Skip to content

Commit 3946ba8

Browse files
dgarskedgarske
committed
Improve user_settings.h examples and add validation rules
 - Standardize header guards to WOLFSSL_USER_SETTINGS_H across all files - Add #if 0/1 gates with labels for easy feature toggling - Fix bugs: typos in eccnonblock (WOLFSL_SHA*), duplicates in fipsv5/all - Add NO_DES3_TLS_SUITES alongside NO_DES3 where needed - Update wolfboot_keytools with upstream PQ algorithms (ML-DSA, LMS, XMSS) - Add settings.h validation rules with descriptive error messages - Auto-define NO_DES3_TLS_SUITES when NO_DES3 is set (instead of error) - Update README.md and add missing files to CI tests
1 parent 4574a0c commit 3946ba8

13 files changed

+294
-146
lines changed

‎.github/workflows/os-check.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,12 +112,14 @@ jobs:
112112
os: [ ubuntu-24.04, macos-latest ]
113113
user-settings: [
114114
# Add new user_settings.h here
115+
'examples/configs/user_settings_EBSnet.h',
115116
'examples/configs/user_settings_eccnonblock.h',
116117
'examples/configs/user_settings_min_ecc.h',
118+
'examples/configs/user_settings_template.h',
119+
'examples/configs/user_settings_tls12.h',
117120
'examples/configs/user_settings_wolfboot_keytools.h',
118-
'examples/configs/user_settings_wolftpm.h',
119121
'examples/configs/user_settings_wolfssh.h',
120-
'examples/configs/user_settings_tls12.h',
122+
'examples/configs/user_settings_wolftpm.h',
121123
]
122124
name: make user_setting.h (testwolfcrypt only)
123125
if: github.repository_owner == 'wolfssl'

‎examples/configs/README.md‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,19 @@ Example wolfSSL configuration file templates for use when autoconf is not availa
44

55
## Files
66

7-
* `user_settings_template.h`: Template that allows modular algorithm and feature selection using `#if 0` logic.
7+
* `user_settings_template.h`: Template that allows modular algorithm and feature selection using `#if 0`/`#if 1` gates.
88
* `user_settings_all.h`: This is wolfSSL with all features enabled. Equivalent to `./configure --enable-all`.
99
* `user_settings_arduino.h`: An example Arduino file. See also [wolfSSL/Arduino-wolfSSL](https://github.com/wolfSSL/Arduino-wolfSSL).
10-
*.`user_settings_EBSnet.h`: Example configuration file for use with EBSnet ports.
10+
* `user_settings_EBSnet.h`: Example configuration file for use with EBSnet ports.
11+
* `user_settings_eccnonblock.h`: Example for non-blocking ECC crypto only. See comment at top for test results.
12+
* `user_settings_espressif.h`: Example configuration for Espressif ESP32. See also [wolfSSL/IDE/Espressif](https://github.com/wolfSSL/wolfssl/tree/master/IDE/Espressif).
1113
* `user_settings_fipsv2.h`: The FIPS v2 (3389) 140-2 certificate build options.
1214
* `user_settings_fipsv5.h`: The FIPS v5 (ready) 140-3 build options. Equivalent to `./configure --enable-fips=v5-dev`.
13-
* `user_settings_min_ecc.h`: This is ECC and SHA-256 only. For ECC verify only add `BUILD_VERIFY_ONLY`.
14-
* `user_settings_platformio.h`: An example for PlatformIO library. See also [platformio/wolfssl](https://registry.platformio.org/libraries/wolfssl/wolfssl)
15+
* `user_settings_min_ecc.h`: Minimal ECC and SHA-256 only (no TLS). For ECC verify only add `NO_ECC_SIGN`.
16+
* `user_settings_platformio.h`: An example for PlatformIO library. See also [platformio/wolfssl](https://registry.platformio.org/libraries/wolfssl/wolfssl).
1517
* `user_settings_stm32.h`: Example configuration file generated from the wolfSSL STM32 Cube pack.
16-
* `user_settings_tls12`: Example for TLS v1.2 client only, ECC only, AES GCM only, SHA2-256 only.
17-
* `user_settings_wolfboot_keytools.h`: This from wolfBoot tools/keytools and is ECC, RSA, ED25519 and ChaCha20.
18+
* `user_settings_tls12.h`: Example for TLS v1.2 client only, ECC only, AES-GCM only, SHA2-256 only.
19+
* `user_settings_wolfboot_keytools.h`: wolfBoot key generation and signing tool. Supports ECC, RSA, ED25519, ED448, and post-quantum (ML-DSA/Dilithium, LMS, XMSS).
1820
* `user_settings_wolfssh.h`: Minimum options for building wolfSSH. See comment at top for ./configure used to generate.
1921
* `user_settings_wolftpm.h`: Minimum options for building wolfTPM. See comment at top for ./configure used to generate.
2022

