diff --git a/.github/configs/os-check-linux.json b/.github/configs/os-check-linux.json index 2dcbdfba8d2..f7eb1850bcc 100644 --- a/.github/configs/os-check-linux.json +++ b/.github/configs/os-check-linux.json @@ -391,7 +391,7 @@ "user_settings": "IDE/m33mu-falcon-verify/user_settings.h", "configure": ["--enable-usersettings", "--disable-examples", "--disable-crypttests", "--disable-shared", - "CPPFLAGS=-DWOLFCRYPT_ONLY -DHAVE_HASHDRBG -DWC_RESEED_INTERVAL=1000000 -DWOLFSSL_NO_GETPID"], + "CPPFLAGS=-DWOLFCRYPT_ONLY -DHAVE_HASHDRBG -DWC_RESEED_INTERVAL=1000000 -DWOLFSSL_NO_GETPID -DWOLFSSL_ACCEPT_WEAK_ENTROPY"], "check": false}, {"name": "no-server-no-client-auth", "minutes": 1.0, "configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]}, @@ -598,7 +598,7 @@ "configure": ["--enable-postauth", "--enable-sessioncerts"]}, {"name": "leanpsk", "comment": "The NO_DEV_RANDOM seed path includes no system headers, so this catches an undeclared getpid() on GCC 13 too. The test-seed #warning fails -Werror and -pedantic, so extra_cflags repeats the global set minus -pedantic (and -Wno-overlength-strings, which only matters with it) and downgrades the #warning.", - "configure": ["--enable-leanpsk"], + "configure": ["--enable-leanpsk", "--enable-weak-entropy"], "extra_cflags": "-Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -Werror=implicit-function-declaration -Wno-error=cpp", "check": false, "run": [["./wolfcrypt/test/testwolfcrypt"]]} diff --git a/.github/membrowse-targets.json b/.github/membrowse-targets.json index 8500360b694..64c540aeb6c 100644 --- a/.github/membrowse-targets.json +++ b/.github/membrowse-targets.json @@ -5,7 +5,7 @@ "board": "cortex-m4", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f IDE/GCC-ARM/Header/user_settings.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat IDE/GCC-ARM/Header/user_settings.h; printf '#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFCRYPT_ONLY -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f IDE/GCC-ARM/Header/user_settings.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat IDE/GCC-ARM/Header/user_settings.h; printf '#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFCRYPT_ONLY -DWOLFSSL_NO_SOCK -DWOLFSSL_ACCEPT_WEAK_ENTROPY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -17,7 +17,7 @@ "board": "cortex-m4-min-ecc", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_min_ecc.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_min_ecc.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_min_ecc.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_min_ecc.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -29,7 +29,7 @@ "board": "cortex-m4-tls12", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_tls12.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls12.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_tls12.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls12.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -41,7 +41,7 @@ "board": "cortex-m4-baremetal", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_baremetal.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_baremetal.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_baremetal.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_baremetal.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -53,7 +53,7 @@ "board": "cortex-m0plus", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_min_ecc.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_min_ecc.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m0plus -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m0plus -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_min_ecc.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_min_ecc.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m0plus -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m0plus -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -65,7 +65,7 @@ "board": "cortex-m3", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_tls12.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls12.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m3 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m3 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_tls12.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls12.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m3 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m3 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -77,7 +77,7 @@ "board": "cortex-m7", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f IDE/GCC-ARM/Header/user_settings.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat IDE/GCC-ARM/Header/user_settings.h; printf '#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-Wno-cpp -DWOLFCRYPT_ONLY -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f IDE/GCC-ARM/Header/user_settings.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat IDE/GCC-ARM/Header/user_settings.h; printf '#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-Wno-cpp -DWOLFCRYPT_ONLY -DWOLFSSL_NO_SOCK -DWOLFSSL_ACCEPT_WEAK_ENTROPY' LDFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -89,7 +89,7 @@ "board": "cortex-m4-tls13", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_tls13.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls13.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_tls13.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls13.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -101,7 +101,7 @@ "board": "cortex-m4-dtls13", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_dtls13.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_dtls13.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", + "build_cmd": "test -f examples/configs/user_settings_dtls13.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_dtls13.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker_large.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -113,7 +113,7 @@ "board": "cortex-m4-pq", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_pq.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_pq.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", + "build_cmd": "test -f examples/configs/user_settings_pq.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_pq.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker_large.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -125,7 +125,7 @@ "board": "cortex-m4-rsa-only", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_rsa_only.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_rsa_only.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", + "build_cmd": "test -f examples/configs/user_settings_rsa_only.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_rsa_only.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker_large.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -137,7 +137,7 @@ "board": "cortex-m4-pkcs7", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_pkcs7.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_pkcs7.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_pkcs7.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_pkcs7.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -149,7 +149,7 @@ "board": "cortex-m4-openssl-compat", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_openssl_compat.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_openssl_compat.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define SMALL_SESSION_CACHE\\n#undef HAVE_OCSP\\n#undef HAVE_CERTIFICATE_STATUS_REQUEST\\n#undef HAVE_CERTIFICATE_STATUS_REQUEST_V2\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define USER_TICKS\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", + "build_cmd": "test -f examples/configs/user_settings_openssl_compat.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_openssl_compat.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define SMALL_SESSION_CACHE\\n#undef HAVE_OCSP\\n#undef HAVE_CERTIFICATE_STATUS_REQUEST\\n#undef HAVE_CERTIFICATE_STATUS_REQUEST_V2\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define USER_TICKS\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker_large.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -161,7 +161,7 @@ "board": "cortex-m4-sp-math", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_min_ecc.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_min_ecc.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n#define WOLFSSL_SP_MATH\\n#define WOLFSSL_SP_NO_ASM\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_min_ecc.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_min_ecc.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n#define WOLFSSL_SP_MATH\\n#define WOLFSSL_SP_NO_ASM\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -173,7 +173,7 @@ "board": "cortex-m4-crypto-only", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "mkdir -p IDE/GCC-ARM/Header-gen && printf '#ifndef WOLFSSL_USER_SETTINGS_H\\n#define WOLFSSL_USER_SETTINGS_H\\n#define WOLFCRYPT_ONLY\\n#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define HAVE_AESGCM\\n#define HAVE_AES_DECRYPT\\n#define HAVE_ECC\\n#define HAVE_CHACHA\\n#define HAVE_POLY1305\\n#define WOLFSSL_SHA512\\n#define WOLFSSL_SHA384\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n#endif\\n' > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "mkdir -p IDE/GCC-ARM/Header-gen && printf '#ifndef WOLFSSL_USER_SETTINGS_H\\n#define WOLFSSL_USER_SETTINGS_H\\n#define WOLFCRYPT_ONLY\\n#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define HAVE_AESGCM\\n#define HAVE_AES_DECRYPT\\n#define HAVE_ECC\\n#define HAVE_CHACHA\\n#define HAVE_POLY1305\\n#define WOLFSSL_SHA512\\n#define WOLFSSL_SHA384\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n#endif\\n' > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK -DWOLFCRYPT_ONLY' LDFLAGS='-mcpu=cortex-m4 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -185,7 +185,7 @@ "board": "cortex-m7-tls13", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_tls13.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls13.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", + "build_cmd": "test -f examples/configs/user_settings_tls13.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_tls13.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20010000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", @@ -197,7 +197,7 @@ "board": "cortex-m7-pq", "apt_packages": "gcc-arm-none-eabi libnewlib-arm-none-eabi libstdc++-arm-none-eabi-newlib", "ghcr_tag": "ubuntu-24.04-embedded", - "build_cmd": "test -f examples/configs/user_settings_pq.