Apache httpd. * Added DH prime functions required for Apache httpd. * Fix and move the BN DH prime macros. * Fix for `SSL_CTX_set_tlsext_servername_arg` to have return code. * Only add the `BN_get_rfc*_prime_*` macro's if older than 1.1.0. * Added `ERR_GET_FUNC`, `SSL_CTX_clear_extra_chain_certs` prototypes. * Added `wolfSSL_CTX_set_client_cert_cb` template and `OPENSSL_load_builtin_modules` stub macro. * Added `X509_INFO` templates (`X509_INFO_new`, `X509_INFO_free`, `sk_X509_INFO_new_null`, `sk_X509_INFO_num`, `sk_X509_INFO_value`, `sk_X509_INFO_free`). Added `sk_X509_shift`. * Added BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg * add BIO_set_nbio, ERR_print_errors and tests * add X509 INFO stack push function * Add ASN1_UTCTIME_print and unit test * Add X509_get_ext_count unit test * initial commit of wolfSSL_PEM_X509_INFO_read_bio * Added `sk_X509_NAME_new`, `sk_X509_NAME_push`, `sk_X509_NAME_find`, `sk_X509_NAME_set_cmp_func` and `sk_X509_NAME_free`. Grouped `sk_X509_NAME_*` functions. * Cleanup sk X509 NAME/INFO pop free template. * Advance openssl compatibility to v1.1.0 for Apache httpd. Added TLS version macros. Implemented sk X509 NAME/INFO pop and pop_free. * Added `TLS_client_method` support. * Added `SSL_get_server_tmp_key` and `EC_curve_nid2nist`. * Added `SSL_CTX_set_min_proto_version` and `SSL_CTX_set_max_proto_version`. Fix for `BN_get_rfc*_prime_*` with the v1.1.0 change. * add test cases for PEM_X509_INFO_read_bio * Fixes for `BN_get_rfc*_prime_*` macros. Added template for `SSL_DH_set0_pqg`. Fix for `SSL_OP_NO_` to use Macro's (as is done in openssl). Added `SSL_set_verify_result`. Added stub for `OPENSSL_malloc_init`. * Apache httpd compatibility functions. BIO setter/getters. * implement ASN1_TIME_check and add test case * add SSL_get_client_CA_list * add initial implementation of wolfSSL_DH_set0_pqg * Add apache support to OBJ_txt2nid and unit test, add stub for OBJ_create * add X509_STORE_CTX_get1_chain, sk_free, sk_X509_dup * Add sk_SSL_COMP_num and SSL_COMP struct * implement and test of SSL_SESSION_print * add SSL_CTX_set_client_cert_cb * expand BIO_printf and add test case * Added `OCSP_CERTID_dup`. Added `ASN1_TYPE`. * add implementation for wolfSSL_get_server_tmp_key * add wolfSSL_BIO_puts and test case * Add X509_EXTENSION_get_object and X509_EXTENSION_get_data * add helper for bio flag set and null x509 stack * add test adn implementation for wolfSSL_i2d_PrivateKey * Added `ASN1_OTHERNAME`, `ACCESS_DESCRIPTION` and `GENERAL_NAME`. Added `sk_ACCESS_DESCRIPTION_pop_free` and `ACCESS_DESCRIPTION_free` stubs. * add wolfSSL_PEM_read_bio_ECPKParameters * add BIO_vfree * add X509_up_ref * add X509_STORE_CTX_set_ex_data * add _GNU_SOURCE macro and wolfSSL_EVP_read_pw_string * add wolfSSL_EVP_PKEY_ref_up function * X509_get_ext, X509V3_EXT_print, and d2i_DISPLAYTEXT stubs * add X509_set_issuer_name * add wolfSSL_sk_SSL_CIPHER_* functions and tests * add prototype for sk_X509_EXTENSION and ACCESS_DESCRIPTION * fix casting to avoid clang warning * adjust test_wolfSSL_X509_STORE_CTX test case * Added `OpenSSL_version` * renegotiate functions and additional stack functions * add aditional stub functions * Add Apache httpd requirements for ALPN, CRL, Cert Gen/Req/Ext and SecRen. Fix for `sk_X509_INFO_new_null`. * add ocsp stub functions * Proper fix for `sk_X509_INFO_new_null`. Added templates for `X509_get_ext_by_NID` and `X509_add_ext`. Added templates for `ASN1_TIME_diff` and `ASN1_TIME_set`. * x509 extension stack additions * Fixed template for `OCSP_id_get0_info`. * add X509 stub functions * add X509_STORE_CTX_get0_store() and unit test * Added `EVP_PKEY_CTX_new_id`, `EVP_PKEY_CTX_set_rsa_keygen_bits`, `EVP_PKEY_keygen_init`, `EVP_PKEY_keygen` and `BN_to_ASN1_INTEGER`. * x509v3 stubs and req add extensions * Add OBJ_txt2obj and unit test; add long name to wolfssl_object_info table for use by OBJ_* functions * wolfSSL_set_alpn_protos implementation * Added `EVP_SignInit_ex` and `TLS_server_method` implementation. Added stubs for `RSA_get0_key` and `i2d_OCSP_REQUEST_bio`. Fix typo on `OCSP_response_create`. Fix warning in `wolfSSL_set_alpn_protos`. * Added `X509_EXTENSION_free` stub. Fixed a few macro typos/adding missing. * add X509_STORE_CTX_get0_current_issuer and unit test * add OBJ_cmp and unit test * add RSA_get0_key and unit test * add OCSP_check_nonce * Implement X509_set_notAfter/notBefore/serialNumber/version,X509_STORE_CTX_set_depth,X509V3_set_ctx. * Modify wolfSSL_X509_set_notAfter/notBefore and add tests for each. * Add test_wolfSSL_X509_set_version w/ fixes to _set_version and fix _set_notBefore/notAfter tests * add OCSP_id_get0_info and unit test, move WOLFSSL_ASN1_INTEGER to asn_public.h from ssl.h * inital implementation of wolfSSL_X509_sign * add debugging messages and set data for BIO's * Add i2d_OCSP_REQUEST_bio. * implementation of some WOLFSSL_BIO_METHOD custom functions * fix for ASN time structure and remove log node * initial eNULL support and sanity checks * fixes after rebasing code * adjust test cases and ASN1_TIME print * Various fixes for memory leaks * Apache compatibility in CTX_set_client_CA_list for X509_NAME use; add X509_NAME_dup as supporting function * Add initial X509_STORE_load_locations stub for Apache * Updates to X509_get_ext_d2i to return GENERAL_NAME struct instead of ASN1_OBJECT for alternative names and add supporting GENERAL_NAME functions * Add X509_STORE_load_locations implementation; add wolfSSL_CertManagerLoadCRL_ex; initial renegotiation fixes/updates * Fix for freeing peer cert in wolfSSL_Rehandshake instead of FreeHandShakeResources during secure renegotiation * Add X509_ALGOR and X509_PUBKEY structs for X509_PUBKEY_get0_param and X509_get_X509_PUBKEY implementation * Initial implementation of wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Add implementation for X509_get0_tbs_sigalg and X509_ALGOR_get0 * Add OBJ_nid2ln implementation * Fix compile errors in tests/api.c for some build options * Updates to X509_STORE_load_locations for non-CRL types; Add additional DETECT_CERT_TYPE enum and logic for detecting certificate type in ProcessFile * Add X509_STORE_load_locations unit test and minor error handling fixes * Add unit test for X509_sign * Set correct alert type for revoked certificates; add/fix a few WOLFSSL_ENTER messages * Add X509_ALGOR member to X509 struct; refactoring and unit tests for wolfSSL_X509_ALGOR_get0 and wolfSSL_X509_get0_tbs_sigalg * Add X509_PUBKEY member to X509 struct; refactoring and unit tests for wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Stack fixes after rebase * Secure renegotiation refactoring: add ACCEPT_BEGIN_RENEG to AcceptState for use in wolfSSL_SSL_in_connect_init; free old peer cert when receiving new cert to fix memory leak * Move enc-then-mac enable option in configure.ac for apache httpd compatibility * Simplify wolfSSL_SSL_in_connect_init logic * Remove unneeded wolfSSL_CertManagerLoadCRL_ex * Fixes for jenkins test failures * SSL_get_secure_renegotiation_support for print statement in Apache
2019-09-19 18:11:10 -06:00
# Apache HTTPD
AC_ARG_ENABLE([apachehttpd],
[AS_HELP_STRING([--enable-apachehttpd],[Enable Apache httpd (default: disabled)])],
[ ENABLED_APACHE_HTTPD=$enableval ],
[ ENABLED_APACHE_HTTPD=no ]
)
if test "$ENABLED_APACHE_HTTPD" = "yes"
then
# Requires opensslextra and opensslall
if test "x$ENABLED_OPENSSLALL" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLALL="yes"
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DOPENSSL_ALL"
Add Apache HTTP Server compatibility and --enable-apachehttpd option (#2466) * Added Apache httpd support `--enable-apachehttpd`. * Added `SSL_CIPHER_get_version`, `BIO_new_fp`, `SSL_SESSION_print` and `SSL_in_connect_init` compatibility API's. * Fix to expose `ASN1_UTCTIME_print` stub. * Pulled in `wolfSSL_X509_get_ext_count` from QT. * Added `X509_get_ext_count`, `BIO_set_callback`, `BIO_set_callback_arg` and `BIO_get_callback_arg`. * Added `wolfSSL_ERR_print_errors`. * Added `BIO_set_nbio` template. * Fixes for building with Apache httpd. * Added DH prime functions required for Apache httpd. * Fix and move the BN DH prime macros. * Fix for `SSL_CTX_set_tlsext_servername_arg` to have return code. * Only add the `BN_get_rfc*_prime_*` macro's if older than 1.1.0. * Added `ERR_GET_FUNC`, `SSL_CTX_clear_extra_chain_certs` prototypes. * Added `wolfSSL_CTX_set_client_cert_cb` template and `OPENSSL_load_builtin_modules` stub macro. * Added `X509_INFO` templates (`X509_INFO_new`, `X509_INFO_free`, `sk_X509_INFO_new_null`, `sk_X509_INFO_num`, `sk_X509_INFO_value`, `sk_X509_INFO_free`). Added `sk_X509_shift`. * Added BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg * add BIO_set_nbio, ERR_print_errors and tests * add X509 INFO stack push function * Add ASN1_UTCTIME_print and unit test * Add X509_get_ext_count unit test * initial commit of wolfSSL_PEM_X509_INFO_read_bio * Added `sk_X509_NAME_new`, `sk_X509_NAME_push`, `sk_X509_NAME_find`, `sk_X509_NAME_set_cmp_func` and `sk_X509_NAME_free`. Grouped `sk_X509_NAME_*` functions. * Cleanup sk X509 NAME/INFO pop free template. * Advance openssl compatibility to v1.1.0 for Apache httpd. Added TLS version macros. Implemented sk X509 NAME/INFO pop and pop_free. * Added `TLS_client_method` support. * Added `SSL_get_server_tmp_key` and `EC_curve_nid2nist`. * Added `SSL_CTX_set_min_proto_version` and `SSL_CTX_set_max_proto_version`. Fix for `BN_get_rfc*_prime_*` with the v1.1.0 change. * add test cases for PEM_X509_INFO_read_bio * Fixes for `BN_get_rfc*_prime_*` macros. Added template for `SSL_DH_set0_pqg`. Fix for `SSL_OP_NO_` to use Macro's (as is done in openssl). Added `SSL_set_verify_result`. Added stub for `OPENSSL_malloc_init`. * Apache httpd compatibility functions. BIO setter/getters. * implement ASN1_TIME_check and add test case * add SSL_get_client_CA_list * add initial implementation of wolfSSL_DH_set0_pqg * Add apache support to OBJ_txt2nid and unit test, add stub for OBJ_create * add X509_STORE_CTX_get1_chain, sk_free, sk_X509_dup * Add sk_SSL_COMP_num and SSL_COMP struct * implement and test of SSL_SESSION_print * add SSL_CTX_set_client_cert_cb * expand BIO_printf and add test case * Added `OCSP_CERTID_dup`. Added `ASN1_TYPE`. * add implementation for wolfSSL_get_server_tmp_key * add wolfSSL_BIO_puts and test case * Add X509_EXTENSION_get_object and X509_EXTENSION_get_data * add helper for bio flag set and null x509 stack * add test adn implementation for wolfSSL_i2d_PrivateKey * Added `ASN1_OTHERNAME`, `ACCESS_DESCRIPTION` and `GENERAL_NAME`. Added `sk_ACCESS_DESCRIPTION_pop_free` and `ACCESS_DESCRIPTION_free` stubs. * add wolfSSL_PEM_read_bio_ECPKParameters * add BIO_vfree * add X509_up_ref * add X509_STORE_CTX_set_ex_data * add _GNU_SOURCE macro and wolfSSL_EVP_read_pw_string * add wolfSSL_EVP_PKEY_ref_up function * X509_get_ext, X509V3_EXT_print, and d2i_DISPLAYTEXT stubs * add X509_set_issuer_name * add wolfSSL_sk_SSL_CIPHER_* functions and tests * add prototype for sk_X509_EXTENSION and ACCESS_DESCRIPTION * fix casting to avoid clang warning * adjust test_wolfSSL_X509_STORE_CTX test case * Added `OpenSSL_version` * renegotiate functions and additional stack functions * add aditional stub functions * Add Apache httpd requirements for ALPN, CRL, Cert Gen/Req/Ext and SecRen. Fix for `sk_X509_INFO_new_null`. * add ocsp stub functions * Proper fix for `sk_X509_INFO_new_null`. Added templates for `X509_get_ext_by_NID` and `X509_add_ext`. Added templates for `ASN1_TIME_diff` and `ASN1_TIME_set`. * x509 extension stack additions * Fixed template for `OCSP_id_get0_info`. * add X509 stub functions * add X509_STORE_CTX_get0_store() and unit test * Added `EVP_PKEY_CTX_new_id`, `EVP_PKEY_CTX_set_rsa_keygen_bits`, `EVP_PKEY_keygen_init`, `EVP_PKEY_keygen` and `BN_to_ASN1_INTEGER`. * x509v3 stubs and req add extensions * Add OBJ_txt2obj and unit test; add long name to wolfssl_object_info table for use by OBJ_* functions * wolfSSL_set_alpn_protos implementation * Added `EVP_SignInit_ex` and `TLS_server_method` implementation. Added stubs for `RSA_get0_key` and `i2d_OCSP_REQUEST_bio`. Fix typo on `OCSP_response_create`. Fix warning in `wolfSSL_set_alpn_protos`. * Added `X509_EXTENSION_free` stub. Fixed a few macro typos/adding missing. * add X509_STORE_CTX_get0_current_issuer and unit test * add OBJ_cmp and unit test * add RSA_get0_key and unit test * add OCSP_check_nonce * Implement X509_set_notAfter/notBefore/serialNumber/version,X509_STORE_CTX_set_depth,X509V3_set_ctx. * Modify wolfSSL_X509_set_notAfter/notBefore and add tests for each. * Add test_wolfSSL_X509_set_version w/ fixes to _set_version and fix _set_notBefore/notAfter tests * add OCSP_id_get0_info and unit test, move WOLFSSL_ASN1_INTEGER to asn_public.h from ssl.h * inital implementation of wolfSSL_X509_sign * add debugging messages and set data for BIO's * Add i2d_OCSP_REQUEST_bio. * implementation of some WOLFSSL_BIO_METHOD custom functions * fix for ASN time structure and remove log node * initial eNULL support and sanity checks * fixes after rebasing code * adjust test cases and ASN1_TIME print * Various fixes for memory leaks * Apache compatibility in CTX_set_client_CA_list for X509_NAME use; add X509_NAME_dup as supporting function * Add initial X509_STORE_load_locations stub for Apache * Updates to X509_get_ext_d2i to return GENERAL_NAME struct instead of ASN1_OBJECT for alternative names and add supporting GENERAL_NAME functions * Add X509_STORE_load_locations implementation; add wolfSSL_CertManagerLoadCRL_ex; initial renegotiation fixes/updates * Fix for freeing peer cert in wolfSSL_Rehandshake instead of FreeHandShakeResources during secure renegotiation * Add X509_ALGOR and X509_PUBKEY structs for X509_PUBKEY_get0_param and X509_get_X509_PUBKEY implementation * Initial implementation of wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Add implementation for X509_get0_tbs_sigalg and X509_ALGOR_get0 * Add OBJ_nid2ln implementation * Fix compile errors in tests/api.c for some build options * Updates to X509_STORE_load_locations for non-CRL types; Add additional DETECT_CERT_TYPE enum and logic for detecting certificate type in ProcessFile * Add X509_STORE_load_locations unit test and minor error handling fixes * Add unit test for X509_sign * Set correct alert type for revoked certificates; add/fix a few WOLFSSL_ENTER messages * Add X509_ALGOR member to X509 struct; refactoring and unit tests for wolfSSL_X509_ALGOR_get0 and wolfSSL_X509_get0_tbs_sigalg * Add X509_PUBKEY member to X509 struct; refactoring and unit tests for wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Stack fixes after rebase * Secure renegotiation refactoring: add ACCEPT_BEGIN_RENEG to AcceptState for use in wolfSSL_SSL_in_connect_init; free old peer cert when receiving new cert to fix memory leak * Move enc-then-mac enable option in configure.ac for apache httpd compatibility * Simplify wolfSSL_SSL_in_connect_init logic * Remove unneeded wolfSSL_CertManagerLoadCRL_ex * Fixes for jenkins test failures * SSL_get_secure_renegotiation_support for print statement in Apache
2019-09-19 18:11:10 -06:00
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_APACHE_HTTPD"
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_NO_SSL2 -DOPENSSL_NO_SSL3 -DOPENSSL_NO_COMP"
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA -DWOLFSSL_SIGNER_DER_CERT"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT -DWOLFSSL_CERT_GEN"
Fix for SNI callback * Fix for SNI callback on server to make sure the SNI data is stored even without setting a hostname. This makes sure the SNI extension is set when there is a registered SNI recv callback. * Fix for Apache HTTPD to include `WOLFSSL_ALWAYS_KEEP_SNI`
2021-03-22 10:45:31 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_KEEP_SNI"
Add Apache 2.4.51 support - Define `OPENSSL_COMPATIBLE_DEFAULTS` and `WOLFSSL_NO_OCSP_ISSUER_CHECK` for Apache config - Fix `SSL_set_timeout` to match OpenSSL signature - Implement `pkey` in `X509_INFO` - Detect attempt to connect with plain HTTP - Implement `wolfSSL_OCSP_request_add1_nonce` - Set `ssl->cipher.bits` when calling `wolfSSL_get_current_cipher` - Use custom flush method in `wolfSSL_BIO_flush` when set in BIO method - Set the TLS version options in the `ssl->options` at the end of ClientHello parsing - Don't modify the `ssl->version` when in a handshake (`ssl->msgsReceived.got_client_hello` is set) - `wolfSSL_get_shutdown` returns a full bidirectional return when the SSL object is cleared. `wolfSSL_get_shutdown` calls `wolfSSL_clear` on a successful shutdown so if we detect a cleared SSL object, assume full shutdown was performed.
2021-12-06 18:44:19 +01:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_COMPATIBLE_DEFAULTS"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_OCSP_ISSUER_CHECK"
Add Apache HTTP Server compatibility and --enable-apachehttpd option (#2466) * Added Apache httpd support `--enable-apachehttpd`. * Added `SSL_CIPHER_get_version`, `BIO_new_fp`, `SSL_SESSION_print` and `SSL_in_connect_init` compatibility API's. * Fix to expose `ASN1_UTCTIME_print` stub. * Pulled in `wolfSSL_X509_get_ext_count` from QT. * Added `X509_get_ext_count`, `BIO_set_callback`, `BIO_set_callback_arg` and `BIO_get_callback_arg`. * Added `wolfSSL_ERR_print_errors`. * Added `BIO_set_nbio` template. * Fixes for building with Apache httpd. * Added DH prime functions required for Apache httpd. * Fix and move the BN DH prime macros. * Fix for `SSL_CTX_set_tlsext_servername_arg` to have return code. * Only add the `BN_get_rfc*_prime_*` macro's if older than 1.1.0. * Added `ERR_GET_FUNC`, `SSL_CTX_clear_extra_chain_certs` prototypes. * Added `wolfSSL_CTX_set_client_cert_cb` template and `OPENSSL_load_builtin_modules` stub macro. * Added `X509_INFO` templates (`X509_INFO_new`, `X509_INFO_free`, `sk_X509_INFO_new_null`, `sk_X509_INFO_num`, `sk_X509_INFO_value`, `sk_X509_INFO_free`). Added `sk_X509_shift`. * Added BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg * add BIO_set_nbio, ERR_print_errors and tests * add X509 INFO stack push function * Add ASN1_UTCTIME_print and unit test * Add X509_get_ext_count unit test * initial commit of wolfSSL_PEM_X509_INFO_read_bio * Added `sk_X509_NAME_new`, `sk_X509_NAME_push`, `sk_X509_NAME_find`, `sk_X509_NAME_set_cmp_func` and `sk_X509_NAME_free`. Grouped `sk_X509_NAME_*` functions. * Cleanup sk X509 NAME/INFO pop free template. * Advance openssl compatibility to v1.1.0 for Apache httpd. Added TLS version macros. Implemented sk X509 NAME/INFO pop and pop_free. * Added `TLS_client_method` support. * Added `SSL_get_server_tmp_key` and `EC_curve_nid2nist`. * Added `SSL_CTX_set_min_proto_version` and `SSL_CTX_set_max_proto_version`. Fix for `BN_get_rfc*_prime_*` with the v1.1.0 change. * add test cases for PEM_X509_INFO_read_bio * Fixes for `BN_get_rfc*_prime_*` macros. Added template for `SSL_DH_set0_pqg`. Fix for `SSL_OP_NO_` to use Macro's (as is done in openssl). Added `SSL_set_verify_result`. Added stub for `OPENSSL_malloc_init`. * Apache httpd compatibility functions. BIO setter/getters. * implement ASN1_TIME_check and add test case * add SSL_get_client_CA_list * add initial implementation of wolfSSL_DH_set0_pqg * Add apache support to OBJ_txt2nid and unit test, add stub for OBJ_create * add X509_STORE_CTX_get1_chain, sk_free, sk_X509_dup * Add sk_SSL_COMP_num and SSL_COMP struct * implement and test of SSL_SESSION_print * add SSL_CTX_set_client_cert_cb * expand BIO_printf and add test case * Added `OCSP_CERTID_dup`. Added `ASN1_TYPE`. * add implementation for wolfSSL_get_server_tmp_key * add wolfSSL_BIO_puts and test case * Add X509_EXTENSION_get_object and X509_EXTENSION_get_data * add helper for bio flag set and null x509 stack * add test adn implementation for wolfSSL_i2d_PrivateKey * Added `ASN1_OTHERNAME`, `ACCESS_DESCRIPTION` and `GENERAL_NAME`. Added `sk_ACCESS_DESCRIPTION_pop_free` and `ACCESS_DESCRIPTION_free` stubs. * add wolfSSL_PEM_read_bio_ECPKParameters * add BIO_vfree * add X509_up_ref * add X509_STORE_CTX_set_ex_data * add _GNU_SOURCE macro and wolfSSL_EVP_read_pw_string * add wolfSSL_EVP_PKEY_ref_up function * X509_get_ext, X509V3_EXT_print, and d2i_DISPLAYTEXT stubs * add X509_set_issuer_name * add wolfSSL_sk_SSL_CIPHER_* functions and tests * add prototype for sk_X509_EXTENSION and ACCESS_DESCRIPTION * fix casting to avoid clang warning * adjust test_wolfSSL_X509_STORE_CTX test case * Added `OpenSSL_version` * renegotiate functions and additional stack functions * add aditional stub functions * Add Apache httpd requirements for ALPN, CRL, Cert Gen/Req/Ext and SecRen. Fix for `sk_X509_INFO_new_null`. * add ocsp stub functions * Proper fix for `sk_X509_INFO_new_null`. Added templates for `X509_get_ext_by_NID` and `X509_add_ext`. Added templates for `ASN1_TIME_diff` and `ASN1_TIME_set`. * x509 extension stack additions * Fixed template for `OCSP_id_get0_info`. * add X509 stub functions * add X509_STORE_CTX_get0_store() and unit test * Added `EVP_PKEY_CTX_new_id`, `EVP_PKEY_CTX_set_rsa_keygen_bits`, `EVP_PKEY_keygen_init`, `EVP_PKEY_keygen` and `BN_to_ASN1_INTEGER`. * x509v3 stubs and req add extensions * Add OBJ_txt2obj and unit test; add long name to wolfssl_object_info table for use by OBJ_* functions * wolfSSL_set_alpn_protos implementation * Added `EVP_SignInit_ex` and `TLS_server_method` implementation. Added stubs for `RSA_get0_key` and `i2d_OCSP_REQUEST_bio`. Fix typo on `OCSP_response_create`. Fix warning in `wolfSSL_set_alpn_protos`. * Added `X509_EXTENSION_free` stub. Fixed a few macro typos/adding missing. * add X509_STORE_CTX_get0_current_issuer and unit test * add OBJ_cmp and unit test * add RSA_get0_key and unit test * add OCSP_check_nonce * Implement X509_set_notAfter/notBefore/serialNumber/version,X509_STORE_CTX_set_depth,X509V3_set_ctx. * Modify wolfSSL_X509_set_notAfter/notBefore and add tests for each. * Add test_wolfSSL_X509_set_version w/ fixes to _set_version and fix _set_notBefore/notAfter tests * add OCSP_id_get0_info and unit test, move WOLFSSL_ASN1_INTEGER to asn_public.h from ssl.h * inital implementation of wolfSSL_X509_sign * add debugging messages and set data for BIO's * Add i2d_OCSP_REQUEST_bio. * implementation of some WOLFSSL_BIO_METHOD custom functions * fix for ASN time structure and remove log node * initial eNULL support and sanity checks * fixes after rebasing code * adjust test cases and ASN1_TIME print * Various fixes for memory leaks * Apache compatibility in CTX_set_client_CA_list for X509_NAME use; add X509_NAME_dup as supporting function * Add initial X509_STORE_load_locations stub for Apache * Updates to X509_get_ext_d2i to return GENERAL_NAME struct instead of ASN1_OBJECT for alternative names and add supporting GENERAL_NAME functions * Add X509_STORE_load_locations implementation; add wolfSSL_CertManagerLoadCRL_ex; initial renegotiation fixes/updates * Fix for freeing peer cert in wolfSSL_Rehandshake instead of FreeHandShakeResources during secure renegotiation * Add X509_ALGOR and X509_PUBKEY structs for X509_PUBKEY_get0_param and X509_get_X509_PUBKEY implementation * Initial implementation of wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Add implementation for X509_get0_tbs_sigalg and X509_ALGOR_get0 * Add OBJ_nid2ln implementation * Fix compile errors in tests/api.c for some build options * Updates to X509_STORE_load_locations for non-CRL types; Add additional DETECT_CERT_TYPE enum and logic for detecting certificate type in ProcessFile * Add X509_STORE_load_locations unit test and minor error handling fixes * Add unit test for X509_sign * Set correct alert type for revoked certificates; add/fix a few WOLFSSL_ENTER messages * Add X509_ALGOR member to X509 struct; refactoring and unit tests for wolfSSL_X509_ALGOR_get0 and wolfSSL_X509_get0_tbs_sigalg * Add X509_PUBKEY member to X509 struct; refactoring and unit tests for wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Stack fixes after rebase * Secure renegotiation refactoring: add ACCEPT_BEGIN_RENEG to AcceptState for use in wolfSSL_SSL_in_connect_init; free old peer cert when receiving new cert to fix memory leak * Move enc-then-mac enable option in configure.ac for apache httpd compatibility * Simplify wolfSSL_SSL_in_connect_init logic * Remove unneeded wolfSSL_CertManagerLoadCRL_ex * Fixes for jenkins test failures * SSL_get_secure_renegotiation_support for print statement in Apache
2019-09-19 18:11:10 -06:00
# Requires OCSP make sure on
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
# Requires sessioncerts make sure on
if test "x$ENABLED_SESSIONCERTS" = "xno"
then
ENABLED_SESSIONCERTS="yes"
AM_CFLAGS="$AM_CFLAGS -DSESSION_CERTS"
fi
# Requires ALPN
if test "x$ENABLED_ALPN" = "xno"
then
ENABLED_ALPN="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_ALPN"
fi
# Requires CRL
if test "x$ENABLED_CRL" = "xno"
then
ENABLED_CRL="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL"
fi
# Requires Certificate Generation, Request and Extensions
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
if test "x$ENABLED_CERTREQ" = "xno"
then
ENABLED_CERTREQ="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_REQ"
fi
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"
fi
# Requires Secure Renegotiation
if test "x$ENABLED_SECURE_RENEGOTIATION" = "xno"
then
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SECURE_RENEGOTIATION -DHAVE_SERVER_RENEGOTIATION_INFO"
Add Apache HTTP Server compatibility and --enable-apachehttpd option (#2466) * Added Apache httpd support `--enable-apachehttpd`. * Added `SSL_CIPHER_get_version`, `BIO_new_fp`, `SSL_SESSION_print` and `SSL_in_connect_init` compatibility API's. * Fix to expose `ASN1_UTCTIME_print` stub. * Pulled in `wolfSSL_X509_get_ext_count` from QT. * Added `X509_get_ext_count`, `BIO_set_callback`, `BIO_set_callback_arg` and `BIO_get_callback_arg`. * Added `wolfSSL_ERR_print_errors`. * Added `BIO_set_nbio` template. * Fixes for building with Apache httpd. * Added DH prime functions required for Apache httpd. * Fix and move the BN DH prime macros. * Fix for `SSL_CTX_set_tlsext_servername_arg` to have return code. * Only add the `BN_get_rfc*_prime_*` macro's if older than 1.1.0. * Added `ERR_GET_FUNC`, `SSL_CTX_clear_extra_chain_certs` prototypes. * Added `wolfSSL_CTX_set_client_cert_cb` template and `OPENSSL_load_builtin_modules` stub macro. * Added `X509_INFO` templates (`X509_INFO_new`, `X509_INFO_free`, `sk_X509_INFO_new_null`, `sk_X509_INFO_num`, `sk_X509_INFO_value`, `sk_X509_INFO_free`). Added `sk_X509_shift`. * Added BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg * add BIO_set_nbio, ERR_print_errors and tests * add X509 INFO stack push function * Add ASN1_UTCTIME_print and unit test * Add X509_get_ext_count unit test * initial commit of wolfSSL_PEM_X509_INFO_read_bio * Added `sk_X509_NAME_new`, `sk_X509_NAME_push`, `sk_X509_NAME_find`, `sk_X509_NAME_set_cmp_func` and `sk_X509_NAME_free`. Grouped `sk_X509_NAME_*` functions. * Cleanup sk X509 NAME/INFO pop free template. * Advance openssl compatibility to v1.1.0 for Apache httpd. Added TLS version macros. Implemented sk X509 NAME/INFO pop and pop_free. * Added `TLS_client_method` support. * Added `SSL_get_server_tmp_key` and `EC_curve_nid2nist`. * Added `SSL_CTX_set_min_proto_version` and `SSL_CTX_set_max_proto_version`. Fix for `BN_get_rfc*_prime_*` with the v1.1.0 change. * add test cases for PEM_X509_INFO_read_bio * Fixes for `BN_get_rfc*_prime_*` macros. Added template for `SSL_DH_set0_pqg`. Fix for `SSL_OP_NO_` to use Macro's (as is done in openssl). Added `SSL_set_verify_result`. Added stub for `OPENSSL_malloc_init`. * Apache httpd compatibility functions. BIO setter/getters. * implement ASN1_TIME_check and add test case * add SSL_get_client_CA_list * add initial implementation of wolfSSL_DH_set0_pqg * Add apache support to OBJ_txt2nid and unit test, add stub for OBJ_create * add X509_STORE_CTX_get1_chain, sk_free, sk_X509_dup * Add sk_SSL_COMP_num and SSL_COMP struct * implement and test of SSL_SESSION_print * add SSL_CTX_set_client_cert_cb * expand BIO_printf and add test case * Added `OCSP_CERTID_dup`. Added `ASN1_TYPE`. * add implementation for wolfSSL_get_server_tmp_key * add wolfSSL_BIO_puts and test case * Add X509_EXTENSION_get_object and X509_EXTENSION_get_data * add helper for bio flag set and null x509 stack * add test adn implementation for wolfSSL_i2d_PrivateKey * Added `ASN1_OTHERNAME`, `ACCESS_DESCRIPTION` and `GENERAL_NAME`. Added `sk_ACCESS_DESCRIPTION_pop_free` and `ACCESS_DESCRIPTION_free` stubs. * add wolfSSL_PEM_read_bio_ECPKParameters * add BIO_vfree * add X509_up_ref * add X509_STORE_CTX_set_ex_data * add _GNU_SOURCE macro and wolfSSL_EVP_read_pw_string * add wolfSSL_EVP_PKEY_ref_up function * X509_get_ext, X509V3_EXT_print, and d2i_DISPLAYTEXT stubs * add X509_set_issuer_name * add wolfSSL_sk_SSL_CIPHER_* functions and tests * add prototype for sk_X509_EXTENSION and ACCESS_DESCRIPTION * fix casting to avoid clang warning * adjust test_wolfSSL_X509_STORE_CTX test case * Added `OpenSSL_version` * renegotiate functions and additional stack functions * add aditional stub functions * Add Apache httpd requirements for ALPN, CRL, Cert Gen/Req/Ext and SecRen. Fix for `sk_X509_INFO_new_null`. * add ocsp stub functions * Proper fix for `sk_X509_INFO_new_null`. Added templates for `X509_get_ext_by_NID` and `X509_add_ext`. Added templates for `ASN1_TIME_diff` and `ASN1_TIME_set`. * x509 extension stack additions * Fixed template for `OCSP_id_get0_info`. * add X509 stub functions * add X509_STORE_CTX_get0_store() and unit test * Added `EVP_PKEY_CTX_new_id`, `EVP_PKEY_CTX_set_rsa_keygen_bits`, `EVP_PKEY_keygen_init`, `EVP_PKEY_keygen` and `BN_to_ASN1_INTEGER`. * x509v3 stubs and req add extensions * Add OBJ_txt2obj and unit test; add long name to wolfssl_object_info table for use by OBJ_* functions * wolfSSL_set_alpn_protos implementation * Added `EVP_SignInit_ex` and `TLS_server_method` implementation. Added stubs for `RSA_get0_key` and `i2d_OCSP_REQUEST_bio`. Fix typo on `OCSP_response_create`. Fix warning in `wolfSSL_set_alpn_protos`. * Added `X509_EXTENSION_free` stub. Fixed a few macro typos/adding missing. * add X509_STORE_CTX_get0_current_issuer and unit test * add OBJ_cmp and unit test * add RSA_get0_key and unit test * add OCSP_check_nonce * Implement X509_set_notAfter/notBefore/serialNumber/version,X509_STORE_CTX_set_depth,X509V3_set_ctx. * Modify wolfSSL_X509_set_notAfter/notBefore and add tests for each. * Add test_wolfSSL_X509_set_version w/ fixes to _set_version and fix _set_notBefore/notAfter tests * add OCSP_id_get0_info and unit test, move WOLFSSL_ASN1_INTEGER to asn_public.h from ssl.h * inital implementation of wolfSSL_X509_sign * add debugging messages and set data for BIO's * Add i2d_OCSP_REQUEST_bio. * implementation of some WOLFSSL_BIO_METHOD custom functions * fix for ASN time structure and remove log node * initial eNULL support and sanity checks * fixes after rebasing code * adjust test cases and ASN1_TIME print * Various fixes for memory leaks * Apache compatibility in CTX_set_client_CA_list for X509_NAME use; add X509_NAME_dup as supporting function * Add initial X509_STORE_load_locations stub for Apache * Updates to X509_get_ext_d2i to return GENERAL_NAME struct instead of ASN1_OBJECT for alternative names and add supporting GENERAL_NAME functions * Add X509_STORE_load_locations implementation; add wolfSSL_CertManagerLoadCRL_ex; initial renegotiation fixes/updates * Fix for freeing peer cert in wolfSSL_Rehandshake instead of FreeHandShakeResources during secure renegotiation * Add X509_ALGOR and X509_PUBKEY structs for X509_PUBKEY_get0_param and X509_get_X509_PUBKEY implementation * Initial implementation of wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Add implementation for X509_get0_tbs_sigalg and X509_ALGOR_get0 * Add OBJ_nid2ln implementation * Fix compile errors in tests/api.c for some build options * Updates to X509_STORE_load_locations for non-CRL types; Add additional DETECT_CERT_TYPE enum and logic for detecting certificate type in ProcessFile * Add X509_STORE_load_locations unit test and minor error handling fixes * Add unit test for X509_sign * Set correct alert type for revoked certificates; add/fix a few WOLFSSL_ENTER messages * Add X509_ALGOR member to X509 struct; refactoring and unit tests for wolfSSL_X509_ALGOR_get0 and wolfSSL_X509_get0_tbs_sigalg * Add X509_PUBKEY member to X509 struct; refactoring and unit tests for wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Stack fixes after rebase * Secure renegotiation refactoring: add ACCEPT_BEGIN_RENEG to AcceptState for use in wolfSSL_SSL_in_connect_init; free old peer cert when receiving new cert to fix memory leak * Move enc-then-mac enable option in configure.ac for apache httpd compatibility * Simplify wolfSSL_SSL_in_connect_init logic * Remove unneeded wolfSSL_CertManagerLoadCRL_ex * Fixes for jenkins test failures * SSL_get_secure_renegotiation_support for print statement in Apache
2019-09-19 18:11:10 -06:00
fi
fi
# Encrypt-Then-Mac
AC_ARG_ENABLE([enc-then-mac],
Improve the sniffer asynchronous test case to support multiple concurrent streams.
