Skip to content

Commit 783cab4

Browse files
rizlikrizlik
committed
examples: add wolfHSM DTLS client
1 parent 7eaba42 commit 783cab4

8 files changed

Lines changed: 831 additions & 0 deletions

File tree

‎.github/workflows/build-and-test-dtls-client.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
name: Build and Test DTLS Client Example
2+
3+
on:
4+
push:
5+
branches: [ 'master', 'main', 'release/**' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
9+
jobs:
10+
build-and-test-dtls:
11+
runs-on: ubuntu-latest
12+
timeout-minutes: 10
13+
14+
steps:
15+
# Step 1: Checkout repositories
16+
- name: Checkout wolfHSM
17+
uses: actions/checkout@v4
18+
19+
- name: Checkout wolfSSL
20+
uses: actions/checkout@v4
21+
with:
22+
repository: wolfssl/wolfssl
23+
path: wolfssl
24+
25+
# Step 2: Build wolfSSL with DTLS support
26+
- name: Build wolfSSL with DTLS
27+
run: |
28+
cd wolfssl
29+
./autogen.sh
30+
./configure --enable-dtls --enable-dtls13 --enable-ecc
31+
make -j
32+
33+
# Step 3: Convert client key from PEM to DER format
34+
- name: Convert client key to DER format
35+
run: |
36+
openssl ec -in wolfssl/certs/ecc-client-key.pem \
37+
-outform DER -out wolfssl/certs/ecc-client-key.der
38+
39+
# Step 4: Build wolfHSM server
40+
- name: Build wolfHSM POSIX server
41+
run: |
42+
cd examples/posix/wh_posix_server
43+
make clean
44+
make -j WOLFSSL_DIR=../../../wolfssl
45+
46+
# Step 5: Build DTLS client
47+
- name: Build DTLS client
48+
run: |
49+
cd examples/posix/tls/wh_posix_dtls_client
50+
make clean
51+
make
52+
53+
# Step 6: Start wolfHSM server in background
54+
- name: Start wolfHSM server
55+
run: |
56+
cd examples/posix/wh_posix_server
57+
./Build/wh_posix_server.elf --type tcp \
58+
--key ../../../wolfssl/certs/ecc-client-key.der \
59+
--id 1 \
60+
--client 12 &
61+
SERVER_PID=$!
62+
echo "WOLFHSM_SERVER_PID=$SERVER_PID" >> $GITHUB_ENV
63+
echo "Started wolfHSM server with PID $SERVER_PID"
64+
sleep 2
65+
66+
# Step 7: Start wolfSSL DTLS server in background
67+
- name: Start wolfSSL DTLS server
68+
run: |
69+
cd wolfssl
70+
./examples/server/server -u -v 3 \
71+
-c ./certs/server-ecc.pem \
72+
-k ./certs/ecc-key.pem \
73+
-A ./certs/client-ecc-cert.pem \
74+
-p 11111 \
75+
-i &
76+
DTLS_SERVER_PID=$!
77+
echo "DTLS_SERVER_PID=$DTLS_SERVER_PID" >> $GITHUB_ENV
78+
echo "Started DTLS server with PID $DTLS_SERVER_PID"
79+
sleep 2
80+
81+
# Step 8: Run DTLS client test
82+
- name: Run DTLS client test
83+
run: |
84+
cd examples/posix/tls/wh_posix_dtls_client
85+
86+
# Send test message with 5 second timeout
87+
echo "Hello from CI test" | timeout 5 ./Build/wh_posix_dtls_client.elf 127.0.0.1 > client_output.txt 2>&1 || CLIENT_EXIT=$?
88+
89+
# Display output for debugging
90+
cat client_output.txt
91+
92+
# Check for successful handshake (exit code 0 = clean exit, 124 = timeout)
93+
if grep -q "DTLS handshake successful!" client_output.txt; then
94+
echo "✓ DTLS client test completed successfully"
95+
exit 0
96+
else
97+
echo "✗ DTLS handshake did not complete"
98+
exit 1
99+
fi
100+
101+
# Step 9: Cleanup servers (always run)
102+
- name: Cleanup servers
103+
if: always()
104+
run: |
105+
echo "Cleaning up server processes..."
106+
kill ${{ env.WOLFHSM_SERVER_PID }} 2>/dev/null || true
107+
kill ${{ env.DTLS_SERVER_PID }} 2>/dev/null || true
108+
sleep 1
109+
kill -9 ${{ env.WOLFHSM_SERVER_PID }} 2>/dev/null || true
110+
kill -9 ${{ env.DTLS_SERVER_PID }} 2>/dev/null || true
111+
echo "Cleanup complete"