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_pq.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", + "build_cmd": "test -f examples/configs/user_settings_pq.h && mkdir -p IDE/GCC-ARM/Header-gen && { cat examples/configs/user_settings_pq.h; printf '#define WOLFSSL_GENERAL_ALIGNMENT 4\\n#define SINGLE_THREADED\\n#define WOLFSSL_SMALL_STACK\\n#define NO_FILESYSTEM\\n#define NO_WRITEV\\n#define NO_MAIN_DRIVER\\n#define NO_DEV_RANDOM\\n#define BENCH_EMBEDDED\\n#define USE_CERT_BUFFERS_256\\n#define USE_CERT_BUFFERS_2048\\n#define WOLFSSL_IGNORE_FILE_WARN\\n#define WOLFSSL_USER_IO\\n#define WOLFSSL_USER_CURRTIME\\n#define TIME_OVERRIDES\\n#define USER_TICKS\\n#define XTIME my_time\\n#define XGMTIME my_gmtime\\n#define CUSTOM_RAND_TYPE unsigned int\\nextern unsigned int my_rng_seed_gen(void);\\n#undef CUSTOM_RAND_GENERATE\\n#define CUSTOM_RAND_GENERATE my_rng_seed_gen\\n#define HAVE_HASHDRBG\\n#define NO_CRYPT_TEST\\n#define NO_CRYPT_BENCHMARK\\n'; } > IDE/GCC-ARM/Header-gen/user_settings.h && cd IDE/GCC-ARM && make -f Makefile.test TOOLCHAIN=arm-none-eabi- FIPS=0 USER_SETTINGS_DIR=./Header-gen ARCHFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs -DUSE_WOLF_ARM_STARTUP' SRC_LD=-T./linker_large.ld CFLAGS_EXTRA='-DWOLFSSL_ACCEPT_WEAK_ENTROPY -Wno-cpp -DWOLFSSL_NO_SOCK' LDFLAGS='-mcpu=cortex-m7 -mthumb -mabi=aapcs --specs=nosys.specs --specs=nano.specs -Wl,-Map=./Build/WolfCryptTest.map -Wl,-ereset_handler -flto -Wl,--defsym=__stack_process_end__=0x20040000'", "elf": "IDE/GCC-ARM/Build/WolfCryptTest.elf", "ld": "IDE/GCC-ARM/linker_large.ld", "map_file": "IDE/GCC-ARM/Build/WolfCryptTest.map", diff --git a/.github/workflows/arduino.yml b/.github/workflows/arduino.yml index c1e929ef1a0..cb5350a7372 100644 --- a/.github/workflows/arduino.yml +++ b/.github/workflows/arduino.yml @@ -301,6 +301,13 @@ jobs: # ** END ** Install wolfSSL Arduino library + - name: Opt in to test-only Arduino entropy + if: matrix.fqbn != 'arduino:sam:arduino_due_x' + run: | + settings="$ARDUINO_ROOT/wolfssl/src/user_settings.h" + test -f "$settings" + sed -i '1i#define WOLFSSL_ACCEPT_WEAK_ENTROPY /* CI compile test only */' "$settings" + - name: List installed Arduino libraries run: arduino-cli lib list diff --git a/.github/workflows/entropy.yml b/.github/workflows/entropy.yml new file mode 100644 index 00000000000..821f8ce3b5b --- /dev/null +++ b/.github/workflows/entropy.yml @@ -0,0 +1,32 @@ +name: Entropy Regression Tests + +# START OF COMMON SECTION +on: + push: + branches: [ 'master', 'main', 'release/**' ] + pull_request: + branches: [ '*' ] + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true +# END OF COMMON SECTION + +jobs: + entropy: + if: github.repository_owner == 'wolfssl' + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Entropy regression tests + run: >- + python3 -m unittest + tests.weak_entropy_defaults + tests.arduino_entropy_guard + tests.cypress_trng_failure + tests.copilot_entropy_review + -v diff --git a/.github/workflows/pic32mz-sim.yml b/.github/workflows/pic32mz-sim.yml index daa215b739b..43229086901 100644 --- a/.github/workflows/pic32mz-sim.yml +++ b/.github/workflows/pic32mz-sim.yml @@ -75,6 +75,13 @@ jobs: - name: Clone PIC32MZ simulator run: git clone --depth 1 https://github.com/wolfSSL/simulators simulators + - name: Opt in to test-only PIC32MZ entropy + run: | + cp simulators/PIC32MZSim/firmware/common/user_settings.h \ + "$RUNNER_TEMP/pic32mz-user-settings-ci.h" + sed -i '1i#define WOLFSSL_ACCEPT_WEAK_ENTROPY /* simulator only */' \ + "$RUNNER_TEMP/pic32mz-user-settings-ci.h" + - uses: docker/setup-buildx-action@v4 - name: Log in to ghcr (cache refresh on cron/manual dispatch) @@ -98,5 +105,6 @@ jobs: run: | docker run --rm \ -v "${{ github.workspace }}/wolfssl:/opt/wolfssl:ro" \ + -v "$RUNNER_TEMP/pic32mz-user-settings-ci.h:/app/firmware/common/user_settings.h:ro" \ ${{ matrix.image_tag }} \ /app/scripts/${{ matrix.script }} diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 2a1bab2f7d6..c5affa0d4a5 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -114,6 +114,7 @@ jobs: --user-settings-include . \ --user-settings-include IDE/GCC-ARM/Header \ --user-settings-define WOLFSSL_USER_SETTINGS \ + --user-settings-define WOLFSSL_ACCEPT_WEAK_ENTROPY \ --user-settings-define NO_STDINT_H \ --user-settings-define WOLFSSL_NO_ASSERT_H \ --srcs wolfcrypt/src/aes.c \ @@ -187,6 +188,8 @@ jobs: cdx = json.load(f) props = {p['name']: p['value'] for p in cdx['metadata']['component']['properties']} + assert props.get('wolfssl:security:weak-entropy') == 'permitted' + assert props.get('wolfssl:security:weak-entropy-note', '').startswith('WARNING:') assert props.get('wolfssl:sbom:hash-kind') == 'source-merkle-omnibor', \ props srcs = props['wolfssl:sbom:source-set'].split(',') @@ -255,6 +258,7 @@ jobs: --user-settings-include . \ --user-settings-include IDE/GCC-ARM/Header \ --user-settings-define WOLFSSL_USER_SETTINGS \ + --user-settings-define WOLFSSL_ACCEPT_WEAK_ENTROPY \ --user-settings-define NO_STDINT_H \ --user-settings-define WOLFSSL_NO_ASSERT_H \ --srcs wolfcrypt/src/aes.c \ @@ -283,6 +287,7 @@ jobs: --user-settings-include . \ --user-settings-include IDE/GCC-ARM/Header \ --user-settings-define WOLFSSL_USER_SETTINGS \ + --user-settings-define WOLFSSL_ACCEPT_WEAK_ENTROPY \ --srcs wolfcrypt/src/aes.c wolfcrypt/src/sha.c \ --dep-libz yes \ --dep-version libz=1.3.1 \ @@ -317,6 +322,7 @@ jobs: gcc -dM -E \ -I . -I IDE/GCC-ARM/Header \ -DWOLFSSL_USER_SETTINGS \ + -DWOLFSSL_ACCEPT_WEAK_ENTROPY \ -DNO_STDINT_H \ -DWOLFSSL_NO_ASSERT_H \ -include wolfssl/wolfcrypt/settings.h \ @@ -363,6 +369,7 @@ jobs: cdx = json.load(f) props = {p['name']: p['value'] for p in cdx['metadata']['component']['properties']} + assert props.get('wolfssl:security:weak-entropy') == 'permitted' build_prop_names = { k.split(':', 2)[-1] for k in props if k.startswith('wolfssl:build:') diff --git a/.github/workflows/zephyr.yml b/.github/workflows/zephyr.yml index 770b811309a..5c0a48041ab 100644 --- a/.github/workflows/zephyr.yml +++ b/.github/workflows/zephyr.yml @@ -68,6 +68,12 @@ jobs: working-directory: zephyr run: west update -n -o=--depth=1 + - name: Opt in to test-only QEMU entropy + run: | + settings=zephyr/modules/crypto/wolfssl/zephyr/user_settings.h + test -f "$settings" + sed -i '1i#define WOLFSSL_ACCEPT_WEAK_ENTROPY /* QEMU test only */' "$settings" + - name: Export zephyr working-directory: zephyr run: west zephyr-export diff --git a/IDE/AURIX/user_settings.h b/IDE/AURIX/user_settings.h index 33094529a5c..ccf43db4b75 100644 --- a/IDE/AURIX/user_settings.h +++ b/IDE/AURIX/user_settings.h @@ -71,10 +71,17 @@ extern unsigned long my_time(unsigned long* timer); #define HAVE_HASHDRBG /* Custom Seed Source */ +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "AURIX example counter seed is predictable: provide a secure custom seed; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #define CUSTOM_RAND_TYPE unsigned int extern unsigned int my_rng_seed_gen(void); -#undef CUSTOM_RAND_GENERATE #define CUSTOM_RAND_GENERATE my_rng_seed_gen +#endif /* Standard Lib - C89 */ #define XSTRCASECMP(s1,s2) strcmp((s1),(s2)) diff --git a/IDE/C2000/compile.sh b/IDE/C2000/compile.sh index 5182e8aeeed..3c5dbd7861d 100755 --- a/IDE/C2000/compile.sh +++ b/IDE/C2000/compile.sh @@ -42,7 +42,7 @@ CFLAGS="-v28 --abi=eabi --float_support=fpu32 --tmu_support=tmu1 -O2 \ # regression surface for this port, plus hash.c, which HashML-DSA # (wc_MlDsaKey_VerifyCtxHash) calls for the digest size and OID. SRCS="error wc_port memory logging misc coding hash \ - sha sha256 sha512 sha3 wc_mldsa random ecc sp_int sp_c32 \ + sha sha256 sha512 sha3 wc_mldsa random rng_noisesrc ecc sp_int sp_c32 \ aes cmac chacha poly1305 cryptocb \ curve25519 ed25519 fe_operations ge_operations \ curve448 ed448 fe_448 ge_448" @@ -61,25 +61,6 @@ for s in $SRCS; do fi done -# rng_noisesrc.c and random.c again with the entropy gate on: that turns -# WOLFSSL_NOISE_SRC on, compiling the generic SP800-90B noise-source layer in -# rng_noisesrc.c and the C2000 wc_GenerateSeed() branch in random.c, both left -# out of the sweep above. Needs no C2000Ware - only the port .c touches -# driverlib. -for s in rng_noisesrc random; do - printf 'CC %s.c (WOLFSSL_C2000_ENTROPY) ... ' "$s" - if "$CL" $CFLAGS $INCS --define=WOLFSSL_C2000_ENTROPY \ - --compile_only --skip_assembler \ - --asm_directory="$OUT" --obj_directory="$OUT" \ - "$WOLFROOT/wolfcrypt/src/$s.c" > "$OUT/$s-noise.log" 2>&1; then - echo "ok" - else - echo "FAIL" - cat "$OUT/$s-noise.log" - rc=1 - fi -done - # The AESA hardware-AES port needs C2000Ware driverlib headers, which CI does # not download, so it is an opt-in extra leg: set C2000WARE to a C2000Ware # install to include it. @@ -89,7 +70,7 @@ if [ -n "${C2000WARE:-}" ]; then -I$C2000WARE/device_support/f28p55x/common/include \ -I$C2000WARE/device_support/f28p55x/headers/include" for p in "ti-c2000-aes:--define=WOLF_CRYPTO_CB --define=WOLFSSL_C2000_AES" \ - "ti-c2000-entropy:--define=WOLFSSL_C2000_ENTROPY"; do + "ti-c2000-entropy:"; do f=${p%%:*} d=${p#*:} printf 'CC port/ti/%s.c ... ' "$f" diff --git a/IDE/C2000/user_settings.h b/IDE/C2000/user_settings.h index 5f84b9a7424..de957e198b3 100644 --- a/IDE/C2000/user_settings.h +++ b/IDE/C2000/user_settings.h @@ -40,7 +40,9 @@ #define WOLFSSL_IGNORE_FILE_WARN #define BENCH_EMBEDDED #define NO_WOLFSSL_MEMORY -#define WOLFSSL_GENSEED_FORTEST /* dev-only seed; no TRNG on this part */ +/* Use the DCC oscillator-noise source for wc_GenerateSeed(). Hardware builds + * must also compile rng_noisesrc.c and port/ti/ti-c2000-entropy.c. */ +#define WOLFSSL_C2000_ENTROPY /* Hashes (SHA-1 is on by default - NO_SHA is not set) */ #define WOLFSSL_SHA512 diff --git a/IDE/ECLIPSE/RTTHREAD/user_settings.h b/IDE/ECLIPSE/RTTHREAD/user_settings.h index d6601a34db8..88c934b678d 100644 --- a/IDE/ECLIPSE/RTTHREAD/user_settings.h +++ b/IDE/ECLIPSE/RTTHREAD/user_settings.h @@ -33,7 +33,7 @@ #define WOLFSSL_BENCHMARK_TEST #define WOLFSSL_CLIENT_TEST #define WOLFSSL_SERVER_TEST -#define USE_TEST_GENSEED +/* Supply CUSTOM_RAND_GENERATE_SEED from a hardware entropy source. */ #define NO_DEV_RANDOM #define HAVE_PKCS7 #define HAVE_AES_KEYWRAP diff --git a/IDE/GCC-ARM/Header/user_settings.h b/IDE/GCC-ARM/Header/user_settings.h index 2ef79b4546f..96dbf9ac68b 