2022-04-27 16:30:18 -07:00
[AS_HELP_STRING([--enable-enc-then-mac],[Enable Encrypt-Then-Mac extension (default: enabled)])],
Add Apache HTTP Server compatibility and --enable-apachehttpd option (#2466) * Added Apache httpd support `--enable-apachehttpd`. * Added `SSL_CIPHER_get_version`, `BIO_new_fp`, `SSL_SESSION_print` and `SSL_in_connect_init` compatibility API's. * Fix to expose `ASN1_UTCTIME_print` stub. * Pulled in `wolfSSL_X509_get_ext_count` from QT. * Added `X509_get_ext_count`, `BIO_set_callback`, `BIO_set_callback_arg` and `BIO_get_callback_arg`. * Added `wolfSSL_ERR_print_errors`. * Added `BIO_set_nbio` template. * Fixes for building with Apache httpd. * Added DH prime functions required for Apache httpd. * Fix and move the BN DH prime macros. * Fix for `SSL_CTX_set_tlsext_servername_arg` to have return code. * Only add the `BN_get_rfc*_prime_*` macro's if older than 1.1.0. * Added `ERR_GET_FUNC`, `SSL_CTX_clear_extra_chain_certs` prototypes. * Added `wolfSSL_CTX_set_client_cert_cb` template and `OPENSSL_load_builtin_modules` stub macro. * Added `X509_INFO` templates (`X509_INFO_new`, `X509_INFO_free`, `sk_X509_INFO_new_null`, `sk_X509_INFO_num`, `sk_X509_INFO_value`, `sk_X509_INFO_free`). Added `sk_X509_shift`. * Added BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg * add BIO_set_nbio, ERR_print_errors and tests * add X509 INFO stack push function * Add ASN1_UTCTIME_print and unit test * Add X509_get_ext_count unit test * initial commit of wolfSSL_PEM_X509_INFO_read_bio * Added `sk_X509_NAME_new`, `sk_X509_NAME_push`, `sk_X509_NAME_find`, `sk_X509_NAME_set_cmp_func` and `sk_X509_NAME_free`. Grouped `sk_X509_NAME_*` functions. * Cleanup sk X509 NAME/INFO pop free template. * Advance openssl compatibility to v1.1.0 for Apache httpd. Added TLS version macros. Implemented sk X509 NAME/INFO pop and pop_free. * Added `TLS_client_method` support. * Added `SSL_get_server_tmp_key` and `EC_curve_nid2nist`. * Added `SSL_CTX_set_min_proto_version` and `SSL_CTX_set_max_proto_version`. Fix for `BN_get_rfc*_prime_*` with the v1.1.0 change. * add test cases for PEM_X509_INFO_read_bio * Fixes for `BN_get_rfc*_prime_*` macros. Added template for `SSL_DH_set0_pqg`. Fix for `SSL_OP_NO_` to use Macro's (as is done in openssl). Added `SSL_set_verify_result`. Added stub for `OPENSSL_malloc_init`. * Apache httpd compatibility functions. BIO setter/getters. * implement ASN1_TIME_check and add test case * add SSL_get_client_CA_list * add initial implementation of wolfSSL_DH_set0_pqg * Add apache support to OBJ_txt2nid and unit test, add stub for OBJ_create * add X509_STORE_CTX_get1_chain, sk_free, sk_X509_dup * Add sk_SSL_COMP_num and SSL_COMP struct * implement and test of SSL_SESSION_print * add SSL_CTX_set_client_cert_cb * expand BIO_printf and add test case * Added `OCSP_CERTID_dup`. Added `ASN1_TYPE`. * add implementation for wolfSSL_get_server_tmp_key * add wolfSSL_BIO_puts and test case * Add X509_EXTENSION_get_object and X509_EXTENSION_get_data * add helper for bio flag set and null x509 stack * add test adn implementation for wolfSSL_i2d_PrivateKey * Added `ASN1_OTHERNAME`, `ACCESS_DESCRIPTION` and `GENERAL_NAME`. Added `sk_ACCESS_DESCRIPTION_pop_free` and `ACCESS_DESCRIPTION_free` stubs. * add wolfSSL_PEM_read_bio_ECPKParameters * add BIO_vfree * add X509_up_ref * add X509_STORE_CTX_set_ex_data * add _GNU_SOURCE macro and wolfSSL_EVP_read_pw_string * add wolfSSL_EVP_PKEY_ref_up function * X509_get_ext, X509V3_EXT_print, and d2i_DISPLAYTEXT stubs * add X509_set_issuer_name * add wolfSSL_sk_SSL_CIPHER_* functions and tests * add prototype for sk_X509_EXTENSION and ACCESS_DESCRIPTION * fix casting to avoid clang warning * adjust test_wolfSSL_X509_STORE_CTX test case * Added `OpenSSL_version` * renegotiate functions and additional stack functions * add aditional stub functions * Add Apache httpd requirements for ALPN, CRL, Cert Gen/Req/Ext and SecRen. Fix for `sk_X509_INFO_new_null`. * add ocsp stub functions * Proper fix for `sk_X509_INFO_new_null`. Added templates for `X509_get_ext_by_NID` and `X509_add_ext`. Added templates for `ASN1_TIME_diff` and `ASN1_TIME_set`. * x509 extension stack additions * Fixed template for `OCSP_id_get0_info`. * add X509 stub functions * add X509_STORE_CTX_get0_store() and unit test * Added `EVP_PKEY_CTX_new_id`, `EVP_PKEY_CTX_set_rsa_keygen_bits`, `EVP_PKEY_keygen_init`, `EVP_PKEY_keygen` and `BN_to_ASN1_INTEGER`. * x509v3 stubs and req add extensions * Add OBJ_txt2obj and unit test; add long name to wolfssl_object_info table for use by OBJ_* functions * wolfSSL_set_alpn_protos implementation * Added `EVP_SignInit_ex` and `TLS_server_method` implementation. Added stubs for `RSA_get0_key` and `i2d_OCSP_REQUEST_bio`. Fix typo on `OCSP_response_create`. Fix warning in `wolfSSL_set_alpn_protos`. * Added `X509_EXTENSION_free` stub. Fixed a few macro typos/adding missing. * add X509_STORE_CTX_get0_current_issuer and unit test * add OBJ_cmp and unit test * add RSA_get0_key and unit test * add OCSP_check_nonce * Implement X509_set_notAfter/notBefore/serialNumber/version,X509_STORE_CTX_set_depth,X509V3_set_ctx. * Modify wolfSSL_X509_set_notAfter/notBefore and add tests for each. * Add test_wolfSSL_X509_set_version w/ fixes to _set_version and fix _set_notBefore/notAfter tests * add OCSP_id_get0_info and unit test, move WOLFSSL_ASN1_INTEGER to asn_public.h from ssl.h * inital implementation of wolfSSL_X509_sign * add debugging messages and set data for BIO's * Add i2d_OCSP_REQUEST_bio. * implementation of some WOLFSSL_BIO_METHOD custom functions * fix for ASN time structure and remove log node * initial eNULL support and sanity checks * fixes after rebasing code * adjust test cases and ASN1_TIME print * Various fixes for memory leaks * Apache compatibility in CTX_set_client_CA_list for X509_NAME use; add X509_NAME_dup as supporting function * Add initial X509_STORE_load_locations stub for Apache * Updates to X509_get_ext_d2i to return GENERAL_NAME struct instead of ASN1_OBJECT for alternative names and add supporting GENERAL_NAME functions * Add X509_STORE_load_locations implementation; add wolfSSL_CertManagerLoadCRL_ex; initial renegotiation fixes/updates * Fix for freeing peer cert in wolfSSL_Rehandshake instead of FreeHandShakeResources during secure renegotiation * Add X509_ALGOR and X509_PUBKEY structs for X509_PUBKEY_get0_param and X509_get_X509_PUBKEY implementation * Initial implementation of wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Add implementation for X509_get0_tbs_sigalg and X509_ALGOR_get0 * Add OBJ_nid2ln implementation * Fix compile errors in tests/api.c for some build options * Updates to X509_STORE_load_locations for non-CRL types; Add additional DETECT_CERT_TYPE enum and logic for detecting certificate type in ProcessFile * Add X509_STORE_load_locations unit test and minor error handling fixes * Add unit test for X509_sign * Set correct alert type for revoked certificates; add/fix a few WOLFSSL_ENTER messages * Add X509_ALGOR member to X509 struct; refactoring and unit tests for wolfSSL_X509_ALGOR_get0 and wolfSSL_X509_get0_tbs_sigalg * Add X509_PUBKEY member to X509 struct; refactoring and unit tests for wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Stack fixes after rebase * Secure renegotiation refactoring: add ACCEPT_BEGIN_RENEG to AcceptState for use in wolfSSL_SSL_in_connect_init; free old peer cert when receiving new cert to fix memory leak * Move enc-then-mac enable option in configure.ac for apache httpd compatibility * Simplify wolfSSL_SSL_in_connect_init logic * Remove unneeded wolfSSL_CertManagerLoadCRL_ex * Fixes for jenkins test failures * SSL_get_secure_renegotiation_support for print statement in Apache
2019-09-19 18:11:10 -06:00
[ ENABLED_ENCRYPT_THEN_MAC=$enableval ],
[ ENABLED_ENCRYPT_THEN_MAC=yes ]
)
if test "x$ENABLED_TLSX" = "xyes"
then
ENABLED_ENCRYPT_THEN_MAC=yes
fi
if test "x$ENABLED_ENCRYPT_THEN_MAC" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_ENCRYPT_THEN_MAC"
fi
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
# stunnel Support
AC_ARG_ENABLE([stunnel],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-stunnel],[Enable stunnel (default: disabled)])],
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
[ ENABLED_STUNNEL=$enableval ],
[ ENABLED_STUNNEL=no ]
)
Changes for WPA Supplicant
2017-02-10 08:45:10 +10:00
if test "$ENABLED_WPAS" = "yes"
then
ENABLED_STUNNEL="yes"
fi
Make changes to get latest verison of stunnel (5.57) working with wolfSSL.
2021-03-12 13:40:07 -06:00
# stunnel support requires all the features enabled within this conditional.
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
if test "$ENABLED_STUNNEL" = "yes"
then
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
then
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
fi
Make changes to get latest verison of stunnel (5.57) working with wolfSSL.
2021-03-12 13:40:07 -06:00
if test "x$ENABLED_SESSION_TICKET" = "xno"
then
ENABLED_SESSION_TICKET="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_SESSION_TICKET"
fi
Adding sni to mimic openssl functionality
2015-08-12 10:10:30 -06:00
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
if test "x$ENABLED_CODING" = "xno"
then
ENABLED_CODING="yes"
fi
if test "x$ENABLED_SESSIONCERTS" = "xno"
then
ENABLED_SESSIONCERTS="yes"
AM_CFLAGS="$AM_CFLAGS -DSESSION_CERTS"
fi
merge pull request 96
2015-07-16 16:46:37 -07:00
if test "x$ENABLED_CRL" = "xno"
then
ENABLED_CRL="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL"
fi
Stunnel needs sni and tlsext
2015-08-12 20:38:51 -06:00
stunnel 5.36 requires des3. Enable by default
2016-10-05 13:17:26 -06:00
if test "x$ENABLED_DES3" = "xno"
then
ENABLED_DES3="yes"
fi
Stunnel needs sni and tlsext
2015-08-12 20:38:51 -06:00
if test "x$ENABLED_TLSX" = "xno"
then
ENABLED_TLSX="yes"
Fixes for TLS 1.3 without ECC or RSA. Fix for building without ECC where HAVE_SUPPORTED_CURVES was getting defined because of ENABLED_TLSX.
2017-06-13 09:44:14 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SNI -DHAVE_MAX_FRAGMENT -DHAVE_TRUNCATED_HMAC"
# Check the ECC supported curves prereq
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
AS_IF([test "x$ENABLED_ECC" != "xno" || test "x$ENABLED_CURVE25519" = "xyes"],
Fixes for TLS 1.3 without ECC or RSA. Fix for building without ECC where HAVE_SUPPORTED_CURVES was getting defined because of ENABLED_TLSX.
2017-06-13 09:44:14 -07:00
[ENABLED_SUPPORTED_CURVES=yes
AM_CFLAGS="$AM_CFLAGS -DHAVE_SUPPORTED_CURVES"])
Stunnel needs sni and tlsext
2015-08-12 20:38:51 -06:00
fi
turn on ecc with Stunnel
2015-08-27 17:44:55 -06:00
if test "x$ENABLED_ECC" = "xno"
then
ENABLED_OPENSSLEXTRA="yes"
enable ecc with stunnel
2015-10-12 09:25:54 -06:00
ENABLED_ECC="yes"
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
Pulled in patches from Debian package.
2016-11-22 11:25:40 -08:00
Added configure "--disable-eccshamir" option.
2016-05-04 23:14:30 -07:00
if test "$ENABLED_ECC_SHAMIR" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"
fi
turn on ecc with Stunnel
2015-08-27 17:44:55 -06:00
fi
throw error when opensslcoexist configured with opensslall or opensslextra
2019-10-23 15:51:19 -07:00
Changes to update stunnel support
2019-08-21 16:06:33 -07:00
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"
fi
throw error when opensslcoexist configured with opensslall or opensslextra
2019-10-23 15:51:19 -07:00
Changes to update stunnel support
2019-08-21 16:06:33 -07:00
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
turn on ecc with Stunnel
2015-08-27 17:44:55 -06:00
Turn on key generation for --enable-stunnel.
2021-08-10 17:14:06 -07:00
if test "x$ENABLED_KEYGEN" = "xno"
then
ENABLED_KEYGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"
fi
Adding sni to mimic openssl functionality
2015-08-12 10:10:30 -06:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_STUNNEL -DWOLFSSL_ALWAYS_VERIFY_CB"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_KEEP_SNI -DHAVE_EX_DATA"
Make changes to get latest verison of stunnel (5.57) working with wolfSSL.
2021-03-12 13:40:07 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DES_ECB -DWOLFSSL_SIGNER_DER_CERT"
stunnel 5.61 support - New/Implemented API - `SSL_has_pending` - `wolfSSL_CertManagerLoadCRLFile` - `wolfSSL_LoadCRLFile` - `wolfSSL_CTX_LoadCRLFile` - `wolfSSL_CTX_add_session` - Calling chain certificate API (for example `wolfSSL_CTX_use_certificate_chain_file`) no longer requires an actual chain certificate PEM file to be passed in as input. `ProcessUserChain` error in `ProcessBuffer` is ignored if it returns that it didn't find a chain. - Add `WOLFSSL_TICKET_HAVE_ID` macro. When defined tickets will include the original session ID that can be used to lookup the session in internal cache. This is useful for fetching information about the peer that doesn't get sent in a resumption (such as the peer's certificate chain). - Add `ssl->ticketSessionID` field because `ssl->session.sessionID` is used to return the "bogus" session ID sent by the client in TLS 1.3 - `OPENSSL_COMPATIBLE_DEFAULTS` changes - Define `WOLFSSL_TRUST_PEER_CERT` and certificates added as CA's will also be loaded as trusted peer certificates - Define `WOLFSSL_TLS13_MIDDLEBOX_COMPAT` - Seperate `internalCacheOff` and `internalCacheLookupOff` options to govern session addition and lookup - `VerifyServerSuite` now determines if RSA is available by checking for it directly and not assuming it as the default if static ECC is not available - `WOLFSSL_SESSION` changes - `ssl->extSession` added to return a dynamic session when internalCacheOff is set - `ssl->session.refPtr` made dynamic and gets free'd in `SSL_ResourceFree` - If `SSL_MODE_AUTO_RETRY` is set then retry should only occur during a handshake - `WOLFSSL_TRUST_PEER_CERT` code now always uses `cert->subjectHash` for the `cm->tpTable` table row selection - Change some error message names to line up with OpenSSL equivalents - Run `MatchSuite` again if certificate setup callback installed and successful - Refactor clearing `ASN_NO_PEM_HEADER` off the error queue into a macro - `wolfSSL_get_peer_certificate` now returns a duplicated object meaning that the caller needs to free the returned object - Allign `wolfSSL_CRYPTO_set_mem_functions` callbacks with OpenSSL API - `wolfSSL_d2i_PKCS12_bio` now consumes the input BIO. It now supports all supported BIO's instead of only memory BIO. - stunnel specific - Always return a session object even if we don't have a session in cache. This allows stunnel to save information in the session external data that will be transfered to new connections if the session is reused - When allocating a dynamic session, always do `wolfSSL_SESSION_set_ex_data(session, 0, (void *)(-1)`. This is to mimic the new index callback set in `SSL_SESSION_get_ex_new_index`. - Fix comment in `wolfSSL_AES_cbc_encrypt` - Trusted peer certificate suite tests need to have CRL disabled since we don't have the issuer certificate in the CA store if the certificates are only added as trusted peer certificates. tested
2022-01-28 14:40:45 +01:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_COMPATIBLE_DEFAULTS -DWOLFSSL_TICKET_HAVE_ID"
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
fi
Add a --enable-curl build option
2021-12-22 17:34:58 -05:00
# curl Support
AC_ARG_ENABLE([curl],
[AS_HELP_STRING([--enable-curl],[Enable curl (default: disabled)])],
[ ENABLED_CURL=$enableval ],
[ ENABLED_CURL=no ]
)
# curl support requires all the features enabled within this conditional.
if test "$ENABLED_CURL" = "yes"
then
if test "x$ENABLED_DES3" = "xno"
then
ENABLED_DES3="yes"
fi
More stuff, probably not complete yet
2021-12-23 17:27:25 -05:00
if test "x$ENABLED_ALPN" = "xno"
then
ENABLED_ALPN="yes"
fi
if test "x$ENABLED_WOLFSSH" = "xno"
then
ENABLED_WOLFSSH="yes"
fi
Add a --enable-curl build option
2021-12-22 17:34:58 -05:00
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLEXTRA="yes"
fi
More stuff, probably not complete yet
2021-12-23 17:27:25 -05:00
if test "x$ENABLED_CRL" = "xno"
then
ENABLED_CRL="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL"
fi
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
if test "x$ENABLED_CERTIFICATE_STATUS_REQUEST" = "xno"
then
ENABLED_CERTIFICATE_STATUS_REQUEST="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_CERTIFICATE_STATUS_REQUEST"
fi
if test "x$ENABLED_CERTIFICATE_STATUS_REQUEST_V2" = "xno"
then
ENABLED_CERTIFICATE_STATUS_REQUEST_V2="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_CERTIFICATE_STATUS_REQUEST_V2"
fi
SNI and ALT_CERT_CHAINS
2021-12-29 12:50:50 -05:00
if test "x$ENABLED_SNI" = "xno"
then
ENABLED_SNI="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SNI"
fi
if test "x$ENABLED_ALT_CERT_CHAINS" = "xno"
then
ENABLED_ALT_CERT_CHAINS="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALT_CERT_CHAINS"
fi
Fix so curl can do FTPS on TLS 1.3 with session resumption.
2022-07-29 17:05:04 -04:00
if test "x$ENABLED_SESSION_TICKET" = "xno"
then
ENABLED_SESSION_TICKET="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SESSION_TICKET"
fi
# FTPS server requires pointer to session cache
AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE_REF"
Add a --enable-curl build option
2021-12-22 17:34:58 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DES_ECB"
fi
Turns on PSK when compiling for stunnel
2015-08-27 11:05:29 -06:00
if test "$ENABLED_PSK" = "no" && test "$ENABLED_LEANPSK" = "no" \
&& test "x$ENABLED_STUNNEL" = "xno"
then
AM_CFLAGS="$AM_CFLAGS -DNO_PSK"
fi
if test "$ENABLED_PSK" = "no" && \
(test "$ENABLED_LEANPSK" = "yes" || test "x$ENABLED_STUNNEL" = "xyes")
then
ENABLED_PSK=yes
fi
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
Add support for tcpdump with wolfSSL.
2021-07-09 12:04:40 -07:00
# tcpdump support
AC_ARG_ENABLE([tcpdump],
[AS_HELP_STRING([--enable-tcpdump],[Enable tcpdump (default: disabled)])],
[ ENABLED_TCPDUMP=$enableval ],
[ ENABLED_TCPDUMP=no ]
)
# tcpdump support requires all the features enabled within this conditional.
if test "$ENABLED_TCPDUMP" = "yes"
then
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
Add support for tcpdump with wolfSSL.
2021-07-09 12:04:40 -07:00
fi
if test "x$ENABLED_DES3" = "xno"
then
ENABLED_DES3="yes"
fi
fi
Add support for sblim-sfcb port.
2021-07-14 10:47:12 -07:00
# sblim-sfcb support
AC_ARG_ENABLE([sblim-sfcb],
[AS_HELP_STRING([--enable-sblim-sfcb],[Enable sblim-sfcb support (default: disabled)])],
[ ENABLED_SBLIM_SFCB=$enableval ],
[ ENABLED_SBLIM_SFCB=no ]
)
# sblim-sfcb support requires all the features enabled within this conditional.
if test "$ENABLED_SBLIM_SFCB" = "yes"
then
if test "x$ENABLED_OPENSSLEXTRA" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA"
Add support for sblim-sfcb port.
2021-07-14 10:47:12 -07:00
fi
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_SBLIM_SFCB -DWOLFSSL_SIGNER_DER_CERT"
fi
Add `--enable-libest` option to configure.ac Refactoring and adding defines for functions
2020-07-02 21:15:15 +02:00
# libest Support
AC_ARG_ENABLE([libest],
[AS_HELP_STRING([--enable-libest],[Enable libest (default: disabled)])],
[ ENABLED_LIBEST=$enableval ],
[ ENABLED_LIBEST=no ]
)
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Add `--enable-libest` option to configure.ac Refactoring and adding defines for functions
2020-07-02 21:15:15 +02:00
if test "$ENABLED_LIBEST" = "yes"
then
Extension manipulation
2020-09-14 17:05:25 +02:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA -DHAVE_LIBEST -DWOLFSSL_ALT_NAMES"
Protect against invalid write in RsaPad_PSS
2020-09-17 13:45:25 +02:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PSS_SALT_LEN_DISCOVER"
Implement/stub the following: - X509_get0_extensions - X509_to_X509_REQ - i2d_X509_REQ_bio - X509v3_get_ext_count - i2d_PKCS7_bio Additional changes: - Added a wc_PKCS7_VerifySignedData call to wolfSSL_d2i_PKCS7_bio to populate the PKCS7 struct with parsed values - wc_PKCS7_VerifySignedData_ex -> wc_PKCS7_VerifySignedData
2020-07-08 20:14:27 +02:00
Add `--enable-libest` option to configure.ac Refactoring and adding defines for functions
2020-07-02 21:15:15 +02:00
# Requires opensslextra and opensslall
if test "x$ENABLED_OPENSSLALL" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
ENABLED_OPENSSLALL="yes"
ENABLED_OPENSSLEXTRA="yes"
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DOPENSSL_ALL"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_EITHER_SIDE -DWC_RSA_NO_PADDING"
AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS -DWOLFSSL_PSS_LONG_SALT"
Add `--enable-libest` option to configure.ac Refactoring and adding defines for functions
2020-07-02 21:15:15 +02:00
fi
Implement/stub the following: - `NID_pkcs9_challengePassword` - added - `wolfSSL_OPENSSL_cleanse` - implemented - `wolfSSL_X509_REQ_add1_attr_by_NID` - stubbed - `wolfSSL_c2i_ASN1_OBJECT` - stubbed
2020-07-03 17:30:16 +02:00
# Requires OCSP
Add `--enable-libest` option to configure.ac Refactoring and adding defines for functions
2020-07-02 21:15:15 +02:00
if test "x$ENABLED_OCSP" = "xno"
then
ENABLED_OCSP="yes"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Implement/stub the following: - `NID_pkcs9_challengePassword` - added - `wolfSSL_OPENSSL_cleanse` - implemented - `wolfSSL_X509_REQ_add1_attr_by_NID` - stubbed - `wolfSSL_c2i_ASN1_OBJECT` - stubbed
2020-07-03 17:30:16 +02:00
# Requires PKCS7
if test "x$ENABLED_PKCS7" = "xno"
then
ENABLED_PKCS7="yes"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Implement/stub the following: - `NID_pkcs9_challengePassword` - added - `wolfSSL_OPENSSL_cleanse` - implemented - `wolfSSL_X509_REQ_add1_attr_by_NID` - stubbed - `wolfSSL_c2i_ASN1_OBJECT` - stubbed
2020-07-03 17:30:16 +02:00
# Requires Certificate Generation and Request
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
if test "x$ENABLED_CERTREQ" = "xno"
then
ENABLED_CERTREQ="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_REQ"
fi
Implement/stub: - X509_REQ_print_fp - X509_print_fp - DHparams_dup
2020-07-10 21:03:00 +02:00
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Implement wolfSSL_PKCS7_to_stack and wolfSSL_d2i_ASN1_OBJECT - I also implemented wolfSSL_c2i_ASN1_OBJECT which was previously a stub. - More configure.ac flags added to libest option
2020-07-07 19:26:24 +02:00
# Requires CRL
if test "x$ENABLED_CRL" = "xno"
then
ENABLED_CRL="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
if test "x$ENABLED_SRP" = "xno"
then
Implement/stub: - wc_DhKeyCopy - SSL_CTX_set_srp_strength - SSL_get_srp_username - X509_REQ_get_attr_by_NID - X509_REQ_get_attr - X509_ATTRIBUTE - wolfSSL_DH_dup Add srp.h file with SRP_MINIMAL_N
2020-07-09 17:09:24 +02:00
ENABLED_SRP="yes"
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_HAVE_SRP"
fi
Implement/stub: - X509_REQ_print_fp - X509_print_fp - DHparams_dup
2020-07-10 21:03:00 +02:00
# Enable prereqs if not already enabled
if test "x$ENABLED_KEYGEN" = "xno"
then
ENABLED_KEYGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Implement/stub: - X509_REQ_print_fp - X509_print_fp - DHparams_dup
2020-07-10 21:03:00 +02:00
# Requires sessioncerts make sure on
if test "x$ENABLED_SESSIONCERTS" = "xno"
then
ENABLED_SESSIONCERTS="yes"
AM_CFLAGS="$AM_CFLAGS -DSESSION_CERTS"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Tests starting to pass
2020-08-27 17:39:03 +02:00
if test "x$ENABLED_DSA" = "xno"
then
AC_MSG_WARN([Enabling DSA with --enable-dsa is recommended for libest])
fi
Add `--enable-libest` option to configure.ac Refactoring and adding defines for functions
2020-07-02 21:15:15 +02:00
fi
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
# MD4
AC_ARG_ENABLE([md4],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-md4],[Enable MD4 (default: disabled)])],
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
[ ENABLED_MD4=$enableval ],
[ ENABLED_MD4=no ]
)
if test "$ENABLED_MD4" = "no"
then
#turn on MD4 if using stunnel
Implement OpenSSL API's - `OBJ_DUP` - `i2d_PKCS7` - `BN_rshift1 - `BN_rshift` testing - Add `--enable-krb`
2021-10-01 14:08:58 +02:00
if test "x$ENABLED_STUNNEL" = "xyes" || test "x$ENABLED_WPAS" != "xno" || test "x$ENABLED_KRB" = "xyes"
Stunnel Base Commit
2015-07-14 14:56:26 -06:00
then
ENABLED_MD4="yes"
else
AM_CFLAGS="$AM_CFLAGS -DNO_MD4"
fi
fi
add enable lighty
2015-07-09 09:14:33 -06:00
Fixes for various build configurations. Added `--enable-enckeys` option to enable support for encrypted PEM private keys using password callback without having to use opensslextra. Moved ASN `CryptKey` function to wc_encrypt.c as `wc_CryptKey`. Fixup some missing heap args on XMALLOC/XFREE in asn.c.
2018-03-30 15:48:15 -07:00
# Encrypted keys
AC_ARG_ENABLE([enckeys],
[AS_HELP_STRING([--enable-enckeys],[Enable PEM encrypted private key support (default: disabled)])],
[ ENABLED_ENCKEYS=$enableval ],
[ ENABLED_ENCKEYS=no ]
)
Added support `--enable-wpas=small` for reduced code size when building against the WPA supplicant with EAP-TLS. This does not use `OPENSSL_EXTRA`, which helps reduce code size.
2020-05-08 13:38:26 -07:00
if test "$ENABLED_OPENSSLEXTRA" = "yes" || test "$ENABLED_WEBSERVER" = "yes" || test "$ENABLED_WPAS" != "no"
Fixes for various build configurations. Added `--enable-enckeys` option to enable support for encrypted PEM private keys using password callback without having to use opensslextra. Moved ASN `CryptKey` function to wc_encrypt.c as `wc_CryptKey`. Fixup some missing heap args on XMALLOC/XFREE in asn.c.
2018-03-30 15:48:15 -07:00
then
ENABLED_ENCKEYS=yes
fi
if test "$ENABLED_ENCKEYS" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ENCRYPTED_KEYS"
fi
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
# PKCS#12
Fix for PKCS12 with NO_ASN.
2021-08-04 17:37:05 -07:00
# set PKCS#12 default
PKCS12_DEFAULT=yes
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
if test "$ENABLED_ASN" = "no" || test "$FIPS_VERSION" = "rand"
Fix for PKCS12 with NO_ASN.
2021-08-04 17:37:05 -07:00
then
PKCS12_DEFAULT=no
fi
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
AC_ARG_ENABLE([pkcs12],
[AS_HELP_STRING([--enable-pkcs12],[Enable pkcs12 (default: enabled)])],
[ ENABLED_PKCS12=$enableval ],
Fix for PKCS12 with NO_ASN.
2021-08-04 17:37:05 -07:00
[ ENABLED_PKCS12=$PKCS12_DEFAULT ]
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
)
if test "x$ENABLED_PKCS12" = "xno"
then
AM_CFLAGS="$AM_CFLAGS -DNO_PKCS12"
fi
move pwdbased lower in config for openssl manual sets
2015-02-16 09:54:55 -08:00
# PWDBASED has to come after certservice since we want it on w/o explicit on
# PWDBASED
AC_ARG_ENABLE([pwdbased],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-pwdbased],[Enable PWDBASED (default: disabled)])],
move pwdbased lower in config for openssl manual sets
2015-02-16 09:54:55 -08:00
[ ENABLED_PWDBASED=$enableval ],
[ ENABLED_PWDBASED=no ]
)
if test "$ENABLED_PWDBASED" = "no"
then
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
if test "$ENABLED_OPENSSLEXTRA" = "yes" || test "$ENABLED_OPENSSLALL" = "yes" || \
test "$ENABLED_WEBSERVER" = "yes" || test "$ENABLED_ENCKEYS" = "yes" || \
test "$ENABLED_PKCS12" = "yes"
move pwdbased lower in config for openssl manual sets
2015-02-16 09:54:55 -08:00
then
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
# opensslextra, opensslall, webserver, enckeys and pkcs12 need pwdbased
move pwdbased lower in config for openssl manual sets
2015-02-16 09:54:55 -08:00
ENABLED_PWDBASED=yes
else
AM_CFLAGS="$AM_CFLAGS -DNO_PWDBASED"
fi
fi
Implementation of scrypt Tests and benchmarking added. Configure with --enable-scrypt and requires --enable-pwdbased
2016-12-14 16:47:54 +10:00
AC_ARG_ENABLE([scrypt],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-scrypt],[Enable SCRYPT (default: disabled)])],
Implementation of scrypt Tests and benchmarking added. Configure with --enable-scrypt and requires --enable-pwdbased
2016-12-14 16:47:54 +10:00
[ ENABLED_SCRYPT=$enableval ],
[ ENABLED_SCRYPT=no ]
)
if test "$ENABLED_SCRYPT" = "yes"
then
if test "$ENABLED_PWDBASED" = "no"
then
AC_MSG_ERROR([cannot enable scrypt without enabling pwdbased.])
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_SCRYPT"
fi
add --enable-cryptonly build option
2015-09-10 16:24:25 -07:00
# wolfCrypt Only Build
if test "$ENABLED_CRYPTONLY" = "yes"
then
fixes for issues identified by Jenkins run: Makefile.am: clean .build_params file; ecc.c: fix misplaced gat #endif in wc_ecc_shared_secret_gen_sync(); move AM_CFLAGS+=-include /.build_params to before AC_SUBST([]AM_CFLAGS); fix new unused-label defect in wc_ecc_shared_secret_gen_sync(); fix integer.[ch] mp_exch() to return int not void (sp_exch() and TFM mp_exch() can both fail on allocations); fix NO_INLINE ForceZero() prototype; ecc.c: add missing if (err == MP_OKAY) in build_lut(); wolfcrypt/test/test.c: revert "rename hkdf_test to wc_hkdf_test to eliminate namespace collision", restoring unconditional static qualifier, to fix crash at return from main() on Xilinx Zynq ARM test; ecc.c: refactor build_lut() flow control to fix uninited variable scenario found by scan-build; WOLFCRYPT_ONLY and OPENSSL_EXTRA: fix gating to allow successful build with --enable-all-crypto, and add configure error if crypt-only and opensslall are combined.
2021-08-31 22:59:57 -05:00
if test "$ENABLED_OPENSSLALL" = "yes"
configure.ac: test for cryptonly && opensslextra, if so error "mutually incompatible".
2021-08-26 15:59:29 -05:00
then
fixes for issues identified by Jenkins run: Makefile.am: clean .build_params file; ecc.c: fix misplaced gat #endif in wc_ecc_shared_secret_gen_sync(); move AM_CFLAGS+=-include /.build_params to before AC_SUBST([]AM_CFLAGS); fix new unused-label defect in wc_ecc_shared_secret_gen_sync(); fix integer.[ch] mp_exch() to return int not void (sp_exch() and TFM mp_exch() can both fail on allocations); fix NO_INLINE ForceZero() prototype; ecc.c: add missing if (err == MP_OKAY) in build_lut(); wolfcrypt/test/test.c: revert "rename hkdf_test to wc_hkdf_test to eliminate namespace collision", restoring unconditional static qualifier, to fix crash at return from main() on Xilinx Zynq ARM test; ecc.c: refactor build_lut() flow control to fix uninited variable scenario found by scan-build; WOLFCRYPT_ONLY and OPENSSL_EXTRA: fix gating to allow successful build with --enable-all-crypto, and add configure error if crypt-only and opensslall are combined.
2021-08-31 22:59:57 -05:00
AC_MSG_ERROR([cryptonly and opensslall are mutually incompatible.])
configure.ac: test for cryptonly && opensslextra, if so error "mutually incompatible".
2021-08-26 15:59:29 -05:00
fi
add --enable-cryptonly build option
2015-09-10 16:24:25 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFCRYPT_ONLY"
fi
Updated the configure.ac comments about big int being used for ECC and DH. Moved the checks for ecc/asn and psk/asn until after cryptonly value is set and fixed so those checks work for normal build and are excluded for crypt only builds.
2016-02-10 13:03:53 -08:00
if test "x$ENABLED_CRYPTONLY" = "xno"
then
if test "x$ENABLED_PSK" = "xno" && test "x$ENABLED_ASN" = "xno"
then
AC_MSG_ERROR([please enable psk if disabling asn.])
fi
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
if test "x$ENABLED_ECC" != "xno" && test "x$ENABLED_ASN" = "xno"
Updated the configure.ac comments about big int being used for ECC and DH. Moved the checks for ecc/asn and psk/asn until after cryptonly value is set and fixed so those checks work for normal build and are excluded for crypt only builds.
2016-02-10 13:03:53 -08:00
then
AC_MSG_ERROR([please disable ecc if disabling asn.])
fi
inital AES-CBC with af_alg progress on AES-GCM with AF_ALG and add SHA256 add aes-gcm test cases and finish logic of aes-gcm with AF_ALG formating of tabs and white space add files to dist adding ecb and ctr mode with af_alg make length of buffers for ctr be AES_BLOCK_SIZE formating and add support for sha256 copy/gethash sanity checks on arguments cast return values and valgrind tests make it easier to use sha256 with af_alg remove hard tabs add endif for after rebase
2018-07-18 17:26:25 -06:00
if test "$ENABLED_AFALG" = "yes"
then
# for TLS connections the intermediate hash needs to store buffer
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AFALG_HASH_KEEP"
fi
crypto only sha256 cryptodev formating and refactoring update configure for devcrypto add AES algorithms to cyrptodev port increase structure size for compatibility AES with cryptodev add wc_devcrypto.h to install path
2018-08-17 09:46:16 -06:00
if test "$ENABLED_DEVCRYPTO" = "yes"
then
# for TLS connections the intermediate hash needs to store buffer
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEVCRYPTO_HASH_KEEP"
fi
Updated the configure.ac comments about big int being used for ECC and DH. Moved the checks for ecc/asn and psk/asn until after cryptonly value is set and fixed so those checks work for normal build and are excluded for crypt only builds.
2016-02-10 13:03:53 -08:00
fi
only have fastmath on by default on x86_64
2013-07-01 12:10:59 -07:00
added configure option --disable-examples to remove example code build, configure runs make clean at the end, sniffer test isn't built if sniffer disabled
2012-11-29 11:31:57 -08:00
# Enable Examples, used to disable examples
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
if test "$ENABLED_LINUXKM" = "yes"
then
ENABLED_EXAMPLES_DEFAULT=no
else
ENABLED_EXAMPLES_DEFAULT=yes
fi
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_ENABLE([examples],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-examples],[Enable Examples (default: enabled)])],
added configure option --disable-examples to remove example code build, configure runs make clean at the end, sniffer test isn't built if sniffer disabled
2012-11-29 11:31:57 -08:00
[ ENABLED_EXAMPLES=$enableval ],
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
[ ENABLED_EXAMPLES=$ENABLED_EXAMPLES_DEFAULT ]
added configure option --disable-examples to remove example code build, configure runs make clean at the end, sniffer test isn't built if sniffer disabled
2012-11-29 11:31:57 -08:00
)
switch --enable-noFilesystem to --enable-filesystem / --disable-filesystem to match others
2013-03-13 12:14:05 -07:00
AS_IF([test "x$ENABLED_FILESYSTEM" = "xno"], [ENABLED_EXAMPLES="no"])
switch --enable-noInline to enable/disable-inline to match all others
2013-03-13 12:25:34 -07:00
AS_IF([test "x$ENABLED_INLINE" = "xno"], [ENABLED_EXAMPLES="no"])
add --enable-cryptonly build option
2015-09-10 16:24:25 -07:00
AS_IF([test "x$ENABLED_CRYPTONLY" = "xyes"], [ENABLED_EXAMPLES="no"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
added configure option --disable-examples to remove example code build, configure runs make clean at the end, sniffer test isn't built if sniffer disabled
2012-11-29 11:31:57 -08:00
Fixes for disabling the crypt test and benchmark. Added new "./configure --disable-crypttests" option. Also made sure use of both NO_CRYPT_BENCHMARK and NO_CRYPT_TEST in "./configure CFLAGS=-D" scenario work correctly.
2016-02-04 12:06:24 -08:00
# Enable wolfCrypt test and benchmark
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
if test "$ENABLED_LINUXKM" = "yes"
then
ENABLED_CRYPT_TESTS_DEFAULT=no
else
ENABLED_CRYPT_TESTS_DEFAULT=yes
fi
Fixes for disabling the crypt test and benchmark. Added new "./configure --disable-crypttests" option. Also made sure use of both NO_CRYPT_BENCHMARK and NO_CRYPT_TEST in "./configure CFLAGS=-D" scenario work correctly.
2016-02-04 12:06:24 -08:00
AC_ARG_ENABLE([crypttests],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-crypttests],[Enable Crypt Bench/Test (default: enabled)])],
Fixes for disabling the crypt test and benchmark. Added new "./configure --disable-crypttests" option. Also made sure use of both NO_CRYPT_BENCHMARK and NO_CRYPT_TEST in "./configure CFLAGS=-D" scenario work correctly.
2016-02-04 12:06:24 -08:00
[ ENABLED_CRYPT_TESTS=$enableval ],
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
[ ENABLED_CRYPT_TESTS=$ENABLED_CRYPT_TESTS_DEFAULT ]
Fixes for disabling the crypt test and benchmark. Added new "./configure --disable-crypttests" option. Also made sure use of both NO_CRYPT_BENCHMARK and NO_CRYPT_TEST in "./configure CFLAGS=-D" scenario work correctly.
2016-02-04 12:06:24 -08:00
)
linuxkm: WIP support for wolfcrypt_test() at module load time.
2020-08-21 00:10:45 -05:00
AC_SUBST([ENABLED_CRYPT_TESTS])
Fixes for disabling the crypt test and benchmark. Added new "./configure --disable-crypttests" option. Also made sure use of both NO_CRYPT_BENCHMARK and NO_CRYPT_TEST in "./configure CFLAGS=-D" scenario work correctly.
2016-02-04 12:06:24 -08:00
Add support for libwolfcrypttest and libwolfcryptbench to autotools flow. These can be built by configuring with `--enable-crypttests-libs`.
2021-09-25 10:31:06 -07:00
# Build wolfCrypt test and benchmark as libraries. This will compile test.c and
# benchmark.c and make their functions available via libraries, libwolfcrypttest
# and libwolfcryptbench, respectively. Note that this feature is not enabled by
# default, and the API of these libraries should NOT be treated as stable.
AC_ARG_ENABLE([crypttests-libs],
[AS_HELP_STRING([--enable-crypttests-libs],[Enable wolfcrypt test and benchmark libraries (default: disabled)])],
[ ENABLED_CRYPT_TESTS_LIBS=$enableval ],
[ ENABLED_CRYPT_TESTS_LIBS=no ]
)
initial cavium, crypto only, no rsa
2013-01-29 16:22:49 -08:00
1.8.8 init
2011-02-05 11:14:47 -08:00
# LIBZ
add macpi huffman
2013-03-20 14:37:05 -07:00
ENABLED_LIBZ="no"
1.8.8 init
2011-02-05 11:14:47 -08:00
trylibzdir=""
fix configure.ac quoting
2012-12-12 14:33:21 -08:00
AC_ARG_WITH([libz],
1.8.8 init
2011-02-05 11:14:47 -08:00
[ --with-libz=PATH PATH to libz install (default /usr/) ],
[
AC_MSG_CHECKING([for libz])
CPPFLAGS="$CPPFLAGS -DHAVE_LIBZ"
LIBS="$LIBS -lz"
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <zlib.h>]], [[ deflateInit(0, 8); ]])],[ libz_linked=yes ],[ libz_linked=no ])
1.8.8 init
2011-02-05 11:14:47 -08:00
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$libz_linked" = "xno" ; then
1.8.8 init
2011-02-05 11:14:47 -08:00
if test "x$withval" != "xno" ; then
trylibzdir=$withval
fi
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$withval" = "xyes" ; then
1.8.8 init
2011-02-05 11:14:47 -08:00
trylibzdir="/usr"
fi
Fixes for building against latest CryptoAuthLib. Refactor to eliminate the atcatls function calls, since these have been removed from latest CryptoAuthLib. Cleanup of the slot assignment handling.
2018-09-26 14:16:32 -07:00
LDFLAGS="$LDFLAGS -L$trylibzdir/lib"
1.8.8 init
2011-02-05 11:14:47 -08:00
CPPFLAGS="$CPPFLAGS -I$trylibzdir/include"
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <zlib.h>]], [[ deflateInit(0, 8); ]])],[ libz_linked=yes ],[ libz_linked=no ])
1.8.8 init
2011-02-05 11:14:47 -08:00
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$libz_linked" = "xno" ; then
1.8.8 init
2011-02-05 11:14:47 -08:00
AC_MSG_ERROR([libz isn't found.
If it's already installed, specify its path using --with-libz=/dir/])
fi
AC_MSG_RESULT([yes])
else
AC_MSG_RESULT([yes])
fi
added stubs and a test for ctaocrypt compress
2013-03-19 16:25:58 -07:00
ENABLED_LIBZ="yes"
1.8.8 init
2011-02-05 11:14:47 -08:00
]
)
Support for PKCS#11 Support for RSA, ECDSA and AES-GCM operations.
2018-09-12 08:56:59 +10:00
# PKCS#11
AC_ARG_ENABLE([pkcs11],
[AS_HELP_STRING([--enable-pkcs11],[Enable pkcs11 access (default: disabled)])],
[ ENABLED_PKCS11=$enableval ],
[ ENABLED_PKCS11=no ]
)
PKCS #11: support static linking with PKCS #11 library --enable-pkcs11=static LIBS=-l<pkcs11 static library> or define HAVE_PKCS11_STATIC
2021-08-30 12:22:30 +10:00
if test "x$ENABLED_PKCS11" != "xno"
Support for PKCS#11 Support for RSA, ECDSA and AES-GCM operations.
2018-09-12 08:56:59 +10:00
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_PKCS11 -DHAVE_WOLF_BIGINT"
PKCS #11: support static linking with PKCS #11 library --enable-pkcs11=static LIBS=-l<pkcs11 static library> or define HAVE_PKCS11_STATIC
2021-08-30 12:22:30 +10:00
if test "x$ENABLED_PKCS11" != "xstatic"
then
LIBS="$LIBS -ldl"
else
AM_CFLAGS="$AM_CFLAGS -DHAVE_PKCS11_STATIC"
ENABLED_PKCS11="yes"
fi
Support for PKCS#11 Support for RSA, ECDSA and AES-GCM operations.
2018-09-12 08:56:59 +10:00
fi
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
# PKCS#8
AC_ARG_ENABLE([pkcs8],
[AS_HELP_STRING([--enable-pkcs8],[Enable PKCS #8 key packages (default: enabled)])],
[ ENABLED_PKCS8=$enableval ],
[ ENABLED_PKCS8=yes ]
Improvements for disabled sections in pwdbased.c, asn.c, rsa.c, pkcs12.c and wc_encrypt.c. Adds `--enable-pkcs12`, `HAVE_PKCS12`/`NO_PKCS12`, `HAVE_PKCS8` / `NO_PKCS8` and `HAVE_PBKDF1` / `NO_PBKDF1`.
2019-07-02 09:35:46 -07:00
)
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
if test "x$ENABLED_PKCS8" = "xno"
Improvements for disabled sections in pwdbased.c, asn.c, rsa.c, pkcs12.c and wc_encrypt.c. Adds `--enable-pkcs12`, `HAVE_PKCS12`/`NO_PKCS12`, `HAVE_PKCS8` / `NO_PKCS8` and `HAVE_PBKDF1` / `NO_PBKDF1`.
2019-07-02 09:35:46 -07:00
then
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
AM_CFLAGS="$AM_CFLAGS -DNO_PKCS8"
Improvements for disabled sections in pwdbased.c, asn.c, rsa.c, pkcs12.c and wc_encrypt.c. Adds `--enable-pkcs12`, `HAVE_PKCS12`/`NO_PKCS12`, `HAVE_PKCS8` / `NO_PKCS8` and `HAVE_PBKDF1` / `NO_PBKDF1`.