‎examples/posix/tls/wh_posix_dtls_client/.cache/clangd/index/user_settings.h.70BDD9097831BA2D.idx‎

690 Bytes
Binary file not shown.

‎examples/posix/tls/wh_posix_dtls_client/.cache/clangd/index/wh_posix_dtls_client.c.E5862DCB5B11F175.idx‎

5.31 KB
Binary file not shown.

‎examples/posix/tls/wh_posix_dtls_client/.cache/clangd/index/wolfhsm_cfg.h.BE11D43E6AF362BB.idx‎

300 Bytes
Binary file not shown.

‎examples/posix/tls/wh_posix_dtls_client/Makefile‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
## Makefile for wolfHSM DTLS Client example using POSIX port
2+
3+
## Project name
4+
# Sets output filenames
5+
BIN = wh_posix_dtls_client
6+
7+
## Important directories
8+
# Base directory for additional project files
9+
PROJECT_DIR ?= .
10+
CONFIG_DIR ?= $(PROJECT_DIR)
11+
SHARED_CONFIG_DIR ?= $(PROJECT_DIR)/../../
12+
# wolfSSL and wolfHSM directories
13+
WOLFSSL_DIR ?= ../../../../wolfssl
14+
WOLFHSM_DIR ?= ../../../../
15+
WOLFHSM_PORT_DIR ?= $(WOLFHSM_DIR)/port/posix
16+
17+
# Output directory for build files
18+
BUILD_DIR ?= $(PROJECT_DIR)/Build
19+
20+
# Includes
21+
INC = -I$(PROJECT_DIR) \
22+
-I$(CONFIG_DIR) \
23+
-I$(SHARED_CONFIG_DIR) \
24+
-I$(WOLFSSL_DIR) \
25+
-I$(WOLFHSM_DIR) \
26+
-I$(WOLFHSM_PORT_DIR)
27+
28+
# POSIX requires C source be defined before any header
29+
DEF += -D_POSIX_C_SOURCE=200809L
30+
31+
# Library configuration defines for user-supplied settings
32+
DEF += -DWOLFSSL_USER_SETTINGS -DWOLFHSM_CFG
33+
34+
# Architecture flags for assembler, C compiler and linker
35+
ARCHFLAGS ?=
36+
37+
# Enable extra C compiler warnings
38+
CFLAGS_EXTRA = -Werror -Wall -Wextra
39+
# Place functions / data into separate sections to allow unused code removal
40+
CFLAGS_EXTRA += -ffunction-sections -fdata-sections
41+
42+
# C standard to use
43+
CSTD ?= -std=c99
44+
45+
ASFLAGS ?= $(ARCHFLAGS)
46+
CFLAGS ?= $(ARCHFLAGS) $(CSTD) $(CFLAGS_EXTRA)
47+
LDFLAGS ?= $(ARCHFLAGS)
48+
49+
# Enable garbage collection. Inexact handling of dead_strip
50+
OS_NAME := $(shell uname -s | tr A-Z a-z)
51+
ifeq ($(OS_NAME),darwin)
52+
LDFLAGS += -Wl,-dead_strip
53+
else
54+
LDFLAGS += -Wl,--gc-sections
55+
endif
56+
57+
# Libc for printf, libm for math (used with DH)
58+
LIBS = -lc -lm
59+
60+
## Makefile options
61+
62+
# Set to @ if you want to suppress command echo
63+
CMD_ECHO ?=
64+
65+
# Check if DEBUG is set to 1 and append debug flags
66+
ifeq ($(DEBUG),1)
67+
DBGFLAGS = -ggdb -g3
68+
CFLAGS += $(DBGFLAGS)
69+
LDFLAGS += $(DBGFLAGS)
70+
DEF += -DWOLFHSM_CFG_DEBUG
71+
endif
72+
73+
# Check if DEBUG_VERBOSE is set to 1 and enable verbose WOLFHSM debug output
74+
# Note: DEBUG_VERBOSE implies DEBUG
75+
ifeq ($(DEBUG_VERBOSE),1)
76+
DBGFLAGS = -ggdb -g3
77+
CFLAGS += $(DBGFLAGS)
78+
LDFLAGS += $(DBGFLAGS)
79+
DEF += -DWOLFHSM_CFG_DEBUG -DWOLFHSM_CFG_DEBUG_VERBOSE
80+
endif
81+
82+
# Add address sanitizer option
83+
ifeq ($(ASAN),1)
84+
CFLAGS += -fsanitize=address
85+
LDFLAGS += -fsanitize=address
86+
endif
87+
88+
## Source files
89+
# Assembly source files
90+