100644 --- a/IDE/GCC-ARM/Header/user_settings.h +++ b/IDE/GCC-ARM/Header/user_settings.h @@ -480,10 +480,16 @@ extern "C" { /* ------------------------------------------------------------------------- */ /* Seed Source */ +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "GCC ARM example counter seed is predictable: provide a secure custom seed; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif /* Size of returned HW RNG value */ #define CUSTOM_RAND_TYPE unsigned int extern unsigned int my_rng_seed_gen(void); -#undef CUSTOM_RAND_GENERATE #define CUSTOM_RAND_GENERATE my_rng_seed_gen /* Choose RNG method */ @@ -501,6 +507,7 @@ extern unsigned int my_rng_seed_gen(void); #undef CUSTOM_RAND_GENERATE_BLOCK #define CUSTOM_RAND_GENERATE_BLOCK my_rng_gen_block #endif +#endif /* no application seed source */ /* ------------------------------------------------------------------------- */ diff --git a/IDE/IAR-EWARM/Projects/user_settings.h b/IDE/IAR-EWARM/Projects/user_settings.h index c6274a29df4..0da20bca95c 100644 --- a/IDE/IAR-EWARM/Projects/user_settings.h +++ b/IDE/IAR-EWARM/Projects/user_settings.h @@ -14,7 +14,9 @@ #define XVALIDATEDATE(d, f,t) (0) #define WOLFSSL_USER_CURRTIME /* for benchmark */ -#define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ +/* Provide a real seed source through CUSTOM_RAND_GENERATE_SEED before use. + * The test seed requires explicit WOLFSSL_GENSEED_FORTEST and + * WOLFSSL_ACCEPT_WEAK_ENTROPY definitions in the application build. */ /* A few examples of different math options below. * diff --git a/IDE/IAR-EWARM/embOS/SAMV71_XULT/embOS_SAMV71_XULT_user_settings/user_settings.h b/IDE/IAR-EWARM/embOS/SAMV71_XULT/embOS_SAMV71_XULT_user_settings/user_settings.h index 37714a3ec33..f895b85e16f 100644 --- a/IDE/IAR-EWARM/embOS/SAMV71_XULT/embOS_SAMV71_XULT_user_settings/user_settings.h +++ b/IDE/IAR-EWARM/embOS/SAMV71_XULT/embOS_SAMV71_XULT_user_settings/user_settings.h @@ -3,6 +3,7 @@ #undef WOLFSSL_EMBOS #define WOLFSSL_EMBOS + /* Supply a real seed through CUSTOM_RAND_GENERATE_SEED. */ #undef WOLFCRYPT_ONLY #define WOLFCRYPT_ONLY diff --git a/IDE/IAR-EWARM/embOS/custom_port/custom_port_user_settings/user_settings.h b/IDE/IAR-EWARM/embOS/custom_port/custom_port_user_settings/user_settings.h index 358c2b48e48..21dff21e8e2 100644 --- a/IDE/IAR-EWARM/embOS/custom_port/custom_port_user_settings/user_settings.h +++ b/IDE/IAR-EWARM/embOS/custom_port/custom_port_user_settings/user_settings.h @@ -3,6 +3,7 @@ #undef WOLFSSL_EMBOS #define WOLFSSL_EMBOS + /* Supply a real seed through CUSTOM_RAND_GENERATE_SEED. */ #undef WOLFCRYPT_ONLY #define WOLFCRYPT_ONLY diff --git a/IDE/IAR-MSP430/user_settings.h b/IDE/IAR-MSP430/user_settings.h index 6ee59effbcb..0c786093a5a 100644 --- a/IDE/IAR-MSP430/user_settings.h +++ b/IDE/IAR-MSP430/user_settings.h @@ -115,8 +115,15 @@ extern "C" { #define CUSTOM_RAND_TYPE unsigned int extern unsigned int msp430_rnd(void); -#undef CUSTOM_RAND_GENERATE -#define CUSTOM_RAND_GENERATE msp430_rnd +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "MSP430 timer XOR is not an entropy source: provide a secure custom seed; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif + #define CUSTOM_RAND_GENERATE msp430_rnd +#endif extern unsigned int msp430_time(long *x); #undef XTIME diff --git a/IDE/INTIME-RTOS/user_settings.h b/IDE/INTIME-RTOS/user_settings.h index 83be2eec754..1549205fb97 100644 --- a/IDE/INTIME-RTOS/user_settings.h +++ b/IDE/INTIME-RTOS/user_settings.h @@ -12,6 +12,8 @@ extern "C" { /* ------------------------------------------------------------------------- */ #undef INTIME_RTOS #define INTIME_RTOS +/* INtime v6+ uses arc4random() for seeding. Older releases must provide a + * custom seed source; random.c rejects their clock-seeded rand() fallback. */ #undef WOLF_EXAMPLES_STACK #define WOLF_EXAMPLES_STACK (1<<17) diff --git a/IDE/MDK5-ARM/Conf/user_settings.h b/IDE/MDK5-ARM/Conf/user_settings.h index bdc3ee8f8ab..be2af6fb906 100644 --- a/IDE/MDK5-ARM/Conf/user_settings.h +++ b/IDE/MDK5-ARM/Conf/user_settings.h @@ -361,15 +361,18 @@ // // Random Seed, for TEST Only -#define MDK_CONF_RNDSEED 1 +#define MDK_CONF_RNDSEED 0 #if MDK_CONF_RNDSEED == 1 +#ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "Test seed only: define WOLFSSL_ACCEPT_WEAK_ENTROPY for development; remove both before deployment" +#endif #define WOLFSSL_GENSEED_FORTEST #endif // // Hardware Crypt (See document for usage) // Hardware RNG -#define MDK_CONF_STM32F2_RNG 0 +#define MDK_CONF_STM32F2_RNG 1 #if MDK_CONF_STM32F2_RNG == 1 #define WOLFSSL_STM32_CUBEMX #define STM32_RNG @@ -386,6 +389,13 @@ #endif // +#if MDK_CONF_STM32F2_RNG == 0 && MDK_CONF_RNDSEED == 0 && \ + !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #error "Enable the STM32 hardware RNG or provide a real custom seed; test only: MDK_CONF_RNDSEED=1 and WOLFSSL_ACCEPT_WEAK_ENTROPY" +#endif // Hardware Crypt #define MDK_CONF_STM32F2_CRYPTO 0 #if MDK_CONF_STM32F2_CRYPTO == 1 @@ -422,6 +432,13 @@ #endif // +#if MDK_CONF_STM32F2_CRYPTO == 0 +#define NO_STM32_CRYPTO +#endif +#if MDK_CONF_STM32F2_HASH == 0 +#define NO_STM32_HASH +#define NO_STM32_HMAC +#endif // // Cert/Key Storage diff --git a/IDE/MPLABX16/user_settings.h b/IDE/MPLABX16/user_settings.h index 174551e95e0..ed7a41fc34e 100644 --- a/IDE/MPLABX16/user_settings.h +++ b/IDE/MPLABX16/user_settings.h @@ -38,7 +38,8 @@ extern "C" { #define BENCH_EMBEDDED #define WC_16BIT_CPU #define WORD64_AVAILABLE - #define WOLFSSL_GENSEED_FORTEST + /* PIC24 has no configured seed source. Supply + * CUSTOM_RAND_GENERATE_SEED before using the RNG. */ #endif /* ------------------------------------------------------------------------- */ diff --git a/IDE/MSVS-2019-AZSPHERE/user_settings.h b/IDE/MSVS-2019-AZSPHERE/user_settings.h index 105757ef029..18bcd6e6d03 100644 --- a/IDE/MSVS-2019-AZSPHERE/user_settings.h +++ b/IDE/MSVS-2019-AZSPHERE/user_settings.h @@ -26,6 +26,7 @@ #define CUSTOM_SERVER_CONNECTION #define WOLFSSL_AZSPHERE +/* Supply a real seed through CUSTOM_RAND_GENERATE_SEED. */ /* Client connects to the server with these details. */ #ifdef CUSTOM_SERVER_CONNECTION #ifndef SERVER_IP diff --git a/IDE/NETOS/wolfssl_netos_custom.c b/IDE/NETOS/wolfssl_netos_custom.c index 4fd4a0de39d..63a07b5bc8e 100644 --- a/IDE/NETOS/wolfssl_netos_custom.c +++ b/IDE/NETOS/wolfssl_netos_custom.c @@ -69,11 +69,12 @@ unsigned char get_byte_from_pool(void) int my_rng_generate_seed(unsigned char* output, int sz) { int i; - srand(get_byte_from_pool()); + /* Use the pool bytes directly: the pool is the entropy source, and a + * libc PRNG stage would add nothing while risking entropy loss through + * non-random low-order bits. */ for (i = 0; i < sz; i++) { - output[i] = (unsigned char) rand(); - srand(get_byte_from_pool()); + output[i] = get_byte_from_pool(); } return 0; diff --git a/IDE/RISCV/SIFIVE-HIFIVE1/user_settings.h b/IDE/RISCV/SIFIVE-HIFIVE1/user_settings.h index 2ce13735ee8..ad67a2ae099 100644 --- a/IDE/RISCV/SIFIVE-HIFIVE1/user_settings.h +++ b/IDE/RISCV/SIFIVE-HIFIVE1/user_settings.h @@ -458,6 +458,13 @@ extern "C" { /* ------------------------------------------------------------------------- */ /* RNG */ /* ------------------------------------------------------------------------- */ +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "HiFive1 example counter seed is predictable: provide a secure custom seed; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #if 0 /* Bypass P-RNG and use only HW RNG */ #define CUSTOM_RAND_TYPE unsigned int @@ -471,9 +478,9 @@ extern "C" { /* Size of returned HW RNG value */ #define CUSTOM_RAND_TYPE unsigned int extern unsigned int my_rng_seed_gen(void); - #undef CUSTOM_RAND_GENERATE #define CUSTOM_RAND_GENERATE my_rng_seed_gen #endif +#endif /* no application seed source */ /* ------------------------------------------------------------------------- */ /* Enable Features */ diff --git a/IDE/Renesas/cs+/Projects/common/user_settings.h b/IDE/Renesas/cs+/Projects/common/user_settings.h index cd24ea79ddd..11ea2f59ae2 100644 --- a/IDE/Renesas/cs+/Projects/common/user_settings.h +++ b/IDE/Renesas/cs+/Projects/common/user_settings.h @@ -55,7 +55,7 @@ #define WOLFSSL_USER_CURRTIME /* for benchmark */ -#define WOLFSSL_GENSEED_FORTEST /* Wardning: define your own seed gen */ +/* Supply a real seed through CUSTOM_RAND_GENERATE_SEED before use. */ #define SINGLE_THREADED /* or define RTOS option */ /*#define WOLFSSL_CMSIS_RTOS */ diff --git a/IDE/Renesas/e2studio/DK-S7G2/user_settings.h b/IDE/Renesas/e2studio/DK-S7G2/user_settings.h index 82f9e5e9acd..27da59124fe 100644 --- a/IDE/Renesas/e2studio/DK-S7G2/user_settings.h +++ b/IDE/Renesas/e2studio/DK-S7G2/user_settings.h @@ -25,8 +25,12 @@ /* #define WOLFSSL_SCE_NO_HASH */ #if defined(WOLFSSL_SCE_NO_TRNG) - /* use unsafe test seed if TRNG not used (not for production) */ - #define WOLFSSL_GENSEED_FORTEST + #if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "SCE TRNG disabled: provide a real custom seed; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #endif #define HAVE_ECC diff --git a/IDE/Renesas/e2studio/Projects/common/user_settings.h b/IDE/Renesas/e2studio/Projects/common/user_settings.h index da6d235df3d..0af064e82d0 100644 --- a/IDE/Renesas/e2studio/Projects/common/user_settings.h +++ b/IDE/Renesas/e2studio/Projects/common/user_settings.h @@ -71,7 +71,12 @@ /* TSIP TLS specific definitions */ #if !defined(WOLFSSL_RENESAS_TSIP) #define OPENSSL_EXTRA - #define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ + #if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "Enable Renesas TSIP or provide a real custom seed; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #else #if defined(WOLFSSL_RENESAS_RX65N) /* In the case of Static RSA and AES-CBC use */ diff --git a/IDE/Renesas/e2studio/RA6M3/common/user_settings.h b/IDE/Renesas/e2studio/RA6M3/common/user_settings.h index c0ccf46f052..61583d357d1 100644 --- a/IDE/Renesas/e2studio/RA6M3/common/user_settings.h +++ b/IDE/Renesas/e2studio/RA6M3/common/user_settings.h @@ -22,9 +22,15 @@ #define USER_SETTINGS_H_ -/* Temporary defines. Not suitable for production. */ -#define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ -/* End temporary defines */ +/* The FSP SCE can supply random data through wc_fspsm_GenerateRandBlock(), + * but this sample does not build the FSPSM port. Integrate that driver and + * select it with CUSTOM_RAND_GENERATE_BLOCK, or provide another