2019-07-02 09:35:46 -07:00
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# cavium
initial cavium, crypto only, no rsa
2013-01-29 16:22:49 -08:00
trycaviumdir=""
AC_ARG_WITH([cavium],
[ --with-cavium=PATH PATH to cavium/software dir ],
[
AC_MSG_CHECKING([for cavium])
CPPFLAGS="$CPPFLAGS -DHAVE_CAVIUM"
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
LIB_ADD="-lrt $LIB_ADD"
initial cavium, crypto only, no rsa
2013-01-29 16:22:49 -08:00
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$withval" = "xyes" ; then
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
AC_MSG_ERROR([need a PATH for --with-cavium])
fi
if test "x$withval" != "xno" ; then
trycaviumdir=$withval
fi
initial cavium, crypto only, no rsa
2013-01-29 16:22:49 -08:00
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
LDFLAGS="$AM_LDFLAGS $trycaviumdir/api/cavium_common.o"
CPPFLAGS="$CPPFLAGS -I$trycaviumdir/include"
initial cavium, crypto only, no rsa
2013-01-29 16:22:49 -08:00
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include "cavium_common.h"]], [[ CspShutdown(CAVIUM_DEV_ID); ]])],[ cavium_linked=yes ],[ cavium_linked=no ])
initial cavium, crypto only, no rsa
2013-01-29 16:22:49 -08:00
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$cavium_linked" = "xno" ; then
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
AC_MSG_ERROR([cavium isn't found.
If it's already installed, specify its path using --with-cavium=/dir/])
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
else
AM_CFLAGS="$AM_CFLAGS -DHAVE_CAVIUM"
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
fi
AC_MSG_RESULT([yes])
enable_shared=no
enable_static=yes
ENABLED_CAVIUM=yes
],
[ ENABLED_CAVIUM=no ]
)
# cavium V
trycaviumdir=""
AC_ARG_WITH([cavium-v],
[ --with-cavium-v=PATH PATH to Cavium V/software dir ],
[
AC_MSG_CHECKING([for cavium])
Nitrox V fixes and additions: * Added support for ECC, AES-GCM and HMAC (SHA-224 and SHA3). * Fixes for Nitrox V with TLS. * ECC refactor for so key based `r` and `s` apply only when building with `WOLFSSL_ASYNC_CRYPT`. * ECC refactor for `e` and `signK` to use key based pointer for Nitrox V. * Improved the Nitrox V HMAC to use start, update and final API's instead of caching updates. * Fix for Intel QuickAssist with unsupported HMAC hash algos using `IntelQaHmacGetType` (such as SHA3). * Added new API `wc_mp_to_bigint_sz` to zero pad unsigned bin. * Fix for AES GCM to gate HW use based on IV len in aes.c and remove the gate in test.c. * Implemented workaround to use software for AES GCM Nitrox V hardware and 13 byte AAD length for TLS. * New debug option `WOLFSSL_NITROX_DEBUG` to add pending count.
2018-04-03 09:14:20 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_CAVIUM -DHAVE_CAVIUM_V"
LIB_ADD="-lrt -lcrypto $LIB_ADD"
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
Fixes for data types, cast warnings and shift operations when using 16-bit platform. Added new `--enable-16bit` build option, which defines `WC_16BIT_CPU`. Fix build error when using `WOLFSSL_LEANPSK` and `NO_WOLFSSL_MEMORY`. Tested using `avr-gcc` version 8.3.0 with: `./configure --host=avr --enable-16bit --disable-filesystem --enable-singlethreaded CFLAGS="-DWOLFSSL_GENSEED_FORTEST -DWOLFSSL_USER_CURRTIME -DWOLFSSL_USER_IO -DWOLFSSL_NO_SOCK -DNO_WRITEV -DUSER_TICKS" --enable-tls13 --enable-compkey --enable-certgen --enable-certext --enable-keygen --enable-session-ticket --enable-maxfragment`. Also with `--enable-fastmath`.
2019-03-01 15:54:08 -08:00
if test "x$withval" = "xyes" ; then
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
AC_MSG_ERROR([need a PATH for --with-cavium])
fi
if test "x$withval" != "xno" ; then
trycaviumdir=$withval
fi
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
if test -e $trycaviumdir/lib/libnitrox.a
then
AM_CPPFLAGS="-I$trycaviumdir/include $AM_CPPFLAGS"
else
ENABLED_CAVIUM_V=no
fi
Nitrox V fixes and additions: * Added support for ECC, AES-GCM and HMAC (SHA-224 and SHA3). * Fixes for Nitrox V with TLS. * ECC refactor for so key based `r` and `s` apply only when building with `WOLFSSL_ASYNC_CRYPT`. * ECC refactor for `e` and `signK` to use key based pointer for Nitrox V. * Improved the Nitrox V HMAC to use start, update and final API's instead of caching updates. * Fix for Intel QuickAssist with unsupported HMAC hash algos using `IntelQaHmacGetType` (such as SHA3). * Added new API `wc_mp_to_bigint_sz` to zero pad unsigned bin. * Fix for AES GCM to gate HW use based on IV len in aes.c and remove the gate in test.c. * Implemented workaround to use software for AES GCM Nitrox V hardware and 13 byte AAD length for TLS. * New debug option `WOLFSSL_NITROX_DEBUG` to add pending count.
2018-04-03 09:14:20 -07:00
LIB_STATIC_ADD="$trycaviumdir/lib/libnitrox.a $LIB_STATIC_ADD"
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
Nitrox V fixes and additions: * Added support for ECC, AES-GCM and HMAC (SHA-224 and SHA3). * Fixes for Nitrox V with TLS. * ECC refactor for so key based `r` and `s` apply only when building with `WOLFSSL_ASYNC_CRYPT`. * ECC refactor for `e` and `signK` to use key based pointer for Nitrox V. * Improved the Nitrox V HMAC to use start, update and final API's instead of caching updates. * Fix for Intel QuickAssist with unsupported HMAC hash algos using `IntelQaHmacGetType` (such as SHA3). * Added new API `wc_mp_to_bigint_sz` to zero pad unsigned bin. * Fix for AES GCM to gate HW use based on IV len in aes.c and remove the gate in test.c. * Implemented workaround to use software for AES GCM Nitrox V hardware and 13 byte AAD length for TLS. * New debug option `WOLFSSL_NITROX_DEBUG` to add pending count.
2018-04-03 09:14:20 -07:00
if test "$ENABLED_CAVIUM_V" = "no"; then
AC_MSG_ERROR([Could not find Nitrox library])
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
fi
enable_shared=no
enable_static=yes
Nitrox V fixes and additions: * Added support for ECC, AES-GCM and HMAC (SHA-224 and SHA3). * Fixes for Nitrox V with TLS. * ECC refactor for so key based `r` and `s` apply only when building with `WOLFSSL_ASYNC_CRYPT`. * ECC refactor for `e` and `signK` to use key based pointer for Nitrox V. * Improved the Nitrox V HMAC to use start, update and final API's instead of caching updates. * Fix for Intel QuickAssist with unsupported HMAC hash algos using `IntelQaHmacGetType` (such as SHA3). * Added new API `wc_mp_to_bigint_sz` to zero pad unsigned bin. * Fix for AES GCM to gate HW use based on IV len in aes.c and remove the gate in test.c. * Implemented workaround to use software for AES GCM Nitrox V hardware and 13 byte AAD length for TLS. * New debug option `WOLFSSL_NITROX_DEBUG` to add pending count.
2018-04-03 09:14:20 -07:00
enable_opensslextra=yes
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
ENABLED_CAVIUM=yes
ENABLED_CAVIUM_V=yes
],
[
ENABLED_CAVIUM_=no
ENABLED_CAVIUM_V=no
initial cavium, crypto only, no rsa
2013-01-29 16:22:49 -08:00
]
)
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
# Cavium Octeon
OCTEON_ROOT=""
QAT Header Hiding For the sync QAT, the QAT headers are included into the library after it has been built and is being used. The actual headers should only be used when building wolfSSL and should be hidden from the user. 1. Most of the functions in the sync QAT and OCTEON headers don't need to be exported. Move all of that into the source files. Only export the init and deinit functions. 2. Remove inline from the OCTEON support functions. 3. Remove the AES-ECB files for sync OCTEON as unused. 4. Configure defaults to OCTEON2 build, can be overridden with variable.
2019-10-22 16:26:35 -07:00
: ${OCTEON_OBJ="obj-octeon2"}
Sync OCTEON fix 1. For OCTEON builds, leave out the "-DCVMX_BUILD_FOR_LINUX_HOST" option from CFLAGS by default so it makes standalone host builds. 2. Add a check of the variable OCTEON_HOST for linux to add back in the "-DCVMX_BUILD_FOR_LINUX_HOST" to CFLAGS.
2019-11-14 14:15:21 -08:00
: ${OCTEON_HOST="standalone"}
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
AC_ARG_WITH([octeon-sync],
[AS_HELP_STRING([--with-octeon-sync=PATH],[PATH to Cavium Octeon SDK dir (sync)])],
[
AC_MSG_CHECKING([for octeon])
if test "x$withval" = "xyes" ; then
AC_MSG_ERROR([need a PATH for --with-octeon])
fi
if test "x$withval" != "xno" ; then
OCTEON_ROOT=$withval
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_CAVIUM_OCTEON_SYNC"
Sync OCTEON fix 1. For OCTEON builds, leave out the "-DCVMX_BUILD_FOR_LINUX_HOST" option from CFLAGS by default so it makes standalone host builds. 2. Add a check of the variable OCTEON_HOST for linux to add back in the "-DCVMX_BUILD_FOR_LINUX_HOST" to CFLAGS.
2019-11-14 14:15:21 -08:00
AM_CFLAGS="$AM_CFLAGS -DOCTEON_MODEL=$OCTEON_MODEL"
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
AM_CFLAGS="$AM_CFLAGS -I$OCTEON_ROOT/executive"
Sync OCTEON fix 1. For OCTEON builds, leave out the "-DCVMX_BUILD_FOR_LINUX_HOST" option from CFLAGS by default so it makes standalone host builds. 2. Add a check of the variable OCTEON_HOST for linux to add back in the "-DCVMX_BUILD_FOR_LINUX_HOST" to CFLAGS.
2019-11-14 14:15:21 -08:00
AS_CASE([$OCTEON_HOST],['linux'],[AM_CFLAGS="$AM_CFLAGS -DCVMX_BUILD_FOR_LINUX_HOST"])
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
libwebsockets requires *CRYPTO_EX_DATA* APIs
2020-08-06 16:05:03 -07:00
#-I$OCTEON_ROOT/target/include
Sniffer Update 1. Add ssl_SetWatchKeyCallback_ex() which was missing. 2. Fix linking issue with OCTEON libraries.
2019-10-23 15:01:41 -07:00
AM_LDFLAGS="$AM_LDFLAGS -lrt -Xlinker -T -Xlinker $OCTEON_ROOT/executive/cvmx-shared-linux.ld"
AM_LDFLAGS="$AM_LDFLAGS -L$OCTEON_ROOT/executive/$OCTEON_OBJ -lcvmx -lfdt"
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
enable_shared=no
enable_static=yes
ENABLED_OCTEON_SYNC=yes
AC_MSG_RESULT([yes])
],
[ENABLED_OCTEON_SYNC=no]
)
Fixes for building with the latest QuickAssist v1.7 driver: * Updated `--with-intelqa=` to support detection of QAT driver version and use different .so libs. * Added include and lib reference for new libusdm. * Added `QAT_ENABLE_RNG` option. * Fix for dynamic type spelling error (`DYNAMIC_TYPE_SYMETRIC_KEY` -> `DYNAMIC_TYPE_SYMMETRIC_KEY`). * Fix benchmark output to use "took" not "tooks".
2018-12-04 12:54:11 -08:00
# Intel QuickAssist
QAT_DIR=""
BUILD_INTEL_QAT_VERSION=2
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
AC_ARG_WITH([intelqa],
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
[AS_HELP_STRING([--with-intelqa=PATH],[PATH to Intel QuickAssist (QAT) driver dir])],
[ENABLED_INTEL_QA=yes; QAT_DIR=$withval],
[ENABLED_INTEL_QA=no])
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AC_ARG_WITH([intelqa-sync],
[AS_HELP_STRING([--with-intelqa-sync=PATH],[PATH to Intel QuickAssist (QAT) driver dir (sync)])],
[ENABLED_INTEL_QA_SYNC=yes; QAT_DIR=$withval],
[ENABLED_INTEL_QA_SYNC=no])
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AS_IF([test "x$ENABLED_INTEL_QA" = "xyes" && test "x$ENABLED_INTEL_QA_SYNC" = "xyes"],
[AC_MSG_ERROR([Both Intel QA Async and Sync are selected, only select one.])])
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AS_IF([test "x$ENABLED_INTEL_QA" = "xyes" || test "x$ENABLED_INTEL_QA_SYNC" = "xyes"],
[AC_MSG_CHECKING([for intelqa])
AS_IF([test "x$ENABLED_INTEL_QA" = "xyes"],
[AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_INTEL_QA -DDO_CRYPTO -DUSER_SPACE"; intelqa_opt=""],
[AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_INTEL_QA_SYNC -DQAT_USE_POLLING_THREAD -DO_CRYPTO -DUSER_SPACE"; intelqa_opt="-sync"])
OLD_LIBS="$LIBS"
OLD_CPPFLAGS="$CPPFLAGS"
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AS_IF([test "x$QAT_DIR" = "xyes"],[AC_MSG_ERROR([need a PATH for --with-intelqa$intelqa_opt])])
Fixes for building with the latest QuickAssist v1.7 driver: * Updated `--with-intelqa=` to support detection of QAT driver version and use different .so libs. * Added include and lib reference for new libusdm. * Added `QAT_ENABLE_RNG` option. * Fix for dynamic type spelling error (`DYNAMIC_TYPE_SYMETRIC_KEY` -> `DYNAMIC_TYPE_SYMMETRIC_KEY`). * Fix benchmark output to use "took" not "tooks".
2018-12-04 12:54:11 -08:00
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AM_CPPFLAGS="$AM_CPPFLAGS -I$QAT_DIR/quickassist/include -I$QAT_DIR/quickassist/include/lac -I$QAT_DIR/quickassist/utilities/osal/include \
-I$QAT_DIR/quickassist/utilities/osal/src/linux/user_space/include -I$QAT_DIR/quickassist/lookaside/access_layer/include \
-I$QAT_DIR/quickassist/lookaside/access_layer/src/common/include -I$srcdir/wolfssl -I$srcdir/wolfssl/wolfcrypt/port/intel \
-I$QAT_DIR/quickassist/utilities/libusdm_drv"
CPPFLAGS="$AM_CPPFLAGS"
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
LDFLAGS="$LDFLAGS -L$QAT_DIR/build"
LIBS="$LIBS -lqat_s -lusdm_drv_s"
Fixes for building with the latest QuickAssist v1.7 driver: * Updated `--with-intelqa=` to support detection of QAT driver version and use different .so libs. * Added include and lib reference for new libusdm. * Added `QAT_ENABLE_RNG` option. * Fix for dynamic type spelling error (`DYNAMIC_TYPE_SYMETRIC_KEY` -> `DYNAMIC_TYPE_SYMMETRIC_KEY`). * Fix benchmark output to use "took" not "tooks".
2018-12-04 12:54:11 -08:00
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include "cpa_cy_common.h"]],[[Cpa16U count = 0; cpaCyGetNumInstances(&count);]])],[intelqa_linked=yes],[intelqa_linked=no])
AS_IF([test "x$intelqa_linked" = "xno"],
[# Try old QAT driver libraries
LIBS="$OLD_LIBS -licp_qa_al_s"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include "cpa_cy_common.h"]],[[Cpa16U count = 0; cpaCyGetNumInstances(&count);]])],[intelqa_linked=yes],[intelqa_linked=no])
AS_IF([test "x$intelqa_linked" = "xno"],
[AC_MSG_ERROR([Intel QuickAssist not found. If it's already installed, specify its path using --with-intelqa$intelqa_opt=/dir/])],
[BUILD_INTEL_QAT_VERSION=1])
])
AC_MSG_RESULT([yes])
configure.ac change == to = when not C code
2020-06-24 13:41:03 -06:00
AS_IF([test "x$BUILD_INTEL_QAT_VERSION" = "x1"],
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
[LIB_ADD="-ladf_proxy -losal -lrt $LIB_ADD"],
[LIB_ADD="-losal -lrt $LIB_ADD"])
CPPFLAGS="$OLD_CPPFLAGS"
])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
################################################################################
# Single Precision option handling #
################################################################################
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_RSA=no
ENABLED_SP_DH=no
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_2048=no
ENABLED_SP_FF_3072=no
ENABLED_SP_FF_4096=no
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_ECC=no
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_EC_256=no
ENABLED_SP_EC_384=no
SP: Add support for P521
2021-12-24 11:16:59 +10:00
ENABLED_SP_EC_521=no
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
ENABLED_SP_SAKKE_1024=$ENABLED_SAKKE
Added new option `WOLFSSL_SP_NO_MALLOC` for building small SP without malloc. Added SP documentation. Added `./configure --enable-sp=yes,nomalloc` supprt. https://github.com/wolfSSL/scripts/pull/79
2020-04-10 11:13:55 -07:00
ENABLED_SP_NO_MALLOC=no
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
ENABLED_SP_NONBLOCK=no
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
ENABLED_SP_SMALL=no
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
for v in `echo $ENABLED_SP | tr "," " "`
do
case $v in
small)
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
ENABLED_SP_SMALL=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_2048=yes
ENABLED_SP_FF_3072=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_ECC=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_EC_256=yes
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" || test "$host_cpu" = "amd64"; then
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_4096=yes
ENABLED_SP_EC_384=yes
SP: Add support for P521
2021-12-24 11:16:59 +10:00
ENABLED_SP_EC_521=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
fi
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
SP C: change number of words for RSA/DH Faster small code and fast code. Allow fixed 4096-bit FFDHE parameters in benchmark. Convert [u]int[32|64|128]*_t types to sp_[u]int[32|64|128]. Add a div for when top bits are all 1 WOLFSSL_SP_FAST_LARGE_CODE added to make mul_add function faster on non-embedded platforms. Change mod_exp window sizes for same performance but less memory. P256 with c32 now 9 words instead of 10.
2021-07-16 22:17:20 +10:00
smallfast)
ENABLED_SP_SMALL=yes
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
ENABLED_SP_FF_2048=yes
ENABLED_SP_FF_3072=yes
ENABLED_SP_ECC=yes
ENABLED_SP_EC_256=yes
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" || test "$host_cpu" = "amd64"; then
SP C: change number of words for RSA/DH Faster small code and fast code. Allow fixed 4096-bit FFDHE parameters in benchmark. Convert [u]int[32|64|128]*_t types to sp_[u]int[32|64|128]. Add a div for when top bits are all 1 WOLFSSL_SP_FAST_LARGE_CODE added to make mul_add function faster on non-embedded platforms. Change mod_exp window sizes for same performance but less memory. P256 with c32 now 9 words instead of 10.
2021-07-16 22:17:20 +10:00
ENABLED_SP_FF_4096=yes
ENABLED_SP_EC_384=yes
SP: Add support for P521
2021-12-24 11:16:59 +10:00
ENABLED_SP_EC_521=yes
SP C: change number of words for RSA/DH Faster small code and fast code. Allow fixed 4096-bit FFDHE parameters in benchmark. Convert [u]int[32|64|128]*_t types to sp_[u]int[32|64|128]. Add a div for when top bits are all 1 WOLFSSL_SP_FAST_LARGE_CODE added to make mul_add function faster on non-embedded platforms. Change mod_exp window sizes for same performance but less memory. P256 with c32 now 9 words instead of 10.
2021-07-16 22:17:20 +10:00
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_FAST_MODEXP"
;;
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
yes)
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_2048=yes
ENABLED_SP_FF_3072=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_ECC=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_EC_256=yes
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
if test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" || test "$host_cpu" = "amd64"; then
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_4096=yes
ENABLED_SP_EC_384=yes
SP: Add support for P521
2021-12-24 11:16:59 +10:00
ENABLED_SP_EC_521=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
fi
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
no)
;;
smallec256 | smallp256 | small256)
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_SMALL=yes
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
ENABLED_SP_ECC=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_EC_256=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
ec256 | p256 | 256)
ENABLED_SP_ECC=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_EC_256=yes
;;
smallec384 | smallp384 | small384)
ENABLED_SP_SMALL=yes
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
ENABLED_SP_ECC=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_EC_384=yes
;;
ec384 | p384 | 384)
ENABLED_SP_ECC=yes
ENABLED_SP_EC_384=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
SP: Add support for P521
2021-12-24 11:16:59 +10:00
smallec521 | smallp521 | small521)
ENABLED_SP_SMALL=yes
ENABLED_SP_ECC=yes
ENABLED_SP_EC_521=yes
;;
ec521 | p521 | 521)
ENABLED_SP_ECC=yes
ENABLED_SP_EC_521=yes
;;
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
smallec1024 | smallp1024 | small1024)
ENABLED_SP_ECC=yes
ENABLED_SP_SMALL=yes
ENABLED_SP_SAKKE_1024=yes
;;
ec1024 | p1024 | 1024)
ENABLED_SP_ECC=yes
ENABLED_SP_SAKKE_1024=yes
;;
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
small2048)
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_SMALL=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_2048=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
2048)
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_2048=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
smallrsa2048)
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_SMALL=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_RSA=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_2048=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
rsa2048)
ENABLED_SP_RSA=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_2048=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
small3072)
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_SMALL=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_3072=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
3072)
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_3072=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
smallrsa3072)
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_SMALL=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP_RSA=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_3072=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
rsa3072)
ENABLED_SP_RSA=yes
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
ENABLED_SP_FF_3072=yes
;;
small4096)
ENABLED_SP_SMALL=yes
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
ENABLED_SP_FF_4096=yes
;;
4096 | +4096)
ENABLED_SP_RSA=yes
ENABLED_SP_DH=yes
ENABLED_SP_FF_4096=yes
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
;;
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
smallrsa4096)
ENABLED_SP_SMALL=yes
ENABLED_SP_RSA=yes
ENABLED_SP_FF_4096=yes
;;
rsa4096)
ENABLED_SP_RSA=yes
ENABLED_SP_FF_4096=yes
SP now has support for RSA/DH 4096-bit operations
2019-11-12 12:04:06 +10:00
;;
Added new option `WOLFSSL_SP_NO_MALLOC` for building small SP without malloc. Added SP documentation. Added `./configure --enable-sp=yes,nomalloc` supprt. https://github.com/wolfSSL/scripts/pull/79
2020-04-10 11:13:55 -07:00
nomalloc)
ENABLED_SP_NO_MALLOC=yes
;;
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
nonblock)
# Requires small and no malloc
ENABLED_SP_NONBLOCK=yes
ENABLED_SP_NO_MALLOC=yes
ENABLED_SP_SMALL=yes
;;
SP config: allow asm to be an SP options (--enable-sp=asm.yes)
2021-03-17 11:24:55 +10:00
asm)
ENABLED_SP_ASM=yes
;;
SP: config option to force no asm Added to configure.ac the option to specify SP to be built with ASM as x64 defaults to with asm.
2022-09-08 16:20:15 +10:00
noasm)
ENABLED_SP_ASM=no
;;
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
*)
SP ARM 32: Fixes to get building for armv7-a Change ldrd to either have even first register or change over to ldm with even first register. Ensure shift value in ORR instruction has a hash before it. Don't index loads and stores by 256 or more - make them post-index. div2 for P521 simplified.
2022-05-20 12:15:58 +10:00
AC_MSG_ERROR([Invalid choice of Single Precision length in bits [256, 384, 521, 1024, 2048, 3072, 4096]: $ENABLED_SP.])
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
break;;
esac
done
ENABLED_SP=no
if test "$ENABLED_RSA" = "yes" && test "$ENABLED_SP_RSA" = "yes"; then
ENABLED_SP=yes
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_SP_RSA"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_HAVE_SP_RSA"
fi
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
if test "$ENABLED_DH" != "no" && test "$ENABLED_SP_DH" = "yes"; then
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP=yes
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_SP_DH"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_HAVE_SP_DH"
fi
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
if test "$ENABLED_SP_RSA" = "yes" || test "$ENABLED_SP_DH" = "yes"; then
if test "$ENABLED_SP_FF_2048" = "no"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_NO_2048"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_NO_2048"
fi
if test "$ENABLED_SP_FF_3072" = "no"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_NO_3072"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_NO_3072"
fi
if test "$ENABLED_SP_FF_4096" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_4096"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_4096"
fi
SP C: change number of words for RSA/DH Faster small code and fast code. Allow fixed 4096-bit FFDHE parameters in benchmark. Convert [u]int[32|64|128]*_t types to sp_[u]int[32|64|128]. Add a div for when top bits are all 1 WOLFSSL_SP_FAST_LARGE_CODE added to make mul_add function faster on non-embedded platforms. Change mod_exp window sizes for same performance but less memory. P256 with c32 now 9 words instead of 10.
2021-07-16 22:17:20 +10:00
case $host_cpu in
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
*x86_64* | *aarch64* | *amd64*)
SP C: change number of words for RSA/DH Faster small code and fast code. Allow fixed 4096-bit FFDHE parameters in benchmark. Convert [u]int[32|64|128]*_t types to sp_[u]int[32|64|128]. Add a div for when top bits are all 1 WOLFSSL_SP_FAST_LARGE_CODE added to make mul_add function faster on non-embedded platforms. Change mod_exp window sizes for same performance but less memory. P256 with c32 now 9 words instead of 10.
2021-07-16 22:17:20 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_LARGE_CODE"
;;
*)
;;
esac
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
fi
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
if test "$ENABLED_ECC" != "no" && test "$ENABLED_SP_ECC" = "yes"; then
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
ENABLED_SP=yes
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_SP_ECC"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_HAVE_SP_ECC"
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
if test "$ENABLED_SP_EC_256" = "no"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_NO_256"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_NO_256"
fi
if test "$ENABLED_SP_EC_384" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC384 -DWOLFSSL_SP_384"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_384"
fi
SP: Add support for P521
2021-12-24 11:16:59 +10:00
if test "$ENABLED_SP_EC_521" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC521 -DWOLFSSL_SP_521"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_521"
fi
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
if test "$ENABLED_SP_SAKKE_1024" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_1024"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_1024"
fi
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
fi
if test "$ENABLED_SP_SMALL" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_SMALL"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_SMALL"
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
fi
Added new option `WOLFSSL_SP_NO_MALLOC` for building small SP without malloc. Added SP documentation. Added `./configure --enable-sp=yes,nomalloc` supprt. https://github.com/wolfSSL/scripts/pull/79
2020-04-10 11:13:55 -07:00
if test "$ENABLED_SP_NO_MALLOC" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_NO_MALLOC"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_NO_MALLOC"
fi
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
if test "$ENABLED_SP_NONBLOCK" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_NONBLOCK"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_NONBLOCK"
fi
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
Disable algorithms: fixes WOLFSSL_PUBLIC_MP and disable algorithms didn't work because of api.c. - mp_cond_copy not available unless ECC compiled in - wc_export_int not available unless ECC compiled in Enabling only DH and using SP with SP Math didn't work as the DH parameters were too small. sp_cmp is needed when only DH. mp_set_int is was not available in SP math when RSA is not defined. mp_set is close enough for the use cases. Configure with SP and SP math but not RSA, DH and ECC didn't configure - now default to small maths.
2021-11-19 13:43:14 +10:00
# Check that we enable SP with RSA, DH or ECC.
if test "$ENABLED_SP" = "no"; then
# Didn't need SP, don't need SP_MATH.
if test "$ENABLED_SP_MATH" = "yes"; then
ENABLED_SP_MATH=no
fi
fi
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
if test "$ENABLED_SP_MATH" = "yes"; then
if test "$ENABLED_SP" = "no"; then
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
AC_MSG_ERROR([Must have SP enabled with SP math: --enable-sp])
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
fi
Support for new DPP in wpa_supplicant - Add null check to asn template code in MakeCertReq and test - ENABLED_ECCCUSTCURVES can also be "all"
2022-06-10 18:13:39 +02:00
if test "$ENABLED_ECCCUSTCURVES" != "no"; then
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
AC_MSG_ERROR([Cannot use single precision math and custom curves])
fi
if test "$ENABLED_DSA" = "yes"; then
AC_MSG_ERROR([Cannot use single precision math and DSA])
fi
if test "$ENABLED_SRP" = "yes"; then
AC_MSG_ERROR([Cannot use single precision math and SRP])
fi
if test "$ENABLED_SP_RSA" = "no" && test "$ENABLED_RSA" = "yes"; then
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
AC_MSG_ERROR([Cannot use RSA single precision only math and RSA])
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
fi
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
if test "$ENABLED_SP_DH" = "no" && test "$ENABLED_DH" != "no"; then
Add support for P384 curve into SP
2019-12-02 10:04:58 +10:00
AC_MSG_ERROR([Cannot use DH single precision only math and DH])
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
fi
fi
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
for v in `echo $ENABLED_SP_MATH_ALL | tr "," " "`
do
case $v in
yes | no)
;;
small)
ENABLED_SP_MATH_ALL="yes"
ENABLED_SP_SMALL="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_SMALL"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_SMALL"
;;
huge)
ENABLED_SP_MATH_ALL="yes"
ENABLED_FASTHUGEMATH="yes"
AM_CFLAGS="$AM_CFLAGS $OPTIMIZE_HUGE_CFLAGS"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_INT_LARGE_COMBA"
;;
256 | 384 | 521 | 1024 | 2048 | 3072 | 4096)
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
if test -z "$DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS" -o "$DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS" -lt "$v"
then
DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS="$v"
fi
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
ENABLED_SP_MATH_ALL="yes"
;;
SP int: Rework allocation of temporaries Allocate only as much is as needed. Use macros to simplify code. Don't use an sp_int if you can use an array of 'sp_int_digit's.
2021-01-27 11:42:44 +10:00
nomalloc)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_NO_MALLOC"
ENABLED_SP_MATH_ALL="yes"
;;
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
neg)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_INT_NEGATIVE"
ENABLED_SP_MATH_ALL="yes"
;;
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
*)
AC_MSG_ERROR([Support SP int bit sizes: 256, 384, 521, 1024, 2048, 3072, 4096. $ENABLED_SP_MATH_ALL not supported])
;;
esac
done
configure.ac: when --enable-fips=disabled, don't touch DEF_SP_MATH/DEF_FAST_MATH; don't enable sp-math-all asm gates when !ENABLED_ASM; add --with-arm-target to allow selecting thumb or cortex in conjunction with a full --host tuple (e.g. --host=armv6zk-softfloat-linux-gnueabi --with-arm-target=thumb).
2022-06-28 18:15:28 -05:00
AC_ARG_WITH([arm-target],
[AS_HELP_STRING([--with-arm-target=x],[x can be "thumb" or "cortex"])],
[ARM_TARGET="$withval"],
[ARM_TARGET=''])
if test "$ENABLED_SP_MATH_ALL" = "yes" && test "$ENABLED_ASM" != "no"; then
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
ENABLED_FASTMATH="no"
ENABLED_SLOWMATH="no"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_MATH_ALL"
case $host_cpu in
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
*x86_64* | *amd64*)
AES x86 ASM: new assembly Added new x86 assembly for AES. AES-CBC decrypt only 4 blocks at a time (not 6 or 8) due to reduces register count. GCM implementation for AVX2, AVX1 and AESNI only. Disabled looking for other assembly files for x86.
2022-09-30 16:19:40 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_X86_64"
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
;;
*x86*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_X86"
;;
*aarch64*)
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM64 -DWOLFSSL_AARCH64_BUILD"
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
;;
*arm*)
configure.ac: when --enable-fips=disabled, don't touch DEF_SP_MATH/DEF_FAST_MATH; don't enable sp-math-all asm gates when !ENABLED_ASM; add --with-arm-target to allow selecting thumb or cortex in conjunction with a full --host tuple (e.g. --host=armv6zk-softfloat-linux-gnueabi --with-arm-target=thumb).
2022-06-28 18:15:28 -05:00
if test "$host_alias" = "thumb" || test "$ARM_TARGET" = "thumb"; then
ARM: identify ARM CPU for Thumb and Cortex Better detailed check of CPU architecture for 32-bit byte reversal asm
2020-12-07 11:02:15 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM_THUMB"
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
else
configure.ac: when --enable-fips=disabled, don't touch DEF_SP_MATH/DEF_FAST_MATH; don't enable sp-math-all asm gates when !ENABLED_ASM; add --with-arm-target to allow selecting thumb or cortex in conjunction with a full --host tuple (e.g. --host=armv6zk-softfloat-linux-gnueabi --with-arm-target=thumb).
2022-06-28 18:15:28 -05:00
if test "$host_alias" = "cortex" || test "$ARM_TARGET" = "cortex"; then
ARM: identify ARM CPU for Thumb and Cortex Better detailed check of CPU architecture for 32-bit byte reversal asm
2020-12-07 11:02:15 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM_CORTEX_M"
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM32"
fi
fi
;;
*ppc64* | *powerpc64*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_PPC64"
;;
*ppc* | *powerpc*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_PPC"
;;
*mips64*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_MIPS64"
;;
*mips*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_MIPS"
;;
*riscv32*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_RISCV32"
;;
*riscv64*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_RISCV64"
;;
*s390x*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_S390X"
;;
esac
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
SP math all: don't use sp_int_word when SQR_MUL_ASM available 1. _WIN64 doesn't have 128-bit type but now can use 64-bit sp_int_digit when assembly code snippets are being used. 2. Fix sp_div() to support values closer to maximum size. 3. Fix builds to work for more configurations. 4. Have ECC uncompressed code keep intermediate values in range of maximum (x^3 calculation fixed). 5. Fix configuation.ac's check of FIPS for using signed SP Math All. Default now not signed as intended.
2022-06-28 15:51:53 +10:00
if test "$ENABLED_FIPS" != "no" || test "$SELFTEST_VERSION" != "none"; then
Fixes required to make SP Math default fasthugemath means turn on fastmath Use sp_int_digit and not sp_digit in sp_int.c. test.c needs to use large static buffer when SP Math used like fastmath. When building static memroy, SP math all without WOLFSSL_SP_NO_MALLOC is a valid configuration. Fix freeing of bigint in sp_int.c. Cast x to a signed value to negate and then back to unsigned. (For Windows builds.) Remove warning about empty file on Windows about integer.obj. Allow RSA verify only and RSA public only to be used with other public key algorithms. If building for FIPS, then older versions of RSA and ECC require SP Math to support negative numbers. Get old FIPS files building with SP int. Disallow --enable-sp-math and --enable-sp-math-all. When just --enable-sp-math on configuration line then disable SP Math all.
2022-01-19 10:20:21 +10:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_INT_NEGATIVE"
fi
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
fi
configure.ac: move --enable-sp-asm handling to follow --enable-sp-math-all handling, so that $ENABLED_SP requirement is properly met.
2020-12-02 18:39:36 -06:00
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
if test "$ENABLED_SP_ASM" = "yes" && test "$ENABLED_SP" = "yes"; then
configure.ac: move --enable-sp-asm handling to follow --enable-sp-math-all handling, so that $ENABLED_SP requirement is properly met.
2020-12-02 18:39:36 -06:00
if test "$ENABLED_SP_NONBLOCK" = "yes"; then
AC_MSG_ERROR([SP non-blocking not supported with sp-asm])
fi
if test "$ENABLED_ASM" = "no"; then
AC_MSG_ERROR([Assembly code turned off])
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ASM"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_ASM"
case $host_cpu in
*aarch64*)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM64_ASM"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_ARM64_ASM"
ENABLED_SP_ARM64_ASM=yes
;;
*arm*)
configure.ac: when --enable-fips=disabled, don't touch DEF_SP_MATH/DEF_FAST_MATH; don't enable sp-math-all asm gates when !ENABLED_ASM; add --with-arm-target to allow selecting thumb or cortex in conjunction with a full --host tuple (e.g. --host=armv6zk-softfloat-linux-gnueabi --with-arm-target=thumb).
2022-06-28 18:15:28 -05:00
if test "$host_alias" = "thumb" || test "$ARM_TARGET" = "thumb"; then
configure.ac: fix rebase error, re enable-sp-asm on ARM.
2020-12-10 14:46:22 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM_THUMB_ASM"
configure.ac: move --enable-sp-asm handling to follow --enable-sp-math-all handling, so that $ENABLED_SP requirement is properly met.
2020-12-02 18:39:36 -06:00
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_ARM_THUMB_ASM"
ENABLED_SP_ARM_THUMB_ASM=yes
else
configure.ac: when --enable-fips=disabled, don't touch DEF_SP_MATH/DEF_FAST_MATH; don't enable sp-math-all asm gates when !ENABLED_ASM; add --with-arm-target to allow selecting thumb or cortex in conjunction with a full --host tuple (e.g. --host=armv6zk-softfloat-linux-gnueabi --with-arm-target=thumb).
2022-06-28 18:15:28 -05:00
if test "$host_alias" = "cortex" || test "$ARM_TARGET" = "cortex"; then
configure.ac: fix rebase error, re enable-sp-asm on ARM.
2020-12-10 14:46:22 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM_CORTEX_M_ASM"
configure.ac: move --enable-sp-asm handling to follow --enable-sp-math-all handling, so that $ENABLED_SP requirement is properly met.
2020-12-02 18:39:36 -06:00
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_ARM_CORTEX_M_ASM"
ENABLED_SP_ARM_CORTEX_ASM=yes
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_ARM32_ASM"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_ARM32_ASM"
ENABLED_SP_ARM32_ASM=yes
fi
fi
;;
configure: Improve defaults for 64-bit BSDs ... by consistently treating host cpu "amd64" like host cpu "x86_64". Tested on ElectroBSD amd64.
2022-05-08 12:13:18 +02:00
*x86_64* | *amd64*)
configure.ac: move --enable-sp-asm handling to follow --enable-sp-math-all handling, so that $ENABLED_SP requirement is properly met.
2020-12-02 18:39:36 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_X86_64_ASM"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_X86_64_ASM"
ENABLED_SP_X86_64_ASM=yes
;;
*)
AC_MSG_ERROR([ASM not available for CPU. Supported CPUs: x86_64, aarch64, arm])
;;
esac
fi
Pull out x86_64 ASM into separate files
2019-01-25 12:03:08 +10:00
if test "$ENABLED_SP_MATH" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_MATH"
fi
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
################################################################################
# End - Single Precision option handling #
################################################################################
configure.ac: move --enable-sp-asm handling to follow --enable-sp-math-all handling, so that $ENABLED_SP requirement is properly met.
2020-12-02 18:39:36 -06:00
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
# Fast RSA using Intel IPP
ippdir="${srcdir}/IPP"
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
ipplib="lib" # if autoconf guesses 32bit system changes lib directory
fastRSA_found=no
abs_path=`pwd`
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
# set up variables used
IPPLIBS=
IPPHEADERS=
IPPLINK=
AC_ARG_ENABLE([fast-rsa],
[AS_HELP_STRING([--enable-fast-rsa],[Enable RSA using Intel IPP (default: disabled)])],
[ ENABLED_FAST_RSA=$enableval ],
[ ENABLED_FAST_RSA=no ],
)
Disable `fast-rsa` if RSA PSS is enabled (not supported).
2020-05-04 10:33:43 -07:00
# Fast RSA does not support RSA-PSS
if test "$ENABLED_RSAPSS" = "yes"; then
ENABLED_FAST_RSA=no
fi
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
if test "$ENABLED_USER_RSA" = "no" && test "$ENABLED_FIPS" = "no"; then
if test "$ac_cv_sizeof_long" = "4" && test "$ac_cv_sizeof_long_long" = "8"; then
ipplib="lib_32" # 32 bit OS detected
fi
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
# Use static IPP Libraries
if test "$enable_shared" = "no" && test "$ENABLED_FAST_RSA" = "yes"; then
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
case $host_os in
*darwin*)
ipplib="$ipplib/mac_static"
AC_MSG_ERROR([Issue with static linking to libippcp.a on Mac.
