wolfSSL

https://www.wolfssl.com/docs/
Admin
wolfSSL provides embedded SSL/TLS libraries, along with other security products like wolfSSH,...
Tokens:83,785
Snippets:1,103
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Building and Installing

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Standard commands to compile and install the library after successful configuration.

```bash
make
sudo make install
```

--------------------------------

### Compile and install NXP HSM

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Build and install the NXP HSM library.

```bash
make
make install
```

--------------------------------

### Clone and Build wolfSSL Examples

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Retrieves the wolfSSL examples repository and builds the CAAM/SECO specific samples.

```bash
git clone https://github.com/wolfssl/wolfssl-examples
cd wolfssl-examples/caam/seco
make
```

--------------------------------

### Display Server Help

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Displays the help menu for the wolfSSL server example.

```bash
./examples/server/server --help
```

--------------------------------

### Compile and Run wolfSSL Example Client

Source: https://www.wolfssl.com/docs/utasker

Commands to build the wolfSSL library and execute the example client against a specific host and port.

```bash
$ cd wolfssl-3.9.0-commercial
$ ./configure
$ make
$ ./examples/client/client -h 192.168.1.144 -p 443
```

--------------------------------

### Cross-Compilation Configuration Examples

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

A collection of specific configure command examples for various target architectures and toolchains.

```bash
./configure --host=armeb-linux \
        CC=armeb-linux-gcc LD=armeb-linux-ld \
        AR=armeb-linux-ar \
        RANLIB=armeb-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --host=arm-linux \
        CC=arm-linux-gcc LD=arm-linux-ld \
        AR=arm-linux-ar \
        RANLIB=arm-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --host=arm-linux \
        CC=arm-linux-gcc LD=arm-linux-ld \
        AR=arm-linux-ar \
        RANLIB=arm-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --host=arm-linux \
        CC=arm-linux-gcc LD=arm-linux-ld \
        AR=arm-linux-ar \
        RANLIB=arm-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --enable-static --disable-shared \--host=arm-linux CC=arm-linux-gcc \
        LD=arm-linux-ld AR=arm-linux-ar \
        RANLIB=arm-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --host=arm-none-eabi \
        CC=arm-none-eabi-gcc LD=arm-none-eabi-ld \
        AR=arm-none-eabi-ar RANLIB=arm-none-eabi-ranlib \
        CFLAGS="-DNO_WOLFSSL_DIR \
        -DWOLFSSL_USER_IO -DNO_WRITEV \
        -mcpu=cortex-m4 -mthumb -Os \
        -specs=rdimon.specs" CPPFLAGS="-I./"
```

```bash
./configure --host=mips-linux \
        CC=mips-linux-gcc LD=mips-linux-ld \
        AR=mips-linux-ar \
        RANLIB=mips-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --host=powerpc64le-buildroot-linux-gnu \
        CC=powerpc64le-buildroot-linux-gnu-gcc \
        LD=powerpc64le-buildroot-linux-gnu-ld \
        AR=powerpc64le-buildroot-linux-gnu-ar \
        RANLIB=powerpc64le-buildroot-linux-gnu-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --host=x86_64-linux \
        CC=x86_64-linux-gcc LD=x86_64-linux-ld \
        AR=x86_64-linux-ar \
        RANLIB=x86_64-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

```bash
./configure --host=x86_64-linux \
        CC=x86_64-linux-gcc LD=x86_64-linux-ld \
        AR=x86_64-linux-ar \
        RANLIB=x86_64-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \CPPFLAGS="-I./"
```

```bash
./configure --host=x86_64-linux \
        CC=x86_64-linux-gcc LD=x86_64-linux-ld \
        AR=x86_64-linux-ar \
        RANLIB=x86_64-linux-ranlib \
        CFLAGS="-DWOLFSSL_USER_IO -Os" \
        CPPFLAGS="-I./"
```

--------------------------------

### Expected Verification Output

Source: https://www.wolfssl.com/docs/installing-a-jsse-provider-in-android-osp

Example output showing the list of installed providers and the active TLS provider.

```text
All Installed Java Providers:
wolfJSSE
AndroidKeyStoreBCWorkaround
AndroidOpenSSL
BC
Crypto
HarmonyJSSE
AndroidKeyStore

Info about wolfSSL Provider:
wolfJSSE version 1.0
wolfSSL JSSE Provider
1.0

What provider is providing TLS?
TLS Provider = wolfJSSE version 1.0
```

--------------------------------

### Desktop TLS Server Example

Source: https://www.wolfssl.com/docs/renesas

Example command and output for running a wolfSSL server on a desktop machine to test against the embedded client.

```bash
$ ./examples/server/server -b -d
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256R1
Client message: Hello Server
```

--------------------------------

### Compile with Makefile

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Use the provided Makefile to build the example application within its directory.

