# configure.ac # # Copyright (C) 2006-2026 wolfSSL Inc. # # This file is part of wolfSSL. (formerly known as CyaSSL) # # AC_COPYRIGHT([Copyright (C) 2006-2026 wolfSSL Inc.]) AC_PREREQ([2.69]) AC_INIT([wolfssl],[5.9.2],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],[https://www.wolfssl.com]) AC_CONFIG_AUX_DIR([build-aux]) # Inhibit unwanted regeneration of autotools artifacts by Makefile. AM_MAINTAINER_MODE([disable]) # The following sets CFLAGS to empty if unset on command line. We do not # want the default "-g -O2" that AC_PROG_CC sets automatically. : ${CFLAGS=""} # Capture user C_EXTRA_FLAGS from configure line. # Use of C_EXTRA_FLAGS is deprecated because CFLAGS was fixed but someone # might still be using it. CFLAGS="$CFLAGS $C_EXTRA_FLAGS $C_FLAGS" AC_PROG_CC AM_PROG_CC_C_O AC_CANONICAL_HOST AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE([1.13.4 -Wall -Werror -Wno-portability foreign tar-ustar subdir-objects no-define color-tests]) m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])]) AC_ARG_PROGRAM # Optional CMake package install (enabled by default) AC_ARG_ENABLE([cmake-install], [AS_HELP_STRING([--disable-cmake-install],[Disable installation of CMake package files])], [ ENABLED_CMAKE_INSTALL=$enableval ], [ ENABLED_CMAKE_INSTALL=yes ]) AM_CONDITIONAL([CMAKE_INSTALL],[test "x$ENABLED_CMAKE_INSTALL" = "xyes"]) AC_CONFIG_HEADERS([config.h:config.in]) LT_PREREQ([2.4.2]) LT_INIT([disable-static win32-dll]) AC_ARG_VAR(EXTRA_CPPFLAGS, [Extra CPPFLAGS to add to end of autoconf-computed arg list. Can also supply directly to make.]) AC_ARG_VAR(EXTRA_CFLAGS, [Extra CFLAGS to add to end of autoconf-computed arg list. Can also supply directly to make.]) AC_ARG_VAR(EXTRA_CCASFLAGS, [Extra CCASFLAGS to add to end of autoconf-computed arg list. Can also supply directly to make.]) AC_ARG_VAR(EXTRA_LDFLAGS, [Extra LDFLAGS to add to end of autoconf-computed arg list. Can also supply directly to make.]) WOLFSSL_CONFIG_ARGS=$ac_configure_args AC_SUBST([WOLFSSL_CONFIG_ARGS]) # Store configure options and CFLAGS for debian rules generation CONFIGURE_OPTIONS="$ac_configure_args" AC_SUBST([CONFIGURE_OPTIONS]) # shared library versioning # The three numbers in the libwolfssl.so.*.*.* file name. Unfortunately # increment if interfaces have been removed or changed WOLFSSL_LIBRARY_VERSION_FIRST=45 # increment if interfaces have been added # set to zero if WOLFSSL_LIBRARY_VERSION_FIRST is incremented WOLFSSL_LIBRARY_VERSION_SECOND=0 # increment if source code has changed # set to zero if WOLFSSL_LIBRARY_VERSION_FIRST is incremented or # WOLFSSL_LIBRARY_VERSION_SECOND is incremented WOLFSSL_LIBRARY_VERSION_THIRD=0 WOLFSSL_LIBRARY_VERSION=${WOLFSSL_LIBRARY_VERSION_FIRST}:${WOLFSSL_LIBRARY_VERSION_SECOND}:${WOLFSSL_LIBRARY_VERSION_THIRD} AC_SUBST([WOLFSSL_LIBRARY_VERSION_FIRST]) AC_SUBST([WOLFSSL_LIBRARY_VERSION_SECOND]) AC_SUBST([WOLFSSL_LIBRARY_VERSION_THIRD]) AC_SUBST([WOLFSSL_LIBRARY_VERSION]) gl_VISIBILITY AS_IF([ test -n "$CFLAG_VISIBILITY" ], [ AM_CFLAGS="$AM_CFLAGS $CFLAG_VISIBILITY" ]) WOLFSSL_BUILD_DATE=$(LC_TIME=C date +"%a, %d %b %Y %T %z") AC_SUBST([WOLFSSL_BUILD_DATE]) # Moved these size of and type checks before the library checks. # The library checks add the library to subsequent test compiles # and in some rare cases, the networking check causes these sizeof # checks to fail. AC_CHECK_SIZEOF([long long]) AC_CHECK_SIZEOF([long]) AC_CHECK_SIZEOF([time_t]) AC_CHECK_TYPES([__uint128_t]) # Distro build feature subset (Debian, Ubuntu, etc.) AC_ARG_ENABLE([distro], [AS_HELP_STRING([--enable-distro],[Enable wolfSSL distro build (default: disabled)])], [ ENABLED_DISTRO=$enableval ], [ ENABLED_DISTRO=no ] ) if test "$ENABLED_DISTRO" = "yes" then enable_shared=yes enable_static=yes enable_all=yes enable_earlydata=no REPRODUCIBLE_BUILD_DEFAULT=yes else REPRODUCIBLE_BUILD_DEFAULT=no fi # Fail when an option is passed that is not recognized m4_divert_once([DEFAULTS], [enable_option_checking=fatal]) # Allow experimental settings AC_ARG_ENABLE([experimental], [AS_HELP_STRING([--enable-experimental],[Allow experimental settings in the configuration (default: disabled)])], [ ENABLED_EXPERIMENTAL=$enableval ], [ ENABLED_EXPERIMENTAL=no ] ) if test "$ENABLED_EXPERIMENTAL" = "yes" then AS_IF([ test "$ENABLED_DISTRO" = "yes" && test "$ENABLED_EXPERIMENTAL" = "yes" ],[ AC_MSG_ERROR([--enable-distro and --enable-experimental are mutually exclusive.]) ]) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_EXPERIMENTAL_SETTINGS" AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_EXPERIMENTAL_SETTINGS" fi # Kernel module benchmark AC_ARG_ENABLE([kernel-benchmarks], [AS_HELP_STRING([--enable-kernel-benchmarks],[Enable crypto benchmarking autorun at module load time for kernel module (default: disabled)])], [ENABLED_KERNEL_BENCHMARKS=$enableval], [ENABLED_KERNEL_BENCHMARKS="no"]) if test "$ENABLED_KERNEL_BENCHMARKS" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KERNEL_BENCHMARKS" fi AC_SUBST([ENABLED_KERNEL_BENCHMARKS]) AC_ARG_ENABLE([kernel-verbose-debug], [AS_HELP_STRING([--enable-kernel-verbose-debug],[Enable supplementary runtime debugging messages for kernel module (default: disabled)])], [ENABLED_KERNEL_VERBOSE_DEBUG=$enableval], [ENABLED_KERNEL_VERBOSE_DEBUG="no"]) if test "$ENABLED_KERNEL_VERBOSE_DEBUG" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KERNEL_VERBOSE_DEBUG" fi AC_ARG_ENABLE([kernel-stack-debug], [AS_HELP_STRING([--enable-kernel-stack-debug],[Enable runtime reporting of stack usage in kernel module (default: disabled)])], [ENABLED_KERNEL_STACK_DEBUG=$enableval], [ENABLED_KERNEL_STACK_DEBUG="no"]) if test "$ENABLED_KERNEL_STACK_DEBUG" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KERNEL_STACK_DEBUG" fi # Linux Kernel Module options (more options later) AC_ARG_ENABLE([linuxkm], [AS_HELP_STRING([--enable-linuxkm],[Enable Linux Kernel Module (default: disabled)])], [ENABLED_LINUXKM=$enableval], [ENABLED_LINUXKM=no] ) # FreeBSD Kernel Module AC_ARG_ENABLE([freebsdkm], [AS_HELP_STRING([--enable-freebsdkm],[Enable FreeBSD Kernel Module (default: disabled)])], [ENABLED_BSDKM=$enableval], [ENABLED_BSDKM=no] ) if test "$ENABLED_LINUXKM" != "no" || test "$ENABLED_BSDKM" != "no" then KERNEL_MODE_DEFAULTS=yes else KERNEL_MODE_DEFAULTS=no fi AC_ARG_ENABLE([kernel-settings], [AS_HELP_STRING([--enable-kernel-settings],[Enable default settings appropriate for kernel modules (default: disabled)])], [KERNEL_MODE_DEFAULTS=$enableval] ) # backward-compat alias for --enable-kernel-settings AC_ARG_ENABLE([linuxkm-defaults], [AS_HELP_STRING([--enable-linuxkm-defaults],[Enable default settings appropriate for kernel modules (default: disabled)])], [KERNEL_MODE_DEFAULTS=$enableval] ) if test "$KERNEL_MODE_DEFAULTS" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KERNEL_MODE_DEFAULTS" fi AC_ARG_ENABLE([freebsdkm-crypto-register], [AS_HELP_STRING([--enable-freebsdkm-crypto-register],[Register wolfCrypt implementations with the FreeBSD kernel opencrypto framework. (default: disabled)])], [ENABLED_BSDKM_REGISTER=$enableval], [ENABLED_BSDKM_REGISTER=no] ) # wolfzfs support AC_ARG_ENABLE([wolfzfs], [AS_HELP_STRING([--enable-wolfzfs],[Enable wolfZFS support ((options: kernel, yes, no, disabled default: disabled)).])], [ENABLED_WOLFZFS=$enableval], [ENABLED_WOLFZFS=no] ) if test "x$ENABLED_WOLFZFS" = "xyes" || test "x$ENABLED_WOLFZFS" = "xkernel" then if test "x$ENABLED_WOLFZFS" = "xyes"; then # userspace libzfs requires openssl compat layer, which will # be detected and enabled later. AM_CFLAGS="$AM_CFLAGS -DNO_OLD_SHA_NAMES" fi if test "x$ENABLED_WOLFZFS" = "xkernel"; then # kernelspace libzfs AM_CFLAGS="$AM_CFLAGS -DNO_STDDEF_H -DNO_STDATOMIC_H" fi fi AC_CHECK_HEADERS([arpa/inet.h fcntl.h netdb.h netinet/in.h stddef.h time.h sys/ioctl.h sys/socket.h sys/time.h errno.h sys/un.h ctype.h sys/random.h]) # Special case: Since types.h depends on HAVE_LIMITS_H, we must define it in options.h. AC_CHECK_HEADER([limits.h], [AM_CPPFLAGS="$AM_CPPFLAGS -DHAVE_LIMITS_H=1"], []) AC_CHECK_LIB([network],[socket]) AC_C_BIGENDIAN AC_C___ATOMIC if test "x$ENABLED_BSDKM" = "xyes"; then # The header should not be included in freebsd kernel build. # Look for instead. AC_CHECK_HEADER(machine/atomic.h, [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSL_HAVE_ATOMIC_H"],[]) elif test "x$ENABLED_WOLFZFS" = "xno"; then # Don't use stdatomic.h with wolfzfs kernel. It expects gcc