Dynamic IPP libraries supported on Mac])
break;;
*linux*)
ipplib="$ipplib/linux_static"
break;;
*)
ENABLED_FAST_RSA=no
esac
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
if test -e $srcdir/IPP/$ipplib/libippcore.a && test -e $srcdir/IPP/$ipplib/libippcp.a
then
:
else
ENABLED_FAST_RSA=no
fi
AC_CHECK_HEADERS([IPP/include/ipp.h IPP/include/ippcp.h], [AM_CPPFLAGS="-I$srcdir/IPP/include $AM_CPPFLAGS"], [ENABLED_FAST_RSA=no])
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
LIB_STATIC_ADD="$srcdir/IPP/$ipplib/libippcp.a $srcdir/IPP/$ipplib/libippcore.a $LIB_STATIC_ADD"
configure error out when not finding libraries with fast-rsa
2015-10-26 13:11:11 -06:00
if test "$ENABLED_FAST_RSA" = "no"; then
AC_MSG_ERROR([Could not find fast rsa libraries])
fi
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
else
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
# Check for and use bundled IPP libraries
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
if test "$ENABLED_FAST_RSA" = "yes"; then
AC_MSG_NOTICE([Using local IPP crypto library])
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
AC_CHECK_HEADER([$abs_path/IPP/include/ippcp.h],
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
[
# build and default locations on linux and mac
STORE_LDFLAGS=${LDFLAGS}
STORE_CPPFLAGS=${CPPFLAGS}
# using LDFLAGS instead of AM_ temporarily to test link to library
LDFLAGS="-L$ippdir/$ipplib -lippcp -lippcore"
CPPFLAGS="-I$ippdir/include"
AC_CHECK_HEADERS([ippcp.h], [AC_CHECK_LIB([ippcp], [ippsRSAEncrypt_PKCSv15], [fastRSA_found=yes], [fastRSA_found=no])], [fastRSA_found=no])
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
name="$ippdir/$ipplib/libippcp"
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
case $host_os in
*darwin*)
# check file existence and conditionally set variables
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
if test -e $abs_path/IPP/$ipplib/libippcp.dylib
then
IPPLIBS="${name}.dylib ${name}-9.0.dylib ${name}e9-9.0.dylib ${name}g9-9.0.dylib ${name}h9-9.0.dylib ${name}k0-9.0.dylib ${name}l9-9.0.dylib ${name}n8-9.0.dylib ${name}p8-9.0.dylib ${name}s8-9.0.dylib ${name}y8-9.0.dylib IPP/lib/libippcore.dylib IPP/lib/libippcore-9.0.dylib"
IPPLINK="mkdir -p src/.libs && ln -f ${name}.dylib src/.libs/libippcp.dylib && ln -f ${srcdir}/${name}-9.0.dylib src/.libs/libippcp-9.0.dylib && ln -f ${srcdir}/${name}e9-9.0.dylib src/.libs/libippcpe9-9.0.dylib && ln -f ${srcdir}/${name}g9-9.0.dylib src/.libs/libippcpg9-9.0.dylib && ln -f ${srcdir}/${name}h9-9.0.dylib src/.libs/libippcph9-9.0.dylib && ln -f ${srcdir}/${name}k0-9.0.dylib src/.libs/libippcpk0-9.0.dylib && ln -f ${srcdir}/${name}l9-9.0.dylib src/.libs/libippcpl9-9.0.dylib && ln -f ${srcdir}/${name}n8-9.0.dylib src/.libs/libippcpn8-9.0.dylib && ln -f ${srcdir}/${name}p8-9.0.dylib src/.libs/libippcpp8-9.0.dylib && ln -f ${srcdir}/${name}s8-9.0.dylib src/.libs/libippcps8-9.0.dylib && ln -f ${srcdir}/${name}y8-9.0.dylib src/.libs/libippcpy8-9.0.dylib && ln -f ${srcdir}/IPP/lib/libippcore.dylib src/.libs/libippcore.dylib && ln -f ${srcdir}/IPP/lib/libippcore-9.0.dylib src/.libs/libippcore-9.0.dylib"
else
fastRSA_found=no
fi
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
break;;
*linux*)
# check file existence and conditionally set variables
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
if test -e $abs_path/IPP/$ipplib/libippcp.so.9.0
then
if test "$ac_cv_sizeof_long" = "4" && test "$ac_cv_sizeof_long_long" = "8"; then
IPPLIBS="${name}.so.9.0 ${name}g9.so.9.0 ${name}h9.so.9.0 ${name}p8.so.9.0 ${name}px.so.9.0 ${name}s8.so.9.0 ${name}.so ${name}w7.so.9.0 IPP/$ipplib/libippcore.so IPP/$ipplib/libippcore.so.9.0"
IPPLINK="mkdir -p src/.libs && ln -f ${name}.so.9.0 src/.libs/libippcp.so.9.0 && ln -f ${name}g9.so.9.0 src/.libs/libippcpg9.so.9.0 && ln -f ${name}h9.so.9.0 src/.libs/libippcph9.so.9.0 && ln -f ${name}p8.so.9.0 src/.libs/libippcpp8.so.9.0 && ln -f ${name}px.so.9.0 src/.libs/libippcppx.so.9.0 && ln -f ${name}s8.so.9.0 src/.libs/libippcps8.so.9.0 && ln -f ${name}.so src/.libs/libippcp.so && ln -f ${name}w7.so.9.0 src/.libs/libippcpw7.so.9.0 && ln -f IPP/$ipplib/libippcore.so src/.libs/libippcore.so && ln -f IPP/$ipplib/libippcore.so.9.0 src/.libs/libippcore.so.9.0"
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
else
configure.ac and autogen.sh: fix warnings in configure.ac, and enable WARNINGS=all,error in autogen.sh. also, remove --verbose to avoid obscuring warning output.
2021-10-06 18:07:06 -05:00
IPPLIBS="${name}.so.9.0 ${name}e9.so.9.0 ${name}k0.so.9.0 ${name}l9.so.9.0 ${name}m7.so.9.0 ${name}mx.so.9.0 ${name}.so ${name}n8.so.9.0 ${name}y8.so.9.0 IPP/lib/libippcore.so IPP/lib/libippcore.so.9.0"
IPPLINK="mkdir -p src/.libs && ln -f ${name}.so.9.0 src/.libs/libippcp.so.9.0 && ln -f ${name}e9.so.9.0 src/.libs/libippcpe9.so.9.0 && ln -f ${name}k0.so.9.0 src/.libs/libippcpk0.so.9.0 && ln -f ${name}l9.so.9.0 src/.libs/libippcpl9.so.9.0 && ln -f ${name}m7.so.9.0 src/.libs/libippcpm7.so.9.0 && ln -f ${name}mx.so.9.0 src/.libs/libippcpmx.so.9.0 && ln -f ${name}.so src/.libs/libippcp.so && ln -f ${name}n8.so.9.0 src/.libs/libippcpn8.so.9.0 && ln -f ${name}y8.so.9.0 src/.libs/libippcpy8.so.9.0 && ln -f IPP/lib/libippcore.so src/.libs/libippcore.so && ln -f IPP/lib/libippcore.so.9.0 src/.libs/libippcore.so.9.0"
fi
else
fastRSA_found=no
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
fi
break;;
*)
fastRSA_found=no
esac
if test "$fastRSA_found" = "yes"; then
# was succesfull so add tested LDFLAGS to AM_ flags
AM_LDFLAGS="${AM_LDFLAGS} ${LDFLAGS}"
AM_CPPFLAGS="${AM_CPPFLAGS} ${CPPFLAGS}"
IPPHEADERS="${srcdir}/IPP/include/*.h"
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
fi
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
# restore LDFLAGS to user set
LDFLAGS=${STORE_LDFLAGS}
CPPFLAGS=${STORE_CPPFLAGS}
], [fastRSA_found=no])
fi
# Don't cache the result so it can be checked
AS_UNSET([ac_cv_header_ippcp_h])
AS_UNSET([ac_cv_header_ipp_h])
AS_UNSET([ac_cv_lib_ippcp_ippsRSAEncrypt_PKCSv15]);
# Check link and see if user has pre-existing IPP Libraries if not using local
if test "$ENABLED_FAST_RSA" = "yes" && test "$fastRSA_found" = "no"; then
AC_MSG_NOTICE([Checking if IPP crypto library installed])
AC_CHECK_HEADER([ippcp.h], [AC_CHECK_LIB([ippcp], [ippsRSAEncrypt_PKCSv15],
[
fastRSA_found=yes
AM_LDFLAGS="${AM_LDFLAGS} -lippcore -lippcp"
], [ fastRSA_found=no])
], [fastRSA_found=no])
configure error out when not finding libraries with fast-rsa
2015-10-26 13:11:11 -06:00
# Error out on not finding libraries
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
if test "$fastRSA_found" = "no"; then
configure error out when not finding libraries with fast-rsa
2015-10-26 13:11:11 -06:00
AC_MSG_ERROR([Could not find fast rsa libraries])
fi
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
fi
fi # end of if for shared library
else # if user rsa is set than do not use fast rsa option
configure error out when not finding libraries with fast-rsa
2015-10-26 13:11:11 -06:00
if test "$ENABLED_FAST_RSA" = "yes"; then
AC_MSG_ERROR([Could not use fast rsa libraries with user crypto or fips])
fi
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
fi # end of if for user rsa crypto or fips
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
# End result of checking for IPP Libraries
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
AC_MSG_CHECKING([for fast RSA])
if test "$ENABLED_FAST_RSA" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DHAVE_FAST_RSA -DHAVE_USER_RSA"
# add in user crypto header that uses Intel IPP
AM_CPPFLAGS="$AM_CPPFLAGS -I$srcdir/wolfcrypt/user-crypto/include"
if test "$enable_shared" = "yes"; then
perfer local IPP libraries, memory usage and casting
2015-11-29 23:34:58 -07:00
LIBS="$LIBS -lippcore -lippcp"
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
LIB_ADD="-lippcp -lippcore $LIB_ADD"
else
LIB_ADD="$srcdir/IPP/$ipplib/libippcp.a $srcdir/IPP/$ipplib/libippcore.a $LIB_ADD"
fi
AC_MSG_RESULT([yes])
else
AC_MSG_RESULT([no])
fi
AC_SUBST([IPPLIBS])
AC_SUBST([IPPHEADERS])
AC_SUBST([IPPLINK])
add staticmemory feature
2016-03-23 10:21:26 -06:00
# static memory use
AC_ARG_ENABLE([staticmemory],
[AS_HELP_STRING([--enable-staticmemory],[Enable static memory use (default: disabled)])],
[ ENABLED_STATICMEMORY=$enableval ],
[ ENABLED_STATICMEMORY=no ]
)
if test "x$ENABLED_STATICMEMORY" = "xyes"
then
static method func / ocsp callbacks / heap test / alpn free func / remove timing resistant constraint
2016-06-09 11:36:31 -06:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY"
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
if test "x$ENABLED_HEAPMATH" = "xyes"
then
AC_MSG_ERROR([please use --enable-fastmath if enabling staticmemory.])
fi
Various improvements for testing Fix wc_ecc_fp_free() to be called when using HAVE_STACK_SIZE. Increase size of replyin client.c so all HTTP reply is displayed. Fix api.c to support only Ed25519 (not RSA and ECC) Fix suites.c to detect when CA for client won't work (Ed25519 only) For Static Memory add debugging and small profile. Also allow realloc to be called with NULL. Add more Ed25519 certs and keys. Fix names of Ed25519 filenames for client and server. Do NOT turn on ECC_SHAMIR by default with lowresource. Enable WOLFSSL_STATIC_MEMORY_SMALL if low resource and no RSA.
2019-02-22 17:14:19 +10:00
if test "$ENABLED_LOWRESOURCE" = "yes" && test "$ENABLED_RSA" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY_SMALL"
fi
add staticmemory feature
2016-03-23 10:21:26 -06:00
fi
add macpi huffman
2013-03-20 14:37:05 -07:00
# microchip api
AC_ARG_ENABLE([mcapi],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-mcapi],[Enable Microchip API (default: disabled)])],
add macpi huffman
2013-03-20 14:37:05 -07:00
[ ENABLED_MCAPI=$enableval ],
[ ENABLED_MCAPI=no ]
)
if test "$ENABLED_MCAPI" = "yes"
then
Adds an --enable-aesctr flag to the configure script to explicitly compile with -DWOLFSSL_AES_COUNTER and -DWOLFSSL_AES_DIRECT If --enable-fortress or --enable-mcapi are used they effectively force --enable-aesctr
2016-12-04 15:23:51 +01:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_MCAPI"
if test "x$ENABLED_AESCTR" != "xyes"
then
# These flags are already implied by --enable-aesctr
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER -DWOLFSSL_AES_DIRECT"
fi
AES-GCM: GMULT using 4-bit table When 64-bit data type available and not big endian code is faster. --enable-aesgcm=4bit
2020-10-14 14:08:06 +10:00
if test "x$ENABLED_AESGCM" != "xyes" && test "x$ENABLED_AESGCM" != "xno"
then
# Use the smaller object size implementation
ENABLED_AESGCM=yes
fi
add macpi huffman
2013-03-20 14:37:05 -07:00
fi
if test "$ENABLED_MCAPI" = "yes" && test "$ENABLED_SHA512" = "no"
then
AC_MSG_ERROR([please enable sha512 if enabling mcapi.])
fi
add mcapi ecc with tests
2013-03-21 13:20:23 -07:00
if test "$ENABLED_MCAPI" = "yes" && test "$ENABLED_ECC" = "no"
then
AC_MSG_ERROR([please enable ecc if enabling mcapi.])
fi
add macpi huffman
2013-03-20 14:37:05 -07:00
if test "$ENABLED_MCAPI" = "yes" && test "$ENABLED_LIBZ" = "no"
then
AC_MSG_ERROR([please use --with-libz if enabling mcapi.])
fi
Make --enable-asynccrypt-sw imply --enable-asynccrypt. Simplifies configuration.
2022-09-08 15:23:22 -07:00
# Asynchronous Crypto
AC_ARG_ENABLE([asynccrypt],
[AS_HELP_STRING([--enable-asynccrypt],[Enable Asynchronous Crypto (default: disabled)])],
[ ENABLED_ASYNCCRYPT=$enableval ],
[ ENABLED_ASYNCCRYPT=no ]
)
Migrate async names from "test" to "software." See async PR 52.
2022-08-30 14:28:09 -07:00
# Asynchronous crypto using software (i.e. not hardware). Required for
# non-blocking crypto with TLS/DTLS.
AC_ARG_ENABLE([asynccrypt-sw],
[AS_HELP_STRING([--enable-asynccrypt-sw],[Enable asynchronous software-based crypto (default: disabled)])],
[ ENABLED_ASYNCCRYPT_SW=$enableval ],
[ ENABLED_ASYNCCRYPT_SW=no ]
)
if test "$ENABLED_ASYNCCRYPT_SW" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASYNC_CRYPT_SW"
Make --enable-asynccrypt-sw imply --enable-asynccrypt. Simplifies configuration.
2022-09-08 15:23:22 -07:00
ENABLED_ASYNCCRYPT=yes
Migrate async names from "test" to "software." See async PR 52.
2022-08-30 14:28:09 -07:00
fi
add macpi huffman
2013-03-20 14:37:05 -07:00
Added "--enable-asynccrypt" option for enabling asynchronous crypto. This includes a refactor of SendServerKeyExchange and DoClientKeyExchange to support WC_PENDING_E on key generation, signing and verification. Currently uses async simulator (WOLFSSL_ASYNC_CRYPT_TEST) if cavium not enabled. All of the examples have been updated to support WC_PENDING_E on accept and connect. A generic WOLF_EVENT infrastructure has been added to support other types of future events and is enabled using "HAVE_WOLF_EVENT". Refactor the ASN OID type (ex: hashType/sigType) to use a more unique name. The real "async.c" and "async.h" files are in a private repo.
2016-03-04 10:05:22 -08:00
if test "$ENABLED_ASYNCCRYPT" = "yes"
then
Fix to disable the raw `Hmac_UpdateFinal_CT` HMAC calculation for async crypt. Resolves issue using `-v 2 -l ECDHE-RSA-AES128-SHA` with QAT.
2018-12-14 15:13:17 -08:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASYNC_CRYPT -DHAVE_WOLF_EVENT -DHAVE_WOLF_BIGINT -DWOLFSSL_NO_HASH_RAW"
Pulled in patches from Debian package.
2016-11-22 11:25:40 -08:00
Migrate async names from "test" to "software." See async PR 52.
2022-08-30 14:28:09 -07:00
# If no async backend (hardware or software) has been explicitly enabled,
# use the software backend for testing.
if test "x$ENABLED_CAVIUM" = "xno" && test "x$ENABLED_INTEL_QA" = "xno" &&
test "x$ENABLED_ASYNCCRYPT_SW" = "xno"
Added "--enable-asynccrypt" option for enabling asynchronous crypto. This includes a refactor of SendServerKeyExchange and DoClientKeyExchange to support WC_PENDING_E on key generation, signing and verification. Currently uses async simulator (WOLFSSL_ASYNC_CRYPT_TEST) if cavium not enabled. All of the examples have been updated to support WC_PENDING_E on accept and connect. A generic WOLF_EVENT infrastructure has been added to support other types of future events and is enabled using "HAVE_WOLF_EVENT". Refactor the ASN OID type (ex: hashType/sigType) to use a more unique name. The real "async.c" and "async.h" files are in a private repo.
2016-03-04 10:05:22 -08:00
then
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
# Async threading is Linux specific
Migrate async names from "test" to "software." See async PR 52.
2022-08-30 14:28:09 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASYNC_CRYPT_SW"
Added "--enable-asynccrypt" option for enabling asynchronous crypto. This includes a refactor of SendServerKeyExchange and DoClientKeyExchange to support WC_PENDING_E on key generation, signing and verification. Currently uses async simulator (WOLFSSL_ASYNC_CRYPT_TEST) if cavium not enabled. All of the examples have been updated to support WC_PENDING_E on accept and connect. A generic WOLF_EVENT infrastructure has been added to support other types of future events and is enabled using "HAVE_WOLF_EVENT". Refactor the ASN OID type (ex: hashType/sigType) to use a more unique name. The real "async.c" and "async.h" files are in a private repo.
2016-03-04 10:05:22 -08:00
fi
fi
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
# check for async if using Intel QuckAssist or Cavium
if test "x$ENABLED_INTEL_QA" = "xyes" || test "x$ENABLED_CAVIUM" = "xyes" ; then
if test "x$ENABLED_ASYNCCRYPT" = "xno" ; then
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AC_MSG_ERROR([Please enable asynchronous support using --enable-asynccrypt])
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
fi
fi
# Asynchronous threading
AC_ARG_ENABLE([asyncthreads],
Refactor of the ./configure help to use AS_HELP_STRING.
2017-05-19 10:54:13 -07:00
[AS_HELP_STRING([--enable-asyncthreads],[Enable Asynchronous Threading (default: enabled)])],
Intel QuickAssist (QAT) support and async enhancements/fixes: * Adds ./configure "--with-intelqa=../QAT1.6”, port files, memory management and README.md (see wolfcrypt/src/port/intel/). * Added Intel QAT support for RSA public/private (CRT/non-CRT), AES CBC/GCM, ECDH/ECDSA, DH, DES3, SHA, SHA224, SHA256, SHA384, SHA512, MD5 and HMAC. * wolfSSL async enabled all client and server: PKI, Encrypt/Decrypt, Hashing/HMAC and Certificate Sign/Verify. * wolfSSL async support in functions: Encrypt, Decrypt, VerifyMAC, BuildMessage, ConfirmSignature, DoCertificate, ParseCertRelative, and MakeSignature. * wolfCrypt test and benchmark async support added for all HW acceleration. * wolfCrypt benchmark multi-threading support. * Added QuickAssist memory overrides for XMALLOC, XFREE and XREALLOC. XREALLOC determines if existing pointer needs reallocated for NUMA. * Refactor to make sure “heap” is available for async dev init. * Added async support for all examples for connect, accept, read and write. * Added new WC_BIGINT (in wolfmath.c) for async hardware support. * Added async simulator tests for DES3 CBC, AES CBC/GCM. * Added QAT standalone build for unit testing. * Added int return code to SHA and MD5 functions. * Refactor of the async stack variable handling, so async operations have generic args buffer area and cleanup function pointer. * Combined duplicate code for async push/pop handling. * Refactor internal.c to add AllocKey / FreeKey. * Refactor of hash init/free in TLS to use InitHashes and FreeHashes. * Refactor of the async event->context to use WOLF_EVENT_TYPE_ASYNC_WOLFSSL for WOLFSSL* and WOLF_EVENT_TYPE_ASYNC_WOLFCRYPT for WC_ASYNC_DEV*. * Suppress error message for WC_PENDING_E. * Implemented "wolfSSL_EVP_MD_CTX_init" to do memset. * Cleanup of the openssl compat CTX sizes when async is enabled. * Cleanup of AES, DES3, DH, SHA, MD5, DES3, DH, HMAC, MD5 for consistency and readability. * Cleanup of the OPAQUE_LEN. * Cleanup to use ENCRYPT_LEN instead of sizeof(ssl->arrays.preMasterSecret). * Changed ssl->arrays.preMasterSecret to use XMALLOC (accelerates HW operations) * Reduce verbosity with debug enabled for "GetMyVersion", "wolfSSL Using RSA OAEP padding" and "wolfSSL Using RSA PKCSV15 padding". * Updated RSA un-padding error message so its different than one above it for better debugging. * Added QAT async enables for each algorithm. * Refactor of the async init to use _ex. * Added WC_ASYNC_THRESH_NONE to allow bypass of the async thresholds for testing. * Reformatted the benchmark results: PKI: "RSA 2048 private HW 18522 ops took 1.003 sec, avg 0.054 ms, 18467.763 ops/sec" Crypto/Hashing: SHA-256 SW 350 megs took 1.009 seconds, 346.946 MB/s Cycles per byte = 9.87 * Added min execution time for all benchmarks. * Moved wc_*GetHash and wc_*RestorePos to appropriate files so use of isCopy flag is local. * Fix for ECC sign status sometimes being invalid due to uninitialized ECC digest in benchmark. * Added new DECLARE_VAR/FREE_VAR and DECLARE_ARRAY/FREE_ARRAY macros for helping setup test/benchmark variables to accelerate async. * Added NO_SW_BENCH option to only run HW bench. * Added support for PRNG to use hardware SHA256 if _wc devId provided. * Fix to prevent curve tests from running against wrong curve sizes. Changed wc_ecc_set_curve to match on exact size. * Added the wc_*GetHash calls to the wolfCrypt tests. * Added async hardware start/stop to wolfSSL init/cleanup. * Refactor to add wc_*Copy for hashing context (for async), which replaces wc_*RestorePos. * Fixes for building with TI hashing (including: SHA224, missing new API’s and building with dummy build for non hw testing). Note: We need to add build test for this `./configure CFLAGS="-DWOLFSSL_TI_HASH -DTI_DUMMY_BUILD”`. * Added arg checks on wc_*GetHash and wc_*Copy. * Cleanup of the BuildMD5, BuildSHA, BuildMD5_CertVerify and BuildSHA_CertVerify functions. * Added new ./configure --enable-asyncthreads, to allow enable/disable of the async threading support. If --enable-asynccrypt set this will be enabled by default if pthread is supported. Allows multi-threaded benchmarks with async simulator. * Added checks for all hashing to verify valid ->buffLen. * Fix for SHA512 scan-build warning about un-initialized “W_X”. * Fix for valgrind un-initialized use of buffer in AllocDer (der->buffer) and BuildTlsFinished handshake_hash. * Refactor of the benchmarking to use common function for start, check and finish of the stats. * Fixed issue with ECC cache loading in multi-threading. * Fix bug with AESNI not aligned code that assumes XMALLOC is 16-byte aligned. * Added new WC_ASYNC_NO_… options to allow disabling of individual async algorithms. New defines are: WC_ASYNC_NO_CRYPT, WC_ASYNC_NO_PKI and WC_ASYNC_NO_HASH. Additionally each algorithm has a WC_ASYNC_NO_[ALGO] define. * Added “wolfSSL_GetAllocators” API and fixed the wolfCrypt memcb_test so it restores callback pointers after test is complete (fixes issue with using custom allocators and test breaking it).
2017-04-07 15:46:32 -07:00
[ ENABLED_ASYNCTHREADS=$enableval ],
[ ENABLED_ASYNCTHREADS=yes ]
)
if test "$ENABLED_ASYNCCRYPT" = "yes" && test "$ENABLED_ASYNCTHREADS" = "yes"
then
AX_PTHREAD([ENABLED_ASYNCTHREADS=yes],[ENABLED_ASYNCTHREADS=no])
else
ENABLED_ASYNCTHREADS=no
fi
if test "$ENABLED_ASYNCTHREADS" = "yes"
then
LIB_ADD="-lpthread $LIB_ADD"
AM_CFLAGS="$AM_CFLAGS -D_GNU_SOURCE"
else
AM_CFLAGS="$AM_CFLAGS -DWC_NO_ASYNC_THREADING"
fi
Added asynchronous wolfCrypt RSA, TLS client and Cavium Nitrox V support. Asynchronous wolfSSL client support for "DoServerKeyExchange", "SendClientKeyExchange", "SendCertificateVerify" and "DoCertificateVerify". Fixes for async DTLS. Refactor of the wolf event and async handling for use in wolfCrypt. Refactor of the async device support so its hardware agnostic. Added Cavium Nitrox V support (Nitrox tested using SDK v0.2 CNN55XX-SDK with new configure "--with-cavium-v=/dir" option). Moved Nitrox specific functions to new port file "port/cavium/cavium_nitrox.c". RSA refactor to handle async with states. RSA optimization for using dpraw for private key decode. Use double linked list in wolf event for faster/cleaner code. Use typedef for wolf event flag. Cleanup of the async error codes. wolfCrypt test and benchmark support for async RSA. Asynchronous mode enabled using "./configure --enable-asynccrypt". If no async hardware is defined then the internal async simulator (WOLFSSL_ASYNC_CRYPT_TEST) is used. Note: Using async mode requires async.c/h files from wolfSSL. If interested in using asynchronous mode please send email to info@wolfssl.com.
2016-08-15 13:59:41 -06:00
Added "--enable-asynccrypt" option for enabling asynchronous crypto. This includes a refactor of SendServerKeyExchange and DoClientKeyExchange to support WC_PENDING_E on key generation, signing and verification. Currently uses async simulator (WOLFSSL_ASYNC_CRYPT_TEST) if cavium not enabled. All of the examples have been updated to support WC_PENDING_E on accept and connect. A generic WOLF_EVENT infrastructure has been added to support other types of future events and is enabled using "HAVE_WOLF_EVENT". Refactor the ASN OID type (ex: hashType/sigType) to use a more unique name. The real "async.c" and "async.h" files are in a private repo.
2016-03-04 10:05:22 -08:00
Release Fixes 1. Rearrange the deprecation cryptodev option so it doesn't overwrite the cryptocb option, and so it doesn't break its case in the build-test. 2. Fix the content length in the sample HTTP used by the example server. 3. Disable OCSP stapling in the example server if RSA is disabled. 4. Fix a variable in asn.c that was declared in the middle of its scope. 5. Retag the xmalloc, xrealloc, xfree functions used in the memory test as WOLFSSL_API like all the other allocators, instead of extern.
2019-03-20 11:01:24 -07:00
# cryptodev is old name, replaced with cryptocb
AC_ARG_ENABLE([cryptodev],
[AS_HELP_STRING([--enable-cryptodev],[DEPRECATED, use cryptocb instead])],
[ ENABLED_CRYPTOCB=$enableval ],[ ENABLED_CRYPTOCB=no ])
Refactor and rename of cryptodev to cryptocb. Refactor API names from `wc_CryptoDev` to use `wc_CryptoCb`. Backwards compatibility is retained for anyone using old `WOLF_CRYPTO_DEV` name. Added comment about fall-through case when CryptoCb return `NOT_COMPILED_IN`.
2019-01-17 11:01:14 -08:00
# Support for crypto callbacks
AC_ARG_ENABLE([cryptocb],
[AS_HELP_STRING([--enable-cryptocb],[Enable crypto callbacks (default: disabled)])],
[ ENABLED_CRYPTOCB=$enableval ],
[ ENABLED_CRYPTOCB=no ]
Added crypto device framework to handle PK RSA/ECC operations using callbacks. Adds new build option `./configure --enable-cryptodev` or `#define WOLF_CRYPTO_DEV`. Added devId support to PKCS7.
2018-05-21 13:03:49 -07:00
)
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
if test "x$ENABLED_PKCS11" = "xyes" || test "x$ENABLED_WOLFTPM" = "xyes" || test "$ENABLED_CAAM" = "qnx" || test "$ENABLED_CAAM" = "seco"
Support for PKCS#11 Support for RSA, ECDSA and AES-GCM operations.
2018-09-12 08:56:59 +10:00
then
Refactor and rename of cryptodev to cryptocb. Refactor API names from `wc_CryptoDev` to use `wc_CryptoCb`. Backwards compatibility is retained for anyone using old `WOLF_CRYPTO_DEV` name. Added comment about fall-through case when CryptoCb return `NOT_COMPILED_IN`.
2019-01-17 11:01:14 -08:00
ENABLED_CRYPTOCB=yes
Support for PKCS#11 Support for RSA, ECDSA and AES-GCM operations.
2018-09-12 08:56:59 +10:00
fi
Refactor and rename of cryptodev to cryptocb. Refactor API names from `wc_CryptoDev` to use `wc_CryptoCb`. Backwards compatibility is retained for anyone using old `WOLF_CRYPTO_DEV` name. Added comment about fall-through case when CryptoCb return `NOT_COMPILED_IN`.
2019-01-17 11:01:14 -08:00
if test "$ENABLED_CRYPTOCB" = "yes"
Added crypto device framework to handle PK RSA/ECC operations using callbacks. Adds new build option `./configure --enable-cryptodev` or `#define WOLF_CRYPTO_DEV`. Added devId support to PKCS7.
2018-05-21 13:03:49 -07:00
then
Refactor and rename of cryptodev to cryptocb. Refactor API names from `wc_CryptoDev` to use `wc_CryptoCb`. Backwards compatibility is retained for anyone using old `WOLF_CRYPTO_DEV` name. Added comment about fall-through case when CryptoCb return `NOT_COMPILED_IN`.
2019-01-17 11:01:14 -08:00
AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB"
Added crypto device framework to handle PK RSA/ECC operations using callbacks. Adds new build option `./configure --enable-cryptodev` or `#define WOLF_CRYPTO_DEV`. Added devId support to PKCS7.
2018-05-21 13:03:49 -07:00
fi
add DTLS session export option
2016-05-10 13:27:45 -06:00
# Session Export
AC_ARG_ENABLE([sessionexport],
[AS_HELP_STRING([--enable-sessionexport],[Enable export and import of sessions (default: disabled)])],
[ ENABLED_SESSIONEXPORT=$enableval ],
[ ENABLED_SESSIONEXPORT=no ]
)
reduce size of state only save and add option to remove peer info
2019-07-26 14:54:44 -06:00
if test "$ENABLED_SESSIONEXPORT" = "yes" ||
test "$ENABLED_SESSIONEXPORT" = "nopeer"
add DTLS session export option
2016-05-10 13:27:45 -06:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SESSION_EXPORT"
reduce size of state only save and add option to remove peer info
2019-07-26 14:54:44 -06:00
if test "$ENABLED_SESSIONEXPORT" = "nopeer"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SESSION_EXPORT_NOPEER"
fi
add DTLS session export option
2016-05-10 13:27:45 -06:00
fi
add AES key wrap support, RFC 3394
2016-12-05 15:38:42 -07:00
# AES key wrap
AC_ARG_ENABLE([aeskeywrap],
[AS_HELP_STRING([--enable-aeskeywrap],[Enable AES key wrap support (default: disabled)])],
[ ENABLED_AESKEYWRAP=$enableval ],
[ ENABLED_AESKEYWRAP=no ]
)
Fixes for building `--enable-wpas=small` with WPA Supplicant v2.7.
2020-09-16 15:41:20 -07:00
if test "$ENABLED_WPAS" != "no" && test "$ENABLED_FIPS" = "no"
Changes for WPA Supplicant
2017-02-10 08:45:10 +10:00
then
ENABLED_AESKEYWRAP="yes"
fi
add AES key wrap support, RFC 3394
2016-12-05 15:38:42 -07:00
if test "$ENABLED_AESKEYWRAP" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_KEYWRAP -DWOLFSSL_AES_DIRECT"
fi
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
# Old name support for backwards compatibility
AC_ARG_ENABLE([oldnames],
[AS_HELP_STRING([--enable-oldnames],[Keep backwards compat with old names (default: enabled)])],
[ ENABLED_OLDNAMES=$enableval ],
[ ENABLED_OLDNAMES=yes ]
)
if test "x$ENABLED_OLDNAMES" = "xno" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
AM_CFLAGS="$AM_CFLAGS -DNO_OLD_RNGNAME -DNO_OLD_WC_NAMES -DNO_OLD_SSL_NAMES"
addressed jenkins failure part1
2021-02-18 09:56:37 +09:00
AM_CFLAGS="$AM_CFLAGS -DNO_OLD_SHA_NAMES -DNO_OLD_MD5_NAME"
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
fi
Added new build option `--enable-memtest` or `WOLFSSL_FORCE_MALLOC_FAIL_TEST` which enables random malloc failures for testing. This test supresses the `abort()` calls to detect seg faults. A new script `./scripts/memtest.sh` starts the test. If an issue is found it can be reviewed with the `./scripts/memtest.txt` log and reproduced using the seed printed at top of unit test as `--- RNG MALLOC FAIL AT 295---` and rerun using `./tests/unit.test 295`.
2018-07-27 10:16:14 -07:00
# Memory Tests
AC_ARG_ENABLE([memtest],
[AS_HELP_STRING([--enable-memtest],[Memory testing option, for internal use (default: disabled)])],
[ ENABLED_MEMTEST=$enableval ],
[ ENABLED_MEMTEST=no ]
)
if test "x$ENABLED_MEMTEST" != "xno"
then
make: `--enable-memtest` track and `--enable-memtest=fail` to force failure
2021-06-17 10:45:39 -07:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TRACK_MEMORY -DWOLFSSL_DEBUG_MEMORY"
Added new build option `--enable-memtest` or `WOLFSSL_FORCE_MALLOC_FAIL_TEST` which enables random malloc failures for testing. This test supresses the `abort()` calls to detect seg faults. A new script `./scripts/memtest.sh` starts the test. If an issue is found it can be reviewed with the `./scripts/memtest.txt` log and reproduced using the seed printed at top of unit test as `--- RNG MALLOC FAIL AT 295---` and rerun using `./tests/unit.test 295`.
2018-07-27 10:16:14 -07:00
fi
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
if test "x$ENABLED_MEMTEST" = "xfail"
make: `--enable-memtest` track and `--enable-memtest=fail` to force failure
2021-06-17 10:45:39 -07:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FORCE_MALLOC_FAIL_TEST"
fi
Added new build option `--enable-memtest` or `WOLFSSL_FORCE_MALLOC_FAIL_TEST` which enables random malloc failures for testing. This test supresses the `abort()` calls to detect seg faults. A new script `./scripts/memtest.sh` starts the test. If an issue is found it can be reviewed with the `./scripts/memtest.txt` log and reproduced using the seed printed at top of unit test as `--- RNG MALLOC FAIL AT 295---` and rerun using `./tests/unit.test 295`.
2018-07-27 10:16:14 -07:00
Added `--enable-hashflags` option.
2019-08-27 13:28:33 -07:00
# Enable hash flags support
# Hash flags are useful for runtime options such as SHA3 KECCAK256 selection
AC_ARG_ENABLE([hashflags],
[AS_HELP_STRING([--enable-hashflags],[Enable support for hash flags (default: disabled)])],
[ ENABLED_HASHFLAGS=$enableval ],
[ ENABLED_HASHFLAGS=no ]
)
if test "x$ENABLED_HASHFLAGS" != "xno"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HASH_FLAGS"
fi
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
# Support for enabling setting default DH parameters in
AC_ARG_ENABLE([defaultdhparams],
[AS_HELP_STRING([--enable-dhdefaultparams],[Enables option for default dh parameters (default: disabled)])],
[ ENABLED_DHDEFAULTPARAMS=$enableval ],
[ ENABLED_DHDEFAULTPARAMS=no ]
)
if test "$ENABLED_DHDEFAULTPARAMS" = "yes" || test "$ENABLED_QT" = "no"
then
ENABLED_DHDEFAULTPARAMS=yes
AM_CFLAGS="$AM_CFLAGS -DHAVE_DH_DEFAULT_PARAMS"
fi
Added `--enable-hashflags` option.
2019-08-27 13:28:33 -07:00
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
AC_ARG_WITH([max-rsa-bits],
[AS_HELP_STRING([--with-max-rsa-bits=number],[number of bits to support for RSA, DH, and DSA keys])],
[WITH_MAX_CLASSIC_ASYM_KEY_BITS=$withval],
[WITH_MAX_CLASSIC_ASYM_KEY_BITS="$DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS"])
if test -n "$WITH_MAX_CLASSIC_ASYM_KEY_BITS"; then
if test "$WITH_MAX_CLASSIC_ASYM_KEY_BITS" -lt 1024 -o "$WITH_MAX_CLASSIC_ASYM_KEY_BITS" -gt 16384; then
AC_MSG_ERROR([--with-max-rsa-bits argument must be between 1024 and 16384 inclusive])
fi
configure.ac: fix handling of ENABLED_FIPS->REPRODUCIBLE_BUILD_DEFAULT=yes; take JNI back out of from enable-all feature set because it adds -DNO_ERROR_QUEUE to flags; fix typo in FIPS test for --with-max-rsa-bits setup.
2021-10-07 22:33:12 -05:00
if test "$ENABLED_FIPS" = "no"
configure.ac: fips tweaks: add --enable-fips=disabled to allow non-fips build in a fips tree, for convenient testing; add ENABLED_SHAKE256=no override to fipsv5 setup; don't add an RSA_MAX_SIZE setting to AM_CFLAGS when FIPS, to avoid a conflict with old rsa.h.
2021-09-24 17:29:00 -05:00
then
AM_CFLAGS="$AM_CFLAGS -DRSA_MAX_SIZE=$WITH_MAX_CLASSIC_ASYM_KEY_BITS"
fi
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
MPI_MAX_KEY_BITS=$WITH_MAX_CLASSIC_ASYM_KEY_BITS
fi
AC_ARG_WITH([max-ecc-bits],
[AS_HELP_STRING([--with-max-ecc-bits=number],[number of bits to support for ECC algorithms])],
[WITH_MAX_ECC_BITS=$withval],
[WITH_MAX_ECC_BITS="$DEFAULT_MAX_ECC_BITS"])
if test -n "$WITH_MAX_ECC_BITS"; then
if test "$WITH_MAX_ECC_BITS" -lt 112 -o "$WITH_MAX_ECC_BITS" -gt 1024; then
AC_MSG_ERROR([--with-max-ecc-bits argument must be between 112 and 1024 inclusive])
fi
AM_CFLAGS="$AM_CFLAGS -DMAX_ECC_BITS=$WITH_MAX_ECC_BITS"
fi
if test -n "$MPI_MAX_KEY_BITS" -o -n "$WITH_MAX_ECC_BITS"; then
if test -n "$MAX_MPI_KEY_BITS" -a -n "$WITH_MAX_ECC_BITS"; then
if test -n "$MAX_MPI_KEY_BITS" -lt "$WITH_MAX_ECC_BITS"; then
MPI_MAX_KEY_BITS="$WITH_MAX_ECC_BITS"
fi
elif test -n "$WITH_MAX_ECC_BITS"; then
MPI_MAX_KEY_BITS="$WITH_MAX_ECC_BITS"
fi
if test "$MPI_MAX_KEY_BITS" -gt 1024; then
AM_CFLAGS="$AM_CFLAGS -DFP_MAX_BITS=$((MPI_MAX_KEY_BITS * 2)) -DSP_INT_BITS=$MPI_MAX_KEY_BITS"
fi
fi
AC_ARG_ENABLE([context-extra-user-data],
[AS_HELP_STRING([--enable-context-extra-user-data],[Enables option for storing user-defined data in TLS API contexts, with optional argument the number of slots to allocate (default: disabled)])],
[ ENABLED_EX_DATA=$enableval ],
[ ENABLED_EX_DATA=no ]
)
case "$ENABLED_EX_DATA" in
no) ;;
yes) AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA"
;;
[[1-9]]|[[1-9]][[0-9]]) AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA -DMAX_EX_DATA=$ENABLED_EX_DATA"
;;
*) AC_MSG_ERROR([Invalid argument to --enable-context-extra-user-data -- must be yes, no, or a number from 1 to 99])
;;
esac
Support for IoT-Safe with TLS demo
2021-07-26 19:38:46 +02:00
# IoT-Safe support
AC_ARG_ENABLE([iotsafe],
[AS_HELP_STRING([--enable-iotsafe],[Enables support for IoT-Safe secure applet (default: disabled)])],
[ ENABLED_IOTSAFE=$enableval ],
[ ENABLED_IOTSAFE=no ]
)
AC_ARG_ENABLE([iotsafe-hwrng],
[AS_HELP_STRING([--enable-iotsafe-hwrng],[Enables support for IoT-Safe RNG (default: disabled)])],
[ ENABLED_IOTSAFE_HWRNG=$enableval ],
[ ENABLED_IOTSAFE_HWRNG=no ]
)
configure.ac: add --with-max-rsa-bits, --with-max-ecc-bits, and --enable-context-extra-user-data[=#]; untabify and otherwise clean up whitespace; tweak api.c, ecc.h, rsa.h, and settings.h, for compatibility with new options.
2021-07-23 22:00:26 -05:00
Allow disabling forced 'make clean' at the end of ./configure.
2022-03-02 13:20:22 -07:00
# Make clean
AC_ARG_ENABLE([makeclean],
[AS_HELP_STRING([--enable-makeclean], [Enables forced "make clean" at the
end of configure (default: enabled)])],
[ ENABLED_MAKECLEAN=$enableval ],
[ ENABLED_MAKECLEAN=yes ]
)
Fixes for know wolfSSL build issues in the following cases: * Fixes for building wolfSSL from GitHub sources download, where .git does exist. The autogen.sh still needs to "touch" files for the build to work. * Fix for FIPS case where `wc_RsaSetRNG` is not available. * Added new `./configure --enable-usersettings` option to not populate the Makefile with build options and instead define `WOLFSSL_USER_SETTINGS` and expect a user provided `user_settings.h` file. * Fix for `HAVE___UINT128_T` to match config.h generated value to eliminate warning.
2019-04-30 11:45:48 -07:00
# User Settings
AC_ARG_ENABLE([usersettings],
[AS_HELP_STRING([--enable-usersettings],[Use your own user_settings.h and do not add Makefile CFLAGS (default: disabled)])],
[ ENABLED_USERSETTINGS=$enableval ],
[ ENABLED_USERSETTINGS=no ]
)
Configure Update Revise default compiler optimization flags enable name to something more descriptive.
2018-03-28 13:17:25 -07:00
# Default optimization CFLAGS enable
AC_ARG_ENABLE([optflags],
[AS_HELP_STRING([--enable-optflags],[Enable default optimization CFLAGS for the compiler (default: enabled)])],
[ ENABLED_OPTFLAGS=$enableval ],
[ ENABLED_OPTFLAGS=yes ]
Configure Update Add a disable option to turn off the default optimization options so the user may set their own in a CFLAGS.
2018-03-27 16:41:39 -07:00
)
Add ability to toggle system CA certs support.
2022-10-07 11:19:34 -07:00
# Adds functionality to load CA certificates from the operating system.
AC_ARG_ENABLE([sys-ca-certs],
[AS_HELP_STRING([--enable-sys-ca-certs],[Enable ability to load CA certs from OS (default: enabled)])],
[ ENABLED_SYS_CA_CERTS=$enableval ],
[ ENABLED_SYS_CA_CERTS=yes ]
)
Configure Update Add a disable option to turn off the default optimization options so the user may set their own in a CFLAGS.
2018-03-27 16:41:39 -07:00
automated test for trusted peer certs
2016-03-01 16:35:32 -07:00
# check if should run the trusted peer certs test
update test script, fall back to cert name search, fix der free
2016-03-12 09:37:32 -07:00
# (for now checking both C_FLAGS and C_EXTRA_FLAGS)
Deprecate some configure flags 1. Add C_EXTRA_FLAGS and C_FLAGS to CFLAGS. 2. Remove the cached copied of C_EXTRA_FLAGS and C_FLAGS. 3. The option.h is set only on CFLAGS, CPPFLAGS, and the AM_ versions.