SRC_ASM +=
91+
92+
# wolfCrypt source files
93+
WOLFCRYPT_SRC := $(wildcard $(WOLFSSL_DIR)/wolfcrypt/src/*.c)
94+
SRC_C += $(filter-out %/evp.c %/misc.c,$(WOLFCRYPT_SRC))
95+
96+
# wolfSSL source files (needed for DTLS)
97+
WOLFSSL_SRC := $(wildcard $(WOLFSSL_DIR)/src/*.c)
98+
SRC_C += $(filter-out %/bio.c %/conf.c %/pk.c %/ssl_asn1.c %/ssl_bn.c %/ssl_certman.c %/ssl_crypto.c %/ssl_load.c %/ssl_misc.c %/ssl_p7p12.c %/ssl_sess.c %/ssl_sk.c %/x509.c %/x509_str.c,$(WOLFSSL_SRC))
99+
100+
# wolfHSM source files
101+
SRC_C += $(wildcard $(WOLFHSM_DIR)/src/*.c)
102+
103+
# wolfHSM port/HAL code
104+
SRC_C += $(wildcard $(WOLFHSM_PORT_DIR)/*.c)
105+
106+
# Project source files
107+
SRC_C += $(wildcard $(PROJECT_DIR)/*.c)
108+
109+
# Set the default device ID for wolfCrypt operations
110+
DEF += -DWC_USE_DEVID=0x5748534D
111+
112+
ifeq ($(SCAN),1)
113+
SCAN_LOG = scan_posix_dtls_client.log
114+
# Default target
115+
.DEFAULT_GOAL := scan
116+
endif
117+
118+
## Automated processing below
119+
120+
FILENAMES_C = $(notdir $(SRC_C))
121+
OBJS_C = $(addprefix $(BUILD_DIR)/, $(FILENAMES_C:.c=.o))
122+
vpath %.c $(dir $(SRC_C))
123+
124+
OBJS_ASM = $(addprefix $(BUILD_DIR)/, $(notdir $(SRC_ASM:.s=.o)))
125+
vpath %.s $(dir $(SRC_ASM))
126+
127+
128+
## Makefile Targets
129+
130+
.PHONY: build_app build_hex build_static clean run
131+
132+
build_app: $(BUILD_DIR) $(BUILD_DIR)/$(BIN).elf
133+
@echo Build complete.
134+
135+
build_hex: $(BUILD_DIR) $(BUILD_DIR)/$(BIN).hex
136+
@echo ""
137+
$(CMD_ECHO) $(SIZE) $(BUILD_DIR)/$(BIN).elf
138+
139+
build_static: $(BUILD_DIR) $(BUILD_DIR)/$(BIN).a
140+
@echo ""
141+
$(CMD_ECHO) $(SIZE) $(BUILD_DIR)/$(BIN).a
142+
143+
$(BUILD_DIR):
144+
$(CMD_ECHO) mkdir -p $(BUILD_DIR)
145+
146+
$(BUILD_DIR)/$(BIN).hex: $(BUILD_DIR)/$(BIN).elf
147+
@echo "Generating HEX binary: $(notdir $@)"
148+
$(CMD_ECHO) $(OBJCOPY) -O ihex $< $@
149+
150+
$(BUILD_DIR)/%.o: %.s
151+
@echo "Compiling ASM file: $(notdir $<)"
152+
$(CMD_ECHO) $(AS) $(ASFLAGS) $(DEF) $(INC) -c -o $@ $<
153+
154+
$(BUILD_DIR)/%.o: %.c
155+
@echo "Compiling C file: $(notdir $<)"
156+
$(CMD_ECHO) $(CC) $(CFLAGS) $(DEF) $(INC) -c -o $@ $<
157+
158+
$(BUILD_DIR)/$(BIN).elf: $(OBJS_ASM) $(OBJS_C)
159+
@echo "Linking ELF binary: $(notdir $@)"
160+
$(CMD_ECHO) $(CC) $(LDFLAGS) $(SRC_LD) -o $@ $^ $(LIBS)
161+
162+
$(BUILD_DIR)/$(BIN).a: $(OBJS_ASM) $(OBJS_C)
163+
@echo "Building static library: $(notdir $@)"
164+
$(CMD_ECHO) $(AR) -r $@ $^
165+
166+
analyze: $(OBJS_ASM) $(OBJS_C)
167+
168+
scan:$(BUILD_DIR)
169+
@echo "Running scan-build static analysis"
170+
@mkdir -p $(WOLFHSM_DIR)/scan_out/
171+
@scan-build --exclude $(WOLFSSL_DIR)/wolfcrypt \
172+
--exclude $(WOLFSSL_DIR)/src \
173+
--status-bugs $(MAKE) analyze 2> $(WOLFHSM_DIR)/scan_out/$(SCAN_LOG)
174+
175+
clean:
176+
@echo "Cleaning build files"
177+
@rm -f \
178+
$(BUILD_DIR)/*.elf \
179+
$(BUILD_DIR)/*.hex \
180+
$(BUILD_DIR)/*.map \
181+
$(BUILD_DIR)/*.o \
182+
$(BUILD_DIR)/*.a \
183+
$(BUILD_DIR)/*.sym \
184+
$(BUILD_DIR)/*.disasm

