Skip to content

Commit c2a9875

Browse files
dgarskedgarske
committed
Add new user_settings.h templates for tls13, dtls13, pq, openssl_compat, baremetal, rsa_only, pkcs7, ca
1 parent 3946ba8 commit c2a9875

File tree

14 files changed

+1862
-6
lines changed

14 files changed

+1862
-6
lines changed

‎.github/workflows/os-check.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,15 +111,24 @@ jobs:
111111
matrix:
112112
os: [ ubuntu-24.04, macos-latest ]
113113
user-settings: [
114-
# Add new user_settings.h here
114+
# Add new user_settings.h here (alphabetical order)
115+
'examples/configs/user_settings_ca.h',
116+
'examples/configs/user_settings_dtls13.h',
115117
'examples/configs/user_settings_EBSnet.h',
116118
'examples/configs/user_settings_eccnonblock.h',
117119
'examples/configs/user_settings_min_ecc.h',
120+
'examples/configs/user_settings_openssl_compat.h',
121+
'examples/configs/user_settings_pkcs7.h',
122+
'examples/configs/user_settings_rsa_only.h',
118123
'examples/configs/user_settings_template.h',
119124
'examples/configs/user_settings_tls12.h',
125+
'examples/configs/user_settings_tls13.h',
120126
'examples/configs/user_settings_wolfboot_keytools.h',
121127
'examples/configs/user_settings_wolfssh.h',
122128
'examples/configs/user_settings_wolftpm.h',
129+
# Not included (require special setup):
130+
# - user_settings_pq.h: Requires --enable-experimental
131+
# - user_settings_baremetal.h: Requires static memory, custom platform
123132
]
124133
name: make user_setting.h (testwolfcrypt only)
125134
if: github.repository_owner == 'wolfssl'

‎examples/configs/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,14 @@ Example wolfSSL configuration file templates for use when autoconf is not availa
1616
* `user_settings_platformio.h`: An example for PlatformIO library. See also [platformio/wolfssl](https://registry.platformio.org/libraries/wolfssl/wolfssl).
1717
* `user_settings_stm32.h`: Example configuration file generated from the wolfSSL STM32 Cube pack.
1818
* `user_settings_tls12.h`: Example for TLS v1.2 client only, ECC only, AES-GCM only, SHA2-256 only.
19+
* `user_settings_tls13.h`: TLS 1.3 only configuration (no TLS 1.2). Modern cipher suites with X25519/X448 key exchange.
20+
* `user_settings_dtls13.h`: DTLS 1.3 for IoT and embedded. Includes connection ID support and smaller MTU options.
21+
* `user_settings_pq.h`: Post-quantum TLS with ML-KEM (Kyber) key exchange and ML-DSA (Dilithium) certificates.
22+
* `user_settings_openssl_compat.h`: OpenSSL compatibility layer for drop-in replacement. Enables OPENSSL_ALL and related APIs.
23+
* `user_settings_baremetal.h`: Bare metal configuration. No filesystem, static memory only, minimal footprint.
24+
* `user_settings_rsa_only.h`: RSA-only configuration (no ECC). For legacy systems requiring RSA cipher suites.
25+
* `user_settings_pkcs7.h`: PKCS#7/CMS configuration for signing and encryption. S/MIME, firmware signing.
26+
* `user_settings_ca.h`: Certificate Authority / PKI operations. Certificate generation, signing, CRL, OCSP.
1927
* `user_settings_wolfboot_keytools.h`: wolfBoot key generation and signing tool. Supports ECC, RSA, ED25519, ED448, and post-quantum (ML-DSA/Dilithium, LMS, XMSS).
2028
* `user_settings_wolfssh.h`: Minimum options for building wolfSSH. See comment at top for ./configure used to generate.
2129
* `user_settings_wolftpm.h`: Minimum options for building wolfTPM. See comment at top for ./configure used to generate.