2020-01-22 14:26:16 -08:00
AS_CASE(["$CFLAGS $CPPFLAGS"],[*'WOLFSSL_TRUST_PEER_CERT'*],[ENABLED_TRUSTED_PEER_CERT=yes])
automated test for trusted peer certs
2016-03-01 16:35:32 -07:00
stunnel 5.61 support - New/Implemented API - `SSL_has_pending` - `wolfSSL_CertManagerLoadCRLFile` - `wolfSSL_LoadCRLFile` - `wolfSSL_CTX_LoadCRLFile` - `wolfSSL_CTX_add_session` - Calling chain certificate API (for example `wolfSSL_CTX_use_certificate_chain_file`) no longer requires an actual chain certificate PEM file to be passed in as input. `ProcessUserChain` error in `ProcessBuffer` is ignored if it returns that it didn't find a chain. - Add `WOLFSSL_TICKET_HAVE_ID` macro. When defined tickets will include the original session ID that can be used to lookup the session in internal cache. This is useful for fetching information about the peer that doesn't get sent in a resumption (such as the peer's certificate chain). - Add `ssl->ticketSessionID` field because `ssl->session.sessionID` is used to return the "bogus" session ID sent by the client in TLS 1.3 - `OPENSSL_COMPATIBLE_DEFAULTS` changes - Define `WOLFSSL_TRUST_PEER_CERT` and certificates added as CA's will also be loaded as trusted peer certificates - Define `WOLFSSL_TLS13_MIDDLEBOX_COMPAT` - Seperate `internalCacheOff` and `internalCacheLookupOff` options to govern session addition and lookup - `VerifyServerSuite` now determines if RSA is available by checking for it directly and not assuming it as the default if static ECC is not available - `WOLFSSL_SESSION` changes - `ssl->extSession` added to return a dynamic session when internalCacheOff is set - `ssl->session.refPtr` made dynamic and gets free'd in `SSL_ResourceFree` - If `SSL_MODE_AUTO_RETRY` is set then retry should only occur during a handshake - `WOLFSSL_TRUST_PEER_CERT` code now always uses `cert->subjectHash` for the `cm->tpTable` table row selection - Change some error message names to line up with OpenSSL equivalents - Run `MatchSuite` again if certificate setup callback installed and successful - Refactor clearing `ASN_NO_PEM_HEADER` off the error queue into a macro - `wolfSSL_get_peer_certificate` now returns a duplicated object meaning that the caller needs to free the returned object - Allign `wolfSSL_CRYPTO_set_mem_functions` callbacks with OpenSSL API - `wolfSSL_d2i_PKCS12_bio` now consumes the input BIO. It now supports all supported BIO's instead of only memory BIO. - stunnel specific - Always return a session object even if we don't have a session in cache. This allows stunnel to save information in the session external data that will be transfered to new connections if the session is reused - When allocating a dynamic session, always do `wolfSSL_SESSION_set_ex_data(session, 0, (void *)(-1)`. This is to mimic the new index callback set in `SSL_SESSION_get_ex_new_index`. - Fix comment in `wolfSSL_AES_cbc_encrypt` - Trusted peer certificate suite tests need to have CRL disabled since we don't have the issuer certificate in the CA store if the certificates are only added as trusted peer certificates. tested
2022-01-28 14:40:45 +01:00
AS_CASE(["$CFLAGS $CPPFLAGS $AM_CFLAGS"],[*'OPENSSL_COMPATIBLE_DEFAULTS'*],
Fixes for multi-test pass. Breaks from PR #4807.
2022-02-24 11:48:40 -08:00
[ENABLED_OPENSSL_COMPATIBLE_DEFAULTS=yes])
stunnel 5.61 support - New/Implemented API - `SSL_has_pending` - `wolfSSL_CertManagerLoadCRLFile` - `wolfSSL_LoadCRLFile` - `wolfSSL_CTX_LoadCRLFile` - `wolfSSL_CTX_add_session` - Calling chain certificate API (for example `wolfSSL_CTX_use_certificate_chain_file`) no longer requires an actual chain certificate PEM file to be passed in as input. `ProcessUserChain` error in `ProcessBuffer` is ignored if it returns that it didn't find a chain. - Add `WOLFSSL_TICKET_HAVE_ID` macro. When defined tickets will include the original session ID that can be used to lookup the session in internal cache. This is useful for fetching information about the peer that doesn't get sent in a resumption (such as the peer's certificate chain). - Add `ssl->ticketSessionID` field because `ssl->session.sessionID` is used to return the "bogus" session ID sent by the client in TLS 1.3 - `OPENSSL_COMPATIBLE_DEFAULTS` changes - Define `WOLFSSL_TRUST_PEER_CERT` and certificates added as CA's will also be loaded as trusted peer certificates - Define `WOLFSSL_TLS13_MIDDLEBOX_COMPAT` - Seperate `internalCacheOff` and `internalCacheLookupOff` options to govern session addition and lookup - `VerifyServerSuite` now determines if RSA is available by checking for it directly and not assuming it as the default if static ECC is not available - `WOLFSSL_SESSION` changes - `ssl->extSession` added to return a dynamic session when internalCacheOff is set - `ssl->session.refPtr` made dynamic and gets free'd in `SSL_ResourceFree` - If `SSL_MODE_AUTO_RETRY` is set then retry should only occur during a handshake - `WOLFSSL_TRUST_PEER_CERT` code now always uses `cert->subjectHash` for the `cm->tpTable` table row selection - Change some error message names to line up with OpenSSL equivalents - Run `MatchSuite` again if certificate setup callback installed and successful - Refactor clearing `ASN_NO_PEM_HEADER` off the error queue into a macro - `wolfSSL_get_peer_certificate` now returns a duplicated object meaning that the caller needs to free the returned object - Allign `wolfSSL_CRYPTO_set_mem_functions` callbacks with OpenSSL API - `wolfSSL_d2i_PKCS12_bio` now consumes the input BIO. It now supports all supported BIO's instead of only memory BIO. - stunnel specific - Always return a session object even if we don't have a session in cache. This allows stunnel to save information in the session external data that will be transfered to new connections if the session is reused - When allocating a dynamic session, always do `wolfSSL_SESSION_set_ex_data(session, 0, (void *)(-1)`. This is to mimic the new index callback set in `SSL_SESSION_get_ex_new_index`. - Fix comment in `wolfSSL_AES_cbc_encrypt` - Trusted peer certificate suite tests need to have CRL disabled since we don't have the issuer certificate in the CA store if the certificates are only added as trusted peer certificates. tested
2022-01-28 14:40:45 +01:00
if test "x$ENABLED_OPENSSL_COMPATIBLE_DEFAULTS" = "xyes"
then
Fix misc memory issues - Make `InternalTicket` memory alignment independent
2022-02-14 19:13:08 +01:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TRUST_PEER_CERT"
Add backwards compatibility for `wolfSSL_get_session` Before this pull request, `wolfSSL_get_session` always returned a pointer to the internal session cache. The user can't tell if the underlying session hasn't changed before it calls `wolfSSL_set_session` on it. This PR adds a define `NO_SESSION_CACHE_REF` (for now only defined with `OPENSSL_COMPATIBLE_DEFAULTS`) that makes wolfSSL only return a pointer to `ssl->session`. The issue is that this makes the pointer returned non-persistent ie: it gets free'd with the `WOLFSSL` object. This commit leverages the lightweight `ClientCache` to "increase" the size of the session cache. The hash of the session ID is checked to make sure that the underlying session hasn't changed.
2022-02-11 19:05:12 +01:00
AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE_REF"
Peeking can't return a `WOLFSSL_ERROR_WANT_READ` in compatibility mode
2022-02-17 15:08:08 +01:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TLS13_NO_PEEK_HANDSHAKE_DONE"
veify ok if alternate cert chain mode for verifyCallback
2022-04-20 17:42:46 +09:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALT_CERT_CHAINS"
stunnel 5.61 support - New/Implemented API - `SSL_has_pending` - `wolfSSL_CertManagerLoadCRLFile` - `wolfSSL_LoadCRLFile` - `wolfSSL_CTX_LoadCRLFile` - `wolfSSL_CTX_add_session` - Calling chain certificate API (for example `wolfSSL_CTX_use_certificate_chain_file`) no longer requires an actual chain certificate PEM file to be passed in as input. `ProcessUserChain` error in `ProcessBuffer` is ignored if it returns that it didn't find a chain. - Add `WOLFSSL_TICKET_HAVE_ID` macro. When defined tickets will include the original session ID that can be used to lookup the session in internal cache. This is useful for fetching information about the peer that doesn't get sent in a resumption (such as the peer's certificate chain). - Add `ssl->ticketSessionID` field because `ssl->session.sessionID` is used to return the "bogus" session ID sent by the client in TLS 1.3 - `OPENSSL_COMPATIBLE_DEFAULTS` changes - Define `WOLFSSL_TRUST_PEER_CERT` and certificates added as CA's will also be loaded as trusted peer certificates - Define `WOLFSSL_TLS13_MIDDLEBOX_COMPAT` - Seperate `internalCacheOff` and `internalCacheLookupOff` options to govern session addition and lookup - `VerifyServerSuite` now determines if RSA is available by checking for it directly and not assuming it as the default if static ECC is not available - `WOLFSSL_SESSION` changes - `ssl->extSession` added to return a dynamic session when internalCacheOff is set - `ssl->session.refPtr` made dynamic and gets free'd in `SSL_ResourceFree` - If `SSL_MODE_AUTO_RETRY` is set then retry should only occur during a handshake - `WOLFSSL_TRUST_PEER_CERT` code now always uses `cert->subjectHash` for the `cm->tpTable` table row selection - Change some error message names to line up with OpenSSL equivalents - Run `MatchSuite` again if certificate setup callback installed and successful - Refactor clearing `ASN_NO_PEM_HEADER` off the error queue into a macro - `wolfSSL_get_peer_certificate` now returns a duplicated object meaning that the caller needs to free the returned object - Allign `wolfSSL_CRYPTO_set_mem_functions` callbacks with OpenSSL API - `wolfSSL_d2i_PKCS12_bio` now consumes the input BIO. It now supports all supported BIO's instead of only memory BIO. - stunnel specific - Always return a session object even if we don't have a session in cache. This allows stunnel to save information in the session external data that will be transfered to new connections if the session is reused - When allocating a dynamic session, always do `wolfSSL_SESSION_set_ex_data(session, 0, (void *)(-1)`. This is to mimic the new index callback set in `SSL_SESSION_get_ex_new_index`. - Fix comment in `wolfSSL_AES_cbc_encrypt` - Trusted peer certificate suite tests need to have CRL disabled since we don't have the issuer certificate in the CA store if the certificates are only added as trusted peer certificates. tested
2022-01-28 14:40:45 +01:00
ENABLED_TRUSTED_PEER_CERT=yes
fi
Testing improvements for cert gen and TLS cert validation: * Fixes to support certificate generation (`WOLFSSL_CERT_GEN`) without RSA enabled. * Added new ECC CA for 384-bit tests. * Created new server cert chain (ECC CA for 256-bit that signs server-ecc.pem) * Created new `./certs/ecc/genecc.sh` script for generating all ECC CA's, generated server cert req (CSR), signing with CA and the required CRL. * Moved the wolfCrypt ECC CA / ECC cert gen test into `ecc_test` as `ecc_test_cert_gen`. * Refactor duplicate code that saves DER to disk, converts DER to PEM and saves PEM to disk into SaveDerAndPem function. * Changed `ecc_test_make_pub` and `ecc_test_key_gen` to use XMALLOC for temp buffers (uses heap instead of stack). * Cleanup to combine all certificate subject information into global `certDefaultName`. * Updated cert request info to use wolfSSL instead of Yassl. * Cleanup to combine keyUsage into `certKeyUsage` and `certKeyUsage2`. * Re-number error codes in rsa_test. * Moved the certext_test after the ecc_test, since it uses a file generated in `ecc_test_cert_gen`.
2017-10-19 16:17:51 -07:00
# dertermine if we have key validation mechanism
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
if test "x$ENABLED_ECC" != "xno" || test "x$ENABLED_RSA" = "xyes"
Testing improvements for cert gen and TLS cert validation: * Fixes to support certificate generation (`WOLFSSL_CERT_GEN`) without RSA enabled. * Added new ECC CA for 384-bit tests. * Created new server cert chain (ECC CA for 256-bit that signs server-ecc.pem) * Created new `./certs/ecc/genecc.sh` script for generating all ECC CA's, generated server cert req (CSR), signing with CA and the required CRL. * Moved the wolfCrypt ECC CA / ECC cert gen test into `ecc_test` as `ecc_test_cert_gen`. * Refactor duplicate code that saves DER to disk, converts DER to PEM and saves PEM to disk into SaveDerAndPem function. * Changed `ecc_test_make_pub` and `ecc_test_key_gen` to use XMALLOC for temp buffers (uses heap instead of stack). * Cleanup to combine all certificate subject information into global `certDefaultName`. * Updated cert request info to use wolfSSL instead of Yassl. * Cleanup to combine keyUsage into `certKeyUsage` and `certKeyUsage2`. * Re-number error codes in rsa_test. * Moved the certext_test after the ecc_test, since it uses a file generated in `ecc_test_cert_gen`.
2017-10-19 16:17:51 -07:00
then
if test "x$ENABLED_ASN" = "xyes"
then
ENABLED_PKI="yes"
fi
fi
wolfRand 1. Updated fips-check.sh to make an archive for wolfRand. 2. Updated configure.ac to provide a wolfRand build.
2019-08-16 09:33:41 -07:00
# When building for wolfRand, strip out all options to disable everything.
AS_IF([test "x$ENABLED_FIPS" = "xyes" && test "x$FIPS_VERSION" = "xrand"],
[NEW_AM_CFLAGS="-DNO_AES -DNO_DH -DNO_ASN -DNO_RSA -DNO_SHA -DNO_MD5 -DNO_BIG_INT"
for v in $AM_CFLAGS
do
case $v in
-DHAVE_FFDHE_2048 | -DTFM_TIMING_RESISTANT | -DECC_TIMING_RESISTANT | \
-DWC_RSA_BLINDING | -DHAVE_AESGCM | -DWOLFSSL_SHA512 | -DWOLFSSL_SHA384 | \
-DHAVE_ECC | -DTFM_ECC256 | -DECC_SHAMIR | -DHAVE_TLS_EXTENSIONS | \
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
-DHAVE_SUPPORTED_CURVES | -DHAVE_EXTENDED_MASTER | -DUSE_FAST_MATH | \
-DWOLFSSL_SHA3)
wolfRand 1. Updated fips-check.sh to make an archive for wolfRand. 2. Updated configure.ac to provide a wolfRand build.
2019-08-16 09:33:41 -07:00
AS_ECHO(["ignoring $v"])
;;
*)
NEW_AM_CFLAGS="$NEW_AM_CFLAGS $v"
;;
esac
done
AM_CFLAGS=$NEW_AM_CFLAGS])
ARM: identify ARM CPU for Thumb and Cortex Better detailed check of CPU architecture for 32-bit byte reversal asm
2020-12-07 11:02:15 +10:00
case $host_cpu in
*arm*)
configure.ac: when --enable-fips=disabled, don't touch DEF_SP_MATH/DEF_FAST_MATH; don't enable sp-math-all asm gates when !ENABLED_ASM; add --with-arm-target to allow selecting thumb or cortex in conjunction with a full --host tuple (e.g. --host=armv6zk-softfloat-linux-gnueabi --with-arm-target=thumb).
2022-06-28 18:15:28 -05:00
if test "$host_alias" = "thumb" || test "$ARM_TARGET" = "thumb"; then
ARM: identify ARM CPU for Thumb and Cortex Better detailed check of CPU architecture for 32-bit byte reversal asm
2020-12-07 11:02:15 +10:00
AM_CFLAGS="$AM_CFLAGS -mthumb -march=armv6"
else
configure.ac: when --enable-fips=disabled, don't touch DEF_SP_MATH/DEF_FAST_MATH; don't enable sp-math-all asm gates when !ENABLED_ASM; add --with-arm-target to allow selecting thumb or cortex in conjunction with a full --host tuple (e.g. --host=armv6zk-softfloat-linux-gnueabi --with-arm-target=thumb).
2022-06-28 18:15:28 -05:00
if test "$host_alias" = "cortex" || test "$ARM_TARGET" = "cortex"; then
ARM: identify ARM CPU for Thumb and Cortex Better detailed check of CPU architecture for 32-bit byte reversal asm
2020-12-07 11:02:15 +10:00
AM_CFLAGS="$AM_CFLAGS -mcpu=cortex-r5"
fi
fi
;;
esac
wolfRand 1. Updated fips-check.sh to make an archive for wolfRand. 2. Updated configure.ac to provide a wolfRand build.
2019-08-16 09:33:41 -07:00
add wolfclu enable option
2021-09-01 08:44:00 -06:00
################################################################################
# Update ENABLE_* variables #
################################################################################
Add ability to toggle system CA certs support.
2022-10-07 11:19:34 -07:00
if test "x$ENABLED_LEANPSK" = "xyes" || test "x$ENABLED_CERTS" = "xno" || \
test "x$ENABLED_ASN" = "xno"
then
ENABLED_CERTS=no
ENABLED_ASN=no
fi
if test "x$ENABLED_SYS_CA_CERTS" = "xyes"
then
if test "x$ENABLED_FILESYSTEM" = "xno"
then
ENABLED_SYS_CA_CERTS="no"
elif test "x$ENABLED_CERTS" = "xno"
then
ENABLED_SYS_CA_CERTS="no"
fi
fi
add wolfclu enable option
2021-09-01 08:44:00 -06:00
if test "x$ENABLED_WOLFCLU" = "xyes"
then
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
fi
if test "x$ENABLED_CERTREQ" = "xno"
then
ENABLED_CERTREQ="yes"
fi
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
fi
# Requires md5
if test "$ENABLED_MD5" = "no"
then
ENABLED_MD5="yes"
fi
# Requires aesctr
if test "x$ENABLED_AESCTR" = "xno"
then
ENABLED_AESCTR="yes"
fi
# Uses key generation
if test "x$ENABLED_KEYGEN" = "xno"
then
ENABLED_KEYGEN="yes"
fi
# Uses functions guarded by opensslall
if test "$ENABLED_OPENSSLALL" = "no"
then
ENABLED_OPENSSLALL="yes"
fi
# Has option for signing with ED25519
if test "$ENABLED_ED25519" = "no"
then
ENABLED_ED25519=yes
ENABLED_FEMATH=yes
ENABLED_GEMATH=yes
ENABLED_CERTS=yes
fi
# Has sha512 hashing
if test "$ENABLED_SHA512" = "no"
then
ENABLED_SHA512="yes"
fi
# Has support for DES3 encrypt/decrypt
if test "$ENABLED_DES3" = "no"
then
ENABLED_DES3="yes"
fi
# Uses alt name
ENABLED_ALTNAMES="yes"
fi
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
if test "$ENABLED_STRONGSWAN" = "yes"; then
if test "$ENABLED_CERTREQ" = "no"; then
ENABLED_CERTREQ="yes"
fi
if test "$ENABLED_OCSP" = "no"; then
ENABLED_OCSP="yes"
fi
fi
add wolfclu enable option
2021-09-01 08:44:00 -06:00
AS_IF([test "x$ENABLED_MCAPI" = "xyes"],
[AS_IF([test "x$ENABLED_DES3" = "xno"],[ENABLED_DES3="yes"])])
if test "$ENABLED_OPENSSH" = "yes" || test "$ENABLED_NGINX" = "yes" || \
test "$ENABLED_SIGNAL" = "yes" || test "$ENABLED_WPAS" = "yes" || \
test "$ENABLED_FORTRESS" = "yes" || test "$ENABLED_BUMP" = "yes" || \
Fixes for minor sniffer and async issues: * Sniffer: Remove old restrictions for max strength, encrypt-then-mac and forcing openssl-extra. * Fix bound warning with strncpy in sniffer.c. * Fix for async DH issue. * Fix for SP math all not initializing raw big int. * Fix for array bounds warning with "-O3" on SetEccPublicKey. * Fix a sniffer async edge case with TLS v1.2 static RSA and extended master. * Improved the sniffer test script detection of features. * Disable ECC custom curve test with Intel QuickAssist.
2022-04-08 15:22:16 -07:00
test "$ENABLED_OPENSSLALL" = "yes" || \
add wolfclu enable option
2021-09-01 08:44:00 -06:00
test "$ENABLED_LIBWEBSOCKETS" = "yes" || \
test "x$ENABLED_LIGHTY" = "xyes" || test "$ENABLED_LIBSSH2" = "yes" || \
Enhance OpenLDAP support. - Add --enable-openldap to configure.ac - Fix some issues around subject alt names and the WOLFSSL_GENERAL_NAME struct.
2022-06-25 16:14:35 +04:00
test "x$ENABLED_NTP" = "xyes" || test "$ENABLED_RSYSLOG" = "yes" || \
test "$ENABLED_OPENLDAP" = "yes"
add wolfclu enable option
2021-09-01 08:44:00 -06:00
then
ENABLED_OPENSSLEXTRA="yes"
fi
if test "$ENABLED_ED25519" != "no" && test "$ENABLED_32BIT" = "no"
then
if test "$ENABLED_ED25519" = "small" || test "$ENABLED_LOWRESOURCE" = "yes"
then
ENABLED_ED25519_SMALL=yes
ENABLED_CURVE25519_SMALL=yes
ENABLED_ED25519=yes
fi
ENABLED_FEMATH=yes
ENABLED_GEMATH=yes
ENABLED_CERTS=yes
fi
move setting of ENABLED_MD5
2021-09-10 12:17:11 -06:00
if test "$ENABLED_MD5" = "yes"
then
# turn off MD5 if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
then
ENABLED_MD5=no
fi
fi
add wolfclu enable option
2021-09-01 08:44:00 -06:00
adds build dependency check for OCSP
2016-02-23 15:19:04 -03:00
################################################################################
# Check for build-type conflicts #
################################################################################
Added --enable-maxstrength configure build to only allow TLSv1.2, PFS, and AEAD ciphers.
2015-04-01 11:55:49 -07:00
AS_IF([test "x$ENABLED_MAXSTRENGTH" = "xyes" && \
test "x$ENABLED_LEANPSK" = "xyes"],
[AC_MSG_ERROR([Cannot use Max Strength and Lean PSK at the same time.])])
adds missing ENABLED_OCSP test
2016-02-24 16:45:07 -03:00
AS_IF([test "x$ENABLED_OCSP" = "xyes" && \
test "x$ENABLED_ASN" = "xno"],
adds build dependency check for OCSP
2016-02-23 15:19:04 -03:00
[AC_MSG_ERROR([please enable asn if enabling ocsp.])])
Added support for reading S/MIME messages via SMIME_read_PKCS7.
2021-02-08 17:12:24 -07:00
AS_IF([test "x$ENABLED_SMIME" = "xyes" && \
test "x$ENABLED_ASN" = "xno"],
[AC_MSG_ERROR([please enable asn if enabling S/MIME.])])
adds check for missing rsa and ecc at the same time
2016-02-24 18:57:16 -03:00
AS_IF([test "x$ENABLED_OCSP" = "xyes" && \
test "x$ENABLED_RSA" = "xno" && \
test "x$ENABLED_ECC" = "xno"],
[AC_MSG_ERROR([please enable rsa or ecc if enabling ocsp.])])
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
# Sync Intel QA and Sync Cavium Octeon require the crypto callback
AS_IF([test "x$ENABLED_INTEL_QA_SYNC" = "xyes" || test "x$ENABLED_OCTEON_SYNC" = "xyes"],
[AS_IF([test "x$ENABLED_CRYPTOCB" = "xno"],
[AC_MSG_ERROR([please enable the crypto callback support using --enable-cryptocb])])])
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
autoconf checks on some builds that break, macro for no server, and user rsa
2016-04-06 09:25:53 -06:00
# checks for pkcs7 needed enables
AS_IF([test "x$ENABLED_PKCS7" = "xyes" && \
Added support for building and using PKCS7 without RSA (assuming ECC is enabled).
2018-04-03 09:26:57 -07:00
test "x$ENABLED_RSA" = "xno" && \
test "x$ENABLED_ECC" = "xno"],
[AC_MSG_ERROR([please enable ecc or rsa if enabling pkcs7.])])
autoconf checks on some builds that break, macro for no server, and user rsa
2016-04-06 09:25:53 -06:00
AS_IF([test "x$ENABLED_PKCS7" = "xyes" && \
test "x$ENABLED_SHA" = "xno"],
[AC_MSG_ERROR([please enable sha if enabling pkcs7.])])
PKCS7 and SCEP need either AES or 3DES enabled, error out if not
2017-11-20 13:16:44 -07:00
AS_IF([test "x$ENABLED_PKCS7" = "xyes" && \
test "x$ENABLED_AES" = "xno" && \
test "x$ENABLED_DES3" = "xno"],
[AC_MSG_ERROR([please enable either AES or 3DES if enabling pkcs7.])])
AS_IF([test "x$ENABLED_WOLFSCEP" = "xyes" && \
test "x$ENABLED_AES" = "xno" && \
test "x$ENABLED_DES3" = "xno"],
[AC_MSG_ERROR([please enable either AES or 3DES if enabling scep.])])
autoconf checks on some builds that break, macro for no server, and user rsa
2016-04-06 09:25:53 -06:00
AS_IF([test "x$ENABLED_LEANTLS" = "xyes" && \
test "x$ENABLED_ECC" = "xno"],
[AC_MSG_ERROR([please enable ecc if enabling leantls.])])
AS_IF([test "x$ENABLED_SNIFFER" = "xyes" && \
TLS v1.3 sniffer support: * Added TLS v1.3 sniffer support using static ephemeral key. * Add support for using a static ephemeral DH and ECC keys with TLS v1.3 using `WOLFSSL_STATIC_EPHEMERAL`. * Adds new API's `wolfSSL_CTX_set_ephemeral_key` and `wolfSSL_set_ephemeral_key`. * Expanded TLS extension support in sniffer. * Refactor of the handshake hashing code. * Added parameter checking to the TLS v1.3 key derivations (protects use of "DoTls13Finished" if handshake resources have been free'd). * Added support for loading DH keys via `wc_DhImportKeyPair` and `wc_DhExportKeyPair`, enabled with `WOLFSSL_DH_EXTRA`. * Added sniffer documentation `sslSniffer/README.md`.
2020-07-09 13:52:49 -07:00
test "x$ENABLED_RSA" = "xno" && \
Expanded support for Curve25519/Curve448 and TLS v1.3 sniffer (#4335) * Fixes for building with Ed/Curve25519 only. Fix for IoT safe demo to exit after running once. Added `WOLFSSL_DH_EXTRA` to `--enable-all` and `--enable-sniffer`. Cleanup uses of `==` in configure.ac. Various spelling fixes. * Fix for sniffer with TLS v1.3 session tickets. * Fix for ASN Template Ed25519 key export (missing version / not setting OID correctly). * Add key import/export support for Curve25519/Curve448. Refactor of the 25519/448 ASN code to combine duplicate code. * Refactor of Curve25519 code. Improved public key export to handle generation when only private is set. Improved private scalar buffer sizing. * Fix for static ephemeral loading of file buffer. * Added sniffer Curve25519 support and test case. * Fix for sniffer to not use ECC for X25519 if both are set. * Fix Curve448 public export when only private is set. * Fix for `dh_generate_test` for small stack size. * Reduce stack size use on new asymmetric DER import/export functions. Cleanup pub length calc. * Fix invalid comment.
2021-08-31 16:28:24 -07:00
test "x$ENABLED_ECC" = "xno" && \
test "x$ENABLED_CURVE25519" = "xno"],
[AC_MSG_ERROR([please enable ecc, rsa or curve25519 if enabling sniffer.])])
autoconf checks on some builds that break, macro for no server, and user rsa
2016-04-06 09:25:53 -06:00
Disable DES3 by default. Force it enabled when it is a prereq for another option. (SCEP and PKCS7)
2016-09-15 11:17:30 -07:00
# Lean TLS forces off prereqs of SCEP.
AS_IF([test "x$ENABLED_SCEP" = "xyes" && \
test "x$ENABLED_LEANTLS" = "xyes"],
[AC_MSG_ERROR([Cannot use SCEP and Lean TLS at the same time.])])
add AES-CMAC
2016-05-23 17:50:36 -07:00
# CMAC currently requires AES.
AS_IF([test "x$ENABLED_CMAC" = "xyes" && \
test "x$ENABLED_AES" = "xno"],
[AC_MSG_ERROR([cannot use CMAC without AES.])])
add wolfclu enable option
2021-09-01 08:44:00 -06:00
# certreq requires certgen
AS_IF([test "x$ENABLED_CERT_REQ" = "xyes" && \
test "x$ENABLED_CERT_GEN" = "xno"],
[AC_MSG_ERROR([cannot use certreq without certgen.])])
# ed25519 requires sha512
AS_IF([test "x$ENABLED_ED25519" = "xyes" && \
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
test "x$ENABLED_SHA512" = "xno" && \
test "x$ENABLED_32BIT" = "xno"],
add wolfclu enable option
2021-09-01 08:44:00 -06:00
[AC_MSG_ERROR([cannot enable ed25519 without enabling sha512.])])
# ed25519 stream requires ed25519
AS_IF([test "x$ENABLED_ED25519_STREAM" = "xyes" && \
test "x$ENABLED_ED25519" = "xno"],
[AC_MSG_ERROR([ED25519 verify streaming enabled but ED25519 is disabled])])
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
# Ensure only one size is enabled
AS_IF([test "x$ENABLED_64BIT" = "xyes" && \
test "x$ENABLED_32BIT" = "xyes"],
[AC_MSG_ERROR([cannot specify 64-bit build and 32-bit build.])])
AS_IF([test "x$ENABLED_64BIT" = "xyes" && \
test "x$ENABLED_16BIT" = "xyes"],
[AC_MSG_ERROR([cannot specify 64-bit build and 16-bit build.])])
AS_IF([test "x$ENABLED_32BIT" = "xyes" && \
test "x$ENABLED_16BIT" = "xyes"],
[AC_MSG_ERROR([cannot specify 32-bit build and 16-bit build.])])
# 16-bit build not supported with SP
AS_IF([test "x$ENABLED_16BIT" = "xyes" && \
test "x$ENABLED_SP" = "xyes"],
[AC_MSG_ERROR([16-bit build not available with SP.])])
adds build dependency check for OCSP
2016-02-23 15:19:04 -03:00
################################################################################
# Update CFLAGS based on options #
################################################################################
Add ability to toggle system CA certs support.
2022-10-07 11:19:34 -07:00
AS_IF([test "x$ENABLED_CERTS" = "xno"],
[AM_CFLAGS="$AM_CFLAGS -DNO_CERTS"])
AS_IF([test "x$ENABLED_ASN" = "xno"],
[AM_CFLAGS="$AM_CFLAGS -DNO_ASN"])
AS_IF([test "x$ENABLED_SYS_CA_CERTS" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SYS_CA_CERTS"])
Added --enable-maxstrength configure build to only allow TLSv1.2, PFS, and AEAD ciphers.
2015-04-01 11:55:49 -07:00
add wolfclu enable option
2021-09-01 08:44:00 -06:00
AS_IF([test "x$ENABLED_ALTNAMES" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALT_NAMES"])
AS_IF([test "x$ENABLED_KEYGEN" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"])
AS_IF([test "x$ENABLED_CERTREQ" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_REQ"])
AS_IF([test "x$ENABLED_CERTGEN" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"])
AS_IF([test "x$ENABLED_CERTEXT" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"])
account for 32bit build with ed25519
2021-09-03 10:03:37 -06:00
AS_IF([test "x$ENABLED_ED25519" = "xyes" && test "x$ENABLED_32BIT" = "xno"],
add wolfclu enable option
2021-09-01 08:44:00 -06:00
[AM_CFLAGS="$AM_CFLAGS -DHAVE_ED25519"])
AS_IF([test "x$ENABLED_ED25519_SMALL" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DED25519_SMALL"])
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
AS_IF([test "x$ENABLED_OCSP" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DHAVE_OCSP"])
AS_IF([test "x$ENABLED_STRONGSWAN" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DES_ECB -DWOLFSSL_LOG_PRINTF -DWOLFSSL_PUBLIC_MP -DHAVE_EX_DATA"])
Enhance OpenLDAP support. - Add --enable-openldap to configure.ac - Fix some issues around subject alt names and the WOLFSSL_GENERAL_NAME struct.
2022-06-25 16:14:35 +04:00
AS_IF([test "x$ENABLED_OPENLDAP" = "xyes"], [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SIGNER_DER_CERT"])
add wolfclu enable option
2021-09-01 08:44:00 -06:00
if test "$ENABLED_ED25519_STREAM" != "no"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ED25519_STREAMING_VERIFY"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_ED25519_STREAMING_VERIFY"
fi
refactor location of error queue count and consolidate no error queue macro
2021-10-06 11:55:40 -06:00
if test "$ENABLED_ERROR_QUEUE" = "no" || test "$ENABLED_JNI" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DNO_ERROR_QUEUE"
fi
add wolfclu enable option
2021-09-01 08:44:00 -06:00
AS_IF([test "x$ENABLED_OPENSSLALL" = "xyes"],
add WOLFSSL_CERT_NAME_ALL macro guard and new values to set subject
2022-08-01 10:52:09 -07:00
[AM_CFLAGS="$AM_CFLAGS -DOPENSSL_ALL -DWOLFSSL_EITHER_SIDE -DWC_RSA_NO_PADDING -DWC_RSA_PSS -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_TICKET_HAVE_ID -DWOLFSSL_ERROR_CODE_OPENSSL -DWOLFSSL_CERT_NAME_ALL"])
add wolfclu enable option
2021-09-01 08:44:00 -06:00
Add AES-SIV (RFC 5297). This commit adds functions to encrypt and decrypt data using AES in SIV mode, as described in RFC 5297. This was added in the process of porting chrony to wolfSSL. chrony is an NTP implementation that can use NTS (network time security), which requires AES-SIV.
2022-01-14 16:52:03 -08:00
AS_IF([test "x$ENABLED_AESSIV" = "xyes"], [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_SIV"])
add wolfclu enable option
2021-09-01 08:44:00 -06:00
AS_IF([test "x$ENABLED_AESCTR" = "xyes" && test "x$ENABLED_FORTRESS" != "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER -DWOLFSSL_AES_DIRECT"])
if test "$ENABLED_MD5" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_MD5 -DNO_OLD_TLS"
fi
Configure HMAC: define NO_HMAC when HMAC disabled
2022-02-14 17:22:10 +10:00
if test "$ENABLED_HMAC" = "no"
then
AM_CFLAGS="$AM_CFLAGS -DNO_HMAC"
fi
add wolfclu enable option
2021-09-01 08:44:00 -06:00
if test "$ENABLED_OPENSSLEXTRA" = "yes" && test "x$ENABLED_OPENSSLCOEXIST" = "xno"
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA -DWOLFSSL_ALWAYS_VERIFY_CB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VERIFY_CB_ALL_CERTS -DWOLFSSL_EXTRA_ALERTS"
AM_CFLAGS="$AM_CFLAGS -DHAVE_EXT_CACHE -DWOLFSSL_FORCE_CACHE_ON_TICKET"
OpenSSL compatible API `WOLFSSL_ERROR_CODE_OPENSSL` breaks ABI compatiblity due to changing the expected return code. Let's only do this when building with the full compatibility layer.
2022-03-21 12:04:59 +01:00
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AKID_NAME -DHAVE_CTS"
add wolfclu enable option
2021-09-01 08:44:00 -06:00
fi
if test "$ENABLED_OPENSSLEXTRA" = "x509small"
then
AC_MSG_NOTICE([Enabling only a subset of X509 opensslextra])
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -DOPENSSL_EXTRA_X509_SMALL"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_EKU_OID -DWOLFSSL_MULTI_ATTRIB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_OPENSSL_RAND_CB"
add wolfclu enable option
2021-09-01 08:44:00 -06:00
fi
1. Updated sniffer to allow DES3 to be disabled. 2. Fixed an unused variable in OpenSSL Extras when DES3 is disabled. 3. Force DES3 enabled when enabling MCAPI.
2016-09-15 14:53:28 -07:00
Disable DES3 by default. Force it enabled when it is a prereq for another option. (SCEP and PKCS7)
2016-09-15 11:17:30 -07:00
if test "$ENABLED_WOLFSCEP" = "yes"
then
# Enable prereqs if not already enabled
if test "x$ENABLED_KEYGEN" = "xno"
then
ENABLED_KEYGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"
fi
if test "x$ENABLED_CERTGEN" = "xno"
then
ENABLED_CERTGEN="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_GEN"
fi
if test "x$ENABLED_CERTREQ" = "xno"
then
ENABLED_CERTREQ="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_REQ"
fi
if test "x$ENABLED_CERTEXT" = "xno"
then
ENABLED_CERTEXT="yes"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_EXT"
fi
if test "x$ENABLED_PKCS7" = "xno"
then
ENABLED_PKCS7="yes"
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_WOLFSCEP"
fi
if test "x$ENABLED_PKCS7" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_PKCS7"
# Enable prereqs if not already enabled
add EnvelopedData ECC support, refactor pkcs7
2016-12-09 17:22:09 -07:00
if test "x$ENABLED_AESKEYWRAP" = "xno"
then
ENABLED_AESKEYWRAP="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_KEYWRAP -DWOLFSSL_AES_DIRECT"
fi
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
if test "x$ENABLED_X963KDF" = "xno" && test "$ENABLED_ECC" != "no"
add EnvelopedData ECC support, refactor pkcs7
2016-12-09 17:22:09 -07:00
then
ENABLED_X963KDF="yes"
AM_CFLAGS="$AM_CFLAGS -DHAVE_X963_KDF"
fi
Disable DES3 by default. Force it enabled when it is a prereq for another option. (SCEP and PKCS7)
2016-09-15 11:17:30 -07:00
fi
if test "x$ENABLED_DES3" = "xno"
then
AM_CFLAGS="$AM_CFLAGS -DNO_DES3"
else
# turn off DES3 if leanpsk or leantls on
if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_LEANTLS" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DNO_DES3"
ENABLED_DES3=no
fi
fi
AES-GCM: GMULT using 4-bit table When 64-bit data type available and not big endian code is faster. --enable-aesgcm=4bit
2020-10-14 14:08:06 +10:00
if test "$ENABLED_AESGCM" != "no"
then
Jenkins nighlty fixes wolfSSL_Rehandshake(): don't set 'ret' unless HAVE_SESSION_TICKET defined (otherwise compiler will complain: warning: Value stored to 'ret' is never read) AES GCM streaming: fix 64-bit word version to compile and pass testing Use '--enable-aesgcm=word' to get the word32 or word64 implementation depending on the availabilty of 64-bit type.
2021-08-24 11:28:10 +10:00
if test "$ENABLED_AESGCM" = "word"
then
ENABLED_AESGCM=yes
fi
AES-GCM: GMULT using 4-bit table When 64-bit data type available and not big endian code is faster. --enable-aesgcm=4bit
2020-10-14 14:08:06 +10:00
if test "$ENABLED_AESGCM" = "word32"
then
AM_CFLAGS="$AM_CFLAGS -DGCM_WORD32"
ENABLED_AESGCM=yes
fi
if test "$ENABLED_AESGCM" = "small" || test "$ENABLED_LOWRESOURCE" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DGCM_SMALL"
ENABLED_AESGCM=yes
fi
if test "$ENABLED_AESGCM" = "table"
then
AM_CFLAGS="$AM_CFLAGS -DGCM_TABLE"
ENABLED_AESGCM=yes
fi
if test "$ENABLED_AESGCM" = "4bit"
then
AM_CFLAGS="$AM_CFLAGS -DGCM_TABLE_4BIT"
ENABLED_AESGCM=yes
fi
AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"
fi
AES GCM: implement streaming Updated EVP layer to use streaming API when enabled. Assembly for x64 updated to include streaming.
2021-03-04 16:01:45 +10:00
if test "$ENABLED_AESGCM_STREAM" != "no"
then
fixup
2021-03-17 11:31:03 +10:00
if test "$ENABLED_AESGCM" = "no"
then
AC_MSG_ERROR([AES-GCM streaming enabled but AES-GCM is disabled])
else
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AESGCM_STREAM"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AESGCM_STREAM"
fi
AES GCM: implement streaming Updated EVP layer to use streaming API when enabled. Assembly for x64 updated to include streaming.
2021-03-04 16:01:45 +10:00
fi
AES-GCM: GMULT using 4-bit table When 64-bit data type available and not big endian code is faster. --enable-aesgcm=4bit
2020-10-14 14:08:06 +10:00
Support for IoT-Safe with TLS demo
2021-07-26 19:38:46 +02:00
if test "$ENABLED_IOTSAFE" != "no"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_IOTSAFE"
ENABLED_IOTSAFE=yes
fi
if test "$ENABLED_IOTSAFE_HWRNG" != "no"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_IOTSAFE_HWRNG"
ENABLED_IOTSAFE_HWRNG=yes
fi
Make the code simpler.
2022-02-04 16:05:58 -05:00
if test "x$ENABLED_WOLFENGINE" = "xyes"
Created new --enable-engine and --enable-engine-witout-fips flags
2022-01-31 11:56:11 -05:00
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_ECB"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT"
AM_CFLAGS="$AM_CFLAGS -DWC_RSA_NO_PADDING"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PUBLIC_MP"
AM_CFLAGS="$AM_CFLAGS -DECC_MIN_KEY_SZ=192"
fi
Fix to add test where needed.
2022-03-14 15:54:39 -04:00
if test "$ENABLED_WOLFENGINE" = "yes" && test "$ENABLED_FIPS" != "no"
Created new --enable-engine and --enable-engine-witout-fips flags
2022-01-31 11:56:11 -05:00
then
AM_CFLAGS="$AM_CFLAGS -DSha3=wc_Sha3"
AM_CFLAGS="$AM_CFLAGS -DNO_OLD_SHA256_NAMES"
AM_CFLAGS="$AM_CFLAGS -DNO_OLD_MD5_NAME"
fi
Fix to add test where needed.