builtins. AC_CHECK_HEADER(stdatomic.h, [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSL_HAVE_ATOMIC_H"],[]) fi AC_CHECK_HEADER(assert.h, [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSL_HAVE_ASSERT_H"],[]) # check if functions of interest are linkable, but also check if # they're declared by the expected headers, and if not, supersede the # unusable positive from AC_CHECK_FUNCS(). AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday gmtime_r gmtime_s inet_ntoa memset socket strftime atexit isascii getpid getrandom]) AC_CHECK_DECLS([gethostbyname, getaddrinfo, gettimeofday, gmtime_r, gmtime_s, inet_ntoa, memset, socket, strftime, atexit, isascii, getpid, getrandom], [], [ if test "$(eval echo \$"$(eval 'echo ac_cv_func_${as_decl_name}')")" = "yes" then AC_MSG_NOTICE([ note: earlier check for $(eval 'echo ${as_decl_name}') superseded.]) eval "ac_cv_func_${as_decl_name}=no" _mask_varname=HAVE_`eval "echo '${as_decl_name}'" | tr 'a-z' 'A-Z'` sed --in-place "s~^#define ${_mask_varname} 1$~~" confdefs.h fi ], [[ #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_STRING_H #include #endif #ifdef HAVE_NETDB_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SYS_TIME_H #include #endif #ifdef HAVE_TIME_H #include #endif #ifdef HAVE_STDLIB_H #include #endif #ifdef HAVE_UNISTD_H #include #endif #ifdef HAVE_CTYPE_H #include #endif #ifdef HAVE_SYS_RANDOM_H #include #endif ]]) AC_PROG_INSTALL AC_TYPE_SIZE_T AC_TYPE_UINT8_T AC_TYPE_UINTPTR_T AM_PROG_AS OPTIMIZE_CFLAGS="-Os" OPTIMIZE_FAST_CFLAGS="-O2" OPTIMIZE_HUGE_CFLAGS="-funroll-loops -DTFM_SMALL_SET -DTFM_HUGE_SET" DEBUG_CFLAGS="-g -DDEBUG -DDEBUG_WOLFSSL" LIB_ADD= LIB_STATIC_ADD= PC_LIBS_PRIVATE="" OPTIMIZE_CFLAGS="$OPTIMIZE_CFLAGS $EXTRA_OPTS_CFLAGS" OPTIMIZE_FAST_CFLAGS="$OPTIMIZE_FAST_CFLAGS $EXTRA_OPTS_CFLAGS" OPTIMIZE_HUGE_CFLAGS="$OPTIMIZE_HUGE_CFLAGS $EXTRA_OPTS_CFLAGS" DEBUG_VFLAGS="$DEBUG_VFLAGS $EXTRA_OPTS_CFLAGS" if test "$output_objdir" = "" then output_objdir=. fi # Thread local storage thread_ls_on="no" AC_ARG_ENABLE([threadlocal], [AS_HELP_STRING([--enable-threadlocal],[Enable thread local support (default: enabled)])], [ ENABLED_THREADLOCAL=$enableval ], [ ENABLED_THREADLOCAL=yes ] ) if test "$ENABLED_THREADLOCAL" = "yes" then AX_TLS([thread_ls_on=yes],[thread_ls_on=no]) AS_IF([test "x$thread_ls_on" = "xyes"],[AM_CFLAGS="$AM_CFLAGS -DHAVE_THREAD_LS"]) fi # DEBUG AX_DEBUG AS_IF([test "$ax_enable_debug" = "yes"], [AM_CFLAGS="$AM_CFLAGS $DEBUG_CFLAGS"], [AM_CFLAGS="$AM_CFLAGS -DNDEBUG"]) AS_IF([test "$ax_enable_debug" = "yes"], [AM_CCASFLAGS="$DEBUG_CFLAGS $AM_CCASFLAGS"], [AM_CCASFLAGS="$AM_CCASFLAGS -DNDEBUG"]) AC_ARG_ENABLE([debug-code-points], [ AS_HELP_STRING([--enable-debug-code-points],[Include source file and line number in --enable-debug messages.]) ], [ ENABLED_DEBUG_CODEPOINTS=$enableval ], [ ENABLED_DEBUG_CODEPOINTS=no ] ) if test "$ENABLED_DEBUG_CODEPOINTS" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEBUG_CODEPOINTS" fi AC_ARG_ENABLE([debug-trace-errcodes], [ AS_HELP_STRING([--enable-debug-trace-errcodes],[Print trace messages when library errors are thrown.]) ], [ ENABLED_DEBUG_TRACE_ERRCODES=$enableval ], [ ENABLED_DEBUG_TRACE_ERRCODES=no ] ) if test "$ENABLED_DEBUG_TRACE_ERRCODES" != "no" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DEBUG_TRACE_ERROR_CODES" fi if test "$ENABLED_DEBUG_TRACE_ERRCODES" = "backtrace" then AM_CFLAGS="$AM_CFLAGS -g -funwind-tables -DWOLFSSL_DEBUG_BACKTRACE_ERROR_CODES" AM_LDFLAGS="$AM_LDFLAGS -lbacktrace" fi # Start without certificates enabled and enable if a certificate algorithm is # enabled ENABLED_CERTS="no" # Implements requirements from RFC9325 AC_ARG_ENABLE([harden-tls], [AS_HELP_STRING([--enable-harden-tls],[Enable requirements from RFC9325. Possible values are , <112>, or <128>. is equivalent to <112>. (default: disabled)])], [ ENABLED_HARDEN_TLS=$enableval ], [ ENABLED_HARDEN_TLS=no ] ) if test "x$ENABLED_HARDEN_TLS" != "xno" then if test "x$ENABLED_HARDEN_TLS" = "xyes" || test "x$ENABLED_HARDEN_TLS" = "x112" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HARDEN_TLS=112" elif test "x$ENABLED_HARDEN_TLS" = "x128" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HARDEN_TLS=128" else AC_MSG_ERROR([Invalid value for --enable-harden-tls]) fi AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_EXTRA_ALERTS -DWOLFSSL_CHECK_ALERT_ON_ERR" fi # Support for forcing 32-bit mode # To force 32-bit instructions use: # ./configure CFLAGS="-m32" LDFLAGS="-m32" && make # The checks for sizeof long and long/long are run at the top of configure and require "-m32" to be set directly in the ./configure statement. AC_ARG_ENABLE([32bit], [AS_HELP_STRING([--enable-32bit],[Enables 32-bit support (default: disabled)])], [ ENABLED_32BIT=$enableval ], [ ENABLED_32BIT=no ] ) if test "$ENABLED_32BIT" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWC_32BIT_CPU" fi # 16-bit compiler support AC_ARG_ENABLE([16bit], [AS_HELP_STRING([--enable-16bit],[Enables 16-bit support (default: disabled)])], [ ENABLED_16BIT=$enableval ], [ ENABLED_16BIT=no ] ) if test "$ENABLED_16BIT" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWC_16BIT_CPU" fi AC_ARG_ENABLE([64bit], [AS_HELP_STRING([--enable-64bit],[Enables 64-bit support (default: disabled)])], [ ENABLED_64BIT=$enableval ], [ ENABLED_64BIT=no ] ) AC_ARG_ENABLE([kdf], [AS_HELP_STRING([--enable-kdf],[Enables kdf support (default: enabled)])], [ ENABLED_KDF=$enableval ], [ ENABLED_KDF=yes ] ) AC_ARG_ENABLE([hmac], [AS_HELP_STRING([--enable-hmac],[Enables HMAC support (default: enabled)])], [ ENABLED_HMAC=$enableval ], [ ENABLED_HMAC=yes ] ) AC_ARG_ENABLE([hmac-copy], [AS_HELP_STRING([--enable-hmac-copy],[Enables digest copying implementation for HMAC (default: disabled)])], [ ENABLED_HMAC_COPY=$enableval ], [ ENABLED_HMAC_COPY=no ] ) if test "$ENABLED_HMAC_COPY" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HMAC_COPY_HASH" fi AC_ARG_ENABLE([do178], [AS_HELP_STRING([--enable-do178],[Enable DO-178, Will NOT work w/o DO178 license (default: disabled)])], [ENABLED_DO178=$enableval], [ENABLED_DO178="no"]) if test "$ENABLED_DO178" = "no" then AM_CFLAGS="$AM_CFLAGS -DNO_DO178" else AM_CFLAGS="$AM_CFLAGS -DHAVE_DO178" fi # Support for disabling all ASM AC_ARG_ENABLE([asm], [AS_HELP_STRING([--enable-asm],[Enables option for assembly (default: enabled)])], [ ENABLED_ASM=$enableval ], [ ENABLED_ASM=yes ] ) if test "$ENABLED_ASM" = "no" then AM_CFLAGS="$AM_CFLAGS -DTFM_NO_ASM -DWOLFSSL_NO_ASM" fi AC_SUBST([ENABLED_ASM]) # Default math is SP Math all and not fast math # FIPS v1 and v2 must use fast math DEF_SP_MATH_ALL="yes" DEF_FAST_MATH="no" # FIPS 140 AC_ARG_ENABLE([fips], [AS_HELP_STRING([--enable-fips],[Enable FIPS 140-2/3, Will NOT work w/o FIPS license (default: disabled)])], [ENABLED_FIPS=$enableval], [ENABLED_FIPS="no"]) FIPS_FLAVOR="$ENABLED_FIPS" AC_SUBST([FIPS_FLAVOR]) # wolfProvider Options AC_ARG_ENABLE([wolfprovider], [AS_HELP_STRING([--enable-wolfprovider],[Enable wolfProvider options (default: disabled)])], [ ENABLED_WOLFPROVIDER=$enableval ], [ ENABLED_WOLFPROVIDER=no ] ) if test "x$ENABLED_WOLFPROVIDER" != "xno" then test -z "$enable_all_crypto" && enable_all_crypto=yes test -z "$enable_opensslcoexist" && enable_opensslcoexist=yes test -z "$enable_sha" && enable_sha=yes test -z "$with_eccminsz" && with_eccminsz=192 test -z "$with_max_ecc_bits" && with_max_ecc_bits=1024 AM_CFLAGS="$AM_CFLAGS -DHAVE_WOLFPROVIDER -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DHAVE_PUBLIC_FFDHE -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER" fi # wolfEngine Options AC_ARG_ENABLE([engine], [AS_HELP_STRING([--enable-engine],[Enable wolfEngine options (default: disabled)])], [ ENABLED_WOLFENGINE=$enableval ], [ ENABLED_WOLFENGINE=no ] ) if test "x$ENABLED_WOLFENGINE" != "xno" then test -z "$with_eccminsz" && with_eccminsz=192 fi AS_CASE([$ENABLED_WOLFENGINE], [no],[ ENABLED_WOLFENGINE="no" ], [disabled],[ ENABLED_WOLFENGINE="no" ], [yes|fips-v2|cert3389],[ ENABLED_WOLFENGINE="yes" ENABLED_FIPS="v2" ], [fips-v5],[ ENABLED_WOLFENGINE="yes" ENABLED_FIPS="v5" ], [fips-v6],[ ENABLED_WOLFENGINE="yes" ENABLED_FIPS="v6" ], [fips-ready],[ ENABLED_WOLFENGINE="yes" ENABLED_FIPS="ready" ], [no-fips],[ ENABLED_WOLFENGINE="yes" ENABLED_FIPS="no" ], [ AC_MSG_ERROR([Invalid value for --enable-engine "$ENABLED_WOLFENGINE" (options: fips-v2, fips-ready, no-fips, no, disabled)]) ]) # The FIPS options are: # no - FIPS build disabled, FIPS