real source. */ +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "RA6M3 needs an FSP SCE or custom seed source; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" +#endif /* TLS 1.3 */ #define WOLFSSL_TLS13 diff --git a/IDE/Renesas/e2studio/RX65N/GR-ROSE/common/user_settings.h b/IDE/Renesas/e2studio/RX65N/GR-ROSE/common/user_settings.h index 90abbd15d44..6f8bc2b92bd 100644 --- a/IDE/Renesas/e2studio/RX65N/GR-ROSE/common/user_settings.h +++ b/IDE/Renesas/e2studio/RX65N/GR-ROSE/common/user_settings.h @@ -254,7 +254,12 @@ #define CUSTOM_RAND_GENERATE_BLOCK wc_tsip_GenerateRandBlock #else #define OPENSSL_EXTRA - #define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ + #if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "Renesas TSIP disabled: provide a real custom seed; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #if !defined(min) #define min(data1, data2) _builtin_min(data1, data2) #endif diff --git a/IDE/Renesas/e2studio/RX65N/RSK/wolfssl_demo/user_settings.h b/IDE/Renesas/e2studio/RX65N/RSK/wolfssl_demo/user_settings.h index 38693da8680..385739839e1 100644 --- a/IDE/Renesas/e2studio/RX65N/RSK/wolfssl_demo/user_settings.h +++ b/IDE/Renesas/e2studio/RX65N/RSK/wolfssl_demo/user_settings.h @@ -257,7 +257,12 @@ #define CUSTOM_RAND_GENERATE_BLOCK wc_tsip_GenerateRandBlock #else #define OPENSSL_EXTRA - #define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ + #if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "Renesas TSIP disabled: provide a real custom seed; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #endif diff --git a/IDE/Renesas/e2studio/RX72N/EnvisionKit/wolfssl_demo/user_settings.h b/IDE/Renesas/e2studio/RX72N/EnvisionKit/wolfssl_demo/user_settings.h index 5d2dddd05ce..92a3435c252 100644 --- a/IDE/Renesas/e2studio/RX72N/EnvisionKit/wolfssl_demo/user_settings.h +++ b/IDE/Renesas/e2studio/RX72N/EnvisionKit/wolfssl_demo/user_settings.h @@ -276,7 +276,12 @@ *-----------------------------------------------------------------------*/ #define CUSTOM_RAND_GENERATE_BLOCK wc_tsip_GenerateRandBlock #else - #define WOLFSSL_GENSEED_FORTEST /* Warning: define your own seed gen */ + #if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "Renesas TSIP disabled: provide a real custom seed; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #if !defined(min) #define min(data1, data2) _builtin_min(data1, data2) #endif diff --git a/IDE/Renesas/e2studio/SK-S7G2/common/user_settings.h b/IDE/Renesas/e2studio/SK-S7G2/common/user_settings.h index 74cc4e7d0a3..5eceba46d5e 100644 --- a/IDE/Renesas/e2studio/SK-S7G2/common/user_settings.h +++ b/IDE/Renesas/e2studio/SK-S7G2/common/user_settings.h @@ -47,8 +47,12 @@ /* #define WOLFSSL_SCE_NO_HASH */ #if defined(WOLFSSL_SCE_NO_TRNG) - /* use unsafe test seed if TRNG not used (not for production) */ - #define WOLFSSL_GENSEED_FORTEST + #if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "SCE TRNG disabled: provide a real custom seed; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #endif #define HAVE_ECC diff --git a/IDE/STARCORE/user_settings.h b/IDE/STARCORE/user_settings.h index f41e24e0b37..d3ad37d2db4 100644 --- a/IDE/STARCORE/user_settings.h +++ b/IDE/STARCORE/user_settings.h @@ -468,11 +468,18 @@ extern "C" { /* Seed Source */ /* Seed Source */ +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "STARCORE example time-seeded rand is weak: provide a secure custom seed; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #if 1 extern int my_rng_generate_seed(unsigned char* output, int sz); - #undef CUSTOM_RAND_GENERATE_SEED #define CUSTOM_RAND_GENERATE_SEED my_rng_generate_seed #endif +#endif /* no application seed source */ /* NETOS */ #if 0 diff --git a/IDE/STM32Cube/MX2/README.md b/IDE/STM32Cube/MX2/README.md index 4e4b2345d92..6d6097f8d6d 100644 --- a/IDE/STM32Cube/MX2/README.md +++ b/IDE/STM32Cube/MX2/README.md @@ -10,7 +10,9 @@ rendered by a Handlebars template through `cube codegen`, producing STM32CubeMX2 (JSON-Forms). Includes the `STM32 Hardware Crypto` toggle: on devices where wolfSSL has register-level STM32 support (independent of the HAL1 to HAL2 API change), the generated configuration enables the - RNG, HASH, AES and PKA peripherals. + HASH, AES and PKA peripherals. The hardware RNG remains enabled for seeding + even when acceleration is off. Devices without an RNG require a custom + entropy source such as `CUSTOM_RAND_GENERATE_SEED`. - `mx_wolfSSL_conf_template.h.hbs` - the Handlebars template that renders `mx_wolfSSL_conf.h`. diff --git a/IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs b/IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs index 8d1611d102e..925e9a0194f 100644 --- a/IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs +++ b/IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs @@ -480,14 +480,12 @@ #elif defined(STM32F401xE) #define WOLFSSL_STM32F4 #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ #ifndef HAL_CONSOLE_UART #define HAL_CONSOLE_UART huart2 #endif #elif defined(STM32G071xx) #define WOLFSSL_STM32G0 #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ #ifndef HAL_CONSOLE_UART #define HAL_CONSOLE_UART huart2 #endif @@ -547,10 +545,15 @@ #undef NO_STM32_HASH #undef NO_STM32_CRYPTO #else + /* HAL2 has no HAL1 RNG API. Keep only the direct-register RNG. */ + #include "stm32c5xx.h" + #define WOLFSSL_STM32_RNG_NOLIB + #define WC_STM32_RNG_CLK_ENABLE() \ + do { RCC->AHB2ENR |= RCC_AHB2ENR_RNGEN; \ + (void)RCC->AHB2ENR; } while (0) #define NO_STM32_HASH #define NO_STM32_CRYPTO - #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST + #define NO_STM32_HMAC #endif #elif defined(STM32V873xx) /* STM32V8 (Cortex-M85): register-level crypto like the C5 above. @@ -565,10 +568,15 @@ #undef NO_STM32_HASH #undef NO_STM32_CRYPTO #else + /* HAL2 has no HAL1 RNG API. Keep only the direct-register RNG. */ + #include "stm32v8xx.h" + #define WOLFSSL_STM32_RNG_NOLIB + #define WC_STM32_RNG_CLK_ENABLE() \ + do { RCC->AHB3ENR |= RCC_AHB3ENR_RNGEN; \ + (void)RCC->AHB3ENR; } while (0) #define NO_STM32_HASH #define NO_STM32_CRYPTO - #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST + #define NO_STM32_HMAC #endif #else #warning Please define a hardware platform! @@ -594,13 +602,10 @@ //#define NO_STM32_RNG //#undef NO_STM32_HASH //#undef NO_STM32_CRYPTO - /* if no HW RNG is available use test seed */ - //#define WOLFSSL_GENSEED_FORTEST + /* If the device has no RNG, provide CUSTOM_RAND_GENERATE_SEED. */ #endif -/* Honor the hardware crypto toggle on every family: the per-family arms - * above enable what each part supports; turning the toggle off forces the - * software paths regardless of family. */ +/* Software crypto mode keeps the hardware RNG for secure seeding. */ #if defined(WOLF_CONF_HW_CRYPTO) && WOLF_CONF_HW_CRYPTO == 0 #undef WOLFSSL_STM32_PKA #undef WOLFSSL_STM32_BARE @@ -610,22 +615,29 @@ #ifndef NO_STM32_CRYPTO #define NO_STM32_CRYPTO #endif - #ifndef NO_STM32_RNG - #define NO_STM32_RNG - #endif - #ifndef WOLFSSL_GENSEED_FORTEST - #define WOLFSSL_GENSEED_FORTEST + #ifndef NO_STM32_HMAC + #define NO_STM32_HMAC #endif #endif +/* These devices have no on-chip RNG. Supply a real seed source or explicitly + * configure a test-only seed in your project. */ +#if (!defined(WOLF_CONF_RNG) || WOLF_CONF_RNG != 0) && \ + defined(NO_STM32_RNG) && !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) && \ + !defined(WOLFSSL_ACCEPT_WEAK_ENTROPY) + #error "STM32 device has no RNG: provide CUSTOM_RAND_GENERATE_SEED or another real seed source" +#endif + /* ------------------------------------------------------------------------- */ /* Platform */ /* ------------------------------------------------------------------------- */ #define SIZEOF_LONG_LONG 8 #define WOLFSSL_GENERAL_ALIGNMENT 4 -#ifndef WOLFSSL_STM32_BARE - /* register-level (BARE) hardware crypto arms above take precedence; - * the two modes are mutually exclusive in wolfssl settings.h */ +#if !defined(WOLFSSL_STM32_BARE) && !defined(WOLFSSL_STM32_RNG_NOLIB) + /* HAL2 register-level RNG and BARE crypto must not select HAL1 CubeMX. */ #define WOLFSSL_STM32_CUBEMX #endif #define WOLFSSL_SMALL_STACK diff --git a/IDE/STM32Cube/MX2/mx_wolfSSL_parameters.json b/IDE/STM32Cube/MX2/mx_wolfSSL_parameters.json index 438e5341701..3f3936bc5fe 100644 --- a/IDE/STM32Cube/MX2/mx_wolfSSL_parameters.json +++ b/IDE/STM32Cube/MX2/mx_wolfSSL_parameters.json @@ -284,7 +284,7 @@ "hwCrypto": { "type": "boolean", "title": "STM32 Hardware Crypto", - "description": "Use the STM32 hardware crypto peripherals (RNG, HASH, AES, PKA) where the selected device has wolfSSL support; software fallback otherwise", + "description": "Use STM32 hardware acceleration for HASH, AES and PKA where supported; the hardware RNG remains enabled for secure seeding when present", "default": true }, "consoleUart": { diff --git a/IDE/STM32Cube/README.md b/IDE/STM32Cube/README.md index 83eaafdbadd..6f1abae8a7d 100644 --- a/IDE/STM32Cube/README.md +++ b/IDE/STM32Cube/README.md @@ -115,6 +115,11 @@ To disable hardware crypto acceleration you can define: * `NO_STM32_CRYPTO` * `NO_STM32_RNG` +The STM32 RNG is used by `wc_GenerateSeed()` when available. Keep it enabled +even if AES, HASH, and PKA acceleration are disabled. STM32F107, STM32F401, +and STM32G071 have no RNG; their sample configurations require a real external +seed source, such as `CUSTOM_RAND_GENERATE_SEED`. + To enable the latest Cube HAL support please define `STM32_HAL_V2`. If you'd like to use the older Standard Peripheral library undefine `WOLFSSL_STM32_CUBEMX`. diff --git a/IDE/STM32Cube/default_conf.ftl b/IDE/STM32Cube/default_conf.ftl index 01bc7034977..a595451a24d 100644 --- a/IDE/STM32Cube/default_conf.ftl +++ b/IDE/STM32Cube/default_conf.ftl @@ -192,14 +192,12 @@ extern ${variable.value} ${variable.name}; #elif defined(STM32F401xE) #define WOLFSSL_STM32F4 #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ #ifndef HAL_CONSOLE_UART #define HAL_CONSOLE_UART huart2 #endif #elif defined(STM32G071xx) #define WOLFSSL_STM32G0 #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ #ifndef HAL_CONSOLE_UART #define HAL_CONSOLE_UART huart2 #endif @@ -285,8 +283,18 @@ extern ${variable.value} ${variable.name}; //#define NO_STM32_RNG //#undef NO_STM32_HASH //#undef NO_STM32_CRYPTO - /* if no HW RNG is available use test seed */ - //#define WOLFSSL_GENSEED_FORTEST + /* If the device has no RNG, provide CUSTOM_RAND_GENERATE_SEED. */ +#endif + +/* These devices have no on-chip RNG. Supply a real seed source or explicitly + * configure a test-only seed in your project. */ +#if (!defined(WOLF_CONF_RNG) || WOLF_CONF_RNG != 0) && \ + defined(NO_STM32_RNG) && !