2022-03-14 15:54:39 -04:00
if test "$ENABLED_WOLFENGINE" = "yes" && test "$ENABLED_FIPS" = "no"
Created new --enable-engine and --enable-engine-witout-fips flags
2022-01-31 11:56:11 -05:00
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PSS_LONG_SALT"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PSS_SALT_LEN_DISCOVER"
fi
Disable DES3 by default. Force it enabled when it is a prereq for another option. (SCEP and PKCS7)
2016-09-15 11:17:30 -07:00
Added --enable-maxstrength configure build to only allow TLSv1.2, PFS, and AEAD ciphers.
2015-04-01 11:55:49 -07:00
AS_IF([test "x$ENABLED_MAXSTRENGTH" = "xyes"],
Added sanity check on TLS encrypt to trap against glitching.
2022-06-10 12:52:34 -07:00
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_MAX_STRENGTH -DWOLFSSL_CIPHER_TEXT_CHECK"])
Added --enable-maxstrength configure build to only allow TLSv1.2, PFS, and AEAD ciphers.
2015-04-01 11:55:49 -07:00
AS_IF([test "x$ENABLED_MAXSTRENGTH" = "xyes" && \
test "x$ENABLED_OLD_TLS" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DNO_OLD_TLS"
ENABLED_OLD_TLS=no])
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
AS_IF([test "x$ENABLED_MAXSTRENGTH" = "xyes" && \
test "x$ENABLED_SSLV3" = "xyes"],
[AC_MSG_ERROR([Cannot use Max Strength and SSLv3 at the same time.])])
1. Added missing -DWOLFSSL_SCTP to configure.ac. 2. Don't do hello verify requests in SCTP mode. 3. Implemented the SCTP MTU size changes. 4. Simplified the MAX_FRAGMENT size when calling ReceiveData().
2016-08-24 13:17:38 -07:00
AS_IF([test "x$ENABLED_SCTP" = "xyes"],
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SCTP"])
1. Added missing -DWOLFSSL_SCTP to configure.ac. 2. Don't do hello verify requests in SCTP mode. 3. Implemented the SCTP MTU size changes. 4. Simplified the MAX_FRAGMENT size when calling ReceiveData().
2016-08-24 13:17:38 -07:00
DTLS SRTP (RFC5764) support (adds `--enable-srtp`). Used with WebRTC to agree on profile for new real-time session keys.
2022-01-13 16:09:11 -08:00
AS_IF([test "x$ENABLED_SRTP" = "xyes"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SRTP"])
Multicast DTLS 1. Add DTLS-multicast to the enable options. 2. Reorg DTLS related enable options together. 3. Update a couple enable option texts to use the AS_HELP_STRING() macro. 4. Add three new APIs for managing a DTLS Multicast session. 5. Add test code for new APIs. 6. Add stub code for the new APIs.
2016-12-06 14:08:52 -08:00
AS_IF([test "x$ENABLED_MCAST" = "xyes"],
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_MULTICAST"])
Multicast DTLS 1. Add DTLS-multicast to the enable options. 2. Reorg DTLS related enable options together. 3. Update a couple enable option texts to use the AS_HELP_STRING() macro. 4. Add three new APIs for managing a DTLS Multicast session. 5. Add test code for new APIs. 6. Add stub code for the new APIs.
2016-12-06 14:08:52 -08:00
inital AES-CBC with af_alg progress on AES-GCM with AF_ALG and add SHA256 add aes-gcm test cases and finish logic of aes-gcm with AF_ALG formating of tabs and white space add files to dist adding ecb and ctr mode with af_alg make length of buffers for ctr be AES_BLOCK_SIZE formating and add support for sha256 copy/gethash sanity checks on arguments cast return values and valgrind tests make it easier to use sha256 with af_alg remove hard tabs add endif for after rebase
2018-07-18 17:26:25 -06:00
# WOLFSSL_AFALG does not support SHA224 yet
AS_IF([(test "x$ENABLED_AFALG" = "xyes") && (test "x$ENABLED_SHA224" = "xyes")],
[AC_MSG_ERROR([--enable-sha224 with --enable-afalg not yet supported])])
crypto only sha256 cryptodev formating and refactoring update configure for devcrypto add AES algorithms to cyrptodev port increase structure size for compatibility AES with cryptodev add wc_devcrypto.h to install path
2018-08-17 09:46:16 -06:00
# WOLFSSL_DEVCRYPTO does not support SHA224 yet
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
AS_IF([(test "x$ENABLED_DEVCRYPTO" = "xyes") && \
(test "x$ENABLED_CAAM" = "xno") && \
(test "x$ENABLED_SHA224" = "xyes")],
crypto only sha256 cryptodev formating and refactoring update configure for devcrypto add AES algorithms to cyrptodev port increase structure size for compatibility AES with cryptodev add wc_devcrypto.h to install path
2018-08-17 09:46:16 -06:00
[AC_MSG_ERROR([--enable-sha224 with --enable-devcrypto not yet supported])])
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
# SCTP, Multicast, SRTP, and strongSwan require DTLS
Multicast DTLS 1. Add DTLS-multicast to the enable options. 2. Reorg DTLS related enable options together. 3. Update a couple enable option texts to use the AS_HELP_STRING() macro. 4. Add three new APIs for managing a DTLS Multicast session. 5. Add test code for new APIs. 6. Add stub code for the new APIs.
2016-12-06 14:08:52 -08:00
AS_IF([(test "x$ENABLED_DTLS" = "xno") && \
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
(test "x$ENABLED_SCTP" = "xyes" || test "x$ENABLED_MCAST" = "xyes" || \
test "x$ENABLED_SRTP" = "xyes" || \
test "x$ENABLED_STRONGSWAN" = "xyes")],
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS"
added SCTP to configure.ac
2016-08-01 07:51:42 -07:00
ENABLED_DTLS=yes])
Multicast 1. Since multicast's only cipher suite uses null cipher automatically enable it. 2. Add options to example client and server to start testing multicast API. (Uses TLS over TCP.) 3. Updates to use the forced secrets set by API.
2016-12-15 11:43:15 -08:00
# Multicast requires the null cipher
AS_IF([test "x$ENABLED_NULL_CIPHER" = "xno" && \
test "x$ENABLED_MCAST" = "xyes"],
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
[AM_CFLAGS="$AM_CFLAGS -DHAVE_NULL_CIPHER"
Multicast 1. Since multicast's only cipher suite uses null cipher automatically enable it. 2. Add options to example client and server to start testing multicast API. (Uses TLS over TCP.) 3. Updates to use the forced secrets set by API.
2016-12-15 11:43:15 -08:00
ENABLED_NULL_CIPHER=yes])
wolfSSH Option Added a configure convenience option for building wolfSSL to work with wolfSSH.
2017-10-04 15:24:22 -07:00
# wolfSSH and WPA Supplicant both need Public MP, only enable once.
# This will let you know if you enabled wolfSSH but have any of the prereqs
# disabled. Some of these options, disabling them adds things to the FLAGS and
# you need to check and add items in two places depending on the option.
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AS_IF([test "x$ENABLED_WOLFSSH" = "xyes"],[AS_IF([test "x$ENABLED_WPAS" = "xno"],[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PUBLIC_MP"])])
wolfSSH Option Added a configure convenience option for building wolfSSL to work with wolfSSH.
2017-10-04 15:24:22 -07:00
throw error when opensslcoexist configured with opensslall or opensslextra
2019-10-23 15:51:19 -07:00
if test "x$ENABLED_OPENSSLCOEXIST" = "xyes"; then
if test "x$ENABLED_OPENSSLALL" = "xyes"; then
AC_MSG_ERROR([Cannot use --enable-opensslcoexist with --enable-opensslall])
fi
if test "x$ENABLED_OPENSSLEXTRA" = "xyes"; then
AC_MSG_ERROR([Cannot use --enable-opensslcoexist with --enable-opensslextra])
fi
fi
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
KDF Update 1. Move wolfSSH's KDF into wolfCrypt.
2020-12-14 11:09:56 -08:00
AS_IF([test "x$ENABLED_WOLFSSH" = "xyes"],[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSL_WOLFSSH"])
TLS: Default secure renegotiation compatability By default this change will have servers send the renegotiation info extension, but not allow renegotiation. This is accordance with RFC 5746 From to RFC 5746: > In order to enable clients to probe, even servers that do not support > renegotiation MUST implement the minimal version of the extension > described in this document for initial handshakes, thus signaling > that they have been upgraded. With openSSL 3.0 the default it not allow connections to servers without secure renegotiation extension. See https://github.com/openssl/openssl/pull/15127
2022-01-10 15:55:37 -08:00
# only allow secure renegotiation info with TLSV12 and ASN
if test "x$ENABLED_ASN" = "xno" || \
test "x$ENABLED_TLSV12" = "xno" || \
test "x$ENABLED_RENEGOTIATION_INDICATION" = "xyes"; then
ENABLED_SECURE_RENEGOTIATION_INFO="no"
fi
if test "x$ENABLED_SECURE_RENEGOTIATION_INFO" = "xyes"; then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SERVER_RENEGOTIATION_INFO"
TLS 1.3: PSK only Support building with only TLS 1.3 and PSK without code for (EC)DHE and certificates. Minimise build size for this configuration.
2020-10-28 11:47:31 +10:00
fi
Disable RC4 unless forcefully enabled with `--enable-rc4` or if `WOLFSSL_ALLOW_RC4` is specified. Related to issue #4248
2021-07-28 10:31:15 -07:00
configure.ac and tests/api.c: lock out compkey on FIPS 140-3 RC12 and ready, and add backward-compat code in test_wc_ecc_export_x963_ex() to allow RC12 compkey builds to pass unit.test.
2022-07-06 17:31:56 -05:00
if test "$ENABLED_COMPKEY" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_COMP_KEY"
fi
TLS: Default secure renegotiation compatability By default this change will have servers send the renegotiation info extension, but not allow renegotiation. This is accordance with RFC 5746 From to RFC 5746: > In order to enable clients to probe, even servers that do not support > renegotiation MUST implement the minimal version of the extension > described in this document for initial handshakes, thus signaling > that they have been upgraded. With openSSL 3.0 the default it not allow connections to servers without secure renegotiation extension. See https://github.com/openssl/openssl/pull/15127
2022-01-10 15:55:37 -08:00
configure.ac and tests/api.c: lock out compkey on FIPS 140-3 RC12 and ready, and add backward-compat code in test_wc_ecc_export_x963_ex() to allow RC12 compkey builds to pass unit.test.
2022-07-06 17:31:56 -05:00
# Deprecated Algorithm Handling
Disable RC4 unless forcefully enabled with `--enable-rc4` or if `WOLFSSL_ALLOW_RC4` is specified. Related to issue #4248
2021-07-28 10:31:15 -07:00
if test "$ENABLED_ARC4" = "yes"
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALLOW_RC4"
fi
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
# Link with the math library iff needed.
if test "$ENABLED_DH" != "no" && test "$ENABLED_DH" != "const"; then
LT_LIB_M
fi
adds build dependency check for OCSP
2016-02-23 15:19:04 -03:00
################################################################################
add macpi huffman
2013-03-20 14:37:05 -07:00
Fixes for know wolfSSL build issues in the following cases: * Fixes for building wolfSSL from GitHub sources download, where .git does exist. The autogen.sh still needs to "touch" files for the build to work. * Fix for FIPS case where `wc_RsaSetRNG` is not available. * Added new `./configure --enable-usersettings` option to not populate the Makefile with build options and instead define `WOLFSSL_USER_SETTINGS` and expect a user provided `user_settings.h` file. * Fix for `HAVE___UINT128_T` to match config.h generated value to eliminate warning.
2019-04-30 11:45:48 -07:00
# USER SETTINGS
if test "x$ENABLED_USERSETTINGS" = "xyes"
then
Make some improvements to user_settings_asm.h. For the CMake and autotools flows, enabling user_settings.h will define the macro WOLFSSL_USER_SETTINGS_ASM. This will cause the generated user_settings_asm.h to be included in the .S assembly files. If the user is building without autotools or CMake, these files will include user_settings.h directly, unless WOLFSSL_USER_SETTINGS_ASM is defined.
2022-10-18 09:20:06 -07:00
# Replace all options and just use WOLFSSL_USER_SETTINGS and
# WOLFSSL_USER_SETTINGS_ASM.
AM_CFLAGS="-DWOLFSSL_USER_SETTINGS -DWOLFSSL_USER_SETTINGS_ASM"
AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_USER_SETTINGS -DWOLFSSL_USER_SETTINGS_ASM"
# Generate assembly-safe user_settings_asm.h (just preprocessor directives
# from user_settings.h).
$srcdir/scripts/user_settings_asm.sh "$CPPFLAGS $CFLAGS $CXXFLAGS"
if test $? -ne 0; then
AC_MSG_ERROR([$srcdir/scripts/user_settings_asm.sh failed.])
fi
Fixes for know wolfSSL build issues in the following cases: * Fixes for building wolfSSL from GitHub sources download, where .git does exist. The autogen.sh still needs to "touch" files for the build to work. * Fix for FIPS case where `wc_RsaSetRNG` is not available. * Added new `./configure --enable-usersettings` option to not populate the Makefile with build options and instead define `WOLFSSL_USER_SETTINGS` and expect a user provided `user_settings.h` file. * Fix for `HAVE___UINT128_T` to match config.h generated value to eliminate warning.
2019-04-30 11:45:48 -07:00
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
# OPTIMIZE FLAGS
Pulled in patches from Debian package.
2016-11-22 11:25:40 -08:00
# For distro disable custom build options that interfere with symbol generation
if test "$GCC" = "yes" && test "$ENABLED_DISTRO" = "no"
1.8.8 init
2011-02-05 11:14:47 -08:00
then
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AM_CFLAGS="$AM_CFLAGS -Wall -Wno-unused"
Brian's c++/clang fixes, minor adjustments
2012-10-22 11:37:46 -07:00
if test "$ax_enable_debug" = "no"
1.8.8 init
2011-02-05 11:14:47 -08:00
then
Configure Update Revise default compiler optimization flags enable name to something more descriptive.
2018-03-28 13:17:25 -07:00
AS_IF([test "x$ENABLED_OPTFLAGS" = "xyes"], [
1.8.8 init
2011-02-05 11:14:47 -08:00
if test "$ENABLED_FASTMATH" = "yes"
then
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AM_CFLAGS="$AM_CFLAGS $OPTIMIZE_FAST_CFLAGS"
1.8.8 init
2011-02-05 11:14:47 -08:00
if test "$ENABLED_FASTHUGEMATH" = "yes"
then
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AM_CFLAGS="$AM_CFLAGS $OPTIMIZE_HUGE_CFLAGS"
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
else
fixes for clang -Os on clang >= 12.0.0; fixes for bugs in blake2s.
2022-02-10 15:54:10 -06:00
if (test "$ENABLED_SP" = "yes" || test "$ENABLED_SP_MATH_ALL" = "yes") && test "$ENABLED_SP_SMALL" = "no"
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
then
AM_CFLAGS="$AM_CFLAGS $OPTIMIZE_FAST_CFLAGS"
if test "$ENABLED_FASTHUGEMATH" = "yes"
then
AM_CFLAGS="$AM_CFLAGS $OPTIMIZE_HUGE_CFLAGS"
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_INT_LARGE_COMBA"
fi
else
AM_CFLAGS="$AM_CFLAGS $OPTIMIZE_CFLAGS"
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
Configure Update Add a disable option to turn off the default optimization options so the user may set their own in a CFLAGS.
2018-03-27 16:41:39 -07:00
])
1.8.8 init
2011-02-05 11:14:47 -08:00
fi
fi
uses most recent version of cyassl
2014-07-10 11:18:49 -06:00
# ICC command line warning for non supported warning flags
if test "$CC" = "icc"
then
AM_CFLAGS="$AM_CFLAGS -wd10006"
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# Expose HAVE___UINT128_T to options flags"
if test "$ac_cv_type___uint128_t" = "yes"
then
Fixes for know wolfSSL build issues in the following cases: * Fixes for building wolfSSL from GitHub sources download, where .git does exist. The autogen.sh still needs to "touch" files for the build to work. * Fix for FIPS case where `wc_RsaSetRNG` is not available. * Added new `./configure --enable-usersettings` option to not populate the Makefile with build options and instead define `WOLFSSL_USER_SETTINGS` and expect a user provided `user_settings.h` file. * Fix for `HAVE___UINT128_T` to match config.h generated value to eliminate warning.
2019-04-30 11:45:48 -07:00
AM_CFLAGS="$AM_CFLAGS -DHAVE___UINT128_T=1"
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
fi
1.8.8 init
2011-02-05 11:14:47 -08:00
LIB_SOCKET_NSL
Update autoconf scripts 1. Add patch to AX_TLS to let it work with AC v2.63. 2. AX_TLS() call needs a no-op in the false case. 3. Move AX_HARDEN call back to its original position. 4. Print CC rather than CC_VERSION in configuration summary.
2014-02-17 15:33:07 -08:00
AX_HARDEN_CC_COMPILER_FLAGS
1.8.8 init
2011-02-05 11:14:47 -08:00
Cygwin/Mingw64 fixes
2013-05-01 14:17:11 -06:00
case $host_os in
MinGW fixes, server port assigning cleanup and ping test cleanup. Fixes issue with visibility detection with MinGW. The visibility.m4 script was not actually trying to call the hidden function, which caused MinGW to detect improperly that visibility was supported. Fix for bogusFile on Windows build. Fixes to build warnings for unused variable 'res' and signed/unsigned comparison for sizeof min(). Cleanup of the server side port assignment to allow use with Windows/MinGW/Cygwin. If Windows uses new GetRandomPort() function in test.h to get port in in the 49152 - 65535 range. If *nix then uses the tcp_listen returned port. Otherwise uses the default wolfSSLPort. Refactor of the ping test code to use common file and properly handle ping count differences (Windows "-c" vs. *Nix style "-n"). Workaround for MinGW and cyassl/options.h getting file permissions error. Added non-fatal compile warning if using MinGW that "strtok_s" might be missing along with a link to public domain source that can be used.
2016-04-01 15:45:53 -07:00
mingw*)
Add support for wolfSSL_CTX_load_system_CA_certs on Windows and Mac. Additionally, fix CMake build to add WOLFSSL_X86_64_BUILD when building for x86_64.
2022-10-03 07:40:10 -07:00
# if mingw then link to ws2_32 for sockets
static and shared library with MinGW
2016-04-15 16:04:15 -06:00
LDFLAGS="$LDFLAGS -lws2_32"
if test "$enable_shared" = "yes"
then
AC_DEFINE([WOLFSSL_DLL], [1], [Use __declspec(dllexport) when building library])
if test "$enable_static" = "yes"
then
MINGW_LIB_WARNING="yes"
fi
fi ;;
Add support for wolfSSL_CTX_load_system_CA_certs on Windows and Mac. Additionally, fix CMake build to add WOLFSSL_X86_64_BUILD when building for x86_64.
2022-10-03 07:40:10 -07:00
*darwin*)
# For Mac we need these frameworks to load system CA certs
LDFLAGS="$LDFLAGS -framework CoreFoundation -framework Security"
;;
Cygwin/Mingw64 fixes
2013-05-01 14:17:11 -06:00
esac
pk.c: rework Re-order RSA functions. Add comments to RSA functions. Rework RSA function implementations.
2022-05-27 16:30:59 +10:00
if test "$enable_shared" = "no"; then
if test "$enable_static" = "yes"; then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TEST_STATIC_BUILD"
fi
fi
configure.ac: check for incompatible combinations, and restore check for non-empty $KROOT when --enable-linuxkm.
2020-08-18 23:38:00 -05:00
if test "x$ENABLED_LINUXKM" = "xyes"; then
linuxkm: add autotools detection of usable compiler flags for enabling and disabling SIMD and fp registers and auto-vectorization, and integrate into linuxkm makefiles.
2020-09-01 14:40:53 -05:00
AX_SIMD_CC_COMPILER_FLAGS
AC_SUBST([CFLAGS_FPU_DISABLE])
AC_SUBST([CFLAGS_FPU_ENABLE])
AC_SUBST([CFLAGS_SIMD_DISABLE])
AC_SUBST([CFLAGS_SIMD_ENABLE])
AC_SUBST([CFLAGS_AUTO_VECTORIZE_DISABLE])
AC_SUBST([CFLAGS_AUTO_VECTORIZE_ENABLE])
linuxkm: add ASFLAGS_FPU_DISABLE_SIMD_ENABLE ASFLAGS_FPU_ENABLE_SIMD_DISABLE ASFLAGS_FPUSIMD_DISABLE ASFLAGS_FPUSIMD_ENABLE to facilitate erroring for unexpected fp/simd instructions in Kbuild, while allowing expected ones.
2020-09-08 23:09:34 -05:00
AC_SUBST([ASFLAGS_FPU_DISABLE_SIMD_ENABLE])
AC_SUBST([ASFLAGS_FPU_ENABLE_SIMD_DISABLE])
AC_SUBST([ASFLAGS_FPUSIMD_DISABLE])
AC_SUBST([ASFLAGS_FPUSIMD_ENABLE])
linuxkm: add autotools detection of usable compiler flags for enabling and disabling SIMD and fp registers and auto-vectorization, and integrate into linuxkm makefiles.
2020-09-01 14:40:53 -05:00
configure.ac: allow --enable-opensslextra with --enable-linuxkm if --enable-cryptonly is also given.
2022-07-20 18:21:29 -05:00
if test "$ENABLED_OPENSSLEXTRA" != "no" && test "$ENABLED_CRYPTONLY" = "no"; then
AC_MSG_ERROR([--enable-opensslextra without --enable-cryptonly is incompatible with --enable-linuxkm.])
linuxkm: add missing #ifdef OPENSSL_EXTRA around openssl includes in module_exports.c.template, and add an assert to configure.ac disallowing linuxkm+opensslextra.
2021-10-22 16:30:43 -05:00
fi
configure.ac: move AC_ARG_ENABLE([linuxkm] before AC_ARG_ENABLE([filesystem], and add ENABLED_FILESYSTEM_DEFAULT=no when ENABLED_LINUXKM.
2020-09-17 22:15:58 -05:00
if test "$ENABLED_FILESYSTEM" = "yes"; then
AC_MSG_ERROR([--enable-filesystem is incompatible with --enable-linuxkm.])
fi
configure.ac: check for incompatible combinations, and restore check for non-empty $KROOT when --enable-linuxkm.
2020-08-18 23:38:00 -05:00
if test "$ENABLED_AFALG" = "yes"; then
AC_MSG_ERROR([--enable-afalg is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_DEVCRYPTO" = "yes"; then
AC_MSG_ERROR([--enable-devcrypto is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_PKCS11" = "yes"; then
AC_MSG_ERROR([--enable-pkcs11 is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_JNI" = "yes"; then
AC_MSG_ERROR([--enable-jni is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_16BIT" = "yes"; then
AC_MSG_ERROR([--enable-16bit is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_SINGLETHREADED" = "yes"; then
AC_MSG_ERROR([--enable-singlethreaded is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_VALGRIND" = "yes"; then
AC_MSG_ERROR([--enable-valgrind is incompatible with --enable-linuxkm.])
fi
linuxkm: configure.ac more incompatible options: --enable-fastmath, --enable-iopool, and --enable-fips; linuxkm/Makefile: reduce -Wframe-larger-than from 65536 to kernel-compatible 5000; wolfssl/wolfcrypt/settings.h: unset HAVE_THREAD_LS when WOLFSSL_LINUXKM; wolfssl/wolfcrypt/types.h: when NO_INLINE and __GNUC__, #define WC_INLINE __attribute__((unused)) rather than to nothing to avoid -Wunused-function warnings; wolfssl/wolfcrypt/wc_port.h: #undef noinline after Linux kernel header includes (another macro conflict).
2020-08-20 11:42:34 -05:00
if test "$ENABLED_FASTMATH" = "yes"; then
configure.ac: tidying linuxkm reqs/exclusions tests at end.
2020-09-03 23:22:48 -05:00
AC_MSG_ERROR([--enable-fastmath is incompatible with --enable-linuxkm (exceeds stack limit).])
linuxkm: configure.ac more incompatible options: --enable-fastmath, --enable-iopool, and --enable-fips; linuxkm/Makefile: reduce -Wframe-larger-than from 65536 to kernel-compatible 5000; wolfssl/wolfcrypt/settings.h: unset HAVE_THREAD_LS when WOLFSSL_LINUXKM; wolfssl/wolfcrypt/types.h: when NO_INLINE and __GNUC__, #define WC_INLINE __attribute__((unused)) rather than to nothing to avoid -Wunused-function warnings; wolfssl/wolfcrypt/wc_port.h: #undef noinline after Linux kernel header includes (another macro conflict).
2020-08-20 11:42:34 -05:00
fi
configure.ac: for linuxkm, make --enable-sp-math the default, and add additional exclusions --enable-fastrsa and --with-libz.
2020-09-04 23:52:17 -05:00
if test "$ENABLED_FAST_RSA" = "yes"; then
AC_MSG_ERROR([--enable-fastrsa is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_LIBZ_RSA" = "yes"; then
AC_MSG_ERROR([--with-libz is incompatible with --enable-linuxkm.])
fi
linuxkm: configure.ac more incompatible options: --enable-fastmath, --enable-iopool, and --enable-fips; linuxkm/Makefile: reduce -Wframe-larger-than from 65536 to kernel-compatible 5000; wolfssl/wolfcrypt/settings.h: unset HAVE_THREAD_LS when WOLFSSL_LINUXKM; wolfssl/wolfcrypt/types.h: when NO_INLINE and __GNUC__, #define WC_INLINE __attribute__((unused)) rather than to nothing to avoid -Wunused-function warnings; wolfssl/wolfcrypt/wc_port.h: #undef noinline after Linux kernel header includes (another macro conflict).
2020-08-20 11:42:34 -05:00
if test "$ENABLED_IOPOOL" = "yes"; then
AC_MSG_ERROR([--enable-iopool is incompatible with --enable-linuxkm.])
fi
configure.ac: check for incompatible combinations, and restore check for non-empty $KROOT when --enable-linuxkm.
2020-08-18 23:38:00 -05:00
if test "$ENABLED_EXAMPLES" = "yes"; then
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
AC_MSG_ERROR([--enable-examples is incompatible with --enable-linuxkm.])
configure.ac: check for incompatible combinations, and restore check for non-empty $KROOT when --enable-linuxkm.
2020-08-18 23:38:00 -05:00
fi
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
if test "$ENABLED_SMALL_STACK" != "yes"; then
AC_MSG_ERROR([--enable-smallstack is required for --enable-linuxkm.])
fi
configure.ac fixes related to change in default math back end (to sp-math-all): wolfRand doesn't use fastmath; FIPS v5-dev follows the non-FIPS default (now sp-math-all); add -DWC_NO_CACHE_RESISTANT to AM_CFLAGS when $ENABLED_HARDEN != yes; add ENABLED_BIGNUM sensor and use it in linuxkm math back end assert; add configuration callout for "Side-channel Hardening" reporting value of $ENABLED_HARDEN.
2022-06-24 15:55:08 -05:00
if test "$ENABLED_SP_MATH" = "no" && test "$ENABLED_SP_MATH_ALL" = "no" && test "$ENABLED_BIGNUM" != "no"; then
configure.ac, wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_port.h: update linuxkm defaults and settings for compatibility with sp-math-all, and change linuxkm default math from sp-math to sp-math-all; refactor enable-all and enable-all-crypto logic to allow piecemeal exclusion of options from the command line.
2020-12-01 18:26:22 -06:00
AC_MSG_ERROR([--enable-sp-math or --enable-sp-math-all is required for --enable-linuxkm.])
configure.ac: --enable-linuxkm: improved defaults and consistency checking.
2020-08-20 15:41:18 -05:00
fi
add --enable-trackmemory=verbose, and add WOLFSSL_TEST_MAX_RELATIVE_HEAP_{BYTES,ALLOCS} and -m/-a (runtime counterparts) to wolfcrypt_test(). also add -h to wolfcrypt_test() to print available options.
2020-12-23 12:03:06 -06:00
if test "$ENABLED_STACKSIZE" != "no"; then
wolfssl/test.h: polish implementation of HAVE_STACK_SIZE_VERBOSE, now enabled with --enable-stacksize-verbose; internal symbol renamed from original DEBUG_STACK_SIZE_VERBOSE, helper functions and macros refactored to be formally threadsafe and to track the overall high water mark (reports same "stack used" value as --enable-stacksize after final return); add "setting stack relative offset reference mark in funcname() to x" message at entry; add configure mutexing of --enable-stacksize[-verbose] relative to --enable-linuxkm.
2020-09-02 14:20:51 -05:00
AC_MSG_ERROR([--enable-stacksize is incompatible with --enable-linuxkm.])
fi
if test "$ENABLED_STACKLOG" = "yes"; then
AC_MSG_ERROR([--enable-stacklog is incompatible with --enable-linuxkm.])
fi
configure.ac: --enable-compkey gates in the recursive do_mp_jacobi(). mutex with --enable-linuxkm.
2020-09-02 23:59:03 -05:00
if test "$ENABLED_COMPKEY" = "yes"; then
AC_MSG_ERROR([--enable-compkey is incompatible with --enable-linuxkm.])
fi
configure.ac: check for incompatible combinations, and restore check for non-empty $KROOT when --enable-linuxkm.
2020-08-18 23:38:00 -05:00
fi
Fixes to address build warnings for GCC 7. Used `-Wimplicit-fallthrough=0` to suppress all switch fall-through warnings.
2017-05-11 14:32:21 -07:00
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
# The following AM_CONDITIONAL statements set flags for use in the Makefiles.
# Some of these affect build targets and objects, some trigger different
# test scripts for make check.
AM_CONDITIONAL([BUILD_DISTRO],[test "x$ENABLED_DISTRO" = "xyes"])
AM_CONDITIONAL([BUILD_ALL],[test "x$ENABLED_ALL" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_TLS13],[test "x$ENABLED_TLS13" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_RNG],[test "x$ENABLED_RNG" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SCTP],[test "x$ENABLED_SCTP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
DTLS SRTP (RFC5764) support (adds `--enable-srtp`). Used with WebRTC to agree on profile for new real-time session keys.
2022-01-13 16:09:11 -08:00
AM_CONDITIONAL([BUILD_SRTP],[test "x$ENABLED_SRTP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_MCAST],[test "x$ENABLED_MCAST" = "xyes"])
AM_CONDITIONAL([BUILD_IPV6],[test "x$ENABLED_IPV6" = "xyes"])
AM_CONDITIONAL([BUILD_LEANPSK],[test "x$ENABLED_LEANPSK" = "xyes"])
AM_CONDITIONAL([BUILD_LEANTLS],[test "x$ENABLED_LEANTLS" = "xyes"])
AM_CONDITIONAL([BUILD_LOWMEM],[test "x$ENABLED_LOWRESOURCE" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_PKCALLBACKS], [ test "x$ENABLED_PKCALLBACKS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_CRYPTOAUTHLIB],[test "x$ENABLED_CRYPTOAUTHLIB" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_SNIFFER], [ test "x$ENABLED_SNIFFER" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SNIFFTEST],[ test "x$ENABLED_SNIFFTEST" = "xyes"])
AM_CONDITIONAL([BUILD_AESGCM],[test "x$ENABLED_AESGCM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_AESCCM],[test "x$ENABLED_AESCCM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_ARMASM],[test "x$ENABLED_ARMASM" = "xyes"])
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
AM_CONDITIONAL([BUILD_ARMASM_INLINE],[test "x$ENABLED_ARMASM_INLINE" = "xyes"])
ARM ASM: ARMv7a with NEON instructions Change to build assembly code for ARMv7a with NEON instruction set. ./configure -host=armv7a --enable-armasm Added ARM32 SHA-256 NEON only implementation.
2022-05-18 16:23:48 +10:00
AM_CONDITIONAL([BUILD_ARMASM_CRYPTO],[test "x$ENABLED_ARMASM_CRYPTO" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_XILINX],[test "x$ENABLED_XILINX" = "xyes"])
AM_CONDITIONAL([BUILD_AESNI],[test "x$ENABLED_AESNI" = "xyes"])
AM_CONDITIONAL([BUILD_INTELASM],[test "x$ENABLED_INTELASM" = "xyes"])
AES x86 ASM: new assembly Added new x86 assembly for AES. AES-CBC decrypt only 4 blocks at a time (not 6 or 8) due to reduces register count. GCM implementation for AVX2, AVX1 and AESNI only. Disabled looking for other assembly files for x86.
2022-09-30 16:19:40 +10:00
AM_CONDITIONAL([BUILD_X86_ASM],[test "x$ENABLED_X86_ASM" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_AFALG],[test "x$ENABLED_AFALG" = "xyes"])
KCAPI: add support for using libkcapi for crypto (Linux Kernel) RSA, DH and ECC not testable as no Linux Kernel driver to use. ECC implementation is customer specific.
2021-08-19 11:25:59 +10:00
AM_CONDITIONAL([BUILD_KCAPI],[test "x$ENABLED_KCAPI" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_DEVCRYPTO],[test "x$ENABLED_DEVCRYPTO" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_CAMELLIA],[test "x$ENABLED_CAMELLIA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_MD2],[test "x$ENABLED_MD2" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_RIPEMD],[test "x$ENABLED_RIPEMD" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_BLAKE2],[test "x$ENABLED_BLAKE2" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_BLAKE2S],[test "x$ENABLED_BLAKE2S" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SHA512],[test "x$ENABLED_SHA512" = "xyes" || test "x$ENABLED_SHA384" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_DSA],[test "x$ENABLED_DSA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Adds ECC non-blocking sign/verify support when used with SP math. New `--enable-sp=nonblock` and `--enable-ecc=nonblock` options. Example `./configure --enable-ecc=nonblock --enable-sp=yes,nonblock`.
2020-07-16 16:06:22 -07:00
AM_CONDITIONAL([BUILD_ECC],[test "x$ENABLED_ECC" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_ED25519],[test "x$ENABLED_ED25519" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fixes `--enable-usersettings` with SP ASM and ED/Curve25519 small `CURVED25519_SMALL`.
2022-06-02 13:10:18 -07:00
AM_CONDITIONAL([BUILD_ED25519_SMALL],[test "x$ENABLED_ED25519_SMALL" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_FEMATH], [test "x$ENABLED_FEMATH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_GEMATH], [test "x$ENABLED_GEMATH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_CURVE25519],[test "x$ENABLED_CURVE25519" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fixes `--enable-usersettings` with SP ASM and ED/Curve25519 small `CURVED25519_SMALL`.
2022-06-02 13:10:18 -07:00
AM_CONDITIONAL([BUILD_CURVE25519_SMALL],[test "x$ENABLED_CURVE25519_SMALL" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
AM_CONDITIONAL([BUILD_ED448],[test "x$ENABLED_ED448" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_ED448_SMALL],[test "x$ENABLED_ED448_SMALL" = "xyes"])
AM_CONDITIONAL([BUILD_FE448], [test "x$ENABLED_FE448" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_GE448], [test "x$ENABLED_GE448" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_CURVE448],[test "x$ENABLED_CURVE448" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_CURVE448_SMALL],[test "x$ENABLED_CURVE448_SMALL" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Kyber: Add option to build Kyber API wolfSSL Kyber implementation not included. Added tests and benchmarking.
2022-09-08 11:23:30 +10:00
AM_CONDITIONAL([BUILD_WC_KYBER],[test "x$ENABLED_WC_KYBER" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
AM_CONDITIONAL([BUILD_ECCSI],[test "x$ENABLED_ECCSI" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SAKKE],[test "x$ENABLED_SAKKE" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_MEMORY],[test "x$ENABLED_MEMORY" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_RSA],[test "x$ENABLED_RSA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
configure.ac: support --enable-dh=const, and link with libm ("LT_LIB_M") only if ENABLED_DH = yes.
2022-06-23 15:00:59 -05:00
AM_CONDITIONAL([BUILD_DH],[test "x$ENABLED_DH" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_ASN],[test "x$ENABLED_ASN" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_AES],[test "x$ENABLED_AES" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_CODING],[test "x$ENABLED_CODING" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_RC4],[test "x$ENABLED_ARC4" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_MD5],[test "x$ENABLED_MD5" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SHA],[test "x$ENABLED_SHA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_FIPS],[test "x$ENABLED_FIPS" = "xyes"])
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
AM_CONDITIONAL([BUILD_FIPS_V1],[test "$HAVE_FIPS_VERSION" = 1])
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
AM_CONDITIONAL([BUILD_FIPS_V2],[test "$HAVE_FIPS_VERSION" = 2 && test "$HAVE_FIPS_VERSION_MINOR" = 0])
AM_CONDITIONAL([BUILD_FIPS_RAND],[test "$HAVE_FIPS_VERSION" = 2 && test "$HAVE_FIPS_VERSION_MINOR" = 1])
configure.ac and wolfssl/wolfcrypt/asn_public.h: add --enable-fips=v5-RC8 for use with WCv5.0-RC8 codebase; add HAVE_FIPS_VERSION_MINOR, and refactor main $ENABLED_FIPS switch to set HAVE_FIPS_VERSION and if applicable HAVE_FIPS_VERSION_MINOR for use in subsequent tests and the main FIPS setup code; in asn_public.h, use HAVE_FIPS_VERSION_MINOR to exclude declaration of wc_RsaKeyToPublicDer() when building FIPS WCv5.0-RC8.
2021-09-27 18:07:37 -05:00
AM_CONDITIONAL([BUILD_FIPS_V5],[test "$HAVE_FIPS_VERSION" = 5])
AM_CONDITIONAL([BUILD_FIPS_CURRENT],[test "$HAVE_FIPS_VERSION" -ge 2 ])
Fix wolfRand Build 1. Remove the v3 FIPS build from configure and automake. This was for the old FIPS Ready build, which is now fixed to the certificate 3389 configuration. 2. Remove AES-GCM, PKCS12, and SHA-3 from wolfRand build. They were getting reenabled later in the configure.
2022-03-09 10:35:39 -08:00
# BUILD_FIPS_CURRENT is for builds after cert 2425.
Add SipHash algorithm
2022-01-14 13:56:23 +10:00
AM_CONDITIONAL([BUILD_SIPHASH],[test "x$ENABLED_SIPHASH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_CMAC],[test "x$ENABLED_CMAC" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_SELFTEST],[test "x$ENABLED_SELFTEST" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_SHA224],[test "x$ENABLED_SHA224" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fixes for `--enable-sha3` reproducibility with `small`. Fixes for shake256 typo and making sure `WOLFSSL_NO_SHAKE256` gets set when disabled. Replaces PR #4225.
2022-06-17 15:12:55 -07:00
AM_CONDITIONAL([BUILD_SHA3],[test "x$ENABLED_SHA3" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_POLY1305],[test "x$ENABLED_POLY1305" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Using `--enable-chacha=noasm` wouldn't actually enable chacha
2021-04-08 12:46:05 +02:00
AM_CONDITIONAL([BUILD_CHACHA],[test "x$ENABLED_CHACHA" = "xyes" || test "x$ENABLED_CHACHA" = "xnoasm" || test "x$ENABLED_USERSETTINGS" = "xyes"])
add wc_XChaCha_init(), wc_XChaCha20Poly1305_Init(), wc_XChaCha20Poly1305_encrypt_oneshot(), wc_XChaCha20Poly1305_decrypt_oneshot(), and wc_Poly1305_EncodeSizes64(). also, remove redundant arg check (typo) in wc_Poly1305Update().
2020-10-01 12:21:38 -05:00
AM_CONDITIONAL([BUILD_XCHACHA],[test "x$ENABLED_XCHACHA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_INLINE],[test "x$ENABLED_INLINE" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_OCSP],[test "x$ENABLED_OCSP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_OCSP_STAPLING],[test "x$ENABLED_CERTIFICATE_STATUS_REQUEST" = "xyes"])
AM_CONDITIONAL([BUILD_OCSP_STAPLING_V2],[test "x$ENABLED_CERTIFICATE_STATUS_REQUEST_V2" = "xyes"])
Improve CRL error codes. Add `--enable-crl=io` option. ZD 12791
2021-08-24 11:12:12 -07:00
AM_CONDITIONAL([BUILD_CRL],[test "x$ENABLED_CRL" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_CRL_MONITOR],[test "x$ENABLED_CRL_MONITOR" = "xyes"])
AM_CONDITIONAL([BUILD_USER_RSA],[test "x$ENABLED_USER_RSA" = "xyes"] )
AM_CONDITIONAL([BUILD_USER_CRYPTO],[test "x$ENABLED_USER_CRYPTO" = "xyes"])
liboqs integration using keyshare/supported_groups extensions in TLS 1.3
2021-04-28 10:28:35 -07:00
AM_CONDITIONAL([BUILD_LIBOQS],[test "x$ENABLED_LIBOQS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_WNR],[test "x$ENABLED_WNR" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_SRP],[test "x$ENABLED_SRP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([USE_VALGRIND],[test "x$ENABLED_VALGRIND" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_MD4],[test "x$ENABLED_MD4" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_PWDBASED],[test "x$ENABLED_PWDBASED" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SCRYPT],[test "x$ENABLED_SCRYPT" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
refactor some openssl extra functions for cryptonly use
2019-10-11 16:40:08 -06:00
AM_CONDITIONAL([BUILD_CRYPTONLY],[test "x$ENABLED_CRYPTONLY" = "xyes" && test "x$ENABLED_OPENSSLEXTRA" = "xno"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_FASTMATH],[test "x$ENABLED_FASTMATH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
AM_CONDITIONAL([BUILD_HEAPMATH],[test "x$ENABLED_HEAPMATH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_EXAMPLE_SERVERS],[test "x$ENABLED_EXAMPLES" = "xyes" && test "x$ENABLED_LEANTLS" = "xno"])
AM_CONDITIONAL([BUILD_EXAMPLE_CLIENTS],[test "x$ENABLED_EXAMPLES" = "xyes"])
configure.ac: define BUILD_TESTS as ENABLED_EXAMPLES, rather than ENABLED_EXAMPLES && !ENABLED_LEANTLS; add missing preprocessor gating in tests/api.c test_wolfSSL_EVP_Digest() and test_wolfSSL_i2d_PrivateKey().
