You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
wolfProvider is compiled by default as a shared library called **libwolfprov** which can be dynamically registered at runtime by an application or OpenSSL through a config file. wolfProvider also provides an entry point for applications to load the provider when compiled in a static build.
Copy file name to clipboardExpand all lines: wolfProvider/src/chapter02.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,5 +3,6 @@
3
3
wolfProvider has been tested against the following versions of OpenSSL. wolfProvider may work with other versions, but may require some modification or adjustment:
4
4
5
5
- OpenSSL 3.0.0
6
+
- OpenSSL 3.5.0
6
7
7
8
If you are interested in having wolfSSL add support to wolfProvider for other OpenSSL versions, please contact wolfSSL at [[email protected]](mailto:[email protected]).
@@ -9,14 +9,17 @@ The most recent version of wolfProvider can be obtained directly from wolfSSL In
9
9
The general wolfProvider package is structured as follows:
10
10
11
11
```
12
-
certs/ (Test certificates and keys, used with unit tests)
13
-
provider.conf(Example OpenSSL config file using wolfProvider)
12
+
certs/ (Test certificates and keys, used with unit tests)
13
+
examples/ (Code examples)
14
14
include/
15
-
wolfprovider/ (wolfProvider header files)
16
-
scripts/ (wolfProvider test scripts)
17
-
src/ (wolfProvider source files)
18
-
test/ (wolfProvider test files)
19
-
user_settings.h (EXAMPLE user_settings.h)
15
+
wolfprovider/ (wolfProvider header files)
16
+
IDE/ (Integration examples)
17
+
scripts/ (wolfProvider scripts for testing and building)
18
+
src/ (wolfProvider source files)
19
+
test/ (wolfProvider test files)
20
+
provider.conf (Example OpenSSL config file using wolfProvider)
21
+
provider-fips.conf (Example OpenSSL config file using wolfProvider FIPS)
22
+
user_settings.h (EXAMPLE user_settings.h)
20
23
```
21
24
## Building on *nix
22
25
The quickest method is to use the `scripts/build-wolfprovider.sh` script as follows:
@@ -25,13 +28,25 @@ The quickest method is to use the `scripts/build-wolfprovider.sh` script as foll
25
28
./scripts/build-wolfprovider.sh
26
29
```
27
30
28
-
It will retrieve the dependencies and compile them as necessary. To use other than the default (such as different releases) you can set various environment variables prior to calling the script:
31
+
It will clone, configure, compile, and install OpenSSL and wolfSSL with a default set of options. Two methods are available to override these defaults:
32
+
33
+
Setting the various environment variables prior to calling the script:
Alternatively, you can manually compile each component using the following guide.
45
+
Of course, these methods can be combined to achieve the desired build combination as well.
46
+
47
+
For a full list of environment variables and script arguments do `./scripts/build-wolfprovider.sh --help`.
48
+
49
+
If desired, each component can be manually compiled using the following guide.
35
50
36
51
37
52
### Building OpenSSL
@@ -47,20 +62,21 @@ sudo make install
47
62
48
63
### Building wolfSSL
49
64
50
-
If using a FIPS-validated version of wolfSSL with wolfProvider, follow the build instructions provided with your specific FIPS validated source bundle and Security Policy. In addition to the correct “--enable-fips” configure option, wolfProvider will need wolfSSL to be compiled with “**WOLFSSL_PUBLIC_MP**” defined. For example, building the “wolfCrypt Linux FIPSv2” bundle on Linux:
65
+
If using a FIPS-validated version of wolfSSL with wolfProvider, follow the build instructions provided with your specific FIPS validated source bundle and Security Policy. In addition to the correct “--enable-fips” configure option, wolfProvider will need wolfSSL to be compiled with “**WOLFSSL_PUBLIC_MP**” defined. For example, building the “wolfCrypt Linux FIPSv2” bundle on Linux:
< modify fips_test.c using verifyCore hash output from testwolfcrypt
57
-
>
71
+
< modify fips_test.c using verifyCore hash output from testwolfcrypt >
58
72
make
59
73
./wolfcrypt/test/testwolfcrypt
60
74
< all algorithms should PASS >
61
75
sudo make install
62
76
```
63
77
78
+
If available, it may be easier to instead `make` then run the `./fips-hash.sh` utility and then `make` once again. This utility automates the process of updating fips_test.c with the testwolfcrypt hash output.