sources forbidden in build tree # disabled - FIPS build disabled, FIPS sources ignored in build tree # v1 - FIPS 140-2 Cert 2425 # default - same as v1 # v2 - FIPS 140-2 Cert 3389 # cert3389 - alias for v2 # rand - wolfRand # v5 - FIPS 140-3 Cert 4718 # cert4718 - alias for v5 # v5.2.3 -- FIPS 140-3 with support for ARM acceleration, derived from Cert 4718 # v5.2.4 -- FIPS 140-3 with support for Linux kernel mode, derived from v5.2.3 # ready - FIPS 140-3 settings with in-tree wolfcrypt sources, feature locked # dev - FIPS 140-3 settings with in-tree wolfcrypt sources, features freely adjustable # v5-ready - Alias for ready. # v5-dev - Alias for dev. # v6 - The SRTP-KDF-full-submission # # These options have been retired, but are listed here for historical reference: # v5-RC8 - historical FIPS 140-3 (wolfCrypt WCv5.0-RC8). # HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 0. # v5-RC9 - historical FIPS 140-3 (wolfCrypt WCv5.0-RC9) # HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 1. # v5-RC10 - historical FIPS 140-3, wolfCrypt/fips WCv5.0-RC10 # HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 2. # v5-RC11 - historical FIPS 140-3, wolfCrypt/fips WCv5.0-RC11 # HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 2. # v5-RC12 - historical FIPS 140-3, wolfCrypt/fips WCv5.0-RC12 AS_CASE([$ENABLED_FIPS], [no],[ FIPS_VERSION="none" ], [disabled],[ FIPS_VERSION="disabled" ENABLED_FIPS="no" ], [v1|cert2425],[ FIPS_VERSION="v1" HAVE_FIPS_VERSION_MAJOR=1 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="no" DEF_FAST_MATH="yes" ], [v2|cert3389],[ FIPS_VERSION="v2" HAVE_FIPS_VERSION_MAJOR=2 HAVE_FIPS_VERSION_MINOR=0 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="no" DEF_FAST_MATH="yes" ], [rand],[ FIPS_VERSION="rand" HAVE_FIPS_VERSION_MAJOR=2 HAVE_FIPS_VERSION_MINOR=1 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="no" DEF_FAST_MATH="no" ], [v5|cert4718],[ FIPS_VERSION="v5" HAVE_FIPS_VERSION_MAJOR=5 HAVE_FIPS_VERSION_MINOR=2 HAVE_FIPS_VERSION_PATCH=1 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="no" DEF_FAST_MATH="yes" ], [v5.2.3],[ FIPS_VERSION="v5" HAVE_FIPS_VERSION_MAJOR=5 HAVE_FIPS_VERSION_MINOR=2 HAVE_FIPS_VERSION_PATCH=3 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="yes" DEF_FAST_MATH="no" ], [v5.2.4],[ FIPS_VERSION="v5" HAVE_FIPS_VERSION_MAJOR=5 HAVE_FIPS_VERSION_MINOR=2 HAVE_FIPS_VERSION_PATCH=4 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="yes" DEF_FAST_MATH="no" ], [v5-RC12],[ FIPS_VERSION="v5-RC12" HAVE_FIPS_VERSION_MAJOR=5 HAVE_FIPS_VERSION_MINOR=2 HAVE_FIPS_VERSION_PATCH=0 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="no" DEF_FAST_MATH="yes" ], [v5-ready],[ FIPS_VERSION="v5-ready" HAVE_FIPS_VERSION_MAJOR=5 HAVE_FIPS_VERSION_MINOR=3 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="no" DEF_FAST_MATH="yes" ], [v5-dev],[ FIPS_VERSION="v5-dev" HAVE_FIPS_VERSION_MAJOR=5 HAVE_FIPS_VERSION_MINOR=2 HAVE_FIPS_VERSION_PATCH=1 ENABLED_FIPS="yes" # for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all) ], [v5-kcapi],[ FIPS_VERSION="v5-dev" HAVE_FIPS_VERSION_MAJOR=5 HAVE_FIPS_VERSION_MINOR=3 HAVE_FIPS_VERSION_PATCH=0 ENABLED_FIPS="yes" # for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all) ], [v6|v6-dev],[ FIPS_VERSION="v6" HAVE_FIPS_VERSION=6 HAVE_FIPS_VERSION_MAJOR=6 HAVE_FIPS_VERSION_MINOR=0 HAVE_FIPS_VERSION_PATCH=0 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="yes" DEF_FAST_MATH="no" ], [v7],[ FIPS_VERSION="v7" HAVE_FIPS_VERSION=7 HAVE_FIPS_VERSION_MAJOR=7 HAVE_FIPS_VERSION_MINOR=0 HAVE_FIPS_VERSION_PATCH=0 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="yes" DEF_FAST_MATH="no" ], # Should always remain one ahead of the latest so as not to be confused with # the latest [ready|v7-ready],[ FIPS_VERSION="ready" HAVE_FIPS_VERSION=8 HAVE_FIPS_VERSION_MAJOR=8 HAVE_FIPS_VERSION_MINOR=0 HAVE_FIPS_VERSION_PATCH=0 ENABLED_FIPS="yes" DEF_SP_MATH_ALL="yes" DEF_FAST_MATH="no" ], [dev|v7-dev],[ FIPS_VERSION="dev" HAVE_FIPS_VERSION_MAJOR=8 HAVE_FIPS_VERSION_MINOR=0 HAVE_FIPS_VERSION_PATCH=0 ENABLED_FIPS="yes" # for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all) ], [lean-aesgcm|lean-aesgcm-ready|lean-aesgcm-dev],[ FIPS_VERSION="$ENABLED_FIPS" HAVE_FIPS_VERSION_MAJOR=8 HAVE_FIPS_VERSION_MINOR=0 HAVE_FIPS_VERSION_PATCH=0 ENABLED_FIPS="yes" ], [ AS_IF([test "$ENABLED_FIPS" = "yes"],[ENABLED_FIPS="(unset)"],[ENABLED_FIPS=\"$ENABLED_FIPS\"]) AC_MSG_ERROR([Invalid value for --enable-fips $ENABLED_FIPS (main options: v1, v2, v5, v6, v7, ready, dev, rand, lean-aesgcm, no, disabled)]) ]) if test -z "$HAVE_FIPS_VERSION_MAJOR" then HAVE_FIPS_VERSION_MAJOR=0 fi if test -z "$HAVE_FIPS_VERSION_MINOR" then HAVE_FIPS_VERSION_MINOR=0 fi if test -z "$HAVE_FIPS_VERSION_PATCH" then HAVE_FIPS_VERSION_PATCH=0 fi if test -z "$HAVE_FIPS_VERSION" then HAVE_FIPS_VERSION="$HAVE_FIPS_VERSION_MAJOR" fi if test "$ENABLED_FIPS" != "no" then REPRODUCIBLE_BUILD_DEFAULT=yes fi AS_CASE([$FIPS_VERSION], [none], [ AS_IF([ test -s $srcdir/wolfcrypt/src/fips.c ], [AC_MSG_ERROR([FIPS source tree is incompatible with non-FIPS build (requires --enable-fips)])]) ], [disabled], [], [ AS_IF([ ! test -s $srcdir/wolfcrypt/src/fips.c], [AC_MSG_ERROR([non-FIPS source tree is incompatible with --enable-fips=$enableval])]) ] ) # For reproducible build, gate out from the build anything that might # introduce semantically frivolous jitter, maximizing chance of # identical object files. AC_ARG_ENABLE([reproducible-build], [AS_HELP_STRING([--enable-reproducible-build],[Enable maximally reproducible build (default: disabled)])], [ ENABLED_REPRODUCIBLE_BUILD=$enableval ], [ ENABLED_REPRODUCIBLE_BUILD=$REPRODUCIBLE_BUILD_DEFAULT ] ) if test "$ENABLED_REPRODUCIBLE_BUILD" = "yes" then # Test ar for the "D" option. Should be checked before the libtool macros. if test -z "$AR"; then AR=ar fi xxx_ar_flags=$(${AR} --help 2>&1) if test -z "$RANLIB"; then RANLIB=ranlib fi xxx_ranlib_flags=$(${RANLIB} --help 2>&1) AS_CASE([$xxx_ar_flags],[*'use zero for timestamps and uids/gids'*],[AR_FLAGS="Dcr" lt_ar_flags="Dcr"]) AS_CASE([$xxx_ranlib_flags],[*'Use zero for symbol map timestamp'*],[RANLIB="${RANLIB} -D"]) AM_CFLAGS="$AM_CFLAGS -DHAVE_REPRODUCIBLE_BUILD" # opportunistically use -ffile-prefix-map (added in GCC8 and LLVM10) if "$CC" -ffile-prefix-map=/tmp=. -x c - -o /dev/null >/dev/null 2>&1 <<' EOF' #include int main(int argc, char **argv) { (void)argc; (void)argv; return 0; } EOF then AM_CFLAGS="$AM_CFLAGS -ffile-prefix-map=\$(abs_top_srcdir)/= -ffile-prefix-map=\$(top_srcdir)/=" fi # opportunistically force linker option --build-id=sha1 (usually the default) if "$CC" -Wl,--build-id=sha1 -x c - -o /dev/null >/dev/null 2>&1 <<' EOF' #include int main(int argc, char **argv) { (void)argc; (void)argv; return 0; } EOF then AM_LDFLAGS="$AM_LDFLAGS -Wl,--build-id=sha1" fi fi AC_ARG_ENABLE([benchmark], [AS_HELP_STRING([--enable-benchmark],[Build benchmark when building crypttests (default: enabled)])], [ENABLED_BENCHMARK=$enableval], [ENABLED_BENCHMARK=yes] ) # Remainder of Linux kernel module options, continued from earlier: ENABLED_LINUXKM_PIE=$ENABLED_FIPS AC_ARG_ENABLE([kernel-reloc-tables], [AS_HELP_STRING([--enable-kernel-reloc-tables],[Enable containerized object build of wolfCrypt module in kernel build (default: disabled)])], [ENABLED_LINUXKM_PIE=$enableval]) AC_ARG_ENABLE([linuxkm-pie], [AS_HELP_STRING([--enable-linuxkm-pie],[Alias for --enable-kernel-reloc-tables])], [ENABLED_LINUXKM_PIE=$enableval]) if test "$ENABLED_LINUXKM" = "yes" && test "$ENABLED_LINUXKM_PIE" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWC_SYM_RELOC_TABLES" fi AC_SUBST([ENABLED_LINUXKM_PIE]) AC_ARG_ENABLE([linuxkm-benchmarks], [AS_HELP_STRING([--enable-linuxkm-benchmarks],[Enable crypto benchmarking autorun at module load time for Linux kernel module (default: disabled)])], [ENABLED_KERNEL_BENCHMARKS=$enableval]) if test "$ENABLED_LINUXKM" = "yes" && test "$ENABLED_KERNEL_BENCHMARKS" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LINUXKM_BENCHMARKS" fi AC_SUBST([ENABLED_KERNEL_BENCHMARKS]) # Kernel mode only supports sp-math-all with smallstack. if test "$KERNEL_MODE_DEFAULTS" = "yes" then DEF_SP_MATH_ALL="yes" DEF_FAST_MATH="no" fi # # kernel mode variables. Shared by linuxkm, freebsdkm. KERNEL_ROOT="" HAVE_KERNEL_MODE=no # Kernel root source tree. AC_ARG_WITH([kernel-source], [AS_HELP_STRING([--with-kernel-source=PATH],[PATH to root of kernel build