‎examples/configs/include.am‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,24 @@
44
EXTRA_DIST += examples/configs/README.md
55
EXTRA_DIST += examples/configs/user_settings_all.h
66
EXTRA_DIST += examples/configs/user_settings_arduino.h
7+
EXTRA_DIST += examples/configs/user_settings_baremetal.h
8+
EXTRA_DIST += examples/configs/user_settings_ca.h
9+
EXTRA_DIST += examples/configs/user_settings_dtls13.h
710
EXTRA_DIST += examples/configs/user_settings_EBSnet.h
811
EXTRA_DIST += examples/configs/user_settings_eccnonblock.h
912
EXTRA_DIST += examples/configs/user_settings_espressif.h
1013
EXTRA_DIST += examples/configs/user_settings_fipsv2.h
1114
EXTRA_DIST += examples/configs/user_settings_fipsv5.h
1215
EXTRA_DIST += examples/configs/user_settings_min_ecc.h
16+
EXTRA_DIST += examples/configs/user_settings_openssl_compat.h
17+
EXTRA_DIST += examples/configs/user_settings_pkcs7.h
1318
EXTRA_DIST += examples/configs/user_settings_platformio.h
19+
EXTRA_DIST += examples/configs/user_settings_pq.h
20+
EXTRA_DIST += examples/configs/user_settings_rsa_only.h
1421
EXTRA_DIST += examples/configs/user_settings_stm32.h
1522
EXTRA_DIST += examples/configs/user_settings_template.h
1623
EXTRA_DIST += examples/configs/user_settings_tls12.h
24+
EXTRA_DIST += examples/configs/user_settings_tls13.h
1725
EXTRA_DIST += examples/configs/user_settings_wolfboot_keytools.h
1826
EXTRA_DIST += examples/configs/user_settings_wolfssh.h
1927
EXTRA_DIST += examples/configs/user_settings_wolftpm.h