79
+
64
80
To build non-FIPS wolfSSL for use with wolfProvider:
65
81
```
66
82
cd wolfssl-X.X.X
@@ -178,62 +194,83 @@ The following are options which may be appended to the `./configure` script to c
178
194
179
195
By default, wolfProvider only builds a shared library, with building of a static library disabled. This speeds up build times by a factor of two. Either mode can be explicitly disabled or enabled if desired.
| WOLFPROVIDER_DEBUG | Build wolfProvider with debug symbols, optimization level, and debug logging. |
200
-
| WP_NO_DYNAMIC_PROVIDER | Do not build wolfProvider with dynamic provider support. Dynamic providers are ones that can be loaded into OpenSSL at runtime. |
201
-
| WP_SINGLE_THREADED | Build wolfProvider in single-threaded mode. This removes the need for locking around global resources used internally. |
202
-
| WP_USE_HASH | Enable digest algorithms using the wc_Hash API. |
Copy file name to clipboardExpand all lines: wolfProvider/src/chapter04.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,6 @@ Note that wolfCrypt FIPS libraries cannot be “switched” into non-FIPS mode.
6
6
7
7
When wolfProvider is compiled to use wolfCrypt FIPS, it will only include support and register provider callbacks for FIPS-validated algorithms, modes, and key sizes. If OpenSSL based applications call non-FIPS validated algorithms, execution may not enter wolfProvider and could be handled by the default OpenSSL provider or other registered provider providers, based on the OpenSSL configuration.
8
8
9
-
**NOTE** : If targeting FIPS compliance,and non-wolfCrypt FIPS algorithms are called from a different provider, those algorithms are outside the scope of
10
-
wolfProvider and wolfCrypt FIPS and may not be FIPS validated.
9
+
**NOTE** : If targeting FIPS compliance, and non-wolfCrypt FIPS algorithms are called from a different provider, those algorithms are outside the scope of both wolfProvider and wolfCrypt FIPS and may not be FIPS validated.
11
10
12
11
For more information on using wolfCrypt FIPS (140-2 / 140-3), contact wolfSSL at [email protected].
WP_LOG_LEVEL_ALL WP_LOG_ERROR | All log levels are enabled | WP_LOG_ENTER | WP_LOG_LEAVE | WP_LOG_INFO | WP_LOG_VERBOSE |
22
+
WP_LOG_LEVEL_ALL | All log levels are enabled | WP_LOG_ERROR | WP_LOG_ENTER | WP_LOG_LEAVE | WP_LOG_INFO | WP_LOG_VERBOSE |
23
23
24
24
25
25
The default wolfProvider logging level includes `WP_LOG_ERROR`, `WP_LOG_ENTER`, `WP_LOG_LEAVE`, and `WP_LOG_INFO`. This includes all log levels except verbose logs (`WP_LOG_VERBOSE`).
@@ -46,14 +46,15 @@ wolfProvider allows logging on a per-component basis. Components are defined in
The default wolfProvider logging configuration logs all components (`WP_LOG_COMPONENTS_DEFAULT`).
55
56
56
-
Components logged can be controlled using the `wolfProv_SetLogComponents(int mask)`. For example, to turn on only logging only for the Digest and Cipher algorithms:
57
+
Components logged can be controlled using the `wolfProv_SetLogComponents(int mask)`. For example, to turn on logging only for the Digest and Cipher algorithms:
57
58
```
58
59
#include <wolfprovider/wp_logging.h>
59
60
@@ -74,21 +75,21 @@ Applications that want to have more control over how or where log messages are o
74
75
* component - [IN] - Component that log message is coming from
75
76
* logMessage - [IN] - Log message
76
77
*/
77
-
typedef void (* **wolfProvider_Logging_cb** )(const int logLevel,
78
+
typedef void (* wolfProvider_Logging_cb )(const int logLevel,
78
79
const int component,
79
80
const char *const logMessage);
80
81
```
81
82
The callback can then be registered with wolfProvider using the `wolfProv_SetLoggingCb(wolfProv_Logging_cb logf)`. For example:
82
83
```
83
-
void **customLogCallback** (const int logLevel, const int component,
84
+
void customLogCallback (const int logLevel, const int component,
An application can read and consume the default OpenSSL config file (openssl.cnf) or config as set by OPENSSL\_CONF environment variable, and default [openssl\_conf] section.
13
+
An application can read and consume the default OpenSSL config file (openssl.cnf) or config as set by OPENSSL\_CONF environment variable and default [openssl\_conf] section.
14
14
15
15
Alternatively to using an OpenSSL config file, applications can explicitly initialize and register wolfProvider using the desired OSSL\_PROVIDER_\* APIs. As one example, initializing wolfProvider and registering for all algorithms could be done using:
0 commit comments