tree])], [KERNEL_ROOT=$withval]) # For backwards compatibility. AC_ARG_WITH([linux-source], [AS_HELP_STRING([--with-linux-source=PATH],[PATH to root of Linux kernel build tree])], [KERNEL_ROOT=$withval]) AC_ARG_WITH([linux-arch], [AS_HELP_STRING([--with-linux-arch=arch],[built arch (SRCARCH) of Linux kernel build tree])], [KERNEL_ARCH=$withval], [KERNEL_ARCH=""]) if test "x$ENABLED_LINUXKM" = "xyes" then HAVE_KERNEL_MODE=yes # Currently DWARF 5 is the default debug format, but it results in # "Unsupported DW_TAG_atomic_type(0x47): type: 0x1eefc" in some # kernel module builds. AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LINUXKM -gdwarf-4" AS_IF([test "$ax_enable_debug" = "yes"], [AM_CFLAGS="$AM_CFLAGS -g3"], [AM_CFLAGS="$AM_CFLAGS -g1"]) AM_CCASFLAGS="$AM_CFLAGS -DWOLFSSL_LINUXKM -gdwarf-4" AS_IF([test "$ax_enable_debug" = "yes"], [AM_CCASFLAGS="$AM_CFLAGS -g3"], [AM_CCASFLAGS="$AM_CFLAGS -g1"]) ENABLED_NO_LIBRARY=yes ENABLED_BENCHMARK=no output_objdir="$(realpath "$output_objdir")/linuxkm" if test "$KERNEL_ROOT" = ""; then AC_PATH_DEFAULT_KERNEL_SOURCE KERNEL_ROOT="$DEFAULT_KERNEL_ROOT" fi AC_SUBST([KERNEL_ROOT]) if test "$KERNEL_ARCH" = ""; then AC_DEFAULT_KERNEL_ARCH KERNEL_ARCH="$DEFAULT_KERNEL_ARCH" fi AC_SUBST([KERNEL_ARCH]) if test "${KERNEL_ROOT}" = ""; then AC_MSG_ERROR([Linux kernel source root not found -- supply with --with-linux-source=PATH.]) fi if test "${KERNEL_ARCH}" = ""; then AC_MSG_ERROR([Linux kernel target architecture for build tree ${KERNEL_ROOT} could not be determined. Is target kernel configured?]) fi fi # # FreeBSD AC_ARG_WITH([bsd-export-syms], [AS_HELP_STRING([--with-bsd-export-syms=LIST],[Sets FreeBSD kernel module EXPORT_SYMS. Allowed values: YES, NO, or LIST of symbols to export (default NO).])], [BSDKM_EXPORT_SYMS=$withval], [BSDKM_EXPORT_SYMS="NO"]) if test "x$ENABLED_BSDKM" = "xyes" then # note: bsdkm is wolfcrypt only for now. HAVE_KERNEL_MODE=yes ENABLED_NO_LIBRARY=yes ENABLED_BENCHMARK=no output_objdir="$(realpath "$output_objdir")/bsdkm" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_BSDKM -DWC_SIPHASH_NO_ASM" AM_CFLAGS="$AM_CFLAGS -DNO_DEV_RANDOM -DNO_WRITEV -DNO_STDIO_FILESYSTEM" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SOCK -DWOLFSSL_USER_IO" AM_CFLAGS="$AM_CFLAGS -DXMALLOC_OVERRIDE -DWOLFCRYPT_ONLY" AM_CFLAGS="$AM_CFLAGS -DNO_ASN_TIME" if test "$ax_enable_debug" = "yes"; then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_BSDKM_VERBOSE_DEBUG" AM_CFLAGS="$AM_CFLAGS -DNO_WOLFSSL_DEBUG_CERTS" fi if test "$KERNEL_ROOT" = ""; then AC_PATH_DEFAULT_BSDKM_SOURCE KERNEL_ROOT="$DEFAULT_BSDKM_ROOT" fi AC_SUBST([KERNEL_ROOT]) AC_SUBST([BSDKM_EXPORT_SYMS]) fi if test "x$ENABLED_BSDKM_REGISTER" = "xyes" then if test "$ENABLED_AESGCM" != "no" && test "$ENABLED_AESGCM_STREAM" = "no" && test "$enable_aesgcm_stream" != "no" && (test "$ENABLED_FIPS" = "no" || test $HAVE_FIPS_VERSION -ge 6); then ENABLED_AESGCM_STREAM=yes fi AM_CFLAGS="$AM_CFLAGS -DBSDKM_CRYPTO_REGISTER" AC_SUBST([ENABLED_BSDKM_REGISTER]) fi # end FreeBSD configure # MATH LIBRARY SELECTION # tiny TLS 1.3: align all feature switches with the WOLFSSL_TINY_TLS13 umbrella # here, EARLY, before they are consumed (math, ASN, TLS version, renegotiation, # etc. are decided at scattered points further down). The -D macros are emitted # later where the AC_ARG_ENABLE help/validation lives. if test "x$enable_tinytls13" != "x" && test "x$enable_tinytls13" != "xno" then tinytls13_cert=no tinytls13_p256=no tinytls13_asm=no for v in `echo $enable_tinytls13 | tr ',' ' '` do case $v in cert|mutualauth) tinytls13_cert=yes ;; p256) tinytls13_p256=yes ;; rsaverify) enable_rsa=yes ;; asm) tinytls13_asm=yes ;; mldsa) enable_mldsa=yes ;; sha384) enable_sha384=yes; enable_sha512=yes ;; esac done # Floor is SHA-256 only. SHA-384/512 share the (large) SHA-512 core and are # otherwise pulled in by default, so keep them out unless asked (sha384). test "x$enable_sha384" = "x" && enable_sha384=no test "x$enable_sha512" = "x" && enable_sha512=no # Small-C floor by default: no platform assembly unless the asm adder is # selected. ENABLED_ASM (resolved above) is the variable the downstream # assembly decisions read; emit the no-asm defines here too, since the # WOLFSSL_NO_ASM emission earlier ran before this block. if test "$tinytls13_asm" = "yes" then ENABLED_ASM=yes else ENABLED_ASM=no AM_CFLAGS="$AM_CFLAGS -DTFM_NO_ASM -DWOLFSSL_NO_ASM" fi # TLS 1.3 only, no legacy TLS / renegotiation / extras. enable_tls13=yes enable_oldtls=no enable_tlsv10=no test "x$enable_tlsv12" = "x" && enable_tlsv12=no enable_dsa=no enable_dh=no enable_psk=yes enable_lowresource=yes if test "$tinytls13_cert" = "yes" then enable_ecc=yes # P-256 only SP math to match the documented footprint; bare "yes" # would also pull in P-384/P-521 on 64-bit hosts. enable_sp="yes,256" test "x$enable_asn" = "x" && enable_asn=template test "x$enable_rsa" = "x" && enable_rsa=no else test "x$enable_asn" = "x" && enable_asn=no test "x$enable_rsa" = "x" && enable_rsa=no if test "$tinytls13_p256" = "yes" then enable_ecc=yes enable_sp="yes,256" else test "x$enable_ecc" = "x" && enable_ecc=no enable_curve25519=yes fi fi fi # Assure consistency of defaults if test "$DEF_FAST_MATH" = "yes" && ( (test "$enable_sp_math" != "no" && test "$enable_sp_math" != "") || test "$enable_heapmath" = "yes") then DEF_FAST_MATH=no fi if test "$DEF_SP_MATH_ALL" = "yes" && (test "$enable_fastmath" = "yes" || test "$enable_fasthugemath" = "yes" || test "$enable_heapmath" = "yes") then DEF_SP_MATH_ALL=no fi # Single Precision maths implementation AC_ARG_ENABLE([sp], [AS_HELP_STRING([--enable-sp],[Enable Single Precision maths implementation (default: disabled)])], [ ENABLED_SP=$enableval ], [ ENABLED_SP=$ENABLED_SP_DEFAULT ], ) AC_ARG_ENABLE([sp-math-all], [AS_HELP_STRING([--enable-sp-math-all],[Enable Single Precision math implementation for full algorithm suite (default: enabled)])], [ ENABLED_SP_MATH_ALL=$enableval ], [ ENABLED_SP_MATH_ALL=$DEF_SP_MATH_ALL ], ) # Single Precision maths (acceleration for common key sizes and curves) if test "$KERNEL_MODE_DEFAULTS" = "yes" && test "$ENABLED_SP" != "no" && test "$ENABLED_SP_MATH_ALL" = "no" then ENABLED_SP_MATH_DEFAULT=yes else ENABLED_SP_MATH_DEFAULT=no fi AC_ARG_ENABLE([sp-math], [AS_HELP_STRING([--enable-sp-math],[Enable Single Precision math implementation with restricted algorithm suite (default: disabled)])], [ ENABLED_SP_MATH=$enableval ], [ ENABLED_SP_MATH=$ENABLED_SP_MATH_DEFAULT ], ) if test "$enable_sp_math" != "" then # When the restricted SP Math is selected and not SP Math ALL, then disable # SP Math ALL. if test "$enable_sp_math" != "no" && test "$enable_sp_math_all" = "" then ENABLED_SP_MATH_ALL="no" else # Can't choose restricted and unrestricted SP Math if test "$enable_sp_math" != "no" && test "$enable_sp_math_all" != "no" then AC_MSG_ERROR([--enable-sp-math and --enable-sp-math-all are incompatible. Use --enable-sp-math-all only when all key sizes need to be supported.]) fi fi fi # enable SP math assembly support automatically for x86_64 and aarch64 (except kernel modules) SP_ASM_DEFAULT=no if test "$ENABLED_SP_MATH" = "yes" && test "$KERNEL_MODE_DEFAULTS" = "no" then if test "$host_cpu" = "x86_64" || test "$host_cpu" = "aarch64" || test "$host_cpu" = "amd64" then SP_ASM_DEFAULT=yes fi fi AC_ARG_ENABLE([sp-asm], [AS_HELP_STRING([--enable-sp-asm],[Enable Single Precision assembly implementation (default: enabled on x86_64/aarch64/amd64)])], [ ENABLED_SP_ASM=$enableval ], [ ENABLED_SP_ASM=$SP_ASM_DEFAULT ], ) if test "$ENABLED_SP_ASM" != "no" then if test "$ENABLED_SP" = "no" then AC_MSG_ERROR([--enable-sp-asm requires SP to be enabled.]) fi if test "$ENABLED_SP" = "" then ENABLED_SP=yes fi fi # fastmath AC_ARG_ENABLE([fastmath], [AS_HELP_STRING([--enable-fastmath],[Enable legacy Tom's Fast Math back end (default: disabled)])], [ ENABLED_FASTMATH=$enableval ], [ ENABLED_FASTMATH=$DEF_FAST_MATH ] ) # fast HUGE math AC_ARG_ENABLE([fasthugemath], [AS_HELP_STRING([--enable-fasthugemath],[Enable legacy Tom's Fast Math + huge code (default: disabled)])], [ ENABLED_FASTHUGEMATH=$enableval ], [ ENABLED_FASTHUGEMATH=no ] ) # ssl bump build AC_ARG_ENABLE([bump], [AS_HELP_STRING([--enable-bump],[Enable SSL Bump build (default: disabled)])], [ ENABLED_BUMP=$enableval ], [ ENABLED_BUMP=no ] ) if test "$ENABLED_BUMP" = "yes" then AM_CFLAGS="$AM_CFLAGS -DLARGE_STATIC_BUFFERS -DWOLFSSL_CERT_GEN -DWOLFSSL_KEY_GEN -DHUGE_SESSION_CACHE -DWOLFSSL_DER_LOAD -DWOLFSSL_ALT_NAMES -DWOLFSSL_TEST_CERT" DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096 if test "$ENABLED_SP_MATH" = "no" && test "$ENABLED_SP_MATH_ALL" = "no" then ENABLED_FASTHUGEMATH="yes" fi fi if test "$ENABLED_FASTHUGEMATH" = "yes" then ENABLED_FASTMATH="yes" fi if (test "$host_cpu" = "x86_64" || test "$host_cpu" = "amd64") && test "$ENABLED_32BIT" != "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_X86_64_BUILD" fi if test "$host_cpu" = "x86" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_X86_BUILD" fi AC_ARG_ENABLE([leanpsk], [AS_HELP_STRING([--enable-leanpsk],[Enable Lean PSK build (default: disabled)])], [ ENABLED_LEANPSK=$enableval ], [ ENABLED_LEANPSK=no ] ) if test "$ENABLED_LEANPSK" = "yes" then AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LEANPSK -DWOLFSSL_STATIC_PSK -DHAVE_NULL_CIPHER -DSINGLE_THREADED -DNO_AES -DNO_FILESYSTEM -DNO_RSA -DNO_DSA -DNO_DH -DNO_PWDBASED -DNO_MD4 -DNO_MD5 -DNO_ERROR_STRINGS -DNO_OLD_TLS -DNO_RC4 -DNO_WRITEV -DNO_DEV_RANDOM -DWOLFSSL_USER_IO -DNO_SHA" ENABLED_SLOWMATH="no" ENABLED_SINGLETHREADED="yes" enable_lowresource=yes fi # ASN # disabling ASN implicitly disables certs, RSA, DSA, and ECC, # and also disables MPI unless DH is enabled. # turn off ASN if leanpsk on if test "$ENABLED_LEANPSK" = "yes" then enable_asn=no fi AC_ARG_ENABLE([asn], [AS_HELP_STRING([--enable-asn],[Enable ASN (default: enabled)])], [ ENABLED_ASN=$enableval ], [ ENABLED_ASN=yes ] ) for v in `echo $ENABLED_ASN | tr "," " "` do case $v in all) # Enable all ASN features AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_ALL" ENABLED_ASN=yes ASN_IMPL=template ;; template | yes) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_TEMPLATE" ENABLED_ASN=yes ASN_IMPL=template ;; original) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_ORIGINAL" ASN_IMPL=original ;; nocrypt) AM_CFLAGS="$AM_CFLAGS -DNO_ASN_CRYPT" enable_pwdbased=no ASN_IMPL=template ;; no) AM_CFLAGS="$AM_CFLAGS -DNO_ASN -DNO_ASN_CRYPT" enable_pwdbased=no ASN_IMPL=no ;; *) AC_MSG_ERROR([Invalid asn option. Valid are: all, template/yes, original, nocrypt or no. Seen: $ENABLED_ASN.]) break;; esac done # if sp-math-all is not set, then enable fast math if test "x$ENABLED_FASTMATH" = "xyes" && test "$enable_sp_math_all" = "" && test "$enable_sp_math" = "" then # turn off fastmath if leanpsk on or asn off (w/o DH and ECC) if test "$ENABLED_LEANPSK" = "yes" || test "$ENABLED_ASN" = "no" then if test "$ENABLED_DH" = "no" && test "$ENABLED_ECC" = "no" && test "$ENABLED_RSA" = "no" then ENABLED_FASTMATH="no" else AM_CFLAGS="$AM_CFLAGS -DUSE_FAST_MATH" ENABLED_HEAPMATH="no" fi else AM_CFLAGS="$AM_CFLAGS -DUSE_FAST_MATH" ENABLED_HEAPMATH="no" ENABLED_SP_MATH_ALL="no" fi AS_IF([test "x$host_cpu" = "xaarch64"],[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AARCH64_BUILD"]) if test "$ENABLED_SAKKE" = "yes" && test "$ENABLED_SAKKE_SMALL" != "yes" then AM_CFLAGS="$AM_CFLAGS -funroll-loops -DTFM_SMALL_SET" fi fi # heap based integer.c math (not timing resistant) AC_ARG_ENABLE([heapmath], [AS_HELP_STRING([--enable-heapmath],[Enable heap based integer.c math ops (default: disabled)])], [ ENABLED_HEAPMATH=$enableval ], [ ENABLED_HEAPMATH=no] ) if test "x$ENABLED_HEAPMATH" = "xyes" then AM_CFLAGS="$AM_CFLAGS -DUSE_INTEGER_HEAP_MATH" ENABLED_HEAPMATH="yes" ENABLED_SP="no" ENABLED_SP_MATH_ALL="no" fi # wolfCrypt Only Build AC_ARG_ENABLE([cryptonly], [AS_HELP_STRING([--enable-cryptonly],[Enable wolfCrypt Only build (default: disabled)])], [ENABLED_CRYPTONLY=$enableval], [ENABLED_CRYPTONLY=no]) AS_IF([test "x$FIPS_VERSION" = "xrand"],[ENABLED_CRYPTONLY="yes"]) # TLS AC_ARG_ENABLE([tls], [AS_HELP_STRING([--enable-tls],[Enable TLS support (default: enabled)])], [ ENABLED_TLS=$enableval ], [ ENABLED_TLS=yes ] ) if test "$ENABLED_CRYPTONLY" = "yes" then ENABLED_TLS=no fi if test "$ENABLED_TLS" = "no" then AM_CFLAGS="$AM_CFLAGS -DNO_TLS" # don't set enable_tls13 or enable_tlsv12 to "no" -- even in cryptonly and # NO_TLS build, they're needed for their crypto-layer KDFs. # enable_tlsv10 defaults to "no", so we don't need to set it here either. test "$enable_dtls" = "" && enable_dtls=no test "$enable_dtls13" = "" && enable_dtls13=no test "$enable_dtls_mtu" = "" && enable_dtls_mtu=no test "$enable_dtlscid" = "" && enable_dtlscid=no test "$enable_dtls_frag_ch" = "" && enable_dtls_frag_ch=no test "$enable_mcast" = "" && enable_mcast=no test "$enable_srtp" = "" && enable_srtp=no test "$enable_ocsp" = "" && enable_ocsp=no test "$enable_tlsx" = "" && enable_tlsx=no test "$enable_sni" = "" && enable_sni=no test "$enable_crl_monitor" = "" && enable_crl_monitor=no test "$enable_alpn" = "" && enable_alpn=no test "$enable_pkcallbacks" = "" && enable_pkcallbacks=no test "$enable_quic" = "" && enable_quic=no test "$enable_ech" = "" && enable_ech=no test "$enable_ocspstapling" = "" && enable_ocspstapling=no test "$enable_earlydata" = "" && enable_earlydata=no test "$enable_renegotiation_indication" = "" && enable_renegotiation_indication=no test "$enable_secure_renegotiation_info" = "" && enable_secure_renegotiation_info=no test "$enable_secure_renegotiation" = "" && enable_secure_renegotiation=no # Disable all open source compatibility enables that might get set with all test "$enable_all_osp" = "" && enable_all_osp=no fi # All features, except conflicting or experimental: AC_ARG_ENABLE([all], [AS_HELP_STRING([--enable-all],[Enable all wolfSSL features, except SSLv3 (default: disabled)])], [ ENABLED_ALL=$enableval ], [ ENABLED_ALL=no ] ) if test "$ENABLED_ALL" = "yes" then test "$enable_all_crypto" = "" && enable_all_crypto=yes test "$enable_all_osp" = "" && test "$KERNEL_MODE_DEFAULTS" != "yes" && enable_all_osp=yes test "$enable_dtls" = "" && enable_dtls=yes test "$enable_dtls_mtu" = "" && enable_dtls_mtu=yes test "$enable_dtlscid" = "" && enable_dtlscid=yes test "$enable_dtls_frag_ch" = "" && enable_dtls_frag_ch=yes if test "x$FIPS_VERSION" != "xv1" then test "$enable_tls13" = "" && enable_tls13=yes test "$enable_dtls13" = "" && enable_dtls13=yes fi test "$enable_ocsp" = "" && enable_ocsp=yes test "$enable_ocspstapling" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling=yes test "$enable_ocspstapling2" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling2=yes test "$enable_ocsp_responder" = "" && test "$enable_ocsp" != "no" && test "$enable_sha" != "no" && test "$ASN_IMPL" = "template" && enable_ocsp_responder=yes test "$enable_savesession" = "" && enable_savesession=yes test "$enable_savecert" = "" && enable_savecert=yes test "$enable_postauth" = "" && enable_postauth=yes test "$enable_hrrcookie" = "" && enable_hrrcookie=yes test "$enable_crl_monitor" = "" && enable_crl_monitor=yes test "$enable_sni" = "" && enable_sni=yes test "$enable_maxfragment" = "" && enable_maxfragment=yes test "$enable_alpn" = "" && enable_alpn=yes test "$enable_truncatedhmac" = "" && enable_truncatedhmac=yes test "$enable_trustedca" = "" && enable_trustedca=yes test "$enable_session_ticket" = "" && enable_session_ticket=yes test "$enable_earlydata" = "" && enable_earlydata=yes test "$enable_rpk" = "" && enable_rpk=yes if test "$KERNEL_MODE_DEFAULTS" != "yes" then # Disable QUIC with JNI since incompatible with WOLFSSL_TLS13_MIDDLEBOX_COMPAT test "$enable_quic" = "" && test "$enable_cryptonly" != "yes" && test "$enable_jni" != "yes" && enable_quic=yes AM_CFLAGS="$AM_CFLAGS -DHAVE_CRL_IO -DHAVE_IO_TIMEOUT" fi if test "$ENABLED_SP_MATH" != "yes" then # kernel modules are currently incompatible with opensslextra and its dependents. if test "$KERNEL_MODE_DEFAULTS" != "yes" then test "$enable_opensslextra" = "" && enable_opensslextra=yes test "$enable_opensslall" = "" && enable_opensslall=yes test "$enable_certservice" = "" && enable_certservice=yes fi fi if test "$ENABLED_FIPS" = "no" then # Disable ECH with JNI since incompatible with WOLFSSL_TLS13_MIDDLEBOX_COMPAT test "$enable_ech" = "" && test "$enable_jni" != "yes" && enable_ech=yes test "$enable_scep" = "" && enable_scep=yes test "$enable_mcast" = "" && enable_mcast=yes fi if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -ge 6 then test "$enable_srtp" = "" && enable_srtp=yes fi AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DER_LOAD -DKEEP_OUR_CERT -DKEEP_PEER_CERT" # Certificate extensions and alt. names for FPKI use AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SUBJ_DIR_ATTR -DWOLFSSL_FPKI -DWOLFSSL_SUBJ_INFO_ACC" # Handle as many subject/issuer name OIDs as possible AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CERT_NAME_ALL" # More thorough error queue usage. AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VERBOSE_ERRORS" fi # All OSP meta-features: AC_ARG_ENABLE([all-osp], [AS_HELP_STRING([--enable-all-osp],[Enable all OSP meta feature sets (default: disabled)])], [ ENABLED_ALL_OSP=$enableval ], [ ENABLED_ALL_OSP=no] ) if test "$ENABLED_ALL_OSP" = "yes" then if test "$KERNEL_MODE_DEFAULTS" = "yes" then AC_MSG_ERROR([--enable-all-osp is incompatible with kernel mode defaults]) fi test "$enable_tailscale" = "" && enable_tailscale=yes test "$enable_wolfguard" = "" && enable_wolfguard=yes test "$enable_webserver" = "" && enable_webserver=yes if test "$ENABLED_SP_MATH" != "yes" then if test "$ENABLED_FIPS" = "no" then # S/MIME support requires PKCS7, which requires no FIPS. test "$enable_smime" = "" && enable_smime=yes if test "$ENABLED_32BIT" != "yes" then test "$enable_openssh" = "" && enable_openssh=yes fi fi if test "$ENABLED_ALL_OSP" != "no" then test "$enable_lighty" = "" && enable_lighty=yes test "$enable_nginx" = "" && enable_nginx=yes test "$enable_openvpn" = "" && enable_openvpn=yes test "$enable_asio" = "" && enable_asio=yes test "$enable_libwebsockets" = "" && enable_libwebsockets=yes fi fi if test "$ENABLED_FIPS" = "no" then # these use DES3: test "$enable_stunnel" = "" && enable_stunnel=yes test "$enable_curl" = "" && enable_curl=yes test "$enable_tcpdump" = "" && enable_tcpdump=yes fi fi # Auto-selected activation of all applicable asm accelerations # Enable asm automatically only if the compiler advertises itself as full Gnu C. if "$CC" $AM_CFLAGS $CPPFLAGS $CFLAGS -x c - -o /dev/null >/dev/null 2>&1 <<' EOF' #include int main(int argc, char **argv) { (void)argc; (void)argv; #ifdef __STRICT_ANSI__ #error __STRICT_ANSI__ #endif #ifndef __GNUC__ #error !__GNUC__ #endif return 0; } EOF then HAVE_GNUC=yes fi if test "$enable_all_crypto" = "yes" && test "$KERNEL_MODE_DEFAULTS" = "no" && test "$ENABLED_ASM" != "no" && test "$HAVE_GNUC" = "yes" && test "$enable_sp_asm" != "no" && test "$enable_intelasm" != "no" && test "$enable_armasm" != "no" && test "$enable_afalg" != "yes" && test "$ENABLED_32BIT" = "no" then DEFAULT_ENABLED_ALL_ASM=yes else DEFAULT_ENABLED_ALL_ASM=no fi if test "$ENABLED_FIPS" = "yes" && test "$HAVE_FIPS_VERSION" -lt 6 then case "$host_cpu" in *x86_64*|*amd64*) ;; *) DEFAULT_ENABLED_ALL_ASM=no ;; esac fi AC_ARG_ENABLE([all-asm], [AS_HELP_STRING([--enable-all-asm],[Enable all applicable assembly accelerations (default: disabled)])], [ ENABLED_ALL_ASM=$enableval ], [ ENABLED_ALL_ASM=$DEFAULT_ENABLED_ALL_ASM ] ) if test "$ENABLED_ALL_ASM" != "no" then if test "$ENABLED_ASM" = "no" then AC_MSG_ERROR([--enable-all-asm is incompatible with --disable-asm]) fi if test "$enable_sp_asm" = "no" then AC_MSG_ERROR([--enable-all-asm is incompatible with --disable-sp-asm]) fi if test "$enable_intelasm" = "no" then AC_MSG_ERROR([--enable-all-asm is incompatible with --disable-intelasm]) fi if test "$enable_armasm" = "no" then AC_MSG_ERROR([--enable-all-asm is incompatible with --disable-armasm]) fi if test "$enable_ppc32_asm" = "no" then AC_MSG_ERROR([--enable-all-asm is incompatible with --disable-ppc32-asm]) fi if test "$enable_ppc64_asm" = "no" then AC_MSG_ERROR([--enable-all-asm is incompatible with --disable-ppc64-asm]) fi case "$host_cpu" in *x86_64*|*amd64*) if test "$enable_intelasm" = "" then enable_intelasm=yes fi if test "$ENABLED_SP" != "no" then ENABLED_SP_ASM=yes if test "$ENABLED_SP" = "" then ENABLED_SP=yes fi fi ;; *aarch64*) if test "$enable_armasm" = "" then enable_armasm=yes fi if test "$ENABLED_SP" != "no" then ENABLED_SP_ASM=yes if test "$ENABLED_SP" = "" then ENABLED_SP=yes fi fi ;; *powerpc64*) if test "$enable_ppc64_asm" = "" then enable_ppc64_asm=yes fi ;; *powerpc*) if test "$enable_ppc32_asm" = "" then enable_ppc32_asm=yes fi ;; esac fi # RISC-V asm now supports WOLFSSL_AESGCM_STREAM: all tiers (base/scalar/vector) # have dedicated streaming assembly (AES_GCM_*_RISCV64). (Previously disabled # here.) # All wolfCrypt features except quantum-resistant asymmetric: AC_ARG_ENABLE([all-crypto], [AS_HELP_STRING([--enable-all-crypto],[Enable all wolfcrypt algorithms except quantum-resistant asymmetric (default: disabled)])], [ ENABLED_ALL_CRYPT=$enableval ], [ ENABLED_ALL_CRYPT=no ] ) if test "$ENABLED_ALL_CRYPT" = "yes" then test "$enable_atomicuser" = "" && enable_atomicuser=yes test "$enable_aesecb" = "" && enable_aesecb=yes test "$enable_aesgcm" = "" && enable_aesgcm=yes test "$enable_aesccm" = "" && enable_aesccm=yes test "$enable_aesctr" = "" && enable_aesctr=yes test "$enable_aesofb" = "" && enable_aesofb=yes test "$enable_aescfb" = "" && enable_aescfb=yes test "$enable_aescbc_length_checks" = "" && enable_aescbc_length_checks=yes test "$enable_camellia" = "" && enable_camellia=yes test "$enable_ripemd" = "" && enable_ripemd=yes test "$enable_sha224" = "" && enable_sha224=yes test "$enable_sha512" = "" && enable_sha512=yes test "$enable_sha3" = "" && enable_sha3=yes test "$enable_sessioncerts" = "" && enable_sessioncerts=yes test "$enable_keygen" = "" && enable_keygen=yes test "$enable_certgen" = "" && enable_certgen=yes test "$enable_certreq" = "" && enable_certreq=yes test "$enable_certext" = "" && enable_certext=yes test "$enable_sep" = "" && enable_sep=yes test "$enable_hkdf" = "" && enable_hkdf=yes test "$enable_eccencrypt" = "" && test "$enable_ecc" != "no" && enable_eccencrypt=yes test "$enable_fpecc" = "" && test "$enable_ecc" != "no" && enable_fpecc=yes test "$enable_eccsi" = "" && test "$enable_ecc" != "no" && enable_eccsi=yes test "$enable_psk" = "" && enable_psk=yes test "$enable_cmac" = "" && enable_cmac=yes test "$enable_cmac_kdf" = "" && enable_cmac_kdf=yes test "$enable_siphash" = "" && enable_siphash=yes test "$enable_ocsp" = "" && enable_ocsp=yes test "$enable_ocspstapling" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling=yes test "$enable_ocspstapling2" = "" && test "$enable_ocsp" != "no" && enable_ocspstapling2=yes test "$enable_crl" = "" && enable_crl=yes test "$enable_supportedcurves" = "" && enable_supportedcurves=yes test "$enable_tlsx" = "" && enable_tlsx=yes test "$enable_pwdbased" = "" && enable_pwdbased=yes test "$enable_aeskeywrap" = "" && enable_aeskeywrap=yes test "$enable_x963kdf" = "" && enable_x963kdf=yes test "$enable_indef" = "" && enable_indef=yes test "$enable_enckeys" = "" && enable_enckeys=yes test "$enable_hashflags" = "" && enable_hashflags=yes test "$enable_defaultdhparams" = "" && enable_defaultdhparams=yes test "$enable_base64encode" = "" && enable_base64encode=yes test "$enable_base16" = "" && enable_base16=yes test "$enable_arc4" = "" && enable_arc4=yes test "$enable_blake2b" = "" && enable_blake2b=yes test "$enable_blake2s" = "" && enable_blake2s=yes test "$enable_md2" = "" && enable_md2=yes test "$enable_md4" = "" && enable_md4=yes test "$enable_md5" = "" && enable_md5=yes test "$enable_ssh" = "" && test "$enable_hmac" != "no" && enable_ssh=yes test "$enable_rng_bank" = "" && enable_rng_bank=yes if test "$KERNEL_MODE_DEFAULTS" != "yes" then # Scrypt is excluded from kernel module builds (unless explicitly # enabled) because of its excessive memory requirements. test "$enable_scrypt" = "" && test "$enable_hmac" != "no" && enable_scrypt=yes fi if test "x$FIPS_VERSION" != "xv1" then test "$enable_rsapss" = "" && enable_rsapss=yes fi # sp-math is incompatible with opensslextra, ECC custom curves, and DSA. if test "$ENABLED_SP_MATH" != "yes" then test "$enable_dsa" = "" && test "$enable_sha" != "no" && enable_dsa=yes if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -le 5; then test "$enable_ecccustcurves" = "" && enable_ecccustcurves=yes test "$enable_ecccustcurves" != "no" && test "$enable_brainpool" = "" && enable_brainpool=yes test "$enable_ecccustcurves" != "no" && AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC_CDH -DHAVE_ECC_KOBLITZ -DHAVE_ECC_SECPR2 -DHAVE_ECC_SECPR3" fi test "$enable_srp" = "" && enable_srp=yes fi if test "$ENABLED_FIPS" = "no" then test "$enable_curve25519" = "" && enable_curve25519=yes test "$enable_curve448" = "" && enable_curve448=yes test "$enable_xchacha" = "" && test "$enable_chacha" != "no" && enable_xchacha=yes test "$enable_pkcs7" = "" && enable_pkcs7=yes test "$enable_nullcipher" = "" && enable_nullcipher=yes