Skip to content

Commit 8bce9f0

Browse files
aidangarskeaidangarske
committed
Add --enable-tinytls13 TLS 1.3-only footprint profile (PSK+ECDHE floor + minimal X.509)
1 parent dd6da70 commit 8bce9f0

10 files changed

Lines changed: 556 additions & 12 deletions

File tree

‎.github/workflows/tinytls13.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Tiny TLS 1.3 Tests
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ 'release/**' ]
7+
pull_request:
8+
types: [opened, synchronize, reopened, ready_for_review]
9+
branches: [ '*' ]
10+
schedule:
11+
- cron: '42 10 * * 1-5'
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
# END OF COMMON SECTION
17+
18+
jobs:
19+
# Build + make check every --enable-tinytls13 spelling on one runner via
20+
# .github/scripts/parallel-make-check.py (see psk.yml for the pattern).
21+
make_check:
22+
name: make check
23+
if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
24+
runs-on: ubuntu-24.04
25+
timeout-minutes: 10
26+
steps:
27+
- uses: actions/checkout@v5
28+
name: Checkout wolfSSL
29+
30+
- name: Install dependencies
31+
uses: ./.github/actions/install-apt-deps
32+
with:
33+
packages: autoconf automake libtool build-essential bubblewrap
34+
ghcr-debs-tag: ubuntu-24.04-minimal
35+
36+
- name: Set up ccache
37+
uses: ./.github/actions/ccache-setup
38+
with:
39+
workflow-id: tinytls13
40+
read-only: ${{ github.event_name == 'pull_request' }}
41+
max-size: 100M
42+
43+
- name: Allow unprivileged user namespaces (for bwrap)
44+
run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
45+
46+
# Every tiny TLS 1.3 profile/adder spelling, so each is proven to build
47+
# and pass make check (which runs the TLS handshake test suite) out of
48+
# the box. Server is enabled where a config needs the server-side tests.
49+
- name: Build and make check all tinytls13 configs
50+
run: |
51+
cat > "$RUNNER_TEMP/tinytls13-configs.json" <<'EOF'
52+
[
53+
{"name": "tinytls13-psk-x25519", "minutes": 1,
54+
"configure": ["--enable-tinytls13=psk,server", "--disable-mlkem"]},
55+
{"name": "tinytls13-psk-p256", "minutes": 1,
56+
"configure": ["--enable-tinytls13=psk,p256,server", "--disable-mlkem"]},
57+
{"name": "tinytls13-psk-staticmem", "minutes": 1,
58+
"configure": ["--enable-tinytls13=psk,server,staticmem", "--disable-mlkem"]},
59+
{"name": "tinytls13-psk-mldsa", "minutes": 1,
60+
"configure": ["--enable-tinytls13=psk,server,mldsa", "--disable-mlkem"]},
61+
{"name": "tinytls13-psk-sha384", "minutes": 1,
62+
"configure": ["--enable-tinytls13=psk,server,sha384", "--disable-mlkem"]},
63+
{"name": "tinytls13-cert", "minutes": 1,
64+
"configure": ["--enable-tinytls13=cert,server", "--disable-mlkem"]},
65+
{"name": "tinytls13-cert-sha384", "minutes": 1,
66+
"configure": ["--enable-tinytls13=cert,server,sha384", "--disable-mlkem"]},
67+
{"name": "tinytls13-cert-mutualauth", "minutes": 1,
68+
"configure": ["--enable-tinytls13=cert,mutualauth,server", "--disable-mlkem"]},
69+
{"name": "tinytls13-cert-rsaverify", "minutes": 1,
70+
"configure": ["--enable-tinytls13=cert,server,rsaverify", "--disable-mlkem"]},
71+
{"name": "tinytls13-cert-mldsa", "minutes": 1,
72+
"configure": ["--enable-tinytls13=cert,server,mldsa", "--disable-mlkem"]}
73+
]
74+
EOF
75+
.github/scripts/parallel-make-check.py \
76+
${{ github.event_name == 'schedule' && '--build-only' || '' }} \
77+
--private-dir=certs \
78+
"$RUNNER_TEMP/tinytls13-configs.json"
79+
80+
- name: ccache stats
81+
if: always()
82+
run: ccache -s || true
83+
84+
- name: Upload logs on failure
85+
if: failure()
86+
uses: actions/upload-artifact@v6
87+
with:
88+
retention-days: 7
89+
name: tinytls13-logs
90+
path: |
91+
build-*/make-check.log
92+
build-*/test-suite.log
93+
build-*/config.log
94+
if-no-files-found: ignore