2020-09-17 02:22:35 -05:00
AM_CONDITIONAL([BUILD_TESTS],[test "x$ENABLED_EXAMPLES" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_THREADED_EXAMPLES],[test "x$ENABLED_SINGLETHREADED" = "xno" && test "x$ENABLED_EXAMPLES" = "xyes" && test "x$ENABLED_LEANTLS" = "xno"])
AM_CONDITIONAL([BUILD_WOLFCRYPT_TESTS],[test "x$ENABLED_CRYPT_TESTS" = "xyes"])
Add support for libwolfcrypttest and libwolfcryptbench to autotools flow. These can be built by configuring with `--enable-crypttests-libs`.
2021-09-25 10:31:06 -07:00
AM_CONDITIONAL([BUILD_WOLFCRYPT_TESTS_LIBS],[test "x$ENABLED_CRYPT_TESTS_LIBS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_LIBZ],[test "x$ENABLED_LIBZ" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_PKCS11],[test "x$ENABLED_PKCS11" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_PKCS12],[test "x$ENABLED_PKCS12" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
AM_CONDITIONAL([BUILD_PKCS8],[test "x$ENABLED_PKCS8" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_CAVIUM],[test "x$ENABLED_CAVIUM" = "xyes"])
AM_CONDITIONAL([BUILD_CAVIUM_V],[test "x$ENABLED_CAVIUM_V" = "xyes"])
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
AM_CONDITIONAL([BUILD_OCTEON_SYNC],[test "x$ENABLED_OCTEON_SYNC" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_INTEL_QA],[test "x$ENABLED_INTEL_QA" = "xyes"])
Synchronous Quick Assist Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Refactor the IntelQA configure checks so they are usable by both the sync and async options. 3. Make a synchonous copy of the quickassist files. 4. Replace the printfs in the code with a logging macro. 5. Added padding to the AES_KEY structure for WOLF_CRYPTO_CB. 6. Tie in the crypto device to the sniffer. 7. When setting up the symmetric operation, add a build case for the sniffer to use malloc instead of realloc. Sniffer usually uses the middle of another buffer for the input data rather than the beginning of the buffer as it has the TCP/IP data to handle as well. 8. Add the raw key to the DES3 structure. 9. Copy the functions from qa_mem over to qa_sync.
2019-10-02 10:08:46 -07:00
AM_CONDITIONAL([BUILD_INTEL_QA_SYNC],[test "x$ENABLED_INTEL_QA_SYNC" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_SP],[test "x$ENABLED_SP" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
configure.ac: add whitespace separators to "((" groupings to mollify shellcheck SC1105 "Shells disambiguate (( differently or not at all. For subshell, add spaces around ( . For ((, fix parsing errors."
2022-05-19 18:19:11 -05:00
AM_CONDITIONAL([BUILD_SP_C32],[ ( ( (test "$ENABLED_SP_RSA" = "yes" || test "$ENABLED_SP_DH" = "yes" \
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
|| test "$ENABLED_SP_ECC" = "yes") && test "x$ENABLED_SP_ASM" = "xno") \
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
|| test "x$ENABLED_USERSETTINGS" = "xyes") && test "x$ENABLED_64BIT" != "xyes"])
configure.ac: add whitespace separators to "((" groupings to mollify shellcheck SC1105 "Shells disambiguate (( differently or not at all. For subshell, add spaces around ( . For ((, fix parsing errors."
2022-05-19 18:19:11 -05:00
AM_CONDITIONAL([BUILD_SP_C64],[ ( ( (test "$ENABLED_SP_RSA" = "yes" || test "$ENABLED_SP_DH" = "yes" \
miscellaneous buildability fixes: configure.ac: fix ed25519/sha512 dependency test to not misfire when ENABLED_32BIT; wolfssl/wolfcrypt/curve{25519,448}.h: fix redundant typedefs of curve{25519,448}_key (fixes -Wpedantic warnings); configure.ac: fix for "ISO C forbids an empty translation unit [-Werror=pedantic]", re wolfcrypt/src/sp_c{32,64}.c; configure.ac: fixes for --enable-32bit versus pedantic "ISO C forbids an empty translation unit", including explicit exclusion of 32bit-incompatible algorithms from enable-all and enable-all-crypto sets; tests/api.c: fixes for a couple inadequately gated SHA2 dependencies; tests/api.c:test_wolfSSL_set_alpn_protos(): fix prototype missing (void); wolfcrypt/src/misc.c and wolfssl/wolfcrypt/misc.h: fix ForceZero() definition and NO_INLINE prototype to not counterfactually constify the mem ptr, to avoid -Wmaybe-uninitialized from gcc11; wolfcrypt/src/des3.c: drop obsolete register qualifier from declaration in DesSetKey(), for c++17 compatibility; src/ssl.c:wolfSSL_BN_mod_word(): fix cast of arg2 to mp_mod_d().
2021-09-20 13:38:52 -05:00
|| test "$ENABLED_SP_ECC" = "yes") && test "x$ENABLED_SP_ASM" = "xno") \
SP C: when sp_c32.c ad sp_c64.c are included in build changed When compiling with the CFLAG -m32, sp_c32.c is used and not sp_c64.c. The build system cannot detect that this is a 32-bit platform and to use sp_c32.c. The SP code detects which implementaiton to use and sets defines that enable the code in sp_c32.c or sp_c64.c. ENABLED_64BIT, 64-bit platform, was on by default, which is not always true. By making ENABLED_64BIT not default then the decision of which SP C files to include in the build had to change to not being the other. That is, sp_c64.c is not included when the configuration line explicitly enables 32bit and sp_c32.c is not include when the configuration line explicitly enables 64bit.
2022-02-08 10:40:05 +10:00
|| test "x$ENABLED_USERSETTINGS" = "xyes") && test "x$ENABLED_32BIT" != "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_SP_ARM64],[test "x$ENABLED_SP_ARM64_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SP_ARM32],[test "x$ENABLED_SP_ARM32_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SP_ARM_THUMB],[test "x$ENABLED_SP_ARM_THUMB_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SP_ARM_CORTEX],[test "x$ENABLED_SP_ARM_CORTEX_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SP_X86_64],[test "x$ENABLED_SP_X86_64_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Implement all relevant mp functions in sp_int
2020-01-06 15:23:45 +10:00
AM_CONDITIONAL([BUILD_SP_INT],[test "x$ENABLED_SP_MATH" = "xyes" || test "x$ENABLED_SP_MATH_ALL" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_FAST_RSA],[test "x$ENABLED_FAST_RSA" = "xyes"])
AM_CONDITIONAL([BUILD_MCAPI],[test "x$ENABLED_MCAPI" = "xyes"])
AM_CONDITIONAL([BUILD_ASYNCCRYPT],[test "x$ENABLED_ASYNCCRYPT" = "xyes"])
AM_CONDITIONAL([BUILD_WOLFEVENT],[test "x$ENABLED_ASYNCCRYPT" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_CRYPTOCB],[test "x$ENABLED_CRYPTOCB" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_PSK],[test "x$ENABLED_PSK" = "xyes"])
Deprecate some configure flags 1. Add C_EXTRA_FLAGS and C_FLAGS to CFLAGS. 2. Remove the cached copied of C_EXTRA_FLAGS and C_FLAGS. 3. The option.h is set only on CFLAGS, CPPFLAGS, and the AM_ versions.
2020-01-22 14:26:16 -08:00
AM_CONDITIONAL([BUILD_TRUST_PEER_CERT],[test "x$ENABLED_TRUSTED_PEER_CERT" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
AM_CONDITIONAL([BUILD_PKI],[test "x$ENABLED_PKI" = "xyes"])
Fix to enable inclusion of all .c files when using the `--enable-usersettings` option.
2020-01-20 21:35:32 -08:00
AM_CONDITIONAL([BUILD_DES3],[test "x$ENABLED_DES3" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_PKCS7],[test "x$ENABLED_PKCS7" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Added support for reading S/MIME messages via SMIME_read_PKCS7.
2021-02-08 17:12:24 -07:00
AM_CONDITIONAL([BUILD_SMIME],[test "x$ENABLED_SMIME" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
Added `--enable-hashflags` option.
2019-08-27 13:28:33 -07:00
AM_CONDITIONAL([BUILD_HASHFLAGS],[test "x$ENABLED_HASHFLAGS" = "xyes"])
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
AM_CONDITIONAL([BUILD_CAAM],[test "x$ENABLED_CAAM" = "xyes" || test "x$ENABLED_CAAM" = "xqnx" || test "x$ENABLED_CAAM" = "xseco"])
add AM_CONDITIONAL([BUILD_DEBUG],...) to configure.ac, and use it to gate inclusion of wolfcrypt/src/debug.c in src/include.am; remove superfluous includes from wolfcrypt/src/debug.c.
2020-09-23 18:30:45 -05:00
AM_CONDITIONAL([BUILD_LINUXKM],[test "$ENABLED_LINUXKM" = "yes"])
AM_CONDITIONAL([BUILD_NO_LIBRARY],[test "$ENABLED_NO_LIBRARY" = "yes"])
linuxkm: add --enable-benchmark switch (default yes) and BUILD_BENCHMARK conditional to configure.ac to allow build with testwolfcrypt but without benchmark; change gate in wolfcrypt/benchmark/include.am from `if !BUILD_LINUXKM` to `if BUILD_BENCHMARK`.
2021-11-08 18:25:15 -06:00
AM_CONDITIONAL([BUILD_BENCHMARK],[test "$ENABLED_BENCHMARK" = "yes"])
wolfSSL RC2 template.
2020-09-18 17:04:26 -07:00
AM_CONDITIONAL([BUILD_RC2],[test "x$ENABLED_RC2" = "xyes"])
add caam header files to make install
2021-05-15 15:42:50 +07:00
AM_CONDITIONAL([BUILD_QNXCAAM],[test "x$ENABLED_CAAM" = "xqnx"])
Support for IoT-Safe with TLS demo
2021-07-26 19:38:46 +02:00
AM_CONDITIONAL([BUILD_IOTSAFE],[test "x$ENABLED_IOTSAFE" = "xyes"])
AM_CONDITIONAL([BUILD_IOTSAFE_HWRNG],[test "x$ENABLED_IOTSAFE_HWRNG" = "xyes"])
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
AM_CONDITIONAL([BUILD_SE050],[test "x$ENABLED_SE050" = "xyes"])
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
AM_CONDITIONAL([BUILD_KDF],[test "x$ENABLED_KDF" = "xyes"])
AM_CONDITIONAL([BUILD_HMAC],[test "x$ENABLED_HMAC" = "xyes"])
AM_CONDITIONAL([BUILD_ERROR_STRINGS],[test "x$ENABLED_ERROR_STRINGS" = "xyes"])
AM_CONDITIONAL([BUILD_DO178],[test "x$ENABLED_DO178" = "xyes"])
autoconf: add PSA options
2021-12-21 13:24:27 +01:00
AM_CONDITIONAL([BUILD_PSA],[test "x$ENABLED_PSA" = "xyes"])
dtls13: add autotools, cmake build options and vstudio paths
2022-05-20 09:59:23 +02:00
AM_CONDITIONAL([BUILD_DTLS13],[test "x$ENABLED_DTLS13" = "xyes"])
add QUIC support.
2022-08-08 13:24:00 +02:00
AM_CONDITIONAL([BUILD_QUIC],[test "x$ENABLED_QUIC" = "xyes"])
add initial support for ConnectionID DTLS extension
2022-08-10 16:39:44 +02:00
AM_CONDITIONAL([BUILD_DTLS_CID],[test "x$ENABLED_DTLS_CID" = "xyes"])
DTLS 1.2: Reset state when sending HelloVerifyRequest
2022-10-04 16:22:59 +02:00
AM_CONDITIONAL([BUILD_DTLS],[test "x$ENABLED_DTLS" = "xyes"])
Autoconf Update Consolidate all the AM_CONDITIONAL statements in one place in the configure process. This replaces the set of repeat checks of enable flags to conditionally check the AM_CONDITIONAL.
2019-06-20 13:37:53 -07:00
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
if test "$ENABLED_REPRODUCIBLE_BUILD" != "yes" &&
(test "$ax_enable_debug" = "yes" ||
add --enable-trackmemory=verbose, and add WOLFSSL_TEST_MAX_RELATIVE_HEAP_{BYTES,ALLOCS} and -m/-a (runtime counterparts) to wolfcrypt_test(). also add -h to wolfcrypt_test() to print available options.
2020-12-23 12:03:06 -06:00
test "$ENABLED_STACKSIZE" != "no" ||
configure.ac: remove smallstackcache from linuxkm default options; add several feature exclusions to enable-all and enable-all-crypto to make them compatible with fips=ready; render the FIPS option in the feature summary at end.
2020-11-26 00:19:35 -06:00
(test "$ENABLED_LEANTLS" = "no" &&
test "$ENABLED_LEANPSK" = "no" &&
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
test "$ENABLED_LOWRESOURCE" = "no"))
introspection tweaks: rename wolfcrypt/src/debug.c to wolfcrypt/src/wc_debug.c; restore BUILD_WC_DEBUG gating for autotools inclusion of wc_debug.o and disable opportunistically when ENABLED_LEANTLS, ENABLED_LEANPSK, or ENABLED_LOWRESOURCE; add HAVE_WC_INTROSPECTION gate for libwolfssl_configure_args() and libwolfssl_global_cflags().
2020-10-23 15:27:10 -05:00
then
don't include wolfssl/options.h in logging.c, use AM_CFLAGS (not wolfssl/options.h) to communicate HAVE_WC_INTROSPECTION to the compiler, and use config.h (not wolfssl/options.h) to communicate LIBWOLFSSL_CONFIGURE_ARGS and LIBWOLFSSL_GLOBAL_CFLAGS to the compiler (for logging.c).
2020-10-28 17:17:06 -05:00
AM_CFLAGS="$AM_CFLAGS -DHAVE_WC_INTROSPECTION"
introspection tweaks: rename wolfcrypt/src/debug.c to wolfcrypt/src/wc_debug.c; restore BUILD_WC_DEBUG gating for autotools inclusion of wc_debug.o and disable opportunistically when ENABLED_LEANTLS, ENABLED_LEANPSK, or ENABLED_LOWRESOURCE; add HAVE_WC_INTROSPECTION gate for libwolfssl_configure_args() and libwolfssl_global_cflags().
2020-10-23 15:27:10 -05:00
fi
fixes for issues identified by Jenkins run: Makefile.am: clean .build_params file; ecc.c: fix misplaced gat #endif in wc_ecc_shared_secret_gen_sync(); move AM_CFLAGS+=-include /.build_params to before AC_SUBST([]AM_CFLAGS); fix new unused-label defect in wc_ecc_shared_secret_gen_sync(); fix integer.[ch] mp_exch() to return int not void (sp_exch() and TFM mp_exch() can both fail on allocations); fix NO_INLINE ForceZero() prototype; ecc.c: add missing if (err == MP_OKAY) in build_lut(); wolfcrypt/test/test.c: revert "rename hkdf_test to wc_hkdf_test to eliminate namespace collision", restoring unconditional static qualifier, to fix crash at return from main() on Xilinx Zynq ARM test; ecc.c: refactor build_lut() flow control to fix uninited variable scenario found by scan-build; WOLFCRYPT_ONLY and OPENSSL_EXTRA: fix gating to allow successful build with --enable-all-crypto, and add configure error if crypt-only and opensslall are combined.
2021-08-31 22:59:57 -05:00
if test "$ENABLED_REPRODUCIBLE_BUILD" != "yes"
then
configure and cmake: Closing gap on options and output cmake: * 32-bit and 16-bit mode flags * Add 4bit to AESGCM * Add align data * Encrypted Keys option * PKC12 option * Header installation cleanup configure: * Add comment for `v5-RC9` * update CFLAGS to always be appended instead of mix of prepend and append * removed duplicate `ARC4` logic
2021-10-29 13:59:53 -07:00
AM_CFLAGS="$AM_CFLAGS -include ${output_objdir}/.build_params"
fixes for issues identified by Jenkins run: Makefile.am: clean .build_params file; ecc.c: fix misplaced gat #endif in wc_ecc_shared_secret_gen_sync(); move AM_CFLAGS+=-include /.build_params to before AC_SUBST([]AM_CFLAGS); fix new unused-label defect in wc_ecc_shared_secret_gen_sync(); fix integer.[ch] mp_exch() to return int not void (sp_exch() and TFM mp_exch() can both fail on allocations); fix NO_INLINE ForceZero() prototype; ecc.c: add missing if (err == MP_OKAY) in build_lut(); wolfcrypt/test/test.c: revert "rename hkdf_test to wc_hkdf_test to eliminate namespace collision", restoring unconditional static qualifier, to fix crash at return from main() on Xilinx Zynq ARM test; ecc.c: refactor build_lut() flow control to fix uninited variable scenario found by scan-build; WOLFCRYPT_ONLY and OPENSSL_EXTRA: fix gating to allow successful build with --enable-all-crypto, and add configure error if crypt-only and opensslall are combined.
2021-08-31 22:59:57 -05:00
fi
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
CREATE_HEX_VERSION
Brian changes
2012-10-24 11:53:33 -07:00
AC_SUBST([AM_CPPFLAGS])
AC_SUBST([AM_CFLAGS])
AC_SUBST([AM_LDFLAGS])
1. Add C NI-intrinsic AES-GCM encrypt and decrypt. 2. Fix error string for wolfcrypt test of GMAC. 3. Add AES-GCM Decrypt to benchmark.
2015-10-30 16:03:26 -07:00
AC_SUBST([AM_CCASFLAGS])
Add Intel IPP crypto for RSA add user-crypto makefile update README for IPP crypto place user crypto in wolfcrypt and use autotools adjust distributed files move openssl compatibility consumption auto use IPP RSA -- IPP directory containing shared libraries local return value of wolfSSL_BN and formating of debug openssh testing make sure IPP not built when fips is ipp init to select correct optimizations -- static libraries on linux -- fast-rsa disabled by default try to only set library once only use static IPP if fast rsa is enabled make print out for user crypto more pretty
2015-09-28 10:06:30 -06:00
AC_SUBST([LIB_ADD])
AC_SUBST([LIB_STATIC_ADD])
1.8.8 init
2011-02-05 11:14:47 -08:00
# FINAL
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
AC_CONFIG_FILES([stamp-h], [echo timestamp > stamp-h])
build: arbitrary path for `make check` To support builds in other directories, unit.test and wolfcrypt test must be aware of the source and build directory.
2021-02-05 10:40:31 -08:00
AC_CONFIG_FILES([Makefile
wolfssl/version.h
wolfssl/options.h
cyassl/options.h
support/wolfssl.pc
rpm/spec
wolfcrypt/test/test_paths.h
])
AC_CONFIG_FILES([scripts/unit.test],[chmod +x scripts/unit.test])
Brian Aker commits plus some minor changes like AM_CFLAGS getting AC_SUBST and --enable-xxx #ifdef to new header layout
2011-08-24 15:54:58 -07:00
This add the generic structure required to have pkgconfig work. I also fixed autogen.sh to do some magic on warnings/errors based on whether code comes from github or not.
2012-10-26 02:06:06 -04:00
AX_CREATE_GENERIC_CONFIG
turn jobserver back on
2012-10-26 15:38:37 -07:00
AX_AM_JOBSERVER([yes])
This dramatically speeds up the time taken to compile cyassl (assuming you have multiple cores...).
2012-10-26 00:35:52 -04:00
Fix for make distcheck, maintainer-clean, to allow distribution builds. This the second pass at this after seeing how fips is added to tree in later phases. This allow autoreconf to be directly called which allows the Makefile to rebuild when seeing that changes have been ( having an autogen.sh is older convention which left to history in the way autotools are invoked ) This fixes "make distcheck" and "make maintainer-clean" which are required by most distributions packaging systems. The files previously touched by autogen.sh are now properly placed into autoconf. The include files files are generated by configure. ( There is a note placed in configure.ac as to why and reference to the automake documention for this ). Append to file was done on purpose, touch cannot be in configure safetly. Normally autoheader would be used for this but since the include files are created out of tree, care has to be taken to not overwrite those file. For the source files, they were moved into the coresponding automake file. It is safe to use touch in automake. Since files can optionally copied from elsewhere, they have to be listed in BUILT_SOURCES. They are written srcdir in order to allow make to do VPATH builds ( which is configure by make distcheck ). To show fips files are preserved without having the actual fips files, a C style comment can be echoed into the files. There are a few current, but outstanding issues. 1) config.h needs to be fixed configure.ac to use autoheader in order to allow configure to know to rebuilt depencies on its changes. ( Out of scope for this patch. ) 2) verion.h checked into the tree and it is a built file. A make maintainer-clean followed by "git status --ignored" will confirm this. ( Out of scope for this patch ) 3) autogen.sh has not been updated to reflect fixes. I believe that for this patch, it should be left alone and checked for regression in Jenkins by itself. 4) There is an out of date .spec file for building RPM which should be updated now that distcheck is working. 5) maintainer-clean should have rule added to remove build-aux testdriver. This has been tested on current Ubuntu testing, OSX, Fedora 34, and Debian 10. Additionaly "make distcheck" should be added to regression testing, along with "make maintainer-check". Other improvement possibilities: A possible future improvement is to let autoconf handle build with optional out of dist files. Modify fips configure.ac check to allow for an injection of comments into blank fips files in order to prove distribution of fips/non-fips builds. Update git rules to use 'make maintainer-clean', 'autoreconf -if', 'make distcheck'.
2021-06-19 20:16:14 -07:00
# See Automake 9.4.1 Built Sources Example
AC_DEFUN([AX_OUT_OF_TREE_FILE],[
AC_CONFIG_COMMANDS([$1], [test ! -f $srcdir/$1 && >> $srcdir/$1])
])
AX_OUT_OF_TREE_FILE([wolfssl/wolfcrypt/async.h])
AX_OUT_OF_TREE_FILE([wolfssl/wolfcrypt/fips.h])
AX_OUT_OF_TREE_FILE([wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h])
AX_OUT_OF_TREE_FILE([wolfssl/wolfcrypt/port/intel/quickassist.h])
AX_OUT_OF_TREE_FILE([wolfssl/wolfcrypt/port/intel/quickassist_mem.h])
1.8.8 init
2011-02-05 11:14:47 -08:00
AC_OUTPUT
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
Allow disabling forced 'make clean' at the end of ./configure.
2022-03-02 13:20:22 -07:00
if test "$ENABLED_MAKECLEAN" = "yes"
then
# force make clean
AC_MSG_NOTICE([---])
AC_MSG_NOTICE([Running make clean...])
Allow overriding make command used for make clean with make.
2022-03-03 15:46:57 -07:00
if test -z "$MAKE"; then
MAKE="make"
fi
Allow disabling forced 'make clean' at the end of ./configure.
2022-03-02 13:20:22 -07:00
if test "$verbose" = "yes"; then
Allow overriding make command used for make clean with make.
2022-03-03 15:46:57 -07:00
$MAKE clean
Allow disabling forced 'make clean' at the end of ./configure.
2022-03-02 13:20:22 -07:00
else
Allow overriding make command used for make clean with make.
2022-03-03 15:46:57 -07:00
$MAKE clean >/dev/null
Allow disabling forced 'make clean' at the end of ./configure.
2022-03-02 13:20:22 -07:00
fi
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
fi
added configure option --disable-examples to remove example code build, configure runs make clean at the end, sniffer test isn't built if sniffer disabled
2012-11-29 11:31:57 -08:00
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
if test "$ENABLED_REPRODUCIBLE_BUILD" != "yes"
then
echo "#define LIBWOLFSSL_CONFIGURE_ARGS \"$ac_configure_args\"" > ${output_objdir}/.build_params &&
echo "#define LIBWOLFSSL_GLOBAL_CFLAGS \"$CPPFLAGS $AM_CPPFLAGS $CFLAGS $AM_CFLAGS\" LIBWOLFSSL_GLOBAL_EXTRA_CFLAGS" >> ${output_objdir}/.build_params ||
AC_MSG_ERROR([Couldn't create ${output_objdir}/.build_params.])
fi
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
# generate user options header
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
AC_MSG_NOTICE([---])
AC_MSG_NOTICE([Generating user options header...])
autoconf, libversioning, .gitignore updated
2014-12-31 14:06:01 -07:00
distribution fix
2015-01-05 16:58:28 -07:00
OPTION_FILE="wolfssl/options.h"
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
rm -f $OPTION_FILE
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
echo "/* wolfssl options.h" > $OPTION_FILE
make clear where options.h came from
2013-04-12 16:50:16 -07:00
echo " * generated from configure options" >> $OPTION_FILE
add wolfSSL header to configure generated options.h
2013-04-12 12:56:44 -07:00
echo " *" >> $OPTION_FILE
cert subset SHA2-256, ecc-256, cert gen, cryptocb
2022-01-05 11:06:25 -08:00
echo " * Copyright (C) 2006-2022 wolfSSL Inc." >> $OPTION_FILE
add wolfSSL header to configure generated options.h
2013-04-12 12:56:44 -07:00
echo " *" >> $OPTION_FILE
configure.ac updates
2014-12-31 13:04:03 -07:00
echo " * This file is part of wolfSSL. (formerly known as CyaSSL)" >> $OPTION_FILE
add wolfSSL header to configure generated options.h
2013-04-12 12:56:44 -07:00
echo " *" >> $OPTION_FILE
echo " */" >> $OPTION_FILE
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
echo "" >> $OPTION_FILE
switch pragma once uses, causes warnings on some compilers
2015-12-17 13:19:17 -07:00
echo "#ifndef WOLFSSL_OPTIONS_H" >> $OPTION_FILE
echo "#define WOLFSSL_OPTIONS_H" >> $OPTION_FILE
echo "" >> $OPTION_FILE
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
echo "" >> $OPTION_FILE
echo "#ifdef __cplusplus" >> $OPTION_FILE
echo "extern \"C\" {" >> $OPTION_FILE
echo "#endif" >> $OPTION_FILE
echo "" >> $OPTION_FILE
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
autotools/Makefiles: enable reproducible build by default for FIPS, and add -DHAVE_REPRODUCIBLE_BUILD to AM_CFLAGS; refactor the HAVE_WC_INTROSPECTION mechanism to pass build params via $output_objdir/.build_params rather than abusing autotools config.h to pass them; add support for EXTRA_CFLAGS on the make command line; in FIPS builds, exclude pkcallbacks from --enable-all; linuxkm: move test.o out of PIE container (uses function pointers as operands).
2021-08-27 23:03:14 -05:00
for option in $CPPFLAGS $AM_CPPFLAGS $CFLAGS $AM_CFLAGS $EXTRA_CFLAGS; do
RPM Fixes 1. Fixed a few parsing checks in the dates in the RPM changelog. 2. Moved some file names between sections in the include.am and spec.in files. 3. Added the match-start-of-line to the regex for finding the -D items for the options file.
2018-06-20 12:04:53 -07:00
defonly=`echo $option | sed 's/^-D//'`
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
if test "$defonly" != "$option"
then
change = to space for user options defines with = value
2013-05-29 15:03:27 -07:00
noequalsign=`echo $defonly | sed 's/=/ /'`
fix github issue #65, don't output (N)DEBUG to options.h
2015-04-13 12:01:21 -07:00
if test "$noequalsign" = "NDEBUG" || test "$noequalsign" = "DEBUG"
then
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
if test "$verbose" = "yes"; then
AC_MSG_NOTICE([not outputting (N)DEBUG to $OPTION_FILE])
fi
fix github issue #65, don't output (N)DEBUG to options.h
2015-04-13 12:01:21 -07:00
continue
fi
Configure Update 1. Fix typo. 2. Change the parsing of the -D options to be more POSIX friendly. Removed the "==" and replaced the multi escaped [] with a test command.
2018-07-10 17:30:47 -07:00
# allow user to ignore system options
Configure Fix 1. The check for options that start with an underscore to wrap them with another check was broken. Replaced with a use of grep. The old original version breaks on some shells.
2018-07-20 15:14:03 -07:00
ignoresys=$(echo "$noequalsign" | grep '^_.*')
if test -n "$ignoresys"
fix github issue #65, ignore sys options
2015-04-17 09:23:43 -07:00
then
echo "#ifndef WOLFSSL_OPTIONS_IGNORE_SYS" >> $OPTION_FILE
fi
fix github issue #65, don't undef with arg to options.h
2015-04-16 10:36:51 -07:00
noarg=`echo $defonly | sed 's/=.*//'`
fix github issue #65, ignore sys options
2015-04-17 09:23:43 -07:00
echo "#undef $noarg" >> $OPTION_FILE
echo "#define $noequalsign" >> $OPTION_FILE
Configure Fix 1. The check for options that start with an underscore to wrap them with another check was broken. Replaced with a use of grep. The old original version breaks on some shells.
2018-07-20 15:14:03 -07:00
if test -n "$ignoresys"
fix github issue #65, ignore sys options
2015-04-17 09:23:43 -07:00
then
echo "#endif" >> $OPTION_FILE
fi
echo "" >> $OPTION_FILE
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
else
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
if test "$verbose" = "yes"; then
AC_MSG_NOTICE([option w/o begin -D is $option, not saving to $OPTION_FILE])
fi
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
fi
done
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
echo "" >> $OPTION_FILE
echo "#ifdef __cplusplus" >> $OPTION_FILE
echo "}" >> $OPTION_FILE
echo "#endif" >> $OPTION_FILE
echo "" >> $OPTION_FILE
switch pragma once uses, causes warnings on some compilers
2015-12-17 13:19:17 -07:00
echo "" >> $OPTION_FILE
echo "#endif /* WOLFSSL_OPTIONS_H */" >> $OPTION_FILE
echo "" >> $OPTION_FILE
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
Fixes for building with IPV6. Added new WOLFSSL_IPV6 define to indicate IPV6 support. Fix to not include connect() and socket() calls unless HAVE_HTTP_CLIENT, HAVE_OCSP or HAVE_CRL_IO defined. Typo fixes.
2017-03-15 11:25:24 -07:00
#backwards compatibility for those who have included options or version
cyassl/options.h backwards compatibile
2015-01-07 14:30:02 -07:00
touch cyassl/options.h
echo "/* cyassl options.h" > cyassl/options.h
echo " * generated from wolfssl/options.h" >> cyassl/options.h
return line options.h being read literally by debian, fixed
2015-02-11 14:10:06 -07:00
echo " */" >> cyassl/options.h
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
cyassl/options.h backwards compatibile
2015-01-07 14:30:02 -07:00
while read -r line
do
echo "$line" >> cyassl/options.h
done < $OPTION_FILE
switch pragma once uses, causes warnings on some compilers
2015-12-17 13:19:17 -07:00
# switch ifdef protection in cyassl/option.h to CYASSL_OPTONS_H, remove bak
sed -i.bak 's/WOLFSSL_OPTIONS_H/CYASSL_OPTIONS_H/g' cyassl/options.h
MinGW fixes, server port assigning cleanup and ping test cleanup. Fixes issue with visibility detection with MinGW. The visibility.m4 script was not actually trying to call the hidden function, which caused MinGW to detect improperly that visibility was supported. Fix for bogusFile on Windows build. Fixes to build warnings for unused variable 'res' and signed/unsigned comparison for sizeof min(). Cleanup of the server side port assignment to allow use with Windows/MinGW/Cygwin. If Windows uses new GetRandomPort() function in test.h to get port in in the 49152 - 65535 range. If *nix then uses the tcp_listen returned port. Otherwise uses the default wolfSSLPort. Refactor of the ping test code to use common file and properly handle ping count differences (Windows "-c" vs. *Nix style "-n"). Workaround for MinGW and cyassl/options.h getting file permissions error. Added non-fatal compile warning if using MinGW that "strtok_s" might be missing along with a link to public domain source that can be used.
2016-04-01 15:45:53 -07:00
# workaround for mingw sed that may get "Permission denied" trying to preserver permissions
case $host_os in
mingw*)
chmod u+w cyassl/options.h ;;
esac
switch pragma once uses, causes warnings on some compilers
2015-12-17 13:19:17 -07:00
rm cyassl/options.h.bak
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
if test "$silent" != "yes"; then
MinGW fixes, server port assigning cleanup and ping test cleanup. Fixes issue with visibility detection with MinGW. The visibility.m4 script was not actually trying to call the hidden function, which caused MinGW to detect improperly that visibility was supported. Fix for bogusFile on Windows build. Fixes to build warnings for unused variable 'res' and signed/unsigned comparison for sizeof min(). Cleanup of the server side port assignment to allow use with Windows/MinGW/Cygwin. If Windows uses new GetRandomPort() function in test.h to get port in in the 49152 - 65535 range. If *nix then uses the tcp_listen returned port. Otherwise uses the default wolfSSLPort. Refactor of the ping test code to use common file and properly handle ping count differences (Windows "-c" vs. *Nix style "-n"). Workaround for MinGW and cyassl/options.h getting file permissions error. Added non-fatal compile warning if using MinGW that "strtok_s" might be missing along with a link to public domain source that can be used.
2016-04-01 15:45:53 -07:00
generate cyassl/options.h based on ./configure flags/settings for user app use
2013-04-12 11:21:38 -07:00
# output config summary
This adds more compiler hardening flags (and fixes all of the issues found in the process).
2012-09-19 23:38:41 -07:00
echo "---"
echo "Configuration summary for $PACKAGE_NAME version $VERSION"
echo ""
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Installation prefix: $prefix"
echo " * System type: $host_vendor-$host_os"
echo " * Host CPU: $host_cpu"
echo " * C Compiler: $CC"
echo " * C Flags: $CFLAGS"
echo " * C++ Compiler: $CXX"
echo " * C++ Flags: $CXXFLAGS"
echo " * CPP Flags: $CPPFLAGS"
echo " * CCAS Flags: $CCASFLAGS"
echo " * LIB Flags: $LIB"
add AM_CONDITIONAL([BUILD_DEBUG],...) to configure.ac, and use it to gate inclusion of wolfcrypt/src/debug.c in src/include.am; remove superfluous includes from wolfcrypt/src/debug.c.
2020-09-23 18:30:45 -05:00
linuxkm: add autotools detection of usable compiler flags for enabling and disabling SIMD and fp registers and auto-vectorization, and integrate into linuxkm makefiles.
2020-09-01 14:40:53 -05:00
test "$ENABLED_LINUXKM" = "yes" && \
echo " * Linux Kernel Build Root: $KERNEL_ROOT" && \
echo " * Linux Kernel Build Arch: $KERNEL_ARCH" && \
echo " * fpu disable C flags: $CFLAGS_FPU_DISABLE" && \
echo " * fpu enable C flags: $CFLAGS_FPU_ENABLE" && \
echo " * SIMD disable C flags: $CFLAGS_SIMD_DISABLE" && \
echo " * SIMD enable C flags: $CFLAGS_SIMD_ENABLE" && \
echo " * No-auto-vectorize C flags: $CFLAGS_AUTO_VECTORIZE_DISABLE" && \
linuxkm: add ASFLAGS_FPU_DISABLE_SIMD_ENABLE ASFLAGS_FPU_ENABLE_SIMD_DISABLE ASFLAGS_FPUSIMD_DISABLE ASFLAGS_FPUSIMD_ENABLE to facilitate erroring for unexpected fp/simd instructions in Kbuild, while allowing expected ones.
2020-09-08 23:09:34 -05:00
echo " * Auto-vectorize C flags: $CFLAGS_AUTO_VECTORIZE_ENABLE" && \
echo " * SIMD enable as flags: $ASFLAGS_FPU_DISABLE_SIMD_ENABLE" && \
echo " * FPU enable as flags: $ASFLAGS_FPU_ENABLE_SIMD_DISABLE" && \
echo " * SIMD+FPU disable as flags: $ASFLAGS_FPUSIMD_DISABLE" && \
--enable-linuxkm-pie (FIPS Linux kernel module) (#4276) * Adds `--enable-linuxkm-pie` and associated infrastructure, to support FIPS mode in the Linux kernel module. * Adds `tests/api.c` missing (void) arglist to `test_SSL_CIPHER_get_xxx()`.
2021-08-19 11:15:52 -05:00
echo " * SIMD+FPU enable as flags: $ASFLAGS_FPUSIMD_ENABLE" && \
echo " * Linux kernel module PIE: $ENABLED_LINUXKM_PIE"
add AM_CONDITIONAL([BUILD_DEBUG],...) to configure.ac, and use it to gate inclusion of wolfcrypt/src/debug.c in src/include.am; remove superfluous includes from wolfcrypt/src/debug.c.
2020-09-23 18:30:45 -05:00
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Debug enabled: $ax_enable_debug"
Single Precision maths for RSA (and DH) Single Precision ECC implementation
2017-08-10 17:27:22 +10:00
echo " * Coverage enabled: $ax_enable_coverage"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Warnings as failure: $ac_cv_warnings_as_errors"
echo " * make -j: $enable_jobserver"
echo " * VCS checkout: $ac_cv_vcs_checkout"
Merge branch 'master' of https://github.com/wolfSSL/wolfssl
2015-08-13 10:20:47 +02:00
echo
Fixes for hardening flags. Additional fixes for using C++ compiler to compile. Include file pcap.h now gates sniffer for build.
2012-10-19 22:00:17 -04:00
echo " Features "
configure.ac: remove smallstackcache from linuxkm default options; add several feature exclusions to enable-all and enable-all-crypto to make them compatible with fips=ready; render the FIPS option in the feature summary at end.
2020-11-26 00:19:35 -06:00
if test "$ENABLED_FIPS" = "yes"; then
echo " * FIPS: $FIPS_VERSION"
else
echo " * FIPS: $ENABLED_FIPS"
fi
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Single threaded: $ENABLED_SINGLETHREADED"
echo " * Filesystem: $ENABLED_FILESYSTEM"
echo " * OpenSSH Build: $ENABLED_OPENSSH"
echo " * OpenSSL Extra API: $ENABLED_OPENSSLEXTRA"
Added new `--disable-oldnames` option to allow for using openssl along-side wolfssl headers (without OPENSSL_EXTRA). Add `--enable-opensslcoexist` which makes sure `oldnames` is disabled. Refactor of `SSL_` to `WOLF_SSL_`. Refactor of `SHA`, `MD5`, `SHA224`, `SHA256`, `SHA512` and `SHA384` to `WC_` naming.
2017-09-25 18:47:36 -07:00
echo " * OpenSSL Coexist: $ENABLED_OPENSSLCOEXIST"
echo " * Old Names: $ENABLED_OLDNAMES"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Max Strength Build: $ENABLED_MAXSTRENGTH"
add distro build option
2016-08-22 10:00:37 -06:00
echo " * Distro Build: $ENABLED_DISTRO"
configure.ac: add --enable-reproducible-build: put ar and ranlib in deterministic mode, and leave LIBWOLFSSL_CONFIGURE_ARGS and LIBWOLFSSL_GLOBAL_CFLAGS out of the generated config.h. relates to PR #3417 .
2021-02-11 00:12:05 -06:00
echo " * Reproducible Build: $ENABLED_REPRODUCIBLE_BUILD"
configure.ac fixes related to change in default math back end (to sp-math-all): wolfRand doesn't use fastmath; FIPS v5-dev follows the non-FIPS default (now sp-math-all); add -DWC_NO_CACHE_RESISTANT to AM_CFLAGS when $ENABLED_HARDEN != yes; add ENABLED_BIGNUM sensor and use it in linuxkm math back end assert; add configuration callout for "Side-channel Hardening" reporting value of $ENABLED_HARDEN.
2022-06-24 15:55:08 -05:00
echo " * Side-channel Hardening: $ENABLED_HARDEN"
Enable wolfSSL SP Math all (sp_int.c) by default. If `--enable-fastmath` or `USE_FAST_MATH` is set the older `tfm.c` fast math will be used. To use the old `integer.c` heap math use `--enable-heapmath` or `USE_INTEGER_HEAP_MATH`.
2022-01-14 14:02:55 -08:00
echo " * Single Precision Math: $ENABLED_SP"
if test "$ENABLED_SP_MATH_ALL" != "no"
then
ENABLED_SP_MATH_DESC="all"
else
if test "$ENABLED_SP_MATH" != "no"
then
ENABLED_SP_MATH_DESC="restricted"
else
ENABLED_SP_MATH_DESC="no"
fi
fi
echo " * SP implementation: $ENABLED_SP_MATH_DESC"
echo " * Fast Math: $ENABLED_FASTMATH"
echo " * Heap Math: $ENABLED_HEAPMATH"
Added ability to force 32-bit mode using `--enable-32bit`. Added ability to disable all inline asembly using `--disable-asm`. Added check for `__EMSCRIPTEN__` define in types.h to properly setup 64-bit type. Fixes for build combinations with SHA512 and CHACHA20.
2017-11-06 14:37:34 -08:00
echo " * Assembly Allowed: $ENABLED_ASM"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * sniffer: $ENABLED_SNIFFER"
echo " * snifftest: $ENABLED_SNIFFTEST"
echo " * ARC4: $ENABLED_ARC4"
echo " * AES: $ENABLED_AES"
echo " * AES-NI: $ENABLED_AESNI"
Config option to disable AES-CBC AEAD only detection and removeal of code. Also in single threaded builds, reference the ctx suites in ssl object if it exists.
2018-07-25 11:22:48 +10:00
echo " * AES-CBC: $ENABLED_AESCBC"
configure.ac: add --enable-aescbc-length-checks and add it to --enable-all; api.c: fix expected error code in WOLFSSL_AES_CBC_LENGTH_CHECKS path of test_wc_AesCbcEncryptDecrypt(); aes.c: add explanatory comment on WOLFSSL_AES_CBC_LENGTH_CHECKS to top of file.
2021-03-26 14:04:25 -05:00
echo " * AES-CBC length checks: $ENABLED_AESCBC_LENGTH_CHECKS"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * AES-GCM: $ENABLED_AESGCM"
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
echo " * AES-GCM streaming: $ENABLED_AESGCM_STREAM"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * AES-CCM: $ENABLED_AESCCM"
Adds an --enable-aesctr flag to the configure script to explicitly compile with -DWOLFSSL_AES_COUNTER and -DWOLFSSL_AES_DIRECT If --enable-fortress or --enable-mcapi are used they effectively force --enable-aesctr
2016-12-04 15:23:51 +01:00
echo " * AES-CTR: $ENABLED_AESCTR"
Added helper configure option '--enable-wolftpm` to enable options used by wolfTPM. This enables (cert gen/req/ext, pkcs7, cryptocb and aes-cfb).
2020-12-23 08:09:24 -08:00
echo " * AES-CFB: $ENABLED_AESCFB"
wolfcrypt: smallstack refactors of AES code for lkm compatibility with --enable-aesgcm=table.
