Skip to content

Commit d993650

Browse files
bigbrettbigbrett
committed
first pre-needs commit
1 parent e44e6b2 commit d993650

24 files changed

Lines changed: 1582 additions & 756 deletions

‎include/user_settings.h‎

Lines changed: 38 additions & 746 deletions
Large diffs are not rendered by default.

‎include/user_settings/base.h‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/* user_settings/base.h
2+
*
3+
* Foundation defines that every wolfBoot build needs regardless of which
4+
* SIGN/HASH/feature flags are set: alignment, threading, stdlib types,
5+
* basic sizing.
6+
*
7+
*
8+
* Copyright (C) 2026 wolfSSL Inc.
9+
*
10+
* This file is part of wolfBoot.
11+
*
12+
* wolfBoot is free software; you can redistribute it and/or modify
13+
* it under the terms of the GNU General Public License as published by
14+
* the Free Software Foundation; either version 3 of the License, or
15+
* (at your option) any later version.
16+
*
17+
* wolfBoot is distributed in the hope that it will be useful,
18+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
19+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20+
* GNU General Public License for more details.
21+
*
22+
* You should have received a copy of the GNU General Public License
23+
* along with this program; if not, write to the Free Software
24+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
25+
*/
26+
#ifndef _WOLFBOOT_USER_SETTINGS_BASE_H_
27+
#define _WOLFBOOT_USER_SETTINGS_BASE_H_
28+
29+
/* System */
30+
#define WOLFSSL_GENERAL_ALIGNMENT 4
31+
#define SINGLE_THREADED
32+
#define WOLFSSL_USER_MUTEX /* avoid wc_port.c wc_InitAndAllocMutex */
33+
/* WOLFCRYPT_ONLY: pure crypto, no TLS/SSL stack. The only configuration
34+
* that needs the SSL layer (cert manager) is wolfHSM server + cert-chain
35+
* verification, where the carve-out moves to user_settings/cert_chain.h
36+
* in a later phase. */
37+
#if !(defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER) && \
38+
defined(WOLFBOOT_CERT_CHAIN_VERIFY))
39+
# define WOLFCRYPT_ONLY
40+
#endif
41+
#define SIZEOF_LONG_LONG 8
42+
#define HAVE_EMPTY_AGGREGATES 0
43+
#define HAVE_ANONYMOUS_INLINE_AGGREGATES 0
44+
45+
/* Stdlib Types */
46+
#define CTYPE_USER /* don't let wolfCrypt types.h include ctype.h */
47+
48+
#ifndef WOLFSSL_ARMASM
49+
# ifndef toupper
50+
extern int toupper(int c);
51+
# endif
52+
# ifndef tolower
53+
extern int tolower(int c);
54+
# endif
55+
# define XTOUPPER(c) toupper((c))
56+
# define XTOLOWER(c) tolower((c))
57+
#endif
58+
59+
#ifdef USE_FAST_MATH
60+
/* wolfBoot only does public asymmetric operations,
61+
* so timing resistance and hardening is not required */
62+
# define WC_NO_HARDEN
63+
#endif
64+
65+
#endif /* _WOLFBOOT_USER_SETTINGS_BASE_H_ */

‎include/user_settings/cascade.h‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/* user_settings/cascade.h
2+
*
3+
* Lift Make-side feature implications into preprocessor cascades so an
4+
* IDE/CMake-only build (which sets only the high-level WOLFBOOT_* flags)
5+
* sees the same derived flags that options.mk would set.
6+
*
7+
* Idempotent: every #define is #ifndef-guarded, so it's a no-op when
8+
* options.mk has already emitted the same -D flag.
9+
*
10+
*
11+
* Copyright (C) 2026 wolfSSL Inc.
12+
*
13+
* This file is part of wolfBoot.
14+
*
15+
* wolfBoot is free software; you can redistribute it and/or modify
16+
* it under the terms of the GNU General Public License as published by
17+
* the Free Software Foundation; either version 3 of the License, or
18+
* (at your option) any later version.
19+
*
20+
* wolfBoot is distributed in the hope that it will be useful,
21+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
22+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23+
* GNU General Public License for more details.
24+
*
25+
* You should have received a copy of the GNU General Public License
26+
* along with this program; if not, write to the Free Software
27+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
28+
*/
29+
#ifndef _WOLFBOOT_USER_SETTINGS_CASCADE_H_
30+
#define _WOLFBOOT_USER_SETTINGS_CASCADE_H_
31+
32+
/* Any feature that requires a hardware TPM 2.0 implies WOLFBOOT_TPM.
33+
* Mirrors options.mk:34-92 where the same Make variables force WOLFTPM:=1. */
34+
#if defined(WOLFBOOT_TPM_VERIFY) || \
35+
defined(WOLFBOOT_MEASURED_BOOT) || \
36+
defined(WOLFBOOT_TPM_KEYSTORE) || \
37+
defined(WOLFBOOT_TPM_SEAL)
38+
# ifndef WOLFBOOT_TPM
39+
# define WOLFBOOT_TPM
40+
# endif
41+
#endif
42+
43+
/* WOLFBOOT_NEEDS_* declarations -- positive intent markers reconciled by
44+
* user_settings/finalize.h. Fragments may also set these from their own
45+
* headers; cascade.h handles the cases that today live as #undef blocks
46+
* scattered through user_settings.h. */
47+
48+
/* WOLFCRYPT_TZ_PSA and WOLFBOOT_TZ_FWTPM both keep CMAC and KDF enabled
49+
* (today by `#undef NO_CMAC` / `#undef NO_KDF` after the always-on block).
50+
* Lift those to positive intent so finalize.h can simply skip the
51+
* `#define NO_CMAC` / `#define NO_KDF`. */
52+
#if defined(WOLFCRYPT_TZ_PSA) || defined(WOLFBOOT_TZ_FWTPM)
53+
# ifndef WOLFBOOT_NEEDS_CMAC
54+
# define WOLFBOOT_NEEDS_CMAC
55+
# endif
56+
# ifndef WOLFBOOT_NEEDS_KDF
57+
# define WOLFBOOT_NEEDS_KDF
58+
# endif
59+
#endif
60+
61+
#endif /* _WOLFBOOT_USER_SETTINGS_CASCADE_H_ */