‎configure.ac‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -932,6 +932,61 @@ fi
932932

933933
# MATH LIBRARY SELECTION
934934

935+
# tiny TLS 1.3: align all feature switches with the WOLFSSL_TINY_TLS13 umbrella
936+
# here, EARLY, before they are consumed (math, ASN, TLS version, renegotiation,
937+
# etc. are decided at scattered points further down). The -D macros are emitted
938+
# later where the AC_ARG_ENABLE help/validation lives.
939+
if test "x$enable_tinytls13" != "x" && test "x$enable_tinytls13" != "xno"
940+
then
941+
tinytls13_cert=no
942+
tinytls13_p256=no
943+
for v in `echo $enable_tinytls13 | tr ',' ' '`
944+
do
945+
case $v in
946+
cert|mutualauth) tinytls13_cert=yes ;;
947+
p256) tinytls13_p256=yes ;;
948+
rsaverify) enable_rsa=yes ;;
949+
asm) enable_asm=yes ;;
950+
mldsa) enable_mldsa=yes ;;
951+
sha384) enable_sha384=yes; enable_sha512=yes ;;
952+
esac
953+
done
954+
955+
# Floor is SHA-256 only. SHA-384/512 share the (large) SHA-512 core and are
956+
# otherwise pulled in by default, so keep them out unless asked (sha384).
957+
test "x$enable_sha384" = "x" && enable_sha384=no
958+
test "x$enable_sha512" = "x" && enable_sha512=no
959+
960+
# TLS 1.3 only, no legacy TLS / renegotiation / extras.
961+
enable_tls13=yes
962+
enable_oldtls=no
963+
enable_tlsv10=no
964+
test "x$enable_tlsv12" = "x" && enable_tlsv12=no
965+
enable_dsa=no
966+
enable_dh=no
967+
enable_psk=yes
968+
enable_lowresource=yes
969+
970+
if test "$tinytls13_cert" = "yes"
971+
then
972+
enable_ecc=yes
973+
enable_sp=yes
974+
test "x$enable_asn" = "x" && enable_asn=template
975+
test "x$enable_rsa" = "x" && enable_rsa=no
976+
else
977+
test "x$enable_asn" = "x" && enable_asn=no
978+
test "x$enable_rsa" = "x" && enable_rsa=no
979+
if test "$tinytls13_p256" = "yes"
980+
then
981+
enable_ecc=yes
982+
enable_sp=yes
983+
else
984+
test "x$enable_ecc" = "x" && enable_ecc=no
985+
enable_curve25519=yes
986+
fi
987+
fi
988+
fi
989+
935990
# Assure consistency of defaults
936991
if test "$DEF_FAST_MATH" = "yes" && ( (test "$enable_sp_math" != "no" && test "$enable_sp_math" != "") || test "$enable_heapmath" = "yes")
937992
then
@@ -2841,6 +2896,55 @@ then
28412896
enable_lowresource=yes
28422897
fi
28432898

2899+
# tiny TLS 1.3 footprint profile (TLS1.3-only; expansion lives in the
2900+
# WOLFSSL_TINY_TLS13 umbrella in settings.h. See
2901+
# examples/configs/user_settings_tinytls13.h.)
2902+
AC_ARG_ENABLE([tinytls13],
2903+
[AS_HELP_STRING([--enable-tinytls13@<:@=LIST@:>@],
2904+
[Enable tiny TLS 1.3 footprint build. LIST is comma-separated from:
2905+
psk cert server mutualauth staticmem asm p256 sha384 mldsa rsaverify
2906+
(default: disabled; bare flag = psk)])],
2907+
[ ENABLED_TINYTLS13=$enableval ],
2908+
[ ENABLED_TINYTLS13=no ]
2909+
)
2910+
2911+
if test "$ENABLED_TINYTLS13" != "no"
2912+
then
2913+
if test "$FIPS_VERSION" != "none"
2914+
then
2915+
AC_MSG_ERROR([--enable-tinytls13 is a non-FIPS footprint profile and cannot be combined with FIPS.])
2916+
fi
2917+
2918+
# Feature switches were aligned early (MATH LIBRARY SELECTION section);
2919+
# here we only emit the umbrella + adder macros (settings.h does the rest).
2920+
tinytls13_base=psk
2921+
for v in `echo $ENABLED_TINYTLS13 | tr ',' ' '`
2922+
do
2923+
case $v in
2924+
yes|psk) ;;
2925+
cert) tinytls13_base=cert ;;
2926+
mutualauth) tinytls13_base=cert
2927+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_MUTUAL_AUTH" ;;
2928+
server) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_SERVER" ;;
2929+
staticmem) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_STATIC_MEM" ;;
2930+
asm) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_ASM" ;;
2931+
p256) AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DECC_USER_CURVES" ;;
2932+
rsaverify) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_RSA_VERIFY" ;;
2933+
sha384) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA384" ;;
2934+
mldsa) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_MLDSA -DWOLFSSL_DILITHIUM_VERIFY_ONLY -DWOLFSSL_DILITHIUM_VERIFY_SMALL_MEM -DWOLFSSL_DILITHIUM_NO_ASN1 -DWOLFSSL_NO_ML_DSA_44 -DWOLFSSL_NO_ML_DSA_87" ;;
2935+
no) ;;
2936+
*) AC_MSG_ERROR([Invalid --enable-tinytls13 value: $v. Valid: psk cert server mutualauth staticmem asm p256 sha384 mldsa rsaverify.]) ;;
2937+
esac
2938+
done
2939+
2940+
if test "$tinytls13_base" = "cert"
2941+
then
2942+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13_CERT"
2943+
else
2944+
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_TINY_TLS13"
2945+
fi
2946+
fi
2947+
28442948