‎examples/configs/user_settings_EBSnet.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ extern "C" {
4747
#define NO_MD4
4848
#define NO_MD5
4949
#define NO_DES3
50+
#define NO_DES3_TLS_SUITES
51+
#define NO_OLD_TLS
5052

5153
#ifdef __cplusplus
5254
}

‎examples/configs/user_settings_all.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,6 @@ extern "C" {
210210
#define WOLFSSL_SHAKE256
211211
#define WOLFSSL_SHA3
212212
#define WOLFSSL_HASH_FLAGS /* enable hash flag API's */
213-
#define WOLFSSL_SHAKE256
214213

215214
/* Additional Algorithms */
216215
#define HAVE_HASHDRBG

‎examples/configs/user_settings_eccnonblock.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -104,8 +104,8 @@ extern "C" {
104104
#define WOLFSSL_SP_MATH /* forces only single precision */
105105

106106
/* Hashing */
107-
#define WOLFSL_SHA512
108-
#define WOLFSL_SHA384
107+
#define WOLFSSL_SHA512
108+
#define WOLFSSL_SHA384
109109
#undef NO_SHA256
110110

111111
/* Debugging */

‎examples/configs/user_settings_fipsv2.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,4 +112,4 @@ extern "C" {
112112
}
113113
#endif
114114

115-
#endif /* WOLFSSL_OPTIONS_H */
115+
#endif /* WOLFSSL_USER_SETTINGS_H */

‎examples/configs/user_settings_fipsv5.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,6 @@ extern "C" {
130130
#define WOLFSSL_AES_COUNTER
131131
#define HAVE_AESCCM
132132
#define HAVE_AES_ECB
133-
#define WOLFSSL_AES_COUNTER
134133
#define WOLFSSL_AES_DIRECT
135134
#define WOLFSSL_AES_OFB
136135
#define HAVE_AESGCM
@@ -147,7 +146,6 @@ extern "C" {
147146
#define WOLFSSL_SHA224
148147
#define WOLFSSL_SHA512
149148
#define WOLFSSL_SHA384
150-
#define WOLFSSL_NO_SHAKE256
151149
#define WOLFSSL_NOSHA512_224
152150
#define WOLFSSL_NOSHA512_256
153151
#define WOLFSSL_SHA3
@@ -162,6 +160,7 @@ extern "C" {
162160
#define NO_MD4
163161
#define NO_MD5
164162
#define NO_DES3
163+
#define NO_DES3_TLS_SUITES
165164
#define NO_DSA
166165
#define NO_RABBIT
167166
#define NO_HC128

‎examples/configs/user_settings_min_ecc.h‎

Lines changed: 77 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -19,63 +19,94 @@
1919
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
2020
*/
2121

22-
/* should be renamed to user_settings.h for customer use
23-
* generated from configure options:
22+
/* Minimal ECC and SHA-256 only (no TLS, no RSA, no AES)
23+
*
24+
* Derived from:
2425
* ./configure \
25-
--enable-cryptonly --enable-ecc --enable-sp \
26-
--disable-rsa --disable-dh --disable-sha3 --disable-sha224 --disable-md5 \
27-
--disable-sha --disable-pkcs12 --disable-memory \
28-
--disable-chacha --disable-poly1305 --disable-sha512 --disable-sha384 \
29-
--disable-aesgcm --disable-aescbc --disable-aes --disable-rng \
30-
CFLAGS="-DNO_SIG_WRAPPER -DWOLFSSL_PUBLIC_MP -DECC_USER_CURVES \
31-
-DNO_ECC_SIGN -DNO_ECC_DHE -DNO_ECC_KEY_EXPORT"
26+
* --enable-cryptonly --enable-ecc --enable-sp \
27+
* --disable-rsa --disable-dh --disable-sha3 \
28+
* --disable-sha224 --disable-md5 \
29+
* --disable-sha --disable-pkcs12 --disable-memory \
30+
* --disable-chacha --disable-poly1305 \
31+
* --disable-sha512 --disable-sha384 \
32+
* --disable-aesgcm --disable-aescbc \
33+
* --disable-aes --disable-rng \
34+
* CFLAGS="-DNO_SIG_WRAPPER -DWOLFSSL_PUBLIC_MP \
35+
* -DECC_USER_CURVES"
3236
*
33-
* Cleaned up by David Garske
37+
* Build and test:
38+
* cp ./examples/configs/user_settings_min_ecc.h \
39+
* user_settings.h
40+
* ./configure --enable-usersettings --disable-examples
41+
* make
42+
* ./wolfcrypt/test/testwolfcrypt
3443
*/
3544