‎examples/configs/user_settings_baremetal.h‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
/* user_settings_baremetal.h
2+
*
3+
* Copyright (C) 2006-2025 wolfSSL Inc.
4+
*
5+
* This file is part of wolfSSL.
6+
*
7+
* wolfSSL is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 3 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfSSL is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
/* Bare metal configuration for systems without an OS.
23+
* No filesystem, no malloc (static memory), minimal footprint.
24+
* Suitable for deeply embedded systems and bootloaders.
25+
*
26+
* Build and test:
27+
* cp ./examples/configs/user_settings_baremetal.h user_settings.h
28+
* ./configure --enable-usersettings --disable-examples
29+
* make
30+
* ./wolfcrypt/test/testwolfcrypt
31+
*/
32+
33+
#ifndef WOLFSSL_USER_SETTINGS_H
34+
#define WOLFSSL_USER_SETTINGS_H
35+
36+
#ifdef __cplusplus
37+
extern "C" {
38+
#endif
39+
40+
/* ------------------------------------------------- */
41+
/* Platform - Bare Metal */
42+
/* ------------------------------------------------- */
43+
#define SINGLE_THREADED
44+
#define NO_FILESYSTEM
45+
#define NO_WRITEV
46+
#define WOLFSSL_NO_SOCK
47+
#define WOLFSSL_IGNORE_FILE_WARN
48+
#define WOLFSSL_GENERAL_ALIGNMENT 4
49+
#define SIZEOF_LONG_LONG 8
50+
51+
/* TLS transport requires setting IO callbacks */
52+
#define WOLFSSL_USER_IO
53+
54+
/* ------------------------------------------------- */
55+
/* Memory */
56+
/* ------------------------------------------------- */
57+
#if 1 /* stack memory */
58+
59+
#elif 1 /* small stack */
60+
/* Small stack - allocate large variables from static pool */
61+
#define WOLFSSL_SMALL_STACK
62+
#else /* static memory */
63+
#define WOLFSSL_STATIC_MEMORY
64+
#define WOLFSSL_NO_MALLOC
65+
#define WOLFSSL_SP_NO_MALLOC
66+
#define WOLFSSL_MALLOC_CHECK
67+
#define NO_WOLFSSL_MEMORY
68+
#endif
69+
70+
/* ------------------------------------------------- */
71+
/* Math - Single Precision (smallest) */
72+
/* ------------------------------------------------- */
73+
#define WOLFSSL_SP_MATH
74+
#define WOLFSSL_SP_SMALL
75+
#define TFM_TIMING_RESISTANT
76+
77+
/* ------------------------------------------------- */
78+
/* TLS (optional - disable for crypto-only) */
79+
/* ------------------------------------------------- */
80+
#if 0 /* TLS support */
81+
#define WOLFSSL_TLS13
82+
#define WOLFSSL_NO_TLS12
83+
#define NO_OLD_TLS
84+
#define HAVE_TLS_EXTENSIONS
85+
#define HAVE_SUPPORTED_CURVES
86+
#define HAVE_HKDF
87+
#else
88+
#define WOLFCRYPT_ONLY
89+
#endif
90+
91+
/* ------------------------------------------------- */
92+
/* ECC (smallest asymmetric option) */
93+
/* ------------------------------------------------- */
94+
#if 1 /* ECC support */
95+
#define HAVE_ECC
96+
#define WOLFSSL_HAVE_SP_ECC
97+
98+
#define ECC_USER_CURVES /* P-256 only */
99+
#undef NO_ECC256
100+
#define ECC_TIMING_RESISTANT
101+
/* Disable for smaller size */
102+
#if 0 /* ECC Shamir (faster, more code) */
103+
#define ECC_SHAMIR
104+
#endif
105+
#endif
106+
107+
/* ECC Feature Reduction */
108+
#if 0 /* Verify only (no signing/keygen) */
109+
#define NO_ECC_SIGN
110+
#define NO_ECC_DHE
111+
#define NO_ECC_KEY_EXPORT
112+
#endif
113+
114+
/* ------------------------------------------------- */
115+
/* RSA (disable for smallest size) */
116+
/* ------------------------------------------------- */
117+
#if 0 /* RSA support */
118+
#undef NO_RSA
119+
#define WOLFSSL_HAVE_SP_RSA
120+
#define WC_RSA_BLINDING
121+
#define RSA_LOW_MEM
122+
#if 0 /* Verify only */
123+
#define WOLFSSL_RSA_PUBLIC_ONLY
124+
#define WOLFSSL_RSA_VERIFY_INLINE
125+
#define NO_CHECK_PRIVATE_KEY
126+
#endif
127+
#else
128+
#define NO_RSA
129+
#endif
130+
131+
/* ------------------------------------------------- */
132+
/* Symmetric Ciphers */
133+
/* ------------------------------------------------- */
134+
#if 1 /* AES */
135+
#define HAVE_AESGCM
136+
#define GCM_SMALL
137+
#define WOLFSSL_AES_SMALL_TABLES
138+
#define WOLFSSL_AES_NO_UNROLL
139+
#define NO_AES_192
140+
#define NO_AES_256
141+
#if 0 /* AES-CBC */
142+
#undef NO_AES_CBC
143+
#else
144+
#define NO_AES_CBC
145+
#endif
146+
#else
147+
#define NO_AES
148+
#endif
149+
150+
#if 0 /* ChaCha20-Poly1305 */
151+
#define HAVE_CHACHA
152+
#define HAVE_POLY1305
153+
#endif
154+
155+
/* ------------------------------------------------- */
156+
/* Hashing */
157+
/* ------------------------------------------------- */
158+
/* SHA-256 only (required) */
159+
#define USE_SLOW_SHA256
160+
161+
#if 0 /* SHA-1 (legacy) */
162+
#undef NO_SHA
163+
#else
164+
#define NO_SHA
165+
#endif
166+
167+
/* ------------------------------------------------- */
168+
/* RNG */
169+
/* ------------------------------------------------- */
170+
#if 1 /* Hash-based DRBG */
171+
#define HAVE_HASHDRBG
172+
#else
173+
/* Use hardware RNG directly */
174+
#define WC_NO_HASHDRBG
175+
extern int my_rng_gen_block(unsigned char* output, unsigned int sz);
176+
#define CUSTOM_RAND_GENERATE_BLOCK my_rng_gen_block
177+
#endif
178+
179+
/* ------------------------------------------------- */
180+
/* ASN / Certificates */
181+
/* ------------------------------------------------- */
182+
#define WOLFSSL_ASN_TEMPLATE
183+
184+
#if 0 /* Disable certificates for smallest size */
185+
#define NO_ASN
186+
#define NO_CERTS
187+
#define NO_CODING
188+
#endif
189+
190+
/* ------------------------------------------------- */
191+
/* Disabled Algorithms */
192+
/* ------------------------------------------------- */
193+
#define NO_DH
194+
#define NO_DSA
195+
#define NO_RC4
196+
#define NO_MD4
197+
#define NO_MD5
198+
#define NO_DES3
199+
#define NO_DES3_TLS_SUITES
200+
#define NO_PSK
201+
#define NO_PWDBASED
202+
#define NO_PKCS8
203+
#define NO_PKCS12
204+
205+
/* ------------------------------------------------- */
206+
/* Disabled Features */
207+
/* ------------------------------------------------- */
208+
#define NO_SIG_WRAPPER
209+
#define NO_SESSION_CACHE
210+
#define NO_ERROR_STRINGS
211+
#define NO_OLD_RNGNAME
212+
#define NO_WOLFSSL_DIR
213+
#define BENCH_EMBEDDED
214+
215+
/* ------------------------------------------------- */
216+
/* Custom Time (bare metal has no RTC typically) */
217+
/* ------------------------------------------------- */
218+
#if 1 /* Custom time function */
219+
#define NO_ASN_TIME
220+
/* Or provide custom time:
221+
* #define USER_TIME
222+
* extern unsigned long my_time(unsigned long* timer);
223+
* #define XTIME my_time
224+
*/
225+
#endif
226+
227+
#ifdef __cplusplus
228+
}
229+
#endif
230+
231+
#endif /* WOLFSSL_USER_SETTINGS_H */

0 commit comments

Comments
 (0)