```bash
make

```

--------------------------------

### Install and Compile wolfSSL

Source: https://www.wolfssl.com/docs/quickstart

Standard commands to configure, build, and install the wolfSSL library from the source directory.

```bash
./configure  
make  
sudo make install
```

--------------------------------

### Compile Example Applications with BitBake

Source: https://www.wolfssl.com/docs/getting-started-yocto-openembedded

Commands to build the wolfCrypt test and benchmark applications individually.

```bash
$ bitbake wolfcrypttest
$ bitbake wolfcryptbenchmark
```

--------------------------------

### Install wolfSSL

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Command to install the compiled wolfSSL headers and libraries to the system.

```bash
sudo make install
```

--------------------------------

### Run ECC-Enabled wolfSSL Server

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch4

Example command to start the wolfSSL server using a specific ECC cipher suite and certificate files.

```bash
./examples/server/server -d -l ECDHE-ECDSA-AES256-SHA -c ./certs/server-ecc.pem -k ./certs/ecc-key.pem
```

--------------------------------

### Install Cross-Compilation Toolchain

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Build and install the Yocto SDK for cross-compilation.

```bash
bitbake meta-toolchain
sudo ./tmp/deploy/sdk/<version>.sh
```

--------------------------------

### Initializing Static Buffers

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch4

Example of calling wolfSSL_CTX_load_static_memory twice to configure general-purpose and I/O buffers.

```c
WOLFSSL_CTX* ctx = NULL; /* pass NULL to generate WOLFSSL_CTX */
int ret;

#define MAX_CONCURRENT_TLS  0
#define MAX_CONCURRENT_IO   0

unsigned char GEN_MEM[GEN_MEM_SIZE];
unsigned char IO_MEM[IO_MEM_SIZE];

  /* set up a general-purpose buffer and generate WOLFSSL_CTX from it on the first call. */
   ret = wolfSSL_CTX_load_static_memory(
           &ctx,                               /* set NULL to ctx */
           wolfSSLv23_client_method_ex(),  /* use function with "_ex" */
           GEN_MEM, GEN_MEM_SIZE,            /* buffer and its size */
           WOLFMEM_GENERAL,                  /* general purpose */
           MAX_CONCURRENT_TLS);              /* max concurrent objects */

   /* set up a I/O-purpose buffer on the second call. */
   ret = wolfSSL_CTX_load_static_memory(
           &ctx,                /* make sure ctx is holding the object */
           NULL,                           /* pass it to NULL this time */
           IO_MEM, IO_MEM_SIZE,                /* buffer and its size */
           WOLFMEM_IO_FIXED,                             /* I/O purpose */
           MAX_CONCURRENT_IO);               /* max concurrent objects */
```

--------------------------------

### Install the Android package

Source: https://www.wolfssl.com/docs/kerberos-android-ndk

Command to install the built APK onto an Android emulator.

```bash
ant <debug> install
```

--------------------------------

### Run echoserver

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Start the echoserver application from its directory.

```bash
./echoserver

```

--------------------------------

### Implement a basic wolfSSL server

Source: https://www.wolfssl.com/docs/quickstart

This example demonstrates the lifecycle of a wolfSSL server, including initialization, context creation, certificate loading, and handling a single incoming connection.

```c
#include <wolfssl/options.h>
#include <wolfssl/ssl.h>
#include <wolfssl/test.h>
#include <errno.h>
#define SERV_PORT 11111
#define MAX_LINE 4096

static void conn_accept(SOCKET_T* sockfd, SOCKET_T* clientfd,
                              func_args* args, word16 port, int useAnyAddr,
                              int udp, int sctp, int ready_file, int do_listen,
                              SOCKADDR_IN_T *client_addr, socklen_t *client_len)
{
    tcp_ready* ready = NULL;

    (void) ready; /* Account for case when "ready" is not used */

    if (udp) {
        udp_accept(sockfd, clientfd, useAnyAddr, port, args);
        return;
    }

    if(do_listen) {
        tcp_listen(sockfd, &port, useAnyAddr, udp, sctp);

#ifndef SINGLE_THREADED
        /* signal ready to tcp_accept */
        if (args)
            ready = args->signal;
        if (ready) {
        #ifdef WOLFSSL_COND
            THREAD_CHECK_RET(wolfSSL_CondStart(&ready->cond));
        #endif
            ready->ready = 1;
            ready->port = port;
        #ifdef WOLFSSL_COND
            THREAD_CHECK_RET(wolfSSL_CondSignal(&ready->cond));
            THREAD_CHECK_RET(wolfSSL_CondEnd(&ready->cond));
        #endif
        }
#endif /* !SINGLE_THREADED */

        if (ready_file) {
        #if !defined(NO_FILESYSTEM) || defined(FORCE_BUFFER_TEST) && \
            !defined(NETOS)
            XFILE srf = (XFILE)NULL;
            if (args)
                ready = args->signal;

            if (ready) {
                srf = XFOPEN(ready->srfName, "w");

                if (srf) {
                    /* let's write port sever is listening on to ready file
                       external monitor can then do ephemeral ports by passing
                       -p 0 to server on supported platforms with -R ready_file
                       client can then wait for existence of ready_file and see
                       which port the server is listening on. */
                    LIBCALL_CHECK_RET(fprintf(srf, "%d\n", (int)port));
                    fclose(srf);
                }
            }
        #endif
        }
    }