test "$enable_ed25519" = "" && enable_ed25519=yes test "$enable_ed25519_stream" = "" && test "$enable_ed25519" != "no" && enable_ed25519_stream=yes test "$enable_ed448" = "" && enable_ed448=yes test "$enable_ed448_stream" = "" && test "$enable_ed448" != "no" && enable_ed448_stream=yes test "$enable_aessiv" = "" && enable_aessiv=yes # AFALG lacks AES-EAX test "$enable_aeseax" = "" && test "$enable_afalg" != "yes" && enable_aeseax=yes test "$enable_sakke" = "" && test "$enable_ecc" != "no" && enable_sakke=yes test "$enable_cryptocb" = "" && enable_cryptocb=yes test "$enable_pkcallbacks" = "" && enable_pkcallbacks=yes fi if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -lt 7 then # Enable DH const table speedups (eliminates `-lm` math lib dependency) AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072" # "Anonymous suite requires DH." test "$enable_anon" = "" && enable_anon=yes fi if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -ge 6 then test "$enable_aesgcm_stream" = "" && test "$enable_aesgcm" = "yes" && enable_aesgcm_stream=yes test "$enable_aesxts" = "" && enable_aesxts=yes test "$enable_aesxts_stream" = "" && test "$enable_aesxts" = "yes" && enable_aesxts_stream=yes test "$enable_shake128" = "" && enable_shake128=yes test "$enable_shake256" = "" && enable_shake256=yes test "$enable_compkey" = "" && enable_compkey=yes # AFALG lacks AES-ECB test "$enable_srtp_kdf" = "" && test "$enable_afalg" != "yes" && enable_srtp_kdf=yes fi if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -ge 7 then test "$enable_cshake" = "" && enable_cshake=yes test "$enable_kmac" = "" && enable_kmac=yes fi if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -lt 5; then test "$enable_des3" = "" && enable_des3=yes test "$enable_des3" != "no" && AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DES_ECB" fi AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_DECRYPT -DHAVE_AES_ECB -DWOLFSSL_ALT_NAMES" DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096 # Enable all parsing features for ASN */ AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ASN_ALL" # Enable DH Extra AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA" # Enable deterministic ECC signing API with variant AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT" # Store issuer name components when parsing certificates. AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_ISSUER_NAMES" # Enable onestep KDF from NIST SP 800 56c option 1. AM_CFLAGS="$AM_CFLAGS -DWC_KDF_NIST_SP_800_56C" fi # All native quantum-resistant asymmetric algorithms: AC_ARG_ENABLE([all-quantum-crypto], [AS_HELP_STRING([--enable-all-quantum-crypto],[Enable all quantum-resistant asymmetric algorithms (default: disabled)])], [ ENABLED_ALL_QUANTUM_CRYPT=$enableval ], [ ENABLED_ALL_QUANTUM_CRYPT=no ] ) if test "$ENABLED_ALL_QUANTUM_CRYPT" = "yes" then test "$enable_mlkem" = "" && enable_mlkem=yes test "$enable_mldsa" = "" && enable_mldsa=yes test "$enable_xmss" = "" && enable_xmss=yes test "$enable_lms" = "" && enable_lms=yes test "$enable_slhdsa" = "" && enable_slhdsa='yes,sha2' fi # kernel-appropriate settings, also in enable-all-crypto above: if test "$KERNEL_MODE_DEFAULTS" = "yes" && test "$ENABLED_ALL_CRYPT" != "yes" then # note several of these are currently on by default, including aesgcm, sha512 if test "$enable_aes" != "no" then test "$enable_aesgcm" = "" && enable_aesgcm=yes test "$enable_aesccm" = "" && enable_aesccm=yes test "$enable_aesecb" = "" && enable_aesecb=yes test "$enable_aesctr" = "" && enable_aesctr=yes test "$enable_aesofb" = "" && enable_aesofb=yes test "$enable_cmac" = "" && enable_cmac=yes fi test "$enable_sha224" = "" && enable_sha224=yes test "$enable_sha512" = "" && enable_sha512=yes test "$enable_sha3" = "" && enable_sha3=yes test "$enable_keygen" = "" && enable_keygen=yes if test "$enable_ecc" != "no" then test "$enable_eccencrypt" = "" && enable_eccencrypt=yes test "$enable_fpecc" = "" && enable_fpecc=yes test "$enable_supportedcurves" = "" && enable_supportedcurves=yes fi test "$enable_rng" != "no" && test "$enable_rng_bank" = "" && enable_rng_bank=yes if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -ge 6 then test "$enable_aes" != "no" && test "$enable_aescfb" = "" && enable_aescfb=yes test "$enable_aesgcm_stream" = "" && test "$enable_aesgcm" = "yes" && enable_aesgcm_stream=yes test "$enable_aes" != "no" && test "$enable_aesxts" = "" && enable_aesxts=yes test "$enable_aesxts_stream" = "" && test "$enable_aesxts" = "yes" && enable_aesxts_stream=yes test "$enable_shake128" = "" && test "$enable_sha3" = "yes" && enable_shake128=yes test "$enable_shake256" = "" && test "$enable_sha3" = "yes" && enable_shake256=yes test "$enable_compkey" = "" && enable_compkey=yes fi if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -lt 7 then # Enable DH const table speedups (eliminates `-lm` math lib dependency) AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072" fi DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096 AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT" fi # Support for Tailscale port AC_ARG_ENABLE([tailscale], [AS_HELP_STRING([--enable-tailscale],[Enable Tailscale build dependencies (default: disabled)])], [ ENABLED_TAILSCALE=$enableval ], [ ENABLED_TAILSCALE=no ] ) if test "$ENABLED_TAILSCALE" = "yes" then enable_wolfguard=yes test "x$enable_sp" = "x" && enable_sp="yes,256" enable_opensslall=yes enable_alpn=yes enable_sni=yes enable_certgen=yes enable_certreq=yes enable_certext=yes enable_sessioncerts=yes enable_cert_setup_cb=yes AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PUBLIC_MP" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_INIT_CTX_KEY" AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALWAYS_KEEP_SNI" AM_CFLAGS="$AM_CFLAGS -DWC_CTC_NAME_SIZE=128 -DWOLFSSL_ACME_OID" fi # wolfGuard AC_ARG_ENABLE([wolfguard], [AS_HELP_STRING([--enable-wolfguard],[Enable wolfGuard dependencies (default: disabled)])], [ ENABLED_WOLFGUARD=$enableval ], [ ENABLED_WOLFGUARD=no ] ) if test "$ENABLED_WOLFGUARD" = "yes" then test "$enable_ecc" = "" && enable_ecc=yes test "$enable_sha256" = "" && enable_sha256=yes test "$enable_aesgcm" = "" && enable_aesgcm=yes test "$enable_base64encode" = "" && enable_base64encode=yes test "$enable_base16" = "" && enable_base16=yes test "$enable_compkey" = "" && enable_compkey=yes if test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -ge 6 then test "$enable_aesgcm_stream" = "" && enable_aesgcm_stream=yes fi fi # liboqs support has been removed: the only consumer (Falcon) is now provided # by the native wolfCrypt implementation. Keep --with-liboqs as a deprecated, # recognised no-op so existing scripts and CI matrices that still pass it do not # hard-fail on an unknown option (enable_option_checking is fatal); it links no # liboqs and has no effect on the build. Warn when it is given. AC_ARG_WITH([liboqs], [AS_HELP_STRING([--with-liboqs],[DEPRECATED and ignored: liboqs support has been removed. Use --enable-falcon for the native implementation.])], [AS_IF([test "x$withval" != "xno"], [AC_MSG_WARN([--with-liboqs is deprecated and has no effect: liboqs support has been removed; Falcon is now provided natively via --enable-falcon.])])], []) # Falcon post-quantum signatures, provided by the native wolfCrypt # implementation (no liboqs); it needs SHA-3 / SHAKE256 (forced on in the CFLAG # section below). Because the algorithm is not yet standardized and its API name # is subject to change, it requires --enable-experimental (checked in the CFLAG # section, once all backend sub-options have been resolved). # # fpr/FFT backend selection follows the common wolfSSL comma-list idiom as # sub-options of --enable-falcon (e.g. --enable-falcon=asm, --enable-falcon=avx2) # rather than standalone --enable-falcon-* switches. Recognised sub-options: # asm - per-architecture assembly fpr backend (x86-64 SSE2 only); the # portable constant-time integer emulation remains the default. # double - inline native-double fpr backend: the fpr ops become static-inline # C double operations, so the FFT/sampler inline them and keep values # in FP registers (no per-op call). Fastest backend on any platform # with a constant-time hardware double FPU (signing ~2.5x faster than # the out-of-line asm backend, ~16x faster than the portable # emulation), but like asm it relies on the native FPU's rounding # behavior. Mutually exclusive with asm. # avx2 - AVX2 (4-wide __m256d + FMA) vectorized FFT for the signing path # (x86-64); implies double. The AVX2 functions carry target("avx2,fma") # attributes, so the TU builds under a baseline -march, but the host # must support AVX2+FMA at run time. Signing is sampler-bound, so this # is a modest (~1.1x) end-to-end speedup. # neon - AArch64 NEON (2-wide float64x2_t + FMA) vectorized FFT; implies # double. Advanced SIMD is part of the ARMv8-A baseline, so no special # -march is required. # small-mem - low-memory dynamic signing: rebuilds the ffLDL tree inside the # sampler instead of precomputing the expanded key, roughly halving # the sign working set (~168KB -> ~78KB at Falcon-1024) for ~10% # slower signing. Orthogonal to the fpr/FFT backends above; verify # and keygen are unchanged. AC_ARG_ENABLE([falcon], [AS_HELP_STRING([--enable-falcon@<:@=OPTS@:>@],[Enable Falcon post-quantum signatures (native, no liboqs; requires --enable-experimental). OPTS is a comma-separated list: fpr/FFT backends asm, double, avx2, neon, plus small-mem for low-memory signing (default: disabled)])], [ ENABLED_FALCON=$enableval ], [ ENABLED_FALCON=no ]) ENABLED_FALCON_ASM=no ENABLED_FALCON_DOUBLE=no ENABLED_FALCON_AVX2=no ENABLED_FALCON_NEON=no ENABLED_FALCON_SMALL_MEM=no # Parse the comma-separated backend sub-options. AC_ARG_ENABLE yields the plain # "yes"/"no" for a bare --enable-falcon/--disable-falcon; anything else is a # backend list. The double implication of avx2/neon is applied after arch-gating # so ignoring an unsupported vector backend does not clobber an explicit 'double'. if test "$ENABLED_FALCON" != "no" && test "$ENABLED_FALCON" != "yes"; then OIFS="$IFS" IFS=',' for opt in $ENABLED_FALCON; do case "$opt" in yes) ;; asm) ENABLED_FALCON_ASM=yes ;; double) ENABLED_FALCON_DOUBLE=yes ;; avx2) ENABLED_FALCON_AVX2=yes ;; neon) ENABLED_FALCON_NEON=yes ;; small-mem) ENABLED_FALCON_SMALL_MEM=yes ;; *) AC_MSG_ERROR([Unknown falcon option: $opt. Valid options: asm, double, avx2, neon, small-mem]) ;; esac done IFS="$OIFS" ENABLED_FALCON=yes fi # Resolve backend arch-gating: asm and avx2 are x86-64 only; neon is AArch64 # only. An unsupported backend is warned and ignored. if test "$ENABLED_FALCON_ASM" = "yes"; then case $host_cpu in *x86_64*|*amd64*) ;; *) AC_MSG_WARN([falcon 'asm' backend is only supported on x86-64; ignoring.]) ENABLED_FALCON_ASM=no ;; esac fi if test "$ENABLED_FALCON_AVX2" = "yes"; then case $host_cpu in *x86_64*|*amd64*) ;; *) AC_MSG_WARN([falcon 'avx2' backend is only supported on x86-64; ignoring.]) ENABLED_FALCON_AVX2=no ;; esac fi if test "$ENABLED_FALCON_NEON" = "yes"; then case $host_cpu in *aarch64*|*arm64*) ;; *) AC_MSG_WARN([falcon 'neon' backend is only supported on AArch64; ignoring.]) ENABLED_FALCON_NEON=no ;; esac fi # avx2/neon vectorized FFT requires the inline native-double fpr backend. if test "$ENABLED_FALCON_AVX2" = "yes" || test "$ENABLED_FALCON_NEON" = "yes"; then ENABLED_FALCON_DOUBLE=yes fi # asm and the double-based backends select different fpr representations. if test "$ENABLED_FALCON_DOUBLE" = "yes" && test "$ENABLED_FALCON_ASM" = "yes"; then AC_MSG_ERROR([falcon 'double' (also implied by 'avx2'/'neon') and 'asm' backends are mutually exclusive.]) fi # MLKEM # Used: # - SHA3, Shake128 and Shake256 # # Note, setup is later, after FIPS setup. if test "$enable_shake128" != "no" && test "$enable_shake256" != "no" && test "$enable_sha3" != "no" && (test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -ge 7) then ENABLED_MLKEM_DEFAULT=yes else ENABLED_MLKEM_DEFAULT=no fi AC_ARG_ENABLE([mlkem], [AS_HELP_STRING([--enable-mlkem],[Enable ML-KEM/Kyber (default: enabled)])], [ ENABLED_MLKEM=$enableval ], [ ENABLED_MLKEM=$ENABLED_MLKEM_DEFAULT ] ) # note, inherits default from "mlkem" clause above. AC_ARG_ENABLE([kyber], [AS_HELP_STRING([--enable-kyber],[Alias for --enable-mlkem])], [ ENABLED_MLKEM=$enableval ] ) AC_ARG_ENABLE([tls-mlkem-standalone], [AS_HELP_STRING([--enable-tls-mlkem-standalone],[Enable ML-KEM as standalone TLS key exchange (non-hybrid) (default: disabled)])], [ ENABLED_MLKEM_STANDALONE=$enableval ], [ ENABLED_MLKEM_STANDALONE=no ] ) AC_ARG_ENABLE([pqc-hybrids], [AS_HELP_STRING([--enable-pqc-hybrids],[Enable PQ/T hybrid combinations (default: enabled)])], [ ENABLED_PQC_HYBRIDS=$enableval ], [ ENABLED_PQC_HYBRIDS=yes ] ) # Extra PQ/T Hybrid combinations AC_ARG_ENABLE([extra-pqc-hybrids], [AS_HELP_STRING([--enable-extra-pqc-hybrids],[Enable extra PQ/T hybrid combinations (default: disabled)])], [ ENABLED_EXTRA_PQC_HYBRIDS=$enableval ], [ ENABLED_EXTRA_PQC_HYBRIDS=no ] ) # FrodoKEM (experimental reference implementation) AC_ARG_ENABLE([frodokem], [AS_HELP_STRING([--enable-frodokem],[Enable FrodoKEM reference implementation, optionally with a comma-separated list of sub-options e.g. aes,ephemeral,small,no-640 (requires --enable-experimental) (default: disabled)])], [ ENABLED_FRODOKEM=$enableval ], [ ENABLED_FRODOKEM=no ] ) AS_IF([ test "$ENABLED_FRODOKEM" != "no" && test "$ENABLED_EXPERIMENTAL" != "yes" ],[ AC_MSG_ERROR([frodokem requires --enable-experimental.]) ]) # FrodoKEM matrix A generation with SHAKE-128 (default: enabled with frodokem). AC_ARG_ENABLE([frodokem-shake], [AS_HELP_STRING([--enable-frodokem-shake],[Enable FrodoKEM SHAKE-128 matrix A generation (default: enabled)])], [ ENABLED_FRODOKEM_SHAKE=$enableval ], [ ENABLED_FRODOKEM_SHAKE=default ] ) # FrodoKEM matrix A generation with AES-128 (default: disabled). AC_ARG_ENABLE([frodokem-aes], [AS_HELP_STRING([--enable-frodokem-aes],[Enable FrodoKEM AES-128 matrix A generation (default: disabled)])], [ ENABLED_FRODOKEM_AES=$enableval ], [ ENABLED_FRODOKEM_AES=no ] ) # AArch64 SVE S*A accumulate, selected at run time by HWCAP (default: disabled). AC_ARG_ENABLE([frodokem-sve], [AS_HELP_STRING([--enable-frodokem-sve],[Enable FrodoKEM AArch64 SVE matrix acceleration (default: disabled)])], [ ENABLED_FRODOKEM_SVE=$enableval ], [ ENABLED_FRODOKEM_SVE=no ] ) # AArch64 SME B*S via the ZA-tile UMOPA, selected at run time (default: disabled). AC_ARG_ENABLE([frodokem-sme], [AS_HELP_STRING([--enable-frodokem-sme],[Enable FrodoKEM AArch64 SME matrix acceleration (default: disabled)])], [ ENABLED_FRODOKEM_SME=$enableval ], [ ENABLED_FRODOKEM_SME=no ] ) # eFrodoKEM (ephemeral, salt-less) variants (default: disabled). AC_ARG_ENABLE([frodokem-ephemeral], [AS_HELP_STRING([--enable-frodokem-ephemeral],[Enable eFrodoKEM (ephemeral) variants (default: disabled)])], [ ENABLED_FRODOKEM_EPHEMERAL=$enableval ], [ ENABLED_FRODOKEM_EPHEMERAL=no ] ) # FrodoKEM parameter sets (each default: enabled with frodokem). AC_ARG_ENABLE([frodokem-640], [AS_HELP_STRING([--enable-frodokem-640],[Enable the FrodoKEM-640 parameter set (default: enabled)])], [ ENABLED_FRODOKEM_640=$enableval ], [ ENABLED_FRODOKEM_640=yes ] ) AC_ARG_ENABLE([frodokem-976], [AS_HELP_STRING([--enable-frodokem-976],[Enable the FrodoKEM-976 parameter set (default: enabled)])], [ ENABLED_FRODOKEM_976=$enableval ], [ ENABLED_FRODOKEM_976=yes ] ) AC_ARG_ENABLE([frodokem-1344], [AS_HELP_STRING([--enable-frodokem-1344],[Enable the FrodoKEM-1344 parameter set (default: enabled)])], [ ENABLED_FRODOKEM_1344=$enableval ], [ ENABLED_FRODOKEM_1344=yes ] ) # FrodoKEM operations (each default: enabled with frodokem). AC_ARG_ENABLE([frodokem-make-key], [AS_HELP_STRING([--enable-frodokem-make-key],[Enable FrodoKEM key generation (default: enabled)])], [ ENABLED_FRODOKEM_MAKE_KEY=$enableval ], [ ENABLED_FRODOKEM_MAKE_KEY=yes ] ) AC_ARG_ENABLE([frodokem-encapsulate], [AS_HELP_STRING([--enable-frodokem-encapsulate],[Enable FrodoKEM encapsulation (default: enabled)])], [ ENABLED_FRODOKEM_ENCAPSULATE=$enableval ], [ ENABLED_FRODOKEM_ENCAPSULATE=yes ] ) AC_ARG_ENABLE([frodokem-decapsulate], [AS_HELP_STRING([--enable-frodokem-decapsulate],[Enable FrodoKEM decapsulation (default: enabled)])], [ ENABLED_FRODOKEM_DECAPSULATE=$enableval ], [ ENABLED_FRODOKEM_DECAPSULATE=yes ] ) # Small-footprint FrodoKEM: use the looped (not fully unrolled) matrix # arithmetic (default: disabled). AC_ARG_ENABLE([frodokem-small], [AS_HELP_STRING([--enable-frodokem-small],[Enable small-footprint FrodoKEM (default: disabled)])], [ ENABLED_FRODOKEM_SMALL=$enableval ], [ ENABLED_FRODOKEM_SMALL=no ] ) # The FrodoKEM sub-options may also be given as a comma-separated list to # --enable-frodokem, e.g. --enable-frodokem=aes,ephemeral,small,no-640. Each # token sets the matching --enable-frodokem-