‎examples/posix/tls/wh_posix_dtls_client/user_settings.h‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#ifndef USER_SETTINGS_H_
2+
#define USER_SETTINGS_H_
3+
4+
/** wolfHSM Client required settings */
5+
6+
/* POSIX system headers */
7+
#define HAVE_SYS_TIME_H
8+
9+
/* CryptoCB support - required for offloading crypto to HSM */
10+
#define WOLF_CRYPTO_CB
11+
#define HAVE_ANONYMOUS_INLINE_AGGREGATES 1
12+
13+
/* PK callbacks - required for TLS-level HSM key operations */
14+
#define HAVE_PK_CALLBACKS
15+
16+
/* Enable DTLS support */
17+
#define WOLFSSL_DTLS
18+
#define WOLFSSL_DTLS13
19+
#define WOLFSSL_TLS13
20+
#define HAVE_TLS_EXTENSIONS
21+
#define WOLFSSL_SEND_HRR_COOKIE
22+
23+
/* Remove old TLS versions */
24+
#define NO_OLD_TLS
25+
26+
/** Crypto Algorithm Options */
27+
28+
/* ECC for ECDHE key exchange and ECDSA authentication */
29+
#define HAVE_ECC
30+
#define HAVE_SUPPORTED_CURVES
31+
32+
/* AES-GCM for symmetric encryption */
33+
#define HAVE_AESGCM
34+
35+
/* HKDF for key derivation */
36+
#define HAVE_HKDF
37+
38+
/* Timing resistance / side-channel attack protection */
39+
#define TFM_TIMING_RESISTANT
40+
#define ECC_TIMING_RESISTANT
41+
#define WC_RSA_BLINDING
42+
43+
/* Use wolfSSL's internal string comparison instead of system strcasecmp */
44+
#define USE_WOLF_STRCASECMP
45+
46+
/* Remove unneeded features */
47+
#define NO_MAIN_DRIVER
48+
#define NO_DO178
49+
#define NO_RSA
50+
#define NO_DH
51+
52+
#endif /* USER_SETTINGS_H_ */

0 commit comments

Comments
 (0)