    *clientfd = accept(*sockfd, (struct sockaddr*)client_addr,
                      (ACCEPT_THIRD_T)client_len);
    if(WOLFSSL_SOCKET_IS_INVALID(*clientfd)) {
        err_sys_with_errno("tcp accept failed");
    }
}

int main(int argc, char** argv)
{
    int listenfd, connfd;
    WOLFSSL_CTX* ctx;
    WOLFSSL* ssl;
    int n;
    char buf[MAX_LINE];
    WOLFSSL_METHOD* method;
    SOCKADDR_IN_T client_addr;
    socklen_t client_len;

    /* Initialize wolfSSL library */
    wolfSSL_Init();

    /* Get encryption method */
    method = wolfTLSv1_2_server_method();

    /* Create wolfSSL_CTX */
    if ((ctx = wolfSSL_CTX_new(method)) == NULL) {
        printf("Failed to wolfSSL_CTX_new\n");
        goto cleanup;
    }

    /* Load server certs into ctx */
    if (wolfSSL_CTX_use_certificate_file(ctx, "./server-cert.pem", SSL_FILETYPE_PEM) != SSL_SUCCESS) {
        printf("Failed to wolfSSL_CTX_use_certificate_file\n");
        goto free_ctx;
    }

    /* Load server key into ctx */
    if (wolfSSL_CTX_use_PrivateKey_file(ctx, "./server-key.pem", SSL_FILETYPE_PEM) != SSL_SUCCESS) {
        printf("Failed to wolfSSL_CTX_use_certificate_file\n");
        goto free_ctx;
    }

    conn_accept(&listenfd, &connfd, NULL, SERV_PORT, 1, 0, 0, 0, 1, &client_addr, &client_len);

    /* Create wolfSSL object */
    if ((ssl = wolfSSL_new(ctx)) == NULL) {
        printf("Failed to wolfSSL_new\n");
        goto close;
    }

    wolfSSL_set_fd(ssl, connfd);

    if ( (n = wolfSSL_read(ssl, buf, (sizeof(buf) -1))) > 0) {
        printf("%s\n", buf);
        if (wolfSSL_write(ssl, buf, n) != n)
            printf("Failed to wolfSSL_write\n");
    }
    if (n <0)
        printf("wolfSSL_read error = %d\n", wolfSSL_get_error(ssl, n));
    else if (n == 0)
        printf("Connection close by peer\n");

exit:
    wolfSSL_free(ssl);
close:
    close(connfd);
free_ctx:
    wolfSSL_CTX_free(ctx);
cleanup:
    wolfSSL_Cleanup();
    return 0;
}
```

--------------------------------

### Locate wolfCrypt Example Recipes

Source: https://www.wolfssl.com/docs/getting-started-yocto-openembedded

Paths to the recipe files for wolfCrypt test and benchmark applications.

```text
meta-wolfssl/recipes-examples/wolfcrypt/wolfcrypttest/wolfcrypttest.bb
meta-wolfssl/recipes-examples/wolfcrypt/wolfcryptbenchmark/wolfcryptbenchmark.bb
```

--------------------------------

### Initializing wolfSSL Client Context

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Example of initializing the wolfSSL library, creating a context with TLS 1.2, and loading CA certificates.

```c
    WOLFSSL_CTX* ctx;

    wolfSSL_Init();/* Initialize wolfSSL */

    /* Create the WOLFSSL_CTX */
    if ( (ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method())) == NULL) {
        fprintf(stderr, "wolfSSL_CTX_new error.\n");
        exit(EXIT_FAILURE);
    }

    /* Load CA certificates into WOLFSSL_CTX */
    if (wolfSSL_CTX_load_verify_locations(ctx, "../certs/ca-cert.pem", NULL) !=
        SSL_SUCCESS) {
        fprintf(stderr, "Error loading ../certs/ca-cert.pem, "
            "please check the file.\n");
        exit(EXIT_FAILURE);
    }

```

--------------------------------

### Add Applications to Image Installation

Source: https://www.wolfssl.com/docs/getting-started-yocto-openembedded

Configuration to include wolfSSL applications in the build by modifying local.conf.

```text
IMAGE_INSTALL_append = “wolfssl wolfcrypttest wolfcryptbenchmark”
```

--------------------------------

### Connect to example.com via HTTPS

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Connects to example.com on port 443, sends a GET request, and disables peer verification.