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) && \ + !defined(WOLFSSL_ACCEPT_WEAK_ENTROPY) + #error "STM32 device has no RNG: provide CUSTOM_RAND_GENERATE_SEED or another real seed source" #endif diff --git a/IDE/VS-AZURE-SPHERE/user_settings.h b/IDE/VS-AZURE-SPHERE/user_settings.h index a55c0b0915d..86245b15285 100644 --- a/IDE/VS-AZURE-SPHERE/user_settings.h +++ b/IDE/VS-AZURE-SPHERE/user_settings.h @@ -2,6 +2,7 @@ #define _USER_SETTINGS_H_ #define WOLFSSL_AZSPHERE +/* Supply a real seed through CUSTOM_RAND_GENERATE_SEED. */ /* Client connects to the server with these details. */ #ifdef CUSTOM_SERVER_CONNECTION #ifndef SERVER_IP diff --git a/IDE/m33mu-falcon-verify/user_settings.h b/IDE/m33mu-falcon-verify/user_settings.h index 22093d26201..d968824fc25 100644 --- a/IDE/m33mu-falcon-verify/user_settings.h +++ b/IDE/m33mu-falcon-verify/user_settings.h @@ -12,7 +12,15 @@ #define NO_WOLFSSL_DIR #define WOLFSSL_NO_ASM #define WC_NO_HARDEN -#define CUSTOM_RAND_GENERATE_BLOCK custom_rand_generate_block +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "m33mu Falcon deterministic RNG is test-only: provide a secure source or explicitly define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif + #define CUSTOM_RAND_GENERATE_BLOCK custom_rand_generate_block +#endif /* Native Falcon, verify-only (no sign/keygen), experimental. The verify path * needs SHA-3 / SHAKE256 for hash-to-point. The DSP NTT auto-enables on diff --git a/IDE/qemu-falcon-neon/user_settings.h b/IDE/qemu-falcon-neon/user_settings.h index ebbbcf9b740..c1985f956c0 100644 --- a/IDE/qemu-falcon-neon/user_settings.h +++ b/IDE/qemu-falcon-neon/user_settings.h @@ -11,7 +11,15 @@ #define NO_WOLFSSL_DIR #define WC_NO_HARDEN #define WOLFSSL_NO_ASM -#define CUSTOM_RAND_GENERATE_BLOCK custom_rand_generate_block +#if !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "QEMU Falcon deterministic RNG is test-only: provide a secure source or explicitly define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif + #define CUSTOM_RAND_GENERATE_BLOCK custom_rand_generate_block +#endif /* Native Falcon (full: keygen + sign + verify), experimental. Signing/keygen * run over the inline-double fpr backend with the AArch64 NEON FFT. */ diff --git a/RTOS/nuttx/wolfssl/README.md b/RTOS/nuttx/wolfssl/README.md index bc5a60953bb..7cd06263021 100644 --- a/RTOS/nuttx/wolfssl/README.md +++ b/RTOS/nuttx/wolfssl/README.md @@ -90,6 +90,11 @@ Skip to step 6 nsh> wolfssl_client_server ``` ## Notes +- `user_settings.h` now requires a real seed source. For supported STM32 + boards, enable the NuttX RNG peripheral and define `STM32_NUTTX_RNG` for both + wolfSSL and the application. This path requires wolfSSL 5.9.4 or newer; the + Kconfig fallback archive still defaults to 5.5.4. Alternatively provide + `CUSTOM_RAND_GENERATE_SEED` from the board integration. - Developed using the following targets: - STM NUCLEO-L552ZE-Q (Cortex-M33) - STM NUCLEO-H753ZI diff --git a/RTOS/nuttx/wolfssl/user_settings.h b/RTOS/nuttx/wolfssl/user_settings.h index 02fc2d5190b..ba8cb154684 100644 --- a/RTOS/nuttx/wolfssl/user_settings.h +++ b/RTOS/nuttx/wolfssl/user_settings.h @@ -33,7 +33,19 @@ #define NO_DSA /* RNG */ -#define WOLFSSL_GENSEED_FORTEST +#if defined(STM32_NUTTX_RNG) + /* NuttX enables the peripheral clock; wolfCrypt reads the STM32 RNG. */ + #include + #if LIBWOLFSSL_VERSION_HEX < 0x05009004 + #error "STM32_NUTTX_RNG needs wolfSSL 5.9.4 or newer; use a current source tree or provide a custom seed" + #endif + #define STM32_RNG +#elif !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) + #error "Enable STM32_NUTTX_RNG or provide a real custom seed; test only: define WOLFSSL_GENSEED_FORTEST and WOLFSSL_ACCEPT_WEAK_ENTROPY" +#endif /* Applications */ #define NO_MAIN_FUNCTION diff --git a/configure.ac b/configure.ac index 9d5287ac2c3..1b809860cfa 100644 --- a/configure.ac +++ b/configure.ac @@ -5560,6 +5560,22 @@ then AM_CFLAGS="$AM_CFLAGS -DHAVE_AMD_RDSEED" fi +# WEAK ENTROPY ACCEPTANCE +AC_ARG_ENABLE([weak-entropy], + [AS_HELP_STRING([--enable-weak-entropy], + [Accept weak/test entropy seed sources; NEVER for production (default: disabled)])], + [ ENABLED_WEAK_ENTROPY=$enableval ], + [ ENABLED_WEAK_ENTROPY=no ] +) + +if test "$ENABLED_WEAK_ENTROPY" = "yes" +then + AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ACCEPT_WEAK_ENTROPY" +elif test "$ENABLED_LEANPSK" = "yes" +then + AC_MSG_WARN([leanpsk has no default entropy source; pass --enable-weak-entropy to accept the test seed, or provide a real one via CUSTOM_RAND_GENERATE_SEED]) +fi + # Linux af_alg AC_ARG_ENABLE([afalg], @@ -15302,6 +15318,7 @@ echo " * SRTP-KDF: $ENABLED_SRTP_KDF" echo " * PSK: $ENABLED_PSK" echo " * Poly1305: $ENABLED_POLY1305" echo " * LEANPSK: $ENABLED_LEANPSK" +echo " * WEAK ENTROPY ACCEPTANCE: $ENABLED_WEAK_ENTROPY" echo " * LEANTLS: $ENABLED_LEANTLS" echo " * RSA: $ENABLED_RSA" echo " * RSA-PSS: $ENABLED_RSAPSS" diff --git a/doc/SBOM.md b/doc/SBOM.md index 32c7de41b7c..4a57dcd8cdf 100644 --- a/doc/SBOM.md +++ b/doc/SBOM.md @@ -153,6 +153,18 @@ downstream tooling filters on — which **input** the checksum came from: is what an integrator keys on without needing to know the hashing internals. +#### Weak entropy opt-in + +If the recorded build defines `WOLFSSL_ACCEPT_WEAK_ENTROPY`, the generator +prints a warning and marks the wolfSSL component with +`wolfssl:security:weak-entropy=permitted`. CycloneDX stores this in the +component's `properties`; SPDX stores it in the package's `annotations`. +Both formats also carry a `wolfssl:security:weak-entropy-note` explaining +that keys and nonces may be predictable. The marker means the build permits +a weak seed source; it does not prove which seed source the application used. +Deployment policy can reject SBOMs containing this marker. Verify the +actual entropy source and remove the opt-in before release. + #### No hashable artefact (`--no-artifact-hash`) For ROM images, HSM firmware, or binary-only redistributions where diff --git a/examples/configs/user_settings_arduino.h b/examples/configs/user_settings_arduino.h index 57dfa6b3630..accc735b732 100644 --- a/examples/configs/user_settings_arduino.h +++ b/examples/configs/user_settings_arduino.h @@ -24,6 +24,11 @@ >> at publish time. (lines with ">>" are removed at publish time) */ +/* Arduino Due uses its TRNG. Other boards must provide a hardware-backed + * CUSTOM_RAND_GENERATE_SEED (or equivalent secure seed source) before using + * wolfSSL's RNG. The Arduino random() fallback is test-only and requires an + * explicit WOLFSSL_ACCEPT_WEAK_ENTROPY build define. */ + /* Define a macro to display user settings version in example code: */ #define WOLFSSL_USER_SETTINGS_ID "Arduino user_settings.h v5.8.2" diff --git a/examples/configs/user_settings_stm32.h b/examples/configs/user_settings_stm32.h index fc6897c521a..9cae5edfe9a 100644 --- a/examples/configs/user_settings_stm32.h +++ b/examples/configs/user_settings_stm32.h @@ -230,12 +230,10 @@ extern "C" { #define WOLFSSL_STM32F4 #define HAL_CONSOLE_UART huart2 #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ #elif defined(STM32G071xx) #define WOLFSSL_STM32G0 #define HAL_CONSOLE_UART huart2 #define NO_STM32_RNG - #define WOLFSSL_GENSEED_FORTEST /* no HW RNG is available use test seed */ #elif defined(STM32G491xx) #define WOLFSSL_STM32G4 #define HAL_CONSOLE_UART hlpuart1 @@ -281,11 +279,21 @@ extern "C" { //#define NO_STM32_RNG //#undef NO_STM32_HASH //#undef NO_STM32_CRYPTO - /* if no HW RNG is available use test seed */ - //#define WOLFSSL_GENSEED_FORTEST + /* If the device has no RNG, provide CUSTOM_RAND_GENERATE_SEED. */ //#define STM32_HAL_V2 #endif +/* These devices have no on-chip RNG. Supply a real seed source or explicitly + * configure a test-only seed in your project. */ +#if (!defined(WOLF_CONF_RNG) || WOLF_CONF_RNG != 0) && \ + defined(NO_STM32_RNG) && !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && !defined(WOLFSSL_GENSEED_FORTEST) && \ + !defined(WOLFSSL_ACCEPT_WEAK_ENTROPY) + #error "STM32 device has no RNG: provide CUSTOM_RAND_GENERATE_SEED or another real seed source" +#endif + /* ------------------------------------------------------------------------- */ /* Platform */ diff --git a/mcapi/user_settings.h b/mcapi/user_settings.h index 79a99ce410e..87c6fb7fd51 100644 --- a/mcapi/user_settings.h +++ b/mcapi/user_settings.h @@ -24,6 +24,7 @@ extern "C" { #undef MICROCHIP_PIC32 #define MICROCHIP_PIC32 +/* Supply a real seed source when the target has no hardware TRNG. */ #undef WOLFSSL_MICROCHIP_PIC32MZ #define WOLFSSL_MICROCHIP_PIC32MZ diff --git a/scripts/gen-sbom b/scripts/gen-sbom index 9225d7c34bf..a672da9c4ab 100755 --- a/scripts/gen-sbom +++ b/scripts/gen-sbom @@ -21,7 +21,20 @@ from datetime import datetime, timezone # fields. Reproducibility CI keys on byte-equal SBOMs across re-runs, # so this constant must change in lockstep with the output it produces. GEN_SBOM_TOOL_NAME = 'wolfssl-sbom-gen' -GEN_SBOM_VERSION = '1.2' +GEN_SBOM_VERSION = '1.3' + +_WEAK_ENTROPY_NOTE = ( + 'WARNING: WOLFSSL_ACCEPT_WEAK_ENTROPY permits weak or deterministic ' + 'seed sources. Keys and nonces may be predictable if such a source is ' + 'selected. Verify the actual entropy source and remove this opt-in ' + 'before deployment.' +) + + +def weak_entropy_permitted(build_props): + """A defined opt-in permits weak seeds even when its value is zero.""" + return any(name == 'WOLFSSL_ACCEPT_WEAK_ENTROPY' + for name, _value in build_props) # Placeholder recorded in the component checksum fields when the operator # passes --no-artifact-hash: a build (ROM image, HSM firmware, binary-only @@ -804,6 +817,12 @@ def generate_cdx(name, version, supplier, license_id, license_text, lib_hash, {'name': f'wolfssl:build:{k}', 'value': v if v else '1'} for k, v in build_props ] + if weak_entropy_permitted(build_props): + properties.extend([ + {'name': 'wolfssl:security:weak-entropy', 'value': 'permitted'}, + {'name': 'wolfssl:security:weak-entropy-note', + 'value': _WEAK_ENTROPY_NOTE}, + ]) # Document what the SHA-256 in `hashes` represents, on every entry # point. Without this property an auditor reading the SBOM has to # guess whether the SHA-256 is over a library binary, a source-set @@ -929,6 +948,9 @@ def generate_spdx(name, version, supplier, license_id, license_text, lib_hash, _annotate(f'wolfssl:sbom:hash-kind={hash_kind}') _annotate(f'wolfssl:sbom:hash-source={hash_source}') + if weak_entropy_permitted(build_props): + _annotate('wolfssl:security:weak-entropy=permitted') + _annotate(f'wolfssl:security:weak-entropy-note={_WEAK_ENTROPY_NOTE}') if hash_source == 'none': _annotate(f'wolfssl:sbom:no-artifact-hash-note={_NO_HASH_NOTE}') if srcs_basenames: @@ -1278,6 +1300,8 @@ def main(): args.user_settings_include, args.user_settings_define, ) + if weak_entropy_permitted(build_props): + print(_WEAK_ENTROPY_NOTE, file=sys.stderr) file_entries = None if args.lib: diff --git a/scripts/test_gen_sbom.py b/scripts/test_gen_sbom.py index d46752f83e2..3ecfa8383f7 100644 --- a/scripts/test_gen_sbom.py +++ b/scripts/test_gen_sbom.py @@ -1478,6 +1478,16 @@ def test_neither_options_nor_user_settings_fails(self): self.assertNotEqual(result.returncode, 0) self.assertIn('--options-h or --user-settings', result.stderr) + def test_weak_entropy_opt_in_warns_at_generation_time(self): + with tempfile.TemporaryDirectory() as directory: + options = pathlib.Path(directory) / 'options.h' + options.write_text('#define WOLFSSL_ACCEPT_WEAK_ENTROPY 1\n') + result = self._run( + *self.BASE, '--options-h', str(options), + '--no-artifact-hash') + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn('WARNING: WOLFSSL_ACCEPT_WEAK_ENTROPY', result.stderr) + def test_lib_and_srcs_together_fail(self): result = self._run( *self.BASE, @@ -1914,6 +1924,19 @@ def test_build_properties_emitted(self): # consumer can't distinguish '#define X' from '#define X 1'. self.assertEqual(names['wolfssl:build:NO_DES3'], '1') + def test_weak_entropy_opt_in_has_visible_security_warning(self): + doc = gs.generate_cdx(**{ + **self.BASE_KW, + 'build_props': [('WOLFSSL_ACCEPT_WEAK_ENTROPY', '1')], + }) + props = {p['name']: p['value'] + for p in doc['metadata']['component']['properties']} + self.assertEqual(props['wolfssl:security:weak-entropy'], 'permitted') + self.assertIn('WARNING', props['wolfssl:security:weak-entropy-note']) + clean = gs.generate_cdx(**self.BASE_KW) + clean_props = {p['name'] for p in clean['metadata']['component']['properties']} + self.assertNotIn('wolfssl:security:weak-entropy', clean_props) + def test_dependency_refs_match_components(self): # Critical invariant: every bom-ref in `dependencies` must # appear as a `bom-ref` on either the main component or one @@ -2241,6 +2264,23 @@ def test_source_merkle_path_annotates_via_annotations(self): self.assertNotIn('hash-kind=', wolfssl_pkg['comment']) self.assertNotIn('source-set=', wolfssl_pkg['comment']) + def test_weak_entropy_opt_in_has_visible_security_annotation(self): + doc = gs.generate_spdx(**{ + **self.BASE_KW, + 'build_props': [('WOLFSSL_ACCEPT_WEAK_ENTROPY', '1')], + }) + package = next(p for p in doc['packages'] + if p['SPDXID'] == 'SPDXRef-Package-wolfssl') + comments = [a['comment'] for a in package['annotations']] + self.assertIn('wolfssl:security:weak-entropy=permitted', comments) + self.assertTrue(any(c.startswith('wolfssl:security:weak-entropy-note=WARNING') + for c in comments)) + clean = gs.generate_spdx(**self.BASE_KW) + clean_package = next(p for p in clean['packages'] + if p['SPDXID'] == 'SPDXRef-Package-wolfssl') + self.assertFalse(any('weak-entropy' in a['comment'] + for a in clean_package['annotations'])) + def test_library_binary_path_annotates_via_annotations(self): # Companion to the source-merkle test: library-binary also # emits hash-kind via annotations[]. The old behaviour of diff --git a/tests/arduino_entropy_guard.py b/tests/arduino_entropy_guard.py new file mode 100644 index 00000000000..9a772915d12 --- /dev/null +++ b/tests/arduino_entropy_guard.py @@ -0,0 +1,50 @@ +"""Compile-time checks for the Arduino seed path in random.c.""" + +import pathlib +import subprocess +import unittest + + +ROOT = pathlib.Path(__file__).resolve().parents[1] +SOURCE = (ROOT / "wolfcrypt/src/random.c").read_text() +START = SOURCE.index("#elif defined(ARDUINO)\n") +END = SOURCE.index("#elif defined(WOLFSSL_ESPIDF)\n", START) +ARDUINO_BRANCH = "#if" + SOURCE[START + len("#elif"):END] + "#endif\n" +SEED_DISPATCH_START = SOURCE.index("#if defined(CUSTOM_RAND_GENERATE_SEED)\n", SOURCE.index("/* Begin wc_GenerateSeed Implementations */")) +SEED_DISPATCH = SOURCE[SEED_DISPATCH_START:END] + "#endif\n" + + +def preprocess(*defines, code=ARDUINO_BRANCH): + return subprocess.run( + ["cc", "-E", "-x", "c", "-"] + ["-D" + name for name in defines], + input=code, + text=True, + capture_output=True, + check=False, + ) + + +class ArduinoEntropyGuard(unittest.TestCase): + def test_generic_arduino_requires_explicit_weak_opt_in(self): + for board in ((), ("ARDUINO_SAMD_NANO_33_IOT",), + ("ARDUINO_ARCH_RP2040",), ("__STM32__",), ("ESP32",)): + with self.subTest(board=board): + result = preprocess("ARDUINO", *board) + self.assertNotEqual(result.returncode, 0) + self.assertIn("WOLFSSL_ACCEPT_WEAK_ENTROPY", result.stderr) + + def test_weak_opt_in_allows_legacy_path(self): + self.assertEqual(preprocess("ARDUINO", "WOLFSSL_ACCEPT_WEAK_ENTROPY").returncode, 0) + + def test_due_trng_does_not_require_weak_opt_in(self): + self.assertEqual(preprocess("ARDUINO", "ARDUINO_SAM_DUE", "__SAM3X8E__").returncode, 0) + + def test_custom_seed_takes_priority_over_arduino_fallback(self): + result = preprocess("ARDUINO", "CUSTOM_RAND_GENERATE_SEED=secure_seed", + code=SEED_DISPATCH) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("return secure_seed(output, sz)", result.stdout) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/copilot_entropy_review.py b/tests/copilot_entropy_review.py new file mode 100644 index 00000000000..586f0ba1d66 --- /dev/null +++ b/tests/copilot_entropy_review.py @@ -0,0 +1,145 @@ +"""Regression checks for PR 12065 entropy configuration review.""" + +import pathlib +import subprocess +import tempfile +import unittest + + +ROOT = pathlib.Path(__file__).resolve().parents[1] + + +def macros(source, *defines): + result = subprocess.run( + ["cc", "-dM", "-E", "-x", "c", "-"] + ["-D" + d for d in defines], + input=source, text=True, capture_output=True, check=False, + ) + return result, {line.split()[1] for line in result.stdout.splitlines() + if line.startswith("#define ")} + + +class EntropyReview(unittest.TestCase): + def test_mdk_rng_does_not_enable_crypto_accelerators(self): + header = (ROOT / "IDE/MDK5-ARM/Conf/user_settings.h").read_text() + result, names = macros(header, "STM32F7xx") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("WOLFSSL_STM32F7", names) + self.assertIn("NO_STM32_CRYPTO", names) + self.assertIn("NO_STM32_HASH", names) + self.assertIn("NO_STM32_HMAC", names) + + def test_c5_v8_software_crypto_keeps_register_rng(self): + source = (ROOT / "IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs").read_text() + start = source.index("#elif defined(STM32C562xx)") + end = source.index("#define WOLFSSL_SMALL_STACK", start) + branch = "#if" + source[start + len("#elif"):end] + branch += "\n#include \n" + # The SDK headers are absent on this host. Empty stand-ins let the + # real settings.h prove which features the generated header selects. + with tempfile.TemporaryDirectory() as directory: + for header in ("stm32c5xx.h", "stm32v8xx.h"): + (pathlib.Path(directory) / header).write_text("") + for family in ("STM32C562xx", "STM32V873xx"): + with self.subTest(family=family): + result = subprocess.run( + ["cc", "-dM", "-E", "-x", "c", "-", "-I", directory, + "-I", str(ROOT), "-D" + family, + "-DWOLF_CONF_HW_CRYPTO=0"], + input=branch, text=True, capture_output=True, + check=False, + ) + self.assertEqual(result.returncode, 0, result.stderr) + names = {line.split()[1] for line in result.stdout.splitlines() + if line.startswith("#define ")} + for name in ("WOLFSSL_STM32_RNG_NOLIB", "STM32_RNG", + "NO_STM32_CRYPTO", "NO_STM32_HASH", + "NO_STM32_HMAC"): + self.assertIn(name, names) + for name in ("WOLFSSL_STM32_CUBEMX", "STM32_CRYPTO", + "STM32_HASH", "STM32_HMAC", "WOLFSSL_STM32_PKA"): + self.assertNotIn(name, names) + register = "AHB2ENR" if family == "STM32C562xx" else "AHB3ENR" + self.assertIn("WC_STM32_RNG_CLK_ENABLE()", result.stdout) + self.assertIn(register, result.stdout) + + def test_rng_disabled_needs_no_seed(self): + for path in ("IDE/STM32Cube/MX2/mx_wolfSSL_conf_template.h.hbs", + "IDE/STM32Cube/default_conf.ftl", + "examples/configs/user_settings_stm32.h"): + with self.subTest(path=path): + source = (ROOT / path).read_text() + start = source.index("#if (!defined(WOLF_CONF_RNG) || WOLF_CONF_RNG != 0) &&") + end = source.index("#endif", start) + len("#endif") + branch = source[start:end] + denied, _ = macros(branch, "NO_STM32_RNG", "WOLF_CONF_RNG=1") + self.assertNotEqual(denied.returncode, 0) + allowed, _ = macros(branch, "NO_STM32_RNG", "WOLF_CONF_RNG=0") + self.assertEqual(allowed.returncode, 0, allowed.stderr) + weak, _ = macros(branch, "NO_STM32_RNG", "WOLF_CONF_RNG=1", + "WOLFSSL_ACCEPT_WEAK_ENTROPY") + self.assertEqual(weak.returncode, 0, weak.stderr) + + def test_netos_seed_uses_pool_bytes_directly(self): + # F-16422: the NET+OS pool is the entropy source; funneling each byte + # through srand()/rand() added nothing and could lose entropy through + # libc low-order bits. The function is a source-level check because it + # needs the NET+OS BSP (tx_api.h, entropy.h) to run. + source = (ROOT / "IDE/NETOS/wolfssl_netos_custom.c").read_text() + start = source.index("int my_rng_generate_seed(") + end = source.index("static void appFipsCb", start) + function = source[start:end] + self.assertNotIn("srand(", function) + self.assertNotIn("rand()", function) + self.assertIn("output[i] = get_byte_from_pool()", function) + + def test_custom_block_precedes_platform_seed_guards(self): + source = (ROOT / "wolfcrypt/src/random.c").read_text() + seed = source[source.index("/* Begin wc_GenerateSeed Implementations */"):] + self.assertLess(seed.index("#elif defined(CUSTOM_RAND_GENERATE_BLOCK)"), + seed.index("#elif defined(CUSTOM_RAND_GENERATE)")) + self.assertLess(seed.index("#elif defined(CUSTOM_RAND_GENERATE_BLOCK)"), + seed.index("#elif defined(HAVE_RTP_SYS)")) + self.assertLess(seed.index("#elif defined(CUSTOM_RAND_GENERATE_BLOCK)"), + seed.index("#elif !defined(WOLFSSL_CAAM)")) + self.assertIn("!defined(CUSTOM_RAND_GENERATE_BLOCK)", + seed[seed.index("#if defined(USE_TEST_GENSEED)"): + seed.index("/* End