2021-01-28 22:51:28 -06:00
echo " * AES-OFB: $ENABLED_AESOFB"
Add AES-SIV (RFC 5297). This commit adds functions to encrypt and decrypt data using AES in SIV mode, as described in RFC 5297. This was added in the process of porting chrony to wolfSSL. chrony is an NTP implementation that can use NTS (network time security), which requires AES-SIV.
2022-01-14 16:52:03 -08:00
echo " * AES-SIV: $ENABLED_AESSIV"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * DES3: $ENABLED_DES3"
echo " * Camellia: $ENABLED_CAMELLIA"
echo " * NULL Cipher: $ENABLED_NULL_CIPHER"
misc fixes for coverage and buildability: add MD2 to --enable-all*; fix spelling of "Sno" to "no" for $ENABLED_BLAKE2S default; when ENABLED_QSH add -DWOLFSSL_STATIC_DH -DWOLFSSL_STATIC_PSK (relates to ZD11073); add missing gating for !defined(WOLFSSL_DEVCRYPTO) in api.c:test_wc_Sha256FinalRaw(); fix tests/api.c:IsValidCipherSuite() to build under gcc10 (relates to ZD11073).
2020-10-15 15:05:29 -05:00
echo " * MD2: $ENABLED_MD2"
echo " * MD4: $ENABLED_MD4"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * MD5: $ENABLED_MD5"
echo " * RIPEMD: $ENABLED_RIPEMD"
echo " * SHA: $ENABLED_SHA"
SHA224 implementation added Added SHA24 implementation and tetss. Added HMAC-SHA224 implementation and tests. Added RSA-SHA224 and ECDSA-SHA224. Added MGF1-SHA224 Added OpenSSL APIs for SHA224 Configuration option to enable SHA224 and it is on by default for x86_64
2016-11-10 15:52:26 +10:00
echo " * SHA-224: $ENABLED_SHA224"
Allow SHA384 to be compiled in without SHA512
2018-07-20 09:42:01 +10:00
echo " * SHA-384: $ENABLED_SHA384"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * SHA-512: $ENABLED_SHA512"
Initial revision of SHA-3
2017-05-23 13:50:49 +10:00
echo " * SHA3: $ENABLED_SHA3"
SHA-3 improvements Add x86_64 assembly code: - BMI2 - AVX2 (using ymm, slower than BMI2) - AVX2 of 4 similtaneous hashes Add SHAKE128 functions and tests. Add Absorb and Squeeze functions for SHAKE128 and SHAK256 and tests. Add doxygen for SHA-3 and SHAKE functions. Update other generated x86_64 assembly files to include settings.h.
2022-09-01 15:07:15 +10:00
echo " * SHAKE128: $ENABLED_SHAKE128"
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
echo " * SHAKE256: $ENABLED_SHAKE256"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * BLAKE2: $ENABLED_BLAKE2"
add wc_XChaCha_init(), wc_XChaCha20Poly1305_Init(), wc_XChaCha20Poly1305_encrypt_oneshot(), wc_XChaCha20Poly1305_decrypt_oneshot(), and wc_Poly1305_EncodeSizes64(). also, remove redundant arg check (typo) in wc_Poly1305Update().
2020-10-01 12:21:38 -05:00
echo " * BLAKE2S: $ENABLED_BLAKE2S"
Add SipHash algorithm
2022-01-14 13:56:23 +10:00
echo " * SipHash: $ENABLED_SIPHASH"
add AES-CMAC
2016-05-23 17:50:36 -07:00
echo " * CMAC: $ENABLED_CMAC"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * keygen: $ENABLED_KEYGEN"
echo " * certgen: $ENABLED_CERTGEN"
echo " * certreq: $ENABLED_CERTREQ"
echo " * certext: $ENABLED_CERTEXT"
Decoded cert cache feature
2019-02-28 15:07:38 -06:00
echo " * certgencache: $ENABLED_certgencache"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * CHACHA: $ENABLED_CHACHA"
add wc_XChaCha_init(), wc_XChaCha20Poly1305_Init(), wc_XChaCha20Poly1305_encrypt_oneshot(), wc_XChaCha20Poly1305_decrypt_oneshot(), and wc_Poly1305_EncodeSizes64(). also, remove redundant arg check (typo) in wc_Poly1305Update().
2020-10-01 12:21:38 -05:00
echo " * XCHACHA: $ENABLED_XCHACHA"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Hash DRBG: $ENABLED_HASHDRBG"
echo " * PWDBASED: $ENABLED_PWDBASED"
Implementation of scrypt Tests and benchmarking added. Configure with --enable-scrypt and requires --enable-pwdbased
2016-12-14 16:47:54 +10:00
echo " * scrypt: $ENABLED_SCRYPT"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * wolfCrypt Only: $ENABLED_CRYPTONLY"
echo " * HKDF: $ENABLED_HKDF"
add ANSI-X9.63-KDF support [SEC1]
2016-12-07 20:09:54 -07:00
echo " * X9.63 KDF: $ENABLED_X963KDF"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * MD4: $ENABLED_MD4"
echo " * PSK: $ENABLED_PSK"
echo " * Poly1305: $ENABLED_POLY1305"
echo " * LEANPSK: $ENABLED_LEANPSK"
LeanTLS: Fixed issue with GetCA, GetCAByName and PickHashSigAlgo with HAVE_ECC, NO_RSA and NO_CERTS defined. Added new "--enable-leantls" option, which enables TLS 1.2 client only with ECC256, AES128 and SHA256 (no RSA, DH, DSA, MD4, MD5, SHA, PSK, PWD, CERTS, DES3, Error Strings, ARC4, Coding, Memory or File System).
2016-02-12 14:30:26 -08:00
echo " * LEANTLS: $ENABLED_LEANTLS"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * RSA: $ENABLED_RSA"
TLS v1.2 and PSS Cleanup the TLS v1.3 PSS code as well. Added RSA API wc_RsaPSS_CheckPadding() to check the padding - no longer a simple memcmp with the digest.
2017-05-18 15:32:06 +10:00
echo " * RSA-PSS: $ENABLED_RSAPSS"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * DSA: $ENABLED_DSA"
echo " * DH: $ENABLED_DH"
Add Qt 5.12 and 5.13 support Co-Authored-By: aaronjense <aaron@wolfssl.com> Co-Authored-By: MJSPollard <mpollard@wolfssl.com> Co-Authored-By: Quinn Miller <quinnmiller1997@users.noreply.github.com> Co-Authored-By: Tim Parrish <timparrish@users.noreply.github.com>
2019-12-06 14:27:01 -07:00
echo " * DH Default Parameters: $ENABLED_DHDEFAULTPARAMS"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * ECC: $ENABLED_ECC"
initial implementation of WOLFSSL_NETWORK_INTROSPECTION: --enable-network-introspection, struct wolfSSL_network_connection, wolfSSL_*_endpoints*(), NetworkFilterCallback_t, wolfSSL_*set_AcceptFilter().
2021-03-17 22:49:07 -05:00
echo " * ECC Custom Curves: $ENABLED_ECCCUSTCURVES"
echo " * ECC Minimum Bits: $ENABLED_ECCMINSZ"
Kyber: Add option to build Kyber API wolfSSL Kyber implementation not included. Added tests and benchmarking.
2022-09-08 11:23:30 +10:00
echo " * FPECC: $ENABLED_FPECC"
echo " * ECC_ENCRYPT: $ENABLED_ECC_ENCRYPT"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * CURVE25519: $ENABLED_CURVE25519"
echo " * ED25519: $ENABLED_ED25519"
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
echo " * ED25519 streaming: $ENABLED_ED25519_STREAM"
Add Curve448, X448, Ed448 implementations
2020-02-19 18:07:45 +10:00
echo " * CURVE448: $ENABLED_CURVE448"
echo " * ED448: $ENABLED_ED448"
ED: add --enable-ed25519-stream and --enable-ed448-stream to configure.ac, disabled by default, and add them to --enable-all and --enable-all-crypto lists, along with --enable-aesgcm-stream; report AES-GCM and ED* streaming API options in feature summary rendered at end; refactor ED routines to pivot on WOLFSSL_ED*_PERSISTENT_SHA and WOLFSSL_ED*_STREAMING_VERIFY macros, with sha state in the key struct only when WOLFSSL_ED*_PERSISTENT_SHA, otherwise on the stack as before; add ed*_hash_init() and ed*_hash_free() local helpers; ED* peer review: fix line lengths, remove superfluous retval checks, tweaks for efficiency, and add ED448_PREHASH_SIZE to ed448.h.
2021-07-14 15:32:33 -05:00
echo " * ED448 streaming: $ENABLED_ED448_STREAM"
Kyber: Add option to build Kyber API wolfSSL Kyber implementation not included. Added tests and benchmarking.
2022-09-08 11:23:30 +10:00
echo " * KYBER: $ENABLED_KYBER"
echo " * KYBER wolfSSL impl: $ENABLED_WC_KYBER"
ECCSI and SAKKE: add support Fixes for static code analysis included. Added const to function parameters. Zeroise some temporaries.
2021-01-12 12:25:52 +10:00
echo " * ECCSI $ENABLED_ECCSI"
echo " * SAKKE $ENABLED_SAKKE"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * ASN: $ENABLED_ASN"
echo " * Anonymous cipher: $ENABLED_ANON"
echo " * CODING: $ENABLED_CODING"
echo " * MEMORY: $ENABLED_MEMORY"
echo " * I/O POOL: $ENABLED_IOPOOL"
checkpoint: fully functioning demo via examples/server/ and unit.test (which produces a "filtered" error on a subtest when built --enable-wolfsentry).
2021-04-01 13:08:41 -05:00
echo " * wolfSentry: $ENABLED_WOLFSENTRY"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * LIGHTY: $ENABLED_LIGHTY"
configure.ac: add ENABLED_WPAS to the config summary.
2022-01-07 21:36:24 -06:00
echo " * WPA Supplicant: $ENABLED_WPAS"
Introduce HAPROXY config flag + get/set app_data
2017-03-28 13:28:36 +02:00
echo " * HAPROXY: $ENABLED_HAPROXY"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * STUNNEL: $ENABLED_STUNNEL"
Add support for tcpdump with wolfSSL.
2021-07-09 12:04:40 -07:00
echo " * tcpdump: $ENABLED_TCPDUMP"
Add support for libssh2.
2021-07-30 13:37:31 -07:00
echo " * libssh2: $ENABLED_LIBSSH2"
Make changes to support port of NTP from OpenSSL to wolfSSL.
2021-07-26 10:05:13 -07:00
echo " * ntp: $ENABLED_NTP"
Add support for rsyslog. - Add an --enable-rsyslog option to configure.ac. - Add a few missing `WOLFSSL_ERROR` calls that were expected by rsyslog unit tests. - Add better documentation around `WOLFSSL_SHUTDOWN_NOT_DONE` and define it to be 0 (rather than 2) when `WOLFSSL_ERROR_CODE_OPENSSL` is defined. This is in accordance with OpenSSL documentation. Without this change, rsyslog was failing to do the bidirectional shutdown properly because it was checking the shutdown return value against 0. I'm keeping the old value when `WOLFSSL_ERROR_CODE_OPENSSL` isn't defined because it's part of the public wolfssl interface (it's in ssl.h).
2021-08-12 09:50:06 -07:00
echo " * rsyslog: $ENABLED_RSYSLOG"
Add Apache HTTP Server compatibility and --enable-apachehttpd option (#2466) * Added Apache httpd support `--enable-apachehttpd`. * Added `SSL_CIPHER_get_version`, `BIO_new_fp`, `SSL_SESSION_print` and `SSL_in_connect_init` compatibility API's. * Fix to expose `ASN1_UTCTIME_print` stub. * Pulled in `wolfSSL_X509_get_ext_count` from QT. * Added `X509_get_ext_count`, `BIO_set_callback`, `BIO_set_callback_arg` and `BIO_get_callback_arg`. * Added `wolfSSL_ERR_print_errors`. * Added `BIO_set_nbio` template. * Fixes for building with Apache httpd. * Added DH prime functions required for Apache httpd. * Fix and move the BN DH prime macros. * Fix for `SSL_CTX_set_tlsext_servername_arg` to have return code. * Only add the `BN_get_rfc*_prime_*` macro's if older than 1.1.0. * Added `ERR_GET_FUNC`, `SSL_CTX_clear_extra_chain_certs` prototypes. * Added `wolfSSL_CTX_set_client_cert_cb` template and `OPENSSL_load_builtin_modules` stub macro. * Added `X509_INFO` templates (`X509_INFO_new`, `X509_INFO_free`, `sk_X509_INFO_new_null`, `sk_X509_INFO_num`, `sk_X509_INFO_value`, `sk_X509_INFO_free`). Added `sk_X509_shift`. * Added BIO_set_callback, BIO_get_callback, BIO_set_callback_arg, BIO_get_callback_arg * add BIO_set_nbio, ERR_print_errors and tests * add X509 INFO stack push function * Add ASN1_UTCTIME_print and unit test * Add X509_get_ext_count unit test * initial commit of wolfSSL_PEM_X509_INFO_read_bio * Added `sk_X509_NAME_new`, `sk_X509_NAME_push`, `sk_X509_NAME_find`, `sk_X509_NAME_set_cmp_func` and `sk_X509_NAME_free`. Grouped `sk_X509_NAME_*` functions. * Cleanup sk X509 NAME/INFO pop free template. * Advance openssl compatibility to v1.1.0 for Apache httpd. Added TLS version macros. Implemented sk X509 NAME/INFO pop and pop_free. * Added `TLS_client_method` support. * Added `SSL_get_server_tmp_key` and `EC_curve_nid2nist`. * Added `SSL_CTX_set_min_proto_version` and `SSL_CTX_set_max_proto_version`. Fix for `BN_get_rfc*_prime_*` with the v1.1.0 change. * add test cases for PEM_X509_INFO_read_bio * Fixes for `BN_get_rfc*_prime_*` macros. Added template for `SSL_DH_set0_pqg`. Fix for `SSL_OP_NO_` to use Macro's (as is done in openssl). Added `SSL_set_verify_result`. Added stub for `OPENSSL_malloc_init`. * Apache httpd compatibility functions. BIO setter/getters. * implement ASN1_TIME_check and add test case * add SSL_get_client_CA_list * add initial implementation of wolfSSL_DH_set0_pqg * Add apache support to OBJ_txt2nid and unit test, add stub for OBJ_create * add X509_STORE_CTX_get1_chain, sk_free, sk_X509_dup * Add sk_SSL_COMP_num and SSL_COMP struct * implement and test of SSL_SESSION_print * add SSL_CTX_set_client_cert_cb * expand BIO_printf and add test case * Added `OCSP_CERTID_dup`. Added `ASN1_TYPE`. * add implementation for wolfSSL_get_server_tmp_key * add wolfSSL_BIO_puts and test case * Add X509_EXTENSION_get_object and X509_EXTENSION_get_data * add helper for bio flag set and null x509 stack * add test adn implementation for wolfSSL_i2d_PrivateKey * Added `ASN1_OTHERNAME`, `ACCESS_DESCRIPTION` and `GENERAL_NAME`. Added `sk_ACCESS_DESCRIPTION_pop_free` and `ACCESS_DESCRIPTION_free` stubs. * add wolfSSL_PEM_read_bio_ECPKParameters * add BIO_vfree * add X509_up_ref * add X509_STORE_CTX_set_ex_data * add _GNU_SOURCE macro and wolfSSL_EVP_read_pw_string * add wolfSSL_EVP_PKEY_ref_up function * X509_get_ext, X509V3_EXT_print, and d2i_DISPLAYTEXT stubs * add X509_set_issuer_name * add wolfSSL_sk_SSL_CIPHER_* functions and tests * add prototype for sk_X509_EXTENSION and ACCESS_DESCRIPTION * fix casting to avoid clang warning * adjust test_wolfSSL_X509_STORE_CTX test case * Added `OpenSSL_version` * renegotiate functions and additional stack functions * add aditional stub functions * Add Apache httpd requirements for ALPN, CRL, Cert Gen/Req/Ext and SecRen. Fix for `sk_X509_INFO_new_null`. * add ocsp stub functions * Proper fix for `sk_X509_INFO_new_null`. Added templates for `X509_get_ext_by_NID` and `X509_add_ext`. Added templates for `ASN1_TIME_diff` and `ASN1_TIME_set`. * x509 extension stack additions * Fixed template for `OCSP_id_get0_info`. * add X509 stub functions * add X509_STORE_CTX_get0_store() and unit test * Added `EVP_PKEY_CTX_new_id`, `EVP_PKEY_CTX_set_rsa_keygen_bits`, `EVP_PKEY_keygen_init`, `EVP_PKEY_keygen` and `BN_to_ASN1_INTEGER`. * x509v3 stubs and req add extensions * Add OBJ_txt2obj and unit test; add long name to wolfssl_object_info table for use by OBJ_* functions * wolfSSL_set_alpn_protos implementation * Added `EVP_SignInit_ex` and `TLS_server_method` implementation. Added stubs for `RSA_get0_key` and `i2d_OCSP_REQUEST_bio`. Fix typo on `OCSP_response_create`. Fix warning in `wolfSSL_set_alpn_protos`. * Added `X509_EXTENSION_free` stub. Fixed a few macro typos/adding missing. * add X509_STORE_CTX_get0_current_issuer and unit test * add OBJ_cmp and unit test * add RSA_get0_key and unit test * add OCSP_check_nonce * Implement X509_set_notAfter/notBefore/serialNumber/version,X509_STORE_CTX_set_depth,X509V3_set_ctx. * Modify wolfSSL_X509_set_notAfter/notBefore and add tests for each. * Add test_wolfSSL_X509_set_version w/ fixes to _set_version and fix _set_notBefore/notAfter tests * add OCSP_id_get0_info and unit test, move WOLFSSL_ASN1_INTEGER to asn_public.h from ssl.h * inital implementation of wolfSSL_X509_sign * add debugging messages and set data for BIO's * Add i2d_OCSP_REQUEST_bio. * implementation of some WOLFSSL_BIO_METHOD custom functions * fix for ASN time structure and remove log node * initial eNULL support and sanity checks * fixes after rebasing code * adjust test cases and ASN1_TIME print * Various fixes for memory leaks * Apache compatibility in CTX_set_client_CA_list for X509_NAME use; add X509_NAME_dup as supporting function * Add initial X509_STORE_load_locations stub for Apache * Updates to X509_get_ext_d2i to return GENERAL_NAME struct instead of ASN1_OBJECT for alternative names and add supporting GENERAL_NAME functions * Add X509_STORE_load_locations implementation; add wolfSSL_CertManagerLoadCRL_ex; initial renegotiation fixes/updates * Fix for freeing peer cert in wolfSSL_Rehandshake instead of FreeHandShakeResources during secure renegotiation * Add X509_ALGOR and X509_PUBKEY structs for X509_PUBKEY_get0_param and X509_get_X509_PUBKEY implementation * Initial implementation of wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Add implementation for X509_get0_tbs_sigalg and X509_ALGOR_get0 * Add OBJ_nid2ln implementation * Fix compile errors in tests/api.c for some build options * Updates to X509_STORE_load_locations for non-CRL types; Add additional DETECT_CERT_TYPE enum and logic for detecting certificate type in ProcessFile * Add X509_STORE_load_locations unit test and minor error handling fixes * Add unit test for X509_sign * Set correct alert type for revoked certificates; add/fix a few WOLFSSL_ENTER messages * Add X509_ALGOR member to X509 struct; refactoring and unit tests for wolfSSL_X509_ALGOR_get0 and wolfSSL_X509_get0_tbs_sigalg * Add X509_PUBKEY member to X509 struct; refactoring and unit tests for wolfSSL_X509_get_X509_PUBKEY and wolfSSL_X509_PUBKEY_get0_param * Stack fixes after rebase * Secure renegotiation refactoring: add ACCEPT_BEGIN_RENEG to AcceptState for use in wolfSSL_SSL_in_connect_init; free old peer cert when receiving new cert to fix memory leak * Move enc-then-mac enable option in configure.ac for apache httpd compatibility * Simplify wolfSSL_SSL_in_connect_init logic * Remove unneeded wolfSSL_CertManagerLoadCRL_ex * Fixes for jenkins test failures * SSL_get_secure_renegotiation_support for print statement in Apache
2019-09-19 18:11:10 -06:00
echo " * Apache httpd: $ENABLED_APACHE_HTTPD"
Get Nginx working with wolfSSL
2016-12-22 12:53:29 +10:00
echo " * NGINX: $ENABLED_NGINX"
OpenResty 1.13.6.2 and 1.19.3.1 support # New or Updated APIs - wolfSSL_get_tlsext_status_type - wolfSSL_X509_chain_up_ref - wolfSSL_get0_verified_chain - SSL_CTX_set_cert_cb - SSL_certs_clear - SSL_add0_chain_cert ssl_cert_add0_chain_cert - SSL_add1_chain_cert ssl_cert_add1_chain_cert - sk_X509_NAME_new_null - SSL_CTX_set_cert_cb - SSL_set0_verify_cert_store - SSL_set_client_CA_list # Other Changes - Ignore gdbinit - Add api.c tests for new API - Add `WOLFSSL_X509_STORE* x509_store_pt` to `WOLFSSL` - Add macro to select the `WOLFSSL` specific store when available and the associated `WOLFSSL_CTX` store otherwise. Calls to `ssl->ctx->cm` and `ssl->ctx->x509_store*` were replaced by macros. - NO-OP when setting existing store - Add reference counter to `WOLFSSL_X509_STORE` - Cleanup MD5 redundant declarations - WOLFSSL_ERROR may map to nothing so make assignment outside of it - refMutex fields are excluded with SINGLE_THREADED macro - Chain cert refactor - Make `wolfSSL_add0_chain_cert` and `wolfSSL_add1_chain_cert` not affect the context associated with the SSL object - `wolfSSL_CTX_add1_chain_cert` now updates the `ctx->certChain` on success and stores the cert in `ctx->x509Chain` for later free'ing
2021-08-12 14:25:19 +02:00
echo " * OpenResty: $ENABLED_OPENRESTY"
Added wolfSSl compatability for Asio C++ library
2018-07-02 10:48:02 -06:00
echo " * ASIO: $ENABLED_ASIO"
libwebsockets build fixes 1. Add --enable-libwebsockets option 2. Add OPENSSL_NO_EC (used in libwebsockets) 3. Add SSL_MODE_RELEASE_BUFFERS and debug message for when wolfSSL_CTX_set_mode doesn't recognize a mode.
2019-10-21 12:03:18 -06:00
echo " * LIBWEBSOCKETS: $ENABLED_LIBWEBSOCKETS"
initial implementation of WOLFSSL_NETWORK_INTROSPECTION: --enable-network-introspection, struct wolfSSL_network_connection, wolfSSL_*_endpoints*(), NetworkFilterCallback_t, wolfSSL_*set_AcceptFilter().
2021-03-17 22:49:07 -05:00
echo " * Qt: $ENABLED_QT"
echo " * Qt Unit Testing: $ENABLED_QT_TEST"
Modification for compliling application with libsignal-protocol-c.
2017-11-13 18:12:18 +09:00
echo " * SIGNAL: $ENABLED_SIGNAL"
Add --enable-chrony configure option. This turns on the necessary features for using the chrony NTP package with wolfSSL.
2022-01-18 22:02:50 -08:00
echo " * chrony: $ENABLED_CHRONY"
Add an --enable-strongswan option to configure.ac. Also, clean up some repetition around adding `-DHAVE_OCSP`.
2022-06-09 16:23:00 +02:00
echo " * strongSwan: $ENABLED_STRONGSWAN"
Enhance OpenLDAP support. - Add --enable-openldap to configure.ac - Fix some issues around subject alt names and the WOLFSSL_GENERAL_NAME struct.
2022-06-25 16:14:35 +04:00
echo " * OpenLDAP: $ENABLED_OPENLDAP"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * ERROR_STRINGS: $ENABLED_ERROR_STRINGS"
echo " * DTLS: $ENABLED_DTLS"
dtls13: add autotools, cmake build options and vstudio paths
2022-05-20 09:59:23 +02:00
echo " * DTLS v1.3: $ENABLED_DTLS13"
added SCTP to configure.ac
2016-08-01 07:51:42 -07:00
echo " * SCTP: $ENABLED_SCTP"
DTLS SRTP (RFC5764) support (adds `--enable-srtp`). Used with WebRTC to agree on profile for new real-time session keys.
2022-01-13 16:09:11 -08:00
echo " * SRTP: $ENABLED_SRTP"
Support indefinite length BER encodings in PKCS #7
2018-02-19 13:40:18 +10:00
echo " * Indefinite Length: $ENABLED_BER_INDEF"
Multicast DTLS 1. Add DTLS-multicast to the enable options. 2. Reorg DTLS related enable options together. 3. Update a couple enable option texts to use the AS_HELP_STRING() macro. 4. Add three new APIs for managing a DTLS Multicast session. 5. Add test code for new APIs. 6. Add stub code for the new APIs.
2016-12-06 14:08:52 -08:00
echo " * Multicast: $ENABLED_MCAST"
Fix for `--enable-all` (also used by `--enable-distro`) to NOT enable SSLV3 and TLS v1.0.
2020-07-31 13:48:15 -07:00
echo " * SSL v3.0 (Old): $ENABLED_SSLV3"
echo " * TLS v1.0 (Old): $ENABLED_TLSV10"
echo " * TLS v1.1 (Old): $ENABLED_OLD_TLS"
echo " * TLS v1.2: $ENABLED_TLSV12"
Add TLS v1.3 as an option
2016-11-24 01:31:07 +10:00
echo " * TLS v1.3: $ENABLED_TLS13"
Updates from code review
2017-06-22 12:40:41 +10:00
echo " * Post-handshake Auth: $ENABLED_TLS13_POST_AUTH"
echo " * Early Data: $ENABLED_TLS13_EARLY_DATA"
add QUIC support.
2022-08-08 13:24:00 +02:00
echo " * QUIC: $ENABLED_QUIC"
Code review fixes Also put in configuration option for sending HRR Cookie extension with state.
2017-06-27 08:52:53 +10:00
echo " * Send State in HRR Cookie: $ENABLED_SEND_HRR_COOKIE"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * OCSP: $ENABLED_OCSP"
cosmetic changes to OCSP Stapling options.
2015-12-30 17:10:25 -03:00
echo " * OCSP Stapling: $ENABLED_CERTIFICATE_STATUS_REQUEST"
echo " * OCSP Stapling v2: $ENABLED_CERTIFICATE_STATUS_REQUEST_V2"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * CRL: $ENABLED_CRL"
echo " * CRL-MONITOR: $ENABLED_CRL_MONITOR"
echo " * Persistent session cache: $ENABLED_SAVESESSION"
echo " * Persistent cert cache: $ENABLED_SAVECERT"
echo " * Atomic User Record Layer: $ENABLED_ATOMICUSER"
echo " * Public Key Callbacks: $ENABLED_PKCALLBACKS"
liboqs integration using keyshare/supported_groups extensions in TLS 1.3
2021-04-28 10:28:35 -07:00
echo " * liboqs: $ENABLED_LIBOQS"
add Whitewood netRandom client library support
2016-05-05 15:31:25 -06:00
echo " * Whitewood netRandom: $ENABLED_WNR"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Server Name Indication: $ENABLED_SNI"
echo " * ALPN: $ENABLED_ALPN"
echo " * Maximum Fragment Length: $ENABLED_MAX_FRAGMENT"
Trusted CA Key Indication Extension Added an API for enabling the Trusted CA Key Indication extension from RFC6066 section 6. If the server doesn't have a match for the client, the client will abandon the session.
2018-09-28 09:05:59 -07:00
echo " * Trusted CA Indication: $ENABLED_TRUSTED_CA"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Truncated HMAC: $ENABLED_TRUNCATED_HMAC"
echo " * Supported Elliptic Curves: $ENABLED_SUPPORTED_CURVES"
Support FFDHE in TLS 1.2 and below. Better TLS 1.3 version support. Add support for the fixed FFDHE curves to TLS 1.2. Same curves in TLS 1.3 already. On by default - no checking of prime required. Add option to require client to see FFDHE parameters from server as per 'may' requirements in RFC 7919. Change TLS 1.3 ClientHello and ServerHello parsing to find the SupportedVersions extension first and process it. Then it can handle other extensions knowing which protocol we are using.
2019-02-18 10:57:12 +10:00
echo " * FFDHE only in client: $ENABLED_FFDHE_ONLY"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Session Ticket: $ENABLED_SESSION_TICKET"
initial extended master secret support
2016-09-01 15:12:54 -06:00
echo " * Extended Master Secret: $ENABLED_EXTENDED_MASTER"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Renegotiation Indication: $ENABLED_RENEGOTIATION_INDICATION"
echo " * Secure Renegotiation: $ENABLED_SECURE_RENEGOTIATION"
Fallback SCSV (Signaling Cipher Suite Value) support on Server only
2019-06-28 15:30:35 +10:00
echo " * Fallback SCSV: $ENABLED_FALLBACK_SCSV"
Implement RFC 5705: Keying Material Exporters for TLS
2020-11-10 17:50:45 +01:00
echo " * Keying Material Exporter: $ENABLED_KEYING_MATERIAL"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * All TLS Extensions: $ENABLED_TLSX"
initial implementation of WOLFSSL_NETWORK_INTROSPECTION: --enable-network-introspection, struct wolfSSL_network_connection, wolfSSL_*_endpoints*(), NetworkFilterCallback_t, wolfSSL_*set_AcceptFilter().
2021-03-17 22:49:07 -05:00
echo " * PKCS#7: $ENABLED_PKCS7"
echo " * S/MIME: $ENABLED_SMIME"
echo " * wolfSSH: $ENABLED_WOLFSSH"
Created new --enable-engine and --enable-engine-witout-fips flags
2022-01-31 11:56:11 -05:00
echo " * wolfEngine: $ENABLED_WOLFENGINE"
initial implementation of WOLFSSL_NETWORK_INTROSPECTION: --enable-network-introspection, struct wolfSSL_network_connection, wolfSSL_*_endpoints*(), NetworkFilterCallback_t, wolfSSL_*set_AcceptFilter().
2021-03-17 22:49:07 -05:00
echo " * wolfTPM: $ENABLED_WOLFTPM"
add wolfclu enable option
2021-09-01 08:44:00 -06:00
echo " * wolfCLU: $ENABLED_WOLFCLU"
initial implementation of WOLFSSL_NETWORK_INTROSPECTION: --enable-network-introspection, struct wolfSSL_network_connection, wolfSSL_*_endpoints*(), NetworkFilterCallback_t, wolfSSL_*set_AcceptFilter().
2021-03-17 22:49:07 -05:00
echo " * wolfSCEP: $ENABLED_WOLFSCEP"
echo " * Secure Remote Password: $ENABLED_SRP"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * Small Stack: $ENABLED_SMALL_STACK"
Linux Kernel Module support using "--enable-linuxkm".
2015-11-19 13:36:21 -08:00
echo " * Linux Kernel Module: $ENABLED_LINUXKM"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * valgrind unit tests: $ENABLED_VALGRIND"
echo " * LIBZ: $ENABLED_LIBZ"
echo " * Examples: $ENABLED_EXAMPLES"
add AM_CONDITIONAL([BUILD_DEBUG],...) to configure.ac, and use it to gate inclusion of wolfcrypt/src/debug.c in src/include.am; remove superfluous includes from wolfcrypt/src/debug.c.
2020-09-23 18:30:45 -05:00
echo " * Crypt tests: $ENABLED_CRYPT_TESTS"
echo " * Stack sizes in tests: $ENABLED_STACKSIZE"
add --enable-trackmemory=verbose, and add WOLFSSL_TEST_MAX_RELATIVE_HEAP_{BYTES,ALLOCS} and -m/-a (runtime counterparts) to wolfcrypt_test(). also add -h to wolfcrypt_test() to print available options.
2020-12-23 12:03:06 -06:00
echo " * Heap stats in tests: $ENABLED_TRACKMEMORY"
Merge branch csr into 'master'
2015-11-02 15:51:01 -03:00
echo " * User Crypto: $ENABLED_USER_CRYPTO"
echo " * Fast RSA: $ENABLED_FAST_RSA"
Added "--enable-asynccrypt" option for enabling asynchronous crypto. This includes a refactor of SendServerKeyExchange and DoClientKeyExchange to support WC_PENDING_E on key generation, signing and verification. Currently uses async simulator (WOLFSSL_ASYNC_CRYPT_TEST) if cavium not enabled. All of the examples have been updated to support WC_PENDING_E on accept and connect. A generic WOLF_EVENT infrastructure has been added to support other types of future events and is enabled using "HAVE_WOLF_EVENT". Refactor the ASN OID type (ex: hashType/sigType) to use a more unique name. The real "async.c" and "async.h" files are in a private repo.
2016-03-04 10:05:22 -08:00
echo " * Async Crypto: $ENABLED_ASYNCCRYPT"
Fix to always support parsing of the PKCS8 header. Improved macro logic for PKCS8 and PKCS12. Added `--disable-pkcs8` option. Fix to enable PWDBASED and PKCS8 if PKCS12 is enabled.
2021-08-03 14:45:45 -07:00
echo " * PKCS#8: $ENABLED_PKCS8"
Support for PKCS#11 Support for RSA, ECDSA and AES-GCM operations.
2018-09-12 08:56:59 +10:00
echo " * PKCS#11: $ENABLED_PKCS11"
Improvements for disabled sections in pwdbased.c, asn.c, rsa.c, pkcs12.c and wc_encrypt.c. Adds `--enable-pkcs12`, `HAVE_PKCS12`/`NO_PKCS12`, `HAVE_PKCS8` / `NO_PKCS8` and `HAVE_PBKDF1` / `NO_PBKDF1`.
2019-07-02 09:35:46 -07:00
echo " * PKCS#12: $ENABLED_PKCS12"
fix spelling of Nitrox in configure option summary
2020-12-16 13:08:32 -07:00
echo " * Cavium Nitrox: $ENABLED_CAVIUM"
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
echo " * Cavium Octeon (Sync): $ENABLED_OCTEON_SYNC"
echo " * Intel Quick Assist: $ENABLED_INTEL_QA"
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
if test "$ENABLED_ARMASM_INLINE" = "yes"
then
ENABLED_ARMASM="inline C"
fi
initial ARMv8 instructions
2016-07-22 15:49:15 +00:00
echo " * ARM ASM: $ENABLED_ARMASM"
SHA-3, ARM64: add assembly support for crypto instructions Add ability to compile ARM assembly from inline C code.
2022-02-07 09:20:49 +10:00
echo " * ARM ASM SHA512/SHA3 Crypto $ENABLED_ARMASM_SHA3"
add AES key wrap support, RFC 3394
2016-12-05 15:38:42 -07:00
echo " * AES Key Wrap: $ENABLED_AESKEYWRAP"
add wolfSSL_write_dup(), creates write_only WOLFSSL to allow concurrent access
2017-03-20 15:08:34 -07:00
echo " * Write duplicate: $ENABLED_WRITEDUP"
Xilinx port
2017-06-07 11:37:21 -06:00
echo " * Xilinx Hardware Acc.: $ENABLED_XILINX"
Add status of inline configure option to feature output
2018-01-17 14:20:49 -07:00
echo " * Inline Code: $ENABLED_INLINE"
inital AES-CBC with af_alg progress on AES-GCM with AF_ALG and add SHA256 add aes-gcm test cases and finish logic of aes-gcm with AF_ALG formating of tabs and white space add files to dist adding ecb and ctr mode with af_alg make length of buffers for ctr be AES_BLOCK_SIZE formating and add support for sha256 copy/gethash sanity checks on arguments cast return values and valgrind tests make it easier to use sha256 with af_alg remove hard tabs add endif for after rebase
2018-07-18 17:26:25 -06:00
echo " * Linux AF_ALG: $ENABLED_AFALG"
KCAPI: add support for using libkcapi for crypto (Linux Kernel) RSA, DH and ECC not testable as no Linux Kernel driver to use. ECC implementation is customer specific.
2021-08-19 11:25:59 +10:00
echo " * Linux KCAPI: $ENABLED_KCAPI"
Release Fixes 1. Rearrange the deprecation cryptodev option so it doesn't overwrite the cryptocb option, and so it doesn't break its case in the build-test. 2. Fix the content length in the sample HTTP used by the example server. 3. Disable OCSP stapling in the example server if RSA is disabled. 4. Fix a variable in asn.c that was declared in the middle of its scope. 5. Retag the xmalloc, xrealloc, xfree functions used in the memory test as WOLFSSL_API like all the other allocators, instead of extern.
2019-03-20 11:01:24 -07:00
echo " * Linux devcrypto: $ENABLED_DEVCRYPTO"
Synchronous Cavium OCTEON Support for Sniffer 1. Add configure option for sync IntelQA that uses the crypto callback API. 2. Make a synchonous copy of the quickassist files. 3. Tie in the crypto device to the sniffer. 4. When making a sniffer build, define static DH enabled. 5. The readme files in the Cavium were being added to the distro optionally, changed to always add the readme files. 6. Added an include of the cavium_octeon header in the wc_ports.c. 7. Updated the Cavium OCTEON callback for AES-GCM. 8. Add the global tag to the list of crypto callback function pointers. 9. Add an accessor to the OCTEON crypto callback module to return the device ID of the OCTEON device. 10. Add a new version of ssl_SetWatchKeyCallback which takes an additional parameter of a device ID. This ID is used to set up the wolfSSL_CTXs in the sniffer session trackers. 11. Update the benchmark to use sync OCTEON and QAT.
2019-10-04 11:21:56 -07:00
echo " * Crypto callbacks: $ENABLED_CRYPTOCB"
Add SECO use and expand cryptodev
2021-12-08 23:59:19 +00:00
echo " * i.MX CAAM: $ENABLED_CAAM"
Support for IoT-Safe with TLS demo
2021-07-26 19:38:46 +02:00
echo " * IoT-Safe: $ENABLED_IOTSAFE"
echo " * IoT-Safe HWRNG: $ENABLED_IOTSAFE_HWRNG"
Fixes and cleanups for NXP SE050 support.
2021-08-20 15:45:10 -07:00
echo " * NXP SE050: $ENABLED_SE050"
autoconf: add PSA options
2021-12-21 13:24:27 +01:00
echo " * PSA: $ENABLED_PSA"
Add ability to toggle system CA certs support.
2022-10-07 11:19:34 -07:00
echo " * System CA certs: $ENABLED_SYS_CA_CERTS"
This adds more compiler hardening flags (and fixes all of the issues found in the process).
2012-09-19 23:38:41 -07:00
echo ""
echo "---"
Added new "wolfSSL_poll" which filters event queue by ssl object pointer. Changed wolfSSL_CTX_poll to support using WOLF_POLL_FLAG_PEEK flag to peek at events and return count. Removed "wolfssl_CTX_poll_peek". Switched the examples (test.h AsyncCryptPoll) to use just the WOLFSSL object and call new wolfSSL_poll. Added warning when using the "--enable-asynccrypt" option to make sure users know they need real async.c/.h files.
2016-03-30 15:15:38 -07:00
configure.ac: enable_stunnel for enable-all only if !FIPS; add enable_tcpdump if !FIPS; add -DWOLFSSL_ECDSA_SET_K to FIPS 140-3 CFLAGS; use DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS to set FP_MAX_BITS indirectly for FIPS 140-3; use AC_MSG_NOTICE() for informational notices previously echoed; gate informational output appropriately on $verbose and $silent.
2021-08-25 18:33:20 -05:00
fi # $silent != yes
static and shared library with MinGW
2016-04-15 16:04:15 -06:00
################################################################################
Added new "wolfSSL_poll" which filters event queue by ssl object pointer. Changed wolfSSL_CTX_poll to support using WOLF_POLL_FLAG_PEEK flag to peek at events and return count. Removed "wolfssl_CTX_poll_peek". Switched the examples (test.h AsyncCryptPoll) to use just the WOLFSSL object and call new wolfSSL_poll. Added warning when using the "--enable-asynccrypt" option to make sure users know they need real async.c/.h files.
2016-03-30 15:15:38 -07:00
# Show warnings at bottom so they are noticed
static and shared library with MinGW
2016-04-15 16:04:15 -06:00
################################################################################
configure.ac: don't warn about loading real async files if async.c is present and non-empty.
2021-10-01 00:56:59 -05:00
if test "$ENABLED_ASYNCCRYPT" = "yes" && ! test -s $srcdir/wolfcrypt/src/async.c
Added new "wolfSSL_poll" which filters event queue by ssl object pointer. Changed wolfSSL_CTX_poll to support using WOLF_POLL_FLAG_PEEK flag to peek at events and return count. Removed "wolfssl_CTX_poll_peek". Switched the examples (test.h AsyncCryptPoll) to use just the WOLFSSL object and call new wolfSSL_poll. Added warning when using the "--enable-asynccrypt" option to make sure users know they need real async.c/.h files.
2016-03-30 15:15:38 -07:00
then
AC_MSG_WARN([Make sure real async files are loaded. Contact wolfSSL for details on using the asynccrypt option.])
fi
static and shared library with MinGW
2016-04-15 16:04:15 -06:00
# MinGW static vs shared library
update comment about MinGW
2016-04-18 12:14:47 -06:00
# Reference URL from libtool for MinGW is located at
static and shared library with MinGW
2016-04-15 16:04:15 -06:00
# http://www.gnu.org/software/libtool/manual/libtool.html#Cygwin-to-MinGW-Cross
# this allows for not even having dllimport/dllexport on functions
# with recent libtools, only requiring it with global variables.
update comment about MinGW
2016-04-18 12:14:47 -06:00
#
# The following warning is displayed here because if not using "contemporary GNU
static and shared library with MinGW
2016-04-15 16:04:15 -06:00
# tools" there is the possibility of export/import issues.
update comment about MinGW
2016-04-18 12:14:47 -06:00
# wolfSSL uses __declspec(dllexport) and "contemporary GNU tools" handle the
# case where both static and shared libraries are built.
static and shared library with MinGW
2016-04-15 16:04:15 -06:00
#
# More can be found about the MinGW linker at
# https://sourceware.org/binutils/docs/ld/WIN32.html
if test "$MINGW_LIB_WARNING" = "yes"
then
AC_MSG_WARN([Building with shared and static library at the same time on this system may cause export/import problems when using non contemporary GNU tools.])
fi
Copy Permalink