```bash
./examples/client/client -h example.com -p 443 -d -g
```

--------------------------------

### Install wolfSSL Recipes in Yocto

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Append the desired wolfSSL recipes to the IMAGE_INSTALL variable in local.conf.

```text
    IMAGE_INSTALL_append = "wolfssl wolfssh wolfmqtt"
```

--------------------------------

### Example testsuite output

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Sample output indicating a successful testsuite run.

```text
------------------------------------------------------------------------------
 wolfSSL version 4.8.1
------------------------------------------------------------------------------
error    test passed!
MEMORY   test passed!
base64   test passed!
base16   test passed!
asn      test passed!
RANDOM   test passed!
MD5      test passed!
SHA      test passed!
SHA-224  test passed!
SHA-256  test passed!
SHA-384  test passed!
SHA-512  test passed!
SHA-3    test passed!
Hash     test passed!
HMAC-MD5 test passed!
HMAC-SHA test passed!
HMAC-SHA224 test passed!
HMAC-SHA256 test passed!
HMAC-SHA384 test passed!
HMAC-SHA512 test passed!
HMAC-SHA3   test passed!
HMAC-KDF    test passed!
GMAC     test passed!
Chacha   test passed!
POLY1305 test passed!
ChaCha20-Poly1305 AEAD test passed!
AES      test passed!
AES192   test passed!
AES256   test passed!
AES-GCM  test passed!
RSA      test passed!
DH       test passed!
PWDBASED test passed!
OPENSSL  test passed!
OPENSSL (EVP MD) passed!
OPENSSL (PKEY0) passed!
OPENSSL (PKEY1) passed!
OPENSSL (EVP Sign/Verify) passed!
ECC      test passed!
logging  test passed!
mutex    test passed!
memcb    test passed!
Test complete
Alternate cert chain used
 issuer : /C=US/ST=Montana/L=Bozeman/O=Sawtooth/OU=Consulting/CN=www.wolfssl.com/emailAddress=facts@wolfssl.com
 subject: /C=US/ST=Montana/L=Bozeman/O=wolfSSL/OU=Support/CN=www.wolfssl.com/emailAddress=facts@wolfssl.com
 altname = example.com
Alternate cert chain used
 issuer : /C=US/ST=Montana/L=Bozeman/O=wolfSSL_2048/OU=Programming-2048/CN=www.wolfssl.com/emailAddress=facts@wolfssl.com
 subject: /C=US/ST=Montana/L=Bozeman/O=wolfSSL_2048/OU=Programming-2048/CN=www.wolfssl.com/emailAddress=facts@wolfssl.com
 altname = example.com
 serial number:01
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL signature algorithm is RSA-SHA256
SSL curve name is SECP256R1
Session timeout set to 500 seconds
Client Random :  serial number:f1:5c:99:43:66:3d:96:04
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL signature algorithm is RSA-SHA256
SSL curve name is SECP256R1
1DC16A2C0D3AC49FC221DD5B8346B7B38CB9899B7A402341482183Server Random : 1679E50DBBBB3DB88C90F600C4C578F4F5D3CEAEC9B16BCCA215C276B448
765A1385611D6A
Client message: hello wolfssl!
I hear you fa shizzle!
sending server shutdown command: quit!
client sent quit command: shutting down!
ciphers = TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305-OLD:ECDHE-ECDSA-CHACHA20-POLY1305-OLD:DHE-RSA-CHACHA20-POLY1305-OLD
33bc1a4570f4f1abccd5c48aace529b01a42ab51293954a297796e90d20970f0  input
33bc1a4570f4f1abccd5c48aace529b01a42ab51293954a297796e90d20970f0  /tmp/output-gNQWZL

All tests passed!
```

--------------------------------

### Example Client Output with Static Memory Debugging

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch4

Sample output showing memory allocation and deallocation events when using the static memory debug configuration.

```text
./examples/client/client
...
...
...
Free'ing : 16128
OUT BUFFER: Alloc'd 6 bytes using bucket size 16992
Alloc'd 848 bytes using bucket size 1024
OUT BUFFER: Alloc'd 150 bytes using bucket size 16992
Alloc'd 13 bytes using bucket size 64
Alloc'd 12 bytes using bucket size 64
Alloc'd 848 bytes using bucket size 1024
IN BUFFER: Alloc'd 40 bytes using bucket size 16992
Alloc'd 13 bytes using bucket size 64
Alloc'd 12 bytes using bucket size 64
Free'ing : 1024
Free'ing : 512

...
...
...
```

--------------------------------

### Connect to External Server with TLS 1.3

Source: https://www.wolfssl.com/docs/tls13

Connect the example client to an external host using TLS 1.3.

```bash
$ ./examples/client/client -v 4 -h www.cloudflare.com -p 443 -d
```

--------------------------------

### Run wolfSSL Client on Desktop Machine

Source: https://www.wolfssl.com/docs/renesas

Executes the wolfSSL client example on a desktop machine to connect to a Renesas board server.