3645

3746
#ifndef WOLFSSL_USER_SETTINGS_H
3847
#define WOLFSSL_USER_SETTINGS_H
3948

40-
4149
#ifdef __cplusplus
4250
extern "C" {
4351
#endif
4452

45-
/* WolfCrypt Only (no TLS) */
46-
#define WOLFCRYPT_ONLY
53+
/* ------------------------------------------------- */
54+
/* Platform */
55+
/* ------------------------------------------------- */
56+
#define WOLFCRYPT_ONLY /* No TLS, wolfCrypt only */
4757

4858
/* Endianness - defaults to little endian */
4959
#ifdef __BIG_ENDIAN__
5060
#define BIG_ENDIAN_ORDER
5161
#endif
5262

53-
/* Expose the math mp_ API's */
54-
#define WOLFSSL_PUBLIC_MP
63+
#define WOLFSSL_PUBLIC_MP /* Expose mp_ math API's */
5564

56-
/* Use single precision math only */
65+
/* ------------------------------------------------- */
66+
/* Math */
67+
/* ------------------------------------------------- */
5768
#define WOLFSSL_SP
5869
#define WOLFSSL_SP_SMALL
5970
#define WOLFSSL_SP_MATH
6071
#define WOLFSSL_HAVE_SP_ECC
6172

62-
/* Enable Timing Resistance */
73+
/* ------------------------------------------------- */
74+
/* Timing Resistance */
75+
/* ------------------------------------------------- */
6376
#define TFM_TIMING_RESISTANT
6477
#define ECC_TIMING_RESISTANT
6578

66-
/* Enable ECC */
79+
/* ------------------------------------------------- */
80+
/* ECC */
81+
/* ------------------------------------------------- */
6782
#define HAVE_ECC
68-
#define ECC_USER_CURVES /* Only 256-Bit Curves */
69-
//#define ECC_SHAMIR
83+
#define ECC_USER_CURVES /* Only P-256 by default */
84+
#if 0 /* ECC Shamir - faster but more code/memory */
85+
#define ECC_SHAMIR
86+
#endif
7087

71-
/* Optional Feature Disables */
72-
#define NO_SIG_WRAPPER
73-
//#define NO_ECC_KEY_EXPORT
74-
//#define NO_ECC_DHE
75-
//#define NO_ECC_SIGN
76-
//#define NO_ECC_VERIFY
88+
/* ECC Feature Options */
89+
#if 0 /* Disable ECC key export */
90+
#define NO_ECC_KEY_EXPORT
91+
#endif
92+
#if 0 /* Disable ECDHE key agreement */
93+
#define NO_ECC_DHE
94+
#endif
95+
#if 0 /* Disable ECC sign */
96+
#define NO_ECC_SIGN
97+
#endif
98+
#if 0 /* Disable ECC verify */
99+
#define NO_ECC_VERIFY
100+
#endif
101+
102+
/* ------------------------------------------------- */
103+
/* Hashing */
104+
/* ------------------------------------------------- */
105+
/* SHA-256 enabled by default */
77106

78-
/* Disable Algorithms */
107+
/* ------------------------------------------------- */
108+
/* Disabled Algorithms */
109+
/* ------------------------------------------------- */
79110
#define NO_AES
80111
#define NO_AES_CBC
81112
#define NO_DES3
@@ -89,17 +120,30 @@ extern "C" {
89120
#define NO_PWDBASED
90121
#define NO_PKCS12
91122
#define NO_PKCS8
92-
//#define WC_NO_RNG
123+
#define NO_SIG_WRAPPER
93124

94-
/* Disable Features */
95-
//#define NO_ASN
96-
//#define NO_CERTS
125+
/* ------------------------------------------------- */
126+
/* Disabled Features */
127+
/* ------------------------------------------------- */
97128
#define NO_WOLFSSL_MEMORY
98129
#define WOLFSSL_NO_PEM
99-
//#define NO_CODING
100130
#define NO_PSK
101-
#ifndef DEBUG_WOLFSSL
131+
#if 0 /* Disable ASN.1 / certificates */
132+
#define NO_ASN
133+
#define NO_CERTS
134+
#define NO_CODING
135+
#endif
136+
#if 0 /* Disable RNG (ECC verify only) */
137+
#define WC_NO_RNG
138+
#endif
139+
140+
/* ------------------------------------------------- */
141+
/* Debugging */
142+
/* ------------------------------------------------- */
143+
#if 0 /* Enable debug logging */
102144
#define DEBUG_WOLFSSL
145+
#endif
146+
#if 1 /* Disable error strings to save flash */
103147
#define NO_ERROR_STRINGS
104148
#endif
105149

0 commit comments

Comments
 (0)