wc_GenerateSeed */")]) + + result = subprocess.run( + ["cc", "-E", "-I", str(ROOT), "-DWOLFSSL_LEANPSK", + "-DUSE_TEST_GENSEED", "-DCUSTOM_RAND_GENERATE_BLOCK=secure_block", + str(ROOT / "wolfcrypt/src/random.c"), "-o", "/dev/null"], + text=True, capture_output=True, check=False, + ) + self.assertEqual(result.returncode, 0, result.stderr) + + def test_windows_custom_block_skips_crypt_handle_calls(self): + source = (ROOT / "wolfcrypt/src/random.c").read_text() + seed = source[source.index("/* Begin wc_GenerateSeed Implementations */"):] + self.assertLess(seed.index("#elif defined(CUSTOM_RAND_GENERATE_BLOCK)"), + seed.index("#elif defined(USE_WINDOWS_API)")) + port = (ROOT / "wolfcrypt/src/wc_port.c").read_text() + self.assertEqual(port.count("!defined(CUSTOM_RAND_GENERATE_BLOCK)"), 2) + + def test_contiki_custom_block_bypasses_default_word_prng(self): + with tempfile.TemporaryDirectory() as directory: + (pathlib.Path(directory) / "contiki.h").write_text( + "unsigned long clock_seconds(void);\n") + command = ["cc", "-E", "-I", directory, "-I", str(ROOT), + "-DWOLFSSL_CONTIKI", "-DCUSTOM_RAND_GENERATE_BLOCK=secure_block", + str(ROOT / "wolfcrypt/src/random.c"), "-o", "/dev/null"] + result = subprocess.run(command, text=True, capture_output=True, + check=False) + self.assertEqual(result.returncode, 0, result.stderr) + + def test_ci_runs_entropy_regressions(self): + workflow = ROOT / ".github/workflows/entropy.yml" + self.assertTrue(workflow.is_file()) + text = workflow.read_text() + for name in ("weak_entropy_defaults", "arduino_entropy_guard", + "cypress_trng_failure", "copilot_entropy_review"): + self.assertIn(name, text) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/cypress_trng_failure.py b/tests/cypress_trng_failure.py new file mode 100644 index 00000000000..88b45b697de --- /dev/null +++ b/tests/cypress_trng_failure.py @@ -0,0 +1,71 @@ +"""Exercise the Cypress seed implementation with a failing TRNG init.""" + +import pathlib +import subprocess +import tempfile +import unittest + + +ROOT = pathlib.Path(__file__).resolve().parents[1] +SOURCE = (ROOT / "wolfcrypt/src/random.c").read_text() +START = SOURCE.index("#elif defined(CY_USING_HAL) && defined(COMPONENT_WOLFSSL)\n", + SOURCE.index("/* Begin wc_GenerateSeed Implementations */")) +END = SOURCE.index("#elif defined(WOLFSSL_SAFERTOS)", START) +IMPLEMENTATION = SOURCE[START:END].split("\n", 1)[1] + +HARNESS = r""" +#include +#include +typedef uint8_t byte; +typedef uint32_t word32; +typedef uintptr_t wc_ptr_t; +typedef struct { int unused; } OS_Seed; +typedef struct { int unused; } cyhal_trng_t; +typedef int cy_rslt_t; +#define CY_RSLT_SUCCESS 0 +#define RNG_FAILURE_E -199 +static int init_result; +static int free_count; +static cy_rslt_t cyhal_trng_init(cyhal_trng_t* obj) +{ (void)obj; return init_result; } +static uint32_t cyhal_trng_generate(cyhal_trng_t* obj) +{ (void)obj; return 0x12345678U; } +static void cyhal_trng_free(cyhal_trng_t* obj) +{ (void)obj; ++free_count; } +""" + +MAIN = r""" +int main(void) +{ + byte output[4] = {0xa5, 0xa5, 0xa5, 0xa5}; + init_result = 1; + if (wc_GenerateSeed(0, output, sizeof(output)) == 0) return 1; + if (free_count != 0) return 2; + if (output[0] != 0xa5 || output[3] != 0xa5) return 3; + init_result = 0; + if (wc_GenerateSeed(0, output, sizeof(output)) != 0) return 4; + if (free_count != 1) return 5; + if (output[0] == 0xa5 && output[3] == 0xa5) return 6; + return 0; +} +""" + + +class CypressTrngFailure(unittest.TestCase): + def test_failed_init_never_reports_seed_success(self): + with tempfile.TemporaryDirectory() as directory: + source = pathlib.Path(directory) / "trng.c" + binary = pathlib.Path(directory) / "trng" + source.write_text(HARNESS + IMPLEMENTATION + MAIN) + compile_result = subprocess.run( + ["cc", "-std=c99", "-Wall", "-Wextra", "-Werror", str(source), + "-o", str(binary)], capture_output=True, text=True, check=False, + ) + self.assertEqual(compile_result.returncode, 0, compile_result.stderr) + result = subprocess.run([str(binary)], capture_output=True, + text=True, check=False) + self.assertEqual(result.returncode, 0, result.stderr) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/weak_entropy_defaults.py b/tests/weak_entropy_defaults.py new file mode 100644 index 00000000000..00ac89b726a --- /dev/null +++ b/tests/weak_entropy_defaults.py @@ -0,0 +1,133 @@ +"""Shipped integration settings must not select test entropy by default.""" + +import pathlib +import re +import subprocess +import unittest + + +ROOT = pathlib.Path(__file__).resolve().parents[1] +WEAK_DEFINES = re.compile( + r"^[ \t]*#[ \t]*define[ \t]+(?:WOLFSSL_ACCEPT_WEAK_ENTROPY|" + r"WOLFSSL_GENSEED_FORTEST|USE_TEST_GENSEED)\b", re.MULTILINE +) + + +class WeakEntropyDefaults(unittest.TestCase): + def test_integration_settings_do_not_enable_weak_entropy(self): + offenders = [] + for base in (ROOT / "IDE", ROOT / "RTOS", ROOT / "mcapi"): + for path in base.rglob("user_settings.h"): + if path == ROOT / "IDE/MDK5-ARM/Conf/user_settings.h": + # This definition is behind an explicit MDK_CONF_RNDSEED=1. + continue + source = path.read_text(errors="replace") + for match in WEAK_DEFINES.finditer(source): + line = source.count("\n", 0, match.start()) + 1 + offenders.append(f"{path.relative_to(ROOT)}:{line}") + self.assertEqual(offenders, [], "automatic weak seeds: " + ", ".join(offenders)) + + def test_clock_and_prng_seed_branches_require_weak_opt_in(self): + source = (ROOT / "wolfcrypt/src/random.c").read_text() + for name in ("WOLFSSL_PB", "MICRIUM", "__MICROBLAZE__", + "WOLFSSL_NETBURNER"): + with self.subTest(platform=name): + start = source.index("#elif defined(" + name + ")", source.index("/* Begin wc_GenerateSeed Implementations */")) + end = source.index("\n#elif defined(", start + 1) + branch = "#if" + source[start + len("#elif"):end] + "\n#endif\n" + result = subprocess.run( + ["cc", "-E", "-x", "c", "-", "-D" + name], + input=branch, text=True, capture_output=True, check=False, + ) + self.assertNotEqual(result.returncode, 0) + self.assertIn("WOLFSSL_ACCEPT_WEAK_ENTROPY", result.stderr) + if name == "WOLFSSL_NETBURNER": + accepted = subprocess.run( + ["cc", "-E", "-x", "c", "-", "-D" + name, + "-DWOLFSSL_ACCEPT_WEAK_ENTROPY"], + input=branch, text=True, capture_output=True, + check=False, + ) + self.assertEqual(accepted.returncode, 0, accepted.stderr) + + def test_vxworks_simulator_requires_weak_opt_in(self): + source = (ROOT / "wolfcrypt/src/random.c").read_text() + start = source.index("#ifdef VXWORKS_SIM", + source.index("#elif defined(WOLFSSL_VXWORKS)")) + end = source.index("#endif", source.index("randomAddTimeStamp();", start)) \ + + len("#endif") + branch = source[start:end] + "\n" + for extra, expected in (((), False), + (("WOLFSSL_ACCEPT_WEAK_ENTROPY",), True)): + with self.subTest(extra=extra): + result = subprocess.run( + ["cc", "-E", "-x", "c", "-", "-DWOLFSSL_VXWORKS", + "-DVXWORKS_SIM"] + ["-D" + item for item in extra], + input=branch, text=True, capture_output=True, check=False, + ) + self.assertEqual(result.returncode == 0, expected) + + def test_contiki_does_not_choose_framework_prng(self): + source = (ROOT / "wolfcrypt/src/random.c").read_text() + start = source.index("#elif defined(CUSTOM_RAND_GENERATE)\n", source.index("/* Begin wc_GenerateSeed Implementations */")) + end = source.index("\n#elif defined(", start + 1) + branch = "#if" + source[start + len("#elif"):end] + "\n#endif\n" + for extra, expected in (((), False), + (("WOLFSSL_ACCEPT_WEAK_ENTROPY",), True), + (("WOLFSSL_CONTIKI_SECURE_ENTROPY",), True)): + with self.subTest(extra=extra): + result = subprocess.run( + ["cc", "-E", "-x", "c", "-", "-DWOLFSSL_CONTIKI", + "-DCUSTOM_RAND_GENERATE=random_rand"] + + ["-D" + item for item in extra], + input=branch, text=True, capture_output=True, check=False, + ) + self.assertEqual(result.returncode == 0, expected) + + def test_predictable_custom_seed_examples_require_opt_in(self): + paths = ( + "IDE/AURIX/user_settings.h", + "IDE/GCC-ARM/Header/user_settings.h", + "IDE/RISCV/SIFIVE-HIFIVE1/user_settings.h", + "IDE/STARCORE/user_settings.h", + "IDE/IAR-MSP430/user_settings.h", + "IDE/qemu-falcon-neon/user_settings.h", + "IDE/m33mu-falcon-verify/user_settings.h", + ) + for path in paths: + with self.subTest(path=path): + command = ["cc", "-E", "-x", "c", "-", "-include", + str(ROOT / path)] + result = subprocess.run(command, input="", text=True, + capture_output=True, check=False) + self.assertNotEqual(result.returncode, 0) + self.assertIn("WOLFSSL_ACCEPT_WEAK_ENTROPY", result.stderr) + for option in ("WOLFSSL_ACCEPT_WEAK_ENTROPY", + "CUSTOM_RAND_GENERATE_SEED=secure_seed"): + with self.subTest(path=path, option=option): + allowed = subprocess.run( + command + ["-D" + option], input="", text=True, + capture_output=True, check=False, + ) + self.assertEqual(allowed.returncode, 0, allowed.stderr) + + def test_zephyr_missing_chosen_entropy_allows_explicit_test_fallback(self): + source = (ROOT / "wolfcrypt/src/random.c").read_text() + start = source.index( + " #if defined(CONFIG_ENTROPY_HAS_DRIVER) && DT_HAS_CHOSEN(zephyr_entropy)\n" + " const struct device", source.index("#elif defined(WOLFSSL_ZEPHYR)")) + end = source.index("#elif defined(WOLFSSL_TELIT_M2MB)", start) + branch = source[start:end] + base = ["cc", "-E", "-x", "c", "-", "-DCONFIG_ENTROPY_HAS_DRIVER", + "-DDT_HAS_CHOSEN(x)=0"] + denied = subprocess.run(base, input=branch, text=True, + capture_output=True, check=False) + self.assertNotEqual(denied.returncode, 0) + allowed = subprocess.run(base + ["-DWOLFSSL_ACCEPT_WEAK_ENTROPY"], + input=branch, text=True, capture_output=True, + check=False) + self.assertEqual(allowed.returncode, 0, allowed.stderr) + + +if __name__ == "__main__": + unittest.main() diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c index 65bb0a3a277..f3989d9e0f4 100644 --- a/wolfcrypt/src/random.c +++ b/wolfcrypt/src/random.c @@ -9368,8 +9368,17 @@ static int wc_GenerateRand_IntelRD(OS_Seed* os, byte* output, word32 sz) return CUSTOM_RAND_GENERATE_SEED_OS(os, output, sz); } +#elif defined(CUSTOM_RAND_GENERATE_BLOCK) + /* The application supplies complete random blocks. No DRBG seed is used. */ + #elif defined(CUSTOM_RAND_GENERATE) + #if defined(WOLFSSL_CONTIKI) && \ + !defined(WOLFSSL_CONTIKI_SECURE_ENTROPY) && \ + !defined(WOLFSSL_ACCEPT_WEAK_ENTROPY) + #error "Contiki random_rand is a PRNG, not an entropy source: provide a secure custom seed or define