```shell
$ ./examples/client/client -h 192.168.1.200 -p 50000
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256R1
hello wolfssl!
```

--------------------------------

### Static Buffer Setup Function Signature

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch4

The function signature for initializing static memory in a WOLFSSL_CTX.

```c
int wolfSSL_CTX_load_static_memory(
      WOLFSSL_CTX** ctx, /* address of the variable to hold WOLFSSL_CTX */
      wolfSSL_method_func method,/* method pointer */
      unsigned char* buf,   /* pointer to the buffer to use as heap */
      unsigned int sz,      /* buffer size */
      int flag,              /* heap usage */
      int max);              /* maximum number of objects allowed */
```

--------------------------------

### Usage of wolfSSL_get_sigalg_info

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch17

Example demonstrating how to call the function and check the returned signature algorithm type.

```c
enum wc_HashType hashAlgo;
enum Key_Sum sigAlgo;

wolfSSL_get_sigalg_info(hashSigAlgo[idx+0], hashSigAlgo[idx+1],
        &hashAlgo, &sigAlgo);

if (sigAlgo == RSAk || sigAlgo == RSAPSSk)
    haveRSA = 1;
else if (sigAlgo == ECDSAk)
    haveECC = 1;
```

--------------------------------

### wolfCrypt Benchmark Output

Source: https://www.wolfssl.com/docs/renesas

Example output from the wolfCrypt benchmark test running on a Renesas MPU.

```text
t: test, b: benchmark, s: server, or c  : client
$ b
Start wolfCrypt Benchmark
------------------------------------------------------------------------------
 wolfSSL version 4.0.0
------------------------------------------------------------------------------
wolfCrypt Benchmark (block bytes 1024, min 1.0 sec each)
RNG                775 KB took 1.031 seconds,  751.916 KB/s
AES-128-CBC-enc      2 MB took 1.006 seconds,    1.505 MB/s
AES-128-CBC-dec      1 MB took 1.010 seconds,    1.450 MB/s
AES-192-CBC-enc      1 MB took 1.010 seconds,    1.378 MB/s
AES-192-CBC-dec      1 MB took 1.011 seconds,    1.328 MB/s
AES-256-CBC-enc      1 MB took 1.019 seconds,    1.270 MB/s
AES-256-CBC-dec      1 MB took 1.014 seconds,    1.227 MB/s
AES-128-GCM-enc    675 KB took 1.025 seconds,  658.858 KB/s
AES-128-GCM-dec    675 KB took 1.026 seconds,  658.087 KB/s
AES-192-GCM-enc    650 KB took 1.027 seconds,  633.220 KB/s
AES-192-GCM-dec    650 KB took 1.028 seconds,  632.603 KB/s
AES-256-GCM-enc    625 KB took 1.025 seconds,  609.697 KB/s
AES-256-GCM-dec    625 KB took 1.026 seconds,  609.102 KB/s
RABBIT               9 MB took 1.001 seconds,    8.534 MB/s
3DES               475 KB took 1.035 seconds,  458.893 KB/s
MD5                 13 MB took 1.001 seconds,   13.275 MB/s
SHA                  5 MB took 1.002 seconds,    4.778 MB/s
SHA-256              2 MB took 1.006 seconds,    1.650 MB/s
SHA-384            675 KB took 1.034 seconds,  653.057 KB/s
SHA-512            675 KB took 1.034 seconds,  652.994 KB/s
HMAC-MD5            13 MB took 1.001 seconds,   13.142 MB/s
HMAC-SHA             5 MB took 1.004 seconds,    4.768 MB/s
HMAC-SHA256          2 MB took 1.014 seconds,    1.638 MB/s
HMAC-SHA384        650 KB took 1.010 seconds,  643.437 KB/s
HMAC-SHA512        650 KB took 1.011 seconds,  643.182 KB/s
RSA     2048 public         26 ops took 1.067 sec, avg 41.038 ms, 24.367 ops/sec
RSA     2048 private         2 ops took 1.157 sec, avg 578.500 ms, 1.729 ops/sec
DH      2048 key gen         6 ops took 1.049 sec, avg 174.883 ms, 5.718 ops/sec
DH      2048 agree           6 ops took 1.191 sec, avg 198.433 ms, 5.039 ops/sec
ECC      256 key gen         7 ops took 1.162 sec, avg 165.943 ms, 6.026 ops/sec
ECDHE    256 agree           8 ops took 1.323 sec, avg 165.325 ms, 6.049 ops/sec
ECDSA    256 sign            6 ops took 1.044 sec, avg 174.017 ms, 5.747 ops/sec
ECDSA    256 verify          4 ops took 1.281 sec, avg 320.300 ms, 3.122 ops/sec
CURVE  25519 key gen         5 ops took 1.137 sec, avg 227.300 ms, 4.399 ops/sec
CURVE  25519 agree           6 ops took 1.366 sec, avg 227.583 ms, 4.394 ops/sec
ED     25519 key gen       198 ops took 1.003 sec, avg 5.064 ms, 197.467 ops/sec
ED     25519 sign          146 ops took 1.005 sec, avg 6.885 ms, 145.245 ops/sec
ED     25519 verify         62 ops took 1.001 sec, avg 16.147 ms, 61.932 ops/sec
Benchmark complete
End wolfCrypt Benchmark
```

--------------------------------

### Test Suite Output Example

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Sample output indicating a successful run of the wolfSSL test suite.