28452949
# low resource options to reduce flash and memory use
28462950
AC_ARG_ENABLE([lowresource],
@@ -12908,6 +13012,7 @@ echo " * TLS v1.0 (Old): $ENABLED_TLSV10"
1290813012
echo " * TLS v1.1 (Old): $ENABLED_OLD_TLS"
1290913013
echo " * TLS v1.2: $ENABLED_TLSV12"
1291013014
echo " * TLS v1.3: $ENABLED_TLS13"
13015+
echo " * Tiny TLS 1.3: $ENABLED_TINYTLS13"
1291113016
echo " * RPK: $ENABLED_RPK"
1291213017
echo " * Post-handshake Auth: $ENABLED_TLS13_POST_AUTH"
1291313018
echo " * Early Data: $ENABLED_TLS13_EARLY_DATA"

‎examples/configs/include.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ EXTRA_DIST += examples/configs/user_settings_stm32.h
2323
EXTRA_DIST += examples/configs/user_settings_template.h
2424
EXTRA_DIST += examples/configs/user_settings_tls12.h
2525
EXTRA_DIST += examples/configs/user_settings_tls13.h
26+
EXTRA_DIST += examples/configs/user_settings_tinytls13.h
2627
EXTRA_DIST += examples/configs/user_settings_wolfboot_keytools.h
2728
EXTRA_DIST += examples/configs/user_settings_wolfssh.h
2829
EXTRA_DIST += examples/configs/user_settings_wolftpm.h