‎include/user_settings/cert_chain.h‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/* user_settings/cert_chain.h
2+
*
3+
* wolfCrypt configuration for WOLFBOOT_CERT_CHAIN_VERIFY. This is the
4+
* only build mode that links the wolfSSL TLS-layer cert manager (server
5+
* side). Client side just uses wolfHSM's cert manager and needs no
6+
* extra wolfCrypt config beyond what wolfhsm.h already supplies.
7+
*
8+
* The companion `WOLFCRYPT_ONLY` carve-out (when the server cert-chain
9+
* mode is active) lives in user_settings/base.h.
10+
*
11+
*
12+
* Copyright (C) 2026 wolfSSL Inc.
13+
*
14+
* This file is part of wolfBoot.
15+
*
16+
* wolfBoot is free software; you can redistribute it and/or modify
17+
* it under the terms of the GNU General Public License as published by
18+
* the Free Software Foundation; either version 3 of the License, or
19+
* (at your option) any later version.
20+
*
21+
* wolfBoot is distributed in the hope that it will be useful,
22+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
23+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24+
* GNU General Public License for more details.
25+
*
26+
* You should have received a copy of the GNU General Public License
27+
* along with this program; if not, write to the Free Software
28+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
29+
*/
30+
#ifndef _WOLFBOOT_USER_SETTINGS_CERT_CHAIN_H_
31+
#define _WOLFBOOT_USER_SETTINGS_CERT_CHAIN_H_
32+
33+
#if defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER) && \
34+
defined(WOLFBOOT_CERT_CHAIN_VERIFY)
35+
# define NO_TLS
36+
# define NO_OLD_TLS
37+
# define WOLFSSL_NO_TLS12
38+
# define WOLFSSL_USER_IO
39+
# define WOLFSSL_SP_MUL_D
40+
# define WOLFSSL_PEM_TO_DER
41+
# define WOLFSSL_ALLOW_NO_SUITES
42+
#endif
43+
44+
#endif /* _WOLFBOOT_USER_SETTINGS_CERT_CHAIN_H_ */

‎include/user_settings/encrypt.h‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/* user_settings/encrypt.h
2+
*
3+
* wolfCrypt configuration for image encryption (EXT_ENCRYPTED) and the
4+
* SECURE_PKCS11 store. The cipher selection (ChaCha20 vs AES-128 vs
5+
* AES-256 vs PKCS#11-backed) lives in options.mk; this fragment owns the
6+
* wolfCrypt-side gates that follow from those choices.
7+
*
8+
*
9+
* Copyright (C) 2026 wolfSSL Inc.
10+
*
11+
* This file is part of wolfBoot.
12+
*
13+
* wolfBoot is free software; you can redistribute it and/or modify
14+
* it under the terms of the GNU General Public License as published by
15+
* the Free Software Foundation; either version 3 of the License, or
16+
* (at your option) any later version.
17+
*
18+
* wolfBoot is distributed in the hope that it will be useful,
19+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
20+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21+
* GNU General Public License for more details.
22+
*
23+
* You should have received a copy of the GNU General Public License
24+
* along with this program; if not, write to the Free Software
25+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
26+
*/
27+
#ifndef _WOLFBOOT_USER_SETTINGS_ENCRYPT_H_
28+
#define _WOLFBOOT_USER_SETTINGS_ENCRYPT_H_
29+
30+
#if defined(EXT_ENCRYPTED)
31+
# define HAVE_PWDBASED
32+
#endif
33+
34+
#if defined(SECURE_PKCS11)
35+
# include <time.h>
36+
# define HAVE_PWDBASED
37+
# define HAVE_PBKDF2
38+
# define WOLFPKCS11_CUSTOM_STORE
39+
# define WOLFBOOT_SECURE_PKCS11
40+
# ifndef WOLFPKCS11_USER_SETTINGS
41+
# define WOLFPKCS11_USER_SETTINGS
42+
# endif
43+
# define WOLFPKCS11_NO_TIME
44+
# ifndef WOLFSSL_AES_COUNTER
45+
# define WOLFSSL_AES_COUNTER
46+
# endif
47+
# define HAVE_AESCTR
48+
# ifndef WOLFSSL_AES_DIRECT
49+
# define WOLFSSL_AES_DIRECT
50+
# endif
51+
# define WOLFSSL_AES_GCM
52+
# define GCM_TABLE_4BIT
53+
# define WOLFSSL_AES_128
54+
# define HAVE_SCRYPT
55+
# define HAVE_AESGCM
56+
# define HAVE_PKCS8
57+
#endif
58+
59+
/* PKCS11 for wolfBoot is always static. */
60+
#define HAVE_PKCS11_STATIC
61+
62+
/* The NO_PWDBASED fallback (when no fragment opted in) lives in
63+
* user_settings/finalize.h so it runs after trustzone.h / tpm.h /
64+
* test_bench.h have had a chance to set HAVE_PWDBASED. */
65+
66+
#endif /* _WOLFBOOT_USER_SETTINGS_ENCRYPT_H_ */

0 commit comments

Comments
 (0)