```text
------------------------------------------------------------------------------
 wolfSSL version 5.7.0
------------------------------------------------------------------------------
error    test passed!
MEMORY   test passed!
base64   test passed!
asn      test passed!
RANDOM   test passed!
MD5      test passed!
SHA      test passed!
SHA-224  test passed!
SHA-256  test passed!
SHA-384  test passed!
SHA-512  test passed!
SHA-512/224  test passed!
SHA-512/256  test passed!
SHA-3    test passed!
Hash     test passed!
HMAC-MD5 test passed!
HMAC-SHA test passed!
HMAC-SHA224 test passed!
HMAC-SHA256 test passed!
HMAC-SHA384 test passed!
HMAC-SHA512 test passed!
HMAC-SHA3   test passed!
HMAC-KDF    test passed!
PRF         test passed!
TLSv1.3 KDF test passed!
GMAC     test passed!
Chacha   test passed!
POLY1305 test passed!
ChaCha20-Poly1305 AEAD test passed!
AES      test passed!
AES192   test passed!
AES256   test passed!
AES-GCM  test passed!
RSA      test passed!
DH       test passed!
PWDBASED test passed!
ECC      test passed!
logging  test passed!
time     test passed!
mutex    test passed!
memcb    test passed!
Test complete

Running simple test
SSL version is TLSv1.2
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256R1
SSL cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSL curve name is SECP256R1
Client message: hello wolfssl!
I hear you fa shizzle!

Running TLS test
sending server shutdown command: quit!
client sent quit command: shutting down!
ciphers = TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305-OLD:ECDHE-ECDSA-CHACHA20-POLY1305-OLD:DHE-RSA-CHACHA20-POLY1305-OLD
33bc1a4570f4f1abccd5c48aace529b01a42ab51293954a297796e90d20970f0  input
33bc1a4570f4f1abccd5c48aace529b01a42ab51293954a297796e90d20970f0  /var/folders/dy/888x7r7d6dgcqw4840l32tpw0000gp/T//testsuite-output-9Ymbuv

All tests passed!
```

--------------------------------

### Configure TinyTLS 1.3 with specific features

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Example command to configure a TLS 1.3 server that supports ECDSA certificate verification and SHA-384.

```bash
./configure --enable-tinytls13=cert,server,sha384
```

--------------------------------

### Run ECC-Enabled wolfSSL Client

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch4

Example command to connect a wolfSSL client to a server using a CA certificate for verification.

```bash
./examples/client/client -A ./certs/server-ecc.pem
```

--------------------------------

### Test TLS 1.3 Client and Server

Source: https://www.wolfssl.com/docs/tls13

Run the wolfSSL example client and server with TLS 1.3 and a specific cipher suite.

```bash
$ ./examples/server/server -v 4 -l TLS13-AES128-GCM-SHA256
```

```bash
$ ./examples/client/client -v 4 -l TLS13-AES128-GCM-SHA256
```

--------------------------------

### Run wolfSSL Server Demo on Renesas Board

Source: https://www.wolfssl.com/docs/renesas

Starts the wolfSSL server mode on the Renesas board to listen for incoming TLS connections.

```shell
wolfSSL Demo
t: test, b: benchmark, s: server, or c <IP addr> <Port>: client
$ s
Start TLS Server
Received: hello wolfssl!
End TLS Server
```

--------------------------------

### Default Library Installation Path

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

The default directory where the wolfSSL shared library is installed.

```text
/usr/local/lib

```

--------------------------------

### View configuration options

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Displays all available build options for the configure script.

```bash
./configure --help
```

--------------------------------

### Configure PRODUCT_BOOT_JARS

Source: https://www.wolfssl.com/docs/installing-a-jsse-provider-in-android-osp

Include wolfssljni in the PRODUCT_BOOT_JARS list, ensuring correct ordering.

```makefile
# The order of PRODUCT_BOOT_JARS matters.                                       
PRODUCT_BOOT_JARS := \                                                          
    core-libart \                                                               
    conscrypt \                                                                 
    okhttp \                                                                    
    core-junit \                                                                
    bouncycastle \                                                              
    wolfssljni \                                                                
    ext \                                                                       
    framework \                                                                 
    telephony-common \                                                          
    voip-common \                                                               
    ims-common \                                                                
    apache-xml \                                                                
    org.apache.http.legacy.boot
```

--------------------------------

### Install Build Dependencies

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Install necessary packages on Ubuntu 18.04 LTS to support the Yocto build environment.