WOLFSSL_CONTIKI_SECURE_ENTROPY for a verified CUSTOM_RAND_GENERATE; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif + /* Implement your own random generation function * word32 rand_gen(void); * #define CUSTOM_RAND_GENERATE rand_gen */ @@ -9508,6 +9517,10 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #elif defined(HAVE_RTP_SYS) || defined(EBSNET) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "HAVE_RTP_SYS/EBSNET clock-seeded PRNG is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif + #include "rtprand.h" /* rtp_rand () */ #if (defined(HAVE_RTP_SYS) || (defined(RTPLATFORM) && (RTPLATFORM != 0))) @@ -9585,6 +9598,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) byte* op = output; #if ((__PIC32_FEATURE_SET0 == 'E') && (__PIC32_FEATURE_SET1 == 'C')) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "PIC32MZ EC RNG is core-timer-seeded, not a TRNG: provide a real custom seed source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif RNGNUMGEN1 = _CP0_GET_COUNT(); RNGPOLY1 = _CP0_GET_COUNT(); RNGPOLY2 = _CP0_GET_COUNT(); @@ -9624,6 +9640,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) return 0; } #else /* WOLFSSL_PIC32MZ_RNG */ + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "MICROCHIP_PIC32 non-MZ core-timer seed is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif /* uses the core timer, in nanoseconds to seed srand */ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) { @@ -10145,6 +10164,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #endif /* WOLFSSL_STM32_CUBEMX */ #elif defined(WOLFSSL_TIRTOS) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "WOLFSSL_TIRTOS clock-seeded rand is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #warning "potential for not enough entropy, currently being used for testing" #include #include @@ -10178,6 +10200,10 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #elif defined(WOLFSSL_PB) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "WOLFSSL_PB UTL_Rand is not a verified entropy source: provide CUSTOM_RAND_GENERATE_SEED or CUSTOM_RAND_GENERATE_BLOCK; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif + int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) { word32 i; @@ -10190,6 +10216,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) } #elif defined(WOLFSSL_NUCLEUS) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "WOLFSSL_NUCLEUS clock-seeded rand is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #include "nucleus.h" #include "kernel/plus_common.h" @@ -10209,6 +10238,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) return 0; } #elif defined(WOLFSSL_DEOS) && !defined(CUSTOM_RAND_GENERATE) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "WOLFSSL_DEOS clock-seeded rand_r is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #include "stdlib.h" #warning "potential for not enough entropy, currently being used for testing Deos" @@ -10229,6 +10261,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) return 0; } #elif defined(MICRIUM) && !defined(CUSTOM_RAND_GENERATE_BLOCK) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "MICRIUM Math_Rand is not an entropy source: provide CUSTOM_RAND_GENERATE_SEED or CUSTOM_RAND_GENERATE_BLOCK; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #if !defined(_MSC_VER) && !defined(__TASKING__) #warning "MICRIUM: seeding the DRBG from Math_Rand(), not an entropy source. Define CUSTOM_RAND_GENERATE_SEED to a hardware RNG." #else @@ -10258,6 +10293,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) } #elif defined(WOLFSSL_VXWORKS) #ifdef WOLFSSL_VXWORKS_6_x + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "WOLFSSL_VXWORKS 6.x tick-seeded rand_r is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #include "stdlib.h" #warning "potential for not enough entropy, currently being used for testing" int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) @@ -10286,6 +10324,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) _Vx_ticks_t seed = 0; #ifdef VXWORKS_SIM + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "VXWORKS_SIM timestamp seed is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif /* cannot generate true entropy with VxWorks simulator */ #warning "not enough entropy, simulator for testing only" int i = 0; @@ -10389,6 +10430,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) len = 4; #else /* v5 and older */ + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "INTIME_RTOS v5 and older time-seeded rand is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #define INTIME_RAND_FUNC rand srand(time(0)); len = 2; /* don't use all 31 returned bits */ @@ -10426,6 +10470,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) } #elif defined(WOLFSSL_NETBURNER) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "NetBurner GetRandomByte is a pseudo-random seed: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #warning using NetBurner pseudo random GetRandomByte for seed int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) { @@ -10513,6 +10560,11 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #elif defined(ARDUINO) + #if !defined(ARDUINO_SAM_DUE) && \ + !defined(WOLFSSL_ACCEPT_WEAK_ENTROPY) + #error "Arduino random() is not an entropy source: define CUSTOM_RAND_GENERATE_SEED for a hardware RNG; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif + int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) { int ret = 0; @@ -10563,7 +10615,6 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #endif #endif - srand(analogRead(0)); rand = trng_read_output_data(TRNG); #elif defined(__STM32__) /* TODO: confirm this is proper random number on Arduino STM32 */ @@ -10799,12 +10850,10 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) } return 0; } -#elif defined(CUSTOM_RAND_GENERATE_BLOCK) - /* #define CUSTOM_RAND_GENERATE_BLOCK myRngFunc - * extern int myRngFunc(byte* output, word32 sz); - */ - #elif defined(__MICROBLAZE__) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "MicroBlaze clock-seeded rand is weak: provide CUSTOM_RAND_GENERATE_SEED or CUSTOM_RAND_GENERATE_BLOCK; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #warning weak source of entropy #define LPD_SCNTR_BASE_ADDRESS 0xFF250000 @@ -10879,8 +10928,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) * cryptographic-quality seed material instead of the general-purpose * sys_rand_get(). A dead source returns an error, which makes wc_InitRng() * fail (RNG_FAILURE_E) rather than yield weak output. Boards that set - * CONFIG_ENTROPY_HAS_DRIVER without a chosen entropy node fall back to - * sys_rand_get() rather than failing the build. */ + * CONFIG_ENTROPY_HAS_DRIVER without a chosen entropy node are a + * misconfiguration and fail the build; boards with no entropy driver + * need WOLFSSL_ACCEPT_WEAK_ENTROPY to use the sys_rand_get() fallback. */ #if defined(CONFIG_ENTROPY_HAS_DRIVER) && DT_HAS_CHOSEN(zephyr_entropy) const struct device *dev = DEVICE_DT_GET(DT_CHOSEN(zephyr_entropy)); word32 off = 0; @@ -10903,6 +10953,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) } return 0; #else + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + #error "Zephyr has no chosen entropy device: provide a real seed source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY to permit sys_rand_get()" + #endif (void)os; sys_rand_get(output, sz); return 0; @@ -10911,6 +10964,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #elif defined(WOLFSSL_TELIT_M2MB) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "WOLFSSL_TELIT_M2MB RTC-seeded rand is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #include "stdlib.h" static long get_timestamp(void) { long myTime = 0; @@ -11195,6 +11251,9 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #elif defined(DOLPHIN_EMULATOR) || defined (WOLFSSL_NDS) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "DOLPHIN_EMULATOR/WOLFSSL_NDS time-seeded rand is weak: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) { word32 i; @@ -11249,24 +11308,25 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) (void)os; result = cyhal_trng_init(&obj); - if (result == CY_RSLT_SUCCESS) { - while (i < sz) { - /* If not aligned or there is odd/remainder add single byte */ - if( (i + sizeof(word32)) > sz || - ((wc_ptr_t)&output[i] % sizeof(word32)) != 0 - ) { - val = cyhal_trng_generate(&obj); - output[i++] = (byte)val; - } - else { - /* Use native 32 instruction */ - val = cyhal_trng_generate(&obj); - *((uint32_t*)&output[i]) = val; - i += sizeof(word32); - } + if (result != CY_RSLT_SUCCESS) + return RNG_FAILURE_E; + + while (i < sz) { + /* If not aligned or there is odd/remainder add single byte */ + if( (i + sizeof(word32)) > sz || + ((wc_ptr_t)&output[i] % sizeof(word32)) != 0 + ) { + val = cyhal_trng_generate(&obj); + output[i++] = (byte)val; + } + else { + /* Use native 32 instruction */ + val = cyhal_trng_generate(&obj); + *((uint32_t*)&output[i]) = val; + i += sizeof(word32); } - cyhal_trng_free(&obj); } + cyhal_trng_free(&obj); return 0; } @@ -11575,7 +11635,13 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #endif -#ifdef USE_TEST_GENSEED +#if defined(USE_TEST_GENSEED) && !defined(CUSTOM_RAND_GENERATE_BLOCK) && \ + !defined(CUSTOM_RAND_GENERATE) && \ + !defined(CUSTOM_RAND_GENERATE_SEED) && \ + !defined(CUSTOM_RAND_GENERATE_SEED_OS) + #ifndef WOLFSSL_ACCEPT_WEAK_ENTROPY + # error "USE_TEST_GENSEED is deterministic: provide a real entropy source; test only: define WOLFSSL_ACCEPT_WEAK_ENTROPY" + #endif #if !defined(_MSC_VER) && !defined(__TASKING__) #warning "write a real random seed!!!!, just for testing now" #else diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c index 0e3bf981338..6e0f5ad8c6e 100644 --- a/wolfcrypt/src/wc_port.c +++ b/wolfcrypt/src/wc_port.c @@ -1097,7 +1097,8 @@ int wolfCrypt_Init(void) } #endif - #if defined(USE_WINDOWS_API) && defined(WIN_REUSE_CRYPT_HANDLE) + #if defined(USE_WINDOWS_API) && defined(WIN_REUSE_CRYPT_HANDLE) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) /* A failure here should not happen, but if it does the actual RNG seed * call will fail. This init is for a shared crypt provider handle for * RNG */ @@ -1374,7 +1375,8 @@ int wolfCrypt_Cleanup(void) Entropy_Final(); #endif - #if defined(USE_WINDOWS_API) && defined(WIN_REUSE_CRYPT_HANDLE) + #if defined(USE_WINDOWS_API) && defined(WIN_REUSE_CRYPT_HANDLE) && \ + !defined(CUSTOM_RAND_GENERATE_BLOCK) wc_WinCryptHandleCleanup(); #endif