‎examples/configs/user_settings_tinytls13.h‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
/* user_settings_tinytls13.h
2+
*
3+
* Copyright (C) 2006-2026 wolfSSL Inc.
4+
*
5+
* This file is part of wolfSSL.
6+
*
7+
* wolfSSL is free software; you can redistribute it and/or modify
8+
* it under the terms of the GNU General Public License as published by
9+
* the Free Software Foundation; either version 3 of the License, or
10+
* (at your option) any later version.
11+
*
12+
* wolfSSL is distributed in the hope that it will be useful,
13+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
* GNU General Public License for more details.
16+
*
17+
* You should have received a copy of the GNU General Public License
18+
* along with this program; if not, write to the Free Software
19+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
20+
*/
21+
22+
/* Tiny TLS 1.3 footprint profile.
23+
*
24+
* A TLS 1.3-only build that strips to a PSK + ECDHE floor (no X.509), with
25+
* X.509 cert verify, mTLS, server role, zero-heap, and PQC as opt-in adders.
26+
* The WOLFSSL_TINY_TLS13 umbrella in settings.h expands these into the
27+
* underlying wolfSSL macros; this file just selects the profile and options.
28+
*
29+
* Smallest footprint comes from a dead-code-eliminated, LTO link of a single
30+
* client/server:
31+
* cp ./examples/configs/user_settings_tinytls13.h user_settings.h
32+
* ./configure --enable-usersettings --enable-static --disable-shared \
33+
* --disable-examples --disable-crypttests
34+
* make
35+
* # link your app: -Os -flto -ffunction-sections -fdata-sections \
36+
* # -Wl,--gc-sections (use gcc-ar/gcc-ranlib for LTO archives)
37+
*/
38+
39+
#ifndef WOLFSSL_USER_SETTINGS_H
40+
#define WOLFSSL_USER_SETTINGS_H
41+
42+
#ifdef __cplusplus
43+
extern "C" {
44+
#endif
45+
46+
/* ===== PROFILE ========================================================== */
47+
#if 1 /* Profile A: PSK + ECDHE floor, no X.509 (smallest) */
48+
#define WOLFSSL_TINY_TLS13
49+
#endif
50+
#if 0 /* Profile B: + minimal X.509 cert verify (ECDSA P-256). Implies core. */
51+
#define WOLFSSL_TINY_TLS13_CERT
52+
#endif
53+
54+
/* ===== ROLE / AUTH ADDERS =============================================== */
55+
#if 0 /* add TLS 1.3 server role (default is client only) */
56+
#define WOLFSSL_TINY_TLS13_SERVER
57+
#endif
58+
#if 0 /* mutual TLS (X.509 client auth, adds ECDSA sign). Implies cert. */
59+
#define WOLFSSL_TINY_TLS13_MUTUAL_AUTH
60+
#endif
61+
#if 0 /* add RSA-PSS cert verify (cert profile is ECDSA-only by default) */
62+
#define WOLFSSL_TINY_TLS13_RSA_VERIFY
63+
#endif
64+
65+
/* ===== MEMORY MODEL ===================================================== */
66+
#if 0 /* zero-heap: static memory pool, no system malloc (deterministic RAM).
67+
* App provides the pool via wolfSSL_CTX_load_static_memory(). */
68+
#define WOLFSSL_TINY_TLS13_STATIC_MEM
69+
#endif
70+
71+
/* ===== SPEED ============================================================ */
72+
#if 0 /* tiny+fast: assembly crypto instead of small-C (size up, speed up) */
73+
#define WOLFSSL_TINY_TLS13_ASM
74+
#endif
75+
76+
/* ===== CURVE (Profile A) =============================================== */
77+
/* Default curve is X25519. For P-256 ECDHE instead, enable the next block.
78+
* (Profile B uses P-256 automatically for both ECDHE and ECDSA verify.) */
79+
#if 0
80+
#define HAVE_ECC
81+
#define ECC_USER_CURVES
82+
#endif
83+
84+
/* ===== AEAD / HASH ADDERS (floor is AES-128-GCM + SHA-256) ============= */
85+
#if 0 /* ChaCha20-Poly1305 */
86+
#define HAVE_CHACHA
87+
#define HAVE_POLY1305
88+
#endif
89+
#if 0 /* AES-256-GCM (floor is AES-128 only) */
90+
#undef NO_AES_256
91+
#define WOLFSSL_AES_256
92+
#endif
93+
#if 0 /* SHA-384 (for AES-256-GCM-SHA384 etc.) */
94+
#define WOLFSSL_SHA384
95+
#endif
96+
97+
/* ===== PQC ADDERS (valid on either profile; SHA-3/SHAKE pulled in auto) = */
98+
#if 0 /* ML-DSA-65 verify-only */
99+
#define WOLFSSL_HAVE_MLDSA
100+
#define WOLFSSL_DILITHIUM_VERIFY_ONLY
101+
#define WOLFSSL_DILITHIUM_VERIFY_SMALL_MEM
102+
#define WOLFSSL_DILITHIUM_NO_ASN1
103+
#define WOLFSSL_NO_ML_DSA_44
104+
#define WOLFSSL_NO_ML_DSA_87
105+
#endif
106+
#if 0 /* ML-KEM-768 + X25519MLKEM768 hybrid */
107+
#define WOLFSSL_HAVE_MLKEM
108+
#define WOLFSSL_WC_MLKEM
109+
#endif
110+
111+
/* ===== PLATFORM (bare-metal defaults; adjust for your target) ========== */
112+
#if 1
113+
#define WOLFSSL_USER_IO /* provide your own send/recv callbacks */
114+
#define NO_FILESYSTEM
115+
#define WOLFSSL_NO_SOCK
116+
#define NO_WRITEV
117+
#define WOLFSSL_NO_GETPID
118+
#endif
119+
/* Provide a hardware RNG seed for bare metal:
120+
* #define CUSTOM_RAND_GENERATE_SEED my_hw_seed (int f(byte*, word32)) */
121+
122+
#ifdef __cplusplus
123+
}
124+
#endif
125+
126+
#endif /* WOLFSSL_USER_SETTINGS_H */

‎examples/server/server.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3110,7 +3110,7 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
31103110
#endif
31113111

31123112

3113-
#ifdef HAVE_ECC
3113+
#if defined(HAVE_ECC) && !defined(NO_CERTS)
31143114
/* Use ECDHE key size that matches long term key.
31153115
* Zero means use ctx->privateKeySz.
31163116
* Default ECDHE_SIZE is 32 bytes

0 commit comments

Comments
 (0)