```bash
sudo apt-get install gawk wget git-core diffstat unzip texinfo gcc-multilib
sudo apt-get install build-essential chrpath socat cpio python python3 python3-pip
sudo apt-get install python3-pexpect xz-utils debianutils iputils-ping python3-git
sudo apt-get install python3-jinja2 libegl1-mesa libsdl1.2-dev pylint3 xterm curl
sudo apt-get install ca-certificates
```

--------------------------------

### Directory Structure of Tutorial Source

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

The layout of the downloaded ZIP file containing original and completed source code.

```text
/finished_src
    /certs  (Certificate files)
    /echoclient (Completed echoclient code)
    /echoserver (Completed echoserver code)
    /include    (Modified unp.h)
    /lib    (Library functions)
/original_src
    /echoclient (Starting echoclient code)
    /echoserver (Starting echoserver code)
    /include    (Modified unp.h)
    /lib    (Library functions)
README
```

--------------------------------

### Benchmark SSL Connections

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Benchmarks 100 SSL connections to example.com on port 443.

```bash
./examples/client/client -b 100 -h example.com -p 443 -d
```

--------------------------------

### Export HSM_DIR

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Set the HSM_DIR environment variable to the installation directory.

```bash
export HSM_DIR=`pwd`/export/usr/
```

--------------------------------

### Initialize WOLFSSL_CTX for Server

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Initializes the wolfSSL library and configures the WOLFSSL_CTX with CA and server certificates and private keys.

```c
WOLFSSL_CTX* ctx;

wolfSSL_Init();  /* Initialize wolfSSL */

/* Create the WOLFSSL_CTX */
if ( (ctx = wolfSSL_CTX_new(wolfTLSv1_2_server_method())) == NULL) {
    fprintf(stderr, "wolfSSL_CTX_new error.\n");
    exit(EXIT_FAILURE);
}

/* Load CA certificates into WOLFSSL_CTX */
if (wolfSSL_CTX_load_verify_locations(ctx, "../certs/ca-cert.pem", NULL) !=
         SSL_SUCCESS) {
    fprintf(stderr, "Error loading ../certs/ca-cert.pem, "
        "please check the file.\n");
    exit(EXIT_FAILURE);
}

/* Load server certificates into WOLFSSL_CTX */
if (wolfSSL_CTX_use_certificate_file(ctx, "../certs/server-cert.pem",
        SSL_FILETYPE_PEM) != SSL_SUCCESS) {
    fprintf(stderr, "Error loading ../certs/server-cert.pem, please"
        "check the file.\n");
    exit(EXIT_FAILURE);
}

/* Load keys */
if (wolfSSL_CTX_use_PrivateKey_file(ctx, "../certs/server-key.pem",
        SSL_FILETYPE_PEM) != SSL_SUCCESS) {
    fprintf(stderr, "Error loading ../certs/server-key.pem, please check"
        "the file.\n");
    exit(EXIT_FAILURE);
}
```

--------------------------------

### Build and Flash Image

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Compile the image and flash it to an SD card.

```bash
bitbake core-image-base

cd tmp/deploy/images/imx8qxpc0mek/
bzcat core-image-base-imx8qxpc0mek.sdcard.bz2 | sudo dd of=/dev/diskX bs=5m
```

--------------------------------

### Get Ciphersuite Information

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch17

Extracts authentication information from raw ciphersuite bytes.

```c
WOLFSSL_CIPHERSUITE_INFO wolfSSL_get_ciphersuite_info(
    byte first,
    byte second
)
```

```c
WOLFSSL_CIPHERSUITE_INFO info =
        wolfSSL_get_ciphersuite_info(suites[0], suites[1]);
if (info.rsaAuth)
    haveRSA = 1;
else if (info.eccAuth)
    haveECC = 1;
```

--------------------------------

### Build library only

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Compiles only the wolfSSL library without building examples or test applications.

```bash
make src/libwolfssl.la
```

--------------------------------

### Linking wolfSSL with GCC

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Example command to link the wolfSSL library to an application during compilation.

```bash
gcc -o echoserver ../lib/*.c tcpserv04.c -I ../include -lm -lwolfssl

```

--------------------------------

### Basic Cross-Compilation Configuration

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Use the --host flag to specify the target platform for the configure script.

```bash
./configure --host=arm-linux
```

--------------------------------

### Verify wolfSSL Directory Structure

Source: https://www.wolfssl.com/docs/installing-a-jsse-provider-in-android-osp

Expected directory listings for wolfSSL and wolfSSL JNI after installation.

```text
/external/wolfssl
        Android.mk
        certs/
        CleanSpec.mk
        COPYING
        README
        src/
        wolfcrypt/
        wolfssl/
```

```text
/external/wolfssljni
        Android.mk
        build.xml
        COPYING
        examples/
        IDE/
        java.sh
        LICENSING
        native/
        README
        src/
```

--------------------------------

### Initialize wolfSSL Context

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Initialize the library and create a WOLFSSL_CTX object, loading necessary CA certificates for server verification.

```c
    wolfSSL_Init();
    WOLFSSL_CTX* ctx;
    if ((ctx = wolfSSL_CTX_new(wolfTLSv1_client_method())) == NULL)
    {
        fprintf(stderr, "wolfSSL_CTX_new error.\n");
        exit(EXIT_FAILURE);
    }
    if (wolfSSL_CTX_load_verify_locations(ctx,"./ca-cert.pem",0) != SSL_SUCCESS) {
        fprintf(stderr, "Error loading ./ca-cert.pem,"
                        " please check the file.\n");
        exit(EXIT_FAILURE);
    }
```

--------------------------------

### Initialize and Sync Yocto

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Initialize the repo and sync the source code for the specified Linux version.

```bash
repo init -u https://source.codeaurora.org/external/imx/imx-manifest -b imx-linux-zeus -m imx-5.4.24-2.1.0.xml
repo sync

DISTRO=fsl-imx-wayland MACHINE=imx8qxpc0mek source imx-setup-release.sh -b build-xwayland
```

--------------------------------

### Example Client Error Output

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Output displayed when the client fails to verify the server certificate.

```text
wolfSSL_connect error -188, ASN no signer error to confirm failure
wolfSSL error: wolfSSL_connect failed
```

--------------------------------

### Load Server Certificate and Private Key

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Load the server's certificate and private key files from the filesystem into the context.

```c
    if (wolfSSL_CTX_use_certificate_file(ctx,"./server-cert.pem", SSL_FILETYPE_PEM) != SSL_SUCCESS) {
        fprintf(stderr, "Error loading ./server-cert.pem,"
                        " please check the file.\n");
        exit(EXIT_FAILURE);
    }
    if (wolfSSL_CTX_use_PrivateKey_file(ctx,"./server-key.pem", SSL_FILETYPE_PEM) != SSL_SUCCESS) {
        fprintf(stderr, "Error loading ./server-key.pem,"
                        " please check the file.\n");
        exit(EXIT_FAILURE);
    }
```

--------------------------------

### Exclude Recipes from Build

Source: https://www.wolfssl.com/docs/getting-started-yocto-openembedded

Commands to remove specific recipes or example directories from the meta-wolfssl layer.

```bash
$ rm meta-wolfssl/recipes-wolfssl/wolftpm
```

```bash
$ rm meta-wolfssl/recipes-examples
```

--------------------------------

### Display wolfSSL Client Help

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch3

Displays the available command-line options for the wolfSSL client.

```bash
./examples/client/client --help
```

--------------------------------

### Run echoclient

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Start the echoclient application, providing the server's IP address as an argument.

```bash
./echoclient 127.0.0.1

```

--------------------------------

### Initialize Method with Static Memory

Source: https://www.wolfssl.com/docs/static-buffer-allocation

Use _ex method functions to create WOLFSSL_METHOD structures without dynamic memory allocation.

```c
WOLFSSL_CTX* ctx;  
int ret;
...
ctx = NULL:
ret = wolfSSL_CTX_load_static_memory(&ctx, wolfSSLv23_server_method_ex, memory, memorySz, 0, MAX_CONCURRENT_HANDSHAKES);
if (ret != SSL_SUCCESS) {
// handle error case
}
...
```

--------------------------------

### Initiate SSL Handshake

Source: https://www.wolfssl.com/docs/quickstart

Called on the client side to start the handshake after the communication channel is established.

```c
int wolfSSL_connect(WOLFSSL* ssl)
```

--------------------------------

### Run wolfSSL Test Suite

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch11

Execute the test suite application to verify the installation and library integrity.

```bash
./testsuite/testsuite.test
```

--------------------------------

### Create Build Directory

Source: https://www.wolfssl.com/docs/wolfssl-manual/ch2

Create and enter the directory for the Yocto BSP build.

```bash
mkdir imx-yocto-bsp
cd imx-yocto-bsp/
```

--------------------------------

### Configure uTasker Tasks

Source: https://www.wolfssl.com/docs/utasker

Example lines for TaskConfig.h to enable either the wolfSSL client or server task.

```c
/*{ "x wolfSSL client", fnTLSClientTask, NO_QUE,(DELAY_LIMIT)(5 * SEC), (DELAY_LIMIT)(2 * SEC), UTASKER_STOP }, */
/* { "wolfSSL server", fnTLSServerTask, NO_QUE,(DELAY_LIMIT)(5 * SEC), (DELAY_LIMIT)(2 * SEC), UTASKER_STOP }, */
```
Tokens:
Raw